@cat-factory/app 0.221.2 → 0.223.0

package/app/stores/toolServers.ts

@@ -0,0 +1,112 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import type { ToolServerProbeResult, ToolServersView } from '~/types/toolServers'
+import { useWorkspaceStore } from '~/stores/workspace'
+import { apiErrorStatus } from '~/composables/api/errors'
+
+/**
+ * The deployment's tool servers (MCP) and the results of probing them.
+ *
+ * Two halves with different lifetimes, which is why they are separate refs. The INVENTORY is
+ * deployment code: it changes when the deployment redeploys, so it is loaded on demand and re-read
+ * rather than patched. A PROBE RESULT is a moment in time and belongs to the operator who asked for
+ * it, so results are kept per server id and never fetched eagerly — a probe spends an outbound
+ * request under the deployment's own credential, so opening a panel must not fire one.
+ *
+ * Mirrors the capability-credential store's availability handling deliberately: the two surfaces sit
+ * in one tab, gate on the same permission, and a member without it must see neither.
+ */
+export const useToolServersStore = defineStore('toolServers', () => {
+  const api = useApi()
+
+  const view = ref<ToolServersView | null>(null)
+  // Probe results by server id. Kept after a re-read of the inventory: a result describes the server
+  // rather than the list it arrived in, and dropping it on refresh would erase the answer the
+  // operator just asked for.
+  const results = ref<Record<string, ToolServerProbeResult>>({})
+  const probing = ref<string | null>(null)
+  const loading = ref(false)
+  // The backend's two definitive refusals: no `secrets.manage` (403), and — unlike the credential
+  // store — never a 503, since the inventory needs no encryption key to project a registry. `null`
+  // until first probed. A 403 HIDES the surface rather than disabling it, because the inventory
+  // names the deployment's credential keys and its endpoints.
+  const available = ref<boolean | null>(null)
+  let inFlight: Promise<void> | null = null
+
+  /**
+   * Whether there is anything to show. A deployment that registers no tool server has no row to
+   * render, and the panel section is hidden rather than rendering an empty heading.
+   *
+   * No `declarationsIncomplete` counterpart here, unlike the credential checklist: the inventory is
+   * read straight off this process's own registry, so an empty answer is an answer rather than
+   * possibly an outage.
+   */
+  const hasSurface = computed(() => (view.value?.servers.length ?? 0) > 0)
+
+  /**
+   * Refresh the inventory, sharing a read that is already in flight.
+   *
+   * Coalescing belongs on `load` and not only on `ensureLoaded` because both callers fire on the
+   * same interaction: the Infrastructure window calls `ensureLoaded` to decide whether the tab
+   * exists at all, and the panel refreshes on mount so a redeploy shows up without a reload. Two
+   * identical GETs per open is what a plain "force" would have cost, and a read that started
+   * microseconds ago IS the refresh.
+   */
+  async function load() {
+    if (inFlight) return inFlight
+    inFlight = readInventory().finally(() => (inFlight = null))
+    return inFlight
+  }
+
+  async function readInventory() {
+    const ws = useWorkspaceStore()
+    loading.value = true
+    try {
+      view.value = await api.listToolServers(ws.requireId())
+      available.value = true
+    } catch (err) {
+      if (apiErrorStatus(err) === 403) {
+        // A definitive answer, not a failure: this caller may not manage secrets. Hide the surface
+        // and stop probing; resolve normally.
+        available.value = false
+        view.value = null
+        return
+      }
+      // Any other failure (transient 5xx / network) leaves the state untouched, so it neither hides
+      // an available panel nor caches a false "unavailable", and PROPAGATES: the panel is the one
+      // surface that can tell a reader it is looking at a list we could not fetch. Same split as the
+      // capability-credential store.
+      throw err
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Load once and stay loaded; `load()` re-reads (both share whatever is in flight). */
+  async function ensureLoaded() {
+    if (available.value !== null) return
+    return load()
+  }
+
+  /**
+   * Probe ONE server and keep its result.
+   *
+   * The result is stored for every outcome, failures included: a failure IS the answer the operator
+   * asked for, and a store that only kept successes would leave the row looking untouched after the
+   * probe reported a dead endpoint. A thrown error (a 404 for a server the deployment has since
+   * dropped, a transient 5xx) propagates instead, because those are not probe verdicts.
+   */
+  async function probe(id: string) {
+    const ws = useWorkspaceStore()
+    probing.value = id
+    try {
+      const result = await api.probeToolServer(ws.requireId(), id)
+      results.value = { ...results.value, [id]: result }
+      return result
+    } finally {
+      probing.value = null
+    }
+  }
+
+  return { view, results, probing, loading, available, hasSurface, load, ensureLoaded, probe }
+})

package/app/types/toolServers.ts

@@ -0,0 +1,17 @@
+// Tool server (MCP) operability shapes: what this deployment declared, and what a probe answered.
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth). The probe
+// STATUS and the not-probeable REASON in particular are vocabularies both sides must agree about —
+// the backend decides them, this app maps each member to translated copy plus a remedy — so a
+// member added on one side only renders as a blank chip rather than failing to compile.
+
+export type {
+  ToolServerAllowedToolsCheck,
+  ToolServerCredential,
+  ToolServerNotProbeableReason,
+  ToolServerProbeResult,
+  ToolServerProbeStatus,
+  ToolServerTransport,
+  ToolServerView,
+  ToolServersView,
+} from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -606,6 +606,48 @@
         "removeFailed": "Der Registry-Eintrag konnte nicht entfernt werden"
       }
     },
+    "toolServers": {
+      "heading": "Werkzeugserver (MCP)",
+      "intro": "Die MCP-Server, die diese Installation für ihre Agenten registriert. Ein Test löst die Zugangsdaten dieses Boards auf und spricht das Protokoll mit dem Server, das Ergebnis entspricht also dem, was ein Lauf erhält.",
+      "transport": {
+        "stdio": "Im Container",
+        "http": "Extern"
+      },
+      "declaredBy": "Zugewiesen an: {kinds}",
+      "declaredByNone": "Kein Agent erhält diesen Server, daher startet ihn kein Lauf.",
+      "servableHarnesses": "Läuft mit: {harnesses}",
+      "servableHarnessesNone": "Keine Agenten-CLI kann diesen Transport bedienen, daher greift dieser Server in keinem Lauf.",
+      "allowedTools": "Eingeschränkt auf: {tools}",
+      "credentials": "Zugangsdaten: {keys}",
+      "test": "Testen",
+      "notProbeable": {
+        "stdio": "Läuft im Container des Agenten und kann von hier aus nicht getestet werden.",
+        "containerLocal": "Lauscht neben dem Agenten in dessen eigenem Container, der von hier aus nicht erreichbar ist.",
+        "urlNotAllowed": "Unter dieser Adresse darf ein Werkzeugserver nicht erreicht werden (https oder einfaches http nur auf localhost)."
+      },
+      "status": {
+        "ok": "Hat geantwortet",
+        "credentialsMissing": "Keine Zugangsdaten",
+        "credentialRefused": "Zugangsdaten abgelehnt",
+        "unreachable": "Keine Antwort",
+        "httpError": "Anfrage abgewiesen",
+        "protocolError": "Kein MCP-Server",
+        "notProbeable": "Von hier nicht testbar"
+      },
+      "okDetail": "{name} {version}, Protokoll {protocol}, {count} Werkzeuge.",
+      "toolsIncomplete": "Der Server hat mehr Werkzeuge, als ein Test liest, diese Zahl ist also ein Mindestwert.",
+      "unmatchedTools": "Dieser Server bietet kein Werkzeug namens {tools}, dem Agenten wird also ein Werkzeug angekündigt, das er nicht aufrufen kann.",
+      "allowedToolsUnchecked": "Die Werkzeugliste war zu lang, um sie vollständig zu lesen, daher konnten die eingeschränkten Namen nicht geprüft werden.",
+      "unresolvedCredentials": "Für {keys} wurde nichts aufgelöst. Trage den Wert unten ein oder setze ihn in der Umgebung der Installation.",
+      "refusedCredentials": "{keys} benennt eine Variable, die zur Konfiguration der Plattform selbst gehört, und wird daher nie aufgelöst. Ändere die Deklaration im Code der Installation.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "Details anzeigen",
+      "hideDetails": "Details verbergen",
+      "toast": {
+        "loadFailed": "Die Werkzeugserver konnten nicht geladen werden",
+        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden"
+      }
+    },
     "capabilityCredentials": {
       "tab": "Zugangsdaten für Fähigkeiten",
       "intro": "Die Secrets, die die Tool-Server und generativen Integrationen dieser Installation namentlich anfordern. Werte gelten nur für dieses Board, werden verschlüsselt gespeichert und direkt an den Prozess des Agenten übergeben: Sie erscheinen weder in einem Prompt noch in einem Log. Werte lassen sich nur schreiben, nie auslesen, ein gespeicherter Wert wird also durch Eingabe eines neuen ersetzt.",
@@ -2216,6 +2258,7 @@
         "judge_review": "Als gelesen markieren",
         "pr_review_ready": "Als gelesen markieren",
         "budget_paused": "Als gelesen markieren",
+        "budget_threshold": "Als gelesen markieren",
         "key_drift": "Veraltete Zugangsdaten entfernen",
         "merge_tag_request": "Aufwand erfassen"
       },
@@ -3525,6 +3568,8 @@
     "spend": {
       "byModel": "Kosten nach Modell",
       "byAgentKind": "Kosten nach Agententyp",
+      "byRepo": "Kosten nach Repository",
+      "byTicket": "Kosten nach Ticket",
       "heading": "Kosten",
       "empty": "In diesem Zeitraum wurde keine Nutzung erfasst.",
       "calls": "{count} Aufruf | {count} Aufrufe",

package/i18n/locales/en.json

@@ -1834,6 +1834,8 @@
     "spend": {
       "byModel": "Spend by model",
       "byAgentKind": "Spend by agent kind",
+      "byRepo": "Spend by repository",
+      "byTicket": "Spend by ticket",
       "heading": "Spend",
       "empty": "No recorded usage in this window.",
       "calls": "{count} call | {count} calls",
@@ -2137,6 +2139,7 @@
         "judge_review": "Mark read",
         "pr_review_ready": "Mark read",
         "budget_paused": "Mark read",
+        "budget_threshold": "Mark read",
         "key_drift": "Drop stale credentials",
         "merge_tag_request": "Record effort"
       },
@@ -3083,6 +3086,48 @@
         "removeFailed": "Could not remove the registry entry"
       }
     },
+    "toolServers": {
+      "heading": "Tool servers (MCP)",
+      "intro": "The MCP servers this deployment registers for its agents. Testing one resolves this board's credentials and speaks the protocol to the server, so the result is what a run would get.",
+      "transport": {
+        "stdio": "In the container",
+        "http": "Remote"
+      },
+      "declaredBy": "Given to: {kinds}",
+      "declaredByNone": "No agent gets this server, so no run will ever start it.",
+      "servableHarnesses": "Works on: {harnesses}",
+      "servableHarnessesNone": "No agent CLI can serve this transport, so this server never applies to any run.",
+      "allowedTools": "Narrowed to: {tools}",
+      "credentials": "Credentials: {keys}",
+      "test": "Test",
+      "notProbeable": {
+        "stdio": "Runs inside the agent's container, so it cannot be tested from here.",
+        "containerLocal": "Listens beside the agent in its own container, which is not reachable from here.",
+        "urlNotAllowed": "The address is not one a tool server may be reached at (https, or plain http on localhost)."
+      },
+      "status": {
+        "ok": "Answered",
+        "credentialsMissing": "No credential",
+        "credentialRefused": "Credential refused",
+        "unreachable": "No answer",
+        "httpError": "Rejected the request",
+        "protocolError": "Not an MCP server",
+        "notProbeable": "Cannot be tested from here"
+      },
+      "okDetail": "{name} {version}, protocol {protocol}, {count} tools.",
+      "toolsIncomplete": "The server has more tools than one test reads, so this count is a minimum.",
+      "unmatchedTools": "This server exposes no tool called {tools}, so the agent is told about a tool it cannot call.",
+      "allowedToolsUnchecked": "The tool list was too long to read in full, so the narrowed names could not be checked.",
+      "unresolvedCredentials": "Nothing resolved for {keys}. Fill it in below, or set it in the deployment's environment.",
+      "refusedCredentials": "{keys} names a variable the platform's own configuration owns, so it is never resolved. Change the declaration in the deployment's code.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "Show details",
+      "hideDetails": "Hide details",
+      "toast": {
+        "loadFailed": "Could not load the tool servers",
+        "probeFailed": "Could not test the tool server"
+      }
+    },
     "capabilityCredentials": {
       "tab": "Capability credentials",
       "intro": "The secrets this deployment's tool servers and generative integrations ask for by name. Values are stored for this board only, sealed at rest, and handed straight to the agent's process: they never reach a prompt or a log. Values are write-only, so a stored one is replaced by typing a new one and never read back.",

package/i18n/locales/es.json

@@ -1742,6 +1742,8 @@
     "spend": {
       "byModel": "Gasto por modelo",
       "byAgentKind": "Gasto por tipo de agente",
+      "byRepo": "Gasto por repositorio",
+      "byTicket": "Gasto por tique",
       "heading": "Gasto",
       "empty": "No se registró uso en este periodo.",
       "calls": "{count} llamada | {count} llamadas",
@@ -2036,6 +2038,7 @@
         "judge_review": "Marcar como leído",
         "pr_review_ready": "Marcar como leída",
         "budget_paused": "Marcar como leída",
+        "budget_threshold": "Marcar como leída",
         "key_drift": "Descartar credenciales obsoletas",
         "merge_tag_request": "Registrar esfuerzo"
       },
@@ -2835,6 +2838,48 @@
         "removeFailed": "No se pudo eliminar la entrada del registro"
       }
     },
+    "toolServers": {
+      "heading": "Servidores de herramientas (MCP)",
+      "intro": "Los servidores MCP que esta instalación registra para sus agentes. Al probar uno se resuelven las credenciales de este tablero y se habla el protocolo con el servidor, así que el resultado es el que obtendría una ejecución.",
+      "transport": {
+        "stdio": "En el contenedor",
+        "http": "Remoto"
+      },
+      "declaredBy": "Asignado a: {kinds}",
+      "declaredByNone": "Ningún agente recibe este servidor, así que ninguna ejecución lo iniciará.",
+      "servableHarnesses": "Funciona con: {harnesses}",
+      "servableHarnessesNone": "Ninguna CLI de agente puede servir este transporte, así que este servidor nunca se aplica a una ejecución.",
+      "allowedTools": "Limitado a: {tools}",
+      "credentials": "Credenciales: {keys}",
+      "test": "Probar",
+      "notProbeable": {
+        "stdio": "Se ejecuta dentro del contenedor del agente, así que no puede probarse desde aquí.",
+        "containerLocal": "Escucha junto al agente en su propio contenedor, que no es accesible desde aquí.",
+        "urlNotAllowed": "Esta dirección no es válida para un servidor de herramientas (https, o http simple solo en localhost)."
+      },
+      "status": {
+        "ok": "Respondió",
+        "credentialsMissing": "Sin credencial",
+        "credentialRefused": "Credencial rechazada",
+        "unreachable": "Sin respuesta",
+        "httpError": "Rechazó la solicitud",
+        "protocolError": "No es un servidor MCP",
+        "notProbeable": "No se puede probar desde aquí"
+      },
+      "okDetail": "{name} {version}, protocolo {protocol}, {count} herramientas.",
+      "toolsIncomplete": "El servidor tiene más herramientas de las que lee una prueba, así que este número es un mínimo.",
+      "unmatchedTools": "Este servidor no expone ninguna herramienta llamada {tools}, así que al agente se le anuncia una herramienta que no puede invocar.",
+      "allowedToolsUnchecked": "La lista de herramientas era demasiado larga para leerla completa, así que no se pudieron comprobar los nombres limitados.",
+      "unresolvedCredentials": "No se resolvió nada para {keys}. Rellénalo abajo o defínelo en el entorno de la instalación.",
+      "refusedCredentials": "{keys} nombra una variable que pertenece a la configuración de la propia plataforma, así que nunca se resuelve. Cambia la declaración en el código de la instalación.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "Ver detalles",
+      "hideDetails": "Ocultar detalles",
+      "toast": {
+        "loadFailed": "No se pudieron cargar los servidores de herramientas",
+        "probeFailed": "No se pudo probar el servidor de herramientas"
+      }
+    },
     "capabilityCredentials": {
       "tab": "Credenciales de capacidades",
       "intro": "Los secretos que los servidores de herramientas y las integraciones generativas de esta instalación piden por nombre. Los valores se guardan solo para este tablero, cifrados en reposo, y se entregan directamente al proceso del agente: nunca llegan a un prompt ni a un registro. Los valores son de solo escritura, así que uno guardado se sustituye escribiendo otro y nunca se vuelve a leer.",

package/i18n/locales/fr.json

@@ -1742,6 +1742,8 @@
     "spend": {
       "byModel": "Dépense par modèle",
       "byAgentKind": "Dépense par type d’agent",
+      "byRepo": "Dépense par dépôt",
+      "byTicket": "Dépense par ticket",
       "heading": "Dépense",
       "empty": "Aucune utilisation enregistrée sur cette période.",
       "calls": "{count} appel | {count} appels",
@@ -2036,6 +2038,7 @@
         "judge_review": "Marquer comme lu",
         "pr_review_ready": "Marquer comme lu",
         "budget_paused": "Marquer comme lu",
+        "budget_threshold": "Marquer comme lu",
         "key_drift": "Supprimer les identifiants obsolètes",
         "merge_tag_request": "Enregistrer l’effort"
       },
@@ -2835,6 +2838,48 @@
         "removeFailed": "Impossible de supprimer l'entrée du registre"
       }
     },
+    "toolServers": {
+      "heading": "Serveurs d’outils (MCP)",
+      "intro": "Les serveurs MCP que ce déploiement enregistre pour ses agents. Tester un serveur résout les identifiants de ce tableau et parle le protocole avec lui : le résultat est donc celui qu’obtiendrait une exécution.",
+      "transport": {
+        "stdio": "Dans le conteneur",
+        "http": "Distant"
+      },
+      "declaredBy": "Attribué à : {kinds}",
+      "declaredByNone": "Aucun agent ne reçoit ce serveur, donc aucune exécution ne le démarrera.",
+      "servableHarnesses": "Fonctionne avec : {harnesses}",
+      "servableHarnessesNone": "Aucune CLI d’agent ne peut servir ce transport, donc ce serveur ne s’applique à aucune exécution.",
+      "allowedTools": "Restreint à : {tools}",
+      "credentials": "Identifiants : {keys}",
+      "test": "Tester",
+      "notProbeable": {
+        "stdio": "Il s’exécute dans le conteneur de l’agent et ne peut donc pas être testé d’ici.",
+        "containerLocal": "Il écoute à côté de l’agent, dans son propre conteneur, qui n’est pas joignable d’ici.",
+        "urlNotAllowed": "Cette adresse n’est pas autorisée pour un serveur d’outils (https, ou http simple sur localhost uniquement)."
+      },
+      "status": {
+        "ok": "A répondu",
+        "credentialsMissing": "Aucun identifiant",
+        "credentialRefused": "Identifiant refusé",
+        "unreachable": "Aucune réponse",
+        "httpError": "Requête rejetée",
+        "protocolError": "Pas un serveur MCP",
+        "notProbeable": "Non testable d’ici"
+      },
+      "okDetail": "{name} {version}, protocole {protocol}, {count} outils.",
+      "toolsIncomplete": "Le serveur expose plus d’outils qu’un test n’en lit : ce nombre est donc un minimum.",
+      "unmatchedTools": "Ce serveur n’expose aucun outil nommé {tools} : l’agent se voit donc annoncer un outil qu’il ne peut pas appeler.",
+      "allowedToolsUnchecked": "La liste d’outils était trop longue pour être lue en entier, les noms restreints n’ont donc pas pu être vérifiés.",
+      "unresolvedCredentials": "Rien n’a été résolu pour {keys}. Renseignez la valeur ci-dessous, ou définissez-la dans l’environnement du déploiement.",
+      "refusedCredentials": "{keys} désigne une variable qui appartient à la configuration de la plateforme elle-même : elle n’est jamais résolue. Modifiez la déclaration dans le code du déploiement.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "Afficher les détails",
+      "hideDetails": "Masquer les détails",
+      "toast": {
+        "loadFailed": "Impossible de charger les serveurs d’outils",
+        "probeFailed": "Impossible de tester le serveur d’outils"
+      }
+    },
     "capabilityCredentials": {
       "tab": "Identifiants des capacités",
       "intro": "Les secrets que les serveurs d'outils et les intégrations génératives de ce déploiement réclament par leur nom. Les valeurs ne sont enregistrées que pour ce tableau, chiffrées au repos, et remises directement au processus de l'agent : elles n'apparaissent ni dans un prompt ni dans un journal. Les valeurs sont en écriture seule, une valeur enregistrée se remplace donc en en saisissant une nouvelle et n'est jamais relue.",

package/i18n/locales/he.json

@@ -1742,6 +1742,8 @@
     "spend": {
       "byModel": "עלות לפי מודל",
       "byAgentKind": "עלות לפי סוג סוכן",
+      "byRepo": "עלות לפי מאגר",
+      "byTicket": "עלות לפי כרטיס",
       "heading": "עלות",
       "empty": "לא נרשם שימוש בטווח הזה.",
       "calls": "קריאה אחת | שתי קריאות | {count} קריאות",
@@ -2036,6 +2038,7 @@
         "judge_review": "סמן כנקרא",
         "pr_review_ready": "סמן כנקרא",
         "budget_paused": "סמן כנקרא",
+        "budget_threshold": "סמן כנקרא",
         "key_drift": "מחק אישורים מיושנים",
         "merge_tag_request": "לתעד את המאמץ"
       },
@@ -2976,6 +2979,48 @@
         "removeFailed": "הסרת רשומת המאגר נכשלה"
       }
     },
+    "toolServers": {
+      "heading": "שרתי כלים (MCP)",
+      "intro": "שרתי ה-MCP שהתקנה זו רושמת עבור הסוכנים שלה. בדיקה מאתרת את פרטי ההזדהות של לוח זה ומדברת עם השרת בפרוטוקול, כך שהתוצאה היא מה שהרצה תקבל.",
+      "transport": {
+        "stdio": "בתוך המכולה",
+        "http": "מרוחק"
+      },
+      "declaredBy": "משויך אל: {kinds}",
+      "declaredByNone": "אף סוכן אינו מקבל שרת זה, ולכן אף הרצה לא תפעיל אותו.",
+      "servableHarnesses": "עובד עם: {harnesses}",
+      "servableHarnessesNone": "אף CLI של סוכן אינו יכול לשרת תעבורה זו, ולכן שרת זה לא חל על שום הרצה.",
+      "allowedTools": "מוגבל אל: {tools}",
+      "credentials": "פרטי הזדהות: {keys}",
+      "test": "בדיקה",
+      "notProbeable": {
+        "stdio": "רץ בתוך המכולה של הסוכן, ולכן לא ניתן לבדוק אותו מכאן.",
+        "containerLocal": "מאזין לצד הסוכן במכולה שלו, שאינה נגישה מכאן.",
+        "urlNotAllowed": "אין זו כתובת שבה מותר להגיע לשרת כלים (https, או http פשוט רק ב-localhost)."
+      },
+      "status": {
+        "ok": "השיב",
+        "credentialsMissing": "אין פרטי הזדהות",
+        "credentialRefused": "פרטי ההזדהות נדחו",
+        "unreachable": "אין תשובה",
+        "httpError": "דחה את הבקשה",
+        "protocolError": "אינו שרת MCP",
+        "notProbeable": "לא ניתן לבדוק מכאן"
+      },
+      "okDetail": "{name} {version}, פרוטוקול {protocol}, {count} כלים.",
+      "toolsIncomplete": "לשרת יש יותר כלים ממה שבדיקה אחת קוראת, ולכן מספר זה הוא מינימום.",
+      "unmatchedTools": "שרת זה אינו חושף כלי בשם {tools}, ולכן מסופר לסוכן על כלי שאינו יכול לקרוא לו.",
+      "allowedToolsUnchecked": "רשימת הכלים הייתה ארוכה מכדי לקרוא אותה במלואה, ולכן לא ניתן היה לבדוק את השמות המוגבלים.",
+      "unresolvedCredentials": "לא אותר דבר עבור {keys}. מלאו את הערך למטה, או הגדירו אותו בסביבת ההתקנה.",
+      "refusedCredentials": "{keys} מציין משתנה שהוא חלק מהתצורה של הפלטפורמה עצמה, ולכן הוא לעולם אינו מאותר. שנו את ההצהרה בקוד ההתקנה.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "הצגת פרטים",
+      "hideDetails": "הסתרת פרטים",
+      "toast": {
+        "loadFailed": "לא ניתן לטעון את שרתי הכלים",
+        "probeFailed": "לא ניתן לבדוק את שרת הכלים"
+      }
+    },
     "capabilityCredentials": {
       "tab": "אישורי גישה ליכולות",
       "intro": "הסודות ששרתי הכלים והאינטגרציות הגנרטיביות של הפריסה הזו מבקשים לפי שם. הערכים נשמרים ללוח הזה בלבד, מוצפנים במנוחה ומועברים ישירות לתהליך של הסוכן: הם לעולם לא מגיעים להנחיה או ליומן. הערכים ניתנים לכתיבה בלבד, ולכן ערך שמור מוחלף בהקלדת ערך חדש ולעולם אינו נקרא בחזרה.",

package/i18n/locales/it.json

@@ -606,6 +606,48 @@
         "removeFailed": "Impossibile rimuovere la voce del registry"
       }
     },
+    "toolServers": {
+      "heading": "Server di strumenti (MCP)",
+      "intro": "I server MCP che questa installazione registra per i suoi agenti. Provarne uno risolve le credenziali di questa bacheca e parla il protocollo con il server, quindi il risultato è quello che otterrebbe un’esecuzione.",
+      "transport": {
+        "stdio": "Nel container",
+        "http": "Remoto"
+      },
+      "declaredBy": "Assegnato a: {kinds}",
+      "declaredByNone": "Nessun agente riceve questo server, quindi nessuna esecuzione lo avvierà.",
+      "servableHarnesses": "Funziona con: {harnesses}",
+      "servableHarnessesNone": "Nessuna CLI di agente può servire questo trasporto, quindi questo server non si applica a nessuna esecuzione.",
+      "allowedTools": "Limitato a: {tools}",
+      "credentials": "Credenziali: {keys}",
+      "test": "Prova",
+      "notProbeable": {
+        "stdio": "Gira dentro il container dell’agente, quindi non può essere provato da qui.",
+        "containerLocal": "Ascolta accanto all’agente nel suo container, che non è raggiungibile da qui.",
+        "urlNotAllowed": "Questo indirizzo non è consentito per un server di strumenti (https, oppure http semplice solo su localhost)."
+      },
+      "status": {
+        "ok": "Ha risposto",
+        "credentialsMissing": "Nessuna credenziale",
+        "credentialRefused": "Credenziale rifiutata",
+        "unreachable": "Nessuna risposta",
+        "httpError": "Richiesta respinta",
+        "protocolError": "Non è un server MCP",
+        "notProbeable": "Non provabile da qui"
+      },
+      "okDetail": "{name} {version}, protocollo {protocol}, {count} strumenti.",
+      "toolsIncomplete": "Il server ha più strumenti di quanti una prova ne legga, quindi questo numero è un minimo.",
+      "unmatchedTools": "Questo server non espone alcuno strumento chiamato {tools}, quindi all’agente viene annunciato uno strumento che non può invocare.",
+      "allowedToolsUnchecked": "L’elenco degli strumenti era troppo lungo per leggerlo tutto, quindi i nomi limitati non hanno potuto essere verificati.",
+      "unresolvedCredentials": "Nulla è stato risolto per {keys}. Inseriscilo qui sotto, oppure impostalo nell’ambiente dell’installazione.",
+      "refusedCredentials": "{keys} nomina una variabile che appartiene alla configurazione della piattaforma stessa, quindi non viene mai risolta. Modifica la dichiarazione nel codice dell’installazione.",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "Mostra dettagli",
+      "hideDetails": "Nascondi dettagli",
+      "toast": {
+        "loadFailed": "Impossibile caricare i server di strumenti",
+        "probeFailed": "Impossibile provare il server di strumenti"
+      }
+    },
     "capabilityCredentials": {
       "tab": "Credenziali delle capacità",
       "intro": "I segreti che i server di strumenti e le integrazioni generative di questo deployment richiedono per nome. I valori vengono salvati solo per questa board, cifrati a riposo, e consegnati direttamente al processo dell'agente: non finiscono mai in un prompt né in un log. I valori sono di sola scrittura, quindi uno salvato si sostituisce digitandone uno nuovo e non viene mai riletto.",
@@ -2216,6 +2258,7 @@
         "judge_review": "Segna come letto",
         "pr_review_ready": "Segna come letto",
         "budget_paused": "Segna come letto",
+        "budget_threshold": "Segna come letto",
         "key_drift": "Elimina credenziali obsolete",
         "merge_tag_request": "Registra l’impegno"
       },
@@ -3525,6 +3568,8 @@
     "spend": {
       "byModel": "Spesa per modello",
       "byAgentKind": "Spesa per tipo di agente",
+      "byRepo": "Spesa per repository",
+      "byTicket": "Spesa per ticket",
       "heading": "Spesa",
       "empty": "Nessun utilizzo registrato in questo periodo.",
       "calls": "{count} chiamata | {count} chiamate",

package/i18n/locales/ja.json

@@ -1742,6 +1742,8 @@
     "spend": {
       "byModel": "モデル別の費用",
       "byAgentKind": "エージェント種別の費用",
+      "byRepo": "リポジトリ別の費用",
+      "byTicket": "チケット別の費用",
       "heading": "費用",
       "empty": "この期間に記録された利用はありません。",
       "calls": "{count} 件の呼び出し | {count} 件の呼び出し",
@@ -2036,6 +2038,7 @@
         "judge_review": "既読にする",
         "pr_review_ready": "既読にする",
         "budget_paused": "既読にする",
+        "budget_threshold": "既読にする",
         "key_drift": "古い認証情報を削除",
         "merge_tag_request": "工数を記録"
       },
@@ -2976,6 +2979,48 @@
         "removeFailed": "レジストリエントリを削除できませんでした"
       }
     },
+    "toolServers": {
+      "heading": "ツールサーバー (MCP)",
+      "intro": "このデプロイがエージェント向けに登録している MCP サーバーです。テストするとこのボードの認証情報を解決してサーバーとプロトコルで通信するため、結果は実行時に得られるものと同じです。",
+      "transport": {
+        "stdio": "コンテナ内",
+        "http": "リモート"
+      },
+      "declaredBy": "割り当て先: {kinds}",
+      "declaredByNone": "どのエージェントにも渡されていないため、どの実行でも起動されません。",
+      "servableHarnesses": "対応 CLI: {harnesses}",
+      "servableHarnessesNone": "このトランスポートを扱えるエージェント CLI がないため、このサーバーはどの実行にも適用されません。",
+      "allowedTools": "許可されたツール: {tools}",
+      "credentials": "認証情報: {keys}",
+      "test": "テスト",
+      "notProbeable": {
+        "stdio": "エージェントのコンテナ内で動作するため、ここからはテストできません。",
+        "containerLocal": "エージェントと同じコンテナ内で待ち受けているため、ここからは到達できません。",
+        "urlNotAllowed": "ツールサーバーの接続先として許可されていないアドレスです (https、または localhost の平文 http のみ)。"
+      },
+      "status": {
+        "ok": "応答あり",
+        "credentialsMissing": "認証情報なし",
+        "credentialRefused": "認証情報を拒否",
+        "unreachable": "応答なし",
+        "httpError": "リクエストを拒否",
+        "protocolError": "MCP サーバーではない",
+        "notProbeable": "ここからテストできない"
+      },
+      "okDetail": "{name} {version}、プロトコル {protocol}、ツール {count} 個。",
+      "toolsIncomplete": "サーバーは 1 回のテストで読み取れる数を超えるツールを持つため、この数は最小値です。",
+      "unmatchedTools": "このサーバーに {tools} というツールは存在しないため、エージェントは呼び出せないツールを知らされています。",
+      "allowedToolsUnchecked": "ツール一覧が長すぎて全部を読み取れなかったため、絞り込んだ名前は確認できませんでした。",
+      "unresolvedCredentials": "{keys} の値が解決できませんでした。下で入力するか、デプロイの環境変数に設定してください。",
+      "refusedCredentials": "{keys} はプラットフォーム自身の設定に属する変数名なので、決して解決されません。デプロイのコード側の宣言を変更してください。",
+      "httpStatus": "HTTP {status}",
+      "showDetails": "詳細を表示",
+      "hideDetails": "詳細を隠す",
+      "toast": {
+        "loadFailed": "ツールサーバーを読み込めませんでした",
+        "probeFailed": "ツールサーバーをテストできませんでした"
+      }
+    },
     "capabilityCredentials": {
       "tab": "機能の認証情報",
       "intro": "このデプロイのツールサーバーと生成系インテグレーションが名前で要求するシークレットです。値はこのボードにのみ保存され、保管時は暗号化され、エージェントのプロセスへ直接渡されます。プロンプトにもログにも現れません。値は書き込み専用なので、保存済みの値は新しい値を入力して置き換えるだけで、読み出すことはできません。",