@cat-factory/app 0.154.1 → 0.156.0

package/app/components/vcs/GitLabConnect.vue

@@ -0,0 +1,85 @@
+<script setup lang="ts">
+// Per-workspace GitLab connect surface — the PAT analogue of <GitHubConnect>. GitLab has no
+// App-installation concept, so there is nothing to discover and nothing to redirect to: the
+// user pastes a personal access token, the backend validates it upstream, seals it, and writes
+// the same projection rows the GitHub connect writes (stamped `provider: 'gitlab'`). Once
+// connected, every repo surface downstream is the shared GitHub-shaped one.
+//
+// The token never persists in the browser: it lives in the field for the length of the request
+// and is cleared on success. A rejected token comes back as a typed API error whose message
+// says why (invalid, revoked, or missing the `api` scope), so it is shown inline rather than
+// flattened into a generic toast.
+import SecretInput from '~/components/common/SecretInput.vue'
+import { apiErrorEnvelope } from '~/composables/api/errors'
+import { VCS_PROVIDER_TOKEN_URLS } from '~/utils/vcs'
+
+const { t } = useI18n()
+const github = useGitHubStore()
+const toast = useToast()
+
+const pat = ref('')
+const connecting = ref(false)
+const error = ref<string | null>(null)
+
+const tokenUrl = VCS_PROVIDER_TOKEN_URLS.gitlab
+
+async function connect() {
+  const token = pat.value.trim()
+  if (!token || connecting.value) return
+  connecting.value = true
+  error.value = null
+  try {
+    await github.connectGitLab(token)
+    pat.value = ''
+    toast.add({
+      title: t('vcs.connect.gitlab.toast.connected'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    error.value =
+      apiErrorEnvelope(e)?.message ??
+      (e instanceof Error ? e.message : t('vcs.connect.gitlab.errors.connect'))
+  } finally {
+    connecting.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="space-y-3">
+    <p class="text-sm text-slate-400">{{ t('vcs.connect.gitlab.intro') }}</p>
+
+    <UFormField :label="t('vcs.connect.gitlab.tokenLabel')" :hint="t('vcs.connect.gitlab.scope')">
+      <SecretInput
+        v-model="pat"
+        placeholder="glpat-…"
+        autocomplete="off"
+        class="w-full"
+        data-testid="gitlab-pat-input"
+        @keyup.enter="connect"
+      />
+    </UFormField>
+
+    <p class="text-[11px] text-slate-500">
+      <ULink :to="tokenUrl" target="_blank" class="text-indigo-400 hover:underline">
+        {{ t('vcs.connect.gitlab.createToken') }}
+      </ULink>
+    </p>
+
+    <p v-if="error" class="text-sm text-rose-400" data-testid="gitlab-connect-error">
+      {{ error }}
+    </p>
+
+    <UButton
+      color="primary"
+      icon="i-lucide-gitlab"
+      :loading="connecting"
+      :disabled="!pat.trim()"
+      data-testid="gitlab-connect-submit"
+      @click="connect"
+    >
+      {{ t('vcs.connect.gitlab.submit') }}
+    </UButton>
+  </section>
+</template>

package/app/composables/api/validationChecks.ts

@@ -0,0 +1,39 @@
+import {
+  deleteServiceValidationConfigContract,
+  getServiceValidationConfigContract,
+  listServiceValidationConfigsContract,
+  setServiceValidationConfigContract,
+} from '@cat-factory/contracts'
+import type { UpsertServiceValidationConfigInput } from '~/types/validationChecks'
+import type { ApiContext } from './context'
+
+/** Pre-PR validation checks: the per-service-frame commands the harness runs before opening a PR. */
+export function validationChecksApi({ send, ws }: ApiContext) {
+  return {
+    listServiceValidationConfigs: (workspaceId: string) =>
+      send(listServiceValidationConfigsContract, { pathPrefix: ws(workspaceId) }),
+
+    getServiceValidationConfig: (workspaceId: string, blockId: string) =>
+      send(getServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+      }),
+
+    setServiceValidationConfig: (
+      workspaceId: string,
+      blockId: string,
+      body: UpsertServiceValidationConfigInput,
+    ) =>
+      send(setServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+        body,
+      }),
+
+    deleteServiceValidationConfig: (workspaceId: string, blockId: string) =>
+      send(deleteServiceValidationConfigContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+      }),
+  }
+}

package/app/composables/api/vcs.ts

@@ -0,0 +1,33 @@
+import {
+  connectGitLabContract,
+  disconnectGitLabContract,
+  getGitLabConnectionContract,
+  listVcsConnectOptionsContract,
+} from '@cat-factory/contracts'
+import type { ApiContext } from './context'
+
+/**
+ * Provider-neutral VCS connect surface: which connect methods the deployment serves, plus the
+ * per-workspace GitLab PAT connect. The GitHub App connect lives in `githubApi` (it is
+ * App-specific); everything a workspace does with a repo AFTER connecting — browse, link, sync,
+ * pulls, issues — stays on the GitHub-shaped endpoints, which serve GitLab through the adapter.
+ */
+export function vcsApi({ send, ws }: ApiContext) {
+  return {
+    // Capability probe: `[]` (or a 403/503) means this workspace has no connect surface at all.
+    listVcsConnectOptions: (workspaceId: string) =>
+      send(listVcsConnectOptionsContract, { pathPrefix: ws(workspaceId) }),
+
+    // The workspace's GitLab connection, or null. A 503 means GitLab connect isn't wired.
+    getGitLabConnection: (workspaceId: string) =>
+      send(getGitLabConnectionContract, { pathPrefix: ws(workspaceId) }),
+
+    // Connect by pasting a PAT; the backend validates it upstream before sealing it, so an
+    // invalid/insufficient token comes back as a 4xx with a human-readable message.
+    connectGitLab: (workspaceId: string, pat: string) =>
+      send(connectGitLabContract, { pathPrefix: ws(workspaceId), body: { pat } }),
+
+    disconnectGitLab: (workspaceId: string) =>
+      send(disconnectGitLabContract, { pathPrefix: ws(workspaceId) }),
+  }
+}

package/app/composables/useApi.ts

@@ -14,6 +14,7 @@ import { prReviewApi } from './api/prReview'
 import { fragmentsApi } from './api/fragments'
 import { skillsApi } from './api/skills'
 import { githubApi } from './api/github'
+import { vcsApi } from './api/vcs'
 import { humanReviewApi } from './api/humanReview'
 import { humanTestApi } from './api/humanTest'
 import { infraHandlersApi } from './api/infraHandlers'
@@ -35,6 +36,7 @@ import { recurringApi } from './api/recurring'
 import { previewApi } from './api/preview'
 import { environmentsApi } from './api/environments'
 import { releaseHealthApi } from './api/releaseHealth'
+import { validationChecksApi } from './api/validationChecks'
 import { sandboxApi } from './api/sandbox'
 import { reviewsApi } from './api/reviews'
 import { slackApi } from './api/slack'
@@ -135,6 +137,7 @@ export function useApi() {
     ...docInterviewApi(ctx),
     ...provisioningLogsApi(ctx),
     ...releaseHealthApi(ctx),
+    ...validationChecksApi(ctx),
     ...testSecretsApi(ctx),
     ...packageRegistriesApi(ctx),
     ...previewApi(ctx),
@@ -142,6 +145,7 @@ export function useApi() {
     ...recurringApi(ctx),
     ...sandboxApi(ctx),
     ...githubApi(ctx),
+    ...vcsApi(ctx),
     ...slackApi(ctx),
     ...bootstrapApi(ctx),
     ...userSecretsApi(ctx),

package/app/modular/panels/inspector.logic.spec.ts

@@ -41,6 +41,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 
@@ -59,6 +60,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 
@@ -70,6 +72,7 @@ describe('inspector panel group', () => {
       'service-test-secrets',
       'service-fragments',
       'service-release-health',
+      'service-validation-checks',
     ])
   })
 

package/app/modular/panels/inspector.logic.ts

@@ -53,6 +53,7 @@ export const INSPECTOR_PANEL_IDS = [
   'service-test-secrets',
   'service-fragments',
   'service-release-health',
+  'service-validation-checks',
   // epic / initiative body
   'epic-children',
   'initiative-inspector',
@@ -118,6 +119,10 @@ export const INSPECTOR_PANEL_SPECS: readonly InspectorPanelSpec[] = [
   { id: 'service-test-secrets', order: 150, when: isDeployableFrame },
   { id: 'service-fragments', order: 160, when: isFrame },
   { id: 'service-release-health', order: 170, when: isDeployableFrame },
+  // Pre-PR validation checks: the commands the harness runs before opening this service's PRs.
+  // Deployable frames only — a doc repo ships no build to install/lint/test, exactly like the
+  // test-infra and release-health panels above it.
+  { id: 'service-validation-checks', order: 180, when: isDeployableFrame },
   { id: 'epic-children', order: 200, when: (b) => b.level === 'epic' },
   { id: 'initiative-inspector', order: 210, when: (b) => b.level === 'initiative' },
 ]

package/app/modular/panels/inspector.ts

@@ -28,6 +28,7 @@ import ServiceTestConfig from '~/components/panels/inspector/ServiceTestConfig.v
 import ServiceTestSecrets from '~/components/panels/inspector/ServiceTestSecrets.vue'
 import ServiceFragments from '~/components/panels/inspector/ServiceFragments.vue'
 import ServiceReleaseHealthConfig from '~/components/panels/inspector/ServiceReleaseHealthConfig.vue'
+import ServiceValidationConfig from '~/components/panels/inspector/ServiceValidationConfig.vue'
 import EpicChildren from '~/components/panels/inspector/EpicChildren.vue'
 import InitiativeInspector from '~/components/panels/inspector/InitiativeInspector.vue'
 
@@ -80,6 +81,7 @@ const COMPONENTS: Record<InspectorPanelId, Component> = {
   'service-test-secrets': ServiceTestSecrets,
   'service-fragments': ServiceFragments,
   'service-release-health': ServiceReleaseHealthConfig,
+  'service-validation-checks': ServiceValidationConfig,
   'epic-children': EpicChildren,
   'initiative-inspector': InitiativeInspector,
 }

package/app/stores/github/connection.ts

@@ -1,4 +1,4 @@
-import type { ResyncRequest } from '~/types/domain'
+import type { ResyncRequest, VcsProvider } from '~/types/domain'
 import type { GitHubStoreContext } from './context'
 
 /**
@@ -6,6 +6,11 @@ import type { GitHubStoreContext } from './context'
  * triggering a resync of the projections. Extracted from the store setup; each operation closes
  * over the shared {@link GitHubStoreContext} so behaviour is identical to the original
  * in-closure functions — the split is purely to keep every function within the size budget.
+ *
+ * Disconnecting is the one operation that spans providers (a workspace holds at most one
+ * connection, of either kind), so it dispatches on the connection's `provider` through an
+ * exhaustive map — a new provider fails the typecheck here instead of silently falling back to
+ * the GitHub route.
  */
 export function createGitHubConnectionActions(ctx: GitHubStoreContext) {
   const { api, workspace, available, connection, installations, loadingInstallations } = ctx
@@ -34,8 +39,14 @@ export function createGitHubConnectionActions(ctx: GitHubStoreContext) {
     await load()
   }
 
+  const DISCONNECT_BY_PROVIDER: Record<VcsProvider, (workspaceId: string) => Promise<unknown>> = {
+    github: (id) => api.disconnectGitHub(id),
+    gitlab: (id) => api.disconnectGitLab(id),
+  }
+
   async function disconnect() {
-    await api.disconnectGitHub(workspace.requireId())
+    // Backends predating the discriminator omit `provider`; those connections are GitHub App ones.
+    await DISCONNECT_BY_PROVIDER[connection.value?.provider ?? 'github'](workspace.requireId())
     connection.value = null
     repos.value = []
     availableRepos.value = []

package/app/stores/github/context.ts

@@ -8,6 +8,7 @@ import type {
   GitHubPullRequest,
   GitHubRepo,
   RepoTreeEntry,
+  VcsConnectOption,
 } from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
 
@@ -26,6 +27,8 @@ export interface GitHubStoreContext {
   workspace: ReturnType<typeof useWorkspaceStore>
   available: Ref<boolean | null>
   connection: Ref<GitHubConnection | null>
+  /** The connect surfaces this deployment can serve (GitHub App / GitLab PAT / …). */
+  connectOptions: Ref<VcsConnectOption[]>
   installations: Ref<GitHubInstallationOption[]>
   loadingInstallations: Ref<boolean>
   repos: Ref<GitHubRepo[]>

package/app/stores/github/vcsConnect.ts

@@ -0,0 +1,40 @@
+import type { GitHubStoreContext } from './context'
+
+/**
+ * The provider-neutral half of the connection lifecycle: which connect surfaces the deployment
+ * serves, and the per-workspace **PAT** connect (GitLab today). The GitHub-App installation
+ * lifecycle lives in {@link createGitHubConnectionActions}; everything AFTER connecting — repos,
+ * branches, pulls, issues — is the one GitHub-shaped surface both providers ride, so there is no
+ * GitLab store (see the VCS section of CLAUDE.md).
+ */
+export function createVcsConnectActions(ctx: GitHubStoreContext) {
+  const { api, workspace, available, connection, connectOptions, load } = ctx
+
+  /**
+   * Load the deployment's connect capability. Best-effort: a 403 (a member without
+   * `integrations.manage`) or a 503 leaves the list empty, which renders as "no connect
+   * surface" rather than a broken picker.
+   */
+  async function loadConnectOptions(): Promise<void> {
+    try {
+      const { options } = await api.listVcsConnectOptions(workspace.requireId())
+      connectOptions.value = options
+    } catch {
+      connectOptions.value = []
+    }
+  }
+
+  /**
+   * Connect the workspace by pasting a GitLab PAT. The backend validates the token upstream
+   * before sealing it, so a rejected token surfaces here as a thrown API error with the reason;
+   * on success the returned connection carries `provider: 'gitlab'` and the projection loads
+   * through the same reads the GitHub connection uses.
+   */
+  async function connectGitLab(pat: string): Promise<void> {
+    connection.value = await api.connectGitLab(workspace.requireId(), pat.trim())
+    available.value = true
+    await load()
+  }
+
+  return { loadConnectOptions, connectGitLab }
+}

package/app/stores/github.spec.ts

@@ -0,0 +1,146 @@
+import { describe, it, expect, vi, type Mock } from 'vitest'
+import { useGitHubStore } from '~/stores/github'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { GitHubConnection, VcsConnectOption } from '~/types/domain'
+
+// The VCS connect surface of the (single, GitHub-shaped) repo store: which connect methods the
+// deployment offers, the per-workspace GitLab PAT connect, and the provider-routed disconnect.
+// These decide what the connect UI renders — an App picker a GitLab-only deployment can't serve,
+// or a GitHub disconnect call against a GitLab connection, are exactly the failures worth pinning.
+
+function connection(overrides: Partial<GitHubConnection> = {}): GitHubConnection {
+  return {
+    installationId: 42,
+    accountLogin: 'octocat',
+    targetType: 'User',
+    connectedAt: 1,
+    provider: 'github',
+    canCreateRepos: false,
+    canManageWorkflows: true,
+    ...overrides,
+  }
+}
+
+/** Stub the auto-imported `useApi()` with just the calls the connect actions make. */
+function stubApi<T extends Record<string, Mock>>(api: T) {
+  const full = {
+    listGitHubRepos: vi.fn().mockResolvedValue([]),
+    listGitHubPullRequests: vi.fn().mockResolvedValue([]),
+    listGitHubIssues: vi.fn().mockResolvedValue([]),
+    ...api,
+  }
+  vi.stubGlobal('useApi', () => full)
+  return full
+}
+
+/** A store bound to an active workspace (the actions all resolve one). */
+function storeWithWorkspace() {
+  useWorkspaceStore().workspaceId = 'ws-1'
+  return useGitHubStore()
+}
+
+describe('github store — VCS connect capability', () => {
+  it('probes the connection and the connect options together', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({
+        options: [{ provider: 'gitlab', method: 'pat' }] satisfies VcsConnectOption[],
+      }),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.canConnectGitHubApp).toBe(false)
+    expect(github.canConnectGitLabPat).toBe(true)
+    // A single-provider deployment names its provider, so the connect copy never says "choose".
+    expect(github.soleConnectProvider).toBe('gitlab')
+  })
+
+  it('reports no connect surface when the capability read fails, without hiding the integration', async () => {
+    // A member without `integrations.manage` gets a 403 here. That must degrade to "nothing to
+    // connect", NOT to a broken picker — and must not flip the whole integration off.
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockRejectedValue(new Error('403')),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.connectOptions).toEqual([])
+    expect(github.soleConnectProvider).toBeNull()
+  })
+
+  it('stays neutral when the deployment serves several providers', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({
+        options: [
+          { provider: 'github', method: 'app' },
+          { provider: 'gitlab', method: 'pat' },
+        ] satisfies VcsConnectOption[],
+      }),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.canConnectGitHubApp).toBe(true)
+    expect(github.canConnectGitLabPat).toBe(true)
+    expect(github.soleConnectProvider).toBeNull()
+  })
+
+  it('connects GitLab with a trimmed PAT and loads the projection', async () => {
+    const api = stubApi({
+      connectGitLab: vi.fn().mockResolvedValue(connection({ provider: 'gitlab' })),
+    })
+    const github = storeWithWorkspace()
+
+    await github.connectGitLab('  glpat-secret  ')
+
+    expect(api.connectGitLab).toHaveBeenCalledWith('ws-1', 'glpat-secret')
+    expect(github.connected).toBe(true)
+    expect(github.provider).toBe('gitlab')
+    expect(github.available).toBe(true)
+    // Connecting seeds the projection reads, exactly as the App connect does.
+    expect(api.listGitHubRepos).toHaveBeenCalledWith('ws-1')
+  })
+
+  it('routes disconnect to the provider that is actually connected', async () => {
+    const api = stubApi({
+      connectGitLab: vi.fn().mockResolvedValue(connection({ provider: 'gitlab' })),
+      disconnectGitLab: vi.fn().mockResolvedValue(undefined),
+      disconnectGitHub: vi.fn().mockResolvedValue(undefined),
+    })
+    const github = storeWithWorkspace()
+    await github.connectGitLab('glpat-secret')
+
+    await github.disconnect()
+
+    expect(api.disconnectGitLab).toHaveBeenCalledWith('ws-1')
+    expect(api.disconnectGitHub).not.toHaveBeenCalled()
+    expect(github.connection).toBeNull()
+  })
+
+  it('disconnects a connection with no provider through the GitHub route', async () => {
+    // Backends predating the discriminator omit `provider`; those are GitHub App connections.
+    const api = stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({
+        connection: { ...connection(), provider: undefined },
+      }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      disconnectGitHub: vi.fn().mockResolvedValue(undefined),
+      disconnectGitLab: vi.fn().mockResolvedValue(undefined),
+    })
+    const github = storeWithWorkspace()
+    await github.probe()
+
+    await github.disconnect()
+
+    expect(api.disconnectGitHub).toHaveBeenCalledWith('ws-1')
+    expect(api.disconnectGitLab).not.toHaveBeenCalled()
+  })
+})

package/app/stores/github.ts

@@ -9,6 +9,8 @@ import type {
   GitHubPullRequest,
   GitHubRepo,
   RepoTreeEntry,
+  VcsConnectOption,
+  VcsProvider,
 } from '~/types/domain'
 import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
 import { useUpsertList } from '~/composables/useUpsertList'
@@ -17,6 +19,7 @@ import { useServicesStore } from '~/stores/services'
 import { pullKey, type GitHubStoreContext } from '~/stores/github/context'
 import { createGitHubConnectionActions } from '~/stores/github/connection'
 import { createGitHubRepoActions } from '~/stores/github/repoActions'
+import { createVcsConnectActions } from '~/stores/github/vcsConnect'
 
 /**
  * GitHub integration state: the workspace's App installation, the projected
@@ -33,8 +36,10 @@ export const useGitHubStore = defineStore('github', () => {
 
   /** null = unknown (not probed yet), true/false = integration on/off. */
   const available = ref<boolean | null>(null)
-  /** The workspace's App installation, or null when not yet connected. */
+  /** The workspace's VCS connection (App installation or PAT), or null when not connected. */
   const connection = ref<GitHubConnection | null>(null)
+  /** The connect surfaces this deployment serves; resolved by the probe alongside `connection`. */
+  const connectOptions = ref<VcsConnectOption[]>([])
   /** Discovered App installations for the connect picker; loaded on demand. */
   const installations = ref<GitHubInstallationOption[]>([])
   const loadingInstallations = ref(false)
@@ -58,6 +63,26 @@ export const useGitHubStore = defineStore('github', () => {
   const syncing = ref(false)
 
   const connected = computed(() => connection.value !== null)
+  /**
+   * The provider backing the current connection. Presentation (labels, icons, host/URL shapes)
+   * keys off this; a connection from a backend predating the discriminator is a GitHub App one.
+   */
+  const provider = computed<VcsProvider>(() => connection.value?.provider ?? 'github')
+  /** Whether the deployment can serve a GitHub App connect / a per-workspace GitLab PAT connect. */
+  const canConnectGitHubApp = computed(() =>
+    connectOptions.value.some((o) => o.provider === 'github' && o.method === 'app'),
+  )
+  const canConnectGitLabPat = computed(() =>
+    connectOptions.value.some((o) => o.provider === 'gitlab' && o.method === 'pat'),
+  )
+  /**
+   * The single provider this deployment can connect, or null when it offers several (or none) —
+   * what the connect copy keys off so a one-provider deployment never says "choose a provider".
+   */
+  const soleConnectProvider = computed<VcsProvider | null>(() => {
+    const providers = new Set(connectOptions.value.map((o) => o.provider))
+    return providers.size === 1 ? [...providers][0]! : null
+  })
   /** Whether cat-factory can create repos under the connected account itself. */
   const canCreateRepos = computed(() => connection.value?.canCreateRepos === true)
   /**
@@ -104,17 +129,29 @@ export const useGitHubStore = defineStore('github', () => {
     return base ? `${base}/issues/${issue.number}` : null
   }
 
-  /** Probe the integration: resolves `available` and the current connection. */
+  /**
+   * Probe the integration: resolves `available`, the current connection, and which connect
+   * surfaces the deployment serves. The capability read rides the same round trip (it is what
+   * the not-connected UI renders from), and degrades to "no connect surface" on its own.
+   */
   async function runProbe() {
     if (!workspace.workspaceId) return
     try {
-      const { connection: conn } = await api.getGitHubConnection(workspace.requireId())
+      const [{ connection: conn }, options] = await Promise.all([
+        api.getGitHubConnection(workspace.requireId()),
+        api
+          .listVcsConnectOptions(workspace.requireId())
+          .then((r) => r.options)
+          .catch(() => []),
+      ])
       available.value = true
       connection.value = conn
+      connectOptions.value = options
     } catch {
       // 503 (integration disabled) or any error → hide the UI entry points.
       available.value = false
       connection.value = null
+      connectOptions.value = []
     }
   }
   // Single-flight the probe (app-startup initiative, item 12): `probe()` still re-reads on demand,
@@ -162,6 +199,7 @@ export const useGitHubStore = defineStore('github', () => {
     workspace,
     available,
     connection,
+    connectOptions,
     installations,
     loadingInstallations,
     repos,
@@ -180,6 +218,7 @@ export const useGitHubStore = defineStore('github', () => {
   }
   const connectionActions = createGitHubConnectionActions(context)
   const repoActions = createGitHubRepoActions(context)
+  const vcsConnectActions = createVcsConnectActions(context)
 
   /**
    * Drop the per-workspace projection + connection state (called on workspace switch)
@@ -189,6 +228,7 @@ export const useGitHubStore = defineStore('github', () => {
   function reset() {
     available.value = null
     connection.value = null
+    connectOptions.value = []
     installations.value = []
     repos.value = []
     availableRepos.value = []
@@ -201,6 +241,7 @@ export const useGitHubStore = defineStore('github', () => {
   return {
     available,
     connection,
+    connectOptions,
     installations,
     loadingInstallations,
     repos,
@@ -213,6 +254,10 @@ export const useGitHubStore = defineStore('github', () => {
     loading,
     syncing,
     connected,
+    provider,
+    canConnectGitHubApp,
+    canConnectGitLabPat,
+    soleConnectProvider,
     canCreateRepos,
     missingWorkflowsPermission,
     repoFor,
@@ -229,6 +274,7 @@ export const useGitHubStore = defineStore('github', () => {
     repoFiles,
     ...connectionActions,
     ...repoActions,
+    ...vcsConnectActions,
     reset,
   }
 })