@cat-factory/app 0.46.12 → 0.47.0

package/app/components/settings/UserSecretsSection.vue

@@ -8,6 +8,7 @@ import { computed, ref, watch } from 'vue'
 import type { ProviderConfigField, UserSecretKind } from '~/types/userSecrets'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 
+const { t } = useI18n()
 const ui = useUiStore()
 const store = useUserSecretsStore()
 const toast = useToast()
@@ -102,12 +103,14 @@ async function save() {
     values.value[secretField.value!.key] = ''
     testResult.value = null
     toast.add({
-      title: `${descriptor.value?.label ?? 'Secret'} saved`,
+      title: t('settings.userSecrets.toast.saved', {
+        label: descriptor.value?.label ?? t('settings.userSecrets.secretFallback'),
+      }),
       icon: 'i-lucide-check',
       color: 'success',
     })
   } catch (e) {
-    notifyError('Could not save secret', e)
+    notifyError(t('settings.userSecrets.toast.saveFailed'), e)
   } finally {
     busy.value = false
   }
@@ -118,9 +121,9 @@ async function remove() {
   try {
     await store.remove(kind.value)
     resetDraft()
-    toast.add({ title: 'Secret removed', icon: 'i-lucide-check' })
+    toast.add({ title: t('settings.userSecrets.toast.removed'), icon: 'i-lucide-check' })
   } catch (e) {
-    notifyError('Could not remove secret', e)
+    notifyError(t('settings.userSecrets.toast.removeFailed'), e)
   } finally {
     busy.value = false
   }
@@ -128,17 +131,25 @@ async function remove() {
 </script>
 
 <template>
-  <UModal v-model:open="open" title="My GitHub token" :ui="{ content: 'max-w-xl' }">
+  <UModal
+    v-model:open="open"
+    :title="t('settings.userSecrets.title')"
+    :ui="{ content: 'max-w-xl' }"
+  >
     <template #title>
-      <IntegrationBackTitle title="My GitHub token" @back="back" />
+      <IntegrationBackTitle :title="t('settings.userSecrets.title')" @back="back" />
     </template>
     <template #body>
       <div class="space-y-4">
         <p class="text-xs text-slate-400">
-          Store a personal access token used for the runs <strong>you</strong> start — pushes, pull
-          requests, the CI gate and merges are attributed to your GitHub access. Stored
-          <span class="text-slate-300">just for you</span>; the token is write-only and never shown
-          again.
+          <i18n-t keypath="settings.userSecrets.intro" tag="span" scope="global">
+            <template #you>
+              <strong>{{ t('settings.userSecrets.introYou') }}</strong>
+            </template>
+            <template #scope>
+              <span class="text-slate-300">{{ t('settings.userSecrets.introScope') }}</span>
+            </template>
+          </i18n-t>
         </p>
 
         <div
@@ -147,7 +158,9 @@ async function remove() {
         >
           <div>
             <span class="font-medium text-slate-200">{{ status.label }}</span>
-            <div class="text-[11px] text-emerald-400">Connected · token stored</div>
+            <div class="text-[11px] text-emerald-400">
+              {{ t('settings.userSecrets.connectedStored') }}
+            </div>
           </div>
           <UButton
             icon="i-lucide-trash-2"
@@ -164,17 +177,23 @@ async function remove() {
           class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3"
         >
           <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
-            {{ status ? 'Replace token' : 'Add a token' }}
+            {{
+              status ? t('settings.userSecrets.replaceToken') : t('settings.userSecrets.addToken')
+            }}
           </p>
 
-          <UFormField label="Label (optional)">
+          <UFormField :label="t('settings.userSecrets.labelField')">
             <UInput v-model="labelDraft" :placeholder="descriptor.label" />
           </UFormField>
 
           <UFormField
             v-for="field in descriptor.configFields"
             :key="field.key"
-            :label="field.label + (field.required ? '' : ' (optional)')"
+            :label="
+              field.required
+                ? field.label
+                : t('settings.userSecrets.optionalField', { label: field.label })
+            "
             :help="field.help"
           >
             <UInput
@@ -195,13 +214,13 @@ async function remove() {
               :disabled="!buildPayload()"
               @click="test()"
             >
-              Test connection
+              {{ t('settings.userSecrets.testConnection') }}
             </UButton>
             <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
-              {{ testResult.message ?? 'Token valid' }}
+              {{ testResult.message ?? t('settings.userSecrets.tokenValid') }}
             </span>
             <span v-else-if="testResult" class="text-xs text-rose-400">
-              {{ testResult.message ?? 'Token rejected' }}
+              {{ testResult.message ?? t('settings.userSecrets.tokenRejected') }}
             </span>
           </div>
 
@@ -213,7 +232,7 @@ async function remove() {
               :disabled="!buildPayload()"
               @click="save()"
             >
-              {{ status ? 'Save' : 'Add token' }}
+              {{ status ? t('common.save') : t('settings.userSecrets.addToken') }}
             </UButton>
           </div>
         </div>

package/app/components/settings/WorkspaceSettingsPanel.vue

@@ -14,6 +14,7 @@ import IssueTrackerPanel from '~/components/settings/IssueTrackerPanel.vue'
 import ServiceFragmentDefaultsPanel from '~/components/settings/ServiceFragmentDefaultsPanel.vue'
 import IntegrationBackTitle from '~/components/layout/IntegrationBackTitle.vue'
 
+const { t, te } = useI18n()
 const ui = useUiStore()
 const store = useWorkspaceSettingsStore()
 const toast = useToast()
@@ -31,35 +32,63 @@ const activeTab = computed({
   set: (v: string) => ui.setWorkspaceSettingsTab(v),
 })
 
-const tabs = [
+const tabs = computed(() => [
   {
     value: 'workspace',
-    label: 'Workspace',
+    label: t('settings.workspaceSettings.tabs.workspace'),
     icon: 'i-lucide-sliders-horizontal',
     slot: 'workspace',
   },
-  { value: 'budget', label: 'Budget', icon: 'i-lucide-wallet', slot: 'budget' },
-  { value: 'merge', label: 'Merge thresholds', icon: 'i-lucide-git-merge', slot: 'merge' },
+  {
+    value: 'budget',
+    label: t('settings.workspaceSettings.tabs.budget'),
+    icon: 'i-lucide-wallet',
+    slot: 'budget',
+  },
+  {
+    value: 'merge',
+    label: t('settings.workspaceSettings.tabs.merge'),
+    icon: 'i-lucide-git-merge',
+    slot: 'merge',
+  },
   {
     value: 'tracker',
-    label: 'Issue tracker',
+    label: t('settings.workspaceSettings.tabs.tracker'),
     icon: 'i-lucide-list-checks',
     slot: 'tracker',
   },
   {
     value: 'fragments',
-    label: 'Service best practices',
+    label: t('settings.workspaceSettings.tabs.fragments'),
     icon: 'i-lucide-book-open-check',
     slot: 'fragments',
   },
-]
+])
 
 const TASK_TYPES: CreateTaskType[] = ['feature', 'bug', 'document', 'spike']
-const MODES: { value: TaskLimitMode; label: string }[] = [
-  { value: 'off', label: 'No limit' },
-  { value: 'shared', label: 'Shared across all types' },
-  { value: 'per_type', label: 'Per task type' },
-]
+
+// Per-task-type label for the "Max {type} tasks" inputs. An exhaustive Record keyed off
+// the CreateTaskType union (a missing member fails the typecheck); each value is a LITERAL
+// catalog key so the typed-message-keys check sees it. Leaf keys mirror the enum verbatim.
+const TASK_TYPE_KEYS: Record<CreateTaskType, string> = {
+  feature: 'settings.workspaceSettings.taskTypes.feature',
+  bug: 'settings.workspaceSettings.taskTypes.bug',
+  document: 'settings.workspaceSettings.taskTypes.document',
+  spike: 'settings.workspaceSettings.taskTypes.spike',
+}
+
+const MODES = computed<{ value: TaskLimitMode; label: string }[]>(() => [
+  { value: 'off', label: t('settings.workspaceSettings.taskLimit.modes.off') },
+  { value: 'shared', label: t('settings.workspaceSettings.taskLimit.modes.shared') },
+  { value: 'per_type', label: t('settings.workspaceSettings.taskLimit.modes.per_type') },
+])
+
+/** The localized "Max {type} tasks" label for a per-type running-task limit input. */
+function maxTaskTypeLabel(type: CreateTaskType): string {
+  const key = TASK_TYPE_KEYS[type]
+  const typeLabel = te(key) ? t(key) : type
+  return t('settings.workspaceSettings.taskLimit.maxPerType', { type: typeLabel })
+}
 
 // Local editable copy, kept in sync with the store's settings.
 const draft = reactive({
@@ -116,10 +145,14 @@ async function save() {
       artifactRetentionDays: draft.artifactRetentionDays,
       kaizenEnabled: draft.kaizenEnabled,
     })
-    toast.add({ title: 'Settings saved', icon: 'i-lucide-check', color: 'success' })
+    toast.add({
+      title: t('settings.workspaceSettings.toast.saved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
   } catch (e) {
     toast.add({
-      title: 'Could not save settings',
+      title: t('settings.workspaceSettings.toast.saveFailed'),
       description: e instanceof Error ? e.message : String(e),
       icon: 'i-lucide-triangle-alert',
       color: 'error',
@@ -142,10 +175,14 @@ async function saveBudget() {
       spendCurrency: draft.spendCurrency.trim() ? draft.spendCurrency.trim().toUpperCase() : null,
       spendMonthlyLimit: monthlyLimit,
     })
-    toast.add({ title: 'Budget saved', icon: 'i-lucide-check', color: 'success' })
+    toast.add({
+      title: t('settings.workspaceSettings.toast.budgetSaved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
   } catch (e) {
     toast.add({
-      title: 'Could not save budget',
+      title: t('settings.workspaceSettings.toast.budgetSaveFailed'),
       description: e instanceof Error ? e.message : String(e),
       icon: 'i-lucide-triangle-alert',
       color: 'error',
@@ -157,9 +194,13 @@ async function saveBudget() {
 </script>
 
 <template>
-  <UModal v-model:open="open" title="Workspace settings" :ui="{ content: 'max-w-3xl' }">
+  <UModal
+    v-model:open="open"
+    :title="t('settings.workspaceSettings.title')"
+    :ui="{ content: 'max-w-3xl' }"
+  >
     <template #title>
-      <IntegrationBackTitle title="Workspace settings" @back="back" />
+      <IntegrationBackTitle :title="t('settings.workspaceSettings.title')" @back="back" />
     </template>
     <template #body>
       <UTabs
@@ -173,15 +214,21 @@ async function saveBudget() {
           <div class="space-y-6">
             <!-- Run-timing escalation -->
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Waiting for a human</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.waiting.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                A run parked on a human decision (a review, an approval, a merge) waits as long as
-                it needs — it is never cancelled. After this many minutes its notification turns red
-                and is flagged <span class="text-error-400">Overdue</span> in the inbox.
+                <i18n-t keypath="settings.workspaceSettings.waiting.body" tag="span" scope="global">
+                  <template #overdue>
+                    <span class="text-error-400">{{
+                      t('settings.workspaceSettings.waiting.overdue')
+                    }}</span>
+                  </template>
+                </i18n-t>
               </p>
               <label class="block w-48">
                 <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                  Escalate after (minutes)
+                  {{ t('settings.workspaceSettings.waiting.escalateAfter') }}
                 </span>
                 <UInput
                   v-model.number="draft.waitingEscalationMinutes"
@@ -194,15 +241,16 @@ async function saveBudget() {
 
             <!-- Per-service running-task limit -->
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Running tasks per service</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.taskLimit.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                Cap how many tasks may run at once under one service. Starting a task over the limit
-                is refused with a clear message until a running task finishes.
+                {{ t('settings.workspaceSettings.taskLimit.body') }}
               </p>
               <label class="block w-64">
-                <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500"
-                  >Mode</span
-                >
+                <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">{{
+                  t('settings.workspaceSettings.taskLimit.mode')
+                }}</span>
                 <USelect
                   v-model="draft.taskLimitMode"
                   :items="MODES"
@@ -214,48 +262,53 @@ async function saveBudget() {
 
               <label v-if="draft.taskLimitMode === 'shared'" class="block w-48">
                 <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                  Max running tasks
+                  {{ t('settings.workspaceSettings.taskLimit.maxRunning') }}
                 </span>
                 <UInput v-model.number="draft.taskLimitShared" type="number" :min="1" size="sm" />
               </label>
 
               <div v-else-if="draft.taskLimitMode === 'per_type'" class="grid grid-cols-2 gap-3">
-                <label v-for="t in TASK_TYPES" :key="t" class="block">
+                <label v-for="taskType in TASK_TYPES" :key="taskType" class="block">
                   <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                    Max {{ t }} tasks
+                    {{ maxTaskTypeLabel(taskType) }}
                   </span>
-                  <UInput v-model.number="draft.perType[t]" type="number" :min="1" size="sm" />
+                  <UInput
+                    v-model.number="draft.perType[taskType]"
+                    type="number"
+                    :min="1"
+                    size="sm"
+                  />
                 </label>
               </div>
             </section>
 
             <!-- Agent observability -->
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Agent observability</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.observability.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                Store the complete context provided to each agent — the composed prompts, the
-                best-practice fragments folded in, and the full content of the files injected into
-                its container — so it can be inspected later in the observability view. The bodies
-                are kept for the same window as the per-call LLM telemetry. Turn off to stop storing
-                it (existing snapshots are pruned by retention).
+                {{ t('settings.workspaceSettings.observability.body') }}
               </p>
               <label class="flex items-center gap-2">
                 <USwitch v-model="draft.storeAgentContext" size="sm" />
-                <span class="text-sm text-slate-200">Store full agent context</span>
+                <span class="text-sm text-slate-200">{{
+                  t('settings.workspaceSettings.observability.toggle')
+                }}</span>
               </label>
             </section>
 
             <!-- Visual-confirmation artifact retention -->
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Screenshot retention</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.retention.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                How long to keep the UI tester’s captured screenshots and the reference design
-                images they’re reviewed against (the visual-confirmation gate). A daily cleanup job
-                deletes both the image bytes and their metadata once they age past this window.
+                {{ t('settings.workspaceSettings.retention.body') }}
               </p>
               <label class="block w-48">
                 <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                  Retention (days)
+                  {{ t('settings.workspaceSettings.retention.days') }}
                 </span>
                 <UInput
                   v-model.number="draft.artifactRetentionDays"
@@ -269,18 +322,17 @@ async function saveBudget() {
 
             <!-- Kaizen agent -->
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Kaizen agent</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.kaizen.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                After each run completes, the Kaizen agent grades how every agent step went — smooth
-                and efficient vs confused and chaotic — and recommends prompt/model improvements. A
-                prompt + agent + model combination that grades highly with no recommendations five
-                times in a row is marked verified and is no longer graded. Grading runs in the
-                background and is shown inside run details and the Kaizen screen. Set the grader's
-                model in Model Configuration (the “Kaizen” agent).
+                {{ t('settings.workspaceSettings.kaizen.body') }}
               </p>
               <label class="flex items-center gap-2">
                 <USwitch v-model="draft.kaizenEnabled" size="sm" />
-                <span class="text-sm text-slate-200">Grade agent runs with Kaizen</span>
+                <span class="text-sm text-slate-200">{{
+                  t('settings.workspaceSettings.kaizen.toggle')
+                }}</span>
               </label>
             </section>
 
@@ -292,7 +344,7 @@ async function saveBudget() {
                 :loading="saving"
                 @click="save"
               >
-                Save
+                {{ t('common.save') }}
               </UButton>
             </div>
           </div>
@@ -302,28 +354,28 @@ async function saveBudget() {
         <template #budget>
           <div class="space-y-6">
             <section class="space-y-2">
-              <h3 class="text-sm font-semibold text-slate-200">Monthly spend budget</h3>
+              <h3 class="text-sm font-semibold text-slate-200">
+                {{ t('settings.workspaceSettings.budget.heading') }}
+              </h3>
               <p class="text-[11px] text-slate-400">
-                Token usage is metered per LLM call, priced, and gated by this budget — when
-                reached, runs in this workspace pause and the board shows a warning. Leave blank to
-                inherit the built-in default (~100&nbsp;EUR/month).
+                {{ t('settings.workspaceSettings.budget.body') }}
               </p>
               <div class="grid grid-cols-2 gap-3">
                 <label class="block">
                   <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                    Monthly limit
+                    {{ t('settings.workspaceSettings.budget.monthlyLimit') }}
                   </span>
                   <UInput
                     v-model="draft.spendMonthlyLimit"
                     type="number"
                     :min="0"
-                    placeholder="Default"
+                    :placeholder="t('settings.workspaceSettings.budget.defaultPlaceholder')"
                     size="sm"
                   />
                 </label>
                 <label class="block">
                   <span class="mb-1 block text-[10px] uppercase tracking-wide text-slate-500">
-                    Currency (ISO 4217)
+                    {{ t('settings.workspaceSettings.budget.currency') }}
                   </span>
                   <UInput
                     v-model="draft.spendCurrency"
@@ -344,7 +396,7 @@ async function saveBudget() {
                 :loading="savingBudget"
                 @click="saveBudget"
               >
-                Save budget
+                {{ t('settings.workspaceSettings.budget.save') }}
               </UButton>
             </div>
           </div>

package/app/composables/api/auth.ts

@@ -5,10 +5,12 @@ import {
   logoutContract,
   meContract,
   passwordLoginContract,
+  patLoginContract,
   peekInvitationContract,
   resetPasswordContract,
   signupContract,
 } from '@cat-factory/contracts'
+import type { VcsProviderWire } from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
 /** Auth/session endpoints + the events-WebSocket ticket mint. */
@@ -27,6 +29,11 @@ export function authApi({ http, send, ws }: ApiContext) {
     passwordLogin: (body: { email: string; password: string }) =>
       send(passwordLoginContract, { pathPrefix: '/auth', body }),
 
+    // Local mode only: log in as the account a source-control PAT belongs to. `token`
+    // omitted ⇒ use the server-configured PAT (one-click); present ⇒ a pasted token.
+    patLogin: (body: { provider: VcsProviderWire; token?: string }) =>
+      send(patLoginContract, { pathPrefix: '/auth', body }),
+
     // Request a reset link. Always succeeds (204) regardless of whether the email is
     // registered, so the response can't be used to enumerate accounts.
     forgotPassword: (body: { email: string }) =>

package/app/stores/auth.ts

@@ -37,6 +37,15 @@ export const useAuthStore = defineStore(
     /** May the app render? True when auth is off, or on with a known user. */
     const isAuthenticated = computed(() => !required.value || user.value !== null)
 
+    /**
+     * Whether the SPA must show the login screen before the board. Auth-enabled deployments
+     * gate on a user as before; local mode ALSO gates (even though its API stays dev-open),
+     * because anonymous local use can't store per-user credentials — see the login flow.
+     */
+    const needsLogin = computed(
+      () => (required.value || localMode.value?.enabled === true) && user.value === null,
+    )
+
     /** Pull a token handed back in the post-login URL fragment (#token=…). */
     function consumeRedirectToken() {
       if (typeof window === 'undefined') return
@@ -62,7 +71,11 @@ export const useAuthStore = defineStore(
         return
       }
 
-      if (required.value && token.value) {
+      // Resolve a stored session into a user whenever sign-in applies — auth-enabled
+      // deployments, OR local mode (which mints real sessions via PAT/password even though
+      // its API otherwise runs dev-open). Without this, a local session wouldn't survive a
+      // reload.
+      if ((required.value || localMode.value?.enabled === true) && token.value) {
         try {
           user.value = (await api.getMe()).user
         } catch {
@@ -133,6 +146,15 @@ export const useAuthStore = defineStore(
       applySession(await api.passwordLogin(body))
     }
 
+    /**
+     * Local mode: sign in as the account a source-control PAT belongs to. `token` omitted
+     * uses the server-configured PAT (one-click); otherwise a pasted token. Resolves to the
+     * SAME canonical user as GitHub OAuth would (keyed on the provider's numeric id).
+     */
+    async function patLogin(body: { provider: 'github' | 'gitlab'; token?: string }) {
+      applySession(await api.patLogin(body))
+    }
+
     /** Request a password-reset link by email (always resolves; never reveals existence). */
     async function forgotPassword(email: string) {
       await api.forgotPassword({ email })
@@ -164,11 +186,13 @@ export const useAuthStore = defineStore(
       localMode,
       ready,
       isAuthenticated,
+      needsLogin,
       bootstrap,
       login,
       loginWithGoogle,
       signup,
       passwordLogin,
+      patLogin,
       forgotPassword,
       resetPassword,
       logout,

package/app/types/accountSettings.ts

@@ -11,4 +11,8 @@ export type {
   AccountSettingsSummary,
   AccountSettingsView,
   UpdateAccountSettingsInput,
+  ContentStorageBackend,
+  ContentStorageConfig,
+  ContentStorageSummary,
+  ContentStorageCapability,
 } from '@cat-factory/contracts'