@cat-factory/app 0.110.0 → 0.110.2

package/app/components/settings/OpenRouterCatalogPanel.vue

@@ -30,6 +30,7 @@ const back = useIntegrationBack(open)
 // refs in the backend MODEL_CATALOG. Only the ones present in the live browse list are
 // ticked, so a recommendation never enables a slug OpenRouter doesn't actually serve.
 const RECOMMENDED_SLUGS = [
+  'anthropic/claude-fable-5',
   'anthropic/claude-opus-4.8',
   'openai/gpt-5.5',
   'google/gemini-3-pro',

package/app/stores/execution.ts

@@ -219,35 +219,29 @@ export const useExecutionStore = defineStore('execution', () => {
     }
   }
 
-  // Interacting with a running individual-usage run (resolve/approve/request-changes) rides
-  // the CACHED personal password along transparently so the server can re-mint the run's
-  // short-TTL activation before advancing — no prompt here (the user is only re-prompted on
-  // start/retry, once the cache lapses). For a non-individual run the server ignores it.
+  // Interacting with a running individual-usage run (resolve/approve/request-changes) advances
+  // + re-dispatches the run, so the server re-mints its short-TTL activation from the personal
+  // password first. It rides the cached password transparently, and — like start/retry — is
+  // gated through `withCredential`: a within-buffer/lapsed cache re-prompts EARLY here (while
+  // the user is present) rather than letting the run break mid-pipeline. For a non-individual
+  // run the server ignores it and nothing prompts.
   async function resolveDecision(instanceId: string, decisionId: string, choice: string) {
     const ws = useWorkspaceStore()
     const personal = usePersonalSubscriptionsStore()
-    await api.resolveDecision(
-      ws.requireId(),
-      instanceId,
-      decisionId,
-      { choice },
-      personal.getCachedPassword(),
-    )
-    await ws.refresh()
+    return await personal.withCredential(async (password) => {
+      await api.resolveDecision(ws.requireId(), instanceId, decisionId, { choice }, password)
+      await ws.refresh()
+    })
   }
 
   /** Approve a step's gated proposal (optionally edited); the run advances. */
   async function approveStep(instanceId: string, approvalId: string, proposal?: string) {
     const ws = useWorkspaceStore()
     const personal = usePersonalSubscriptionsStore()
-    await api.approveStep(
-      ws.requireId(),
-      instanceId,
-      approvalId,
-      { proposal },
-      personal.getCachedPassword(),
-    )
-    await ws.refresh()
+    return await personal.withCredential(async (password) => {
+      await api.approveStep(ws.requireId(), instanceId, approvalId, { proposal }, password)
+      await ws.refresh()
+    })
   }
 
   /** Request changes on a gated proposal; the step re-runs with the review. */
@@ -258,14 +252,10 @@ export const useExecutionStore = defineStore('execution', () => {
   ) {
     const ws = useWorkspaceStore()
     const personal = usePersonalSubscriptionsStore()
-    await api.requestStepChanges(
-      ws.requireId(),
-      instanceId,
-      approvalId,
-      review,
-      personal.getCachedPassword(),
-    )
-    await ws.refresh()
+    return await personal.withCredential(async (password) => {
+      await api.requestStepChanges(ws.requireId(), instanceId, approvalId, review, password)
+      await ws.refresh()
+    })
   }
 
   /** Reject a gated proposal; the run stops entirely (a retryable failure). */
@@ -278,8 +268,9 @@ export const useExecutionStore = defineStore('execution', () => {
   /**
    * Resolve a companion step parked at its rework cap: extra-round (one more pass) /
    * proceed (advance with the current output) / stop-reset (cancel + reset the task).
-   * Rides the cached personal password so the server can re-mint the run's activation
-   * before re-dispatching on extra-round/proceed.
+   * Rides the cached personal password (gated through `withCredential`, so a within-buffer
+   * cache re-prompts early) for the server to re-mint the run's activation before
+   * re-dispatching on extra-round/proceed.
    */
   async function resolveCompanionExceeded(
     instanceId: string,
@@ -288,14 +279,16 @@ export const useExecutionStore = defineStore('execution', () => {
   ) {
     const ws = useWorkspaceStore()
     const personal = usePersonalSubscriptionsStore()
-    await api.resolveCompanionExceeded(
-      ws.requireId(),
-      instanceId,
-      approvalId,
-      { choice },
-      personal.getCachedPassword(),
-    )
-    await ws.refresh()
+    return await personal.withCredential(async (password) => {
+      await api.resolveCompanionExceeded(
+        ws.requireId(),
+        instanceId,
+        approvalId,
+        { choice },
+        password,
+      )
+      await ws.refresh()
+    })
   }
 
   /** How many approval gates anywhere are awaiting a human. */

package/app/stores/personalSubscriptions.spec.ts

@@ -0,0 +1,112 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { ApiError } from '~/composables/api/errors'
+import { usePersonalSubscriptionsStore } from '~/stores/personalSubscriptions'
+
+// The single localStorage key the store caches the personal password under (private to the
+// store; hard-coded here so the buffer/expiry semantics can be asserted directly).
+const CACHE_KEY = 'cf.personal-pw'
+const HOUR = 60 * 60 * 1000
+/** Mirrors PASSWORD_EXPIRY_BUFFER_MS in the store — the runway a key must have to be ridden. */
+const BUFFER_MS = 8 * HOUR
+
+/** Write a cache entry with an explicit remaining lifetime (positive = valid, negative = past). */
+function seedCache(password: string, msFromNow: number) {
+  localStorage.setItem(CACHE_KEY, JSON.stringify({ password, expiresAt: Date.now() + msFromNow }))
+}
+
+/** A 428 credential_required error shaped like the server envelope the store parses. */
+function credentialError() {
+  return new ApiError(428, {
+    error: {
+      code: 'credential_required',
+      message: 'Enter your personal password.',
+      details: { vendor: 'claude', reason: 'password_required' },
+    },
+  })
+}
+
+/** Let queued microtasks (the first withCredential attempt + its catch) settle. */
+async function flush() {
+  await new Promise((resolve) => setTimeout(resolve, 0))
+}
+
+describe('personal-password cache expiry buffer', () => {
+  beforeEach(() => {
+    localStorage.clear()
+  })
+
+  it('returns a healthy key both plainly and within the buffer', () => {
+    const store = usePersonalSubscriptionsStore()
+    seedCache('secret', 40 * HOUR)
+    expect(store.getCachedPassword()).toBe('secret')
+    expect(store.getCachedPassword(BUFFER_MS)).toBe('secret')
+  })
+
+  it('withholds a within-buffer key for a buffered read but KEEPS it in storage', () => {
+    const store = usePersonalSubscriptionsStore()
+    seedCache('secret', 2 * HOUR) // still valid, but under the 8h buffer
+    // Plain read still returns it (it has not truly expired)…
+    expect(store.getCachedPassword()).toBe('secret')
+    // …but a buffered read withholds it so the action re-prompts early.
+    expect(store.getCachedPassword(BUFFER_MS)).toBeUndefined()
+    // Crucially it is NOT dropped — the key is still valid, just deliberately refreshed early.
+    expect(localStorage.getItem(CACHE_KEY)).not.toBeNull()
+  })
+
+  it('removes a truly-expired key on read', () => {
+    const store = usePersonalSubscriptionsStore()
+    seedCache('stale', -HOUR)
+    expect(store.getCachedPassword()).toBeUndefined()
+    expect(localStorage.getItem(CACHE_KEY)).toBeNull()
+  })
+})
+
+describe('withCredential early re-entry', () => {
+  beforeEach(() => {
+    localStorage.clear()
+  })
+
+  it('rides a healthy cached key without prompting', async () => {
+    const store = usePersonalSubscriptionsStore()
+    seedCache('secret', 40 * HOUR)
+    // The action only fails when it receives no password; a healthy key is passed through.
+    const action = vi.fn(async (pw?: string) => {
+      if (!pw) throw credentialError()
+    })
+    const ran = await store.withCredential(action)
+    expect(ran).toBe(true)
+    expect(action).toHaveBeenCalledWith('secret')
+    expect(store.pending).toBeNull()
+  })
+
+  it('prompts EARLY when the cached key is within the buffer, then refreshes it on re-entry', async () => {
+    const store = usePersonalSubscriptionsStore()
+    seedCache('secret', 2 * HOUR) // valid but within the 8h buffer → withheld on the first try
+    const action = vi.fn(async (pw?: string) => {
+      if (!pw) throw credentialError()
+    })
+
+    const done = store.withCredential(action)
+    await flush()
+
+    // The buffered first attempt sent no password → the server 428'd → the modal opened,
+    // even though the key had NOT actually expired yet. That is the early re-entry.
+    expect(action).toHaveBeenCalledWith(undefined)
+    expect(store.pending).not.toBeNull()
+    expect(store.pending?.reason).toBe('password_required')
+
+    const pending = store.pending!
+    await pending.retry('fresh-secret')
+
+    await expect(done).resolves.toBe(true)
+    expect(action).toHaveBeenLastCalledWith('fresh-secret')
+    expect(store.pending).toBeNull()
+    // The re-entered password is cached with a full (well beyond the buffer) window.
+    const cached = JSON.parse(localStorage.getItem(CACHE_KEY)!) as {
+      password: string
+      expiresAt: number
+    }
+    expect(cached.password).toBe('fresh-secret')
+    expect(cached.expiresAt - Date.now()).toBeGreaterThan(BUFFER_MS)
+  })
+})

package/app/stores/personalSubscriptions.ts

@@ -19,6 +19,13 @@ import type {
 // sent as the `X-Personal-Password` header — and the user is only re-prompted once it
 // expires (or is wrong).
 //
+// Every gated action (start / retry / confirm) re-validates the cache against an 8h EXPIRY
+// BUFFER: a key with less than that runway left is withheld (treated as absent) so the
+// server's 428 gate re-challenges EARLY and the modal refreshes the full window. This is
+// what keeps a key from lapsing MID-PIPELINE — the run breaks with a retry only if the key
+// was allowed to run down while the user wasn't looking, so we ask for re-entry while they
+// still are (at the start/confirm/retry they just triggered), not later.
+//
 // Caching here is a DELIBERATE convenience choice, not a security weakness. The password
 // layer exists to prevent ACCIDENTAL misuse (a credential can't be silently pooled); the
 // real at-rest protection is the server's system encryption, which the cache doesn't touch.
@@ -30,6 +37,12 @@ import type {
 
 /** How long a typed password stays cached before the user is re-prompted (40h). */
 const PASSWORD_TTL_MS = 40 * 60 * 60 * 1000
+/**
+ * Runway a cached password must still have for a gated action to ride it. Within this
+ * window of expiry the key is withheld so the action re-challenges and refreshes the cache
+ * EARLY — a buffer wide enough that a pipeline kicked off now won't outlive the key (8h).
+ */
+const PASSWORD_EXPIRY_BUFFER_MS = 8 * 60 * 60 * 1000
 const CACHE_KEY = 'cf.personal-pw'
 
 /** A credential prompt the UI must satisfy (set when the server replies 428). */
@@ -98,7 +111,13 @@ export const usePersonalSubscriptionsStore = defineStore('personalSubscriptions'
   const renewals = computed(() => subscriptions.value.filter((s) => s.renewSoon))
 
   // --- client-side password cache (single localStorage key + TTL) ------------
-  function getCachedPassword(): string | undefined {
+  /**
+   * The cached password, or `undefined` when there is none to ride. `bufferMs` withholds a
+   * still-valid key that is within that window of expiry (WITHOUT dropping it) so a gated
+   * action re-challenges early; a truly-expired key is always removed. Default `0` = the
+   * plain "is it still valid right now" read.
+   */
+  function getCachedPassword(bufferMs = 0): string | undefined {
     if (typeof localStorage === 'undefined') return undefined
     try {
       const raw = localStorage.getItem(CACHE_KEY)
@@ -108,6 +127,9 @@ export const usePersonalSubscriptionsStore = defineStore('personalSubscriptions'
         localStorage.removeItem(CACHE_KEY)
         return undefined
       }
+      // Within the buffer the key is still valid — keep it, but withhold it so the action
+      // re-challenges and refreshes the full window before it can lapse mid-pipeline.
+      if (Date.now() + bufferMs > expiresAt) return undefined
       return password
     } catch {
       return undefined
@@ -147,9 +169,11 @@ export const usePersonalSubscriptionsStore = defineStore('personalSubscriptions'
    */
   async function withCredential(action: (password?: string) => Promise<void>): Promise<boolean> {
     // First attempt may carry no password (non-individual runs) or the single cached one;
-    // the server only consults it when the block needs it.
+    // the server only consults it when the block needs it. A key within the expiry buffer
+    // is withheld so an individual-usage action 428s and re-prompts EARLY (refreshing the
+    // window) rather than riding a key that could lapse mid-pipeline.
     try {
-      await action(getCachedPassword())
+      await action(getCachedPassword(PASSWORD_EXPIRY_BUFFER_MS))
       return true
     } catch (error) {
       const credential = parseCredentialError(error)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.110.0",
+  "version": "0.110.2",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",