@cat-factory/app 0.10.0 → 0.11.0

package/app/components/layout/AccountTeamSettings.vue

@@ -228,10 +228,13 @@ async function disconnectEmail() {
       </template>
     </section>
 
-    <!-- account-wide provider API keys (admin-only) -->
-    <section v-if="isAdmin">
+    <!-- account-wide provider API keys (admin-only): direct vendors + proxy gateways -->
+    <section v-if="isAdmin" class="space-y-6">
       <h3 class="mb-2 font-semibold text-white">Account API keys</h3>
-      <ProvidersApiKeysSection :account-id="accountId" />
+      <ProvidersApiKeysSection :account-id="accountId" category="direct" />
+      <div class="border-t border-slate-800 pt-6">
+        <ProvidersApiKeysSection :account-id="accountId" category="proxy" />
+      </div>
     </section>
   </div>
 </template>

package/app/components/providers/ApiKeysSection.vue

@@ -1,9 +1,15 @@
 <script setup lang="ts">
-// Direct-provider API keys: connect a vendor API key (OpenAI/Anthropic/Qwen/DeepSeek/
-// Moonshot) so agent steps and inline calls run on that provider. Keys are stored
-// encrypted in the DB, pooled and rotated by usage — replacing deployment env vars.
+// Provider API keys: connect a vendor API key so agent steps and inline calls run on
+// that provider. Keys are stored encrypted in the DB, pooled and rotated by usage —
+// replacing deployment env vars.
 //
-// Two modes:
+// `category` splits the providers into two kinds:
+//  - 'direct' (default): you reach the vendor directly (OpenAI/Anthropic/Qwen/DeepSeek/
+//    Moonshot).
+//  - 'proxy': an intermediary gateway that fronts many vendors behind one key
+//    (OpenRouter, LiteLLM). These are NOT direct vendors, so they get their own section.
+//
+// Two scopes:
 //  - Default (no `accountId`): manage WORKSPACE keys (shared by the team) and YOUR own
 //    keys (your personal pool, usable in any workspace), toggled by the Scope select.
 //  - With `accountId`: manage ACCOUNT-wide keys (shared by every workspace in the
@@ -11,7 +17,9 @@
 import { computed, ref, watch } from 'vue'
 import type { ApiKey, ApiKeyProvider } from '~/types/domain'
 
-const props = defineProps<{ accountId?: string }>()
+const props = withDefaults(defineProps<{ accountId?: string; category?: 'direct' | 'proxy' }>(), {
+  category: 'direct',
+})
 
 const workspace = useWorkspaceStore()
 const keys = useApiKeysStore()
@@ -21,13 +29,15 @@ const toast = useToast()
 /** Account-wide mode (single account scope) vs the default workspace/user toggle. */
 const isAccount = computed(() => !!props.accountId)
 
-/** Where to obtain each provider's API key + a short note. */
-const PROVIDERS: {
+interface ProviderMeta {
   value: ApiKeyProvider
   label: string
   url: string
   steps: string[]
-}[] = [
+}
+
+/** Direct vendors: the key reaches that one vendor's own endpoint. */
+const DIRECT_PROVIDERS: ProviderMeta[] = [
   {
     value: 'openai',
     label: 'OpenAI',
@@ -73,6 +83,10 @@ const PROVIDERS: {
       'Copy the key; it authenticates the OpenAI-compatible Moonshot endpoint.',
     ],
   },
+]
+
+/** Proxies / gateways: one key fronts many vendors. These are intermediaries, not vendors. */
+const PROXY_PROVIDERS: ProviderMeta[] = [
   {
     value: 'openrouter',
     label: 'OpenRouter',
@@ -93,8 +107,12 @@ const PROVIDERS: {
   },
 ]
 
+/** Providers for the requested category; labels everywhere fall back to the full set. */
+const PROVIDERS = computed(() => (props.category === 'proxy' ? PROXY_PROVIDERS : DIRECT_PROVIDERS))
+const ALL_PROVIDERS = [...DIRECT_PROVIDERS, ...PROXY_PROVIDERS]
+
 const scope = ref<'workspace' | 'user'>('workspace')
-const provider = ref<ApiKeyProvider>('openai')
+const provider = ref<ApiKeyProvider>(props.category === 'proxy' ? 'openrouter' : 'openai')
 const label = ref('')
 const key = ref('')
 const busy = ref(false)
@@ -115,17 +133,23 @@ watch(
   { immediate: true },
 )
 
-const selected = computed(() => PROVIDERS.find((p) => p.value === provider.value)!)
-const connected = computed<ApiKey[]>(() =>
-  isAccount.value
+const selected = computed(
+  () => PROVIDERS.value.find((p) => p.value === provider.value) ?? PROVIDERS.value[0]!,
+)
+
+/** Keys for the active scope, narrowed to this section's category (direct vs proxy). */
+const categoryProviders = computed(() => new Set(PROVIDERS.value.map((p) => p.value)))
+const connected = computed<ApiKey[]>(() => {
+  const all = isAccount.value
     ? keys.accountKeys
     : scope.value === 'workspace'
       ? keys.workspaceKeys
-      : keys.userKeys,
-)
+      : keys.userKeys
+  return all.filter((k) => categoryProviders.value.has(k.provider))
+})
 
 function providerLabel(p: ApiKeyProvider): string {
-  return PROVIDERS.find((x) => x.value === p)?.label ?? p
+  return ALL_PROVIDERS.find((x) => x.value === p)?.label ?? p
 }
 
 async function add() {
@@ -176,17 +200,34 @@ async function remove(k: ApiKey) {
   <div class="space-y-4">
     <div>
       <h4 class="text-xs font-semibold uppercase tracking-wide text-slate-500">
-        Direct provider API keys
+        {{ category === 'proxy' ? 'Proxy / gateway API keys' : 'Direct provider API keys' }}
       </h4>
-      <p v-if="isAccount" class="mt-1 text-sm text-slate-400">
-        Connect a vendor API key shared by <strong>every workspace</strong> in this account. Keys
-        are stored encrypted, pooled, and rotated by usage. Account keys are admin-managed.
-      </p>
-      <p v-else class="mt-1 text-sm text-slate-400">
-        Connect a vendor API key so models run directly on that provider. Keys are stored encrypted,
-        pooled, and rotated by usage. Scope a key to this <strong>workspace</strong> (shared with
-        the team) or to <strong>you</strong> (your own pool, usable anywhere).
-      </p>
+      <template v-if="category === 'proxy'">
+        <p v-if="isAccount" class="mt-1 text-sm text-slate-400">
+          Connect a <strong>proxy</strong> key (OpenRouter, LiteLLM) shared by
+          <strong>every workspace</strong> in this account. A proxy is an intermediary that fronts
+          many vendors behind a single key. Keys are stored encrypted, pooled, and rotated by usage.
+        </p>
+        <p v-else class="mt-1 text-sm text-slate-400">
+          Connect a <strong>proxy</strong> key (OpenRouter, LiteLLM). A proxy is an intermediary
+          that reaches many vendors' models through a single gateway, rather than one vendor
+          directly. Keys are stored encrypted, pooled, and rotated by usage. Scope a key to this
+          <strong>workspace</strong> (shared with the team) or to <strong>you</strong> (your own
+          pool, usable anywhere).
+        </p>
+      </template>
+      <template v-else>
+        <p v-if="isAccount" class="mt-1 text-sm text-slate-400">
+          Connect a vendor API key shared by <strong>every workspace</strong> in this account. Keys
+          are stored encrypted, pooled, and rotated by usage. Account keys are admin-managed.
+        </p>
+        <p v-else class="mt-1 text-sm text-slate-400">
+          Connect a vendor API key so models run directly on that provider. Keys are stored
+          encrypted, pooled, and rotated by usage. Scope a key to this
+          <strong>workspace</strong> (shared with the team) or to <strong>you</strong> (your own
+          pool, usable anywhere).
+        </p>
+      </template>
     </div>
 
     <!-- scope + provider -->
@@ -201,7 +242,7 @@ async function remove(k: ApiKey) {
           class="w-48"
         />
       </UFormField>
-      <UFormField label="Provider">
+      <UFormField :label="category === 'proxy' ? 'Proxy' : 'Provider'">
         <USelect
           v-model="provider"
           :items="PROVIDERS.map((p) => ({ label: p.label, value: p.value }))"

package/app/components/providers/VendorCredentialsModal.vue

@@ -18,6 +18,21 @@ const open = computed({
   set: (v: boolean) => (v ? ui.openVendorCredentials() : ui.closeVendorCredentials()),
 })
 
+// Horizontal tabs replace the old long vertical scroll: each credential kind is its own
+// section (pooled subscriptions, direct vendor keys, proxy/gateway keys, personal subs).
+const activeTab = ref('pool')
+const tabs = [
+  { value: 'pool', label: 'Workspace pool', icon: 'i-lucide-users', slot: 'pool' },
+  { value: 'direct', label: 'Direct providers', icon: 'i-lucide-key-round', slot: 'direct' },
+  { value: 'proxy', label: 'Proxies', icon: 'i-lucide-route', slot: 'proxy' },
+  {
+    value: 'personal',
+    label: 'Personal subscriptions',
+    icon: 'i-lucide-user',
+    slot: 'personal',
+  },
+]
+
 // Only commercial coding-plan vendors that permit team/organization use are poolable here.
 // Claude, GLM and ChatGPT/Codex are licensed for individual use only, so they are connected
 // per-user in the "Personal subscriptions" section below (PersonalSubscriptionSection).
@@ -102,96 +117,112 @@ function vendorLabel(v: SubscriptionVendor): string {
 <template>
   <UModal v-model:open="open" title="LLM Vendors" :ui="{ content: 'max-w-2xl' }">
     <template #body>
-      <div class="space-y-5">
-        <p class="text-sm text-slate-400">
-          Connect a <strong>commercial</strong> coding-plan subscription (Kimi, DeepSeek) that
-          permits team/organization use to run agent steps on the Claude Code harness instead of an
-          API key. Tokens are stored encrypted, pooled, and rotated by usage. Subscription models
-          are flat-rate quota — they don’t draw on your spend budget. Individual-use subscriptions
-          (Claude, GLM, ChatGPT/Codex) are connected per-user in the Personal subscriptions section
-          below.
-        </p>
-
-        <h4 class="text-xs font-semibold uppercase tracking-wide text-slate-500">
-          Workspace pool (commercial coding plans)
-        </h4>
-
-        <!-- vendor picker -->
-        <div class="flex flex-wrap items-end gap-3">
-          <UFormField label="Vendor">
-            <USelect
-              v-model="vendor"
-              :items="visibleVendors.map((v) => ({ label: v.label, value: v.value }))"
-              class="w-64"
-            />
-          </UFormField>
-        </div>
-
-        <!-- guided steps -->
-        <ol
-          class="list-decimal space-y-1.5 rounded-lg border border-slate-700 bg-slate-900/60 p-4 pl-8 text-sm text-slate-300"
-        >
-          <li v-for="(step, i) in steps" :key="i">{{ step }}</li>
-        </ol>
-
-        <!-- add form -->
-        <div class="space-y-2">
-          <UFormField label="Label (optional)">
-            <UInput v-model="label" placeholder="e.g. work account" />
-          </UFormField>
-          <UFormField label="Token">
-            <UTextarea
-              v-model="token"
-              :rows="3"
-              :placeholder="tokenPlaceholder"
-              class="font-mono"
-            />
-          </UFormField>
-          <div class="flex justify-end">
-            <UButton :loading="busy" :disabled="!token.trim()" icon="i-lucide-plus" @click="add()">
-              Connect
-            </UButton>
-          </div>
-        </div>
-
-        <!-- connected pool -->
-        <div v-if="creds.credentials.length" class="space-y-2">
-          <h4 class="text-xs font-semibold uppercase tracking-wide text-slate-500">
-            Connected ({{ creds.credentials.length }})
-          </h4>
-          <div
-            v-for="c in creds.credentials"
-            :key="c.id"
-            class="flex items-center justify-between rounded-md border border-slate-700 bg-slate-900/50 px-3 py-2 text-sm"
-          >
-            <div>
-              <span class="font-medium text-slate-200">{{ c.label }}</span>
-              <span class="ml-2 text-xs text-slate-500">{{ vendorLabel(c.vendor) }}</span>
-              <div class="text-[11px] tabular-nums text-slate-500">
-                {{ (c.inputTokens + c.outputTokens).toLocaleString() }} tok this window ·
-                {{ c.requestCount }} run{{ c.requestCount === 1 ? '' : 's' }}
+      <UTabs
+        v-model="activeTab"
+        :items="tabs"
+        variant="link"
+        :ui="{ root: 'gap-4', list: 'overflow-x-auto' }"
+      >
+        <!-- Workspace pool (commercial coding-plan subscriptions) -->
+        <template #pool>
+          <div class="space-y-5">
+            <p class="text-sm text-slate-400">
+              Connect a <strong>commercial</strong> coding-plan subscription (Kimi, DeepSeek) that
+              permits team/organization use to run agent steps on the Claude Code harness instead of
+              an API key. Tokens are stored encrypted, pooled, and rotated by usage. Subscription
+              models are flat-rate quota — they don’t draw on your spend budget. Individual-use
+              subscriptions (Claude, GLM, ChatGPT/Codex) are connected per-user in the Personal
+              subscriptions tab.
+            </p>
+
+            <!-- vendor picker -->
+            <div class="flex flex-wrap items-end gap-3">
+              <UFormField label="Vendor">
+                <USelect
+                  v-model="vendor"
+                  :items="visibleVendors.map((v) => ({ label: v.label, value: v.value }))"
+                  class="w-64"
+                />
+              </UFormField>
+            </div>
+
+            <!-- guided steps -->
+            <ol
+              class="list-decimal space-y-1.5 rounded-lg border border-slate-700 bg-slate-900/60 p-4 pl-8 text-sm text-slate-300"
+            >
+              <li v-for="(step, i) in steps" :key="i">{{ step }}</li>
+            </ol>
+
+            <!-- add form -->
+            <div class="space-y-2">
+              <UFormField label="Label (optional)">
+                <UInput v-model="label" placeholder="e.g. work account" />
+              </UFormField>
+              <UFormField label="Token">
+                <UTextarea
+                  v-model="token"
+                  :rows="3"
+                  :placeholder="tokenPlaceholder"
+                  class="font-mono"
+                />
+              </UFormField>
+              <div class="flex justify-end">
+                <UButton
+                  :loading="busy"
+                  :disabled="!token.trim()"
+                  icon="i-lucide-plus"
+                  @click="add()"
+                >
+                  Connect
+                </UButton>
+              </div>
+            </div>
+
+            <!-- connected pool -->
+            <div v-if="creds.credentials.length" class="space-y-2">
+              <h4 class="text-xs font-semibold uppercase tracking-wide text-slate-500">
+                Connected ({{ creds.credentials.length }})
+              </h4>
+              <div
+                v-for="c in creds.credentials"
+                :key="c.id"
+                class="flex items-center justify-between rounded-md border border-slate-700 bg-slate-900/50 px-3 py-2 text-sm"
+              >
+                <div>
+                  <span class="font-medium text-slate-200">{{ c.label }}</span>
+                  <span class="ml-2 text-xs text-slate-500">{{ vendorLabel(c.vendor) }}</span>
+                  <div class="text-[11px] tabular-nums text-slate-500">
+                    {{ (c.inputTokens + c.outputTokens).toLocaleString() }} tok this window ·
+                    {{ c.requestCount }} run{{ c.requestCount === 1 ? '' : 's' }}
+                  </div>
+                </div>
+                <UButton
+                  icon="i-lucide-trash-2"
+                  color="error"
+                  variant="ghost"
+                  size="xs"
+                  @click="remove(c.id)"
+                />
               </div>
             </div>
-            <UButton
-              icon="i-lucide-trash-2"
-              color="error"
-              variant="ghost"
-              size="xs"
-              @click="remove(c.id)"
-            />
           </div>
-        </div>
+        </template>
+
+        <!-- Direct provider API keys (OpenAI/Anthropic/Qwen/DeepSeek/Moonshot), pooled -->
+        <template #direct>
+          <ProvidersApiKeysSection category="direct" />
+        </template>
 
-        <!-- direct provider API keys (OpenAI/Anthropic/Qwen/DeepSeek/Moonshot), pooled -->
-        <div class="border-t border-slate-800 pt-5">
-          <ProvidersApiKeysSection />
-        </div>
+        <!-- Proxies / gateways (OpenRouter, LiteLLM): intermediaries that front many vendors -->
+        <template #proxy>
+          <ProvidersApiKeysSection category="proxy" />
+        </template>
 
-        <!-- personal (individual-usage) subscriptions: Claude / GLM / Codex, per-user -->
-        <div class="border-t border-slate-800 pt-5">
+        <!-- Personal (individual-usage) subscriptions: Claude / GLM / Codex, per-user -->
+        <template #personal>
           <ProvidersPersonalSubscriptionSection />
-        </div>
-      </div>
+        </template>
+      </UTabs>
     </template>
   </UModal>
 </template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",