@cat-factory/app 0.296.6 → 0.298.0

package/app/components/panels/inspector/ServiceTestConfig.vue

@@ -3,13 +3,11 @@ import { computed, onMounted, ref, watch } from 'vue'
 import type {
   Block,
   CloudProvider,
-  EnvironmentTestStage,
   InstanceSize,
   ProvisionType,
   ServiceProvisioning,
 } from '~/types/domain'
 import type {
-  ConflictReason,
   KubernetesManifestSource,
   KubernetesRenderer,
   ProvisioningComposeServiceCandidate,
@@ -20,8 +18,8 @@ import type {
 } from '@cat-factory/contracts'
 import RepoTreeBrowser from '~/components/github/RepoTreeBrowser.vue'
 import InspectorSection from '~/components/panels/inspector/InspectorSection.vue'
+import ServiceSelfTests from '~/components/panels/inspector/ServiceSelfTests.vue'
 import { apiErrorEnvelope } from '~/composables/api/errors'
-import { parseConflict } from '~/composables/usePipelineErrorToast'
 
 // Service-level (frame) configuration: the service-owned PROVISIONING — the provision
 // TYPE this service produces (`infraless` / `docker-compose` / `kubernetes` / `custom`)
@@ -263,117 +261,6 @@ async function generateOrFixManifest() {
   }
 }
 
-// Ephemeral-environment self-test: run the whole create-branch → provision → tear-down →
-// delete-branch cycle against this service's provisioning config and report success / the stage
-// it failed at. The returned run is tracked live (by frame id) via the workspace stream store.
-const envTest = useEnvironmentTestStore()
-const envTestStarting = ref(false)
-// The self-test's start/stop error. Structured (not a bare string) so the not-provisionable case
-// can render its remedy prose PLUS a one-click jump to the environment-handler config; every other
-// case is plain text.
-interface EnvTestError {
-  text: string
-  /** Show the "Configure infrastructure" deep-link — only the not-provisionable handler case. */
-  configurable?: boolean
-}
-const envTestError = ref<EnvTestError | null>(null)
-// The newest self-test run for this frame — re-attaches after a reconnect (the run is carried in
-// the snapshot while running), so the live stage keeps showing without a locally-held id.
-const envTestRun = computed(() => envTest.runForBlock(props.block.id))
-const envTestRunning = computed(() => envTestRun.value?.status === 'running')
-// Nothing to provision for an `infraless` service, so there is nothing to test.
-const canTestEnv = computed(() => provisionType.value !== 'infraless')
-
-// Per-stage label KEYS, exhaustive over the contracts `EnvironmentTestStage` union: a new
-// backend stage fails THIS typecheck until mapped (the key is resolved at runtime, so the
-// typed-message-keys check can't see the `t()` lookup — the map's exhaustiveness is the
-// drift guard, same pattern as `CONFLICT_TITLE_KEYS`).
-const ENV_TEST_STAGE_KEYS: Record<EnvironmentTestStage, string> = {
-  creating_branch: 'inspector.testConfig.envTest.stage.creating_branch',
-  provisioning: 'inspector.testConfig.envTest.stage.provisioning',
-  tearing_down: 'inspector.testConfig.envTest.stage.tearing_down',
-  deleting_branch: 'inspector.testConfig.envTest.stage.deleting_branch',
-  done: 'inspector.testConfig.envTest.stage.done',
-}
-
-function envTestStageLabel(stage: EnvironmentTestStage): string {
-  const key = ENV_TEST_STAGE_KEYS[stage]
-  // `te`-guarded so a locale missing the key shows the raw stage id, never a raw message key.
-  return te(key) ? t(key) : stage
-}
-
-// The start preflight's machine-readable 409 reasons, mapped to their localized titles —
-// exhaustive over the contracts `env_test_*` conflict reasons (same drift guard as above).
-// The raw backend `message` is only the last-resort fallback for unmapped/non-conflict errors.
-const ENV_TEST_CONFLICT_KEYS: Record<Extract<ConflictReason, `env_test_${string}`>, string> = {
-  env_test_not_a_frame: 'errors.conflict.title.env_test_not_a_frame',
-  env_test_infraless: 'errors.conflict.title.env_test_infraless',
-  env_test_not_provisionable: 'errors.conflict.title.env_test_not_provisionable',
-  env_test_no_vcs: 'errors.conflict.title.env_test_no_vcs',
-  env_test_connection_failed: 'errors.conflict.title.env_test_connection_failed',
-}
-
-function buildEnvTestError(e: unknown): EnvTestError {
-  const parsed = parseConflict(e)
-  const reason = parsed?.reason
-  // No workspace handler resolves for the service's provision type. Word the SPECIFIC case —
-  // nothing configured vs. an ambiguous match (carried on `details.handlerIssue`, distinct from the
-  // `env_test_not_provisionable` code) — and offer the one-click jump to the Infrastructure →
-  // Test-environments handler config.
-  if (reason === 'env_test_not_provisionable') {
-    const ambiguous = parsed?.details.handlerIssue === 'type-mismatch'
-    return {
-      text: t(
-        ambiguous
-          ? 'errors.conflict.description.env_test_not_provisionable_type_mismatch'
-          : 'errors.conflict.description.env_test_not_provisionable_no_handler',
-      ),
-      configurable: true,
-    }
-  }
-  // The handler resolved but its live connection probe failed. The provider's OWN message is the
-  // actionable part ("project 'X' was not found"), so wrap it in localized prose rather than
-  // replacing it with a generic sentence — and offer the same jump, since the fix is in the
-  // handler's connection config.
-  if (reason === 'env_test_connection_failed' && parsed?.message) {
-    return {
-      text: t('errors.conflict.description.env_test_connection_failed_detail', {
-        detail: parsed.message,
-      }),
-      configurable: true,
-    }
-  }
-  const key =
-    reason && reason in ENV_TEST_CONFLICT_KEYS
-      ? ENV_TEST_CONFLICT_KEYS[reason as keyof typeof ENV_TEST_CONFLICT_KEYS]
-      : undefined
-  if (key && te(key)) return { text: t(key) }
-  return { text: apiErrorEnvelope(e)?.message ?? (e instanceof Error ? e.message : String(e)) }
-}
-
-async function startEnvTest() {
-  if (!canTestEnv.value || envTestStarting.value || envTestRunning.value) return
-  envTestStarting.value = true
-  envTestError.value = null
-  try {
-    await envTest.start(props.block.id)
-  } catch (e) {
-    envTestError.value = buildEnvTestError(e)
-  } finally {
-    envTestStarting.value = false
-  }
-}
-
-async function stopEnvTest() {
-  const run = envTestRun.value
-  if (!run || run.status !== 'running') return
-  try {
-    await envTest.stop(run.id)
-  } catch (e) {
-    envTestError.value = buildEnvTestError(e)
-  }
-}
-
 // The provisioning hints (cloud provider + instance size) are advisory inputs to the
 // ephemeral-environment provisioner, not commonly tuned — keep them collapsed by default.
 const showProvisioning = ref(false)
@@ -1049,93 +936,10 @@ function setSize(value: InstanceSize) {
       </div>
     </InspectorSection>
 
-    <!-- Ephemeral-environment self-test: exercise the whole provisioning lifecycle against a
-         throwaway branch and report success / the failing stage. Disabled for `infraless`. -->
-    <div class="mt-3 space-y-2 border-t border-white/5 pt-3" data-testid="env-test-section">
-      <div class="flex items-center justify-between gap-2">
-        <div class="min-w-0">
-          <p class="text-[11px] font-medium text-slate-300">
-            {{ t('inspector.testConfig.envTest.title') }}
-          </p>
-          <p class="text-[11px] text-slate-400">{{ t('inspector.testConfig.envTest.hint') }}</p>
-        </div>
-        <UButton
-          v-if="!envTestRunning"
-          icon="i-lucide-flask-conical"
-          size="xs"
-          color="primary"
-          variant="soft"
-          data-testid="env-test-start"
-          :loading="envTestStarting"
-          :disabled="!canTestEnv"
-          @click="startEnvTest"
-        >
-          {{ t('inspector.testConfig.envTest.start') }}
-        </UButton>
-        <UButton
-          v-else
-          icon="i-lucide-square"
-          size="xs"
-          color="neutral"
-          variant="ghost"
-          data-testid="env-test-stop"
-          @click="stopEnvTest"
-        >
-          {{ t('inspector.testConfig.envTest.stop') }}
-        </UButton>
-      </div>
-
-      <p v-if="!canTestEnv" class="text-[11px] text-slate-500">
-        {{ t('inspector.testConfig.envTest.infraless') }}
-      </p>
-
-      <!-- Live stage + terminal outcome of the tracked run (pushed via the workspace stream). -->
-      <p
-        v-if="envTestRun"
-        class="text-[11px]"
-        :class="{
-          'text-sky-300/80': envTestRun.status === 'running',
-          'text-emerald-300/80': envTestRun.status === 'succeeded',
-          'text-rose-300/80': envTestRun.status === 'failed',
-        }"
-        data-testid="env-test-status"
-      >
-        <template v-if="envTestRun.status === 'running'">
-          {{
-            t('inspector.testConfig.envTest.running', {
-              stage: envTestStageLabel(envTestRun.stage),
-            })
-          }}
-        </template>
-        <template v-else-if="envTestRun.status === 'succeeded'">
-          {{ t('inspector.testConfig.envTest.succeeded') }}
-        </template>
-        <template v-else>
-          {{ t('inspector.testConfig.envTest.failed') }}
-          <template v-if="envTestRun.failedStage">
-            ({{ envTestStageLabel(envTestRun.failedStage) }})
-          </template>
-          <span v-if="envTestRun.error" class="block text-rose-300/70">{{ envTestRun.error }}</span>
-        </template>
-      </p>
-
-      <div v-if="envTestError" class="text-[11px] text-rose-400" data-testid="env-test-error">
-        <p>{{ envTestError.text }}</p>
-        <!-- Only the not-provisionable handler case is one-click fixable: jump to Infrastructure →
-             Test environments, where the workspace's per-type environment handler is registered. -->
-        <UButton
-          v-if="envTestError.configurable"
-          class="mt-1.5"
-          icon="i-lucide-settings"
-          size="xs"
-          color="neutral"
-          variant="soft"
-          data-testid="env-test-configure-handler"
-          @click="ui.openProviderConnection('environment')"
-        >
-          {{ t('errors.conflict.action.configureInfrastructure') }}
-        </UButton>
-      </div>
-    </div>
+    <!-- The two self-tests this service offers: does its provisioning stand an environment up,
+         and could an agent handed that environment actually operate the service. Their own
+         collaborator (they share every piece of state and every refusal), so this view stays
+         about the provisioning CONFIG. -->
+    <ServiceSelfTests :block="block" />
   </InspectorSection>
 </template>

package/app/composables/api/environments.ts

@@ -5,11 +5,11 @@ import {
   startEnvironmentTestContract,
   stopEnvironmentTestContract,
 } from '@cat-factory/contracts'
-import type { ProvisionEnvironmentInput } from '@cat-factory/contracts'
+import type { EnvironmentTestMode, ProvisionEnvironmentInput } from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /** Ephemeral environments: the workspace's live env handles (used to resolve frontend bindings). */
-export function environmentsApi({ send, ws }: ApiContext) {
+export function environmentsApi({ send, sendWith, ws, pwHeaders }: ApiContext) {
   return {
     listEnvironments: (workspaceId: string) =>
       send(listEnvironmentsContract, { pathPrefix: ws(workspaceId) }),
@@ -20,9 +20,24 @@ export function environmentsApi({ send, ws }: ApiContext) {
       send(provisionEnvironmentContract, { pathPrefix: ws(workspaceId), body }),
 
     // Ephemeral-environment self-test: start a full create-branch → provision → tear-down →
-    // delete-branch cycle against a service frame, then read / stop its run.
-    startEnvironmentTest: (workspaceId: string, blockId: string) =>
-      send(startEnvironmentTestContract, { pathPrefix: ws(workspaceId), pathParams: { blockId } }),
+    // delete-branch cycle against a service frame, then read / stop its run. `mode` picks what it
+    // exercises: the provisioning alone, or that plus an agent dry run against the environment.
+    //
+    // Carries the personal unlock password, because an `agent-probe` run spends a model call and
+    // the model comes from the workspace's preset, which can name a personal subscription
+    // (Claude). The backend only consults it when the resolved model needs one, so a provisioning
+    // self-test is unaffected.
+    startEnvironmentTest: (
+      workspaceId: string,
+      blockId: string,
+      mode: EnvironmentTestMode,
+      password?: string,
+    ) =>
+      sendWith(pwHeaders(password), startEnvironmentTestContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { blockId },
+        body: { mode },
+      }),
     getEnvironmentTest: (workspaceId: string, id: string) =>
       send(getEnvironmentTestContract, { pathPrefix: ws(workspaceId), pathParams: { id } }),
     stopEnvironmentTest: (workspaceId: string, id: string) =>

package/app/composables/usePipelineErrorToast.ts

@@ -270,6 +270,34 @@ const CONFLICT_INFO: Record<Exclude<ConflictReason, BespokeConflictReason>, Conf
       run: (ui) => ui.openProviderConnection('environment'),
     },
   },
+  // An agent dry run on a deployment that cannot drive one. No ACTION: the gap is a container
+  // runner, a proxyable model or a repository seam, none of which a user can wire from the SPA.
+  // Offering a settings jump here would send them somewhere that cannot fix it.
+  env_test_probe_unavailable: {
+    titleKey: 'errors.conflict.title.env_test_probe_unavailable',
+    descriptionKey: 'errors.conflict.description.env_test_probe_unavailable',
+  },
+  // The frame's RESOLVED model cannot be dispatched: a provider the LLM proxy cannot serve, or a
+  // subscription-only model with no connected credential. Distinct from the reason above, whose
+  // gap is a container prerequisite: this deployment is wired and the workspace's own model preset
+  // names something unrunnable, so the remedy is in the model settings and the jump is worth
+  // offering. The specific cause rides `details.modelIssue`, which the funnel surfaces as detail.
+  env_test_probe_model_unavailable: {
+    titleKey: 'errors.conflict.title.env_test_probe_model_unavailable',
+    descriptionKey: 'errors.conflict.description.env_test_probe_model_unavailable',
+  },
+  // A second self-test on a frame that already has one running. No ACTION: the remedy is to wait
+  // for the run showing in the same panel, or to stop it with the button beside it.
+  env_test_already_running: {
+    titleKey: 'errors.conflict.title.env_test_already_running',
+    descriptionKey: 'errors.conflict.description.env_test_already_running',
+  },
+  // The workspace is over a spend budget and a dry run is a billable call. No ACTION here either:
+  // budgets are an account-level setting, and the provisioning self-test beside it still runs.
+  env_test_over_budget: {
+    titleKey: 'errors.conflict.title.env_test_over_budget',
+    descriptionKey: 'errors.conflict.description.env_test_over_budget',
+  },
   // Opt-in review-debt friction. In the normal task-create flow AddTaskModal intercepts these
   // 409s and opens the friction dialog (which can retry with an acknowledgement), so these entries
   // are the last-resort toast fallback for any OTHER caller — a generic, param-free title +

package/app/stores/environmentTest.spec.ts

@@ -1,10 +1,12 @@
 import { describe, it, expect, beforeEach, vi } from 'vitest'
 import type { EnvironmentTestRun } from '~/types/domain'
 import { useEnvironmentTestStore } from '~/stores/environmentTest'
+import { usePersonalSubscriptionsStore } from '~/stores/personalSubscriptions'
+import { useWorkspaceStore } from '~/stores/workspace'
 
 // The store resolves `useApi()` at setup; override the inert global stub from
 // `test/setup.ts` with a per-suite mock so the hydrate reconcile point-read is observable.
-const apiMock = { getEnvironmentTest: vi.fn() }
+const apiMock = { getEnvironmentTest: vi.fn(), startEnvironmentTest: vi.fn() }
 vi.stubGlobal('useApi', () => apiMock)
 
 /** Minimal EnvironmentTestRun factory — only the fields the store's reconcile logic touches. */
@@ -13,18 +15,61 @@ function run(id: string, over: Partial<EnvironmentTestRun> = {}): EnvironmentTes
     id,
     workspaceId: 'ws_test',
     blockId: `blk_${id}`,
+    mode: 'provision',
     status: 'running',
     stage: 'provisioning',
     branch: null,
     envUrl: null,
     error: null,
     failedStage: null,
+    probe: null,
+    probeProgress: null,
     createdAt: 1,
     updatedAt: 1,
     ...over,
   }
 }
 
+describe('environmentTest store: starting a run that may need a personal credential', () => {
+  let store: ReturnType<typeof useEnvironmentTestStore>
+  let withCredential: ReturnType<typeof vi.fn>
+
+  beforeEach(() => {
+    useWorkspaceStore().workspaceId = 'ws_test'
+    // The gate's contract, stubbed on the real store: run the action with the cached password, and
+    // resolve `false` when the person cancels the unlock prompt.
+    withCredential = vi.fn(async (action: (password?: string) => Promise<void>) => {
+      await action('cached-password')
+      return true
+    })
+    usePersonalSubscriptionsStore().withCredential = withCredential as unknown as ReturnType<
+      typeof usePersonalSubscriptionsStore
+    >['withCredential']
+    apiMock.startEnvironmentTest = vi.fn(async () => run('envtest_1', { mode: 'agent-probe' }))
+    store = useEnvironmentTestStore()
+  })
+
+  it('rides the unlock password, so a preset-resolved Claude dry run can lease it', async () => {
+    // Ungated, an `agent-probe` start 428s and the person is never asked for anything: the
+    // failure they see is a dry run that provisioned an environment and then could not open a
+    // credential nobody unlocked.
+    const started = await store.start('blk_1', 'agent-probe')
+    expect(apiMock.startEnvironmentTest).toHaveBeenCalledWith(
+      'ws_test',
+      'blk_1',
+      'agent-probe',
+      'cached-password',
+    )
+    expect(started?.id).toBe('envtest_1')
+    expect(store.runById('envtest_1')).toBeTruthy()
+  })
+
+  it('reports a cancelled unlock as no run, so the caller stops waiting for one', async () => {
+    withCredential.mockImplementation(async () => false)
+    expect(await store.start('blk_1', 'agent-probe')).toBeNull()
+  })
+})
+
 describe('environmentTest store — monotonic run reconcile', () => {
   let store: ReturnType<typeof useEnvironmentTestStore>
   beforeEach(() => {
@@ -41,7 +86,7 @@ describe('environmentTest store — monotonic run reconcile', () => {
     // as `running` (older updatedAt) — it must NOT clobber the terminal state (terminal runs
     // emit nothing further, so the inspector would be stuck on "testing" forever).
     store.hydrate([run('r1', { status: 'running', updatedAt: 2 })], 'ws_test')
-    expect(store.runForBlock('blk_r1')!.status).toBe('failed')
+    expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('failed')
   })
 
   it('hydrate does NOT drop a live-added run the stale snapshot never saw', () => {
@@ -49,7 +94,7 @@ describe('environmentTest store — monotonic run reconcile', () => {
     // inspector still shows must survive a full refresh.
     store.upsert(run('r1', { status: 'succeeded', stage: 'done', updatedAt: 5 }))
     store.hydrate([], 'ws_test')
-    expect(store.runForBlock('blk_r1')!.status).toBe('succeeded')
+    expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('succeeded')
   })
 
   it('hydrate point-reads a preserved RUNNING run the snapshot omitted (finished offline)', async () => {
@@ -62,7 +107,9 @@ describe('environmentTest store — monotonic run reconcile', () => {
     )
     store.hydrate([], 'ws_test')
     expect(apiMock.getEnvironmentTest).toHaveBeenCalledWith('ws_test', 'r1')
-    await vi.waitFor(() => expect(store.runForBlock('blk_r1')!.status).toBe('succeeded'))
+    await vi.waitFor(() =>
+      expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('succeeded'),
+    )
   })
 
   it('a STALE point-read cannot regress a run a live event advanced meanwhile', async () => {
@@ -74,7 +121,7 @@ describe('environmentTest store — monotonic run reconcile', () => {
     store.upsert(run('r1', { status: 'failed', failedStage: 'tearing_down', updatedAt: 8 }))
     await vi.waitFor(() => expect(apiMock.getEnvironmentTest).toHaveBeenCalled())
     await Promise.resolve()
-    expect(store.runForBlock('blk_r1')!.status).toBe('failed')
+    expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('failed')
   })
 
   /**
@@ -106,7 +153,9 @@ describe('environmentTest store — monotonic run reconcile', () => {
     expect(apiMock.getEnvironmentTest).toHaveBeenCalledTimes(1)
 
     releaseFirst()
-    await vi.waitFor(() => expect(store.runForBlock('blk_r1')!.status).toBe('succeeded'))
+    await vi.waitFor(() =>
+      expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('succeeded'),
+    )
     expect(apiMock.getEnvironmentTest).toHaveBeenCalledTimes(2)
   })
 
@@ -122,15 +171,35 @@ describe('environmentTest store — monotonic run reconcile', () => {
       [run('r1', { status: 'running', stage: 'tearing_down', updatedAt: 9 })],
       'ws_test',
     )
-    expect(store.runForBlock('blk_r1')!.stage).toBe('tearing_down')
+    expect(store.runForBlock('blk_r1', 'provision')!.stage).toBe('tearing_down')
   })
 
   it('upsert ignores an older/out-of-order write but applies newer/equal', () => {
     store.upsert(run('r1', { status: 'failed', updatedAt: 5 }))
     // e.g. a `start()` response resolving AFTER the fast-failing run's terminal event landed.
     store.upsert(run('r1', { status: 'running', stage: 'creating_branch', updatedAt: 3 }))
-    expect(store.runForBlock('blk_r1')!.status).toBe('failed')
+    expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('failed')
     store.upsert(run('r1', { status: 'succeeded', stage: 'done', updatedAt: 5 }))
-    expect(store.runForBlock('blk_r1')!.status).toBe('succeeded')
+    expect(store.runForBlock('blk_r1', 'provision')!.status).toBe('succeeded')
+  })
+
+  /**
+   * The two self-tests render side by side in the inspector, each with its own status line, so a
+   * per-block read has to be per MODE too. Unscoped, whichever ran more recently would report
+   * under both controls, and a developer would act on the wrong one.
+   */
+  it('runForBlock scopes to the mode, so the two self-tests never report each other', () => {
+    store.upsert(run('r1', { blockId: 'blk_frame', mode: 'provision', status: 'succeeded' }))
+    store.upsert(
+      run('r2', {
+        blockId: 'blk_frame',
+        mode: 'agent-probe',
+        status: 'failed',
+        failedStage: 'probing',
+        updatedAt: 9,
+      }),
+    )
+    expect(store.runForBlock('blk_frame', 'provision')!.id).toBe('r1')
+    expect(store.runForBlock('blk_frame', 'agent-probe')!.id).toBe('r2')
   })
 })

package/app/stores/environmentTest.ts

@@ -1,18 +1,23 @@
 import { defineStore } from 'pinia'
 import { ref } from 'vue'
+import type { EnvironmentTestMode } from '@cat-factory/contracts'
 import type { EnvironmentTestRun } from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
+import { usePersonalSubscriptionsStore } from '~/stores/personalSubscriptions'
 
 /**
- * Ephemeral-environment self-test runs. A developer starts one from a service frame's inspector
- * (`POST …/blocks/:id/environment-test`); the backend drives the create-branch → provision →
- * tear-down → delete-branch cycle durably and pushes live `envTest` stage events, which
+ * Ephemeral-environment self-test runs, in both modes: the provisioning self-test and the AGENT
+ * DRY RUN, which adds a `probing` stage and comes back with a report. A developer starts one from
+ * a service frame's inspector (`POST …/blocks/:id/environment-test`); the backend drives the
+ * create-branch → provision → [probe] → tear-down → delete-branch cycle durably and pushes live
+ * `envTest` stage events, which
  * `useWorkspaceStream` folds in via {@link upsert}. In-flight runs also arrive in the workspace
  * snapshot ({@link hydrate}) so the inspector re-attaches to a running test after a reconnect.
  *
  * Runs are keyed by their FRAME block id for the inspector's per-service lookup ({@link runForBlock}
- * returns the newest run for a block). Terminal runs are kept in memory for the session so the
- * inspector can show the last outcome; the snapshot only carries running ones.
+ * returns the newest run for a block IN ONE MODE, since the two self-tests render side by side).
+ * Terminal runs are kept in memory for the session so the inspector can show the last outcome; the
+ * snapshot only carries running ones.
  */
 export const useEnvironmentTestStore = defineStore('environmentTest', () => {
   const api = useApi()
@@ -113,17 +118,43 @@ export const useEnvironmentTestStore = defineStore('environmentTest', () => {
     return runs.value.find((r) => r.id === id)
   }
 
-  /** The newest run for a service frame — the inspector's per-service attach point. */
-  function runForBlock(blockId: string): EnvironmentTestRun | undefined {
-    return runs.value.find((r) => r.blockId === blockId)
+  /**
+   * The newest run for a service frame IN ONE MODE: the inspector's per-service attach point.
+   *
+   * Scoped by mode because the inspector shows the two self-tests side by side and each owns its
+   * own status line: an unscoped read would have a provisioning test's outcome appear under the
+   * agent dry run's button (and vice versa) whenever the other one ran more recently, which is
+   * the reading a developer would act on.
+   */
+  function runForBlock(blockId: string, mode: EnvironmentTestMode): EnvironmentTestRun | undefined {
+    return runs.value.find((r) => r.blockId === blockId && r.mode === mode)
   }
 
-  /** Start a self-test against a service frame; the returned run is tracked immediately. */
-  async function start(blockId: string): Promise<EnvironmentTestRun> {
+  /**
+   * Start a self-test against a service frame; the returned run is tracked immediately.
+   *
+   * Gated through `withCredential`, like every other surface that starts agent work: an AGENT DRY
+   * RUN resolves its model from the workspace's model preset, which can name an individual-usage
+   * subscription (Claude), and such a credential is only leasable with the owner's unlock
+   * password. The cached password rides the first attempt and a `428` opens the modal; the
+   * provisioning self-test spends no model call, so the backend never consults it there.
+   *
+   * `null` when the person cancels the prompt: the run never started, so the caller reverts its
+   * spinner rather than waiting for a run that is not coming.
+   */
+  async function start(
+    blockId: string,
+    mode: EnvironmentTestMode,
+  ): Promise<EnvironmentTestRun | null> {
     const ws = useWorkspaceStore()
-    const run = await api.startEnvironmentTest(ws.requireId(), blockId)
-    upsert(run)
-    return run
+    const personal = usePersonalSubscriptionsStore()
+    let started: EnvironmentTestRun | null = null
+    const ok = await personal.withCredential(async (password) => {
+      const run = await api.startEnvironmentTest(ws.requireId(), blockId, mode, password)
+      upsert(run)
+      started = run
+    })
+    return ok ? started : null
   }
 
   /** Stop a running self-test (best-effort cleanup, then failed). */

package/app/types/domain.ts

@@ -40,6 +40,7 @@ export type {
   ResolvedFrontendBinding,
   EnvironmentHandle,
   EnvironmentTestRun,
+  EnvironmentTestMode,
   EnvironmentTestStage,
   EnvironmentTestStatus,
   ServiceConnection,

package/i18n/locales/de.json

@@ -1691,17 +1691,53 @@
         "hint": "Führt den gesamten Lebenszyklus gegen einen Wegwerf-Branch aus: Branch erstellen, bereitstellen, abbauen, Branch löschen.",
         "start": "Umgebungserstellung testen",
         "stop": "Stopp",
-        "infraless": "Konfiguriere oben einen Bereitstellungstyp, um die Umgebungserstellung zu testen.",
+        "infraless": "Konfigurieren Sie oben einen Bereitstellungstyp, um einen der beiden Selbsttests auszuführen.",
         "running": "Wird getestet: {stage}",
         "succeeded": "Test bestanden: Die Umgebung wurde erstellt und abgebaut, und der Branch wurde gelöscht.",
         "failed": "Test fehlgeschlagen",
         "stage": {
           "creating_branch": "Branch wird erstellt",
           "provisioning": "Umgebung wird bereitgestellt",
+          "probing": "Prüfung durch einen Agenten",
           "tearing_down": "Umgebung wird abgebaut",
           "deleting_branch": "Branch wird gelöscht",
           "done": "fertig"
         }
+      },
+      "envProbe": {
+        "title": "Agenten-Probelauf testen",
+        "hint": "Stellt eine Wegwerf-Umgebung bereit, lässt einen Agenten darin einige echte Operationen versuchen und baut anschließend alles ab. Berichtet, was versucht wurde und was der Agent nicht herausfinden konnte.",
+        "surfaceApi": "Dieser Dienst wird über HTTP angesprochen.",
+        "surfaceUi": "Dieses Frontend wird im Browser bedient.",
+        "start": "Agenten-Probelauf testen",
+        "completed": "Probelauf abgeschlossen: Die Umgebung wurde abgebaut und der Branch gelöscht.",
+        "failed": "Probelauf fehlgeschlagen",
+        "verdict": {
+          "operable": "Ein Agent kann diesen Dienst bedienen.",
+          "partially_operable": "Ein Agent kann diesen Dienst nur teilweise bedienen.",
+          "inoperable": "Ein Agent konnte diesen Dienst nicht bedienen."
+        },
+        "counts": "{succeeded} von {attempted} Operationen erfolgreich; {authenticated} davon mit Authentifizierung.",
+        "missingContext": "Was dem Agenten nicht mitgeteilt wurde",
+        "blockers": "Was den Probelauf gestoppt hat",
+        "operations": "Versuchte Operationen",
+        "operationsOmitted": "Gemeldete Operationen, die durch das Limit entfallen sind: {count}.",
+        "operationsUnreadable": "Gemeldete Operationen, die die Plattform nicht lesen konnte: {count}.",
+        "progress": "({completed} von {total} Schritten erledigt)",
+        "authenticated": "(authentifiziert)",
+        "model": "Modell: {model}",
+        "failure": {
+          "auth_missing": "Keine Zugangsdaten übergeben",
+          "auth_rejected": "Zugangsdaten abgelehnt",
+          "access_unclear": "Authentifizierungsweg unklar",
+          "endpoint_unknown": "Aufrufziel nicht auffindbar",
+          "unreachable": "Umgebung nicht erreichbar",
+          "timeout": "Zeitüberschreitung",
+          "server_error": "Fehler im Dienst",
+          "bad_request": "Anfrage als fehlerhaft abgelehnt",
+          "tooling_missing": "Kein Client oder Browser verfügbar",
+          "other": "Sonstiges"
+        }
       }
     },
     "agentConfig": {
@@ -6163,6 +6199,10 @@
         "env_test_not_provisionable": "Umgebungs-Handler nicht konfiguriert",
         "env_test_no_vcs": "Git-Anbieter nicht verbunden",
         "env_test_connection_failed": "Umgebungsverbindung fehlgeschlagen",
+        "env_test_probe_unavailable": "Agenten-Probeläufe hier nicht verfügbar",
+        "env_test_probe_model_unavailable": "Modell für den Probelauf nicht ausführbar",
+        "env_test_already_running": "Selbsttest läuft bereits",
+        "env_test_over_budget": "Ausgabenbudget erreicht",
         "prompt_revision_conflict": "Prompt von jemand anderem geändert",
         "pipeline_schedule_attached": "Wiederkehrender Zeitplan nutzt diese Pipeline",
         "pipeline_schedule_requires_recurring": "Wiederkehrender Zeitplan braucht diese Pipeline",
@@ -6212,6 +6252,10 @@
         "env_test_no_vcs": "Der Selbsttest benötigt einen Git-Anbieter, um seinen Wegwerf-Branch zu erstellen und zu löschen, aber dieser Workspace ist mit keinem verbunden.",
         "env_test_connection_failed": "Der Umgebungs-Handler dieses Dienstes hat seinen Verbindungstest nicht bestanden. Prüfen Sie Endpunkt, Anmeldedaten und Projekteinstellungen und testen Sie die Verbindung erneut.",
         "env_test_connection_failed_detail": "Der Umgebungs-Handler dieses Dienstes hat seinen Verbindungstest nicht bestanden: {detail}. Prüfen Sie Endpunkt, Anmeldedaten und Projekteinstellungen und testen Sie die Verbindung erneut.",
+        "env_test_probe_unavailable": "Ein Agenten-Probelauf benötigt einen Container-Runner und ein verbundenes Repository. Hier fehlt eines davon, daher lässt sich nur der Bereitstellungs-Selbsttest ausführen.",
+        "env_test_probe_model_unavailable": "Der Probelauf dieses Dienstes verweist auf ein Modell, das diese Installation nicht ausführen kann: entweder kann der LLM-Proxy dessen Anbieter nicht bedienen, oder es braucht ein Abonnement, das niemand verbunden hat. Ändern Sie das Modell-Preset für den Prüfagenten (oder das am Rahmen fixierte Modell), oder verbinden Sie das Abonnement. Der Bereitstellungs-Selbsttest braucht kein Modell und läuft weiterhin.",
+        "env_test_already_running": "Für diesen Dienst läuft bereits ein Selbsttest. Jeder stellt seine eigene Wegwerf-Umgebung bereit, daher läuft immer nur einer. Warten Sie, bis er fertig ist, oder stoppen Sie ihn zuerst.",
+        "env_test_over_budget": "Ein Agenten-Probelauf ist ein kostenpflichtiger Modellaufruf, und dieser Workspace hat sein Ausgabenbudget erreicht. Erhöhen Sie das Budget oder warten Sie auf den nächsten Abrechnungszeitraum. Der Bereitstellungs-Selbsttest kostet nichts und läuft weiterhin.",
         "prompt_revision_conflict": "Eine andere Änderung an diesem Prompt war zuerst da. Laden Sie ihn neu und wenden Sie Ihre Änderung darauf erneut an.",
         "pipeline_schedule_attached": "Ein wiederkehrender Zeitplan verweist noch auf diese Pipeline, und jeder von ihm gestartete Lauf löst die Pipeline über ihre ID auf. Lösen oder löschen Sie zuerst diesen Zeitplan und entfernen Sie danach die Pipeline.",
         "pipeline_schedule_requires_recurring": "Ein wiederkehrender Zeitplan verweist noch auf diese Pipeline. Sie nur einmalig zu machen würde jeden künftigen Lauf unterbrechen. Lösen Sie zuerst diesen Zeitplan.",