fix(ui): save unmaterialized inbox policy

Co-Authored-By: Paperclip <noreply@paperclip.ing>

ui/src/components/InboxAgentPolicyControl.test.tsx

@@ -51,7 +51,7 @@ function policy(overrides: Partial<InboxAgentPolicy> = {}): InboxAgentPolicy {
     userId: "user-1",
     mode: "open",
     allowedAgentIds: [],
-    materialized: false,
+    materialized: true,
     createdAt: null,
     updatedAt: null,
     ...overrides,
@@ -127,6 +127,40 @@ describe("InboxAgentPolicyControl", () => {
     act(() => root.unmount());
   });
 
+  it("enables saving an unmaterialized open policy and marks it unsaved until persistence", async () => {
+    mockInboxAgentPolicyApi.getMine.mockResolvedValue(policy({ materialized: false }));
+    const root = render(container);
+    await flush();
+
+    await waitForAssertion(() => {
+      expect(container.textContent).toContain("Not saved yet. Agents cannot manage your inbox until you save.");
+      const save = Array.from(container.querySelectorAll("button")).find((button) =>
+        button.textContent?.includes("Save"),
+      );
+      expect(save?.disabled).toBe(false);
+    });
+
+    const saveButton = Array.from(container.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Save"),
+    );
+    expect(saveButton).toBeTruthy();
+    await act(async () => saveButton!.click());
+    await flush();
+
+    expect(mockInboxAgentPolicyApi.updateMine).toHaveBeenCalledWith("company-1", {
+      mode: "open",
+      allowedAgentIds: [],
+    });
+
+    await waitForAssertion(() => {
+      expect(container.textContent).not.toContain("Not saved yet");
+      expect(container.textContent).toContain("Saved");
+      expect(saveButton!.disabled).toBe(true);
+    });
+
+    act(() => root.unmount());
+  });
+
   it("round-trips an allowlist selection through the PUT endpoint", async () => {
     const root = render(container);
     await flush();

ui/src/components/InboxAgentPolicyControl.tsx

@@ -94,7 +94,10 @@ export function InboxAgentPolicyControl({ companyId }: { companyId: string | nul
   });
 
   const isDirty = Boolean(
-    draft && policy && policyKey(draft.mode, draft.allowedAgentIds) !== policyKey(policy.mode, policy.allowedAgentIds),
+    draft &&
+      policy &&
+      (!policy.materialized ||
+        policyKey(draft.mode, draft.allowedAgentIds) !== policyKey(policy.mode, policy.allowedAgentIds)),
   );
 
   if (policyQuery.error) {
@@ -140,6 +143,12 @@ export function InboxAgentPolicyControl({ companyId }: { companyId: string | nul
         className="max-w-2xl"
       />
 
+      {!policy.materialized ? (
+        <p className="max-w-2xl text-sm text-muted-foreground" role="status">
+          Not saved yet. Agents cannot manage your inbox until you save.
+        </p>
+      ) : null}
+
       {draft.mode === "allowlist" ? (
         <div className="max-w-2xl space-y-2 rounded-md border border-border p-3">
           <div className="text-sm font-medium">Agents allowed to tidy my inbox</div>