@cat-factory/app 0.48.0 → 0.48.2

package/app/components/settings/KubernetesRunnerForm.vue

@@ -0,0 +1,205 @@
+<script setup lang="ts">
+// The Kubernetes "agent runner backend" connect form — one option of the runner-pool tab's
+// backend-type selector (the other being the manifest pool). It builds the discriminated
+// `{ kind: 'kubernetes', kubernetes }` config + the `apiToken` secret bundle and emits
+// test/save to the parent tab (which calls the shared provider-connections store).
+import { computed, reactive, ref, watch } from 'vue'
+import { KUBERNETES_RUNNER_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
+import type { ProviderConnection } from '~/types/providerConnections'
+
+const props = defineProps<{
+  connection: ProviderConnection | null
+  supportsTest: boolean
+  testing: boolean
+  busy: boolean
+  testResult: { ok: boolean; message?: string } | null
+}>()
+
+const emit = defineEmits<{
+  test: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+  save: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+}>()
+
+const { t } = useI18n()
+
+const form = reactive({
+  label: '',
+  apiServerUrl: '',
+  namespace: '',
+  image: '',
+  imageUi: '',
+  caCertPem: '',
+  harnessPort: '',
+})
+const apiToken = ref('')
+
+// A registered k8s connection exposes its non-secret config, so prefill every non-secret
+// field from it (never the token — secrets are write-only and re-entered on update). This
+// lets an edit change one field without re-typing the whole form.
+watch(
+  () => props.connection,
+  (c) => {
+    if (c?.kind !== 'kubernetes') return
+    form.label = c.label
+    form.apiServerUrl = c.baseUrl
+    const k =
+      c.config && (c.config as { kind?: string }).kind === 'kubernetes'
+        ? (c.config as { kubernetes: Record<string, unknown> }).kubernetes
+        : undefined
+    if (k) {
+      form.namespace = typeof k.namespace === 'string' ? k.namespace : ''
+      form.image = typeof k.image === 'string' ? k.image : ''
+      form.imageUi = typeof k.imageUi === 'string' ? k.imageUi : ''
+      form.caCertPem = typeof k.caCertPem === 'string' ? k.caCertPem : ''
+      form.harnessPort = typeof k.harnessPort === 'number' ? String(k.harnessPort) : ''
+    }
+  },
+  { immediate: true },
+)
+
+const canSave = computed(
+  () =>
+    !!form.label.trim() &&
+    !!form.apiServerUrl.trim() &&
+    !!form.namespace.trim() &&
+    !!form.image.trim() &&
+    !!apiToken.value.trim(),
+)
+
+function buildPayload(): { config: Record<string, unknown>; secrets: Record<string, string> } {
+  const kubernetes: Record<string, unknown> = {
+    label: form.label.trim(),
+    apiServerUrl: form.apiServerUrl.trim(),
+    namespace: form.namespace.trim(),
+    image: form.image.trim(),
+  }
+  if (form.imageUi.trim()) kubernetes.imageUi = form.imageUi.trim()
+  if (form.caCertPem.trim()) kubernetes.caCertPem = form.caCertPem.trim()
+  const port = Number(form.harnessPort)
+  if (form.harnessPort.trim() && Number.isFinite(port)) kubernetes.harnessPort = port
+  return {
+    config: { kind: 'kubernetes', kubernetes },
+    secrets: { [KUBERNETES_RUNNER_TOKEN_SECRET_KEY]: apiToken.value.trim() },
+  }
+}
+</script>
+
+<template>
+  <div class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+      {{
+        connection?.kind === 'kubernetes'
+          ? t('settings.providerConnection.form.updateConfiguration')
+          : t('settings.providerConnection.form.connect')
+      }}
+    </p>
+
+    <UFormField :label="t('settings.providerConnection.kubernetes.label')">
+      <UInput
+        v-model="form.label"
+        :placeholder="t('settings.providerConnection.kubernetes.labelPlaceholder')"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.apiServerUrl')"
+      :help="t('settings.providerConnection.kubernetes.apiServerUrlHelp')"
+    >
+      <UInput v-model="form.apiServerUrl" class="font-mono" placeholder="https://10.0.0.1:6443" />
+    </UFormField>
+
+    <UFormField :label="t('settings.providerConnection.kubernetes.namespace')">
+      <UInput v-model="form.namespace" class="font-mono" placeholder="cat-factory" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.image')"
+      :help="t('settings.providerConnection.kubernetes.imageHelp')"
+    >
+      <UInput
+        v-model="form.image"
+        class="font-mono"
+        placeholder="ghcr.io/acme/cat-factory-executor:latest"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.imageUi'),
+        })
+      "
+    >
+      <UInput v-model="form.imageUi" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.apiToken')"
+      :help="t('settings.providerConnection.kubernetes.apiTokenHelp')"
+    >
+      <UInput v-model="apiToken" type="password" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.caCertPem'),
+        })
+      "
+      :help="t('settings.providerConnection.kubernetes.caCertPemHelp')"
+    >
+      <UTextarea
+        v-model="form.caCertPem"
+        :rows="3"
+        class="font-mono"
+        placeholder="-----BEGIN CERTIFICATE-----"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.harnessPort'),
+        })
+      "
+    >
+      <UInput v-model="form.harnessPort" type="number" class="font-mono" placeholder="8080" />
+    </UFormField>
+
+    <div v-if="supportsTest" class="flex items-center gap-2">
+      <UButton
+        color="neutral"
+        variant="soft"
+        size="sm"
+        icon="i-lucide-plug-zap"
+        :loading="testing"
+        :disabled="!canSave"
+        @click="emit('test', buildPayload())"
+      >
+        {{ t('settings.providerConnection.test.button') }}
+      </UButton>
+      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
+      </span>
+      <span v-else-if="testResult" class="text-xs text-rose-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
+      </span>
+    </div>
+
+    <div class="flex justify-end">
+      <UButton
+        color="primary"
+        size="sm"
+        :loading="busy"
+        :disabled="!canSave"
+        @click="emit('save', buildPayload())"
+      >
+        {{
+          connection?.kind === 'kubernetes'
+            ? t('common.save')
+            : t('settings.providerConnection.form.connect')
+        }}
+      </UButton>
+    </div>
+  </div>
+</template>

package/app/components/settings/ProviderConnectionTab.vue

@@ -10,6 +10,7 @@ import { computed, ref, toRaw, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
+import KubernetesRunnerForm from '~/components/settings/KubernetesRunnerForm.vue'
 
 const props = defineProps<{ kind: ProviderConnectionKind }>()
 
@@ -184,6 +185,57 @@ async function saveManifest(payload: {
   }
 }
 
+// --- Runner-backend selector (runner-pool only) -------------------------------------
+// The runner-pool tab can configure either the manifest pool OR a native Kubernetes
+// cluster; environments are manifest-only. Defaults to the saved connection's kind.
+const RUNNER_BACKEND_KINDS = ['manifest', 'kubernetes'] as const
+type RunnerBackendKind = (typeof RUNNER_BACKEND_KINDS)[number]
+const backendKind = ref<RunnerBackendKind>('manifest')
+const showBackendSelector = computed(() => props.kind === 'runner-pool')
+const backendKindItems = computed(() =>
+  RUNNER_BACKEND_KINDS.map((k) => ({
+    label: t(`settings.providerConnection.backend.${k}`),
+    value: k,
+  })),
+)
+watch(
+  () => connection.value,
+  (c) => {
+    if (c?.kind === 'kubernetes' || c?.kind === 'manifest') backendKind.value = c.kind
+  },
+  { immediate: true },
+)
+
+async function testConfig(payload: {
+  config: Record<string, unknown>
+  secrets: Record<string, string>
+}) {
+  testing.value = true
+  testResult.value = null
+  try {
+    testResult.value = await store.test(props.kind, payload)
+  } catch (e) {
+    testResult.value = { ok: false, message: e instanceof Error ? e.message : String(e) }
+  } finally {
+    testing.value = false
+  }
+}
+
+async function saveConfig(payload: {
+  config: Record<string, unknown>
+  secrets: Record<string, string>
+}) {
+  busy.value = true
+  try {
+    await store.register(props.kind, payload)
+    toastSaved()
+  } catch (e) {
+    notifyError(t('settings.providerConnection.toast.saveFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
 async function remove() {
   busy.value = true
   try {
@@ -265,8 +317,31 @@ function fieldHelp(key: string): string | undefined {
       }}
     </div>
 
+    <!-- Runner-backend selector: the manifest pool or a native Kubernetes cluster. -->
+    <UFormField
+      v-if="showBackendSelector"
+      :label="t('settings.providerConnection.backend.selectorLabel')"
+    >
+      <USelect v-model="backendKind" :items="backendKindItems" />
+    </UFormField>
+
+    <!-- Native Kubernetes runner backend. -->
+    <KubernetesRunnerForm
+      v-if="showBackendSelector && backendKind === 'kubernetes'"
+      :connection="connection"
+      :supports-test="descriptor.supportsTest"
+      :testing="testing"
+      :busy="busy"
+      :test-result="testResult"
+      @test="testConfig"
+      @save="saveConfig"
+    />
+
     <!-- NATIVE provider: the friendly, descriptor-driven flat field form. -->
-    <div v-if="isNative" class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <div
+      v-else-if="isNative"
+      class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3"
+    >
       <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
         {{
           connection

package/app/composables/api/providerConnections.ts

@@ -58,9 +58,10 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       send(CONTRACTS[kind].get, { pathPrefix: ws(workspaceId) }),
 
     // The connect form builds the manifest dynamically from a server-provided scaffold, so
-    // the FE input keeps `manifest` opaque (`Record<string, unknown>`); narrow on the kind
-    // and cast to the matching per-kind contract input at this single boundary (the backend
-    // re-validates the manifest against the precise contract on receipt).
+    // the FE input keeps `manifest`/`config` opaque (`Record<string, unknown>`); narrow on
+    // the kind and cast to the matching per-kind contract input at this single boundary (the
+    // backend re-validates against the precise contract on receipt). The runner-pool provider
+    // takes a discriminated `config`; a bare `manifest` is wrapped into the manifest backend.
     registerProviderConnection: (
       workspaceId: string,
       kind: ProviderConnectionKind,
@@ -73,7 +74,10 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
           })
         : send(CONTRACTS['runner-pool'].register, {
             pathPrefix: ws(workspaceId),
-            body: body as RegisterRunnerPoolInput,
+            body: {
+              config: runnerBackendConfig(body),
+              secrets: body.secrets,
+            } as RegisterRunnerPoolInput,
           }),
 
     updateProviderSecrets: (
@@ -94,10 +98,25 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
           })
         : send(CONTRACTS['runner-pool'].test, {
             pathPrefix: ws(workspaceId),
-            body: body as TestRunnerPoolConnectionInput,
+            body: {
+              ...(body.manifest || body.config ? { config: runnerBackendConfig(body) } : {}),
+              ...(body.secrets ? { secrets: body.secrets } : {}),
+            } as TestRunnerPoolConnectionInput,
           }),
 
     deleteProviderConnection: (workspaceId: string, kind: ProviderConnectionKind) =>
       send(CONTRACTS[kind].unregister, { pathPrefix: ws(workspaceId) }),
   }
 }
+
+/**
+ * Resolve the discriminated runner-backend config from a connect-form payload: an
+ * explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the manifest
+ * editor) is wrapped into the manifest backend kind.
+ */
+function runnerBackendConfig(
+  body: RegisterProviderInput | TestProviderInput,
+): Record<string, unknown> {
+  if (body.config) return body.config
+  return { kind: 'manifest', manifest: body.manifest ?? {} }
+}

package/app/composables/useWorkspaceStream.ts

@@ -64,6 +64,11 @@ export function useWorkspaceStream() {
       // or a failed badge) without a full refresh.
       agentRuns.upsertBootstrap(event.job)
       if (event.block) board.upsert(event.block)
+    } else if (event.type === 'env-config-repair') {
+      // A provider config-repair run advanced — patch its live status/subtasks/outcome so
+      // the infrastructure-providers window's "repairing…" indicator updates in place
+      // (then flips to ok / residual issues / a failure) without a refetch. No board block.
+      agentRuns.upsertEnvConfigRepair(event.job)
     } else if (event.type === 'notification') {
       // A PR needs a merge decision, a pipeline finished, or CI gave up — patch the
       // inbox + per-block badge in place (resolved ones drop out of the inbox).

package/app/stores/agentRuns.ts

@@ -1,6 +1,12 @@
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
-import type { AgentFailure, AgentRunKind, BootstrapJob, StepSubtasks } from '~/types/domain'
+import type {
+  AgentFailure,
+  AgentRunKind,
+  BootstrapJob,
+  EnvConfigRepairJob,
+  StepSubtasks,
+} from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
 import { useExecutionStore } from '~/stores/execution'
 
@@ -45,11 +51,40 @@ export const useAgentRunsStore = defineStore('agentRuns', () => {
   /** Bootstrap runs for this workspace, newest-first. */
   const bootstrapJobs = ref<BootstrapJob[]>([])
 
+  /**
+   * Env-config-repair runs for this workspace, newest-first. These have NO board block —
+   * they're surfaced only on the infrastructure-providers window (looked up by the
+   * `repairJobId` the `bootstrapRepo` response returned), so they're held separately and
+   * NOT merged into {@link byBlock}.
+   */
+  const envConfigRepairJobs = ref<EnvConfigRepairJob[]>([])
+
   /** Replace the cached bootstrap runs with a server snapshot. */
   function hydrate(jobs: BootstrapJob[]) {
     bootstrapJobs.value = [...jobs].sort((a, b) => b.createdAt - a.createdAt)
   }
 
+  /** Replace the cached env-config-repair runs with a server snapshot. */
+  function hydrateEnvConfigRepair(jobs: EnvConfigRepairJob[]) {
+    envConfigRepairJobs.value = [...jobs].sort((a, b) => b.createdAt - a.createdAt)
+  }
+
+  /**
+   * Patch an env-config-repair run from a real-time `env-config-repair` event (or after
+   * launching one): replace it in place by id, else prepend it. Keeps the infra window's
+   * "repairing…" indicator reactive to live progress / outcome without a refetch.
+   */
+  function upsertEnvConfigRepair(job: EnvConfigRepairJob) {
+    const i = envConfigRepairJobs.value.findIndex((j) => j.id === job.id)
+    if (i >= 0) envConfigRepairJobs.value[i] = job
+    else envConfigRepairJobs.value.unshift(job)
+  }
+
+  /** Look up a single env-config-repair run by id (the infra window tracks one by `repairJobId`). */
+  function envConfigRepairById(id: string): EnvConfigRepairJob | undefined {
+    return envConfigRepairJobs.value.find((j) => j.id === id)
+  }
+
   /**
    * Patch a bootstrap run from a real-time `bootstrap` event (or after launching
    * one): replace it in place by id, else prepend it. Keeps the service card
@@ -126,5 +161,16 @@ export const useAgentRunsStore = defineStore('agentRuns', () => {
     return kind
   }
 
-  return { bootstrapJobs, hydrate, upsertBootstrap, byBlock, retry, stop }
+  return {
+    bootstrapJobs,
+    hydrate,
+    upsertBootstrap,
+    envConfigRepairJobs,
+    hydrateEnvConfigRepair,
+    upsertEnvConfigRepair,
+    envConfigRepairById,
+    byBlock,
+    retry,
+    stop,
+  }
 })

package/app/stores/workspace.ts

@@ -85,6 +85,7 @@ export const useWorkspaceStore = defineStore(
       usePipelinesStore().hydrate(snapshot.pipelines, snapshot.pipelineCatalogVersions)
       useExecutionStore().hydrate(snapshot.executions)
       useAgentRunsStore().hydrate(snapshot.bootstrapJobs ?? [])
+      useAgentRunsStore().hydrateEnvConfigRepair(snapshot.envConfigRepairJobs ?? [])
       useNotificationsStore().hydrate(snapshot.notifications ?? [])
       useMergePresetsStore().hydrate(snapshot.mergePresets ?? [])
       useWorkspaceSettingsStore().hydrate(snapshot.settings)

package/app/types/domain.ts

@@ -105,6 +105,7 @@ export type * from './fragments'
 export type * from './documents'
 export type * from './tasks'
 export type * from './bootstrap'
+export type * from './envConfigRepair'
 export type * from './github'
 export type * from './accounts'
 export type * from './notifications'

package/app/types/envConfigRepair.ts

@@ -0,0 +1,15 @@
+// ---------------------------------------------------------------------------
+// Environment-provider config-repair domain types. Mirrors the
+// `@cat-factory/contracts` env-config-repair schemas so backend payloads drop
+// straight into the Pinia store.
+//
+// A config-repair run is the durable agent fallback dispatched when mechanical
+// provider-config bootstrap can't produce a valid config: a coding agent fixes the
+// provider's config file in an existing repo and pushes the fix back, then the
+// backend re-validates. It has no board block — it's surfaced only on the
+// infrastructure-providers window that triggered it.
+// ---------------------------------------------------------------------------
+//
+// All wire shapes are sourced from @cat-factory/contracts (single source of truth).
+
+export type { EnvConfigRepairStatus, EnvConfigRepairJob } from '@cat-factory/contracts'

package/app/types/providerConnections.ts

@@ -19,12 +19,20 @@ export type ProviderConnectionKind = 'environment' | 'runner-pool'
 
 /** A workspace's provider binding, as exposed to clients (never secret values). */
 export interface ProviderConnection {
+  /** The runner-backend kind for a runner-pool connection (`manifest` | `kubernetes`). */
+  kind?: string
   providerId: string
   label: string
   baseUrl: string
   connectedAt: number
   /** Which secret/config keys are stored (names only), so the UI shows completeness. */
   secretKeys: string[]
+  /**
+   * The stored discriminated runner-backend config, sans secrets, so the connect form
+   * can prefill its non-secret fields on edit. Shape mirrors the backend
+   * `RunnerBackendConfig` ({ kind: 'manifest' | 'kubernetes', … }); kept opaque here.
+   */
+  config?: Record<string, unknown>
 }
 
 // The connect form builds the manifest dynamically from a server-provided scaffold
@@ -33,15 +41,23 @@ export interface ProviderConnection {
 // per-provider manifest contract on receipt; the composable casts to the contract input
 // type at the single `send` boundary.
 
-/** The assembled register payload (a full manifest + the write-only secret bundle). */
+/**
+ * The assembled register payload. The environment provider sends a full `manifest`.
+ * The runner-pool ("agent runner backend") provider sends a discriminated `config`
+ * ({ kind: 'manifest' | 'kubernetes', … }); for back-compat of the manifest editor it
+ * may instead send a bare `manifest`, which the composable wraps into the manifest
+ * backend config. The write-only secret bundle rides alongside.
+ */
 export interface RegisterProviderInput {
-  manifest: Record<string, unknown>
+  manifest?: Record<string, unknown>
+  /** The discriminated runner-backend config (manifest pool or kubernetes). */
+  config?: Record<string, unknown>
   secrets: Record<string, string>
 }
 
-/** The test/probe payload (manifest-driven or native), shared by both providers. */
+/** The test/probe payload (manifest-driven, native, or a discriminated runner config). */
 export interface TestProviderInput {
   manifest?: Record<string, unknown>
-  config?: Record<string, string>
+  config?: Record<string, unknown>
   secrets?: Record<string, string>
 }

package/i18n/locales/en.json

@@ -1272,10 +1272,30 @@
           "blurb": "Where the Tester agent runs against a live preview environment. Configure the per-workspace settings and credentials your provider needs."
         },
         "runner-pool": {
-          "title": "Self-hosted runner pool",
-          "blurb": "Where the coding agents run when not using Cloudflare Containers. Configure the pool scheduler endpoint and credentials."
+          "title": "Agent runner backend",
+          "blurb": "Where the coding agents run when not using Cloudflare Containers. Choose a self-hosted runner pool (your own scheduler) or a Kubernetes cluster, then configure its endpoint and credentials."
         }
       },
+      "backend": {
+        "selectorLabel": "Runner backend",
+        "manifest": "Self-hosted pool (manifest)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Name",
+        "labelPlaceholder": "Production cluster",
+        "apiServerUrl": "API server URL",
+        "apiServerUrlHelp": "The kube-apiserver root, e.g. https://10.0.0.1:6443. The orchestrator reaches each run's pod through the apiserver, so only this endpoint must be reachable.",
+        "namespace": "Namespace",
+        "image": "Executor image",
+        "imageHelp": "The executor-harness image each per-run pod runs.",
+        "imageUi": "UI-tester image",
+        "apiToken": "ServiceAccount token",
+        "apiTokenHelp": "A bearer token with RBAC to create, get and delete pods and pods/proxy in the namespace. Stored encrypted; never shown again.",
+        "caCertPem": "Cluster CA certificate (PEM)",
+        "caCertPemHelp": "Paste the cluster CA bundle so the apiserver's TLS certificate verifies. Omit only for a publicly-trusted CA.",
+        "harnessPort": "Harness port"
+      },
       "manifestEditor": {
         "title": "Provider manifest",
         "jsonLabel": "Manifest (JSON)",

package/i18n/locales/es.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "No se pudo guardar la conexión",
         "removed": "Conexión eliminada",
         "removeFailed": "No se pudo eliminar la conexión"
+      },
+      "backend": {
+        "selectorLabel": "Backend de ejecución",
+        "manifest": "Pool autohospedado (manifiesto)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nombre",
+        "labelPlaceholder": "Clúster de producción",
+        "apiServerUrl": "URL del API server",
+        "apiServerUrlHelp": "La raíz del kube-apiserver, p. ej. https://10.0.0.1:6443. El orquestador llega al pod de cada ejecución a través del apiserver, así que solo este endpoint debe ser accesible.",
+        "namespace": "Namespace",
+        "image": "Imagen del ejecutor",
+        "imageHelp": "La imagen de executor-harness que ejecuta cada pod por ejecución.",
+        "imageUi": "Imagen de tester de UI",
+        "apiToken": "Token de ServiceAccount",
+        "apiTokenHelp": "Un token bearer con permisos RBAC para crear, obtener y eliminar pods y pods/proxy en el namespace. Se almacena cifrado; no se vuelve a mostrar.",
+        "caCertPem": "Certificado CA del clúster (PEM)",
+        "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
+        "harnessPort": "Puerto del harness"
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/fr.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Impossible d'enregistrer la connexion",
         "removed": "Connexion supprimée",
         "removeFailed": "Impossible de supprimer la connexion"
+      },
+      "backend": {
+        "selectorLabel": "Backend d'exécution",
+        "manifest": "Pool auto-hébergé (manifeste)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nom",
+        "labelPlaceholder": "Cluster de production",
+        "apiServerUrl": "URL du serveur d'API",
+        "apiServerUrlHelp": "La racine du kube-apiserver, p. ex. https://10.0.0.1:6443. L'orchestrateur atteint le pod de chaque exécution via l'apiserver, donc seul ce point d'accès doit être accessible.",
+        "namespace": "Namespace",
+        "image": "Image de l'exécuteur",
+        "imageHelp": "L'image executor-harness exécutée par chaque pod d'exécution.",
+        "imageUi": "Image testeur d'UI",
+        "apiToken": "Jeton de ServiceAccount",
+        "apiTokenHelp": "Un jeton bearer avec les droits RBAC pour créer, lire et supprimer les pods et pods/proxy dans le namespace. Stocké chiffré ; jamais réaffiché.",
+        "caCertPem": "Certificat CA du cluster (PEM)",
+        "caCertPemHelp": "Collez le bundle CA du cluster pour que le certificat TLS de l'apiserver soit vérifié. À omettre uniquement pour une CA publiquement approuvée.",
+        "harnessPort": "Port du harness"
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/pl.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Nie udało się zapisać połączenia",
         "removed": "Połączenie usunięte",
         "removeFailed": "Nie udało się usunąć połączenia"
+      },
+      "backend": {
+        "selectorLabel": "Backend wykonawczy",
+        "manifest": "Własny pool (manifest)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nazwa",
+        "labelPlaceholder": "Klaster produkcyjny",
+        "apiServerUrl": "URL serwera API",
+        "apiServerUrlHelp": "Główny adres kube-apiserver, np. https://10.0.0.1:6443. Orkiestrator łączy się z podem każdego uruchomienia przez apiserver, więc tylko ten endpoint musi być osiągalny.",
+        "namespace": "Namespace",
+        "image": "Obraz wykonawcy",
+        "imageHelp": "Obraz executor-harness uruchamiany przez każdy pod uruchomienia.",
+        "imageUi": "Obraz testera UI",
+        "apiToken": "Token ServiceAccount",
+        "apiTokenHelp": "Token bearer z uprawnieniami RBAC do tworzenia, odczytu i usuwania podów oraz pods/proxy w namespace. Przechowywany w postaci zaszyfrowanej; nie jest ponownie pokazywany.",
+        "caCertPem": "Certyfikat CA klastra (PEM)",
+        "caCertPemHelp": "Wklej pakiet CA klastra, aby certyfikat TLS apiservera został zweryfikowany. Pomiń tylko dla publicznie zaufanego CA.",
+        "harnessPort": "Port harnessa"
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/uk.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Не вдалося зберегти підключення",
         "removed": "Підключення видалено",
         "removeFailed": "Не вдалося видалити підключення"
+      },
+      "backend": {
+        "selectorLabel": "Бекенд виконавця",
+        "manifest": "Власний пул (маніфест)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Назва",
+        "labelPlaceholder": "Робочий кластер",
+        "apiServerUrl": "URL сервера API",
+        "apiServerUrlHelp": "Кореневий адрес kube-apiserver, напр. https://10.0.0.1:6443. Оркестратор звертається до пода кожного запуску через apiserver, тож лише цей endpoint має бути доступним.",
+        "namespace": "Простір імен",
+        "image": "Образ виконавця",
+        "imageHelp": "Образ executor-harness, який запускає кожен под запуску.",
+        "imageUi": "Образ UI-тестувальника",
+        "apiToken": "Токен ServiceAccount",
+        "apiTokenHelp": "Bearer-токен з правами RBAC на створення, читання та видалення подів і pods/proxy у просторі імен. Зберігається зашифрованим; більше не показується.",
+        "caCertPem": "Сертифікат CA кластера (PEM)",
+        "caCertPemHelp": "Вставте CA-набір кластера, щоб TLS-сертифікат apiserver проходив перевірку. Пропустіть лише для публічно довіреного CA.",
+        "harnessPort": "Порт harness"
       }
     },
     "serviceFragmentDefaults": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.48.0",
+  "version": "0.48.2",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.46.0"
+    "@cat-factory/contracts": "0.48.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",