create-safest-tools 0.6.0 → 0.7.0

package/template/console/reports/controller.ts

@@ -1,13 +1,18 @@
-import { errorMessage, requestJson } from "../lib/http";
+import { clearPrivateDrafts, removePrivateDraft } from "./private-drafts";
+import { loadInbox } from "./load-inbox";
+import { priorityName } from "../lib/priority";
+import { ApiRequestError, errorMessage, requestJson } from "../lib/http";
+import { readable } from "../lib/format";
 import { getQueueWorkspaceSnapshot, subscribeToQueueWorkspace } from "../queues/store";
 import type { QueueRecord } from "../queues/types";
 import { getShellSnapshot, setShellSnapshot, subscribeToShell } from "../shell/store";
-import { reportEvents } from "./events";
+import { isReportSection, reportEvents } from "./events";
 import { getReportWorkspaceSnapshot, setReportWorkspaceSnapshot } from "./store";
 import type {
   HumanDecisionInput,
   PresenceAnalyst,
   ReportDetailRecord,
+  ReportSection,
   ReportFilters,
   ReporterMessageInput,
   ReportSummary,
@@ -17,6 +22,7 @@ import type {
 } from "./types";
 
 interface RawReport {
+  assignment?: RawReport["claim"];
   id: string;
   reference: string;
   targetType: string;
@@ -42,14 +48,14 @@ interface RawPresenceAnalyst {
   activeReportId?: string | null;
 }
 
-interface ReportsResponse { reports?: RawReport[] }
 interface ReportResponse { report: ReportDetailRecord }
 interface TimelineResponse { events?: ReportDetailRecord["timeline"] }
 interface WorkflowRunsResponse { runs?: WorkflowRunRecord[] }
 interface WorkflowActionsResponse { actions?: WorkflowActionRecord[] }
+interface FindingsResponse { findings?: ReportDetailRecord["findings"] }
 interface PresenceResponse { analysts?: RawPresenceAnalyst[] }
 
-const defaultFilters = (): ReportFilters => ({ search: "", queueId: "", priority: "", age: "", state: "", sort: "oldest" });
+const defaultFilters = (): ReportFilters => ({ search: "", queueId: "", priority: "", age: "", state: "needs_review", sort: "priority" });
 const initialSnapshot = (): ReportWorkspaceSnapshot => ({
   loading: true,
   refreshing: false,
@@ -61,7 +67,7 @@ const initialSnapshot = (): ReportWorkspaceSnapshot => ({
   reports: [],
   presence: [],
   actionCodes: [],
-  permissions: { claimReports: false, messageReporters: false, decideReports: false, readRuns: false },
+  permissions: { reassignReports: false, manageConfiguration: false, claimReports: false, messageReporters: false, decideReports: false, readRuns: false, readEvidence: false },
   detail: { reportId: null, loading: false, error: "", statusMessage: "", pendingAction: null, messageMutationVersion: 0, report: null },
 });
 
@@ -69,6 +75,7 @@ let actorId = "";
 let rawReports: RawReport[] = [];
 let rawPresence: RawPresenceAnalyst[] = [];
 let detailRequestVersion = 0;
+let listRequestVersion = 0;
 let presenceSessionId = crypto.randomUUID();
 let presenceSocket: WebSocket | null = null;
 let presenceReconnectTimer: ReturnType<typeof setTimeout> | null = null;
@@ -78,19 +85,12 @@ let realtimeRefreshTimer: ReturnType<typeof setTimeout> | null = null;
 let presenceReconnectAttempts = 0;
 let presenceRunning = false;
 let started = false;
-
-function readable(value: string): string {
-  const copy = value.replaceAll("_", " ");
-  if (!copy) return "";
-  const sentence = `${copy.charAt(0).toUpperCase()}${copy.slice(1)}`;
-  const acronyms: Record<string, string> = { ai: "AI", api: "API", csv: "CSV", d1: "D1", http: "HTTP", https: "HTTPS", id: "ID", json: "JSON", r2: "R2", sla: "SLA", url: "URL" };
-  return sentence.replace(/\b(ai|api|csv|d1|http|https|id|json|r2|sla|url)\b/giu, (match) => acronyms[match.toLowerCase()] ?? match);
-}
-
-function priorityName(priority: number): "high" | "medium" | "low" {
-  if (priority >= 70) return "high";
-  if (priority >= 40) return "medium";
-  return "low";
+const caseMutationKeys = new Map<string, { fingerprint: string; key: string }>();
+function caseMutationKey(kind: string, reportId: string, input: unknown): string {
+  const fingerprint = JSON.stringify([getShellSnapshot().session?.actor.id, reportId, input]);
+  const previous = caseMutationKeys.get(kind);
+  if (previous?.fingerprint === fingerprint) return previous.key;
+  const key = crypto.randomUUID(); caseMutationKeys.set(kind, { fingerprint, key }); return key;
 }
 
 function queues(): QueueRecord[] {
@@ -101,6 +101,10 @@ function visibleReports(filters: ReportFilters): RawReport[] {
   const query = filters.search.trim().toLowerCase();
   const now = Date.now();
   return rawReports.filter((report) => {
+    if (filters.state === "needs_review" && !["human_review", "human_review_requested"].includes(report.state)) return false;
+    const claimed = Boolean(report.assignment);
+    if (filters.ownership === "unassigned" && claimed) return false;
+    if (filters.ownership === "mine" && (!claimed || report.assignment?.reviewerId !== actorId)) return false;
     if (filters.priority && priorityName(report.priority) !== filters.priority) return false;
     const milliseconds = now - Date.parse(report.receivedAt);
     if (filters.age === "hour" && milliseconds > 3_600_000) return false;
@@ -130,12 +134,12 @@ function reportSummaries(filters: ReportFilters): ReportSummary[] {
     state: report.state,
     priority: Number(report.priority || 0),
     receivedAt: report.receivedAt,
-    owner: report.claim ? {
-      reviewerId: report.claim.reviewerId,
-      mine: report.claim.reviewerId === session?.actor.id,
-      displayName: report.claim.analyst?.displayName || "Unknown analyst",
-      avatarUrl: report.claim.analyst?.avatarUrl || null,
-      avatarColor: report.claim.analyst?.avatarColor || "#315d4d",
+    owner: report.assignment ? {
+      reviewerId: report.assignment.reviewerId,
+      mine: report.assignment.reviewerId === session?.actor.id,
+      displayName: report.assignment.analyst?.displayName || "Unknown analyst",
+      avatarUrl: report.assignment.analyst?.avatarUrl || null,
+      avatarColor: report.assignment.analyst?.avatarColor || "#315d4d",
     } : null,
   }));
 }
@@ -181,15 +185,19 @@ function publish(next?: Partial<ReportWorkspaceSnapshot>): void {
       ? configuration.allowed_action_codes
       : [],
     permissions: {
+      reassignReports: shell.session?.permissions.reassignReports === true,
+      manageConfiguration: shell.session?.permissions.manageConfiguration === true,
       claimReports: shell.session?.permissions.claimReports === true,
       messageReporters: shell.session?.permissions.messageReporters === true,
       decideReports: shell.session?.permissions.decideReports === true,
       readRuns: shell.session?.permissions.readRuns === true,
+      readEvidence: shell.session?.permissions.readEvidence === true,
     },
   });
 }
 
 async function loadReports(): Promise<void> {
+  const version = ++listRequestVersion;
   const session = getShellSnapshot().session;
   if (!session?.permissions.readReports) {
     rawReports = [];
@@ -201,29 +209,33 @@ async function loadReports(): Promise<void> {
   publish({ error: "", refreshing: !snapshot.loading });
   const params = new URLSearchParams({ limit: "100" });
   if (snapshot.filters.queueId) params.set("queue_id", snapshot.filters.queueId);
-  if (snapshot.filters.state) params.set("state", snapshot.filters.state);
+  if (snapshot.filters.state && snapshot.filters.state !== "needs_review") params.set("state", snapshot.filters.state);
   try {
-    const response = await requestJson<ReportsResponse>(`/v1/admin/reports?${params}`);
-    rawReports = response.reports || [];
+    const reports = await loadInbox<RawReport>(params);
+    if (version !== listRequestVersion) return;
+    rawReports = reports;
     setShellSnapshot((shell) => ({
       ...shell,
       reportCount: rawReports.filter((report) => !["resolved_by_human", "resolved_by_ai", "closed"].includes(report.state)).length,
     }));
   } catch (cause) {
-    publish({ error: errorMessage(cause, "Reports could not be loaded.") });
+    if (version === listRequestVersion) publish({ error: errorMessage(cause, "Reports could not be loaded.") });
   } finally {
-    publish({ loading: false, refreshing: false });
+    if (version === listRequestVersion) publish({ loading: false, refreshing: false });
   }
 }
 
-async function openReport(reportId: string): Promise<void> {
-  const version = ++detailRequestVersion;
+async function openReport(reportId: string, review = false, destination?: { section: ReportSection; taskId?: string }): Promise<void> {
   const snapshot = getReportWorkspaceSnapshot();
+  if (snapshot.detail.reportId && snapshot.detail.reportId !== reportId && !window.dispatchEvent(new Event(reportEvents.beforeClose, { cancelable: true }))) return;
+  const version = ++detailRequestVersion;
   document.body.classList.add("report-open");
   publish({
     detail: {
       ...snapshot.detail,
       reportId,
+      reviewRequest: review ? (snapshot.detail.reviewRequest || 0) + 1 : snapshot.detail.reportId === reportId ? snapshot.detail.reviewRequest : 0,
+      destination: destination ? { ...destination, request: version } : snapshot.detail.reportId === reportId ? snapshot.detail.destination : undefined,
       loading: true,
       error: "",
       statusMessage: snapshot.detail.reportId === reportId ? snapshot.detail.statusMessage : "",
@@ -233,11 +245,17 @@ async function openReport(reportId: string): Promise<void> {
   try {
     const encodedId = encodeURIComponent(reportId);
     const canReadRuns = getShellSnapshot().session?.permissions.readRuns === true;
-    const [reportResponse, timelineResponse, runsResponse, actionsResponse] = await Promise.all([
-      requestJson<ReportResponse>(`/v1/admin/reports/${encodedId}`),
-      requestJson<TimelineResponse>(`/v1/admin/reports/${encodedId}/timeline?limit=50`).catch(() => ({ events: [] })),
-      canReadRuns ? requestJson<WorkflowRunsResponse>(`/v1/admin/reports/${encodedId}/workflow-runs`).catch(() => ({ runs: [] })) : Promise.resolve({ runs: [] }),
-      requestJson<WorkflowActionsResponse>(`/v1/admin/reports/${encodedId}/actions`).catch(() => ({ actions: [] })),
+    const canReadEvidence = getShellSnapshot().session?.permissions.readEvidence === true;
+    const prior = snapshot.detail.report?.id === reportId ? snapshot.detail.report : null;
+    const partialLoadErrors: string[] = [];
+    const unavailable = <T>(label: string, fallback: T) => () => { partialLoadErrors.push(label); return fallback; };
+    const readOptions = () => ({ signal: AbortSignal.timeout(15_000) });
+    const [reportResponse, timelineResponse, runsResponse, actionsResponse, findingsResponse] = await Promise.all([
+      requestJson<ReportResponse>(`/v1/admin/reports/${encodedId}`, readOptions()),
+      requestJson<TimelineResponse>(`/v1/admin/reports/${encodedId}/timeline?limit=50`, readOptions()).catch(unavailable("activity", { events: prior?.timeline || [] })),
+      canReadRuns ? requestJson<WorkflowRunsResponse>(`/v1/admin/reports/${encodedId}/workflow-runs`, readOptions()).catch(unavailable("playbook progress", { runs: prior?.workflowRuns || [] })) : Promise.resolve({ runs: [] }),
+      requestJson<WorkflowActionsResponse>(`/v1/admin/reports/${encodedId}/actions`, readOptions()).catch(unavailable("customer action states", { actions: prior?.workflowActions || [] })),
+      canReadEvidence ? requestJson<FindingsResponse>(`/v1/admin/reports/${encodedId}/findings`, readOptions()).catch(unavailable("retrieved evidence", { findings: prior?.findings || [] })) : Promise.resolve({ findings: [] }),
     ]);
     if (version !== detailRequestVersion || getReportWorkspaceSnapshot().detail.reportId !== reportId) return;
     publish({
@@ -245,16 +263,18 @@ async function openReport(reportId: string): Promise<void> {
         ...getReportWorkspaceSnapshot().detail,
         report: {
           ...reportResponse.report,
+          partialLoadErrors: partialLoadErrors.sort(),
           timeline: timelineResponse.events || [],
           workflowRuns: runsResponse.runs || [],
           workflowActions: actionsResponse.actions || [],
+          findings: findingsResponse.findings || [],
         },
       },
     });
     sendPresenceActivity();
   } catch (cause) {
     if (version !== detailRequestVersion || getReportWorkspaceSnapshot().detail.reportId !== reportId) return;
-    publish({ detail: { ...getReportWorkspaceSnapshot().detail, report: null, error: errorMessage(cause, "The report could not be opened.") } });
+    publish({ detail: { ...getReportWorkspaceSnapshot().detail, ...(cause instanceof ApiRequestError && [401, 403, 404].includes(cause.status) ? { report: null } : {}), error: errorMessage(cause, "The case could not refresh. Use Refresh case to retry.") } });
   } finally {
     if (version === detailRequestVersion && getReportWorkspaceSnapshot().detail.reportId === reportId) {
       publish({ detail: { ...getReportWorkspaceSnapshot().detail, loading: false } });
@@ -262,7 +282,8 @@ async function openReport(reportId: string): Promise<void> {
   }
 }
 
-function closeReport(): void {
+function closeReport(committed = false): void {
+  if (!committed && !window.dispatchEvent(new Event(reportEvents.beforeClose, { cancelable: true }))) return;
   detailRequestVersion += 1;
   const messageMutationVersion = getReportWorkspaceSnapshot().detail.messageMutationVersion;
   document.body.classList.remove("report-open");
@@ -276,25 +297,39 @@ async function claimReport(): Promise<void> {
   if (!reportId || !snapshot.permissions.claimReports || snapshot.detail.pendingAction) return;
   publish({ detail: { ...snapshot.detail, error: "", pendingAction: "claim" } });
   try {
-    await requestJson(`/v1/admin/reports/${encodeURIComponent(reportId)}/claim`, { method: "POST" });
-    await Promise.all([openReport(reportId), loadReports()]);
+    const result = await requestJson<{ claim: NonNullable<ReportDetailRecord["claim"]> }>(`/v1/admin/reports/${encodeURIComponent(reportId)}/claim`, { method: "POST" });
+    const detail = getReportWorkspaceSnapshot().detail;
+    const analyst = { displayName: getShellSnapshot().session?.displayName || "You" };
+    const claim = { ...result.claim, analyst };
+    publish({ detail: { ...detail, report: detail.report ? { ...detail.report, claim, assignment: claim } : null,
+      reviewRequest: (detail.reviewRequest || 0) + 1, statusMessage: "" } });
+    void Promise.all([openReport(reportId), loadReports()]);
   } catch (cause) {
-    publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "The report could not be claimed.") } });
+    await openReport(reportId);
+    publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "Review could not be started. Your private draft is unchanged.") } });
+
   } finally {
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, pendingAction: null } });
   }
 }
 
-async function releaseReport(): Promise<void> {
+export async function changeCaseOwner(input: { reviewerId: string | null; displayName?: string; version: number; note: string }): Promise<boolean> {
   const snapshot = getReportWorkspaceSnapshot();
   const reportId = snapshot.detail.report?.id;
-  if (!reportId || !snapshot.permissions.claimReports || snapshot.detail.pendingAction) return;
-  publish({ detail: { ...snapshot.detail, error: "", pendingAction: "release" } });
+  if (!reportId || !snapshot.permissions.reassignReports || snapshot.detail.pendingAction) return false;
+  publish({ detail: { ...snapshot.detail, error: "", statusMessage: "", pendingAction: input.reviewerId ? "transfer" : "release" } });
   try {
-    await requestJson(`/v1/admin/reports/${encodeURIComponent(reportId)}/claim`, { method: "DELETE" });
-    await Promise.all([openReport(reportId), loadReports()]);
+    await requestJson(`/v1/admin/reports/${encodeURIComponent(reportId)}/ownership`, { method: "PATCH", headers: { "content-type": "application/json" }, body: JSON.stringify({ reviewer_id: input.reviewerId, version: input.version, note: input.note }) });
+    const detail = getReportWorkspaceSnapshot().detail;
+    const assignment = input.reviewerId ? { reviewerId: input.reviewerId, version: input.version + 1, expiresAt: "1970-01-01T00:00:00.000Z", analyst: { displayName: input.displayName || "Assigned reviewer" } } : null;
+    publish({ detail: { ...detail, report: detail.report ? { ...detail.report, assignment, claim: null } : null,
+      statusMessage: `${input.reviewerId ? "Case transferred" : "Case returned to the queue"}. Handoff note shared; your drafts remain private.` } });
+    void Promise.all([openReport(reportId), loadReports()]);
+    return true;
   } catch (cause) {
-    publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "The claim could not be released.") } });
+    await openReport(reportId);
+    publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "Ownership could not be changed. Your note and private draft are unchanged.") } });
+    return false;
   } finally {
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, pendingAction: null } });
   }
@@ -304,7 +339,7 @@ async function sendMessage(input: ReporterMessageInput): Promise<void> {
   const snapshot = getReportWorkspaceSnapshot();
   const reportId = snapshot.detail.report?.id;
   if (!reportId || !snapshot.permissions.messageReporters || snapshot.detail.pendingAction) return;
-  const idempotencyKey = crypto.randomUUID();
+  const idempotencyKey = caseMutationKey("message", reportId, input);
   publish({ detail: { ...snapshot.detail, error: "", statusMessage: "", pendingAction: "message" } });
   try {
     const response = await requestJson<{ delivery_state?: string; delivery_channel?: string | null }>(`/v1/admin/reports/${encodeURIComponent(reportId)}/messages`, {
@@ -312,6 +347,7 @@ async function sendMessage(input: ReporterMessageInput): Promise<void> {
       headers: { "content-type": "application/json", "idempotency-key": idempotencyKey },
       body: JSON.stringify({ idempotency_key: idempotencyKey, body: input.body, await_reporter: input.awaitReporter }),
     });
+    caseMutationKeys.delete("message");
     const version = getReportWorkspaceSnapshot().detail.messageMutationVersion + 1;
     const statusMessage = response.delivery_state === "queued"
       ? response.delivery_channel === "email"
@@ -319,7 +355,8 @@ async function sendMessage(input: ReporterMessageInput): Promise<void> {
         : "Participant update queued for the configured customer notification channel."
       : "The update was saved but not sent because this report has no available participant delivery channel.";
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, messageMutationVersion: version, statusMessage } });
-    await Promise.all([openReport(reportId), loadReports()]);
+    // The mutation is acknowledged. Background refresh must not keep unrelated actions locked.
+    void Promise.all([openReport(reportId), loadReports()]);
   } catch (cause) {
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "The message could not be created.") } });
   } finally {
@@ -331,7 +368,7 @@ async function recordDecision(input: HumanDecisionInput): Promise<void> {
   const snapshot = getReportWorkspaceSnapshot();
   const reportId = snapshot.detail.report?.id;
   if (!reportId || !snapshot.permissions.decideReports || snapshot.detail.pendingAction) return;
-  const idempotencyKey = crypto.randomUUID();
+  const idempotencyKey = caseMutationKey("decision", reportId, input);
   publish({ detail: { ...snapshot.detail, error: "", pendingAction: "decision" } });
   try {
     await requestJson(`/v1/admin/reports/${encodeURIComponent(reportId)}/decisions`, {
@@ -348,8 +385,10 @@ async function recordDecision(input: HumanDecisionInput): Promise<void> {
         ...(input.actionCode ? { action_code: input.actionCode } : {}),
       }),
     });
-    closeReport();
-    await loadReports();
+    caseMutationKeys.delete("decision");
+    removePrivateDraft(getShellSnapshot().session?.actor.id || "", reportId);
+    closeReport(true);
+    void loadReports();
   } catch (cause) {
     publish({ detail: { ...getReportWorkspaceSnapshot().detail, error: errorMessage(cause, "The decision could not be recorded.") } });
   } finally {
@@ -382,6 +421,17 @@ async function heartbeatPresence(): Promise<void> {
   }
 }
 
+async function reconcilePresence(): Promise<void> {
+  if (!getShellSnapshot().session || document.visibilityState === "hidden") return;
+  try {
+    const response = await requestJson<PresenceResponse>("/v1/admin/presence");
+    rawPresence = response.analysts || [];
+    publish();
+  } catch {
+    // Presence is advisory. Keep the last known snapshot until the stream recovers.
+  }
+}
+
 function scheduleRealtimeRefresh(reportId?: string | null, immediate = false): void {
   if (!getShellSnapshot().session || document.visibilityState === "hidden") return;
   if (realtimeRefreshTimer) clearTimeout(realtimeRefreshTimer);
@@ -484,7 +534,10 @@ async function startPresence(): Promise<void> {
       void heartbeatPresence();
     }
   }, 15_000);
-  reconciliationTimer = setInterval(() => scheduleRealtimeRefresh(), 30_000);
+  reconciliationTimer = setInterval(() => {
+    scheduleRealtimeRefresh();
+    void reconcilePresence();
+  }, 30_000);
   openPresenceSocket();
 }
 
@@ -493,9 +546,10 @@ function validFilters(value: unknown): value is ReportFilters {
   const filters = value as Partial<ReportFilters>;
   return typeof filters.search === "string"
     && typeof filters.queueId === "string"
-    && ["", "high", "medium", "low"].includes(filters.priority ?? "invalid")
+    && ["", "urgent", "high", "medium", "low"].includes(filters.priority ?? "invalid")
     && ["", "hour", "day", "older"].includes(filters.age ?? "invalid")
     && typeof filters.state === "string"
+    && [undefined, "", "unassigned", "mine"].includes(filters.ownership)
     && ["oldest", "newest", "priority"].includes(filters.sort ?? "invalid");
 }
 
@@ -509,6 +563,7 @@ export function startReportController(): void {
       publish();
       return;
     }
+    if (actorId && actorId !== nextActorId) clearPrivateDrafts();
     actorId = nextActorId;
     detailRequestVersion += 1;
     stopPresence();
@@ -523,9 +578,14 @@ export function startReportController(): void {
   });
   subscribeToQueueWorkspace(() => publish());
   window.addEventListener(reportEvents.open, (event) => {
-    if (event instanceof CustomEvent && typeof event.detail?.reportId === "string") void openReport(event.detail.reportId);
+    if (!(event instanceof CustomEvent) || typeof event.detail?.reportId !== "string") return;
+    const destination = isReportSection(event.detail.section) ? {
+      section: event.detail.section,
+      ...(typeof event.detail.taskId === "string" && event.detail.taskId.length <= 100 ? { taskId: event.detail.taskId } : {}),
+    } : undefined;
+    void openReport(event.detail.reportId, event.detail.review === true, destination);
   });
-  window.addEventListener(reportEvents.close, closeReport);
+  window.addEventListener(reportEvents.close, () => closeReport());
   window.addEventListener(reportEvents.refresh, () => { void loadReports(); });
   window.addEventListener(reportEvents.filters, (event) => {
     if (!(event instanceof CustomEvent) || !validFilters(event.detail?.filters)) return;
@@ -535,7 +595,6 @@ export function startReportController(): void {
     if (filters.queueId !== previous.queueId || filters.state !== previous.state) void loadReports();
   });
   window.addEventListener(reportEvents.claim, () => { void claimReport(); });
-  window.addEventListener(reportEvents.release, () => { void releaseReport(); });
   window.addEventListener(reportEvents.message, (event) => {
     if (!(event instanceof CustomEvent) || typeof event.detail?.body !== "string" || typeof event.detail?.awaitReporter !== "boolean") return;
     void sendMessage(event.detail as ReporterMessageInput);
@@ -545,10 +604,16 @@ export function startReportController(): void {
     void recordDecision(event.detail as HumanDecisionInput);
   });
   window.addEventListener("keydown", (event) => {
-    if (event.key === "Escape" && getReportWorkspaceSnapshot().detail.reportId) closeReport();
+    if (event.key === "Escape" && !event.defaultPrevented && !document.querySelector(".case-handoff-dialog[open]") && getReportWorkspaceSnapshot().detail.reportId) closeReport();
+  });
+  window.addEventListener("focus", () => {
+    scheduleRealtimeRefresh(null, true);
+    void reconcilePresence();
   });
-  window.addEventListener("focus", () => scheduleRealtimeRefresh(null, true));
   document.addEventListener("visibilitychange", () => {
-    if (document.visibilityState === "visible") scheduleRealtimeRefresh(null, true);
+    if (document.visibilityState === "visible") {
+      scheduleRealtimeRefresh(null, true);
+      void reconcilePresence();
+    }
   });
 }

package/template/console/reports/events.ts

@@ -1,4 +1,4 @@
-import type { HumanDecisionInput, ReportFilters, ReporterMessageInput, ReportWorkspaceSnapshot } from "./types";
+import type { HumanDecisionInput, ReportFilters, ReporterMessageInput, ReportWorkspaceSnapshot, ReportSection } from "./types";
 
 export const reportEvents = {
   state: "safest:reports:state",
@@ -6,6 +6,7 @@ export const reportEvents = {
   filters: "safest:reports:filters",
   open: "safest:reports:open",
   close: "safest:reports:close",
+  beforeClose: "safest:reports:before-close",
   claim: "safest:reports:claim",
   release: "safest:reports:release",
   message: "safest:reports:message",
@@ -18,7 +19,13 @@ function dispatch<TDetail>(type: string, detail?: TDetail): void {
 
 export function dispatchReportRefresh(): void { dispatch(reportEvents.refresh); }
 export function dispatchReportFilters(filters: ReportFilters): void { dispatch(reportEvents.filters, { filters }); }
-export function dispatchOpenReport(reportId: string): void { dispatch(reportEvents.open, { reportId }); }
+export function dispatchOpenReport(reportId: string, review = false): void { dispatch(reportEvents.open, { reportId, review }); }
+export function dispatchOpenReportSection(reportId: string, section: ReportSection, taskId?: string): void {
+  dispatch(reportEvents.open, { reportId, section, taskId });
+}
+export function isReportSection(value: unknown): value is ReportSection {
+  return typeof value === "string" && ["overview", "evidence", "review", "messages", "outcome", "activity"].includes(value);
+}
 export function dispatchCloseReport(): void { dispatch(reportEvents.close); }
 export function dispatchClaimReport(): void { dispatch(reportEvents.claim); }
 export function dispatchReleaseReport(): void { dispatch(reportEvents.release); }

package/template/console/reports/load-inbox.ts

@@ -0,0 +1,17 @@
+import { requestJson } from "../lib/http";
+
+// The API returns at most 100 reports. Follow its opaque cursor so search,
+// sorting, and summary counts include the entire authorized result set.
+export async function loadInbox<T>(query = new URLSearchParams()): Promise<T[]> {
+  const params = new URLSearchParams(query);
+  params.set("limit", "100");
+  const reports: T[] = [];
+  let cursor: string | null = null;
+  do {
+    if (cursor) params.set("cursor", cursor);
+    const page = await requestJson<{ reports?: T[]; next_cursor?: string | null }>(`/v1/admin/reports?${params}`);
+    reports.push(...(page.reports || []));
+    cursor = page.next_cursor || null;
+  } while (cursor);
+  return reports;
+}

package/template/console/reports/presence-presentation.ts

@@ -0,0 +1,52 @@
+export interface PresencePresentationAnalyst {
+  actorId: string;
+  displayName: string;
+  activity: string;
+  activeReportId: string | null;
+}
+
+const activityPriority: Record<string, number> = {
+  editing: 0,
+  viewing: 1,
+  online: 2,
+  away: 3,
+};
+
+export function orderedPresence<TAnalyst extends PresencePresentationAnalyst>(analysts: TAnalyst[]): TAnalyst[] {
+  return [...analysts].sort((left, right) => {
+    const activityDifference = (activityPriority[left.activity] ?? 4) - (activityPriority[right.activity] ?? 4);
+    return activityDifference || left.displayName.localeCompare(right.displayName) || left.actorId.localeCompare(right.actorId);
+  });
+}
+
+export function presenceSummaryLabel(analysts: PresencePresentationAnalyst[]): string {
+  if (!analysts.length) return "No reviewers online";
+  if (analysts.length === 1) {
+    const firstName = analysts[0]?.displayName.trim().split(/\s+/u)[0];
+    return `${firstName || "1 reviewer"} is online`;
+  }
+  return `${analysts.length} reviewers online`;
+}
+
+export function partitionPresence<TAnalyst extends PresencePresentationAnalyst>(analysts: TAnalyst[]): { reviewing: TAnalyst[]; elsewhere: TAnalyst[] } {
+  return analysts.reduce<{ reviewing: TAnalyst[]; elsewhere: TAnalyst[] }>((groups, analyst) => {
+    groups[analyst.activeReportId ? "reviewing" : "elsewhere"].push(analyst);
+    return groups;
+  }, { reviewing: [], elsewhere: [] });
+}
+
+export function otherReviewersOnReport<TAnalyst extends PresencePresentationAnalyst>(analysts: TAnalyst[], reportId: string, actorId: string): TAnalyst[] {
+  return orderedPresence(analysts.filter((analyst) => analyst.activeReportId === reportId && analyst.actorId !== actorId));
+}
+
+export function reviewersOnReport<TAnalyst extends PresencePresentationAnalyst>(analysts: TAnalyst[], reportId: string): TAnalyst[] {
+  return orderedPresence(analysts.filter((analyst) => analyst.activeReportId === reportId));
+}
+
+export function reportPresenceLabel(analysts: PresencePresentationAnalyst[]): string {
+  if (analysts.length === 1) {
+    const analyst = analysts[0];
+    return `${analyst.displayName} is ${analyst.activity === "editing" ? "editing" : "viewing"} this report`;
+  }
+  return `${analysts.length} other reviewers are on this report`;
+}

package/template/console/reports/private-drafts.ts

@@ -0,0 +1,32 @@
+const prefix = "safest:private-case-draft:";
+export interface PrivateCaseDraft {
+  message: string; awaitReporter: boolean; decisionCode: string; policyCode: string;
+  rationale: string; reporterNotice: string; affectedNotice: string; actionCode: string; evidence: string[];
+  taskDecision?: string; findings?: string[];
+}
+const memory = new Map<string, PrivateCaseDraft>();
+const key = (actorId: string, reportId: string) => `${prefix}${encodeURIComponent(actorId)}:${encodeURIComponent(reportId)}`;
+export function readPrivateDraft(actorId: string, reportId: string): PrivateCaseDraft | null {
+  const id = key(actorId, reportId);
+  if (memory.has(id)) return memory.get(id)!;
+  try {
+    const stored = JSON.parse(sessionStorage.getItem(id) || "null");
+    if (stored && Date.now() - stored.savedAt < 86_400_000 && typeof stored.draft?.message === "string" && Array.isArray(stored.draft.evidence)) return stored.draft;
+    sessionStorage.removeItem(id);
+  } catch { /* A browser can deny storage; in-memory drafts still work. */ }
+  return null;
+}
+export function savePrivateDraft(actorId: string, reportId: string, draft: PrivateCaseDraft): void {
+  const id = key(actorId, reportId);
+  if (![draft.message,draft.rationale,draft.reporterNotice,draft.affectedNotice,draft.actionCode,draft.taskDecision].some(Boolean)) { removePrivateDraft(actorId,reportId); return; }
+  memory.set(id,draft);
+  try { sessionStorage.setItem(id,JSON.stringify({ savedAt:Date.now(),draft })); } catch { /* Keep the in-memory copy. */ }
+}
+export function removePrivateDraft(actorId: string, reportId: string): void {
+  const id = key(actorId,reportId); memory.delete(id);
+  try { sessionStorage.removeItem(id); } catch { /* Storage may be unavailable. */ }
+}
+export function clearPrivateDrafts(): void {
+  memory.clear();
+  try { Object.keys(sessionStorage).filter(id => id.startsWith(prefix)).forEach(id => sessionStorage.removeItem(id)); } catch { /* Storage may be unavailable. */ }
+}

package/template/console/reports/store.ts

@@ -9,12 +9,12 @@ let snapshot: ReportWorkspaceSnapshot = {
   error: "",
   generatedAt: new Date().toISOString(),
   actorId: "",
-  filters: { search: "", queueId: "", priority: "", age: "", state: "", sort: "oldest" },
+  filters: { search: "", queueId: "", priority: "", age: "", state: "needs_review", sort: "priority" },
   queues: [],
   reports: [],
   presence: [],
   actionCodes: [],
-  permissions: { claimReports: false, messageReporters: false, decideReports: false, readRuns: false },
+  permissions: { reassignReports: false, manageConfiguration: false, claimReports: false, messageReporters: false, decideReports: false, readRuns: false, readEvidence: false },
   detail: { reportId: null, loading: false, error: "", statusMessage: "", pendingAction: null, messageMutationVersion: 0, report: null },
 };