fix(webapp): admin-gate trace-export debug events, harden clipboard copy

Author: ericallam

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.$runParam.spans.$spanParam/route.tsx

@@ -1134,11 +1134,21 @@ function TraceExportMenuItems({ runParam }: { runParam: string }) {
 
   const copyForAI = async () => {
     try {
-      const response = await fetch(`${downloadPath}?format=markdown`, { credentials: "include" });
-      if (!response.ok) {
-        throw new Error(`Request failed with ${response.status}`);
-      }
-      await navigator.clipboard.writeText(await response.text());
+      // Hand the clipboard a ClipboardItem backed by a promise so access is
+      // reserved synchronously during the click. The fetch can then take as long
+      // as a large trace needs without the browser revoking the transient user
+      // activation, which a fetch-then-writeText sequence trips (notably Safari
+      // and Firefox).
+      const text = fetch(`${downloadPath}?format=markdown`, { credentials: "include" }).then(
+        async (response) => {
+          if (!response.ok) {
+            throw new Error(`Request failed with ${response.status}`);
+          }
+          return new Blob([await response.text()], { type: "text/plain" });
+        }
+      );
+
+      await navigator.clipboard.write([new ClipboardItem({ "text/plain": text })]);
       toast.custom((t) => (
         <ToastUI variant="success" message="Copied trace as Markdown" t={t as string} />
       ));

apps/webapp/app/routes/resources.runs.$runParam.logs.download.ts

@@ -20,9 +20,10 @@ export async function loader({ params, request }: LoaderFunctionArgs) {
 
   const url = new URL(request.url);
   // ?format=log|jsonl|markdown (default log). ?showDebug=true includes internal
-  // engine debug events (off by default, matching the trace view's Debug toggle).
+  // engine debug events; these stay admin-only (matching the admin-gated Debug
+  // toggle in the trace view) and are off by default.
   const format = getTraceExportFormat(url.searchParams.get("format"));
-  const showDebug = url.searchParams.get("showDebug") === "true";
+  const showDebug = url.searchParams.get("showDebug") === "true" && user.admin;
   const filename = `${parsedParams.runParam}.${format.extension}`;
 
   const run = await prisma.taskRun.findFirst({