@cat-factory/app 0.225.0 → 0.226.0

package/app/components/board/StepExecutionHistory.vue

@@ -22,22 +22,18 @@ type Entry =
 // clock-fallback `occurredAt`).
 const entries = computed<Entry[]>(() =>
   [
-    ...props.failures.map(
-      (failure, i): Entry => ({
-        kind: 'failure',
-        key: `failure-${i}`,
-        occurredAt: failure.occurredAt,
-        failure,
-      }),
-    ),
-    ...props.outputs.map(
-      (output, i): Entry => ({
-        kind: 'success',
-        key: `success-${i}`,
-        occurredAt: output.occurredAt,
-        output,
-      }),
-    ),
+    ...props.failures.map((failure, i): Entry => ({
+      kind: 'failure',
+      key: `failure-${i}`,
+      occurredAt: failure.occurredAt,
+      failure,
+    })),
+    ...props.outputs.map((output, i): Entry => ({
+      kind: 'success',
+      key: `success-${i}`,
+      occurredAt: output.occurredAt,
+      output,
+    })),
   ].sort((a, b) => b.occurredAt - a.occurredAt),
 )
 </script>

package/app/components/riskPolicy/RiskPolicyPicker.logic.spec.ts

@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import type { RiskPolicy } from '~/types/merge'
-import { resolveRiskPolicyPicker } from '~/components/riskPolicy/RiskPolicyPicker.logic'
+import {
+  refusedRiskPolicySelections,
+  resolveRiskPolicyPicker,
+} from '~/components/riskPolicy/RiskPolicyPicker.logic'
 
 // The resolver reads ids only, so the fixture carries just enough to be identifiable.
 const policy = (id: string, name: string) => ({ id, name }) as unknown as RiskPolicy
@@ -73,3 +76,60 @@ describe('resolveRiskPolicyPicker', () => {
     expect(state).toEqual({ policy: null, viaWorkspaceDefault: false })
   })
 })
+
+describe('refusedRiskPolicySelections', () => {
+  const rolePolicy = (id: string, over: Partial<RiskPolicy>) =>
+    ({ id, name: id, classRules: {}, classRulesByRole: {}, dryRunRoles: [], ...over }) as RiskPolicy
+
+  const sandboxed = rolePolicy('mp_sandboxed', { dryRunRoles: ['member'] })
+  const open = rolePolicy('mp_open', {})
+  const member = { role: 'member' as const, managesPolicy: false }
+
+  it('marks the rows a member may not move a sandboxed task to', () => {
+    // The picker must not offer what the backend refuses, including the "workspace default" row,
+    // which is a real policy (here: the open one) and not the absence of a choice.
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: open,
+      modelValue: 'mp_sandboxed',
+      actor: member,
+    })
+    expect(refused.get('mp_open')).toBe('relaxes_role_sandbox')
+    expect(refused.get('')).toBe('relaxes_role_sandbox')
+    expect(refused.has('mp_sandboxed')).toBe(false) // the row already selected
+  })
+
+  it('judges a task that picked nothing against the workspace default, as the engine does', () => {
+    // The create-form shape: nothing selected yet, so the policy being moved AWAY from is the one
+    // the task would have been governed by.
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: sandboxed,
+      modelValue: '',
+      actor: member,
+    })
+    expect(refused.get('mp_open')).toBe('relaxes_role_sandbox')
+    expect(refused.has('mp_sandboxed')).toBe(false)
+  })
+
+  it('refuses nothing to an editor who manages the policy library', () => {
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: open,
+      modelValue: 'mp_sandboxed',
+      actor: { role: 'admin', managesPolicy: true },
+    })
+    expect(refused.size).toBe(0)
+  })
+
+  it('refuses nothing between policies that treat every initiator alike', () => {
+    // Every built-in ships with an empty role layer, so the common case offers the whole library.
+    const refused = refusedRiskPolicySelections({
+      options: [open, rolePolicy('mp_other', {})],
+      defaultPolicy: open,
+      modelValue: 'mp_open',
+      actor: member,
+    })
+    expect(refused.size).toBe(0)
+  })
+})

package/app/components/riskPolicy/RiskPolicyPicker.logic.ts

@@ -6,6 +6,11 @@
 // riskPolicies store's `resolve()` falls back to the workspace default for both an empty id
 // and a dangling one; this mirrors that, so the picker can never tell the user "no risk policy
 // configured" about a task the default is quietly governing.
+import {
+  refuseRiskPolicySelection,
+  type BlockEditActor,
+  type RiskPolicySelectionRefusal,
+} from '@cat-factory/contracts'
 import type { RiskPolicy } from '~/types/merge'
 
 export interface RiskPolicyPickerState {
@@ -45,3 +50,38 @@ export function resolveRiskPolicyPicker(input: RiskPolicyPickerInput): RiskPolic
   if (named) return { policy: named, viaWorkspaceDefault: false }
   return { policy: input.defaultPolicy, viaWorkspaceDefault: !!input.defaultPolicy }
 }
+
+/**
+ * Which of the offered policies this user may not move THIS task to, keyed by option id (`''`
+ * for the "workspace default" row), with the reason.
+ *
+ * A task's policy decides whether its runs are sandboxed for the initiator's role and how their
+ * auto-merge is narrowed, so the backend refuses a selection that would relax what the selector's
+ * own role is held to (ADR 0037). The picker applies the SAME contracts rule rather than offering
+ * a row and handing back a 403: an authoring surface that offers what the engine discards is
+ * telling someone they made a choice they did not make.
+ *
+ * The policy being moved AWAY from is resolved exactly as the engine resolves it: the named
+ * option, else the workspace default. That is what makes the same call correct on the create form
+ * (nothing picked yet, so the default is what would have governed the task) and in the inspector.
+ */
+export function refusedRiskPolicySelections(input: {
+  options: readonly RiskPolicy[]
+  defaultPolicy: RiskPolicy | null
+  modelValue: string
+  actor: BlockEditActor
+}): Map<string, RiskPolicySelectionRefusal> {
+  const refusals = new Map<string, RiskPolicySelectionRefusal>()
+  const from =
+    (input.modelValue ? input.options.find((p) => p.id === input.modelValue) : undefined) ??
+    input.defaultPolicy
+  if (!from) return refusals
+  const judge = (id: string, to: RiskPolicy | null) => {
+    if (!to) return
+    const refusal = refuseRiskPolicySelection({ from, to, actor: input.actor })
+    if (refusal) refusals.set(id, refusal)
+  }
+  judge('', input.defaultPolicy)
+  for (const policy of input.options) judge(policy.id, policy)
+  return refusals
+}

package/app/components/riskPolicy/RiskPolicyPicker.vue

@@ -14,7 +14,10 @@
 import { computed, ref } from 'vue'
 import type { RiskPolicy } from '~/types/merge'
 import RiskPolicyPreview from '~/components/riskPolicy/RiskPolicyPreview.vue'
-import { resolveRiskPolicyPicker } from '~/components/riskPolicy/RiskPolicyPicker.logic'
+import {
+  refusedRiskPolicySelections,
+  resolveRiskPolicyPicker,
+} from '~/components/riskPolicy/RiskPolicyPicker.logic'
 
 const props = withDefaults(
   defineProps<{
@@ -37,6 +40,7 @@ const props = withDefaults(
 
 const emit = defineEmits<{ 'update:modelValue': [string] }>()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 const open = ref(false)
 // The row the pointer or the keyboard is currently on, driving the right-column preview.
@@ -56,6 +60,39 @@ const preview = computed(() =>
   }),
 )
 
+/**
+ * The policies this user may not move THIS task to, and why (ADR 0037): a selection may not
+ * relax what the selector's own role is held to, and the backend refuses one that does. Offering
+ * the row anyway would be telling someone they made a choice the engine then discards.
+ *
+ * Empty on every workspace whose policies treat each initiator alike (which is every built-in),
+ * and always empty for someone holding `settings.manage`, who owns the library.
+ */
+const refused = computed(() =>
+  refusedRiskPolicySelections({
+    options: props.options,
+    defaultPolicy: props.defaultPolicy,
+    modelValue: props.modelValue,
+    actor: { role: access.role.value, managesPolicy: access.canManageSettings.value },
+  }),
+)
+
+/** The reason the previewed row is refused, if it is: the pane explains what the row cannot. */
+const previewRefusal = computed(() => refused.value.get(activeId.value ?? props.modelValue))
+
+/**
+ * The same reason as a tooltip on the row itself, `undefined` when the row is selectable.
+ *
+ * A refused row is `aria-disabled`, NOT `disabled`: a disabled button is unfocusable, so keyboard
+ * users could never land on it, and landing on it is precisely what puts the reason in the detail
+ * pane (the `@focus` handler below drives the preview). Refusing the click is `choose`'s job, so
+ * the row stays reachable by both routes and explains itself on both.
+ */
+function refusalText(id: string): string | undefined {
+  const refusal = refused.value.get(id)
+  return refusal ? t(`riskPolicy.picker.refused.${refusal}`) : undefined
+}
+
 /**
  * Tabbing BETWEEN two rows fires `focusout` on the one being left, so only focus leaving the
  * panel altogether may drop the preview back to the selection.
@@ -68,6 +105,7 @@ function onPanelFocusOut(event: FocusEvent) {
 }
 
 function choose(id: string) {
+  if (refused.value.has(id)) return
   emit('update:modelValue', id)
   open.value = false
 }
@@ -101,14 +139,22 @@ function choose(id: string) {
           <li>
             <button
               type="button"
-              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm hover:bg-slate-800/60"
-              :class="modelValue ? 'text-slate-300' : 'text-slate-100'"
+              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm"
+              :class="[
+                refused.has('') ? 'cursor-not-allowed opacity-50' : 'hover:bg-slate-800/60',
+                modelValue ? 'text-slate-300' : 'text-slate-100',
+              ]"
+              :aria-disabled="refused.has('')"
+              :title="refusalText('')"
               data-testid="risk-policy-option-none"
               @mouseenter="activeId = ''"
               @focus="activeId = ''"
               @click="choose('')"
             >
-              <UIcon name="i-lucide-rotate-ccw" class="h-4 w-4 shrink-0 text-slate-400" />
+              <UIcon
+                :name="refused.has('') ? 'i-lucide-lock' : 'i-lucide-rotate-ccw'"
+                class="h-4 w-4 shrink-0 text-slate-400"
+              />
               <span class="flex-1 truncate">{{ noneLabel }}</span>
               <UIcon
                 v-if="!modelValue"
@@ -120,14 +166,22 @@ function choose(id: string) {
           <li v-for="p in options" :key="p.id">
             <button
               type="button"
-              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm hover:bg-slate-800/60"
-              :class="modelValue === p.id ? 'text-slate-100' : 'text-slate-300'"
+              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm"
+              :class="[
+                refused.has(p.id) ? 'cursor-not-allowed opacity-50' : 'hover:bg-slate-800/60',
+                modelValue === p.id ? 'text-slate-100' : 'text-slate-300',
+              ]"
+              :aria-disabled="refused.has(p.id)"
+              :title="refusalText(p.id)"
               :data-testid="`risk-policy-option-${p.id}`"
               @mouseenter="activeId = p.id"
               @focus="activeId = p.id"
               @click="choose(p.id)"
             >
-              <UIcon name="i-lucide-git-merge" class="h-4 w-4 shrink-0 text-slate-400" />
+              <UIcon
+                :name="refused.has(p.id) ? 'i-lucide-lock' : 'i-lucide-git-merge'"
+                class="h-4 w-4 shrink-0 text-slate-400"
+              />
               <span class="flex-1 truncate">{{ p.name }}</span>
               <UIcon
                 v-if="modelValue === p.id"
@@ -141,6 +195,13 @@ function choose(id: string) {
         <!-- right: what the active (or selected) policy actually does -->
         <div class="w-1/2 overflow-y-auto p-3">
           <template v-if="preview.policy">
+            <p
+              v-if="previewRefusal"
+              class="mb-2 text-[11px] leading-snug text-amber-400"
+              data-testid="risk-policy-refusal"
+            >
+              {{ t(`riskPolicy.picker.refused.${previewRefusal}`) }}
+            </p>
             <p
               v-if="preview.viaWorkspaceDefault"
               class="mb-2 text-[11px] leading-snug text-slate-500"

package/i18n/locales/de.json

@@ -6156,7 +6156,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Gilt, weil diese Aufgabe keine eigene Richtlinie wählt.",
-      "noneHint": "Keine Risikorichtlinie konfiguriert. Jeder Pull Request wartet auf eine menschliche Prüfung."
+      "noneHint": "Keine Risikorichtlinie konfiguriert. Jeder Pull Request wartet auf eine menschliche Prüfung.",
+      "refused": {
+        "relaxes_role_sandbox": "Für deine Rolle nicht verfügbar: Läufe dieser Aufgabe laufen in der Sandbox, und diese Richtlinie würde sie mergen lassen. Eine Workspace-Administration kann das ändern.",
+        "relaxes_role_class_rule": "Für deine Rolle nicht verfügbar: Diese Richtlinie merged Änderungen automatisch, die du bei dieser Aufgabe prüfen musst. Eine Workspace-Administration kann das ändern."
+      }
     },
     "preview": {
       "defaultBadge": "Standard",

package/i18n/locales/en.json

@@ -4744,7 +4744,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Applied because this task picks no policy of its own.",
-      "noneHint": "No risk policy configured. Every pull request waits for a human review."
+      "noneHint": "No risk policy configured. Every pull request waits for a human review.",
+      "refused": {
+        "relaxes_role_sandbox": "Not available for your role: this task’s runs are sandboxed, and this policy would let them merge. A workspace admin can change it.",
+        "relaxes_role_class_rule": "Not available for your role: this policy auto-merges changes you are held to review on this task. A workspace admin can change it."
+      }
     },
     "preview": {
       "defaultBadge": "Default",

package/i18n/locales/es.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Se aplica porque esta tarea no elige una política propia.",
-      "noneHint": "No hay ninguna política de riesgo configurada. Cada pull request espera una revisión humana."
+      "noneHint": "No hay ninguna política de riesgo configurada. Cada pull request espera una revisión humana.",
+      "refused": {
+        "relaxes_role_sandbox": "No disponible para tu rol: las ejecuciones de esta tarea están en un entorno aislado y esta política permitiría fusionarlas. Un administrador del espacio de trabajo puede cambiarlo.",
+        "relaxes_role_class_rule": "No disponible para tu rol: esta política fusiona automáticamente cambios que tú debes revisar en esta tarea. Un administrador del espacio de trabajo puede cambiarlo."
+      }
     },
     "preview": {
       "defaultBadge": "Predeterminada",

package/i18n/locales/fr.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Appliquée parce que cette tâche ne choisit aucune politique.",
-      "noneHint": "Aucune politique de risque configurée. Chaque pull request attend une revue humaine."
+      "noneHint": "Aucune politique de risque configurée. Chaque pull request attend une revue humaine.",
+      "refused": {
+        "relaxes_role_sandbox": "Indisponible pour votre rôle : les exécutions de cette tâche sont isolées, et cette politique les laisserait fusionner. Un administrateur de l’espace de travail peut le changer.",
+        "relaxes_role_class_rule": "Indisponible pour votre rôle : cette politique fusionne automatiquement des changements que vous devez relire sur cette tâche. Un administrateur de l’espace de travail peut le changer."
+      }
     },
     "preview": {
       "defaultBadge": "Par défaut",

package/i18n/locales/he.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "חלה מפני שהמשימה הזו לא בוחרת מדיניות משלה.",
-      "noneHint": "לא הוגדרה מדיניות סיכון. כל בקשת משיכה ממתינה לסקירה אנושית."
+      "noneHint": "לא הוגדרה מדיניות סיכון. כל בקשת משיכה ממתינה לסקירה אנושית.",
+      "refused": {
+        "relaxes_role_sandbox": "לא זמין לתפקיד שלך: ההרצות של משימה זו מבודדות, והמדיניות הזו הייתה מאפשרת למזג אותן. מנהל סביבת העבודה יכול לשנות זאת.",
+        "relaxes_role_class_rule": "לא זמין לתפקיד שלך: המדיניות הזו ממזגת אוטומטית שינויים שאתה נדרש לבדוק במשימה זו. מנהל סביבת העבודה יכול לשנות זאת."
+      }
     },
     "preview": {
       "defaultBadge": "ברירת מחדל",

package/i18n/locales/it.json

@@ -6156,7 +6156,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Si applica perche questa attivita non sceglie un criterio proprio.",
-      "noneHint": "Nessun criterio di rischio configurato. Ogni pull request attende una revisione umana."
+      "noneHint": "Nessun criterio di rischio configurato. Ogni pull request attende una revisione umana.",
+      "refused": {
+        "relaxes_role_sandbox": "Non disponibile per il tuo ruolo: le esecuzioni di questa attività sono isolate e questo criterio ne consentirebbe il merge. Un amministratore dello spazio di lavoro può cambiarlo.",
+        "relaxes_role_class_rule": "Non disponibile per il tuo ruolo: questo criterio unisce automaticamente modifiche che devi revisionare in questa attività. Un amministratore dello spazio di lavoro può cambiarlo."
+      }
     },
     "preview": {
       "defaultBadge": "Predefinito",

package/i18n/locales/ja.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "このタスクが独自のポリシーを選んでいないため、これが適用されます。",
-      "noneHint": "リスクポリシーが設定されていません。すべてのプルリクエストは人のレビューを待ちます。"
+      "noneHint": "リスクポリシーが設定されていません。すべてのプルリクエストは人のレビューを待ちます。",
+      "refused": {
+        "relaxes_role_sandbox": "あなたのロールでは選べません。このタスクの実行はサンドボックスで動作しますが、このポリシーではマージが許可されます。ワークスペース管理者が変更できます。",
+        "relaxes_role_class_rule": "あなたのロールでは選べません。このポリシーは、このタスクであなたのレビューが必要な変更を自動マージします。ワークスペース管理者が変更できます。"
+      }
     },
     "preview": {
       "defaultBadge": "既定",

package/i18n/locales/pl.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Stosowana, ponieważ to zadanie nie wybiera własnej zasady.",
-      "noneHint": "Nie skonfigurowano żadnej zasady ryzyka. Każdy pull request czeka na ludzką recenzję."
+      "noneHint": "Nie skonfigurowano żadnej zasady ryzyka. Każdy pull request czeka na ludzką recenzję.",
+      "refused": {
+        "relaxes_role_sandbox": "Niedostępne dla twojej roli: uruchomienia tego zadania działają w piaskownicy, a ta zasada pozwoliłaby je scalić. Administrator obszaru roboczego może to zmienić.",
+        "relaxes_role_class_rule": "Niedostępne dla twojej roli: ta zasada automatycznie scala zmiany, które musisz przejrzeć w tym zadaniu. Administrator obszaru roboczego może to zmienić."
+      }
     },
     "preview": {
       "defaultBadge": "Domyślna",

package/i18n/locales/tr.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Bu görev kendine bir ilke seçmediği için uygulanır.",
-      "noneHint": "Yapılandırılmış risk ilkesi yok. Her pull request insan incelemesini bekler."
+      "noneHint": "Yapılandırılmış risk ilkesi yok. Her pull request insan incelemesini bekler.",
+      "refused": {
+        "relaxes_role_sandbox": "Rolün için kullanılamaz: bu görevin çalışmaları yalıtılmış çalışır ve bu ilke birleştirmelerine izin verirdi. Bir çalışma alanı yöneticisi bunu değiştirebilir.",
+        "relaxes_role_class_rule": "Rolün için kullanılamaz: bu ilke, bu görevde incelemen gereken değişiklikleri otomatik birleştirir. Bir çalışma alanı yöneticisi bunu değiştirebilir."
+      }
     },
     "preview": {
       "defaultBadge": "Varsayılan",

package/i18n/locales/uk.json

@@ -6023,7 +6023,11 @@
     },
     "picker": {
       "workspaceDefaultCaption": "Застосовується, бо це завдання не обрало власної політики.",
-      "noneHint": "Політику ризику не налаштовано. Кожен pull request чекає на людську перевірку."
+      "noneHint": "Політику ризику не налаштовано. Кожен pull request чекає на людську перевірку.",
+      "refused": {
+        "relaxes_role_sandbox": "Недоступно для вашої ролі: запуски цього завдання ізольовані, а ця політика дозволила б їх злиття. Адміністратор робочого простору може це змінити.",
+        "relaxes_role_class_rule": "Недоступно для вашої ролі: ця політика автоматично зливає зміни, які ви маєте перевіряти в цьому завданні. Адміністратор робочого простору може це змінити."
+      }
     },
     "preview": {
       "defaultBadge": "Типова",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.225.0",
+  "version": "0.226.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@modular-frontend/core": "^0.6.0",
+    "@modular-frontend/core": "0.6.0",
     "@modular-vue/core": "^1.5.0",
     "@modular-vue/journeys": "^1.4.0",
     "@modular-vue/nuxt": "^0.4.1",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.242.0"
+    "@cat-factory/contracts": "0.243.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",
@@ -53,7 +53,7 @@
     "vue-tsc": "^3.3.9"
   },
   "peerDependencies": {
-    "nuxt": "^4.5.0"
+    "nuxt": "^4.5.1"
   },
   "scripts": {
     "postinstall": "nuxt prepare",