* feat(flea): phase-1 — title, tagline, synthetic_name columns + upload UX
Schema v49 adds three user-facing metadata columns to store_entities:
- title (NOT NULL) — humanized display name shown on marketplace
surfaces in later phases. Acronym-aware humanizer in
src/store_naming.py (27 entries: MCP, API, OAuth, S3, …) shared
with the frontend via Jinja-injected dict so JS pre-fill and
Python backfill produce identical output.
- tagline (NULL, ≤200 chars) — optional short description for card
listings. Long-form `description` stays.
- synthetic_name (NOT NULL) — deterministic `<name>-by-<owner_username>`
stored as a column for indexing and as the single source of truth
for attribution lookups in later phases. Today's bundle bake still
uses suffixed_name() at the same call sites.
Migration (_v48_to_v49_migrate, Python function — humanize has no
SQL equivalent) backfills existing rows: title from
humanize_name(strip_archive_suffix(name)), synthetic from the concat
formula; tagline stays NULL. Idempotent (ADD COLUMN IF NOT EXISTS +
SET NOT NULL no-op on re-run).
Upload form (store_upload.html step 2) reorders fields: Title
(pre-filled from server-side humanize, JS keeps it in sync until
the user edits manually) → Name + dark synthetic preview on one
row (matches marketplace_item_detail.html dark code styling, no
copy button — preview only) → Short description with character
counter → Description (unchanged). Edit form (store_edit.html)
mirrors the layout with pre-filled values from the entity row.
API:
- POST /api/store/entities/preview returns `title` (humanized
fallback) for upload form pre-fill.
- POST + PUT /api/store/entities accept `title` and `tagline` form
fields with 100/200-char validation; PUT recomputes
synthetic_name when `name` changes (caller responsibility per
repo contract).
- StoreEntityResponse exposes all three new fields.
Repository:
- create() takes title + tagline + synthetic_name as optional
kwargs with derived defaults (humanize_name(name) / concat) so
existing test fixtures don't need to thread them.
- update() supports partial updates on all three; tagline empty
string clears via NULL sentinel.
- archive() recomputes synthetic_name on rename to the archived
slug so the column stays consistent with name.
Tests:
- New test_schema_v48_to_v49_migration.py: fresh install,
populated-row backfill (incl. archived row strip), idempotence,
NOT NULL constraint verification.
- test_store_naming.py: 14 humanize parametrize cases + acronym
dict invariants.
- test_store_api.py::TestStoreV49Metadata: preview humanize, POST
with explicit + fallback title, 100/200-char rejects, PUT
partial update + synthetic recompute on rename.
- Schema version assertion bumps (48 → 49) in test_db_schema_version,
test_home_stats, test_schema_v42_migration, test_schema_v46_migration.
Phase 1 only — surface rendering on cards / detail pages and
Claude Code bundle propagation come in later phases.
* feat(flea): phase-2 — wire title/tagline/owner through marketplace cards + detail pages
Phase 1 (7f4cfcbb) populated the three new columns on store_entities;
phase 2 surfaces them across the web presentation layer so the kebab-
case slug + bare username no longer leak into user-facing copy.
API:
- `_flea_to_item` now takes `conn` (both callsites updated) and sets
`display_name=entity.title`, `tagline=entity.tagline`, `owner=
_resolve_owner_display(conn, owner_user_id, owner_username)` —
matches the chain the curated path already uses (users.name →
users.email → fallback). The card JS chain `it.display_name ||
it.name` then renders the friendly form; `name` stays at the
suffixed slug as the technical identifier JS uses for fallbacks.
- `flea_detail` adds `display_name` + `tagline` to PluginDetailResponse
so the standalone skill/agent + plugin detail heroes pick them up
through the existing `d.display_name` / `d.tagline` chains.
- `_flea_inner_parent_fields` swaps `parent_display_name` from
`strip_archive_suffix(name)` to `entity.title or strip_archive_suffix(
name)`. Drives parent-plugin label in four surfaces at once:
breadcrumb 3rd segment, hero "part of <plugin>" meta-row,
helper "This skill is part of <plugin>" panel, and the Details
sidebar's "Parent plugin" row.
Templates — `marketplace_item_detail.html`:
- Pre-render: browser title, hero h1, and hero-window-label read
`(entity.title if entity else None) or inner_name or item_name or
plugin_name` so the SSR shell shows the friendly title before the
JS fetch lands (no flash of kebab-case).
- Breadcrumb last segment for flea standalone drops the `d.manifest_name
|| heroTitle` fallback in favour of just `heroTitle` — manifest_name
is the suffixed slug and users explicitly didn't want it in the path.
- Hero meta-row for flea standalone is now hidden. The prior "by
<author> · N installed · <size>" line duplicated install count
(hero telemetry chip below), owner + bundle size (Details sidebar).
Templates — `marketplace_plugin_detail.html`:
- Same SSR pre-render swap (title, h1, window-label, crumb-name).
- Hero tagline element starts hidden; JS shows it only when
`d.tagline` is truthy. Pre-fix it fell back to `d.description`
(long-form text), which read awkwardly under the h1 and pulled the
hero too tall. Description still renders in the "What it does"
panel below the hero.
- Initial "Loading…" placeholder removed so entities without a
tagline don't flash that text mid-fetch.
Tests:
- New `TestFleaPhase2Presentation` class in test_marketplace_api.py
(6 cases): card title + tagline + full-name owner, owner fallback
chain when users.name is NULL, flea_detail exposes title + tagline,
tagline null when omitted, inner skill parent_display_name uses
entity.title (explicit + humanize-fallback variants).
- Updated `TestListItems.test_flea_lists_uploads` to assert both
`display_name == "Alpha"` (humanized) and `name ==
"alpha-by-alice"` (suffixed slug compat).
- Updated `TestWebPages.test_marketplace_flea_detail_page_renders`
to look for the humanized title ("Page Skill") in the SSR shell
instead of the kebab-case `page-skill`.
* feat(flea): phase-3 — read synthetic_name from DB, suffixed_name() only on write
Phase 1 added the column + backfill, repo write paths keep it in sync.
Phase 3 routes every READ callsite through `store_entities.synthetic_name`
directly instead of recomputing `<name>-by-<owner_username>` on the fly,
and switches the collision query off the inline string concat. The
`suffixed_name()` primitive now lives exclusively in write flows.
Read callsites updated (all read `entity["synthetic_name"]` directly,
no fallback — the column is NOT NULL and a missing value would be a
real bug worth surfacing as KeyError):
- app/api/marketplace.py:_flea_to_item — card MarketplaceItem.name.
- app/api/marketplace.py:flea_detail — PluginDetailResponse.manifest_name.
- app/api/store.py:_entity_to_response — StoreEntityResponse.invocation_name.
- app/api/store.py PUT bundle re-bake — `suffixed` passed to
`_bake_plugin_tree`; entity is loaded pre-rename, so its
synthetic_name is the OLD value `_bake_plugin_tree` expects.
- app/api/store.py PUT rename — `old_suffix` for `_rename_baked_tree`.
- app/api/my_stack.py — StoreInstallEntry.invocation_name.
- src/marketplace_filter.py — manifest_name in served plugin entry.
`suffixed_name` imports removed from marketplace.py, my_stack.py, and
marketplace_filter.py (no remaining callsites). store.py keeps the
import for its write paths:
- POST create (`suffixed = suffixed_name(final_name, username)` →
passed to `_bake_plugin_tree` and `repo.create(synthetic_name=...)`).
- PUT rename collision check (`new_suffixed`).
- PUT rename `new_suffix` for `_rename_baked_tree` (proposed value).
- PUT rename `new_synthetic` for `repo.update(synthetic_name=...)`.
- Archive `old_suffix` + `new_suffix` for `_rename_baked_tree`
(retro-compute pre-archive value after `repo.archive` already
overwrote the DB row with the post-archive synthetic).
Collision SQL — `_suffixed_already_taken`:
WHERE name || '-by-' || owner_username = ? (before)
WHERE synthetic_name = ? (after)
Same matches today (phase 1 backfill + NOT NULL invariant + write
paths in sync); indexable + single source of truth going forward.
Repository:
- UserStoreInstallsRepository.list_for_user explicit SELECT extended
with `se.title`, `se.tagline`, `se.synthetic_name` so my_stack and
marketplace_filter callers can read them off the joined row.
Tests:
- test_store_api.py::test_invocation_name_reads_from_synthetic_column —
upload entity, manually override the column with a non-canonical
value, verify GET response returns the override (proves read path
consumes the column, not recomputes).
- test_marketplace_api.py::test_flea_card_and_detail_read_synthetic_name_from_db —
same proof for `MarketplaceItem.name` (card) and
`PluginDetailResponse.manifest_name` (detail).
* feat(flea): phase-4 — rename agnes-store-bundle → flea (synthetic plugin)
The synthetic plugin that wraps loose flea-market skills + agents into
one Claude Code plugin is renamed from `agnes-store-bundle` to `flea`.
Plugin-type flea uploads (their own standalone plugin entry) are
unaffected.
Constants:
- src/marketplace_filter.py:
- BUNDLE_PLUGIN_NAME: "agnes-store-bundle" → "flea" (Claude Code
plugin manifest name + .claude-plugin/plugin.json name)
- BUNDLE_PREFIXED_NAME: "store-bundle" → "flea" (on-disk ZIP /
git tree path, now plugins/flea/...)
Attribution layer (services/session_processors/usage_lib.py):
- FLEA_BUNDLE_PREFIX: "agnes-store-bundle" → "flea". The JSONL
invocation identifier going forward is `flea:<skill-name>`.
- New `_LEGACY_FLEA_BUNDLE_PREFIXES = ("agnes-store-bundle",)`.
`MarketplaceItemLookup.resolve()` + `_attribute_event()` accept BOTH
the new and the legacy prefix so historic usage_events (~90-day
retention) continue attributing to source='flea'. The tuple becomes
a no-op once the rename has been live past the retention window —
a follow-up commit can drop it then.
- USAGE_PROCESSOR_VERSION bumped 6 → 7 so the session-pipeline reprocess
loop re-runs attribution with the new + legacy prefix branches.
User-facing copy:
- /api/store/bundle.zip Content-Disposition filename: agnes-store-bundle.zip → flea.zip
- `agnes admin store pull` default --out: agnes-store-bundle.zip → flea.zip
- Docstrings + JS comment + welcome template comment updated.
Tests:
- skill_flea.jsonl fixture identifier updated to flea:flea-skill.
- New skill_flea_legacy.jsonl with the legacy prefix for backward-compat
coverage.
- New test `test_legacy_agnes_store_bundle_prefix_resolves` replays the
legacy fixture and asserts source='flea' attribution still lands.
- All other test assertions / mocks substituted mechanically:
test_session_processor_usage.py, test_usage_rollups.py,
test_marketplace_filter_store.py, test_store_api.py,
test_cli_refresh_marketplace.py.
- `_seed_flea_entity` (test_usage_rollups.py) + `_seed_attribution`
(test_session_processor_usage.py) helpers now supply the NOT NULL
`title` + `synthetic_name` columns from phase 1, since they INSERT
directly bypassing the repo's create() fallback.
Client rollover note (CHANGELOG): `agnes refresh-marketplace` will
install the new `flea@agnes` plugin and the local marketplace clone's
`plugins/store-bundle/` source folder is removed via `git reset --hard`.
Whether Claude Code itself auto-prunes the orphan `agnes-store-bundle
@agnes` registry entry is undocumented — to verify empirically on the
dev VM. If the orphan entry lingers, a follow-up will add targeted
cleanup; until then users can manually run
`claude plugin uninstall agnes-store-bundle@agnes`.
Verified locally: 98 passed (session_processor_usage + usage_rollups +
marketplace_filter_store + cli_refresh_marketplace) + 228 passed/2
skipped (store_api + marketplace_api + admin_store_submissions +
store_entity_versions + store_repositories).
* fix(flea): phase-5 — attribution keyspace mismatch (closes #335)
Pre-fix every flea skill/agent invocation silently fell through to
`usage_events.source = 'builtin'`. Root cause: lookup tables in
`services/session_processors/usage_lib.py` keyed `_flea_entities` (and
the derived `_flea_plugins` set) by `store_entities.name` — the
un-suffixed display name. Claude Code writes invocations as
`flea:<synthetic_name>` (e.g. `flea:xlsx-by-c-marustamyan`), so
`dict.get(local)` always missed and the resolver fell through to
builtin. Result: marketplace cards, detail telemetry chips, admin
group-by-source all showed 0 flea invocations even when the raw
JSONL stream was correct.
Phase 1 added the `synthetic_name` column + backfill; phase 4 renamed
the bundle prefix to `flea`; phase 5 finally flips the lookup
keyspace to match what JSONL writes.
usage_lib.py:
- `MarketplaceItemLookup.__init__` preload: `SELECT synthetic_name,
type FROM store_entities` (was `SELECT name, type`). `_flea_plugins`
set derived from those keys, so it now carries synthetic_names
too — matches what Claude Code writes when invoking a skill nested
inside a flea plugin (`<synthetic>:<inner>`).
- `rebuild_rollups` preload: same SELECT change; also derives
`flea_plugins` and threads it through `_aggregate_events` /
`_rebuild_window`.
- `_attribute_event`: signature extended with `flea_plugins`; new
branch `if prefix in flea_plugins: return ("flea", default_type,
prefix, local)` for flea-plugin-nested skills/agents. This branch
was added to `MarketplaceItemLookup.resolve()` in v6 (commit
e076ebbe) but the rollup builder's helper was never updated to
match, so nested skills inside flea plugins silently dropped out
of the daily/window fact tables.
- `USAGE_PROCESSOR_VERSION`: 7 → 8. Forces the session-pipeline
reprocess loop to re-attribute existing usage_events rows with
the corrected lookup so rollup tables fill correctly on the next
tick.
marketplace.py — 4 API stats lookup callsites switched from
`entity["name"]` to `entity["synthetic_name"]`:
- `_flea_to_item` (card stats lookup)
- `flea_detail` (`_build_telemetry` + `_load_inner_items_stats_by_parent`)
- `flea_skill_detail` (inner detail `parent_plugin` key)
- `flea_agent_detail` (inner detail `parent_plugin` key)
Tests:
- `skill_flea.jsonl` invocation: `flea:flea-skill` →
`flea:flea-skill-by-alice` (mirrors what Claude Code writes after
phase 1/4 — the suffixed synthetic_name).
- `test_flea_skill_attributed_with_empty_parent` assertion: rollup
`name` column now carries the synthetic_name.
No legacy `agnes-store-bundle` prefix backward compat — clean cut per
user direction (dev phase, no production data worth preserving).
Verified locally: 53 passed targeted (session_processor_usage +
usage_rollups + marketplace_filter_store) + 215 passed/2 skipped
broader (store_api + marketplace_api + admin_store_submissions +
store_entity_versions).
* fix(flea): phase-6 — plugin-level rollup aggregation parity for flea
Flea plugin entity cards + detail pages showed 0 invocations even
though nested skills had correct rollup rows. Root cause: the
plugin-level aggregation pass in `_aggregate_events` was hardcoded
to `source='curated'` only:
if source != "curated" or not parent:
continue
if group_by_day:
pkey = (day, "curated", "plugin", "", parent)
else:
pkey = ("curated", "plugin", "", parent)
So flea plugin entities never got a synthetic
`(source='flea', type='plugin', parent_plugin='', name=<synth>)`
row aggregating nested invocations. `_load_invocation_stats('flea')`
filters `parent_plugin = ''` and returned no row for flea plugin
entity cards, so `stats.get(entity["synthetic_name"])` missed and
the API exposed 0/0.
Triggered by empirical observation on the dev VM —
`codex-second-opinion-by-c-marustamyan` plugin showed 0 calls in
the listing card while its three inner skills (codex-setup ×3,
codex-review ×1, codex-second-opinion ×1) had the expected child
rollup rows.
Fix:
- Extend the guard to `source in ("curated", "flea")`.
- Replace the hardcoded `"curated"` in the `pkey` tuple with the
loop's `source` variable, so flea aggregation lands as `source=
'flea'` and curated aggregation continues landing as
`source='curated'`.
API path unchanged — `_load_invocation_stats('flea')` filters
`parent_plugin = ''` already picks up the new aggregated row
alongside standalone skill/agent rows. Rollup `name` field carries
the synthetic_name keyspace; no collision between standalone entity
synthetic and plugin entity synthetic (global suffix uniqueness
enforced by `_suffixed_already_taken`).
`USAGE_PROCESSOR_VERSION` bumped 8 → 9 to force a reprocess pass so
historic nested-invocation data fills the new plugin-level rows on
the next tick (instead of waiting for the next live invocation).
Tests:
- New `test_flea_plugin_row_aggregates_children` mirrors the existing
`test_curated_plugin_row_aggregates_children`: seeds a flea plugin
entity, three nested events (one user invoking two skills, a
second user invoking one) → asserts the aggregated plugin row
carries count=3, distinct_users=2 (union, not sum), plus the child
rows survive alongside.
Verified locally: 43 passed (session_processor_usage + usage_rollups)
+ 82 passed/2 skipped broader (+ marketplace_filter_store +
marketplace_api).
* refactor(marketplace): phase-7 — unify Details sidebar across detail surfaces
Five marketplace detail surfaces (curated plugin, flea plugin, curated
inner skill/agent, flea inner skill/agent, flea standalone skill/agent)
had drifted on which Details rows they show and what order — the same
field landed in different positions, some fields duplicated hero info,
and the flea plugin Owner row leaked the kebab-case `owner_username`
slug instead of the user's real name. This commit aligns all five
surfaces on a single scan order driven by UX priority:
identity → life-stage → telemetry → debug-tier
Concretely:
1. Curator / Owner (first scan signal — trust)
2. Parent plugin (inner skill/agent only)
3. Released (top-level only — plugins + flea standalone)
4. Last used (recency)
5. Active days (engagement consistency)
6. Version (flea standalone only — content hash)
7. Bundle size (debug-tier)
Dropped:
- Slug field on plugin detail surfaces (`marketplace_id` for curated,
`entity_id` for flea). Pure debug info, never user-relevant; URL
already carries it.
- Category + Installs on flea standalone skill/agent detail.
Category is already shown as a hero badge; install count is in
the hero telemetry chip — sidebar duplication added noise.
Owner display:
- Flea plugin Owner row now reads `d.owner_display` (resolved through
`users.name → users.email → owner_username` by `_resolve_owner_display`
in `app/api/marketplace.py:1491`) instead of the raw `d.author_name`
(which is `owner_username`, the kebab-case slug). API field already
populated from phase 2; templates just consume it.
- Curated Curator row continues to read `d.author_name` from
marketplace-metadata.json; `owner_todo` placeholder behavior
preserved.
Files:
- app/web/templates/marketplace_plugin_detail.html — rewrote the
Details render loop (lines 1364-1427 area). Slug row removed,
rows reordered, Owner branch reads `d.owner_display`.
- app/web/templates/marketplace_item_detail.html — both branches of
the Details sidebar (inner skill/agent + flea standalone) re-laid
around the same scan order. Telemetry helper unchanged, just
repositioned. Category + Installs rows removed from the
standalone branch.
No new tests — no existing test asserts the precise order of Details
rows or references the dropped fields in a sidebar context (grep
confirmed). API surface unchanged.
Verified locally: 84 passed / 2 skipped on `test_marketplace_api.py`
+ `test_store_api.py`.
* fix(flea): post-review hardening — N+1, v50 UNIQUE, docs, test cleanup
Addresses 5 critical findings from PR #342 code review:
1. N+1 query in `_flea_to_item` — owner-display resolution previously
ran one `SELECT … FROM users WHERE id = ?` per item in the listing
comprehension. Now batched via `_load_users_display` IN-query
prefetch; 50 items drops 51 user queries to 2. Regression-guarded
by `TestFleaOwnerDisplayBatched` (spies `_resolve_owner_display`
and asserts it's not called inside the list path).
2. Misleading comment in `src/marketplace_filter.py` claimed the
attribution layer accepts both `agnes-store-bundle` and `flea`
prefixes — it doesn't (clean cut per CHANGELOG). Rewrote to match
reality.
3. CHANGELOG `[Unreleased]` had two `### Changed` blocks. Merged into
one (BREAKING bullet first).
4. New v49→v50 migration adds `UNIQUE INDEX
idx_store_entities_synthetic_name`. v49 made `synthetic_name` the
canonical attribution key but uniqueness was only app-enforced;
v50 promotes the invariant to the DB layer. Migration pre-checks
for existing duplicates and raises `RuntimeError` listing them
rather than letting `CREATE UNIQUE INDEX` fail mid-way. v48→v49
migration gained an `is_nullable='YES'` guard on its `SET NOT NULL`
ALTERs so re-runs on a fully-migrated DB don't trip DuckDB's
"cannot alter entry … entries depend on it" block (the new index
counts as such an entry). Index is created by the migration only —
keeping it out of `_SYSTEM_SCHEMA` preserves fresh-install ordering
(CREATE TABLE → v49 ALTERs → v50 CREATE INDEX).
5. Deleted three redundant version-pinned schema asserts whose names
lied about their bodies (`test_schema_version_is_42` asserting
`== 49`, etc.). Canonical assert lives in
`test_db_schema_version.py`, renamed to
`test_schema_version_matches_constant`.
* fix(db): gate v34→v38 store_entities ALTER COLUMN steps on column state
CI on Linux failed `test_v17_to_v18_drops_*` after the v50 UNIQUE INDEX
landed. Root cause: those tests open a DB at the full target version,
seed fixtures, then reset `schema_version` to 17 and reopen — forcing
the ladder to re-run from 17 → current. With the v50 index now in place,
DuckDB blocks intermediate `ALTER COLUMN` steps on `store_entities`
("Cannot drop this column: an index depends on a column after it!" /
"Cannot alter entry because there are entries that depend on it"),
because `synthetic_name` (the indexed column) sits positionally after
the columns those steps touch.
Fix: convert the three SQL-list migrations that hit store_entities into
defensive Python functions:
- `_v34_to_v35_migrate` short-circuits when `synthetic_name` already
exists (post-v49 shape — the visibility_status rebuild is moot and
the DROP COLUMN would be blocked by the index).
- `_v35_to_v36_migrate` gates the `visibility_status SET NOT NULL` +
`SET DEFAULT` on `is_nullable='YES'` so it's a true no-op when the
column is already constrained.
- `_v37_to_v38_migrate` gates the `version_no SET NOT NULL` step the
same way.
Forward-roll path (real installs that never reset schema_version) is
unchanged: the gates fire `YES` → ALTERs run. The fix only changes
behavior for the "DB is already at v50 shape but version row says 17"
scenario the tests construct.
---------
Co-authored-by: Minas Arustamyan <arustamyan.minas@gmail.com>
438 lines
18 KiB
HTML
438 lines
18 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Edit {{ entity.name | store_display_name }} — {{ config.INSTANCE_NAME }}{% endblock %}
|
|
|
|
{% block content %}
|
|
<style>
|
|
.edit-back { font-size: 13px; color: var(--text-secondary, #6b7280); text-decoration: none; }
|
|
.edit-back:hover { color: var(--text, #111827); text-decoration: underline; }
|
|
|
|
h1.edit-title { margin: 8px 0 16px 0; font-size: 22px; font-weight: 600; }
|
|
.field { margin-bottom: 18px; }
|
|
.field-label {
|
|
display: block; font-size: 13px; font-weight: 500;
|
|
color: var(--text, #111827); margin-bottom: 6px;
|
|
}
|
|
.field-help {
|
|
font-size: 12px; color: var(--text-secondary, #6b7280); margin-top: 4px;
|
|
}
|
|
.field-help.warn { color: #92400e; }
|
|
|
|
input[type=text], textarea, select {
|
|
width: 100%; padding: 8px 10px;
|
|
border: 1px solid var(--border, #d1d5db); border-radius: 6px;
|
|
font-size: 14px; font-family: inherit;
|
|
background: var(--surface, #fff);
|
|
}
|
|
textarea { min-height: 80px; resize: vertical; }
|
|
|
|
.file-drop {
|
|
display: flex; align-items: center; gap: 12px;
|
|
padding: 16px; border-radius: 8px;
|
|
border: 2px dashed var(--border, #d1d5db); background: var(--surface-muted, #f9fafb);
|
|
cursor: pointer;
|
|
}
|
|
.file-drop input[type=file] { display: none; }
|
|
.file-drop:hover { border-color: var(--primary, #0073D1); background: #fff; }
|
|
.file-drop.is-dragover { border-color: var(--primary, #0073D1); background: #eff6ff; }
|
|
.file-drop .icon { font-size: 24px; }
|
|
.file-drop .file-info .label { font-size: 13px; font-weight: 500; }
|
|
.file-drop .file-info .meta { font-size: 12px; color: var(--text-secondary, #6b7280); }
|
|
.file-drop button {
|
|
margin-left: auto; padding: 6px 12px; border-radius: 6px;
|
|
border: 1px solid var(--border, #d1d5db); background: var(--surface, #fff);
|
|
font-size: 13px; cursor: pointer;
|
|
}
|
|
|
|
.actions { display: flex; gap: 8px; margin-top: 20px; align-items: center; }
|
|
|
|
.pending-banner {
|
|
margin: 12px 0 16px 0; padding: 14px 18px; border-radius: 10px;
|
|
background: #fef3c7; color: #92400e; border: 1px solid #fde68a; font-size: 14px;
|
|
}
|
|
.pending-banner h3 { margin: 0 0 6px 0; font-size: 15px; }
|
|
|
|
.banner {
|
|
padding: 12px 16px; border-radius: 8px; margin-bottom: 16px;
|
|
font-size: 13px; line-height: 1.5; display: flex; align-items: flex-start; gap: 10px;
|
|
}
|
|
/* `display: flex` above overrides the user-agent default rule for
|
|
[hidden] (display:none); force it back so the empty banner stays
|
|
out of the layout until showError() unhides it. */
|
|
.banner[hidden] { display: none !important; }
|
|
.banner.error { background: #fef2f2; color: #b91c1c; border: 1px solid #fecaca; }
|
|
.banner > span { white-space: pre-wrap; }
|
|
|
|
/* v49: matches the synthetic-name preview styling on store_upload.html
|
|
so upload + edit forms read identically. */
|
|
.name-row {
|
|
display: flex; align-items: stretch; gap: 10px; flex-wrap: wrap;
|
|
}
|
|
.name-row input[type=text] {
|
|
flex: 0 1 320px; min-width: 220px;
|
|
}
|
|
.invocation-preview {
|
|
flex: 1 1 320px; min-width: 0;
|
|
display: flex; align-items: center;
|
|
background: #1e1e2e; color: #cdd6f4;
|
|
border-radius: 6px; padding: 0 14px;
|
|
font-family: var(--font-mono, monospace); font-size: 13px;
|
|
overflow: hidden; white-space: nowrap; text-overflow: ellipsis;
|
|
}
|
|
.invocation-preview .prompt {
|
|
color: #a6e3a1; user-select: none; margin-right: 2px;
|
|
}
|
|
.invocation-preview #synthetic-text {
|
|
overflow: hidden; text-overflow: ellipsis;
|
|
}
|
|
</style>
|
|
|
|
<div class="page-shell">
|
|
<p style="margin: 8px 0;">
|
|
<a class="edit-back" href="/marketplace/flea/{{ entity.id }}">← Back to detail</a>
|
|
</p>
|
|
<h1 class="edit-title">Edit · {{ entity.type }} · {{ entity.name | store_display_name }}</h1>
|
|
|
|
{% if pending_sub %}
|
|
<div class="pending-banner">
|
|
<h3>⟳ A previous edit is still under review</h3>
|
|
<div>
|
|
Submission <code>{{ pending_sub.id[:8] }}</code> is being checked
|
|
({{ pending_sub.status }}). Edits are temporarily disabled until
|
|
the verdict lands. The detail page auto-refreshes when it does.
|
|
</div>
|
|
</div>
|
|
{% endif %}
|
|
|
|
<div id="banner" class="banner error" hidden>
|
|
<span class="ico">!</span><span id="banner-text"></span>
|
|
</div>
|
|
|
|
<form id="edit-form">
|
|
<div class="field">
|
|
<label class="field-label" for="f-title">Title</label>
|
|
<input id="f-title" name="title" type="text" maxlength="100" required
|
|
value="{{ entity.title or '' }}"
|
|
data-user-edited="{{ 'true' if entity.title else 'false' }}"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<div class="field-help">Human-friendly name shown on marketplace cards.</div>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-name">Display name</label>
|
|
<div class="name-row">
|
|
<input id="f-name" name="name" type="text" value="{{ entity.name | store_display_name }}"
|
|
pattern="^[a-z][a-z0-9-]{0,63}$"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<div class="invocation-preview" id="synthetic-preview" aria-live="polite">
|
|
<span class="prompt">/</span><span id="synthetic-text">{{ entity.synthetic_name or (entity.name ~ '-by-' ~ entity.owner_username) }}</span>
|
|
</div>
|
|
</div>
|
|
<div class="field-help warn">
|
|
⚠ Changing the name renames the plugin slug for existing
|
|
installers. They'll see the plugin renamed on their next sync
|
|
and may need to re-add it to their stack.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-tagline">Short description <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
|
|
<input id="f-tagline" name="tagline" type="text" maxlength="200"
|
|
value="{{ entity.tagline or '' }}"
|
|
placeholder="One-line summary shown alongside the entity name"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<div id="tagline-counter" class="field-help" style="font-family: var(--font-mono); font-size: 12px;">0 / 200 max</div>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-description">Description</label>
|
|
<textarea id="f-description" name="description" maxlength="1000"
|
|
{% if pending_sub %}disabled{% endif %}>{{ entity.description or "" }}</textarea>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-category">Category</label>
|
|
<select id="f-category" name="category"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<option value="">— none —</option>
|
|
{% for cat in categories %}
|
|
<option value="{{ cat }}" {% if cat == entity.category %}selected{% endif %}>{{ cat }}</option>
|
|
{% endfor %}
|
|
</select>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label" for="f-video">Video URL <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
|
|
<input id="f-video" name="video_url" type="text"
|
|
value="{{ entity.video_url or '' }}" placeholder="https://..."
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
</div>
|
|
|
|
<div class="field">
|
|
<label class="field-label">Cover photo</label>
|
|
<div class="file-drop" id="photo-drop">
|
|
<div class="icon">🖼</div>
|
|
<div class="file-info">
|
|
<div class="label" id="photo-label">
|
|
{% if entity.photo_path %}Replace existing photo{% else %}No photo{% endif %}
|
|
</div>
|
|
<div class="meta">JPG, PNG, WebP · Max 5 MB</div>
|
|
</div>
|
|
<input type="file" id="photo" accept="image/jpeg,image/png,image/webp"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<button type="button" id="photo-pick" {% if pending_sub %}disabled{% endif %}>Choose</button>
|
|
</div>
|
|
</div>
|
|
|
|
<hr style="border:none;border-top:1px solid var(--border-light, #e5e7eb); margin: 20px 0;">
|
|
|
|
<div class="field">
|
|
<label class="field-label">Upload new version <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
|
|
<div class="file-drop" id="zip-drop">
|
|
<div class="icon">📦</div>
|
|
<div class="file-info">
|
|
<div class="label" id="zip-label">No file selected</div>
|
|
<div class="meta" id="zip-meta">
|
|
Skip to update only the metadata above. Uploading creates
|
|
v{{ (entity.version_no or 1) + 1 }} and re-runs guardrails.
|
|
</div>
|
|
</div>
|
|
<input type="file" id="zip" accept=".zip"
|
|
{% if pending_sub %}disabled{% endif %}>
|
|
<button type="button" id="zip-pick" {% if pending_sub %}disabled{% endif %}>Choose file</button>
|
|
</div>
|
|
<div class="field-help">
|
|
Current version: <strong>v{{ entity.version_no or 1 }}</strong>
|
|
({{ entity.version[:12] if entity.version else "—" }}).
|
|
Prior versions remain on disk and can be restored from the
|
|
detail page's <em>Versions</em> section.
|
|
</div>
|
|
</div>
|
|
|
|
<div class="actions">
|
|
<button type="submit" class="btn btn-primary" id="save-btn"
|
|
{% if pending_sub %}disabled{% endif %}>Save</button>
|
|
<a href="/marketplace/flea/{{ entity.id }}" class="btn btn-secondary">Cancel</a>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
|
|
<script>
|
|
const ENTITY_ID = {{ entity.id|tojson }};
|
|
const banner = document.getElementById('banner');
|
|
const bannerText = document.getElementById('banner-text');
|
|
function showError(msg) {
|
|
banner.className = 'banner error';
|
|
bannerText.textContent = msg;
|
|
banner.hidden = false;
|
|
banner.scrollIntoView({behavior: 'smooth', block: 'start'});
|
|
}
|
|
function clearBanner() { banner.hidden = true; }
|
|
|
|
function humanizeError(detail) {
|
|
if (!detail) return 'Save failed.';
|
|
if (typeof detail === 'object') {
|
|
const code = detail.code || '';
|
|
const checks = detail.checks || {};
|
|
|
|
function appendFindings(lines, payload) {
|
|
const findings = (payload?.findings) || [];
|
|
for (const f of findings.slice(0, 5)) {
|
|
lines.push('• ' + (f.file || '?') + ':' + (f.line || '?') + ' — ' + (f.reason || f.category || ''));
|
|
}
|
|
if (findings.length > 5) lines.push(' …and ' + (findings.length - 5) + ' more.');
|
|
}
|
|
function appendManifest(lines, payload) {
|
|
const issues = (payload?.issues) || [];
|
|
for (const m of issues.slice(0, 5)) lines.push('• manifest: ' + m);
|
|
if (issues.length > 5) lines.push(' …and ' + (issues.length - 5) + ' more.');
|
|
}
|
|
function appendContent(lines, payload) {
|
|
const issues = (payload?.issues) || [];
|
|
for (const i of issues.slice(0, 5)) {
|
|
const where = i.component_type === 'submission'
|
|
? 'Description on the form'
|
|
: ((i.component_type || 'component') + (i.name ? ' — ' + i.name : ''));
|
|
const code = (i.code || '').replace(/_/g, ' ');
|
|
lines.push('• ' + where + ' — ' + (i.field || 'description') + ' ' + code);
|
|
}
|
|
if (issues.length > 5) lines.push(' …and ' + (issues.length - 5) + ' more.');
|
|
}
|
|
|
|
if (code === 'validation_failed') {
|
|
const lines = ['New version needs fixing before it can be saved.'];
|
|
appendManifest(lines, checks.manifest);
|
|
appendContent(lines, checks.content);
|
|
lines.push('');
|
|
lines.push('Fix the issues above and try again. The previous version is still live.');
|
|
return lines.join('\n');
|
|
}
|
|
if (code === 'security_blocked') {
|
|
const lines = ['Save blocked: security review found risky patterns in the new bundle.'];
|
|
appendFindings(lines, checks.static_security);
|
|
lines.push('');
|
|
lines.push('Remove the flagged code/secrets and try again. The previous version stays live.');
|
|
return lines.join('\n');
|
|
}
|
|
if (code === 'submission_blocked') {
|
|
// Legacy server response (pre-cutover) — kept for one release.
|
|
const lines = ['New version blocked by automated checks.'];
|
|
appendFindings(lines, checks.static_security);
|
|
appendManifest(lines, checks.manifest);
|
|
appendContent(lines, checks.content);
|
|
lines.push('');
|
|
lines.push('Fix the issues and re-upload, or open the detail page to see the full report.');
|
|
return lines.join('\n');
|
|
}
|
|
if (code === 'prior_version_pending') {
|
|
return 'A previous edit is still under review. Wait for the verdict before saving.';
|
|
}
|
|
if (code === 'type_locked') {
|
|
return 'Cannot change the entity type. Upload a new entity if you need a different form factor.';
|
|
}
|
|
if (code === 'conflict_owner_name') return 'You already have a plugin with that name.';
|
|
if (code === 'conflict_global_suffix') return 'That name conflicts with another user\'s plugin slug.';
|
|
if (code === 'invalid_name_format') return 'Name must be lowercase letters / digits / hyphens, starting with a letter.';
|
|
if (code === 'title_required') return 'Title is required.';
|
|
if (code === 'title_too_long') return 'Title is too long — max 100 characters.';
|
|
if (code === 'tagline_too_long') return 'Short description is too long — max 200 characters.';
|
|
if (code) return 'Save failed: ' + code;
|
|
try { return 'Save failed: ' + JSON.stringify(detail); } catch (_) { return 'Save failed.'; }
|
|
}
|
|
return 'Save failed: ' + String(detail);
|
|
}
|
|
|
|
// File picker wiring (no double-click bug — div, not label).
|
|
function wireDropZone(dropEl, fileInput, pickBtn, labelEl, validate) {
|
|
if (!dropEl) return;
|
|
pickBtn.addEventListener('click', (e) => {
|
|
e.stopPropagation();
|
|
fileInput.click();
|
|
});
|
|
dropEl.addEventListener('click', (e) => {
|
|
if (e.target.tagName !== 'BUTTON') fileInput.click();
|
|
});
|
|
fileInput.addEventListener('change', () => {
|
|
const f = fileInput.files[0];
|
|
if (!f) return;
|
|
const err = validate ? validate(f) : null;
|
|
if (err) { showError(err); fileInput.value = ''; return; }
|
|
if (labelEl) labelEl.textContent = f.name + ' (' + Math.round(f.size / 1024) + ' KB)';
|
|
dropEl.classList.add('is-dragover');
|
|
});
|
|
}
|
|
|
|
wireDropZone(
|
|
document.getElementById('zip-drop'),
|
|
document.getElementById('zip'),
|
|
document.getElementById('zip-pick'),
|
|
document.getElementById('zip-label'),
|
|
(f) => f.size > 50 * 1024 * 1024 ? 'ZIP too large (max 50 MB).' : null,
|
|
);
|
|
wireDropZone(
|
|
document.getElementById('photo-drop'),
|
|
document.getElementById('photo'),
|
|
document.getElementById('photo-pick'),
|
|
document.getElementById('photo-label'),
|
|
(f) => f.size > 5 * 1024 * 1024 ? 'Photo too large (max 5 MB).' : null,
|
|
);
|
|
|
|
// v49 phase-1 — Title, Tagline, synthetic preview wiring (mirrors
|
|
// store_upload.html). Acronym dict + owner injected via template ctx.
|
|
const TITLE_ACRONYMS = {{ title_acronyms|tojson if title_acronyms else "{}" }};
|
|
const OWNER_USERNAME = {{ owner_username|tojson if owner_username else '""' }};
|
|
const titleInput = document.getElementById('f-title');
|
|
const taglineInput = document.getElementById('f-tagline');
|
|
const taglineCounter = document.getElementById('tagline-counter');
|
|
const fNameInput = document.getElementById('f-name');
|
|
const syntheticText = document.getElementById('synthetic-text');
|
|
|
|
function humanizeName(name) {
|
|
if (!name) return '';
|
|
const tokens = String(name).split('-').filter(Boolean);
|
|
return tokens.map(tok => {
|
|
const canonical = TITLE_ACRONYMS[tok.toLowerCase()];
|
|
if (canonical !== undefined) return canonical;
|
|
return tok.charAt(0).toUpperCase() + tok.slice(1).toLowerCase();
|
|
}).join(' ');
|
|
}
|
|
function updateSyntheticPreview() {
|
|
const name = (fNameInput.value || '').trim();
|
|
if (!name) {
|
|
syntheticText.textContent = 'your-name-by-' + (OWNER_USERNAME || 'you');
|
|
} else {
|
|
syntheticText.textContent = name + '-by-' + (OWNER_USERNAME || 'you');
|
|
}
|
|
}
|
|
function maybeAutoFillTitle() {
|
|
if (titleInput.dataset.userEdited === 'true') return;
|
|
const name = (fNameInput.value || '').trim();
|
|
titleInput.value = humanizeName(name);
|
|
}
|
|
function updateTaglineCounter() {
|
|
const len = (taglineInput.value || '').length;
|
|
taglineCounter.textContent = `${len} / 200 max`;
|
|
}
|
|
titleInput.addEventListener('input', () => {
|
|
titleInput.dataset.userEdited = titleInput.value.trim() ? 'true' : 'false';
|
|
});
|
|
fNameInput.addEventListener('input', () => {
|
|
updateSyntheticPreview();
|
|
maybeAutoFillTitle();
|
|
});
|
|
taglineInput.addEventListener('input', updateTaglineCounter);
|
|
updateSyntheticPreview();
|
|
updateTaglineCounter();
|
|
|
|
document.getElementById('edit-form').addEventListener('submit', async (e) => {
|
|
e.preventDefault();
|
|
clearBanner();
|
|
const saveBtn = document.getElementById('save-btn');
|
|
saveBtn.disabled = true;
|
|
saveBtn.textContent = 'Saving…';
|
|
try {
|
|
const fd = new FormData();
|
|
const name = document.getElementById('f-name').value.trim();
|
|
if (name) fd.append('name', name);
|
|
fd.append('description', document.getElementById('f-description').value);
|
|
fd.append('category', document.getElementById('f-category').value);
|
|
fd.append('video_url', document.getElementById('f-video').value);
|
|
// v49: title is required when present; always send so server can
|
|
// detect "no change" (same value) vs "user-cleared". Tagline sends
|
|
// empty string to clear.
|
|
const titleVal = titleInput.value.trim();
|
|
if (!titleVal) { showError('Title is required.'); saveBtn.disabled = false; saveBtn.textContent = 'Save'; return; }
|
|
fd.append('title', titleVal);
|
|
fd.append('tagline', taglineInput.value.trim());
|
|
const zip = document.getElementById('zip').files[0];
|
|
if (zip) fd.append('file', zip);
|
|
const photo = document.getElementById('photo').files[0];
|
|
if (photo) fd.append('photo', photo);
|
|
|
|
const r = await fetch(`/api/store/entities/${ENTITY_ID}`, {
|
|
method: 'PUT', body: fd, credentials: 'same-origin',
|
|
});
|
|
if (r.ok) {
|
|
window.location = `/marketplace/flea/${ENTITY_ID}`;
|
|
return;
|
|
}
|
|
let msg = 'Save failed.';
|
|
try {
|
|
const j = await r.json();
|
|
const eid = j?.detail?.entity_id;
|
|
if (eid && j.detail.code === 'submission_blocked') {
|
|
// Land on detail to see the banner.
|
|
window.location = `/marketplace/flea/${eid}`;
|
|
return;
|
|
}
|
|
if (j.detail) msg = humanizeError(j.detail);
|
|
} catch (_) {}
|
|
showError(msg);
|
|
} catch (err) {
|
|
showError(String(err));
|
|
} finally {
|
|
saveBtn.disabled = false;
|
|
saveBtn.textContent = 'Save';
|
|
}
|
|
});
|
|
</script>
|
|
{% endblock %}
|