@cat-factory/app 0.128.0 → 0.130.0

package/app/components/board/AgentFailureCard.vue

@@ -15,6 +15,7 @@ const props = withDefaults(
 
 const { t } = useI18n()
 const agentRuns = useAgentRunsStore()
+const access = useWorkspaceAccess()
 const ui = useUiStore()
 const auth = useAuthStore()
 const board = useBoardStore()
@@ -171,7 +172,8 @@ async function retry() {
         type="button"
         class="nodrag flex items-center gap-1 rounded-md bg-rose-900/40 text-rose-200 hover:bg-rose-900/70 disabled:opacity-60"
         :class="compact ? 'px-2 py-0.5 text-[10px]' : 'px-2 py-1 text-[11px]'"
-        :disabled="retrying"
+        :disabled="retrying || !access.canExecuteRuns.value"
+        :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
         data-testid="agent-failure-retry"
         @click.stop="retry"
       >

package/app/components/board/AgentStopButton.vue

@@ -21,6 +21,7 @@ const props = withDefaults(
 
 const { t } = useI18n()
 const agentRuns = useAgentRunsStore()
+const access = useWorkspaceAccess()
 const toast = useToast()
 const { confirm } = useConfirm()
 const stopping = ref(false)
@@ -68,6 +69,8 @@ async function stop() {
     :size="size"
     icon="i-lucide-circle-stop"
     :loading="stopping"
+    :disabled="!access.canExecuteRuns.value"
+    :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
     @click.stop="stop"
   >
     {{ displayLabel }}

package/app/components/board/BoardCanvas.vue

@@ -20,6 +20,7 @@ const execution = useExecutionStore()
 const ui = useUiStore()
 const github = useGitHubStore()
 const toast = useToast()
+const access = useWorkspaceAccess()
 const { t } = useI18n()
 
 const { onNodeDragStop, onViewportChange, screenToFlowCoordinate } = useVueFlow(BOARD_FLOW_ID)
@@ -240,12 +241,22 @@ async function onDrop(event: DragEvent) {
           {{ t('board.canvas.emptyBody') }}
         </p>
       </div>
-      <div class="pointer-events-auto flex flex-wrap items-center justify-center gap-2">
-        <UButton color="primary" icon="i-lucide-git-branch-plus" @click="ui.openBootstrap()">
+      <div
+        v-if="
+          access.canManageIntegrations.value || (github.available && access.canWriteBoard.value)
+        "
+        class="pointer-events-auto flex flex-wrap items-center justify-center gap-2"
+      >
+        <UButton
+          v-if="access.canManageIntegrations.value"
+          color="primary"
+          icon="i-lucide-git-branch-plus"
+          @click="ui.openBootstrap()"
+        >
           {{ t('nav.bootstrapRepo') }}
         </UButton>
         <UButton
-          v-if="github.available"
+          v-if="github.available && access.canWriteBoard.value"
           color="primary"
           variant="soft"
           icon="i-lucide-folder-git-2"
@@ -254,6 +265,8 @@ async function onDrop(event: DragEvent) {
           {{ t('nav.addFromRepo') }}
         </UButton>
       </div>
+      <!-- A read-only viewer sees the empty state but no create affordances. -->
+      <p v-else class="max-w-sm text-xs text-slate-600">{{ t('access.noBoardWrite') }}</p>
     </div>
 
     <!-- task dependency arrows, overlaid in screen space -->

package/app/components/board/RecurringPipelineModal.vue

@@ -16,6 +16,7 @@ const recurring = useRecurringPipelinesStore()
 const tracker = useTrackerStore()
 const tasks = useTasksStore()
 const toast = useToast()
+const access = useWorkspaceAccess()
 const { t } = useI18n()
 
 const open = computed({
@@ -200,7 +201,12 @@ function buildIssueIntake(): IssueIntakeConfig {
 }
 
 const canAdd = computed(
-  () => name.value.trim().length > 0 && pipelineId.value.length > 0 && intakeReady.value,
+  () =>
+    name.value.trim().length > 0 &&
+    pipelineId.value.length > 0 &&
+    intakeReady.value &&
+    // Scheduling a recurring pipeline is a `runs.execute` action.
+    access.canExecuteRuns.value,
 )
 
 async function add() {

package/app/components/board/nodes/BlockNode.vue

@@ -23,6 +23,7 @@ const tasks = useTasksStore()
 const agentRuns = useAgentRunsStore()
 const services = useServicesStore()
 const reviews = useReviewStage()
+const access = useWorkspaceAccess()
 const { t } = useI18n()
 const { lod } = useSemanticZoom()
 // Coarse-pointer (touch) bumps the frame-header actions from `xs` to `sm` so
@@ -466,45 +467,50 @@ const ITEM_ICON: Record<string, string> = {
               <UBadge :color="statusMeta.chip as any" variant="subtle" size="sm">{{
                 statusLabel
               }}</UBadge>
-              <UButton
-                class="nodrag"
-                data-testid="frame-add-task"
-                :size="isTouch ? 'sm' : 'xs'"
-                variant="ghost"
-                color="neutral"
-                icon="i-lucide-plus"
-                :title="t('board.frame.addTaskTitle')"
-                @click.stop="addTask"
-              />
-              <UButton
-                v-if="tasks.anyOffered"
-                class="nodrag"
-                :size="isTouch ? 'sm' : 'xs'"
-                variant="ghost"
-                color="neutral"
-                icon="i-lucide-ticket"
-                :title="t('board.frame.createTaskFromIssueTitle')"
-                @click.stop="createTaskFromIssue"
-              />
-              <UButton
-                class="nodrag"
-                :size="isTouch ? 'sm' : 'xs'"
-                variant="ghost"
-                color="neutral"
-                icon="i-lucide-repeat"
-                :title="t('board.frame.addRecurringTitle')"
-                @click.stop="addRecurring"
-              />
-              <UButton
-                class="nodrag"
-                data-testid="frame-add-initiative"
-                :size="isTouch ? 'sm' : 'xs'"
-                variant="ghost"
-                color="neutral"
-                icon="i-lucide-milestone"
-                :title="t('board.frame.createInitiativeTitle')"
-                @click.stop="createInitiative"
-              />
+              <!-- Board-authoring buttons (create task / from issue / recurring / initiative)
+                   are `board.write` — hidden for a read-only viewer, who keeps the badge +
+                   collapse toggle (view-only affordances). -->
+              <template v-if="access.canWriteBoard.value">
+                <UButton
+                  class="nodrag"
+                  data-testid="frame-add-task"
+                  :size="isTouch ? 'sm' : 'xs'"
+                  variant="ghost"
+                  color="neutral"
+                  icon="i-lucide-plus"
+                  :title="t('board.frame.addTaskTitle')"
+                  @click.stop="addTask"
+                />
+                <UButton
+                  v-if="tasks.anyOffered"
+                  class="nodrag"
+                  :size="isTouch ? 'sm' : 'xs'"
+                  variant="ghost"
+                  color="neutral"
+                  icon="i-lucide-ticket"
+                  :title="t('board.frame.createTaskFromIssueTitle')"
+                  @click.stop="createTaskFromIssue"
+                />
+                <UButton
+                  class="nodrag"
+                  :size="isTouch ? 'sm' : 'xs'"
+                  variant="ghost"
+                  color="neutral"
+                  icon="i-lucide-repeat"
+                  :title="t('board.frame.addRecurringTitle')"
+                  @click.stop="addRecurring"
+                />
+                <UButton
+                  class="nodrag"
+                  data-testid="frame-add-initiative"
+                  :size="isTouch ? 'sm' : 'xs'"
+                  variant="ghost"
+                  color="neutral"
+                  icon="i-lucide-milestone"
+                  :title="t('board.frame.createInitiativeTitle')"
+                  @click.stop="createInitiative"
+                />
+              </template>
               <UButton
                 class="nodrag"
                 :size="isTouch ? 'sm' : 'xs'"
@@ -540,9 +546,9 @@ const ITEM_ICON: Record<string, string> = {
           <InitiativeCard v-for="i in initiativeBlocks" :key="i.id" :block-id="i.id" />
           <DraggableTask v-for="t in directTasks" :key="t.id" :task-id="t.id" />
           <button
-            v-if="!hasTasks"
+            v-if="!hasTasks && access.canWriteBoard.value"
             type="button"
-            data-testid="frame-add-task"
+            data-testid="frame-add-task-empty"
             class="absolute inset-4 flex items-center justify-center gap-1 rounded-lg border border-dashed border-slate-700 text-[11px] text-slate-500 hover:border-slate-500 hover:text-slate-300"
             @click.stop="addTask"
           >

package/app/components/brainstorm/BrainstormWindow.vue

@@ -25,6 +25,7 @@ const brainstorm = useBrainstormStore()
 const ui = useUiStore()
 const toast = useToast()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 const drafts = ref<Record<string, string>>({})
 const redoComment = ref('')
@@ -427,7 +428,14 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                             variant="soft"
                             size="xs"
                             icon="i-lucide-corner-down-left"
-                            :disabled="!(drafts[item.id] ?? '').trim() || frozen"
+                            :disabled="
+                              !(drafts[item.id] ?? '').trim() ||
+                              frozen ||
+                              !access.canExecuteRuns.value
+                            "
+                            :title="
+                              access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                            "
                             @click="submitReply(item)"
                           >
                             {{ t('brainstorm.saveChoice') }}
@@ -437,7 +445,10 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                             variant="ghost"
                             size="xs"
                             icon="i-lucide-x"
-                            :disabled="frozen"
+                            :disabled="frozen || !access.canExecuteRuns.value"
+                            :title="
+                              access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                            "
                             @click="setStatus(item, 'dismissed')"
                           >
                             {{ t('brainstorm.dismiss') }}
@@ -452,7 +463,10 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           variant="ghost"
                           size="xs"
                           icon="i-lucide-rotate-ccw"
-                          :disabled="frozen"
+                          :disabled="frozen || !access.canExecuteRuns.value"
+                          :title="
+                            access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                          "
                           @click="setStatus(item, 'open')"
                         >
                           {{ t('brainstorm.reopen') }}
@@ -533,6 +547,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   icon="i-lucide-arrow-right"
                   :ui="{ leadingIcon: 'rtl:-scale-x-100', trailingIcon: 'rtl:-scale-x-100' }"
                   :loading="acting"
+                  :disabled="!access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="proceed"
                 >
                   {{ t('brainstorm.proceedNothing') }}
@@ -544,7 +560,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   block
                   icon="i-lucide-wand-sparkles"
                   :loading="reworking"
-                  :disabled="!canIncorporate"
+                  :disabled="!canIncorporate || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="incorporate()"
                 >
                   {{ t('brainstorm.incorporateChoices') }}
@@ -568,6 +585,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   block
                   icon="i-lucide-sparkles"
                   :loading="busy"
+                  :disabled="!access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="reReview"
                 >
                   {{ busy ? t('brainstorm.reRunning') : t('brainstorm.reRun') }}
@@ -602,7 +621,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                     block
                     icon="i-lucide-wand-sparkles"
                     :loading="reworking"
-                    :disabled="!redoComment.trim()"
+                    :disabled="!redoComment.trim() || !access.canExecuteRuns.value"
+                    :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                     @click="incorporate(redoComment.trim())"
                   >
                     {{ t('brainstorm.redoWithDirection') }}

package/app/components/clarity/ClarityReviewWindow.vue

@@ -25,6 +25,7 @@ const clarity = useClarityStore()
 const models = useModelsStore()
 const toast = useToast()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 // Draft replies, keyed by item id, so editing one item doesn't disturb others.
 const drafts = ref<Record<string, string>>({})
@@ -474,7 +475,10 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                             variant="ghost"
                             size="xs"
                             icon="i-lucide-x"
-                            :disabled="frozen"
+                            :disabled="frozen || !access.canExecuteRuns.value"
+                            :title="
+                              access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                            "
                             @click="setStatus(item, 'dismissed')"
                           >
                             {{ t('clarity.dismissIrrelevant') }}
@@ -489,7 +493,10 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           variant="ghost"
                           size="xs"
                           icon="i-lucide-rotate-ccw"
-                          :disabled="frozen"
+                          :disabled="frozen || !access.canExecuteRuns.value"
+                          :title="
+                            access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                          "
                           @click="setStatus(item, 'open')"
                         >
                           {{ t('clarity.reopen') }}
@@ -577,6 +584,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   icon="i-lucide-arrow-right"
                   :ui="{ leadingIcon: 'rtl:-scale-x-100', trailingIcon: 'rtl:-scale-x-100' }"
                   :loading="acting"
+                  :disabled="!access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="proceed"
                 >
                   {{ t('clarity.proceedNothing') }}
@@ -588,7 +597,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   block
                   icon="i-lucide-wand-sparkles"
                   :loading="reworking"
-                  :disabled="!canIncorporate"
+                  :disabled="!canIncorporate || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="incorporate()"
                 >
                   {{ t('clarity.incorporateAnswers') }}
@@ -612,6 +622,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                   block
                   icon="i-lucide-sparkles"
                   :loading="busy"
+                  :disabled="!access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="reReview"
                 >
                   {{ busy ? t('clarity.reReviewing') : t('clarity.looksGoodReReview') }}
@@ -646,7 +658,8 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                     block
                     icon="i-lucide-wand-sparkles"
                     :loading="reworking"
-                    :disabled="!redoComment.trim()"
+                    :disabled="!redoComment.trim() || !access.canExecuteRuns.value"
+                    :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                     @click="incorporate(redoComment.trim())"
                   >
                     {{ t('clarity.redoWithDirection') }}

package/app/components/docs/DocInterviewWindow.vue

@@ -12,6 +12,7 @@ import { computed, reactive, watch } from 'vue'
 const board = useBoardStore()
 const docInterview = useDocInterviewStore()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 const { open, blockId, close } = useResultView('doc-interview', {
   onOpen: (id) => void docInterview.load(id),
@@ -186,6 +187,8 @@ const onProceed = () => flushThen((id) => docInterview.proceedInterview(id))
               variant="ghost"
               size="sm"
               :loading="resuming"
+              :disabled="!access.canExecuteRuns.value"
+              :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
               data-testid="doc-interview-proceed"
               @click="onProceed"
             >
@@ -195,7 +198,8 @@ const onProceed = () => flushThen((id) => docInterview.proceedInterview(id))
               color="primary"
               size="sm"
               :loading="resuming"
-              :disabled="!allAnswered"
+              :disabled="!allAnswered || !access.canExecuteRuns.value"
+              :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
               data-testid="doc-interview-continue"
               @click="onContinue"
             >

package/app/components/followUp/FollowUpWindow.vue

@@ -16,6 +16,7 @@ import { FOLLOW_UP_COMPANION_META } from '~/utils/catalog'
 const execution = useExecutionStore()
 const board = useBoardStore()
 const followUps = useFollowUpsStore()
+const access = useWorkspaceAccess()
 
 const { t } = useI18n()
 
@@ -207,7 +208,12 @@ const STATUS_META: Record<
                           size="xs"
                           color="primary"
                           :loading="followUps.isActing(item.id)"
-                          :disabled="!(drafts[item.id] ?? '').trim()"
+                          :disabled="
+                            !(drafts[item.id] ?? '').trim() || !access.canExecuteRuns.value
+                          "
+                          :title="
+                            access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                          "
                           @click="onAnswer(item)"
                         >
                           {{ t('followUp.actions.answerAndSend') }}
@@ -217,6 +223,10 @@ const STATUS_META: Record<
                           color="neutral"
                           variant="ghost"
                           :loading="followUps.isActing(item.id)"
+                          :disabled="!access.canExecuteRuns.value"
+                          :title="
+                            access.canExecuteRuns.value ? undefined : t('access.noRunExecute')
+                          "
                           @click="onDismiss(item)"
                         >
                           {{ t('followUp.actions.dismiss') }}
@@ -231,6 +241,8 @@ const STATUS_META: Record<
                         color="primary"
                         icon="i-lucide-ticket"
                         :loading="followUps.isActing(item.id)"
+                        :disabled="!access.canExecuteRuns.value"
+                        :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                         @click="onFile(item)"
                       >
                         {{ t('followUp.actions.fileAsIssue') }}
@@ -241,6 +253,8 @@ const STATUS_META: Record<
                         variant="soft"
                         icon="i-lucide-corner-up-left"
                         :loading="followUps.isActing(item.id)"
+                        :disabled="!access.canExecuteRuns.value"
+                        :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                         @click="onQueue(item)"
                       >
                         {{ t('followUp.actions.sendToCoder') }}

package/app/components/forkDecision/ForkDecisionWindow.vue

@@ -18,6 +18,7 @@ import { FORK_DECISION_META } from '~/utils/catalog'
 const execution = useExecutionStore()
 const board = useBoardStore()
 const forkDecision = useForkDecisionStore()
+const access = useWorkspaceAccess()
 
 const { t } = useI18n()
 
@@ -348,7 +349,10 @@ async function onSend() {
                   size="sm"
                   icon="i-lucide-send"
                   :loading="forkDecision.chatting"
-                  :disabled="!canChat || chatInput.trim().length === 0"
+                  :disabled="
+                    !canChat || chatInput.trim().length === 0 || !access.canExecuteRuns.value
+                  "
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="onSend"
                 >
                   {{ t('forkDecision.chat.send') }}
@@ -380,7 +384,8 @@ async function onSend() {
             size="sm"
             icon="i-lucide-check"
             :loading="forkDecision.choosing"
-            :disabled="!canChoose"
+            :disabled="!canChoose || !access.canExecuteRuns.value"
+            :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
             @click="onChoose"
           >
             {{ t('forkDecision.choose') }}

package/app/components/gates/GateResultView.vue

@@ -17,6 +17,7 @@ import CopyButton from '~/components/common/CopyButton.vue'
 const board = useBoardStore()
 const execution = useExecutionStore()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 // Synchronous window: it reads its state straight off the execution step, so there's
 // nothing to fetch on open (no `onOpen` loader).
@@ -305,7 +306,12 @@ const conflictVerdict = computed(() => {
                       color="primary"
                       icon="i-lucide-wrench"
                       :loading="fixBusy"
-                      :disabled="fixBusy || fixInstructions.trim().length === 0"
+                      :disabled="
+                        fixBusy ||
+                        fixInstructions.trim().length === 0 ||
+                        !access.canExecuteRuns.value
+                      "
+                      :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                       @click="submitFix"
                     >
                       {{ t('gates.humanReview.requestFix') }}

package/app/components/humanTest/HumanTestWindow.vue

@@ -20,6 +20,7 @@ const execution = useExecutionStore()
 const humanTest = useHumanTestStore()
 const { t, d } = useI18n()
 const toast = useToast()
+const access = useWorkspaceAccess()
 const { confirmAction, toastDone } = useConfirmAction()
 
 // Shared seam contract (open/blockId/close + Escape). No `onOpen` loader: the gate state
@@ -230,7 +231,8 @@ const canDestroy = computed(
                   color="neutral"
                   icon="i-lucide-refresh-cw"
                   :loading="busy"
-                  :disabled="busy || !canManageEnv"
+                  :disabled="busy || !canManageEnv || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="recreate"
                 >
                   {{ t('humanTest.actions.recreate') }}
@@ -240,7 +242,8 @@ const canDestroy = computed(
                   variant="soft"
                   color="neutral"
                   icon="i-lucide-trash-2"
-                  :disabled="busy || !canDestroy"
+                  :disabled="busy || !canDestroy || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="destroy"
                 >
                   {{ t('humanTest.actions.destroy') }}
@@ -251,7 +254,8 @@ const canDestroy = computed(
                   color="neutral"
                   icon="i-lucide-git-merge"
                   :loading="busy"
-                  :disabled="busy || !canManageEnv"
+                  :disabled="busy || !canManageEnv || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="pullMain"
                 >
                   {{ t('humanTest.actions.pullMain') }}
@@ -296,7 +300,8 @@ const canDestroy = computed(
                   color="warning"
                   icon="i-lucide-wrench"
                   :loading="busy"
-                  :disabled="busy || !findings.trim()"
+                  :disabled="busy || !findings.trim() || !access.canExecuteRuns.value"
+                  :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
                   @click="submitFix"
                 >
                   {{ t('humanTest.fix.send') }}
@@ -366,7 +371,8 @@ const canDestroy = computed(
             color="primary"
             icon="i-lucide-circle-check"
             :loading="busy"
-            :disabled="busy || !awaitingHuman"
+            :disabled="busy || !awaitingHuman || !access.canExecuteRuns.value"
+            :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
             @click="confirm"
           >
             {{ t('humanTest.confirm') }}

package/app/components/layout/BoardSwitcher.vue

@@ -12,6 +12,7 @@ const accounts = useAccountsStore()
 const workspace = useWorkspaceStore()
 const ui = useUiStore()
 const toast = useToast()
+const access = useWorkspaceAccess()
 const { confirm } = useConfirm()
 
 const busy = ref(false)
@@ -92,7 +93,9 @@ const accountItems = computed<DropdownMenuItem[][]>(() => [
 
 const boardItems = computed<DropdownMenuItem[][]>(() => [
   workspace.accountWorkspaces.map((w) => ({
-    label: w.name,
+    // Badge a board the caller only reaches as a read-only viewer (a restricted board
+    // they're not a member/admin of), so the switcher shows why it's read-only.
+    label: w.viewerRole === 'viewer' ? `${w.name} · ${t('access.viewerBadge')}` : w.name,
     icon: 'i-lucide-layout-dashboard',
     trailingIcon: w.id === workspace.workspaceId ? 'i-lucide-check' : undefined,
     onSelect: () => void switchBoard(w.id),
@@ -103,17 +106,23 @@ const boardItems = computed<DropdownMenuItem[][]>(() => [
       icon: 'i-lucide-plus',
       onSelect: () => openPrompt('board'),
     },
-    {
-      label: t('layout.boardSwitcher.board.rename'),
-      icon: 'i-lucide-pencil',
-      onSelect: () => openPrompt('rename'),
-    },
-    {
-      label: t('layout.boardSwitcher.board.delete'),
-      icon: 'i-lucide-trash-2',
-      color: 'error' as const,
-      onSelect: () => void removeBoard(),
-    },
+    // Rename/delete of the active board is `settings.manage` — omit for a member/viewer,
+    // who would only get a 403 (the backend gates WorkspaceController update/delete).
+    ...(access.canManageSettings.value
+      ? [
+          {
+            label: t('layout.boardSwitcher.board.rename'),
+            icon: 'i-lucide-pencil',
+            onSelect: () => openPrompt('rename'),
+          },
+          {
+            label: t('layout.boardSwitcher.board.delete'),
+            icon: 'i-lucide-trash-2',
+            color: 'error' as const,
+            onSelect: () => void removeBoard(),
+          },
+        ]
+      : []),
   ],
 ])
 

package/app/components/layout/BoardToolbar.vue

@@ -10,6 +10,7 @@ const workspace = useWorkspaceStore()
 const workspaceSettings = useWorkspaceSettingsStore()
 const services = useServicesStore()
 const toast = useToast()
+const access = useWorkspaceAccess()
 const { t, n } = useI18n()
 const { fitView, zoomIn, zoomOut, resetZoom } = useBoardFlow()
 
@@ -207,15 +208,18 @@ const decisionItems = computed(() =>
       </UButton>
     </UDropdownMenu>
 
-    <!-- in-org sharing: add an existing org service to this board -->
-    <UDropdownMenu v-if="mountableItems.length" :items="mountableItems">
+    <!-- in-org sharing: add an existing org service to this board (mount = board.write) -->
+    <UDropdownMenu
+      v-if="mountableItems.length && access.canWriteBoard.value"
+      :items="mountableItems"
+    >
       <UButton color="neutral" variant="ghost" size="sm" icon="i-lucide-plus-circle">
         <span class="hidden sm:inline">{{ t('board.toolbar.addService') }}</span>
       </UButton>
     </UDropdownMenu>
 
-    <!-- archived services: hidden from the board, restorable with no expiry -->
-    <UDropdownMenu v-if="archivedItems.length" :items="archivedItems">
+    <!-- archived services: hidden from the board, restorable with no expiry (board.write) -->
+    <UDropdownMenu v-if="archivedItems.length && access.canWriteBoard.value" :items="archivedItems">
       <UButton
         color="neutral"
         variant="ghost"