@cat-factory/app 0.261.1 → 0.261.2

package/app/components/foundational/FoundationalServiceManager.vue

@@ -45,7 +45,7 @@ watch(
   () => {
     void catalog.probe()
     // The repo pickers need the active board's installation state; probe once so they light up.
-    void github.probe()
+    void github.ensureProbed()
   },
   { immediate: true },
 )

package/app/components/fragments/FragmentLibraryManager.vue

@@ -62,7 +62,7 @@ watch(
     void documents.probe()
     // The GitHub pickers (repo search + tree browser) need the active board's
     // installation state; probe once so they light up when the App is connected.
-    void github.probe()
+    void github.ensureProbed()
   },
   { immediate: true },
 )

package/app/components/layout/BoardTopOverlays.vue

@@ -3,6 +3,7 @@ import BoardToolbar from '~/components/layout/BoardToolbar.vue'
 import ConnectionStatusBanner from '~/components/layout/ConnectionStatusBanner.vue'
 import SpendWarningBanner from '~/components/layout/SpendWarningBanner.vue'
 import GitHubPatBanner from '~/components/layout/GitHubPatBanner.vue'
+import GitHubPatPermissionsBanner from '~/components/layout/GitHubPatPermissionsBanner.vue'
 import AiProvidersBanner from '~/components/layout/AiProvidersBanner.vue'
 import ProviderConfigBanner from '~/components/layout/ProviderConfigBanner.vue'
 import InfraSetupBanner from '~/components/layout/InfraSetupBanner.vue'
@@ -68,6 +69,10 @@ const ui = useUiStore()
          - Connection status: what is on screen right now may already be stale.
          - Spend exceeded: runs are blocked until the budget moves.
          - GitHub PAT (local mode): every repo-operating step will fail.
+         - GitHub PAT permissions: a token IS configured, but it cannot push or open pull
+           requests, so every repo-operating step will fail just as surely. Directly after its
+           missing-token sibling, which it can never appear beside (that one raises only when
+           there is no token, this one only when there is).
          - AI readiness: no usable model source, or the default preset names unavailable models.
          - Infrastructure provider: env/runner-pool wired but missing mandatory config.
          - Infra setup: an executor / test env / storage this deployment needs is undefined, so
@@ -82,6 +87,7 @@ const ui = useUiStore()
     />
     <SpendWarningBanner />
     <GitHubPatBanner />
+    <GitHubPatPermissionsBanner />
     <AiProvidersBanner />
     <ProviderConfigBanner />
     <InfraSetupBanner />

package/app/components/layout/GitHubPatPermissionsBanner.vue

@@ -0,0 +1,224 @@
+<script setup lang="ts">
+import { computed, ref } from 'vue'
+import {
+  GITHUB_PAT_FINE_GRAINED_PERMISSIONS,
+  githubPatCheckNeedsAttention,
+  githubPatCheckSource,
+  missingGitHubPatCapabilities,
+} from '@cat-factory/contracts'
+import type { GitHubPatCapability, GitHubPatKind } from '~/types/domain'
+import { githubPatRemintUrl } from '~/utils/vcs'
+
+// The token a run would authenticate with cannot do what the pipeline needs.
+//
+// This is the board-load half of a warning the backend already logs at boot in local mode: a
+// developer's terminal is easy to miss, and on a HOSTED deployment there is no terminal at all
+// for the case this also covers, where the run initiator's own stored token outranks the App
+// installation. Either way the alternative to saying it here is saying it eight steps into a
+// pipeline as a 403 out of a container, after the run has spent money.
+//
+// It raises on ESTABLISHED blocking gaps only (`githubPatCheckNeedsAttention`). An unreachable
+// GitHub, an advisory-only finding and an unknowable fine-grained permission each render
+// nothing over the board, because none of them is something the reader can act on right now and
+// a banner that appears when nothing is wrong is one people learn to dismiss unread.
+//
+// Positioning/stacking is owned by `BoardTopOverlays`; this renders only its card.
+
+const { t } = useI18n()
+const github = useGitHubStore()
+
+const dismissed = ref(false)
+const check = computed(() => github.patCheck)
+const show = computed(
+  () => !dismissed.value && check.value !== null && githubPatCheckNeedsAttention(check.value),
+)
+
+/** The report, when the check produced one. Absent for a token GitHub rejected outright. */
+const report = computed(() => (check.value?.state === 'checked' ? check.value.report : undefined))
+
+/**
+ * Which claim the card is making. `rejected` is the strictly worse problem (the token does not
+ * authenticate at all), so it gets its own copy rather than being folded into "some capability
+ * is missing" — every capability would read as missing, which describes the symptom and not the
+ * cause.
+ */
+const claim = computed<'rejected' | 'underscoped'>(() =>
+  check.value?.state === 'token_rejected' ? 'rejected' : 'underscoped',
+)
+
+const missing = computed<GitHubPatCapability[]>(() =>
+  report.value ? missingGitHubPatCapabilities(report.value).blocking : [],
+)
+/**
+ * Established gaps that do NOT stop a pipeline, listed inside the card but never the reason it
+ * opened. Today that is `workflows`: worth fixing while you are on the token page, not worth
+ * interrupting a board for on its own.
+ */
+const advisory = computed<GitHubPatCapability[]>(() =>
+  report.value ? missingGitHubPatCapabilities(report.value).advisory : [],
+)
+
+const CAPABILITY_KEYS: Record<GitHubPatCapability, string> = {
+  push: 'layout.githubPatPermissionsBanner.capability.push',
+  pullRequests: 'layout.githubPatPermissionsBanner.capability.pullRequests',
+  workflows: 'layout.githubPatPermissionsBanner.capability.workflows',
+}
+function capabilityLabel(capability: GitHubPatCapability): string {
+  return t(CAPABILITY_KEYS[capability])
+}
+
+/**
+ * The kind carried over to the re-mint link. A rejected token was never classified, so it falls
+ * back to `unknown` — which lands on the classic form, the only one GitHub lets us pre-fill.
+ */
+const kind = computed<GitHubPatKind>(() => report.value?.kind ?? 'unknown')
+const remintUrl = computed(() =>
+  githubPatRemintUrl(kind.value, report.value?.webUrl ?? github.connection?.webUrl),
+)
+
+/**
+ * Who has to act. A deployment token is replaced by whoever runs the deployment (local mode:
+ * the developer at the terminal); an initiator token belongs to the signed-in user and is
+ * replaced in their own settings. Sending one to the other's remedy is worse than saying
+ * nothing, which is why the source rides the wire rather than being guessed from the shape.
+ *
+ * Read through the contract's own accessor rather than off `report`, because a REJECTED token
+ * produces no report and every state this banner renders carries a source. Deriving it from the
+ * report alone left the rejected case falling through to whichever branch the ternary ended on,
+ * which told a local developer whose deployment token had expired to replace it in their
+ * personal settings: the exact misrouting the wire field exists to prevent.
+ */
+const sourceKey = computed(() =>
+  check.value && githubPatCheckSource(check.value) === 'deployment'
+    ? 'layout.githubPatPermissionsBanner.sourceDeployment'
+    : 'layout.githubPatPermissionsBanner.sourceInitiator',
+)
+
+/** The fine-grained form takes no prefill, so the permissions have to be named as prose. */
+const fineGrainedPermissions = GITHUB_PAT_FINE_GRAINED_PERMISSIONS.join(', ')
+</script>
+
+<template>
+  <Transition name="fade">
+    <div v-if="show" class="pointer-events-auto w-full max-w-3xl">
+      <div
+        class="w-full max-w-3xl rounded-2xl border-2 border-red-500/70 bg-red-950/95 p-5 shadow-2xl backdrop-blur"
+        role="alert"
+        data-testid="github-pat-permissions-banner"
+      >
+        <div class="flex items-start gap-4">
+          <UIcon name="i-lucide-shield-alert" class="mt-0.5 h-9 w-9 shrink-0 text-red-400" />
+          <div class="min-w-0 flex-1">
+            <div class="flex items-start justify-between gap-3">
+              <h2 class="text-lg font-semibold text-red-100">
+                {{
+                  claim === 'rejected'
+                    ? t('layout.githubPatPermissionsBanner.rejectedTitle')
+                    : t('layout.githubPatPermissionsBanner.title')
+                }}
+              </h2>
+              <UButton
+                color="neutral"
+                variant="ghost"
+                size="xs"
+                icon="i-lucide-x"
+                :aria-label="t('common.close')"
+                @click="
+                  () => {
+                    dismissed = true
+                  }
+                "
+              />
+            </div>
+
+            <p class="mt-1 text-sm text-red-200/90">
+              {{
+                claim === 'rejected'
+                  ? t('layout.githubPatPermissionsBanner.rejectedBody')
+                  : t('layout.githubPatPermissionsBanner.body')
+              }}
+            </p>
+
+            <!-- The established gaps, named one by one. A bare "permissions are missing" leaves
+                 the reader to guess which box to tick on a form with dozens. -->
+            <p v-if="missing.length" class="mt-3 text-sm text-red-100">
+              <span class="font-medium">{{ t('layout.githubPatPermissionsBanner.missing') }}</span>
+              {{ missing.map(capabilityLabel).join(', ') }}
+            </p>
+            <p v-if="advisory.length" class="mt-1 text-xs text-red-200/80">
+              {{
+                t('layout.githubPatPermissionsBanner.alsoMissing', {
+                  capabilities: advisory.map(capabilityLabel).join(', '),
+                })
+              }}
+            </p>
+
+            <!-- For a fine-grained token, WHICH repositories it was not granted is the whole
+                 remedy: the permission list is right and the repository selection is not. -->
+            <p v-if="report && report.deniedRepos.length" class="mt-1 text-xs text-red-200/80">
+              {{
+                t('layout.githubPatPermissionsBanner.deniedRepos', {
+                  repos: report.deniedRepos.join(', '),
+                })
+              }}
+            </p>
+
+            <p class="mt-2 text-xs text-red-200/80">{{ t(sourceKey) }}</p>
+
+            <div class="mt-4">
+              <UButton
+                :to="remintUrl"
+                target="_blank"
+                rel="noopener noreferrer"
+                color="error"
+                variant="solid"
+                icon="i-lucide-external-link"
+                trailing
+              >
+                {{
+                  kind === 'fine_grained'
+                    ? t('layout.githubPatPermissionsBanner.createFineGrained')
+                    : t('layout.githubPatPermissionsBanner.createClassic')
+                }}
+              </UButton>
+              <!-- The classic form arrives with the scopes ticked; the fine-grained one accepts
+                   no prefill at all, so its permissions are spelled out. Saying so is the point:
+                   a link that silently arrived with nothing selected reads as "already done for
+                   you", which is how the missing permission got there in the first place. -->
+              <p class="mt-2 text-xs text-red-300/70">
+                {{
+                  kind === 'fine_grained'
+                    ? t('layout.githubPatPermissionsBanner.fineGrainedHint', {
+                        permissions: fineGrainedPermissions,
+                      })
+                    : t('layout.githubPatPermissionsBanner.classicHint')
+                }}
+              </p>
+              <!-- A fine-grained verdict is a SAMPLE of the linked repositories. Declaring the
+                   remainder keeps a clean-looking list from reading as a guarantee. -->
+              <p v-if="report && report.unprobedRepoCount > 0" class="mt-1 text-xs text-red-300/60">
+                {{
+                  t('layout.githubPatPermissionsBanner.sampled', {
+                    checked: report.probedRepos.length,
+                    remaining: report.unprobedRepoCount,
+                  })
+                }}
+              </p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </div>
+  </Transition>
+</template>
+
+<style scoped>
+.fade-enter-active,
+.fade-leave-active {
+  transition: opacity 0.2s ease;
+}
+.fade-enter-from,
+.fade-leave-to {
+  opacity: 0;
+}
+</style>

package/app/components/skills/SkillLibraryManager.vue

@@ -24,7 +24,7 @@ watch(
   () => {
     void library.probe()
     // The GitHub pickers need the active board's installation state; probe once so they light up.
-    void github.probe()
+    void github.ensureProbed()
   },
   { immediate: true },
 )

package/app/composables/api/github.ts

@@ -6,6 +6,7 @@ import {
   createGitHubRepoContract,
   disconnectGitHubContract,
   getGitHubConnectionContract,
+  getGitHubPatCheckContract,
   getGitHubInstallUrlContract,
   listGitHubAvailableReposContract,
   listGitHubBranchesContract,
@@ -52,6 +53,12 @@ export function githubApi({ send, ws }: ApiContext) {
     getGitHubConnection: (workspaceId: string) =>
       send(getGitHubConnectionContract, { pathPrefix: ws(workspaceId) }),
 
+    // What the personal access token this workspace's runs would authenticate with can actually
+    // do. Answers `not_applicable` (not a 404/503) on a deployment that uses a GitHub App or no
+    // PAT at all, so the caller makes one unconditional call on board load.
+    getGitHubPatCheck: (workspaceId: string) =>
+      send(getGitHubPatCheckContract, { pathPrefix: ws(workspaceId) }),
+
     listGitHubInstallations: (workspaceId: string) =>
       send(listGitHubInstallationsContract, { pathPrefix: ws(workspaceId) }),
 

package/app/stores/github/probe.ts

@@ -0,0 +1,97 @@
+import type { Ref } from 'vue'
+import type { GitHubPatCheck } from '~/types/domain'
+import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
+import type { GitHubStoreContext } from '~/stores/github/context'
+
+/**
+ * The board-load probe: everything the store learns about the deployment's VCS setup in one round
+ * trip, before anything is clicked.
+ *
+ * Three questions, deliberately not three failure modes:
+ *  - Is the integration there at all, and what is bound? (`available` + `connection`)
+ *  - What could be connected, for the not-connected UI? (`connectOptions`)
+ *  - Can the token a run would use actually push? (`patCheck`)
+ *
+ * Extracted from the store setup when the credential check pushed it past the function-size
+ * ratchet, and it is the right seam rather than a convenient one: these three reads share a
+ * lifecycle (fired together on board open, reset together on workspace switch) and nothing else in
+ * the store does.
+ *
+ * The credential check is the odd one out in TWO ways, and both are why it is single-flighted
+ * SEPARATELY rather than being a third branch of `runProbe`:
+ *
+ *  - It is the only read that leaves the deployment. The others answer from local rows in
+ *    milliseconds; this one waits on GitHub, up to a `GET /user` plus a repository read each. So
+ *    it is started beside them and never awaited by the caller: a modal that awaits `probe()` to
+ *    learn whether the integration is available would otherwise sit behind a slow or unreachable
+ *    GitHub for as long as those calls take, to render a banner it does not own.
+ *  - It is a DIAGNOSTIC, not data any caller reads, so it follows the DOOR rather than the batch.
+ *    `ensureProbed()` (the on-board-open fan-out) checks at most once per board; `probe()` (the
+ *    deliberate-refresh door) re-checks, because the surfaces that force a refresh are the ones
+ *    that just changed what the answer depends on: linking a repository to a service frame is
+ *    what turns "this board targets no GitHub repository" into a verdict at all. A panel that
+ *    merely wants to know whether the integration is available belongs on `ensureProbed()`, and
+ *    the ones whose own comments said "probe once so the pickers light up" were moved onto it.
+ */
+export function createGitHubProbe(
+  ctx: GitHubStoreContext,
+  patCheck: Ref<GitHubPatCheck | null>,
+): { probe: () => Promise<void>; ensureProbed: () => Promise<void> } {
+  const { api, workspace, available, connection, connectOptions } = ctx
+
+  async function runPatCheck(): Promise<void> {
+    // Which board asked, captured BEFORE the await: a workspace switch mid-flight must not land
+    // this board's verdict on the next one's banner. The single-flight wrapper re-keys on the id
+    // but cannot un-assign a value the run already wrote.
+    const askedFor = workspace.workspaceId
+    if (!askedFor) return
+    // A failure leaves the previous value alone rather than clearing it: `null` means "not
+    // answered", which the banner reads as nothing to say, and overwriting a real verdict with
+    // it would silently retract a warning the reader has not acted on.
+    const check = await api.getGitHubPatCheck(askedFor).catch(() => null)
+    if (check && workspace.workspaceId === askedFor) patCheck.value = check
+  }
+
+  const patProbe = useSingleFlightProbe(runPatCheck, () => workspace.workspaceId)
+
+  async function runConnectionReads(): Promise<void> {
+    if (!workspace.workspaceId) return
+    try {
+      const [{ connection: conn }, options] = await Promise.all([
+        api.getGitHubConnection(workspace.requireId()),
+        api
+          .listVcsConnectOptions(workspace.requireId())
+          .then((r) => r.options)
+          .catch(() => []),
+      ])
+      available.value = true
+      connection.value = conn
+      connectOptions.value = options
+    } catch {
+      // 503 (integration disabled) or any error → hide the UI entry points.
+      available.value = false
+      connection.value = null
+      connectOptions.value = []
+    }
+  }
+
+  // Single-flight the connection reads (app-startup initiative, item 12): `probe()` still re-reads
+  // on demand, but the on-board-open callers (the board page's onboarding gate + the SideBar) use
+  // `ensureProbed()` so their duplicate fire collapses to one request per board. A workspace switch
+  // (new id) re-probes.
+  const connectionProbe = useSingleFlightProbe(runConnectionReads, () => workspace.workspaceId)
+
+  // The credential check rides the same DOOR the caller opened but never its await, so a slow or
+  // unreachable GitHub delays nothing a caller is waiting on. Awaiting only the connection reads
+  // is what keeps `await github.probe()` a local-row read, which is what its callers treat it as.
+  return {
+    probe: () => {
+      void patProbe.probe()
+      return connectionProbe.probe()
+    },
+    ensureProbed: () => {
+      void patProbe.ensureProbed()
+      return connectionProbe.ensureProbed()
+    },
+  }
+}

package/app/stores/github.spec.ts

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, type Mock } from 'vitest'
 import { useGitHubStore } from '~/stores/github'
 import { useWorkspaceStore } from '~/stores/workspace'
-import type { GitHubConnection, GitHubRepo, VcsConnectOption } from '~/types/domain'
+import type { GitHubConnection, GitHubPatCheck, GitHubRepo, VcsConnectOption } from '~/types/domain'
 
 // The VCS connect surface of the (single, GitHub-shaped) repo store: which connect methods the
 // deployment offers, the per-workspace GitLab PAT connect, and the provider-routed disconnect.
@@ -29,6 +29,7 @@ function stubApi<T extends Record<string, Mock>>(api: T) {
     listGitHubRepos: vi.fn().mockResolvedValue([]),
     listGitHubPullRequests: vi.fn().mockResolvedValue([]),
     listGitHubIssues: vi.fn().mockResolvedValue([]),
+    getGitHubPatCheck: vi.fn().mockResolvedValue({ state: 'not_applicable' }),
     ...api,
   }
   vi.stubGlobal('useApi', () => full)
@@ -285,3 +286,110 @@ describe('github store — repo web links', () => {
     )
   })
 })
+
+// The credential check rides the same probe DOOR, but neither the same failure nor the same
+// await. Local mode reaches GitHub with a personal access token and wires no App module, so the
+// connection read 503s exactly where this check matters most; sharing that catch would have
+// discarded the answer there. And it is the only read that leaves the deployment, so a caller
+// awaiting `probe()` must never end up waiting on GitHub.
+describe('github store — GitHub PAT credential check', () => {
+  const REPORT: GitHubPatCheck = {
+    state: 'checked',
+    report: {
+      source: 'deployment',
+      kind: 'classic',
+      capabilities: { push: 'missing', pullRequests: 'missing', workflows: 'missing' },
+      probedRepos: [],
+      deniedRepos: [],
+      unprobedRepoCount: 0,
+      webUrl: 'https://github.com',
+    },
+  }
+
+  it('resolves the check alongside the connection probe', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockResolvedValue(REPORT),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  it('keeps the check when the connection read fails, as it does in local mode', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockRejectedValue(new Error('503')),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockResolvedValue(REPORT),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(false)
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  // A failed READ is not a verdict: `null` says "not answered", which the banner renders as
+  // nothing. Collapsing it onto a clean report would be an all-clear nobody established.
+  it('leaves the check unanswered when its own read fails', async () => {
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: null }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockRejectedValue(new Error('500')),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.patCheck).toBeNull()
+  })
+
+  // The reason it is not awaited: two modals block their open on `probe()`, and every other
+  // read behind it answers from local rows. Awaited, an unreachable GitHub held those modals
+  // for the full outbound timeout to settle a banner they do not render.
+  it('does not make callers wait on the outbound check', async () => {
+    let settleCheck = (_: GitHubPatCheck) => {}
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck: vi.fn().mockReturnValue(
+        new Promise<GitHubPatCheck>((resolve) => {
+          settleCheck = resolve
+        }),
+      ),
+    })
+    const github = storeWithWorkspace()
+
+    await github.probe()
+
+    expect(github.available).toBe(true)
+    expect(github.patCheck).toBeNull()
+    settleCheck(REPORT)
+    await vi.waitFor(() => expect(github.patCheck).toEqual(REPORT))
+  })
+
+  // The on-board-open fan-out fires the probe from several places at once. The credential check
+  // spends the user's GitHub rate limit, so it collapses to one per board rather than one per
+  // caller — while `probe()`, the deliberate-refresh door, still re-checks, because the surfaces
+  // that force a refresh are the ones that just changed what the answer depends on.
+  it('checks once per board across the on-open fan-out, and again on a deliberate refresh', async () => {
+    const getGitHubPatCheck = vi.fn().mockResolvedValue(REPORT)
+    stubApi({
+      getGitHubConnection: vi.fn().mockResolvedValue({ connection: connection() }),
+      listVcsConnectOptions: vi.fn().mockResolvedValue({ options: [] }),
+      getGitHubPatCheck,
+    })
+    const github = storeWithWorkspace()
+
+    await Promise.all([github.ensureProbed(), github.ensureProbed()])
+    await github.ensureProbed()
+    await vi.waitFor(() => expect(getGitHubPatCheck).toHaveBeenCalledTimes(1))
+
+    await github.probe()
+    await vi.waitFor(() => expect(getGitHubPatCheck).toHaveBeenCalledTimes(2))
+  })
+})

package/app/stores/github.ts

@@ -6,6 +6,7 @@ import type {
   GitHubConnection,
   GitHubInstallationOption,
   GitHubIssue,
+  GitHubPatCheck,
   GitHubPullRequest,
   GitHubRepo,
   RepoTreeEntry,
@@ -13,12 +14,12 @@ import type {
   VcsProvider,
 } from '~/types/domain'
 import { branchWebUrl, issueWebUrl, pullWebUrl, repoWebUrl } from '~/utils/vcs'
-import { useSingleFlightProbe } from '~/composables/useSingleFlightProbe'
 import { useUpsertList } from '~/composables/useUpsertList'
 import { useWorkspaceStore } from '~/stores/workspace'
 import { useServicesStore } from '~/stores/services'
 import { pullKey, type GitHubStoreContext } from '~/stores/github/context'
 import { createGitHubConnectionActions } from '~/stores/github/connection'
+import { createGitHubProbe } from '~/stores/github/probe'
 import { createGitHubRepoActions } from '~/stores/github/repoActions'
 import { createVcsConnectActions, createVcsProviderViews } from '~/stores/github/vcsConnect'
 
@@ -41,6 +42,13 @@ export const useGitHubStore = defineStore('github', () => {
   const connection = ref<GitHubConnection | null>(null)
   /** The connect surfaces this deployment serves; resolved by the probe alongside `connection`. */
   const connectOptions = ref<VcsConnectOption[]>([])
+  /**
+   * What the personal access token this workspace's runs would use can actually do, resolved by
+   * the probe. `null` = not answered (unprobed, or the read failed); the check's own
+   * `not_applicable` state is what "there is no PAT here" looks like. The two are kept apart
+   * because only the second is a fact.
+   */
+  const patCheck = ref<GitHubPatCheck | null>(null)
   /** Discovered App installations for the connect picker; loaded on demand. */
   const installations = ref<GitHubInstallationOption[]>([])
   const loadingInstallations = ref(false)
@@ -124,37 +132,6 @@ export const useGitHubStore = defineStore('github', () => {
     return branchWebUrl(providerOfRepo(repoGithubId), repoUrl(repoGithubId), branch)
   }
 
-  /**
-   * Probe the integration: resolves `available`, the current connection, and which connect
-   * surfaces the deployment serves. The capability read rides the same round trip (it is what
-   * the not-connected UI renders from), and degrades to "no connect surface" on its own.
-   */
-  async function runProbe() {
-    if (!workspace.workspaceId) return
-    try {
-      const [{ connection: conn }, options] = await Promise.all([
-        api.getGitHubConnection(workspace.requireId()),
-        api
-          .listVcsConnectOptions(workspace.requireId())
-          .then((r) => r.options)
-          .catch(() => []),
-      ])
-      available.value = true
-      connection.value = conn
-      connectOptions.value = options
-    } catch {
-      // 503 (integration disabled) or any error → hide the UI entry points.
-      available.value = false
-      connection.value = null
-      connectOptions.value = []
-    }
-  }
-  // Single-flight the probe (app-startup initiative, item 12): `probe()` still re-reads on demand,
-  // but the on-board-open callers (the board page's onboarding gate + the SideBar) use
-  // `ensureProbed()` so their duplicate fire collapses to one request per board. A workspace switch
-  // (new id) re-probes.
-  const { probe, ensureProbed } = useSingleFlightProbe(runProbe, () => workspace.workspaceId)
-
   /** Load the cached repos, pull requests and issues for the workspace. */
   async function load() {
     if (!connected.value) return
@@ -173,16 +150,6 @@ export const useGitHubStore = defineStore('github', () => {
     }
   }
 
-  /**
-   * Ensure the projection (repos/PRs/issues) is loaded at least once — for views
-   * that need it without opening the GitHub panel (e.g. the inspector's repo link).
-   * Probes the integration first if it hasn't been yet.
-   */
-  async function ensureLoaded() {
-    if (available.value === null) await probe()
-    if (connected.value && repos.value.length === 0) await load()
-  }
-
   /** Full file listing per repo (recursive tree), cached by GitHub numeric id. */
   const repoFiles = ref<Record<number, RepoTreeEntry[]>>({})
 
@@ -211,6 +178,21 @@ export const useGitHubStore = defineStore('github', () => {
     connected,
     load,
   }
+  // The board-load probe (integration availability + the bound connection + the connect options +
+  // the credential check). Built from the context rather than inline, so this setup stays within
+  // the function-size ratchet the credential check pushed it past.
+  const { probe, ensureProbed } = createGitHubProbe(context, patCheck)
+
+  /**
+   * Ensure the projection (repos/PRs/issues) is loaded at least once — for views
+   * that need it without opening the GitHub panel (e.g. the inspector's repo link).
+   * Probes the integration first if it hasn't been yet.
+   */
+  async function ensureLoaded() {
+    if (available.value === null) await probe()
+    if (connected.value && repos.value.length === 0) await load()
+  }
+
   const connectionActions = createGitHubConnectionActions(context)
   const repoActions = createGitHubRepoActions(context)
   const vcsConnectActions = createVcsConnectActions(context)
@@ -227,6 +209,7 @@ export const useGitHubStore = defineStore('github', () => {
     available.value = null
     connection.value = null
     connectOptions.value = []
+    patCheck.value = null
     installations.value = []
     repos.value = []
     availableRepos.value = []
@@ -240,6 +223,7 @@ export const useGitHubStore = defineStore('github', () => {
     available,
     connection,
     connectOptions,
+    patCheck,
     installations,
     loadingInstallations,
     repos,

package/app/types/github.ts

@@ -11,6 +11,10 @@
 export type {
   GitHubConnection,
   GitHubInstallationOption,
+  GitHubPatCapability,
+  GitHubPatCapabilityReport,
+  GitHubPatCheck,
+  GitHubPatKind,
   GitHubRepo,
   RepoTreeEntry,
   GitHubBranch,

package/app/utils/connectionWarnings.ts

@@ -20,4 +20,5 @@ export const CONNECTION_WARNING_KEYS: Record<ConnectionWarningCode, string> = {
     'settings.providerConnection.test.warnings.github_pat_scopes_beyond_need',
   github_pat_scope_unreadable:
     'settings.providerConnection.test.warnings.github_pat_scope_unreadable',
+  github_pat_no_scopes: 'settings.providerConnection.test.warnings.github_pat_no_scopes',
 }

package/app/utils/vcs.ts

@@ -1,4 +1,5 @@
-import type { GitHubConnection, VcsProvider } from '~/types/domain'
+import { GITHUB_TOKEN_CREATE_PATHS, githubPatCreateUrl } from '@cat-factory/contracts'
+import type { GitHubConnection, GitHubPatKind, VcsProvider } from '~/types/domain'
 
 // ---------------------------------------------------------------------------
 // Shared VCS provider presentation. The platform's repo DATA is provider-neutral (one
@@ -42,9 +43,14 @@ const VCS_PROVIDER_PUBLIC_WEB_URLS: Record<VcsProvider, string> = {
   gitlab: 'https://gitlab.com',
 }
 
-/** Where a user creates a personal access token, relative to the instance's web root. */
+/**
+ * Where a user creates a personal access token, relative to the instance's web root. GitHub's
+ * comes from `@cat-factory/contracts` rather than being spelled again here: the credential
+ * banner's PRE-FILLED re-mint link is built from that same map, and the unscoped connect-box
+ * link below has to land on the same page.
+ */
 const TOKEN_SETTINGS_PATHS: Record<VcsProvider, string> = {
-  github: '/settings/tokens/new',
+  github: GITHUB_TOKEN_CREATE_PATHS.classic,
   gitlab: '/-/user_settings/personal_access_tokens',
 }
 
@@ -85,6 +91,25 @@ export function vcsTokenCreateUrl(provider: VcsProvider, webUrl?: string | null)
   return `${root(webUrl || VCS_PROVIDER_PUBLIC_WEB_URLS[provider])}${TOKEN_SETTINGS_PATHS[provider]}`
 }
 
+/**
+ * Where the credential banner sends someone to REPLACE a GitHub token that cannot do what their
+ * runs need, pre-filled as far as GitHub allows.
+ *
+ * The `kind` is the kind of the token being replaced, so a deployment that standardised on
+ * fine-grained tokens is not pushed back to a classic one by a warning. When the check never got
+ * far enough to classify (GitHub rejected the token outright), the caller passes `'unknown'` and
+ * lands on the form that CAN be pre-filled.
+ *
+ * Shares {@link vcsTokenCreateUrl}'s public-host fallback for the same stated reason: this is a
+ * settings page, so being wrong costs one noticed click, unlike a repository link.
+ */
+export function githubPatRemintUrl(kind: GitHubPatKind, webUrl?: string | null): string {
+  return githubPatCreateUrl(kind, {
+    webUrl: webUrl || VCS_PROVIDER_PUBLIC_WEB_URLS.github,
+    description: 'cat-factory',
+  })
+}
+
 /**
  * The App installation's settings page, where a user grants it access to a repository it
  * can't see yet — or `undefined` when the connection is not a GitHub-App one.

package/i18n/locales/de.json

@@ -388,7 +388,8 @@
           "runner_manifest_no_status_path": "Kein Statuspfad: Jede Abfrage wird als weiterhin laufend gelesen. Ein Job kann daher nur enden, wenn das Abfragebudget des Laufs aufgebraucht ist.",
           "github_pat_classic_account_wide": "Dies ist ein klassisches Token mit dem Bereich 'repo': Es erreicht jedes Repository, in das du pushen kannst, auch solche, in denen die GitHub-App dieses Arbeitsbereichs nie installiert wurde. Ausführungen, die du startest, nutzen es bevorzugt vor der App. Ein fein abgestuftes Token, das auf die Repositories dieser Installation begrenzt ist, ist enger gefasst.",
           "github_pat_scopes_beyond_need": "Dieses Token gewährt Berechtigungen, die cat-factory nie nutzt. Sie zu entfernen kostet nichts und verkleinert das, was eine kompromittierte Ausführung erreichen könnte.",
-          "github_pat_scope_unreadable": "GitHub hat dieses Token akzeptiert, aber keine Bereiche dafür gemeldet, daher lässt sich seine Reichweite hier nicht anzeigen. Prüfe in deinen GitHub-Token-Einstellungen, was es gewährt."
+          "github_pat_scope_unreadable": "GitHub hat dieses Token akzeptiert, aber keine Bereiche dafür gemeldet, daher lässt sich seine Reichweite hier nicht anzeigen. Prüfe in deinen GitHub-Token-Einstellungen, was es gewährt.",
+          "github_pat_no_scopes": "GitHub meldet für dieses klassische Token keine Scopes, es kann also nur öffentliche Daten lesen. Läufe, die damit klonen, pushen oder einen Pull Request öffnen, schlagen fehl. Erstellen Sie ein neues Token mit ausgewähltem 'repo' und 'workflow'."
         }
       },
       "toast": {
@@ -2453,6 +2454,27 @@
       "createToken": "Ein GitHub-Token erstellen (Scopes vorausgewählt)",
       "thenSet": "Setzen Sie dann {envVar} und starten Sie neu."
     },
+    "githubPatPermissionsBanner": {
+      "title": "GitHub-Token kann nicht pushen oder Pull Requests öffnen",
+      "rejectedTitle": "GitHub hat das Token Ihrer Läufe abgelehnt",
+      "body": "Hier gestartete Läufe authentifizieren sich mit einem GitHub Personal Access Token, und diesem fehlen Berechtigungen, die die Pipeline braucht. Agentenschritte, die einen Branch pushen, einen Pull Request öffnen oder mergen, werden fehlschlagen.",
+      "rejectedBody": "Das GitHub Personal Access Token, mit dem sich Ihre Läufe authentifizieren, ist ungültig, abgelaufen, widerrufen oder durch eine Organisationsrichtlinie blockiert. Jeder Schritt, der klont, pusht, einen Pull Request öffnet oder merget, schlägt fehl, bis es ersetzt wird.",
+      "missing": "Fehlt:",
+      "alsoMissing": "Fehlt ebenfalls, blockiert aber nur Änderungen an Workflow-Dateien: {capabilities}.",
+      "capability": {
+        "push": "Commits pushen",
+        "pullRequests": "Pull Requests öffnen und mergen",
+        "workflows": "Workflow-Dateien bearbeiten"
+      },
+      "sourceDeployment": "Dies ist das Token, mit dem dieses Deployment konfiguriert ist; es zu ersetzen bedeutet daher, das Deployment zu aktualisieren.",
+      "sourceInitiator": "Dies ist Ihr eigenes gespeichertes Token, das Ihre Läufe bevorzugt vor den Deployment-Zugangsdaten verwenden. Ersetzen Sie es in Ihren persönlichen Einstellungen.",
+      "createClassic": "Ersatz-Token erstellen (Scopes vorausgewählt)",
+      "createFineGrained": "Fein granuliertes Ersatz-Token erstellen",
+      "classicHint": "Der Link öffnet das klassische Token-Formular mit bereits ausgewählten erforderlichen Scopes.",
+      "fineGrainedHint": "Das fein granulierte Formular von GitHub akzeptiert keine Vorauswahl; erteilen Sie diese Repository-Berechtigungen daher selbst: {permissions}.",
+      "sampled": "Gegen {checked} genutzte Repositories geprüft; {remaining} weitere wurden nicht geprüft.",
+      "deniedRepos": "Das Token erreicht diese von Ihren Services genutzten Repositories nicht: {repos}. Erstellen Sie es neu und wählen Sie diese Repositories aus."
+    },
     "providerConfigBanner": {
       "titleMany": "Anbieter benötigen Konfiguration",
       "titleOne": {

package/i18n/locales/en.json

@@ -2341,6 +2341,45 @@
       "createToken": "Create a GitHub token (scopes pre-selected)",
       "thenSet": "Then set {envVar} and restart."
     },
+    "githubPatPermissionsBanner": {
+      "title": "GitHub token cannot push or open pull requests",
+      "rejectedTitle": "GitHub rejected the token your runs use",
+      "body": "Runs started here authenticate with a GitHub personal access token, and this one lacks permissions the pipeline needs. Agent steps that push a branch, open a pull request or merge will fail.",
+      "rejectedBody": "The GitHub personal access token your runs authenticate with is invalid, expired, revoked, or blocked by an organisation policy. Every step that clones, pushes, opens a pull request or merges will fail until it is replaced.",
+      "missing": "Missing:",
+      "alsoMissing": "Also missing, though it only blocks changes to workflow files: {capabilities}.",
+      "capability": {
+        "push": "pushing commits",
+        "pullRequests": "opening and merging pull requests",
+        "workflows": "editing workflow files"
+      },
+      "sourceDeployment": "This is the token this deployment is configured with, so replacing it means updating the deployment.",
+      "sourceInitiator": "This is your own stored token, which your runs use in preference to the deployment credential. Replace it in your personal settings.",
+      "createClassic": "Create a replacement token (scopes pre-selected)",
+      "createFineGrained": "Create a replacement fine-grained token",
+      "classicHint": "The link opens the classic token form with the required scopes already selected.",
+      "fineGrainedHint": "GitHub's fine-grained form accepts no pre-selection, so grant these repository permissions yourself: {permissions}.",
+      "sampled": "Checked against {checked} targeted repositories; {remaining} more were not checked.",
+      "deniedRepos": "The token cannot reach these repositories your services target: {repos}. Re-mint it with those repositories selected.",
+      "@title": {
+        "description": "Banner heading when the configured GitHub personal access token authenticates but lacks a permission the pipeline needs. \"push\" and \"pull request\" are the Git/GitHub terms."
+      },
+      "@rejectedTitle": {
+        "description": "Banner heading for the worse case: GitHub refused the token outright (401/403). Distinct from the missing-permission heading on purpose."
+      },
+      "@alsoMissing": {
+        "description": "{capabilities} is a comma-joined list of capability names from the `capability` group. Shown only beside a blocking finding, never alone."
+      },
+      "@fineGrainedHint": {
+        "description": "{permissions} is a comma-joined list of GitHub's own fine-grained permission identifiers (e.g. contents:write); keep them verbatim, untranslated."
+      },
+      "@sampled": {
+        "description": "Declares that the fine-grained check read a SAMPLE. {checked} and {remaining} are counts of repositories."
+      },
+      "@deniedRepos": {
+        "description": "{repos} is a comma-joined list of GitHub owner/name repository paths; keep them verbatim, untranslated. Shown when a fine-grained token was denied access to repositories the board's services target."
+      }
+    },
     "providerConfigBanner": {
       "titleMany": "Providers need configuration",
       "titleOne": {
@@ -3074,7 +3113,8 @@
           "runner_manifest_no_status_path": "No status path: every poll reads as still running, so a job can only end by exhausting the run's poll budget.",
           "github_pat_classic_account_wide": "This is a classic token with the 'repo' scope: it reaches every repository you can push to, including ones this workspace's GitHub App was never installed on. Runs you start use it in preference to the App. A fine-grained token limited to this deployment's repositories is narrower.",
           "github_pat_scopes_beyond_need": "This token grants permissions cat-factory never uses. Removing them costs nothing and narrows what a compromised run could reach.",
-          "github_pat_scope_unreadable": "GitHub accepted this token but reported no scopes for it, so its reach cannot be shown here. Check what it grants in your GitHub token settings."
+          "github_pat_scope_unreadable": "GitHub accepted this token but reported no scopes for it, so its reach cannot be shown here. Check what it grants in your GitHub token settings.",
+          "github_pat_no_scopes": "GitHub reports no scopes for this classic token, so it can read public data and nothing else. Runs that clone, push or open a pull request with it will fail. Mint a replacement with 'repo' and 'workflow' selected."
         }
       },
       "toast": {

package/i18n/locales/es.json

@@ -2234,6 +2234,27 @@
       "createToken": "Crear un token de GitHub (ámbitos preseleccionados)",
       "thenSet": "Luego define {envVar} y reinicia."
     },
+    "githubPatPermissionsBanner": {
+      "title": "El token de GitHub no puede hacer push ni abrir pull requests",
+      "rejectedTitle": "GitHub rechazó el token que usan tus ejecuciones",
+      "body": "Las ejecuciones iniciadas aquí se autentican con un token de acceso personal de GitHub, y a este le faltan permisos que la canalización necesita. Los pasos de agente que envían una rama, abren una pull request o fusionan fallarán.",
+      "rejectedBody": "El token de acceso personal de GitHub con el que se autentican tus ejecuciones no es válido, ha caducado, fue revocado o está bloqueado por una política de la organización. Todos los pasos que clonan, envían, abren pull requests o fusionan fallarán hasta que lo reemplaces.",
+      "missing": "Falta:",
+      "alsoMissing": "También falta, aunque solo bloquea cambios en archivos de flujo de trabajo: {capabilities}.",
+      "capability": {
+        "push": "enviar commits",
+        "pullRequests": "abrir y fusionar pull requests",
+        "workflows": "editar archivos de flujo de trabajo"
+      },
+      "sourceDeployment": "Este es el token con el que está configurado este despliegue, así que reemplazarlo implica actualizar el despliegue.",
+      "sourceInitiator": "Este es tu propio token almacenado, que tus ejecuciones usan con preferencia sobre la credencial del despliegue. Reemplázalo en tus ajustes personales.",
+      "createClassic": "Crear un token de reemplazo (ámbitos preseleccionados)",
+      "createFineGrained": "Crear un token de reemplazo de permisos detallados",
+      "classicHint": "El enlace abre el formulario de token clásico con los ámbitos necesarios ya seleccionados.",
+      "fineGrainedHint": "El formulario de permisos detallados de GitHub no admite preselección, así que concede tú mismo estos permisos de repositorio: {permissions}.",
+      "sampled": "Se comprobaron {checked} repositorios en uso; otros {remaining} no se comprobaron.",
+      "deniedRepos": "El token no puede acceder a estos repositorios que usan tus servicios: {repos}. Vuelve a generarlo seleccionando esos repositorios."
+    },
     "providerConfigBanner": {
       "titleMany": "Los proveedores necesitan configuración",
       "titleOne": {
@@ -2763,7 +2784,8 @@
           "runner_manifest_no_status_path": "Sin ruta de estado: cada sondeo se interpreta como todavía en ejecución, así que un trabajo solo puede terminar agotando el presupuesto de sondeo de la ejecución.",
           "github_pat_classic_account_wide": "Es un token clásico con el ámbito 'repo': alcanza todos los repositorios a los que puedes hacer push, incluidos aquellos donde nunca se instaló la App de GitHub de este espacio de trabajo. Las ejecuciones que inicias lo usan con preferencia sobre la App. Un token granular limitado a los repositorios de esta instalación es más estrecho.",
           "github_pat_scopes_beyond_need": "Este token concede permisos que cat-factory nunca usa. Quitarlos no cuesta nada y reduce lo que podría alcanzar una ejecución comprometida.",
-          "github_pat_scope_unreadable": "GitHub aceptó este token pero no informó de sus ámbitos, así que aquí no se puede mostrar su alcance. Comprueba lo que concede en la configuración de tokens de GitHub."
+          "github_pat_scope_unreadable": "GitHub aceptó este token pero no informó de sus ámbitos, así que aquí no se puede mostrar su alcance. Comprueba lo que concede en la configuración de tokens de GitHub.",
+          "github_pat_no_scopes": "GitHub no informa de ningún ámbito para este token clásico, así que solo puede leer datos públicos. Las ejecuciones que clonen, envíen cambios o abran una pull request con él fallarán. Genera uno nuevo con 'repo' y 'workflow' seleccionados."
         }
       },
       "toast": {

package/i18n/locales/fr.json

@@ -2234,6 +2234,27 @@
       "createToken": "Créer un jeton GitHub (portées présélectionnées)",
       "thenSet": "Définissez ensuite {envVar} et redémarrez."
     },
+    "githubPatPermissionsBanner": {
+      "title": "Le jeton GitHub ne peut ni pousser ni ouvrir de pull requests",
+      "rejectedTitle": "GitHub a rejeté le jeton utilisé par vos exécutions",
+      "body": "Les exécutions lancées ici s'authentifient avec un jeton d'accès personnel GitHub, et celui-ci n'a pas les autorisations dont le pipeline a besoin. Les étapes d'agent qui poussent une branche, ouvrent une pull request ou fusionnent échoueront.",
+      "rejectedBody": "Le jeton d'accès personnel GitHub avec lequel vos exécutions s'authentifient est invalide, expiré, révoqué ou bloqué par une politique d'organisation. Toute étape qui clone, pousse, ouvre une pull request ou fusionne échouera tant qu'il n'est pas remplacé.",
+      "missing": "Manquant :",
+      "alsoMissing": "Manque également, bien que cela ne bloque que les modifications des fichiers de workflow : {capabilities}.",
+      "capability": {
+        "push": "pousser des commits",
+        "pullRequests": "ouvrir et fusionner des pull requests",
+        "workflows": "modifier les fichiers de workflow"
+      },
+      "sourceDeployment": "C'est le jeton configuré pour ce déploiement ; le remplacer suppose donc de mettre à jour le déploiement.",
+      "sourceInitiator": "C'est votre propre jeton enregistré, que vos exécutions utilisent de préférence aux identifiants du déploiement. Remplacez-le dans vos paramètres personnels.",
+      "createClassic": "Créer un jeton de remplacement (portées présélectionnées)",
+      "createFineGrained": "Créer un jeton de remplacement à portée fine",
+      "classicHint": "Le lien ouvre le formulaire de jeton classique avec les portées requises déjà sélectionnées.",
+      "fineGrainedHint": "Le formulaire à portée fine de GitHub n'accepte aucune présélection : accordez vous-même ces autorisations de dépôt : {permissions}.",
+      "sampled": "Vérifié sur {checked} dépôts utilisés ; {remaining} autres non vérifiés.",
+      "deniedRepos": "Le jeton n'atteint pas ces dépôts utilisés par vos services : {repos}. Régénérez-le en sélectionnant ces dépôts."
+    },
     "providerConfigBanner": {
       "titleMany": "Les fournisseurs nécessitent une configuration",
       "titleOne": {
@@ -2763,7 +2784,8 @@
           "runner_manifest_no_status_path": "Aucun chemin de statut : chaque interrogation est lue comme toujours en cours, donc un job ne peut se terminer qu'en épuisant le budget d'interrogation de l'exécution.",
           "github_pat_classic_account_wide": "Il s'agit d'un jeton classique avec la portée 'repo' : il atteint tous les dépôts sur lesquels vous pouvez pousser, y compris ceux où l'App GitHub de cet espace de travail n'a jamais été installée. Les exécutions que vous lancez l'utilisent de préférence à l'App. Un jeton à portée fine, limité aux dépôts de cette installation, est plus restreint.",
           "github_pat_scopes_beyond_need": "Ce jeton accorde des permissions que cat-factory n'utilise jamais. Les retirer ne coûte rien et réduit ce qu'une exécution compromise pourrait atteindre.",
-          "github_pat_scope_unreadable": "GitHub a accepté ce jeton mais n'a signalé aucune portée, sa portée ne peut donc pas être affichée ici. Vérifiez ce qu'il accorde dans vos paramètres de jetons GitHub."
+          "github_pat_scope_unreadable": "GitHub a accepté ce jeton mais n'a signalé aucune portée, sa portée ne peut donc pas être affichée ici. Vérifiez ce qu'il accorde dans vos paramètres de jetons GitHub.",
+          "github_pat_no_scopes": "GitHub ne signale aucune portée pour ce jeton classique : il ne peut lire que des données publiques. Les exécutions qui clonent, poussent ou ouvrent une pull request avec lui échoueront. Créez-en un nouveau avec 'repo' et 'workflow' sélectionnés."
         }
       },
       "toast": {

package/i18n/locales/he.json

@@ -2234,6 +2234,27 @@
       "createToken": "צור אסימון GitHub (ההרשאות נבחרו מראש)",
       "thenSet": "לאחר מכן הגדר {envVar} והפעל מחדש."
     },
+    "githubPatPermissionsBanner": {
+      "title": "אסימון GitHub אינו יכול לדחוף או לפתוח בקשות משיכה",
+      "rejectedTitle": "GitHub דחה את האסימון שבו משתמשות ההרצות שלך",
+      "body": "הרצות שמתחילות כאן מאמתות באמצעות אסימון גישה אישי של GitHub, ולאסימון הזה חסרות הרשאות שהצינור זקוק להן. שלבי סוכן שדוחפים ענף, פותחים בקשת משיכה או ממזגים ייכשלו.",
+      "rejectedBody": "אסימון הגישה האישי של GitHub שבו מאומתות ההרצות שלך אינו תקף, פג תוקפו, בוטל או נחסם על ידי מדיניות ארגונית. כל שלב שמשכפל, דוחף, פותח בקשת משיכה או ממזג ייכשל עד להחלפתו.",
+      "missing": "חסר:",
+      "alsoMissing": "חסר גם, אף שהדבר חוסם רק שינויים בקובצי תהליכי עבודה: {capabilities}.",
+      "capability": {
+        "push": "דחיפת קומיטים",
+        "pullRequests": "פתיחה ומיזוג של בקשות משיכה",
+        "workflows": "עריכת קובצי תהליכי עבודה"
+      },
+      "sourceDeployment": "זהו האסימון שאיתו מוגדרת הפריסה הזו, ולכן החלפתו משמעה עדכון הפריסה.",
+      "sourceInitiator": "זהו האסימון השמור שלך, שההרצות שלך מעדיפות על פני אישורי הפריסה. החלף אותו בהגדרות האישיות שלך.",
+      "createClassic": "צור אסימון חלופי (ההרשאות נבחרו מראש)",
+      "createFineGrained": "צור אסימון חלופי עם הרשאות מדויקות",
+      "classicHint": "הקישור פותח את טופס האסימון הקלאסי כשההרשאות הנדרשות כבר מסומנות.",
+      "fineGrainedHint": "טופס ההרשאות המדויקות של GitHub אינו תומך בבחירה מראש, לכן הענק בעצמך את הרשאות המאגר הבאות: {permissions}.",
+      "sampled": "נבדק מול {checked} מאגרים שבשימוש; {remaining} נוספים לא נבדקו.",
+      "deniedRepos": "האסימון אינו מגיע למאגרים האלה שהשירותים שלך משתמשים בהם: {repos}. צור אותו מחדש ובחר את המאגרים האלה."
+    },
     "providerConfigBanner": {
       "titleMany": "ספקים זקוקים להגדרה",
       "titleOne": {
@@ -2964,7 +2985,8 @@
           "runner_manifest_no_status_path": "אין נתיב סטטוס: כל תשאול נקרא כאילו המשימה עדיין רצה, ולכן משימה יכולה להסתיים רק לאחר ניצול כל תקציב התשאול של ההרצה.",
           "github_pat_classic_account_wide": "זהו אסימון קלאסי עם ההרשאה 'repo': הוא מגיע לכל מאגר שאתם יכולים לדחוף אליו, כולל מאגרים שאפליקציית GitHub של סביבת העבודה הזו מעולם לא הותקנה בהם. הרצות שאתם מתחילים משתמשות בו במקום באפליקציה. אסימון מפורט המוגבל למאגרים של התקנה זו צר יותר.",
           "github_pat_scopes_beyond_need": "האסימון הזה מעניק הרשאות ש-cat-factory לעולם אינה משתמשת בהן. הסרתן אינה עולה דבר ומצמצמת את מה שהרצה שנפרצה יכולה להגיע אליו.",
-          "github_pat_scope_unreadable": "GitHub קיבלה את האסימון הזה אך לא דיווחה על ההרשאות שלו, ולכן לא ניתן להציג כאן את טווחו. בדקו בהגדרות האסימונים שלכם ב-GitHub מה הוא מעניק."
+          "github_pat_scope_unreadable": "GitHub קיבלה את האסימון הזה אך לא דיווחה על ההרשאות שלו, ולכן לא ניתן להציג כאן את טווחו. בדקו בהגדרות האסימונים שלכם ב-GitHub מה הוא מעניק.",
+          "github_pat_no_scopes": "GitHub אינו מדווח על היקפי הרשאה לאסימון הקלאסי הזה, ולכן הוא יכול לקרוא רק נתונים ציבוריים. הרצות שמשכפלות, דוחפות או פותחות בקשת משיכה איתו ייכשלו. צור אסימון חדש עם 'repo' ו-'workflow' מסומנים."
         }
       },
       "toast": {

package/i18n/locales/it.json

@@ -388,7 +388,8 @@
           "runner_manifest_no_status_path": "Nessun percorso di stato: ogni polling viene letto come ancora in corso, quindi un job può terminare solo esaurendo il budget di polling dell'esecuzione.",
           "github_pat_classic_account_wide": "È un token classico con l'ambito 'repo': raggiunge ogni repository su cui puoi fare push, compresi quelli in cui l'App GitHub di questo spazio di lavoro non è mai stata installata. Le esecuzioni che avvii lo usano di preferenza rispetto all'App. Un token granulare limitato ai repository di questa installazione è più ristretto.",
           "github_pat_scopes_beyond_need": "Questo token concede permessi che cat-factory non usa mai. Rimuoverli non costa nulla e restringe ciò che un'esecuzione compromessa potrebbe raggiungere.",
-          "github_pat_scope_unreadable": "GitHub ha accettato questo token ma non ne ha segnalato gli ambiti, quindi la sua portata non può essere mostrata qui. Verifica cosa concede nelle impostazioni dei token di GitHub."
+          "github_pat_scope_unreadable": "GitHub ha accettato questo token ma non ne ha segnalato gli ambiti, quindi la sua portata non può essere mostrata qui. Verifica cosa concede nelle impostazioni dei token di GitHub.",
+          "github_pat_no_scopes": "GitHub non riporta alcun ambito per questo token classico, quindi può solo leggere dati pubblici. Le esecuzioni che clonano, inviano commit o aprono una pull request con esso falliranno. Generane uno nuovo con 'repo' e 'workflow' selezionati."
         }
       },
       "toast": {
@@ -2453,6 +2454,27 @@
       "createToken": "Crea un token GitHub (scope pre-selezionati)",
       "thenSet": "Poi imposta {envVar} e riavvia."
     },
+    "githubPatPermissionsBanner": {
+      "title": "Il token GitHub non può fare push né aprire pull request",
+      "rejectedTitle": "GitHub ha rifiutato il token usato dalle tue esecuzioni",
+      "body": "Le esecuzioni avviate qui si autenticano con un personal access token GitHub, e a questo mancano permessi necessari alla pipeline. Le fasi degli agenti che effettuano push di un branch, aprono una pull request o uniscono falliranno.",
+      "rejectedBody": "Il personal access token GitHub con cui si autenticano le tue esecuzioni non è valido, è scaduto, è stato revocato o è bloccato da una policy dell'organizzazione. Ogni fase che clona, effettua push, apre una pull request o unisce fallirà finché non lo sostituisci.",
+      "missing": "Manca:",
+      "alsoMissing": "Manca anche, sebbene blocchi solo le modifiche ai file di workflow: {capabilities}.",
+      "capability": {
+        "push": "effettuare push dei commit",
+        "pullRequests": "aprire e unire pull request",
+        "workflows": "modificare i file di workflow"
+      },
+      "sourceDeployment": "Questo è il token con cui è configurato questo deployment, quindi sostituirlo significa aggiornare il deployment.",
+      "sourceInitiator": "Questo è il tuo token memorizzato, che le tue esecuzioni usano al posto delle credenziali del deployment. Sostituiscilo nelle tue impostazioni personali.",
+      "createClassic": "Crea un token sostitutivo (scope pre-selezionati)",
+      "createFineGrained": "Crea un token sostitutivo fine-grained",
+      "classicHint": "Il link apre il modulo del token classico con gli scope richiesti già selezionati.",
+      "fineGrainedHint": "Il modulo fine-grained di GitHub non accetta pre-selezioni, quindi concedi tu stesso questi permessi di repository: {permissions}.",
+      "sampled": "Verificato su {checked} repository in uso; altri {remaining} non sono stati verificati.",
+      "deniedRepos": "Il token non raggiunge questi repository usati dai tuoi servizi: {repos}. Rigeneralo selezionando quei repository."
+    },
     "providerConfigBanner": {
       "titleMany": "I provider necessitano di configurazione",
       "titleOne": {

package/i18n/locales/ja.json

@@ -2234,6 +2234,27 @@
       "createToken": "GitHub トークンを作成（スコープは事前選択済み）",
       "thenSet": "その後 {envVar} を設定して再起動してください。"
     },
+    "githubPatPermissionsBanner": {
+      "title": "GitHub トークンにプッシュやプルリクエスト作成の権限がありません",
+      "rejectedTitle": "GitHub が実行で使うトークンを拒否しました",
+      "body": "ここで開始した実行は GitHub の個人アクセストークンで認証しますが、このトークンにはパイプラインに必要な権限がありません。ブランチのプッシュ、プルリクエストの作成、マージを行うエージェントステップは失敗します。",
+      "rejectedBody": "実行の認証に使う GitHub 個人アクセストークンが、無効・期限切れ・失効、または組織ポリシーによりブロックされています。置き換えるまで、クローン、プッシュ、プルリクエスト作成、マージを行うすべてのステップが失敗します。",
+      "missing": "不足:",
+      "alsoMissing": "ワークフローファイルの変更のみを妨げるものですが、次も不足しています: {capabilities}。",
+      "capability": {
+        "push": "コミットのプッシュ",
+        "pullRequests": "プルリクエストの作成とマージ",
+        "workflows": "ワークフローファイルの編集"
+      },
+      "sourceDeployment": "これはこのデプロイに設定されているトークンです。置き換えるにはデプロイの更新が必要です。",
+      "sourceInitiator": "これはあなた自身の保存済みトークンで、実行はデプロイの資格情報よりこちらを優先します。個人設定で置き換えてください。",
+      "createClassic": "置き換え用トークンを作成（スコープは事前選択済み）",
+      "createFineGrained": "置き換え用のきめ細かいトークンを作成",
+      "classicHint": "リンクを開くと、必要なスコープが選択済みのクラシックトークン作成フォームが表示されます。",
+      "fineGrainedHint": "GitHub のきめ細かいトークンのフォームは事前選択に対応していないため、次のリポジトリ権限をご自身で付与してください: {permissions}。",
+      "sampled": "使用中のリポジトリ {checked} 件を確認しました。残り {remaining} 件は未確認です。",
+      "deniedRepos": "このトークンはサービスが使用する次のリポジトリにアクセスできません: {repos}。これらのリポジトリを選択して再発行してください。"
+    },
     "providerConfigBanner": {
       "titleMany": "プロバイダーの設定が必要です",
       "titleOne": {
@@ -2964,7 +2985,8 @@
           "runner_manifest_no_status_path": "ステータスパスがありません。ポーリングは常に実行中と解釈されるため、ジョブは実行のポーリング上限を使い切ることでしか終了できません。",
           "github_pat_classic_account_wide": "これは 'repo' スコープを持つクラシックトークンです。あなたがプッシュできるすべてのリポジトリ（このワークスペースの GitHub App が一度もインストールされていないものを含む）に到達します。あなたが開始する実行は App よりこれを優先して使います。このインストールのリポジトリに限定したファイングレインドトークンのほうが範囲は狭くなります。",
           "github_pat_scopes_beyond_need": "このトークンは cat-factory が使わない権限を含んでいます。外しても支障はなく、侵害された実行が到達できる範囲を狭められます。",
-          "github_pat_scope_unreadable": "GitHub はこのトークンを受け入れましたが、スコープを報告しなかったため、ここでは到達範囲を表示できません。GitHub のトークン設定で何が付与されているか確認してください。"
+          "github_pat_scope_unreadable": "GitHub はこのトークンを受け入れましたが、スコープを報告しなかったため、ここでは到達範囲を表示できません。GitHub のトークン設定で何が付与されているか確認してください。",
+          "github_pat_no_scopes": "GitHub はこのクラシックトークンのスコープを報告していないため、公開データの読み取りしかできません。これを使ってクローン、プッシュ、プルリクエストの作成を行う実行は失敗します。'repo' と 'workflow' を選択して新しいトークンを発行してください。"
         }
       },
       "toast": {

package/i18n/locales/pl.json

@@ -2234,6 +2234,27 @@
       "createToken": "Utwórz token GitHub (zakresy wstępnie wybrane)",
       "thenSet": "Następnie ustaw {envVar} i uruchom ponownie."
     },
+    "githubPatPermissionsBanner": {
+      "title": "Token GitHub nie może wypychać zmian ani otwierać pull requestów",
+      "rejectedTitle": "GitHub odrzucił token używany przez Twoje uruchomienia",
+      "body": "Uruchomienia rozpoczęte tutaj uwierzytelniają się osobistym tokenem dostępu GitHub, a temu brakuje uprawnień wymaganych przez potok. Kroki agenta, które wypychają gałąź, otwierają pull request lub scalają, zakończą się niepowodzeniem.",
+      "rejectedBody": "Osobisty token dostępu GitHub, którym uwierzytelniają się Twoje uruchomienia, jest nieprawidłowy, wygasł, został unieważniony lub zablokowany przez zasady organizacji. Każdy krok, który klonuje, wypycha, otwiera pull request lub scala, będzie kończył się niepowodzeniem, dopóki go nie wymienisz.",
+      "missing": "Brakuje:",
+      "alsoMissing": "Brakuje również, choć blokuje to tylko zmiany w plikach przepływów pracy: {capabilities}.",
+      "capability": {
+        "push": "wypychanie commitów",
+        "pullRequests": "otwieranie i scalanie pull requestów",
+        "workflows": "edytowanie plików przepływów pracy"
+      },
+      "sourceDeployment": "To jest token skonfigurowany dla tego wdrożenia, więc jego wymiana oznacza aktualizację wdrożenia.",
+      "sourceInitiator": "To Twój własny zapisany token, którego Twoje uruchomienia używają zamiast poświadczeń wdrożenia. Wymień go w swoich ustawieniach osobistych.",
+      "createClassic": "Utwórz token zastępczy (zakresy wstępnie wybrane)",
+      "createFineGrained": "Utwórz zastępczy token o precyzyjnych uprawnieniach",
+      "classicHint": "Link otwiera formularz klasycznego tokenu z już zaznaczonymi wymaganymi zakresami.",
+      "fineGrainedHint": "Formularz precyzyjnych uprawnień GitHub nie obsługuje wstępnego wyboru, więc nadaj te uprawnienia repozytorium samodzielnie: {permissions}.",
+      "sampled": "Sprawdzono {checked} używanych repozytoriów; kolejnych {remaining} nie sprawdzono.",
+      "deniedRepos": "Token nie ma dostępu do tych repozytoriów używanych przez Twoje usługi: {repos}. Wygeneruj go ponownie z zaznaczonymi tymi repozytoriami."
+    },
     "providerConfigBanner": {
       "titleMany": "Dostawcy wymagają konfiguracji",
       "titleOne": {
@@ -2763,7 +2784,8 @@
           "runner_manifest_no_status_path": "Brak ścieżki statusu: każde odpytanie jest odczytywane jako wciąż trwające, więc zadanie może zakończyć się tylko po wyczerpaniu budżetu odpytań przebiegu.",
           "github_pat_classic_account_wide": "To klasyczny token z zakresem 'repo': sięga każdego repozytorium, do którego możesz wypychać zmiany, także tych, w których aplikacja GitHub tego obszaru roboczego nigdy nie została zainstalowana. Uruchomienia, które rozpoczynasz, używają go zamiast aplikacji. Token szczegółowy ograniczony do repozytoriów tej instalacji jest węższy.",
           "github_pat_scopes_beyond_need": "Ten token przyznaje uprawnienia, z których cat-factory nigdy nie korzysta. Ich usunięcie nic nie kosztuje i zawęża to, co mogłoby osiągnąć skompromitowane uruchomienie.",
-          "github_pat_scope_unreadable": "GitHub przyjął ten token, ale nie zgłosił jego zakresów, więc jego zasięgu nie da się tu pokazać. Sprawdź w ustawieniach tokenów GitHub, co przyznaje."
+          "github_pat_scope_unreadable": "GitHub przyjął ten token, ale nie zgłosił jego zakresów, więc jego zasięgu nie da się tu pokazać. Sprawdź w ustawieniach tokenów GitHub, co przyznaje.",
+          "github_pat_no_scopes": "GitHub nie zgłasza żadnych zakresów dla tego klasycznego tokena, więc może on tylko odczytywać dane publiczne. Uruchomienia, które klonują, wypychają zmiany lub otwierają pull requesta przy jego użyciu, zakończą się niepowodzeniem. Wygeneruj nowy z zaznaczonymi 'repo' i 'workflow'."
         }
       },
       "toast": {

package/i18n/locales/tr.json

@@ -2234,6 +2234,27 @@
       "createToken": "GitHub belirteci oluştur (kapsamlar önceden seçili)",
       "thenSet": "Ardından {envVar} ayarlayın ve yeniden başlatın."
     },
+    "githubPatPermissionsBanner": {
+      "title": "GitHub belirteci push yapamıyor veya pull request açamıyor",
+      "rejectedTitle": "GitHub, çalıştırmalarınızın kullandığı belirteci reddetti",
+      "body": "Burada başlatılan çalıştırmalar bir GitHub kişisel erişim belirteciyle kimlik doğrular ve bu belirteçte iş hattının ihtiyaç duyduğu izinler yok. Dal push eden, pull request açan veya birleştiren ajan adımları başarısız olacak.",
+      "rejectedBody": "Çalıştırmalarınızın kimlik doğruladığı GitHub kişisel erişim belirteci geçersiz, süresi dolmuş, iptal edilmiş ya da bir kuruluş politikası tarafından engellenmiş. Değiştirilene kadar klonlayan, push eden, pull request açan veya birleştiren her adım başarısız olacak.",
+      "missing": "Eksik:",
+      "alsoMissing": "Yalnızca iş akışı dosyalarındaki değişiklikleri engellese de şu da eksik: {capabilities}.",
+      "capability": {
+        "push": "commit push etme",
+        "pullRequests": "pull request açma ve birleştirme",
+        "workflows": "iş akışı dosyalarını düzenleme"
+      },
+      "sourceDeployment": "Bu, bu dağıtımın yapılandırıldığı belirteçtir; değiştirmek dağıtımı güncellemek anlamına gelir.",
+      "sourceInitiator": "Bu, çalıştırmalarınızın dağıtım kimlik bilgisi yerine tercih ettiği kendi kayıtlı belirtecinizdir. Kişisel ayarlarınızdan değiştirin.",
+      "createClassic": "Yerine belirteç oluştur (kapsamlar önceden seçili)",
+      "createFineGrained": "Yerine ayrıntılı izinli belirteç oluştur",
+      "classicHint": "Bağlantı, gerekli kapsamlar zaten seçili hâlde klasik belirteç formunu açar.",
+      "fineGrainedHint": "GitHub'ın ayrıntılı izin formu ön seçim kabul etmez; bu depo izinlerini kendiniz verin: {permissions}.",
+      "sampled": "Kullanılan {checked} depoya karşı denetlendi; {remaining} tanesi denetlenmedi.",
+      "deniedRepos": "Belirteç, hizmetlerinizin kullandığı şu depolara erişemiyor: {repos}. Bu depoları seçerek yeniden oluşturun."
+    },
     "providerConfigBanner": {
       "titleMany": "Sağlayıcıların yapılandırılması gerekiyor",
       "titleOne": {
@@ -2964,7 +2985,8 @@
           "runner_manifest_no_status_path": "Durum yolu yok: her yoklama hâlâ çalışıyor olarak okunur, bu yüzden bir iş ancak çalıştırmanın yoklama bütçesi tükendiğinde sona erebilir.",
           "github_pat_classic_account_wide": "Bu, 'repo' kapsamına sahip klasik bir belirteç: gönderim yapabildiğiniz her depoya, bu çalışma alanının GitHub Uygulamasının hiç kurulmadığı depolar dahil, erişir. Başlattığınız çalıştırmalar bunu Uygulamaya tercih eder. Bu kurulumun depolarıyla sınırlı ince ayarlı bir belirteç daha dardır.",
           "github_pat_scopes_beyond_need": "Bu belirteç, cat-factory'nin hiç kullanmadığı izinler veriyor. Bunları kaldırmak hiçbir şeye mal olmaz ve ele geçirilmiş bir çalıştırmanın erişebileceği alanı daraltır.",
-          "github_pat_scope_unreadable": "GitHub bu belirteci kabul etti ancak kapsamlarını bildirmedi, bu yüzden erişimi burada gösterilemiyor. Neler verdiğini GitHub belirteç ayarlarınızdan kontrol edin."
+          "github_pat_scope_unreadable": "GitHub bu belirteci kabul etti ancak kapsamlarını bildirmedi, bu yüzden erişimi burada gösterilemiyor. Neler verdiğini GitHub belirteç ayarlarınızdan kontrol edin.",
+          "github_pat_no_scopes": "GitHub bu klasik belirteç için hiçbir kapsam bildirmiyor, dolayısıyla yalnızca herkese açık verileri okuyabilir. Onunla klonlayan, gönderim yapan veya pull request açan çalıştırmalar başarısız olur. 'repo' ve 'workflow' seçili yeni bir belirteç oluşturun."
         }
       },
       "toast": {

package/i18n/locales/uk.json

@@ -2234,6 +2234,27 @@
       "createToken": "Створити токен GitHub (області попередньо вибрані)",
       "thenSet": "Потім встановіть {envVar} і перезапустіть."
     },
+    "githubPatPermissionsBanner": {
+      "title": "Токен GitHub не може надсилати зміни або відкривати pull request-и",
+      "rejectedTitle": "GitHub відхилив токен, який використовують ваші запуски",
+      "body": "Запуски, розпочаті тут, автентифікуються особистим токеном доступу GitHub, і цьому бракує дозволів, потрібних конвеєру. Кроки агента, які надсилають гілку, відкривають pull request або зливають, завершаться невдало.",
+      "rejectedBody": "Особистий токен доступу GitHub, яким автентифікуються ваші запуски, недійсний, прострочений, відкликаний або заблокований політикою організації. Кожен крок, який клонує, надсилає, відкриває pull request чи зливає, завершуватиметься невдало, доки ви його не заміните.",
+      "missing": "Бракує:",
+      "alsoMissing": "Також бракує, хоча це блокує лише зміни у файлах робочих процесів: {capabilities}.",
+      "capability": {
+        "push": "надсилання комітів",
+        "pullRequests": "відкриття та злиття pull request-ів",
+        "workflows": "редагування файлів робочих процесів"
+      },
+      "sourceDeployment": "Це токен, з яким налаштовано це розгортання, тож його заміна означає оновлення розгортання.",
+      "sourceInitiator": "Це ваш власний збережений токен, який ваші запуски використовують замість облікових даних розгортання. Замініть його в особистих налаштуваннях.",
+      "createClassic": "Створити токен на заміну (області попередньо вибрані)",
+      "createFineGrained": "Створити токен на заміну з точними дозволами",
+      "classicHint": "Посилання відкриває форму класичного токена з уже вибраними потрібними областями.",
+      "fineGrainedHint": "Форма точних дозволів GitHub не підтримує попередній вибір, тож надайте ці дозволи репозиторію самостійно: {permissions}.",
+      "sampled": "Перевірено {checked} використовуваних репозиторіїв; ще {remaining} не перевірено.",
+      "deniedRepos": "Токен не має доступу до цих репозиторіїв, які використовують ваші сервіси: {repos}. Створіть його заново, обравши ці репозиторії."
+    },
     "providerConfigBanner": {
       "titleMany": "Постачальники потребують налаштування",
       "titleOne": {
@@ -2763,7 +2784,8 @@
           "runner_manifest_no_status_path": "Немає шляху до статусу: кожне опитування читається як таке, що ще триває, тож завдання може завершитися лише після вичерпання бюджету опитувань запуску.",
           "github_pat_classic_account_wide": "Це класичний токен з областю 'repo': він сягає кожного репозиторію, до якого ви можете надсилати зміни, зокрема тих, де застосунок GitHub цього робочого простору ніколи не встановлювався. Запуски, які ви розпочинаєте, використовують його замість застосунку. Деталізований токен, обмежений репозиторіями цього встановлення, вужчий.",
           "github_pat_scopes_beyond_need": "Цей токен надає дозволи, якими cat-factory ніколи не користується. Прибрати їх нічого не коштує, і це звужує те, чого міг би сягнути скомпрометований запуск.",
-          "github_pat_scope_unreadable": "GitHub прийняв цей токен, але не повідомив його областей, тож показати його обсяг доступу тут неможливо. Перевірте в налаштуваннях токенів GitHub, що саме він надає."
+          "github_pat_scope_unreadable": "GitHub прийняв цей токен, але не повідомив його областей, тож показати його обсяг доступу тут неможливо. Перевірте в налаштуваннях токенів GitHub, що саме він надає.",
+          "github_pat_no_scopes": "GitHub не повідомляє жодних областей дії для цього класичного токена, тож він може лише читати публічні дані. Запуски, які клонують, надсилають зміни або відкривають pull request із ним, завершаться помилкою. Створіть новий із вибраними 'repo' і 'workflow'."
         }
       },
       "toast": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.261.1",
+  "version": "0.261.2",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.41",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.292.1"
+    "@cat-factory/contracts": "0.292.2"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",