@cat-factory/app 0.310.3 → 0.311.0

package/README.md

@@ -611,6 +611,14 @@ The seams, and what a new feature should use rather than reading the store ad ho
 - **A surface that narrows inline** reads `useUiRoleStore().fullSurface` (the frame header's bug-hunt
   button, the palette's per-connection integration commands). Same rule as the tier: what remains
   must be exactly what the full surface would have shown, only less of it.
+- **A setup prompt** (a "configure this" card over the board) goes through `canActOnSetup`
+  (`app/utils/setupAudience.ts`) with the caller from `useSetupActor()`: it combines the role's
+  surface with the board and account grants and the owner the server reports for the gap
+  (`infraSetupOwners`). A caller who cannot act gets no card. If the gap stops runs they could start,
+  it reaches them as one line saying how it gets fixed (`blockingSetupNotice`): the owner to ask, or
+  the role switch when they hold the grant and only the designer surface hides the card. A viewer
+  gets nothing, and the line honours the card's dismissals. Never a button that opens a screen the
+  caller's save is refused on.
 - **A tutorial tour whose step clicks a non-`intake` nav entry declares
   `TUTORIAL_REQUIREMENTS.fullSurface`.** Which tours those are is not a judgement call:
   `tutorial-tours.spec.ts` derives the pairing from `navItemVisible`, so a tour that gains such a

package/app/components/github/GitHubOnboarding.vue

@@ -3,8 +3,11 @@
 // has no connection yet. cat-factory's whole flow runs on a connected repository host (agents
 // open pull/merge requests on the user's repos), so the board is withheld until the workspace
 // connects one. <VcsConnectSurfaces> renders whichever connect methods the deployment serves; a
-// "Sign out" escape hatch avoids trapping a user who needs to switch accounts.
+// "Sign out" escape hatch avoids trapping a user who needs to switch accounts. The board switcher is
+// the other escape: the gate replaces the whole board, sidebar included, so without it a member
+// who landed on a board they cannot connect had no way to reach a board they can.
 import VcsConnectSurfaces from '~/components/vcs/VcsConnectSurfaces.vue'
+import BoardSwitcher from '~/components/layout/BoardSwitcher.vue'
 import { VCS_PROVIDER_ICONS, VCS_PROVIDER_LABELS } from '~/utils/vcs'
 
 const { t } = useI18n()
@@ -39,6 +42,11 @@ const title = computed(() =>
 
       <VcsConnectSurfaces :app-intro="t('github.onboarding.appIntro')" />
 
+      <div class="mt-6 border-t border-default pt-4" data-testid="vcs-onboarding-switch-board">
+        <p class="mb-2 text-xs text-muted">{{ t('vcs.onboarding.switchBoard') }}</p>
+        <BoardSwitcher standalone />
+      </div>
+
       <p
         v-if="auth.required && auth.user"
         class="mt-6 border-t border-default pt-4 text-center text-xs text-dimmed"

package/app/components/layout/AccountTeamSettings.vue

@@ -53,7 +53,7 @@ function invitationStatusLabel(status: InvitationStatus): string {
 }
 
 /** Whether the signed-in caller is an admin of this account (drives edit affordances). */
-const isAdmin = computed(() => accounts.activeAccount?.roles?.includes('admin') ?? false)
+const isAdmin = computed(() => accounts.isActiveAccountAdmin)
 /**
  * Members / roles / invitations are org-scoped — the backend rejects membership on a
  * personal account. For a personal account we show a "create an organization" CTA in

package/app/components/layout/BoardSwitcher.vue

@@ -12,7 +12,16 @@ import SectionLabel from '~/components/common/SectionLabel.vue'
 // account row folds away — it is a label with a menu duplicated inside the board menu's
 // reach — and the board button keeps only its glyph. Both dropdowns are unchanged, so
 // switching boards never requires expanding the sidebar first.
-withDefaults(defineProps<{ collapsed?: boolean }>(), { collapsed: false })
+//
+// `standalone` is for a host OUTSIDE the board page (the repository-host gate), where the
+// page-level dialogs are not mounted. The items that open one are left out there: "Account
+// settings" opens `AccountSettingsPanel` and "Delete board" awaits `ConfirmDialog`, so on the gate
+// both would do nothing and then fire once a board page mounted, the delete against the board that
+// was active when it was asked.
+const props = withDefaults(defineProps<{ collapsed?: boolean; standalone?: boolean }>(), {
+  collapsed: false,
+  standalone: false,
+})
 
 const { t } = useI18n()
 
@@ -65,14 +74,19 @@ const accountItems = computed<DropdownMenuItem[][]>(() => [
     },
     // Account settings: the unified per-account panel (team + roles + invitations + email
     // sender + account-tier fragment library). The panel itself handles personal accounts
-    // (prompting to create an org for the team tab), so this is not gated.
-    {
-      label: t('layout.boardSwitcher.account.settings'),
-      icon: 'i-lucide-settings',
-      onSelect: () => ui.openAccountSettings(),
-    },
+    // (prompting to create an org for the team tab), so this is not gated by role; it is left out
+    // only where the panel is not mounted (`standalone`).
+    ...(props.standalone
+      ? []
+      : [
+          {
+            label: t('layout.boardSwitcher.account.settings'),
+            icon: 'i-lucide-settings',
+            onSelect: () => ui.openAccountSettings(),
+          },
+        ]),
     // Admins can set the account-wide default provider new services inherit.
-    ...(accounts.activeAccount?.roles?.includes('admin')
+    ...(accounts.isActiveAccountAdmin
       ? [
           {
             label: t('layout.boardSwitcher.account.defaultProvider'),
@@ -122,12 +136,17 @@ const boardItems = computed<DropdownMenuItem[][]>(() => [
             icon: 'i-lucide-pencil',
             onSelect: () => openPrompt('rename'),
           },
-          {
-            label: t('layout.boardSwitcher.board.delete'),
-            icon: 'i-lucide-trash-2',
-            color: 'error' as const,
-            onSelect: () => void removeBoard(),
-          },
+          // Delete confirms through the page's `ConfirmDialog`, absent in `standalone`.
+          ...(props.standalone
+            ? []
+            : [
+                {
+                  label: t('layout.boardSwitcher.board.delete'),
+                  icon: 'i-lucide-trash-2',
+                  color: 'error' as const,
+                  onSelect: () => void removeBoard(),
+                },
+              ]),
         ]
       : []),
   ],

package/app/components/layout/DefaultTestEnvBanner.vue

@@ -22,14 +22,17 @@ const ui = useUiStore()
 const workspace = useWorkspaceStore()
 const settingsStore = useWorkspaceSettingsStore()
 const { canManageSettings } = useWorkspaceAccess()
+const uiRole = useUiRoleStore()
 
 // Only prompt someone who can actually answer. A member/viewer cannot write workspace settings
 // (the endpoint is `settings.manage`-gated), so for them this would be an un-actionable nag
-// pointing at a screen that would refuse their save.
+// pointing at a screen that would refuse their save. The designer surface never configures the
+// platform, so it is kept off there too, whatever the grant.
 const show = computed(
   () =>
     workspace.ready &&
     canManageSettings.value &&
+    uiRole.fullSurface &&
     needsDefaultProvisioningChoice(settingsStore.settings) &&
     !ui.defaultProvisionDismissed,
 )

package/app/components/layout/InfraSetupBanner.vue

@@ -6,6 +6,11 @@
 // runtime whose account picked no backend — incl. Cloudflare without an ARTIFACT_BUCKET binding;
 // ephemeral test environments on any runtime that wires the integration).
 //
+// Audience: a card renders only for a caller who can act on its area, per the server-reported
+// owner (`infraSetupOwners`) and `canActOnSetup`. A caller who cannot (a member, a viewer, the
+// designer surface, or anyone when the operator owns the gap) sees one compact line instead, and
+// only for a gap that stops every run (`InfraSetupNotice`).
+//
 // Positioning/stacking against the sibling advisory banners (AI-readiness, provider-config) is
 // owned by the shared, click-through banner column in `pages/index.vue` — so concurrent prompts
 // stack vertically instead of drawing on top of each other. This component only stacks its OWN
@@ -52,11 +57,14 @@ import {
 import type { DropdownMenuItem } from '@nuxt/ui'
 import type { InfraSetupArea, InfraSetupStatus } from '~/types/domain'
 import { infraSetupDismissalKey, type InfraSetupCardKind } from '~/utils/infraSetup'
+import { blockingSetupNotice, canActOnSetup } from '~/utils/setupAudience'
+import InfraSetupNotice from '~/components/layout/InfraSetupNotice.vue'
 
 const { t } = useI18n()
 const ui = useUiStore()
 const auth = useAuthStore()
 const workspace = useWorkspaceStore()
+const { actor } = useSetupActor()
 
 // Severity order: no executor blocks EVERY agent, so it leads; a missing test environment blocks
 // only testing agents; missing storage only degrades the UI-tester's screenshots.
@@ -140,6 +148,9 @@ const visible = computed<AreaCard[]>(() => {
   return AREAS.filter((area) => {
     const kind = cardKind(status[area])
     if (!kind) return false
+    // A card is for the people who can act on it. Everyone else hears about a gap only when it
+    // stops their own work, through the one line below (`blockingSetupNotice`).
+    if (!canActOnSetup(workspace.infraSetupOwners?.[area], actor.value)) return false
     // Both dismissals are keyed by the CLAIM, not by the area: silencing "you haven't configured
     // this" must not also silence "you configured it and it is now down". The permanent dismissal
     // only ever covers a setup gap (`dismissPermanently` is offered nowhere else).
@@ -152,6 +163,18 @@ const visible = computed<AreaCard[]>(() => {
   }))
 })
 
+// The one line for a caller who cannot act on a gap that stops every run. It honours BOTH
+// dismissals of the card it stands in for, keyed by the same claim: someone who said "don't
+// notify me again" on the card (before their role changed, say) is not nagged again by the line.
+const notice = computed(() => {
+  const found = blockingSetupNotice(workspace.infraSetup, workspace.infraSetupOwners, actor.value)
+  if (!found) return null
+  if (ui.infraSetupSessionDismissed.includes(infraSetupDismissalKey(found.area, found.kind))) {
+    return null
+  }
+  return found.kind === 'setup' && dismissedForUser.value.includes(found.area) ? null : found
+})
+
 /** Which card an area's status raises, or null when it raises none (`configured`/`not_applicable`). */
 function cardKind(status: InfraSetupStatus): InfraSetupCardKind | null {
   if (isInfraSetupHealthStatus(status)) return 'outage'
@@ -169,7 +192,7 @@ function titleKey(card: AreaCard): string {
  * The dismiss dropdown: the product wants the user asked WHICH kind of dismissal on close. An
  * outage offers the session option ONLY — see the fork note at the top of this file.
  */
-function dismissMenu(card: AreaCard): DropdownMenuItem[][] {
+function dismissMenu(card: Pick<AreaCard, 'area' | 'kind'>): DropdownMenuItem[][] {
   const session = {
     label: t('layout.infraSetupBanner.dismiss.session'),
     icon: 'i-lucide-clock',
@@ -195,11 +218,12 @@ function dismissMenu(card: AreaCard): DropdownMenuItem[][] {
          than an assertive `role="alert"` per card — an advisory setup nag shouldn't interrupt a
          screen reader, and up to three stacked alerts would spam it. -->
     <div
-      v-if="visible.length > 0"
+      v-if="visible.length > 0 || notice"
       class="flex w-full flex-col items-center gap-2"
       role="status"
       aria-live="polite"
     >
+      <InfraSetupNotice v-if="notice" :notice="notice" :dismiss-menu="dismissMenu(notice)" />
       <!-- An OUTAGE reads red, a setup gap amber: one is something breaking now, the other is
            something never switched on, and a reader has to be able to tell at a glance. -->
       <div

package/app/components/layout/InfraSetupNotice.vue

@@ -0,0 +1,69 @@
+<script setup lang="ts">
+// The one line a caller sees for a setup gap they cannot fix from where they are, when it stops
+// their runs. It replaces the full card (and its "Configure" button that would open a screen their
+// save is refused on) with two facts: what does not work, and how it gets fixed. Compact on
+// purpose: the caller has nothing to do here, so it must not cover the board the way an actionable
+// card may.
+import type { DropdownMenuItem } from '@nuxt/ui'
+import type { BlockingInfraArea, SetupNotice, SetupRemedy } from '~/utils/setupAudience'
+
+defineProps<{
+  notice: SetupNotice
+  /** The card's own session / permanent choice, built by the banner so both close the same claim. */
+  dismissMenu: DropdownMenuItem[][]
+}>()
+
+const { t } = useI18n()
+
+// Exhaustive over the blocking areas and the remedies, so a new member of either fails typecheck
+// here rather than rendering a raw key.
+const STATE_KEYS: Record<BlockingInfraArea, Record<SetupNotice['kind'], string>> = {
+  agentExecutor: {
+    setup: 'layout.infraSetupNotice.agentExecutor.setup',
+    outage: 'layout.infraSetupNotice.agentExecutor.outage',
+  },
+}
+const REMEDY_KEYS: Record<SetupRemedy, string> = {
+  workspace_admin: 'layout.infraSetupNotice.owner.workspace_admin',
+  account_admin: 'layout.infraSetupNotice.owner.account_admin',
+  operator: 'layout.infraSetupNotice.owner.operator',
+  full_surface: 'layout.infraSetupNotice.fullSurface',
+}
+</script>
+
+<template>
+  <div
+    class="pointer-events-auto flex w-full max-w-3xl items-center gap-3 rounded-xl border px-4 py-2 shadow-lg backdrop-blur"
+    :class="
+      notice.kind === 'outage'
+        ? 'border-app-error-500/50 bg-app-error-950/90'
+        : 'border-app-warning-500/50 bg-app-warning-950/90'
+    "
+    :data-testid="`infra-setup-notice-${notice.area}`"
+    :data-infra-remedy="notice.remedy"
+  >
+    <UIcon
+      :name="notice.kind === 'outage' ? 'i-lucide-plug-zap' : 'i-lucide-server-off'"
+      class="h-5 w-5 shrink-0"
+      :class="notice.kind === 'outage' ? 'text-app-error-400' : 'text-app-warning-400'"
+    />
+    <p
+      class="min-w-0 flex-1 text-sm"
+      :class="notice.kind === 'outage' ? 'text-app-error-100' : 'text-app-warning-100'"
+    >
+      {{ t(STATE_KEYS[notice.area][notice.kind]) }}
+      <span class="opacity-80">{{ t(REMEDY_KEYS[notice.remedy]) }}</span>
+    </p>
+    <UDropdownMenu :items="dismissMenu" :content="{ align: 'end' }">
+      <UButton
+        color="neutral"
+        variant="ghost"
+        size="xs"
+        icon="i-lucide-x"
+        class="shrink-0"
+        :aria-label="t('common.close')"
+        :data-testid="`infra-setup-notice-dismiss-${notice.area}`"
+      />
+    </UDropdownMenu>
+  </div>
+</template>

package/app/components/layout/ProviderConfigBanner.vue

@@ -6,11 +6,13 @@
 // link into its connect panel. Dismissible per session.
 import { computed, ref, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
+import { canActOnSetup } from '~/utils/setupAudience'
 
 const { t } = useI18n()
 const ui = useUiStore()
 const workspace = useWorkspaceStore()
 const store = useProviderConnectionsStore()
+const { actor } = useSetupActor()
 
 // Exhaustive per-kind title/action keys (leaf names mirror the kind verbatim).
 const TITLE_KEYS: Record<ProviderConnectionKind, string> = {
@@ -33,7 +35,12 @@ watch(
 
 const dismissed = ref(false)
 const pending = computed(() => store.needingConfig as ProviderConnectionKind[])
-const show = computed(() => pending.value.length > 0 && !dismissed.value)
+// Only for the people whose save would land: the connection fields are a workspace-admin write,
+// and a member or a designer could only open the panel and be refused.
+const show = computed(
+  () =>
+    pending.value.length > 0 && !dismissed.value && canActOnSetup('workspace_admin', actor.value),
+)
 </script>
 
 <template>

package/app/components/providers/AiProviderOnboardingModal.vue

@@ -9,6 +9,7 @@ import { computed } from 'vue'
 
 const { t } = useI18n()
 const ui = useUiStore()
+const { canManageSecrets } = useWorkspaceAccess()
 
 const open = computed({
   get: () => ui.aiProviderSetupOpen,
@@ -49,7 +50,12 @@ const routes = computed<Route[]>(() => [
     title: t('providers.onboarding.routes.keys.title'),
     body: t('providers.onboarding.routes.keys.body'),
     cta: t('providers.onboarding.routes.keys.cta'),
-    onSelect: () => go(ui.openVendorCredentials),
+    // The default tab is the workspace's pooled subscriptions, a `secrets.manage` write. Anyone else
+    // lands on the direct keys, which open on their own "My keys" scope (see ApiKeysSection).
+    onSelect: () =>
+      go(() =>
+        canManageSecrets.value ? ui.openVendorCredentials() : ui.openVendorCredentials('direct'),
+      ),
   },
   {
     icon: 'i-lucide-route',

package/app/components/providers/ApiKeysSection.vue

@@ -37,8 +37,27 @@ const { confirmAction, toastDone } = useConfirmAction()
 /** Account-wide mode (single account scope) vs the default workspace/user toggle. */
 const isAccount = computed(() => !!props.accountId)
 
-/** Which store the form writes to: the shared workspace keys or the user's own. */
-const scope = ref<'workspace' | 'user'>('workspace')
+/**
+ * Which store the form writes to: the shared workspace keys or the user's own. The DEFAULT follows
+ * the caller's grant on the active board: the workspace for whoever may write it (`secrets.manage`)
+ * and "My keys" for everyone else, so a first save lands instead of being refused. It is derived,
+ * not captured once, because this section stays mounted while the board (and so the grant)
+ * changes. A scope the user picks by hand wins until they move to another board.
+ */
+const { canManageSecrets } = useWorkspaceAccess()
+const pickedScope = ref<'workspace' | 'user' | null>(null)
+const scope = computed<'workspace' | 'user'>({
+  get: () => pickedScope.value ?? (canManageSecrets.value ? 'workspace' : 'user'),
+  set: (value) => {
+    pickedScope.value = value
+  },
+})
+watch(
+  () => workspace.workspaceId,
+  () => {
+    pickedScope.value = null
+  },
+)
 
 // "My keys" (user scope) are stored per-user, so they need a signed-in user. Block just
 // that scope when there's none (a deployment without sign-in); workspace/account keys are

package/app/components/vcs/VcsConnectSurfaces.vue

@@ -27,6 +27,12 @@ const props = defineProps<{
 
 const { t } = useI18n()
 const github = useGitHubStore()
+const { canManageIntegrations } = useWorkspaceAccess()
+
+// Connecting is an `integrations.manage` write, and the connect-options read is gated the same way,
+// so for anyone else the options come back empty. That empty list says nothing about the
+// deployment: name the board admin instead of telling a member the operator configured nothing.
+const adminRequired = computed(() => !canManageIntegrations.value)
 
 // Whether the deployment serves neither surface. Rendered as a statement rather than an empty
 // box: "nothing is configured" and "we couldn't read what is configured" both land here, and a
@@ -36,23 +42,33 @@ const nothingConfigured = computed(() => !github.canConnectGitHubApp && !github.
 
 <template>
   <div class="space-y-3">
-    <template v-if="github.canConnectGitHubApp">
-      <p v-if="props.appIntro" class="text-sm text-muted">{{ props.appIntro }}</p>
-      <GitHubConnect />
-    </template>
-
-    <USeparator
-      v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
-      :label="t('vcs.connect.or')"
-    />
-
-    <GitLabConnect v-if="github.canConnectGitLabPat" />
-
     <p
-      v-if="nothingConfigured"
+      v-if="adminRequired"
       class="rounded-md border border-dashed border-default px-3 py-3 text-sm text-muted"
+      data-testid="vcs-connect-admin-required"
     >
-      {{ t('vcs.connect.noneConfigured') }}
+      {{ t('vcs.connect.adminRequired') }}
     </p>
+
+    <template v-else>
+      <template v-if="github.canConnectGitHubApp">
+        <p v-if="props.appIntro" class="text-sm text-muted">{{ props.appIntro }}</p>
+        <GitHubConnect />
+      </template>
+
+      <USeparator
+        v-if="github.canConnectGitHubApp && github.canConnectGitLabPat"
+        :label="t('vcs.connect.or')"
+      />
+
+      <GitLabConnect v-if="github.canConnectGitLabPat" />
+
+      <p
+        v-if="nothingConfigured"
+        class="rounded-md border border-dashed border-default px-3 py-3 text-sm text-muted"
+      >
+        {{ t('vcs.connect.noneConfigured') }}
+      </p>
+    </template>
   </div>
 </template>

package/app/composables/useSetupActor.ts

@@ -0,0 +1,25 @@
+import { computed } from 'vue'
+import type { SetupActor } from '~/utils/setupAudience'
+
+/**
+ * The caller as a setup prompt sees them: which app surface they chose, and the board and account
+ * grants that decide whether a "configure this" button would let them save. Every input is read
+ * from the source the nav gates read too (the role store, `useWorkspaceAccess`, and the accounts
+ * store's `isActiveAccountAdmin`), so a setup prompt and the sidebar cannot disagree about who the
+ * caller is.
+ */
+export function useSetupActor() {
+  const access = useWorkspaceAccess()
+  const uiRole = useUiRoleStore()
+  const accounts = useAccountsStore()
+
+  const actor = computed<SetupActor>(() => ({
+    fullSurface: uiRole.fullSurface,
+    canManageIntegrations: access.canManageIntegrations.value,
+    canExecuteRuns: access.canExecuteRuns.value,
+    isAccountAdmin: accounts.isActiveAccountAdmin,
+    accountsEnabled: accounts.enabled,
+  }))
+
+  return { actor }
+}

package/app/composables/useWorkspaceAccess.ts

@@ -16,7 +16,7 @@ import type { WorkspacePermission, WorkspaceRole } from '~/types/domain'
  * SPA never hides an affordance the backend would have permitted.
  *
  * This is deliberately distinct from the ACCOUNT-scoped admin checks
- * (`accounts.activeAccount?.roles?.includes('admin')`), which stay account-scoped: this
+ * (`accounts.isActiveAccountAdmin`), which stay account-scoped: this
  * composable answers "what can you do inside THIS board", the account check answers "what
  * can you do to the tenant".
  */

package/app/modular/nav-gates.ts

@@ -75,7 +75,6 @@ export function createNavGates(): NavGates {
       providerConnections.isAvailable('runner-pool') ||
       providerConnections.isAvailable('environment'),
   )
-  const isAccountAdmin = computed(() => accounts.activeAccount?.roles?.includes('admin') ?? false)
 
   return {
     get canWriteBoard() {
@@ -105,7 +104,7 @@ export function createNavGates(): NavGates {
       return accounts.enabled
     },
     get isAccountAdmin() {
-      return isAccountAdmin.value
+      return accounts.isActiveAccountAdmin
     },
     get advancedMode() {
       return uiMode.isAdvanced

package/app/stores/accounts.ts

@@ -35,6 +35,13 @@ export const useAccountsStore = defineStore(
     )
     /** Whether accounts exist (auth on); gates the switcher UI. */
     const enabled = computed(() => accounts.value.length > 0)
+    /**
+     * Whether the caller is an admin of the ACTIVE account. The one reading of it, so the nav gates,
+     * the setup prompts and the account panels cannot disagree about who the account admin is.
+     */
+    const isActiveAccountAdmin = computed(
+      () => activeAccount.value?.roles?.includes('admin') ?? false,
+    )
 
     /** Load the user's accounts and resolve the active one (persisted or first). */
     async function load() {
@@ -209,6 +216,7 @@ export const useAccountsStore = defineStore(
       activeAccountId,
       activeAccount,
       enabled,
+      isActiveAccountAdmin,
       ready,
       members,
       invitations,

package/app/stores/workspace/infraSetup.ts

@@ -1,6 +1,6 @@
 import { ref } from 'vue'
 import { applyInfraSetupTransition, isInfraSetupHealthStatus } from '@cat-factory/contracts'
-import type { InfraSetup, InfraSetupArea, InfraSetupStatus } from '~/types/domain'
+import type { InfraSetup, InfraSetupArea, InfraSetupOwners, InfraSetupStatus } from '~/types/domain'
 
 // The workspace store's infra-setup slice: the per-area setup/health projection the setup banner
 // renders, and the live `infraSetup` event patch the reachability watcher pushes into it. Its own
@@ -32,8 +32,16 @@ export function createInfraSetupState() {
    */
   const infraSetupDetails = ref<Partial<Record<InfraSetupArea, string>>>({})
 
-  function hydrate(next: InfraSetup | null | undefined) {
+  /**
+   * Who can close each area's gap (workspace admin, account admin or the operator), from the
+   * snapshot. Static for the life of a deployment, so the live event never touches it. Null on an
+   * older backend, which the banner reads as "owner unknown".
+   */
+  const infraSetupOwners = ref<InfraSetupOwners | null>(null)
+
+  function hydrate(next: InfraSetup | null | undefined, owners?: InfraSetupOwners | null) {
     infraSetup.value = next ?? null
+    infraSetupOwners.value = owners ?? null
     // The reasons belong to the live pushes this session observed, so an authoritative snapshot
     // supersedes them: keeping one would caption a freshly-read status with a stale probe.
     infraSetupDetails.value = {}
@@ -73,5 +81,5 @@ export function createInfraSetupState() {
     if (!isInfraSetupHealthStatus(status)) useUiStore().clearInfraSetupSessionDismissal(area)
   }
 
-  return { infraSetup, infraSetupDetails, hydrate, patchInfraSetup }
+  return { infraSetup, infraSetupDetails, infraSetupOwners, hydrate, patchInfraSetup }
 }

package/app/stores/workspace.ts

@@ -59,6 +59,7 @@ export const useWorkspaceStore = defineStore(
     const {
       infraSetup,
       infraSetupDetails,
+      infraSetupOwners,
       hydrate: hydrateInfraSetup,
       patchInfraSetup,
     } = createInfraSetupState()
@@ -98,7 +99,7 @@ export const useWorkspaceStore = defineStore(
       accountSpend.value = snapshot.accountSpend ?? null
       userSpend.value = snapshot.userSpend ?? null
       budgetCaps.value = snapshot.budgetCaps ?? null
-      hydrateInfraSetup(snapshot.infraSetup)
+      hydrateInfraSetup(snapshot.infraSetup, snapshot.infraSetupOwners)
       access.value = snapshot.access ?? null
       // Keep the board list in step (e.g. a freshly created board, or a rename). The
       // snapshot's `workspace` carries no `viewerRole` (that's a `GET /workspaces` list
@@ -241,6 +242,7 @@ export const useWorkspaceStore = defineStore(
       budgetCaps,
       infraSetup,
       infraSetupDetails,
+      infraSetupOwners,
       patchInfraSetup,
       access,
       init,

package/app/types/domain.ts

@@ -108,6 +108,8 @@ export type {
   InfraSetup,
   InfraSetupStatus,
   InfraSetupArea,
+  InfraSetupOwner,
+  InfraSetupOwners,
   ServiceFragmentDefaults,
   KaizenGradingStatus,
   KaizenGrading,

package/app/utils/setupAudience.spec.ts

@@ -0,0 +1,115 @@
+import { describe, expect, it } from 'vitest'
+import type { InfraSetup, InfraSetupOwners } from '~/types/domain'
+import { blockingSetupNotice, canActOnSetup, type SetupActor } from './setupAudience'
+
+const admin: SetupActor = {
+  fullSurface: true,
+  canManageIntegrations: true,
+  canExecuteRuns: true,
+  isAccountAdmin: false,
+  accountsEnabled: true,
+}
+const member: SetupActor = { ...admin, canManageIntegrations: false }
+const viewer: SetupActor = { ...member, canExecuteRuns: false }
+const designerAdmin: SetupActor = { ...admin, fullSurface: false }
+const designerMember: SetupActor = { ...member, fullSurface: false }
+
+const owners: InfraSetupOwners = {
+  agentExecutor: 'workspace_admin',
+  ephemeralEnvironments: 'workspace_admin',
+  binaryStorage: 'account_admin',
+}
+
+function status(patch: Partial<InfraSetup>): InfraSetup {
+  return {
+    agentExecutor: 'configured',
+    ephemeralEnvironments: 'configured',
+    binaryStorage: 'configured',
+    ...patch,
+  }
+}
+
+const noRunner = status({ agentExecutor: 'not_defined' })
+
+describe('canActOnSetup', () => {
+  it('lets a workspace admin act on the workspace areas, and not a member', () => {
+    expect(canActOnSetup('workspace_admin', admin)).toBe(true)
+    expect(canActOnSetup('workspace_admin', member)).toBe(false)
+  })
+
+  it('keeps every prompt off the designer surface, whatever the permissions', () => {
+    expect(canActOnSetup('workspace_admin', designerAdmin)).toBe(false)
+    expect(canActOnSetup('account_admin', { ...designerAdmin, isAccountAdmin: true })).toBe(false)
+  })
+
+  it('gives an account-owned gap to the account admin, not to a workspace admin', () => {
+    expect(canActOnSetup('account_admin', admin)).toBe(false)
+    expect(canActOnSetup('account_admin', { ...member, isAccountAdmin: true })).toBe(true)
+  })
+
+  it('lets the single user act on an account-owned gap when there are no accounts', () => {
+    expect(canActOnSetup('account_admin', { ...admin, accountsEnabled: false })).toBe(true)
+  })
+
+  it('lets nobody act on an operator-owned gap', () => {
+    expect(canActOnSetup('operator', { ...admin, isAccountAdmin: true })).toBe(false)
+  })
+
+  it('falls back to the workspace admin for an absent owner or one this build does not know', () => {
+    // An older backend sends nothing; a newer one may send a value past the compiled union. Both
+    // read as the workspace admin, and neither throws inside the banner's render.
+    for (const owner of [undefined, 'board_owner']) {
+      expect(canActOnSetup(owner, admin)).toBe(true)
+      expect(canActOnSetup(owner, member)).toBe(false)
+    }
+  })
+})
+
+describe('blockingSetupNotice', () => {
+  it('tells a member that agents cannot run, and who can fix it', () => {
+    expect(blockingSetupNotice(noRunner, owners, member)).toEqual({
+      area: 'agentExecutor',
+      kind: 'setup',
+      remedy: 'workspace_admin',
+    })
+  })
+
+  it('reports an executor outage as an outage', () => {
+    expect(
+      blockingSetupNotice(status({ agentExecutor: 'unreachable' }), owners, member)?.kind,
+    ).toBe('outage')
+  })
+
+  it('says nothing to the admin, who gets the full card instead', () => {
+    expect(blockingSetupNotice(noRunner, owners, admin)).toBeNull()
+  })
+
+  it('says nothing to a viewer, whose work the gap does not stop', () => {
+    expect(blockingSetupNotice(noRunner, owners, viewer)).toBeNull()
+  })
+
+  it('tells an admin on the designer surface to switch surface, not to find an admin', () => {
+    expect(blockingSetupNotice(noRunner, owners, designerAdmin)?.remedy).toBe('full_surface')
+    // A designer without the grant is still pointed at the owner.
+    expect(blockingSetupNotice(noRunner, owners, designerMember)?.remedy).toBe('workspace_admin')
+  })
+
+  it('says nothing about gaps that only degrade some runs', () => {
+    const optional = status({ ephemeralEnvironments: 'not_defined', binaryStorage: 'not_defined' })
+    expect(blockingSetupNotice(optional, owners, member)).toBeNull()
+  })
+
+  it('says nothing when the executor is configured or not used here', () => {
+    expect(blockingSetupNotice(status({}), owners, member)).toBeNull()
+    expect(
+      blockingSetupNotice(status({ agentExecutor: 'not_applicable' }), owners, member),
+    ).toBeNull()
+    expect(blockingSetupNotice(null, owners, member)).toBeNull()
+  })
+
+  it('names the workspace admin when the backend reports no owner, or one it does not know', () => {
+    expect(blockingSetupNotice(noRunner, null, member)?.remedy).toBe('workspace_admin')
+    const unknown = { ...owners, agentExecutor: 'board_owner' } as unknown as InfraSetupOwners
+    expect(blockingSetupNotice(noRunner, unknown, member)?.remedy).toBe('workspace_admin')
+  })
+})

package/app/utils/setupAudience.ts

@@ -0,0 +1,102 @@
+import { isInfraSetupHealthStatus, isInfraSetupOwner } from '@cat-factory/contracts'
+import type { InfraSetup, InfraSetupArea, InfraSetupOwner, InfraSetupOwners } from '~/types/domain'
+
+// Who a setup prompt is FOR. The infra-setup cards used to render for every caller, so a member,
+// a viewer and a designer each got "Configure runner pool" buttons that opened screens their save
+// would 403 on. The rule here keeps each card to the people who can act on it, and gives everyone
+// else one line naming who can, but only when the gap stops their own work.
+
+/** What the caller can do, as far as a setup prompt cares. */
+export interface SetupActor {
+  /** The full app surface (engineer / PM). The designer (`intake`) surface never configures. */
+  fullSurface: boolean
+  /** `integrations.manage` on the active board (true in dev-open, like every permission). */
+  canManageIntegrations: boolean
+  /** `runs.execute` on the active board: whether a gap that stops runs stops THEIR work. */
+  canExecuteRuns: boolean
+  /** An admin of the board's account. */
+  isAccountAdmin: boolean
+  /** Whether this deployment has accounts at all (auth on). */
+  accountsEnabled: boolean
+}
+
+/**
+ * The areas whose gap stops EVERY run, so a caller who cannot fix one still needs to know it is
+ * there: without an executor no agent starts. A missing test environment or content storage only
+ * degrades some runs, and the run that needs them already says so when it starts.
+ */
+export const BLOCKING_INFRA_AREAS = ['agentExecutor'] as const satisfies readonly InfraSetupArea[]
+export type BlockingInfraArea = (typeof BLOCKING_INFRA_AREAS)[number]
+
+/**
+ * The owner to act on: the reported one when this build knows it, else the workspace admin, which
+ * is who the cards assumed before the owner was reported. An older backend sends none; a newer one
+ * may send an owner this bundle has never seen, and neither may break the board's render.
+ */
+export function effectiveOwner(owner: unknown): InfraSetupOwner {
+  return isInfraSetupOwner(owner) ? owner : 'workspace_admin'
+}
+
+/** Whether the caller can close a gap owned by `owner` (any value; see {@link effectiveOwner}). */
+export function canActOnSetup(owner: unknown, actor: SetupActor): boolean {
+  if (!actor.fullSurface) return false
+  const known = effectiveOwner(owner)
+  switch (known) {
+    case 'workspace_admin':
+      return actor.canManageIntegrations
+    case 'account_admin':
+      // Without accounts there is no account admin to name, and the single user holds every
+      // permission, so the workspace grant stands in for it.
+      return actor.accountsEnabled ? actor.isAccountAdmin : actor.canManageIntegrations
+    case 'operator':
+      return false
+    default: {
+      // Compile-time exhaustiveness only: `effectiveOwner` already narrowed the runtime value.
+      const unreachable: never = known
+      return unreachable
+    }
+  }
+}
+
+/**
+ * How a caller who cannot act on a gap from where they are CAN get it fixed: the owner to ask, or
+ * `full_surface` when they hold the grant themselves and only the designer surface they chose hides
+ * the card. Telling a board admin that "a board admin can fix this" would send them looking for
+ * someone else.
+ */
+export type SetupRemedy = InfraSetupOwner | 'full_surface'
+
+/** The line a caller who cannot act sees for a blocking gap. */
+export interface SetupNotice {
+  area: BlockingInfraArea
+  /** `outage` when the area is configured but unreachable, else `setup`. */
+  kind: 'setup' | 'outage'
+  remedy: SetupRemedy
+}
+
+/**
+ * The first blocking gap the caller cannot act on, or null. The caller who CAN act gets the full
+ * card instead, so the two never describe the same gap twice, and a caller who cannot start a run
+ * (a viewer) gets nothing: the gap does not stop anything they do.
+ */
+export function blockingSetupNotice(
+  status: InfraSetup | null,
+  owners: InfraSetupOwners | null,
+  actor: SetupActor,
+): SetupNotice | null {
+  if (!status || !actor.canExecuteRuns) return null
+  for (const area of BLOCKING_INFRA_AREAS) {
+    const areaStatus = status[area]
+    const kind = isInfraSetupHealthStatus(areaStatus)
+      ? 'outage'
+      : areaStatus === 'not_defined'
+        ? 'setup'
+        : null
+    if (!kind) continue
+    const owner = effectiveOwner(owners?.[area])
+    if (canActOnSetup(owner, actor)) continue
+    const remedy = canActOnSetup(owner, { ...actor, fullSurface: true }) ? 'full_surface' : owner
+    return { area, kind, remedy }
+  }
+  return null
+}

package/i18n/locales/de.json

@@ -2687,6 +2687,18 @@
         "action": "Verbindung prüfen"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Auf diesem Board können noch keine Agenten laufen: Es ist kein Runner-Pool verbunden.",
+        "outage": "Agenten können gerade nicht laufen: Der Runner-Pool dieses Boards ist nicht erreichbar."
+      },
+      "owner": {
+        "workspace_admin": "Ein Board-Admin kann das beheben.",
+        "account_admin": "Ein Konto-Admin kann das beheben.",
+        "operator": "Nur der Betreiber des Deployments kann das beheben."
+      },
+      "fullSurface": "Sie können das selbst beheben: Wechseln Sie Ihre Rolle oben in der Seitenleiste."
+    },
     "spendWarningBanner": {
       "title": "Ausgabenlimit erreicht, Agentenausführung pausiert",
       "body": "Die Token-Ausgaben dieses Monats haben das konfigurierte Budget erreicht, sodass laufende Pipelines pausiert wurden, um weitere Kosten zu vermeiden. Die Ausführung wird automatisch fortgesetzt, wenn das Budget im nächsten Monat zurückgesetzt wird, oder sobald das Limit angehoben wird.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "oder",
       "noneConfigured": "Für dieses Deployment ist keine Quellcodeverbindung konfiguriert. Bitten Sie einen Betreiber, eine GitHub App oder einen GitLab-Zugang einzurichten.",
+      "adminRequired": "Nur ein Board-Admin kann einen Repository-Host verbinden. Bitten Sie einen Admin dieses Boards darum.",
       "gitlab": {
         "intro": "Fügen Sie ein persönliches GitLab-Zugriffstoken ein, um diesen Workspace zu verbinden. cat-factory nutzt es, um Ihre Projekte aufzulisten, Branches zu pushen und Merge Requests zu öffnen.",
         "tokenLabel": "Persönliches Zugriffstoken",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "cat-factory mit {provider} verbinden",
       "titleAny": "cat-factory mit Ihren Repositorys verbinden",
-      "intro": "cat-factory funktioniert, indem es Pull Requests in Ihren Repositorys öffnet. Verbinden Sie Ihren Repository-Anbieter, um fortzufahren."
+      "intro": "cat-factory funktioniert, indem es Pull Requests in Ihren Repositorys öffnet. Verbinden Sie Ihren Repository-Anbieter, um fortzufahren.",
+      "switchBoard": "Nicht das gewünschte Board? Wechseln Sie zu einem anderen oder erstellen Sie ein eigenes."
     },
     "addService": {
       "intro": "Wählen Sie ein bestehendes {provider}-Repository, um es als Board-Service hinzuzufügen. Kein Bootstrapping: Das Repo wird unverändert mit einem neuen Service-Frame verknüpft, und Aufgaben, die Sie darauf ausführen, zielen auf dieses Repo.",

package/i18n/locales/en.json

@@ -2715,6 +2715,18 @@
         "action": "Check connection"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Agents can't run on this board yet: no runner pool is connected.",
+        "outage": "Agents can't run right now: this board's runner pool is unreachable."
+      },
+      "owner": {
+        "workspace_admin": "A board admin can fix this.",
+        "account_admin": "An account admin can fix this.",
+        "operator": "Only the deployment operator can fix this."
+      },
+      "fullSurface": "You can fix this yourself: switch your role at the top of the sidebar."
+    },
     "spendWarningBanner": {
       "title": "Spend limit reached, agent execution paused",
       "body": "This month's token spend has hit the configured budget, so running pipelines were paused to avoid further cost. Execution resumes automatically when the budget rolls over next month, or once the limit is raised.",
@@ -8289,6 +8301,7 @@
     "connect": {
       "or": "or",
       "noneConfigured": "No source-control connection is configured for this deployment. Ask an operator to set up a GitHub App or GitLab access.",
+      "adminRequired": "Only a board admin can connect a repository host. Ask an admin of this board.",
       "gitlab": {
         "intro": "Paste a GitLab personal access token to connect this workspace. cat-factory uses it to list your projects, push branches and open merge requests.",
         "tokenLabel": "Personal access token",
@@ -8306,7 +8319,8 @@
     "onboarding": {
       "title": "Connect cat-factory to {provider}",
       "titleAny": "Connect cat-factory to your repositories",
-      "intro": "cat-factory works by opening pull requests on your repositories. Connect your repository host to continue."
+      "intro": "cat-factory works by opening pull requests on your repositories. Connect your repository host to continue.",
+      "switchBoard": "Not the board you meant? Switch to another one, or create your own."
     },
     "addService": {
       "intro": "Pick an existing {provider} repository to add as a board service. No bootstrapping: the repo is linked to a new service frame as-is, and tasks you run on it target that repo.",

package/i18n/locales/es.json

@@ -2560,6 +2560,18 @@
         "action": "Comprobar conexión"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Los agentes aún no pueden ejecutarse en este tablero: no hay ningún pool de runners conectado.",
+        "outage": "Los agentes no pueden ejecutarse ahora mismo: el pool de runners de este tablero no está accesible."
+      },
+      "owner": {
+        "workspace_admin": "Un administrador del tablero puede solucionarlo.",
+        "account_admin": "Un administrador de la cuenta puede solucionarlo.",
+        "operator": "Solo el operador del despliegue puede solucionarlo."
+      },
+      "fullSurface": "Puedes solucionarlo tú: cambia tu rol desde la parte superior de la barra lateral."
+    },
     "spendWarningBanner": {
       "title": "Límite de gasto alcanzado, ejecución de agentes en pausa",
       "body": "El gasto de tokens de este mes ha alcanzado el presupuesto configurado, por lo que las canalizaciones en curso se pausaron para evitar más costes. La ejecución se reanuda automáticamente cuando el presupuesto se renueva el mes que viene, o una vez que se aumente el límite.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "o",
       "noneConfigured": "Este despliegue no tiene configurada ninguna conexión de control de código. Pide a un operador que configure una GitHub App o el acceso a GitLab.",
+      "adminRequired": "Solo un administrador del tablero puede conectar un host de repositorios. Pídeselo a un administrador de este tablero.",
       "gitlab": {
         "intro": "Pega un token de acceso personal de GitLab para conectar este espacio de trabajo. cat-factory lo usa para listar tus proyectos, subir ramas y abrir solicitudes de fusión.",
         "tokenLabel": "Token de acceso personal",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "Conecta cat-factory con {provider}",
       "titleAny": "Conecta cat-factory con tus repositorios",
-      "intro": "cat-factory funciona abriendo solicitudes de incorporación de cambios en tus repositorios. Conecta tu proveedor de repositorios para continuar."
+      "intro": "cat-factory funciona abriendo solicitudes de incorporación de cambios en tus repositorios. Conecta tu proveedor de repositorios para continuar.",
+      "switchBoard": "¿No es el tablero que buscabas? Cambia a otro o crea uno propio."
     },
     "addService": {
       "intro": "Elige un repositorio de {provider} existente para añadirlo como servicio del tablero. Sin arranque inicial: el repositorio se vincula tal cual a un nuevo marco de servicio, y las tareas que ejecutes en él apuntan a ese repositorio.",

package/i18n/locales/fr.json

@@ -2560,6 +2560,18 @@
         "action": "Vérifier la connexion"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Les agents ne peuvent pas encore s'exécuter sur ce tableau : aucun pool de runners n'est connecté.",
+        "outage": "Les agents ne peuvent pas s'exécuter pour le moment : le pool de runners de ce tableau est injoignable."
+      },
+      "owner": {
+        "workspace_admin": "Un administrateur du tableau peut corriger cela.",
+        "account_admin": "Un administrateur du compte peut corriger cela.",
+        "operator": "Seul l'opérateur du déploiement peut corriger cela."
+      },
+      "fullSurface": "Vous pouvez corriger cela vous-même : changez de rôle en haut de la barre latérale."
+    },
     "spendWarningBanner": {
       "title": "Limite de dépense atteinte, exécution des agents en pause",
       "body": "La dépense en jetons de ce mois a atteint le budget configuré, les pipelines en cours ont donc été mis en pause pour éviter des coûts supplémentaires. L'exécution reprend automatiquement au renouvellement du budget le mois prochain, ou dès que la limite est relevée.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "ou",
       "noneConfigured": "Aucune connexion de gestion de code n'est configurée pour ce déploiement. Demandez à un opérateur de configurer une GitHub App ou un accès GitLab.",
+      "adminRequired": "Seul un administrateur du tableau peut connecter un hébergeur de dépôts. Demandez-le à un administrateur de ce tableau.",
       "gitlab": {
         "intro": "Collez un jeton d'accès personnel GitLab pour connecter cet espace de travail. cat-factory l'utilise pour lister vos projets, pousser des branches et ouvrir des merge requests.",
         "tokenLabel": "Jeton d'accès personnel",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "Connecter cat-factory à {provider}",
       "titleAny": "Connecter cat-factory à vos dépôts",
-      "intro": "cat-factory fonctionne en ouvrant des pull requests sur vos dépôts. Connectez votre hébergeur de dépôts pour continuer."
+      "intro": "cat-factory fonctionne en ouvrant des pull requests sur vos dépôts. Connectez votre hébergeur de dépôts pour continuer.",
+      "switchBoard": "Ce n'est pas le bon tableau ? Passez à un autre, ou créez le vôtre."
     },
     "addService": {
       "intro": "Choisissez un dépôt {provider} existant à ajouter comme service du tableau. Sans amorçage : le dépôt est lié tel quel à un nouveau cadre de service, et les tâches que vous y exécutez ciblent ce dépôt.",

package/i18n/locales/he.json

@@ -2560,6 +2560,18 @@
         "action": "בדיקת החיבור"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "סוכנים עדיין לא יכולים לפעול בלוח הזה: לא מחובר מאגר ראנרים.",
+        "outage": "סוכנים לא יכולים לפעול כרגע: מאגר הראנרים של הלוח הזה אינו נגיש."
+      },
+      "owner": {
+        "workspace_admin": "מנהל של הלוח יכול לתקן זאת.",
+        "account_admin": "מנהל של החשבון יכול לתקן זאת.",
+        "operator": "רק המפעיל של הפריסה יכול לתקן זאת."
+      },
+      "fullSurface": "אפשר לתקן זאת בעצמכם: החליפו תפקיד בראש סרגל הצד."
+    },
     "spendWarningBanner": {
       "title": "מגבלת ההוצאה הושגה, הרצת הסוכנים הושהתה",
       "body": "הוצאת האסימונים של החודש הגיעה לתקציב המוגדר, ולכן צינורות פעילים הושהו כדי להימנע מעלות נוספת. ההרצה מתחדשת אוטומטית כשהתקציב מתחדש בחודש הבא, או כאשר המגבלה מועלית.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "או",
       "noneConfigured": "לא הוגדר חיבור לניהול קוד מקור בפריסה הזו. בקש ממפעיל להגדיר אפליקציית GitHub או גישה ל-GitLab.",
+      "adminRequired": "רק מנהל של הלוח יכול לחבר שירות אחסון מאגרים. בקשו זאת ממנהל של הלוח הזה.",
       "gitlab": {
         "intro": "הדבק אסימון גישה אישי של GitLab כדי לחבר את סביבת העבודה הזו. cat-factory משתמש בו כדי להציג את הפרויקטים שלך, לדחוף ענפים ולפתוח בקשות מיזוג.",
         "tokenLabel": "אסימון גישה אישי",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "חבר את cat-factory ל-{provider}",
       "titleAny": "חבר את cat-factory למאגרים שלך",
-      "intro": "cat-factory פועל על ידי פתיחת בקשות משיכה במאגרים שלך. חבר את ספק המאגרים שלך כדי להמשיך."
+      "intro": "cat-factory פועל על ידי פתיחת בקשות משיכה במאגרים שלך. חבר את ספק המאגרים שלך כדי להמשיך.",
+      "switchBoard": "זה לא הלוח שהתכוונתם אליו? עברו ללוח אחר או צרו לוח משלכם."
     },
     "addService": {
       "intro": "בחר מאגר {provider} קיים כדי להוסיף כשירות בלוח. ללא אתחול: המאגר מקושר למסגרת שירות חדשה כפי שהוא, ומשימות שתריץ עליו ממוקדות באותו מאגר.",

package/i18n/locales/it.json

@@ -2687,6 +2687,18 @@
         "action": "Verifica connessione"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Gli agenti non possono ancora funzionare su questa board: nessun runner pool è connesso.",
+        "outage": "Gli agenti non possono funzionare in questo momento: il runner pool di questa board non è raggiungibile."
+      },
+      "owner": {
+        "workspace_admin": "Un amministratore della board può risolvere il problema.",
+        "account_admin": "Un amministratore dell'account può risolvere il problema.",
+        "operator": "Solo l'operatore del deployment può risolvere il problema."
+      },
+      "fullSurface": "Puoi risolverlo tu: cambia ruolo dall'alto della barra laterale."
+    },
     "spendWarningBanner": {
       "title": "Limite di spesa raggiunto, esecuzione degli agenti sospesa",
       "body": "La spesa in token di questo mese ha raggiunto il budget configurato, quindi le pipeline in esecuzione sono state sospese per evitare ulteriori costi. L'esecuzione riprende automaticamente quando il budget si rinnova il mese prossimo, oppure una volta che il limite viene aumentato.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "oppure",
       "noneConfigured": "Per questo deployment non è configurata alcuna connessione al controllo del codice. Chiedi a un operatore di configurare una GitHub App o l'accesso a GitLab.",
+      "adminRequired": "Solo un amministratore della board può connettere un host di repository. Chiedilo a un amministratore di questa board.",
       "gitlab": {
         "intro": "Incolla un token di accesso personale GitLab per collegare questo workspace. cat-factory lo usa per elencare i tuoi progetti, inviare branch e aprire merge request.",
         "tokenLabel": "Token di accesso personale",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "Collega cat-factory a {provider}",
       "titleAny": "Collega cat-factory ai tuoi repository",
-      "intro": "cat-factory funziona aprendo pull request sui tuoi repository. Collega il tuo host di repository per continuare."
+      "intro": "cat-factory funziona aprendo pull request sui tuoi repository. Collega il tuo host di repository per continuare.",
+      "switchBoard": "Non è la board che cercavi? Passa a un'altra, oppure creane una tua."
     },
     "addService": {
       "intro": "Scegli un repository {provider} esistente da aggiungere come servizio sulla board. Nessun bootstrapping: il repo viene collegato a un nuovo frame di servizio così com'è, e le attività che vi esegui puntano a quel repo.",

package/i18n/locales/ja.json

@@ -2560,6 +2560,18 @@
         "action": "接続を確認"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "このボードではまだエージェントを実行できません。ランナープールが接続されていません。",
+        "outage": "現在エージェントを実行できません。このボードのランナープールに接続できません。"
+      },
+      "owner": {
+        "workspace_admin": "ボードの管理者が解決できます。",
+        "account_admin": "アカウントの管理者が解決できます。",
+        "operator": "解決できるのはデプロイの運用者だけです。"
+      },
+      "fullSurface": "ご自身で解決できます。サイドバー上部でロールを切り替えてください。"
+    },
     "spendWarningBanner": {
       "title": "支出上限に達したため、エージェントの実行を一時停止しました",
       "body": "今月のトークン支出が設定された予算に達したため、これ以上のコストを避けるために実行中のパイプラインを一時停止しました。来月に予算がリセットされると、または上限を引き上げると、実行は自動的に再開されます。",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "または",
       "noneConfigured": "このデプロイにはソース管理の接続が設定されていません。GitHub App または GitLab へのアクセスの設定を運用者に依頼してください。",
+      "adminRequired": "リポジトリホストを接続できるのはボードの管理者だけです。このボードの管理者に依頼してください。",
       "gitlab": {
         "intro": "GitLab の個人用アクセストークンを貼り付けて、このワークスペースを接続します。cat-factory はこれを使ってプロジェクトの一覧取得、ブランチのプッシュ、マージリクエストの作成を行います。",
         "tokenLabel": "個人用アクセストークン",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "cat-factory を {provider} に接続",
       "titleAny": "cat-factory をリポジトリに接続",
-      "intro": "cat-factory はリポジトリ上でプルリクエストを開くことで動作します。続行するにはリポジトリホストを接続してください。"
+      "intro": "cat-factory はリポジトリ上でプルリクエストを開くことで動作します。続行するにはリポジトリホストを接続してください。",
+      "switchBoard": "目的のボードではありませんか？別のボードに切り替えるか、自分のボードを作成してください。"
     },
     "addService": {
       "intro": "ボードサービスとして追加する既存の{provider}リポジトリを選択してください。ブートストラップはありません。リポジトリはそのまま新しいサービスフレームにリンクされ、その上で実行するタスクはそのリポジトリを対象とします。",

package/i18n/locales/pl.json

@@ -2560,6 +2560,18 @@
         "action": "Sprawdź połączenie"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Na tej tablicy agenci nie mogą jeszcze działać: nie podłączono żadnej puli runnerów.",
+        "outage": "Agenci nie mogą teraz działać: pula runnerów tej tablicy jest nieosiągalna."
+      },
+      "owner": {
+        "workspace_admin": "Może to naprawić administrator tablicy.",
+        "account_admin": "Może to naprawić administrator konta.",
+        "operator": "Może to naprawić tylko operator wdrożenia."
+      },
+      "fullSurface": "Możesz to naprawić sam: zmień rolę u góry panelu bocznego."
+    },
     "spendWarningBanner": {
       "title": "Osiągnięto limit wydatków, wykonywanie agentów wstrzymane",
       "body": "Wydatki na tokeny w tym miesiącu osiągnęły skonfigurowany budżet, dlatego działające potoki zostały wstrzymane, aby uniknąć dalszych kosztów. Wykonywanie wznowi się automatycznie po odnowieniu budżetu w przyszłym miesiącu lub po podniesieniu limitu.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "lub",
       "noneConfigured": "W tym wdrożeniu nie skonfigurowano połączenia z systemem kontroli źródeł. Poproś operatora o skonfigurowanie aplikacji GitHub lub dostępu do GitLab.",
+      "adminRequired": "Tylko administrator tablicy może podłączyć hosta repozytoriów. Poproś o to administratora tej tablicy.",
       "gitlab": {
         "intro": "Wklej osobisty token dostępu GitLab, aby połączyć ten obszar roboczy. cat-factory używa go do wyświetlania Twoich projektów, wypychania gałęzi i otwierania merge requestów.",
         "tokenLabel": "Osobisty token dostępu",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "Połącz cat-factory z {provider}",
       "titleAny": "Połącz cat-factory ze swoimi repozytoriami",
-      "intro": "cat-factory działa, otwierając pull requesty w Twoich repozytoriach. Połącz swojego dostawcę repozytoriów, aby kontynuować."
+      "intro": "cat-factory działa, otwierając pull requesty w Twoich repozytoriach. Połącz swojego dostawcę repozytoriów, aby kontynuować.",
+      "switchBoard": "To nie ta tablica? Przełącz się na inną albo utwórz własną."
     },
     "addService": {
       "intro": "Wybierz istniejące repozytorium {provider}, aby dodać je jako usługę tablicy. Bez inicjowania: repozytorium jest wiązane bez zmian z nową ramką usługi, a uruchamiane na nim zadania celują w to repozytorium.",

package/i18n/locales/tr.json

@@ -2560,6 +2560,18 @@
         "action": "Bağlantıyı denetle"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "Bu panoda aracılar henüz çalışamaz: bağlı bir runner havuzu yok.",
+        "outage": "Aracılar şu anda çalışamıyor: bu panonun runner havuzuna erişilemiyor."
+      },
+      "owner": {
+        "workspace_admin": "Bir pano yöneticisi bunu düzeltebilir.",
+        "account_admin": "Bir hesap yöneticisi bunu düzeltebilir.",
+        "operator": "Bunu yalnızca dağıtımın operatörü düzeltebilir."
+      },
+      "fullSurface": "Bunu kendiniz düzeltebilirsiniz: kenar çubuğunun üstünden rolünüzü değiştirin."
+    },
     "spendWarningBanner": {
       "title": "Harcama limitine ulaşıldı, ajan yürütmesi duraklatıldı",
       "body": "Bu ayki belirteç harcaması yapılandırılan bütçeye ulaştı, bu yüzden daha fazla maliyeti önlemek için çalışan boru hatları duraklatıldı. Yürütme, bütçe gelecek ay yenilendiğinde veya limit yükseltildiğinde otomatik olarak devam eder.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "veya",
       "noneConfigured": "Bu dağıtım için yapılandırılmış bir kaynak denetimi bağlantısı yok. Bir operatörden GitHub App veya GitLab erişimi kurmasını isteyin.",
+      "adminRequired": "Bir depo sağlayıcısını yalnızca pano yöneticisi bağlayabilir. Bu panonun bir yöneticisinden isteyin.",
       "gitlab": {
         "intro": "Bu çalışma alanını bağlamak için bir GitLab kişisel erişim belirteci yapıştırın. cat-factory bunu projelerinizi listelemek, dal göndermek ve merge request açmak için kullanır.",
         "tokenLabel": "Kişisel erişim belirteci",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "cat-factory'yi {provider}'a bağla",
       "titleAny": "cat-factory'yi depolarınıza bağlayın",
-      "intro": "cat-factory, depolarınızda pull request'ler açarak çalışır. Devam etmek için depo sağlayıcınızı bağlayın."
+      "intro": "cat-factory, depolarınızda pull request'ler açarak çalışır. Devam etmek için depo sağlayıcınızı bağlayın.",
+      "switchBoard": "Aradığınız pano bu değil mi? Başka bir panoya geçin veya kendinizinkini oluşturun."
     },
     "addService": {
       "intro": "Pano servisi olarak eklenecek mevcut bir {provider} deposu seçin. Bootstrap yok: depo olduğu gibi yeni bir servis çerçevesine bağlanır ve üzerinde çalıştırdığınız görevler o depoyu hedefler.",

package/i18n/locales/uk.json

@@ -2560,6 +2560,18 @@
         "action": "Перевірити з’єднання"
       }
     },
+    "infraSetupNotice": {
+      "agentExecutor": {
+        "setup": "На цій дошці агенти ще не можуть працювати: не підключено жодного пулу раннерів.",
+        "outage": "Агенти зараз не можуть працювати: пул раннерів цієї дошки недоступний."
+      },
+      "owner": {
+        "workspace_admin": "Це може виправити адміністратор дошки.",
+        "account_admin": "Це може виправити адміністратор облікового запису.",
+        "operator": "Це може виправити лише оператор розгортання."
+      },
+      "fullSurface": "Ви можете виправити це самі: змініть роль угорі бічної панелі."
+    },
     "spendWarningBanner": {
       "title": "Досягнуто ліміту витрат, виконання агентів призупинено",
       "body": "Витрати на токени цього місяця досягли налаштованого бюджету, тому запущені конвеєри було призупинено, щоб уникнути подальших витрат. Виконання відновиться автоматично, коли бюджет оновиться наступного місяця, або щойно ліміт буде підвищено.",
@@ -7985,6 +7997,7 @@
     "connect": {
       "or": "або",
       "noneConfigured": "Для цього розгортання не налаштовано підключення до системи керування кодом. Попросіть оператора налаштувати застосунок GitHub або доступ до GitLab.",
+      "adminRequired": "Підключити хост репозиторіїв може лише адміністратор дошки. Попросіть про це адміністратора цієї дошки.",
       "gitlab": {
         "intro": "Вставте персональний токен доступу GitLab, щоб під'єднати цей робочий простір. cat-factory використовує його, щоб отримувати перелік ваших проєктів, надсилати гілки та відкривати запити на злиття.",
         "tokenLabel": "Персональний токен доступу",
@@ -8002,7 +8015,8 @@
     "onboarding": {
       "title": "Підключіть cat-factory до {provider}",
       "titleAny": "Підключіть cat-factory до ваших репозиторіїв",
-      "intro": "cat-factory працює, відкриваючи pull requests у ваших репозиторіях. Під'єднайте свого постачальника репозиторіїв, щоб продовжити."
+      "intro": "cat-factory працює, відкриваючи pull requests у ваших репозиторіях. Під'єднайте свого постачальника репозиторіїв, щоб продовжити.",
+      "switchBoard": "Не та дошка? Перейдіть на іншу або створіть власну."
     },
     "addService": {
       "intro": "Виберіть наявний репозиторій {provider}, щоб додати його як сервіс дошки. Без початкового налаштування: репозиторій прив’язується як є до нового фрейму сервісу, а задачі, які ви на ньому запускаєте, націлені на цей репозиторій.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.310.3",
+  "version": "0.311.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -18,7 +18,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@cat-factory/contracts": "0.364.0",
+    "@cat-factory/contracts": "0.365.0",
     "@modular-frontend/core": "0.6.0",
     "@modular-vue/core": "^1.5.0",
     "@modular-vue/journeys": "^1.4.0",