@cat-factory/app 0.52.0 → 0.54.0

package/app/components/settings/InfrastructureBackendPicker.vue

@@ -0,0 +1,304 @@
+<script setup lang="ts">
+// ONE flat radio list per infrastructure axis — the single picker that replaces the old
+// two-step "where it runs" radio + "runner/environment backend" dropdown. Each item is a
+// concrete destination with a one-line description, so there is no more hidden second list:
+//   - execution axis → where agent containers run: the facade built-in (local Docker /
+//     Cloudflare Containers), the registered backend kinds (Kubernetes, a custom HTTP runner
+//     pool, plus any deployment-registered CUSTOM kind), and — in local mode — a low-config
+//     "Local Kubernetes (k3s)" preset.
+//   - testEnv axis   → where the Tester's ephemeral environments run: the built-in
+//     (in-container docker-compose) + the registered backend kinds.
+//
+// The backend kinds come from the workspace snapshot (`providerConnections.backendKindsFor`),
+// so a custom kind a deployment registered shows up as a first-class radio item. Selecting a
+// pool/cluster item reveals its connect form inline (driven through ProviderConnectionTab). In
+// LOCAL MODE the choice is a real per-workspace toggle (the `delegate*` settings) — but we
+// DEFER writing `delegate=true` until a connection is actually registered, so a half-configured
+// pick never routes runs to a non-existent pool. Off-local (Worker/Node) the active backend is
+// deployment/registration-driven, so the radio doesn't write the toggle — it only reveals the
+// connect forms — and a read-only "Active: …" line states what's effectively routing.
+import { computed, ref, watch } from 'vue'
+import type { ExecutionBackendKind, TestEnvBackendKind } from '@cat-factory/contracts'
+import ProviderConnectionTab from '~/components/settings/ProviderConnectionTab.vue'
+
+const props = defineProps<{ axis: 'execution' | 'testEnv' }>()
+
+const { t } = useI18n()
+const auth = useAuthStore()
+const settings = useWorkspaceSettingsStore()
+const providerConnections = useProviderConnectionsStore()
+const toast = useToast()
+
+type BackendKind = ExecutionBackendKind | TestEnvBackendKind
+// A radio item: the built-in facade runtime, one per registered backend kind (built-in +
+// custom), or the synthetic local-k3s preset. `backendKind` is the slug passed to the connect
+// tab (absent on the built-in, which means "don't delegate"); `preset` prefills the k8s form.
+interface PickerItem {
+  id: string
+  backendKind?: string
+  preset?: 'k3s'
+  label: string
+  desc: string
+}
+
+// The built-in facade runtimes carry localized labels + descriptions. i18n leaf keys are
+// spelled as literals so the typed-message-keys check stays live.
+const BUILTIN_KEYS: Record<BackendKind, { label: string; desc: string }> = {
+  'local-docker': {
+    label: 'settings.infrastructure.executionBackend.local-docker',
+    desc: 'settings.infrastructure.executionBackend.local-dockerDesc',
+  },
+  'cloudflare-containers': {
+    label: 'settings.infrastructure.executionBackend.cloudflare-containers',
+    desc: 'settings.infrastructure.executionBackend.cloudflare-containersDesc',
+  },
+  'runner-pool': {
+    label: 'settings.infrastructure.executionBackend.runner-pool',
+    desc: 'settings.infrastructure.executionBackend.runner-poolDesc',
+  },
+  'local-compose': {
+    label: 'settings.infrastructure.testEnvBackend.local-compose',
+    desc: 'settings.infrastructure.testEnvBackend.local-composeDesc',
+  },
+  'environment-provider': {
+    label: 'settings.infrastructure.testEnvBackend.environment-provider',
+    desc: 'settings.infrastructure.testEnvBackend.environment-providerDesc',
+  },
+}
+// The built-in `kubernetes` backend kind's localized label/desc, per axis.
+const KUBERNETES_KEYS: Record<'execution' | 'testEnv', { label: string; desc: string }> = {
+  execution: {
+    label: 'settings.infrastructure.executionBackend.kubernetes',
+    desc: 'settings.infrastructure.executionBackend.kubernetesDesc',
+  },
+  testEnv: {
+    label: 'settings.infrastructure.testEnvBackend.kubernetes',
+    desc: 'settings.infrastructure.testEnvBackend.kubernetesDesc',
+  },
+}
+// k3s is an execution-only preset (the env k8s config can't be reduced to low-config), so a
+// single catalog key serves it — no dead test-env keys.
+const K3S_KEYS = {
+  label: 'settings.infrastructure.executionBackend.k3s',
+  desc: 'settings.infrastructure.executionBackend.k3sDesc',
+}
+
+const cap = computed<{ available: BackendKind[]; active: BackendKind } | null>(() => {
+  const c = auth.infrastructure?.[props.axis]
+  return c ? { available: c.available as BackendKind[], active: c.active as BackendKind } : null
+})
+const isLocal = computed(() => auth.localMode?.enabled === true)
+const suggestedImage = computed(() => auth.infrastructure?.execution.suggestedExecutorImage)
+
+// The kind reached by "delegating" away from the on-machine default + its connection kind.
+const delegatedKind = computed<BackendKind>(() =>
+  props.axis === 'execution' ? 'runner-pool' : 'environment-provider',
+)
+const connectionKind = computed<'runner-pool' | 'environment'>(() =>
+  props.axis === 'execution' ? 'runner-pool' : 'environment',
+)
+// The built-in (the available option that isn't the delegated one), if this facade has one.
+const builtinKind = computed<BackendKind | null>(
+  () => cap.value?.available.find((k) => k !== delegatedKind.value) ?? null,
+)
+const connection = computed(() => providerConnections.connectionFor(connectionKind.value))
+const connectionRegistered = computed(() => !!connection.value)
+// Pool/cluster items can be configured only when the deployment supports delegation AND the
+// connect integration is enabled (not 503).
+const poolConfigurable = computed(
+  () =>
+    (cap.value?.available.includes(delegatedKind.value) ?? false) &&
+    providerConnections.isAvailable(connectionKind.value),
+)
+
+// The delegation flag is a genuine per-workspace toggle ONLY in local mode.
+const writable = computed(() => isLocal.value && (cap.value?.available.length ?? 0) > 1)
+const delegated = computed(() =>
+  props.axis === 'execution'
+    ? settings.settings.delegateAgentsToRunnerPool
+    : settings.settings.delegateTestEnvToProvider,
+)
+
+// The effective active backend (matches the prior ExecutionBackendSelector logic): local
+// mode follows the toggle; off-local the delegated backend is active when its pool is
+// registered, else the deployment default.
+const effectiveActive = computed<BackendKind | null>(() => {
+  if (!cap.value) return builtinKind.value
+  if (writable.value) return delegated.value ? delegatedKind.value : builtinKind.value
+  if (cap.value.available.includes(delegatedKind.value) && connectionRegistered.value) {
+    return delegatedKind.value
+  }
+  return cap.value.active
+})
+
+// Localized label/desc for a built-in backend kind; null for a CUSTOM kind (which uses its
+// snapshot label and has no description).
+function backendKindKeys(kind: string): { label: string; desc: string } | null {
+  if (kind === 'kubernetes') return KUBERNETES_KEYS[props.axis]
+  if (kind === 'manifest') return BUILTIN_KEYS[delegatedKind.value]
+  return null
+}
+
+// The radio item the current state maps to (an item id). A stored connection reads back as its
+// own backend-kind slug; k3s is a one-shot prefill, never re-derived.
+const derivedItem = computed<string>(() => {
+  if (effectiveActive.value === delegatedKind.value) return connection.value?.kind ?? 'kubernetes'
+  return 'builtin'
+})
+
+const selected = ref<string>(derivedItem.value)
+// Re-sync when the derived state changes (e.g. after a save/remove or a settings flip
+// elsewhere). A pending pool/k3s pick before save doesn't move `derivedItem`, so the user's
+// selection survives until a connection is registered.
+watch(derivedItem, (v) => {
+  selected.value = v
+})
+
+const items = computed<PickerItem[]>(() => {
+  const out: PickerItem[] = []
+  if (builtinKind.value) {
+    const k = BUILTIN_KEYS[builtinKind.value]
+    out.push({ id: 'builtin', label: t(k.label), desc: t(k.desc) })
+  }
+  if (poolConfigurable.value) {
+    for (const opt of providerConnections.backendKindsFor(connectionKind.value)) {
+      const keys = backendKindKeys(opt.kind)
+      out.push({
+        id: opt.kind,
+        backendKind: opt.kind,
+        label: keys ? t(keys.label) : opt.label,
+        desc: keys ? t(keys.desc) : '',
+      })
+    }
+    // The k3s low-config preset prefills the RUNNER k8s form; the env k8s config (manifest
+    // source + URL derivation) can't be reduced to low-config, so it's execution-only.
+    if (isLocal.value && props.axis === 'execution') {
+      out.push({
+        id: 'k3s',
+        backendKind: 'kubernetes',
+        preset: 'k3s',
+        label: t(K3S_KEYS.label),
+        desc: t(K3S_KEYS.desc),
+      })
+    }
+  }
+  return out
+})
+
+// The active-line label: prefer the registered connection's concrete kind over the generic
+// "delegated" label so "Active: Kubernetes cluster" reads truthfully.
+const activeLabel = computed(() => {
+  const c = connection.value
+  if (effectiveActive.value === delegatedKind.value && c?.kind) {
+    const keys = backendKindKeys(c.kind)
+    if (keys) return t(keys.label)
+    const opt = providerConnections
+      .backendKindsFor(connectionKind.value)
+      .find((o) => o.kind === c.kind)
+    return opt?.label ?? c.kind
+  }
+  const kind = effectiveActive.value
+  return kind ? t(BUILTIN_KEYS[kind].label) : ''
+})
+
+const saving = ref(false)
+
+async function setDelegate(value: boolean) {
+  saving.value = true
+  try {
+    await settings.update(
+      props.axis === 'execution'
+        ? { delegateAgentsToRunnerPool: value }
+        : { delegateTestEnvToProvider: value },
+    )
+  } catch (e) {
+    toast.add({
+      title: t('settings.infrastructure.updateFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      icon: 'i-lucide-triangle-alert',
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+
+async function select(id: string) {
+  selected.value = id
+  if (!writable.value) return // off-local: reveal the form, but don't flip a toggle.
+  if (id === 'builtin') {
+    await setDelegate(false)
+    return
+  }
+  // Pool/cluster pick: only commit delegation now if a pool is already registered; otherwise
+  // defer to onConnected so we never route to a non-existent pool (the amber hint nags).
+  if (connectionRegistered.value) await setDelegate(true)
+}
+
+// Emitted by ProviderConnectionTab after a connection is successfully registered: now it's
+// safe to activate delegation for the pending pick.
+async function onConnected() {
+  if (writable.value && selected.value !== 'builtin' && !delegated.value) await setDelegate(true)
+}
+
+// Which connect form ProviderConnectionTab should show, and the k3s prefill signal.
+const selectedItem = computed<PickerItem | undefined>(() =>
+  items.value.find((i) => i.id === selected.value),
+)
+const showConnectForm = computed(() => !!selectedItem.value?.backendKind && poolConfigurable.value)
+const selectedBackendKind = computed(() => selectedItem.value?.backendKind ?? 'manifest')
+const selectedPreset = computed(() => selectedItem.value?.preset)
+// Nag when a pool item is picked in local mode but no pool is registered to back it.
+const showRegisterHint = computed(
+  () => writable.value && selected.value !== 'builtin' && !connectionRegistered.value,
+)
+
+const labelKey = computed(() =>
+  props.axis === 'execution'
+    ? 'settings.infrastructure.executionBackend.label'
+    : 'settings.infrastructure.testEnvBackend.label',
+)
+</script>
+
+<template>
+  <section v-if="cap" class="space-y-2 rounded-lg border border-slate-700 bg-slate-900/40 p-3">
+    <h3 class="text-sm font-semibold text-slate-200">{{ t(labelKey) }}</h3>
+
+    <!-- Off-local: the active backend is deployment/registration-driven; state it plainly. -->
+    <p v-if="!writable" class="text-sm text-slate-300" :data-testid="`${axis}-backend-active`">
+      {{ t('settings.infrastructure.active', { backend: activeLabel }) }}
+    </p>
+
+    <div class="space-y-1.5" :data-testid="`${axis}-backend-options`">
+      <label v-for="item in items" :key="item.id" class="flex cursor-pointer items-start gap-2">
+        <input
+          type="radio"
+          class="mt-1"
+          :value="item.id"
+          :checked="item.id === selected"
+          :disabled="saving"
+          :data-testid="`${axis}-backend-${item.id}`"
+          @change="select(item.id)"
+        />
+        <span class="min-w-0">
+          <span class="text-sm text-slate-200">{{ item.label }}</span>
+          <span v-if="item.desc" class="block text-[11px] text-slate-400">{{ item.desc }}</span>
+        </span>
+      </label>
+    </div>
+
+    <p v-if="showRegisterHint" class="text-[11px] text-amber-300/80">
+      {{ t('settings.infrastructure.registerHint') }}
+    </p>
+
+    <!-- The connect form for the selected pool/cluster, driven through the shared tab. -->
+    <ProviderConnectionTab
+      v-if="showConnectForm"
+      :kind="connectionKind"
+      :backend-kind="selectedBackendKind"
+      :preset="selectedPreset"
+      :suggested-image="suggestedImage"
+      @connected="onConnected"
+    />
+  </section>
+</template>

package/app/components/settings/InfrastructureWindow.vue

@@ -11,8 +11,7 @@
 // backend integration is disabled (503) simply doesn't render.
 import { computed, ref, watch } from 'vue'
 import type { ProviderConnectionKind } from '~/types/providerConnections'
-import ProviderConnectionTab from '~/components/settings/ProviderConnectionTab.vue'
-import ExecutionBackendSelector from '~/components/settings/ExecutionBackendSelector.vue'
+import InfrastructureBackendPicker from '~/components/settings/InfrastructureBackendPicker.vue'
 import LocalContainerPoolSettings from '~/components/settings/LocalContainerPoolSettings.vue'
 
 const { t } = useI18n()
@@ -103,10 +102,9 @@ watch([tabs, () => store.loaded], () => {
         >
           <template #runner-pool>
             <div class="space-y-4">
-              <!-- Where agent containers run (writable in local mode; read-only elsewhere). -->
-              <ExecutionBackendSelector axis="execution" />
-              <!-- The runner-pool connect form only when that integration is enabled. -->
-              <ProviderConnectionTab v-if="store.isAvailable('runner-pool')" kind="runner-pool" />
+              <!-- One unified list of where agent containers run; the selected pool/cluster
+                   reveals its connect form inline. -->
+              <InfrastructureBackendPicker axis="execution" />
               <!-- Local mode: the warm-pool + checkout reuse ARE the host agent-container
                    runtime, so they live here rather than in a separate menu. -->
               <section v-if="isLocal" class="border-t border-slate-800 pt-4">
@@ -119,10 +117,8 @@ watch([tabs, () => store.loaded], () => {
           </template>
           <template #environment>
             <div class="space-y-4">
-              <!-- Where Tester environments run (writable in local mode; read-only elsewhere). -->
-              <ExecutionBackendSelector axis="testEnv" />
-              <!-- The environment-provider connect form only when that integration is enabled. -->
-              <ProviderConnectionTab v-if="store.isAvailable('environment')" kind="environment" />
+              <!-- One unified list of where the Tester's ephemeral environments run. -->
+              <InfrastructureBackendPicker axis="testEnv" />
             </div>
           </template>
         </UTabs>

package/app/components/settings/KubernetesRunnerForm.vue

@@ -9,6 +9,10 @@ import type { ProviderConnection } from '~/types/providerConnections'
 
 const props = defineProps<{
   connection: ProviderConnection | null
+  /** A low-config preset to seed the form with (today: local k3s). */
+  preset?: 'k3s'
+  /** The deployment's executor image, used to prefill the k3s preset's image field. */
+  suggestedImage?: string
   supportsTest: boolean
   testing: boolean
   busy: boolean
@@ -30,6 +34,7 @@ const form = reactive({
   imageUi: '',
   caCertPem: '',
   harnessPort: '',
+  insecureSkipTlsVerify: false,
 })
 const apiToken = ref('')
 
@@ -52,11 +57,28 @@ watch(
       form.imageUi = typeof k.imageUi === 'string' ? k.imageUi : ''
       form.caCertPem = typeof k.caCertPem === 'string' ? k.caCertPem : ''
       form.harnessPort = typeof k.harnessPort === 'number' ? String(k.harnessPort) : ''
+      form.insecureSkipTlsVerify = k.insecureSkipTlsVerify === true
     }
   },
   { immediate: true },
 )
 
+// Low-config k3s preset: seed the local-cluster defaults so the operator only pastes a
+// ServiceAccount token (and an image, unless the deployment surfaced one). Only seeds a
+// fresh form — never clobbers an existing connection's config on edit.
+watch(
+  () => props.preset,
+  (preset) => {
+    if (preset !== 'k3s' || props.connection) return
+    form.label = 'Local k3s'
+    form.apiServerUrl = 'https://127.0.0.1:6443'
+    form.namespace = 'cat-factory'
+    form.insecureSkipTlsVerify = true
+    if (props.suggestedImage) form.image = props.suggestedImage
+  },
+  { immediate: true },
+)
+
 const canSave = computed(
   () =>
     !!form.label.trim() &&
@@ -75,6 +97,7 @@ function buildPayload(): { config: Record<string, unknown>; secrets: Record<stri
   }
   if (form.imageUi.trim()) kubernetes.imageUi = form.imageUi.trim()
   if (form.caCertPem.trim()) kubernetes.caCertPem = form.caCertPem.trim()
+  if (form.insecureSkipTlsVerify) kubernetes.insecureSkipTlsVerify = true
   const port = Number(form.harnessPort)
   if (form.harnessPort.trim() && Number.isFinite(port)) kubernetes.harnessPort = port
   return {
@@ -156,6 +179,13 @@ function buildPayload(): { config: Record<string, unknown>; secrets: Record<stri
       />
     </UFormField>
 
+    <UFormField :help="t('settings.providerConnection.kubernetes.insecureSkipTlsVerifyHelp')">
+      <UCheckbox
+        v-model="form.insecureSkipTlsVerify"
+        :label="t('settings.providerConnection.kubernetes.insecureSkipTlsVerify')"
+      />
+    </UFormField>
+
     <UFormField
       :label="
         t('settings.providerConnection.form.optionalLabel', {

package/app/components/settings/ProviderConnectionTab.vue

@@ -13,7 +13,18 @@ import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor
 import KubernetesRunnerForm from '~/components/settings/KubernetesRunnerForm.vue'
 import KubernetesEnvironmentForm from '~/components/settings/KubernetesEnvironmentForm.vue'
 
-const props = defineProps<{ kind: ProviderConnectionKind }>()
+const props = defineProps<{
+  kind: ProviderConnectionKind
+  /** The selected backend-kind slug — chosen by the parent picker's radio, not a local
+   *  dropdown. Built-in (`manifest`/`kubernetes`) or a deployment-registered custom kind. */
+  backendKind: string
+  /** A low-config preset to prefill the Kubernetes form (today: local k3s). */
+  preset?: 'k3s'
+  /** The deployment's executor image, used to prefill the k3s preset's image field. */
+  suggestedImage?: string
+}>()
+
+const emit = defineEmits<{ connected: [] }>()
 
 const { t } = useI18n()
 const store = useProviderConnectionsStore()
@@ -31,7 +42,7 @@ const title = computed(() => t(`settings.providerConnection.kind.${props.kind}.t
 
 watch(
   () => props.kind,
-  (k) => void store.loadKind(k).then(resetDraft),
+  (k) => void store.loadKind(k, props.backendKind).then(resetDraft),
   { immediate: true },
 )
 
@@ -88,6 +99,7 @@ const canSave = computed(() => {
 function buildManifestPayload(): {
   manifest: Record<string, unknown>
   secrets: Record<string, string>
+  backendKind: string
 } | null {
   const template = descriptor.value?.manifestTemplate
   if (!template) return null
@@ -106,7 +118,9 @@ function buildManifestPayload(): {
     else providerConfig[f.key] = val
   }
   if (Object.keys(providerConfig).length) manifest.providerConfig = providerConfig
-  return { manifest, secrets }
+  // Carry the selected kind so a CUSTOM backend's flat-form save is tagged with its slug
+  // (not silently wrapped into the built-in `manifest` backend).
+  return { manifest, secrets, backendKind: props.backendKind }
 }
 
 function notifyError(title: string, e: unknown) {
@@ -146,6 +160,7 @@ async function saveNative() {
   try {
     const payload = buildManifestPayload()
     if (payload) await store.register(props.kind, payload)
+    emit('connected')
     resetDraft()
     toastSaved()
   } catch (e) {
@@ -156,6 +171,8 @@ async function saveNative() {
 }
 
 // --- Manifest-editor actions (emitted from ProviderManifestEditor) ------------------
+// Tag the raw-manifest save/test with the selected backend kind too, so a CUSTOM kind that
+// ships no flat-form template (and thus uses the raw editor) isn't mis-tagged as `manifest`.
 async function testManifest(payload: {
   manifest: Record<string, unknown>
   secrets: Record<string, string>
@@ -163,7 +180,7 @@ async function testManifest(payload: {
   testing.value = true
   testResult.value = null
   try {
-    testResult.value = await store.test(props.kind, payload)
+    testResult.value = await store.test(props.kind, { ...payload, backendKind: props.backendKind })
   } catch (e) {
     testResult.value = { ok: false, message: e instanceof Error ? e.message : String(e) }
   } finally {
@@ -177,7 +194,8 @@ async function saveManifest(payload: {
 }) {
   busy.value = true
   try {
-    await store.register(props.kind, payload)
+    await store.register(props.kind, { ...payload, backendKind: props.backendKind })
+    emit('connected')
     toastSaved()
   } catch (e) {
     notifyError(t('settings.providerConnection.toast.saveFailed'), e)
@@ -186,39 +204,18 @@ async function saveManifest(payload: {
   }
 }
 
-// --- Backend selector -----------------------------------------------------------------
-// Both infrastructure tabs can configure either the BYO manifest backend OR a native
-// Kubernetes backend (a runner cluster for runner-pool, per-PR namespaces for environment).
-// The two K8s backends have different config shapes, so each kind renders its own form.
-// Defaults to the saved connection's kind.
-const BACKEND_KINDS = ['manifest', 'kubernetes'] as const
-type BackendKind = (typeof BACKEND_KINDS)[number]
-const backendKind = ref<BackendKind>('manifest')
-const showBackendSelector = computed(() => true)
-const backendSelectorLabel = computed(() =>
-  t(
-    props.kind === 'environment'
-      ? 'settings.providerConnection.backend.environmentSelectorLabel'
-      : 'settings.providerConnection.backend.selectorLabel',
-  ),
-)
-function backendKindLabel(k: BackendKind): string {
-  if (k === 'kubernetes') return t('settings.providerConnection.backend.kubernetes')
-  return t(
-    props.kind === 'environment'
-      ? 'settings.providerConnection.backend.environmentManifest'
-      : 'settings.providerConnection.backend.manifest',
-  )
-}
-const backendKindItems = computed(() =>
-  BACKEND_KINDS.map((k) => ({ label: backendKindLabel(k), value: k })),
-)
+// --- Backend connect forms ------------------------------------------------------------
+// Which backend kind to configure (the built-in `manifest`/`kubernetes` backends or any
+// CUSTOM kind a deployment registered) is decided by the parent picker's unified radio and
+// passed in as `backendKind` — there is no longer a local dropdown here. The two K8s
+// backends have bespoke forms; every other kind (manifest + custom) uses the descriptor-
+// driven flat form / raw manifest editor. Switching the kind re-probes ONLY that kind's
+// descriptor (so a not-yet-connected custom kind's connect form renders) WITHOUT re-fetching
+// the stored connection — using `loadDescriptor` (not `loadKind`) avoids bouncing the
+// picker's selection back to the stored kind via a connection re-read.
 watch(
-  () => connection.value,
-  (c) => {
-    if (c?.kind === 'kubernetes' || c?.kind === 'manifest') backendKind.value = c.kind
-  },
-  { immediate: true },
+  () => props.backendKind,
+  (k) => void store.loadDescriptor(props.kind, k).then(resetDraft),
 )
 
 async function testConfig(payload: {
@@ -243,6 +240,7 @@ async function saveConfig(payload: {
   busy.value = true
   try {
     await store.register(props.kind, payload)
+    emit('connected')
     toastSaved()
   } catch (e) {
     notifyError(t('settings.providerConnection.toast.saveFailed'), e)
@@ -332,15 +330,12 @@ function fieldHelp(key: string): string | undefined {
       }}
     </div>
 
-    <!-- Backend selector: the BYO manifest backend or a native Kubernetes backend. -->
-    <UFormField v-if="showBackendSelector" :label="backendSelectorLabel">
-      <USelect v-model="backendKind" :items="backendKindItems" />
-    </UFormField>
-
     <!-- Native Kubernetes runner backend (runner-pool). -->
     <KubernetesRunnerForm
       v-if="kind === 'runner-pool' && backendKind === 'kubernetes'"
       :connection="connection"
+      :preset="preset"
+      :suggested-image="suggestedImage"
       :supports-test="descriptor.supportsTest"
       :testing="testing"
       :busy="busy"
@@ -440,31 +435,20 @@ function fieldHelp(key: string): string | undefined {
       </div>
     </div>
 
-    <!-- MANIFEST-driven provider: the raw JSON manifest editor. Collapsed by default — it's
-         the advanced path, needed ONLY to integrate a custom API-based scheduler. The common
-         backends (local Docker, Cloudflare Containers, Kubernetes) don't need it. -->
-    <details
+    <!-- MANIFEST-driven provider: the raw JSON manifest editor. The radio already selected
+         "custom HTTP" so it's shown expanded — no extra disclosure. -->
+    <ProviderManifestEditor
       v-else
-      class="rounded-lg border border-slate-700 bg-slate-900/40 p-3"
-      :open="!!connection"
-    >
-      <summary class="cursor-pointer text-sm font-medium text-slate-200">
-        {{ t('settings.providerConnection.advancedManifest.summary') }}
-      </summary>
-      <p class="mt-2 mb-3 text-[11px] text-slate-400">
-        {{ t('settings.providerConnection.advancedManifest.intro') }}
-      </p>
-      <ProviderManifestEditor
-        :kind="kind"
-        :saved-manifest="descriptor.savedManifest"
-        :connected="!!connection"
-        :supports-test="descriptor.supportsTest"
-        :testing="testing"
-        :busy="busy"
-        :test-result="testResult"
-        @test="testManifest"
-        @save="saveManifest"
-      />
-    </details>
+      :kind="kind"
+      :saved-manifest="descriptor.savedManifest"
+      :connected="!!connection"
+      :stored-secret-keys="connection?.secretKeys ?? []"
+      :supports-test="descriptor.supportsTest"
+      :testing="testing"
+      :busy="busy"
+      :test-result="testResult"
+      @test="testManifest"
+      @save="saveManifest"
+    />
   </div>
 </template>

package/app/components/settings/ProviderManifestEditor.vue

@@ -25,6 +25,9 @@ const props = defineProps<{
   savedManifest?: Record<string, unknown>
   /** Whether a connection already exists (drives the re-enter-secrets hint + button label). */
   connected: boolean
+  /** The secret keys already stored for this connection (names only) — shown next to the
+   *  write-only inputs so it's obvious what exists without scrolling to the summary. */
+  storedSecretKeys?: string[]
   /** Whether the provider exposes a connection test the UI can call. */
   supportsTest: boolean
   /** Bubbled-up busy state from the tab's store calls (so the editor shows loading). */
@@ -235,9 +238,22 @@ function onSave() {
       <p v-if="!secretKeys.length" class="text-[11px] text-slate-500">
         {{ t('settings.providerConnection.manifestEditor.noSecrets') }}
       </p>
-      <p v-else-if="connected" class="text-[11px] text-amber-300/80">
-        {{ t('settings.providerConnection.manifestEditor.reenterSecrets') }}
-      </p>
+      <template v-else-if="connected">
+        <p
+          v-if="storedSecretKeys && storedSecretKeys.length"
+          class="text-[11px] text-slate-400"
+          data-testid="manifest-editor-stored"
+        >
+          {{
+            t('settings.providerConnection.manifestEditor.stored', {
+              keys: storedSecretKeys.join(', '),
+            })
+          }}
+        </p>
+        <p class="text-[11px] text-amber-300/80">
+          {{ t('settings.providerConnection.manifestEditor.reenterSecrets') }}
+        </p>
+      </template>
       <UFormField v-for="key in secretKeys" :key="key" :label="key">
         <UInput
           v-model="secrets[key]"

package/app/composables/api/providerConnections.ts

@@ -51,8 +51,20 @@ const CONTRACTS = {
 /** Environment-provider + runner-pool connection endpoints (self-describe + register/test). */
 export function providerConnectionsApi({ send, ws }: ApiContext) {
   return {
-    describeProvider: (workspaceId: string, kind: ProviderConnectionKind) =>
-      send(CONTRACTS[kind].describe, { pathPrefix: ws(workspaceId) }),
+    // `backendKind` (optional) describes a REGISTERED backend that isn't connected yet, so a
+    // custom kind's connect form renders before the first connect. Omitted ⇒ the stored kind.
+    // Branch on the kind so `send` sees a single concrete contract (a union contract can't
+    // type-check the optional `queryParams`).
+    describeProvider: (workspaceId: string, kind: ProviderConnectionKind, backendKind?: string) =>
+      kind === 'environment'
+        ? send(CONTRACTS.environment.describe, {
+            pathPrefix: ws(workspaceId),
+            queryParams: { kind: backendKind },
+          })
+        : send(CONTRACTS['runner-pool'].describe, {
+            pathPrefix: ws(workspaceId),
+            queryParams: { kind: backendKind },
+          }),
 
     getProviderConnection: (workspaceId: string, kind: ProviderConnectionKind) =>
       send(CONTRACTS[kind].get, { pathPrefix: ws(workspaceId) }),
@@ -118,10 +130,11 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
 /**
  * Resolve the discriminated backend config (runner-pool OR environment) from a connect-form
  * payload: an explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the
- * manifest editor) is wrapped into the `manifest` backend kind. Both subsystems now take a
- * discriminated `config`, so the same shape serves each.
+ * flat form / manifest editor) is wrapped into the selected backend kind — `body.backendKind`
+ * (a built-in `manifest` or a registered CUSTOM slug), defaulting to `manifest`. A custom kind
+ * MUST carry its slug here, else its flat-form save would be mis-tagged as the manifest backend.
  */
 function backendConfig(body: RegisterProviderInput | TestProviderInput): Record<string, unknown> {
   if (body.config) return body.config
-  return { kind: 'manifest', manifest: body.manifest ?? {} }
+  return { kind: body.backendKind ?? 'manifest', manifest: body.manifest ?? {} }
 }

package/app/stores/providerConnections.ts

@@ -1,5 +1,6 @@
 import { defineStore } from 'pinia'
 import { computed, reactive, ref } from 'vue'
+import type { BackendKindOption } from '@cat-factory/contracts'
 import type {
   ProviderConnection,
   ProviderConnectionKind,
@@ -11,6 +12,21 @@ import { useWorkspaceStore } from '~/stores/workspace'
 
 const KINDS: ProviderConnectionKind[] = ['environment', 'runner-pool']
 
+// Built-in fallback so the connect form's backend selector works before the snapshot
+// loads (or on an older backend that doesn't advertise the kinds). The live lists come
+// from the workspace snapshot (`environmentBackendKinds` / `runnerBackendKinds`) and may
+// additionally carry a deployment's programmatically-registered CUSTOM kinds.
+const BUILTIN_BACKEND_KINDS: Record<ProviderConnectionKind, BackendKindOption[]> = {
+  environment: [
+    { kind: 'manifest', label: 'HTTP manifest' },
+    { kind: 'kubernetes', label: 'Kubernetes' },
+  ],
+  'runner-pool': [
+    { kind: 'manifest', label: 'HTTP manifest pool' },
+    { kind: 'kubernetes', label: 'Kubernetes' },
+  ],
+}
+
 interface ProviderState {
   /** null until first probed; false ⇒ integration disabled on the backend (hide it). */
   available: boolean | null
@@ -38,13 +54,35 @@ export const useProviderConnectionsStore = defineStore('providerConnections', ()
   })
   const loaded = ref(false)
   let inFlight: Promise<void> | null = null
+  // The selectable backend kinds per subsystem, fed from the workspace snapshot.
+  const backendKinds = reactive<Record<ProviderConnectionKind, BackendKindOption[]>>({
+    environment: BUILTIN_BACKEND_KINDS.environment,
+    'runner-pool': BUILTIN_BACKEND_KINDS['runner-pool'],
+  })
+
+  /** Seed the backend-kind selector lists from the workspace snapshot (built-in + custom). */
+  function registerBackendKinds(
+    payload: Partial<Record<ProviderConnectionKind, BackendKindOption[]>>,
+  ) {
+    for (const kind of KINDS) {
+      const list = payload[kind]
+      if (list && list.length > 0) backendKinds[kind] = list
+    }
+  }
+
+  /** The selectable backend kinds for a subsystem (built-in fallback until the snapshot loads). */
+  function backendKindsFor(kind: ProviderConnectionKind): BackendKindOption[] {
+    return backendKinds[kind]
+  }
 
-  async function loadKind(kind: ProviderConnectionKind) {
+  // `backendKind` (optional) re-probes the descriptor for a specific (e.g. not-yet-connected
+  // custom) backend kind, so its connect form renders before the first connect.
+  async function loadKind(kind: ProviderConnectionKind, backendKind?: string) {
     const ws = useWorkspaceStore()
     const s = state[kind]
     try {
       const [descriptor, { connection }] = await Promise.all([
-        api.describeProvider(ws.requireId(), kind),
+        api.describeProvider(ws.requireId(), kind, backendKind),
         api.getProviderConnection(ws.requireId(), kind),
       ])
       s.descriptor = descriptor
@@ -58,9 +96,24 @@ export const useProviderConnectionsStore = defineStore('providerConnections', ()
     }
   }
 
+  /**
+   * Re-probe ONLY the descriptor for a specific backend kind (e.g. a not-yet-connected
+   * custom kind the user just picked), leaving the stored connection untouched. Switching
+   * the selector must NOT re-fetch the connection: that would reassign `state.connection`
+   * and bounce the selector back to the stored kind via the component's `connection` watch.
+   */
+  async function loadDescriptor(kind: ProviderConnectionKind, backendKind?: string) {
+    const ws = useWorkspaceStore()
+    try {
+      state[kind].descriptor = await api.describeProvider(ws.requireId(), kind, backendKind)
+    } catch {
+      // Keep the existing descriptor/availability on a transient describe failure.
+    }
+  }
+
   /** Refresh both providers (used by the banner + after a save/remove). */
   async function load() {
-    await Promise.all(KINDS.map(loadKind))
+    await Promise.all(KINDS.map((k) => loadKind(k)))
     loaded.value = true
   }
 
@@ -123,11 +176,14 @@ export const useProviderConnectionsStore = defineStore('providerConnections', ()
     loaded,
     load,
     loadKind,
+    loadDescriptor,
     ensureLoaded,
     descriptorFor,
     connectionFor,
     isAvailable,
     needingConfig,
+    backendKindsFor,
+    registerBackendKinds,
     register,
     updateSecrets,
     test,

package/app/stores/workspace.ts

@@ -21,6 +21,7 @@ import { useClarityStore } from '~/stores/clarity'
 import { useBrainstormStore } from '~/stores/brainstorm'
 import { useConsensusStore } from '~/stores/consensus'
 import { useGitHubStore } from '~/stores/github'
+import { useProviderConnectionsStore } from '~/stores/providerConnections'
 
 /**
  * Owns the active workspace and bootstraps the app against the backend. On load
@@ -98,6 +99,13 @@ export const useWorkspaceStore = defineStore(
       // Merge the deployment's registered custom agent kinds into the palette catalog so a
       // proprietary kind renders as a first-class block + result view (idempotent on reload).
       useAgentsStore().registerCustomKinds(snapshot.customAgentKinds ?? [])
+      // Seed the connect form's backend-kind selectors (built-in + any custom backend a
+      // deployment registered), so a programmatically-registered env/runner backend is a
+      // first-class connect option instead of a hardcoded manifest/kubernetes list.
+      useProviderConnectionsStore().registerBackendKinds({
+        environment: snapshot.environmentBackendKinds,
+        'runner-pool': snapshot.runnerBackendKinds,
+      })
     }
 
     /** Resolve accounts + boards, then open the right board for the active account. */

package/app/types/providerConnections.ts

@@ -50,8 +50,14 @@ export interface ProviderConnection {
  */
 export interface RegisterProviderInput {
   manifest?: Record<string, unknown>
-  /** The discriminated runner-backend config (manifest pool or kubernetes). */
+  /** The discriminated runner-backend config (manifest pool, kubernetes, or a custom kind). */
   config?: Record<string, unknown>
+  /**
+   * The selected backend kind, used to wrap a bare `manifest` into the discriminated config
+   * (`{ kind, manifest }`). Defaults to `manifest`. A CUSTOM registered kind passes its slug
+   * here so the flat-form save isn't mis-tagged as the built-in manifest backend.
+   */
+  backendKind?: string
   secrets: Record<string, string>
 }
 
@@ -59,5 +65,6 @@ export interface RegisterProviderInput {
 export interface TestProviderInput {
   manifest?: Record<string, unknown>
   config?: Record<string, unknown>
+  backendKind?: string
   secrets?: Record<string, string>
 }

package/i18n/locales/en.json

@@ -1275,13 +1275,24 @@
       "executionBackend": {
         "label": "Where agents run",
         "local-docker": "Local Docker (host)",
+        "local-dockerDesc": "Run each agent in a container on this machine's Docker daemon.",
         "cloudflare-containers": "Cloudflare Containers (built-in)",
-        "runner-pool": "Self-hosted runner pool"
+        "cloudflare-containersDesc": "Run agents on Cloudflare's built-in per-run container platform.",
+        "kubernetes": "Kubernetes cluster",
+        "kubernetesDesc": "Run each agent as a pod in a Kubernetes cluster you operate.",
+        "runner-pool": "Custom runner pool (HTTP)",
+        "runner-poolDesc": "Dispatch agents to your own scheduler behind an HTTP manifest API.",
+        "k3s": "Local Kubernetes (k3s)",
+        "k3sDesc": "Prefilled for a local k3s/k3d cluster on this machine — just paste a token."
       },
       "testEnvBackend": {
         "label": "Where test environments run",
         "local-compose": "In-container docker-compose",
-        "environment-provider": "Environment provider"
+        "local-composeDesc": "Stand the Tester's dependencies up with docker-compose inside the run's container.",
+        "kubernetes": "Kubernetes cluster",
+        "kubernetesDesc": "Provision a per-PR namespace in a Kubernetes cluster you operate.",
+        "environment-provider": "Custom HTTP provider",
+        "environment-providerDesc": "Provision ephemeral environments through your own HTTP management API."
       }
     },
     "providerConnection": {
@@ -1302,13 +1313,6 @@
           "blurb": "Where the coding agents run when not using Cloudflare Containers. Choose a self-hosted runner pool (your own scheduler) or a Kubernetes cluster, then configure its endpoint and credentials."
         }
       },
-      "backend": {
-        "selectorLabel": "Runner backend",
-        "manifest": "Self-hosted pool (manifest)",
-        "kubernetes": "Kubernetes",
-        "environmentSelectorLabel": "Environment backend",
-        "environmentManifest": "Custom HTTP API (manifest)"
-      },
       "kubernetesEnv": {
         "label": "Name",
         "labelPlaceholder": "Preview cluster",
@@ -1359,6 +1363,8 @@
         "apiTokenHelp": "A bearer token with RBAC to create, get and delete pods and pods/proxy in the namespace. Stored encrypted; never shown again.",
         "caCertPem": "Cluster CA certificate (PEM)",
         "caCertPemHelp": "Paste the cluster CA bundle so the apiserver's TLS certificate verifies. Omit only for a publicly-trusted CA.",
+        "insecureSkipTlsVerify": "Skip TLS verification",
+        "insecureSkipTlsVerifyHelp": "Strongly discouraged. Disables apiserver TLS verification; use only for local k3s/kind/dev clusters.",
         "harnessPort": "Harness port"
       },
       "manifestEditor": {
@@ -1370,13 +1376,10 @@
         "schemaError": "Manifest problem: {message}",
         "secretsLabel": "Secrets",
         "noSecrets": "This manifest references no secrets.",
+        "stored": "Currently stored: {keys}",
         "reenterSecrets": "Re-enter every secret to save. Stored secrets are write-only and aren't shown.",
         "starterHint": "This is a starter example. Edit it to match your provider's API."
       },
-      "advancedManifest": {
-        "summary": "Advanced: custom API-based scheduler",
-        "intro": "Only needed to integrate a custom API-based scheduler. The common backends (local Docker, Cloudflare Containers and Kubernetes) don't need this; describe your own scheduler's HTTP API here only if you run one."
-      },
       "viewLogs": "View logs",
       "hideLogs": "Hide logs",
       "connectedAt": "Connected · {baseUrl}",

package/i18n/locales/es.json

@@ -1256,6 +1256,7 @@
         "schemaError": "Problema con el manifiesto — {message}",
         "secretsLabel": "Secretos",
         "noSecrets": "Este manifiesto no hace referencia a ningún secreto.",
+        "stored": "Almacenados actualmente: {keys}",
         "reenterSecrets": "Vuelve a introducir cada secreto para guardar: los secretos almacenados son de solo escritura y no se muestran.",
         "starterHint": "Este es un ejemplo inicial. Edítalo para que coincida con la API de tu proveedor."
       },
@@ -1283,13 +1284,6 @@
         "removed": "Conexión eliminada",
         "removeFailed": "No se pudo eliminar la conexión"
       },
-      "backend": {
-        "selectorLabel": "Backend de ejecución",
-        "manifest": "Pool autohospedado (manifiesto)",
-        "kubernetes": "Kubernetes",
-        "environmentSelectorLabel": "Backend de entorno",
-        "environmentManifest": "API HTTP personalizada (manifiesto)"
-      },
       "kubernetesEnv": {
         "label": "Nombre",
         "labelPlaceholder": "Clúster de vista previa",
@@ -1340,11 +1334,9 @@
         "apiTokenHelp": "Un token bearer con permisos RBAC para crear, obtener y eliminar pods y pods/proxy en el namespace. Se almacena cifrado; no se vuelve a mostrar.",
         "caCertPem": "Certificado CA del clúster (PEM)",
         "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
+        "insecureSkipTlsVerify": "Omitir verificación TLS",
+        "insecureSkipTlsVerifyHelp": "Muy desaconsejado. Desactiva la verificación TLS del apiserver; úsalo solo para clústeres locales k3s/kind/dev.",
         "harnessPort": "Puerto del harness"
-      },
-      "advancedManifest": {
-        "summary": "Avanzado: planificador personalizado basado en API",
-        "intro": "Solo es necesario para integrar un planificador personalizado basado en API. Los backends habituales (Docker local, Cloudflare Containers y Kubernetes) no lo necesitan; describe aquí la API HTTP de tu propio planificador solo si usas uno."
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/fr.json

@@ -1256,6 +1256,7 @@
         "schemaError": "Problème de manifeste — {message}",
         "secretsLabel": "Secrets",
         "noSecrets": "Ce manifeste ne référence aucun secret.",
+        "stored": "Actuellement stockés : {keys}",
         "reenterSecrets": "Saisissez à nouveau chaque secret pour enregistrer : les secrets stockés sont en écriture seule et ne sont pas affichés.",
         "starterHint": "Ceci est un exemple de départ. Modifiez-le pour qu'il corresponde à l'API de votre fournisseur."
       },
@@ -1283,13 +1284,6 @@
         "removed": "Connexion supprimée",
         "removeFailed": "Impossible de supprimer la connexion"
       },
-      "backend": {
-        "selectorLabel": "Backend d'exécution",
-        "manifest": "Pool auto-hébergé (manifeste)",
-        "kubernetes": "Kubernetes",
-        "environmentSelectorLabel": "Backend d'environnement",
-        "environmentManifest": "API HTTP personnalisée (manifeste)"
-      },
       "kubernetesEnv": {
         "label": "Nom",
         "labelPlaceholder": "Cluster de prévisualisation",
@@ -1340,11 +1334,9 @@
         "apiTokenHelp": "Un jeton bearer avec les droits RBAC pour créer, lire et supprimer les pods et pods/proxy dans le namespace. Stocké chiffré ; jamais réaffiché.",
         "caCertPem": "Certificat CA du cluster (PEM)",
         "caCertPemHelp": "Collez le bundle CA du cluster pour que le certificat TLS de l'apiserver soit vérifié. À omettre uniquement pour une CA publiquement approuvée.",
+        "insecureSkipTlsVerify": "Ignorer la vérification TLS",
+        "insecureSkipTlsVerifyHelp": "Fortement déconseillé. Désactive la vérification TLS de l'apiserver ; à utiliser uniquement pour des clusters locaux k3s/kind/dev.",
         "harnessPort": "Port du harness"
-      },
-      "advancedManifest": {
-        "summary": "Avancé : planificateur personnalisé basé sur une API",
-        "intro": "Nécessaire uniquement pour intégrer un planificateur personnalisé basé sur une API. Les backends courants (Docker local, Cloudflare Containers et Kubernetes) n'en ont pas besoin ; décrivez ici l'API HTTP de votre propre planificateur uniquement si vous en utilisez un."
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/pl.json

@@ -1256,6 +1256,7 @@
         "schemaError": "Problem z manifestem — {message}",
         "secretsLabel": "Sekrety",
         "noSecrets": "Ten manifest nie odwołuje się do żadnych sekretów.",
+        "stored": "Obecnie przechowywane: {keys}",
         "reenterSecrets": "Wprowadź ponownie każdy sekret, aby zapisać — przechowywane sekrety są tylko do zapisu i nie są wyświetlane.",
         "starterHint": "To jest przykład startowy. Zmodyfikuj go, aby pasował do API Twojego dostawcy."
       },
@@ -1283,13 +1284,6 @@
         "removed": "Połączenie usunięte",
         "removeFailed": "Nie udało się usunąć połączenia"
       },
-      "backend": {
-        "selectorLabel": "Backend wykonawczy",
-        "manifest": "Własny pool (manifest)",
-        "kubernetes": "Kubernetes",
-        "environmentSelectorLabel": "Backend środowiska",
-        "environmentManifest": "Własne API HTTP (manifest)"
-      },
       "kubernetesEnv": {
         "label": "Nazwa",
         "labelPlaceholder": "Klaster podglądu",
@@ -1340,11 +1334,9 @@
         "apiTokenHelp": "Token bearer z uprawnieniami RBAC do tworzenia, odczytu i usuwania podów oraz pods/proxy w namespace. Przechowywany w postaci zaszyfrowanej; nie jest ponownie pokazywany.",
         "caCertPem": "Certyfikat CA klastra (PEM)",
         "caCertPemHelp": "Wklej pakiet CA klastra, aby certyfikat TLS apiservera został zweryfikowany. Pomiń tylko dla publicznie zaufanego CA.",
+        "insecureSkipTlsVerify": "Pomiń weryfikację TLS",
+        "insecureSkipTlsVerifyHelp": "Zdecydowanie odradzane. Wyłącza weryfikację TLS apiservera; używaj tylko dla lokalnych klastrów k3s/kind/dev.",
         "harnessPort": "Port harnessa"
-      },
-      "advancedManifest": {
-        "summary": "Zaawansowane: niestandardowy harmonogram oparty na API",
-        "intro": "Potrzebne tylko do zintegrowania niestandardowego harmonogramu opartego na API. Typowe backendy (lokalny Docker, Cloudflare Containers i Kubernetes) tego nie wymagają; opisz tutaj API HTTP własnego harmonogramu tylko, jeśli go używasz."
       }
     },
     "serviceFragmentDefaults": {

package/i18n/locales/uk.json

@@ -1256,6 +1256,7 @@
         "schemaError": "Проблема з маніфестом — {message}",
         "secretsLabel": "Секрети",
         "noSecrets": "Цей маніфест не посилається на жодні секрети.",
+        "stored": "Зараз збережено: {keys}",
         "reenterSecrets": "Введіть кожен секрет повторно, щоб зберегти — збережені секрети доступні лише для запису й не показуються.",
         "starterHint": "Це початковий приклад. Відредагуйте його відповідно до API вашого постачальника."
       },
@@ -1283,13 +1284,6 @@
         "removed": "Підключення видалено",
         "removeFailed": "Не вдалося видалити підключення"
       },
-      "backend": {
-        "selectorLabel": "Бекенд виконавця",
-        "manifest": "Власний пул (маніфест)",
-        "kubernetes": "Kubernetes",
-        "environmentSelectorLabel": "Бекенд середовища",
-        "environmentManifest": "Власний HTTP API (маніфест)"
-      },
       "kubernetesEnv": {
         "label": "Назва",
         "labelPlaceholder": "Кластер попереднього перегляду",
@@ -1340,11 +1334,9 @@
         "apiTokenHelp": "Bearer-токен з правами RBAC на створення, читання та видалення подів і pods/proxy у просторі імен. Зберігається зашифрованим; більше не показується.",
         "caCertPem": "Сертифікат CA кластера (PEM)",
         "caCertPemHelp": "Вставте CA-набір кластера, щоб TLS-сертифікат apiserver проходив перевірку. Пропустіть лише для публічно довіреного CA.",
+        "insecureSkipTlsVerify": "Пропустити перевірку TLS",
+        "insecureSkipTlsVerifyHelp": "Наполегливо не рекомендується. Вимикає перевірку TLS apiserver; використовуйте лише для локальних кластерів k3s/kind/dev.",
         "harnessPort": "Порт harness"
-      },
-      "advancedManifest": {
-        "summary": "Розширено: власний планувальник на основі API",
-        "intro": "Потрібно лише для інтеграції власного планувальника на основі API. Звичайні бекенди (локальний Docker, Cloudflare Containers і Kubernetes) цього не потребують; опишіть тут HTTP API власного планувальника, лише якщо ви його використовуєте."
       }
     },
     "serviceFragmentDefaults": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.52.0",
+  "version": "0.54.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.54.0"
+    "@cat-factory/contracts": "0.56.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",

package/app/components/settings/ExecutionBackendSelector.vue

@@ -1,171 +0,0 @@
-<script setup lang="ts">
-// A clear picker for WHERE work runs, replacing the old bare "delegate to runner pool"
-// yes/no switch. It reads the deployment's available backends from the capability descriptor
-// (`auth.infrastructure`) and presents the actual options for THIS deployment:
-//   - execution axis → where agent containers run (local Docker host / Cloudflare Containers /
-//     self-hosted runner pool);
-//   - testEnv axis   → where the Tester's ephemeral environments run (in-container
-//     docker-compose / an environment provider).
-//
-// The control is WRITABLE only in local mode, where the choice is a real per-workspace toggle
-// (the `delegateAgentsToRunnerPool` / `delegateTestEnvToProvider` settings — this selector is a
-// nicer face over those existing booleans, no new persistence). On the Worker/Node facades the
-// active backend is determined by the deployment + whether a pool is registered (the Worker
-// routes to a registered pool automatically, else Cloudflare Containers), so there it renders a
-// read-only "Active: …" line instead of a control that wouldn't actually switch anything.
-import { computed, ref } from 'vue'
-import type { ExecutionBackendKind, TestEnvBackendKind } from '@cat-factory/contracts'
-
-const props = defineProps<{ axis: 'execution' | 'testEnv' }>()
-
-const { t } = useI18n()
-const auth = useAuthStore()
-const settings = useWorkspaceSettingsStore()
-const providerConnections = useProviderConnectionsStore()
-const toast = useToast()
-
-type BackendKind = ExecutionBackendKind | TestEnvBackendKind
-
-// Per-axis labels — static literal keys whose leaves mirror the contract enum values verbatim
-// (so the typed-message-keys check stays live and a dynamic lookup is total).
-const EXECUTION_LABELS: Record<ExecutionBackendKind, string> = {
-  'local-docker': 'settings.infrastructure.executionBackend.local-docker',
-  'cloudflare-containers': 'settings.infrastructure.executionBackend.cloudflare-containers',
-  'runner-pool': 'settings.infrastructure.executionBackend.runner-pool',
-}
-const TEST_ENV_LABELS: Record<TestEnvBackendKind, string> = {
-  'local-compose': 'settings.infrastructure.testEnvBackend.local-compose',
-  'environment-provider': 'settings.infrastructure.testEnvBackend.environment-provider',
-}
-
-function labelFor(kind: BackendKind): string {
-  const key =
-    props.axis === 'execution'
-      ? EXECUTION_LABELS[kind as ExecutionBackendKind]
-      : TEST_ENV_LABELS[kind as TestEnvBackendKind]
-  return t(key)
-}
-
-// Normalise to the union element type so array ops (`includes`/`find`) don't collapse to
-// `never` across the execution/testEnv discriminated union.
-const cap = computed<{ available: BackendKind[]; active: BackendKind } | null>(() => {
-  const c = auth.infrastructure?.[props.axis]
-  return c ? { available: c.available as BackendKind[], active: c.active as BackendKind } : null
-})
-const isLocal = computed(() => auth.localMode?.enabled === true)
-
-// The backend reached by "delegating" away from the on-machine default, plus the provider
-// connection that must exist for it to work.
-const delegatedKind = computed<BackendKind>(() =>
-  props.axis === 'execution' ? 'runner-pool' : 'environment-provider',
-)
-const connectionKind = computed<'runner-pool' | 'environment'>(() =>
-  props.axis === 'execution' ? 'runner-pool' : 'environment',
-)
-const delegatedRegistered = computed(
-  () => !!providerConnections.connectionFor(connectionKind.value),
-)
-
-// The on-machine / built-in default (the available option that isn't the delegated one).
-const localKind = computed<BackendKind>(
-  () =>
-    cap.value?.available.find((k) => k !== delegatedKind.value) ??
-    cap.value?.active ??
-    'local-docker',
-)
-
-// The delegation flag is a genuine per-workspace toggle ONLY in local mode; elsewhere the
-// active backend is registration/deployment-driven, so the control is read-only there.
-const writable = computed(() => isLocal.value && (cap.value?.available.length ?? 0) > 1)
-
-const delegated = computed(() =>
-  props.axis === 'execution'
-    ? settings.settings.delegateAgentsToRunnerPool
-    : settings.settings.delegateTestEnvToProvider,
-)
-
-// The effective active backend. In local mode it follows the delegation flag; otherwise the
-// delegated backend is active when its provider is registered (the Worker auto-routes to a
-// registered pool), else the deployment default from the descriptor.
-const activeKind = computed<BackendKind>(() => {
-  if (!cap.value) return localKind.value
-  if (writable.value) return delegated.value ? delegatedKind.value : localKind.value
-  if (cap.value.available.includes(delegatedKind.value) && delegatedRegistered.value) {
-    return delegatedKind.value
-  }
-  return cap.value.active
-})
-
-const saving = ref(false)
-
-async function select(kind: BackendKind) {
-  if (kind === activeKind.value) return
-  const toRunnerPool = kind === delegatedKind.value
-  saving.value = true
-  try {
-    await settings.update(
-      props.axis === 'execution'
-        ? { delegateAgentsToRunnerPool: toRunnerPool }
-        : { delegateTestEnvToProvider: toRunnerPool },
-    )
-  } catch (e) {
-    toast.add({
-      title: t('settings.infrastructure.updateFailed'),
-      description: e instanceof Error ? e.message : String(e),
-      icon: 'i-lucide-triangle-alert',
-      color: 'error',
-    })
-  } finally {
-    saving.value = false
-  }
-}
-
-const labelKey = computed(() =>
-  props.axis === 'execution'
-    ? 'settings.infrastructure.executionBackend.label'
-    : 'settings.infrastructure.testEnvBackend.label',
-)
-</script>
-
-<template>
-  <section v-if="cap" class="space-y-2 rounded-lg border border-slate-700 bg-slate-900/40 p-3">
-    <h3 class="text-sm font-semibold text-slate-200">{{ t(labelKey) }}</h3>
-
-    <!-- Local mode: a real choice the user can flip (writes the delegation setting). -->
-    <div v-if="writable" class="space-y-1.5" :data-testid="`${axis}-backend-options`">
-      <label
-        v-for="kind in cap.available"
-        :key="kind"
-        class="flex items-start gap-2"
-        :class="
-          kind === delegatedKind && !delegatedRegistered
-            ? 'cursor-not-allowed opacity-50'
-            : 'cursor-pointer'
-        "
-      >
-        <input
-          type="radio"
-          class="mt-1"
-          :value="kind"
-          :checked="kind === activeKind"
-          :disabled="saving || (kind === delegatedKind && !delegatedRegistered)"
-          @change="select(kind)"
-        />
-        <span class="min-w-0">
-          <span class="text-sm text-slate-200">{{ labelFor(kind) }}</span>
-          <span
-            v-if="kind === delegatedKind && !delegatedRegistered"
-            class="block text-[11px] text-amber-300/80"
-          >
-            {{ t('settings.infrastructure.registerHint') }}
-          </span>
-        </span>
-      </label>
-    </div>
-
-    <!-- Worker/Node: the active backend is deployment/registration-driven, not a toggle. -->
-    <p v-else class="text-sm text-slate-300" :data-testid="`${axis}-backend-active`">
-      {{ t('settings.infrastructure.active', { backend: labelFor(activeKind) }) }}
-    </p>
-  </section>
-</template>