[freeqaz]

Problem

A member who can read an Agent but not update it never sees the version draft's default plugin approvers on the Plugins tab. The approver field stays hidden until the plugin policy capabilities read answers, and since #3608 the page no longer sends that read to a caller whose permission answer denies Agent update (the route needs Agent update). The next deployment still uses those approvers, and the same reader opening an admitted version does see them in its snapshot.

The guide also says Open version draft shows only without Configuration update. Since #3611 it also shows when the caller lacks Secret operate on a Secret the Configuration binds.

Change

• plugins.mts: when the permission answer refuses a save, the Plugins tab shows the saved default approvers as text under Default plugin approvers, the way the version snapshot does. One shared approverSummary helper now renders both. Editors and unknown permission answers keep the existing field and capabilities read.
• configuration-plugins-and-files.md: the Open version draft sentence names the Secret operate case, and the read-only plugins sentence names the default approvers.
• Storybook: the pluginsUpdateDenied story now has a saved default approver.

Verification

All browser runs used a remote test VM, each in a private network namespace.

• New browser test A reader sees the version draft's default plugin approvers (console-agent-plugin-approvers.test.mjs): a namespace member with only read grants opens the draft's Plugins tab, sees the heading, the note and the saved approver, sees no approver field, and sends no capabilities read.
  • It fails on main (no approvers heading for the reader) and passes on this branch.
  • The whole file passes (9/9).
  • The new test, plus the two existing reader tests in console-agent-detail.test.mjs, pinned 20/20 at 2 CPUs.
• tsc (repo and tests), ESLint and Prettier pass on the touched files.
• Storybook (simulated UI proof): Pages/Agent detail → Plugin selections, viewer cannot update the Agent (pluginsUpdateDenied), from the prepared assets of each revision.

Before (main), 1440 wide: the reader sees no default approvers.

After, 1440 wide:

After, 390 wide:

Not verified: there is no video. The change adds static text with no controls, so the screenshots show the whole result. Storybook data is simulated; the browser test covers the real API path.

Risks

Low. This is a console read-only view; no API or permission change. Approvers show as raw channel: id text, with no Slack name lookup, the same as the version snapshot. A reader does not get the directory lookup, which needs Secret access.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.