@cat-factory/app 0.261.0 → 0.261.1

package/app/components/settings/ConnectionTestVerdict.vue

@@ -0,0 +1,62 @@
+<script setup lang="ts">
+// The verdict of one "Test connection" probe, rendered identically everywhere a connect form
+// offers that button.
+//
+// Its own component because the message stopped being a few words. A failed probe now reports
+// the EXACT transport failure plus what to do about it (kernel's `connectionFailureResult`),
+// which runs to a sentence or three, and the inline `<span>` each form used to carry sat inside
+// a `flex items-center` row beside the button, where a long message squashes the button and
+// overflows the panel. So the result is a block that wraps, and the six forms share it rather
+// than each growing its own copy of the same markup.
+//
+// Two lines, because that account is English by construction and this SPA ships in ten languages.
+// The backend states the failure CLASS as a machine-readable `failureCause`; the headline is that
+// class in the operator's own language, and the backend's prose sits under it as the detail. The
+// detail stays VISIBLE rather than folding behind a disclosure: it is the half that names the
+// concrete host, port and remedy, and a probe verdict is read to find out what to go fix.
+import { computed } from 'vue'
+import type { ConnectionFailureCause } from '@cat-factory/contracts'
+import { CONNECTION_FAILURE_CAUSE_KEYS } from '~/utils/connectionFailures'
+
+const props = defineProps<{
+  /** The probe verdict; null before the first test (renders nothing). */
+  result: { ok: boolean; message?: string; failureCause?: ConnectionFailureCause } | null
+}>()
+
+const { t, te } = useI18n()
+
+/**
+ * The translated-headline key for this failure, or null when there is none: an `unknown` cause, a
+ * cause this SPA build predates, or a failure that was an ANSWER (an HTTP status the provider
+ * mapped itself, which carries no transport cause). In every one of those the backend's own
+ * message becomes the primary line, so a missing translation is never a blank verdict.
+ */
+const causeKey = computed(() => {
+  const cause = props.result && !props.result.ok ? props.result.failureCause : undefined
+  const key = cause ? CONNECTION_FAILURE_CAUSE_KEYS[cause] : null
+  return key && te(key) ? key : null
+})
+
+const headline = computed(() =>
+  causeKey.value
+    ? t(causeKey.value)
+    : (props.result?.message ?? t('settings.providerConnection.test.failed')),
+)
+
+/** The backend's English account, shown only when a headline took the primary line from it. */
+const detail = computed(() => (causeKey.value ? (props.result?.message ?? '') : ''))
+</script>
+
+<template>
+  <p
+    v-if="result?.ok"
+    class="text-xs text-emerald-400 break-words"
+    data-testid="connection-test-result"
+  >
+    {{ result.message ?? t('settings.providerConnection.test.ok') }}
+  </p>
+  <div v-else-if="result" class="space-y-0.5" data-testid="connection-test-result">
+    <p class="text-xs text-rose-400 break-words">{{ headline }}</p>
+    <p v-if="detail" class="text-[11px] text-slate-400 break-words">{{ detail }}</p>
+  </div>
+</template>

package/app/components/settings/InfraHandlersConfigurator.logic.spec.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest'
+import {
+  consumeKubernetesScrollAnchor,
+  type ScrollableSection,
+} from '~/components/settings/InfraHandlersConfigurator.logic'
+
+/**
+ * The `cat-factory k3s` hand-off promises the operator lands on the ONE form the CLI just filled
+ * in. `k3sDeepLink.spec.ts` pins that the link arms the anchor; this pins the other half, that the
+ * panel consumes it exactly once and only when there is something to scroll to.
+ */
+function recorder(): ScrollableSection & { calls: ScrollIntoViewOptions[] } {
+  const calls: ScrollIntoViewOptions[] = []
+  return { calls, scrollIntoView: (options) => calls.push(options) }
+}
+
+describe('consumeKubernetesScrollAnchor', () => {
+  it('scrolls the section into view once the panel and the section are both there', () => {
+    const section = recorder()
+    const outcome = consumeKubernetesScrollAnchor({
+      target: 'kubernetes',
+      available: true,
+      section,
+    })
+
+    expect(outcome).toBe('scrolled')
+    expect(section.calls).toEqual([{ behavior: 'smooth', block: 'start' }])
+  })
+
+  it('does nothing when no anchor is pending, so a plain open never jumps', () => {
+    const section = recorder()
+    expect(consumeKubernetesScrollAnchor({ target: null, available: true, section })).toBe(
+      'not-anchored',
+    )
+    expect(section.calls).toEqual([])
+  })
+
+  it('does nothing while the infra probe is still resolving', () => {
+    // The whole configurator is behind `v-if="infra.available === true"`, and that probe resolves
+    // AFTER the deep link fires: the section cannot be scrolled to before it exists.
+    const section = recorder()
+    expect(consumeKubernetesScrollAnchor({ target: 'kubernetes', available: null, section })).toBe(
+      'not-anchored',
+    )
+    expect(section.calls).toEqual([])
+  })
+
+  it('leaves the anchor for the next attempt when the section has not rendered yet', () => {
+    // `not-rendered` is what keeps the hand-off alive across the render the probe gates: only
+    // `scrolled` tells the caller to clear the store's target, so a miss cannot swallow the link.
+    const first = consumeKubernetesScrollAnchor({
+      target: 'kubernetes',
+      available: true,
+      section: null,
+    })
+    expect(first).toBe('not-rendered')
+
+    const section = recorder()
+    expect(consumeKubernetesScrollAnchor({ target: 'kubernetes', available: true, section })).toBe(
+      'scrolled',
+    )
+    expect(section.calls).toHaveLength(1)
+  })
+})

package/app/components/settings/InfraHandlersConfigurator.logic.ts

@@ -0,0 +1,41 @@
+import type { InfrastructureScrollTarget } from '~/types/providerConnections'
+
+// The deep-link SECTION anchor the `cat-factory k3s` hand-off lands on, as a plain function so the
+// rule is testable: the component half is a `watch` plus an `onMounted` retry, and neither is
+// reachable from a spec (this SPA has no component-mounting harness).
+//
+// The rule that needed pinning is the three-way outcome, not the scroll. The anchor is one-shot and
+// is consumed only once the section is actually IN the DOM, but the section renders behind an async
+// probe, so an attempt that finds nothing must leave the anchor ARMED for the next attempt rather
+// than clear it. Clearing on a miss silently swallows the hand-off on a slow probe; never clearing
+// leaves a dead anchor, which is why "scrolled" is the only outcome the caller acts on and why
+// closing the window drops whatever is left (`closeProviderConnection`).
+
+/** The minimum of an element this needs, so a spec can pass a recorder instead of a DOM node. */
+export interface ScrollableSection {
+  scrollIntoView: (options: ScrollIntoViewOptions) => void
+}
+
+export interface ScrollAnchorAttempt {
+  /** The store's pending anchor, or null when there is nothing to land on. */
+  target: InfrastructureScrollTarget | null
+  /** The infra-probe gate the sections render behind; null while it is still resolving. */
+  available: boolean | null
+  /** The section element, or null when it has not rendered yet. */
+  section: ScrollableSection | null
+}
+
+/**
+ * - `scrolled`: the anchor was honoured and the CALLER must now clear it.
+ * - `not-anchored`: nothing is pending for this section (or the panel is not showing yet).
+ * - `not-rendered`: it IS pending, but the section is not in the DOM, so the anchor stays armed.
+ */
+export type ScrollAnchorOutcome = 'scrolled' | 'not-anchored' | 'not-rendered'
+
+/** Honour a pending Kubernetes-section anchor, reporting which of the three cases this was. */
+export function consumeKubernetesScrollAnchor(attempt: ScrollAnchorAttempt): ScrollAnchorOutcome {
+  if (attempt.target !== 'kubernetes' || attempt.available !== true) return 'not-anchored'
+  if (!attempt.section) return 'not-rendered'
+  attempt.section.scrollIntoView({ behavior: 'smooth', block: 'start' })
+  return 'scrolled'
+}

package/app/components/settings/InfraHandlersConfigurator.vue

@@ -12,7 +12,7 @@
 //                      per custom type (matched to a service's pinned `manifestId`).
 // In LOCAL mode each handler additionally offers a per-USER override (this-machine only),
 // written to the `/me/environment-handlers` endpoints. Drives the infraConfig store.
-import { computed, ref, watch } from 'vue'
+import { computed, nextTick, onMounted, ref, watch } from 'vue'
 import type {
   CustomManifestType,
   EnvironmentHandlerView,
@@ -28,6 +28,8 @@ import KubernetesEngineForm from '~/components/settings/KubernetesEngineForm.vue
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
 import CustomManifestTypeEditor from '~/components/settings/CustomManifestTypeEditor.vue'
 import CloudflareHandlerSection from '~/components/settings/CloudflareHandlerSection.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
+import { consumeKubernetesScrollAnchor } from '~/components/settings/InfraHandlersConfigurator.logic'
 
 const { t } = useI18n()
 const infra = useInfraConfigStore()
@@ -94,6 +96,32 @@ watch(
   { immediate: true },
 )
 
+// Deep-link anchor: the `cat-factory k3s` hand-off opens this window with the ui store's scroll
+// target set to `kubernetes`, so bring that section into view once rather than dropping the
+// operator at the top of the tab to hunt for the form the CLI just described.
+//
+// Attempted from BOTH the watch and `onMounted`, and the anchor is cleared only on a real scroll:
+// the section is behind `v-if="infra.available === true"`, whose probe resolves after the deep link
+// fires, so a single attempt that finds nothing rendered would swallow the hand-off with neither
+// watched value ever changing again to re-drive it. The decision itself is in the logic module,
+// where it is tested.
+const kubeSection = ref<HTMLElement | null>(null)
+async function anchorKubernetesSection() {
+  await nextTick()
+  const outcome = consumeKubernetesScrollAnchor({
+    target: ui.infrastructureScrollTarget,
+    available: infra.available,
+    section: kubeSection.value,
+  })
+  if (outcome === 'scrolled') ui.clearInfrastructureScrollTarget()
+}
+watch([() => ui.infrastructureScrollTarget, () => infra.available], () => {
+  void anchorKubernetesSection()
+})
+onMounted(() => {
+  void anchorKubernetesSection()
+})
+
 const busy = ref(false)
 
 // Connection-probe state for the kube engine forms (workspace + per-user override kept
@@ -400,7 +428,11 @@ function notifyError(e: unknown) {
     <p class="text-xs text-slate-400">{{ t('settings.infrastructure.handler.intro') }}</p>
 
     <!-- kubernetes -->
-    <section class="space-y-2 rounded-lg border border-slate-700 bg-slate-900/40 p-3">
+    <section
+      ref="kubeSection"
+      class="space-y-2 rounded-lg border border-slate-700 bg-slate-900/40 p-3"
+      data-testid="infra-kubernetes-section"
+    >
       <h3 class="text-sm font-semibold text-slate-200">
         {{ t('inspector.testConfig.provisionTypes.kubernetes') }}
       </h3>
@@ -433,7 +465,7 @@ function notifyError(e: unknown) {
           {{ t('settings.infrastructure.handler.activeEngine') }}
           <span class="text-slate-200">{{ kubeHandlerEngineLabel }}</span>
         </p>
-        <div class="flex items-center gap-2 pl-7">
+        <div class="space-y-1.5 pl-7">
           <UButton
             color="neutral"
             variant="soft"
@@ -444,12 +476,7 @@ function notifyError(e: unknown) {
           >
             {{ t('settings.providerConnection.test.button') }}
           </UButton>
-          <span v-if="kubeSavedTestResult?.ok" class="text-xs text-emerald-400">
-            {{ kubeSavedTestResult.message ?? t('settings.providerConnection.test.ok') }}
-          </span>
-          <span v-else-if="kubeSavedTestResult" class="text-xs text-rose-400">
-            {{ kubeSavedTestResult.message ?? t('settings.providerConnection.test.failed') }}
-          </span>
+          <ConnectionTestVerdict :result="kubeSavedTestResult" />
         </div>
       </div>
       <p v-else class="flex items-center gap-1.5 text-[12px] text-slate-500">

package/app/components/settings/KubernetesEngineForm.vue

@@ -9,6 +9,7 @@
 import { computed, reactive, ref, watch } from 'vue'
 import { KUBERNETES_ENV_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
 import SecretInput from '~/components/common/SecretInput.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import type {
   EnvironmentHandlerView,
   InfraEngine,
@@ -75,6 +76,13 @@ const form = reactive({
   urlScheme: 'default' as 'default' | 'http' | 'https',
 })
 const apiToken = ref('')
+// Flag a bad paste ON THE FIELD, before Test is ever clicked. The guided CLI flow ends with
+// "copy this token out of your terminal", and a terminal wraps: a token copied across that wrap
+// carries an invisible newline that survives `.trim()` and can never become an `authorization`
+// header. Left to the probe it comes back as an opaque transport failure minutes later.
+// Destructured at the top level so the template auto-unwraps the refs (a ref nested in a plain
+// object is not unwrapped in a template, only a top-level one is).
+const { blocking: tokenBlocking, message: tokenProblem } = useServiceAccountTokenProblem(apiToken)
 
 const urlSourceItems = computed(() => [
   {
@@ -210,6 +218,7 @@ const canSave = computed(
     !!form.label.trim() &&
     !!form.apiServerUrl.trim() &&
     (tokenStored.value || !!apiToken.value.trim()) &&
+    !tokenBlocking.value &&
     urlValid.value,
 )
 
@@ -232,6 +241,9 @@ const connectBlockedReason = computed(() => {
     missing.push(t('settings.infrastructure.kubernetesEngine.serviceName'))
   if (missing.length)
     return t('settings.providerConnection.form.missingFields', { fields: missing.join(', ') })
+  // Repeated from under the token field, so the disabled button is never left unexplained for a
+  // reader whose eye is on it rather than on the field above.
+  if (tokenBlocking.value) return tokenProblem.value
   return t('settings.infrastructure.kubernetesEngine.invalidPort')
 })
 
@@ -414,6 +426,16 @@ async function copyAutoSetupCommand() {
             : undefined
         "
       />
+      <!-- Rose when the paste is impossible (blocks Test/Save), amber when it is only suspicious
+           and the operator may legitimately overrule it. -->
+      <p
+        v-if="tokenProblem"
+        class="mt-1 text-[11px]"
+        :class="tokenBlocking ? 'text-rose-400' : 'text-amber-400'"
+        data-testid="service-account-token-problem"
+      >
+        {{ tokenProblem }}
+      </p>
     </UFormField>
 
     <!-- URL derivation: how the live environment URL is resolved once the service's
@@ -517,7 +539,7 @@ async function copyAutoSetupCommand() {
       />
     </UFormField>
 
-    <div v-if="supportsTest" class="flex items-center gap-2">
+    <div v-if="supportsTest" class="space-y-1.5">
       <UButton
         color="neutral"
         variant="soft"
@@ -529,12 +551,7 @@ async function copyAutoSetupCommand() {
       >
         {{ t('settings.providerConnection.test.button') }}
       </UButton>
-      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-      </span>
-      <span v-else-if="testResult" class="text-xs text-rose-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-      </span>
+      <ConnectionTestVerdict :result="testResult" />
     </div>
 
     <div class="flex items-center justify-end gap-3">

package/app/components/settings/KubernetesEnvironmentForm.vue

@@ -12,6 +12,7 @@ import { computed, reactive, ref, watch } from 'vue'
 import { KUBERNETES_ENV_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 import type { ProviderConnection } from '~/types/providerConnections'
 
@@ -54,6 +55,10 @@ const form = reactive({
   urlScheme: 'default' as 'default' | 'http' | 'https',
 })
 const apiToken = ref('')
+// Flag a bad paste on the field itself rather than leaving it to surface as an opaque probe
+// failure. Destructured at the top level so the template auto-unwraps the refs. Same rule and
+// same copy as the per-type engine form, via the shared composable.
+const { blocking: tokenBlocking, message: tokenProblem } = useServiceAccountTokenProblem(apiToken)
 
 const manifestSourceItems = computed(() => [
   { label: t('settings.providerConnection.kubernetesEnv.sourceColocated'), value: 'colocated' },
@@ -168,6 +173,7 @@ const canSave = computed(
     !!form.label.trim() &&
     !!form.apiServerUrl.trim() &&
     !!apiToken.value.trim() &&
+    !tokenBlocking.value &&
     manifestSourceValid.value &&
     urlValid.value,
 )
@@ -191,6 +197,8 @@ const connectBlockedReason = computed(() => {
     missing.push(t('settings.providerConnection.kubernetesEnv.serviceName'))
   if (missing.length)
     return t('settings.providerConnection.form.missingFields', { fields: missing.join(', ') })
+  // Repeated from under the token field, so the disabled button is never left unexplained.
+  if (tokenBlocking.value) return tokenProblem.value
   return t('settings.providerConnection.kubernetesEnv.invalidFields')
 })
 
@@ -273,6 +281,16 @@ function optional(label: string): string {
       :help="t('settings.providerConnection.kubernetesEnv.apiTokenHelp')"
     >
       <SecretInput v-model="apiToken" class="w-full font-mono" />
+      <!-- Rose when the paste is impossible (blocks Test/Save), amber when it is only suspicious
+           and the operator may legitimately overrule it. -->
+      <p
+        v-if="tokenProblem"
+        class="mt-1 text-[11px]"
+        :class="tokenBlocking ? 'text-rose-400' : 'text-amber-400'"
+        data-testid="service-account-token-problem"
+      >
+        {{ tokenProblem }}
+      </p>
     </UFormField>
 
     <!-- Manifest source: where the per-PR resources are read from. -->
@@ -391,7 +409,7 @@ function optional(label: string): string {
       />
     </UFormField>
 
-    <div v-if="supportsTest" class="flex items-center gap-2">
+    <div v-if="supportsTest" class="space-y-1.5">
       <UButton
         color="neutral"
         variant="soft"
@@ -403,12 +421,7 @@ function optional(label: string): string {
       >
         {{ t('settings.providerConnection.test.button') }}
       </UButton>
-      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-      </span>
-      <span v-else-if="testResult" class="text-xs text-rose-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-      </span>
+      <ConnectionTestVerdict :result="testResult" />
     </div>
 
     <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/components/settings/ProviderConnectionTab.vue

@@ -15,6 +15,7 @@ import { computed, ref, toRaw, watch } from 'vue'
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import type { ProviderConfigField, ProviderConnectionKind } from '~/types/providerConnections'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
 import KubernetesEnvironmentForm from '~/components/settings/KubernetesEnvironmentForm.vue'
@@ -498,7 +499,7 @@ function fieldHelp(key: string): string | undefined {
         />
       </UFormField>
 
-      <div v-if="descriptor.supportsTest" class="flex items-center gap-2">
+      <div v-if="descriptor.supportsTest" class="space-y-1.5">
         <UButton
           color="neutral"
           variant="soft"
@@ -509,12 +510,7 @@ function fieldHelp(key: string): string | undefined {
         >
           {{ t('settings.providerConnection.test.button') }}
         </UButton>
-        <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-          {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-        </span>
-        <span v-else-if="testResult" class="text-xs text-rose-400">
-          {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-        </span>
+        <ConnectionTestVerdict :result="testResult" />
       </div>
 
       <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/components/settings/ProviderManifestEditor.vue

@@ -20,6 +20,7 @@ import { environmentManifestSchema, runnerPoolManifestSchema } from '@cat-factor
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 const props = defineProps<{
@@ -267,7 +268,7 @@ function onSave() {
       </UFormField>
     </div>
 
-    <div v-if="supportsTest" class="flex items-center gap-2">
+    <div v-if="supportsTest" class="space-y-1.5">
       <UButton
         color="neutral"
         variant="soft"
@@ -280,12 +281,7 @@ function onSave() {
       >
         {{ t('settings.providerConnection.test.button') }}
       </UButton>
-      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-      </span>
-      <span v-else-if="testResult" class="text-xs text-rose-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-      </span>
+      <ConnectionTestVerdict :result="testResult" />
     </div>
 
     <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/composables/useServiceAccountTokenProblem.ts

@@ -0,0 +1,52 @@
+import { computed, type ComputedRef, type Ref } from 'vue'
+import {
+  classifyServiceAccountToken,
+  isFatalServiceAccountTokenProblem,
+  type ServiceAccountTokenProblem,
+} from '@cat-factory/contracts'
+
+// Inline validation of a pasted Kubernetes ServiceAccount token, shared by the two kube connect
+// forms so they cannot drift on what a bad paste is or on what to say about it.
+//
+// The rule itself is in `@cat-factory/contracts` because the backend enforces the same one (see
+// `KubernetesApiClient`), and this is the SPA half of the split CLAUDE.md prescribes: the backend
+// emits a machine-readable code, the SPA owns the translated prose. So the map below is the one
+// place a problem code becomes copy.
+
+/**
+ * The message key per problem, as an exhaustive `Record`: a code added to the contract union fails
+ * the typecheck here until it has copy, rather than rendering as a silently missing hint. The keys
+ * are literals for the same reason they are elsewhere in the SPA (an assembled key is invisible to
+ * the typed-message-key check), and they sit under the shared `providerConnection` namespace
+ * because both the per-type engine form and the legacy single-connection form show them.
+ */
+const MESSAGE_KEYS: Record<ServiceAccountTokenProblem, string> = {
+  whitespace: 'settings.providerConnection.serviceAccountToken.whitespace',
+  'base64-encoded': 'settings.providerConnection.serviceAccountToken.base64Encoded',
+  'not-a-jwt': 'settings.providerConnection.serviceAccountToken.notAJwt',
+}
+
+export interface ServiceAccountTokenCheck {
+  /** The problem code, or null when the value looks fine (and when it is empty). */
+  problem: ComputedRef<ServiceAccountTokenProblem | null>
+  /**
+   * Whether the problem should BLOCK Test and Save. True only for the impossible case (whitespace
+   * inside the token), never for the merely-suspicious shapes: a `--token-auth-file` apiserver
+   * accepts an arbitrary static bearer token, and a check that cannot be sure must not be the
+   * thing that stops a legitimate cluster being configured.
+   */
+  blocking: ComputedRef<boolean>
+  /** The translated hint to render under the field, or '' when there is nothing to say. */
+  message: ComputedRef<string>
+}
+
+/** Classify the live value of a token field and render the verdict as translated copy. */
+export function useServiceAccountTokenProblem(token: Ref<string>): ServiceAccountTokenCheck {
+  const { t } = useI18n()
+  const problem = computed(() => classifyServiceAccountToken(token.value))
+  return {
+    problem,
+    blocking: computed(() => !!problem.value && isFatalServiceAccountTokenProblem(problem.value)),
+    message: computed(() => (problem.value ? t(MESSAGE_KEYS[problem.value]) : '')),
+  }
+}

package/app/stores/ui/k3sDeepLink.spec.ts

@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { createUiModals } from '~/stores/ui/modals'
+
+/**
+ * The `cat-factory k3s` CLI hand-off (`?infraSetup=local-k3s&…`), driven through the modals slice
+ * directly (plain refs/functions, no Pinia) exactly as the overlay-host slice tests do.
+ *
+ * What is worth pinning here is the ARRIVAL, not the parsing: the CLI's whole promise is that the
+ * operator lands on the one form it just filled in, and both halves of that (the tab AND the
+ * section anchor within it) are set in this one function. The prefill is asserted alongside
+ * because the deep link is the only thing that ever sets it.
+ */
+function openWith(search: string): void {
+  window.history.replaceState(null, '', `/${search}`)
+}
+
+const K3S_LINK =
+  '?infraSetup=local-k3s&label=Local+k3s&apiServerUrl=https%3A%2F%2F127.0.0.1%3A6443' +
+  '&namespaceTemplate=cf-env-%7B%7BpullNumber%7D%7D&hostTemplate=%7B%7Bbranch%7D%7D.127.0.0.1.nip.io' +
+  '&insecureSkipTlsVerify=1'
+
+describe('consumeK3sSetupDeepLink', () => {
+  beforeEach(() => {
+    openWith('')
+  })
+
+  it('opens the Test-environments tab ANCHORED on the Kubernetes section', () => {
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+
+    expect(ui.infrastructureOpen.value).toBe(true)
+    expect(ui.infrastructureTab.value).toBe('environment')
+    // The tab opens on the default-provision picker, so without this the operator lands above
+    // the form the CLI just described and has to scroll to find it.
+    expect(ui.infrastructureScrollTarget.value).toBe('kubernetes')
+    expect(ui.k3sSetupPrefill.value).toEqual({
+      label: 'Local k3s',
+      apiServerUrl: 'https://127.0.0.1:6443',
+      namespaceTemplate: 'cf-env-{{pullNumber}}',
+      hostTemplate: '{{branch}}.127.0.0.1.nip.io',
+      insecureSkipTlsVerify: true,
+    })
+  })
+
+  it('strips the params so a reload neither re-opens the window nor re-anchors it', () => {
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+    expect(window.location.search).toBe('')
+
+    const reloaded = createUiModals()
+    reloaded.consumeK3sSetupDeepLink()
+    expect(reloaded.infrastructureOpen.value).toBe(false)
+    expect(reloaded.infrastructureScrollTarget.value).toBeNull()
+  })
+
+  it('drops an UNCONSUMED anchor on close, so the next plain open does not scroll', () => {
+    // The panel clears the target once it has scrolled. Closing before it rendered (the window
+    // was dismissed, or the infra probe never resolved) must not leave the anchor armed.
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+    ui.closeProviderConnection()
+
+    expect(ui.infrastructureScrollTarget.value).toBeNull()
+    expect(ui.k3sSetupPrefill.value).toBeNull()
+  })
+
+  it('is a no-op for an unrelated query string', () => {
+    const ui = createUiModals()
+    openWith('?settings=default-test-env')
+    ui.consumeK3sSetupDeepLink()
+
+    expect(ui.infrastructureOpen.value).toBe(false)
+    expect(ui.infrastructureScrollTarget.value).toBeNull()
+    expect(window.location.search).toBe('?settings=default-test-env')
+  })
+})

package/app/stores/ui/modals.ts

@@ -1,6 +1,10 @@
 import { ref } from 'vue'
 import type { DocumentSourceKind, InfraSetupArea, TaskSourceKind } from '~/types/domain'
-import type { InfrastructureTab, ProviderConnectionKind } from '~/types/providerConnections'
+import type {
+  InfrastructureScrollTarget,
+  InfrastructureTab,
+  ProviderConnectionKind,
+} from '~/types/providerConnections'
 import type { PendingContext } from '~/composables/useContextLinking'
 import {
   infraSetupDismissalKey,
@@ -737,6 +741,13 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
   // `local-k3s` connection from it; the ServiceAccount token is deliberately NOT in the link (a
   // secret in a URL leaks into history/logs), so the user still pastes it before Test → Save.
   const k3sSetupPrefill = ref<K3sSetupPrefill | null>(null)
+  // A one-shot deep-link anchor into a SECTION of the open tab, mirroring
+  // `accountSettingsScrollTarget`. The Test-environments tab opens on the default-provision
+  // picker and the Compose wizard, with the per-type handler sections between them, so landing an
+  // operator at the top of it after a `cat-factory k3s` hand-off leaves them scrolling to find the
+  // very form the CLI just filled in. The owning panel scrolls the section into view once and
+  // then calls `clearInfrastructureScrollTarget`, so a later plain open doesn't re-scroll.
+  const infrastructureScrollTarget = ref<InfrastructureScrollTarget | null>(null)
   // Environment setup wizard (shared-stacks slice 7): the guided detect → review → preflight →
   // trial → save flow for a service frame's `docker-compose` provisioning. `environmentWizardOpen`
   // is the modal flag; `environmentWizardFrameId` preselects the service frame the flow targets
@@ -761,8 +772,14 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
   }
   function closeProviderConnection() {
     infrastructureOpen.value = false
-    // Drop any consumed CLI prefill so re-opening the window normally doesn't re-seed the form.
+    // Drop any consumed CLI prefill so re-opening the window normally doesn't re-seed the form,
+    // and the anchor with it: an unconsumed target (the window was closed before the section
+    // rendered) would otherwise scroll the next, unrelated open.
     k3sSetupPrefill.value = null
+    infrastructureScrollTarget.value = null
+  }
+  function clearInfrastructureScrollTarget() {
+    infrastructureScrollTarget.value = null
   }
   // Capture a `cat-factory k3s` deep-link (`?infraSetup=local-k3s&…`) on app load: stash the
   // non-secret connection values, open the Infrastructure window on the Test-environments tab so
@@ -786,6 +803,10 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
     }
     resetHubReturn()
     infrastructureTab.value = 'environment'
+    // The hand-off is about ONE form, so land on it: the Kubernetes section sits below the
+    // default-provision picker, far enough down the tab that an operator arriving from the CLI
+    // would otherwise have to go looking for the fields it just told them about.
+    infrastructureScrollTarget.value = 'kubernetes'
     infrastructureOpen.value = true
     for (const key of [
       'infraSetup',
@@ -840,6 +861,8 @@ function createInfraModals(resetHubReturn: ResetHubReturn) {
     infrastructureTab,
     openInfrastructure,
     k3sSetupPrefill,
+    infrastructureScrollTarget,
+    clearInfrastructureScrollTarget,
     consumeK3sSetupDeepLink,
     environmentWizardOpen,
     environmentWizardFrameId,

package/app/types/providerConnections.ts

@@ -33,6 +33,15 @@ export type InfrastructureTab =
   | 'package-registries'
   | 'capability-credentials'
 
+/**
+ * A SECTION within an Infrastructure tab that a deep link can land the user on, rather than at
+ * the top of the tab with the section to hunt for. A closed union rather than a bare string, so
+ * the store's setter and the panel that honours it cannot drift apart silently: today's only
+ * member is the `kubernetes` provision-type section the `cat-factory k3s` hand-off targets, which
+ * sits below the default-provision picker in a tab long enough to need scrolling.
+ */
+export type InfrastructureScrollTarget = 'kubernetes'
+
 /** A workspace's provider binding, as exposed to clients (never secret values). */
 export interface ProviderConnection {
   /** The runner-backend kind for a runner-pool connection (`manifest` | `kubernetes`). */

package/app/utils/connectionFailures.ts

@@ -0,0 +1,32 @@
+import type { ConnectionFailureCause } from '@cat-factory/contracts'
+
+// A connection test that never got an ANSWER reports the transport failure CLASS as a
+// machine-readable `failureCause` (the backend does not localize prose), and the copy the operator
+// reads lives here. The backend's own English account of the failure, including the remedy it can
+// phrase with the concrete host in it, stays beside the headline as the technical detail.
+//
+// The exhaustive `Record<ConnectionFailureCause, …>` is the tier-2 drift guard, as in
+// `connectionWarnings.ts`: a backend that adds a cause fails this typecheck until the SPA has copy
+// for it, which the typed-key check cannot catch for a runtime-assembled key.
+
+/**
+ * Failure class → i18n key, or `null` where there is deliberately no headline to render.
+ *
+ * `unknown` is that case, and it is the reason the values are nullable: the chain was read and
+ * matched nothing, so the only honest statement about it is the backend's verbatim account, which
+ * is then rendered as the primary line instead of a headline that would have to invent a class.
+ */
+export const CONNECTION_FAILURE_CAUSE_KEYS: Record<ConnectionFailureCause, string | null> = {
+  refused: 'settings.providerConnection.test.causes.refused',
+  dns: 'settings.providerConnection.test.causes.dns',
+  timeout: 'settings.providerConnection.test.causes.timeout',
+  aborted: 'settings.providerConnection.test.causes.aborted',
+  unreachable: 'settings.providerConnection.test.causes.unreachable',
+  reset: 'settings.providerConnection.test.causes.reset',
+  'tls-untrusted': 'settings.providerConnection.test.causes.tlsUntrusted',
+  'tls-expired': 'settings.providerConnection.test.causes.tlsExpired',
+  'tls-hostname': 'settings.providerConnection.test.causes.tlsHostname',
+  'tls-protocol': 'settings.providerConnection.test.causes.tlsProtocol',
+  'invalid-header': 'settings.providerConnection.test.causes.invalidHeader',
+  unknown: null,
+}

package/i18n/locales/de.json

@@ -278,6 +278,11 @@
           "blurb": "Wo die Coding-Agenten laufen, wenn keine Cloudflare Containers verwendet werden. Wähle einen selbst gehosteten Runner-Pool (deinen eigenen Scheduler) oder einen Kubernetes-Cluster und konfiguriere dann dessen Endpunkt und Zugangsdaten."
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "Dieses Token enthält ein Leerzeichen oder einen Zeilenumbruch, was bei einem Bearer-Token nie vorkommt. Vermutlich wurde es über einen Zeilenumbruch im Terminal hinweg kopiert. Kopieren Sie es erneut als eine einzige ununterbrochene Zeile.",
+        "base64Encoded": "Das sieht nach dem Base64-Wert aus dem Feld .data.token des Secrets aus, nicht nach dem Token selbst. Dekodieren Sie ihn zuerst, zum Beispiel mit base64 -d.",
+        "notAJwt": "Das sieht nicht nach einem ServiceAccount-Token aus, das ein JWT aus drei durch Punkte getrennten Teilen ist. Prüfen Sie, ob der gesamte Wert kopiert wurde. Ignorieren Sie diesen Hinweis, wenn Ihr Cluster statische Bearer-Token verwendet."
+      },
       "kubernetesEnv": {
         "label": "Name",
         "labelPlaceholder": "Preview-Cluster",
@@ -364,6 +369,19 @@
         "button": "Verbindung testen",
         "ok": "Verbindung OK",
         "failed": "Verbindung fehlgeschlagen",
+        "causes": {
+          "refused": "An dieser Adresse wartet nichts: Die Verbindung wurde abgelehnt.",
+          "dns": "Dieser Hostname lässt sich von dieser Installation aus nicht auflösen.",
+          "timeout": "Es kam keine Antwort, bevor die Prüfung abgelaufen ist.",
+          "aborted": "Die Anfrage wurde abgebrochen, bevor eine Antwort ankam.",
+          "unreachable": "Von dieser Installation aus gibt es keine Netzwerkroute zu dieser Adresse.",
+          "reset": "Die Verbindung wurde geschlossen, bevor eine Antwort ankam.",
+          "tlsUntrusted": "Diese Installation vertraut dem TLS-Zertifikat nicht.",
+          "tlsExpired": "Das TLS-Zertifikat liegt außerhalb seines Gültigkeitszeitraums.",
+          "tlsHostname": "Das TLS-Zertifikat wurde nicht für diesen Hostnamen ausgestellt.",
+          "tlsProtocol": "Der TLS-Handshake ist fehlgeschlagen.",
+          "invalidHeader": "Die Anfrage ließ sich nicht erstellen: Ein Zugangsdaten-Wert enthält ein Zeichen, das ein HTTP-Header nicht übertragen kann."
+        },
         "warningsTitle": "Lücken in dieser Konfiguration",
         "warnings": {
           "runner_manifest_no_release": "Kein Release-Template: Beim Abbrechen eines Laufs kann dem Pool nicht mitgeteilt werden, dass er seinen Job stoppen soll. Ein verwaister Job belegt seinen Runner, bis der Pool ihn von selbst zurücknimmt.",

package/i18n/locales/en.json

@@ -2961,6 +2961,11 @@
           "blurb": "Where the coding agents run when not using Cloudflare Containers. Choose a self-hosted runner pool (your own scheduler) or a Kubernetes cluster, then configure its endpoint and credentials."
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "This token contains a space or line break, which a bearer token never has. It was most likely copied across a wrapped line in your terminal. Re-copy it as a single unbroken line.",
+        "base64Encoded": "This looks like the base64 value from the Secret's .data.token field rather than the token itself. Decode it first, for example with base64 -d.",
+        "notAJwt": "This does not look like a ServiceAccount token, which is a JWT of three dot-separated parts. Check that the whole value was copied. Ignore this if your cluster uses static bearer tokens."
+      },
       "kubernetesEnv": {
         "label": "Name",
         "labelPlaceholder": "Preview cluster",
@@ -3050,6 +3055,19 @@
         "button": "Test connection",
         "ok": "Connection OK",
         "failed": "Connection failed",
+        "causes": {
+          "refused": "Nothing is listening at that address: the connection was refused.",
+          "dns": "That host name does not resolve from this deployment.",
+          "timeout": "No answer arrived before the test timed out.",
+          "aborted": "The request was cancelled before an answer arrived.",
+          "unreachable": "There is no network route to that address from this deployment.",
+          "reset": "The connection was closed before an answer arrived.",
+          "tlsUntrusted": "This deployment does not trust the TLS certificate.",
+          "tlsExpired": "The TLS certificate is outside its validity window.",
+          "tlsHostname": "The TLS certificate was not issued for that host name.",
+          "tlsProtocol": "The TLS handshake failed.",
+          "invalidHeader": "The request could not be built: a credential holds a character an HTTP header cannot carry."
+        },
         "warningsTitle": "Gaps in this configuration",
         "warnings": {
           "runner_manifest_no_release": "No release template: cancelling a run cannot tell the pool to stop its job, so an orphaned job keeps its runner until the pool reclaims it on its own.",

package/i18n/locales/es.json

@@ -2744,6 +2744,19 @@
         "button": "Probar conexión",
         "ok": "Conexión correcta",
         "failed": "Falló la conexión",
+        "causes": {
+          "refused": "No hay nada escuchando en esa dirección: la conexión fue rechazada.",
+          "dns": "Ese nombre de host no se resuelve desde esta instalación.",
+          "timeout": "No llegó ninguna respuesta antes de que la prueba agotara su tiempo.",
+          "aborted": "La solicitud se canceló antes de que llegara una respuesta.",
+          "unreachable": "No hay ruta de red hacia esa dirección desde esta instalación.",
+          "reset": "La conexión se cerró antes de que llegara una respuesta.",
+          "tlsUntrusted": "Esta instalación no confía en el certificado TLS.",
+          "tlsExpired": "El certificado TLS está fuera de su periodo de validez.",
+          "tlsHostname": "El certificado TLS no se emitió para ese nombre de host.",
+          "tlsProtocol": "El protocolo de enlace TLS falló.",
+          "invalidHeader": "No se pudo construir la solicitud: una credencial contiene un carácter que una cabecera HTTP no puede transportar."
+        },
         "warningsTitle": "Carencias en esta configuración",
         "warnings": {
           "runner_manifest_no_release": "Sin plantilla de release: al cancelar una ejecución no se puede indicar al pool que detenga su trabajo, así que un trabajo huérfano ocupa su runner hasta que el pool lo recupere por su cuenta.",
@@ -2759,6 +2772,11 @@
         "removed": "Conexión eliminada",
         "removeFailed": "No se pudo eliminar la conexión"
       },
+      "serviceAccountToken": {
+        "whitespace": "Este token contiene un espacio o un salto de línea, algo que nunca ocurre en un token de portador. Lo más probable es que se haya copiado a través de una línea ajustada en la terminal. Vuelve a copiarlo como una única línea continua.",
+        "base64Encoded": "Esto parece el valor en base64 del campo .data.token del Secret, no el token en sí. Descodifícalo primero, por ejemplo con base64 -d.",
+        "notAJwt": "Esto no parece un token de ServiceAccount, que es un JWT de tres partes separadas por puntos. Comprueba que has copiado el valor completo. Ignora este aviso si tu clúster usa tokens de portador estáticos."
+      },
       "kubernetesEnv": {
         "label": "Nombre",
         "labelPlaceholder": "Clúster de vista previa",

package/i18n/locales/fr.json

@@ -2744,6 +2744,19 @@
         "button": "Tester la connexion",
         "ok": "Connexion réussie",
         "failed": "Échec de la connexion",
+        "causes": {
+          "refused": "Rien n'écoute à cette adresse : la connexion a été refusée.",
+          "dns": "Ce nom d'hôte n'est pas résolu depuis ce déploiement.",
+          "timeout": "Aucune réponse n'est arrivée avant l'expiration du test.",
+          "aborted": "La requête a été annulée avant l'arrivée d'une réponse.",
+          "unreachable": "Aucune route réseau ne mène à cette adresse depuis ce déploiement.",
+          "reset": "La connexion a été fermée avant l'arrivée d'une réponse.",
+          "tlsUntrusted": "Ce déploiement ne fait pas confiance au certificat TLS.",
+          "tlsExpired": "Le certificat TLS est en dehors de sa période de validité.",
+          "tlsHostname": "Le certificat TLS n'a pas été émis pour ce nom d'hôte.",
+          "tlsProtocol": "La négociation TLS a échoué.",
+          "invalidHeader": "La requête n'a pas pu être construite : un identifiant contient un caractère qu'un en-tête HTTP ne peut pas transporter."
+        },
         "warningsTitle": "Lacunes dans cette configuration",
         "warnings": {
           "runner_manifest_no_release": "Aucun modèle de release : annuler une exécution ne permet pas de demander au pool d'arrêter son job, donc un job orphelin occupe son runner jusqu'à ce que le pool le récupère de lui-même.",
@@ -2759,6 +2772,11 @@
         "removed": "Connexion supprimée",
         "removeFailed": "Impossible de supprimer la connexion"
       },
+      "serviceAccountToken": {
+        "whitespace": "Ce jeton contient une espace ou un saut de ligne, ce qu'un jeton porteur ne contient jamais. Il a probablement été copié à cheval sur un retour à la ligne du terminal. Recopiez-le sur une seule ligne ininterrompue.",
+        "base64Encoded": "Ceci ressemble à la valeur base64 du champ .data.token du Secret, et non au jeton lui-même. Décodez-la d'abord, par exemple avec base64 -d.",
+        "notAJwt": "Ceci ne ressemble pas à un jeton de ServiceAccount, qui est un JWT composé de trois parties séparées par des points. Vérifiez que la valeur a été copiée en entier. Ignorez cet avertissement si votre cluster utilise des jetons porteurs statiques."
+      },
       "kubernetesEnv": {
         "label": "Nom",
         "labelPlaceholder": "Cluster de prévisualisation",

package/i18n/locales/he.json

@@ -2854,6 +2854,11 @@
           "blurb": "היכן סוכני הקוד רצים כשלא משתמשים ב-Cloudflare Containers. בחר מאגר מריצים בניהול עצמי (מתזמן משלך) או אשכול Kubernetes, ואז הגדר את נקודת הקצה והאישורים שלו."
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "האסימון הזה מכיל רווח או שבירת שורה, דבר שלא קיים באסימון נושא. סביר להניח שהוא הועתק תוך חציית שורה שנשברה במסוף. העתיקו אותו מחדש כשורה אחת רציפה.",
+        "base64Encoded": "זה נראה כמו הערך בבסיס 64 מהשדה .data.token של ה-Secret, ולא כמו האסימון עצמו. פענחו אותו קודם, למשל באמצעות base64 -d.",
+        "notAJwt": "זה לא נראה כמו אסימון ServiceAccount, שהוא JWT בן שלושה חלקים המופרדים בנקודות. ודאו שהערך הועתק במלואו. התעלמו מההודעה אם האשכול שלכם משתמש באסימוני נושא סטטיים."
+      },
       "kubernetesEnv": {
         "label": "שם",
         "labelPlaceholder": "אשכול תצוגה מקדימה",
@@ -2940,6 +2945,19 @@
         "button": "בדוק חיבור",
         "ok": "החיבור תקין",
         "failed": "החיבור נכשל",
+        "causes": {
+          "refused": "אין דבר שמאזין בכתובת הזו: החיבור נדחה.",
+          "dns": "שם המחשב המארח הזה אינו נפתר מהפריסה הזו.",
+          "timeout": "לא הגיעה תשובה לפני שתם הזמן שהוקצב לבדיקה.",
+          "aborted": "הבקשה בוטלה לפני שהגיעה תשובה.",
+          "unreachable": "אין נתיב רשת לכתובת הזו מהפריסה הזו.",
+          "reset": "החיבור נסגר לפני שהגיעה תשובה.",
+          "tlsUntrusted": "הפריסה הזו אינה סומכת על אישור ה-TLS.",
+          "tlsExpired": "אישור ה-TLS נמצא מחוץ לתקופת התוקף שלו.",
+          "tlsHostname": "אישור ה-TLS לא הונפק עבור שם המחשב המארח הזה.",
+          "tlsProtocol": "לחיצת היד של TLS נכשלה.",
+          "invalidHeader": "לא ניתן היה לבנות את הבקשה: פרטי גישה מכילים תו שכותרת HTTP אינה יכולה לשאת."
+        },
         "warningsTitle": "פערים בתצורה הזו",
         "warnings": {
           "runner_manifest_no_release": "אין תבנית שחרור: ביטול הרצה לא יכול להודיע למאגר להפסיק את המשימה שלו, ולכן משימה יתומה תופסת את הראנר שלה עד שהמאגר משחרר אותה בעצמו.",

package/i18n/locales/it.json

@@ -278,6 +278,11 @@
           "blurb": "Dove vengono eseguiti gli agenti di coding quando non si usano i Cloudflare Containers. Scegli un pool di runner self-hosted (il tuo scheduler) o un cluster Kubernetes, poi configura il suo endpoint e le sue credenziali."
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "Questo token contiene uno spazio o un'interruzione di riga, cosa che un token bearer non ha mai. Probabilmente è stato copiato a cavallo di una riga mandata a capo nel terminale. Ricopialo come un'unica riga ininterrotta.",
+        "base64Encoded": "Sembra il valore base64 del campo .data.token del Secret, non il token vero e proprio. Decodificalo prima, ad esempio con base64 -d.",
+        "notAJwt": "Non sembra un token di ServiceAccount, che è un JWT composto da tre parti separate da punti. Verifica di aver copiato il valore completo. Ignora questo avviso se il tuo cluster usa token bearer statici."
+      },
       "kubernetesEnv": {
         "label": "Nome",
         "labelPlaceholder": "Cluster di anteprima",
@@ -364,6 +369,19 @@
         "button": "Testa la connessione",
         "ok": "Connessione OK",
         "failed": "Connessione fallita",
+        "causes": {
+          "refused": "Nessuno è in ascolto a quell'indirizzo: la connessione è stata rifiutata.",
+          "dns": "Quel nome host non viene risolto da questa installazione.",
+          "timeout": "Nessuna risposta è arrivata prima della scadenza del test.",
+          "aborted": "La richiesta è stata annullata prima che arrivasse una risposta.",
+          "unreachable": "Non esiste una rotta di rete verso quell'indirizzo da questa installazione.",
+          "reset": "La connessione è stata chiusa prima che arrivasse una risposta.",
+          "tlsUntrusted": "Questa installazione non considera attendibile il certificato TLS.",
+          "tlsExpired": "Il certificato TLS è fuori dal suo periodo di validità.",
+          "tlsHostname": "Il certificato TLS non è stato emesso per quel nome host.",
+          "tlsProtocol": "L'handshake TLS è fallito.",
+          "invalidHeader": "Non è stato possibile costruire la richiesta: una credenziale contiene un carattere che un header HTTP non può trasportare."
+        },
         "warningsTitle": "Lacune in questa configurazione",
         "warnings": {
           "runner_manifest_no_release": "Nessun template di release: annullare un'esecuzione non può dire al pool di fermare il suo job, quindi un job orfano tiene occupato il suo runner finché il pool non lo recupera da solo.",

package/i18n/locales/ja.json

@@ -2854,6 +2854,11 @@
           "blurb": "Cloudflare Containers を使用しない場合にコーディングエージェントが実行される場所。セルフホストのランナープール (自前のスケジューラー) または Kubernetes クラスターを選択し、エンドポイントと認証情報を構成します。"
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "このトークンにはスペースまたは改行が含まれています。ベアラートークンには本来含まれないもので、ターミナルで折り返された行をまたいでコピーした可能性が高いです。改行のない 1 行としてコピーし直してください。",
+        "base64Encoded": "これはトークン自体ではなく、Secret の .data.token フィールドの Base64 値のように見えます。先に base64 -d などでデコードしてください。",
+        "notAJwt": "これは ServiceAccount トークン (ピリオドで区切られた 3 つの部分から成る JWT) には見えません。値全体をコピーしたか確認してください。クラスターが静的なベアラートークンを使用している場合は無視して構いません。"
+      },
       "kubernetesEnv": {
         "label": "名前",
         "labelPlaceholder": "プレビュークラスター",
@@ -2940,6 +2945,19 @@
         "button": "接続をテスト",
         "ok": "接続 OK",
         "failed": "接続に失敗しました",
+        "causes": {
+          "refused": "そのアドレスでは何も待ち受けていません。接続が拒否されました。",
+          "dns": "そのホスト名はこのデプロイからは解決できません。",
+          "timeout": "テストがタイムアウトするまでに応答がありませんでした。",
+          "aborted": "応答が届く前にリクエストがキャンセルされました。",
+          "unreachable": "このデプロイからそのアドレスへのネットワーク経路がありません。",
+          "reset": "応答が届く前に接続が閉じられました。",
+          "tlsUntrusted": "このデプロイは TLS 証明書を信頼していません。",
+          "tlsExpired": "TLS 証明書は有効期間を外れています。",
+          "tlsHostname": "TLS 証明書はそのホスト名向けに発行されていません。",
+          "tlsProtocol": "TLS ハンドシェイクに失敗しました。",
+          "invalidHeader": "リクエストを組み立てられませんでした。認証情報に HTTP ヘッダーが扱えない文字が含まれています。"
+        },
         "warningsTitle": "この設定の不足点",
         "warnings": {
           "runner_manifest_no_release": "release テンプレートがありません。実行をキャンセルしてもプールにジョブの停止を伝えられないため、取り残されたジョブはプールが自分で回収するまでランナーを占有し続けます。",

package/i18n/locales/pl.json

@@ -2744,6 +2744,19 @@
         "button": "Przetestuj połączenie",
         "ok": "Połączenie poprawne",
         "failed": "Połączenie nieudane",
+        "causes": {
+          "refused": "Nic nie nasłuchuje pod tym adresem: połączenie zostało odrzucone.",
+          "dns": "Ta nazwa hosta nie jest rozwiązywana z tego wdrożenia.",
+          "timeout": "Nie nadeszła żadna odpowiedź przed upływem czasu testu.",
+          "aborted": "Żądanie zostało anulowane, zanim nadeszła odpowiedź.",
+          "unreachable": "Z tego wdrożenia nie ma trasy sieciowej do tego adresu.",
+          "reset": "Połączenie zostało zamknięte, zanim nadeszła odpowiedź.",
+          "tlsUntrusted": "To wdrożenie nie ufa certyfikatowi TLS.",
+          "tlsExpired": "Certyfikat TLS jest poza okresem swojej ważności.",
+          "tlsHostname": "Certyfikat TLS nie został wystawiony dla tej nazwy hosta.",
+          "tlsProtocol": "Uzgadnianie TLS nie powiodło się.",
+          "invalidHeader": "Nie udało się zbudować żądania: dane uwierzytelniające zawierają znak, którego nagłówek HTTP nie może przenieść."
+        },
         "warningsTitle": "Braki w tej konfiguracji",
         "warnings": {
           "runner_manifest_no_release": "Brak szablonu release: anulowanie przebiegu nie może przekazać puli, że ma zatrzymać zadanie, więc osierocone zadanie zajmuje swojego runnera, dopóki pula sama go nie odzyska.",
@@ -2759,6 +2772,11 @@
         "removed": "Połączenie usunięte",
         "removeFailed": "Nie udało się usunąć połączenia"
       },
+      "serviceAccountToken": {
+        "whitespace": "Ten token zawiera spację lub znak nowego wiersza, czego token typu bearer nigdy nie ma. Najprawdopodobniej został skopiowany przez zawinięty wiersz w terminalu. Skopiuj go ponownie jako jeden nieprzerwany wiersz.",
+        "base64Encoded": "To wygląda na wartość base64 z pola .data.token obiektu Secret, a nie na sam token. Najpierw ją zdekoduj, na przykład poleceniem base64 -d.",
+        "notAJwt": "To nie wygląda na token ServiceAccount, który jest tokenem JWT złożonym z trzech części oddzielonych kropkami. Sprawdź, czy skopiowano całą wartość. Zignoruj to ostrzeżenie, jeśli Twój klaster używa statycznych tokenów bearer."
+      },
       "kubernetesEnv": {
         "label": "Nazwa",
         "labelPlaceholder": "Klaster podglądu",

package/i18n/locales/tr.json

@@ -2854,6 +2854,11 @@
           "blurb": "Cloudflare Containers kullanılmadığında kodlama ajanlarının çalıştığı yer. Bir self-hosted runner havuzu (kendi zamanlayıcınız) veya bir Kubernetes kümesi seçin, ardından uç noktasını ve kimlik bilgilerini yapılandırın."
         }
       },
+      "serviceAccountToken": {
+        "whitespace": "Bu belirteç bir boşluk ya da satır sonu içeriyor; taşıyıcı belirteçlerde bu asla bulunmaz. Büyük olasılıkla terminalde kaydırılmış bir satırın üzerinden kopyalanmış. Tek ve kesintisiz bir satır olarak yeniden kopyalayın.",
+        "base64Encoded": "Bu, belirtecin kendisi değil, Secret nesnesinin .data.token alanındaki base64 değeri gibi görünüyor. Önce çözün, örneğin base64 -d ile.",
+        "notAJwt": "Bu, noktayla ayrılmış üç bölümden oluşan bir JWT olan ServiceAccount belirtecine benzemiyor. Değerin tamamının kopyalandığını doğrulayın. Kümeniz statik taşıyıcı belirteç kullanıyorsa bu uyarıyı yoksayın."
+      },
       "kubernetesEnv": {
         "label": "Ad",
         "labelPlaceholder": "Önizleme kümesi",
@@ -2940,6 +2945,19 @@
         "button": "Bağlantıyı test et",
         "ok": "Bağlantı tamam",
         "failed": "Bağlantı başarısız",
+        "causes": {
+          "refused": "Bu adreste dinleyen bir şey yok: bağlantı reddedildi.",
+          "dns": "Bu ana bilgisayar adı bu kurulumdan çözümlenemiyor.",
+          "timeout": "Test zaman aşımına uğrayana kadar yanıt gelmedi.",
+          "aborted": "Yanıt gelmeden önce istek iptal edildi.",
+          "unreachable": "Bu kurulumdan bu adrese ağ yolu yok.",
+          "reset": "Yanıt gelmeden önce bağlantı kapatıldı.",
+          "tlsUntrusted": "Bu kurulum TLS sertifikasına güvenmiyor.",
+          "tlsExpired": "TLS sertifikası geçerlilik süresinin dışında.",
+          "tlsHostname": "TLS sertifikası bu ana bilgisayar adı için verilmemiş.",
+          "tlsProtocol": "TLS el sıkışması başarısız oldu.",
+          "invalidHeader": "İstek oluşturulamadı: kimlik bilgisi, bir HTTP başlığının taşıyamayacağı bir karakter içeriyor."
+        },
         "warningsTitle": "Bu yapılandırmadaki eksikler",
         "warnings": {
           "runner_manifest_no_release": "Release şablonu yok: bir çalıştırma iptal edildiğinde havuza işi durdurması söylenemez, bu yüzden sahipsiz kalan iş, havuz onu kendi kendine geri alana kadar runner'ını meşgul tutar.",

package/i18n/locales/uk.json

@@ -2744,6 +2744,19 @@
         "button": "Перевірити підключення",
         "ok": "Підключення в порядку",
         "failed": "Не вдалося підключитися",
+        "causes": {
+          "refused": "За цією адресою ніщо не слухає: з'єднання відхилено.",
+          "dns": "Це ім'я хоста не розпізнається з цього розгортання.",
+          "timeout": "Відповідь не надійшла до завершення часу перевірки.",
+          "aborted": "Запит скасовано, перш ніж надійшла відповідь.",
+          "unreachable": "З цього розгортання немає мережевого маршруту до цієї адреси.",
+          "reset": "З'єднання закрито, перш ніж надійшла відповідь.",
+          "tlsUntrusted": "Це розгортання не довіряє сертифікату TLS.",
+          "tlsExpired": "Сертифікат TLS поза строком дії.",
+          "tlsHostname": "Сертифікат TLS видано не для цього імені хоста.",
+          "tlsProtocol": "Рукостискання TLS не вдалося.",
+          "invalidHeader": "Не вдалося сформувати запит: дані для входу містять символ, який заголовок HTTP не може передати."
+        },
         "warningsTitle": "Прогалини в цій конфігурації",
         "warnings": {
           "runner_manifest_no_release": "Немає шаблону release: скасування запуску не може повідомити пулу, що завдання треба зупинити, тож осиротіле завдання займає свій раннер, доки пул не забере його сам.",
@@ -2759,6 +2772,11 @@
         "removed": "Підключення видалено",
         "removeFailed": "Не вдалося видалити підключення"
       },
+      "serviceAccountToken": {
+        "whitespace": "Цей токен містить пробіл або розрив рядка, чого в токені-носії ніколи не буває. Найімовірніше, його скопійовано через перенесений рядок у терміналі. Скопіюйте його ще раз одним суцільним рядком.",
+        "base64Encoded": "Це схоже на значення в base64 з поля .data.token об'єкта Secret, а не на сам токен. Спершу розкодуйте його, наприклад за допомогою base64 -d.",
+        "notAJwt": "Це не схоже на токен ServiceAccount, який є JWT із трьох частин, розділених крапками. Переконайтеся, що скопійовано все значення. Знехтуйте цим попередженням, якщо ваш кластер використовує статичні токени-носії."
+      },
       "kubernetesEnv": {
         "label": "Назва",
         "labelPlaceholder": "Кластер попереднього перегляду",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.261.0",
+  "version": "0.261.1",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.41",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.292.0"
+    "@cat-factory/contracts": "0.292.1"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",