@cat-factory/app 0.48.1 → 0.48.3

package/app/components/documents/DocumentSourceConnectModal.vue

@@ -19,10 +19,6 @@ const connection = computed(() =>
   source.value ? documents.connectionFor(source.value) : undefined,
 )
 const connected = computed(() => connection.value !== undefined)
-// A `credentialScope: 'user'` source (e.g. Claude Design) stores a PERSONAL credential
-// keyed to the signed-in user and never shared with the workspace — surface that so a
-// member understands they're connecting their own account, not the team's.
-const isPersonal = computed(() => descriptor.value?.credentialScope === 'user')
 
 const open = computed({
   get: () => ui.documentConnect !== null,
@@ -99,17 +95,6 @@ async function disconnect() {
           {{ t('documents.connect.intro', { source: descriptor.label }) }}
         </p>
 
-        <p
-          v-if="isPersonal"
-          class="flex items-start gap-1.5 text-xs text-amber-400/90"
-          data-testid="document-source-personal-note"
-        >
-          <UIcon name="i-lucide-user" class="mt-0.5 size-3.5 shrink-0" />
-          <span>
-            {{ t('documents.connect.personalNote') }}
-          </span>
-        </p>
-
         <div class="space-y-3">
           <UFormField
             v-for="field in descriptor.credentialFields"

package/app/components/settings/KubernetesRunnerForm.vue

@@ -0,0 +1,205 @@
+<script setup lang="ts">
+// The Kubernetes "agent runner backend" connect form — one option of the runner-pool tab's
+// backend-type selector (the other being the manifest pool). It builds the discriminated
+// `{ kind: 'kubernetes', kubernetes }` config + the `apiToken` secret bundle and emits
+// test/save to the parent tab (which calls the shared provider-connections store).
+import { computed, reactive, ref, watch } from 'vue'
+import { KUBERNETES_RUNNER_TOKEN_SECRET_KEY } from '@cat-factory/contracts'
+import type { ProviderConnection } from '~/types/providerConnections'
+
+const props = defineProps<{
+  connection: ProviderConnection | null
+  supportsTest: boolean
+  testing: boolean
+  busy: boolean
+  testResult: { ok: boolean; message?: string } | null
+}>()
+
+const emit = defineEmits<{
+  test: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+  save: [payload: { config: Record<string, unknown>; secrets: Record<string, string> }]
+}>()
+
+const { t } = useI18n()
+
+const form = reactive({
+  label: '',
+  apiServerUrl: '',
+  namespace: '',
+  image: '',
+  imageUi: '',
+  caCertPem: '',
+  harnessPort: '',
+})
+const apiToken = ref('')
+
+// A registered k8s connection exposes its non-secret config, so prefill every non-secret
+// field from it (never the token — secrets are write-only and re-entered on update). This
+// lets an edit change one field without re-typing the whole form.
+watch(
+  () => props.connection,
+  (c) => {
+    if (c?.kind !== 'kubernetes') return
+    form.label = c.label
+    form.apiServerUrl = c.baseUrl
+    const k =
+      c.config && (c.config as { kind?: string }).kind === 'kubernetes'
+        ? (c.config as { kubernetes: Record<string, unknown> }).kubernetes
+        : undefined
+    if (k) {
+      form.namespace = typeof k.namespace === 'string' ? k.namespace : ''
+      form.image = typeof k.image === 'string' ? k.image : ''
+      form.imageUi = typeof k.imageUi === 'string' ? k.imageUi : ''
+      form.caCertPem = typeof k.caCertPem === 'string' ? k.caCertPem : ''
+      form.harnessPort = typeof k.harnessPort === 'number' ? String(k.harnessPort) : ''
+    }
+  },
+  { immediate: true },
+)
+
+const canSave = computed(
+  () =>
+    !!form.label.trim() &&
+    !!form.apiServerUrl.trim() &&
+    !!form.namespace.trim() &&
+    !!form.image.trim() &&
+    !!apiToken.value.trim(),
+)
+
+function buildPayload(): { config: Record<string, unknown>; secrets: Record<string, string> } {
+  const kubernetes: Record<string, unknown> = {
+    label: form.label.trim(),
+    apiServerUrl: form.apiServerUrl.trim(),
+    namespace: form.namespace.trim(),
+    image: form.image.trim(),
+  }
+  if (form.imageUi.trim()) kubernetes.imageUi = form.imageUi.trim()
+  if (form.caCertPem.trim()) kubernetes.caCertPem = form.caCertPem.trim()
+  const port = Number(form.harnessPort)
+  if (form.harnessPort.trim() && Number.isFinite(port)) kubernetes.harnessPort = port
+  return {
+    config: { kind: 'kubernetes', kubernetes },
+    secrets: { [KUBERNETES_RUNNER_TOKEN_SECRET_KEY]: apiToken.value.trim() },
+  }
+}
+</script>
+
+<template>
+  <div class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
+      {{
+        connection?.kind === 'kubernetes'
+          ? t('settings.providerConnection.form.updateConfiguration')
+          : t('settings.providerConnection.form.connect')
+      }}
+    </p>
+
+    <UFormField :label="t('settings.providerConnection.kubernetes.label')">
+      <UInput
+        v-model="form.label"
+        :placeholder="t('settings.providerConnection.kubernetes.labelPlaceholder')"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.apiServerUrl')"
+      :help="t('settings.providerConnection.kubernetes.apiServerUrlHelp')"
+    >
+      <UInput v-model="form.apiServerUrl" class="font-mono" placeholder="https://10.0.0.1:6443" />
+    </UFormField>
+
+    <UFormField :label="t('settings.providerConnection.kubernetes.namespace')">
+      <UInput v-model="form.namespace" class="font-mono" placeholder="cat-factory" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.image')"
+      :help="t('settings.providerConnection.kubernetes.imageHelp')"
+    >
+      <UInput
+        v-model="form.image"
+        class="font-mono"
+        placeholder="ghcr.io/acme/cat-factory-executor:latest"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.imageUi'),
+        })
+      "
+    >
+      <UInput v-model="form.imageUi" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="t('settings.providerConnection.kubernetes.apiToken')"
+      :help="t('settings.providerConnection.kubernetes.apiTokenHelp')"
+    >
+      <UInput v-model="apiToken" type="password" class="font-mono" />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.caCertPem'),
+        })
+      "
+      :help="t('settings.providerConnection.kubernetes.caCertPemHelp')"
+    >
+      <UTextarea
+        v-model="form.caCertPem"
+        :rows="3"
+        class="font-mono"
+        placeholder="-----BEGIN CERTIFICATE-----"
+      />
+    </UFormField>
+
+    <UFormField
+      :label="
+        t('settings.providerConnection.form.optionalLabel', {
+          label: t('settings.providerConnection.kubernetes.harnessPort'),
+        })
+      "
+    >
+      <UInput v-model="form.harnessPort" type="number" class="font-mono" placeholder="8080" />
+    </UFormField>
+
+    <div v-if="supportsTest" class="flex items-center gap-2">
+      <UButton
+        color="neutral"
+        variant="soft"
+        size="sm"
+        icon="i-lucide-plug-zap"
+        :loading="testing"
+        :disabled="!canSave"
+        @click="emit('test', buildPayload())"
+      >
+        {{ t('settings.providerConnection.test.button') }}
+      </UButton>
+      <span v-if="testResult && testResult.ok" class="text-xs text-emerald-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.ok') }}
+      </span>
+      <span v-else-if="testResult" class="text-xs text-rose-400">
+        {{ testResult.message ?? t('settings.providerConnection.test.failed') }}
+      </span>
+    </div>
+
+    <div class="flex justify-end">
+      <UButton
+        color="primary"
+        size="sm"
+        :loading="busy"
+        :disabled="!canSave"
+        @click="emit('save', buildPayload())"
+      >
+        {{
+          connection?.kind === 'kubernetes'
+            ? t('common.save')
+            : t('settings.providerConnection.form.connect')
+        }}
+      </UButton>
+    </div>
+  </div>
+</template>

package/app/components/settings/ProviderConnectionTab.vue

@@ -10,6 +10,7 @@ import { computed, ref, toRaw, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
+import KubernetesRunnerForm from '~/components/settings/KubernetesRunnerForm.vue'
 
 const props = defineProps<{ kind: ProviderConnectionKind }>()
 
@@ -184,6 +185,57 @@ async function saveManifest(payload: {
   }
 }
 
+// --- Runner-backend selector (runner-pool only) -------------------------------------
+// The runner-pool tab can configure either the manifest pool OR a native Kubernetes
+// cluster; environments are manifest-only. Defaults to the saved connection's kind.
+const RUNNER_BACKEND_KINDS = ['manifest', 'kubernetes'] as const
+type RunnerBackendKind = (typeof RUNNER_BACKEND_KINDS)[number]
+const backendKind = ref<RunnerBackendKind>('manifest')
+const showBackendSelector = computed(() => props.kind === 'runner-pool')
+const backendKindItems = computed(() =>
+  RUNNER_BACKEND_KINDS.map((k) => ({
+    label: t(`settings.providerConnection.backend.${k}`),
+    value: k,
+  })),
+)
+watch(
+  () => connection.value,
+  (c) => {
+    if (c?.kind === 'kubernetes' || c?.kind === 'manifest') backendKind.value = c.kind
+  },
+  { immediate: true },
+)
+
+async function testConfig(payload: {
+  config: Record<string, unknown>
+  secrets: Record<string, string>
+}) {
+  testing.value = true
+  testResult.value = null
+  try {
+    testResult.value = await store.test(props.kind, payload)
+  } catch (e) {
+    testResult.value = { ok: false, message: e instanceof Error ? e.message : String(e) }
+  } finally {
+    testing.value = false
+  }
+}
+
+async function saveConfig(payload: {
+  config: Record<string, unknown>
+  secrets: Record<string, string>
+}) {
+  busy.value = true
+  try {
+    await store.register(props.kind, payload)
+    toastSaved()
+  } catch (e) {
+    notifyError(t('settings.providerConnection.toast.saveFailed'), e)
+  } finally {
+    busy.value = false
+  }
+}
+
 async function remove() {
   busy.value = true
   try {
@@ -265,8 +317,31 @@ function fieldHelp(key: string): string | undefined {
       }}
     </div>
 
+    <!-- Runner-backend selector: the manifest pool or a native Kubernetes cluster. -->
+    <UFormField
+      v-if="showBackendSelector"
+      :label="t('settings.providerConnection.backend.selectorLabel')"
+    >
+      <USelect v-model="backendKind" :items="backendKindItems" />
+    </UFormField>
+
+    <!-- Native Kubernetes runner backend. -->
+    <KubernetesRunnerForm
+      v-if="showBackendSelector && backendKind === 'kubernetes'"
+      :connection="connection"
+      :supports-test="descriptor.supportsTest"
+      :testing="testing"
+      :busy="busy"
+      :test-result="testResult"
+      @test="testConfig"
+      @save="saveConfig"
+    />
+
     <!-- NATIVE provider: the friendly, descriptor-driven flat field form. -->
-    <div v-if="isNative" class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3">
+    <div
+      v-else-if="isNative"
+      class="rounded-lg border border-dashed border-slate-700 p-3 space-y-3"
+    >
       <p class="text-[11px] font-semibold uppercase tracking-wide text-slate-400">
         {{
           connection

package/app/composables/api/providerConnections.ts

@@ -58,9 +58,10 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       send(CONTRACTS[kind].get, { pathPrefix: ws(workspaceId) }),
 
     // The connect form builds the manifest dynamically from a server-provided scaffold, so
-    // the FE input keeps `manifest` opaque (`Record<string, unknown>`); narrow on the kind
-    // and cast to the matching per-kind contract input at this single boundary (the backend
-    // re-validates the manifest against the precise contract on receipt).
+    // the FE input keeps `manifest`/`config` opaque (`Record<string, unknown>`); narrow on
+    // the kind and cast to the matching per-kind contract input at this single boundary (the
+    // backend re-validates against the precise contract on receipt). The runner-pool provider
+    // takes a discriminated `config`; a bare `manifest` is wrapped into the manifest backend.
     registerProviderConnection: (
       workspaceId: string,
       kind: ProviderConnectionKind,
@@ -73,7 +74,10 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
           })
         : send(CONTRACTS['runner-pool'].register, {
             pathPrefix: ws(workspaceId),
-            body: body as RegisterRunnerPoolInput,
+            body: {
+              config: runnerBackendConfig(body),
+              secrets: body.secrets,
+            } as RegisterRunnerPoolInput,
           }),
 
     updateProviderSecrets: (
@@ -94,10 +98,25 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
           })
         : send(CONTRACTS['runner-pool'].test, {
             pathPrefix: ws(workspaceId),
-            body: body as TestRunnerPoolConnectionInput,
+            body: {
+              ...(body.manifest || body.config ? { config: runnerBackendConfig(body) } : {}),
+              ...(body.secrets ? { secrets: body.secrets } : {}),
+            } as TestRunnerPoolConnectionInput,
           }),
 
     deleteProviderConnection: (workspaceId: string, kind: ProviderConnectionKind) =>
       send(CONTRACTS[kind].unregister, { pathPrefix: ws(workspaceId) }),
   }
 }
+
+/**
+ * Resolve the discriminated runner-backend config from a connect-form payload: an
+ * explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the manifest
+ * editor) is wrapped into the manifest backend kind.
+ */
+function runnerBackendConfig(
+  body: RegisterProviderInput | TestProviderInput,
+): Record<string, unknown> {
+  if (body.config) return body.config
+  return { kind: 'manifest', manifest: body.manifest ?? {} }
+}

package/app/types/providerConnections.ts

@@ -19,12 +19,20 @@ export type ProviderConnectionKind = 'environment' | 'runner-pool'
 
 /** A workspace's provider binding, as exposed to clients (never secret values). */
 export interface ProviderConnection {
+  /** The runner-backend kind for a runner-pool connection (`manifest` | `kubernetes`). */
+  kind?: string
   providerId: string
   label: string
   baseUrl: string
   connectedAt: number
   /** Which secret/config keys are stored (names only), so the UI shows completeness. */
   secretKeys: string[]
+  /**
+   * The stored discriminated runner-backend config, sans secrets, so the connect form
+   * can prefill its non-secret fields on edit. Shape mirrors the backend
+   * `RunnerBackendConfig` ({ kind: 'manifest' | 'kubernetes', … }); kept opaque here.
+   */
+  config?: Record<string, unknown>
 }
 
 // The connect form builds the manifest dynamically from a server-provided scaffold
@@ -33,15 +41,23 @@ export interface ProviderConnection {
 // per-provider manifest contract on receipt; the composable casts to the contract input
 // type at the single `send` boundary.
 
-/** The assembled register payload (a full manifest + the write-only secret bundle). */
+/**
+ * The assembled register payload. The environment provider sends a full `manifest`.
+ * The runner-pool ("agent runner backend") provider sends a discriminated `config`
+ * ({ kind: 'manifest' | 'kubernetes', … }); for back-compat of the manifest editor it
+ * may instead send a bare `manifest`, which the composable wraps into the manifest
+ * backend config. The write-only secret bundle rides alongside.
+ */
 export interface RegisterProviderInput {
-  manifest: Record<string, unknown>
+  manifest?: Record<string, unknown>
+  /** The discriminated runner-backend config (manifest pool or kubernetes). */
+  config?: Record<string, unknown>
   secrets: Record<string, string>
 }
 
-/** The test/probe payload (manifest-driven or native), shared by both providers. */
+/** The test/probe payload (manifest-driven, native, or a discriminated runner config). */
 export interface TestProviderInput {
   manifest?: Record<string, unknown>
-  config?: Record<string, string>
+  config?: Record<string, unknown>
   secrets?: Record<string, string>
 }

package/i18n/locales/en.json

@@ -1272,10 +1272,30 @@
           "blurb": "Where the Tester agent runs against a live preview environment. Configure the per-workspace settings and credentials your provider needs."
         },
         "runner-pool": {
-          "title": "Self-hosted runner pool",
-          "blurb": "Where the coding agents run when not using Cloudflare Containers. Configure the pool scheduler endpoint and credentials."
+          "title": "Agent runner backend",
+          "blurb": "Where the coding agents run when not using Cloudflare Containers. Choose a self-hosted runner pool (your own scheduler) or a Kubernetes cluster, then configure its endpoint and credentials."
         }
       },
+      "backend": {
+        "selectorLabel": "Runner backend",
+        "manifest": "Self-hosted pool (manifest)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Name",
+        "labelPlaceholder": "Production cluster",
+        "apiServerUrl": "API server URL",
+        "apiServerUrlHelp": "The kube-apiserver root, e.g. https://10.0.0.1:6443. The orchestrator reaches each run's pod through the apiserver, so only this endpoint must be reachable.",
+        "namespace": "Namespace",
+        "image": "Executor image",
+        "imageHelp": "The executor-harness image each per-run pod runs.",
+        "imageUi": "UI-tester image",
+        "apiToken": "ServiceAccount token",
+        "apiTokenHelp": "A bearer token with RBAC to create, get and delete pods and pods/proxy in the namespace. Stored encrypted; never shown again.",
+        "caCertPem": "Cluster CA certificate (PEM)",
+        "caCertPemHelp": "Paste the cluster CA bundle so the apiserver's TLS certificate verifies. Omit only for a publicly-trusted CA.",
+        "harnessPort": "Harness port"
+      },
       "manifestEditor": {
         "title": "Provider manifest",
         "jsonLabel": "Manifest (JSON)",
@@ -2080,7 +2100,6 @@
       "title": "Connect source",
       "sourceFallback": "Source",
       "intro": "Connect {source} to import requirements, RFCs and PRDs, then spawn board structure or attach them to tasks as agent context.",
-      "personalNote": "Personal connection — this credential authenticates as you and is stored only for your account, never shared with the rest of the workspace.",
       "disconnect": "Disconnect",
       "connect": "Connect",
       "update": "Update connection",

package/i18n/locales/es.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "No se pudo guardar la conexión",
         "removed": "Conexión eliminada",
         "removeFailed": "No se pudo eliminar la conexión"
+      },
+      "backend": {
+        "selectorLabel": "Backend de ejecución",
+        "manifest": "Pool autohospedado (manifiesto)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nombre",
+        "labelPlaceholder": "Clúster de producción",
+        "apiServerUrl": "URL del API server",
+        "apiServerUrlHelp": "La raíz del kube-apiserver, p. ej. https://10.0.0.1:6443. El orquestador llega al pod de cada ejecución a través del apiserver, así que solo este endpoint debe ser accesible.",
+        "namespace": "Namespace",
+        "image": "Imagen del ejecutor",
+        "imageHelp": "La imagen de executor-harness que ejecuta cada pod por ejecución.",
+        "imageUi": "Imagen de tester de UI",
+        "apiToken": "Token de ServiceAccount",
+        "apiTokenHelp": "Un token bearer con permisos RBAC para crear, obtener y eliminar pods y pods/proxy en el namespace. Se almacena cifrado; no se vuelve a mostrar.",
+        "caCertPem": "Certificado CA del clúster (PEM)",
+        "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
+        "harnessPort": "Puerto del harness"
       }
     },
     "serviceFragmentDefaults": {
@@ -2026,7 +2046,6 @@
       "title": "Conectar fuente",
       "sourceFallback": "Fuente",
       "intro": "Conecta {source} para importar requisitos, RFC y PRD, y luego generar la estructura del tablero o adjuntarlos a las tareas como contexto para los agentes.",
-      "personalNote": "Conexión personal: esta credencial te autentica a ti y se almacena solo para tu cuenta, nunca se comparte con el resto del espacio de trabajo.",
       "disconnect": "Desconectar",
       "connect": "Conectar",
       "update": "Actualizar conexión",

package/i18n/locales/fr.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Impossible d'enregistrer la connexion",
         "removed": "Connexion supprimée",
         "removeFailed": "Impossible de supprimer la connexion"
+      },
+      "backend": {
+        "selectorLabel": "Backend d'exécution",
+        "manifest": "Pool auto-hébergé (manifeste)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nom",
+        "labelPlaceholder": "Cluster de production",
+        "apiServerUrl": "URL du serveur d'API",
+        "apiServerUrlHelp": "La racine du kube-apiserver, p. ex. https://10.0.0.1:6443. L'orchestrateur atteint le pod de chaque exécution via l'apiserver, donc seul ce point d'accès doit être accessible.",
+        "namespace": "Namespace",
+        "image": "Image de l'exécuteur",
+        "imageHelp": "L'image executor-harness exécutée par chaque pod d'exécution.",
+        "imageUi": "Image testeur d'UI",
+        "apiToken": "Jeton de ServiceAccount",
+        "apiTokenHelp": "Un jeton bearer avec les droits RBAC pour créer, lire et supprimer les pods et pods/proxy dans le namespace. Stocké chiffré ; jamais réaffiché.",
+        "caCertPem": "Certificat CA du cluster (PEM)",
+        "caCertPemHelp": "Collez le bundle CA du cluster pour que le certificat TLS de l'apiserver soit vérifié. À omettre uniquement pour une CA publiquement approuvée.",
+        "harnessPort": "Port du harness"
       }
     },
     "serviceFragmentDefaults": {
@@ -2026,7 +2046,6 @@
       "title": "Connecter une source",
       "sourceFallback": "Source",
       "intro": "Connectez {source} pour importer des exigences, des RFC et des PRD, puis générer la structure du tableau ou les joindre aux tâches comme contexte pour les agents.",
-      "personalNote": "Connexion personnelle : cet identifiant vous authentifie et n'est stocké que pour votre compte, jamais partagé avec le reste de l'espace de travail.",
       "disconnect": "Déconnecter",
       "connect": "Connecter",
       "update": "Mettre à jour la connexion",

package/i18n/locales/pl.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Nie udało się zapisać połączenia",
         "removed": "Połączenie usunięte",
         "removeFailed": "Nie udało się usunąć połączenia"
+      },
+      "backend": {
+        "selectorLabel": "Backend wykonawczy",
+        "manifest": "Własny pool (manifest)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Nazwa",
+        "labelPlaceholder": "Klaster produkcyjny",
+        "apiServerUrl": "URL serwera API",
+        "apiServerUrlHelp": "Główny adres kube-apiserver, np. https://10.0.0.1:6443. Orkiestrator łączy się z podem każdego uruchomienia przez apiserver, więc tylko ten endpoint musi być osiągalny.",
+        "namespace": "Namespace",
+        "image": "Obraz wykonawcy",
+        "imageHelp": "Obraz executor-harness uruchamiany przez każdy pod uruchomienia.",
+        "imageUi": "Obraz testera UI",
+        "apiToken": "Token ServiceAccount",
+        "apiTokenHelp": "Token bearer z uprawnieniami RBAC do tworzenia, odczytu i usuwania podów oraz pods/proxy w namespace. Przechowywany w postaci zaszyfrowanej; nie jest ponownie pokazywany.",
+        "caCertPem": "Certyfikat CA klastra (PEM)",
+        "caCertPemHelp": "Wklej pakiet CA klastra, aby certyfikat TLS apiservera został zweryfikowany. Pomiń tylko dla publicznie zaufanego CA.",
+        "harnessPort": "Port harnessa"
       }
     },
     "serviceFragmentDefaults": {
@@ -2026,7 +2046,6 @@
       "title": "Połącz źródło",
       "sourceFallback": "Źródło",
       "intro": "Połącz {source}, aby importować wymagania, dokumenty RFC i PRD, a następnie utworzyć strukturę tablicy lub dołączyć je do zadań jako kontekst dla agentów.",
-      "personalNote": "Połączenie osobiste: te poświadczenia uwierzytelniają Ciebie i są przechowywane tylko dla Twojego konta, nigdy nie są udostępniane reszcie obszaru roboczego.",
       "disconnect": "Rozłącz",
       "connect": "Połącz",
       "update": "Zaktualizuj połączenie",

package/i18n/locales/uk.json

@@ -1283,6 +1283,26 @@
         "saveFailed": "Не вдалося зберегти підключення",
         "removed": "Підключення видалено",
         "removeFailed": "Не вдалося видалити підключення"
+      },
+      "backend": {
+        "selectorLabel": "Бекенд виконавця",
+        "manifest": "Власний пул (маніфест)",
+        "kubernetes": "Kubernetes"
+      },
+      "kubernetes": {
+        "label": "Назва",
+        "labelPlaceholder": "Робочий кластер",
+        "apiServerUrl": "URL сервера API",
+        "apiServerUrlHelp": "Кореневий адрес kube-apiserver, напр. https://10.0.0.1:6443. Оркестратор звертається до пода кожного запуску через apiserver, тож лише цей endpoint має бути доступним.",
+        "namespace": "Простір імен",
+        "image": "Образ виконавця",
+        "imageHelp": "Образ executor-harness, який запускає кожен под запуску.",
+        "imageUi": "Образ UI-тестувальника",
+        "apiToken": "Токен ServiceAccount",
+        "apiTokenHelp": "Bearer-токен з правами RBAC на створення, читання та видалення подів і pods/proxy у просторі імен. Зберігається зашифрованим; більше не показується.",
+        "caCertPem": "Сертифікат CA кластера (PEM)",
+        "caCertPemHelp": "Вставте CA-набір кластера, щоб TLS-сертифікат apiserver проходив перевірку. Пропустіть лише для публічно довіреного CA.",
+        "harnessPort": "Порт harness"
       }
     },
     "serviceFragmentDefaults": {
@@ -2026,7 +2046,6 @@
       "title": "Підключити джерело",
       "sourceFallback": "Джерело",
       "intro": "Підключіть {source}, щоб імпортувати вимоги, RFC та PRD, а потім створити структуру дошки або долучити їх до завдань як контекст для агентів.",
-      "personalNote": "Особисте підключення: ці облікові дані автентифікують саме вас і зберігаються лише для вашого облікового запису, ніколи не передаються решті робочого простору.",
       "disconnect": "Відключити",
       "connect": "Підключити",
       "update": "Оновити підключення",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.48.1",
+  "version": "0.48.3",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.47.0"
+    "@cat-factory/contracts": "0.49.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",