@cat-factory/app 0.215.1 → 0.216.0

package/app/components/inputGate/InputGateNotice.vue

@@ -0,0 +1,176 @@
+<script setup lang="ts">
+import { computed } from 'vue'
+import type { InputGateIssue, InputGateIssueCode, RunInputGate } from '@cat-factory/contracts'
+import type { InputGateTone } from '~/utils/inputGate'
+import { useInputGateStore } from '~/stores/inputGate'
+
+// The PRE-TOKEN INPUT GATE's notice: what the structural check found in the task's authored
+// input, and the two ways out. Shown wherever a run parked on the gate is surfaced (the
+// inspector's execution panel, the step-detail overlay), so it is a plain component over a
+// verdict rather than an overlay of its own, its remedy is to go and edit the task, which is a
+// board action a modal would be in the way of.
+//
+// Every line of copy is keyed off the finding CODE, never off backend prose: the backend does
+// not localize, and its `describeInputGateIssues` summary is a detail line for logs.
+
+const props = defineProps<{
+  /** The run's verdict. Which verdicts earn a notice is `inputGateNoticeFor`'s decision. */
+  gate: RunInputGate
+  /**
+   * How to present it (see {@link InputGateTone}). Passed in rather than re-derived from
+   * `gate.status`, because the advisory tone is NOT a status: it is a `passed` verdict that
+   * happens to carry findings, and a component deriving its own tone would have to repeat that
+   * rule and would go on rendering advisories as if the run had been cleared with nothing found.
+   */
+  tone: InputGateTone
+  /** The run this verdict belongs to, for the resolve calls. */
+  executionId: string
+  /** Compact form drops the explanatory paragraph (used inside the step-detail rail). */
+  compact?: boolean
+}>()
+
+const { t, te } = useI18n()
+const inputGate = useInputGateStore()
+
+/**
+ * Finding code → its translated copy, as an EXHAUSTIVE `Record` of LITERAL keys. Two guards in
+ * one: the Record fails to compile when a code is added without copy, and the literal keys are
+ * what the typed-message-key check can see (an assembled `\`inputGate.issue.${code}.title\`` is
+ * invisible to it). The `te` fallback below covers the case neither can, a run PERSISTED under
+ * a code this build has since retired.
+ */
+const ISSUE_KEYS = {
+  description_missing: {
+    title: 'inputGate.issue.description_missing.title',
+    hint: 'inputGate.issue.description_missing.hint',
+  },
+  description_placeholder: {
+    title: 'inputGate.issue.description_placeholder.title',
+    hint: 'inputGate.issue.description_placeholder.hint',
+  },
+  description_thin: {
+    title: 'inputGate.issue.description_thin.title',
+    hint: 'inputGate.issue.description_thin.hint',
+  },
+  reproduction_missing: {
+    title: 'inputGate.issue.reproduction_missing.title',
+    hint: 'inputGate.issue.reproduction_missing.hint',
+  },
+  review_target_missing: {
+    title: 'inputGate.issue.review_target_missing.title',
+    hint: 'inputGate.issue.review_target_missing.hint',
+  },
+  success_criteria_missing: {
+    title: 'inputGate.issue.success_criteria_missing.title',
+    hint: 'inputGate.issue.success_criteria_missing.hint',
+  },
+} as const satisfies Record<InputGateIssueCode, { title: string; hint: string }>
+
+/**
+ * The findings, blocking first. Sorting here rather than trusting the emitted order keeps the
+ * thing a human must fix at the top even when an advisory was found earlier in the check.
+ */
+const issues = computed<InputGateIssue[]>(() =>
+  [...props.gate.issues].sort((a, b) =>
+    a.severity === b.severity ? 0 : a.severity === 'blocking' ? -1 : 1,
+  ),
+)
+
+/** Only a parked verdict has anything to answer; the other two tones are a record. */
+const blocking = computed(() => props.tone === 'blocked')
+
+/** Title + body keys per tone, as literals so the typed-message-key check can see them. */
+const TONE_COPY: Record<InputGateTone, { title: string; body: string }> = {
+  blocked: { title: 'inputGate.blockedTitle', body: 'inputGate.blockedBody' },
+  waived: { title: 'inputGate.waivedTitle', body: 'inputGate.waivedBody' },
+  advisory: { title: 'inputGate.advisoryTitle', body: 'inputGate.advisoryBody' },
+}
+const copy = computed(() => TONE_COPY[props.tone])
+
+/** A finding's translated title, falling back to the generic line for a retired code. */
+function issueTitle(code: InputGateIssueCode): string {
+  const key = ISSUE_KEYS[code]?.title
+  return key && te(key) ? t(key) : t('inputGate.issue.unknown.title')
+}
+
+/** A finding's translated remedy hint, on the same fallback. */
+function issueHint(code: InputGateIssueCode): string {
+  const key = ISSUE_KEYS[code]?.hint
+  return key && te(key) ? t(key) : t('inputGate.issue.unknown.hint')
+}
+
+async function resolve(choice: 'recheck' | 'proceed') {
+  await inputGate.resolve(props.executionId, choice)
+}
+</script>
+
+<template>
+  <div
+    class="rounded-lg border p-3"
+    :class="
+      blocking
+        ? 'border-amber-300 bg-amber-50 dark:border-amber-800 dark:bg-amber-950/40'
+        : 'border-default bg-elevated/40'
+    "
+    :data-tone="tone"
+    data-testid="input-gate-notice"
+  >
+    <div class="flex items-start gap-2">
+      <UIcon
+        :name="blocking ? 'i-lucide-file-question' : 'i-lucide-info'"
+        class="mt-0.5 size-4 shrink-0"
+        :class="blocking ? 'text-amber-600 dark:text-amber-400' : 'text-muted'"
+      />
+      <div class="min-w-0 flex-1">
+        <p class="text-sm font-medium">{{ t(copy.title) }}</p>
+        <p v-if="!compact" class="text-muted mt-0.5 text-xs">{{ t(copy.body) }}</p>
+
+        <ul class="mt-2 space-y-1.5">
+          <li v-for="issue in issues" :key="issue.code" class="flex items-start gap-2 text-xs">
+            <UBadge
+              :color="issue.severity === 'blocking' ? 'warning' : 'neutral'"
+              variant="subtle"
+              size="sm"
+            >
+              {{
+                issue.severity === 'blocking'
+                  ? t('inputGate.severity.blocking')
+                  : t('inputGate.severity.advisory')
+              }}
+            </UBadge>
+            <span class="min-w-0">
+              <span class="font-medium">{{ issueTitle(issue.code) }}</span>
+              <span class="text-muted">, {{ issueHint(issue.code) }}</span>
+            </span>
+          </li>
+        </ul>
+
+        <div v-if="blocking" class="mt-3 flex flex-wrap items-center gap-2">
+          <UButton
+            color="primary"
+            size="xs"
+            icon="i-lucide-refresh-cw"
+            :loading="inputGate.resolving"
+            data-testid="input-gate-recheck"
+            @click="resolve('recheck')"
+          >
+            {{ t('inputGate.recheck') }}
+          </UButton>
+          <UButton
+            color="neutral"
+            variant="ghost"
+            size="xs"
+            :disabled="inputGate.resolving"
+            data-testid="input-gate-proceed"
+            @click="resolve('proceed')"
+          >
+            {{ t('inputGate.proceed') }}
+          </UButton>
+          <span class="text-muted text-xs">{{ t('inputGate.recheckHint') }}</span>
+        </div>
+
+        <p v-if="inputGate.error" class="text-error mt-2 text-xs">{{ inputGate.error }}</p>
+      </div>
+    </div>
+  </div>
+</template>

package/app/components/panels/AgentStepDetail.vue

@@ -20,6 +20,7 @@ import { useStepTimer } from '~/composables/useStepTimer'
 import { useStepProse } from '~/composables/useStepProse'
 import { useStepApproval } from '~/composables/useStepApproval'
 import { dedicatedParkView } from '~/utils/pipelineRender'
+import InputGateNotice from '~/components/inputGate/InputGateNotice.vue'
 
 // Detail overlay for a single pipeline step. Opened by clicking an agent in the
 // inspector list (TaskExecution) or the focus-view pipeline (PipelineProgress) via
@@ -168,7 +169,21 @@ const companionExceeded = computed(() => approvalPending.value && !!step.value?.
 // resolver refuses these server-side, so the rail is replaced by a redirect to that window.
 // Computed live, since a coder step can park on one WHILE this overlay is already open
 // (the routing in `dispatchStepView` only covers the open click).
-const dedicatedPark = computed(() => (step.value ? dedicatedParkView(step.value) : null))
+const dedicatedPark = computed(() =>
+  step.value ? dedicatedParkView(step.value, instance.value) : null,
+)
+/**
+ * The PRE-TOKEN INPUT GATE's verdict when it is what holds this step. Answered INLINE here
+ * (unlike the other dedicated parks, which redirect to a window): its remedy is to edit the
+ * task, so there is no second modal to send anyone to.
+ *
+ * Only the PARK, hence the literal `blocked` tone at the call site: this overlay exists to
+ * answer one step's park, and an advisory finding is about the run rather than this step. It is
+ * reported once, on the run panel, instead of on every step overlay opened under it.
+ */
+const inputGateVerdict = computed(() =>
+  dedicatedPark.value === 'input-gate' ? (instance.value?.inputGate ?? null) : null,
+)
 /** The generic approve/request-changes/reject rail applies (no dedicated surface owns the park). */
 const genericApprovalPending = computed(
   () => approvalPending.value && !companionExceeded.value && !dedicatedPark.value,
@@ -181,7 +196,7 @@ function openDedicatedWindow() {
   if (!c || !park) return
   close()
   if (park === 'follow-ups') ui.openFollowUps(c.instanceId, c.stepIndex)
-  else ui.openForkDecision(c.instanceId, c.stepIndex)
+  else if (park === 'fork-decision') ui.openForkDecision(c.instanceId, c.stepIndex)
 }
 
 function close() {
@@ -433,8 +448,17 @@ async function copyOutput() {
               <!-- a park a dedicated window owns (fork choice / follow-up triage): the
                    generic approval rail can't resolve it (the server refuses), so point
                    the human at the window that can -->
+              <!-- the pre-token input gate holds this step: answered here, in place -->
+              <InputGateNotice
+                v-if="inputGateVerdict && instance"
+                :gate="inputGateVerdict"
+                tone="blocked"
+                :execution-id="instance.id"
+                compact
+              />
+
               <div
-                v-if="dedicatedPark"
+                v-if="dedicatedPark && dedicatedPark !== 'input-gate'"
                 class="rounded-xl border border-amber-500/30 bg-amber-500/5 p-4"
                 data-testid="dedicated-park-redirect"
               >

package/app/components/panels/inspector/TaskExecution.vue

@@ -16,6 +16,8 @@ import { useNowTick, stepDurationLabel } from '~/composables/useStepTimer'
 import type { PipelineStep } from '~/types/execution'
 import type { ChangeClass, ReviewEffort } from '~/types/merge'
 import MergeEffortChips from '~/components/merge/MergeEffortChips.vue'
+import InputGateNotice from '~/components/inputGate/InputGateNotice.vue'
+import { inputGateNoticeFor } from '~/utils/inputGate'
 
 const props = defineProps<{ block: Block }>()
 
@@ -58,6 +60,14 @@ const isEmpty = computed(
 // A failed run is no longer executing: a step left mid-flight must stop showing
 // its live "Spinning up…" phase (the shared failure banner renders below).
 const runFailed = computed(() => instance.value?.status === 'failed')
+/**
+ * The run's PRE-TOKEN INPUT GATE notice: the park while it holds the run, the waiver once
+ * somebody overruled it, and the ADVISORY findings a `passed` verdict still carries (which is
+ * the entire product of `advisory` mode, and how `standard` mode reports a thin description).
+ * Read off the RUN, not a step: the gate guards the first dispatch and leaves nothing
+ * kind-specific behind. Which verdicts earn a notice is `inputGateNoticeFor`'s call.
+ */
+const inputGateNotice = computed(() => inputGateNoticeFor(instance.value))
 
 // A failed pipeline run surfaces the shared failure banner + retry — the
 // execution failure surface that the old `pr_ready` flip used to hide.
@@ -298,6 +308,16 @@ async function mergePr() {
           </UButton>
         </div>
       </div>
+      <!-- What the task's input check found. Rendered above the step list because it is a fact
+           about the RUN, and because the remedy for a park is to edit the task, not open a step.
+           An advisory verdict renders here too: nothing was parked, but something was found. -->
+      <InputGateNotice
+        v-if="inputGateNotice"
+        :gate="inputGateNotice.gate"
+        :tone="inputGateNotice.tone"
+        :execution-id="instance.id"
+        class="mb-2"
+      />
       <ul class="space-y-1">
         <li
           v-for="(s, i) in instance.steps"
@@ -417,7 +437,7 @@ async function mergePr() {
               v-else-if="
                 s.approval &&
                 s.approval.status === 'pending' &&
-                dedicatedParkView(s) === 'fork-decision'
+                dedicatedParkView(s, instance) === 'fork-decision'
               "
               color="primary"
               variant="soft"
@@ -434,7 +454,7 @@ async function mergePr() {
               v-else-if="
                 s.approval &&
                 s.approval.status === 'pending' &&
-                dedicatedParkView(s) === 'follow-ups'
+                dedicatedParkView(s, instance) === 'follow-ups'
               "
               color="primary"
               variant="soft"
@@ -461,8 +481,17 @@ async function mergePr() {
             >
               {{ t('inspector.execution.reviewFindings') }}
             </UButton>
+            <!-- The generic approve/review rail. Reached only once no dedicated surface owns
+                 the park: the branches above took the fork and follow-up windows, so the one
+                 left to exclude is the PRE-TOKEN INPUT GATE, which rides `step.approval` too
+                 but is refused by the generic resolver server-side (approving it would mark the
+                 run's first working step done and skip the work). It is answered by the notice
+                 above the list. Asked of `dedicatedParkView` rather than re-derived here, so
+                 the rule that decides which surface owns a park lives in exactly one place. -->
             <UButton
-              v-else-if="s.approval && s.approval.status === 'pending'"
+              v-else-if="
+                s.approval && s.approval.status === 'pending' && !dedicatedParkView(s, instance)
+              "
               color="warning"
               variant="soft"
               size="xs"

package/app/components/pipeline/PipelineProgress.vue

@@ -681,7 +681,7 @@ const ITEM_ICON: Record<string, string> = {
               s.approval &&
               s.approval.status === 'pending' &&
               !prReviewAwaiting(s) &&
-              !dedicatedParkView(s)
+              !dedicatedParkView(s, props.instance)
             "
             class="mt-3"
           >

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -11,7 +11,7 @@
 // standalone modals).
 import { reactive, ref, watch } from 'vue'
 import { useReactiveSlots } from '@modular-vue/runtime'
-import type { ReviewFrictionMode, TaskLimitMode } from '~/types/domain'
+import type { InputGateMode, ReviewFrictionMode, TaskLimitMode } from '~/types/domain'
 import RiskPolicyPanel from '~/components/settings/RiskPolicyPanel.vue'
 import IssueTrackerPanel from '~/components/settings/IssueTrackerPanel.vue'
 import ServiceFragmentDefaultsPanel from '~/components/settings/ServiceFragmentDefaultsPanel.vue'
@@ -151,6 +151,12 @@ const MODES = computed<{ value: TaskLimitMode; label: string }[]>(() => [
   { value: 'per_type', label: t('settings.workspaceSettings.taskLimit.modes.per_type') },
 ])
 
+const INPUT_GATE_MODES = computed<{ value: InputGateMode; label: string }[]>(() => [
+  { value: 'standard', label: t('settings.workspaceSettings.inputGate.modes.standard') },
+  { value: 'advisory', label: t('settings.workspaceSettings.inputGate.modes.advisory') },
+  { value: 'off', label: t('settings.workspaceSettings.inputGate.modes.off') },
+])
+
 const REVIEW_FRICTION_MODES = computed<{ value: ReviewFrictionMode; label: string }[]>(() => [
   { value: 'off', label: t('settings.workspaceSettings.reviewFriction.modes.off') },
   { value: 'warn', label: t('settings.workspaceSettings.reviewFriction.modes.warn') },
@@ -175,6 +181,7 @@ const draft = reactive({
   artifactRetentionDays: 14,
   kaizenEnabled: true,
   allowInitiatorPat: true,
+  inputGateMode: 'standard' as InputGateMode,
   reviewFrictionMode: 'off' as ReviewFrictionMode,
   reviewFrictionWarnCount: 3,
   reviewFrictionBlockCountEnabled: false,
@@ -195,6 +202,7 @@ function hydrate() {
   draft.artifactRetentionDays = s.artifactRetentionDays
   draft.kaizenEnabled = s.kaizenEnabled
   draft.allowInitiatorPat = s.allowInitiatorPat
+  draft.inputGateMode = s.inputGateMode
   draft.reviewFrictionMode = s.reviewFrictionMode
   draft.reviewFrictionWarnCount = s.reviewFrictionWarnCount
   // The hard-block knobs are nullable (null ⇒ that trigger is off); a per-trigger checkbox is
@@ -252,6 +260,7 @@ async function save() {
       artifactRetentionDays: draft.artifactRetentionDays,
       kaizenEnabled: draft.kaizenEnabled,
       allowInitiatorPat: draft.allowInitiatorPat,
+      inputGateMode: draft.inputGateMode,
       reviewFrictionMode: draft.reviewFrictionMode,
       reviewFrictionWarnCount: draft.reviewFrictionWarnCount,
       reviewFrictionBlockCount: blockCount,
@@ -359,6 +368,30 @@ async function save() {
               </div>
             </section>
 
+            <!-- The pre-token input gate: the structural check of a task's own wording, run
+                 before a run's first agent step is dispatched. -->
+            <section class="space-y-2">
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.inputGate.heading') }}
+              </h3>
+              <p class="text-[11px] text-slate-400">
+                {{ t('settings.workspaceSettings.inputGate.body') }}
+              </p>
+              <label class="block w-64">
+                <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">{{
+                  t('settings.workspaceSettings.inputGate.mode')
+                }}</span>
+                <USelect
+                  v-model="draft.inputGateMode"
+                  :items="INPUT_GATE_MODES"
+                  value-key="value"
+                  size="sm"
+                  class="w-full"
+                  data-testid="input-gate-mode"
+                />
+              </label>
+            </section>
+
             <!-- Review-debt friction on task creation -->
             <section class="space-y-2">
               <h3 class="text-sm font-semibold text-slate-200">

package/app/components/vcs/VcsConnectSurfaces.vue

@@ -0,0 +1,58 @@
+<script setup lang="ts">
+// The connect surfaces a deployment can actually serve, in one place. A deployment wires a
+// GitHub App, a per-workspace GitLab PAT connect, both, or neither, and only
+// `GET /vcs/connect-options` (via the store's `canConnect*`) can say which — a connection
+// READ says nothing, because the `github` module builds for either provider.
+//
+// Every surface that can strand a user on "not connected yet" renders this: the source-control
+// panel, the onboarding gate, and the two modals that need a connection before they can do
+// anything (add-service-from-repo, bootstrap). They had diverged — both modals hardcoded the
+// GitHub App picker, so a GitLab-only deployment offered an installation flow it cannot serve
+// and no way to connect at all — which is why the fan-out lives here rather than being copied
+// a fourth time.
+//
+// Explicit imports: the auto-import name for `github/GitHubConnect` doesn't match the
+// `<GitHubConnect>` tag (see GitHubPanel), so both children are bound by path.
+import GitHubConnect from '~/components/github/GitHubConnect.vue'
+import GitLabConnect from '~/components/vcs/GitLabConnect.vue'
+
+const props = defineProps<{
+  /**
+   * Copy shown above the GitHub App picker only, since it is the one surface whose flow needs
+   * explaining (pick an account, grant repo access). Omitted ⇒ no intro, which is what the
+   * modals want: their own prompt already said why a connection is needed.
+   */
+  appIntro?: string
+}>()
+
+const { t } = useI18n()
+const github = useGitHubStore()
+
+// Whether the deployment serves neither surface. Rendered as a statement rather than an empty
+// box: "nothing is configured" and "we couldn't read what is configured" both land here, and a
+// blank space would read as the connect UI still loading.
+const nothingConfigured = computed(() => !github.canConnectGitHubApp && !github.canConnectGitLabPat)
+</script>
+
+<template>
+  <div class="space-y-3">
+    <template v-if="github.canConnectGitHubApp">
+      <p v-if="props.appIntro" class="text-sm text-slate-400">{{ props.appIntro }}</p>
+      <GitHubConnect />
+    </template>
+
+    <USeparator
+      v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
+      :label="t('vcs.connect.or')"
+    />
+
+    <GitLabConnect v-if="github.canConnectGitLabPat" />
+
+    <p
+      v-if="nothingConfigured"
+      class="rounded-md border border-dashed border-slate-800 px-3 py-3 text-sm text-slate-400"
+    >
+      {{ t('vcs.connect.noneConfigured') }}
+    </p>
+  </div>
+</template>

package/app/composables/api/inputGate.ts

@@ -0,0 +1,25 @@
+import { resolveInputGateContract, type ResolveInputGateChoice } from '@cat-factory/contracts'
+import type { ApiContext } from './context'
+
+/**
+ * The PRE-TOKEN INPUT GATE: a run whose task states nothing an agent could act on parks before
+ * its first dispatch, having spent no tokens. This resolves that park: `recheck` re-evaluates
+ * the task as it now stands (the fix is verified, not asserted), `proceed` waives the findings.
+ *
+ * There is deliberately no read: the verdict rides the run (`ExecutionInstance.inputGate`),
+ * which the board snapshot and the live stream already carry.
+ */
+export function inputGateApi({ send, ws }: ApiContext) {
+  return {
+    resolveInputGate: (
+      workspaceId: string,
+      executionId: string,
+      body: { choice: ResolveInputGateChoice },
+    ) =>
+      send(resolveInputGateContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { executionId },
+        body,
+      }),
+  }
+}

package/app/composables/useApi.ts

@@ -13,6 +13,7 @@ import { documentsApi } from './api/documents'
 import { executionApi } from './api/execution'
 import { followUpsApi } from './api/followUps'
 import { forkDecisionApi } from './api/forkDecision'
+import { inputGateApi } from './api/inputGate'
 import { judgeApi } from './api/judge'
 import { prReviewApi } from './api/prReview'
 import { fragmentsApi } from './api/fragments'
@@ -129,6 +130,7 @@ export function useApi() {
     ...reviewsApi(ctx),
     ...followUpsApi(ctx),
     ...forkDecisionApi(ctx),
+    ...inputGateApi(ctx),
     ...judgeApi(ctx),
     ...prReviewApi(ctx),
     ...humanTestApi(ctx),

package/app/composables/usePipelineErrorToast.ts

@@ -80,6 +80,14 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
     titleKey: 'errors.conflict.title.dependencies_unmet',
     descriptionKey: 'errors.conflict.description.dependencies_unmet',
   },
+  input_gate_not_parked: {
+    titleKey: 'errors.conflict.title.input_gate_not_parked',
+    descriptionKey: 'errors.conflict.description.input_gate_not_parked',
+  },
+  input_gate_parked: {
+    titleKey: 'errors.conflict.title.input_gate_parked',
+    descriptionKey: 'errors.conflict.description.input_gate_parked',
+  },
   task_limit_reached: {
     titleKey: 'errors.conflict.title.task_limit_reached',
     descriptionKey: 'errors.conflict.description.task_limit_reached',

package/app/stores/github/vcsConnect.ts

@@ -1,5 +1,67 @@
+import { computed, type ComputedRef } from 'vue'
+import type { VcsProvider } from '~/types/domain'
 import type { GitHubStoreContext } from './context'
 
+/**
+ * Everything a component needs to know about WHICH provider it is dealing with. Kept here,
+ * beside the connect actions that populate the state it reads, so the three questions stay
+ * answered in one place: what is connected, what could be connected, and what a given surface
+ * should therefore call itself.
+ */
+export interface VcsProviderViews {
+  /** The provider backing the current connection; a connection predating the discriminator is App-era GitHub. */
+  provider: ComputedRef<VcsProvider>
+  canConnectGitHubApp: ComputedRef<boolean>
+  canConnectGitLabPat: ComputedRef<boolean>
+  soleConnectProvider: ComputedRef<VcsProvider | null>
+  surfaceProvider: ComputedRef<VcsProvider | null>
+}
+
+/** The derived provider questions above, off the probed connection + capability state. */
+export function createVcsProviderViews(ctx: GitHubStoreContext): VcsProviderViews {
+  const { connection, connectOptions } = ctx
+
+  const provider = computed<VcsProvider>(() => connection.value?.provider ?? 'github')
+
+  /** Whether the deployment can serve a GitHub App connect / a per-workspace GitLab PAT connect. */
+  const canConnectGitHubApp = computed(() =>
+    connectOptions.value.some((o) => o.provider === 'github' && o.method === 'app'),
+  )
+  const canConnectGitLabPat = computed(() =>
+    connectOptions.value.some((o) => o.provider === 'gitlab' && o.method === 'pat'),
+  )
+
+  /**
+   * The single provider this deployment can connect, or null when it offers several (or none) —
+   * what the connect copy keys off so a one-provider deployment never says "choose a provider".
+   */
+  const soleConnectProvider = computed<VcsProvider | null>(() => {
+    const providers = new Set(connectOptions.value.map((o) => o.provider))
+    return providers.size === 1 ? [...providers][0]! : null
+  })
+
+  /**
+   * The provider a repo-facing surface is ABOUT: the connected one, or (with nothing bound yet)
+   * the only one this deployment could connect. Null when it offers several and none is
+   * connected, because naming one there would be a guess — such a surface says something neutral
+   * instead (`vcs.onboarding.titleAny` is the pattern). Distinct from {@link provider}, which
+   * answers "what is connected" and therefore defaults to `github`: reading THAT before a
+   * connection exists is what puts "Pick an existing GitHub repository" in front of a
+   * GitLab-only deployment.
+   */
+  const surfaceProvider = computed<VcsProvider | null>(() =>
+    connection.value !== null ? provider.value : soleConnectProvider.value,
+  )
+
+  return {
+    provider,
+    canConnectGitHubApp,
+    canConnectGitLabPat,
+    soleConnectProvider,
+    surfaceProvider,
+  }
+}
+
 /**
  * The provider-neutral half of the connection lifecycle: which connect surfaces the deployment
  * serves, and the per-workspace **PAT** connect (GitLab today). The GitHub-App installation

package/app/stores/github.spec.ts

@@ -15,6 +15,7 @@ function connection(overrides: Partial<GitHubConnection> = {}): GitHubConnection
     targetType: 'User',
     connectedAt: 1,
     provider: 'github',
+    method: 'app',
     canCreateRepos: false,
     canManageWorkflows: true,
     ...overrides,
@@ -56,6 +57,33 @@ describe('github store — VCS connect capability', () => {
     expect(github.canConnectGitLabPat).toBe(true)
     // A single-provider deployment names its provider, so the connect copy never says "choose".
     expect(github.soleConnectProvider).toBe('gitlab')
+    // …and the repo-facing surfaces name it too, BEFORE anything is connected. `provider`
+    // answers "what is connected" and so defaults to github; a surface reading that one is how
+    // "Pick an existing GitHub repository" ends up on a GitLab-only deployment.
+    expect(github.provider).toBe('github')
+    expect(github.surfaceProvider).toBe('gitlab')
+  })
+
+  it('names the connected provider once bound, whatever the deployment could connect', async () => {
+    stubApi({
+      getGitHubConnection: vi
+        .fn()
+        .mockResolvedValue({ connection: connection({ provider: 'gitlab', method: 'pat' }) }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({
+        options: [
+          { provider: 'github', method: 'app' },
+          { provider: 'gitlab', method: 'pat' },
+        ] satisfies VcsConnectOption[],
+      }),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    // Several connectable, so there is no sole provider — but one IS connected, and that is
+    // what every repo-facing surface is about.
+    expect(github.soleConnectProvider).toBeNull()
+    expect(github.surfaceProvider).toBe('gitlab')
   })
 
   it('reports no connect surface when the capability read fails, without hiding the integration', async () => {
@@ -91,6 +119,9 @@ describe('github store — VCS connect capability', () => {
     expect(github.canConnectGitHubApp).toBe(true)
     expect(github.canConnectGitLabPat).toBe(true)
     expect(github.soleConnectProvider).toBeNull()
+    // Nothing connected and several on offer: naming one would be a guess, so the surfaces
+    // fall back to their neutral copy rather than picking a brand.
+    expect(github.surfaceProvider).toBeNull()
   })
 
   it('connects GitLab with a trimmed PAT and loads the projection', async () => {