@cat-factory/app 0.310.2 → 0.311.0

package/app/components/layout/ProviderConfigBanner.vue

@@ -6,11 +6,13 @@
 // link into its connect panel. Dismissible per session.
 import { computed, ref, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
+import { canActOnSetup } from '~/utils/setupAudience'
 
 const { t } = useI18n()
 const ui = useUiStore()
 const workspace = useWorkspaceStore()
 const store = useProviderConnectionsStore()
+const { actor } = useSetupActor()
 
 // Exhaustive per-kind title/action keys (leaf names mirror the kind verbatim).
 const TITLE_KEYS: Record<ProviderConnectionKind, string> = {
@@ -33,7 +35,12 @@ watch(
 
 const dismissed = ref(false)
 const pending = computed(() => store.needingConfig as ProviderConnectionKind[])
-const show = computed(() => pending.value.length > 0 && !dismissed.value)
+// Only for the people whose save would land: the connection fields are a workspace-admin write,
+// and a member or a designer could only open the panel and be refused.
+const show = computed(
+  () =>
+    pending.value.length > 0 && !dismissed.value && canActOnSetup('workspace_admin', actor.value),
+)
 </script>
 
 <template>

package/app/components/panels/AgentStepDetail.vue

@@ -657,6 +657,7 @@ async function copyOutput() {
                provider error, behind a toggle (most useful on a failed-to-start run) -->
           <div v-if="executionId">
             <UButton
+              color="neutral"
               :icon="showProvisioning ? 'i-lucide-chevron-up' : 'i-lucide-scroll-text'"
               variant="ghost"
               size="xs"
@@ -685,6 +686,7 @@ async function copyOutput() {
                superseded and the FAILED attempts, scoped to the step being looked at -->
           <div v-if="hasStepHistory">
             <UButton
+              color="neutral"
               :icon="showHistory ? 'i-lucide-chevron-up' : 'i-lucide-history'"
               variant="ghost"
               size="xs"

package/app/components/panels/InspectorPanel.vue

@@ -678,7 +678,7 @@ const showOriginalDescription = ref(false)
         </UButton>
         <UButton
           color="error"
-          variant="ghost"
+          variant="soft"
           size="sm"
           icon="i-lucide-trash-2"
           :class="isServiceFrame ? '' : 'ms-auto'"

package/app/components/panels/inspector/ServiceReleaseHealthConfig.vue

@@ -101,7 +101,7 @@ async function clear() {
       <UButton
         v-if="saved"
         color="error"
-        variant="ghost"
+        variant="soft"
         size="xs"
         icon="i-lucide-trash-2"
         :loading="busy"

package/app/components/panels/inspector/ServiceTestSecrets.vue

@@ -152,7 +152,7 @@ async function clearAll() {
       <UButton
         v-if="configured.length"
         color="error"
-        variant="ghost"
+        variant="soft"
         size="xs"
         icon="i-lucide-trash-2"
         :loading="busy"

package/app/components/panels/inspector/ServiceValidationConfig.vue

@@ -209,7 +209,7 @@ async function clear() {
       <UButton
         v-if="configured"
         color="error"
-        variant="ghost"
+        variant="soft"
         size="xs"
         icon="i-lucide-trash-2"
         :loading="busy"

package/app/components/panels/inspector/TaskExecution.vue

@@ -347,7 +347,7 @@ async function mergePr() {
           <UButton
             icon="i-lucide-trash-2"
             color="error"
-            variant="ghost"
+            variant="soft"
             size="xs"
             :loading="resetting"
             :disabled="stopping || !access.canExecuteRuns.value"

package/app/components/pipeline/PipelineBuilder.vue

@@ -1340,7 +1340,7 @@ const { toggleArchive, toggleDefault, edit, removePipeline, clone } = usePipelin
                   <IconButton
                     v-if="!p.builtin"
                     icon="i-lucide-trash-2"
-                    color="neutral"
+                    color="error"
                     variant="ghost"
                     size="xs"
                     :label="t('pipeline.builder.delete')"

package/app/components/pipeline/PipelineHealthModal.vue

@@ -218,7 +218,7 @@ const reseedableCount = computed(
                   v-else
                   size="xs"
                   color="error"
-                  variant="subtle"
+                  variant="soft"
                   icon="i-lucide-trash-2"
                   :loading="isBusy(h.pipeline.id)"
                   :disabled="locked"
@@ -259,7 +259,7 @@ const reseedableCount = computed(
               <UButton
                 size="xs"
                 color="error"
-                variant="subtle"
+                variant="soft"
                 icon="i-lucide-trash-2"
                 :loading="isBusy(r.pipeline.id)"
                 :disabled="locked"

package/app/components/providers/AiProviderOnboardingModal.vue

@@ -9,6 +9,7 @@ import { computed } from 'vue'
 
 const { t } = useI18n()
 const ui = useUiStore()
+const { canManageSecrets } = useWorkspaceAccess()
 
 const open = computed({
   get: () => ui.aiProviderSetupOpen,
@@ -49,7 +50,12 @@ const routes = computed<Route[]>(() => [
     title: t('providers.onboarding.routes.keys.title'),
     body: t('providers.onboarding.routes.keys.body'),
     cta: t('providers.onboarding.routes.keys.cta'),
-    onSelect: () => go(ui.openVendorCredentials),
+    // The default tab is the workspace's pooled subscriptions, a `secrets.manage` write. Anyone else
+    // lands on the direct keys, which open on their own "My keys" scope (see ApiKeysSection).
+    onSelect: () =>
+      go(() =>
+        canManageSecrets.value ? ui.openVendorCredentials() : ui.openVendorCredentials('direct'),
+      ),
   },
   {
     icon: 'i-lucide-route',

package/app/components/providers/ApiKeysSection.vue

@@ -37,8 +37,27 @@ const { confirmAction, toastDone } = useConfirmAction()
 /** Account-wide mode (single account scope) vs the default workspace/user toggle. */
 const isAccount = computed(() => !!props.accountId)
 
-/** Which store the form writes to: the shared workspace keys or the user's own. */
-const scope = ref<'workspace' | 'user'>('workspace')
+/**
+ * Which store the form writes to: the shared workspace keys or the user's own. The DEFAULT follows
+ * the caller's grant on the active board: the workspace for whoever may write it (`secrets.manage`)
+ * and "My keys" for everyone else, so a first save lands instead of being refused. It is derived,
+ * not captured once, because this section stays mounted while the board (and so the grant)
+ * changes. A scope the user picks by hand wins until they move to another board.
+ */
+const { canManageSecrets } = useWorkspaceAccess()
+const pickedScope = ref<'workspace' | 'user' | null>(null)
+const scope = computed<'workspace' | 'user'>({
+  get: () => pickedScope.value ?? (canManageSecrets.value ? 'workspace' : 'user'),
+  set: (value) => {
+    pickedScope.value = value
+  },
+})
+watch(
+  () => workspace.workspaceId,
+  () => {
+    pickedScope.value = null
+  },
+)
 
 // "My keys" (user scope) are stored per-user, so they need a signed-in user. Block just
 // that scope when there's none (a deployment without sign-in); workspace/account keys are

package/app/components/provisioning/ProvisioningLogsDrawer.vue

@@ -120,6 +120,7 @@ function when(epochMs: number): string {
         {{ t('provisioning.title') }}
       </SectionLabel>
       <UButton
+        color="neutral"
         icon="i-lucide-rotate-ccw"
         variant="ghost"
         size="xs"

package/app/components/sandbox/SandboxPanel.vue

@@ -629,6 +629,7 @@ async function archive(prompt: SandboxPromptVersion) {
                      Offered on a graded candidate and on an older workspace revision (rolling
                      back), but not on the one already live, where it would be a no-op. -->
                 <IconButton
+                  color="neutral"
                   v-if="canPromote(p)"
                   icon="i-lucide-rocket"
                   variant="ghost"

package/app/components/settings/InfraHandlersConfigurator.vue

@@ -540,7 +540,7 @@ function toastRemoved() {
             <UButton
               icon="i-lucide-trash-2"
               color="error"
-              variant="ghost"
+              variant="soft"
               size="xs"
               :disabled="busy"
               @click="removeKubeOverride"

package/app/components/settings/ProviderConnectionTab.vue

@@ -356,6 +356,7 @@ function fieldHelp(key: string): string | undefined {
     <div class="flex items-start justify-between gap-3">
       <p class="text-xs text-muted">{{ blurb }}</p>
       <UButton
+        color="neutral"
         :icon="showLogs ? 'i-lucide-chevron-up' : 'i-lucide-scroll-text'"
         variant="ghost"
         size="xs"

package/app/components/settings/ToolServerChecklist.vue

@@ -242,7 +242,7 @@ async function runProbe(id: string) {
           <UButton
             v-if="server.oauth.connected"
             size="xs"
-            variant="ghost"
+            variant="soft"
             color="error"
             :loading="store.connecting === server.id"
             :disabled="store.connecting !== null"

package/app/components/skills/SkillLibraryManager.vue

@@ -236,6 +236,7 @@ async function unlinkSource(id: string) {
           </UBadge>
           <div class="ms-auto flex gap-1">
             <IconButton
+              color="neutral"
               icon="i-lucide-search-check"
               size="xs"
               variant="ghost"
@@ -244,6 +245,7 @@ async function unlinkSource(id: string) {
               @click="checkSource(s.id)"
             />
             <IconButton
+              color="neutral"
               icon="i-lucide-refresh-cw"
               size="xs"
               variant="ghost"

package/app/components/slack/SlackPanel.vue

@@ -257,7 +257,7 @@ async function saveMapping() {
             </span>
             <UButton
               color="error"
-              variant="ghost"
+              variant="soft"
               size="xs"
               icon="i-lucide-unplug"
               @click="disconnect"

package/app/components/tasks/TaskSourceConnectModal.vue

@@ -193,7 +193,7 @@ async function toggleEnabled(enabled: boolean) {
           <UButton
             v-if="connected"
             color="error"
-            variant="ghost"
+            variant="soft"
             icon="i-lucide-unplug"
             @click="disconnect"
           >

package/app/components/testing/TestReportWindow.vue

@@ -438,6 +438,7 @@ const GROUP_STATUS_META: Record<ScenarioGroup['status'], { icon: string; text: s
             </p>
             <template v-if="infraSetup.logs">
               <UButton
+                color="neutral"
                 :icon="showInfraSetupLogs ? 'i-lucide-chevron-up' : 'i-lucide-scroll-text'"
                 variant="ghost"
                 size="xs"
@@ -476,6 +477,7 @@ const GROUP_STATUS_META: Record<ScenarioGroup['status'], { icon: string; text: s
 
           <div v-if="executionId">
             <UButton
+              color="neutral"
               :icon="showProvisioning ? 'i-lucide-chevron-up' : 'i-lucide-scroll-text'"
               variant="ghost"
               size="xs"

package/app/components/vcs/VcsConnectSurfaces.vue

@@ -27,6 +27,12 @@ const props = defineProps<{
 
 const { t } = useI18n()
 const github = useGitHubStore()
+const { canManageIntegrations } = useWorkspaceAccess()
+
+// Connecting is an `integrations.manage` write, and the connect-options read is gated the same way,
+// so for anyone else the options come back empty. That empty list says nothing about the
+// deployment: name the board admin instead of telling a member the operator configured nothing.
+const adminRequired = computed(() => !canManageIntegrations.value)
 
 // Whether the deployment serves neither surface. Rendered as a statement rather than an empty
 // box: "nothing is configured" and "we couldn't read what is configured" both land here, and a
@@ -36,23 +42,33 @@ const nothingConfigured = computed(() => !github.canConnectGitHubApp && !github.
 
 <template>
   <div class="space-y-3">
-    <template v-if="github.canConnectGitHubApp">
-      <p v-if="props.appIntro" class="text-sm text-muted">{{ props.appIntro }}</p>
-      <GitHubConnect />
-    </template>
-
-    <USeparator
-      v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
-      :label="t('vcs.connect.or')"
-    />
-
-    <GitLabConnect v-if="github.canConnectGitLabPat" />
-
     <p
-      v-if="nothingConfigured"
+      v-if="adminRequired"
       class="rounded-md border border-dashed border-default px-3 py-3 text-sm text-muted"
+      data-testid="vcs-connect-admin-required"
     >
-      {{ t('vcs.connect.noneConfigured') }}
+      {{ t('vcs.connect.adminRequired') }}
     </p>
+
+    <template v-else>
+      <template v-if="github.canConnectGitHubApp">
+        <p v-if="props.appIntro" class="text-sm text-muted">{{ props.appIntro }}</p>
+        <GitHubConnect />
+      </template>
+
+      <USeparator
+        v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
+        :label="t('vcs.connect.or')"
+      />
+
+      <GitLabConnect v-if="github.canConnectGitLabPat" />
+
+      <p
+        v-if="nothingConfigured"
+        class="rounded-md border border-dashed border-default px-3 py-3 text-sm text-muted"
+      >
+        {{ t('vcs.connect.noneConfigured') }}
+      </p>
+    </template>
   </div>
 </template>

package/app/components/visualConfirm/VisualConfirmationWindow.vue

@@ -406,6 +406,7 @@ watch(pendingUpload, async (file) => {
               {{ t('visualConfirm.requestFix.foldedHint') }}
             </span>
             <UButton
+              variant="soft"
               size="sm"
               color="warning"
               icon="i-lucide-wrench"

package/app/composables/useSetupActor.ts

@@ -0,0 +1,25 @@
+import { computed } from 'vue'
+import type { SetupActor } from '~/utils/setupAudience'
+
+/**
+ * The caller as a setup prompt sees them: which app surface they chose, and the board and account
+ * grants that decide whether a "configure this" button would let them save. Every input is read
+ * from the source the nav gates read too (the role store, `useWorkspaceAccess`, and the accounts
+ * store's `isActiveAccountAdmin`), so a setup prompt and the sidebar cannot disagree about who the
+ * caller is.
+ */
+export function useSetupActor() {
+  const access = useWorkspaceAccess()
+  const uiRole = useUiRoleStore()
+  const accounts = useAccountsStore()
+
+  const actor = computed<SetupActor>(() => ({
+    fullSurface: uiRole.fullSurface,
+    canManageIntegrations: access.canManageIntegrations.value,
+    canExecuteRuns: access.canExecuteRuns.value,
+    isAccountAdmin: accounts.isActiveAccountAdmin,
+    accountsEnabled: accounts.enabled,
+  }))
+
+  return { actor }
+}

package/app/composables/useWorkspaceAccess.ts

@@ -16,7 +16,7 @@ import type { WorkspacePermission, WorkspaceRole } from '~/types/domain'
  * SPA never hides an affordance the backend would have permitted.
  *
  * This is deliberately distinct from the ACCOUNT-scoped admin checks
- * (`accounts.activeAccount?.roles?.includes('admin')`), which stay account-scoped: this
+ * (`accounts.isActiveAccountAdmin`), which stay account-scoped: this
  * composable answers "what can you do inside THIS board", the account check answers "what
  * can you do to the tenant".
  */

package/app/modular/nav-gates.ts

@@ -75,7 +75,6 @@ export function createNavGates(): NavGates {
       providerConnections.isAvailable('runner-pool') ||
       providerConnections.isAvailable('environment'),
   )
-  const isAccountAdmin = computed(() => accounts.activeAccount?.roles?.includes('admin') ?? false)
 
   return {
     get canWriteBoard() {
@@ -105,7 +104,7 @@ export function createNavGates(): NavGates {
       return accounts.enabled
     },
     get isAccountAdmin() {
-      return isAccountAdmin.value
+      return accounts.isActiveAccountAdmin
     },
     get advancedMode() {
       return uiMode.isAdvanced

package/app/stores/accounts.ts

@@ -35,6 +35,13 @@ export const useAccountsStore = defineStore(
     )
     /** Whether accounts exist (auth on); gates the switcher UI. */
     const enabled = computed(() => accounts.value.length > 0)
+    /**
+     * Whether the caller is an admin of the ACTIVE account. The one reading of it, so the nav gates,
+     * the setup prompts and the account panels cannot disagree about who the account admin is.
+     */
+    const isActiveAccountAdmin = computed(
+      () => activeAccount.value?.roles?.includes('admin') ?? false,
+    )
 
     /** Load the user's accounts and resolve the active one (persisted or first). */
     async function load() {
@@ -209,6 +216,7 @@ export const useAccountsStore = defineStore(
       activeAccountId,
       activeAccount,
       enabled,
+      isActiveAccountAdmin,
       ready,
       members,
       invitations,

package/app/stores/workspace/infraSetup.ts

@@ -1,6 +1,6 @@
 import { ref } from 'vue'
 import { applyInfraSetupTransition, isInfraSetupHealthStatus } from '@cat-factory/contracts'
-import type { InfraSetup, InfraSetupArea, InfraSetupStatus } from '~/types/domain'
+import type { InfraSetup, InfraSetupArea, InfraSetupOwners, InfraSetupStatus } from '~/types/domain'
 
 // The workspace store's infra-setup slice: the per-area setup/health projection the setup banner
 // renders, and the live `infraSetup` event patch the reachability watcher pushes into it. Its own
@@ -32,8 +32,16 @@ export function createInfraSetupState() {
    */
   const infraSetupDetails = ref<Partial<Record<InfraSetupArea, string>>>({})
 
-  function hydrate(next: InfraSetup | null | undefined) {
+  /**
+   * Who can close each area's gap (workspace admin, account admin or the operator), from the
+   * snapshot. Static for the life of a deployment, so the live event never touches it. Null on an
+   * older backend, which the banner reads as "owner unknown".
+   */
+  const infraSetupOwners = ref<InfraSetupOwners | null>(null)
+
+  function hydrate(next: InfraSetup | null | undefined, owners?: InfraSetupOwners | null) {
     infraSetup.value = next ?? null
+    infraSetupOwners.value = owners ?? null
     // The reasons belong to the live pushes this session observed, so an authoritative snapshot
     // supersedes them: keeping one would caption a freshly-read status with a stale probe.
     infraSetupDetails.value = {}
@@ -73,5 +81,5 @@ export function createInfraSetupState() {
     if (!isInfraSetupHealthStatus(status)) useUiStore().clearInfraSetupSessionDismissal(area)
   }
 
-  return { infraSetup, infraSetupDetails, hydrate, patchInfraSetup }
+  return { infraSetup, infraSetupDetails, infraSetupOwners, hydrate, patchInfraSetup }
 }

package/app/stores/workspace.ts

@@ -59,6 +59,7 @@ export const useWorkspaceStore = defineStore(
     const {
       infraSetup,
       infraSetupDetails,
+      infraSetupOwners,
       hydrate: hydrateInfraSetup,
       patchInfraSetup,
     } = createInfraSetupState()
@@ -98,7 +99,7 @@ export const useWorkspaceStore = defineStore(
       accountSpend.value = snapshot.accountSpend ?? null
       userSpend.value = snapshot.userSpend ?? null
       budgetCaps.value = snapshot.budgetCaps ?? null
-      hydrateInfraSetup(snapshot.infraSetup)
+      hydrateInfraSetup(snapshot.infraSetup, snapshot.infraSetupOwners)
       access.value = snapshot.access ?? null
       // Keep the board list in step (e.g. a freshly created board, or a rename). The
       // snapshot's `workspace` carries no `viewerRole` (that's a `GET /workspaces` list
@@ -241,6 +242,7 @@ export const useWorkspaceStore = defineStore(
       budgetCaps,
       infraSetup,
       infraSetupDetails,
+      infraSetupOwners,
       patchInfraSetup,
       access,
       init,

package/app/types/domain.ts

@@ -108,6 +108,8 @@ export type {
   InfraSetup,
   InfraSetupStatus,
   InfraSetupArea,
+  InfraSetupOwner,
+  InfraSetupOwners,
   ServiceFragmentDefaults,
   KaizenGradingStatus,
   KaizenGrading,

package/app/utils/setupAudience.spec.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import type { InfraSetup, InfraSetupOwners } from '~/types/domain'
+import { blockingSetupNotice, canActOnSetup, type SetupActor } from './setupAudience'
+
+const admin: SetupActor = {
+  fullSurface: true,
+  canManageIntegrations: true,
+  canExecuteRuns: true,
+  isAccountAdmin: false,
+  accountsEnabled: true,
+}
+const member: SetupActor = { ...admin, canManageIntegrations: false }
+const viewer: SetupActor = { ...member, canExecuteRuns: false }
+const designerAdmin: SetupActor = { ...admin, fullSurface: false }
+const designerMember: SetupActor = { ...member, fullSurface: false }
+
+const owners: InfraSetupOwners = {
+  agentExecutor: 'workspace_admin',
+  ephemeralEnvironments: 'workspace_admin',
+  binaryStorage: 'account_admin',
+}
+
+function status(patch: Partial<InfraSetup>): InfraSetup {
+  return {
+    agentExecutor: 'configured',
+    ephemeralEnvironments: 'configured',
+    binaryStorage: 'configured',
+    ...patch,
+  }
+}
+
+const noRunner = status({ agentExecutor: 'not_defined' })
+
+describe('canActOnSetup', () => {
+  it('lets a workspace admin act on the workspace areas, and not a member', () => {
+    expect(canActOnSetup('workspace_admin', admin)).toBe(true)
+    expect(canActOnSetup('workspace_admin', member)).toBe(false)
+  })
+
+  it('keeps every prompt off the designer surface, whatever the permissions', () => {
+    expect(canActOnSetup('workspace_admin', designerAdmin)).toBe(false)
+    expect(canActOnSetup('account_admin', { ...designerAdmin, isAccountAdmin: true })).toBe(false)
+  })
+
+  it('gives an account-owned gap to the account admin, not to a workspace admin', () => {
+    expect(canActOnSetup('account_admin', admin)).toBe(false)
+    expect(canActOnSetup('account_admin', { ...member, isAccountAdmin: true })).toBe(true)
+  })
+
+  it('lets the single user act on an account-owned gap when there are no accounts', () => {
+    expect(canActOnSetup('account_admin', { ...admin, accountsEnabled: false })).toBe(true)
+  })
+
+  it('lets nobody act on an operator-owned gap', () => {
+    expect(canActOnSetup('operator', { ...admin, isAccountAdmin: true })).toBe(false)
+  })
+
+  it('falls back to the workspace admin for an absent owner or one this build does not know', () => {
+    // An older backend sends nothing; a newer one may send a value past the compiled union. Both
+    // read as the workspace admin, and neither throws inside the banner's render.
+    for (const owner of [undefined, 'board_owner']) {
+      expect(canActOnSetup(owner, admin)).toBe(true)
+      expect(canActOnSetup(owner, member)).toBe(false)
+    }
+  })
+})
+
+describe('blockingSetupNotice', () => {
+  it('tells a member that agents cannot run, and who can fix it', () => {
+    expect(blockingSetupNotice(noRunner, owners, member)).toEqual({
+      area: 'agentExecutor',
+      kind: 'setup',
+      remedy: 'workspace_admin',
+    })
+  })
+
+  it('reports an executor outage as an outage', () => {
+    expect(
+      blockingSetupNotice(status({ agentExecutor: 'unreachable' }), owners, member)?.kind,
+    ).toBe('outage')
+  })
+
+  it('says nothing to the admin, who gets the full card instead', () => {
+    expect(blockingSetupNotice(noRunner, owners, admin)).toBeNull()
+  })
+
+  it('says nothing to a viewer, whose work the gap does not stop', () => {
+    expect(blockingSetupNotice(noRunner, owners, viewer)).toBeNull()
+  })
+
+  it('tells an admin on the designer surface to switch surface, not to find an admin', () => {
+    expect(blockingSetupNotice(noRunner, owners, designerAdmin)?.remedy).toBe('full_surface')
+    // A designer without the grant is still pointed at the owner.
+    expect(blockingSetupNotice(noRunner, owners, designerMember)?.remedy).toBe('workspace_admin')
+  })
+
+  it('says nothing about gaps that only degrade some runs', () => {
+    const optional = status({ ephemeralEnvironments: 'not_defined', binaryStorage: 'not_defined' })
+    expect(blockingSetupNotice(optional, owners, member)).toBeNull()
+  })
+
+  it('says nothing when the executor is configured or not used here', () => {
+    expect(blockingSetupNotice(status({}), owners, member)).toBeNull()
+    expect(
+      blockingSetupNotice(status({ agentExecutor: 'not_applicable' }), owners, member),
+    ).toBeNull()
+    expect(blockingSetupNotice(null, owners, member)).toBeNull()
+  })
+
+  it('names the workspace admin when the backend reports no owner, or one it does not know', () => {
+    expect(blockingSetupNotice(noRunner, null, member)?.remedy).toBe('workspace_admin')
+    const unknown = { ...owners, agentExecutor: 'board_owner' } as unknown as InfraSetupOwners
+    expect(blockingSetupNotice(noRunner, unknown, member)?.remedy).toBe('workspace_admin')
+  })
+})