@cat-factory/app 0.261.7 → 0.263.0

package/app/components/settings/ApiTokensPanel.vue

@@ -57,6 +57,23 @@ function minterLabel(key: PublicApiKey): string | null {
     ? t('settings.apiTokens.list.createdByYou')
     : key.createdByUserId
 }
+
+/**
+ * The badge for a key bound to a person's subscription, WHOSE person named.
+ *
+ * Keys are workspace-scoped and this list is shared, so a colleague's bound key is right here in
+ * everyone's panel: a fixed "your subscription" tells every other member that a token they never
+ * minted reaches theirs, which is alarming and false. The same comparison {@link minterLabel} makes
+ * is available (a binding is always to the minter), so the honest badge names the owner, and falls
+ * back to the `usr_*` id for the same reason that function does — there is no user-name lookup here,
+ * and an id is not misleading.
+ */
+function boundLabel(key: PublicApiKey): string | null {
+  if (!key.actsAsUserId) return null
+  return key.actsAsUserId === auth.user?.id
+    ? t('settings.apiTokens.list.boundToYou')
+    : t('settings.apiTokens.list.boundToOther', { user: key.actsAsUserId })
+}
 const toast = useToast()
 const { present } = usePipelineErrorToast()
 const { confirmAction, toastDone } = useConfirmAction()
@@ -70,6 +87,35 @@ const back = useIntegrationBack(open)
 const label = ref('')
 // The scope the next minted key will carry; defaults to the safe middle of the ladder.
 const scope = ref<PublicApiScope>('write')
+// WHO the next key runs as. Two named options rather than an unchecked box, because they are two
+// different credentials with two different blast radii and neither is a mere setting on the other:
+//
+//  - `system` (the default): the token belongs to the workspace. Its runs are attributed to nobody
+//    and it can reach no personal subscription, so a leaked shared credential can never spend one
+//    person's Claude quota. This is what a CI job or a shared integration should hold.
+//  - `self`: the token belongs to the person minting it. Its runs are theirs and may unlock their
+//    personal Claude / Codex / GLM subscription, with the password sent on each such call.
+//
+// NOT gated on the interface mode, unlike an override field. This whole panel is the Integrations
+// hub's Development surface, reached only by someone already minting an API key, and `scope` next
+// to it is ungated for the same reason. Hiding it in basic mode would leave that person a key that
+// silently cannot run their own models, with nothing on screen to say why.
+type TokenIdentity = 'system' | 'self'
+const identity = ref<TokenIdentity>('system')
+// Nobody to bind on a board with no signed-in user (a dev-open deployment): the server refuses
+// such a mint outright, so the choice is withheld and every key is a system key, which is what
+// that deployment can honestly offer.
+const canBindSelf = computed(() => auth.user !== null && auth.user !== undefined)
+const identityItems = computed(() => [
+  { value: 'system' as const, label: t('settings.apiTokens.add.identitySystem') },
+  { value: 'self' as const, label: t('settings.apiTokens.add.identitySelf') },
+])
+/** The help text under the picker, so each option explains ITSELF rather than only its opposite. */
+const identityHelp = computed(() =>
+  identity.value === 'self'
+    ? t('settings.apiTokens.add.identitySelfHelp')
+    : t('settings.apiTokens.add.identitySystemHelp'),
+)
 const busy = ref(false)
 // The full raw secret from the most recent create — surfaced once, then dismissed. Never
 // re-fetchable, so it lives only in this transient ref (not the store).
@@ -97,10 +143,15 @@ async function createToken() {
   if (!trimmed) return
   busy.value = true
   try {
-    const created = await store.create(trimmed, scope.value)
+    const created = await store.create(
+      trimmed,
+      scope.value,
+      canBindSelf.value && identity.value === 'self',
+    )
     newSecret.value = created.secret
     label.value = ''
     scope.value = 'write'
+    identity.value = 'system'
     toast.add({
       title: t('settings.apiTokens.toast.created'),
       icon: 'i-lucide-check',
@@ -195,6 +246,18 @@ async function revokeToken(key: PublicApiKey) {
                 >
                   {{ scopeLabel(key.scope) }}
                 </UBadge>
+                <!-- Always shown, never mode-gated: an existing key can already carry the
+                     binding, and this is the only place its holder can see that a token they
+                     are about to hand out reaches a personal subscription. -->
+                <UBadge
+                  v-if="boundLabel(key)"
+                  color="warning"
+                  variant="subtle"
+                  size="sm"
+                  :data-testid="`api-token-bound-${key.id}`"
+                >
+                  {{ boundLabel(key) }}
+                </UBadge>
               </div>
               <div class="text-[11px] text-slate-500">
                 {{
@@ -255,6 +318,18 @@ async function revokeToken(key: PublicApiKey) {
               data-testid="api-token-scope"
             />
           </UFormField>
+          <UFormField
+            v-if="canBindSelf"
+            :label="t('settings.apiTokens.add.identity')"
+            :help="identityHelp"
+          >
+            <USelect
+              v-model="identity"
+              :items="identityItems"
+              class="w-full"
+              data-testid="api-token-identity"
+            />
+          </UFormField>
           <UButton
             :loading="busy"
             :disabled="!label.trim()"

package/app/components/settings/LocalModelEndpointsPanel.vue

@@ -6,9 +6,12 @@
 // serves and tick which to enable. Save persists the endpoint; the enabled models then surface
 // automatically in the per-workspace model picker. One endpoint per runner type.
 import { computed, ref, watch } from 'vue'
+
 import {
+  knownLocalModel,
   LOCAL_RUNNER_DEFAULTS,
   LOCAL_RUNNER_LABELS,
+  type LocalModelDeclaration,
   type LocalRunner,
   type LocalRunnerUrlReason,
 } from '~/types/localModels'
@@ -28,16 +31,6 @@ const open = computed({
 })
 const back = useIntegrationBack(open)
 
-// Load the user's endpoints whenever the panel opens (loaded independently of the
-// workspace snapshot, like personal subscriptions).
-watch(
-  open,
-  (isOpen) => {
-    if (isOpen) void store.load()
-  },
-  { immediate: true },
-)
-
 const RUNNERS: { value: LocalRunner; label: string }[] = (
   Object.keys(LOCAL_RUNNER_LABELS) as LocalRunner[]
 ).map((value) => ({ value, label: LOCAL_RUNNER_LABELS[value] }))
@@ -59,14 +52,76 @@ function urlReasonText(reason: LocalRunnerUrlReason): string {
   return t(URL_REASON_KEYS[reason])
 }
 
+// Whether an enabled model reads IMAGES. Three states, because the runner's `/models` probe cannot
+// tell us and "nobody has said" is not the same answer as "no": undeclared says the platform never
+// asked, while `no` says the model cannot. Mirrors `LocalModelDeclaration.acceptsImages`.
+//
+// For a RECOGNISED family the platform already knows, so leaving this alone is the right answer and
+// the "not set" option says which way that falls: the control is the ESCAPE HATCH for a build the
+// table cannot know about (a text-only quant, a fine-tune, a re-tagged copy), not a step everyone
+// has to take.
+const IMAGE_INPUT_CHOICES = ['unknown', 'yes', 'no'] as const
+type ImageInputChoice = (typeof IMAGE_INPUT_CHOICES)[number]
+
+function choiceFor(declared: LocalModelDeclaration): ImageInputChoice {
+  return declared.acceptsImages === undefined ? 'unknown' : declared.acceptsImages ? 'yes' : 'no'
+}
+
+/** The declared modality for a choice, as a spread-ready slice (undeclared adds no key at all). */
+function modalityOf(choice: ImageInputChoice | undefined): { acceptsImages?: boolean } {
+  if (choice === 'yes') return { acceptsImages: true }
+  if (choice === 'no') return { acceptsImages: false }
+  return {}
+}
+
+/**
+ * What "not set" will actually do for one model id: name the recognised family and the modality it
+ * implies, else say plainly that nothing has been said. Read from the SAME table the engine folds
+ * onto the dispatched ref, so this label cannot promise a picture the run then withholds.
+ */
+function unsetLabelFor(modelId: string): string {
+  const known = knownLocalModel(modelId)
+  if (!known) return t('settings.localModelEndpoints.imageInput.unknown')
+  return t(
+    known.acceptsImages
+      ? 'settings.localModelEndpoints.imageInput.autoYes'
+      : 'settings.localModelEndpoints.imageInput.autoNo',
+    { family: known.label },
+  )
+}
+
 // ---- add / edit draft ------------------------------------------------------
 const provider = ref<LocalRunner>('ollama')
 const label = ref('')
 const baseUrl = ref(LOCAL_RUNNER_DEFAULTS.ollama ?? '')
 const apiKey = ref('')
-// The models discovered by the last "Test connection", plus the user's tick selection.
+// The models discovered by the last "Test connection", plus the user's tick selection and what
+// they declared about each ticked one (kept per model id, so un-ticking and re-ticking a model
+// does not silently drop the declaration they already made for it).
 const discovered = ref<string[]>([])
 const selected = ref<string[]>([])
+const imageInput = ref<Record<string, ImageInputChoice>>({})
+
+/**
+ * The three options per discovered model: "not set" carries what the recognised-family table will
+ * do. Built once per discovered set rather than per row per render, because the "not set" label
+ * scans the family table and a fresh array identity each tick also defeats the select's own
+ * memoisation (a runner serving forty models re-ran both on every keystroke elsewhere in the form).
+ */
+const imageInputItems = computed<Record<string, { value: ImageInputChoice; label: string }[]>>(() =>
+  Object.fromEntries(
+    discovered.value.map((modelId) => [
+      modelId,
+      IMAGE_INPUT_CHOICES.map((value) => ({
+        value,
+        label:
+          value === 'unknown'
+            ? unsetLabelFor(modelId)
+            : t(`settings.localModelEndpoints.imageInput.${value}`),
+      })),
+    ]),
+  ),
+)
 const testError = ref<string | null>(null)
 // The backend's own wording, kept as DETAIL beside a translated refusal rather than being
 // shown as the description (it names env vars an operator, not this user, acts on).
@@ -77,25 +132,48 @@ const busy = ref(false)
 
 const existing = computed(() => store.endpoints.find((e) => e.provider === provider.value))
 
-// Switching runner type prefills the default base URL and resets the discovered models —
-// editing an already-connected runner loads its stored config instead.
-watch(provider, (p) => {
+/**
+ * Point the draft at one runner: its stored config when that runner is already connected (so the
+ * ticks and the declarations the user made come back), else the defaults for a fresh one.
+ *
+ * Called EXPLICITLY from each event that means "start editing this runner", never watched off
+ * `provider`, because the commonest of those events does not change it: clicking Edit on the row
+ * the form is already showing assigns the same value, which fires no watcher. The draft would then
+ * be whatever the empty initial state was, and saving it PUTs every model with no declaration,
+ * destroying what the user had recorded with nothing saying so.
+ */
+function seedDraft(p: LocalRunner) {
   const e = store.endpoints.find((x) => x.provider === p)
-  if (e) {
-    label.value = e.label
-    baseUrl.value = e.baseUrl
-    discovered.value = [...e.models]
-    selected.value = [...e.models]
-  } else {
-    label.value = ''
-    baseUrl.value = LOCAL_RUNNER_DEFAULTS[p] ?? ''
-    discovered.value = []
-    selected.value = []
-  }
+  label.value = e?.label ?? ''
+  baseUrl.value = e?.baseUrl ?? LOCAL_RUNNER_DEFAULTS[p] ?? ''
+  discovered.value = e?.models.map((m) => m.id) ?? []
+  selected.value = e?.models.map((m) => m.id) ?? []
+  imageInput.value = Object.fromEntries(e?.models.map((m) => [m.id, choiceFor(m)]) ?? [])
   apiKey.value = ''
   testError.value = null
+  testErrorDetail.value = null
   tested.value = false
-})
+}
+
+/** Select a runner in the form: the runner-type select and each row's Edit button share this. */
+function selectRunner(p: LocalRunner) {
+  provider.value = p
+  seedDraft(p)
+}
+
+// Load the user's endpoints whenever the panel opens (loaded independently of the workspace
+// snapshot, like personal subscriptions), then seed the draft from what arrived. The seed WAITS
+// for the load: the panel mounts against an empty store, so seeding before it resolves would
+// leave a form headed "Edit runner" holding none of that runner's config.
+watch(
+  open,
+  async (isOpen) => {
+    if (!isOpen) return
+    await store.load()
+    seedDraft(provider.value)
+  },
+  { immediate: true },
+)
 
 async function test() {
   if (!baseUrl.value.trim()) return
@@ -147,7 +225,7 @@ async function save() {
       label: label.value.trim() || undefined,
       baseUrl: baseUrl.value.trim(),
       apiKey: apiKey.value.trim() || undefined,
-      models: selected.value,
+      models: selected.value.map((id) => ({ id, ...modalityOf(imageInput.value[id]) })),
     })
     apiKey.value = ''
     toast.add({
@@ -178,13 +256,9 @@ async function remove(p: LocalRunner) {
   busy.value = true
   try {
     await store.remove(p)
-    if (provider.value === p) {
-      baseUrl.value = LOCAL_RUNNER_DEFAULTS[p] ?? ''
-      label.value = ''
-      discovered.value = []
-      selected.value = []
-      tested.value = false
-    }
+    // The row is gone from the store, so re-seeding the draft it was showing yields the
+    // fresh-runner defaults: the same reset, without a second copy of what a reset means.
+    if (provider.value === p) seedDraft(p)
     toast.add({ title: t('settings.localModelEndpoints.toast.removed'), icon: 'i-lucide-check' })
   } catch (e) {
     present(e, 'settings.localModelEndpoints.toast.removeFailed')
@@ -246,6 +320,12 @@ async function remove(p: LocalRunner) {
               {{ t('settings.localModelEndpoints.blocked') }}
               <span class="block text-amber-300/70">{{ urlReasonText(e.urlBlockedReason) }}</span>
             </div>
+            <!-- Part of the stored model list could not be read and was discarded. Without this
+                 the shortened list reads exactly like a runner nothing was ever enabled on, and
+                 only one of those is fixed by re-ticking. -->
+            <div v-if="e.unreadableModels" class="mt-1 text-[11px] text-amber-400">
+              {{ t('settings.localModelEndpoints.modelsDiscarded') }}
+            </div>
           </div>
           <div class="flex items-center gap-1">
             <UButton
@@ -255,11 +335,7 @@ async function remove(p: LocalRunner) {
               size="xs"
               :disabled="busy"
               :title="t('settings.localModelEndpoints.edit')"
-              @click="
-                () => {
-                  provider = e.provider
-                }
-              "
+              @click="selectRunner(e.provider)"
             />
             <UButton
               icon="i-lucide-trash-2"
@@ -284,7 +360,13 @@ async function remove(p: LocalRunner) {
 
           <div class="flex flex-wrap items-end gap-3">
             <UFormField :label="t('settings.localModelEndpoints.runnerType')">
-              <USelect v-model="provider" :items="RUNNERS" value-key="value" class="w-48" />
+              <USelect
+                :model-value="provider"
+                :items="RUNNERS"
+                value-key="value"
+                class="w-48"
+                @update:model-value="(v: string) => selectRunner(v as LocalRunner)"
+              />
             </UFormField>
             <UFormField
               :label="t('settings.localModelEndpoints.labelOptional')"
@@ -349,23 +431,38 @@ async function remove(p: LocalRunner) {
             }}</span>
           </div>
 
-          <!-- discovered models multi-select -->
+          <!-- discovered models multi-select, each with its declared image support -->
           <div v-if="discovered.length" class="space-y-1.5">
             <span class="block text-[10px] uppercase tracking-wide text-slate-500">
               {{ t('settings.localModelEndpoints.enableModels') }}
             </span>
-            <div class="grid grid-cols-1 gap-1.5 sm:grid-cols-2">
-              <label
-                v-for="m in discovered"
-                :key="m"
-                class="flex items-center gap-2 text-sm text-slate-300"
-              >
-                <UCheckbox
-                  :model-value="selected.includes(m)"
-                  @update:model-value="(v: boolean | 'indeterminate') => toggleModel(m, v === true)"
+            <p class="text-[11px] text-slate-500">
+              {{ t('settings.localModelEndpoints.imageInputHint') }}
+            </p>
+            <div class="space-y-1.5">
+              <div v-for="m in discovered" :key="m" class="flex items-center gap-2">
+                <label class="flex min-w-0 flex-1 items-center gap-2 text-sm text-slate-300">
+                  <UCheckbox
+                    :model-value="selected.includes(m)"
+                    @update:model-value="
+                      (v: boolean | 'indeterminate') => toggleModel(m, v === true)
+                    "
+                  />
+                  <span class="truncate font-mono text-xs">{{ m }}</span>
+                </label>
+                <!-- Shown only for a model that is actually enabled: declaring a modality for one
+                     nothing can run would be a setting with no effect. -->
+                <USelect
+                  v-if="selected.includes(m)"
+                  :model-value="imageInput[m] ?? 'unknown'"
+                  :items="imageInputItems[m]"
+                  value-key="value"
+                  size="xs"
+                  class="w-52 shrink-0"
+                  :aria-label="t('settings.localModelEndpoints.imageInputLabel', { model: m })"
+                  @update:model-value="(v: string) => (imageInput[m] = v as ImageInputChoice)"
                 />
-                <span class="truncate font-mono text-xs">{{ m }}</span>
-              </label>
+              </div>
             </div>
           </div>
 

package/app/stores/publicApiKeys.spec.ts

@@ -14,6 +14,7 @@ function key(over: Partial<PublicApiKey> = {}): PublicApiKey {
     createdByUserId: null,
     createdByKeyId: null,
     externalIdentity: null,
+    actsAsUserId: null,
     createdAt: 1,
     lastUsedAt: null,
     revokedAt: null,
@@ -94,6 +95,21 @@ describe('publicApiKeys store', () => {
     expect(store.available).toBe(true)
   })
 
+  it('mints a SYSTEM token unless the caller asks to be bound', async () => {
+    // The default decides whose subscription an unattended run may spend, so it is worth an
+    // assertion rather than a reading of the signature: a key that silently acted as its minter
+    // would put one person's Claude quota behind every integration the workspace hands a token to.
+    const body = vi.fn((_body: unknown) => Promise.resolve({ key: key(), secret: 's' }))
+    vi.stubGlobal('useApi', () => ({ createPublicApiKey: (_ws: string, b: unknown) => body(b) }))
+
+    const store = usePublicApiKeysStore()
+    await store.create('ci', 'write')
+    expect(body).toHaveBeenCalledWith({ label: 'ci', scope: 'write', actsAsSelf: false })
+
+    await store.create('mine', 'write', true)
+    expect(body).toHaveBeenCalledWith({ label: 'mine', scope: 'write', actsAsSelf: true })
+  })
+
   it('revoke drops the key from the list', async () => {
     vi.stubGlobal('useApi', () => ({
       listPublicApiKeys: () => Promise.resolve({ keys: [key({ id: 'a' }), key({ id: 'b' })] }),

package/app/stores/publicApiKeys.ts

@@ -54,10 +54,18 @@ export const usePublicApiKeysStore = defineStore('publicApiKeys', () => {
   /**
    * Mint a key with a permission `scope` (read ⊂ write ⊂ admin). Returns the created record
    * PLUS the one-time raw secret (shown once).
+   *
+   * `actsAsSelf` binds the key to the signed-in user's PERSONAL subscriptions, so a headless run
+   * it starts can unlock them with the password sent on that call. Passed through rather than
+   * defaulted here: the server writes the id off the session, so this is only ever a yes/no.
    */
-  async function create(label: string, scope: PublicApiScope): Promise<CreatedPublicApiKey> {
+  async function create(
+    label: string,
+    scope: PublicApiScope,
+    actsAsSelf = false,
+  ): Promise<CreatedPublicApiKey> {
     const ws = useWorkspaceStore()
-    const created = await api.createPublicApiKey(ws.requireId(), { label, scope })
+    const created = await api.createPublicApiKey(ws.requireId(), { label, scope, actsAsSelf })
     // Prepend: the backend lists newest-first, so the freshly minted key belongs at the
     // top — matching the order a subsequent `load()` would produce.
     keys.value = [created.key, ...keys.value]

package/app/types/localModels.ts

@@ -13,6 +13,7 @@
 
 export type {
   LocalRunner,
+  LocalModelDeclaration,
   LocalModelEndpoint,
   LocalRunnerUrlReason,
   UpsertLocalModelEndpointInput,
@@ -22,3 +23,9 @@ export type {
 
 // Value re-exports (the per-runner default base URL + display labels).
 export { LOCAL_RUNNER_DEFAULTS, LOCAL_RUNNER_LABELS } from '@cat-factory/contracts'
+
+// What the platform already KNOWS about the popular local model families. The panel reads the same
+// table the engine folds onto a dispatched ref, so the "not set" option can state what will happen
+// instead of implying nothing will.
+export { knownLocalModel } from '@cat-factory/contracts'
+export type { KnownLocalModel } from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -793,7 +793,9 @@
         "createdBy": "erstellt von {user}",
         "createdByYou": "Ihnen",
         "createdByKey": "API-Schlüssel {id}",
-        "revoke": "Token widerrufen"
+        "revoke": "Token widerrufen",
+        "boundToYou": "Ihr Abonnement",
+        "boundToOther": "Abonnement von {user}"
       },
       "add": {
         "heading": "Token erstellen",
@@ -802,7 +804,12 @@
         "labelPlaceholder": "z. B. CI-Pipeline",
         "scope": "Berechtigung",
         "scopeHelp": "Was dieses Token darf: nur Lesen, Lesen und Schreiben oder Vollzugriff (der auch das Löschen erlaubt).",
-        "create": "Token erstellen"
+        "create": "Token erstellen",
+        "identity": "Läuft als",
+        "identitySystem": "Dieser Arbeitsbereich (System-Token)",
+        "identitySelf": "Ich (persönliches Token)",
+        "identitySystemHelp": "Mit diesem Token gestartete Läufe gehören dem Arbeitsbereich und werden keiner Person zugeordnet. Es kann kein persönliches Claude-/Codex-/GLM-Abonnement nutzen: Eine Aufgabe mit einem solchen Modell wird abgelehnt, statt jemandem in Abwesenheit berechnet zu werden. Für CI und gemeinsam genutzte Integrationen.",
+        "identitySelfHelp": "Mit diesem Token gestartete Läufe gelten als Ihre und können Ihr persönliches Claude-/Codex-/GLM-Abonnement nutzen. Jeder solche Aufruf muss zusätzlich Ihr persönliches Passwort im Header X-Personal-Password senden; es wird nie gespeichert. Für Ihre eigenen Headless-Läufe."
       },
       "scopes": {
         "read": "Nur Lesen",
@@ -1133,6 +1140,15 @@
       "reachable": "Erreichbar · keine Modelle | Erreichbar · {count} Modell | Erreichbar · {count} Modelle",
       "noModels": "Keine Modelle gemeldet.",
       "enableModels": "Modelle aktivieren",
+      "imageInputHint": "Manche lokalen Modelle lesen Screenshots und Design-Renderings. Bekannte Modellfamilien werden automatisch erkannt, und die Option Nicht gesetzt zeigt pro Modell, wie es behandelt wird; setzen Sie den Wert selbst für einen Build, den die Plattform nicht kennen kann, etwa eine reine Text-Quantisierung oder ein Fine-Tuning.",
+      "imageInputLabel": "Bildunterstützung für {model}",
+      "imageInput": {
+        "autoYes": "Nicht gesetzt: {family} liest Bilder",
+        "autoNo": "Nicht gesetzt: {family} ist nur Text",
+        "unknown": "Bilder: nicht gesetzt",
+        "yes": "Liest Bilder",
+        "no": "Nur Text"
+      },
       "toast": {
         "saved": "{name} gespeichert",
         "saveFailed": "Runner konnte nicht gespeichert werden",
@@ -1144,6 +1160,7 @@
         "body": "\"{name}\" wird entfernt. Dies kann nicht rückgängig gemacht werden."
       },
       "blocked": "Die URL dieses Runners ist auf dieser Installation nicht erlaubt, daher sind seine Modelle in der Auswahl ausgeblendet.",
+      "modelsDiscarded": "Einige der aktivierten Modelle dieses Runners konnten nicht gelesen werden und wurden verworfen. Wählen Sie die gewünschten erneut aus und speichern Sie.",
       "urlReason": {
         "invalid_url": "Das ist keine gültige URL.",
         "scheme_not_allowed": "Eine Runner-URL muss mit http:// oder https:// beginnen.",

package/i18n/locales/en.json

@@ -3527,7 +3527,9 @@
         "createdBy": "created by {user}",
         "createdByYou": "you",
         "createdByKey": "API key {id}",
-        "revoke": "Revoke token"
+        "revoke": "Revoke token",
+        "boundToYou": "Your subscription",
+        "boundToOther": "{user}'s subscription"
       },
       "add": {
         "heading": "Create a token",
@@ -3536,7 +3538,12 @@
         "labelPlaceholder": "e.g. CI pipeline",
         "scope": "Scope",
         "scopeHelp": "What this token can do: read-only, read and write, or full access (which also allows deleting).",
-        "create": "Create token"
+        "create": "Create token",
+        "identity": "Runs as",
+        "identitySystem": "This workspace (system token)",
+        "identitySelf": "Me (personal token)",
+        "identitySystemHelp": "Runs started with this token belong to the workspace and are attributed to no person. It cannot use anyone’s personal Claude / Codex / GLM subscription, so a task pinned to one of those models is refused rather than charged to someone who is not there. Use this for CI and shared integrations.",
+        "identitySelfHelp": "Runs started with this token count as yours and can use your personal Claude / Codex / GLM subscription. Every such call must also send your personal password in the X-Personal-Password header; it is never stored. Use this to drive your own headless runs."
       },
       "scopes": {
         "read": "Read only",
@@ -3870,6 +3877,15 @@
       "reachable": "Reachable · no models | Reachable · {count} model | Reachable · {count} models",
       "noModels": "No models reported.",
       "enableModels": "Enable models",
+      "imageInputHint": "Some local models read screenshots and design renders. Well-known families are recognised automatically, and the not-set option on each model says which way it falls; set it yourself for a build the platform cannot know about, such as a text-only quant or a fine-tune.",
+      "imageInputLabel": "Image support for {model}",
+      "imageInput": {
+        "autoYes": "Not set: {family} reads images",
+        "autoNo": "Not set: {family} is text only",
+        "unknown": "Images: not set",
+        "yes": "Reads images",
+        "no": "Text only"
+      },
       "toast": {
         "saved": "{name} saved",
         "saveFailed": "Could not save runner",
@@ -3881,6 +3897,7 @@
         "body": "\"{name}\" will be removed. This can't be undone."
       },
       "blocked": "This runner's URL is not allowed on this deployment, so its models are hidden from the picker.",
+      "modelsDiscarded": "Some of this runner's enabled models could not be read and were discarded. Re-select the ones you want and save.",
       "urlReason": {
         "invalid_url": "That is not a valid URL.",
         "scheme_not_allowed": "A runner URL must start with http:// or https://.",

package/i18n/locales/es.json

@@ -3248,7 +3248,9 @@
         "createdBy": "creado por {user}",
         "createdByYou": "ti",
         "createdByKey": "la clave de API {id}",
-        "revoke": "Revocar token"
+        "revoke": "Revocar token",
+        "boundToYou": "Tu suscripción",
+        "boundToOther": "Suscripción de {user}"
       },
       "add": {
         "heading": "Crear un token",
@@ -3257,7 +3259,12 @@
         "labelPlaceholder": "p. ej. pipeline de CI",
         "scope": "Alcance",
         "scopeHelp": "Lo que puede hacer este token: solo lectura, lectura y escritura o acceso completo (que también permite eliminar).",
-        "create": "Crear token"
+        "create": "Crear token",
+        "identity": "Se ejecuta como",
+        "identitySystem": "Este espacio de trabajo (token de sistema)",
+        "identitySelf": "Yo (token personal)",
+        "identitySystemHelp": "Las ejecuciones iniciadas con este token pertenecen al espacio de trabajo y no se atribuyen a ninguna persona. No puede usar la suscripción personal de Claude / Codex / GLM de nadie, así que una tarea fijada a uno de esos modelos se rechaza en lugar de cargarse a alguien ausente. Úsalo para CI e integraciones compartidas.",
+        "identitySelfHelp": "Las ejecuciones iniciadas con este token se te atribuyen y pueden usar tu suscripción personal de Claude / Codex / GLM. Cada llamada debe enviar además tu contraseña personal en la cabecera X-Personal-Password; nunca se almacena. Úsalo para tus propias ejecuciones headless."
       },
       "scopes": {
         "read": "Solo lectura",
@@ -3588,6 +3595,15 @@
       "reachable": "Accesible · ningún modelo | Accesible · {count} modelo | Accesible · {count} modelos",
       "noModels": "No se informó de ningún modelo.",
       "enableModels": "Habilitar modelos",
+      "imageInputHint": "Algunos modelos locales leen capturas de pantalla y renders de diseño. Las familias conocidas se reconocen automáticamente, y la opción Sin definir de cada modelo indica cómo se tratará; defínelo tú mismo para una compilación que la plataforma no puede conocer, como una cuantización solo de texto o un ajuste fino.",
+      "imageInputLabel": "Compatibilidad con imágenes de {model}",
+      "imageInput": {
+        "autoYes": "Sin definir: {family} lee imágenes",
+        "autoNo": "Sin definir: {family} es solo texto",
+        "unknown": "Imágenes: sin definir",
+        "yes": "Lee imágenes",
+        "no": "Solo texto"
+      },
       "toast": {
         "saved": "{name} guardado",
         "saveFailed": "No se pudo guardar el runner",
@@ -3599,6 +3615,7 @@
         "body": "Se eliminará \"{name}\". Esta acción no se puede deshacer."
       },
       "blocked": "La URL de este runner no está permitida en esta instalación, por lo que sus modelos están ocultos en el selector.",
+      "modelsDiscarded": "Algunos de los modelos habilitados de este runner no se pudieron leer y se descartaron. Vuelve a seleccionar los que quieras y guarda.",
       "urlReason": {
         "invalid_url": "Esa URL no es válida.",
         "scheme_not_allowed": "La URL de un runner debe empezar por http:// o https://.",

package/i18n/locales/fr.json

@@ -3248,7 +3248,9 @@
         "createdBy": "créé par {user}",
         "createdByYou": "vous",
         "createdByKey": "la clé d’API {id}",
-        "revoke": "Révoquer le jeton"
+        "revoke": "Révoquer le jeton",
+        "boundToYou": "Votre abonnement",
+        "boundToOther": "Abonnement de {user}"
       },
       "add": {
         "heading": "Créer un jeton",
@@ -3257,7 +3259,12 @@
         "labelPlaceholder": "ex. pipeline CI",
         "scope": "Portée",
         "scopeHelp": "Ce que ce jeton peut faire : lecture seule, lecture et écriture, ou accès complet (qui autorise aussi la suppression).",
-        "create": "Créer le jeton"
+        "create": "Créer le jeton",
+        "identity": "S'exécute en tant que",
+        "identitySystem": "Cet espace de travail (jeton système)",
+        "identitySelf": "Moi (jeton personnel)",
+        "identitySystemHelp": "Les exécutions lancées avec ce jeton appartiennent à l'espace de travail et ne sont attribuées à personne. Il ne peut utiliser l'abonnement personnel Claude / Codex / GLM de qui que ce soit : une tâche fixée sur un tel modèle est refusée plutôt que facturée à quelqu'un d'absent. À utiliser pour la CI et les intégrations partagées.",
+        "identitySelfHelp": "Les exécutions lancées avec ce jeton vous sont attribuées et peuvent utiliser votre abonnement personnel Claude / Codex / GLM. Chaque appel doit aussi envoyer votre mot de passe personnel dans l'en-tête X-Personal-Password ; il n'est jamais conservé. À utiliser pour vos propres exécutions headless."
       },
       "scopes": {
         "read": "Lecture seule",
@@ -3588,6 +3595,15 @@
       "reachable": "Joignable · aucun modèle | Joignable · {count} modèle | Joignable · {count} modèles",
       "noModels": "Aucun modèle signalé.",
       "enableModels": "Activer les modèles",
+      "imageInputHint": "Certains modèles locaux lisent les captures d'écran et les rendus de design. Les familles connues sont reconnues automatiquement, et l'option Non défini de chaque modèle indique ce qui s'appliquera ; définissez-la vous-même pour une version que la plateforme ne peut pas connaître, comme une quantification texte seulement ou un modèle affiné.",
+      "imageInputLabel": "Prise en charge des images pour {model}",
+      "imageInput": {
+        "autoYes": "Non défini : {family} lit les images",
+        "autoNo": "Non défini : {family} est texte seulement",
+        "unknown": "Images : non défini",
+        "yes": "Lit les images",
+        "no": "Texte seulement"
+      },
       "toast": {
         "saved": "{name} enregistré",
         "saveFailed": "Impossible d'enregistrer le runner",
@@ -3599,6 +3615,7 @@
         "body": "\"{name}\" sera supprimé. Cette action est irréversible."
       },
       "blocked": "L'URL de ce runner n'est pas autorisée sur ce déploiement, ses modèles sont donc masqués dans le sélecteur.",
+      "modelsDiscarded": "Certains modèles activés de ce runner n'ont pas pu être lus et ont été supprimés. Sélectionnez à nouveau ceux que vous voulez, puis enregistrez.",
       "urlReason": {
         "invalid_url": "Cette URL n'est pas valide.",
         "scheme_not_allowed": "L'URL d'un runner doit commencer par http:// ou https://.",

package/i18n/locales/he.json

@@ -3390,7 +3390,9 @@
         "createdBy": "נוצר על ידי {user}",
         "createdByYou": "אתה",
         "createdByKey": "מפתח API {id}",
-        "revoke": "בטל אסימון"
+        "revoke": "בטל אסימון",
+        "boundToYou": "המנוי שלך",
+        "boundToOther": "המנוי של {user}"
       },
       "add": {
         "heading": "צור אסימון",
@@ -3399,7 +3401,12 @@
         "labelPlaceholder": "לדוגמה, צינור CI",
         "scope": "היקף הרשאות",
         "scopeHelp": "מה האסימון הזה יכול לעשות: קריאה בלבד, קריאה וכתיבה, או גישה מלאה (שמאפשרת גם מחיקה).",
-        "create": "צור אסימון"
+        "create": "צור אסימון",
+        "identity": "פועל בשם",
+        "identitySystem": "סביבת העבודה הזו (אסימון מערכת)",
+        "identitySelf": "אני (אסימון אישי)",
+        "identitySystemHelp": "הרצות שמתחילות עם האסימון הזה שייכות לסביבת העבודה ואינן משויכות לאף אדם. הוא אינו יכול להשתמש במנוי האישי של אף אחד ל-Claude / Codex / GLM, ולכן משימה שמוצמדת למודל כזה תידחה במקום להיזקף לחובת מי שאינו נוכח. השתמשו בו ל-CI ולאינטגרציות משותפות.",
+        "identitySelfHelp": "הרצות שמתחילות עם האסימון הזה נחשבות שלך ויכולות להשתמש במנוי האישי שלך ל-Claude / Codex / GLM. כל קריאה כזו חייבת לשלוח גם את הסיסמה האישית שלך בכותרת X-Personal-Password; היא לעולם אינה נשמרת. השתמשו בו להרצות headless משלכם."
       },
       "scopes": {
         "read": "קריאה בלבד",
@@ -3730,6 +3737,15 @@
       "reachable": "נגיש · אין מודלים | נגיש · {count} מודל | נגיש · {count} מודלים | נגיש · {count} מודלים",
       "noModels": "לא דווחו מודלים.",
       "enableModels": "אפשר מודלים",
+      "imageInputHint": "מודלים מקומיים מסוימים קוראים צילומי מסך ורנדרים של עיצוב. משפחות מודלים מוכרות מזוהות אוטומטית, והאפשרות לא הוגדר אצל כל מודל מציינת כיצד הוא יטופל; הגדירו זאת בעצמכם עבור בנייה שהפלטפורמה אינה יכולה להכיר, כמו קוונטיזציה לטקסט בלבד או כיוונון עדין.",
+      "imageInputLabel": "תמיכה בתמונות עבור {model}",
+      "imageInput": {
+        "autoYes": "לא הוגדר: {family} קורא תמונות",
+        "autoNo": "לא הוגדר: {family} הוא טקסט בלבד",
+        "unknown": "תמונות: לא הוגדר",
+        "yes": "קורא תמונות",
+        "no": "טקסט בלבד"
+      },
       "toast": {
         "saved": "{name} נשמר",
         "saveFailed": "לא ניתן היה לשמור מריץ",
@@ -3741,6 +3757,7 @@
         "body": "\"{name}\" יימחק. לא ניתן לבטל פעולה זו."
       },
       "blocked": "כתובת ה-URL של מריץ זה אינה מותרת בפריסה הזו, ולכן הדגמים שלו מוסתרים מהבורר.",
+      "modelsDiscarded": "חלק מהמודלים שהופעלו במריץ הזה לא ניתנו לקריאה והושמטו. בחרו מחדש את אלה שאתם רוצים ושמרו.",
       "urlReason": {
         "invalid_url": "זו אינה כתובת URL תקפה.",
         "scheme_not_allowed": "כתובת URL של מריץ חייבת להתחיל ב-http:// או ב-https://.",

package/i18n/locales/it.json

@@ -793,7 +793,9 @@
         "createdBy": "creato da {user}",
         "createdByYou": "te",
         "createdByKey": "la chiave API {id}",
-        "revoke": "Revoca token"
+        "revoke": "Revoca token",
+        "boundToYou": "Il tuo abbonamento",
+        "boundToOther": "Abbonamento di {user}"
       },
       "add": {
         "heading": "Crea un token",
@@ -802,7 +804,12 @@
         "labelPlaceholder": "es. pipeline CI",
         "scope": "Ambito",
         "scopeHelp": "Cosa può fare questo token: sola lettura, lettura e scrittura o accesso completo (che consente anche l'eliminazione).",
-        "create": "Crea token"
+        "create": "Crea token",
+        "identity": "Viene eseguito come",
+        "identitySystem": "Questo spazio di lavoro (token di sistema)",
+        "identitySelf": "Io (token personale)",
+        "identitySystemHelp": "Le esecuzioni avviate con questo token appartengono allo spazio di lavoro e non sono attribuite a nessuna persona. Non può usare l'abbonamento personale Claude / Codex / GLM di nessuno: un'attività fissata su uno di quei modelli viene rifiutata anziché addebitata a chi non c'è. Usalo per la CI e le integrazioni condivise.",
+        "identitySelfHelp": "Le esecuzioni avviate con questo token sono attribuite a te e possono usare il tuo abbonamento personale Claude / Codex / GLM. Ogni chiamata deve inviare anche la tua password personale nell'intestazione X-Personal-Password; non viene mai memorizzata. Usalo per le tue esecuzioni headless."
       },
       "scopes": {
         "read": "Sola lettura",
@@ -1133,6 +1140,15 @@
       "reachable": "Raggiungibile · nessun modello | Raggiungibile · {count} modello | Raggiungibile · {count} modelli",
       "noModels": "Nessun modello riportato.",
       "enableModels": "Abilita i modelli",
+      "imageInputHint": "Alcuni modelli locali leggono screenshot e render di design. Le famiglie note vengono riconosciute automaticamente e l'opzione Non impostato di ogni modello indica come verrà trattato; impostalo tu per una build che la piattaforma non può conoscere, come una quantizzazione solo testo o un fine-tuning.",
+      "imageInputLabel": "Supporto immagini per {model}",
+      "imageInput": {
+        "autoYes": "Non impostato: {family} legge immagini",
+        "autoNo": "Non impostato: {family} è solo testo",
+        "unknown": "Immagini: non impostato",
+        "yes": "Legge immagini",
+        "no": "Solo testo"
+      },
       "toast": {
         "saved": "{name} salvato",
         "saveFailed": "Impossibile salvare il runner",
@@ -1144,6 +1160,7 @@
         "body": "\"{name}\" verra rimosso. Questa operazione non puo essere annullata."
       },
       "blocked": "L'URL di questo runner non è consentito su questo deployment, quindi i suoi modelli sono nascosti nel selettore.",
+      "modelsDiscarded": "Alcuni dei modelli abilitati di questo runner non sono risultati leggibili e sono stati scartati. Riseleziona quelli che vuoi e salva.",
       "urlReason": {
         "invalid_url": "Questo URL non è valido.",
         "scheme_not_allowed": "L'URL di un runner deve iniziare con http:// o https://.",

package/i18n/locales/ja.json

@@ -3390,7 +3390,9 @@
         "createdBy": "作成者: {user}",
         "createdByYou": "あなた",
         "createdByKey": "APIキー {id}",
-        "revoke": "トークンを取り消す"
+        "revoke": "トークンを取り消す",
+        "boundToYou": "あなたのサブスクリプション",
+        "boundToOther": "{user} のサブスクリプション"
       },
       "add": {
         "heading": "トークンを作成",
@@ -3399,7 +3401,12 @@
         "labelPlaceholder": "例: CI パイプライン",
         "scope": "権限範囲",
         "scopeHelp": "このトークンでできること: 読み取り専用、読み取りと書き込み、またはフルアクセス（削除も可能）。",
-        "create": "トークンを作成"
+        "create": "トークンを作成",
+        "identity": "実行者",
+        "identitySystem": "このワークスペース（システムトークン）",
+        "identitySelf": "自分（個人トークン）",
+        "identitySystemHelp": "このトークンで開始した実行はワークスペースに属し、個人には紐づきません。誰の個人 Claude / Codex / GLM サブスクリプションも利用できないため、それらのモデルを指定したタスクは、不在の相手に課金される代わりに拒否されます。CI や共有連携にはこちらを使ってください。",
+        "identitySelfHelp": "このトークンで開始した実行はあなたのものとして扱われ、あなたの個人 Claude / Codex / GLM サブスクリプションを利用できます。その際は毎回のリクエストで X-Personal-Password ヘッダーに個人パスワードを送る必要があります。パスワードは保存されません。自分のヘッドレス実行にはこちらを使ってください。"
       },
       "scopes": {
         "read": "読み取り専用",
@@ -3730,6 +3737,15 @@
       "reachable": "接続可能 · モデルなし | 接続可能 · {count} 個のモデル | 接続可能 · {count} 個のモデル",
       "noModels": "報告されたモデルがありません。",
       "enableModels": "モデルを有効化",
+      "imageInputHint": "一部のローカルモデルはスクリーンショットやデザインのレンダー画像を読み取れます。よく使われるモデルファミリーは自動的に判別され、各モデルの未設定の選択肢にどちらとして扱われるかが表示されます。テキスト専用の量子化版やファインチューンなど、プラットフォームでは判断できないビルドの場合にご自身で設定してください。",
+      "imageInputLabel": "{model} の画像対応",
+      "imageInput": {
+        "autoYes": "未設定: {family} は画像を読み取る",
+        "autoNo": "未設定: {family} はテキストのみ",
+        "unknown": "画像: 未設定",
+        "yes": "画像を読み取る",
+        "no": "テキストのみ"
+      },
       "toast": {
         "saved": "{name} を保存しました",
         "saveFailed": "ランナーを保存できませんでした",
@@ -3741,6 +3757,7 @@
         "body": "「{name}」が削除されます。 この操作は取り消せません。"
       },
       "blocked": "このランナーの URL はこのデプロイでは許可されていないため、モデルはピッカーに表示されません。",
+      "modelsDiscarded": "このランナーで有効になっていたモデルの一部を読み取れず、破棄しました。必要なものを選び直して保存してください。",
       "urlReason": {
         "invalid_url": "有効な URL ではありません。",
         "scheme_not_allowed": "ランナーの URL は http:// または https:// で始める必要があります。",

package/i18n/locales/pl.json

@@ -3248,7 +3248,9 @@
         "createdBy": "utworzone przez {user}",
         "createdByYou": "Ciebie",
         "createdByKey": "klucz API {id}",
-        "revoke": "Unieważnij token"
+        "revoke": "Unieważnij token",
+        "boundToYou": "Twoja subskrypcja",
+        "boundToOther": "Subskrypcja użytkownika {user}"
       },
       "add": {
         "heading": "Utwórz token",
@@ -3257,7 +3259,12 @@
         "labelPlaceholder": "np. potok CI",
         "scope": "Zakres",
         "scopeHelp": "Co może ten token: tylko odczyt, odczyt i zapis lub pełny dostęp (który pozwala także na usuwanie).",
-        "create": "Utwórz token"
+        "create": "Utwórz token",
+        "identity": "Działa jako",
+        "identitySystem": "Ten obszar roboczy (token systemowy)",
+        "identitySelf": "Ja (token osobisty)",
+        "identitySystemHelp": "Uruchomienia rozpoczęte tym tokenem należą do obszaru roboczego i nie są przypisywane do żadnej osoby. Token nie może korzystać z niczyjej osobistej subskrypcji Claude / Codex / GLM, więc zadanie przypięte do takiego modelu zostanie odrzucone, zamiast obciążyć kogoś nieobecnego. Użyj go do CI i wspólnych integracji.",
+        "identitySelfHelp": "Uruchomienia rozpoczęte tym tokenem są przypisywane Tobie i mogą korzystać z Twojej osobistej subskrypcji Claude / Codex / GLM. Każde takie wywołanie musi dodatkowo przesłać Twoje hasło osobiste w nagłówku X-Personal-Password; nie jest ono nigdzie zapisywane. Użyj go do własnych uruchomień headless."
       },
       "scopes": {
         "read": "Tylko odczyt",
@@ -3588,6 +3595,15 @@
       "reachable": "Osiągalny · {count} model | Osiągalny · {count} modele | Osiągalny · {count} modeli",
       "noModels": "Nie zgłoszono żadnych modeli.",
       "enableModels": "Włącz modele",
+      "imageInputHint": "Część modeli lokalnych czyta zrzuty ekranu i rendery projektów. Znane rodziny modeli są rozpoznawane automatycznie, a opcja Nie ustawiono przy każdym modelu mówi, jak zostanie potraktowany; ustaw ją samodzielnie dla wersji, której platforma nie może znać, na przykład kwantyzacji tylko tekstowej lub własnego dostrojenia.",
+      "imageInputLabel": "Obsługa obrazów dla {model}",
+      "imageInput": {
+        "autoYes": "Nie ustawiono: {family} czyta obrazy",
+        "autoNo": "Nie ustawiono: {family} obsługuje tylko tekst",
+        "unknown": "Obrazy: nie ustawiono",
+        "yes": "Czyta obrazy",
+        "no": "Tylko tekst"
+      },
       "toast": {
         "saved": "Zapisano {name}",
         "saveFailed": "Nie udało się zapisać runnera",
@@ -3599,6 +3615,7 @@
         "body": "\"{name}\" zostanie usunięty. Tej operacji nie można cofnąć."
       },
       "blocked": "Adres URL tego runnera nie jest dozwolony w tym wdrożeniu, dlatego jego modele są ukryte w selektorze.",
+      "modelsDiscarded": "Części włączonych modeli tego runnera nie udało się odczytać i zostały odrzucone. Wybierz ponownie te, których chcesz, i zapisz.",
       "urlReason": {
         "invalid_url": "To nie jest prawidłowy adres URL.",
         "scheme_not_allowed": "Adres URL runnera musi zaczynać się od http:// lub https://.",

package/i18n/locales/tr.json

@@ -3390,7 +3390,9 @@
         "createdBy": "oluşturan: {user}",
         "createdByYou": "siz",
         "createdByKey": "{id} API anahtarı",
-        "revoke": "Belirteci iptal et"
+        "revoke": "Belirteci iptal et",
+        "boundToYou": "Aboneliğiniz",
+        "boundToOther": "{user} kullanıcısının aboneliği"
       },
       "add": {
         "heading": "Belirteç oluştur",
@@ -3399,7 +3401,12 @@
         "labelPlaceholder": "örn. CI hattı",
         "scope": "Kapsam",
         "scopeHelp": "Bu belirtecin yapabilecekleri: yalnızca okuma, okuma ve yazma ya da tam erişim (silmeye de izin verir).",
-        "create": "Belirteç oluştur"
+        "create": "Belirteç oluştur",
+        "identity": "Şu kimlikle çalışır",
+        "identitySystem": "Bu çalışma alanı (sistem belirteci)",
+        "identitySelf": "Ben (kişisel belirteç)",
+        "identitySystemHelp": "Bu belirteçle başlatılan çalıştırmalar çalışma alanına aittir ve hiçbir kişiye atfedilmez. Kimsenin kişisel Claude / Codex / GLM aboneliğini kullanamaz; bu nedenle böyle bir modele sabitlenmiş görev, orada olmayan birine fatura edilmek yerine reddedilir. CI ve paylaşılan entegrasyonlar için bunu kullanın.",
+        "identitySelfHelp": "Bu belirteçle başlatılan çalıştırmalar size ait sayılır ve kişisel Claude / Codex / GLM aboneliğinizi kullanabilir. Bu tür her çağrının ayrıca kişisel parolanızı X-Personal-Password başlığında göndermesi gerekir; parola hiçbir zaman saklanmaz. Kendi headless çalıştırmalarınız için bunu kullanın."
       },
       "scopes": {
         "read": "Yalnızca okuma",
@@ -3730,6 +3737,15 @@
       "reachable": "Ulaşılabilir · model yok | Ulaşılabilir · {count} model | Ulaşılabilir · {count} model",
       "noModels": "Model bildirilmedi.",
       "enableModels": "Modelleri etkinleştir",
+      "imageInputHint": "Bazı yerel modeller ekran görüntülerini ve tasarım render'larını okuyabilir. Bilinen model aileleri otomatik olarak tanınır ve her modeldeki Ayarlanmadı seçeneği hangi sonucu vereceğini belirtir; yalnızca metin niceleme ya da ince ayar gibi platformun bilemeyeceği bir yapı için bunu kendiniz ayarlayın.",
+      "imageInputLabel": "{model} için görsel desteği",
+      "imageInput": {
+        "autoYes": "Ayarlanmadı: {family} görsel okur",
+        "autoNo": "Ayarlanmadı: {family} yalnızca metin",
+        "unknown": "Görseller: ayarlanmadı",
+        "yes": "Görsel okur",
+        "no": "Yalnızca metin"
+      },
       "toast": {
         "saved": "{name} kaydedildi",
         "saveFailed": "Çalıştırıcı kaydedilemedi",
@@ -3741,6 +3757,7 @@
         "body": "\"{name}\" kaldırılacak. Bu işlem geri alınamaz."
       },
       "blocked": "Bu çalıştırıcının URL adresi bu kurulumda izinli değil, bu nedenle modelleri seçicide gizlendi.",
+      "modelsDiscarded": "Bu çalıştırıcının etkin modellerinin bir kısmı okunamadı ve atıldı. İstediklerinizi yeniden seçip kaydedin.",
       "urlReason": {
         "invalid_url": "Bu geçerli bir URL değil.",
         "scheme_not_allowed": "Çalıştırıcı URL adresi http:// veya https:// ile başlamalıdır.",

package/i18n/locales/uk.json

@@ -3248,7 +3248,9 @@
         "createdBy": "створено {user}",
         "createdByYou": "вами",
         "createdByKey": "ключ API {id}",
-        "revoke": "Відкликати токен"
+        "revoke": "Відкликати токен",
+        "boundToYou": "Ваша підписка",
+        "boundToOther": "Підписка {user}"
       },
       "add": {
         "heading": "Створити токен",
@@ -3257,7 +3259,12 @@
         "labelPlaceholder": "напр. конвеєр CI",
         "scope": "Обсяг доступу",
         "scopeHelp": "Що може цей токен: лише читання, читання та запис або повний доступ (який також дозволяє видалення).",
-        "create": "Створити токен"
+        "create": "Створити токен",
+        "identity": "Виконується як",
+        "identitySystem": "Цей робочий простір (системний токен)",
+        "identitySelf": "Я (особистий токен)",
+        "identitySystemHelp": "Запуски, розпочаті цим токеном, належать робочому простору й не приписуються жодній особі. Він не може використовувати чиюсь особисту підписку Claude / Codex / GLM, тож завдання, закріплене за такою моделлю, буде відхилено, а не оплачено коштом відсутньої людини. Використовуйте його для CI та спільних інтеграцій.",
+        "identitySelfHelp": "Запуски, розпочаті цим токеном, вважаються вашими й можуть використовувати вашу особисту підписку Claude / Codex / GLM. Кожен такий виклик має також надсилати ваш особистий пароль у заголовку X-Personal-Password; він ніколи не зберігається. Використовуйте його для власних headless-запусків."
       },
       "scopes": {
         "read": "Лише читання",
@@ -3588,6 +3595,15 @@
       "reachable": "Доступний · {count} модель | Доступний · {count} моделі | Доступний · {count} моделей",
       "noModels": "Жодної моделі не повідомлено.",
       "enableModels": "Увімкнути моделі",
+      "imageInputHint": "Деякі локальні моделі читають знімки екрана та рендери дизайну. Відомі сімейства моделей розпізнаються автоматично, а параметр Не задано біля кожної моделі показує, як її буде оброблено; задайте його самостійно для збірки, про яку платформа не може знати, як-от суто текстова квантизація або власне доналаштування.",
+      "imageInputLabel": "Підтримка зображень для {model}",
+      "imageInput": {
+        "autoYes": "Не задано: {family} читає зображення",
+        "autoNo": "Не задано: {family} лише текст",
+        "unknown": "Зображення: не задано",
+        "yes": "Читає зображення",
+        "no": "Лише текст"
+      },
       "toast": {
         "saved": "{name} збережено",
         "saveFailed": "Не вдалося зберегти раннер",
@@ -3599,6 +3615,7 @@
         "body": "\"{name}\" буде видалено. Цю дію не можна скасувати."
       },
       "blocked": "URL цього раннера не дозволений у цьому розгортанні, тому його моделі приховані у виборі.",
+      "modelsDiscarded": "Частину увімкнених моделей цього раннера не вдалося прочитати, і вони були відкинуті. Виберіть потрібні знову та збережіть.",
       "urlReason": {
         "invalid_url": "Це недійсний URL.",
         "scheme_not_allowed": "URL раннера має починатися з http:// або https://.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.261.7",
+  "version": "0.263.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -40,7 +40,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.41",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.296.0"
+    "@cat-factory/contracts": "0.298.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",