@cat-factory/app 0.228.1 → 0.229.0

package/app/components/settings/McpOAuthCallbackScreen.vue

@@ -0,0 +1,103 @@
+<script setup lang="ts">
+import { onMounted, ref } from 'vue'
+
+// Where a vendor's authorization server sends the operator's browser back to after they approve a
+// remote MCP tool server (`/mcp-oauth-callback?code=…&state=…`).
+//
+// A page in the APP rather than a route on the backend, which is the security shape of this flow
+// rather than a routing preference: a redirect is a third-party navigation carrying no bearer
+// token, so a backend receiver could never tell WHO was completing the grant. This page re-presents
+// the two values over the authenticated API, where the session, the "same user who started it"
+// binding and the `secrets.manage` re-check all actually run.
+//
+// It is NOT a public route (unlike the password reset beside it): an expired session renders the
+// login screen on this same URL, and once the operator signs in the query string is still here and
+// the grant completes. That is the correct behaviour, not a gap.
+
+const api = useApi()
+const { t } = useI18n()
+
+const state = ref<'working' | 'done' | 'failed'>('working')
+const detail = ref<string | null>(null)
+const serverId = ref<string | null>(null)
+
+function query(name: string): string {
+  if (typeof window === 'undefined') return ''
+  return new URLSearchParams(window.location.search).get(name) ?? ''
+}
+
+onMounted(async () => {
+  // An authorization server that REFUSED reports it here rather than on the token endpoint, so the
+  // operator's own "Deny" and a misconfigured client both arrive as this. Named rather than folded
+  // into "no code": one is nothing to fix and the other is the client registration.
+  const denied = query('error')
+  if (denied) {
+    state.value = 'failed'
+    detail.value = query('error_description') || denied
+    return
+  }
+  const code = query('code')
+  const sealed = query('state')
+  if (!code || !sealed) {
+    state.value = 'failed'
+    detail.value = t('settings.toolServers.oauth.callback.missingParams')
+    return
+  }
+  try {
+    const result = await api.completeToolServerOAuth({ code, state: sealed })
+    serverId.value = result.serverId
+    state.value = 'done'
+  } catch (e) {
+    state.value = 'failed'
+    detail.value =
+      (e as { data?: { error?: { message?: string } } })?.data?.error?.message ??
+      t('settings.toolServers.oauth.callback.failed')
+  }
+})
+
+function backToApp() {
+  if (typeof window !== 'undefined') window.location.assign('/')
+}
+</script>
+
+<template>
+  <div
+    class="flex h-screen w-screen items-center justify-center bg-slate-950 text-slate-100"
+    data-testid="mcp-oauth-callback"
+  >
+    <div
+      class="w-full max-w-sm rounded-xl border border-slate-800 bg-slate-900/80 p-8 text-center backdrop-blur"
+    >
+      <template v-if="state === 'working'">
+        <UIcon name="i-lucide-loader" class="mx-auto mb-3 h-10 w-10 animate-spin text-indigo-400" />
+        <h1 class="mb-1 text-lg font-semibold text-white">
+          {{ t('settings.toolServers.oauth.callback.working') }}
+        </h1>
+      </template>
+
+      <template v-else-if="state === 'done'">
+        <UIcon name="i-lucide-check-circle" class="mx-auto mb-3 h-10 w-10 text-emerald-400" />
+        <h1 class="mb-1 text-lg font-semibold text-white" data-testid="mcp-oauth-callback-done">
+          {{ t('settings.toolServers.oauth.callback.done', { server: serverId }) }}
+        </h1>
+        <p class="mb-6 text-sm text-slate-400">
+          {{ t('settings.toolServers.oauth.callback.doneHint') }}
+        </p>
+        <UButton block color="primary" @click="backToApp">
+          {{ t('settings.toolServers.oauth.callback.back') }}
+        </UButton>
+      </template>
+
+      <template v-else>
+        <UIcon name="i-lucide-alert-triangle" class="mx-auto mb-3 h-10 w-10 text-red-400" />
+        <h1 class="mb-1 text-lg font-semibold text-white" data-testid="mcp-oauth-callback-failed">
+          {{ t('settings.toolServers.oauth.callback.failedTitle') }}
+        </h1>
+        <p class="mb-6 text-sm break-words text-slate-400">{{ detail }}</p>
+        <UButton block color="neutral" variant="subtle" @click="backToApp">
+          {{ t('settings.toolServers.oauth.callback.back') }}
+        </UButton>
+      </template>
+    </div>
+  </div>
+</template>

package/app/components/settings/ToolServerChecklist.vue

@@ -40,6 +40,8 @@ const STATUS_LABELS = computed<Record<ToolServerProbeStatus, string>>(() => ({
   ok: t('settings.toolServers.status.ok'),
   credentials_missing: t('settings.toolServers.status.credentialsMissing'),
   credential_refused: t('settings.toolServers.status.credentialRefused'),
+  oauth_not_connected: t('settings.toolServers.status.oauthNotConnected'),
+  oauth_token_failed: t('settings.toolServers.status.oauthTokenFailed'),
   unreachable: t('settings.toolServers.status.unreachable'),
   http_error: t('settings.toolServers.status.httpError'),
   protocol_error: t('settings.toolServers.status.protocolError'),
@@ -53,6 +55,36 @@ const NOT_PROBEABLE_LABELS = computed<Record<ToolServerNotProbeableReason, strin
 
 const servers = computed<ToolServerView[]>(() => store.view?.servers ?? [])
 
+/**
+ * Whether a row offers the Connect / Disconnect pair.
+ *
+ * Only the INTERACTIVE grant does. A `client_credentials` declaration authenticates as the
+ * deployment's own client and mints its token on the first dispatch that needs one, so there is
+ * nothing for a person to authorise and a button would promise an action that does not exist.
+ */
+function isInteractive(server: ToolServerView): boolean {
+  return server.oauth?.grant === 'authorization_code'
+}
+
+async function connect(id: string) {
+  try {
+    await store.connectOAuth(id)
+  } catch (e) {
+    // Everything that can refuse does so BEFORE the browser leaves the app: an unconfigured
+    // redirect URL, a deployment with no grant store, an authorization server that publishes no
+    // metadata. Each carries a `details.reason` the shared funnel maps to translated copy.
+    present(e, 'settings.toolServers.toast.connectFailed')
+  }
+}
+
+async function disconnect(id: string) {
+  try {
+    await store.disconnectOAuth(id)
+  } catch (e) {
+    present(e, 'settings.toolServers.toast.disconnectFailed')
+  }
+}
+
 function resultFor(id: string) {
   return store.results[id]
 }
@@ -138,6 +170,85 @@ async function runProbe(id: string) {
         }}
       </p>
 
+      <!-- OAuth. Absent for a server that authenticates with a static credential, so the Connect
+           affordance never appears on a row it does not apply to. `connected` and `lastError` are
+           rendered TOGETHER rather than as alternatives: a grant that is on file and no longer
+           producing tokens is exactly the state that reads as working and is not. -->
+      <div
+        v-if="server.oauth"
+        class="space-y-1 rounded-md border border-slate-800 bg-slate-900/40 p-2"
+        :data-testid="`tool-server-oauth-${server.id}`"
+      >
+        <div class="flex flex-wrap items-center gap-2">
+          <UBadge
+            :color="server.oauth.connected ? 'success' : 'neutral'"
+            variant="soft"
+            size="sm"
+            :data-testid="`tool-server-oauth-state-${server.id}`"
+          >
+            {{
+              server.oauth.connected
+                ? t('settings.toolServers.oauth.connected')
+                : isInteractive(server)
+                  ? t('settings.toolServers.oauth.notConnected')
+                  : t('settings.toolServers.oauth.machineGrant')
+            }}
+          </UBadge>
+          <span v-if="server.oauth.connectedBy" class="text-[11px] text-slate-400">
+            {{ t('settings.toolServers.oauth.connectedBy', { user: server.oauth.connectedBy }) }}
+          </span>
+        </div>
+
+        <p v-if="server.oauth.scopes?.length" class="text-[11px] text-slate-400">
+          {{ t('settings.toolServers.oauth.scopes', { scopes: server.oauth.scopes.join(', ') }) }}
+        </p>
+        <!-- A grant with no refresh token works until its access token expires and then needs
+             granting again by hand. Said BEFORE it happens, which is the only time it is useful. -->
+        <p
+          v-if="server.oauth.connected && server.oauth.refreshable === false"
+          class="text-[11px] text-amber-400"
+        >
+          {{ t('settings.toolServers.oauth.notRefreshable') }}
+        </p>
+        <p
+          v-if="server.oauth.lastError"
+          class="text-[11px] text-red-400"
+          :data-testid="`tool-server-oauth-error-${server.id}`"
+        >
+          {{ t('settings.toolServers.oauth.lastError', { detail: server.oauth.lastError }) }}
+        </p>
+
+        <div v-if="isInteractive(server)" class="flex flex-wrap items-center gap-2 pt-1">
+          <UButton
+            size="xs"
+            variant="subtle"
+            icon="i-lucide-link"
+            :loading="store.connecting === server.id"
+            :disabled="store.connecting !== null"
+            :data-testid="`tool-server-connect-${server.id}`"
+            @click="connect(server.id)"
+          >
+            {{
+              server.oauth.connected
+                ? t('settings.toolServers.oauth.reconnect')
+                : t('settings.toolServers.oauth.connect')
+            }}
+          </UButton>
+          <UButton
+            v-if="server.oauth.connected"
+            size="xs"
+            variant="ghost"
+            color="error"
+            :loading="store.connecting === server.id"
+            :disabled="store.connecting !== null"
+            :data-testid="`tool-server-disconnect-${server.id}`"
+            @click="disconnect(server.id)"
+          >
+            {{ t('settings.toolServers.oauth.disconnect') }}
+          </UButton>
+        </div>
+      </div>
+
       <div class="flex flex-wrap items-center gap-2 pt-1">
         <UButton
           v-if="server.probeable"

package/app/composables/api/toolServers.ts

@@ -1,4 +1,10 @@
-import { listToolServersContract, probeToolServerContract } from '@cat-factory/contracts'
+import {
+  completeToolServerOAuthContract,
+  disconnectToolServerOAuthContract,
+  listToolServersContract,
+  probeToolServerContract,
+  startToolServerOAuthContract,
+} from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /**
@@ -17,5 +23,21 @@ export function toolServersApi({ send, ws }: ApiContext) {
 
     probeToolServer: (workspaceId: string, id: string) =>
       send(probeToolServerContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    // Begin an interactive OAuth grant: answers with the VENDOR's authorization URL for the
+    // operator's browser to follow, rather than redirecting, since a redirect from a `fetch` lands
+    // in a cross-origin document this app cannot observe.
+    startToolServerOAuth: (workspaceId: string, id: string) =>
+      send(startToolServerOAuthContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    disconnectToolServerOAuth: (workspaceId: string, id: string) =>
+      send(disconnectToolServerOAuthContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
+
+    // Finish a grant with what the vendor's redirect carried. NOT workspace-prefixed: the board is
+    // sealed into the `state`, so the caller does not know it and could not be trusted with it
+    // anyway. This is the request that makes the flow's session, user binding and permission
+    // re-check enforceable, which a vendor's redirect landing on the backend never could.
+    completeToolServerOAuth: (body: { code: string; state: string }) =>
+      send(completeToolServerOAuthContract, { body }),
   }
 }

package/app/pages/mcp-oauth-callback.vue

@@ -0,0 +1,7 @@
+<script setup lang="ts">
+import McpOAuthCallbackScreen from '~/components/settings/McpOAuthCallbackScreen.vue'
+</script>
+
+<template>
+  <McpOAuthCallbackScreen />
+</template>

package/app/stores/toolServers.ts

@@ -25,6 +25,9 @@ export const useToolServersStore = defineStore('toolServers', () => {
   // operator just asked for.
   const results = ref<Record<string, ToolServerProbeResult>>({})
   const probing = ref<string | null>(null)
+  // The server whose OAuth grant is being connected or disconnected, so one row's button spins and
+  // the rest stay clickable — the same shape `probing` has, and for the same reason.
+  const connecting = ref<string | null>(null)
   const loading = ref(false)
   // The backend's two definitive refusals: no `secrets.manage` (403), and — unlike the credential
   // store — never a 503, since the inventory needs no encryption key to project a registry. `null`
@@ -108,5 +111,58 @@ export const useToolServersStore = defineStore('toolServers', () => {
     }
   }
 
-  return { view, results, probing, loading, available, hasSurface, load, ensureLoaded, probe }
+  /**
+   * Start an OAuth grant and hand the browser to the vendor.
+   *
+   * A full-page navigation rather than a popup: the operator has to sign in at a third party, and a
+   * popup is what a browser blocks and a password manager cannot fill. Nothing is stored here — the
+   * vendor redirects back to `/mcp-oauth-callback`, which finishes the grant over the authenticated
+   * API and returns here, so the connection state comes from the row rather than from anything this
+   * store guessed across a navigation that leaves the app entirely.
+   */
+  async function connectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      const { url } = await api.startToolServerOAuth(ws.requireId(), id)
+      window.location.href = url
+    } finally {
+      connecting.value = null
+    }
+  }
+
+  /**
+   * Drop the workspace's grant, then re-read so the row's state comes from the backend rather than
+   * from an optimistic edit: a disconnect is the one action whose whole point is that the server
+   * stops being usable, and a row that looked connected for another second would be the misreport
+   * this panel exists to prevent.
+   */
+  async function disconnectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      await api.disconnectToolServerOAuth(ws.requireId(), id)
+      // The stored probe result described a server this board could still reach. It cannot now.
+      const { [id]: _dropped, ...rest } = results.value
+      results.value = rest
+    } finally {
+      connecting.value = null
+    }
+    await load()
+  }
+
+  return {
+    view,
+    results,
+    probing,
+    connecting,
+    loading,
+    available,
+    hasSurface,
+    load,
+    ensureLoaded,
+    probe,
+    connectOAuth,
+    disconnectOAuth,
+  }
 })

package/app/types/toolServers.ts

@@ -9,6 +9,8 @@ export type {
   ToolServerAllowedToolsCheck,
   ToolServerCredential,
   ToolServerNotProbeableReason,
+  ToolServerOAuthGrant,
+  ToolServerOAuthStatus,
   ToolServerProbeResult,
   ToolServerProbeStatus,
   ToolServerTransport,

package/i18n/locales/de.json

@@ -624,6 +624,27 @@
       "servableHarnessesNone": "Keine Agenten-CLI kann diesen Transport bedienen, daher greift dieser Server in keinem Lauf.",
       "allowedTools": "Eingeschränkt auf: {tools}",
       "credentials": "Zugangsdaten: {keys}",
+      "oauth": {
+        "connected": "Verbunden",
+        "notConnected": "Nicht verbunden",
+        "machineGrant": "Meldet sich als dieses Deployment an",
+        "connectedBy": "Verbunden von {user}",
+        "scopes": "Gewährt: {scopes}",
+        "notRefreshable": "Der Anbieter hat kein Refresh-Token ausgestellt, daher muss diese Verbindung neu hergestellt werden, sobald das Zugriffstoken abläuft.",
+        "lastError": "Die letzte Token-Erneuerung ist fehlgeschlagen: {detail}",
+        "connect": "Verbinden",
+        "reconnect": "Neu verbinden",
+        "disconnect": "Trennen",
+        "callback": {
+          "working": "Verbindung wird abgeschlossen …",
+          "done": "Mit {server} verbunden",
+          "doneHint": "Die Läufe dieses Boards können den Werkzeugserver jetzt mit dem Konto nutzen, mit dem Sie sich angemeldet haben.",
+          "back": "Zurück zur App",
+          "failedTitle": "Die Verbindung konnte nicht abgeschlossen werden",
+          "failed": "Die Autorisierung konnte nicht abgeschlossen werden. Starten Sie die Verbindung im Infrastruktur-Fenster erneut.",
+          "missingParams": "In diesem Link fehlen die vom Anbieter zurückgesendeten Werte, daher gibt es nichts abzuschließen. Starten Sie die Verbindung erneut."
+        }
+      },
       "test": "Testen",
       "notProbeable": {
         "stdio": "Läuft im Container des Agenten und kann von hier aus nicht getestet werden.",
@@ -634,6 +655,8 @@
         "ok": "Hat geantwortet",
         "credentialsMissing": "Keine Zugangsdaten",
         "credentialRefused": "Zugangsdaten abgelehnt",
+        "oauthNotConnected": "Nicht verbunden",
+        "oauthTokenFailed": "Verbindung funktioniert nicht mehr",
         "unreachable": "Keine Antwort",
         "httpError": "Anfrage abgewiesen",
         "protocolError": "Kein MCP-Server",
@@ -650,7 +673,9 @@
       "hideDetails": "Details verbergen",
       "toast": {
         "loadFailed": "Die Werkzeugserver konnten nicht geladen werden",
-        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden"
+        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden",
+        "connectFailed": "Die Verbindung konnte nicht gestartet werden",
+        "disconnectFailed": "Der Werkzeugserver konnte nicht getrennt werden"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/en.json

@@ -3125,6 +3125,27 @@
       "servableHarnessesNone": "No agent CLI can serve this transport, so this server never applies to any run.",
       "allowedTools": "Narrowed to: {tools}",
       "credentials": "Credentials: {keys}",
+      "oauth": {
+        "connected": "Connected",
+        "notConnected": "Not connected",
+        "machineGrant": "Signs in as this deployment",
+        "connectedBy": "Connected by {user}",
+        "scopes": "Granted: {scopes}",
+        "notRefreshable": "The vendor issued no refresh token, so this connection has to be made again once its access token expires.",
+        "lastError": "The last token renewal failed: {detail}",
+        "connect": "Connect",
+        "reconnect": "Reconnect",
+        "disconnect": "Disconnect",
+        "callback": {
+          "working": "Finishing the connection…",
+          "done": "Connected to {server}",
+          "doneHint": "This board's runs can now use the tool server as the account you signed in with.",
+          "back": "Back to the app",
+          "failedTitle": "The connection could not be finished",
+          "failed": "The authorization could not be completed. Start the connection again from the Infrastructure window.",
+          "missingParams": "This link is missing the values the vendor sends back, so there is nothing to complete. Start the connection again."
+        }
+      },
       "test": "Test",
       "notProbeable": {
         "stdio": "Runs inside the agent's container, so it cannot be tested from here.",
@@ -3135,6 +3156,8 @@
         "ok": "Answered",
         "credentialsMissing": "No credential",
         "credentialRefused": "Credential refused",
+        "oauthNotConnected": "Not connected",
+        "oauthTokenFailed": "Connection stopped working",
         "unreachable": "No answer",
         "httpError": "Rejected the request",
         "protocolError": "Not an MCP server",
@@ -3151,7 +3174,9 @@
       "hideDetails": "Hide details",
       "toast": {
         "loadFailed": "Could not load the tool servers",
-        "probeFailed": "Could not test the tool server"
+        "probeFailed": "Could not test the tool server",
+        "connectFailed": "Could not start the connection",
+        "disconnectFailed": "Could not disconnect the tool server"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/es.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Ninguna CLI de agente puede servir este transporte, así que este servidor nunca se aplica a una ejecución.",
       "allowedTools": "Limitado a: {tools}",
       "credentials": "Credenciales: {keys}",
+      "oauth": {
+        "connected": "Conectado",
+        "notConnected": "Sin conexión",
+        "machineGrant": "Se identifica como este despliegue",
+        "connectedBy": "Conectado por {user}",
+        "scopes": "Concedido: {scopes}",
+        "notRefreshable": "El proveedor no emitió un token de actualización, así que habrá que volver a conectar cuando caduque el token de acceso.",
+        "lastError": "La última renovación del token falló: {detail}",
+        "connect": "Conectar",
+        "reconnect": "Volver a conectar",
+        "disconnect": "Desconectar",
+        "callback": {
+          "working": "Finalizando la conexión…",
+          "done": "Conectado a {server}",
+          "doneHint": "Las ejecuciones de este tablero ya pueden usar el servidor de herramientas con la cuenta con la que iniciaste sesión.",
+          "back": "Volver a la aplicación",
+          "failedTitle": "No se pudo finalizar la conexión",
+          "failed": "No se pudo completar la autorización. Vuelve a iniciar la conexión desde la ventana de Infraestructura.",
+          "missingParams": "A este enlace le faltan los valores que devuelve el proveedor, así que no hay nada que completar. Vuelve a iniciar la conexión."
+        }
+      },
       "test": "Probar",
       "notProbeable": {
         "stdio": "Se ejecuta dentro del contenedor del agente, así que no puede probarse desde aquí.",
@@ -2884,6 +2905,8 @@
         "ok": "Respondió",
         "credentialsMissing": "Sin credencial",
         "credentialRefused": "Credencial rechazada",
+        "oauthNotConnected": "Sin conexión",
+        "oauthTokenFailed": "La conexión dejó de funcionar",
         "unreachable": "Sin respuesta",
         "httpError": "Rechazó la solicitud",
         "protocolError": "No es un servidor MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Ocultar detalles",
       "toast": {
         "loadFailed": "No se pudieron cargar los servidores de herramientas",
-        "probeFailed": "No se pudo probar el servidor de herramientas"
+        "probeFailed": "No se pudo probar el servidor de herramientas",
+        "connectFailed": "No se pudo iniciar la conexión",
+        "disconnectFailed": "No se pudo desconectar el servidor de herramientas"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/fr.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Aucune CLI d’agent ne peut servir ce transport, donc ce serveur ne s’applique à aucune exécution.",
       "allowedTools": "Restreint à : {tools}",
       "credentials": "Identifiants : {keys}",
+      "oauth": {
+        "connected": "Connecté",
+        "notConnected": "Non connecté",
+        "machineGrant": "S’authentifie en tant que ce déploiement",
+        "connectedBy": "Connecté par {user}",
+        "scopes": "Accordé : {scopes}",
+        "notRefreshable": "Le fournisseur n’a pas émis de jeton de rafraîchissement : il faudra reconnecter dès que le jeton d’accès expirera.",
+        "lastError": "Le dernier renouvellement du jeton a échoué : {detail}",
+        "connect": "Connecter",
+        "reconnect": "Reconnecter",
+        "disconnect": "Déconnecter",
+        "callback": {
+          "working": "Finalisation de la connexion…",
+          "done": "Connecté à {server}",
+          "doneHint": "Les exécutions de ce tableau peuvent désormais utiliser le serveur d’outils avec le compte auquel vous vous êtes connecté.",
+          "back": "Retour à l’application",
+          "failedTitle": "La connexion n’a pas pu être finalisée",
+          "failed": "L’autorisation n’a pas pu être menée à bien. Relancez la connexion depuis la fenêtre Infrastructure.",
+          "missingParams": "Il manque à ce lien les valeurs renvoyées par le fournisseur, il n’y a donc rien à finaliser. Relancez la connexion."
+        }
+      },
       "test": "Tester",
       "notProbeable": {
         "stdio": "Il s’exécute dans le conteneur de l’agent et ne peut donc pas être testé d’ici.",
@@ -2884,6 +2905,8 @@
         "ok": "A répondu",
         "credentialsMissing": "Aucun identifiant",
         "credentialRefused": "Identifiant refusé",
+        "oauthNotConnected": "Non connecté",
+        "oauthTokenFailed": "La connexion ne fonctionne plus",
         "unreachable": "Aucune réponse",
         "httpError": "Requête rejetée",
         "protocolError": "Pas un serveur MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Masquer les détails",
       "toast": {
         "loadFailed": "Impossible de charger les serveurs d’outils",
-        "probeFailed": "Impossible de tester le serveur d’outils"
+        "probeFailed": "Impossible de tester le serveur d’outils",
+        "connectFailed": "Impossible de démarrer la connexion",
+        "disconnectFailed": "Impossible de déconnecter le serveur d’outils"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/he.json

@@ -3015,6 +3015,27 @@
       "servableHarnessesNone": "אף CLI של סוכן אינו יכול לשרת תעבורה זו, ולכן שרת זה לא חל על שום הרצה.",
       "allowedTools": "מוגבל אל: {tools}",
       "credentials": "פרטי הזדהות: {keys}",
+      "oauth": {
+        "connected": "מחובר",
+        "notConnected": "לא מחובר",
+        "machineGrant": "מזדהה בשם פריסה זו",
+        "connectedBy": "חובר על ידי {user}",
+        "scopes": "ניתנו ההרשאות: {scopes}",
+        "notRefreshable": "הספק לא הנפיק אסימון רענון, ולכן יש לחבר מחדש כאשר אסימון הגישה יפוג.",
+        "lastError": "חידוש האסימון האחרון נכשל: {detail}",
+        "connect": "התחברות",
+        "reconnect": "התחברות מחדש",
+        "disconnect": "ניתוק",
+        "callback": {
+          "working": "מסיים את החיבור…",
+          "done": "מחובר אל {server}",
+          "doneHint": "ההרצות של לוח זה יכולות מעכשיו להשתמש בשרת הכלים בחשבון שאיתו נכנסת.",
+          "back": "חזרה לאפליקציה",
+          "failedTitle": "לא ניתן היה לסיים את החיבור",
+          "failed": "לא ניתן היה להשלים את ההרשאה. התחל את החיבור מחדש מחלון התשתית.",
+          "missingParams": "בקישור הזה חסרים הערכים שהספק מחזיר, ולכן אין מה להשלים. התחל את החיבור מחדש."
+        }
+      },
       "test": "בדיקה",
       "notProbeable": {
         "stdio": "רץ בתוך המכולה של הסוכן, ולכן לא ניתן לבדוק אותו מכאן.",
@@ -3025,6 +3046,8 @@
         "ok": "השיב",
         "credentialsMissing": "אין פרטי הזדהות",
         "credentialRefused": "פרטי ההזדהות נדחו",
+        "oauthNotConnected": "לא מחובר",
+        "oauthTokenFailed": "החיבור הפסיק לעבוד",
         "unreachable": "אין תשובה",
         "httpError": "דחה את הבקשה",
         "protocolError": "אינו שרת MCP",
@@ -3041,7 +3064,9 @@
       "hideDetails": "הסתרת פרטים",
       "toast": {
         "loadFailed": "לא ניתן לטעון את שרתי הכלים",
-        "probeFailed": "לא ניתן לבדוק את שרת הכלים"
+        "probeFailed": "לא ניתן לבדוק את שרת הכלים",
+        "connectFailed": "לא ניתן להתחיל את החיבור",
+        "disconnectFailed": "לא ניתן לנתק את שרת הכלים"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/it.json

@@ -624,6 +624,27 @@
       "servableHarnessesNone": "Nessuna CLI di agente può servire questo trasporto, quindi questo server non si applica a nessuna esecuzione.",
       "allowedTools": "Limitato a: {tools}",
       "credentials": "Credenziali: {keys}",
+      "oauth": {
+        "connected": "Collegato",
+        "notConnected": "Non collegato",
+        "machineGrant": "Si autentica come questo deployment",
+        "connectedBy": "Collegato da {user}",
+        "scopes": "Concesso: {scopes}",
+        "notRefreshable": "Il fornitore non ha emesso un token di aggiornamento, quindi il collegamento andrà rifatto alla scadenza del token di accesso.",
+        "lastError": "L’ultimo rinnovo del token non è riuscito: {detail}",
+        "connect": "Collega",
+        "reconnect": "Ricollega",
+        "disconnect": "Scollega",
+        "callback": {
+          "working": "Completamento della connessione…",
+          "done": "Collegato a {server}",
+          "doneHint": "Le esecuzioni di questa lavagna possono ora usare il server di strumenti con l’account con cui hai effettuato l’accesso.",
+          "back": "Torna all’app",
+          "failedTitle": "Non è stato possibile completare la connessione",
+          "failed": "Non è stato possibile completare l’autorizzazione. Riavvia la connessione dalla finestra Infrastruttura.",
+          "missingParams": "A questo link mancano i valori restituiti dal fornitore, quindi non c’è nulla da completare. Riavvia la connessione."
+        }
+      },
       "test": "Prova",
       "notProbeable": {
         "stdio": "Gira dentro il container dell’agente, quindi non può essere provato da qui.",
@@ -634,6 +655,8 @@
         "ok": "Ha risposto",
         "credentialsMissing": "Nessuna credenziale",
         "credentialRefused": "Credenziale rifiutata",
+        "oauthNotConnected": "Non collegato",
+        "oauthTokenFailed": "Il collegamento ha smesso di funzionare",
         "unreachable": "Nessuna risposta",
         "httpError": "Richiesta respinta",
         "protocolError": "Non è un server MCP",
@@ -650,7 +673,9 @@
       "hideDetails": "Nascondi dettagli",
       "toast": {
         "loadFailed": "Impossibile caricare i server di strumenti",
-        "probeFailed": "Impossibile provare il server di strumenti"
+        "probeFailed": "Impossibile provare il server di strumenti",
+        "connectFailed": "Impossibile avviare il collegamento",
+        "disconnectFailed": "Impossibile scollegare il server di strumenti"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/ja.json

@@ -3015,6 +3015,27 @@
       "servableHarnessesNone": "このトランスポートを扱えるエージェント CLI がないため、このサーバーはどの実行にも適用されません。",
       "allowedTools": "許可されたツール: {tools}",
       "credentials": "認証情報: {keys}",
+      "oauth": {
+        "connected": "接続済み",
+        "notConnected": "未接続",
+        "machineGrant": "このデプロイとしてサインインします",
+        "connectedBy": "{user} が接続しました",
+        "scopes": "許可されたスコープ: {scopes}",
+        "notRefreshable": "プロバイダーがリフレッシュトークンを発行しなかったため、アクセストークンの期限が切れたら接続をやり直す必要があります。",
+        "lastError": "直近のトークン更新に失敗しました: {detail}",
+        "connect": "接続",
+        "reconnect": "再接続",
+        "disconnect": "接続を解除",
+        "callback": {
+          "working": "接続を完了しています…",
+          "done": "{server} に接続しました",
+          "doneHint": "このボードの実行では、サインインしたアカウントとしてツールサーバーを利用できるようになりました。",
+          "back": "アプリに戻る",
+          "failedTitle": "接続を完了できませんでした",
+          "failed": "認可を完了できませんでした。インフラストラクチャ ウィンドウから接続をやり直してください。",
+          "missingParams": "このリンクにはプロバイダーが返す値が含まれていないため、完了できる処理がありません。接続をやり直してください。"
+        }
+      },
       "test": "テスト",
       "notProbeable": {
         "stdio": "エージェントのコンテナ内で動作するため、ここからはテストできません。",
@@ -3025,6 +3046,8 @@
         "ok": "応答あり",
         "credentialsMissing": "認証情報なし",
         "credentialRefused": "認証情報を拒否",
+        "oauthNotConnected": "未接続",
+        "oauthTokenFailed": "接続が機能しなくなりました",
         "unreachable": "応答なし",
         "httpError": "リクエストを拒否",
         "protocolError": "MCP サーバーではない",
@@ -3041,7 +3064,9 @@
       "hideDetails": "詳細を隠す",
       "toast": {
         "loadFailed": "ツールサーバーを読み込めませんでした",
-        "probeFailed": "ツールサーバーをテストできませんでした"
+        "probeFailed": "ツールサーバーをテストできませんでした",
+        "connectFailed": "接続を開始できませんでした",
+        "disconnectFailed": "ツールサーバーの接続を解除できませんでした"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/pl.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Żadne CLI agenta nie obsługuje tego transportu, więc ten serwer nie dotyczy żadnego przebiegu.",
       "allowedTools": "Zawężone do: {tools}",
       "credentials": "Dane uwierzytelniające: {keys}",
+      "oauth": {
+        "connected": "Połączono",
+        "notConnected": "Niepołączony",
+        "machineGrant": "Loguje się jako to wdrożenie",
+        "connectedBy": "Połączone przez {user}",
+        "scopes": "Przyznano: {scopes}",
+        "notRefreshable": "Dostawca nie wydał tokenu odświeżania, więc połączenie trzeba będzie nawiązać ponownie, gdy token dostępu wygaśnie.",
+        "lastError": "Ostatnie odnowienie tokenu nie powiodło się: {detail}",
+        "connect": "Połącz",
+        "reconnect": "Połącz ponownie",
+        "disconnect": "Rozłącz",
+        "callback": {
+          "working": "Kończenie połączenia…",
+          "done": "Połączono z {server}",
+          "doneHint": "Uruchomienia tej tablicy mogą teraz korzystać z serwera narzędzi na koncie, na które się zalogowano.",
+          "back": "Powrót do aplikacji",
+          "failedTitle": "Nie udało się zakończyć połączenia",
+          "failed": "Nie udało się dokończyć autoryzacji. Rozpocznij połączenie ponownie w oknie Infrastruktura.",
+          "missingParams": "W tym odnośniku brakuje wartości zwracanych przez dostawcę, więc nie ma czego kończyć. Rozpocznij połączenie ponownie."
+        }
+      },
       "test": "Testuj",
       "notProbeable": {
         "stdio": "Działa w kontenerze agenta, więc nie można go przetestować z tego miejsca.",
@@ -2884,6 +2905,8 @@
         "ok": "Odpowiedział",
         "credentialsMissing": "Brak danych uwierzytelniających",
         "credentialRefused": "Dane uwierzytelniające odrzucone",
+        "oauthNotConnected": "Niepołączony",
+        "oauthTokenFailed": "Połączenie przestało działać",
         "unreachable": "Brak odpowiedzi",
         "httpError": "Odrzucił żądanie",
         "protocolError": "To nie serwer MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Ukryj szczegóły",
       "toast": {
         "loadFailed": "Nie udało się wczytać serwerów narzędzi",
-        "probeFailed": "Nie udało się przetestować serwera narzędzi"
+        "probeFailed": "Nie udało się przetestować serwera narzędzi",
+        "connectFailed": "Nie udało się rozpocząć łączenia",
+        "disconnectFailed": "Nie udało się rozłączyć serwera narzędzi"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/tr.json

@@ -3015,6 +3015,27 @@
       "servableHarnessesNone": "Hiçbir ajan CLI’si bu taşımayı sunamaz, dolayısıyla bu sunucu hiçbir çalıştırmada geçerli olmaz.",
       "allowedTools": "Şunlarla sınırlı: {tools}",
       "credentials": "Kimlik bilgileri: {keys}",
+      "oauth": {
+        "connected": "Bağlandı",
+        "notConnected": "Bağlı değil",
+        "machineGrant": "Bu dağıtım olarak oturum açar",
+        "connectedBy": "{user} bağladı",
+        "scopes": "Verilen izinler: {scopes}",
+        "notRefreshable": "Sağlayıcı yenileme belirteci vermedi, bu yüzden erişim belirteci sona erdiğinde bağlantının yeniden kurulması gerekir.",
+        "lastError": "Son belirteç yenileme başarısız oldu: {detail}",
+        "connect": "Bağlan",
+        "reconnect": "Yeniden bağlan",
+        "disconnect": "Bağlantıyı kes",
+        "callback": {
+          "working": "Bağlantı tamamlanıyor…",
+          "done": "{server} bağlandı",
+          "doneHint": "Bu panonun çalıştırmaları artık araç sunucusunu oturum açtığınız hesapla kullanabilir.",
+          "back": "Uygulamaya dön",
+          "failedTitle": "Bağlantı tamamlanamadı",
+          "failed": "Yetkilendirme tamamlanamadı. Bağlantıyı Altyapı penceresinden yeniden başlatın.",
+          "missingParams": "Bu bağlantıda sağlayıcının geri gönderdiği değerler eksik, bu yüzden tamamlanacak bir şey yok. Bağlantıyı yeniden başlatın."
+        }
+      },
       "test": "Test et",
       "notProbeable": {
         "stdio": "Ajanın konteynerinin içinde çalışır, bu yüzden buradan test edilemez.",
@@ -3025,6 +3046,8 @@
         "ok": "Yanıt verdi",
         "credentialsMissing": "Kimlik bilgisi yok",
         "credentialRefused": "Kimlik bilgisi reddedildi",
+        "oauthNotConnected": "Bağlı değil",
+        "oauthTokenFailed": "Bağlantı çalışmayı bıraktı",
         "unreachable": "Yanıt yok",
         "httpError": "İsteği reddetti",
         "protocolError": "MCP sunucusu değil",
@@ -3041,7 +3064,9 @@
       "hideDetails": "Ayrıntıları gizle",
       "toast": {
         "loadFailed": "Araç sunucuları yüklenemedi",
-        "probeFailed": "Araç sunucusu test edilemedi"
+        "probeFailed": "Araç sunucusu test edilemedi",
+        "connectFailed": "Bağlantı başlatılamadı",
+        "disconnectFailed": "Araç sunucusunun bağlantısı kesilemedi"
       }
     },
     "capabilityCredentials": {

package/i18n/locales/uk.json

@@ -2874,6 +2874,27 @@
       "servableHarnessesNone": "Жоден CLI агента не може обслуговувати цей транспорт, тож цей сервер не застосовується ні до якого запуску.",
       "allowedTools": "Звужено до: {tools}",
       "credentials": "Облікові дані: {keys}",
+      "oauth": {
+        "connected": "З’єднано",
+        "notConnected": "Не під’єднано",
+        "machineGrant": "Входить як це розгортання",
+        "connectedBy": "З’єднав {user}",
+        "scopes": "Надано: {scopes}",
+        "notRefreshable": "Постачальник не видав токена оновлення, тож з’єднання доведеться створити знову, щойно мине термін дії токена доступу.",
+        "lastError": "Останнє оновлення токена не вдалося: {detail}",
+        "connect": "З’єднати",
+        "reconnect": "З’єднати знову",
+        "disconnect": "Від’єднати",
+        "callback": {
+          "working": "Завершення з’єднання…",
+          "done": "З’єднано з {server}",
+          "doneHint": "Запуски цієї дошки тепер можуть використовувати сервер інструментів під обліковим записом, у який ви увійшли.",
+          "back": "Повернутися до застосунку",
+          "failedTitle": "Не вдалося завершити з’єднання",
+          "failed": "Не вдалося завершити авторизацію. Розпочніть з’єднання знову у вікні інфраструктури.",
+          "missingParams": "У цьому посиланні бракує значень, які повертає постачальник, тож завершувати нічого. Розпочніть з’єднання знову."
+        }
+      },
       "test": "Перевірити",
       "notProbeable": {
         "stdio": "Працює всередині контейнера агента, тож звідси його перевірити неможливо.",
@@ -2884,6 +2905,8 @@
         "ok": "Відповів",
         "credentialsMissing": "Немає облікових даних",
         "credentialRefused": "Облікові дані відхилено",
+        "oauthNotConnected": "Не під’єднано",
+        "oauthTokenFailed": "З’єднання перестало працювати",
         "unreachable": "Немає відповіді",
         "httpError": "Відхилив запит",
         "protocolError": "Це не сервер MCP",
@@ -2900,7 +2923,9 @@
       "hideDetails": "Сховати деталі",
       "toast": {
         "loadFailed": "Не вдалося завантажити сервери інструментів",
-        "probeFailed": "Не вдалося перевірити сервер інструментів"
+        "probeFailed": "Не вдалося перевірити сервер інструментів",
+        "connectFailed": "Не вдалося розпочати з’єднання",
+        "disconnectFailed": "Не вдалося від’єднати сервер інструментів"
       }
     },
     "capabilityCredentials": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.228.1",
+  "version": "0.229.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.245.0"
+    "@cat-factory/contracts": "0.246.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",