@cat-factory/app 0.155.0 → 0.156.0

package/README.md

@@ -78,9 +78,10 @@ example ships in [`deploy/frontend`](../../deploy/frontend) (the `acme:security`
   docs/issues/scenarios. Decisions resolve via `DecisionModal`.
 - **Pipeline builder** (`components/pipeline`) — assemble/edit agent chains and
   watch `PipelineProgress`.
-- **Integrations** — modals/panels for `github`, `bootstrap`, `documents`,
-  `tasks`, `requirements` (review), `scenarios` (acceptance), and `fragments`
-  (the prompt-fragment library).
+- **Integrations** — modals/panels for `github` (the source-control panel, shared
+  by every VCS provider), `vcs` (the GitLab personal-access-token connect),
+  `bootstrap`, `documents`, `tasks`, `requirements` (review), `scenarios`
+  (acceptance), and `fragments` (the prompt-fragment library).
 - **Auth** (`components/auth`) — `AuthGate` / `LoginScreen` / `UserMenu`; the app
   is gated when the backend requires sign-in.
 

package/app/components/auth/LoginScreen.vue

@@ -2,28 +2,24 @@
 import { computed, ref, watch } from 'vue'
 import { apiErrorEnvelope } from '~/composables/api/errors'
 import SecretInput from '~/components/common/SecretInput.vue'
+import type { VcsProvider } from '~/types/domain'
+import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS, VCS_PROVIDER_TOKEN_URLS } from '~/utils/vcs'
 
 const auth = useAuthStore()
 const { t } = useI18n()
 
 // Local-mode source-control PAT login. The PAT lives server-side in env (GITHUB_PAT /
 // GITLAB_PAT); the login screen only SELECTS a configured provider — no token is ever typed
-// into or shown in the browser. GitHub/GitLab are brand names (kept verbatim across locales),
-// as are the token-settings URLs, so they're inline constants rather than catalog keys — same
-// convention as the provider descriptors in ApiKeysSection. The "create a token" link prefers
-// the server's scopes-preselected deep link (`patLogin.setupUrls`); these are the fallback.
-type PatProvider = 'github' | 'gitlab'
+// into or shown in the browser. The brand labels / icons / token-settings URLs are the shared
+// provider descriptors in `~/utils/vcs` (brand names stay verbatim across locales, so they are
+// constants rather than catalog keys — the same convention as ApiKeysSection). The "create a
+// token" link prefers the server's scopes-preselected deep link (`patLogin.setupUrls`); the
+// descriptor's URL is the fallback.
+type PatProvider = VcsProvider
 const ALL_PROVIDERS: PatProvider[] = ['github', 'gitlab']
-const PROVIDER_LABELS: Record<PatProvider, string> = { github: 'GitHub', gitlab: 'GitLab' }
-const PROVIDER_ICONS: Record<PatProvider, string> = {
-  github: 'i-lucide-github',
-  gitlab: 'i-lucide-gitlab',
-}
-// Fallback token-creation pages, used only if the server didn't advertise a deep link.
-const PROVIDER_TOKEN_URLS: Record<PatProvider, string> = {
-  github: 'https://github.com/settings/tokens/new',
-  gitlab: 'https://gitlab.com/-/user_settings/personal_access_tokens',
-}
+const PROVIDER_LABELS = VCS_PROVIDER_LABELS
+const PROVIDER_ICONS = VCS_PROVIDER_ICONS
+const PROVIDER_TOKEN_URLS = VCS_PROVIDER_TOKEN_URLS
 
 const patLoginCfg = computed(() => auth.localMode?.patLogin)
 // Only providers whose PAT is configured in env can sign in (the token is the operational

package/app/components/github/GitHubOnboarding.vue

@@ -1,16 +1,29 @@
 <script setup lang="ts">
-// Hard onboarding gate shown after login when the GitHub integration is enabled
-// but the workspace has no App installation yet. cat-factory's whole flow runs on
-// the App (agents open PRs on the user's repos), so the board is withheld until
-// the App is installed/connected. Reuses <GitHubConnect>, which drives the
-// account-level install (https://github.com/apps/<slug>/installations/new — the
+// Hard onboarding gate shown after login when the VCS integration is enabled but the workspace
+// has no connection yet. cat-factory's whole flow runs on a connected repository host (agents
+// open pull/merge requests on the user's repos), so the board is withheld until the workspace
+// connects one. Renders the connect surfaces the deployment can actually serve: <GitHubConnect>
+// drives the account-level App install (https://github.com/apps/<slug>/installations/new — the
 // user picks the account/org and grants all or a subset of repos) plus the
-// pick-an-existing-installation path. A "Sign out" escape hatch avoids trapping a
-// user who needs to switch GitHub accounts.
+// pick-an-existing-installation path, and <GitLabConnect> takes a pasted GitLab PAT. A "Sign
+// out" escape hatch avoids trapping a user who needs to switch accounts.
 import GitHubConnect from '~/components/github/GitHubConnect.vue'
+import GitLabConnect from '~/components/vcs/GitLabConnect.vue'
+import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS } from '~/utils/vcs'
 
 const { t } = useI18n()
 const auth = useAuthStore()
+const github = useGitHubStore()
+
+// A deployment that serves exactly one provider names it; one serving several stays neutral
+// (the per-surface copy below then says which is which).
+const sole = computed(() => github.soleConnectProvider)
+const icon = computed(() => (sole.value ? VCS_PROVIDER_ICONS[sole.value] : 'i-lucide-git-branch'))
+const title = computed(() =>
+  sole.value
+    ? t('vcs.onboarding.title', { provider: VCS_PROVIDER_LABELS[sole.value] })
+    : t('vcs.onboarding.titleAny'),
+)
 </script>
 
 <template>
@@ -21,14 +34,29 @@ const auth = useAuthStore()
       class="my-8 w-full max-w-md rounded-xl border border-slate-800 bg-slate-900/80 p-8 backdrop-blur"
     >
       <div class="mb-5 text-center">
-        <UIcon name="i-lucide-github" class="mx-auto mb-3 h-10 w-10 text-indigo-400" />
-        <h1 class="mb-1 text-lg font-semibold text-white">{{ t('github.onboarding.title') }}</h1>
+        <UIcon :name="icon" class="mx-auto mb-3 h-10 w-10 text-indigo-400" />
+        <h1 class="mb-1 text-lg font-semibold text-white">{{ title }}</h1>
         <p class="text-sm text-slate-400">
-          {{ t('github.onboarding.intro') }}
+          {{ t('vcs.onboarding.intro') }}
         </p>
       </div>
 
-      <GitHubConnect />
+      <template v-if="github.canConnectGitHubApp">
+        <p class="mb-3 text-sm text-slate-400">{{ t('github.onboarding.appIntro') }}</p>
+        <GitHubConnect />
+      </template>
+      <USeparator
+        v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
+        class="my-4"
+        :label="t('vcs.connect.or')"
+      />
+      <GitLabConnect v-if="github.canConnectGitLabPat" />
+      <p
+        v-if="!github.canConnectGitHubApp && !github.canConnectGitLabPat"
+        class="rounded-md border border-dashed border-slate-800 px-3 py-3 text-sm text-slate-400"
+      >
+        {{ t('vcs.connect.noneConfigured') }}
+      </p>
 
       <p
         v-if="auth.required && auth.user"

package/app/components/github/GitHubPanel.vue

@@ -4,13 +4,15 @@
 // pull requests and issues the backend caches in D1. Mirrors the document-source
 // connect/import surface, but for GitHub. Writes (new branch, open/merge PR,
 // comment) go straight to the repo via the backend's installation token.
-import type { GitHubPullRequest, GitHubRepo } from '~/types/domain'
+import type { GitHubPullRequest, GitHubRepo, VcsProvider } from '~/types/domain'
 // Explicit import: the auto-import name for a component nested under a
 // like-named directory (github/GitHubConnect) doesn't match the `<GitHubConnect>`
 // tag, so it silently renders as an empty element. Importing it directly binds
 // the tag unambiguously.
 import GitHubConnect from './GitHubConnect.vue'
+import GitLabConnect from '~/components/vcs/GitLabConnect.vue'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
+import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS } from '~/utils/vcs'
 
 const { t } = useI18n()
 const ui = useUiStore()
@@ -26,6 +28,32 @@ const open = computed({
 })
 const back = useIntegrationBack(open)
 
+// Provider-aware chrome: once connected, the panel is titled for the provider the workspace
+// actually connected; before that it names the sole connectable provider, or stays neutral when
+// the deployment serves several. Brand names are verbatim in every locale (see `~/utils/vcs`).
+const chromeProvider = computed(() =>
+  github.connected ? github.provider : github.soleConnectProvider,
+)
+const panelTitle = computed(() =>
+  chromeProvider.value ? VCS_PROVIDER_LABELS[chromeProvider.value] : t('vcs.panel.title'),
+)
+const providerIcon = computed(() =>
+  chromeProvider.value ? VCS_PROVIDER_ICONS[chromeProvider.value] : 'i-lucide-git-branch',
+)
+
+// What the connection line says under the account: a GitHub App connection is identified by its
+// installation, a PAT connection by the credential it rides. Keyed by an exhaustive Record of
+// literal `t()` keys, so a new provider fails the typecheck rather than rendering App vocabulary.
+const CONNECTION_META: Record<VcsProvider, () => string> = {
+  github: () =>
+    t('github.panel.installationMeta', {
+      targetType: github.connection?.targetType ?? '',
+      id: github.connection?.installationId ?? '',
+    }),
+  gitlab: () => t('vcs.panel.patMeta'),
+}
+const connectionMeta = computed(() => CONNECTION_META[github.provider]())
+
 // On open: refresh projections when connected. The not-connected state renders
 // <GitHubConnect>, which discovers and links installations on its own.
 watch(
@@ -48,8 +76,10 @@ function notifyError(title: string, e: unknown) {
 
 async function disconnect() {
   const ok = await confirm({
-    title: t('github.panel.confirmDisconnect.title'),
-    description: t('github.panel.confirmDisconnect.body'),
+    title: t('vcs.panel.confirmDisconnect.title', {
+      provider: VCS_PROVIDER_LABELS[github.provider],
+    }),
+    description: t('vcs.panel.confirmDisconnect.body'),
     variant: 'destructive',
     confirmLabel: t('common.disconnect'),
     icon: 'i-lucide-unplug',
@@ -57,7 +87,10 @@ async function disconnect() {
   if (!ok) return
   try {
     await github.disconnect()
-    toast.add({ title: t('github.panel.toast.disconnected'), icon: 'i-lucide-unplug' })
+    toast.add({
+      title: t('vcs.panel.toast.disconnected', { provider: VCS_PROVIDER_LABELS[github.provider] }),
+      icon: 'i-lucide-unplug',
+    })
   } catch (e) {
     notifyError(t('github.panel.errors.disconnect'), e)
   }
@@ -241,19 +274,32 @@ async function merge(pr: GitHubPullRequest) {
 </script>
 
 <template>
-  <UModal v-model:open="open" title="GitHub" :ui="{ content: 'max-w-2xl' }">
+  <UModal v-model:open="open" :title="panelTitle" :ui="{ content: 'max-w-2xl' }">
     <template #title>
-      <IntegrationBackTitle title="GitHub" @back="back" />
+      <IntegrationBackTitle :title="panelTitle" @back="back" />
     </template>
     <template #body>
       <div class="space-y-5">
         <!-- not connected: connect -->
         <template v-if="!github.connected">
-          <p class="text-sm text-slate-400">
-            {{ t('github.panel.connectIntro') }}
+          <!-- One connect surface per method the deployment actually serves: the App
+               installation picker only where a GitHub App is configured, the PAT box only
+               where the per-workspace GitLab connect is wired. -->
+          <template v-if="github.canConnectGitHubApp">
+            <p class="text-sm text-slate-400">{{ t('github.panel.connectIntro') }}</p>
+            <GitHubConnect />
+          </template>
+          <USeparator
+            v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
+            :label="t('vcs.connect.or')"
+          />
+          <GitLabConnect v-if="github.canConnectGitLabPat" />
+          <p
+            v-if="!github.canConnectGitHubApp && !github.canConnectGitLabPat"
+            class="rounded-md border border-dashed border-slate-800 px-3 py-3 text-sm text-slate-400"
+          >
+            {{ t('vcs.connect.noneConfigured') }}
           </p>
-
-          <GitHubConnect />
         </template>
 
         <!-- connected: manage + browse -->
@@ -263,19 +309,12 @@ async function merge(pr: GitHubPullRequest) {
             class="flex items-center justify-between gap-2 rounded-md border border-slate-800 bg-slate-900/60 px-3 py-2"
           >
             <div class="flex items-center gap-2 min-w-0">
-              <UIcon name="i-lucide-github" class="h-5 w-5 text-slate-300" />
+              <UIcon :name="providerIcon" class="h-5 w-5 text-slate-300" />
               <div class="min-w-0">
                 <div class="truncate text-sm text-slate-200">
                   {{ github.connection?.accountLogin }}
                 </div>
-                <div class="text-[11px] text-slate-500">
-                  {{
-                    t('github.panel.installationMeta', {
-                      targetType: github.connection?.targetType,
-                      id: github.connection?.installationId,
-                    })
-                  }}
-                </div>
+                <div class="text-[11px] text-slate-500">{{ connectionMeta }}</div>
               </div>
             </div>
             <div class="flex items-center gap-1">

package/app/components/vcs/GitLabConnect.vue

@@ -0,0 +1,85 @@
+<script setup lang="ts">
+// Per-workspace GitLab connect surface — the PAT analogue of <GitHubConnect>. GitLab has no
+// App-installation concept, so there is nothing to discover and nothing to redirect to: the
+// user pastes a personal access token, the backend validates it upstream, seals it, and writes
+// the same projection rows the GitHub connect writes (stamped `provider: 'gitlab'`). Once
+// connected, every repo surface downstream is the shared GitHub-shaped one.
+//
+// The token never persists in the browser: it lives in the field for the length of the request
+// and is cleared on success. A rejected token comes back as a typed API error whose message
+// says why (invalid, revoked, or missing the `api` scope), so it is shown inline rather than
+// flattened into a generic toast.
+import SecretInput from '~/components/common/SecretInput.vue'
+import { apiErrorEnvelope } from '~/composables/api/errors'
+import { VCS_PROVIDER_TOKEN_URLS } from '~/utils/vcs'
+
+const { t } = useI18n()
+const github = useGitHubStore()
+const toast = useToast()
+
+const pat = ref('')
+const connecting = ref(false)
+const error = ref<string | null>(null)
+
+const tokenUrl = VCS_PROVIDER_TOKEN_URLS.gitlab
+
+async function connect() {
+  const token = pat.value.trim()
+  if (!token || connecting.value) return
+  connecting.value = true
+  error.value = null
+  try {
+    await github.connectGitLab(token)
+    pat.value = ''
+    toast.add({
+      title: t('vcs.connect.gitlab.toast.connected'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    error.value =
+      apiErrorEnvelope(e)?.message ??
+      (e instanceof Error ? e.message : t('vcs.connect.gitlab.errors.connect'))
+  } finally {
+    connecting.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="space-y-3">
+    <p class="text-sm text-slate-400">{{ t('vcs.connect.gitlab.intro') }}</p>
+
+    <UFormField :label="t('vcs.connect.gitlab.tokenLabel')" :hint="t('vcs.connect.gitlab.scope')">
+      <SecretInput
+        v-model="pat"
+        placeholder="glpat-…"
+        autocomplete="off"
+        class="w-full"
+        data-testid="gitlab-pat-input"
+        @keyup.enter="connect"
+      />
+    </UFormField>
+
+    <p class="text-[11px] text-slate-500">
+      <ULink :to="tokenUrl" target="_blank" class="text-indigo-400 hover:underline">
+        {{ t('vcs.connect.gitlab.createToken') }}
+      </ULink>
+    </p>
+
+    <p v-if="error" class="text-sm text-rose-400" data-testid="gitlab-connect-error">
+      {{ error }}
+    </p>
+
+    <UButton
+      color="primary"
+      icon="i-lucide-gitlab"
+      :loading="connecting"
+      :disabled="!pat.trim()"
+      data-testid="gitlab-connect-submit"
+      @click="connect"
+    >
+      {{ t('vcs.connect.gitlab.submit') }}
+    </UButton>
+  </section>
+</template>

package/app/composables/api/vcs.ts

@@ -0,0 +1,33 @@
+import {
+  connectGitLabContract,
+  disconnectGitLabContract,
+  getGitLabConnectionContract,
+  listVcsConnectOptionsContract,
+} from '@cat-factory/contracts'
+import type { ApiContext } from './context'
+
+/**
+ * Provider-neutral VCS connect surface: which connect methods the deployment serves, plus the
+ * per-workspace GitLab PAT connect. The GitHub App connect lives in `githubApi` (it is
+ * App-specific); everything a workspace does with a repo AFTER connecting — browse, link, sync,
+ * pulls, issues — stays on the GitHub-shaped endpoints, which serve GitLab through the adapter.
+ */
+export function vcsApi({ send, ws }: ApiContext) {
+  return {
+    // Capability probe: `[]` (or a 403/503) means this workspace has no connect surface at all.
+    listVcsConnectOptions: (workspaceId: string) =>
+      send(listVcsConnectOptionsContract, { pathPrefix: ws(workspaceId) }),
+
+    // The workspace's GitLab connection, or null. A 503 means GitLab connect isn't wired.
+    getGitLabConnection: (workspaceId: string) =>
+      send(getGitLabConnectionContract, { pathPrefix: ws(workspaceId) }),
+
+    // Connect by pasting a PAT; the backend validates it upstream before sealing it, so an
+    // invalid/insufficient token comes back as a 4xx with a human-readable message.
+    connectGitLab: (workspaceId: string, pat: string) =>
+      send(connectGitLabContract, { pathPrefix: ws(workspaceId), body: { pat } }),
+
+    disconnectGitLab: (workspaceId: string) =>
+      send(disconnectGitLabContract, { pathPrefix: ws(workspaceId) }),
+  }
+}

package/app/composables/useApi.ts

@@ -14,6 +14,7 @@ import { prReviewApi } from './api/prReview'
 import { fragmentsApi } from './api/fragments'
 import { skillsApi } from './api/skills'
 import { githubApi } from './api/github'
+import { vcsApi } from './api/vcs'
 import { humanReviewApi } from './api/humanReview'
 import { humanTestApi } from './api/humanTest'
 import { infraHandlersApi } from './api/infraHandlers'
@@ -144,6 +145,7 @@ export function useApi() {
     ...recurringApi(ctx),
     ...sandboxApi(ctx),
     ...githubApi(ctx),
+    ...vcsApi(ctx),
     ...slackApi(ctx),
     ...bootstrapApi(ctx),
     ...userSecretsApi(ctx),

package/app/stores/github/connection.ts

@@ -1,4 +1,4 @@
-import type { ResyncRequest } from '~/types/domain'
+import type { ResyncRequest, VcsProvider } from '~/types/domain'
 import type { GitHubStoreContext } from './context'
 
 /**
@@ -6,6 +6,11 @@ import type { GitHubStoreContext } from './context'
  * triggering a resync of the projections. Extracted from the store setup; each operation closes
  * over the shared {@link GitHubStoreContext} so behaviour is identical to the original
  * in-closure functions — the split is purely to keep every function within the size budget.
+ *
+ * Disconnecting is the one operation that spans providers (a workspace holds at most one
+ * connection, of either kind), so it dispatches on the connection's `provider` through an
+ * exhaustive map — a new provider fails the typecheck here instead of silently falling back to
+ * the GitHub route.
  */
 export function createGitHubConnectionActions(ctx: GitHubStoreContext) {
   const { api, workspace, available, connection, installations, loadingInstallations } = ctx
@@ -34,8 +39,14 @@ export function createGitHubConnectionActions(ctx: GitHubStoreContext) {
     await load()
   }
 
+  const DISCONNECT_BY_PROVIDER: Record<VcsProvider, (workspaceId: string) => Promise<unknown>> = {
+    github: (id) => api.disconnectGitHub(id),
+    gitlab: (id) => api.disconnectGitLab(id),
+  }
+
   async function disconnect() {
-    await api.disconnectGitHub(workspace.requireId())
+    // Backends predating the discriminator omit `provider`; those connections are GitHub App ones.
+    await DISCONNECT_BY_PROVIDER[connection.value?.provider ?? 'github'](workspace.requireId())
     connection.value = null
     repos.value = []
     availableRepos.value = []

package/app/stores/github/context.ts

@@ -8,6 +8,7 @@ import type {
   GitHubPullRequest,
   GitHubRepo,
   RepoTreeEntry,
+  VcsConnectOption,
 } from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
 
@@ -26,6 +27,8 @@ export interface GitHubStoreContext {
   workspace: ReturnType<typeof useWorkspaceStore>
   available: Ref<boolean | null>
   connection: Ref<GitHubConnection | null>
+  /** The connect surfaces this deployment can serve (GitHub App / GitLab PAT / …). */
+  connectOptions: Ref<VcsConnectOption[]>
   installations: Ref<GitHubInstallationOption[]>
   loadingInstallations: Ref<boolean>
   repos: Ref<GitHubRepo[]>

package/app/stores/github/vcsConnect.ts

@@ -0,0 +1,40 @@
+import type { GitHubStoreContext } from './context'
+
+/**
+ * The provider-neutral half of the connection lifecycle: which connect surfaces the deployment
+ * serves, and the per-workspace **PAT** connect (GitLab today). The GitHub-App installation
+ * lifecycle lives in {@link createGitHubConnectionActions}; everything AFTER connecting — repos,
+ * branches, pulls, issues — is the one GitHub-shaped surface both providers ride, so there is no
+ * GitLab store (see the VCS section of CLAUDE.md).
+ */
+export function createVcsConnectActions(ctx: GitHubStoreContext) {
+  const { api, workspace, available, connection, connectOptions, load } = ctx
+
+  /**
+   * Load the deployment's connect capability. Best-effort: a 403 (a member without
+   * `integrations.manage`) or a 503 leaves the list empty, which renders as "no connect
+   * surface" rather than a broken picker.
+   */
+  async function loadConnectOptions(): Promise<void> {
+    try {
+      const { options } = await api.listVcsConnectOptions(workspace.requireId())
+      connectOptions.value = options
+    } catch {
+      connectOptions.value = []
+    }
+  }
+
+  /**
+   * Connect the workspace by pasting a GitLab PAT. The backend validates the token upstream
+   * before sealing it, so a rejected token surfaces here as a thrown API error with the reason;
+   * on success the returned connection carries `provider: 'gitlab'` and the projection loads
+   * through the same reads the GitHub connection uses.
+   */
+  async function connectGitLab(pat: string): Promise<void> {
+    connection.value = await api.connectGitLab(workspace.requireId(), pat.trim())
+    available.value = true
+    await load()
+  }
+
+  return { loadConnectOptions, connectGitLab }
+}

package/app/stores/github.spec.ts

@@ -0,0 +1,146 @@
+import { describe, it, expect, vi, type Mock } from 'vitest'
+import { useGitHubStore } from '~/stores/github'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { GitHubConnection, VcsConnectOption } from '~/types/domain'
+
+// The VCS connect surface of the (single, GitHub-shaped) repo store: which connect methods the
+// deployment offers, the per-workspace GitLab PAT connect, and the provider-routed disconnect.
+// These decide what the connect UI renders — an App picker a GitLab-only deployment can't serve,
+// or a GitHub disconnect call against a GitLab connection, are exactly the failures worth pinning.
+
+function connection(overrides: Partial<GitHubConnection> = {}): GitHubConnection {
+  return {
+    installationId: 42,
+    accountLogin: 'octocat',
+    targetType: 'User',
+    connectedAt: 1,
+    provider: 'github',
+    canCreateRepos: false,
+    canManageWorkflows: true,
+    ...overrides,
+  }
+}
+
+/** Stub the auto-imported `useApi()` with just the calls the connect actions make. */
+function stubApi<T extends Record<string, Mock>>(api: T) {
+  const full = {
+    listGitHubRepos: vi.fn().mockResolvedValue([]),
+    listGitHubPullRequests: vi.fn().mockResolvedValue([]),
+    listGitHubIssues: vi.fn().mockResolvedValue([]),
+    ...api,
+  }
+  vi.stubGlobal('useApi', () => full)
+  return full
+}
+
+/** A store bound to an active workspace (the actions all resolve one). */
+function storeWithWorkspace() {
+  useWorkspaceStore().workspaceId = 'ws-1'
+  return useGitHubStore()
+}
+
+describe('github store — VCS connect capability', () => {
+  it('probes the connection and the connect options together', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({
+        options: [{ provider: 'gitlab', method: 'pat' }] satisfies VcsConnectOption[],
+      }),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.canConnectGitHubApp).toBe(false)
+    expect(github.canConnectGitLabPat).toBe(true)
+    // A single-provider deployment names its provider, so the connect copy never says "choose".
+    expect(github.soleConnectProvider).toBe('gitlab')
+  })
+
+  it('reports no connect surface when the capability read fails, without hiding the integration', async () => {
+    // A member without `integrations.manage` gets a 403 here. That must degrade to "nothing to
+    // connect", NOT to a broken picker — and must not flip the whole integration off.
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockRejectedValue(new Error('403')),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.connectOptions).toEqual([])
+    expect(github.soleConnectProvider).toBeNull()
+  })
+
+  it('stays neutral when the deployment serves several providers', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({
+        options: [
+          { provider: 'github', method: 'app' },
+          { provider: 'gitlab', method: 'pat' },
+        ] satisfies VcsConnectOption[],
+      }),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.canConnectGitHubApp).toBe(true)
+    expect(github.canConnectGitLabPat).toBe(true)
+    expect(github.soleConnectProvider).toBeNull()
+  })
+
+  it('connects GitLab with a trimmed PAT and loads the projection', async () => {
+    const api = stubApi({
+      connectGitLab: vi.fn().mockResolvedValue(connection({ provider: 'gitlab' })),
+    })
+    const github = storeWithWorkspace()
+
+    await github.connectGitLab('  glpat-secret  ')
+
+    expect(api.connectGitLab).toHaveBeenCalledWith('ws-1', 'glpat-secret')
+    expect(github.connected).toBe(true)
+    expect(github.provider).toBe('gitlab')
+    expect(github.available).toBe(true)
+    // Connecting seeds the projection reads, exactly as the App connect does.
+    expect(api.listGitHubRepos).toHaveBeenCalledWith('ws-1')
+  })
+
+  it('routes disconnect to the provider that is actually connected', async () => {
+    const api = stubApi({
+      connectGitLab: vi.fn().mockResolvedValue(connection({ provider: 'gitlab' })),
+      disconnectGitLab: vi.fn().mockResolvedValue(undefined),
+      disconnectGitHub: vi.fn().mockResolvedValue(undefined),
+    })
+    const github = storeWithWorkspace()
+    await github.connectGitLab('glpat-secret')
+
+    await github.disconnect()
+
+    expect(api.disconnectGitLab).toHaveBeenCalledWith('ws-1')
+    expect(api.disconnectGitHub).not.toHaveBeenCalled()
+    expect(github.connection).toBeNull()
+  })
+
+  it('disconnects a connection with no provider through the GitHub route', async () => {
+    // Backends predating the discriminator omit `provider`; those are GitHub App connections.
+    const api = stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({
+        connection: { ...connection(), provider: undefined },
+      }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      disconnectGitHub: vi.fn().mockResolvedValue(undefined),
+      disconnectGitLab: vi.fn().mockResolvedValue(undefined),
+    })
+    const github = storeWithWorkspace()
+    await github.probe()
+
+    await github.disconnect()
+
+    expect(api.disconnectGitHub).toHaveBeenCalledWith('ws-1')
+    expect(api.disconnectGitLab).not.toHaveBeenCalled()
+  })
+})