@cat-factory/app 0.200.4 → 0.201.1

package/app/components/foundational/FoundationalContractSummary.vue

@@ -4,8 +4,14 @@
 // catalog carries, so rendering the same fields here is what makes the surface answer "what will
 // the design actually see?".
 //
-// `omittedOperations` is rendered rather than dropped: the operation list is CAPPED, and a reader
-// who assumed it was complete would conclude the missing endpoints do not exist.
+// `omittedOperations` is rendered rather than dropped: the operation list is CAPPED (and, for a
+// contract module, read by a best-effort static extractor), and a reader who assumed it complete
+// would conclude the missing endpoints do not exist.
+//
+// An EMPTY list is likewise never left to speak for itself: `operationsAreIndexable` tells apart a
+// format this platform does not read from an interface that genuinely declares nothing, and the
+// two need opposite reactions from whoever is looking.
+import { operationsAreIndexable } from '@cat-factory/contracts'
 import type { ApiContractFormat, ApiContractSummary } from '~/types/domain'
 
 defineProps<{
@@ -25,6 +31,12 @@ const { t, n } = useI18n()
       <span v-if="c.operations.length" class="ms-1 font-mono text-slate-500">
         {{ c.operations.join(' · ') }}
       </span>
+      <span v-else-if="!operationsAreIndexable(c.format)" class="ms-1 text-slate-600">
+        {{ t('foundational.contracts.notIndexed') }}
+      </span>
+      <span v-else-if="!c.omittedOperations" class="ms-1 text-slate-600">
+        {{ t('foundational.contracts.noOperations') }}
+      </span>
       <span v-if="c.omittedOperations > 0" class="ms-1 text-amber-500/80">
         {{ t('foundational.contracts.omitted', { count: c.omittedOperations }) }}
       </span>

package/app/components/foundational/FoundationalServiceCatalogList.vue

@@ -1,7 +1,8 @@
 <script setup lang="ts">
-// The MERGED catalog an Architect is actually handed for this board — account ⊕ workspace, the
-// workspace winning by id (backend/docs/adr/0031-foundational-services.md). Workspace scope only: an
-// account has no tier above it to merge with.
+// The MERGED catalog an Architect is actually handed for this board — the deployment's
+// code-registered `builtin` services ⊕ account ⊕ workspace, the later tier winning by id
+// (backend/docs/adr/0031-foundational-services.md). Workspace scope only: a board is what runs
+// agents, so this is the only place the whole merge is realised.
 //
 // This view is where the two board-level decisions live, and they are deliberately different
 // actions rather than one "remove":
@@ -24,6 +25,7 @@ const { t } = useI18n()
 
 // Exhaustive maps of literal `t(...)` keys, so a new tier/format fails the typed-key guard.
 const tierLabel = computed<Record<FoundationalServiceTier, string>>(() => ({
+  builtin: t('foundational.tier.builtin'),
   account: t('foundational.tier.account'),
   workspace: t('foundational.tier.workspace'),
 }))
@@ -34,6 +36,7 @@ const formatLabel = computed<Record<ApiContractFormat, string>>(() => ({
 }))
 // `as const` keeps the literal colour names assignable to UBadge's `color` union.
 const tierColor = {
+  builtin: 'neutral',
   account: 'info',
   workspace: 'primary',
 } as const satisfies Record<FoundationalServiceTier, string>
@@ -147,10 +150,11 @@ async function suppress(serviceId: string) {
           <UBadge size="xs" :color="tierColor[s.tier]" variant="subtle">
             {{ tierLabel[s.tier] }}
           </UBadge>
-          <!-- Only an INHERITED entry can be suppressed; the board's own row is managed in the
-               registry tab, where deleting it is the honest action. -->
+          <!-- Only an INHERITED entry can be suppressed — an account service or one the
+               deployment registered in code; the board's own row is managed in the registry tab,
+               where deleting it is the honest action. -->
           <UButton
-            v-if="s.tier === 'account'"
+            v-if="s.tier !== 'workspace'"
             icon="i-lucide-eye-off"
             size="xs"
             variant="ghost"

package/app/components/foundational/FoundationalServiceManager.vue

@@ -7,8 +7,9 @@
 //
 // The tab split is the feature's own split, not a layout choice: "Catalog" is what an agent sees
 // (identity + operation names, never a document body), while "This tier" is what this owner
-// actually registers. An account has no tier above it, so it gets no catalog tab and no
-// suppression controls.
+// actually registers. Only a board gets the catalog tab — it is what runs agents — but BOTH
+// scopes get the suppression list, because an account inherits the deployment's code-registered
+// services exactly as a board inherits its account's.
 import { computed, ref, watch } from 'vue'
 import type { FoundationalServiceOwnerKind } from '~/types/domain'
 import {
@@ -97,11 +98,20 @@ const activeTab = computed({
       <template #catalog>
         <div class="flex flex-col gap-4">
           <FoundationalServiceCatalogList />
-          <FoundationalSuppressions />
+          <FoundationalSuppressions :kind="props.kind" :owner-id="props.ownerId" />
         </div>
       </template>
       <template #registry>
-        <FoundationalServiceRegistry :kind="props.kind" :owner-id="props.ownerId" />
+        <div class="flex flex-col gap-4">
+          <FoundationalServiceRegistry :kind="props.kind" :owner-id="props.ownerId" />
+          <!-- A scope with no catalog tab still has to be able to see (and lift) what it is
+               opting out of; with one, the list lives beside the catalog it explains. -->
+          <FoundationalSuppressions
+            v-if="!props.showCatalog"
+            :kind="props.kind"
+            :owner-id="props.ownerId"
+          />
+        </div>
       </template>
       <template #sources>
         <FoundationalServiceSources :kind="props.kind" :owner-id="props.ownerId" />

package/app/components/foundational/FoundationalSuppressions.vue

@@ -1,19 +1,43 @@
 <script setup lang="ts">
-// What this board is opted OUT of (backend/docs/adr/0031-foundational-services.md). A suppressed id is
+// What this tier is opted OUT of (backend/docs/adr/0031-foundational-services.md). A suppressed id is
 // by construction absent from the merged catalog, so without this list the suppress action would
 // be a one-way door — which is why it is a section of its own rather than a badge on the catalog.
 //
+// Rendered at BOTH scopes, because both inherit: a board from its account, and either from the
+// services the deployment registered in code (the `builtin` tier).
+//
 // `inherited: false` is rendered distinctly rather than hidden: the tombstone shadows nothing
-// today (the account withdrew the service, or this row is what remains of the board deleting its
-// own registration), and an operator reading it as "a capability is being withheld" would go
+// today (the tier below withdrew the service, or this row is what remains of this tier deleting
+// its own registration), and an operator reading it as "a capability is being withheld" would go
 // looking for something that is not there.
-import { reactive } from 'vue'
-import { useFoundationalServicesStore } from '~/stores/foundationalServices'
+import { computed, reactive } from 'vue'
+import type { FoundationalServiceOwnerKind } from '~/types/domain'
+import {
+  useFoundationalServices,
+  useFoundationalServicesStore,
+} from '~/stores/foundationalServices'
+
+const props = defineProps<{ kind: FoundationalServiceOwnerKind; ownerId: string }>()
 
-const catalog = useFoundationalServicesStore()
+const catalog =
+  props.kind === 'workspace'
+    ? useFoundationalServicesStore()
+    : useFoundationalServices(props.kind, props.ownerId)
 const toast = useToast()
 const { t } = useI18n()
 
+// Exhaustive scope→key maps of literal `t(...)` keys: what a board opts out of (its account's
+// services) and what an account opts out of (the deployment's) are different enough sentences
+// that one string with a placeholder would read as neither.
+const title = computed<Record<FoundationalServiceOwnerKind, string>>(() => ({
+  workspace: t('foundational.suppressions.title.workspace'),
+  account: t('foundational.suppressions.title.account'),
+}))
+const intro = computed<Record<FoundationalServiceOwnerKind, string>>(() => ({
+  workspace: t('foundational.suppressions.intro.workspace'),
+  account: t('foundational.suppressions.intro.account'),
+}))
+
 const busyRows = reactive(new Set<string>())
 const rowBusy = (id: string) => busyRows.has(id)
 
@@ -42,8 +66,8 @@ async function restore(serviceId: string) {
     class="flex flex-col gap-2"
     data-testid="foundational-suppressions"
   >
-    <p class="text-sm font-medium">{{ t('foundational.suppressions.title') }}</p>
-    <p class="text-xs text-slate-500">{{ t('foundational.suppressions.intro') }}</p>
+    <p class="text-sm font-medium">{{ title[props.kind] }}</p>
+    <p class="text-xs text-slate-500">{{ intro[props.kind] }}</p>
     <div
       v-for="s in catalog.suppressions"
       :key="s.id"

package/app/components/github/BranchProtectionPreflight.vue

@@ -0,0 +1,202 @@
+<script setup lang="ts">
+// The branch-protection preflight: for each linked repository, is its DEFAULT branch protected
+// on the host?
+//
+// This is the one control the platform can neither provide nor enforce. An agent run pushes with
+// a `Contents: write` credential, and nothing platform-side stops a stolen one from pushing
+// straight to `main` — or merging an open pull request through the host's merge API, which needs
+// no more permission than the push already had. Branch protection is what covers both, it lives
+// on GitHub rather than in this product, and until now nothing in-product said when it was
+// missing. See `backend/docs/security-model.md`.
+//
+// On demand, never on open: each repository costs one or two live GitHub reads, so a panel that
+// probed automatically would spend an operator's rate limit every time they glanced at settings.
+import { computed, ref } from 'vue'
+import type { BranchProtectionReportView, BranchProtectionStateValue } from '@cat-factory/contracts'
+import { describeGenericFailure } from '~/composables/usePipelineErrorToast'
+
+const { t } = useI18n()
+const api = useApi()
+const workspace = useWorkspaceStore()
+
+const report = ref<BranchProtectionReportView | null>(null)
+const checking = ref(false)
+// A failed probe is described from its STATUS CLASS in translated copy, with the backend's
+// untranslated prose (plus the request id an operator greps for) behind a disclosure — the same
+// split every other failure surface makes, through the same pure classifier the run-control
+// toasts use. Rendering `e.message` as the headline would hand a non-English operator English
+// on the one panel whose entire job is telling them their deployment is exposed.
+const failure = ref<{ descriptionKey: string; detail: string } | null>(null)
+const showFailureDetail = ref(false)
+
+type Row = BranchProtectionReportView['repos'][number]
+type UnknownReason = NonNullable<Row['protection']['reason']>
+
+/** Unprotected first, then unknown, then protected — the order an operator has to act in. */
+const RANK: Record<BranchProtectionStateValue, number> = {
+  unprotected: 0,
+  unknown: 1,
+  protected: 2,
+}
+const rows = computed(() =>
+  [...(report.value?.repos ?? [])].sort(
+    (a, b) => RANK[a.protection.state] - RANK[b.protection.state],
+  ),
+)
+const exposedCount = computed(
+  () => rows.value.filter((r) => r.protection.state === 'unprotected').length,
+)
+
+const STATE_STYLE: Record<BranchProtectionStateValue, string> = {
+  unprotected: 'text-rose-300',
+  unknown: 'text-amber-300',
+  protected: 'text-emerald-400',
+}
+
+// Exhaustive Records of LITERAL keys, not an assembled `\`…\${state}\`` lookup: the typed-key
+// check cannot see a runtime-assembled key, so these are what fail the build when the backend
+// adds a state or a reason the SPA has no copy for.
+const STATE_LABEL: Record<BranchProtectionStateValue, () => string> = {
+  protected: () => t('vcs.branchProtection.state.protected'),
+  unprotected: () => t('vcs.branchProtection.state.unprotected'),
+  unknown: () => t('vcs.branchProtection.state.unknown'),
+}
+const UNKNOWN_REASON: Record<UnknownReason, () => string> = {
+  branch_not_found: () => t('vcs.branchProtection.unknownReason.branch_not_found'),
+  forbidden: () => t('vcs.branchProtection.unknownReason.forbidden'),
+  error: () => t('vcs.branchProtection.unknownReason.error'),
+}
+
+/**
+ * The line under a repository. `unknown` names its CAUSE, and a protected branch whose rule we
+ * could not read says so rather than passing as fully verified — the two are different operator
+ * situations, and collapsing them is how a report starts lying.
+ */
+function detailLine(row: Row): string {
+  const p = row.protection
+  if (p.state === 'unknown') return UNKNOWN_REASON[p.reason ?? 'error']()
+  if (p.state === 'unprotected') return t('vcs.branchProtection.unprotectedHint')
+  if (p.detailUnavailable) return t('vcs.branchProtection.detailUnavailable')
+  if (!p.detail) return ''
+  return p.detail.requiresPullRequest
+    ? t('vcs.branchProtection.requiresPr', {
+        reviews: p.detail.requiredApprovingReviewCount,
+        checks: p.detail.requiredStatusChecks.length,
+      })
+    : t('vcs.branchProtection.noPrRequired')
+}
+
+async function check() {
+  const workspaceId = workspace.workspaceId
+  if (!workspaceId) return
+  checking.value = true
+  failure.value = null
+  showFailureDetail.value = false
+  try {
+    report.value = await api.checkGitHubBranchProtection(workspaceId)
+  } catch (e) {
+    const described = describeGenericFailure(e)
+    // Joined exactly as the toast disclosure joins it, so the same failure reads the same way
+    // wherever it surfaces. Empty parts drop out: a disclosure that reveals nothing is worse
+    // than no disclosure, so the button is hidden when there is no detail to show.
+    const detail = [
+      described.message,
+      described.issues.join(', '),
+      described.requestId ? t('errors.generic.requestId', { id: described.requestId }) : '',
+    ]
+      .filter((part) => part && part.trim().length > 0)
+      .join(' · ')
+    failure.value = { descriptionKey: described.descriptionKey, detail }
+  } finally {
+    checking.value = false
+  }
+}
+</script>
+
+<template>
+  <section class="space-y-2" data-testid="branch-protection-preflight">
+    <h3 class="text-sm font-semibold text-slate-200">{{ t('vcs.branchProtection.heading') }}</h3>
+    <p class="text-[11px] text-slate-400">{{ t('vcs.branchProtection.body') }}</p>
+
+    <UButton
+      color="neutral"
+      variant="soft"
+      size="xs"
+      icon="i-lucide-shield-check"
+      :loading="checking"
+      data-testid="branch-protection-check"
+      @click="check()"
+    >
+      {{ t('vcs.branchProtection.check') }}
+    </UButton>
+
+    <div v-if="failure" class="space-y-1" data-testid="branch-protection-failure">
+      <p class="text-xs text-rose-400">{{ t(failure.descriptionKey) }}</p>
+      <!-- The raw prose stays reachable, never dropped: the backend's messages here name the
+           operator remedy, and the request id is the join to the one server log line that
+           explains it. One click away, so it is never what a user is shown FIRST. -->
+      <UButton
+        v-if="failure.detail && !showFailureDetail"
+        color="neutral"
+        variant="link"
+        size="xs"
+        class="p-0"
+        data-testid="branch-protection-failure-detail"
+        @click="showFailureDetail = true"
+      >
+        {{ t('errors.generic.showDetail') }}
+      </UButton>
+      <p v-if="showFailureDetail" class="font-mono text-[10px] break-all text-slate-500">
+        {{ failure.detail }}
+      </p>
+    </div>
+
+    <!-- The provider cannot answer this at all. Said explicitly, because an empty list here
+         would otherwise read exactly like a clean bill of health. -->
+    <p
+      v-else-if="report && report.capability === 'unavailable'"
+      class="text-xs text-amber-300"
+      data-testid="branch-protection-unavailable"
+    >
+      {{ t('vcs.branchProtection.unavailable') }}
+    </p>
+
+    <template v-else-if="report">
+      <p
+        class="text-xs"
+        :class="exposedCount ? 'text-rose-300' : 'text-emerald-400'"
+        data-testid="branch-protection-summary"
+      >
+        {{
+          exposedCount
+            ? t('vcs.branchProtection.exposed', { count: exposedCount }, exposedCount)
+            : t('vcs.branchProtection.allProtected')
+        }}
+      </p>
+
+      <ul class="space-y-1">
+        <li
+          v-for="row in rows"
+          :key="row.repoGithubId"
+          class="rounded-md border border-slate-800 bg-slate-900/40 px-2 py-1.5"
+        >
+          <div class="flex items-baseline justify-between gap-2">
+            <span class="font-mono text-xs text-slate-300">{{ row.owner }}/{{ row.name }}</span>
+            <span class="text-[11px]" :class="STATE_STYLE[row.protection.state]">
+              {{ STATE_LABEL[row.protection.state]() }}
+            </span>
+          </div>
+          <p class="text-[10px] text-slate-500">
+            {{ row.defaultBranch }}<span v-if="detailLine(row)"> — {{ detailLine(row) }}</span>
+          </p>
+        </li>
+      </ul>
+
+      <!-- A cap that truncated silently would read as "these are all your repositories", which
+           on a security report is the same failure as calling an unprobed repo protected. -->
+      <p v-if="report.omittedRepos > 0" class="text-[11px] text-amber-300">
+        {{ t('vcs.branchProtection.omitted', { count: report.omittedRepos }, report.omittedRepos) }}
+      </p>
+    </template>
+  </section>
+</template>

package/app/components/github/GitHubPanel.vue

@@ -10,12 +10,14 @@ import type { GitHubPullRequest, GitHubRepo, VcsProvider } from '~/types/domain'
 // tag, so it silently renders as an empty element. Importing it directly binds
 // the tag unambiguously.
 import GitHubConnect from './GitHubConnect.vue'
+import BranchProtectionPreflight from './BranchProtectionPreflight.vue'
 import GitLabConnect from '~/components/vcs/GitLabConnect.vue'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS } from '~/utils/vcs'
 
 const { t } = useI18n()
 const ui = useUiStore()
+const access = useWorkspaceAccess()
 const github = useGitHubStore()
 const toast = useToast()
 const { confirm } = useConfirm()
@@ -459,6 +461,18 @@ async function merge(pr: GitHubPullRequest) {
             <p v-if="!github.repos.length && !managing" class="py-4 text-sm text-slate-400">
               {{ t('github.panel.noLinkedRepos') }}
             </p>
+
+            <!-- Whether the host actually protects what an agent run pushes to. Placed above the
+                 repo list because it is a posture check across ALL of them, not a per-repo
+                 attribute. Admin-only to match the route: the probe spends the installation's
+                 GitHub rate limit, which the CI gate and the merger share, so it is gated rather
+                 than merely read-only. Hidden rather than disabled — a member has nothing to do
+                 with a control whose result is the operator's to act on. -->
+            <BranchProtectionPreflight
+              v-if="github.repos.length && access.canManageIntegrations.value"
+              class="rounded-md border border-slate-800 bg-slate-900/40 p-3"
+            />
+
             <div
               v-for="repo in github.repos"
               :key="repo.githubId"

package/app/components/layout/AccountRunCredentialSettings.vue

@@ -0,0 +1,97 @@
+<script setup lang="ts">
+import { onMounted, ref, watch } from 'vue'
+
+// The account-wide FLOOR under each board's "may a run act as its initiator's own personal
+// access token?" switch (admin only).
+//
+// Why a second tier at all: the workspace switch is edited with `settings.manage`, which a
+// member elevated on one board holds — and the control exists precisely for the case where
+// someone re-widens what the operator scoped. A floor a board admin cannot lift is the only
+// version of it that binds. Effective = this permits AND the board permits.
+//
+// Left UNSET by default, deliberately. A personal token is the right credential for someone
+// adopting cat-factory alone inside an org that has not adopted it: there is no App
+// installation to inherit and no account admin to ask. Setting this is for the opposite case.
+// See `backend/docs/security-model.md`.
+const props = defineProps<{ accountId: string }>()
+
+const store = useAccountSettingsStore()
+const toast = useToast()
+const { t } = useI18n()
+
+// Tri-state, and it must stay tri-state: "not set" is a real, distinct answer from "permitted".
+// Collapsing it to a boolean would make every existing account look as though an admin had
+// actively decided, and would write that decision on the next unrelated save.
+const forbid = ref(false)
+const saving = ref(false)
+
+function hydrate() {
+  forbid.value = store.view?.config?.allowInitiatorPat === false
+}
+
+onMounted(async () => {
+  if (!store.view && store.available !== false) await store.load(props.accountId)
+  hydrate()
+})
+watch(() => store.view, hydrate)
+
+async function save() {
+  saving.value = true
+  try {
+    // `config` fully REPLACES the stored non-secret config, so the rest is carried forward —
+    // the same contract the model-policy editor honours. Clearing the floor writes `undefined`
+    // rather than `true`, keeping "no opinion" distinguishable from "explicitly permitted".
+    await store.save(props.accountId, {
+      config: {
+        ...store.view?.config,
+        ...(forbid.value ? { allowInitiatorPat: false } : { allowInitiatorPat: undefined }),
+      },
+    })
+    toast.add({ title: t('settings.runCredentialPolicy.saved'), color: 'success' })
+  } catch (e) {
+    toast.add({
+      title: t('settings.runCredentialPolicy.saveFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <div v-if="store.available !== false" class="space-y-2" data-testid="account-run-credential">
+    <h3 class="text-sm font-semibold text-slate-200">
+      {{ t('settings.runCredentialPolicy.heading') }}
+    </h3>
+    <p class="text-[11px] text-slate-400">{{ t('settings.runCredentialPolicy.body') }}</p>
+
+    <label class="flex items-center gap-2">
+      <USwitch v-model="forbid" size="sm" data-testid="account-forbid-initiator-pat" />
+      <span class="text-sm text-slate-200">{{ t('settings.runCredentialPolicy.toggle') }}</span>
+    </label>
+
+    <!-- What the choice actually costs, stated at the point of choosing rather than discovered
+         later: attribution is a real feature, and turning this on is what trades it away. -->
+    <p v-if="forbid" class="text-[11px] text-amber-300">
+      {{ t('settings.runCredentialPolicy.onHint') }}
+    </p>
+    <p v-else class="text-[11px] text-slate-500">
+      {{ t('settings.runCredentialPolicy.offHint') }}
+    </p>
+
+    <div class="flex justify-end">
+      <UButton
+        color="primary"
+        size="xs"
+        icon="i-lucide-save"
+        :loading="saving"
+        data-testid="account-run-credential-save"
+        @click="save"
+      >
+        {{ t('common.save') }}
+      </UButton>
+    </div>
+  </div>
+</template>

package/app/components/layout/AccountTeamSettings.vue

@@ -5,6 +5,7 @@ import type { AccountRole } from '~/types/domain'
 import type { InvitationStatus } from '@cat-factory/contracts'
 import AccountDeploymentSettings from '~/components/layout/AccountDeploymentSettings.vue'
 import AccountModelPolicySettings from '~/components/layout/AccountModelPolicySettings.vue'
+import AccountRunCredentialSettings from '~/components/layout/AccountRunCredentialSettings.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 // Team settings for an org account: the member roster (with combinable admin /
@@ -337,5 +338,13 @@ async function disconnectEmail() {
     <section v-if="isAdmin && modelPolicySupported">
       <AccountModelPolicySettings :account-id="accountId" />
     </section>
+
+    <!-- account-wide floor under each board's run-credential switch (admin-only). Not gated on
+         `modelPolicySupported`: unlike a model policy this binds wherever account settings
+         exist, and a deployment that could not enforce it would be the one case where saying
+         so matters most. -->
+    <section v-if="isAdmin">
+      <AccountRunCredentialSettings :account-id="accountId" />
+    </section>
   </div>
 </template>

package/app/components/settings/ConnectionWarnings.vue

@@ -14,7 +14,15 @@
 import type { ConnectionWarning } from '@cat-factory/contracts'
 import { CONNECTION_WARNING_KEYS } from '~/utils/connectionWarnings'
 
-defineProps<{ warnings?: ConnectionWarning[] }>()
+const props = defineProps<{
+  warnings?: ConnectionWarning[]
+  /**
+   * Heading for the block. Defaults to the connection-test wording ("gaps in this
+   * configuration"), which is wrong for a surface where the finding is about a CREDENTIAL's
+   * reach rather than a config gap — those callers pass their own already-translated title.
+   */
+  title?: string
+}>()
 
 const { t, te } = useI18n()
 
@@ -30,7 +38,9 @@ const copy = (warning: ConnectionWarning): string => {
     class="rounded-md border border-amber-500/40 bg-amber-950/40 px-3 py-2 text-xs text-amber-200"
     data-testid="connection-warnings"
   >
-    <p class="font-semibold">{{ t('settings.providerConnection.test.warningsTitle') }}</p>
+    <p class="font-semibold">
+      {{ props.title ?? t('settings.providerConnection.test.warningsTitle') }}
+    </p>
     <ul class="mt-1 list-disc space-y-1 pl-4">
       <li v-for="warning in warnings" :key="warning.code">{{ copy(warning) }}</li>
     </ul>

package/app/components/settings/UserSecretsSection.vue

@@ -5,9 +5,11 @@
 // renders them without hard-coding any kind. Stored PER USER (runs you initiate use YOUR
 // access); the secret is write-only server-side and never shown again.
 import { computed, ref, watch } from 'vue'
+import type { ConnectionTestResult } from '@cat-factory/contracts'
 import type { ProviderConfigField, UserSecretKind } from '~/types/userSecrets'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
+import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
 
 const { t } = useI18n()
 const ui = useUiStore()
@@ -30,7 +32,7 @@ const status = computed(() => store.statusFor(kind.value))
 // all other fields map into `metadata`.
 const values = ref<Record<string, string>>({})
 const labelDraft = ref('')
-const testResult = ref<{ ok: boolean; message?: string } | null>(null)
+const testResult = ref<ConnectionTestResult | null>(null)
 const testing = ref(false)
 const busy = ref(false)
 
@@ -103,7 +105,13 @@ async function save() {
   try {
     await store.store(kind.value, { ...payload, label: labelDraft.value.trim() || undefined })
     values.value[secretField.value!.key] = ''
-    testResult.value = null
+    // Probe AFTER the save so what this credential can reach is stated at the moment it is
+    // stored, not only when someone happens to press Test first. A run you start authenticates
+    // with this token in preference to the deployment's own, and the platform cannot narrow it —
+    // so this is the one point at which an over-broad token is visible at all
+    // (backend/docs/security-model.md). Best-effort: the save already succeeded, so a probe
+    // failure must not read as one.
+    testResult.value = await store.test(kind.value, payload).catch(() => null)
     toast.add({
       title: t('settings.userSecrets.toast.saved', {
         label: descriptor.value?.label ?? t('settings.userSecrets.secretFallback'),
@@ -236,6 +244,13 @@ async function remove() {
             </span>
           </div>
 
+          <!-- How far this token reaches. Independent of the pass/fail verdict: an over-broad
+               token is perfectly VALID, and that is exactly why it is otherwise invisible. -->
+          <ConnectionWarnings
+            :warnings="testResult?.warnings"
+            :title="t('settings.userSecrets.tokenReachTitle')"
+          />
+
           <div class="flex justify-end">
             <UButton
               color="primary"