@cat-factory/app 0.228.0 → 0.229.0

package/app/components/settings/ToolServerChecklist.vue

@@ -40,6 +40,8 @@ const STATUS_LABELS = computed<Record<ToolServerProbeStatus, string>>(() => ({
   ok: t('settings.toolServers.status.ok'),
   credentials_missing: t('settings.toolServers.status.credentialsMissing'),
   credential_refused: t('settings.toolServers.status.credentialRefused'),
+  oauth_not_connected: t('settings.toolServers.status.oauthNotConnected'),
+  oauth_token_failed: t('settings.toolServers.status.oauthTokenFailed'),
   unreachable: t('settings.toolServers.status.unreachable'),
   http_error: t('settings.toolServers.status.httpError'),
   protocol_error: t('settings.toolServers.status.protocolError'),
@@ -53,6 +55,36 @@ const NOT_PROBEABLE_LABELS = computed<Record<ToolServerNotProbeableReason, strin
 
 const servers = computed<ToolServerView[]>(() => store.view?.servers ?? [])
 
+/**
+ * Whether a row offers the Connect / Disconnect pair.
+ *
+ * Only the INTERACTIVE grant does. A `client_credentials` declaration authenticates as the
+ * deployment's own client and mints its token on the first dispatch that needs one, so there is
+ * nothing for a person to authorise and a button would promise an action that does not exist.
+ */
+function isInteractive(server: ToolServerView): boolean {
+  return server.oauth?.grant === 'authorization_code'
+}
+
+async function connect(id: string) {
+  try {
+    await store.connectOAuth(id)
+  } catch (e) {
+    // Everything that can refuse does so BEFORE the browser leaves the app: an unconfigured
+    // redirect URL, a deployment with no grant store, an authorization server that publishes no
+    // metadata. Each carries a `details.reason` the shared funnel maps to translated copy.
+    present(e, 'settings.toolServers.toast.connectFailed')
+  }
+}
+
+async function disconnect(id: string) {
+  try {
+    await store.disconnectOAuth(id)
+  } catch (e) {
+    present(e, 'settings.toolServers.toast.disconnectFailed')
+  }
+}
+
 function resultFor(id: string) {
   return store.results[id]
 }
@@ -138,6 +170,85 @@ async function runProbe(id: string) {
         }}
       </p>
 
+      <!-- OAuth. Absent for a server that authenticates with a static credential, so the Connect
+           affordance never appears on a row it does not apply to. `connected` and `lastError` are
+           rendered TOGETHER rather than as alternatives: a grant that is on file and no longer
+           producing tokens is exactly the state that reads as working and is not. -->
+      <div
+        v-if="server.oauth"
+        class="space-y-1 rounded-md border border-slate-800 bg-slate-900/40 p-2"
+        :data-testid="`tool-server-oauth-${server.id}`"
+      >
+        <div class="flex flex-wrap items-center gap-2">
+          <UBadge
+            :color="server.oauth.connected ? 'success' : 'neutral'"
+            variant="soft"
+            size="sm"
+            :data-testid="`tool-server-oauth-state-${server.id}`"
+          >
+            {{
+              server.oauth.connected
+                ? t('settings.toolServers.oauth.connected')
+                : isInteractive(server)
+                  ? t('settings.toolServers.oauth.notConnected')
+                  : t('settings.toolServers.oauth.machineGrant')
+            }}
+          </UBadge>
+          <span v-if="server.oauth.connectedBy" class="text-[11px] text-slate-400">
+            {{ t('settings.toolServers.oauth.connectedBy', { user: server.oauth.connectedBy }) }}
+          </span>
+        </div>
+
+        <p v-if="server.oauth.scopes?.length" class="text-[11px] text-slate-400">
+          {{ t('settings.toolServers.oauth.scopes', { scopes: server.oauth.scopes.join(', ') }) }}
+        </p>
+        <!-- A grant with no refresh token works until its access token expires and then needs
+             granting again by hand. Said BEFORE it happens, which is the only time it is useful. -->
+        <p
+          v-if="server.oauth.connected && server.oauth.refreshable === false"
+          class="text-[11px] text-amber-400"
+        >
+          {{ t('settings.toolServers.oauth.notRefreshable') }}
+        </p>
+        <p
+          v-if="server.oauth.lastError"
+          class="text-[11px] text-red-400"
+          :data-testid="`tool-server-oauth-error-${server.id}`"
+        >
+          {{ t('settings.toolServers.oauth.lastError', { detail: server.oauth.lastError }) }}
+        </p>
+
+        <div v-if="isInteractive(server)" class="flex flex-wrap items-center gap-2 pt-1">
+          <UButton
+            size="xs"
+            variant="subtle"
+            icon="i-lucide-link"
+            :loading="store.connecting === server.id"
+            :disabled="store.connecting !== null"
+            :data-testid="`tool-server-connect-${server.id}`"
+            @click="connect(server.id)"
+          >
+            {{
+              server.oauth.connected
+                ? t('settings.toolServers.oauth.reconnect')
+                : t('settings.toolServers.oauth.connect')
+            }}
+          </UButton>
+          <UButton
+            v-if="server.oauth.connected"
+            size="xs"
+            variant="ghost"
+            color="error"
+            :loading="store.connecting === server.id"
+            :disabled="store.connecting !== null"
+            :data-testid="`tool-server-disconnect-${server.id}`"
+            @click="disconnect(server.id)"
+          >
+            {{ t('settings.toolServers.oauth.disconnect') }}
+          </UButton>
+        </div>
+      </div>
+
       <div class="flex flex-wrap items-center gap-2 pt-1">
         <UButton
           v-if="server.probeable"

package/app/components/visualConfirm/VisualConfirmationWindow.vue

@@ -131,6 +131,20 @@ function buildFindings(): { text: string; structured: { view?: string; note: str
   return { text: blocks.join('\n\n'), structured }
 }
 
+// Degraded-basis approval guard (no capture / a fix landed after these shots): require an
+// explicit "I reviewed this another way" acknowledgement before the one-click approve.
+const ackDegraded = ref(false)
+watch(
+  () => vc.value?.degradedReason ?? null,
+  () => {
+    ackDegraded.value = false
+  },
+)
+const needsAck = computed(() => !!vc.value?.degradedReason)
+const canApprove = computed(
+  () => awaitingHuman.value && !busy.value && (!needsAck.value || ackDegraded.value),
+)
+
 async function approve() {
   if (!blockId.value || !canApprove.value) return
   await visualConfirm.approve(blockId.value)
@@ -169,20 +183,6 @@ async function onFilePicked(e: Event) {
   uploadView.value = ''
   if (fileInput.value) fileInput.value.value = ''
 }
-
-// Degraded-basis approval guard (no capture / a fix landed after these shots): require an
-// explicit "I reviewed this another way" acknowledgement before the one-click approve.
-const ackDegraded = ref(false)
-watch(
-  () => vc.value?.degradedReason ?? null,
-  () => {
-    ackDegraded.value = false
-  },
-)
-const needsAck = computed(() => !!vc.value?.degradedReason)
-const canApprove = computed(
-  () => awaitingHuman.value && !busy.value && (!needsAck.value || ackDegraded.value),
-)
 </script>
 
 <template>

package/app/composables/api/toolServers.ts

@@ -1,4 +1,10 @@
-import { listToolServersContract, probeToolServerContract } from '@cat-factory/contracts'
+import {
+  completeToolServerOAuthContract,
+  disconnectToolServerOAuthContract,
+  listToolServersContract,
+  probeToolServerContract,
+  startToolServerOAuthContract,
+} from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /**
@@ -17,5 +23,21 @@ export function toolServersApi({ send, ws }: ApiContext) {
 
     probeToolServer: (workspaceId: string, id: string) =>
       send(probeToolServerContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    // Begin an interactive OAuth grant: answers with the VENDOR's authorization URL for the
+    // operator's browser to follow, rather than redirecting, since a redirect from a `fetch` lands
+    // in a cross-origin document this app cannot observe.
+    startToolServerOAuth: (workspaceId: string, id: string) =>
+      send(startToolServerOAuthContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    disconnectToolServerOAuth: (workspaceId: string, id: string) =>
+      send(disconnectToolServerOAuthContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    // Finish a grant with what the vendor's redirect carried. NOT workspace-prefixed: the board is
+    // sealed into the `state`, so the caller does not know it and could not be trusted with it
+    // anyway. This is the request that makes the flow's session, user binding and permission
+    // re-check enforceable, which a vendor's redirect landing on the backend never could.
+    completeToolServerOAuth: (body: { code: string; state: string }) =>
+      send(completeToolServerOAuthContract, { body }),
   }
 }

package/app/pages/index.vue

@@ -285,6 +285,27 @@ watch(
   { immediate: true },
 )
 
+// Probe the GitHub integration as soon as a board is active (re-probe per board —
+// connections are per workspace). The result drives the onboarding gate in the template
+// before the board mounts, so an unconnected user can't slip past it. `ensureProbed`
+// single-flights per board (app-startup initiative, item 12), so this and the SideBar's
+// probe collapse to one request on a cold open instead of two.
+watch(
+  () => workspace.workspaceId,
+  (id) => {
+    if (id) void github.ensureProbed()
+  },
+  { immediate: true },
+)
+
+// Hard gate: the App is enabled on the backend but this workspace has no
+// installation yet. `available === null` means the probe is still in flight.
+// Both are declared here, ahead of the tutorial offer below, because that offer reads them
+// from a watcher that runs synchronously during setup (`immediate: true`). Declared after
+// it, they'd still be in their TDZ and the first run would throw.
+const needsGitHubInstall = computed(() => github.available === true && !github.connected)
+const githubProbePending = computed(() => github.available === null)
+
 // Offer the tutorial on launch, once the board is up. Yields to every other startup
 // surface — the GitHub onboarding gate and the advisory/onboarding modals above — so a
 // first launch never stacks the tour prompt on top of a dialog that needs answering
@@ -347,24 +368,6 @@ useTutorialNudge()
 // simply has nothing to talk to, and the browser-persisted store carries on alone.
 useTutorialSync()
 
-// Probe the GitHub integration as soon as a board is active (re-probe per board —
-// connections are per workspace). The result drives the onboarding gate below
-// before the board mounts, so an unconnected user can't slip past it. `ensureProbed`
-// single-flights per board (app-startup initiative, item 12), so this and the SideBar's
-// probe collapse to one request on a cold open instead of two.
-watch(
-  () => workspace.workspaceId,
-  (id) => {
-    if (id) void github.ensureProbed()
-  },
-  { immediate: true },
-)
-
-// Hard gate: the App is enabled on the backend but this workspace has no
-// installation yet. `available === null` means the probe is still in flight.
-const needsGitHubInstall = computed(() => github.available === true && !github.connected)
-const githubProbePending = computed(() => github.available === null)
-
 // Subscribe to the backend's real-time event stream and (re)connect whenever the
 // active workspace changes. Runs advance durably server-side; progress arrives as
 // pushed events rather than by polling.

package/app/pages/mcp-oauth-callback.vue

@@ -0,0 +1,7 @@
+<script setup lang="ts">
+import McpOAuthCallbackScreen from '~/components/settings/McpOAuthCallbackScreen.vue'
+</script>
+
+<template>
+  <McpOAuthCallbackScreen />
+</template>

package/app/stores/execution.ts

@@ -131,6 +131,12 @@ export const useExecutionStore = defineStore('execution', () => {
     } else instances.value.push(instance)
   }
 
+  const byId = computed(() => {
+    const map = new Map<string, ExecutionInstance>()
+    for (const e of instances.value) map.set(e.id, e)
+    return map
+  })
+
   /**
    * Run an action that returns a run's authoritative sub-state and apply that state to the cached
    * run as an OPTIMISTIC ECHO — but only when the event stream has not delivered a newer revision
@@ -169,12 +175,6 @@ export const useExecutionStore = defineStore('execution', () => {
     return state
   }
 
-  const byId = computed(() => {
-    const map = new Map<string, ExecutionInstance>()
-    for (const e of instances.value) map.set(e.id, e)
-    return map
-  })
-
   function getInstance(id: string | null | undefined) {
     return id ? byId.value.get(id) : undefined
   }

package/app/stores/toolServers.ts

@@ -25,6 +25,9 @@ export const useToolServersStore = defineStore('toolServers', () => {
   // operator just asked for.
   const results = ref<Record<string, ToolServerProbeResult>>({})
   const probing = ref<string | null>(null)
+  // The server whose OAuth grant is being connected or disconnected, so one row's button spins and
+  // the rest stay clickable — the same shape `probing` has, and for the same reason.
+  const connecting = ref<string | null>(null)
   const loading = ref(false)
   // The backend's two definitive refusals: no `secrets.manage` (403), and — unlike the credential
   // store — never a 503, since the inventory needs no encryption key to project a registry. `null`
@@ -108,5 +111,58 @@ export const useToolServersStore = defineStore('toolServers', () => {
     }
   }
 
-  return { view, results, probing, loading, available, hasSurface, load, ensureLoaded, probe }
+  /**
+   * Start an OAuth grant and hand the browser to the vendor.
+   *
+   * A full-page navigation rather than a popup: the operator has to sign in at a third party, and a
+   * popup is what a browser blocks and a password manager cannot fill. Nothing is stored here — the
+   * vendor redirects back to `/mcp-oauth-callback`, which finishes the grant over the authenticated
+   * API and returns here, so the connection state comes from the row rather than from anything this
+   * store guessed across a navigation that leaves the app entirely.
+   */
+  async function connectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      const { url } = await api.startToolServerOAuth(ws.requireId(), id)
+      window.location.href = url
+    } finally {
+      connecting.value = null
+    }
+  }
+
+  /**
+   * Drop the workspace's grant, then re-read so the row's state comes from the backend rather than
+   * from an optimistic edit: a disconnect is the one action whose whole point is that the server
+   * stops being usable, and a row that looked connected for another second would be the misreport
+   * this panel exists to prevent.
+   */
+  async function disconnectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      await api.disconnectToolServerOAuth(ws.requireId(), id)
+      // The stored probe result described a server this board could still reach. It cannot now.
+      const { [id]: _dropped, ...rest } = results.value
+      results.value = rest
+    } finally {
+      connecting.value = null
+    }
+    await load()
+  }
+
+  return {
+    view,
+    results,
+    probing,
+    connecting,
+    loading,
+    available,
+    hasSurface,
+    load,
+    ensureLoaded,
+    probe,
+    connectOAuth,
+    disconnectOAuth,
+  }
 })

package/app/types/toolServers.ts

@@ -9,6 +9,8 @@ export type {
   ToolServerAllowedToolsCheck,
   ToolServerCredential,
   ToolServerNotProbeableReason,
+  ToolServerOAuthGrant,
+  ToolServerOAuthStatus,
   ToolServerProbeResult,
   ToolServerProbeStatus,
   ToolServerTransport,

package/i18n/locales/de.json

@@ -624,6 +624,27 @@
       "servableHarnessesNone": "Keine Agenten-CLI kann diesen Transport bedienen, daher greift dieser Server in keinem Lauf.",
       "allowedTools": "Eingeschränkt auf: {tools}",
       "credentials": "Zugangsdaten: {keys}",
+      "oauth": {
+        "connected": "Verbunden",
+        "notConnected": "Nicht verbunden",
+        "machineGrant": "Meldet sich als dieses Deployment an",
+        "connectedBy": "Verbunden von {user}",
+        "scopes": "Gewährt: {scopes}",
+        "notRefreshable": "Der Anbieter hat kein Refresh-Token ausgestellt, daher muss diese Verbindung neu hergestellt werden, sobald das Zugriffstoken abläuft.",
+        "lastError": "Die letzte Token-Erneuerung ist fehlgeschlagen: {detail}",
+        "connect": "Verbinden",
+        "reconnect": "Neu verbinden",
+        "disconnect": "Trennen",
+        "callback": {
+          "working": "Verbindung wird abgeschlossen …",
+          "done": "Mit {server} verbunden",
+          "doneHint": "Die Läufe dieses Boards können den Werkzeugserver jetzt mit dem Konto nutzen, mit dem Sie sich angemeldet haben.",
+          "back": "Zurück zur App",
+          "failedTitle": "Die Verbindung konnte nicht abgeschlossen werden",
+          "failed": "Die Autorisierung konnte nicht abgeschlossen werden. Starten Sie die Verbindung im Infrastruktur-Fenster erneut.",
+          "missingParams": "In diesem Link fehlen die vom Anbieter zurückgesendeten Werte, daher gibt es nichts abzuschließen. Starten Sie die Verbindung erneut."
+        }
+      },
       "test": "Testen",
       "notProbeable": {
         "stdio": "Läuft im Container des Agenten und kann von hier aus nicht getestet werden.",
@@ -634,6 +655,8 @@
         "ok": "Hat geantwortet",
         "credentialsMissing": "Keine Zugangsdaten",
         "credentialRefused": "Zugangsdaten abgelehnt",
+        "oauthNotConnected": "Nicht verbunden",
+        "oauthTokenFailed": "Verbindung funktioniert nicht mehr",
         "unreachable": "Keine Antwort",
         "httpError": "Anfrage abgewiesen",
         "protocolError": "Kein MCP-Server",
@@ -650,7 +673,9 @@
       "hideDetails": "Details verbergen",
       "toast": {
         "loadFailed": "Die Werkzeugserver konnten nicht geladen werden",
-        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden"
+        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden",
+        "connectFailed": "Die Verbindung konnte nicht gestartet werden",
+        "disconnectFailed": "Der Werkzeugserver konnte nicht getrennt werden"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/en.json

@@ -3125,6 +3125,27 @@
       "servableHarnessesNone": "No agent CLI can serve this transport, so this server never applies to any run.",
       "allowedTools": "Narrowed to: {tools}",
       "credentials": "Credentials: {keys}",
+      "oauth": {
+        "connected": "Connected",
+        "notConnected": "Not connected",
+        "machineGrant": "Signs in as this deployment",
+        "connectedBy": "Connected by {user}",
+        "scopes": "Granted: {scopes}",
+        "notRefreshable": "The vendor issued no refresh token, so this connection has to be made again once its access token expires.",
+        "lastError": "The last token renewal failed: {detail}",
+        "connect": "Connect",
+        "reconnect": "Reconnect",
+        "disconnect": "Disconnect",
+        "callback": {
+          "working": "Finishing the connection…",
+          "done": "Connected to {server}",
+          "doneHint": "This board's runs can now use the tool server as the account you signed in with.",
+          "back": "Back to the app",
+          "failedTitle": "The connection could not be finished",
+          "failed": "The authorization could not be completed. Start the connection again from the Infrastructure window.",
+          "missingParams": "This link is missing the values the vendor sends back, so there is nothing to complete. Start the connection again."
+        }
+      },
       "test": "Test",
       "notProbeable": {
         "stdio": "Runs inside the agent's container, so it cannot be tested from here.",
@@ -3135,6 +3156,8 @@
         "ok": "Answered",
         "credentialsMissing": "No credential",
         "credentialRefused": "Credential refused",
+        "oauthNotConnected": "Not connected",
+        "oauthTokenFailed": "Connection stopped working",
         "unreachable": "No answer",
         "httpError": "Rejected the request",
         "protocolError": "Not an MCP server",
@@ -3151,7 +3174,9 @@
       "hideDetails": "Hide details",
       "toast": {
         "loadFailed": "Could not load the tool servers",
-        "probeFailed": "Could not test the tool server"
+        "probeFailed": "Could not test the tool server",
+        "connectFailed": "Could not start the connection",
+        "disconnectFailed": "Could not disconnect the tool server"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/es.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Ninguna CLI de agente puede servir este transporte, así que este servidor nunca se aplica a una ejecución.",
       "allowedTools": "Limitado a: {tools}",
       "credentials": "Credenciales: {keys}",
+      "oauth": {
+        "connected": "Conectado",
+        "notConnected": "Sin conexión",
+        "machineGrant": "Se identifica como este despliegue",
+        "connectedBy": "Conectado por {user}",
+        "scopes": "Concedido: {scopes}",
+        "notRefreshable": "El proveedor no emitió un token de actualización, así que habrá que volver a conectar cuando caduque el token de acceso.",
+        "lastError": "La última renovación del token falló: {detail}",
+        "connect": "Conectar",
+        "reconnect": "Volver a conectar",
+        "disconnect": "Desconectar",
+        "callback": {
+          "working": "Finalizando la conexión…",
+          "done": "Conectado a {server}",
+          "doneHint": "Las ejecuciones de este tablero ya pueden usar el servidor de herramientas con la cuenta con la que iniciaste sesión.",
+          "back": "Volver a la aplicación",
+          "failedTitle": "No se pudo finalizar la conexión",
+          "failed": "No se pudo completar la autorización. Vuelve a iniciar la conexión desde la ventana de Infraestructura.",
+          "missingParams": "A este enlace le faltan los valores que devuelve el proveedor, así que no hay nada que completar. Vuelve a iniciar la conexión."
+        }
+      },
       "test": "Probar",
       "notProbeable": {
         "stdio": "Se ejecuta dentro del contenedor del agente, así que no puede probarse desde aquí.",
@@ -2884,6 +2905,8 @@
         "ok": "Respondió",
         "credentialsMissing": "Sin credencial",
         "credentialRefused": "Credencial rechazada",
+        "oauthNotConnected": "Sin conexión",
+        "oauthTokenFailed": "La conexión dejó de funcionar",
         "unreachable": "Sin respuesta",
         "httpError": "Rechazó la solicitud",
         "protocolError": "No es un servidor MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Ocultar detalles",
       "toast": {
         "loadFailed": "No se pudieron cargar los servidores de herramientas",
-        "probeFailed": "No se pudo probar el servidor de herramientas"
+        "probeFailed": "No se pudo probar el servidor de herramientas",
+        "connectFailed": "No se pudo iniciar la conexión",
+        "disconnectFailed": "No se pudo desconectar el servidor de herramientas"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/fr.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Aucune CLI d’agent ne peut servir ce transport, donc ce serveur ne s’applique à aucune exécution.",
       "allowedTools": "Restreint à : {tools}",
       "credentials": "Identifiants : {keys}",
+      "oauth": {
+        "connected": "Connecté",
+        "notConnected": "Non connecté",
+        "machineGrant": "S’authentifie en tant que ce déploiement",
+        "connectedBy": "Connecté par {user}",
+        "scopes": "Accordé : {scopes}",
+        "notRefreshable": "Le fournisseur n’a pas émis de jeton de rafraîchissement : il faudra reconnecter dès que le jeton d’accès expirera.",
+        "lastError": "Le dernier renouvellement du jeton a échoué : {detail}",
+        "connect": "Connecter",
+        "reconnect": "Reconnecter",
+        "disconnect": "Déconnecter",
+        "callback": {
+          "working": "Finalisation de la connexion…",
+          "done": "Connecté à {server}",
+          "doneHint": "Les exécutions de ce tableau peuvent désormais utiliser le serveur d’outils avec le compte auquel vous vous êtes connecté.",
+          "back": "Retour à l’application",
+          "failedTitle": "La connexion n’a pas pu être finalisée",
+          "failed": "L’autorisation n’a pas pu être menée à bien. Relancez la connexion depuis la fenêtre Infrastructure.",
+          "missingParams": "Il manque à ce lien les valeurs renvoyées par le fournisseur, il n’y a donc rien à finaliser. Relancez la connexion."
+        }
+      },
       "test": "Tester",
       "notProbeable": {
         "stdio": "Il s’exécute dans le conteneur de l’agent et ne peut donc pas être testé d’ici.",
@@ -2884,6 +2905,8 @@
         "ok": "A répondu",
         "credentialsMissing": "Aucun identifiant",
         "credentialRefused": "Identifiant refusé",
+        "oauthNotConnected": "Non connecté",
+        "oauthTokenFailed": "La connexion ne fonctionne plus",
         "unreachable": "Aucune réponse",
         "httpError": "Requête rejetée",
         "protocolError": "Pas un serveur MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Masquer les détails",
       "toast": {
         "loadFailed": "Impossible de charger les serveurs d’outils",
-        "probeFailed": "Impossible de tester le serveur d’outils"
+        "probeFailed": "Impossible de tester le serveur d’outils",
+        "connectFailed": "Impossible de démarrer la connexion",
+        "disconnectFailed": "Impossible de déconnecter le serveur d’outils"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/he.json

@@ -3015,6 +3015,27 @@
       "servableHarnessesNone": "אף CLI של סוכן אינו יכול לשרת תעבורה זו, ולכן שרת זה לא חל על שום הרצה.",
       "allowedTools": "מוגבל אל: {tools}",
       "credentials": "פרטי הזדהות: {keys}",
+      "oauth": {
+        "connected": "מחובר",
+        "notConnected": "לא מחובר",
+        "machineGrant": "מזדהה בשם פריסה זו",
+        "connectedBy": "חובר על ידי {user}",
+        "scopes": "ניתנו ההרשאות: {scopes}",
+        "notRefreshable": "הספק לא הנפיק אסימון רענון, ולכן יש לחבר מחדש כאשר אסימון הגישה יפוג.",
+        "lastError": "חידוש האסימון האחרון נכשל: {detail}",
+        "connect": "התחברות",
+        "reconnect": "התחברות מחדש",
+        "disconnect": "ניתוק",
+        "callback": {
+          "working": "מסיים את החיבור…",
+          "done": "מחובר אל {server}",
+          "doneHint": "ההרצות של לוח זה יכולות מעכשיו להשתמש בשרת הכלים בחשבון שאיתו נכנסת.",
+          "back": "חזרה לאפליקציה",
+          "failedTitle": "לא ניתן היה לסיים את החיבור",
+          "failed": "לא ניתן היה להשלים את ההרשאה. התחל את החיבור מחדש מחלון התשתית.",
+          "missingParams": "בקישור הזה חסרים הערכים שהספק מחזיר, ולכן אין מה להשלים. התחל את החיבור מחדש."
+        }
+      },
       "test": "בדיקה",
       "notProbeable": {
         "stdio": "רץ בתוך המכולה של הסוכן, ולכן לא ניתן לבדוק אותו מכאן.",
@@ -3025,6 +3046,8 @@
         "ok": "השיב",
         "credentialsMissing": "אין פרטי הזדהות",
         "credentialRefused": "פרטי ההזדהות נדחו",
+        "oauthNotConnected": "לא מחובר",
+        "oauthTokenFailed": "החיבור הפסיק לעבוד",
         "unreachable": "אין תשובה",
         "httpError": "דחה את הבקשה",
         "protocolError": "אינו שרת MCP",
@@ -3041,7 +3064,9 @@
       "hideDetails": "הסתרת פרטים",
       "toast": {
         "loadFailed": "לא ניתן לטעון את שרתי הכלים",
-        "probeFailed": "לא ניתן לבדוק את שרת הכלים"
+        "probeFailed": "לא ניתן לבדוק את שרת הכלים",
+        "connectFailed": "לא ניתן להתחיל את החיבור",
+        "disconnectFailed": "לא ניתן לנתק את שרת הכלים"
       }
     },
     "capabilityCredentials": {