@cat-factory/app 0.208.2 → 0.210.0

package/app/stores/capabilityCredentials.spec.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { useCapabilityCredentialsStore } from '~/stores/capabilityCredentials'
+import { useWorkspaceStore } from '~/stores/workspace'
+import type { CapabilityCredentialsView } from '~/types/capabilityCredentials'
+
+/**
+ * Two behaviours carry this store, and both are about a list that is empty for more than one
+ * reason:
+ *
+ *   - the probe. A 503 ("no encryption key on this deployment") and a 403 ("you may not manage
+ *     secrets") are ANSWERS and resolve normally, hiding the tab; anything else propagates,
+ *     because the panel is the surface that can tell a reader the list could not be fetched.
+ *   - `hasSurface`. An empty checklist with a COMPLETE declaration read means this deployment
+ *     registers no capability that wants a credential, so there is nothing to type; the same
+ *     empty checklist with an INCOMPLETE read is an outage the panel has to state.
+ */
+function view(over: Partial<CapabilityCredentialsView> = {}): CapabilityCredentialsView {
+  return {
+    declared: [],
+    orphaned: [],
+    environmentFallback: true,
+    declarationsIncomplete: false,
+    ...over,
+  }
+}
+
+function declared(key: string, stored = false) {
+  return {
+    key,
+    declaredBy: [{ subject: 'tool-server' as const, id: 'srv', label: 'Search' }],
+    required: true,
+    stored,
+    ...(stored ? { updatedAt: 1000 } : {}),
+  }
+}
+
+describe('capabilityCredentials store', () => {
+  beforeEach(() => {
+    useWorkspaceStore().workspaceId = 'ws1'
+  })
+
+  it('load stores the view and marks the surface available', async () => {
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () => Promise.resolve(view({ declared: [declared('SEARCH_KEY')] })),
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+
+    expect(store.available).toBe(true)
+    expect(store.hasSurface).toBe(true)
+    expect(store.loading).toBe(false)
+  })
+
+  it.each([503, 403])(
+    'a definitive %i latches the surface unavailable without throwing',
+    async (statusCode) => {
+      // 503: the deployment has no encryption key. 403: this caller may not manage secrets, and
+      // the READ is gated too, because the view names the credential keys the deployment wants.
+      // Both hide the tab rather than disabling it.
+      vi.stubGlobal('useApi', () => ({
+        getCapabilityCredentials: () => Promise.reject({ statusCode }),
+      }))
+
+      const store = useCapabilityCredentialsStore()
+      await expect(store.load()).resolves.toBeUndefined()
+
+      expect(store.available).toBe(false)
+      expect(store.view).toBeNull()
+      expect(store.hasSurface).toBe(false)
+    },
+  )
+
+  it('a transient failure propagates and leaves `available` null so the probe stays retryable', async () => {
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () => Promise.reject({ statusCode: 500 }),
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await expect(store.load()).rejects.toMatchObject({ statusCode: 500 })
+
+    expect(store.available).toBeNull()
+    expect(store.loading).toBe(false)
+  })
+
+  it('offers no surface when nothing is declared and nothing is stored', async () => {
+    vi.stubGlobal('useApi', () => ({ getCapabilityCredentials: () => Promise.resolve(view()) }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+
+    // The panel is a checklist projected from the deployment's registered capabilities. With
+    // none, there is no credential to type and the tab would be a dead end.
+    expect(store.available).toBe(true)
+    expect(store.hasSurface).toBe(false)
+  })
+
+  it('keeps the surface when the declaration read failed, even with both lists empty', async () => {
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () => Promise.resolve(view({ declarationsIncomplete: true })),
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+
+    // An unreadable list and an empty one are the same list and opposite facts. Hiding the tab
+    // here would render someone else's outage as "this deployment needs no credentials".
+    expect(store.hasSurface).toBe(true)
+  })
+
+  it('keeps the surface for an orphan nothing declares any more', async () => {
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () =>
+        Promise.resolve(view({ orphaned: [{ key: 'OLD_KEY', updatedAt: 1000 }] })),
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+
+    // A live secret nobody will ever ask for. The tab is the only place it can be removed.
+    expect(store.hasSurface).toBe(true)
+  })
+
+  it('saves ONE key and adopts the returned view', async () => {
+    const calls: { key: string; value: string }[] = []
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () => Promise.resolve(view({ declared: [declared('SEARCH_KEY')] })),
+      setCapabilityCredential: (_ws: string, key: string, value: string) => {
+        calls.push({ key, value })
+        return Promise.resolve(view({ declared: [declared('SEARCH_KEY', true)] }))
+      },
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+    await store.save('SEARCH_KEY', 'sk-live')
+
+    // Per KEY, never a set-replacing write: this client never received the other values, so a
+    // whole-set save would delete every credential the operator did not retype.
+    expect(calls).toEqual([{ key: 'SEARCH_KEY', value: 'sk-live' }])
+    expect(store.view?.declared[0]?.stored).toBe(true)
+  })
+
+  it('re-reads after a delete rather than patching the row out locally', async () => {
+    let stored = true
+    vi.stubGlobal('useApi', () => ({
+      getCapabilityCredentials: () =>
+        Promise.resolve(view({ declared: [declared('SEARCH_KEY', stored)] })),
+      deleteCapabilityCredential: () => {
+        stored = false
+        return Promise.resolve(undefined)
+      },
+    }))
+
+    const store = useCapabilityCredentialsStore()
+    await store.load()
+    await store.remove('SEARCH_KEY')
+
+    // The DELETE answers 204, and the declared half is deployment state this client does not
+    // own: a locally-patched row would drift from it the moment the deployment changed.
+    expect(store.view?.declared[0]?.stored).toBe(false)
+  })
+})

package/app/stores/capabilityCredentials.ts

@@ -0,0 +1,102 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import type { CapabilityCredentialsView } from '~/types/capabilityCredentials'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * The workspace's capability credentials: the sealed, tenant-scoped values behind the secrets a
+ * registered tool server (MCP) or generative binary integration declares BY NAME. Values are
+ * write-only — the store only ever holds the view, which pairs the deployment's DECLARATIONS with
+ * which of them this workspace has stored. Loaded on demand (the Infrastructure window's
+ * "Capability credentials" tab, whose existence gates on the probe below), not from the snapshot.
+ *
+ * Writes are PER KEY. A whole-set write exists on the API for a caller declaring a set at once,
+ * and this store cannot use it: it never receives the values, so replacing the set would delete
+ * every credential the operator did not retype in this sitting.
+ */
+export const useCapabilityCredentialsStore = defineStore('capabilityCredentials', () => {
+  const api = useApi()
+
+  const view = ref<CapabilityCredentialsView | null>(null)
+  const loading = ref(false)
+  // Mirrors the backend's two definitive refusals: the module 503s with no encryption key, and
+  // the whole surface (the READ included) is `secrets.manage`-gated, so a member without it gets
+  // a 403. `null` until first probed, then `true`/`false`. Both answers hide the tab rather than
+  // disabling it — a member who cannot manage secrets has no business learning which environment
+  // variables the deployment's capabilities want, which is the very content of this view.
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /**
+   * Whether there is anything to show. The panel is a CHECKLIST projected from the deployment's
+   * registered capabilities, so with nothing declared, nothing orphaned and a complete read there
+   * is no credential to type and no tab worth rendering.
+   *
+   * `declarationsIncomplete` keeps the surface even when both lists are empty, because then the
+   * emptiness is an OUTAGE (`BinaryGeneratorSource` throws rather than answering an empty set)
+   * rather than an answer, and hiding the tab would render the outage as "this deployment needs
+   * no credentials".
+   */
+  const hasSurface = computed(
+    () =>
+      view.value !== null &&
+      (view.value.declared.length > 0 ||
+        view.value.orphaned.length > 0 ||
+        view.value.declarationsIncomplete),
+  )
+
+  /** Force a refresh of the view (used after a save/remove). */
+  async function load() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      view.value = await api.getCapabilityCredentials(ws.requireId())
+      available.value = true
+    } catch (err) {
+      const status = apiErrorStatus(err)
+      if (status === 503 || status === 403) {
+        // Definitive answers, not failures: the module is unconfigured, or this caller may not
+        // manage secrets. Hide the entry point and stop probing; resolve normally.
+        available.value = false
+        view.value = null
+        return
+      }
+      // Any other failure (transient 5xx / network) leaves the state untouched: it must not hide
+      // an already-available panel nor cache a false "unavailable", and `available` stays `null`
+      // when never probed so `ensureLoaded` remains retryable. The error PROPAGATES, because the
+      // panel is the one surface that can tell a reader it is looking at a list we could not
+      // fetch — the PROBE caller swallows instead (a failed probe means no tab, not a broken
+      // window). Same split as the package-registries store.
+      throw err
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once and share the result (coalescing concurrent callers); `load()` refreshes. */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    if (!inFlight) inFlight = load().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  /** Store ONE credential's value, leaving every other stored key as it is. */
+  async function save(key: string, value: string) {
+    const ws = useWorkspaceStore()
+    view.value = await api.setCapabilityCredential(ws.requireId(), key, value)
+    available.value = true
+  }
+
+  /** Remove ONE stored credential (a rotated key, or an orphan nothing declares any more). */
+  async function remove(key: string) {
+    const ws = useWorkspaceStore()
+    await api.deleteCapabilityCredential(ws.requireId(), key)
+    // The DELETE answers 204, so the view is re-read rather than patched locally: the declared
+    // half is deployment state this client does not own, and a locally-patched row would drift
+    // from it the moment the deployment changed.
+    await load()
+  }
+
+  return { view, loading, available, hasSurface, load, ensureLoaded, save, remove }
+})

package/app/stores/ui/resultViews.ts

@@ -2,6 +2,7 @@ import { ref } from 'vue'
 import { useExecutionStore } from '~/stores/execution'
 import { agentKindMeta } from '~/utils/catalog'
 import { dedicatedParkView } from '~/utils/pipelineRender'
+import { createRunStepOpeners } from './runStepOpeners'
 
 /**
  * The step-inspection / result-view slice of the UI store: the dedicated result-view overlay
@@ -126,84 +127,16 @@ export function createUiResultViews() {
   function openInitiativePlanning(blockId: string) {
     resultView.value = { view: 'initiative-planning', blockId, instanceId: null, stepIndex: null }
   }
-  // Open the Follow-up companion window for a run's Coder step (the blinking chip + the
-  // `followup_pending` notification). Resolves the Coder step index from the run when not
-  // given, so callers that only know the run can still open it.
-  function openFollowUps(instanceId: string, stepIndex: number | null = null) {
-    const execution = useExecutionStore()
-    const instance = execution.getInstance(instanceId)
-    if (!instance) return
-    // A pipeline may carry more than one follow-up-enabled Coder step, so don't blindly pick
-    // the first when no index is given: prefer the step that still has undecided items (the
-    // one the run is parked on), else the current step, else the first enabled one.
-    const resolveIdx = () => {
-      const pending = instance.steps.findIndex(
-        (s) => s.followUps?.enabled && s.followUps.items.some((i) => i.status === 'pending'),
-      )
-      if (pending >= 0) return pending
-      const current = instance.steps[instance.currentStep]
-      if (current?.followUps?.enabled) return instance.currentStep
-      return instance.steps.findIndex((s) => s.followUps?.enabled)
-    }
-    const idx = stepIndex ?? resolveIdx()
-    if (idx < 0) return
-    resultView.value = {
-      view: 'follow-ups',
-      blockId: instance.blockId,
-      instanceId,
-      stepIndex: idx,
-    }
-  }
-  // Open the implementation-fork decision window for a run's coder step (from the inspector /
-  // pipeline chip / `fork_decision_pending` notification). Resolves the coder step index from
-  // the run when not given, preferring the step parked awaiting a choice.
-  function openForkDecision(instanceId: string, stepIndex: number | null = null) {
-    const execution = useExecutionStore()
-    const instance = execution.getInstance(instanceId)
-    if (!instance) return
-    const resolveIdx = () => {
-      const awaiting = instance.steps.findIndex(
-        (s) => s.agentKind === 'coder' && s.forkDecision?.status === 'awaiting_choice',
-      )
-      if (awaiting >= 0) return awaiting
-      const current = instance.steps[instance.currentStep]
-      if (current?.agentKind === 'coder' && current.forkDecision) return instance.currentStep
-      return instance.steps.findIndex((s) => s.agentKind === 'coder' && s.forkDecision)
-    }
-    const idx = stepIndex ?? resolveIdx()
-    if (idx < 0) return
-    resultView.value = {
-      view: 'fork-decision',
-      blockId: instance.blockId,
-      instanceId,
-      stepIndex: idx,
-    }
-  }
-  // Open the PR deep-review window for a run's `pr-reviewer` step (from the `pr_review_ready`
-  // notification / the step). Resolves the step index from the run when not given, preferring
-  // the step parked awaiting a finding selection.
-  function openPrReview(instanceId: string, stepIndex: number | null = null) {
-    const execution = useExecutionStore()
-    const instance = execution.getInstance(instanceId)
-    if (!instance) return
-    const resolveIdx = () => {
-      const awaiting = instance.steps.findIndex(
-        (s) => s.agentKind === 'pr-reviewer' && s.prReview?.status === 'awaiting_selection',
-      )
-      if (awaiting >= 0) return awaiting
-      const current = instance.steps[instance.currentStep]
-      if (current?.agentKind === 'pr-reviewer' && current.prReview) return instance.currentStep
-      return instance.steps.findIndex((s) => s.agentKind === 'pr-reviewer' && s.prReview)
-    }
-    const idx = stepIndex ?? resolveIdx()
-    if (idx < 0) return
-    resultView.value = {
-      view: 'pr-review',
-      blockId: instance.blockId,
-      instanceId,
-      stepIndex: idx,
-    }
-  }
+  // The run-scoped openers (a caller that knows only the RUN, so the step index has to be
+  // resolved) live in a sibling module: they share one shape and one hazard, and lifting them out
+  // keeps this factory inside its per-function line budget. Their two seams are bound here.
+  const { openFollowUps, openForkDecision, openPrReview, openTestEvidence } = createRunStepOpeners({
+    dispatchStepView: (instanceId, stepIndex) => dispatchStepView(instanceId, stepIndex),
+    setResultView: (view, instance, stepIndex) => {
+      resultView.value = { view, blockId: instance.blockId, instanceId: instance.id, stepIndex }
+    },
+  })
+
   function closeResultView() {
     resultView.value = null
   }
@@ -243,6 +176,7 @@ export function createUiResultViews() {
     openFollowUps,
     openForkDecision,
     openPrReview,
+    openTestEvidence,
     closeResultView,
     closeRequirementReview,
     openStepDetail,

package/app/stores/ui/runStepOpeners.ts

@@ -0,0 +1,143 @@
+import { useExecutionStore } from '~/stores/execution'
+import { isTesterKind } from '~/utils/catalog'
+import type { ExecutionInstance, PipelineStep } from '~/types/domain'
+
+/**
+ * The RUN-SCOPED window openers: entry points that know only which run to open, and have to
+ * resolve WHICH step of it the caller means before dispatching.
+ *
+ * They share one shape (find the step, bail if the run has none, open its window) and one hazard:
+ * a pipeline may carry the same agent kind more than once, so "the first matching step" is the
+ * wrong answer for every one of them. Each resolver states which of its candidates is the one a
+ * human was pointed at (the step parked awaiting a decision, the one that actually reported), and
+ * the callers that DO know the index still pass it and skip the resolution entirely.
+ *
+ * Extracted from `resultViews.ts` when the `test-evidence` opener pushed that factory over its
+ * per-function line budget: the budget is a split trigger, and this is the cohesive seam it named.
+ * Purely a move plus the new opener; the store's public surface is unchanged.
+ */
+export interface RunStepOpenerDeps {
+  /** Open a step's bespoke window through the universal routing seam. */
+  dispatchStepView: (instanceId: string, stepIndex: number) => void
+  /** Set the result-view overlay directly, for a window the routing seam does not select. */
+  setResultView: (view: string, instance: ExecutionInstance, stepIndex: number) => void
+}
+
+/** Index of the first step matching `predicate`, or -1. */
+function indexOf(instance: ExecutionInstance, predicate: (step: PipelineStep) => boolean): number {
+  return instance.steps.findIndex(predicate)
+}
+
+export function createRunStepOpeners(deps: RunStepOpenerDeps) {
+  /**
+   * Resolve the run, then the step index (the caller's when given, else `resolve`'s), then hand
+   * both to `open`. A run the store has not hydrated, or a pipeline with no candidate step, is a
+   * silent no-op: these are notification and deep-link entry points, and failing loudly at one
+   * would strand a user on a blank overlay.
+   */
+  function withStep(
+    instanceId: string,
+    stepIndex: number | null,
+    resolve: (instance: ExecutionInstance) => number,
+    open: (instance: ExecutionInstance, idx: number) => void,
+  ): void {
+    const instance = useExecutionStore().getInstance(instanceId)
+    if (!instance) return
+    const idx = stepIndex ?? resolve(instance)
+    if (idx < 0) return
+    open(instance, idx)
+  }
+
+  // Open the Follow-up companion window for a run's Coder step (the blinking chip + the
+  // `followup_pending` notification). Resolves the Coder step index from the run when not
+  // given, so callers that only know the run can still open it.
+  function openFollowUps(instanceId: string, stepIndex: number | null = null) {
+    withStep(
+      instanceId,
+      stepIndex,
+      // A pipeline may carry more than one follow-up-enabled Coder step, so don't blindly pick
+      // the first when no index is given: prefer the step that still has undecided items (the
+      // one the run is parked on), else the current step, else the first enabled one.
+      (instance) => {
+        const pending = indexOf(
+          instance,
+          (s) => !!s.followUps?.enabled && s.followUps.items.some((i) => i.status === 'pending'),
+        )
+        if (pending >= 0) return pending
+        const current = instance.steps[instance.currentStep]
+        if (current?.followUps?.enabled) return instance.currentStep
+        return indexOf(instance, (s) => !!s.followUps?.enabled)
+      },
+      (instance, idx) => deps.setResultView('follow-ups', instance, idx),
+    )
+  }
+
+  // Open the implementation-fork decision window for a run's coder step (from the inspector /
+  // pipeline chip / `fork_decision_pending` notification). Resolves the coder step index from
+  // the run when not given, preferring the step parked awaiting a choice.
+  function openForkDecision(instanceId: string, stepIndex: number | null = null) {
+    withStep(
+      instanceId,
+      stepIndex,
+      (instance) => {
+        const awaiting = indexOf(
+          instance,
+          (s) => s.agentKind === 'coder' && s.forkDecision?.status === 'awaiting_choice',
+        )
+        if (awaiting >= 0) return awaiting
+        const current = instance.steps[instance.currentStep]
+        if (current?.agentKind === 'coder' && current.forkDecision) return instance.currentStep
+        return indexOf(instance, (s) => s.agentKind === 'coder' && !!s.forkDecision)
+      },
+      (instance, idx) => deps.setResultView('fork-decision', instance, idx),
+    )
+  }
+
+  // Open the PR deep-review window for a run's `pr-reviewer` step (from the `pr_review_ready`
+  // notification / the step). Resolves the step index from the run when not given, preferring
+  // the step parked awaiting a finding selection.
+  function openPrReview(instanceId: string, stepIndex: number | null = null) {
+    withStep(
+      instanceId,
+      stepIndex,
+      (instance) => {
+        const awaiting = indexOf(
+          instance,
+          (s) => s.agentKind === 'pr-reviewer' && s.prReview?.status === 'awaiting_selection',
+        )
+        if (awaiting >= 0) return awaiting
+        const current = instance.steps[instance.currentStep]
+        if (current?.agentKind === 'pr-reviewer' && current.prReview) return instance.currentStep
+        return indexOf(instance, (s) => s.agentKind === 'pr-reviewer' && !!s.prReview)
+      },
+      (instance, idx) => deps.setResultView('pr-review', instance, idx),
+    )
+  }
+
+  // Open the Tester's result window for a run, where the screenshots and per-area outcomes it
+  // captured are rendered. The entry point is the `test-evidence` deep link the engine puts in
+  // every PR verification report's environment-lifecycle section, so the caller only ever knows
+  // the run.
+  function openTestEvidence(instanceId: string) {
+    withStep(
+      instanceId,
+      null,
+      // Prefer the tester step that actually REPORTED: a pipeline may carry more than one, and
+      // the later one describes the PR as it stands. Falling back to the first tester step opens
+      // the window on its "not run yet" state, which beats the link going nowhere.
+      (instance) => {
+        const candidates = instance.steps
+          .map((s, i) => ({ s, i }))
+          .filter(({ s }) => isTesterKind(s.agentKind))
+        const reported = candidates.filter(({ s }) => s.test?.lastReport)
+        return (reported.at(-1) ?? candidates[0])?.i ?? -1
+      },
+      // Routed through the universal dispatch rather than a fixed view id: a tester step running
+      // as a consensus panel opens the Consensus Session window instead, and this entry point
+      // must not override that.
+      (_instance, idx) => deps.dispatchStepView(instanceId, idx),
+    )
+  }
+
+  return { openFollowUps, openForkDecision, openPrReview, openTestEvidence }
+}

package/app/stores/ui.dispatch.spec.ts

@@ -96,4 +96,42 @@ describe('dispatchStepView routing', () => {
     expect(ui.resultView).toBeNull()
     expect(ui.stepDetail).toEqual({ instanceId: 'e1', stepIndex: 0 })
   })
+
+  // The `test-evidence` deep link the engine puts in every PR verification report knows only the
+  // RUN, so the opener has to resolve which tester step the reviewer was pointed at.
+  describe('openTestEvidence', () => {
+    it('opens the tester step that actually reported, not the first one', () => {
+      execution.hydrate(
+        [
+          instance('e1', 'b1', [
+            { agentKind: 'coder' },
+            { agentKind: 'tester-api' },
+            { agentKind: 'tester-ui', test: { lastReport: { greenlight: true } } },
+          ]),
+        ],
+        'ws1',
+      )
+
+      ui.openTestEvidence('e1')
+
+      expect(ui.resultView).toMatchObject({ view: 'tester', instanceId: 'e1', stepIndex: 2 })
+    })
+
+    it('still opens a tester step that has not reported, rather than going nowhere', () => {
+      execution.hydrate([instance('e1', 'b1', [{ agentKind: 'tester-api' }])], 'ws1')
+
+      ui.openTestEvidence('e1')
+
+      expect(ui.resultView).toMatchObject({ view: 'tester', stepIndex: 0 })
+    })
+
+    it('does nothing when the run carries no tester step at all', () => {
+      execution.hydrate([instance('e1', 'b1', [{ agentKind: 'coder' }])], 'ws1')
+
+      ui.openTestEvidence('e1')
+
+      expect(ui.resultView).toBeNull()
+      expect(ui.stepDetail).toBeNull()
+    })
+  })
 })

package/app/types/capabilityCredentials.ts

@@ -0,0 +1,12 @@
+// Per-workspace capability-credential shapes: the tenant-scoped home for the secrets a
+// registered tool server (MCP) or generative binary integration declares BY NAME. Values are
+// write-only — the view carries the keys the deployment DECLARES, which of them this workspace
+// has stored, and which stored keys nothing declares any more.
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+
+export type {
+  CapabilityCredentialRef,
+  CapabilityCredentialStatus,
+  CapabilityCredentialsView,
+} from '@cat-factory/contracts'

package/app/types/providerConnections.ts

@@ -27,7 +27,11 @@ export type ProviderConnectionKind = 'environment' | 'runner-pool'
  * pointer could open the window but never land the user on the tab it meant. Every tab
  * `InfrastructureWindow.vue` can render must have a name here.
  */
-export type InfrastructureTab = ProviderConnectionKind | 'shared-stacks' | 'package-registries'
+export type InfrastructureTab =
+  | ProviderConnectionKind
+  | 'shared-stacks'
+  | 'package-registries'
+  | 'capability-credentials'
 
 /** A workspace's provider binding, as exposed to clients (never secret values). */
 export interface ProviderConnection {

package/i18n/locales/de.json

@@ -568,6 +568,41 @@
         "removeFailed": "Der Registry-Eintrag konnte nicht entfernt werden"
       }
     },
+    "capabilityCredentials": {
+      "tab": "Zugangsdaten für Fähigkeiten",
+      "intro": "Die Secrets, die die Tool-Server und generativen Integrationen dieser Installation namentlich anfordern. Werte gelten nur für dieses Board, werden verschlüsselt gespeichert und direkt an den Prozess des Agenten übergeben: Sie erscheinen weder in einem Prompt noch in einem Log. Werte lassen sich nur schreiben, nie auslesen, ein gespeicherter Wert wird also durch Eingabe eines neuen ersetzt.",
+      "credentialNoun": "Zugangsdaten {key}",
+      "required": "Erforderlich",
+      "optional": "Optional",
+      "stored": "Gespeichert",
+      "storedAt": "Zuletzt gesetzt am {date}",
+      "notStoredWithFallback": "Für dieses Board ist nichts gespeichert. Diese Installation liest den Schlüssel auch aus ihrer eigenen Umgebung, die Fähigkeit funktioniert also möglicherweise trotzdem.",
+      "notStored": "Für dieses Board ist nichts gespeichert, und diese Installation hat keinen Rückfallwert aus der Umgebung. Die Fähigkeit kann sich daher nicht authentifizieren.",
+      "notStoredUnknownFallback": "Für dieses Board ist nichts gespeichert. Die Kette der Anmeldedaten dieser Installation lässt sich hier nicht beschreiben, daher ist nicht bekannt, ob der Schlüssel anderswo beantwortet wird.",
+      "setValue": "Wert",
+      "replaceValue": "Gespeicherten Wert ersetzen",
+      "save": "Speichern",
+      "remove": "Zugangsdaten entfernen",
+      "noneDeclared": "Keine der registrierten Fähigkeiten dieser Installation fordert Zugangsdaten an.",
+      "subject": {
+        "toolServer": "Tool-Server",
+        "binaryGenerator": "Generative Integration"
+      },
+      "incomplete": {
+        "title": "Diese Liste ist möglicherweise unvollständig",
+        "body": "Die generativen Integrationen konnten nicht gelesen werden, daher fehlen unten womöglich Zugangsdaten, die eine von ihnen anfordert. Gespeicherte Schlüssel, die niemand anfordert, bleiben ausgeblendet, bis die Liste wieder gelesen werden kann."
+      },
+      "orphaned": {
+        "heading": "Gespeichert, aber nicht angefordert",
+        "body": "Nichts, was diese Installation registriert hat, fordert diese Schlüssel an. Genau das hinterlässt eine abgeschaltete Integration oder eine umbenannte Variable. Sie bleiben verschlüsselt gespeichert, bis du sie entfernst."
+      },
+      "toast": {
+        "loadFailed": "Zugangsdaten für Fähigkeiten konnten nicht geladen werden",
+        "saved": "{key} gespeichert",
+        "saveFailed": "Die Zugangsdaten konnten nicht gespeichert werden",
+        "removeFailed": "Die Zugangsdaten konnten nicht entfernt werden"
+      }
+    },
     "apiTokens": {
       "title": "API-Zugriffstokens",
       "intro": "Erstelle Tokens, die externe Systeme der cat-factory-API vorlegen. Jedes Token authentifiziert sich als dieser Arbeitsbereich an den /api/v1-Endpunkten. Das Geheimnis wird nur einmal bei der Erstellung angezeigt und kann nicht wiederhergestellt werden. Speichere es daher sofort.",