@cat-factory/app 0.261.0 → 0.261.2

package/app/components/settings/KubernetesEnvironmentForm.vue

@@ -12,6 +12,7 @@ import { computed, reactive, ref, watch } from 'vue'
 import { KUBERNETES_ENV_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 import type { ProviderConnection } from '~/types/providerConnections'
 
@@ -54,6 +55,10 @@ const form = reactive({
   urlScheme: 'default' as 'default' | 'http' | 'https',
 })
 const apiToken = ref('')
+// Flag a bad paste on the field itself rather than leaving it to surface as an opaque probe
+// failure. Destructured at the top level so the template auto-unwraps the refs. Same rule and
+// same copy as the per-type engine form, via the shared composable.
+const { blocking: tokenBlocking, message: tokenProblem } = useServiceAccountTokenProblem(apiToken)
 
 const manifestSourceItems = computed(() => [
   { label: t('settings.providerConnection.kubernetesEnv.sourceColocated'), value: 'colocated' },
@@ -168,6 +173,7 @@ const canSave = computed(
     !!form.label.trim() &&
     !!form.apiServerUrl.trim() &&
     !!apiToken.value.trim() &&
+    !tokenBlocking.value &&
     manifestSourceValid.value &&
     urlValid.value,
 )
@@ -191,6 +197,8 @@ const connectBlockedReason = computed(() => {
     missing.push(t('settings.providerConnection.kubernetesEnv.serviceName'))
   if (missing.length)
     return t('settings.providerConnection.form.missingFields', { fields: missing.join(', ') })
+  // Repeated from under the token field, so the disabled button is never left unexplained.
+  if (tokenBlocking.value) return tokenProblem.value
   return t('settings.providerConnection.kubernetesEnv.invalidFields')
 })
 
@@ -273,6 +281,16 @@ function optional(label: string): string {
       :help="t('settings.providerConnection.kubernetesEnv.apiTokenHelp')"
     >
       <SecretInput v-model="apiToken" class="w-full font-mono" />
+      <!-- Rose when the paste is impossible (blocks Test/Save), amber when it is only suspicious
+           and the operator may legitimately overrule it. -->
+      <p
+        v-if="tokenProblem"
+        class="mt-1 text-[11px]"
+        :class="tokenBlocking ? 'text-rose-400' : 'text-amber-400'"
+        data-testid="service-account-token-problem"
+      >
+        {{ tokenProblem }}
+      </p>
     </UFormField>
 
     <!-- Manifest source: where the per-PR resources are read from. -->
@@ -391,7 +409,7 @@ function optional(label: string): string {
       />
     </UFormField>
 
-    <div v-if="supportsTest" class="flex items-center gap-2">
+    <div v-if="supportsTest" class="space-y-1.5">
       <UButton
         color="neutral"
         variant="soft"
@@ -403,12 +421,7 @@ function optional(label: string): string {
       >
         {{ t('settings.providerConnection.test.button') }}
       </UButton>
-      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-      </span>
-      <span v-else-if="testResult" class="text-xs text-rose-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-      </span>
+      <ConnectionTestVerdict :result="testResult" />
     </div>
 
     <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/components/settings/ProviderConnectionTab.vue

@@ -15,6 +15,7 @@ import { computed, ref, toRaw, watch } from 'vue'
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import type { ProviderConfigField, ProviderConnectionKind } from '~/types/providerConnections'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
 import KubernetesEnvironmentForm from '~/components/settings/KubernetesEnvironmentForm.vue'
@@ -498,7 +499,7 @@ function fieldHelp(key: string): string | undefined {
         />
       </UFormField>
 
-      <div v-if="descriptor.supportsTest" class="flex items-center gap-2">
+      <div v-if="descriptor.supportsTest" class="space-y-1.5">
         <UButton
           color="neutral"
           variant="soft"
@@ -509,12 +510,7 @@ function fieldHelp(key: string): string | undefined {
         >
           {{ t('settings.providerConnection.test.button') }}
         </UButton>
-        <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-          {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-        </span>
-        <span v-else-if="testResult" class="text-xs text-rose-400">
-          {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-        </span>
+        <ConnectionTestVerdict :result="testResult" />
       </div>
 
       <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/components/settings/ProviderManifestEditor.vue

@@ -20,6 +20,7 @@ import { environmentManifestSchema, runnerPoolManifestSchema } from '@cat-factor
 import type { ConnectionTestResult } from '@cat-factory/contracts'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ConnectionWarnings from '~/components/settings/ConnectionWarnings.vue'
+import ConnectionTestVerdict from '~/components/settings/ConnectionTestVerdict.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 const props = defineProps<{
@@ -267,7 +268,7 @@ function onSave() {
       </UFormField>
     </div>
 
-    <div v-if="supportsTest" class="flex items-center gap-2">
+    <div v-if="supportsTest" class="space-y-1.5">
       <UButton
         color="neutral"
         variant="soft"
@@ -280,12 +281,7 @@ function onSave() {
       >
         {{ t('settings.providerConnection.test.button') }}
       </UButton>
-      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
-      </span>
-      <span v-else-if="testResult" class="text-xs text-rose-400">
-        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
-      </span>
+      <ConnectionTestVerdict :result="testResult" />
     </div>
 
     <ConnectionWarnings :warnings="testResult?.warnings" />

package/app/components/skills/SkillLibraryManager.vue

@@ -24,7 +24,7 @@ watch(
   () => {
     void library.probe()
     // The GitHub pickers need the active board's installation state; probe once so they light up.
-    void github.probe()
+    void github.ensureProbed()
   },
   { immediate: true },
 )

package/app/composables/api/github.ts

@@ -6,6 +6,7 @@ import {
   createGitHubRepoContract,
   disconnectGitHubContract,
   getGitHubConnectionContract,
+  getGitHubPatCheckContract,
   getGitHubInstallUrlContract,
   listGitHubAvailableReposContract,
   listGitHubBranchesContract,
@@ -52,6 +53,12 @@ export function githubApi({ send, ws }: ApiContext) {
     getGitHubConnection: (workspaceId: string) =>
       send(getGitHubConnectionContract, { pathPrefix: ws(workspaceId) }),
 
+    // What the personal access token this workspace's runs would authenticate with can actually
+    // do. Answers `not_applicable` (not a 404/503) on a deployment that uses a GitHub App or no
+    // PAT at all, so the caller makes one unconditional call on board load.
+    getGitHubPatCheck: (workspaceId: string) =>
+      send(getGitHubPatCheckContract, { pathPrefix: ws(workspaceId) }),
+
     listGitHubInstallations: (workspaceId: string) =>
       send(listGitHubInstallationsContract, { pathPrefix: ws(workspaceId) }),
 

package/app/composables/useServiceAccountTokenProblem.ts

@@ -0,0 +1,52 @@
+import { computed, type ComputedRef, type Ref } from 'vue'
+import {
+  classifyServiceAccountToken,
+  isFatalServiceAccountTokenProblem,
+  type ServiceAccountTokenProblem,
+} from '@cat-factory/contracts'
+
+// Inline validation of a pasted Kubernetes ServiceAccount token, shared by the two kube connect
+// forms so they cannot drift on what a bad paste is or on what to say about it.
+//
+// The rule itself is in `@cat-factory/contracts` because the backend enforces the same one (see
+// `KubernetesApiClient`), and this is the SPA half of the split CLAUDE.md prescribes: the backend
+// emits a machine-readable code, the SPA owns the translated prose. So the map below is the one
+// place a problem code becomes copy.
+
+/**
+ * The message key per problem, as an exhaustive `Record`: a code added to the contract union fails
+ * the typecheck here until it has copy, rather than rendering as a silently missing hint. The keys
+ * are literals for the same reason they are elsewhere in the SPA (an assembled key is invisible to
+ * the typed-message-key check), and they sit under the shared `providerConnection` namespace
+ * because both the per-type engine form and the legacy single-connection form show them.
+ */
+const MESSAGE_KEYS: Record<ServiceAccountTokenProblem, string> = {
+  whitespace: 'settings.providerConnection.serviceAccountToken.whitespace',
+  'base64-encoded': 'settings.providerConnection.serviceAccountToken.base64Encoded',
+  'not-a-jwt': 'settings.providerConnection.serviceAccountToken.notAJwt',
+}
+
+export interface ServiceAccountTokenCheck {
+  /** The problem code, or null when the value looks fine (and when it is empty). */
+  problem: ComputedRef<ServiceAccountTokenProblem | null>
+  /**
+   * Whether the problem should BLOCK Test and Save. True only for the impossible case (whitespace
+   * inside the token), never for the merely-suspicious shapes: a `--token-auth-file` apiserver
+   * accepts an arbitrary static bearer token, and a check that cannot be sure must not be the
+   * thing that stops a legitimate cluster being configured.
+   */
+  blocking: ComputedRef<boolean>
+  /** The translated hint to render under the field, or '' when there is nothing to say. */
+  message: ComputedRef<string>
+}
+
+/** Classify the live value of a token field and render the verdict as translated copy. */
+export function useServiceAccountTokenProblem(token: Ref<string>): ServiceAccountTokenCheck {
+  const { t } = useI18n()
+  const problem = computed(() => classifyServiceAccountToken(token.value))
+  return {
+    problem,
+    blocking: computed(() => !!problem.value && isFatalServiceAccountTokenProblem(problem.value)),
+    message: computed(() => (problem.value ? t(MESSAGE_KEYS[problem.value]) : '')),
+  }
+}

package/app/stores/github/probe.ts

@@ -0,0 +1,97 @@
+import type { Ref } from 'vue'
+import type { GitHubPatCheck } from '~/types/domain'
+import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
+import type { GitHubStoreContext } from '~/stores/github/context'
+
+/**
+ * The board-load probe: everything the store learns about the deployment's VCS setup in one round
+ * trip, before anything is clicked.
+ *
+ * Three questions, deliberately not three failure modes:
+ *  - Is the integration there at all, and what is bound? (`available` + `connection`)
+ *  - What could be connected, for the not-connected UI? (`connectOptions`)
+ *  - Can the token a run would use actually push? (`patCheck`)
+ *
+ * Extracted from the store setup when the credential check pushed it past the function-size
+ * ratchet, and it is the right seam rather than a convenient one: these three reads share a
+ * lifecycle (fired together on board open, reset together on workspace switch) and nothing else in
+ * the store does.
+ *
+ * The credential check is the odd one out in TWO ways, and both are why it is single-flighted
+ * SEPARATELY rather than being a third branch of `runProbe`:
+ *
+ *  - It is the only read that leaves the deployment. The others answer from local rows in
+ *    milliseconds; this one waits on GitHub, up to a `GET /user` plus a repository read each. So
+ *    it is started beside them and never awaited by the caller: a modal that awaits `probe()` to
+ *    learn whether the integration is available would otherwise sit behind a slow or unreachable
+ *    GitHub for as long as those calls take, to render a banner it does not own.
+ *  - It is a DIAGNOSTIC, not data any caller reads, so it follows the DOOR rather than the batch.
+ *    `ensureProbed()` (the on-board-open fan-out) checks at most once per board; `probe()` (the
+ *    deliberate-refresh door) re-checks, because the surfaces that force a refresh are the ones
+ *    that just changed what the answer depends on: linking a repository to a service frame is
+ *    what turns "this board targets no GitHub repository" into a verdict at all. A panel that
+ *    merely wants to know whether the integration is available belongs on `ensureProbed()`, and
+ *    the ones whose own comments said "probe once so the pickers light up" were moved onto it.
+ */
+export function createGitHubProbe(
+  ctx: GitHubStoreContext,
+  patCheck: Ref<GitHubPatCheck | null>,
+): { probe: () => Promise<void>; ensureProbed: () => Promise<void> } {
+  const { api, workspace, available, connection, connectOptions } = ctx
+
+  async function runPatCheck(): Promise<void> {
+    // Which board asked, captured BEFORE the await: a workspace switch mid-flight must not land
+    // this board's verdict on the next one's banner. The single-flight wrapper re-keys on the id
+    // but cannot un-assign a value the run already wrote.
+    const askedFor = workspace.workspaceId
+    if (!askedFor) return
+    // A failure leaves the previous value alone rather than clearing it: `null` means "not
+    // answered", which the banner reads as nothing to say, and overwriting a real verdict with
+    // it would silently retract a warning the reader has not acted on.
+    const check = await api.getGitHubPatCheck(askedFor).catch(() => null)
+    if (check && workspace.workspaceId === askedFor) patCheck.value = check
+  }
+
+  const patProbe = useSingleFlightProbe(runPatCheck, () => workspace.workspaceId)
+
+  async function runConnectionReads(): Promise<void> {
+    if (!workspace.workspaceId) return
+    try {
+      const [{ connection: conn }, options] = await Promise.all([
+        api.getGitHubConnection(workspace.requireId()),
+        api
+          .listVcsConnectOptions(workspace.requireId())
+          .then((r) => r.options)
+          .catch(() => []),
+      ])
+      available.value = true
+      connection.value = conn
+      connectOptions.value = options
+    } catch {
+      // 503 (integration disabled) or any error → hide the UI entry points.
+      available.value = false
+      connection.value = null
+      connectOptions.value = []
+    }
+  }
+
+  // Single-flight the connection reads (app-startup initiative, item 12): `probe()` still re-reads
+  // on demand, but the on-board-open callers (the board page's onboarding gate + the SideBar) use
+  // `ensureProbed()` so their duplicate fire collapses to one request per board. A workspace switch
+  // (new id) re-probes.
+  const connectionProbe = useSingleFlightProbe(runConnectionReads, () => workspace.workspaceId)
+
+  // The credential check rides the same DOOR the caller opened but never its await, so a slow or
+  // unreachable GitHub delays nothing a caller is waiting on. Awaiting only the connection reads
+  // is what keeps `await github.probe()` a local-row read, which is what its callers treat it as.
+  return {
+    probe: () => {
+      void patProbe.probe()
+      return connectionProbe.probe()
+    },
+    ensureProbed: () => {
+      void patProbe.ensureProbed()
+      return connectionProbe.ensureProbed()
+    },
+  }
+}

package/app/stores/github.spec.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, type Mock } from 'vitest'
 import { useGitHubStore } from '~/stores/github'
 import { useWorkspaceStore } from '~/stores/workspace'
-import type { GitHubConnection, GitHubRepo, VcsConnectOption } from '~/types/domain'
+import type { GitHubConnection, GitHubPatCheck, GitHubRepo, VcsConnectOption } from '~/types/domain'
 
 // The VCS connect surface of the (single, GitHub-shaped) repo store: which connect methods the
 // deployment offers, the per-workspace GitLab PAT connect, and the provider-routed disconnect.
@@ -29,6 +29,7 @@ function stubApi<T extends Record<string, Mock>>(api: T) {
     listGitHubRepos: vi.fn().mockResolvedValue([]),
     listGitHubPullRequests: vi.fn().mockResolvedValue([]),
     listGitHubIssues: vi.fn().mockResolvedValue([]),
+    getGitHubPatCheck: vi.fn().mockResolvedValue({ state: 'not_applicable' }),
     ...api,
   }
   vi.stubGlobal('useApi', () => full)
@@ -285,3 +286,110 @@ describe('github store — repo web links', () => {
     )
   })
 })
+
+// The credential check rides the same probe DOOR, but neither the same failure nor the same
+// await. Local mode reaches GitHub with a personal access token and wires no App module, so the
+// connection read 503s exactly where this check matters most; sharing that catch would have
+// discarded the answer there. And it is the only read that leaves the deployment, so a caller
+// awaiting `probe()` must never end up waiting on GitHub.
+describe('github store — GitHub PAT credential check', () => {
+  const REPORT: GitHubPatCheck = {
+    state: 'checked',
+    report: {
+      source: 'deployment',
+      kind: 'classic',
+      capabilities: { push: 'missing', pullRequests: 'missing', workflows: 'missing' },
+      probedRepos: [],
+      deniedRepos: [],
+      unprobedRepoCount: 0,
+      webUrl: 'https://github.com',
+    },
+  }
+
+  it('resolves the check alongside the connection probe', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockResolvedValue(REPORT),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  it('keeps the check when the connection read fails, as it does in local mode', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockRejectedValue(new Error('503')),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockResolvedValue(REPORT),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(false)
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  // A failed READ is not a verdict: `null` says "not answered", which the banner renders as
+  // nothing. Collapsing it onto a clean report would be an all-clear nobody established.
+  it('leaves the check unanswered when its own read fails', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockRejectedValue(new Error('500')),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.patCheck).toBeNull()
+  })
+
+  // The reason it is not awaited: two modals block their open on `probe()`, and every other
+  // read behind it answers from local rows. Awaited, an unreachable GitHub held those modals
+  // for the full outbound timeout to settle a banner they do not render.
+  it('does not make callers wait on the outbound check', async () => {
+    let settleCheck = (_: GitHubPatCheck) => {}
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockReturnValue(
+        new Promise<GitHubPatCheck>((resolve) => {
+          settleCheck = resolve
+        }),
+      ),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.patCheck).toBeNull()
+    settleCheck(REPORT)
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  // The on-board-open fan-out fires the probe from several places at once. The credential check
+  // spends the user's GitHub rate limit, so it collapses to one per board rather than one per
+  // caller — while `probe()`, the deliberate-refresh door, still re-checks, because the surfaces
+  // that force a refresh are the ones that just changed what the answer depends on.
+  it('checks once per board across the on-open fan-out, and again on a deliberate refresh', async () => {
+    const getGitHubPatCheck = vi.fn().mockResolvedValue(REPORT)
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck,
+    })
+    const github = storeWithWorkspace()
+
+    await Promise.all([github.ensureProbed(), github.ensureProbed()])
+    await github.ensureProbed()
+    await vi.waitFor(() => expect(getGitHubPatCheck).toHaveBeenCalledTimes(1))
+
+    await github.probe()
+    await vi.waitFor(() => expect(getGitHubPatCheck).toHaveBeenCalledTimes(2))
+  })
+})

package/app/stores/github.ts

@@ -6,6 +6,7 @@ import type {
   GitHubConnection,
   GitHubInstallationOption,
   GitHubIssue,
+  GitHubPatCheck,
   GitHubPullRequest,
   GitHubRepo,
   RepoTreeEntry,
@@ -13,12 +14,12 @@ import type {
   VcsProvider,
 } from '~/types/domain'
 import { branchWebUrl, issueWebUrl, pullWebUrl, repoWebUrl } from '~/utils/vcs'
-import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
 import { useUpsertList } from '~/composables/useUpsertList'
 import { useWorkspaceStore } from '~/stores/workspace'
 import { useServicesStore } from '~/stores/services'
 import { pullKey, type GitHubStoreContext } from '~/stores/github/context'
 import { createGitHubConnectionActions } from '~/stores/github/connection'
+import { createGitHubProbe } from '~/stores/github/probe'
 import { createGitHubRepoActions } from '~/stores/github/repoActions'
 import { createVcsConnectActions, createVcsProviderViews } from '~/stores/github/vcsConnect'
 
@@ -41,6 +42,13 @@ export const useGitHubStore = defineStore('github', () => {
   const connection = ref<GitHubConnection | null>(null)
   /** The connect surfaces this deployment serves; resolved by the probe alongside `connection`. */
   const connectOptions = ref<VcsConnectOption[]>([])
+  /**
+   * What the personal access token this workspace's runs would use can actually do, resolved by
+   * the probe. `null` = not answered (unprobed, or the read failed); the check's own
+   * `not_applicable` state is what "there is no PAT here" looks like. The two are kept apart
+   * because only the second is a fact.
+   */
+  const patCheck = ref<GitHubPatCheck | null>(null)
   /** Discovered App installations for the connect picker; loaded on demand. */
   const installations = ref<GitHubInstallationOption[]>([])
   const loadingInstallations = ref(false)
@@ -124,37 +132,6 @@ export const useGitHubStore = defineStore('github', () => {
     return branchWebUrl(providerOfRepo(repoGithubId), repoUrl(repoGithubId), branch)
   }
 
-  /**
-   * Probe the integration: resolves `available`, the current connection, and which connect
-   * surfaces the deployment serves. The capability read rides the same round trip (it is what
-   * the not-connected UI renders from), and degrades to "no connect surface" on its own.
-   */
-  async function runProbe() {
-    if (!workspace.workspaceId) return
-    try {
-      const [{ connection: conn }, options] = await Promise.all([
-        api.getGitHubConnection(workspace.requireId()),
-        api
-          .listVcsConnectOptions(workspace.requireId())
-          .then((r) => r.options)
-          .catch(() => []),
-      ])
-      available.value = true
-      connection.value = conn
-      connectOptions.value = options
-    } catch {
-      // 503 (integration disabled) or any error → hide the UI entry points.
-      available.value = false
-      connection.value = null
-      connectOptions.value = []
-    }
-  }
-  // Single-flight the probe (app-startup initiative, item 12): `probe()` still re-reads on demand,
-  // but the on-board-open callers (the board page's onboarding gate + the SideBar) use
-  // `ensureProbed()` so their duplicate fire collapses to one request per board. A workspace switch
-  // (new id) re-probes.
-  const { probe, ensureProbed } = useSingleFlightProbe(runProbe, () => workspace.workspaceId)
-
   /** Load the cached repos, pull requests and issues for the workspace. */
   async function load() {
     if (!connected.value) return
@@ -173,16 +150,6 @@ export const useGitHubStore = defineStore('github', () => {
     }
   }
 
-  /**
-   * Ensure the projection (repos/PRs/issues) is loaded at least once — for views
-   * that need it without opening the GitHub panel (e.g. the inspector's repo link).
-   * Probes the integration first if it hasn't been yet.
-   */
-  async function ensureLoaded() {
-    if (available.value === null) await probe()
-    if (connected.value && repos.value.length === 0) await load()
-  }
-
   /** Full file listing per repo (recursive tree), cached by GitHub numeric id. */
   const repoFiles = ref<Record<number, RepoTreeEntry[]>>({})
 
@@ -211,6 +178,21 @@ export const useGitHubStore = defineStore('github', () => {
     connected,
     load,
   }
+  // The board-load probe (integration availability + the bound connection + the connect options +
+  // the credential check). Built from the context rather than inline, so this setup stays within
+  // the function-size ratchet the credential check pushed it past.
+  const { probe, ensureProbed } = createGitHubProbe(context, patCheck)
+
+  /**
+   * Ensure the projection (repos/PRs/issues) is loaded at least once — for views
+   * that need it without opening the GitHub panel (e.g. the inspector's repo link).
+   * Probes the integration first if it hasn't been yet.
+   */
+  async function ensureLoaded() {
+    if (available.value === null) await probe()
+    if (connected.value && repos.value.length === 0) await load()
+  }
+
   const connectionActions = createGitHubConnectionActions(context)
   const repoActions = createGitHubRepoActions(context)
   const vcsConnectActions = createVcsConnectActions(context)
@@ -227,6 +209,7 @@ export const useGitHubStore = defineStore('github', () => {
     available.value = null
     connection.value = null
     connectOptions.value = []
+    patCheck.value = null
     installations.value = []
     repos.value = []
     availableRepos.value = []
@@ -240,6 +223,7 @@ export const useGitHubStore = defineStore('github', () => {
     available,
     connection,
     connectOptions,
+    patCheck,
     installations,
     loadingInstallations,
     repos,

package/app/stores/ui/k3sDeepLink.spec.ts

@@ -0,0 +1,79 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { createUiModals } from '~/stores/ui/modals'
+
+/**
+ * The `cat-factory k3s` CLI hand-off (`?infraSetup=local-k3s&…`), driven through the modals slice
+ * directly (plain refs/functions, no Pinia) exactly as the overlay-host slice tests do.
+ *
+ * What is worth pinning here is the ARRIVAL, not the parsing: the CLI's whole promise is that the
+ * operator lands on the one form it just filled in, and both halves of that (the tab AND the
+ * section anchor within it) are set in this one function. The prefill is asserted alongside
+ * because the deep link is the only thing that ever sets it.
+ */
+function openWith(search: string): void {
+  window.history.replaceState(null, '', `/${search}`)
+}
+
+const K3S_LINK =
+  '?infraSetup=local-k3s&label=Local+k3s&apiServerUrl=https%3A%2F%2F127.0.0.1%3A6443' +
+  '&namespaceTemplate=cf-env-%7B%7BpullNumber%7D%7D&hostTemplate=%7B%7Bbranch%7D%7D.127.0.0.1.nip.io' +
+  '&insecureSkipTlsVerify=1'
+
+describe('consumeK3sSetupDeepLink', () => {
+  beforeEach(() => {
+    openWith('')
+  })
+
+  it('opens the Test-environments tab ANCHORED on the Kubernetes section', () => {
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+
+    expect(ui.infrastructureOpen.value).toBe(true)
+    expect(ui.infrastructureTab.value).toBe('environment')
+    // The tab opens on the default-provision picker, so without this the operator lands above
+    // the form the CLI just described and has to scroll to find it.
+    expect(ui.infrastructureScrollTarget.value).toBe('kubernetes')
+    expect(ui.k3sSetupPrefill.value).toEqual({
+      label: 'Local k3s',
+      apiServerUrl: 'https://127.0.0.1:6443',
+      namespaceTemplate: 'cf-env-{{pullNumber}}',
+      hostTemplate: '{{branch}}.127.0.0.1.nip.io',
+      insecureSkipTlsVerify: true,
+    })
+  })
+
+  it('strips the params so a reload neither re-opens the window nor re-anchors it', () => {
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+    expect(window.location.search).toBe('')
+
+    const reloaded = createUiModals()
+    reloaded.consumeK3sSetupDeepLink()
+    expect(reloaded.infrastructureOpen.value).toBe(false)
+    expect(reloaded.infrastructureScrollTarget.value).toBeNull()
+  })
+
+  it('drops an UNCONSUMED anchor on close, so the next plain open does not scroll', () => {
+    // The panel clears the target once it has scrolled. Closing before it rendered (the window
+    // was dismissed, or the infra probe never resolved) must not leave the anchor armed.
+    const ui = createUiModals()
+    openWith(K3S_LINK)
+    ui.consumeK3sSetupDeepLink()
+    ui.closeProviderConnection()
+
+    expect(ui.infrastructureScrollTarget.value).toBeNull()
+    expect(ui.k3sSetupPrefill.value).toBeNull()
+  })
+
+  it('is a no-op for an unrelated query string', () => {
+    const ui = createUiModals()
+    openWith('?settings=default-test-env')
+    ui.consumeK3sSetupDeepLink()
+
+    expect(ui.infrastructureOpen.value).toBe(false)
+    expect(ui.infrastructureScrollTarget.value).toBeNull()
+    expect(window.location.search).toBe('?settings=default-test-env')
+  })
+})