feat(den-web): plugin access panel — who has this plugin, share with role choice, blast-radius confirm (P3 PR2)

[benjaminshafii]

What

PR2 of P3 (program: prds/skill-sharing/; design: Paper page "PR2 — Skill access panel", user-approved with PRIMITIVES/NEW annotations). The other direction of PR1's team view: who can access THIS plugin, editable in place.

• "WHO CAN ACCESS THIS" section on plugin detail (stacked section under the header — no tabs, per design decision): people rows via OrgMemberIdentity + team rows, role pills (editor = amber + border), shared-by provenance from grant fields, Revoke per row (creator's manager grant exempt).
• Share via the AccessAddPicker pattern with a role choice at share time: "Can view (use in chat)" default, "Can edit" behind a DenSelect with the amber consequence line.
• Org-wide switch rendered only for admins — hide-not-disable, because the server 403s member org-wide grants (feat(den-api): members can create plugins and cloud skills (skill-sharing posture slice) #3411).
• Archive confirm gains a computed blast-radius line ("removes it for N people across M teams") — client-side from grants already fetched, zero extra requests.
• No new API: existing GET/POST/DELETE /v1/plugins/:id/access; plugin serializer already exposed creator fields.

Tests (commands + results)

cd ee/apps/den-web && pnpm exec tsc --noEmit && pnpm run build          # clean
pnpm --dir evals exec vitest run --project nightly specs/plugin-access-panel.slow.test.ts
# → 3× pass (executor 2× + orchestrator rerun) against live stack from this branch:
#   creator grants person + team via API (3 active grants asserted),
#   browser leg loads the real panel — vision validated 2/2 (role pills + revoke visible),
#   org-wide toggle PRESENT for admin
pnpm --dir evals run typecheck                                           # clean

Photo roll of the real panel follows as the sticky photo-roll comment.

Honest finding (feeds PR3)

The den-web (admin) route group redirects plain members away from plugin detail — a member creator cannot yet manage sharing in the web dashboard (they share via chat, P2). The member library (PR3 / Screen C) therefore cannot live behind the admin gate; that placement decision is now explicitly on PR3's plate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openwork-app	Ready	Preview	Aug 2, 2026 10:59am
openwork-den	Ready	Preview	Aug 2, 2026 10:59am
openwork-den-worker-proxy	Ready	Preview	Aug 2, 2026 10:59am
openwork-diagnostics	Ready	Preview	Aug 2, 2026 10:59am
openwork-landing	Ready	Preview, v0	Aug 2, 2026 10:59am

[benjaminshafii]

Photo roll — p3-plugin-access

✅ 1/1 frames passed · 0 failed · 0 unvalidated · 2 expectations passed · 0 failed

1. An access section lists a person and a team with viewer role pills

• ✅ PASS An access section lists a person and a team with viewer role pills — Nova Spec (person) and Spec Plugin Access Team 1785668275415 (team) are both listed with Viewer pills.
• ✅ PASS A revoke button is visible next to a shared row — Red-outlined Revoke buttons are visible beside the shared Nova Spec and team rows.

---

Roll created 2026-08-02T10:58:03.338Z · Source: evals/results/rolls/2026-08-02T10-58-03-338Z-p3-plugin-access/roll.json · Repro: pnpm --dir evals run publish:pr -- --pr 3425 --roll 2026-08-02T10-58-03-338Z-p3-plugin-access

[diff-warden]

Warden security clearance: clear. No new security issues found in this diff (8bbfb609f9b9374c3de16aa19905b2ca95280dd5). Automated clearance satisfies the required-review gate only — a human still reviews and merges. Analysis run