@cat-factory/app 0.182.1 → 0.183.0

package/app/components/settings/PackageRegistriesPanel.vue

@@ -3,24 +3,18 @@
 // orgs, GitHub Packages) that agent containers use to resolve private dependencies
 // on checkout. Tokens are write-only: the list renders from the redacted summary
 // (vendor + scopes + token tail) and an entry is edited by deleting + re-adding.
-// Opened from the Integrations hub.
-import { computed, reactive, ref, watch } from 'vue'
+// Renders inline inside the Infrastructure window's "Package registries" tab: what a
+// checkout installs from is part of where agent containers RUN, not an optional
+// external system the workspace links in.
+import { computed, onMounted, reactive, ref } from 'vue'
 import type { PackageRegistryVendor } from '~/types/packageRegistries'
-import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 const { t } = useI18n()
-const ui = useUiStore()
 const store = usePackageRegistriesStore()
 const toast = useToast()
 const { confirmAction, toastDone } = useConfirmAction()
 
-const open = computed({
-  get: () => ui.packageRegistriesOpen,
-  set: (v: boolean) => (v ? ui.openPackageRegistries() : ui.closePackageRegistries()),
-})
-const back = useIntegrationBack(open)
-
 // The registry vendors a workspace can connect. Fixed set — the host derives from the
 // vendor server-side, so it renders read-only here. Vendor names stay verbatim.
 const VENDORS: { value: PackageRegistryVendor; label: string; host: string }[] = [
@@ -59,18 +53,19 @@ function notifyError(title: string, e: unknown) {
   })
 }
 
-watch(
-  open,
-  async (isOpen) => {
-    if (!isOpen) return
-    try {
-      await store.ensureLoaded()
-    } catch (e) {
-      notifyError(t('settings.packageRegistries.toast.loadFailed'), e)
-    }
-  },
-  { immediate: true },
-)
+// The tab this renders in only exists once the window's probe resolved `available === true`, so
+// `ensureLoaded()` here would early-return every time and this error branch would be dead code.
+// Read the list outright instead: the window owns the PROBE (a failure there means no tab), the
+// panel owns the DATA (a failure here means the reader is looking at a list we could not fetch,
+// and must be told). It also drops the staleness `ensureLoaded` carried — reopening the tab
+// after an entry was added elsewhere used to re-render the first load's snapshot.
+onMounted(async () => {
+  try {
+    await store.load()
+  } catch (e) {
+    notifyError(t('settings.packageRegistries.toast.loadFailed'), e)
+  }
+})
 
 async function addEntry() {
   busy.value = true
@@ -111,108 +106,121 @@ async function removeEntry(entryId: string) {
 </script>
 
 <template>
-  <UModal
-    v-model:open="open"
-    :title="t('settings.packageRegistries.title')"
-    :ui="{ content: 'max-w-lg' }"
-  >
-    <template #title>
-      <IntegrationBackTitle :title="t('settings.packageRegistries.title')" @back="back" />
-    </template>
-    <template #body>
-      <div class="space-y-4" data-testid="package-registries-panel">
-        <p class="text-sm text-slate-400">
-          {{ t('settings.packageRegistries.intro') }}
-        </p>
-
-        <section
-          v-if="store.entries.length"
-          class="space-y-2 rounded-lg border border-slate-700 p-3"
-        >
-          <h3 class="text-sm font-semibold">
-            {{ t('settings.packageRegistries.list.heading') }}
-          </h3>
-          <div
-            v-for="entry in store.entries"
-            :key="entry.id"
-            class="flex items-center justify-between gap-2 rounded-md border border-slate-800 px-3 py-2"
-          >
-            <div class="min-w-0 space-y-1">
-              <div class="flex items-center gap-2">
-                <span class="text-sm font-medium">{{ vendorLabel(entry.vendor) }}</span>
-                <span class="text-[11px] text-slate-500">
-                  {{ t('settings.packageRegistries.list.tokenTail', { tail: entry.tokenTail }) }}
-                </span>
-              </div>
-              <div class="flex flex-wrap gap-1">
-                <UBadge
-                  v-for="scope in entry.scopes"
-                  :key="scope"
-                  color="neutral"
-                  variant="soft"
-                  size="sm"
-                >
-                  {{ scope }}
-                </UBadge>
-              </div>
-            </div>
-            <UButton
-              color="error"
-              variant="ghost"
-              icon="i-lucide-trash-2"
+  <div class="space-y-4" data-testid="package-registries-panel">
+    <p class="text-sm text-slate-400">
+      {{ t('settings.packageRegistries.intro') }}
+    </p>
+
+    <section v-if="store.entries.length" class="space-y-2 rounded-lg border border-slate-700 p-3">
+      <h3 class="text-sm font-semibold">
+        {{ t('settings.packageRegistries.list.heading') }}
+      </h3>
+      <div
+        v-for="entry in store.entries"
+        :key="entry.id"
+        class="flex items-center justify-between gap-2 rounded-md border border-slate-800 px-3 py-2"
+      >
+        <div class="min-w-0 space-y-1">
+          <div class="flex items-center gap-2">
+            <span class="text-sm font-medium">{{ vendorLabel(entry.vendor) }}</span>
+            <span class="text-[11px] text-slate-500">
+              {{ t('settings.packageRegistries.list.tokenTail', { tail: entry.tokenTail }) }}
+            </span>
+          </div>
+          <div class="flex flex-wrap gap-1">
+            <UBadge
+              v-for="scope in entry.scopes"
+              :key="scope"
+              color="neutral"
+              variant="soft"
               size="sm"
-              :loading="busy"
-              :data-testid="`package-registry-delete-${entry.id}`"
-              :aria-label="t('settings.packageRegistries.list.remove')"
-              @click="removeEntry(entry.id)"
-            />
+            >
+              {{ scope }}
+            </UBadge>
+            <!-- An entry with no scopes authenticates its host without routing any scope to
+                 it (the deliberate mixed public/private setup) — say so, or the row reads as
+                 half-configured. -->
+            <span v-if="!entry.scopes.length" class="text-[11px] text-slate-500">
+              {{ t('settings.packageRegistries.list.noScopes') }}
+            </span>
           </div>
-        </section>
-
-        <section class="space-y-3 rounded-lg border border-slate-700 p-3">
-          <h3 class="text-sm font-semibold">
-            {{ t('settings.packageRegistries.add.heading') }}
-          </h3>
-
-          <UFormField :label="t('settings.packageRegistries.add.vendor')">
-            <USelect
-              v-model="form.vendor"
-              :items="VENDORS"
-              value-key="value"
-              class="w-full"
-              data-testid="package-registry-vendor"
-            />
-          </UFormField>
-          <p class="text-[11px] text-slate-500">
-            {{ t('settings.packageRegistries.add.host', { host: vendorHost }) }}
-          </p>
-
-          <UFormField
-            :label="t('settings.packageRegistries.add.scopes')"
-            :help="t('settings.packageRegistries.add.scopesHelp')"
-          >
-            <UInput
-              v-model="form.scopes"
-              placeholder="@my-org, @my-other-org"
-              class="w-full"
-              data-testid="package-registry-scopes"
-            />
-          </UFormField>
-
-          <UFormField :label="t('settings.packageRegistries.add.token')">
-            <SecretInput v-model="form.token" class="w-full" data-testid="package-registry-token" />
-          </UFormField>
-
-          <UButton
-            :loading="busy"
-            :disabled="!parsedScopes.length || !form.token.trim()"
-            data-testid="package-registry-save"
-            @click="addEntry"
-          >
-            {{ t('settings.packageRegistries.add.save') }}
-          </UButton>
-        </section>
+        </div>
+        <UButton
+          color="error"
+          variant="ghost"
+          icon="i-lucide-trash-2"
+          size="sm"
+          :loading="busy"
+          :data-testid="`package-registry-delete-${entry.id}`"
+          :aria-label="t('settings.packageRegistries.list.remove')"
+          @click="removeEntry(entry.id)"
+        />
+      </div>
+    </section>
+
+    <section class="space-y-3 rounded-lg border border-slate-700 p-3">
+      <h3 class="text-sm font-semibold">
+        {{ t('settings.packageRegistries.add.heading') }}
+      </h3>
+
+      <UFormField :label="t('settings.packageRegistries.add.vendor')">
+        <USelect
+          v-model="form.vendor"
+          :items="VENDORS"
+          value-key="value"
+          class="w-full"
+          data-testid="package-registry-vendor"
+        />
+      </UFormField>
+      <p class="text-[11px] text-slate-500">
+        {{ t('settings.packageRegistries.add.host', { host: vendorHost }) }}
+      </p>
+
+      <UFormField
+        :label="t('settings.packageRegistries.add.scopes')"
+        :help="t('settings.packageRegistries.add.scopesHelp')"
+      >
+        <UInput
+          v-model="form.scopes"
+          placeholder="@my-org, @my-other-org"
+          class="w-full"
+          data-testid="package-registry-scopes"
+        />
+      </UFormField>
+      <!-- What will actually be SAVED. The parse splits on commas/whitespace and prefixes a
+           missing `@`, so the field's text and the stored scopes routinely differ — and now
+           that an empty list is a legitimate save, "I typed something that parsed to nothing"
+           and "I meant to leave this empty" would otherwise look identical at the button. -->
+      <div v-if="parsedScopes.length" class="flex flex-wrap gap-1">
+        <UBadge
+          v-for="scope in parsedScopes"
+          :key="scope"
+          color="neutral"
+          variant="soft"
+          size="sm"
+          data-testid="package-registry-parsed-scope"
+        >
+          {{ scope }}
+        </UBadge>
       </div>
-    </template>
-  </UModal>
+      <!-- Why leaving this empty is often the RIGHT answer — a scope mapping is all-or-nothing,
+           so an org publishing some of its `@org` packages publicly breaks under one. -->
+      <p class="text-[11px] text-slate-500">
+        {{ t('settings.packageRegistries.add.scopesNote') }}
+      </p>
+
+      <UFormField :label="t('settings.packageRegistries.add.token')">
+        <SecretInput v-model="form.token" class="w-full" data-testid="package-registry-token" />
+      </UFormField>
+
+      <UButton
+        :loading="busy"
+        :disabled="!form.token.trim()"
+        data-testid="package-registry-save"
+        @click="addEntry"
+      >
+        {{ t('settings.packageRegistries.add.save') }}
+      </UButton>
+    </section>
+  </div>
 </template>

package/app/pages/index.vue

@@ -437,7 +437,6 @@ watch(
       <WorkspaceSettingsPanel v-if="ui.workspaceSettingsOpen" />
       <AccountSettingsPanel v-if="ui.accountSettingsOpen" />
       <ObservabilityConnectionPanel v-if="ui.observabilityConnectionOpen" />
-      <PackageRegistriesPanel v-if="ui.packageRegistriesOpen" />
       <ApiTokensPanel v-if="ui.apiTokensOpen" />
       <InfrastructureWindow v-if="ui.infrastructureOpen" />
       <EnvironmentSetupWizard v-if="ui.environmentWizardOpen" />

package/app/stores/packageRegistries.spec.ts

@@ -0,0 +1,111 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { usePackageRegistriesStore } from '~/stores/packageRegistries'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { PackageRegistryEntryView } from '~/types/packageRegistries'
+
+/**
+ * The availability probe and the list read share one `load()`, but their failure contracts are
+ * opposite, and the split is what these cases pin:
+ *
+ *   - a 503 is an ANSWER ("this deployment has no registries module") and resolves normally, so
+ *     the Infrastructure window simply shows no tab;
+ *   - anything else is a FAILURE that propagates, because the panel — which only renders once
+ *     the probe already succeeded — is the surface that can tell a reader the list they are
+ *     looking at could not be fetched.
+ */
+function entry(over: Partial<PackageRegistryEntryView> = {}): PackageRegistryEntryView {
+  return {
+    id: 'pkgreg_1',
+    ecosystem: 'npm',
+    vendor: 'npmjs',
+    scopes: ['@acme'],
+    tokenTail: 'cdef',
+    ...over,
+  }
+}
+
+describe('packageRegistries store', () => {
+  beforeEach(() => {
+    useWorkspaceStore().workspaceId = 'ws1'
+  })
+
+  it('load stores the entries and marks the module available', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPackageRegistries: () => Promise.resolve({ entries: [entry()] }),
+    }))
+
+    const store = usePackageRegistriesStore()
+    await store.load()
+
+    expect(store.available).toBe(true)
+    expect(store.entries).toHaveLength(1)
+    expect(store.loading).toBe(false)
+  })
+
+  it('a definitive 503 latches the module unavailable without throwing', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPackageRegistries: () => Promise.reject({ statusCode: 503 }),
+    }))
+
+    const store = usePackageRegistriesStore()
+    await expect(store.load()).resolves.toBeUndefined()
+
+    expect(store.available).toBe(false)
+    expect(store.entries).toEqual([])
+  })
+
+  it('a transient failure propagates and leaves `available` null so the probe stays retryable', async () => {
+    vi.stubGlobal('useApi', () => ({
+      listPackageRegistries: () => Promise.reject({ statusCode: 500 }),
+    }))
+
+    const store = usePackageRegistriesStore()
+    await expect(store.load()).rejects.toMatchObject({ statusCode: 500 })
+
+    // Never cached as a false "unavailable": a reachable-but-flaky backend must not hide a tab
+    // the deployment really has.
+    expect(store.available).toBeNull()
+    expect(store.loading).toBe(false)
+  })
+
+  it('keeps an already-loaded list when a later refresh fails', async () => {
+    let fail = false
+    vi.stubGlobal('useApi', () => ({
+      listPackageRegistries: () =>
+        fail ? Promise.reject({ statusCode: 500 }) : Promise.resolve({ entries: [entry()] }),
+    }))
+
+    const store = usePackageRegistriesStore()
+    await store.load()
+    fail = true
+    await expect(store.load()).rejects.toMatchObject({ statusCode: 500 })
+
+    // The panel reports the failure; it must not also blank the list the reader had.
+    expect(store.available).toBe(true)
+    expect(store.entries).toHaveLength(1)
+  })
+
+  it('ensureLoaded probes once and stays retryable after a transient failure', async () => {
+    let calls = 0
+    let fail = true
+    vi.stubGlobal('useApi', () => ({
+      listPackageRegistries: () => {
+        calls += 1
+        return fail ? Promise.reject({ statusCode: 500 }) : Promise.resolve({ entries: [] })
+      },
+    }))
+
+    const store = usePackageRegistriesStore()
+    await expect(store.ensureLoaded()).rejects.toMatchObject({ statusCode: 500 })
+    expect(calls).toBe(1)
+
+    fail = false
+    await store.ensureLoaded()
+    expect(calls).toBe(2)
+    expect(store.available).toBe(true)
+
+    // Settled now, so a third caller costs no request.
+    await store.ensureLoaded()
+    expect(calls).toBe(2)
+  })
+})

package/app/stores/packageRegistries.ts

@@ -7,8 +7,9 @@ import { apiErrorStatus } from '~/composables/api/errors'
 /**
  * The workspace's private package-registry entries (npm private orgs, GitHub
  * Packages) that agent containers install with. Tokens are write-only — the store
- * only ever holds the redacted summary views. Loaded on demand (the registries
- * panel + the Integrations hub badge), not from the snapshot.
+ * only ever holds the redacted summary views. Loaded on demand (the Infrastructure
+ * window's "Package registries" tab, whose very existence gates on the probe below),
+ * not from the snapshot.
  */
 export const usePackageRegistriesStore = defineStore('packageRegistries', () => {
   const api = useApi()
@@ -16,8 +17,8 @@ export const usePackageRegistriesStore = defineStore('packageRegistries', () =>
   const entries = ref<PackageRegistryEntryView[]>([])
   const loading = ref(false)
   // Mirrors the backend's opt-in gate (the module 503s when the encryption key is
-  // absent): `null` until first probed, then `true`/`false`. The hub hides its
-  // registries entry point when this is false.
+  // absent): `null` until first probed, then `true`/`false`. The Infrastructure window
+  // shows no registries tab unless this is `true`.
   const available = ref<boolean | null>(null)
   let inFlight: Promise<void> | null = null
 
@@ -31,13 +32,25 @@ export const usePackageRegistriesStore = defineStore('packageRegistries', () =>
     } catch (err) {
       if (apiErrorStatus(err) === 503) {
         // A definitive 503 means the integration is unconfigured (no encryption key on
-        // the backend): hide the UI entry points and stop probing.
+        // the backend): hide the UI entry points and stop probing. This is an ANSWER, not a
+        // failure, so it resolves normally.
         available.value = false
         entries.value = []
+        return
       }
-      // Any other failure (transient 5xx / network) is left untouched: it must not hide
-      // an already-available panel nor cache a false "unavailable". `available` stays
-      // `null` when never probed, so `ensureLoaded` remains retryable on the next open.
+      // Any other failure (transient 5xx / network) leaves the state untouched: it must not
+      // hide an already-available panel nor cache a false "unavailable". `available` stays
+      // `null` when never probed, so `ensureLoaded` remains retryable on the next open — and
+      // the error PROPAGATES so a caller can say so. Swallowing it made every caller's error
+      // branch dead code: "the backend is unreachable" and "your deployment has no registries
+      // module" are different problems that must not render identically, and the panel is the
+      // one surface that can tell a reader which it hit. The PROBE callers still swallow (a
+      // failed probe means no tab, not a broken window) — the split is deliberate.
+      //
+      // NB `publicApiKeys` carries the same availability shape and still swallows here. It is
+      // not being changed alongside: its probe only hides one row of a hub full of others,
+      // whereas this one gates the feature's ONLY surface.
+      throw err
     } finally {
       loading.value = false
     }

package/app/stores/ui/modals.ts

@@ -1,5 +1,6 @@
 import { ref } from 'vue'
 import type { DocumentSourceKind, InfraSetupArea, TaskSourceKind } from '~/types/domain'
+import type { InfrastructureTab, ProviderConnectionKind } from '~/types/providerConnections'
 import type { PendingContext } from '~/composables/useContextLinking'
 import {
   DEFAULT_PROVISION_DEEP_LINK_PARAM,
@@ -452,9 +453,8 @@ function createIntegrationPanelModals(resetHubReturn: ResetHubReturn) {
   // model / agent kind, spend + activity per workspace / service / task type). Admin-gated.
   // Distinct from `operatorDashboardOpen`, which answers the deployment-HEALTH question.
   const reportsOpen = ref(false)
-  // Private package registries: the workspace's npm/GitHub-Packages entries agent
-  // containers install with. Opened from the Integrations hub.
-  const packageRegistriesOpen = ref(false)
+  // NOTE: private package registries are no longer a panel of their own — they are a tab of
+  // the Infrastructure window (`infrastructureOpen`), reached from the navbar.
   // API access tokens: the workspace's inbound public-API keys external systems present to
   // the `/api/v1` surface. Opened from the Integrations hub.
   const apiTokensOpen = ref(false)
@@ -505,13 +505,6 @@ function createIntegrationPanelModals(resetHubReturn: ResetHubReturn) {
   function closeReports() {
     reportsOpen.value = false
   }
-  function openPackageRegistries() {
-    resetHubReturn()
-    packageRegistriesOpen.value = true
-  }
-  function closePackageRegistries() {
-    packageRegistriesOpen.value = false
-  }
   function openApiTokens() {
     resetHubReturn()
     apiTokensOpen.value = true
@@ -564,7 +557,6 @@ function createIntegrationPanelModals(resetHubReturn: ResetHubReturn) {
     observabilityConnectionOpen,
     operatorDashboardOpen,
     reportsOpen,
-    packageRegistriesOpen,
     apiTokensOpen,
     modelConfigOpen,
     vendorCredentialsOpen,
@@ -582,8 +574,6 @@ function createIntegrationPanelModals(resetHubReturn: ResetHubReturn) {
     openReports,
     closeReports,
     closeOperatorDashboard,
-    openPackageRegistries,
-    closePackageRegistries,
     openApiTokens,
     closeApiTokens,
     openModelConfig,
@@ -683,13 +673,19 @@ function createSettingsModals(resetHubReturn: ResetHubReturn) {
  */
 function createInfraModals(resetHubReturn: ResetHubReturn) {
   // The single tabbed Infrastructure window — a TOP-LEVEL navbar destination (no longer
-  // reached via the Integrations hub). Two topical tabs: "Agent containers" (the execution
-  // backend + self-hosted runner pool, plus the local-mode warm pool/checkout) and "Test
-  // environments" (the ephemeral-environment provider). `infrastructureOpen` is the modal
-  // flag; `infrastructureTab` selects the tab. `openInfrastructure()` is the navbar entry;
-  // `openProviderConnection(kind)` remains for deep-links (a banner's "Configure…" button).
+  // reached via the Integrations hub). Its topical tabs: "Agent containers" (the execution
+  // backend + self-hosted runner pool, plus the local-mode warm pool/checkout), "Test
+  // environments" (the ephemeral-environment provider), "Shared stacks" (long-lived Compose
+  // infra an environment attaches to) and "Package registries" (the private registries a
+  // checkout installs from). `infrastructureOpen` is the modal flag; `infrastructureTab`
+  // selects the tab. `openInfrastructure()` is the navbar entry; `openProviderConnection(kind)`
+  // remains for deep-links (a banner's "Configure…" button).
+  //
+  // The ref is typed against the FULL `InfrastructureTab` union, not the provider-connection
+  // kinds: a tab this cannot name is a tab nothing can deep-link to, which is how the
+  // non-connection tabs ended up reachable only by opening the window and clicking across.
   const infrastructureOpen = ref(false)
-  const infrastructureTab = ref<'environment' | 'runner-pool'>('runner-pool')
+  const infrastructureTab = ref<InfrastructureTab>('runner-pool')
   // Non-secret prefill captured from the `cat-factory k3s` CLI deep-link (see
   // `consumeK3sSetupDeepLink`). When set, the Test-environments tab's kube engine form seeds the
   // `local-k3s` connection from it; the ServiceAccount token is deliberately NOT in the link (a
@@ -704,12 +700,15 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
 
   // Top-level navbar entry into the Infrastructure window. No hub-return marker (it isn't
   // reached from the Integrations hub), so the window shows no "Back to Integrations" control.
-  function openInfrastructure(tab: 'environment' | 'runner-pool' = 'runner-pool') {
+  function openInfrastructure(tab: InfrastructureTab = 'runner-pool') {
     resetHubReturn()
     infrastructureTab.value = tab
     infrastructureOpen.value = true
   }
-  function openProviderConnection(kind: 'environment' | 'runner-pool') {
+  // Deep-link into a PROVIDER's tab specifically (a config banner's "Configure…" button), so
+  // this one stays narrowed to the connection kinds — it means "connect this provider", not
+  // "open the window somewhere". Use `openInfrastructure(tab)` for any other tab.
+  function openProviderConnection(kind: ProviderConnectionKind) {
     resetHubReturn()
     infrastructureTab.value = kind
     infrastructureOpen.value = true

package/app/types/providerConnections.ts

@@ -17,6 +17,18 @@ export type {
 /** The two infrastructure providers configured through the generic connect form. */
 export type ProviderConnectionKind = 'environment' | 'runner-pool'
 
+/**
+ * A tab of the Infrastructure window, and the vocabulary `ui.infrastructureTab` selects from.
+ *
+ * Deliberately WIDER than {@link ProviderConnectionKind}: the window also hosts tabs that are
+ * not a provider connection at all (long-lived shared Compose stacks, the workspace's private
+ * package registries). Typing the store's tab ref as the connection kinds alone is what made
+ * those tabs unreachable by deep link — a banner, a command-palette entry or an Integrations-hub
+ * pointer could open the window but never land the user on the tab it meant. Every tab
+ * `InfrastructureWindow.vue` can render must have a name here.
+ */
+export type InfrastructureTab = ProviderConnectionKind | 'shared-stacks' | 'package-registries'
+
 /** A workspace's provider binding, as exposed to clients (never secret values). */
 export interface ProviderConnection {
   /** The runner-backend kind for a runner-pool connection (`manifest` | `kubernetes`). */

package/i18n/locales/de.json

@@ -537,20 +537,22 @@
       "incidentNoun": "der Incident-Provider"
     },
     "packageRegistries": {
-      "title": "Private Package-Registries",
+      "tab": "Package-Registries",
       "intro": "Verbinde die privaten Registries, aus denen deine Repositories installieren. Agenten erhalten sie beim Auschecken eines Repositorys, sodass private Abhängigkeiten während der Installation aufgelöst werden. Tokens sind nur schreibbar: um eines zu ändern, entferne den Eintrag und füge ihn erneut hinzu.",
       "entryNoun": "Registry-Eintrag",
       "list": {
         "heading": "Verbundene Registries",
         "tokenTail": "Token …{tail}",
-        "remove": "Eintrag entfernen"
+        "remove": "Eintrag entfernen",
+        "noScopes": "Keine Scopes (das Token authentifiziert nur dieses Registry)"
       },
       "add": {
         "heading": "Eine Registry hinzufügen",
         "vendor": "Registry",
         "host": "Das Token wird nur an {host} gesendet.",
         "scopes": "Package-Scopes",
-        "scopesHelp": "Kommagetrennte npm-Scopes",
+        "scopesHelp": "Optional. Kommagetrennte npm-Scopes.",
+        "scopesNote": "Optional. Ein hier eingetragener Scope leitet jedes Paket darunter an dieses Registry, sodass ein Scope, der auch öffentlich veröffentlichte Pakete enthält, nicht mehr aufgelöst wird. Lass das Feld leer, wenn das Repository eine eigene .npmrc enthält oder wenn einzelne Abhängigkeiten über ein benanntes Registry-Präfix wie gh: festgelegt werden (pnpm 11.1 oder neuer) - das Token authentifiziert das Registry ohnehin.",
         "token": "Zugriffstoken",
         "save": "Registry hinzufügen"
       },
@@ -2147,10 +2149,6 @@
           "label": "Post-Release-Health",
           "description": "Überwachen Sie Monitore und SLOs, nachdem ein Release ausgeliefert wurde (Datadog)."
         },
-        "packageRegistries": {
-          "label": "Private Package-Registries",
-          "description": "npm- und GitHub-Packages-Tokens, mit denen Agenten private Abhängigkeiten installieren."
-        },
         "apiTokens": {
           "label": "API-Zugriffstokens",
           "description": "Tokens, die externe Systeme vorlegen, um die cat-factory-API aufzurufen."

package/i18n/locales/en.json

@@ -2163,10 +2163,6 @@
           "label": "Post-release health",
           "description": "Watch monitors and SLOs after a release ships (Datadog)."
         },
-        "packageRegistries": {
-          "label": "Private package registries",
-          "description": "npm and GitHub Packages tokens agents use to install private dependencies."
-        },
         "apiTokens": {
           "label": "API access tokens",
           "description": "Tokens external systems present to call the cat-factory API."
@@ -2813,20 +2809,22 @@
       "incidentNoun": "the incident provider"
     },
     "packageRegistries": {
-      "title": "Private package registries",
+      "tab": "Package registries",
       "intro": "Connect the private registries your repositories install from. Agents receive them when they check out a repository, so private dependencies resolve during installs. Tokens are write-only: to change one, remove the entry and add it again.",
       "entryNoun": "registry entry",
       "list": {
         "heading": "Connected registries",
         "tokenTail": "token …{tail}",
-        "remove": "Remove entry"
+        "remove": "Remove entry",
+        "noScopes": "No scopes (the token authenticates this registry only)"
       },
       "add": {
         "heading": "Add a registry",
         "vendor": "Registry",
         "host": "The token is sent only to {host}.",
         "scopes": "Package scopes",
-        "scopesHelp": "Comma-separated npm scopes",
+        "scopesHelp": "Optional. Comma-separated npm scopes.",
+        "scopesNote": "Optional. A scope listed here routes every package under it to this registry, so a scope that also holds publicly published packages stops resolving. Leave it empty when the repository commits its own .npmrc, or when single dependencies are pinned with a named-registry prefix such as gh: (pnpm 11.1 or newer) - the token authenticates the registry either way.",
         "token": "Access token",
         "save": "Add registry"
       },