@cat-factory/app 0.228.1 → 0.230.0

package/app/stores/auth.ts

@@ -2,6 +2,7 @@ import type {
   BackendMisconfigured,
   InfrastructureCapabilities,
   LocalModeConfig,
+  SsoConfigView,
 } from '@cat-factory/contracts'
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
@@ -9,6 +10,7 @@ import type { AuthUser } from '~/types/domain'
 import { retryWhileBackendUnreachable } from '~/utils/backendReady'
 import { createAuthSessionActions } from '~/stores/auth/session'
 import { createAuthRedirectActions } from '~/stores/auth/mothership'
+import type { SsoLoginFailure } from '~/utils/sso'
 
 /**
  * "Login with GitHub" session state. The backend mints a signed session token
@@ -31,7 +33,20 @@ export const useAuthStore = defineStore(
     /** Whether the backend requires authentication. */
     const required = ref(false)
     /** Which login providers the backend offers (drives the login UI). */
-    const providers = ref({ github: false, password: false, google: false })
+    const providers = ref({ github: false, password: false, google: false, sso: false })
+    /**
+     * Presentation for the deployment's OWN identity provider (enterprise SSO) — its
+     * operator-supplied label and protocol. Null unless `providers.sso` is set. The label names
+     * the operator's IdP, so it is the one piece of login copy the SPA renders verbatim rather
+     * than through the catalog.
+     */
+    const sso = ref<SsoConfigView | null>(null)
+    /**
+     * Why the last enterprise-SSO sign-in produced no session, when one was refused. Captured
+     * from the `#sso_error=` fragment on boot so the login screen can name the rule that refused
+     * instead of returning the user to an unchanged sign-in button.
+     */
+    const ssoError = ref<SsoLoginFailure | null>(null)
     /**
      * Source-control providers a HOSTED facade (remote node) accepts a user-supplied PAT for.
      * Drives the login screen's "sign in with a PAT" option on non-local deployments. Empty on
@@ -134,14 +149,29 @@ export const useAuthStore = defineStore(
       user,
       autoLoginProvider,
     })
-    const { consumeRedirectToken, maybeConnectMothership, signInViaMothership, maybeAcceptInvite } =
-      createAuthRedirectActions({ api, token, localMode, mothershipError, applySession })
+    const {
+      consumeRedirectToken,
+      consumeSsoError,
+      maybeConnectMothership,
+      signInViaMothership,
+      maybeAcceptInvite,
+    } = createAuthRedirectActions({
+      api,
+      token,
+      localMode,
+      mothershipError,
+      ssoError,
+      applySession,
+    })
 
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
       // A returning mothership-connect redirect is handled first (it carries a mothership session,
       // which must be exchanged — not stored as a local token by `consumeRedirectToken`).
       if (!(await maybeConnectMothership())) consumeRedirectToken()
+      // A refused SSO round-trip returns a reason instead of a token, and it must be read BEFORE
+      // the config call: the login screen renders from the same settled state either way.
+      consumeSsoError()
       try {
         // Tolerate a cold-start race: when the SPA and backend boot together, this first call
         // can beat the backend's listener by a second or two. Retry a not-listening-yet socket
@@ -149,6 +179,7 @@ export const useAuthStore = defineStore(
         const config = await retryWhileBackendUnreachable(() => api.getAuthConfig())
         required.value = config.enabled
         if (config.providers) providers.value = config.providers
+        sso.value = config.sso ?? null
         patProviders.value = config.patLogin?.providers ?? []
         testingNoAuth.value = config.testingNoAuth ?? false
         localMode.value = config.localMode ?? null
@@ -211,6 +242,8 @@ export const useAuthStore = defineStore(
       user,
       required,
       providers,
+      sso,
+      ssoError,
       patProviders,
       testingNoAuth,
       localMode,

package/app/stores/toolServers.ts

@@ -25,6 +25,9 @@ export const useToolServersStore = defineStore('toolServers', () => {
   // operator just asked for.
   const results = ref<Record<string, ToolServerProbeResult>>({})
   const probing = ref<string | null>(null)
+  // The server whose OAuth grant is being connected or disconnected, so one row's button spins and
+  // the rest stay clickable — the same shape `probing` has, and for the same reason.
+  const connecting = ref<string | null>(null)
   const loading = ref(false)
   // The backend's two definitive refusals: no `secrets.manage` (403), and — unlike the credential
   // store — never a 503, since the inventory needs no encryption key to project a registry. `null`
@@ -108,5 +111,58 @@ export const useToolServersStore = defineStore('toolServers', () => {
     }
   }
 
-  return { view, results, probing, loading, available, hasSurface, load, ensureLoaded, probe }
+  /**
+   * Start an OAuth grant and hand the browser to the vendor.
+   *
+   * A full-page navigation rather than a popup: the operator has to sign in at a third party, and a
+   * popup is what a browser blocks and a password manager cannot fill. Nothing is stored here — the
+   * vendor redirects back to `/mcp-oauth-callback`, which finishes the grant over the authenticated
+   * API and returns here, so the connection state comes from the row rather than from anything this
+   * store guessed across a navigation that leaves the app entirely.
+   */
+  async function connectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      const { url } = await api.startToolServerOAuth(ws.requireId(), id)
+      window.location.href = url
+    } finally {
+      connecting.value = null
+    }
+  }
+
+  /**
+   * Drop the workspace's grant, then re-read so the row's state comes from the backend rather than
+   * from an optimistic edit: a disconnect is the one action whose whole point is that the server
+   * stops being usable, and a row that looked connected for another second would be the misreport
+   * this panel exists to prevent.
+   */
+  async function disconnectOAuth(id: string) {
+    const ws = useWorkspaceStore()
+    connecting.value = id
+    try {
+      await api.disconnectToolServerOAuth(ws.requireId(), id)
+      // The stored probe result described a server this board could still reach. It cannot now.
+      const { [id]: _dropped, ...rest } = results.value
+      results.value = rest
+    } finally {
+      connecting.value = null
+    }
+    await load()
+  }
+
+  return {
+    view,
+    results,
+    probing,
+    connecting,
+    loading,
+    available,
+    hasSurface,
+    load,
+    ensureLoaded,
+    probe,
+    connectOAuth,
+    disconnectOAuth,
+  }
 })

package/app/types/toolServers.ts

@@ -9,6 +9,8 @@ export type {
   ToolServerAllowedToolsCheck,
   ToolServerCredential,
   ToolServerNotProbeableReason,
+  ToolServerOAuthGrant,
+  ToolServerOAuthStatus,
   ToolServerProbeResult,
   ToolServerProbeStatus,
   ToolServerTransport,

package/app/utils/sso.spec.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { SSO_ERROR_REASONS } from '@cat-factory/contracts'
+import en from '../../i18n/locales/en.json'
+import { SSO_ERROR_MESSAGE_KEYS } from './sso'
+
+// The copy side of the SSO refusal contract. The `Record<SsoLoginFailure, string>` type already
+// forces every reason to name a key, but a key is only a STRING: nothing there checks it exists in
+// the catalog, and a typo renders the raw key path to a user who just failed to sign in. That is
+// the assertion the type and the locale-parity guard structurally cannot make between them (parity
+// compares locales to each other, so a key missing from ALL of them is parity-clean).
+
+/** Resolve a dotted i18n key against the catalog, or undefined when it names nothing. */
+function lookup(key: string): unknown {
+  return key
+    .split('.')
+    .reduce<unknown>(
+      (node, part) =>
+        node && typeof node === 'object' ? (node as Record<string, unknown>)[part] : undefined,
+      en,
+    )
+}
+
+describe('SSO_ERROR_MESSAGE_KEYS', () => {
+  it('covers every wire reason EXACTLY once, plus the newer-backend fallback', () => {
+    // Derived from the vocabulary the backend actually ships rather than a pinned count, so a
+    // reason added there fails here until it has wording instead of silently rendering nothing.
+    expect(Object.keys(SSO_ERROR_MESSAGE_KEYS).sort()).toEqual(
+      [...SSO_ERROR_REASONS, 'unknown'].sort(),
+    )
+  })
+
+  it('names a key that resolves to real copy for every reason', () => {
+    for (const [reason, key] of Object.entries(SSO_ERROR_MESSAGE_KEYS)) {
+      const copy = lookup(key)
+      expect(typeof copy, `${reason} -> ${key}`).toBe('string')
+      expect(copy as string, `${reason} -> ${key}`).not.toBe('')
+    }
+  })
+})

package/app/utils/sso.ts

@@ -0,0 +1,41 @@
+import { type SsoErrorReason } from '@cat-factory/contracts'
+
+// ---------------------------------------------------------------------------
+// Enterprise SSO presentation, in ONE place — the same convention as `utils/vcs.ts`.
+//
+// The backend does not localize prose (CLAUDE.md's i18n rule): a refused SSO round-trip lands
+// back here with a machine-readable reason, and this module is where each reason becomes copy.
+// ---------------------------------------------------------------------------
+
+/**
+ * A failed SSO sign-in as the SPA models it: one of the wire reasons, or `unknown`.
+ *
+ * `unknown` is not a wire value — it is what a reason from a NEWER backend than this build reads
+ * as. Without it the alternatives are rendering the raw wire token to a user or showing nothing
+ * at all after a failed sign-in, and the second is the worse one: the user clicked the button and
+ * came back to the same button.
+ */
+export type SsoLoginFailure = SsoErrorReason | 'unknown'
+
+/**
+ * The copy key per failure. An exhaustive `Record`, so a member added to the wire vocabulary
+ * fails this typecheck until it has wording — the drift guard the `UNAVAILABLE_REASONS` pattern
+ * establishes.
+ *
+ * The wording split matters more than it looks: `group_required` and `domain_not_allowed` are
+ * things the USER takes to their IT team, while `exchange_failed` and `token_invalid` are
+ * OPERATOR faults in the deployment's own configuration. One "sign-in failed" for all four sends
+ * every user to the wrong place.
+ */
+export const SSO_ERROR_MESSAGE_KEYS: Record<SsoLoginFailure, string> = {
+  state_invalid: 'auth.sso.errors.stateInvalid',
+  provider_denied: 'auth.sso.errors.providerDenied',
+  exchange_failed: 'auth.sso.errors.exchangeFailed',
+  token_invalid: 'auth.sso.errors.tokenInvalid',
+  subject_missing: 'auth.sso.errors.subjectMissing',
+  group_required: 'auth.sso.errors.groupRequired',
+  domain_not_allowed: 'auth.sso.errors.domainNotAllowed',
+  email_required: 'auth.sso.errors.emailRequired',
+  provider_unreachable: 'auth.sso.errors.providerUnreachable',
+  unknown: 'auth.sso.errors.unknown',
+}

package/i18n/locales/de.json

@@ -624,6 +624,27 @@
       "servableHarnessesNone": "Keine Agenten-CLI kann diesen Transport bedienen, daher greift dieser Server in keinem Lauf.",
       "allowedTools": "Eingeschränkt auf: {tools}",
       "credentials": "Zugangsdaten: {keys}",
+      "oauth": {
+        "connected": "Verbunden",
+        "notConnected": "Nicht verbunden",
+        "machineGrant": "Meldet sich als dieses Deployment an",
+        "connectedBy": "Verbunden von {user}",
+        "scopes": "Gewährt: {scopes}",
+        "notRefreshable": "Der Anbieter hat kein Refresh-Token ausgestellt, daher muss diese Verbindung neu hergestellt werden, sobald das Zugriffstoken abläuft.",
+        "lastError": "Die letzte Token-Erneuerung ist fehlgeschlagen: {detail}",
+        "connect": "Verbinden",
+        "reconnect": "Neu verbinden",
+        "disconnect": "Trennen",
+        "callback": {
+          "working": "Verbindung wird abgeschlossen …",
+          "done": "Mit {server} verbunden",
+          "doneHint": "Die Läufe dieses Boards können den Werkzeugserver jetzt mit dem Konto nutzen, mit dem Sie sich angemeldet haben.",
+          "back": "Zurück zur App",
+          "failedTitle": "Die Verbindung konnte nicht abgeschlossen werden",
+          "failed": "Die Autorisierung konnte nicht abgeschlossen werden. Starten Sie die Verbindung im Infrastruktur-Fenster erneut.",
+          "missingParams": "In diesem Link fehlen die vom Anbieter zurückgesendeten Werte, daher gibt es nichts abzuschließen. Starten Sie die Verbindung erneut."
+        }
+      },
       "test": "Testen",
       "notProbeable": {
         "stdio": "Läuft im Container des Agenten und kann von hier aus nicht getestet werden.",
@@ -634,6 +655,8 @@
         "ok": "Hat geantwortet",
         "credentialsMissing": "Keine Zugangsdaten",
         "credentialRefused": "Zugangsdaten abgelehnt",
+        "oauthNotConnected": "Nicht verbunden",
+        "oauthTokenFailed": "Verbindung funktioniert nicht mehr",
         "unreachable": "Keine Antwort",
         "httpError": "Anfrage abgewiesen",
         "protocolError": "Kein MCP-Server",
@@ -650,7 +673,9 @@
       "hideDetails": "Details verbergen",
       "toast": {
         "loadFailed": "Die Werkzeugserver konnten nicht geladen werden",
-        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden"
+        "probeFailed": "Der Werkzeugserver konnte nicht getestet werden",
+        "connectFailed": "Die Verbindung konnte nicht gestartet werden",
+        "disconnectFailed": "Der Werkzeugserver konnte nicht getrennt werden"
       }
     },
     "capabilityCredentials": {
@@ -3650,10 +3675,26 @@
       "signInFailed": "Anmeldung fehlgeschlagen. Prüfen Sie Ihre Angaben und versuchen Sie es erneut.",
       "genericError": "Etwas ist schiefgelaufen. Bitte versuchen Sie es erneut.",
       "notConfiguredTitle": "Authentifizierung ist nicht konfiguriert",
-      "notConfiguredBody": "Für dieses Deployment ist keine Anmeldemethode aktiviert, daher können Sie sich nicht anmelden oder auf Ihre Workspaces zugreifen. Ein Administrator muss einen Authentifizierungs-Provider konfigurieren (GitHub- oder Google-OAuth oder E-Mail-/Passwort-Anmeldung).",
+      "notConfiguredBody": "Für dieses Deployment ist keine Anmeldemethode aktiviert, daher können Sie sich nicht anmelden oder auf Ihre Workspaces zugreifen. Ein Administrator muss einen Authentifizierungs-Provider konfigurieren (Single Sign-on über den Identitätsprovider Ihrer Organisation, GitHub- oder Google-OAuth oder E-Mail-/Passwort-Anmeldung).",
       "patPlaceholder": "{provider} Personal Access Token",
       "signInWithPat": "Mit {provider}-PAT anmelden"
     },
+    "sso": {
+      "continueWith": "Mit {provider} fortfahren",
+      "failedTitle": "Single Sign-on wurde nicht abgeschlossen",
+      "errors": {
+        "stateInvalid": "Dieser Anmeldeversuch ist abgelaufen oder wurde bereits verwendet. Beginnen Sie erneut auf dieser Seite.",
+        "providerDenied": "Ihr Identitätsprovider hat die Anmeldung abgelehnt. Falls Sie sie nicht selbst abgebrochen haben, fragen Sie Ihre IT-Abteilung, ob diese Anwendung Ihnen zugewiesen ist.",
+        "exchangeFailed": "Dieses Deployment konnte den Austausch mit Ihrem Identitätsprovider nicht abschließen. Ein Administrator muss das Single-Sign-on-Client-Secret und die Redirect-URL prüfen.",
+        "tokenInvalid": "Die Antwort Ihres Identitätsproviders konnte nicht verifiziert werden. Ein Administrator muss die Single-Sign-on-Konfiguration dieses Deployments prüfen.",
+        "subjectMissing": "Ihr Identitätsprovider hat keine Benutzerkennung zurückgegeben, daher konnte kein Konto ermittelt werden. Ein Administrator muss prüfen, welche Claims freigegeben werden.",
+        "groupRequired": "Die Anmeldung hat funktioniert, aber Sie sind in keiner Verzeichnisgruppe, die dieses Deployment nutzen darf. Bitten Sie Ihre IT-Abteilung, Sie hinzuzufügen.",
+        "domainNotAllowed": "Ihre E-Mail-Domain darf sich bei diesem Deployment nicht anmelden. Fragen Sie Ihre IT-Abteilung, welches Konto Sie verwenden sollen.",
+        "emailRequired": "Dieses Deployment beschränkt die Anmeldung auf bestimmte E-Mail-Domains, aber Ihr Identitätsprovider hat keine verifizierte E-Mail-Adresse freigegeben. Ein Administrator muss den E-Mail-Claim aktivieren.",
+        "providerUnreachable": "Ihr Identitätsprovider hat beim Abschluss der Anmeldung nicht geantwortet, möglicherweise ist er oder die Verbindung zu ihm gestört. Versuchen Sie es in einem Moment erneut und informieren Sie einen Administrator, falls es weiterhin auftritt.",
+        "unknown": "Single Sign-on ist aus einem Grund fehlgeschlagen, den diese Version nicht kennt. Versuchen Sie es erneut und informieren Sie einen Administrator, falls es weiterhin auftritt."
+      }
+    },
     "resetPassword": {
       "title": "Passwort zurücksetzen",
       "subtitle": "Wählen Sie ein neues Passwort für Ihren Account.",
@@ -5526,6 +5567,7 @@
     "threshold": "Schwellenwert {threshold}",
     "thresholdHint": "Der Wert, den dieser Schritt erreichen musste, aus der Merge-Policy der Aufgabe. Darunter schickt der Judge die Arbeit mit seinen Befunden als Nacharbeit an den erzeugenden Schritt zurück oder parkt den Lauf für Sie, wenn kein Versuchsbudget mehr übrig ist.",
     "rubricOverridden": "Raster des Arbeitsbereichs",
+    "modelPinUnavailable": "Diese Prüfung wurde für das Modell {model} geschrieben, das diese Installation nicht ausführen kann. Die Arbeit wurde daher von einem anderen Modell bewertet.",
     "reworkRounds": "Überarbeitung {spent}/{budget}",
     "findingsHeading": "Was das Bewertungsraster beanstandet hat",
     "roundsHeading": "Prüfrunden",

package/i18n/locales/en.json

@@ -1918,10 +1918,32 @@
       "signInFailed": "Sign-in failed. Check your details and try again.",
       "genericError": "Something went wrong. Please try again.",
       "notConfiguredTitle": "Authentication isn't configured",
-      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (GitHub or Google OAuth, or email and password login).",
+      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (single sign-on through your organization's identity provider, GitHub or Google OAuth, or email and password login).",
       "patPlaceholder": "{provider} personal access token",
       "signInWithPat": "Sign in with {provider} PAT"
     },
+    "sso": {
+      "continueWith": "Continue with {provider}",
+      "@continueWith": {
+        "description": "Sign-in button for the deployment's own identity provider (enterprise SSO). {provider} is the operator-configured label (AUTH_SSO_LABEL) naming their IdP, e.g. \"Acme SSO\" or \"Okta\" - it is a proper noun supplied at runtime, so never translate the interpolated value."
+      },
+      "failedTitle": "Single sign-on didn't complete",
+      "@failedTitle": {
+        "description": "Title of the alert shown when an enterprise single-sign-on round-trip came back without a session. The per-reason detail underneath is the matching `errors.*` message."
+      },
+      "errors": {
+        "stateInvalid": "That sign-in attempt has expired or was already used. Start again from this page.",
+        "providerDenied": "Your identity provider refused the sign-in. If you didn't cancel it yourself, ask your IT team whether this application is assigned to you.",
+        "exchangeFailed": "This deployment couldn't complete the exchange with your identity provider. An administrator needs to check its single sign-on client secret and redirect URL.",
+        "tokenInvalid": "The response from your identity provider couldn't be verified. An administrator needs to check this deployment's single sign-on configuration.",
+        "subjectMissing": "Your identity provider didn't return a user identifier, so no account could be resolved. An administrator needs to check which claims it releases.",
+        "groupRequired": "Your sign-in worked, but you aren't in a directory group that's allowed to use this deployment. Ask your IT team to add you.",
+        "domainNotAllowed": "Your email domain isn't allowed to sign in to this deployment. Ask your IT team which account to use.",
+        "emailRequired": "This deployment restricts sign-in by email domain, but your identity provider didn't release a verified email address. An administrator needs to enable the email claim.",
+        "providerUnreachable": "Your identity provider didn't respond while your sign-in was being completed, so it or the network to it may be down. Try again in a moment, and tell an administrator if it keeps happening.",
+        "unknown": "Single sign-on failed for a reason this version doesn't recognise. Try again, and tell an administrator if it keeps happening."
+      }
+    },
     "resetPassword": {
       "title": "Reset password",
       "subtitle": "Choose a new password for your account.",
@@ -3125,6 +3147,27 @@
       "servableHarnessesNone": "No agent CLI can serve this transport, so this server never applies to any run.",
       "allowedTools": "Narrowed to: {tools}",
       "credentials": "Credentials: {keys}",
+      "oauth": {
+        "connected": "Connected",
+        "notConnected": "Not connected",
+        "machineGrant": "Signs in as this deployment",
+        "connectedBy": "Connected by {user}",
+        "scopes": "Granted: {scopes}",
+        "notRefreshable": "The vendor issued no refresh token, so this connection has to be made again once its access token expires.",
+        "lastError": "The last token renewal failed: {detail}",
+        "connect": "Connect",
+        "reconnect": "Reconnect",
+        "disconnect": "Disconnect",
+        "callback": {
+          "working": "Finishing the connection…",
+          "done": "Connected to {server}",
+          "doneHint": "This board's runs can now use the tool server as the account you signed in with.",
+          "back": "Back to the app",
+          "failedTitle": "The connection could not be finished",
+          "failed": "The authorization could not be completed. Start the connection again from the Infrastructure window.",
+          "missingParams": "This link is missing the values the vendor sends back, so there is nothing to complete. Start the connection again."
+        }
+      },
       "test": "Test",
       "notProbeable": {
         "stdio": "Runs inside the agent's container, so it cannot be tested from here.",
@@ -3135,6 +3178,8 @@
         "ok": "Answered",
         "credentialsMissing": "No credential",
         "credentialRefused": "Credential refused",
+        "oauthNotConnected": "Not connected",
+        "oauthTokenFailed": "Connection stopped working",
         "unreachable": "No answer",
         "httpError": "Rejected the request",
         "protocolError": "Not an MCP server",
@@ -3151,7 +3196,9 @@
       "hideDetails": "Hide details",
       "toast": {
         "loadFailed": "Could not load the tool servers",
-        "probeFailed": "Could not test the tool server"
+        "probeFailed": "Could not test the tool server",
+        "connectFailed": "Could not start the connection",
+        "disconnectFailed": "Could not disconnect the tool server"
       }
     },
     "capabilityCredentials": {
@@ -4885,6 +4932,7 @@
     "threshold": "threshold {threshold}",
     "thresholdHint": "The score this step had to reach, taken from the task's merge policy. Below it the judge sends the work back to the step that produced it, with its findings as rework, or parks the run for you when no attempt budget is left.",
     "rubricOverridden": "workspace rubric",
+    "modelPinUnavailable": "This review was written for the {model} model, which this deployment cannot run, so another model scored the work.",
     "reworkRounds": "rework {spent}/{budget}",
     "findingsHeading": "What the rubric flagged",
     "roundsHeading": "Review rounds",

package/i18n/locales/es.json

@@ -1820,10 +1820,26 @@
       "signInFailed": "Error al iniciar sesión. Revisa tus datos e inténtalo de nuevo.",
       "genericError": "Algo salió mal. Inténtalo de nuevo.",
       "notConfiguredTitle": "La autenticación no está configurada",
-      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
+      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (inicio de sesión único mediante el proveedor de identidad de tu organización, OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
       "patPlaceholder": "Token de acceso personal de {provider}",
       "signInWithPat": "Iniciar sesión con un PAT de {provider}"
     },
+    "sso": {
+      "continueWith": "Continuar con {provider}",
+      "failedTitle": "El inicio de sesión único no se completó",
+      "errors": {
+        "stateInvalid": "Ese intento de inicio de sesión ha caducado o ya se usó. Vuelve a empezar desde esta página.",
+        "providerDenied": "Tu proveedor de identidad rechazó el inicio de sesión. Si no lo cancelaste tú, pregunta a tu equipo de TI si esta aplicación está asignada a ti.",
+        "exchangeFailed": "Este despliegue no pudo completar el intercambio con tu proveedor de identidad. Un administrador debe revisar el secreto de cliente y la URL de redirección del inicio de sesión único.",
+        "tokenInvalid": "No se pudo verificar la respuesta de tu proveedor de identidad. Un administrador debe revisar la configuración de inicio de sesión único de este despliegue.",
+        "subjectMissing": "Tu proveedor de identidad no devolvió un identificador de usuario, por lo que no se pudo resolver ninguna cuenta. Un administrador debe revisar qué claims publica.",
+        "groupRequired": "Te has autenticado correctamente, pero no perteneces a ningún grupo del directorio autorizado a usar este despliegue. Pide a tu equipo de TI que te añada.",
+        "domainNotAllowed": "Tu dominio de correo no tiene permitido iniciar sesión en este despliegue. Pregunta a tu equipo de TI qué cuenta debes usar.",
+        "emailRequired": "Este despliegue restringe el inicio de sesión por dominio de correo, pero tu proveedor de identidad no publicó una dirección de correo verificada. Un administrador debe habilitar el claim de correo.",
+        "providerUnreachable": "Tu proveedor de identidad no respondió mientras se completaba el inicio de sesión, por lo que puede estar caído o sin conexión. Vuelve a intentarlo en un momento y avisa a un administrador si sigue ocurriendo.",
+        "unknown": "El inicio de sesión único falló por un motivo que esta versión no reconoce. Inténtalo de nuevo y avisa a un administrador si sigue ocurriendo."
+      }
+    },
     "resetPassword": {
       "title": "Restablecer contraseña",
       "subtitle": "Elige una nueva contraseña para tu cuenta.",
@@ -2874,6 +2890,27 @@
       "servableHarnessesNone": "Ninguna CLI de agente puede servir este transporte, así que este servidor nunca se aplica a una ejecución.",
       "allowedTools": "Limitado a: {tools}",
       "credentials": "Credenciales: {keys}",
+      "oauth": {
+        "connected": "Conectado",
+        "notConnected": "Sin conexión",
+        "machineGrant": "Se identifica como este despliegue",
+        "connectedBy": "Conectado por {user}",
+        "scopes": "Concedido: {scopes}",
+        "notRefreshable": "El proveedor no emitió un token de actualización, así que habrá que volver a conectar cuando caduque el token de acceso.",
+        "lastError": "La última renovación del token falló: {detail}",
+        "connect": "Conectar",
+        "reconnect": "Volver a conectar",
+        "disconnect": "Desconectar",
+        "callback": {
+          "working": "Finalizando la conexión…",
+          "done": "Conectado a {server}",
+          "doneHint": "Las ejecuciones de este tablero ya pueden usar el servidor de herramientas con la cuenta con la que iniciaste sesión.",
+          "back": "Volver a la aplicación",
+          "failedTitle": "No se pudo finalizar la conexión",
+          "failed": "No se pudo completar la autorización. Vuelve a iniciar la conexión desde la ventana de Infraestructura.",
+          "missingParams": "A este enlace le faltan los valores que devuelve el proveedor, así que no hay nada que completar. Vuelve a iniciar la conexión."
+        }
+      },
       "test": "Probar",
       "notProbeable": {
         "stdio": "Se ejecuta dentro del contenedor del agente, así que no puede probarse desde aquí.",
@@ -2884,6 +2921,8 @@
         "ok": "Respondió",
         "credentialsMissing": "Sin credencial",
         "credentialRefused": "Credencial rechazada",
+        "oauthNotConnected": "Sin conexión",
+        "oauthTokenFailed": "La conexión dejó de funcionar",
         "unreachable": "Sin respuesta",
         "httpError": "Rechazó la solicitud",
         "protocolError": "No es un servidor MCP",
@@ -2900,7 +2939,9 @@
       "hideDetails": "Ocultar detalles",
       "toast": {
         "loadFailed": "No se pudieron cargar los servidores de herramientas",
-        "probeFailed": "No se pudo probar el servidor de herramientas"
+        "probeFailed": "No se pudo probar el servidor de herramientas",
+        "connectFailed": "No se pudo iniciar la conexión",
+        "disconnectFailed": "No se pudo desconectar el servidor de herramientas"
       }
     },
     "capabilityCredentials": {
@@ -4668,6 +4709,7 @@
     "threshold": "umbral {threshold}",
     "thresholdHint": "La puntuacion que este paso tenia que alcanzar, tomada de la politica de fusion de la tarea. Por debajo, el juez devuelve el trabajo al paso que lo produjo con sus hallazgos como retrabajo, o aparca la ejecucion para ti cuando ya no queda presupuesto de intentos.",
     "rubricOverridden": "rúbrica del espacio de trabajo",
+    "modelPinUnavailable": "Esta revisión se escribió para el modelo {model}, que esta instalación no puede ejecutar, así que otro modelo puntuó el trabajo.",
     "reworkRounds": "revisión {spent}/{budget}",
     "findingsHeading": "Lo que señaló la rúbrica",
     "roundsHeading": "Rondas de revisión",

package/i18n/locales/fr.json

@@ -1820,10 +1820,26 @@
       "signInFailed": "Échec de la connexion. Vérifiez vos informations et réessayez.",
       "genericError": "Une erreur s'est produite. Veuillez réessayer.",
       "notConfiguredTitle": "L'authentification n'est pas configurée",
-      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
+      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (authentification unique via le fournisseur d'identité de votre organisation, OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
       "patPlaceholder": "Jeton d'accès personnel {provider}",
       "signInWithPat": "Se connecter avec un PAT {provider}"
     },
+    "sso": {
+      "continueWith": "Continuer avec {provider}",
+      "failedTitle": "L'authentification unique n'a pas abouti",
+      "errors": {
+        "stateInvalid": "Cette tentative de connexion a expiré ou a déjà été utilisée. Recommencez depuis cette page.",
+        "providerDenied": "Votre fournisseur d'identité a refusé la connexion. Si vous ne l'avez pas annulée vous-même, demandez à votre service informatique si cette application vous est attribuée.",
+        "exchangeFailed": "Ce déploiement n'a pas pu finaliser l'échange avec votre fournisseur d'identité. Un administrateur doit vérifier le secret client et l'URL de redirection de l'authentification unique.",
+        "tokenInvalid": "La réponse de votre fournisseur d'identité n'a pas pu être vérifiée. Un administrateur doit vérifier la configuration de l'authentification unique de ce déploiement.",
+        "subjectMissing": "Votre fournisseur d'identité n'a pas renvoyé d'identifiant utilisateur, aucun compte n'a donc pu être résolu. Un administrateur doit vérifier les claims qu'il expose.",
+        "groupRequired": "Votre connexion a réussi, mais vous n'appartenez à aucun groupe de l'annuaire autorisé à utiliser ce déploiement. Demandez à votre service informatique de vous ajouter.",
+        "domainNotAllowed": "Votre domaine de messagerie n'est pas autorisé à se connecter à ce déploiement. Demandez à votre service informatique quel compte utiliser.",
+        "emailRequired": "Ce déploiement limite la connexion à certains domaines de messagerie, mais votre fournisseur d'identité n'a pas transmis d'adresse e-mail vérifiée. Un administrateur doit activer le claim e-mail.",
+        "providerUnreachable": "Votre fournisseur d'identité n'a pas répondu pendant la finalisation de la connexion : lui-même ou le réseau qui y mène est peut-être indisponible. Réessayez dans un instant et prévenez un administrateur si cela persiste.",
+        "unknown": "L'authentification unique a échoué pour une raison que cette version ne reconnaît pas. Réessayez et prévenez un administrateur si le problème persiste."
+      }
+    },
     "resetPassword": {
       "title": "Réinitialiser le mot de passe",
       "subtitle": "Choisissez un nouveau mot de passe pour votre compte.",
@@ -2874,6 +2890,27 @@
       "servableHarnessesNone": "Aucune CLI d’agent ne peut servir ce transport, donc ce serveur ne s’applique à aucune exécution.",
       "allowedTools": "Restreint à : {tools}",
       "credentials": "Identifiants : {keys}",
+      "oauth": {
+        "connected": "Connecté",
+        "notConnected": "Non connecté",
+        "machineGrant": "S’authentifie en tant que ce déploiement",
+        "connectedBy": "Connecté par {user}",
+        "scopes": "Accordé : {scopes}",
+        "notRefreshable": "Le fournisseur n’a pas émis de jeton de rafraîchissement : il faudra reconnecter dès que le jeton d’accès expirera.",
+        "lastError": "Le dernier renouvellement du jeton a échoué : {detail}",
+        "connect": "Connecter",
+        "reconnect": "Reconnecter",
+        "disconnect": "Déconnecter",
+        "callback": {
+          "working": "Finalisation de la connexion…",
+          "done": "Connecté à {server}",
+          "doneHint": "Les exécutions de ce tableau peuvent désormais utiliser le serveur d’outils avec le compte auquel vous vous êtes connecté.",
+          "back": "Retour à l’application",
+          "failedTitle": "La connexion n’a pas pu être finalisée",
+          "failed": "L’autorisation n’a pas pu être menée à bien. Relancez la connexion depuis la fenêtre Infrastructure.",
+          "missingParams": "Il manque à ce lien les valeurs renvoyées par le fournisseur, il n’y a donc rien à finaliser. Relancez la connexion."
+        }
+      },
       "test": "Tester",
       "notProbeable": {
         "stdio": "Il s’exécute dans le conteneur de l’agent et ne peut donc pas être testé d’ici.",
@@ -2884,6 +2921,8 @@
         "ok": "A répondu",
         "credentialsMissing": "Aucun identifiant",
         "credentialRefused": "Identifiant refusé",
+        "oauthNotConnected": "Non connecté",
+        "oauthTokenFailed": "La connexion ne fonctionne plus",
         "unreachable": "Aucune réponse",
         "httpError": "Requête rejetée",
         "protocolError": "Pas un serveur MCP",
@@ -2900,7 +2939,9 @@
       "hideDetails": "Masquer les détails",
       "toast": {
         "loadFailed": "Impossible de charger les serveurs d’outils",
-        "probeFailed": "Impossible de tester le serveur d’outils"
+        "probeFailed": "Impossible de tester le serveur d’outils",
+        "connectFailed": "Impossible de démarrer la connexion",
+        "disconnectFailed": "Impossible de déconnecter le serveur d’outils"
       }
     },
     "capabilityCredentials": {
@@ -4668,6 +4709,7 @@
     "threshold": "seuil {threshold}",
     "thresholdHint": "Le score que cette etape devait atteindre, issu de la politique de fusion de la tache. En dessous, le juge renvoie le travail a l'etape qui l'a produit avec ses constats a reprendre, ou met l'execution en attente pour vous quand il ne reste plus de budget de tentatives.",
     "rubricOverridden": "grille de l'espace de travail",
+    "modelPinUnavailable": "Cette revue a été écrite pour le modèle {model}, que ce déploiement ne peut pas exécuter : un autre modèle a donc noté le travail.",
     "reworkRounds": "reprise {spent}/{budget}",
     "findingsHeading": "Ce que la grille a signalé",
     "roundsHeading": "Tours de revue",