Files
FabledScribe/frontend/src/views/SnippetDetailView.vue
T
bvandeusen 04b58ce01e
CI & Build / Python lint (push) Successful in 3s
CI & Build / TypeScript typecheck (push) Successful in 28s
CI & Build / integration (push) Successful in 35s
CI & Build / Python tests (push) Failing after 41s
CI & Build / Build & push image (push) Has been skipped
feat(acl): shared records are search-only and always labelled as someone else's
Narrows the b7d6fc7 widening per the operator's call, and fixes a regression it
introduced. Decision recorded as note 2094.

Two scopes now, deliberately different:

  readable_notes_clause  — everything the ACL permits, including records reached
                           only via a direct/group note share. For EXPLICIT acts:
                           a search the caller typed, a fetch by id.
  browsable_notes_clause — the caller's own records plus anything in a project
                           they can reach. For PASSIVE surfaces: browse lists,
                           facet counts, the process->skill manifest.

The split is a trust boundary. Anything appearing unasked — in your own list,
your own counts, or as a skill installed on your machine — reads as material you
endorsed. A one-off someone shared with you hasn't earned that standing, so it
waits until you go looking. This also dissolves the shared-Process problem by
construction rather than by special case: the manifest is a passive surface, so a
directly-shared Process is never installed as an auto-surfacing skill.

Regression fix (#2093): b7d6fc7 widened the list queries but left the fetch path
owner-only, so on the MCP path a record could be listed and then not opened —
get_snippet raised not-found, get_process couldn't resolve, and the manifest
emitted stubs whose get_process call would fail. snippets.get_snippet and
notes.resolve_process now resolve the read scope. delete_snippet gained an
explicit can_write_note guard, since being able to SEE a shared snippet must not
imply being able to bin it.

Provenance, so nothing arrives looking like the operator's own work:
- access.describe_provenance / label_shared_items add shared/owner/permission;
  labelling costs no query when everything is the caller's own.
- MCP: get_snippet, list_snippets, get_process and list_processes carry it, and
  get_process now says outright NOT to follow a shared process verbatim — its
  follow-as-written contract was the sharpest instance of the problem.
- The skill stub for a shared Process names its author and asks for a go-ahead,
  instead of describing it as "the operator's saved Scribe process".
- Policy stated once in the MCP _INSTRUCTIONS and the reusing-code skill: a
  shared record is that person's suggestion, weigh it, attribute it, ask before
  adopting it.
- UI: shared snippets show "by <owner>" in the list and a notice above the code
  in the detail view, reusing SharedWithMeView's vocabulary.

Plugin 0.1.15 -> 0.1.16 (skill text changed).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RLwAaV4DQEmVyn496HnEvt
2026-07-25 22:43:00 -04:00

343 lines
8.4 KiB
Vue

<script setup lang="ts">
import { ref, computed, onMounted } from "vue";
import { useRoute, useRouter } from "vue-router";
import { getSnippet, deleteSnippet, type Snippet } from "@/api/snippets";
import { useToastStore } from "@/stores/toast";
import ConfirmDialog from "@/components/ConfirmDialog.vue";
const route = useRoute();
const router = useRouter();
const toast = useToastStore();
const snippet = ref<Snippet | null>(null);
const loading = ref(false);
const error = ref<string | null>(null);
const showDeleteConfirm = ref(false);
const id = computed(() => Number(route.params.id));
const canWrite = computed(() => {
const p = snippet.value?.permission;
return p === undefined || p === "owner" || p === "edit" || p === "admin";
});
const locations = computed(() => snippet.value?.snippet.locations ?? []);
function locParts(loc: { repo: string; path: string; symbol: string }): string[] {
return [loc.repo, loc.path, loc.symbol].filter((p) => p && p.trim());
}
async function load() {
loading.value = true;
error.value = null;
try {
snippet.value = await getSnippet(id.value);
} catch (e: unknown) {
const status = (e as { status?: number }).status;
error.value = status === 404
? "This snippet couldn't be found."
: "Couldn't load this snippet.";
} finally {
loading.value = false;
}
}
onMounted(load);
async function copyCode() {
const code = snippet.value?.snippet.code ?? "";
try {
await navigator.clipboard.writeText(code);
toast.show("Code copied");
} catch {
toast.show("Couldn't copy — select and copy manually", "error");
}
}
async function confirmDelete() {
try {
await deleteSnippet(id.value);
toast.show("Snippet deleted");
router.push("/snippets");
} catch {
toast.show("Failed to delete snippet", "error");
} finally {
showDeleteConfirm.value = false;
}
}
</script>
<template>
<main class="snippet-detail">
<router-link to="/snippets" class="back-link"> Snippets</router-link>
<div v-if="loading" class="state-msg">Fetching the snippet</div>
<p v-else-if="error" class="error-msg">{{ error }}</p>
<template v-else-if="snippet">
<div class="detail-header">
<h1 class="snippet-name">{{ snippet.snippet.name }}</h1>
<div class="header-actions" v-if="canWrite">
<button class="btn-ghost" @click="router.push(`/snippets/${id}/edit`)">Edit</button>
<button class="btn-danger" @click="showDeleteConfirm = true">Delete</button>
</div>
</div>
<p v-if="snippet.shared" class="shared-notice">
Shared by <strong>{{ snippet.owner ?? "another user" }}</strong> their
suggestion, not one of your own records. Worth weighing on its merits
before you build on it.
</p>
<p v-if="snippet.snippet.when_to_use" class="when-to-use">
{{ snippet.snippet.when_to_use }}
</p>
<dl class="meta-grid">
<template v-if="snippet.snippet.signature">
<dt>Signature</dt>
<dd><code>{{ snippet.snippet.signature }}</code></dd>
</template>
<template v-if="locations.length">
<dt>{{ locations.length > 1 ? "Locations" : "Location" }}</dt>
<dd class="location-list">
<div v-for="(loc, i) in locations" :key="i" class="location">
<code v-for="(p, j) in locParts(loc)" :key="j">{{ p }}</code>
</div>
</dd>
</template>
<template v-if="snippet.snippet.language">
<dt>Language</dt>
<dd>{{ snippet.snippet.language }}</dd>
</template>
</dl>
<div class="code-block">
<div class="code-bar">
<span class="code-lang">{{ snippet.snippet.language || "code" }}</span>
<button class="btn-ghost btn-copy" @click="copyCode">Copy</button>
</div>
<pre><code>{{ snippet.snippet.code }}</code></pre>
</div>
<div v-if="snippet.tags.length" class="tag-row">
<span v-for="t in snippet.tags" :key="t" class="tag-pill">{{ t }}</span>
</div>
</template>
<ConfirmDialog
v-if="showDeleteConfirm"
title="Delete snippet"
:message="`Delete “${snippet?.snippet.name}”? This can be restored from the trash.`"
confirmLabel="Delete"
danger
@confirm="confirmDelete"
@cancel="showDeleteConfirm = false"
/>
</main>
</template>
<style scoped>
.snippet-detail {
max-width: 820px;
margin: 2rem auto;
padding: 0 var(--page-padding-x);
overflow-x: clip;
}
.back-link {
display: inline-block;
margin-bottom: 1rem;
font-size: 0.85rem;
color: var(--color-text-secondary);
text-decoration: none;
}
.back-link:hover {
color: var(--color-primary);
}
.state-msg {
color: var(--color-text-muted);
font-size: 0.9rem;
margin-top: 1rem;
}
.error-msg {
color: var(--color-danger);
font-size: 0.9rem;
margin-top: 1rem;
}
.detail-header {
display: flex;
align-items: flex-start;
justify-content: space-between;
gap: 1rem;
}
.snippet-name {
margin: 0;
font-family: var(--font-mono, ui-monospace, "JetBrains Mono", monospace);
font-size: 1.4rem;
word-break: break-word;
}
.header-actions {
display: flex;
gap: 0.5rem;
flex-shrink: 0;
}
.btn-ghost {
padding: 0.35rem 0.8rem;
border: 1px solid var(--color-border);
background: transparent;
color: var(--color-text);
border-radius: var(--radius-sm);
cursor: pointer;
font-size: 0.85rem;
font-family: inherit;
transition: border-color 0.15s, color 0.15s;
}
.btn-ghost:hover {
border-color: var(--color-primary);
color: var(--color-primary);
}
.btn-danger {
padding: 0.35rem 0.8rem;
border: none;
background: var(--color-action-destructive, #6B2118);
color: #fff;
border-radius: var(--radius-sm);
cursor: pointer;
font-size: 0.85rem;
font-family: inherit;
}
.btn-danger:hover {
opacity: 0.9;
}
.when-to-use {
margin: 0.75rem 0 1.25rem;
font-size: 1rem;
color: var(--color-text-secondary);
line-height: 1.55;
}
/* Shown only for a record another user owns. Deliberately above the code: the
provenance has to be read before the implementation is trusted. */
.shared-notice {
margin: 0.75rem 0 0;
padding: 0.6rem 0.85rem;
border-left: 3px solid var(--color-text-muted);
border-radius: 6px;
background: var(--color-bg-secondary);
font-size: 0.85rem;
line-height: 1.5;
color: var(--color-text-secondary);
}
.meta-grid {
display: grid;
grid-template-columns: max-content 1fr;
gap: 0.4rem 1rem;
margin: 0 0 1.5rem;
}
.meta-grid dt {
font-size: 0.7rem;
text-transform: uppercase;
letter-spacing: 0.06em;
color: var(--color-text-muted);
padding-top: 0.15rem;
}
.meta-grid dd {
margin: 0;
font-size: 0.9rem;
color: var(--color-text);
min-width: 0;
}
.meta-grid code,
.tag-row + * code {
font-family: var(--font-mono, ui-monospace, "JetBrains Mono", monospace);
font-size: 0.82rem;
background: color-mix(in srgb, var(--color-primary) 12%, transparent);
color: var(--color-primary);
padding: 0.08rem 0.35rem;
border-radius: var(--radius-sm);
word-break: break-all;
}
.location-list {
display: flex;
flex-direction: column;
gap: 0.35rem;
}
.location {
display: flex;
flex-wrap: wrap;
gap: 0.35rem;
align-items: center;
}
.code-block {
border: 1px solid var(--color-border);
border-radius: var(--radius-md);
overflow: hidden;
background: var(--color-bg);
}
.code-bar {
display: flex;
align-items: center;
justify-content: space-between;
padding: 0.4rem 0.5rem 0.4rem 0.85rem;
border-bottom: 1px solid var(--color-border);
background: var(--color-bg-secondary);
}
.code-lang {
font-size: 0.72rem;
text-transform: uppercase;
letter-spacing: 0.06em;
color: var(--color-text-muted);
}
.btn-copy {
padding: 0.2rem 0.65rem;
font-size: 0.78rem;
}
.code-block pre {
margin: 0;
padding: 1rem;
overflow-x: auto;
}
.code-block code {
font-family: var(--font-mono, ui-monospace, "JetBrains Mono", monospace);
font-size: 0.85rem;
line-height: 1.6;
color: var(--color-text);
white-space: pre;
}
.tag-row {
display: flex;
flex-wrap: wrap;
gap: 0.4rem;
margin-top: 1.25rem;
}
.tag-pill {
font-size: 0.72rem;
padding: 0.15rem 0.5rem;
border-radius: 999px;
background: var(--color-bg-secondary);
color: var(--color-text-secondary);
border: 1px solid var(--color-border);
}
@media (max-width: 600px) {
.detail-header {
flex-direction: column;
}
.meta-grid {
grid-template-columns: 1fr;
gap: 0.15rem 0;
}
.meta-grid dd {
margin-bottom: 0.5rem;
}
}
</style>