agnes-the-ai-analyst/app/web/templates/store_edit.html
minasarustamyan c6c72b9c00
feat(flea): marketplace refactor — data model, attribution, UI unification (#342)
* feat(flea): phase-1 — title, tagline, synthetic_name columns + upload UX

Schema v49 adds three user-facing metadata columns to store_entities:

- title (NOT NULL) — humanized display name shown on marketplace
  surfaces in later phases. Acronym-aware humanizer in
  src/store_naming.py (27 entries: MCP, API, OAuth, S3, …) shared
  with the frontend via Jinja-injected dict so JS pre-fill and
  Python backfill produce identical output.
- tagline (NULL, ≤200 chars) — optional short description for card
  listings. Long-form `description` stays.
- synthetic_name (NOT NULL) — deterministic `<name>-by-<owner_username>`
  stored as a column for indexing and as the single source of truth
  for attribution lookups in later phases. Today's bundle bake still
  uses suffixed_name() at the same call sites.

Migration (_v48_to_v49_migrate, Python function — humanize has no
SQL equivalent) backfills existing rows: title from
humanize_name(strip_archive_suffix(name)), synthetic from the concat
formula; tagline stays NULL. Idempotent (ADD COLUMN IF NOT EXISTS +
SET NOT NULL no-op on re-run).

Upload form (store_upload.html step 2) reorders fields: Title
(pre-filled from server-side humanize, JS keeps it in sync until
the user edits manually) → Name + dark synthetic preview on one
row (matches marketplace_item_detail.html dark code styling, no
copy button — preview only) → Short description with character
counter → Description (unchanged). Edit form (store_edit.html)
mirrors the layout with pre-filled values from the entity row.

API:

- POST /api/store/entities/preview returns `title` (humanized
  fallback) for upload form pre-fill.
- POST + PUT /api/store/entities accept `title` and `tagline` form
  fields with 100/200-char validation; PUT recomputes
  synthetic_name when `name` changes (caller responsibility per
  repo contract).
- StoreEntityResponse exposes all three new fields.

Repository:

- create() takes title + tagline + synthetic_name as optional
  kwargs with derived defaults (humanize_name(name) / concat) so
  existing test fixtures don't need to thread them.
- update() supports partial updates on all three; tagline empty
  string clears via NULL sentinel.
- archive() recomputes synthetic_name on rename to the archived
  slug so the column stays consistent with name.

Tests:

- New test_schema_v48_to_v49_migration.py: fresh install,
  populated-row backfill (incl. archived row strip), idempotence,
  NOT NULL constraint verification.
- test_store_naming.py: 14 humanize parametrize cases + acronym
  dict invariants.
- test_store_api.py::TestStoreV49Metadata: preview humanize, POST
  with explicit + fallback title, 100/200-char rejects, PUT
  partial update + synthetic recompute on rename.
- Schema version assertion bumps (48 → 49) in test_db_schema_version,
  test_home_stats, test_schema_v42_migration, test_schema_v46_migration.

Phase 1 only — surface rendering on cards / detail pages and
Claude Code bundle propagation come in later phases.

* feat(flea): phase-2 — wire title/tagline/owner through marketplace cards + detail pages

Phase 1 (7f4cfcbb) populated the three new columns on store_entities;
phase 2 surfaces them across the web presentation layer so the kebab-
case slug + bare username no longer leak into user-facing copy.

API:

- `_flea_to_item` now takes `conn` (both callsites updated) and sets
  `display_name=entity.title`, `tagline=entity.tagline`, `owner=
  _resolve_owner_display(conn, owner_user_id, owner_username)` —
  matches the chain the curated path already uses (users.name →
  users.email → fallback). The card JS chain `it.display_name ||
  it.name` then renders the friendly form; `name` stays at the
  suffixed slug as the technical identifier JS uses for fallbacks.
- `flea_detail` adds `display_name` + `tagline` to PluginDetailResponse
  so the standalone skill/agent + plugin detail heroes pick them up
  through the existing `d.display_name` / `d.tagline` chains.
- `_flea_inner_parent_fields` swaps `parent_display_name` from
  `strip_archive_suffix(name)` to `entity.title or strip_archive_suffix(
  name)`. Drives parent-plugin label in four surfaces at once:
  breadcrumb 3rd segment, hero "part of <plugin>" meta-row,
  helper "This skill is part of <plugin>" panel, and the Details
  sidebar's "Parent plugin" row.

Templates — `marketplace_item_detail.html`:

- Pre-render: browser title, hero h1, and hero-window-label read
  `(entity.title if entity else None) or inner_name or item_name or
  plugin_name` so the SSR shell shows the friendly title before the
  JS fetch lands (no flash of kebab-case).
- Breadcrumb last segment for flea standalone drops the `d.manifest_name
  || heroTitle` fallback in favour of just `heroTitle` — manifest_name
  is the suffixed slug and users explicitly didn't want it in the path.
- Hero meta-row for flea standalone is now hidden. The prior "by
  <author> · N installed · <size>" line duplicated install count
  (hero telemetry chip below), owner + bundle size (Details sidebar).

Templates — `marketplace_plugin_detail.html`:

- Same SSR pre-render swap (title, h1, window-label, crumb-name).
- Hero tagline element starts hidden; JS shows it only when
  `d.tagline` is truthy. Pre-fix it fell back to `d.description`
  (long-form text), which read awkwardly under the h1 and pulled the
  hero too tall. Description still renders in the "What it does"
  panel below the hero.
- Initial "Loading…" placeholder removed so entities without a
  tagline don't flash that text mid-fetch.

Tests:

- New `TestFleaPhase2Presentation` class in test_marketplace_api.py
  (6 cases): card title + tagline + full-name owner, owner fallback
  chain when users.name is NULL, flea_detail exposes title + tagline,
  tagline null when omitted, inner skill parent_display_name uses
  entity.title (explicit + humanize-fallback variants).
- Updated `TestListItems.test_flea_lists_uploads` to assert both
  `display_name == "Alpha"` (humanized) and `name ==
  "alpha-by-alice"` (suffixed slug compat).
- Updated `TestWebPages.test_marketplace_flea_detail_page_renders`
  to look for the humanized title ("Page Skill") in the SSR shell
  instead of the kebab-case `page-skill`.

* feat(flea): phase-3 — read synthetic_name from DB, suffixed_name() only on write

Phase 1 added the column + backfill, repo write paths keep it in sync.
Phase 3 routes every READ callsite through `store_entities.synthetic_name`
directly instead of recomputing `<name>-by-<owner_username>` on the fly,
and switches the collision query off the inline string concat. The
`suffixed_name()` primitive now lives exclusively in write flows.

Read callsites updated (all read `entity["synthetic_name"]` directly,
no fallback — the column is NOT NULL and a missing value would be a
real bug worth surfacing as KeyError):

- app/api/marketplace.py:_flea_to_item — card MarketplaceItem.name.
- app/api/marketplace.py:flea_detail — PluginDetailResponse.manifest_name.
- app/api/store.py:_entity_to_response — StoreEntityResponse.invocation_name.
- app/api/store.py PUT bundle re-bake — `suffixed` passed to
  `_bake_plugin_tree`; entity is loaded pre-rename, so its
  synthetic_name is the OLD value `_bake_plugin_tree` expects.
- app/api/store.py PUT rename — `old_suffix` for `_rename_baked_tree`.
- app/api/my_stack.py — StoreInstallEntry.invocation_name.
- src/marketplace_filter.py — manifest_name in served plugin entry.

`suffixed_name` imports removed from marketplace.py, my_stack.py, and
marketplace_filter.py (no remaining callsites). store.py keeps the
import for its write paths:

- POST create (`suffixed = suffixed_name(final_name, username)` →
  passed to `_bake_plugin_tree` and `repo.create(synthetic_name=...)`).
- PUT rename collision check (`new_suffixed`).
- PUT rename `new_suffix` for `_rename_baked_tree` (proposed value).
- PUT rename `new_synthetic` for `repo.update(synthetic_name=...)`.
- Archive `old_suffix` + `new_suffix` for `_rename_baked_tree`
  (retro-compute pre-archive value after `repo.archive` already
  overwrote the DB row with the post-archive synthetic).

Collision SQL — `_suffixed_already_taken`:

  WHERE name || '-by-' || owner_username = ?   (before)
  WHERE synthetic_name = ?                     (after)

Same matches today (phase 1 backfill + NOT NULL invariant + write
paths in sync); indexable + single source of truth going forward.

Repository:

- UserStoreInstallsRepository.list_for_user explicit SELECT extended
  with `se.title`, `se.tagline`, `se.synthetic_name` so my_stack and
  marketplace_filter callers can read them off the joined row.

Tests:

- test_store_api.py::test_invocation_name_reads_from_synthetic_column —
  upload entity, manually override the column with a non-canonical
  value, verify GET response returns the override (proves read path
  consumes the column, not recomputes).
- test_marketplace_api.py::test_flea_card_and_detail_read_synthetic_name_from_db —
  same proof for `MarketplaceItem.name` (card) and
  `PluginDetailResponse.manifest_name` (detail).

* feat(flea): phase-4 — rename agnes-store-bundle → flea (synthetic plugin)

The synthetic plugin that wraps loose flea-market skills + agents into
one Claude Code plugin is renamed from `agnes-store-bundle` to `flea`.
Plugin-type flea uploads (their own standalone plugin entry) are
unaffected.

Constants:
- src/marketplace_filter.py:
  - BUNDLE_PLUGIN_NAME: "agnes-store-bundle" → "flea"  (Claude Code
    plugin manifest name + .claude-plugin/plugin.json name)
  - BUNDLE_PREFIXED_NAME: "store-bundle" → "flea"      (on-disk ZIP /
    git tree path, now plugins/flea/...)

Attribution layer (services/session_processors/usage_lib.py):
- FLEA_BUNDLE_PREFIX: "agnes-store-bundle" → "flea". The JSONL
  invocation identifier going forward is `flea:<skill-name>`.
- New `_LEGACY_FLEA_BUNDLE_PREFIXES = ("agnes-store-bundle",)`.
  `MarketplaceItemLookup.resolve()` + `_attribute_event()` accept BOTH
  the new and the legacy prefix so historic usage_events (~90-day
  retention) continue attributing to source='flea'. The tuple becomes
  a no-op once the rename has been live past the retention window —
  a follow-up commit can drop it then.
- USAGE_PROCESSOR_VERSION bumped 6 → 7 so the session-pipeline reprocess
  loop re-runs attribution with the new + legacy prefix branches.

User-facing copy:
- /api/store/bundle.zip Content-Disposition filename: agnes-store-bundle.zip → flea.zip
- `agnes admin store pull` default --out: agnes-store-bundle.zip → flea.zip
- Docstrings + JS comment + welcome template comment updated.

Tests:
- skill_flea.jsonl fixture identifier updated to flea:flea-skill.
- New skill_flea_legacy.jsonl with the legacy prefix for backward-compat
  coverage.
- New test `test_legacy_agnes_store_bundle_prefix_resolves` replays the
  legacy fixture and asserts source='flea' attribution still lands.
- All other test assertions / mocks substituted mechanically:
  test_session_processor_usage.py, test_usage_rollups.py,
  test_marketplace_filter_store.py, test_store_api.py,
  test_cli_refresh_marketplace.py.
- `_seed_flea_entity` (test_usage_rollups.py) + `_seed_attribution`
  (test_session_processor_usage.py) helpers now supply the NOT NULL
  `title` + `synthetic_name` columns from phase 1, since they INSERT
  directly bypassing the repo's create() fallback.

Client rollover note (CHANGELOG): `agnes refresh-marketplace` will
install the new `flea@agnes` plugin and the local marketplace clone's
`plugins/store-bundle/` source folder is removed via `git reset --hard`.
Whether Claude Code itself auto-prunes the orphan `agnes-store-bundle
@agnes` registry entry is undocumented — to verify empirically on the
dev VM. If the orphan entry lingers, a follow-up will add targeted
cleanup; until then users can manually run
`claude plugin uninstall agnes-store-bundle@agnes`.

Verified locally: 98 passed (session_processor_usage + usage_rollups +
marketplace_filter_store + cli_refresh_marketplace) + 228 passed/2
skipped (store_api + marketplace_api + admin_store_submissions +
store_entity_versions + store_repositories).

* fix(flea): phase-5 — attribution keyspace mismatch (closes #335)

Pre-fix every flea skill/agent invocation silently fell through to
`usage_events.source = 'builtin'`. Root cause: lookup tables in
`services/session_processors/usage_lib.py` keyed `_flea_entities` (and
the derived `_flea_plugins` set) by `store_entities.name` — the
un-suffixed display name. Claude Code writes invocations as
`flea:<synthetic_name>` (e.g. `flea:xlsx-by-c-marustamyan`), so
`dict.get(local)` always missed and the resolver fell through to
builtin. Result: marketplace cards, detail telemetry chips, admin
group-by-source all showed 0 flea invocations even when the raw
JSONL stream was correct.

Phase 1 added the `synthetic_name` column + backfill; phase 4 renamed
the bundle prefix to `flea`; phase 5 finally flips the lookup
keyspace to match what JSONL writes.

usage_lib.py:
- `MarketplaceItemLookup.__init__` preload: `SELECT synthetic_name,
  type FROM store_entities` (was `SELECT name, type`). `_flea_plugins`
  set derived from those keys, so it now carries synthetic_names
  too — matches what Claude Code writes when invoking a skill nested
  inside a flea plugin (`<synthetic>:<inner>`).
- `rebuild_rollups` preload: same SELECT change; also derives
  `flea_plugins` and threads it through `_aggregate_events` /
  `_rebuild_window`.
- `_attribute_event`: signature extended with `flea_plugins`; new
  branch `if prefix in flea_plugins: return ("flea", default_type,
  prefix, local)` for flea-plugin-nested skills/agents. This branch
  was added to `MarketplaceItemLookup.resolve()` in v6 (commit
  e076ebbe) but the rollup builder's helper was never updated to
  match, so nested skills inside flea plugins silently dropped out
  of the daily/window fact tables.
- `USAGE_PROCESSOR_VERSION`: 7 → 8. Forces the session-pipeline
  reprocess loop to re-attribute existing usage_events rows with
  the corrected lookup so rollup tables fill correctly on the next
  tick.

marketplace.py — 4 API stats lookup callsites switched from
`entity["name"]` to `entity["synthetic_name"]`:
- `_flea_to_item` (card stats lookup)
- `flea_detail` (`_build_telemetry` + `_load_inner_items_stats_by_parent`)
- `flea_skill_detail` (inner detail `parent_plugin` key)
- `flea_agent_detail` (inner detail `parent_plugin` key)

Tests:
- `skill_flea.jsonl` invocation: `flea:flea-skill` →
  `flea:flea-skill-by-alice` (mirrors what Claude Code writes after
  phase 1/4 — the suffixed synthetic_name).
- `test_flea_skill_attributed_with_empty_parent` assertion: rollup
  `name` column now carries the synthetic_name.

No legacy `agnes-store-bundle` prefix backward compat — clean cut per
user direction (dev phase, no production data worth preserving).

Verified locally: 53 passed targeted (session_processor_usage +
usage_rollups + marketplace_filter_store) + 215 passed/2 skipped
broader (store_api + marketplace_api + admin_store_submissions +
store_entity_versions).

* fix(flea): phase-6 — plugin-level rollup aggregation parity for flea

Flea plugin entity cards + detail pages showed 0 invocations even
though nested skills had correct rollup rows. Root cause: the
plugin-level aggregation pass in `_aggregate_events` was hardcoded
to `source='curated'` only:

    if source != "curated" or not parent:
        continue
    if group_by_day:
        pkey = (day, "curated", "plugin", "", parent)
    else:
        pkey = ("curated", "plugin", "", parent)

So flea plugin entities never got a synthetic
`(source='flea', type='plugin', parent_plugin='', name=<synth>)`
row aggregating nested invocations. `_load_invocation_stats('flea')`
filters `parent_plugin = ''` and returned no row for flea plugin
entity cards, so `stats.get(entity["synthetic_name"])` missed and
the API exposed 0/0.

Triggered by empirical observation on the dev VM —
`codex-second-opinion-by-c-marustamyan` plugin showed 0 calls in
the listing card while its three inner skills (codex-setup ×3,
codex-review ×1, codex-second-opinion ×1) had the expected child
rollup rows.

Fix:

- Extend the guard to `source in ("curated", "flea")`.
- Replace the hardcoded `"curated"` in the `pkey` tuple with the
  loop's `source` variable, so flea aggregation lands as `source=
  'flea'` and curated aggregation continues landing as
  `source='curated'`.

API path unchanged — `_load_invocation_stats('flea')` filters
`parent_plugin = ''` already picks up the new aggregated row
alongside standalone skill/agent rows. Rollup `name` field carries
the synthetic_name keyspace; no collision between standalone entity
synthetic and plugin entity synthetic (global suffix uniqueness
enforced by `_suffixed_already_taken`).

`USAGE_PROCESSOR_VERSION` bumped 8 → 9 to force a reprocess pass so
historic nested-invocation data fills the new plugin-level rows on
the next tick (instead of waiting for the next live invocation).

Tests:

- New `test_flea_plugin_row_aggregates_children` mirrors the existing
  `test_curated_plugin_row_aggregates_children`: seeds a flea plugin
  entity, three nested events (one user invoking two skills, a
  second user invoking one) → asserts the aggregated plugin row
  carries count=3, distinct_users=2 (union, not sum), plus the child
  rows survive alongside.

Verified locally: 43 passed (session_processor_usage + usage_rollups)
+ 82 passed/2 skipped broader (+ marketplace_filter_store +
marketplace_api).

* refactor(marketplace): phase-7 — unify Details sidebar across detail surfaces

Five marketplace detail surfaces (curated plugin, flea plugin, curated
inner skill/agent, flea inner skill/agent, flea standalone skill/agent)
had drifted on which Details rows they show and what order — the same
field landed in different positions, some fields duplicated hero info,
and the flea plugin Owner row leaked the kebab-case `owner_username`
slug instead of the user's real name. This commit aligns all five
surfaces on a single scan order driven by UX priority:

  identity → life-stage → telemetry → debug-tier

Concretely:

  1. Curator / Owner          (first scan signal — trust)
  2. Parent plugin            (inner skill/agent only)
  3. Released                 (top-level only — plugins + flea standalone)
  4. Last used                (recency)
  5. Active days              (engagement consistency)
  6. Version                  (flea standalone only — content hash)
  7. Bundle size              (debug-tier)

Dropped:

  - Slug field on plugin detail surfaces (`marketplace_id` for curated,
    `entity_id` for flea). Pure debug info, never user-relevant; URL
    already carries it.
  - Category + Installs on flea standalone skill/agent detail.
    Category is already shown as a hero badge; install count is in
    the hero telemetry chip — sidebar duplication added noise.

Owner display:

  - Flea plugin Owner row now reads `d.owner_display` (resolved through
    `users.name → users.email → owner_username` by `_resolve_owner_display`
    in `app/api/marketplace.py:1491`) instead of the raw `d.author_name`
    (which is `owner_username`, the kebab-case slug). API field already
    populated from phase 2; templates just consume it.
  - Curated Curator row continues to read `d.author_name` from
    marketplace-metadata.json; `owner_todo` placeholder behavior
    preserved.

Files:

  - app/web/templates/marketplace_plugin_detail.html — rewrote the
    Details render loop (lines 1364-1427 area). Slug row removed,
    rows reordered, Owner branch reads `d.owner_display`.
  - app/web/templates/marketplace_item_detail.html — both branches of
    the Details sidebar (inner skill/agent + flea standalone) re-laid
    around the same scan order. Telemetry helper unchanged, just
    repositioned. Category + Installs rows removed from the
    standalone branch.

No new tests — no existing test asserts the precise order of Details
rows or references the dropped fields in a sidebar context (grep
confirmed). API surface unchanged.

Verified locally: 84 passed / 2 skipped on `test_marketplace_api.py`
+ `test_store_api.py`.

* fix(flea): post-review hardening — N+1, v50 UNIQUE, docs, test cleanup

Addresses 5 critical findings from PR #342 code review:

1. N+1 query in `_flea_to_item` — owner-display resolution previously
   ran one `SELECT … FROM users WHERE id = ?` per item in the listing
   comprehension. Now batched via `_load_users_display` IN-query
   prefetch; 50 items drops 51 user queries to 2. Regression-guarded
   by `TestFleaOwnerDisplayBatched` (spies `_resolve_owner_display`
   and asserts it's not called inside the list path).

2. Misleading comment in `src/marketplace_filter.py` claimed the
   attribution layer accepts both `agnes-store-bundle` and `flea`
   prefixes — it doesn't (clean cut per CHANGELOG). Rewrote to match
   reality.

3. CHANGELOG `[Unreleased]` had two `### Changed` blocks. Merged into
   one (BREAKING bullet first).

4. New v49→v50 migration adds `UNIQUE INDEX
   idx_store_entities_synthetic_name`. v49 made `synthetic_name` the
   canonical attribution key but uniqueness was only app-enforced;
   v50 promotes the invariant to the DB layer. Migration pre-checks
   for existing duplicates and raises `RuntimeError` listing them
   rather than letting `CREATE UNIQUE INDEX` fail mid-way. v48→v49
   migration gained an `is_nullable='YES'` guard on its `SET NOT NULL`
   ALTERs so re-runs on a fully-migrated DB don't trip DuckDB's
   "cannot alter entry … entries depend on it" block (the new index
   counts as such an entry). Index is created by the migration only —
   keeping it out of `_SYSTEM_SCHEMA` preserves fresh-install ordering
   (CREATE TABLE → v49 ALTERs → v50 CREATE INDEX).

5. Deleted three redundant version-pinned schema asserts whose names
   lied about their bodies (`test_schema_version_is_42` asserting
   `== 49`, etc.). Canonical assert lives in
   `test_db_schema_version.py`, renamed to
   `test_schema_version_matches_constant`.

* fix(db): gate v34→v38 store_entities ALTER COLUMN steps on column state

CI on Linux failed `test_v17_to_v18_drops_*` after the v50 UNIQUE INDEX
landed. Root cause: those tests open a DB at the full target version,
seed fixtures, then reset `schema_version` to 17 and reopen — forcing
the ladder to re-run from 17 → current. With the v50 index now in place,
DuckDB blocks intermediate `ALTER COLUMN` steps on `store_entities`
("Cannot drop this column: an index depends on a column after it!" /
"Cannot alter entry because there are entries that depend on it"),
because `synthetic_name` (the indexed column) sits positionally after
the columns those steps touch.

Fix: convert the three SQL-list migrations that hit store_entities into
defensive Python functions:

- `_v34_to_v35_migrate` short-circuits when `synthetic_name` already
  exists (post-v49 shape — the visibility_status rebuild is moot and
  the DROP COLUMN would be blocked by the index).
- `_v35_to_v36_migrate` gates the `visibility_status SET NOT NULL` +
  `SET DEFAULT` on `is_nullable='YES'` so it's a true no-op when the
  column is already constrained.
- `_v37_to_v38_migrate` gates the `version_no SET NOT NULL` step the
  same way.

Forward-roll path (real installs that never reset schema_version) is
unchanged: the gates fire `YES` → ALTERs run. The fix only changes
behavior for the "DB is already at v50 shape but version row says 17"
scenario the tests construct.

---------

Co-authored-by: Minas Arustamyan <arustamyan.minas@gmail.com>
2026-05-19 02:32:41 +02:00

438 lines
18 KiB
HTML

{% extends "base.html" %}
{% block title %}Edit {{ entity.name | store_display_name }} — {{ config.INSTANCE_NAME }}{% endblock %}
{% block content %}
<style>
.edit-back { font-size: 13px; color: var(--text-secondary, #6b7280); text-decoration: none; }
.edit-back:hover { color: var(--text, #111827); text-decoration: underline; }
h1.edit-title { margin: 8px 0 16px 0; font-size: 22px; font-weight: 600; }
.field { margin-bottom: 18px; }
.field-label {
display: block; font-size: 13px; font-weight: 500;
color: var(--text, #111827); margin-bottom: 6px;
}
.field-help {
font-size: 12px; color: var(--text-secondary, #6b7280); margin-top: 4px;
}
.field-help.warn { color: #92400e; }
input[type=text], textarea, select {
width: 100%; padding: 8px 10px;
border: 1px solid var(--border, #d1d5db); border-radius: 6px;
font-size: 14px; font-family: inherit;
background: var(--surface, #fff);
}
textarea { min-height: 80px; resize: vertical; }
.file-drop {
display: flex; align-items: center; gap: 12px;
padding: 16px; border-radius: 8px;
border: 2px dashed var(--border, #d1d5db); background: var(--surface-muted, #f9fafb);
cursor: pointer;
}
.file-drop input[type=file] { display: none; }
.file-drop:hover { border-color: var(--primary, #0073D1); background: #fff; }
.file-drop.is-dragover { border-color: var(--primary, #0073D1); background: #eff6ff; }
.file-drop .icon { font-size: 24px; }
.file-drop .file-info .label { font-size: 13px; font-weight: 500; }
.file-drop .file-info .meta { font-size: 12px; color: var(--text-secondary, #6b7280); }
.file-drop button {
margin-left: auto; padding: 6px 12px; border-radius: 6px;
border: 1px solid var(--border, #d1d5db); background: var(--surface, #fff);
font-size: 13px; cursor: pointer;
}
.actions { display: flex; gap: 8px; margin-top: 20px; align-items: center; }
.pending-banner {
margin: 12px 0 16px 0; padding: 14px 18px; border-radius: 10px;
background: #fef3c7; color: #92400e; border: 1px solid #fde68a; font-size: 14px;
}
.pending-banner h3 { margin: 0 0 6px 0; font-size: 15px; }
.banner {
padding: 12px 16px; border-radius: 8px; margin-bottom: 16px;
font-size: 13px; line-height: 1.5; display: flex; align-items: flex-start; gap: 10px;
}
/* `display: flex` above overrides the user-agent default rule for
[hidden] (display:none); force it back so the empty banner stays
out of the layout until showError() unhides it. */
.banner[hidden] { display: none !important; }
.banner.error { background: #fef2f2; color: #b91c1c; border: 1px solid #fecaca; }
.banner > span { white-space: pre-wrap; }
/* v49: matches the synthetic-name preview styling on store_upload.html
so upload + edit forms read identically. */
.name-row {
display: flex; align-items: stretch; gap: 10px; flex-wrap: wrap;
}
.name-row input[type=text] {
flex: 0 1 320px; min-width: 220px;
}
.invocation-preview {
flex: 1 1 320px; min-width: 0;
display: flex; align-items: center;
background: #1e1e2e; color: #cdd6f4;
border-radius: 6px; padding: 0 14px;
font-family: var(--font-mono, monospace); font-size: 13px;
overflow: hidden; white-space: nowrap; text-overflow: ellipsis;
}
.invocation-preview .prompt {
color: #a6e3a1; user-select: none; margin-right: 2px;
}
.invocation-preview #synthetic-text {
overflow: hidden; text-overflow: ellipsis;
}
</style>
<div class="page-shell">
<p style="margin: 8px 0;">
<a class="edit-back" href="/marketplace/flea/{{ entity.id }}">← Back to detail</a>
</p>
<h1 class="edit-title">Edit · {{ entity.type }} · {{ entity.name | store_display_name }}</h1>
{% if pending_sub %}
<div class="pending-banner">
<h3>⟳ A previous edit is still under review</h3>
<div>
Submission <code>{{ pending_sub.id[:8] }}</code> is being checked
({{ pending_sub.status }}). Edits are temporarily disabled until
the verdict lands. The detail page auto-refreshes when it does.
</div>
</div>
{% endif %}
<div id="banner" class="banner error" hidden>
<span class="ico">!</span><span id="banner-text"></span>
</div>
<form id="edit-form">
<div class="field">
<label class="field-label" for="f-title">Title</label>
<input id="f-title" name="title" type="text" maxlength="100" required
value="{{ entity.title or '' }}"
data-user-edited="{{ 'true' if entity.title else 'false' }}"
{% if pending_sub %}disabled{% endif %}>
<div class="field-help">Human-friendly name shown on marketplace cards.</div>
</div>
<div class="field">
<label class="field-label" for="f-name">Display name</label>
<div class="name-row">
<input id="f-name" name="name" type="text" value="{{ entity.name | store_display_name }}"
pattern="^[a-z][a-z0-9-]{0,63}$"
{% if pending_sub %}disabled{% endif %}>
<div class="invocation-preview" id="synthetic-preview" aria-live="polite">
<span class="prompt">/</span><span id="synthetic-text">{{ entity.synthetic_name or (entity.name ~ '-by-' ~ entity.owner_username) }}</span>
</div>
</div>
<div class="field-help warn">
⚠ Changing the name renames the plugin slug for existing
installers. They'll see the plugin renamed on their next sync
and may need to re-add it to their stack.
</div>
</div>
<div class="field">
<label class="field-label" for="f-tagline">Short description <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
<input id="f-tagline" name="tagline" type="text" maxlength="200"
value="{{ entity.tagline or '' }}"
placeholder="One-line summary shown alongside the entity name"
{% if pending_sub %}disabled{% endif %}>
<div id="tagline-counter" class="field-help" style="font-family: var(--font-mono); font-size: 12px;">0 / 200 max</div>
</div>
<div class="field">
<label class="field-label" for="f-description">Description</label>
<textarea id="f-description" name="description" maxlength="1000"
{% if pending_sub %}disabled{% endif %}>{{ entity.description or "" }}</textarea>
</div>
<div class="field">
<label class="field-label" for="f-category">Category</label>
<select id="f-category" name="category"
{% if pending_sub %}disabled{% endif %}>
<option value="">— none —</option>
{% for cat in categories %}
<option value="{{ cat }}" {% if cat == entity.category %}selected{% endif %}>{{ cat }}</option>
{% endfor %}
</select>
</div>
<div class="field">
<label class="field-label" for="f-video">Video URL <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
<input id="f-video" name="video_url" type="text"
value="{{ entity.video_url or '' }}" placeholder="https://..."
{% if pending_sub %}disabled{% endif %}>
</div>
<div class="field">
<label class="field-label">Cover photo</label>
<div class="file-drop" id="photo-drop">
<div class="icon">🖼</div>
<div class="file-info">
<div class="label" id="photo-label">
{% if entity.photo_path %}Replace existing photo{% else %}No photo{% endif %}
</div>
<div class="meta">JPG, PNG, WebP · Max 5 MB</div>
</div>
<input type="file" id="photo" accept="image/jpeg,image/png,image/webp"
{% if pending_sub %}disabled{% endif %}>
<button type="button" id="photo-pick" {% if pending_sub %}disabled{% endif %}>Choose</button>
</div>
</div>
<hr style="border:none;border-top:1px solid var(--border-light, #e5e7eb); margin: 20px 0;">
<div class="field">
<label class="field-label">Upload new version <span style="color:var(--text-secondary,#6b7280);font-weight:400;">(optional)</span></label>
<div class="file-drop" id="zip-drop">
<div class="icon">📦</div>
<div class="file-info">
<div class="label" id="zip-label">No file selected</div>
<div class="meta" id="zip-meta">
Skip to update only the metadata above. Uploading creates
v{{ (entity.version_no or 1) + 1 }} and re-runs guardrails.
</div>
</div>
<input type="file" id="zip" accept=".zip"
{% if pending_sub %}disabled{% endif %}>
<button type="button" id="zip-pick" {% if pending_sub %}disabled{% endif %}>Choose file</button>
</div>
<div class="field-help">
Current version: <strong>v{{ entity.version_no or 1 }}</strong>
({{ entity.version[:12] if entity.version else "—" }}).
Prior versions remain on disk and can be restored from the
detail page's <em>Versions</em> section.
</div>
</div>
<div class="actions">
<button type="submit" class="btn btn-primary" id="save-btn"
{% if pending_sub %}disabled{% endif %}>Save</button>
<a href="/marketplace/flea/{{ entity.id }}" class="btn btn-secondary">Cancel</a>
</div>
</form>
</div>
<script>
const ENTITY_ID = {{ entity.id|tojson }};
const banner = document.getElementById('banner');
const bannerText = document.getElementById('banner-text');
function showError(msg) {
banner.className = 'banner error';
bannerText.textContent = msg;
banner.hidden = false;
banner.scrollIntoView({behavior: 'smooth', block: 'start'});
}
function clearBanner() { banner.hidden = true; }
function humanizeError(detail) {
if (!detail) return 'Save failed.';
if (typeof detail === 'object') {
const code = detail.code || '';
const checks = detail.checks || {};
function appendFindings(lines, payload) {
const findings = (payload?.findings) || [];
for (const f of findings.slice(0, 5)) {
lines.push('• ' + (f.file || '?') + ':' + (f.line || '?') + ' — ' + (f.reason || f.category || ''));
}
if (findings.length > 5) lines.push(' …and ' + (findings.length - 5) + ' more.');
}
function appendManifest(lines, payload) {
const issues = (payload?.issues) || [];
for (const m of issues.slice(0, 5)) lines.push('• manifest: ' + m);
if (issues.length > 5) lines.push(' …and ' + (issues.length - 5) + ' more.');
}
function appendContent(lines, payload) {
const issues = (payload?.issues) || [];
for (const i of issues.slice(0, 5)) {
const where = i.component_type === 'submission'
? 'Description on the form'
: ((i.component_type || 'component') + (i.name ? ' — ' + i.name : ''));
const code = (i.code || '').replace(/_/g, ' ');
lines.push('• ' + where + ' — ' + (i.field || 'description') + ' ' + code);
}
if (issues.length > 5) lines.push(' …and ' + (issues.length - 5) + ' more.');
}
if (code === 'validation_failed') {
const lines = ['New version needs fixing before it can be saved.'];
appendManifest(lines, checks.manifest);
appendContent(lines, checks.content);
lines.push('');
lines.push('Fix the issues above and try again. The previous version is still live.');
return lines.join('\n');
}
if (code === 'security_blocked') {
const lines = ['Save blocked: security review found risky patterns in the new bundle.'];
appendFindings(lines, checks.static_security);
lines.push('');
lines.push('Remove the flagged code/secrets and try again. The previous version stays live.');
return lines.join('\n');
}
if (code === 'submission_blocked') {
// Legacy server response (pre-cutover) — kept for one release.
const lines = ['New version blocked by automated checks.'];
appendFindings(lines, checks.static_security);
appendManifest(lines, checks.manifest);
appendContent(lines, checks.content);
lines.push('');
lines.push('Fix the issues and re-upload, or open the detail page to see the full report.');
return lines.join('\n');
}
if (code === 'prior_version_pending') {
return 'A previous edit is still under review. Wait for the verdict before saving.';
}
if (code === 'type_locked') {
return 'Cannot change the entity type. Upload a new entity if you need a different form factor.';
}
if (code === 'conflict_owner_name') return 'You already have a plugin with that name.';
if (code === 'conflict_global_suffix') return 'That name conflicts with another user\'s plugin slug.';
if (code === 'invalid_name_format') return 'Name must be lowercase letters / digits / hyphens, starting with a letter.';
if (code === 'title_required') return 'Title is required.';
if (code === 'title_too_long') return 'Title is too long — max 100 characters.';
if (code === 'tagline_too_long') return 'Short description is too long — max 200 characters.';
if (code) return 'Save failed: ' + code;
try { return 'Save failed: ' + JSON.stringify(detail); } catch (_) { return 'Save failed.'; }
}
return 'Save failed: ' + String(detail);
}
// File picker wiring (no double-click bug — div, not label).
function wireDropZone(dropEl, fileInput, pickBtn, labelEl, validate) {
if (!dropEl) return;
pickBtn.addEventListener('click', (e) => {
e.stopPropagation();
fileInput.click();
});
dropEl.addEventListener('click', (e) => {
if (e.target.tagName !== 'BUTTON') fileInput.click();
});
fileInput.addEventListener('change', () => {
const f = fileInput.files[0];
if (!f) return;
const err = validate ? validate(f) : null;
if (err) { showError(err); fileInput.value = ''; return; }
if (labelEl) labelEl.textContent = f.name + ' (' + Math.round(f.size / 1024) + ' KB)';
dropEl.classList.add('is-dragover');
});
}
wireDropZone(
document.getElementById('zip-drop'),
document.getElementById('zip'),
document.getElementById('zip-pick'),
document.getElementById('zip-label'),
(f) => f.size > 50 * 1024 * 1024 ? 'ZIP too large (max 50 MB).' : null,
);
wireDropZone(
document.getElementById('photo-drop'),
document.getElementById('photo'),
document.getElementById('photo-pick'),
document.getElementById('photo-label'),
(f) => f.size > 5 * 1024 * 1024 ? 'Photo too large (max 5 MB).' : null,
);
// v49 phase-1 — Title, Tagline, synthetic preview wiring (mirrors
// store_upload.html). Acronym dict + owner injected via template ctx.
const TITLE_ACRONYMS = {{ title_acronyms|tojson if title_acronyms else "{}" }};
const OWNER_USERNAME = {{ owner_username|tojson if owner_username else '""' }};
const titleInput = document.getElementById('f-title');
const taglineInput = document.getElementById('f-tagline');
const taglineCounter = document.getElementById('tagline-counter');
const fNameInput = document.getElementById('f-name');
const syntheticText = document.getElementById('synthetic-text');
function humanizeName(name) {
if (!name) return '';
const tokens = String(name).split('-').filter(Boolean);
return tokens.map(tok => {
const canonical = TITLE_ACRONYMS[tok.toLowerCase()];
if (canonical !== undefined) return canonical;
return tok.charAt(0).toUpperCase() + tok.slice(1).toLowerCase();
}).join(' ');
}
function updateSyntheticPreview() {
const name = (fNameInput.value || '').trim();
if (!name) {
syntheticText.textContent = 'your-name-by-' + (OWNER_USERNAME || 'you');
} else {
syntheticText.textContent = name + '-by-' + (OWNER_USERNAME || 'you');
}
}
function maybeAutoFillTitle() {
if (titleInput.dataset.userEdited === 'true') return;
const name = (fNameInput.value || '').trim();
titleInput.value = humanizeName(name);
}
function updateTaglineCounter() {
const len = (taglineInput.value || '').length;
taglineCounter.textContent = `${len} / 200 max`;
}
titleInput.addEventListener('input', () => {
titleInput.dataset.userEdited = titleInput.value.trim() ? 'true' : 'false';
});
fNameInput.addEventListener('input', () => {
updateSyntheticPreview();
maybeAutoFillTitle();
});
taglineInput.addEventListener('input', updateTaglineCounter);
updateSyntheticPreview();
updateTaglineCounter();
document.getElementById('edit-form').addEventListener('submit', async (e) => {
e.preventDefault();
clearBanner();
const saveBtn = document.getElementById('save-btn');
saveBtn.disabled = true;
saveBtn.textContent = 'Saving…';
try {
const fd = new FormData();
const name = document.getElementById('f-name').value.trim();
if (name) fd.append('name', name);
fd.append('description', document.getElementById('f-description').value);
fd.append('category', document.getElementById('f-category').value);
fd.append('video_url', document.getElementById('f-video').value);
// v49: title is required when present; always send so server can
// detect "no change" (same value) vs "user-cleared". Tagline sends
// empty string to clear.
const titleVal = titleInput.value.trim();
if (!titleVal) { showError('Title is required.'); saveBtn.disabled = false; saveBtn.textContent = 'Save'; return; }
fd.append('title', titleVal);
fd.append('tagline', taglineInput.value.trim());
const zip = document.getElementById('zip').files[0];
if (zip) fd.append('file', zip);
const photo = document.getElementById('photo').files[0];
if (photo) fd.append('photo', photo);
const r = await fetch(`/api/store/entities/${ENTITY_ID}`, {
method: 'PUT', body: fd, credentials: 'same-origin',
});
if (r.ok) {
window.location = `/marketplace/flea/${ENTITY_ID}`;
return;
}
let msg = 'Save failed.';
try {
const j = await r.json();
const eid = j?.detail?.entity_id;
if (eid && j.detail.code === 'submission_blocked') {
// Land on detail to see the banner.
window.location = `/marketplace/flea/${eid}`;
return;
}
if (j.detail) msg = humanizeError(j.detail);
} catch (_) {}
showError(msg);
} catch (err) {
showError(String(err));
} finally {
saveBtn.disabled = false;
saveBtn.textContent = 'Save';
}
});
</script>
{% endblock %}