@cat-factory/app 0.230.0 → 0.231.0

package/README.md

@@ -583,7 +583,7 @@ event left to restore it.
 All user-facing SPA copy goes through `@nuxtjs/i18n`; never hard-code a display string. This
 layer ships the base `en` locale, and a downstream deployment overrides by dropping its own files
 (the per-layer deep-merge is the override seam, consumer wins key by key). Migration status:
-[`docs/localization.md`](../../docs/localization.md).
+[`docs/internal/localization.md`](../../docs/internal/localization.md).
 
 - `i18n/locales/<locale>.json`: the catalogs (the v9+ `i18n/` convention, NOT `app/locales/`).
 - `i18n/i18n.config.ts`: runtime vue-i18n behaviour only (fallback locale, the plural

package/app/components/auth/LoginScreen.vue

@@ -9,25 +9,32 @@ import { SSO_ERROR_MESSAGE_KEYS } from '~/utils/sso'
 const auth = useAuthStore()
 const { t } = useI18n()
 
-// Local-mode source-control PAT login. The PAT lives server-side in env (GITHUB_PAT /
-// GITLAB_PAT); the login screen only SELECTS a configured provider — no token is ever typed
-// into or shown in the browser. The brand labels / icons / token-settings URLs are the shared
-// provider descriptors in `~/utils/vcs` (brand names stay verbatim across locales, so they are
-// constants rather than catalog keys — the same convention as ApiKeysSection). The "create a
-// token" link prefers the server's scopes-preselected deep link (`patLogin.setupUrls`); the
-// descriptor's URL is the fallback.
+// Local-mode source-control PAT login. A configured token lives server-side and is selected by
+// PROVIDER (no token is typed into the browser); a deployment that holds none can be handed one
+// here, and it becomes both this sign-in and the credential the deployment operates with. The
+// brand labels / icons / token-settings URLs are the shared provider descriptors in `~/utils/vcs`
+// (brand names stay verbatim across locales, so they are constants rather than catalog keys — the
+// same convention as ApiKeysSection). The "create a token" link prefers the server's
+// scopes-preselected deep link (`patLogin.setupUrls`); the descriptor's URL is the fallback.
 type PatProvider = VcsProvider
+/** Every provider a token page exists for — the fallback link set when none can be installed. */
 const ALL_PROVIDERS: PatProvider[] = ['github', 'gitlab']
 const PROVIDER_LABELS = VCS_PROVIDER_LABELS
 const PROVIDER_ICONS = VCS_PROVIDER_ICONS
 const PROVIDER_TOKEN_URLS = VCS_PROVIDER_TOKEN_URLS
 
 const patLoginCfg = computed(() => auth.localMode?.patLogin)
-// Only providers whose PAT is configured in env can sign in (the token is the operational
-// credential too). A provider without one gets no button — see the no-PAT notice instead.
+// Providers whose token the deployment already holds: one-click sign-in. A provider without one
+// gets no button — it is offered in the paste form below instead.
 const configuredProviders = computed<PatProvider[]>(
   () => (patLoginCfg.value?.configured ?? []) as PatProvider[],
 )
+// Providers the server will ACCEPT a token for from here. Empty when `.env` owns the credential
+// (it wins, so a pasted token would be ignored) or nothing can seal one — the notice then falls
+// back to telling the developer where the token actually has to go.
+const installableProviders = computed<PatProvider[]>(
+  () => (patLoginCfg.value?.installable ?? []) as PatProvider[],
+)
 const isLocalMode = computed(() => auth.localMode?.enabled === true)
 const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
 // Mothership mode: identity + org data live on a hosted mothership, so the primary sign-in is a
@@ -137,13 +144,15 @@ const ssoErrorMessage = computed(() =>
   auth.ssoError ? t(SSO_ERROR_MESSAGE_KEYS[auth.ssoError]) : null,
 )
 
-// Hosted (remote node) PAT login: the user pastes their OWN source-control PAT, which the
-// server resolves to an account and holds to its login/org/domain allowlist. The available
-// providers come from the server (`auth.patProviders`) — GitHub always, GitLab when configured,
-// on both hosted facades (Node + Worker); empty in local mode (which uses the configured-token
-// flow above).
+// Paste-a-token sign-in. The user supplies a source-control PAT and the server resolves it to an
+// account. What it MEANS differs per facade, which is why the providers come from two places:
+//  - hosted (remote node): the user's OWN token, held to the login/org/domain allowlist. GitHub
+//    always, GitLab when configured, on both hosted facades (Node + Worker).
+//  - local: the token also becomes the DEPLOYMENT's credential, so the server names the providers
+//    it will accept one for (`installable`) — empty once `.env` owns it.
+// One form serves both; the local-only hint below says what the token is additionally used for.
 const remotePatProviders = computed<PatProvider[]>(() =>
-  isLocalMode.value ? [] : (auth.patProviders as PatProvider[]),
+  isLocalMode.value ? installableProviders.value : (auth.patProviders as PatProvider[]),
 )
 const remotePatProvider = ref<PatProvider>('github')
 watch(
@@ -251,16 +260,24 @@ const noSignInMethod = computed(
           {{ t('auth.localMode.continueWithConfigured', { provider: PROVIDER_LABELS[p] }) }}
         </UButton>
 
-        <!-- Neither GITHUB_PAT nor GITLAB_PAT is set: tell the developer how to configure one -->
+        <!-- The deployment holds no token. When one can be installed from here the notice says
+             so and the create-token links feed the form below; when it can't (`.env` owns the
+             credential, or nothing can seal one) it names where the token has to go instead. -->
         <template v-if="!hasConfiguredPat">
           <UAlert
             color="warning"
             variant="subtle"
             icon="i-lucide-key-round"
             :title="t('auth.localMode.noPatTitle')"
-            :description="t('auth.localMode.noPatBody')"
+            :description="
+              installableProviders.length > 0
+                ? t('auth.localMode.setupBody')
+                : t('auth.localMode.noPatBody')
+            "
           />
-          <div class="flex flex-wrap gap-3 px-1">
+          <!-- Only when nothing can be installed here: the paste form below carries its own
+               per-provider link, so showing these too would offer the same thing twice. -->
+          <div v-if="installableProviders.length === 0" class="flex flex-wrap gap-3 px-1">
             <a
               v-for="p in ALL_PROVIDERS"
               :key="p"
@@ -423,10 +440,16 @@ const noSignInMethod = computed(
         </p>
       </form>
 
-      <!-- Hosted (remote node) PAT login: paste your own source-control PAT -->
+      <!-- Paste-a-token sign-in: your own PAT on a hosted node; on local mode the token this
+           deployment will operate with (see `remotePatProviders`). -->
       <template v-if="remotePatProviders.length > 0 && mode !== 'forgot'">
         <div
-          v-if="auth.providers.github || auth.providers.google || auth.providers.password"
+          v-if="
+            auth.providers.github ||
+            auth.providers.google ||
+            auth.providers.password ||
+            hasConfiguredPat
+          "
           class="my-4 flex items-center gap-3 text-xs text-slate-500"
         >
           <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.login.or') }}
@@ -471,6 +494,11 @@ const noSignInMethod = computed(
           >
             {{ t('auth.login.signInWithPat', { provider: PROVIDER_LABELS[remotePatProvider] }) }}
           </UButton>
+          <!-- Local mode only: say what else the token is for BEFORE it is handed over, since it
+               becomes the credential every agent step on this machine clones and pushes with. -->
+          <p v-if="isLocalMode" class="px-1 text-xs text-slate-400">
+            {{ t('auth.localMode.tokenBecomesCredential') }}
+          </p>
           <p class="px-1 text-center">
             <a
               :href="tokenCreateUrl(remotePatProvider)"

package/app/docs/consumer-extensions.md

@@ -213,8 +213,8 @@ suite can address a row and the caption inside it.
 Together, `fields` + `defaultFragmentIds` + `defaultPipelineId` are what turns a task type from a
 badge into a **reusable operation**: a canned unit of work an org runs repeatedly with per-case
 input, whose collected values reach every agent's prompt. See
-[`docs/initiatives/reusable-operations.md`](../../../../docs/initiatives/reusable-operations.md)
-and the `org:introduce-api` worked example in `backend/internal/example-custom-agent`.
+[`backend/docs/reusable-operations.md`](../../../../backend/docs/reusable-operations.md) and the
+`org:introduce-api` worked example in `backend/internal/example-custom-agent`.
 
 The **same type can be delivered from the backend** instead of code-shipped: register it on the
 deployment's app-owned `TaskTypeRegistry` and it arrives in the workspace snapshot's

package/i18n/locales/de.json

@@ -3644,7 +3644,9 @@
       "continueWithConfigured": "Mit konfiguriertem {provider}-PAT anmelden",
       "noPatTitle": "Kein Versionsverwaltungs-Token konfiguriert",
       "noPatBody": "Setzen Sie GITHUB_PAT oder GITLAB_PAT in Ihrer .env, um sich mit einem Personal Access Token anzumelden, und starten Sie dann den Server neu.",
+      "setupBody": "Erstellen Sie einen Personal Access Token und fügen Sie ihn unten ein. Er meldet Sie an und wird zum Token, mit dem diese Installation klont, pusht und merged.",
       "createToken": "Einen {provider}-Token erstellen ↗",
+      "tokenBecomesCredential": "Dieser Token wird auf diesem Rechner gespeichert und für jeden Clone, Push, PR und Merge der Agenten verwendet.",
       "orDivider": "oder",
       "failed": "Anmeldung fehlgeschlagen. Prüfen Sie, ob der konfigurierte Token gültig ist, und versuchen Sie es erneut."
     },

package/i18n/locales/en.json

@@ -1884,7 +1884,9 @@
       "continueWithConfigured": "Sign in with configured {provider} PAT",
       "noPatTitle": "No source-control token configured",
       "noPatBody": "Set GITHUB_PAT or GITLAB_PAT in your .env to sign in with a personal access token, then restart the server.",
+      "setupBody": "Create a personal access token and paste it below. It signs you in and becomes the token this deployment clones, pushes and merges with.",
       "createToken": "Create a {provider} token ↗",
+      "tokenBecomesCredential": "This token is stored on this machine and used for every clone, push, PR and merge the agents make.",
       "orDivider": "or",
       "failed": "Sign-in failed. Check that the configured token is valid and try again."
     },

package/i18n/locales/es.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Inicia sesión con el PAT de {provider} configurado",
       "noPatTitle": "No hay ningún token de control de versiones configurado",
       "noPatBody": "Define GITHUB_PAT o GITLAB_PAT en tu .env para iniciar sesión con un token de acceso personal y reinicia el servidor.",
+      "setupBody": "Crea un token de acceso personal y pégalo abajo. Inicia tu sesión y pasa a ser el token con el que esta instalación clona, publica y fusiona.",
       "createToken": "Crear un token de {provider} ↗",
+      "tokenBecomesCredential": "Este token se guarda en esta máquina y se usa en cada clonado, push, PR y fusión que hacen los agentes.",
       "orDivider": "o",
       "failed": "Error al iniciar sesión. Comprueba que el token configurado sea válido e inténtalo de nuevo."
     },

package/i18n/locales/fr.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Se connecter avec le PAT {provider} configuré",
       "noPatTitle": "Aucun jeton de gestion de versions configuré",
       "noPatBody": "Définissez GITHUB_PAT ou GITLAB_PAT dans votre .env pour vous connecter avec un jeton d'accès personnel, puis redémarrez le serveur.",
+      "setupBody": "Créez un jeton d'accès personnel et collez-le ci-dessous. Il vous connecte et devient le jeton avec lequel cette installation clone, pousse et fusionne.",
       "createToken": "Créer un jeton {provider} ↗",
+      "tokenBecomesCredential": "Ce jeton est stocké sur cette machine et utilisé pour chaque clone, push, PR et fusion des agents.",
       "orDivider": "ou",
       "failed": "Échec de la connexion. Vérifiez que le jeton configuré est valide et réessayez."
     },

package/i18n/locales/he.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "התחבר באמצעות PAT מוגדר של {provider}",
       "noPatTitle": "לא הוגדר טוקן לבקרת מקור",
       "noPatBody": "הגדר את GITHUB_PAT או GITLAB_PAT בקובץ ה-.env שלך כדי להתחבר עם טוקן גישה אישי, ואז הפעל מחדש את השרת.",
+      "setupBody": "צור טוקן גישה אישי והדבק אותו למטה. הוא מחבר אותך וגם הופך לטוקן שבו ההתקנה הזו משכפלת, דוחפת וממזגת.",
       "createToken": "צור טוקן {provider} ↗",
+      "tokenBecomesCredential": "הטוקן נשמר במחשב הזה ומשמש לכל שכפול, דחיפה, PR ומיזוג שהסוכנים מבצעים.",
       "orDivider": "או",
       "failed": "ההתחברות נכשלה. ודא שהטוקן המוגדר תקף ונסה שוב."
     },

package/i18n/locales/it.json

@@ -3644,7 +3644,9 @@
       "continueWithConfigured": "Accedi con il PAT {provider} configurato",
       "noPatTitle": "Nessun token di controllo del codice sorgente configurato",
       "noPatBody": "Imposta GITHUB_PAT o GITLAB_PAT nel tuo file .env per accedere con un personal access token, poi riavvia il server.",
+      "setupBody": "Crea un personal access token e incollalo qui sotto. Ti autentica e diventa il token con cui questa installazione clona, pubblica e unisce.",
       "createToken": "Crea un token {provider} ↗",
+      "tokenBecomesCredential": "Questo token viene salvato su questa macchina e usato per ogni clone, push, PR e merge degli agenti.",
       "orDivider": "oppure",
       "failed": "Accesso non riuscito. Verifica che il token configurato sia valido e riprova."
     },

package/i18n/locales/ja.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "設定済みの {provider} PAT でサインイン",
       "noPatTitle": "ソース管理トークンが設定されていません",
       "noPatBody": ".env に GITHUB_PAT または GITLAB_PAT を設定するとパーソナルアクセストークンでサインインできます。設定後、サーバーを再起動してください。",
+      "setupBody": "パーソナルアクセストークンを作成して下に貼り付けてください。サインインに使われるとともに、この環境がクローン・プッシュ・マージに使うトークンになります。",
       "createToken": "{provider} トークンを作成 ↗",
+      "tokenBecomesCredential": "このトークンはこのマシンに保存され、エージェントによるクローン・プッシュ・PR・マージのすべてに使われます。",
       "orDivider": "または",
       "failed": "サインインに失敗しました。設定されたトークンが有効か確認して、もう一度お試しください。"
     },

package/i18n/locales/pl.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Zaloguj się skonfigurowanym tokenem PAT {provider}",
       "noPatTitle": "Nie skonfigurowano tokenu systemu kontroli wersji",
       "noPatBody": "Ustaw GITHUB_PAT lub GITLAB_PAT w pliku .env, aby zalogować się za pomocą osobistego tokenu dostępu, a następnie zrestartuj serwer.",
+      "setupBody": "Utwórz osobisty token dostępu i wklej go poniżej. Zaloguje Cię i stanie się tokenem, którym ta instalacja klonuje, wypycha zmiany i scala.",
       "createToken": "Utwórz token {provider} ↗",
+      "tokenBecomesCredential": "Token jest zapisywany na tym komputerze i używany przy każdym klonowaniu, wypchnięciu, PR i scaleniu wykonywanym przez agentów.",
       "orDivider": "lub",
       "failed": "Logowanie nie powiodło się. Sprawdź, czy skonfigurowany token jest prawidłowy, i spróbuj ponownie."
     },

package/i18n/locales/tr.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Yapılandırılmış {provider} PAT ile oturum aç",
       "noPatTitle": "Yapılandırılmış kaynak denetimi token'ı yok",
       "noPatBody": "Kişisel erişim token'ı ile oturum açmak için .env dosyanızda GITHUB_PAT veya GITLAB_PAT ayarlayın, ardından sunucuyu yeniden başlatın.",
+      "setupBody": "Bir kişisel erişim token’ı oluşturup aşağıya yapıştırın. Hem oturumunuzu açar hem de bu kurulumun klonlama, push ve birleştirme işlemlerinde kullandığı token olur.",
       "createToken": "{provider} token'ı oluştur ↗",
+      "tokenBecomesCredential": "Bu token bu makinede saklanır ve ajanların yaptığı her klonlama, push, PR ve birleştirmede kullanılır.",
       "orDivider": "veya",
       "failed": "Oturum açma başarısız. Yapılandırılan token'ın geçerli olduğunu kontrol edip tekrar deneyin."
     },

package/i18n/locales/uk.json

@@ -1789,7 +1789,9 @@
       "continueWithConfigured": "Увійти за допомогою налаштованого PAT {provider}",
       "noPatTitle": "Токен системи контролю версій не налаштовано",
       "noPatBody": "Установіть GITHUB_PAT або GITLAB_PAT у файлі .env, щоб увійти за допомогою особистого токена доступу, потім перезапустіть сервер.",
+      "setupBody": "Створіть особистий токен доступу та вставте його нижче. Він виконає вхід і стане токеном, яким ця інсталяція клонує, надсилає зміни та зливає гілки.",
       "createToken": "Створити токен {provider} ↗",
+      "tokenBecomesCredential": "Токен зберігається на цій машині й використовується для кожного клонування, надсилання, PR та злиття, які роблять агенти.",
       "orDivider": "або",
       "failed": "Не вдалося увійти. Перевірте, що налаштований токен дійсний, і спробуйте ще раз."
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.230.0",
+  "version": "0.231.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.40",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.247.0"
+    "@cat-factory/contracts": "0.248.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",