@cat-factory/app 0.26.7 → 0.28.0

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -8,7 +8,7 @@
 // The latter three are body-only section components rendered in tabs here (no longer
 // standalone modals).
 import { reactive, ref, watch } from 'vue'
-import type { CreateTaskType, TaskLimitMode } from '~/types/domain'
+import type { CreateTaskType, TaskLimitMode, WorkspaceSettings } from '~/types/domain'
 import MergeThresholdsPanel from '~/components/settings/MergeThresholdsPanel.vue'
 import IssueTrackerPanel from '~/components/settings/IssueTrackerPanel.vue'
 import ServiceFragmentDefaultsPanel from '~/components/settings/ServiceFragmentDefaultsPanel.vue'
@@ -36,6 +36,7 @@ const tabs = [
     icon: 'i-lucide-sliders-horizontal',
     slot: 'workspace',
   },
+  { value: 'budget', label: 'Budget', icon: 'i-lucide-wallet', slot: 'budget' },
   { value: 'merge', label: 'Merge thresholds', icon: 'i-lucide-git-merge', slot: 'merge' },
   {
     value: 'tracker',
@@ -64,6 +65,10 @@ const draft = reactive({
   taskLimitMode: 'off' as TaskLimitMode,
   taskLimitShared: 5 as number,
   perType: {} as Record<CreateTaskType, number>,
+  // Budget: empty string ⇒ "use the built-in default" (null on the wire).
+  spendCurrency: '',
+  spendMonthlyLimit: '',
+  spendModelPrices: '',
 })
 
 function hydrate() {
@@ -73,6 +78,9 @@ function hydrate() {
   draft.taskLimitShared = s.taskLimitShared ?? 5
   const pt = s.taskLimitPerType ?? {}
   for (const t of TASK_TYPES) draft.perType[t] = pt[t] ?? 3
+  draft.spendCurrency = s.spendCurrency ?? ''
+  draft.spendMonthlyLimit = s.spendMonthlyLimit == null ? '' : String(s.spendMonthlyLimit)
+  draft.spendModelPrices = s.spendModelPrices ? JSON.stringify(s.spendModelPrices, null, 2) : ''
 }
 
 watch(() => store.settings, hydrate, { immediate: true, deep: true })
@@ -109,6 +117,45 @@ async function save() {
     saving.value = false
   }
 }
+
+const savingBudget = ref(false)
+
+async function saveBudget() {
+  // Parse the optional per-model price overrides JSON (blank ⇒ no overrides).
+  let prices: WorkspaceSettings['spendModelPrices'] = null
+  const raw = draft.spendModelPrices.trim()
+  if (raw) {
+    try {
+      prices = JSON.parse(raw)
+    } catch {
+      toast.add({
+        title: 'Per-model prices must be valid JSON',
+        icon: 'i-lucide-triangle-alert',
+        color: 'error',
+      })
+      return
+    }
+  }
+  savingBudget.value = true
+  try {
+    await store.update({
+      spendCurrency: draft.spendCurrency.trim() ? draft.spendCurrency.trim().toUpperCase() : null,
+      spendMonthlyLimit:
+        draft.spendMonthlyLimit.trim() === '' ? null : Number(draft.spendMonthlyLimit),
+      spendModelPrices: prices,
+    })
+    toast.add({ title: 'Budget saved', icon: 'i-lucide-check', color: 'success' })
+  } catch (e) {
+    toast.add({
+      title: 'Could not save budget',
+      description: e instanceof Error ? e.message : String(e),
+      icon: 'i-lucide-triangle-alert',
+      color: 'error',
+    })
+  } finally {
+    savingBudget.value = false
+  }
+}
 </script>
 
 <template>
@@ -195,6 +242,74 @@ async function save() {
           </div>
         </template>
 
+        <!-- Budget -->
+        <template #budget>
+          <div class="space-y-6">
+            <section class="space-y-2">
+              <h3 class="text-sm font-semibold text-slate-200">Monthly spend budget</h3>
+              <p class="text-[11px] text-slate-400">
+                Token usage is metered per LLM call, priced, and gated by this budget — when
+                reached, runs in this workspace pause and the board shows a warning. Leave blank to
+                inherit the built-in default (~100&nbsp;EUR/month).
+              </p>
+              <div class="grid grid-cols-2 gap-3">
+                <label class="block">
+                  <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
+                    Monthly limit
+                  </span>
+                  <UInput
+                    v-model="draft.spendMonthlyLimit"
+                    type="number"
+                    :min="0"
+                    placeholder="Default"
+                    size="sm"
+                  />
+                </label>
+                <label class="block">
+                  <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
+                    Currency (ISO 4217)
+                  </span>
+                  <UInput
+                    v-model="draft.spendCurrency"
+                    placeholder="EUR"
+                    maxlength="3"
+                    size="sm"
+                    class="uppercase"
+                  />
+                </label>
+              </div>
+            </section>
+
+            <section class="space-y-2">
+              <h3 class="text-sm font-semibold text-slate-200">Per-model price overrides</h3>
+              <p class="text-[11px] text-slate-400">
+                Optional. JSON object of <code>"provider:model"</code> (or a bare
+                <code>"provider"</code>) → <code>{ inputPerMillion, outputPerMillion }</code>,
+                overlaid on the built-in price table. Leave blank to use the defaults.
+              </p>
+              <UTextarea
+                v-model="draft.spendModelPrices"
+                :rows="6"
+                size="sm"
+                class="w-full font-mono text-[11px]"
+                placeholder='{"openai:gpt-4o":{"inputPerMillion":2.3,"outputPerMillion":9.2}}'
+              />
+            </section>
+
+            <div class="flex justify-end">
+              <UButton
+                color="primary"
+                icon="i-lucide-save"
+                size="sm"
+                :loading="savingBudget"
+                @click="saveBudget"
+              >
+                Save budget
+              </UButton>
+            </div>
+          </div>
+        </template>
+
         <!-- Merge thresholds -->
         <template #merge>
           <MergeThresholdsPanel />

package/app/composables/api/accounts.ts

@@ -7,6 +7,7 @@ import type {
   EmailConnection,
   UpdateAccountInput,
 } from '~/types/domain'
+import type { AccountSettingsView, UpdateAccountSettingsInput } from '~/types/accountSettings'
 import type { ApiContext } from './context'
 
 /** Account (tenancy) management: orgs, members, invitations + the email sender. */
@@ -77,5 +78,16 @@ export function accountsApi({ http }: ApiContext) {
         method: 'POST',
         body: { to },
       }),
+
+    // Per-account deployment settings (admin only): integration secrets (Slack OAuth +
+    // web-search keys), sealed at rest. Read returns config + non-secret summary only.
+    getAccountSettings: (accountId: string) =>
+      http<AccountSettingsView>(`/accounts/${encodeURIComponent(accountId)}/settings`),
+
+    updateAccountSettings: (accountId: string, body: UpdateAccountSettingsInput) =>
+      http<AccountSettingsView>(`/accounts/${encodeURIComponent(accountId)}/settings`, {
+        method: 'PUT',
+        body,
+      }),
   }
 }

package/app/composables/api/releaseHealth.ts

@@ -4,6 +4,10 @@ import type {
   UpsertObservabilityConnectionInput,
   UpsertReleaseHealthConfigInput,
 } from '~/types/releaseHealth'
+import type {
+  IncidentEnrichmentView,
+  UpsertIncidentEnrichmentInput,
+} from '~/types/incidentEnrichment'
 import type { ApiContext } from './context'
 
 /** Post-release-health: the observability connection + per-block monitor/SLO mapping. */
@@ -40,5 +44,18 @@ export function releaseHealthApi({ http, ws }: ApiContext) {
       http(`${ws(workspaceId)}/release-health-configs/${encodeURIComponent(blockId)}`, {
         method: 'DELETE',
       }),
+
+    // ---- Incident enrichment (PagerDuty + incident.io, write-only secrets) --
+    getIncidentEnrichment: (workspaceId: string) =>
+      http<IncidentEnrichmentView>(`${ws(workspaceId)}/incident-enrichment`),
+
+    setIncidentEnrichment: (workspaceId: string, body: UpsertIncidentEnrichmentInput) =>
+      http<IncidentEnrichmentView>(`${ws(workspaceId)}/incident-enrichment`, {
+        method: 'PUT',
+        body,
+      }),
+
+    deleteIncidentEnrichment: (workspaceId: string) =>
+      http(`${ws(workspaceId)}/incident-enrichment`, { method: 'DELETE' }),
   }
 }

package/app/composables/api/sandbox.ts

@@ -0,0 +1,57 @@
+import type {
+  CloneSandboxPromptInput,
+  CreateSandboxExperimentInput,
+  SandboxExperiment,
+  SandboxExperimentDetail,
+  SandboxFixture,
+  SandboxOverview,
+  SandboxPromptVersion,
+  SaveSandboxVersionInput,
+} from '~/types/sandbox'
+import type { ApiContext } from './context'
+
+/**
+ * The Sandbox API (the parallel prompt/model testing surface): manage versioned prompt
+ * candidates + the fixture library, define experiments (prompt × model × fixture), and
+ * launch one to run + grade every cell. Opt-in: every endpoint 503s when the deployment
+ * hasn't wired the Sandbox (its dedicated DB / schema).
+ */
+export function sandboxApi({ http, ws }: ApiContext) {
+  const base = (workspaceId: string) => `${ws(workspaceId)}/sandbox`
+  return {
+    getSandboxOverview: (workspaceId: string) =>
+      http<SandboxOverview>(`${base(workspaceId)}/overview`),
+
+    // ---- prompt versions -------------------------------------------------
+    cloneSandboxPrompt: (workspaceId: string, body: CloneSandboxPromptInput) =>
+      http<SandboxPromptVersion>(`${base(workspaceId)}/prompts/clone`, { method: 'POST', body }),
+    saveSandboxVersion: (workspaceId: string, body: SaveSandboxVersionInput) =>
+      http<SandboxPromptVersion>(`${base(workspaceId)}/prompts`, { method: 'POST', body }),
+    setSandboxPromptLabels: (workspaceId: string, promptId: string, labels: string[]) =>
+      http<SandboxPromptVersion>(
+        `${base(workspaceId)}/prompts/${encodeURIComponent(promptId)}/labels`,
+        { method: 'PATCH', body: { labels } },
+      ),
+    archiveSandboxPrompt: (workspaceId: string, promptId: string) =>
+      http(`${base(workspaceId)}/prompts/${encodeURIComponent(promptId)}`, { method: 'DELETE' }),
+
+    // ---- fixtures --------------------------------------------------------
+    createSandboxFixture: (workspaceId: string, body: Partial<SandboxFixture>) =>
+      http<SandboxFixture>(`${base(workspaceId)}/fixtures`, { method: 'POST', body }),
+    deleteSandboxFixture: (workspaceId: string, fixtureId: string) =>
+      http(`${base(workspaceId)}/fixtures/${encodeURIComponent(fixtureId)}`, { method: 'DELETE' }),
+
+    // ---- experiments -----------------------------------------------------
+    createSandboxExperiment: (workspaceId: string, body: CreateSandboxExperimentInput) =>
+      http<SandboxExperiment>(`${base(workspaceId)}/experiments`, { method: 'POST', body }),
+    getSandboxExperiment: (workspaceId: string, experimentId: string) =>
+      http<SandboxExperimentDetail>(
+        `${base(workspaceId)}/experiments/${encodeURIComponent(experimentId)}`,
+      ),
+    launchSandboxExperiment: (workspaceId: string, experimentId: string) =>
+      http<SandboxExperimentDetail>(
+        `${base(workspaceId)}/experiments/${encodeURIComponent(experimentId)}/launch`,
+        { method: 'POST' },
+      ),
+  }
+}

package/app/composables/useApi.ts

@@ -15,6 +15,7 @@ import { presetsApi } from './api/presets'
 import { providerConnectionsApi } from './api/providerConnections'
 import { recurringApi } from './api/recurring'
 import { releaseHealthApi } from './api/releaseHealth'
+import { sandboxApi } from './api/sandbox'
 import { reviewsApi } from './api/reviews'
 import { slackApi } from './api/slack'
 import { specApi } from './api/spec'
@@ -89,6 +90,7 @@ export function useApi() {
     ...providerConnectionsApi(ctx),
     ...releaseHealthApi(ctx),
     ...recurringApi(ctx),
+    ...sandboxApi(ctx),
     ...githubApi(ctx),
     ...slackApi(ctx),
     ...bootstrapApi(ctx),

package/app/pages/index.vue

@@ -33,6 +33,7 @@ import ProviderConnectionPanel from '~/components/settings/ProviderConnectionPan
 import ProviderConfigBanner from '~/components/layout/ProviderConfigBanner.vue'
 import ModelConfigurationPanel from '~/components/settings/ModelConfigurationPanel.vue'
 import LocalModelEndpointsPanel from '~/components/settings/LocalModelEndpointsPanel.vue'
+import SandboxPanel from '~/components/sandbox/SandboxPanel.vue'
 import UserSecretsSection from '~/components/settings/UserSecretsSection.vue'
 import OpenRouterCatalogPanel from '~/components/settings/OpenRouterCatalogPanel.vue'
 import VendorCredentialsModal from '~/components/providers/VendorCredentialsModal.vue'
@@ -189,6 +190,7 @@ watch(
       <ProviderConnectionPanel />
       <ModelConfigurationPanel />
       <LocalModelEndpointsPanel />
+      <SandboxPanel />
       <UserSecretsSection />
       <OpenRouterCatalogPanel />
       <VendorCredentialsModal />

package/app/stores/accountSettings.ts

@@ -0,0 +1,49 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import type { AccountSettingsView, UpdateAccountSettingsInput } from '~/types/accountSettings'
+
+/**
+ * Per-account deployment settings (admin only): the integration secrets — Slack app OAuth
+ * credentials + the web-search upstream keys — sealed at rest in the DB. Secrets are
+ * write-only: this store only ever holds the non-secret `summary` (which integrations are
+ * configured), never the values. `available` mirrors the backend opt-in: a 503 (no
+ * ENCRYPTION_KEY) hides the panel. Loaded on demand from the account-settings panel.
+ */
+export const useAccountSettingsStore = defineStore('accountSettings', () => {
+  const api = useApi()
+
+  const view = ref<AccountSettingsView | null>(null)
+  const loading = ref(false)
+  const available = ref<boolean | null>(null)
+
+  async function load(accountId: string) {
+    loading.value = true
+    try {
+      view.value = await api.getAccountSettings(accountId)
+      available.value = true
+    } catch (e) {
+      // 503 ⇒ the settings store isn't wired (no ENCRYPTION_KEY) ⇒ hide the panel.
+      if (
+        e &&
+        typeof e === 'object' &&
+        'statusCode' in e &&
+        (e as { statusCode?: number }).statusCode === 503
+      ) {
+        available.value = false
+        view.value = null
+      } else {
+        throw e
+      }
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function save(accountId: string, input: UpdateAccountSettingsInput) {
+    view.value = await api.updateAccountSettings(accountId, input)
+    available.value = true
+    return view.value
+  }
+
+  return { view, loading, available, load, save }
+})

package/app/stores/releaseHealth.ts

@@ -6,6 +6,10 @@ import type {
   UpsertObservabilityConnectionInput,
   UpsertReleaseHealthConfigInput,
 } from '~/types/releaseHealth'
+import type {
+  IncidentEnrichmentView,
+  UpsertIncidentEnrichmentInput,
+} from '~/types/incidentEnrichment'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -23,6 +27,10 @@ export const useReleaseHealthStore = defineStore('releaseHealth', () => {
     summary: null,
   })
   const configs = ref<ReleaseHealthConfig[]>([])
+  // Incident-enrichment (PagerDuty + incident.io) connection — write-only secrets, the
+  // store only ever holds the presence summary. Wired alongside observability.
+  const incident = ref<IncidentEnrichmentView>({ connected: false, summary: null })
+  const incidentAvailable = ref<boolean | null>(null)
   const loading = ref(false)
   // Mirrors the backend's opt-in gate (`OBSERVABILITY_ENABLED`): `null` until first
   // probed, then `true`/`false`. The hub + inspector hide their observability entry
@@ -95,9 +103,35 @@ export const useReleaseHealthStore = defineStore('releaseHealth', () => {
     configs.value = configs.value.filter((c) => c.blockId !== blockId)
   }
 
+  /** Load the incident-enrichment connection (separate opt-in gate from observability). */
+  async function loadIncident() {
+    const ws = useWorkspaceStore()
+    try {
+      incident.value = await api.getIncidentEnrichment(ws.requireId())
+      incidentAvailable.value = true
+    } catch {
+      incidentAvailable.value = false
+      incident.value = { connected: false, summary: null }
+    }
+  }
+
+  async function saveIncident(input: UpsertIncidentEnrichmentInput) {
+    const ws = useWorkspaceStore()
+    incident.value = await api.setIncidentEnrichment(ws.requireId(), input)
+    incidentAvailable.value = true
+  }
+
+  async function removeIncident() {
+    const ws = useWorkspaceStore()
+    await api.deleteIncidentEnrichment(ws.requireId())
+    incident.value = { connected: false, summary: null }
+  }
+
   return {
     connection,
     configs,
+    incident,
+    incidentAvailable,
     loading,
     available,
     load,
@@ -107,5 +141,8 @@ export const useReleaseHealthStore = defineStore('releaseHealth', () => {
     configForBlock,
     saveConfig,
     removeConfig,
+    loadIncident,
+    saveIncident,
+    removeIncident,
   }
 })

package/app/stores/sandbox.ts

@@ -0,0 +1,174 @@
+import { defineStore } from 'pinia'
+import { computed, ref } from 'vue'
+import type { ModelOption } from '~/types/domain'
+import type {
+  CreateSandboxExperimentInput,
+  SandboxAgentKindMeta,
+  SandboxExperiment,
+  SandboxExperimentDetail,
+  SandboxFixture,
+  SandboxOverview,
+  SandboxPromptVersion,
+} from '~/types/sandbox'
+import { useWorkspaceStore } from '~/stores/workspace'
+
+/**
+ * The Sandbox (parallel prompt/model testing surface). Loaded on demand when the panel
+ * opens (it's an opt-in, secondary surface, not part of the board snapshot): the testable
+ * agent-kind catalog, the shipped baselines + stored candidate prompt versions, the
+ * fixture library, and experiment definitions. Running an experiment grades every cell
+ * with a judge model; `launch` returns the full result grid.
+ */
+export const useSandboxStore = defineStore('sandbox', () => {
+  const api = useApi()
+
+  const available = ref(true)
+  const loading = ref(false)
+  const error = ref<string | null>(null)
+
+  const agentKinds = ref<SandboxAgentKindMeta[]>([])
+  const prompts = ref<SandboxPromptVersion[]>([])
+  const fixtures = ref<SandboxFixture[]>([])
+  const experiments = ref<SandboxExperiment[]>([])
+  const models = ref<ModelOption[]>([])
+  /** The matrix cell cap (from the backend overview, so the builder gates on the same limit). */
+  const maxCells = ref(100)
+
+  /** The currently-opened experiment's full detail (result grid), if any. */
+  const detail = ref<SandboxExperimentDetail | null>(null)
+  const launching = ref(false)
+
+  function hydrate(overview: SandboxOverview) {
+    agentKinds.value = overview.agentKinds
+    prompts.value = overview.prompts
+    fixtures.value = overview.fixtures
+    experiments.value = [...overview.experiments].sort((a, b) => b.createdAt - a.createdAt)
+    maxCells.value = overview.maxCells
+  }
+
+  /** Patch one experiment into the list in place (newest-first), without a full reload. */
+  function upsertExperiment(experiment: SandboxExperiment) {
+    const next = experiments.value.filter((e) => e.id !== experiment.id)
+    next.push(experiment)
+    experiments.value = next.sort((a, b) => b.createdAt - a.createdAt)
+  }
+
+  /** Load the overview + the workspace model catalog. The 503 (feature off) is surfaced. */
+  async function load() {
+    const ws = useWorkspaceStore()
+    if (!ws.workspaceId) return
+    loading.value = true
+    error.value = null
+    try {
+      const [overview, modelList] = await Promise.all([
+        api.getSandboxOverview(ws.requireId()),
+        api.getWorkspaceModels(ws.requireId()),
+      ])
+      hydrate(overview)
+      models.value = modelList
+      available.value = true
+    } catch (e) {
+      const status =
+        (e as { statusCode?: number; response?: { status?: number } })?.statusCode ??
+        (e as { response?: { status?: number } })?.response?.status
+      if (status === 503) {
+        available.value = false
+      } else {
+        error.value = e instanceof Error ? e.message : String(e)
+      }
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** Selectable models for the experiment picker (the backend computed `available`). */
+  const selectableModels = computed(() => models.value.filter((m) => m.available !== false))
+
+  /** Prompt versions for one agent kind (baselines first, then candidates). */
+  function promptsForKind(agentKind: string): SandboxPromptVersion[] {
+    return prompts.value.filter((p) => p.agentKind === agentKind)
+  }
+
+  /** Fixtures authored for one agent kind, filtered by the catalog's `fixtureKinds`. */
+  function fixturesForKind(agentKind: string): SandboxFixture[] {
+    const meta = agentKinds.value.find((k) => k.agentKind === agentKind)
+    if (!meta) return fixtures.value
+    // The backend catalog is the source of truth for the fixture↔kind mapping.
+    const wanted = meta.fixtureKinds
+    return fixtures.value.filter((f) => wanted.includes(f.kind))
+  }
+
+  async function clonePrompt(agentKind: string, basePromptId: string | null, name?: string) {
+    const ws = useWorkspaceStore()
+    const created = await api.cloneSandboxPrompt(ws.requireId(), { agentKind, basePromptId, name })
+    await load()
+    return created
+  }
+
+  async function saveVersion(parentId: string, systemText: string) {
+    const ws = useWorkspaceStore()
+    const saved = await api.saveSandboxVersion(ws.requireId(), { parentId, systemText })
+    await load()
+    return saved
+  }
+
+  async function archivePrompt(promptId: string) {
+    const ws = useWorkspaceStore()
+    await api.archiveSandboxPrompt(ws.requireId(), promptId)
+    await load()
+  }
+
+  async function createExperiment(input: CreateSandboxExperimentInput) {
+    const ws = useWorkspaceStore()
+    const created = await api.createSandboxExperiment(ws.requireId(), input)
+    await load()
+    return created
+  }
+
+  async function openExperiment(experimentId: string) {
+    const ws = useWorkspaceStore()
+    detail.value = await api.getSandboxExperiment(ws.requireId(), experimentId)
+    return detail.value
+  }
+
+  async function launch(experimentId: string) {
+    const ws = useWorkspaceStore()
+    launching.value = true
+    try {
+      // `launch` returns the full graded grid AND the updated experiment, so patch both in
+      // place rather than calling `load()`: a transient failure in that follow-up fetch
+      // would otherwise set `error` and hide the freshly-returned result grid behind the
+      // error panel (and re-fetch the whole overview + model catalog for nothing).
+      const result = await api.launchSandboxExperiment(ws.requireId(), experimentId)
+      detail.value = result
+      upsertExperiment(result.experiment)
+      return result
+    } finally {
+      launching.value = false
+    }
+  }
+
+  return {
+    available,
+    loading,
+    error,
+    agentKinds,
+    prompts,
+    fixtures,
+    experiments,
+    models,
+    maxCells,
+    selectableModels,
+    detail,
+    launching,
+    load,
+    promptsForKind,
+    fixturesForKind,
+    clonePrompt,
+    saveVersion,
+    archivePrompt,
+    createExperiment,
+    openExperiment,
+    launch,
+  }
+})

package/app/stores/ui.ts

@@ -104,6 +104,8 @@ export const useUiStore = defineStore('ui', () => {
   const vendorCredentialsOpen = ref(false)
   // Per-user settings panel: the signed-in user's own-machine local model runners.
   const localModelsOpen = ref(false)
+  // The Sandbox (parallel prompt/model testing) surface — an opt-in, on-demand window.
+  const sandboxOpen = ref(false)
   const userSecretsOpen = ref(false)
   // Per-workspace settings panel: the OpenRouter dynamic catalog (browse/enable gateway models).
   const openRouterOpen = ref(false)
@@ -364,6 +366,12 @@ export const useUiStore = defineStore('ui', () => {
   function closeLocalModels() {
     localModelsOpen.value = false
   }
+  function openSandbox() {
+    sandboxOpen.value = true
+  }
+  function closeSandbox() {
+    sandboxOpen.value = false
+  }
   function openUserSecrets() {
     userSecretsOpen.value = true
   }
@@ -464,6 +472,7 @@ export const useUiStore = defineStore('ui', () => {
     modelConfigOpen,
     vendorCredentialsOpen,
     localModelsOpen,
+    sandboxOpen,
     userSecretsOpen,
     openRouterOpen,
     aiProviderSetupOpen,
@@ -528,6 +537,8 @@ export const useUiStore = defineStore('ui', () => {
     closeVendorCredentials,
     openLocalModels,
     closeLocalModels,
+    openSandbox,
+    closeSandbox,
     openUserSecrets,
     closeUserSecrets,
     openOpenRouter,

package/app/stores/workspaceSettings.ts

@@ -9,6 +9,9 @@ const DEFAULTS: WorkspaceSettings = {
   taskLimitMode: 'off',
   taskLimitShared: null,
   taskLimitPerType: null,
+  spendCurrency: null,
+  spendMonthlyLimit: null,
+  spendModelPrices: null,
 }
 
 /**

package/app/types/accountSettings.ts

@@ -0,0 +1,39 @@
+// Per-account (deployment-wide) integration settings. Mirrors
+// `@cat-factory/contracts` accountSettings. Secrets are write-only — the read view
+// returns only `config` + a non-secret presence `summary`.
+
+export interface SlackOAuthSecret {
+  clientId: string
+  clientSecret: string
+  redirectUrl: string
+}
+
+export interface WebSearchSecret {
+  braveApiKey?: string
+  searxngUrl?: string
+  searxngApiKey?: string
+}
+
+/** Non-secret per-account config (empty today; reserved for forward-compatible tuning). */
+export type AccountSettingsConfig = Record<string, never>
+
+export interface AccountSettingsSummary {
+  slackOAuthConfigured: boolean
+  webSearch: 'brave' | 'searxng' | null
+}
+
+export interface AccountSettingsView {
+  config: AccountSettingsConfig
+  summary: AccountSettingsSummary
+}
+
+/**
+ * Admin write. Each secrets group: omit ⇒ leave unchanged, `null` ⇒ clear, value ⇒ set.
+ */
+export interface UpdateAccountSettingsInput {
+  config?: AccountSettingsConfig
+  secrets?: {
+    slackOAuth?: SlackOAuthSecret | null
+    webSearch?: WebSearchSecret | null
+  }
+}