@cat-factory/app 0.229.0 → 0.231.0

package/README.md

@@ -583,7 +583,7 @@ event left to restore it.
 All user-facing SPA copy goes through `@nuxtjs/i18n`; never hard-code a display string. This
 layer ships the base `en` locale, and a downstream deployment overrides by dropping its own files
 (the per-layer deep-merge is the override seam, consumer wins key by key). Migration status:
-[`docs/localization.md`](../../docs/localization.md).
+[`docs/internal/localization.md`](../../docs/internal/localization.md).
 
 - `i18n/locales/<locale>.json`: the catalogs (the v9+ `i18n/` convention, NOT `app/locales/`).
 - `i18n/i18n.config.ts`: runtime vue-i18n behaviour only (fallback locale, the plural

package/app/components/auth/LoginScreen.vue

@@ -4,29 +4,37 @@ import { apiErrorEnvelope } from '~/composables/api/errors'
 import SecretInput from '~/components/common/SecretInput.vue'
 import type { VcsProvider } from '~/types/domain'
 import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS, VCS_PROVIDER_TOKEN_URLS } from '~/utils/vcs'
+import { SSO_ERROR_MESSAGE_KEYS } from '~/utils/sso'
 
 const auth = useAuthStore()
 const { t } = useI18n()
 
-// Local-mode source-control PAT login. The PAT lives server-side in env (GITHUB_PAT /
-// GITLAB_PAT); the login screen only SELECTS a configured provider — no token is ever typed
-// into or shown in the browser. The brand labels / icons / token-settings URLs are the shared
-// provider descriptors in `~/utils/vcs` (brand names stay verbatim across locales, so they are
-// constants rather than catalog keys — the same convention as ApiKeysSection). The "create a
-// token" link prefers the server's scopes-preselected deep link (`patLogin.setupUrls`); the
-// descriptor's URL is the fallback.
+// Local-mode source-control PAT login. A configured token lives server-side and is selected by
+// PROVIDER (no token is typed into the browser); a deployment that holds none can be handed one
+// here, and it becomes both this sign-in and the credential the deployment operates with. The
+// brand labels / icons / token-settings URLs are the shared provider descriptors in `~/utils/vcs`
+// (brand names stay verbatim across locales, so they are constants rather than catalog keys — the
+// same convention as ApiKeysSection). The "create a token" link prefers the server's
+// scopes-preselected deep link (`patLogin.setupUrls`); the descriptor's URL is the fallback.
 type PatProvider = VcsProvider
+/** Every provider a token page exists for — the fallback link set when none can be installed. */
 const ALL_PROVIDERS: PatProvider[] = ['github', 'gitlab']
 const PROVIDER_LABELS = VCS_PROVIDER_LABELS
 const PROVIDER_ICONS = VCS_PROVIDER_ICONS
 const PROVIDER_TOKEN_URLS = VCS_PROVIDER_TOKEN_URLS
 
 const patLoginCfg = computed(() => auth.localMode?.patLogin)
-// Only providers whose PAT is configured in env can sign in (the token is the operational
-// credential too). A provider without one gets no button — see the no-PAT notice instead.
+// Providers whose token the deployment already holds: one-click sign-in. A provider without one
+// gets no button — it is offered in the paste form below instead.
 const configuredProviders = computed<PatProvider[]>(
   () => (patLoginCfg.value?.configured ?? []) as PatProvider[],
 )
+// Providers the server will ACCEPT a token for from here. Empty when `.env` owns the credential
+// (it wins, so a pasted token would be ignored) or nothing can seal one — the notice then falls
+// back to telling the developer where the token actually has to go.
+const installableProviders = computed<PatProvider[]>(
+  () => (patLoginCfg.value?.installable ?? []) as PatProvider[],
+)
 const isLocalMode = computed(() => auth.localMode?.enabled === true)
 const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
 // Mothership mode: identity + org data live on a hosted mothership, so the primary sign-in is a
@@ -124,13 +132,27 @@ const showOAuthDivider = computed(
   () => auth.providers.password && (auth.providers.github || auth.providers.google),
 )
 
-// Hosted (remote node) PAT login: the user pastes their OWN source-control PAT, which the
-// server resolves to an account and holds to its login/org/domain allowlist. The available
-// providers come from the server (`auth.patProviders`) — GitHub always, GitLab when configured,
-// on both hosted facades (Node + Worker); empty in local mode (which uses the configured-token
-// flow above).
+// Enterprise SSO. Led with, above the consumer providers, because on a deployment that configures
+// it that is the intended way in — a person arriving at an org's board should not have to find
+// their company's button under two they must not use. The label is the operator's own wording
+// (it names their IdP), so it is rendered verbatim rather than through the catalog.
+const ssoLabel = computed(() => auth.sso?.label ?? '')
+// Translated copy for a refused round-trip, keyed off the machine-readable reason the backend
+// handed back. Each reason has its own wording because the remedies differ: a missing directory
+// group is something the user takes to IT, a failed code exchange is the operator's own config.
+const ssoErrorMessage = computed(() =>
+  auth.ssoError ? t(SSO_ERROR_MESSAGE_KEYS[auth.ssoError]) : null,
+)
+
+// Paste-a-token sign-in. The user supplies a source-control PAT and the server resolves it to an
+// account. What it MEANS differs per facade, which is why the providers come from two places:
+//  - hosted (remote node): the user's OWN token, held to the login/org/domain allowlist. GitHub
+//    always, GitLab when configured, on both hosted facades (Node + Worker).
+//  - local: the token also becomes the DEPLOYMENT's credential, so the server names the providers
+//    it will accept one for (`installable`) — empty once `.env` owns it.
+// One form serves both; the local-only hint below says what the token is additionally used for.
 const remotePatProviders = computed<PatProvider[]>(() =>
-  isLocalMode.value ? [] : (auth.patProviders as PatProvider[]),
+  isLocalMode.value ? installableProviders.value : (auth.patProviders as PatProvider[]),
 )
 const remotePatProvider = ref<PatProvider>('github')
 watch(
@@ -157,6 +179,16 @@ async function submitRemotePat() {
   }
 }
 
+// Only divide SSO from what follows when something actually follows it.
+const showSsoDivider = computed(
+  () =>
+    auth.providers.sso &&
+    (auth.providers.github ||
+      auth.providers.google ||
+      auth.providers.password ||
+      remotePatProviders.value.length > 0),
+)
+
 // A remote deployment (node service / Worker) that advertises no sign-in method at all:
 // no OAuth, no password, no PAT, and not local mode. The auth gate still routes here (a
 // remote facade has no anonymous tier), so instead of a blank card we explain that
@@ -167,6 +199,7 @@ const noSignInMethod = computed(
     !auth.providers.github &&
     !auth.providers.google &&
     !auth.providers.password &&
+    !auth.providers.sso &&
     remotePatProviders.value.length === 0,
 )
 </script>
@@ -227,16 +260,24 @@ const noSignInMethod = computed(
           {{ t('auth.localMode.continueWithConfigured', { provider: PROVIDER_LABELS[p] }) }}
         </UButton>
 
-        <!-- Neither GITHUB_PAT nor GITLAB_PAT is set: tell the developer how to configure one -->
+        <!-- The deployment holds no token. When one can be installed from here the notice says
+             so and the create-token links feed the form below; when it can't (`.env` owns the
+             credential, or nothing can seal one) it names where the token has to go instead. -->
         <template v-if="!hasConfiguredPat">
           <UAlert
             color="warning"
             variant="subtle"
             icon="i-lucide-key-round"
             :title="t('auth.localMode.noPatTitle')"
-            :description="t('auth.localMode.noPatBody')"
+            :description="
+              installableProviders.length > 0
+                ? t('auth.localMode.setupBody')
+                : t('auth.localMode.noPatBody')
+            "
           />
-          <div class="flex flex-wrap gap-3 px-1">
+          <!-- Only when nothing can be installed here: the paste form below carries its own
+               per-provider link, so showing these too would offer the same thing twice. -->
+          <div v-if="installableProviders.length === 0" class="flex flex-wrap gap-3 px-1">
             <a
               v-for="p in ALL_PROVIDERS"
               :key="p"
@@ -261,6 +302,41 @@ const noSignInMethod = computed(
         <span class="h-px flex-1 bg-slate-800" />
       </div>
 
+      <!-- A refused SSO round-trip: name the rule that refused, don't return the user to an
+           unchanged sign-in button. -->
+      <UAlert
+        v-if="ssoErrorMessage && mode !== 'forgot'"
+        class="mb-4"
+        color="error"
+        variant="subtle"
+        icon="i-lucide-shield-x"
+        :title="t('auth.sso.failedTitle')"
+        :description="ssoErrorMessage"
+        data-testid="sso-error"
+      />
+
+      <!-- Enterprise SSO: the deployment's OWN identity provider, led with where configured. -->
+      <div v-if="auth.providers.sso && mode !== 'forgot'" class="mb-2 space-y-2">
+        <UButton
+          block
+          size="lg"
+          color="primary"
+          icon="i-lucide-building-2"
+          data-testid="sso-signin"
+          @click="auth.loginWithSso(invite)"
+        >
+          {{ t('auth.sso.continueWith', { provider: ssoLabel }) }}
+        </UButton>
+      </div>
+
+      <div
+        v-if="showSsoDivider && mode !== 'forgot'"
+        class="my-4 flex items-center gap-3 text-xs text-slate-500"
+      >
+        <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.login.or') }}
+        <span class="h-px flex-1 bg-slate-800" />
+      </div>
+
       <!-- OAuth providers -->
       <div v-if="mode !== 'forgot'" class="space-y-2">
         <UButton
@@ -364,10 +440,16 @@ const noSignInMethod = computed(
         </p>
       </form>
 
-      <!-- Hosted (remote node) PAT login: paste your own source-control PAT -->
+      <!-- Paste-a-token sign-in: your own PAT on a hosted node; on local mode the token this
+           deployment will operate with (see `remotePatProviders`). -->
       <template v-if="remotePatProviders.length > 0 && mode !== 'forgot'">
         <div
-          v-if="auth.providers.github || auth.providers.google || auth.providers.password"
+          v-if="
+            auth.providers.github ||
+            auth.providers.google ||
+            auth.providers.password ||
+            hasConfiguredPat
+          "
           class="my-4 flex items-center gap-3 text-xs text-slate-500"
         >
           <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.login.or') }}
@@ -412,6 +494,11 @@ const noSignInMethod = computed(
           >
             {{ t('auth.login.signInWithPat', { provider: PROVIDER_LABELS[remotePatProvider] }) }}
           </UButton>
+          <!-- Local mode only: say what else the token is for BEFORE it is handed over, since it
+               becomes the credential every agent step on this machine clones and pushes with. -->
+          <p v-if="isLocalMode" class="px-1 text-xs text-slate-400">
+            {{ t('auth.localMode.tokenBecomesCredential') }}
+          </p>
           <p class="px-1 text-center">
             <a
               :href="tokenCreateUrl(remotePatProvider)"

package/app/components/board/AddTaskModal.vue

@@ -895,6 +895,7 @@ function openReviewFrictionDialog(conflict: NonNullable<ReturnType<typeof parseC
                     : t('board.addTask.descriptionPlaceholder')
                 "
                 class="w-full"
+                data-testid="add-task-description"
               />
             </UFormField>
           </template>

package/app/components/board/nodes/TaskCard.vue

@@ -406,6 +406,7 @@ function selectTask() {
           :icon="!runnable ? 'i-lucide-lock' : sandboxed ? 'i-lucide-shield' : 'i-lucide-play'"
           :loading="starting"
           :disabled="!runnable || starting"
+          data-testid="task-start"
           :title="
             !runnable
               ? t('board.task.waitingOn', { deps: unmet.map((d) => d.title).join(', ') })

package/app/components/inputGate/InputGateNotice.vue

@@ -148,6 +148,9 @@ async function resolve(choice: 'recheck' | 'proceed') {
             v-for="issue in issues"
             :key="`${issue.code}:${issue.field?.key ?? ''}`"
             class="flex items-start gap-2 text-xs"
+            data-testid="input-gate-issue"
+            :data-issue-code="issue.code"
+            :data-issue-severity="issue.severity"
           >
             <UBadge
               :color="issue.severity === 'blocking' ? 'warning' : 'neutral'"

package/app/components/judge/JudgeResultView.vue

@@ -170,6 +170,17 @@ async function act(choice: 'proceed' | 'bounce' | 'stop') {
           </span>
         </div>
 
+        <!-- The rubric asked for a model this deployment cannot serve, so something else scored
+             the work. Only this case is shown: a pin that was honoured says nothing the model
+             name doesn't, and being overridden by the task's own choice is the normal outcome. -->
+        <p
+          v-if="judge.modelPin?.status === 'unavailable'"
+          class="mt-2 rounded-md border border-amber-500/30 bg-amber-500/5 px-3 py-2 text-[12px] leading-relaxed text-amber-200"
+          data-testid="judge-model-pin"
+        >
+          {{ t('judge.modelPinUnavailable', { model: judge.modelPin.requested }) }}
+        </p>
+
         <!-- Why the judge did nothing, when it did nothing. A skipped judge must never read
              like a clean pass. -->
         <p
@@ -288,6 +299,8 @@ async function act(choice: 'proceed' | 'bounce' | 'stop') {
               v-for="round in rounds"
               :key="round.round"
               class="flex flex-wrap items-center gap-2 rounded-md border border-slate-800 bg-slate-950/40 px-3 py-1.5 text-[12px] text-slate-300"
+              data-testid="judge-round"
+              :data-round-disposition="round.disposition"
             >
               <span class="text-slate-500">{{ t('judge.round', { round: round.round }) }}</span>
               <span class="font-medium text-slate-100">{{

package/app/components/panels/inspector/TaskExecution.vue

@@ -373,6 +373,7 @@ async function mergePr() {
             <button
               type="button"
               class="flex min-w-0 cursor-pointer items-center gap-2 text-start transition hover:text-white"
+              data-testid="run-step-open"
               :title="
                 s.output
                   ? t('inspector.execution.viewDetailsOutput')

package/app/components/requirements/RequirementsReviewWindow.vue

@@ -708,6 +708,7 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
           <div
             v-if="incorporated"
             class="mb-4 flex items-center gap-2 rounded-lg border border-emerald-900/60 bg-emerald-950/30 p-4 text-sm text-emerald-300"
+            data-testid="requirements-settled"
           >
             <UIcon name="i-lucide-circle-check" class="h-5 w-5 shrink-0" />
             {{ t('requirements.settled') }}
@@ -760,6 +761,9 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
               <div
                 class="rounded-lg border border-slate-800 bg-slate-900/60 p-3"
                 :class="{ 'opacity-60': item.status === 'dismissed' }"
+                data-testid="requirements-finding"
+                :data-finding-status="item.status"
+                :data-finding-severity="item.severity"
               >
                 <div class="flex items-start gap-2">
                   <UIcon
@@ -831,6 +835,7 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           size="xs"
                           :icon="opt.icon"
                           :disabled="frozen"
+                          :data-testid="`requirements-mode-${opt.mode}`"
                           @click="setMode(item, opt.mode)"
                         >
                           {{ t(opt.labelKey) }}
@@ -881,6 +886,7 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
                           class="mt-2 w-full"
                           :placeholder="t('requirements.answerPlaceholder')"
                           :disabled="frozen"
+                          data-testid="requirements-answer"
                           @blur="persistDraft(item)"
                         />
                         <p
@@ -1170,6 +1176,7 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
               :loading="acting"
               :disabled="!access.canExecuteRuns.value"
               :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
+              data-testid="requirements-proceed"
               @click="proceed"
             >
               {{ t('requirements.actions.proceedNothing') }}
@@ -1183,6 +1190,7 @@ async function resolveExceeded(choice: 'extra-round' | 'proceed' | 'stop-reset')
               :loading="reworking"
               :disabled="!canIncorporate || !access.canExecuteRuns.value"
               :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
+              data-testid="requirements-incorporate"
               @click="incorporate()"
             >
               {{ t('requirements.actions.incorporateAnswers') }}

package/app/docs/consumer-extensions.md

@@ -213,8 +213,8 @@ suite can address a row and the caption inside it.
 Together, `fields` + `defaultFragmentIds` + `defaultPipelineId` are what turns a task type from a
 badge into a **reusable operation**: a canned unit of work an org runs repeatedly with per-case
 input, whose collected values reach every agent's prompt. See
-[`docs/initiatives/reusable-operations.md`](../../../../docs/initiatives/reusable-operations.md)
-and the `org:introduce-api` worked example in `backend/internal/example-custom-agent`.
+[`backend/docs/reusable-operations.md`](../../../../backend/docs/reusable-operations.md) and the
+`org:introduce-api` worked example in `backend/internal/example-custom-agent`.
 
 The **same type can be delivered from the backend** instead of code-shipped: register it on the
 deployment's app-owned `TaskTypeRegistry` and it arrives in the workspace snapshot's

package/app/stores/auth/mothership.ts

@@ -1,6 +1,8 @@
 import type { Ref } from 'vue'
+import { SSO_ERROR_FRAGMENT_KEY, parseSsoErrorReason } from '@cat-factory/contracts'
 import type { LocalModeConfig } from '@cat-factory/contracts'
 import type { AuthUser } from '~/types/domain'
+import type { SsoLoginFailure } from '~/utils/sso'
 
 /**
  * Shared reactive state + injected dependencies the auth-store redirect factory closes over.
@@ -13,6 +15,8 @@ export interface AuthRedirectContext {
   token: Ref<string | null>
   localMode: Ref<LocalModeConfig | null>
   mothershipError: Ref<string | null>
+  /** Why the last enterprise-SSO round-trip produced no session, when one was refused. */
+  ssoError: Ref<SsoLoginFailure | null>
   /** Apply a freshly-minted token + user (the session factory's setter). */
   applySession: (result: { token: string; user: AuthUser }) => void
 }
@@ -23,7 +27,7 @@ export interface AuthRedirectContext {
  * mode — exchanging a returning MOTHERSHIP session for a local one.
  */
 export function createAuthRedirectActions(ctx: AuthRedirectContext) {
-  const { api, token, localMode, mothershipError, applySession } = ctx
+  const { api, token, localMode, mothershipError, ssoError, applySession } = ctx
 
   /** Pull a token handed back in the post-login URL fragment (#token=…). */
   function consumeRedirectToken() {
@@ -35,6 +39,27 @@ export function createAuthRedirectActions(ctx: AuthRedirectContext) {
     history.replaceState(null, '', window.location.pathname + window.location.search)
   }
 
+  /**
+   * Pull the reason a REFUSED enterprise-SSO round-trip handed back (`#sso_error=<reason>`), the
+   * sibling of the `#token=` a successful one sets.
+   *
+   * A fragment rather than a query for the same reason the token is: it never reaches a server log
+   * or a `Referer`, and the reason names the deployment's own admission rules. Stripped from the
+   * URL afterwards so a reload doesn't resurrect a stale failure.
+   */
+  function consumeSsoError() {
+    if (typeof window === 'undefined') return
+    const match = new RegExp(`(?:^#|[#&])${SSO_ERROR_FRAGMENT_KEY}=([^&]+)`).exec(
+      window.location.hash,
+    )
+    if (!match) return
+    // An unrecognised value came from a newer backend than this build: reported as `unknown`
+    // rather than rendered raw, and never dropped — the user clicked a button and is owed an
+    // answer about why they are back here.
+    ssoError.value = parseSsoErrorReason(decodeURIComponent(match[1]!)) ?? 'unknown'
+    history.replaceState(null, '', window.location.pathname + window.location.search)
+  }
+
   /**
    * Mothership mode: when the mothership OAuth redirect returns here (flagged
    * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
@@ -101,6 +126,7 @@ export function createAuthRedirectActions(ctx: AuthRedirectContext) {
 
   return {
     consumeRedirectToken,
+    consumeSsoError,
     maybeConnectMothership,
     signInViaMothership,
     maybeAcceptInvite,

package/app/stores/auth/session.ts

@@ -44,6 +44,16 @@ export function createAuthSessionActions(ctx: AuthSessionContext) {
     window.location.href = `${apiBase}/auth/google/login?${redirectTarget(invite)}`
   }
 
+  /**
+   * Send the browser to the deployment's OWN identity provider (enterprise SSO), returning here
+   * after. One entry point whichever IdP is configured: the backend resolves the provider from its
+   * discovery document, so there is nothing per-vendor for the SPA to know.
+   */
+  function loginWithSso(invite?: string) {
+    if (typeof window === 'undefined') return
+    window.location.href = `${apiBase}/auth/sso/login?${redirectTarget(invite)}`
+  }
+
   /** Apply a freshly-minted token + user (from password signup/login). */
   function applySession(result: { token: string; user: AuthUser }) {
     token.value = result.token
@@ -107,6 +117,7 @@ export function createAuthSessionActions(ctx: AuthSessionContext) {
     applySession,
     login,
     loginWithGoogle,
+    loginWithSso,
     signup,
     passwordLogin,
     patLogin,

package/app/stores/auth/ssoError.spec.ts

@@ -0,0 +1,64 @@
+import { ref } from 'vue'
+import { beforeEach, describe, expect, it } from 'vitest'
+import { createAuthRedirectActions } from './mothership'
+import type { SsoLoginFailure } from '~/utils/sso'
+
+// The other half of the SSO refusal contract: the backend lands the browser here with a
+// machine-readable reason in the fragment, and this is what turns it into state the login screen
+// renders. Worth pinning because the failure mode is silent — a reason the SPA drops leaves the
+// user back on the same sign-in button with no explanation for the click that just failed.
+
+/** Point `window.location` + `history` at a URL the consumer can read and rewrite. */
+function setUrl(path: string): void {
+  history.replaceState(null, '', path)
+}
+
+function actions() {
+  const ssoError = ref<SsoLoginFailure | null>(null)
+  const factory = createAuthRedirectActions({
+    api: {} as never,
+    token: ref<string | null>(null),
+    localMode: ref(null),
+    mothershipError: ref<string | null>(null),
+    ssoError,
+    applySession: () => {},
+  })
+  return { ...factory, ssoError }
+}
+
+describe('consumeSsoError', () => {
+  beforeEach(() => setUrl('/'))
+
+  it('reads a known reason off the fragment', () => {
+    setUrl('/#sso_error=group_required')
+    const a = actions()
+    a.consumeSsoError()
+    expect(a.ssoError.value).toBe('group_required')
+  })
+
+  it('strips the fragment so a reload does not resurrect a stale failure', () => {
+    setUrl('/board?ws=ws_1#sso_error=state_invalid')
+    actions().consumeSsoError()
+    expect(window.location.hash).toBe('')
+    // The rest of the URL is left alone.
+    expect(window.location.pathname + window.location.search).toBe('/board?ws=ws_1')
+  })
+
+  it('reports an unrecognised reason as `unknown` rather than dropping it', () => {
+    // A reason from a NEWER backend than this build. Rendering the raw wire token to a user is
+    // wrong; showing nothing after a failed sign-in is worse.
+    setUrl('/#sso_error=reason_from_the_future')
+    const a = actions()
+    a.consumeSsoError()
+    expect(a.ssoError.value).toBe('unknown')
+  })
+
+  it('leaves the state untouched when the fragment carries no SSO error', () => {
+    setUrl('/#token=abc')
+    const a = actions()
+    a.consumeSsoError()
+    expect(a.ssoError.value).toBeNull()
+    // The session token is another consumer's to read, so the fragment must survive.
+    expect(window.location.hash).toBe('#token=abc')
+  })
+})

package/app/stores/auth.ts

@@ -2,6 +2,7 @@ import type {
   BackendMisconfigured,
   InfrastructureCapabilities,
   LocalModeConfig,
+  SsoConfigView,
 } from '@cat-factory/contracts'
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
@@ -9,6 +10,7 @@ import type { AuthUser } from '~/types/domain'
 import { retryWhileBackendUnreachable } from '~/utils/backendReady'
 import { createAuthSessionActions } from '~/stores/auth/session'
 import { createAuthRedirectActions } from '~/stores/auth/mothership'
+import type { SsoLoginFailure } from '~/utils/sso'
 
 /**
  * "Login with GitHub" session state. The backend mints a signed session token
@@ -31,7 +33,20 @@ export const useAuthStore = defineStore(
     /** Whether the backend requires authentication. */
     const required = ref(false)
     /** Which login providers the backend offers (drives the login UI). */
-    const providers = ref({ github: false, password: false, google: false })
+    const providers = ref({ github: false, password: false, google: false, sso: false })
+    /**
+     * Presentation for the deployment's OWN identity provider (enterprise SSO) — its
+     * operator-supplied label and protocol. Null unless `providers.sso` is set. The label names
+     * the operator's IdP, so it is the one piece of login copy the SPA renders verbatim rather
+     * than through the catalog.
+     */
+    const sso = ref<SsoConfigView | null>(null)
+    /**
+     * Why the last enterprise-SSO sign-in produced no session, when one was refused. Captured
+     * from the `#sso_error=` fragment on boot so the login screen can name the rule that refused
+     * instead of returning the user to an unchanged sign-in button.
+     */
+    const ssoError = ref<SsoLoginFailure | null>(null)
     /**
      * Source-control providers a HOSTED facade (remote node) accepts a user-supplied PAT for.
      * Drives the login screen's "sign in with a PAT" option on non-local deployments. Empty on
@@ -134,14 +149,29 @@ export const useAuthStore = defineStore(
       user,
       autoLoginProvider,
     })
-    const { consumeRedirectToken, maybeConnectMothership, signInViaMothership, maybeAcceptInvite } =
-      createAuthRedirectActions({ api, token, localMode, mothershipError, applySession })
+    const {
+      consumeRedirectToken,
+      consumeSsoError,
+      maybeConnectMothership,
+      signInViaMothership,
+      maybeAcceptInvite,
+    } = createAuthRedirectActions({
+      api,
+      token,
+      localMode,
+      mothershipError,
+      ssoError,
+      applySession,
+    })
 
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
       // A returning mothership-connect redirect is handled first (it carries a mothership session,
       // which must be exchanged — not stored as a local token by `consumeRedirectToken`).
       if (!(await maybeConnectMothership())) consumeRedirectToken()
+      // A refused SSO round-trip returns a reason instead of a token, and it must be read BEFORE
+      // the config call: the login screen renders from the same settled state either way.
+      consumeSsoError()
       try {
         // Tolerate a cold-start race: when the SPA and backend boot together, this first call
         // can beat the backend's listener by a second or two. Retry a not-listening-yet socket
@@ -149,6 +179,7 @@ export const useAuthStore = defineStore(
         const config = await retryWhileBackendUnreachable(() => api.getAuthConfig())
         required.value = config.enabled
         if (config.providers) providers.value = config.providers
+        sso.value = config.sso ?? null
         patProviders.value = config.patLogin?.providers ?? []
         testingNoAuth.value = config.testingNoAuth ?? false
         localMode.value = config.localMode ?? null
@@ -211,6 +242,8 @@ export const useAuthStore = defineStore(
       user,
       required,
       providers,
+      sso,
+      ssoError,
       patProviders,
       testingNoAuth,
       localMode,

package/app/utils/sso.spec.ts

@@ -0,0 +1,39 @@
+import { describe, expect, it } from 'vitest'
+import { SSO_ERROR_REASONS } from '@cat-factory/contracts'
+import en from '../../i18n/locales/en.json'
+import { SSO_ERROR_MESSAGE_KEYS } from './sso'
+
+// The copy side of the SSO refusal contract. The `Record<SsoLoginFailure, string>` type already
+// forces every reason to name a key, but a key is only a STRING: nothing there checks it exists in
+// the catalog, and a typo renders the raw key path to a user who just failed to sign in. That is
+// the assertion the type and the locale-parity guard structurally cannot make between them (parity
+// compares locales to each other, so a key missing from ALL of them is parity-clean).
+
+/** Resolve a dotted i18n key against the catalog, or undefined when it names nothing. */
+function lookup(key: string): unknown {
+  return key
+    .split('.')
+    .reduce<unknown>(
+      (node, part) =>
+        node && typeof node === 'object' ? (node as Record<string, unknown>)[part] : undefined,
+      en,
+    )
+}
+
+describe('SSO_ERROR_MESSAGE_KEYS', () => {
+  it('covers every wire reason EXACTLY once, plus the newer-backend fallback', () => {
+    // Derived from the vocabulary the backend actually ships rather than a pinned count, so a
+    // reason added there fails here until it has wording instead of silently rendering nothing.
+    expect(Object.keys(SSO_ERROR_MESSAGE_KEYS).sort()).toEqual(
+      [...SSO_ERROR_REASONS, 'unknown'].sort(),
+    )
+  })
+
+  it('names a key that resolves to real copy for every reason', () => {
+    for (const [reason, key] of Object.entries(SSO_ERROR_MESSAGE_KEYS)) {
+      const copy = lookup(key)
+      expect(typeof copy, `${reason} -> ${key}`).toBe('string')
+      expect(copy as string, `${reason} -> ${key}`).not.toBe('')
+    }
+  })
+})

package/app/utils/sso.ts

@@ -0,0 +1,41 @@
+import { type SsoErrorReason } from '@cat-factory/contracts'
+
+// ---------------------------------------------------------------------------
+// Enterprise SSO presentation, in ONE place — the same convention as `utils/vcs.ts`.
+//
+// The backend does not localize prose (CLAUDE.md's i18n rule): a refused SSO round-trip lands
+// back here with a machine-readable reason, and this module is where each reason becomes copy.
+// ---------------------------------------------------------------------------
+
+/**
+ * A failed SSO sign-in as the SPA models it: one of the wire reasons, or `unknown`.
+ *
+ * `unknown` is not a wire value — it is what a reason from a NEWER backend than this build reads
+ * as. Without it the alternatives are rendering the raw wire token to a user or showing nothing
+ * at all after a failed sign-in, and the second is the worse one: the user clicked the button and
+ * came back to the same button.
+ */
+export type SsoLoginFailure = SsoErrorReason | 'unknown'
+
+/**
+ * The copy key per failure. An exhaustive `Record`, so a member added to the wire vocabulary
+ * fails this typecheck until it has wording — the drift guard the `UNAVAILABLE_REASONS` pattern
+ * establishes.
+ *
+ * The wording split matters more than it looks: `group_required` and `domain_not_allowed` are
+ * things the USER takes to their IT team, while `exchange_failed` and `token_invalid` are
+ * OPERATOR faults in the deployment's own configuration. One "sign-in failed" for all four sends
+ * every user to the wrong place.
+ */
+export const SSO_ERROR_MESSAGE_KEYS: Record<SsoLoginFailure, string> = {
+  state_invalid: 'auth.sso.errors.stateInvalid',
+  provider_denied: 'auth.sso.errors.providerDenied',
+  exchange_failed: 'auth.sso.errors.exchangeFailed',
+  token_invalid: 'auth.sso.errors.tokenInvalid',
+  subject_missing: 'auth.sso.errors.subjectMissing',
+  group_required: 'auth.sso.errors.groupRequired',
+  domain_not_allowed: 'auth.sso.errors.domainNotAllowed',
+  email_required: 'auth.sso.errors.emailRequired',
+  provider_unreachable: 'auth.sso.errors.providerUnreachable',
+  unknown: 'auth.sso.errors.unknown',
+}

package/i18n/locales/de.json

@@ -3644,7 +3644,9 @@
       "continueWithConfigured": "Mit konfiguriertem {provider}-PAT anmelden",
       "noPatTitle": "Kein Versionsverwaltungs-Token konfiguriert",
       "noPatBody": "Setzen Sie GITHUB_PAT oder GITLAB_PAT in Ihrer .env, um sich mit einem Personal Access Token anzumelden, und starten Sie dann den Server neu.",
+      "setupBody": "Erstellen Sie einen Personal Access Token und fügen Sie ihn unten ein. Er meldet Sie an und wird zum Token, mit dem diese Installation klont, pusht und merged.",
       "createToken": "Einen {provider}-Token erstellen ↗",
+      "tokenBecomesCredential": "Dieser Token wird auf diesem Rechner gespeichert und für jeden Clone, Push, PR und Merge der Agenten verwendet.",
       "orDivider": "oder",
       "failed": "Anmeldung fehlgeschlagen. Prüfen Sie, ob der konfigurierte Token gültig ist, und versuchen Sie es erneut."
     },
@@ -3675,10 +3677,26 @@
       "signInFailed": "Anmeldung fehlgeschlagen. Prüfen Sie Ihre Angaben und versuchen Sie es erneut.",
       "genericError": "Etwas ist schiefgelaufen. Bitte versuchen Sie es erneut.",
       "notConfiguredTitle": "Authentifizierung ist nicht konfiguriert",
-      "notConfiguredBody": "Für dieses Deployment ist keine Anmeldemethode aktiviert, daher können Sie sich nicht anmelden oder auf Ihre Workspaces zugreifen. Ein Administrator muss einen Authentifizierungs-Provider konfigurieren (GitHub- oder Google-OAuth oder E-Mail-/Passwort-Anmeldung).",
+      "notConfiguredBody": "Für dieses Deployment ist keine Anmeldemethode aktiviert, daher können Sie sich nicht anmelden oder auf Ihre Workspaces zugreifen. Ein Administrator muss einen Authentifizierungs-Provider konfigurieren (Single Sign-on über den Identitätsprovider Ihrer Organisation, GitHub- oder Google-OAuth oder E-Mail-/Passwort-Anmeldung).",
       "patPlaceholder": "{provider} Personal Access Token",
       "signInWithPat": "Mit {provider}-PAT anmelden"
     },
+    "sso": {
+      "continueWith": "Mit {provider} fortfahren",
+      "failedTitle": "Single Sign-on wurde nicht abgeschlossen",
+      "errors": {
+        "stateInvalid": "Dieser Anmeldeversuch ist abgelaufen oder wurde bereits verwendet. Beginnen Sie erneut auf dieser Seite.",
+        "providerDenied": "Ihr Identitätsprovider hat die Anmeldung abgelehnt. Falls Sie sie nicht selbst abgebrochen haben, fragen Sie Ihre IT-Abteilung, ob diese Anwendung Ihnen zugewiesen ist.",
+        "exchangeFailed": "Dieses Deployment konnte den Austausch mit Ihrem Identitätsprovider nicht abschließen. Ein Administrator muss das Single-Sign-on-Client-Secret und die Redirect-URL prüfen.",
+        "tokenInvalid": "Die Antwort Ihres Identitätsproviders konnte nicht verifiziert werden. Ein Administrator muss die Single-Sign-on-Konfiguration dieses Deployments prüfen.",
+        "subjectMissing": "Ihr Identitätsprovider hat keine Benutzerkennung zurückgegeben, daher konnte kein Konto ermittelt werden. Ein Administrator muss prüfen, welche Claims freigegeben werden.",
+        "groupRequired": "Die Anmeldung hat funktioniert, aber Sie sind in keiner Verzeichnisgruppe, die dieses Deployment nutzen darf. Bitten Sie Ihre IT-Abteilung, Sie hinzuzufügen.",
+        "domainNotAllowed": "Ihre E-Mail-Domain darf sich bei diesem Deployment nicht anmelden. Fragen Sie Ihre IT-Abteilung, welches Konto Sie verwenden sollen.",
+        "emailRequired": "Dieses Deployment beschränkt die Anmeldung auf bestimmte E-Mail-Domains, aber Ihr Identitätsprovider hat keine verifizierte E-Mail-Adresse freigegeben. Ein Administrator muss den E-Mail-Claim aktivieren.",
+        "providerUnreachable": "Ihr Identitätsprovider hat beim Abschluss der Anmeldung nicht geantwortet, möglicherweise ist er oder die Verbindung zu ihm gestört. Versuchen Sie es in einem Moment erneut und informieren Sie einen Administrator, falls es weiterhin auftritt.",
+        "unknown": "Single Sign-on ist aus einem Grund fehlgeschlagen, den diese Version nicht kennt. Versuchen Sie es erneut und informieren Sie einen Administrator, falls es weiterhin auftritt."
+      }
+    },
     "resetPassword": {
       "title": "Passwort zurücksetzen",
       "subtitle": "Wählen Sie ein neues Passwort für Ihren Account.",
@@ -5551,6 +5569,7 @@
     "threshold": "Schwellenwert {threshold}",
     "thresholdHint": "Der Wert, den dieser Schritt erreichen musste, aus der Merge-Policy der Aufgabe. Darunter schickt der Judge die Arbeit mit seinen Befunden als Nacharbeit an den erzeugenden Schritt zurück oder parkt den Lauf für Sie, wenn kein Versuchsbudget mehr übrig ist.",
     "rubricOverridden": "Raster des Arbeitsbereichs",
+    "modelPinUnavailable": "Diese Prüfung wurde für das Modell {model} geschrieben, das diese Installation nicht ausführen kann. Die Arbeit wurde daher von einem anderen Modell bewertet.",
     "reworkRounds": "Überarbeitung {spent}/{budget}",
     "findingsHeading": "Was das Bewertungsraster beanstandet hat",
     "roundsHeading": "Prüfrunden",

package/i18n/locales/en.json

@@ -1884,7 +1884,9 @@
       "continueWithConfigured": "Sign in with configured {provider} PAT",
       "noPatTitle": "No source-control token configured",
       "noPatBody": "Set GITHUB_PAT or GITLAB_PAT in your .env to sign in with a personal access token, then restart the server.",
+      "setupBody": "Create a personal access token and paste it below. It signs you in and becomes the token this deployment clones, pushes and merges with.",
       "createToken": "Create a {provider} token ↗",
+      "tokenBecomesCredential": "This token is stored on this machine and used for every clone, push, PR and merge the agents make.",
       "orDivider": "or",
       "failed": "Sign-in failed. Check that the configured token is valid and try again."
     },
@@ -1918,10 +1920,32 @@
       "signInFailed": "Sign-in failed. Check your details and try again.",
       "genericError": "Something went wrong. Please try again.",
       "notConfiguredTitle": "Authentication isn't configured",
-      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (GitHub or Google OAuth, or email and password login).",
+      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (single sign-on through your organization's identity provider, GitHub or Google OAuth, or email and password login).",
       "patPlaceholder": "{provider} personal access token",
       "signInWithPat": "Sign in with {provider} PAT"
     },
+    "sso": {
+      "continueWith": "Continue with {provider}",
+      "@continueWith": {
+        "description": "Sign-in button for the deployment's own identity provider (enterprise SSO). {provider} is the operator-configured label (AUTH_SSO_LABEL) naming their IdP, e.g. \"Acme SSO\" or \"Okta\" - it is a proper noun supplied at runtime, so never translate the interpolated value."
+      },
+      "failedTitle": "Single sign-on didn't complete",
+      "@failedTitle": {
+        "description": "Title of the alert shown when an enterprise single-sign-on round-trip came back without a session. The per-reason detail underneath is the matching `errors.*` message."
+      },
+      "errors": {
+        "stateInvalid": "That sign-in attempt has expired or was already used. Start again from this page.",
+        "providerDenied": "Your identity provider refused the sign-in. If you didn't cancel it yourself, ask your IT team whether this application is assigned to you.",
+        "exchangeFailed": "This deployment couldn't complete the exchange with your identity provider. An administrator needs to check its single sign-on client secret and redirect URL.",
+        "tokenInvalid": "The response from your identity provider couldn't be verified. An administrator needs to check this deployment's single sign-on configuration.",
+        "subjectMissing": "Your identity provider didn't return a user identifier, so no account could be resolved. An administrator needs to check which claims it releases.",
+        "groupRequired": "Your sign-in worked, but you aren't in a directory group that's allowed to use this deployment. Ask your IT team to add you.",
+        "domainNotAllowed": "Your email domain isn't allowed to sign in to this deployment. Ask your IT team which account to use.",
+        "emailRequired": "This deployment restricts sign-in by email domain, but your identity provider didn't release a verified email address. An administrator needs to enable the email claim.",
+        "providerUnreachable": "Your identity provider didn't respond while your sign-in was being completed, so it or the network to it may be down. Try again in a moment, and tell an administrator if it keeps happening.",
+        "unknown": "Single sign-on failed for a reason this version doesn't recognise. Try again, and tell an administrator if it keeps happening."
+      }
+    },
     "resetPassword": {
       "title": "Reset password",
       "subtitle": "Choose a new password for your account.",
@@ -4910,6 +4934,7 @@
     "threshold": "threshold {threshold}",
     "thresholdHint": "The score this step had to reach, taken from the task's merge policy. Below it the judge sends the work back to the step that produced it, with its findings as rework, or parks the run for you when no attempt budget is left.",
     "rubricOverridden": "workspace rubric",
+    "modelPinUnavailable": "This review was written for the {model} model, which this deployment cannot run, so another model scored the work.",
     "reworkRounds": "rework {spent}/{budget}",
     "findingsHeading": "What the rubric flagged",
     "roundsHeading": "Review rounds",

package/i18n/locales/es.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Inicia sesión con el PAT de {provider} configurado",
       "noPatTitle": "No hay ningún token de control de versiones configurado",
       "noPatBody": "Define GITHUB_PAT o GITLAB_PAT en tu .env para iniciar sesión con un token de acceso personal y reinicia el servidor.",
+      "setupBody": "Crea un token de acceso personal y pégalo abajo. Inicia tu sesión y pasa a ser el token con el que esta instalación clona, publica y fusiona.",
       "createToken": "Crear un token de {provider} ↗",
+      "tokenBecomesCredential": "Este token se guarda en esta máquina y se usa en cada clonado, push, PR y fusión que hacen los agentes.",
       "orDivider": "o",
       "failed": "Error al iniciar sesión. Comprueba que el token configurado sea válido e inténtalo de nuevo."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "Error al iniciar sesión. Revisa tus datos e inténtalo de nuevo.",
       "genericError": "Algo salió mal. Inténtalo de nuevo.",
       "notConfiguredTitle": "La autenticación no está configurada",
-      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
+      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (inicio de sesión único mediante el proveedor de identidad de tu organización, OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
       "patPlaceholder": "Token de acceso personal de {provider}",
       "signInWithPat": "Iniciar sesión con un PAT de {provider}"
     },
+    "sso": {
+      "continueWith": "Continuar con {provider}",
+      "failedTitle": "El inicio de sesión único no se completó",
+      "errors": {
+        "stateInvalid": "Ese intento de inicio de sesión ha caducado o ya se usó. Vuelve a empezar desde esta página.",
+        "providerDenied": "Tu proveedor de identidad rechazó el inicio de sesión. Si no lo cancelaste tú, pregunta a tu equipo de TI si esta aplicación está asignada a ti.",
+        "exchangeFailed": "Este despliegue no pudo completar el intercambio con tu proveedor de identidad. Un administrador debe revisar el secreto de cliente y la URL de redirección del inicio de sesión único.",
+        "tokenInvalid": "No se pudo verificar la respuesta de tu proveedor de identidad. Un administrador debe revisar la configuración de inicio de sesión único de este despliegue.",
+        "subjectMissing": "Tu proveedor de identidad no devolvió un identificador de usuario, por lo que no se pudo resolver ninguna cuenta. Un administrador debe revisar qué claims publica.",
+        "groupRequired": "Te has autenticado correctamente, pero no perteneces a ningún grupo del directorio autorizado a usar este despliegue. Pide a tu equipo de TI que te añada.",
+        "domainNotAllowed": "Tu dominio de correo no tiene permitido iniciar sesión en este despliegue. Pregunta a tu equipo de TI qué cuenta debes usar.",
+        "emailRequired": "Este despliegue restringe el inicio de sesión por dominio de correo, pero tu proveedor de identidad no publicó una dirección de correo verificada. Un administrador debe habilitar el claim de correo.",
+        "providerUnreachable": "Tu proveedor de identidad no respondió mientras se completaba el inicio de sesión, por lo que puede estar caído o sin conexión. Vuelve a intentarlo en un momento y avisa a un administrador si sigue ocurriendo.",
+        "unknown": "El inicio de sesión único falló por un motivo que esta versión no reconoce. Inténtalo de nuevo y avisa a un administrador si sigue ocurriendo."
+      }
+    },
     "resetPassword": {
       "title": "Restablecer contraseña",
       "subtitle": "Elige una nueva contraseña para tu cuenta.",
@@ -4693,6 +4711,7 @@
     "threshold": "umbral {threshold}",
     "thresholdHint": "La puntuacion que este paso tenia que alcanzar, tomada de la politica de fusion de la tarea. Por debajo, el juez devuelve el trabajo al paso que lo produjo con sus hallazgos como retrabajo, o aparca la ejecucion para ti cuando ya no queda presupuesto de intentos.",
     "rubricOverridden": "rúbrica del espacio de trabajo",
+    "modelPinUnavailable": "Esta revisión se escribió para el modelo {model}, que esta instalación no puede ejecutar, así que otro modelo puntuó el trabajo.",
     "reworkRounds": "revisión {spent}/{budget}",
     "findingsHeading": "Lo que señaló la rúbrica",
     "roundsHeading": "Rondas de revisión",

package/i18n/locales/fr.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Se connecter avec le PAT {provider} configuré",
       "noPatTitle": "Aucun jeton de gestion de versions configuré",
       "noPatBody": "Définissez GITHUB_PAT ou GITLAB_PAT dans votre .env pour vous connecter avec un jeton d'accès personnel, puis redémarrez le serveur.",
+      "setupBody": "Créez un jeton d'accès personnel et collez-le ci-dessous. Il vous connecte et devient le jeton avec lequel cette installation clone, pousse et fusionne.",
       "createToken": "Créer un jeton {provider} ↗",
+      "tokenBecomesCredential": "Ce jeton est stocké sur cette machine et utilisé pour chaque clone, push, PR et fusion des agents.",
       "orDivider": "ou",
       "failed": "Échec de la connexion. Vérifiez que le jeton configuré est valide et réessayez."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "Échec de la connexion. Vérifiez vos informations et réessayez.",
       "genericError": "Une erreur s'est produite. Veuillez réessayer.",
       "notConfiguredTitle": "L'authentification n'est pas configurée",
-      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
+      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (authentification unique via le fournisseur d'identité de votre organisation, OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
       "patPlaceholder": "Jeton d'accès personnel {provider}",
       "signInWithPat": "Se connecter avec un PAT {provider}"
     },
+    "sso": {
+      "continueWith": "Continuer avec {provider}",
+      "failedTitle": "L'authentification unique n'a pas abouti",
+      "errors": {
+        "stateInvalid": "Cette tentative de connexion a expiré ou a déjà été utilisée. Recommencez depuis cette page.",
+        "providerDenied": "Votre fournisseur d'identité a refusé la connexion. Si vous ne l'avez pas annulée vous-même, demandez à votre service informatique si cette application vous est attribuée.",
+        "exchangeFailed": "Ce déploiement n'a pas pu finaliser l'échange avec votre fournisseur d'identité. Un administrateur doit vérifier le secret client et l'URL de redirection de l'authentification unique.",
+        "tokenInvalid": "La réponse de votre fournisseur d'identité n'a pas pu être vérifiée. Un administrateur doit vérifier la configuration de l'authentification unique de ce déploiement.",
+        "subjectMissing": "Votre fournisseur d'identité n'a pas renvoyé d'identifiant utilisateur, aucun compte n'a donc pu être résolu. Un administrateur doit vérifier les claims qu'il expose.",
+        "groupRequired": "Votre connexion a réussi, mais vous n'appartenez à aucun groupe de l'annuaire autorisé à utiliser ce déploiement. Demandez à votre service informatique de vous ajouter.",
+        "domainNotAllowed": "Votre domaine de messagerie n'est pas autorisé à se connecter à ce déploiement. Demandez à votre service informatique quel compte utiliser.",
+        "emailRequired": "Ce déploiement limite la connexion à certains domaines de messagerie, mais votre fournisseur d'identité n'a pas transmis d'adresse e-mail vérifiée. Un administrateur doit activer le claim e-mail.",
+        "providerUnreachable": "Votre fournisseur d'identité n'a pas répondu pendant la finalisation de la connexion : lui-même ou le réseau qui y mène est peut-être indisponible. Réessayez dans un instant et prévenez un administrateur si cela persiste.",
+        "unknown": "L'authentification unique a échoué pour une raison que cette version ne reconnaît pas. Réessayez et prévenez un administrateur si le problème persiste."
+      }
+    },
     "resetPassword": {
       "title": "Réinitialiser le mot de passe",
       "subtitle": "Choisissez un nouveau mot de passe pour votre compte.",
@@ -4693,6 +4711,7 @@
     "threshold": "seuil {threshold}",
     "thresholdHint": "Le score que cette etape devait atteindre, issu de la politique de fusion de la tache. En dessous, le juge renvoie le travail a l'etape qui l'a produit avec ses constats a reprendre, ou met l'execution en attente pour vous quand il ne reste plus de budget de tentatives.",
     "rubricOverridden": "grille de l'espace de travail",
+    "modelPinUnavailable": "Cette revue a été écrite pour le modèle {model}, que ce déploiement ne peut pas exécuter : un autre modèle a donc noté le travail.",
     "reworkRounds": "reprise {spent}/{budget}",
     "findingsHeading": "Ce que la grille a signalé",
     "roundsHeading": "Tours de revue",

package/i18n/locales/he.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "התחבר באמצעות PAT מוגדר של {provider}",
       "noPatTitle": "לא הוגדר טוקן לבקרת מקור",
       "noPatBody": "הגדר את GITHUB_PAT או GITLAB_PAT בקובץ ה-.env שלך כדי להתחבר עם טוקן גישה אישי, ואז הפעל מחדש את השרת.",
+      "setupBody": "צור טוקן גישה אישי והדבק אותו למטה. הוא מחבר אותך וגם הופך לטוקן שבו ההתקנה הזו משכפלת, דוחפת וממזגת.",
       "createToken": "צור טוקן {provider} ↗",
+      "tokenBecomesCredential": "הטוקן נשמר במחשב הזה ומשמש לכל שכפול, דחיפה, PR ומיזוג שהסוכנים מבצעים.",
       "orDivider": "או",
       "failed": "ההתחברות נכשלה. ודא שהטוקן המוגדר תקף ונסה שוב."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "ההתחברות נכשלה. בדוק את הפרטים שלך ונסה שוב.",
       "genericError": "משהו השתבש. אנא נסה שוב.",
       "notConfiguredTitle": "האימות אינו מוגדר",
-      "notConfiguredBody": "בפריסה זו לא מופעלת אף שיטת התחברות, ולכן לא ניתן להתחבר או לגשת למרחבי העבודה שלך. מנהל המערכת צריך להגדיר ספק אימות (GitHub או Google OAuth, או התחברות עם אימייל וסיסמה).",
+      "notConfiguredBody": "בפריסה זו לא מופעלת אף שיטת התחברות, ולכן לא ניתן להתחבר או לגשת למרחבי העבודה שלך. מנהל המערכת צריך להגדיר ספק אימות (התחברות מאוחדת דרך ספק הזהויות של הארגון שלכם, GitHub או Google OAuth, או התחברות עם אימייל וסיסמה).",
       "patPlaceholder": "אסימון גישה אישי של {provider}",
       "signInWithPat": "התחברות עם PAT של {provider}"
     },
+    "sso": {
+      "continueWith": "המשך עם {provider}",
+      "failedTitle": "ההתחברות המאוחדת לא הושלמה",
+      "errors": {
+        "stateInvalid": "ניסיון ההתחברות הזה פג או שכבר נעשה בו שימוש. התחילו מחדש מדף זה.",
+        "providerDenied": "ספק הזהויות שלכם דחה את ההתחברות. אם לא ביטלתם אותה בעצמכם, בדקו עם צוות ה-IT אם היישום הזה מוקצה לכם.",
+        "exchangeFailed": "הפריסה הזו לא הצליחה להשלים את ההחלפה עם ספק הזהויות שלכם. מנהל המערכת צריך לבדוק את סוד הלקוח ואת כתובת ההפניה של ההתחברות המאוחדת.",
+        "tokenInvalid": "לא ניתן היה לאמת את התשובה מספק הזהויות שלכם. מנהל המערכת צריך לבדוק את הגדרות ההתחברות המאוחדת של הפריסה.",
+        "subjectMissing": "ספק הזהויות לא החזיר מזהה משתמש, ולכן לא ניתן היה לאתר חשבון. מנהל המערכת צריך לבדוק אילו claims הוא חושף.",
+        "groupRequired": "ההתחברות הצליחה, אך אינכם חברים בקבוצת ספרייה שמורשית להשתמש בפריסה הזו. בקשו מצוות ה-IT להוסיף אתכם.",
+        "domainNotAllowed": "הדומיין של האימייל שלכם אינו מורשה להתחבר לפריסה הזו. בדקו עם צוות ה-IT באיזה חשבון להשתמש.",
+        "emailRequired": "הפריסה הזו מגבילה התחברות לפי דומיין אימייל, אך ספק הזהויות לא חשף כתובת אימייל מאומתת. מנהל המערכת צריך להפעיל את claim האימייל.",
+        "providerUnreachable": "ספק הזהויות שלך לא הגיב בעת השלמת ההתחברות, ולכן ייתכן שהוא או הרשת אליו אינם זמינים. נסו שוב בעוד רגע, ואם התקלה חוזרת דווחו למנהל המערכת.",
+        "unknown": "ההתחברות המאוחדת נכשלה מסיבה שגרסה זו אינה מזהה. נסו שוב, ואם התקלה חוזרת עדכנו את מנהל המערכת."
+      }
+    },
     "resetPassword": {
       "title": "אפס סיסמה",
       "subtitle": "בחר סיסמה חדשה לחשבונך.",
@@ -4693,6 +4711,7 @@
     "threshold": "סף {threshold}",
     "thresholdHint": "הציון שהשלב הזה היה צריך להגיע אליו, לפי מדיניות המיזוג של המשימה. מתחת לכך השופט מחזיר את העבודה לשלב שיצר אותה, עם הממצאים לתיקון, או משהה עבורכם את ההרצה כשלא נותר תקציב ניסיונות.",
     "rubricOverridden": "מחוון סביבת העבודה",
+    "modelPinUnavailable": "הביקורת הזו נכתבה עבור המודל {model}, שהפריסה הזו לא יכולה להריץ, ולכן מודל אחר ניקד את העבודה.",
     "reworkRounds": "עיבוד מחדש {spent}/{budget}",
     "findingsHeading": "מה שהמחוון סימן",
     "roundsHeading": "סבבי בדיקה",

package/i18n/locales/it.json

@@ -3644,7 +3644,9 @@
       "continueWithConfigured": "Accedi con il PAT {provider} configurato",
       "noPatTitle": "Nessun token di controllo del codice sorgente configurato",
       "noPatBody": "Imposta GITHUB_PAT o GITLAB_PAT nel tuo file .env per accedere con un personal access token, poi riavvia il server.",
+      "setupBody": "Crea un personal access token e incollalo qui sotto. Ti autentica e diventa il token con cui questa installazione clona, pubblica e unisce.",
       "createToken": "Crea un token {provider} ↗",
+      "tokenBecomesCredential": "Questo token viene salvato su questa macchina e usato per ogni clone, push, PR e merge degli agenti.",
       "orDivider": "oppure",
       "failed": "Accesso non riuscito. Verifica che il token configurato sia valido e riprova."
     },
@@ -3675,10 +3677,26 @@
       "signInFailed": "Accesso non riuscito. Controlla i tuoi dati e riprova.",
       "genericError": "Qualcosa è andato storto. Riprova.",
       "notConfiguredTitle": "L'autenticazione non è configurata",
-      "notConfiguredBody": "Questo deployment non ha alcun metodo di accesso abilitato, quindi non puoi accedere o utilizzare i tuoi workspace. Un amministratore deve configurare un provider di autenticazione (OAuth GitHub o Google, oppure accesso con email e password).",
+      "notConfiguredBody": "Questo deployment non ha alcun metodo di accesso abilitato, quindi non puoi accedere o utilizzare i tuoi workspace. Un amministratore deve configurare un provider di autenticazione (accesso unico tramite il provider di identità della tua organizzazione, OAuth GitHub o Google, oppure accesso con email e password).",
       "patPlaceholder": "personal access token {provider}",
       "signInWithPat": "Accedi con il PAT {provider}"
     },
+    "sso": {
+      "continueWith": "Continua con {provider}",
+      "failedTitle": "L'accesso unico non è stato completato",
+      "errors": {
+        "stateInvalid": "Questo tentativo di accesso è scaduto o è già stato usato. Riprova da questa pagina.",
+        "providerDenied": "Il tuo provider di identità ha rifiutato l'accesso. Se non l'hai annullato tu, chiedi al team IT se questa applicazione ti è stata assegnata.",
+        "exchangeFailed": "Questo deployment non ha potuto completare lo scambio con il tuo provider di identità. Un amministratore deve verificare il client secret e l'URL di reindirizzamento dell'accesso unico.",
+        "tokenInvalid": "Non è stato possibile verificare la risposta del tuo provider di identità. Un amministratore deve controllare la configurazione dell'accesso unico di questo deployment.",
+        "subjectMissing": "Il tuo provider di identità non ha restituito un identificatore utente, quindi non è stato possibile risolvere alcun account. Un amministratore deve controllare quali claim vengono esposti.",
+        "groupRequired": "L'accesso è riuscito, ma non appartieni a nessun gruppo della directory autorizzato a usare questo deployment. Chiedi al team IT di aggiungerti.",
+        "domainNotAllowed": "Il tuo dominio email non è autorizzato ad accedere a questo deployment. Chiedi al team IT quale account usare.",
+        "emailRequired": "Questo deployment limita l'accesso per dominio email, ma il tuo provider di identità non ha esposto un indirizzo email verificato. Un amministratore deve abilitare il claim email.",
+        "providerUnreachable": "Il tuo provider di identità non ha risposto durante il completamento dell'accesso, quindi potrebbe non essere raggiungibile. Riprova tra un momento e avvisa un amministratore se il problema persiste.",
+        "unknown": "L'accesso unico è fallito per un motivo che questa versione non riconosce. Riprova e avvisa un amministratore se il problema persiste."
+      }
+    },
     "resetPassword": {
       "title": "Reimposta password",
       "subtitle": "Scegli una nuova password per il tuo account.",
@@ -5551,6 +5569,7 @@
     "threshold": "soglia {threshold}",
     "thresholdHint": "Il punteggio che questo step doveva raggiungere, preso dalla policy di merge dell'attivita. Al di sotto il giudice rimanda il lavoro allo step che lo ha prodotto, con i suoi rilievi da correggere, oppure mette in pausa l'esecuzione per te quando non resta budget di tentativi.",
     "rubricOverridden": "rubrica dello spazio di lavoro",
+    "modelPinUnavailable": "Questa revisione è stata scritta per il modello {model}, che questa installazione non può eseguire, quindi il lavoro è stato valutato da un altro modello.",
     "reworkRounds": "revisione {spent}/{budget}",
     "findingsHeading": "Cosa ha segnalato la rubrica",
     "roundsHeading": "Cicli di revisione",

package/i18n/locales/ja.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "設定済みの {provider} PAT でサインイン",
       "noPatTitle": "ソース管理トークンが設定されていません",
       "noPatBody": ".env に GITHUB_PAT または GITLAB_PAT を設定するとパーソナルアクセストークンでサインインできます。設定後、サーバーを再起動してください。",
+      "setupBody": "パーソナルアクセストークンを作成して下に貼り付けてください。サインインに使われるとともに、この環境がクローン・プッシュ・マージに使うトークンになります。",
       "createToken": "{provider} トークンを作成 ↗",
+      "tokenBecomesCredential": "このトークンはこのマシンに保存され、エージェントによるクローン・プッシュ・PR・マージのすべてに使われます。",
       "orDivider": "または",
       "failed": "サインインに失敗しました。設定されたトークンが有効か確認して、もう一度お試しください。"
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "サインインに失敗しました。入力内容を確認して、もう一度お試しください。",
       "genericError": "問題が発生しました。もう一度お試しください。",
       "notConfiguredTitle": "認証が設定されていません",
-      "notConfiguredBody": "このデプロイにはサインイン方法が有効になっていないため、サインインやワークスペースへのアクセスができません。管理者が認証プロバイダー（GitHub または Google の OAuth、あるいはメールアドレスとパスワードによるログイン）を設定する必要があります。",
+      "notConfiguredBody": "このデプロイにはサインイン方法が有効になっていないため、サインインやワークスペースへのアクセスができません。管理者が認証プロバイダー（組織の ID プロバイダーによるシングルサインオン、GitHub または Google の OAuth、あるいはメールアドレスとパスワードによるログイン）を設定する必要があります。",
       "patPlaceholder": "{provider} のパーソナルアクセストークン",
       "signInWithPat": "{provider} の PAT でサインイン"
     },
+    "sso": {
+      "continueWith": "{provider} で続行",
+      "failedTitle": "シングルサインオンを完了できませんでした",
+      "errors": {
+        "stateInvalid": "このサインイン試行は期限切れか、すでに使用されています。このページからやり直してください。",
+        "providerDenied": "ID プロバイダーがサインインを拒否しました。ご自身でキャンセルしていない場合は、このアプリケーションが割り当てられているか IT 部門に確認してください。",
+        "exchangeFailed": "このデプロイは ID プロバイダーとの交換を完了できませんでした。管理者がシングルサインオンのクライアントシークレットとリダイレクト URL を確認する必要があります。",
+        "tokenInvalid": "ID プロバイダーからの応答を検証できませんでした。管理者がこのデプロイのシングルサインオン設定を確認する必要があります。",
+        "subjectMissing": "ID プロバイダーがユーザー識別子を返さなかったため、アカウントを特定できませんでした。管理者が公開しているクレームを確認する必要があります。",
+        "groupRequired": "サインインは成功しましたが、このデプロイの利用を許可されたディレクトリグループに所属していません。IT 部門に追加を依頼してください。",
+        "domainNotAllowed": "お使いのメールドメインはこのデプロイへのサインインを許可されていません。どのアカウントを使うべきか IT 部門に確認してください。",
+        "emailRequired": "このデプロイはメールドメインでサインインを制限していますが、ID プロバイダーが検証済みのメールアドレスを公開しませんでした。管理者がメールクレームを有効にする必要があります。",
+        "providerUnreachable": "サインインの完了中に ID プロバイダーから応答がありませんでした。プロバイダー自体か、そこへのネットワークが停止している可能性があります。少し待ってからもう一度お試しいただき、繰り返す場合は管理者にお知らせください。",
+        "unknown": "このバージョンが認識できない理由でシングルサインオンに失敗しました。もう一度お試しいただき、繰り返す場合は管理者にご連絡ください。"
+      }
+    },
     "resetPassword": {
       "title": "パスワードをリセット",
       "subtitle": "アカウントの新しいパスワードを選択してください。",
@@ -4693,6 +4711,7 @@
     "threshold": "しきい値 {threshold}",
     "thresholdHint": "このステップが達成すべきスコアで、タスクのマージポリシーから取られます。これを下回ると、ジャッジは指摘事項を手戻りとして生成元のステップに差し戻すか、試行回数の予算が尽きている場合は実行を保留してあなたの判断を待ちます。",
     "rubricOverridden": "ワークスペースのルーブリック",
+    "modelPinUnavailable": "このレビューは {model} モデル向けに書かれていますが、このデプロイでは実行できないため、別のモデルが作業を採点しました。",
     "reworkRounds": "手戻り {spent}/{budget}",
     "findingsHeading": "ルーブリックが指摘した点",
     "roundsHeading": "レビューの回数",

package/i18n/locales/pl.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Zaloguj się skonfigurowanym tokenem PAT {provider}",
       "noPatTitle": "Nie skonfigurowano tokenu systemu kontroli wersji",
       "noPatBody": "Ustaw GITHUB_PAT lub GITLAB_PAT w pliku .env, aby zalogować się za pomocą osobistego tokenu dostępu, a następnie zrestartuj serwer.",
+      "setupBody": "Utwórz osobisty token dostępu i wklej go poniżej. Zaloguje Cię i stanie się tokenem, którym ta instalacja klonuje, wypycha zmiany i scala.",
       "createToken": "Utwórz token {provider} ↗",
+      "tokenBecomesCredential": "Token jest zapisywany na tym komputerze i używany przy każdym klonowaniu, wypchnięciu, PR i scaleniu wykonywanym przez agentów.",
       "orDivider": "lub",
       "failed": "Logowanie nie powiodło się. Sprawdź, czy skonfigurowany token jest prawidłowy, i spróbuj ponownie."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "Logowanie nie powiodło się. Sprawdź swoje dane i spróbuj ponownie.",
       "genericError": "Coś poszło nie tak. Spróbuj ponownie.",
       "notConfiguredTitle": "Uwierzytelnianie nie jest skonfigurowane",
-      "notConfiguredBody": "To wdrożenie nie ma włączonej żadnej metody logowania, więc nie możesz się zalogować ani uzyskać dostępu do swoich przestrzeni roboczych. Administrator musi skonfigurować dostawcę uwierzytelniania (OAuth GitHub lub Google albo logowanie e-mailem i hasłem).",
+      "notConfiguredBody": "To wdrożenie nie ma włączonej żadnej metody logowania, więc nie możesz się zalogować ani uzyskać dostępu do swoich przestrzeni roboczych. Administrator musi skonfigurować dostawcę uwierzytelniania (logowanie jednokrotne przez dostawcę tożsamości Twojej organizacji, OAuth GitHub lub Google albo logowanie e-mailem i hasłem).",
       "patPlaceholder": "Osobisty token dostępu {provider}",
       "signInWithPat": "Zaloguj się tokenem PAT {provider}"
     },
+    "sso": {
+      "continueWith": "Kontynuuj z {provider}",
+      "failedTitle": "Nie udało się ukończyć logowania jednokrotnego",
+      "errors": {
+        "stateInvalid": "Ta próba logowania wygasła lub została już użyta. Zacznij ponownie z tej strony.",
+        "providerDenied": "Twój dostawca tożsamości odrzucił logowanie. Jeśli nie anulowałeś go samodzielnie, zapytaj zespół IT, czy ta aplikacja jest do Ciebie przypisana.",
+        "exchangeFailed": "To wdrożenie nie mogło zakończyć wymiany z dostawcą tożsamości. Administrator musi sprawdzić sekret klienta i adres przekierowania logowania jednokrotnego.",
+        "tokenInvalid": "Nie udało się zweryfikować odpowiedzi dostawcy tożsamości. Administrator musi sprawdzić konfigurację logowania jednokrotnego tego wdrożenia.",
+        "subjectMissing": "Dostawca tożsamości nie zwrócił identyfikatora użytkownika, więc nie udało się ustalić konta. Administrator musi sprawdzić, które oświadczenia (claims) są udostępniane.",
+        "groupRequired": "Logowanie się udało, ale nie należysz do żadnej grupy katalogowej uprawnionej do korzystania z tego wdrożenia. Poproś zespół IT o dodanie Cię.",
+        "domainNotAllowed": "Twoja domena e-mail nie ma uprawnień do logowania w tym wdrożeniu. Zapytaj zespół IT, którego konta użyć.",
+        "emailRequired": "To wdrożenie ogranicza logowanie do wybranych domen e-mail, ale dostawca tożsamości nie udostępnił zweryfikowanego adresu e-mail. Administrator musi włączyć oświadczenie e-mail.",
+        "providerUnreachable": "Twój dostawca tożsamości nie odpowiedział podczas kończenia logowania, więc on sam lub połączenie z nim może być niedostępne. Spróbuj ponownie po chwili, a jeśli problem się powtarza, powiadom administratora.",
+        "unknown": "Logowanie jednokrotne nie powiodło się z powodu, którego ta wersja nie rozpoznaje. Spróbuj ponownie, a jeśli problem się powtarza, powiadom administratora."
+      }
+    },
     "resetPassword": {
       "title": "Zresetuj hasło",
       "subtitle": "Wybierz nowe hasło do swojego konta.",
@@ -4693,6 +4711,7 @@
     "threshold": "próg {threshold}",
     "thresholdHint": "Wynik, który ten krok musiał osiągnąć, wzięty z polityki scalania zadania. Poniżej sędzia odsyła pracę do kroku, który ją wytworzył, przekazując swoje uwagi do poprawy, albo wstrzymuje przebieg i czeka na Ciebie, gdy skończy się budżet prób.",
     "rubricOverridden": "rubryka przestrzeni roboczej",
+    "modelPinUnavailable": "Ta ocena została napisana dla modelu {model}, którego to wdrożenie nie może uruchomić, więc pracę ocenił inny model.",
     "reworkRounds": "poprawki {spent}/{budget}",
     "findingsHeading": "Co zgłosiła rubryka",
     "roundsHeading": "Rundy przeglądu",

package/i18n/locales/tr.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Yapılandırılmış {provider} PAT ile oturum aç",
       "noPatTitle": "Yapılandırılmış kaynak denetimi token'ı yok",
       "noPatBody": "Kişisel erişim token'ı ile oturum açmak için .env dosyanızda GITHUB_PAT veya GITLAB_PAT ayarlayın, ardından sunucuyu yeniden başlatın.",
+      "setupBody": "Bir kişisel erişim token’ı oluşturup aşağıya yapıştırın. Hem oturumunuzu açar hem de bu kurulumun klonlama, push ve birleştirme işlemlerinde kullandığı token olur.",
       "createToken": "{provider} token'ı oluştur ↗",
+      "tokenBecomesCredential": "Bu token bu makinede saklanır ve ajanların yaptığı her klonlama, push, PR ve birleştirmede kullanılır.",
       "orDivider": "veya",
       "failed": "Oturum açma başarısız. Yapılandırılan token'ın geçerli olduğunu kontrol edip tekrar deneyin."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "Oturum açma başarısız. Bilgilerinizi kontrol edip tekrar deneyin.",
       "genericError": "Bir şeyler ters gitti. Lütfen tekrar deneyin.",
       "notConfiguredTitle": "Kimlik doğrulama yapılandırılmamış",
-      "notConfiguredBody": "Bu dağıtımda etkin bir oturum açma yöntemi yok, bu nedenle oturum açamaz veya çalışma alanlarınıza erişemezsiniz. Bir yönetici, bir kimlik doğrulama sağlayıcısı (GitHub veya Google OAuth ya da e-posta ve parola ile oturum açma) yapılandırmalıdır.",
+      "notConfiguredBody": "Bu dağıtımda etkin bir oturum açma yöntemi yok, bu nedenle oturum açamaz veya çalışma alanlarınıza erişemezsiniz. Bir yönetici, bir kimlik doğrulama sağlayıcısı (kuruluşunuzun kimlik sağlayıcısı üzerinden tek oturum açma, GitHub veya Google OAuth ya da e-posta ve parola ile oturum açma) yapılandırmalıdır.",
       "patPlaceholder": "{provider} kişisel erişim belirteci",
       "signInWithPat": "{provider} PAT ile oturum aç"
     },
+    "sso": {
+      "continueWith": "{provider} ile devam et",
+      "failedTitle": "Tek oturum açma tamamlanamadı",
+      "errors": {
+        "stateInvalid": "Bu oturum açma denemesinin süresi doldu veya daha önce kullanıldı. Bu sayfadan yeniden başlayın.",
+        "providerDenied": "Kimlik sağlayıcınız oturum açmayı reddetti. İptal eden siz değilseniz, bu uygulamanın size atanıp atanmadığını BT ekibinize sorun.",
+        "exchangeFailed": "Bu dağıtım, kimlik sağlayıcınızla değişimi tamamlayamadı. Bir yöneticinin tek oturum açma istemci parolasını ve yönlendirme adresini kontrol etmesi gerekiyor.",
+        "tokenInvalid": "Kimlik sağlayıcınızdan gelen yanıt doğrulanamadı. Bir yöneticinin bu dağıtımın tek oturum açma yapılandırmasını kontrol etmesi gerekiyor.",
+        "subjectMissing": "Kimlik sağlayıcınız bir kullanıcı tanımlayıcısı döndürmedi, bu nedenle hiçbir hesap çözümlenemedi. Bir yöneticinin hangi taleplerin (claims) paylaşıldığını kontrol etmesi gerekiyor.",
+        "groupRequired": "Oturum açma başarılı oldu, ancak bu dağıtımı kullanmasına izin verilen bir dizin grubunda değilsiniz. BT ekibinizden sizi eklemesini isteyin.",
+        "domainNotAllowed": "E-posta alan adınızın bu dağıtımda oturum açma izni yok. Hangi hesabı kullanmanız gerektiğini BT ekibinize sorun.",
+        "emailRequired": "Bu dağıtım oturum açmayı e-posta alan adına göre kısıtlıyor, ancak kimlik sağlayıcınız doğrulanmış bir e-posta adresi paylaşmadı. Bir yöneticinin e-posta talebini etkinleştirmesi gerekiyor.",
+        "providerUnreachable": "Oturum açma işlemi tamamlanırken kimlik sağlayıcınız yanıt vermedi; sağlayıcı ya da ona giden ağ çalışmıyor olabilir. Biraz sonra yeniden deneyin, sorun sürerse bir yöneticiye bildirin.",
+        "unknown": "Tek oturum açma, bu sürümün tanımadığı bir nedenle başarısız oldu. Tekrar deneyin ve sorun sürerse bir yöneticiye bildirin."
+      }
+    },
     "resetPassword": {
       "title": "Parolayı sıfırla",
       "subtitle": "Hesabınız için yeni bir parola seçin.",
@@ -4693,6 +4711,7 @@
     "threshold": "eşik {threshold}",
     "thresholdHint": "Bu adımın ulaşması gereken puan; görevin birleştirme politikasından alınır. Altında kaldığında hakem, bulgularını yeniden çalışma olarak ekleyip işi üreten adıma geri gönderir; deneme bütçesi kalmadıysa çalıştırmayı sizin için beklemeye alır.",
     "rubricOverridden": "çalışma alanı ölçütü",
+    "modelPinUnavailable": "Bu inceleme {model} modeli için yazıldı ancak bu kurulum onu çalıştıramıyor, bu yüzden işi başka bir model puanladı.",
     "reworkRounds": "yeniden çalışma {spent}/{budget}",
     "findingsHeading": "Ölçütün işaretledikleri",
     "roundsHeading": "İnceleme turları",

package/i18n/locales/uk.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Увійти за допомогою налаштованого PAT {provider}",
       "noPatTitle": "Токен системи контролю версій не налаштовано",
       "noPatBody": "Установіть GITHUB_PAT або GITLAB_PAT у файлі .env, щоб увійти за допомогою особистого токена доступу, потім перезапустіть сервер.",
+      "setupBody": "Створіть особистий токен доступу та вставте його нижче. Він виконає вхід і стане токеном, яким ця інсталяція клонує, надсилає зміни та зливає гілки.",
       "createToken": "Створити токен {provider} ↗",
+      "tokenBecomesCredential": "Токен зберігається на цій машині й використовується для кожного клонування, надсилання, PR та злиття, які роблять агенти.",
       "orDivider": "або",
       "failed": "Не вдалося увійти. Перевірте, що налаштований токен дійсний, і спробуйте ще раз."
     },
@@ -1820,10 +1822,26 @@
       "signInFailed": "Не вдалося увійти. Перевірте свої дані та спробуйте ще раз.",
       "genericError": "Щось пішло не так. Спробуйте ще раз.",
       "notConfiguredTitle": "Автентифікацію не налаштовано",
-      "notConfiguredBody": "У цьому розгортанні не ввімкнено жодного способу входу, тому ви не можете увійти чи отримати доступ до своїх робочих просторів. Адміністратор має налаштувати постачальника автентифікації (OAuth GitHub або Google чи вхід за електронною поштою та паролем).",
+      "notConfiguredBody": "У цьому розгортанні не ввімкнено жодного способу входу, тому ви не можете увійти чи отримати доступ до своїх робочих просторів. Адміністратор має налаштувати постачальника автентифікації (єдиний вхід через постачальника ідентифікації вашої організації, OAuth GitHub або Google чи вхід за електронною поштою та паролем).",
       "patPlaceholder": "Особистий токен доступу {provider}",
       "signInWithPat": "Увійти за допомогою PAT {provider}"
     },
+    "sso": {
+      "continueWith": "Продовжити з {provider}",
+      "failedTitle": "Єдиний вхід не завершено",
+      "errors": {
+        "stateInvalid": "Ця спроба входу застаріла або вже була використана. Почніть знову з цієї сторінки.",
+        "providerDenied": "Ваш постачальник ідентифікації відмовив у вході. Якщо ви не скасовували його самостійно, запитайте у своєї ІТ-команди, чи призначено вам цей застосунок.",
+        "exchangeFailed": "Це розгортання не змогло завершити обмін із вашим постачальником ідентифікації. Адміністратор має перевірити клієнтський секрет і URL перенаправлення єдиного входу.",
+        "tokenInvalid": "Не вдалося перевірити відповідь вашого постачальника ідентифікації. Адміністратор має перевірити налаштування єдиного входу цього розгортання.",
+        "subjectMissing": "Постачальник ідентифікації не повернув ідентифікатора користувача, тому обліковий запис не вдалося визначити. Адміністратор має перевірити, які claims він передає.",
+        "groupRequired": "Вхід відбувся успішно, але ви не належите до жодної групи каталогу, якій дозволено користуватися цим розгортанням. Попросіть ІТ-команду додати вас.",
+        "domainNotAllowed": "Вашому домену електронної пошти не дозволено входити до цього розгортання. Запитайте в ІТ-команди, який обліковий запис використати.",
+        "emailRequired": "Це розгортання обмежує вхід за доменом електронної пошти, але ваш постачальник ідентифікації не передав підтвердженої адреси. Адміністратор має увімкнути claim електронної пошти.",
+        "providerUnreachable": "Ваш постачальник ідентифікації не відповів під час завершення входу, тож він або мережа до нього можуть бути недоступні. Спробуйте ще раз за мить, а якщо це повторюється, повідомте адміністратора.",
+        "unknown": "Єдиний вхід не вдався з причини, якої ця версія не розпізнає. Спробуйте ще раз, а якщо проблема повторюється, повідомте адміністратора."
+      }
+    },
     "resetPassword": {
       "title": "Скинути пароль",
       "subtitle": "Виберіть новий пароль для свого облікового запису.",
@@ -4693,6 +4711,7 @@
     "threshold": "поріг {threshold}",
     "thresholdHint": "Оцінка, якої мав досягти цей крок, узята з політики злиття завдання. Нижче за неї суддя повертає роботу до кроку, що її створив, разом зі своїми зауваженнями на доопрацювання, або ставить запуск на паузу для вас, коли бюджет спроб вичерпано.",
     "rubricOverridden": "рубрика робочого простору",
+    "modelPinUnavailable": "Цю перевірку написано для моделі {model}, яку це розгортання не може запустити, тож роботу оцінила інша модель.",
     "reworkRounds": "доопрацювання {spent}/{budget}",
     "findingsHeading": "Що позначила рубрика",
     "roundsHeading": "Раунди перевірки",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.229.0",
+  "version": "0.231.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.246.0"
+    "@cat-factory/contracts": "0.248.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",