@cat-factory/app 0.58.4 → 0.59.0

package/app/components/auth/LoginScreen.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { computed, ref } from 'vue'
+import { computed, ref, watch } from 'vue'
 import { apiErrorEnvelope } from '~/composables/api/errors'
 
 const auth = useAuthStore()
@@ -123,6 +123,51 @@ function setMode(next: 'login' | 'signup' | 'forgot') {
 const showOAuthDivider = computed(
   () => auth.providers.password && (auth.providers.github || auth.providers.google),
 )
+
+// Hosted (remote node) PAT login: the user pastes their OWN source-control PAT, which the
+// server resolves to an account and holds to its login/org/domain allowlist. The available
+// providers come from the server (`auth.patProviders`); empty in local mode (which uses the
+// configured-token flow above) and on OAuth-only facades like the Worker.
+const remotePatProviders = computed<PatProvider[]>(() =>
+  isLocalMode.value ? [] : (auth.patProviders as PatProvider[]),
+)
+const remotePatProvider = ref<PatProvider>('github')
+watch(
+  remotePatProviders,
+  (list) => {
+    if (list.length && !list.includes(remotePatProvider.value)) remotePatProvider.value = list[0]!
+  },
+  { immediate: true },
+)
+const remotePatToken = ref('')
+const remotePatBusy = ref(false)
+const remotePatError = ref<string | null>(null)
+
+async function submitRemotePat() {
+  remotePatError.value = null
+  remotePatBusy.value = true
+  try {
+    await auth.patLogin({ provider: remotePatProvider.value, token: remotePatToken.value.trim() })
+    if (typeof window !== 'undefined') window.location.assign(window.location.pathname)
+  } catch (e) {
+    remotePatError.value = apiErrorEnvelope(e)?.message ?? t('auth.login.signInFailed')
+  } finally {
+    remotePatBusy.value = false
+  }
+}
+
+// A remote deployment (node service / Worker) that advertises no sign-in method at all:
+// no OAuth, no password, no PAT, and not local mode. The auth gate still routes here (a
+// remote facade has no anonymous tier), so instead of a blank card we explain that
+// authentication isn't configured and there's nothing to sign in with yet.
+const noSignInMethod = computed(
+  () =>
+    !isLocalMode.value &&
+    !auth.providers.github &&
+    !auth.providers.google &&
+    !auth.providers.password &&
+    remotePatProviders.value.length === 0,
+)
 </script>
 
 <template>
@@ -296,6 +341,76 @@ const showOAuthDivider = computed(
         </p>
       </form>
 
+      <!-- Hosted (remote node) PAT login: paste your own source-control PAT -->
+      <template v-if="remotePatProviders.length > 0 && mode !== 'forgot'">
+        <div
+          v-if="auth.providers.github || auth.providers.google || auth.providers.password"
+          class="my-4 flex items-center gap-3 text-xs text-slate-500"
+        >
+          <span class="h-px flex-1 bg-slate-800" /> {{ t('auth.login.or') }}
+          <span class="h-px flex-1 bg-slate-800" />
+        </div>
+        <form class="space-y-3" @submit.prevent="submitRemotePat">
+          <div v-if="remotePatProviders.length > 1" class="flex gap-2">
+            <UButton
+              v-for="p in remotePatProviders"
+              :key="p"
+              :color="p === remotePatProvider ? 'primary' : 'neutral'"
+              :variant="p === remotePatProvider ? 'solid' : 'subtle'"
+              :icon="PROVIDER_ICONS[p]"
+              size="sm"
+              @click="remotePatProvider = p"
+            >
+              {{ PROVIDER_LABELS[p] }}
+            </UButton>
+          </div>
+          <UInput
+            v-model="remotePatToken"
+            type="password"
+            required
+            :placeholder="
+              t('auth.login.patPlaceholder', { provider: PROVIDER_LABELS[remotePatProvider] })
+            "
+            icon="i-lucide-key-round"
+            size="lg"
+            class="w-full"
+          />
+          <p v-if="remotePatError" class="text-sm text-rose-400">{{ remotePatError }}</p>
+          <UButton
+            block
+            size="lg"
+            color="primary"
+            type="submit"
+            :icon="PROVIDER_ICONS[remotePatProvider]"
+            :loading="remotePatBusy"
+          >
+            {{ t('auth.login.signInWithPat', { provider: PROVIDER_LABELS[remotePatProvider] }) }}
+          </UButton>
+          <p class="px-1 text-center">
+            <a
+              :href="tokenCreateUrl(remotePatProvider)"
+              target="_blank"
+              rel="noopener noreferrer"
+              class="text-xs text-indigo-400 hover:underline"
+            >
+              {{
+                t('auth.localMode.createToken', { provider: PROVIDER_LABELS[remotePatProvider] })
+              }}
+            </a>
+          </p>
+        </form>
+      </template>
+
+      <!-- No sign-in method configured on a remote deployment: explain, don't show a blank card -->
+      <UAlert
+        v-if="noSignInMethod"
+        color="warning"
+        variant="subtle"
+        icon="i-lucide-shield-alert"
+        :title="t('auth.login.notConfiguredTitle')"
+        :description="t('auth.login.notConfiguredBody')"
+      />
+
       <!-- Forgot password: request a reset link by email -->
       <form
         v-if="auth.providers.password && mode === 'forgot'"

package/app/components/panels/inspector/ServiceTestConfig.vue

@@ -1,14 +1,14 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue'
-import type { Block, CloudProvider, InstanceSize } from '~/types/domain'
+import type { Block, CloudProvider, InstanceSize, ProvisionType } from '~/types/domain'
 import RepoTreeBrowser from '~/components/github/RepoTreeBrowser.vue'
 
-// Service-level (frame) configuration: where the Tester's local-mode infra comes
-// from (a docker-compose path, or an explicit "no infra dependencies" toggle — a
-// Tester pipeline can't start until one is set), plus the cloud provider + instance
-// size the service's container jobs run on. Autodiscovery suggests a compose path
-// when the service is added; it can be set/changed here later — or browsed for in
-// the backing repository.
+// Service-level (frame) configuration: the service-owned PROVISIONING — the provision
+// TYPE this service produces (`infraless` / `docker-compose` / `kubernetes` / `custom`)
+// plus, for docker-compose, the in-repo compose path the Tester stands up — and the
+// cloud provider + instance size the service's container jobs run on. The WORKSPACE
+// configures HOW each type is handled (the engine + connection), so this view only owns
+// the "what + where". Autodiscovery suggests a compose path when the service is added.
 const props = defineProps<{
   block: Block
   // Repo backing this service, supplied by the add-service modal when the block is
@@ -22,33 +22,33 @@ const github = useGitHubStore()
 const services = useServicesStore()
 const { t } = useI18n()
 
-const composePath = computed(() => props.block.testComposePath ?? '')
-const noInfra = computed(() => props.block.noInfraDependencies === true)
+// The service's declared provision type (absent ⇒ treated as `infraless`: no environment
+// is stood up for the Tester). Switching type preserves the compose path so toggling away
+// and back doesn't lose it.
+const provisionType = computed<ProvisionType>(() => props.block.provisioning?.type ?? 'infraless')
+const composePath = computed(() => props.block.provisioning?.composePath ?? '')
+
+const PROVISION_TYPES = computed<{ value: ProvisionType; label: string }[]>(() => [
+  { value: 'infraless', label: t('inspector.testConfig.provisionTypes.infraless') },
+  { value: 'docker-compose', label: t('inspector.testConfig.provisionTypes.docker-compose') },
+  { value: 'kubernetes', label: t('inspector.testConfig.provisionTypes.kubernetes') },
+  { value: 'custom', label: t('inspector.testConfig.provisionTypes.custom') },
+])
 
-// The default test environment a task under this service is spawned with. `local`
-// stands the dependencies up via docker-compose (or "no infra"); `ephemeral` runs
-// against a provisioned environment. A task can override it per-task in its agent
-// settings. Absent ⇒ the built-in `ephemeral`.
-type TestEnvironment = 'local' | 'ephemeral'
-const TEST_ENVIRONMENTS = computed<{ value: TestEnvironment; label: string; hint: string }[]>(
-  () => [
-    {
-      value: 'ephemeral',
-      label: t('inspector.testConfig.env.ephemeral'),
-      hint: t('inspector.testConfig.env.ephemeralHint'),
-    },
-    {
-      value: 'local',
-      label: t('inspector.testConfig.env.local'),
-      hint: t('inspector.testConfig.env.localHint'),
+function setProvisionType(type: ProvisionType) {
+  // Carry the compose path across a switch so it isn't lost when toggling type.
+  board.updateBlock(props.block.id, {
+    provisioning: {
+      type,
+      ...(type === 'docker-compose' && composePath.value ? { composePath: composePath.value } : {}),
     },
-  ],
-)
-const effectiveTestEnv = computed<TestEnvironment>(
-  () => props.block.defaultTestEnvironment ?? 'ephemeral',
-)
-function setDefaultTestEnv(value: TestEnvironment) {
-  board.updateBlock(props.block.id, { defaultTestEnvironment: value })
+  })
+}
+
+function setComposePath(value: string) {
+  board.updateBlock(props.block.id, {
+    provisioning: { type: 'docker-compose', composePath: value.trim() },
+  })
 }
 
 // The provisioning hints (cloud provider + instance size) are advisory inputs to the
@@ -86,13 +86,6 @@ const effectiveProvider = computed<CloudProvider>(
   () => props.block.cloudProvider ?? accounts.activeAccount?.defaultCloudProvider ?? 'cloudflare',
 )
 
-function setComposePath(value: string) {
-  board.updateBlock(props.block.id, { testComposePath: value.trim() })
-}
-function toggleNoInfra(value: boolean) {
-  board.updateBlock(props.block.id, { noInfraDependencies: value })
-}
-
 const PROVIDERS = computed<{ value: CloudProvider; label: string }[]>(() => [
   { value: 'cloudflare', label: 'Cloudflare' },
   { value: 'docker', label: t('inspector.testConfig.providers.docker') },
@@ -114,8 +107,6 @@ function setProvider(value: CloudProvider) {
 function setSize(value: InstanceSize) {
   board.updateBlock(props.block.id, { instanceSize: value })
 }
-
-const missingInfra = computed(() => !noInfra.value && composePath.value.trim() === '')
 </script>
 
 <template>
@@ -125,26 +116,25 @@ const missingInfra = computed(() => !noInfra.value && composePath.value.trim() =
     </div>
 
     <div class="space-y-1">
-      <span class="text-[11px] text-slate-400">{{ t('inspector.testConfig.defaultEnv') }}</span>
+      <span class="text-[11px] text-slate-400">{{ t('inspector.testConfig.provisionType') }}</span>
       <div class="flex flex-wrap gap-1">
         <UButton
-          v-for="e in TEST_ENVIRONMENTS"
-          :key="e.value"
-          :color="effectiveTestEnv === e.value ? 'primary' : 'neutral'"
-          :variant="effectiveTestEnv === e.value ? 'soft' : 'ghost'"
+          v-for="p in PROVISION_TYPES"
+          :key="p.value"
+          :color="provisionType === p.value ? 'primary' : 'neutral'"
+          :variant="provisionType === p.value ? 'soft' : 'ghost'"
           size="xs"
-          :title="e.hint"
-          @click="setDefaultTestEnv(e.value)"
+          @click="setProvisionType(p.value)"
         >
-          {{ e.label }}
+          {{ p.label }}
         </UButton>
       </div>
       <p class="text-[11px] leading-snug text-slate-500">
-        {{ t('inspector.testConfig.defaultEnvHint') }}
+        {{ t('inspector.testConfig.provisionTypeHint') }}
       </p>
     </div>
 
-    <div class="space-y-1">
+    <div v-if="provisionType === 'docker-compose'" class="space-y-1">
       <label class="text-[11px] text-slate-400">{{ t('inspector.testConfig.composePath') }}</label>
       <div class="flex items-center gap-1">
         <UInput
@@ -152,7 +142,6 @@ const missingInfra = computed(() => !noInfra.value && composePath.value.trim() =
           size="xs"
           class="flex-1"
           placeholder="docker-compose.yml"
-          :disabled="noInfra"
           @blur="(e: FocusEvent) => setComposePath((e.target as HTMLInputElement).value)"
           @keydown.enter="
             (e: KeyboardEvent) => setComposePath((e.target as HTMLInputElement).value)
@@ -164,7 +153,6 @@ const missingInfra = computed(() => !noInfra.value && composePath.value.trim() =
           variant="soft"
           color="neutral"
           icon="i-lucide-folder-search"
-          :disabled="noInfra"
           :title="t('inspector.testConfig.browseRepo')"
           @click="openBrowse"
         />
@@ -205,18 +193,6 @@ const missingInfra = computed(() => !noInfra.value && composePath.value.trim() =
       </template>
     </UModal>
 
-    <label class="flex items-center gap-2 text-[11px] text-slate-400">
-      <UCheckbox
-        :model-value="noInfra"
-        @update:model-value="(v: boolean | 'indeterminate') => toggleNoInfra(v === true)"
-      />
-      {{ t('inspector.testConfig.noInfra') }}
-    </label>
-
-    <p v-if="missingInfra" class="text-[11px] leading-snug text-amber-500">
-      {{ t('inspector.testConfig.missingInfra') }}
-    </p>
-
     <!-- Provisioning hints: advisory inputs to the ephemeral-environment provisioner.
          Collapsed by default — most services never tune them. -->
     <div class="border-t border-slate-800 pt-2">

package/app/components/panels/inspector/TaskAgentConfig.vue

@@ -5,7 +5,7 @@ import { useAgentConfigStore } from '~/stores/agentConfig'
 import { useExecutionStore } from '~/stores/execution'
 
 // Task-level configuration contributed by the agents in this task's selected
-// pipeline (e.g. the Tester's environment: local vs ephemeral). Each value is
+// pipeline (e.g. the Playwright agent's e2e target: CI vs ephemeral). Each value is
 // editable until its contributing agent's step starts, then it freezes (the run is
 // already consuming it). Persisted as a sparse id→value map on the block.
 const props = defineProps<{ block: Block }>()
@@ -30,33 +30,6 @@ const descriptors = computed(() => {
 
 const run = computed(() => execution.getByBlock(props.block.id))
 
-// The Tester's environment descriptor inherits its default from the service frame this
-// task lives under (set in the service inspector); a task only overrides it by clicking.
-// Walk up the parent chain (frame → module → task) to find that default.
-const serviceDefaultTestEnv = computed<'local' | 'ephemeral' | undefined>(() => {
-  let cur: Block | undefined = props.block
-  for (let i = 0; i < 8 && cur; i++) {
-    if (cur.level === 'frame') return cur.defaultTestEnvironment
-    if (!cur.parentId) break
-    cur = board.getBlock(cur.parentId)
-  }
-  return undefined
-})
-
-/** The effective default for a descriptor — the inherited service value for the Tester's
- *  environment, otherwise the descriptor's own static default. */
-function effectiveDefault(d: { id: string; default: string }): string {
-  if (d.id === 'tester.environment' && serviceDefaultTestEnv.value) {
-    return serviceDefaultTestEnv.value
-  }
-  return d.default
-}
-
-/** Whether a descriptor's shown value is inherited (not explicitly pinned on this task). */
-function isInherited(d: { id: string }): boolean {
-  return d.id === 'tester.environment' && props.block.agentConfig?.[d.id] === undefined
-}
-
 /** A descriptor freezes once its contributing agent's step has left `pending`. */
 function isFrozen(agentKind: string): boolean {
   const steps = run.value?.steps
@@ -84,9 +57,6 @@ function setValue(id: string, value: string) {
       <div class="flex items-center justify-between">
         <span class="text-[11px] text-slate-400">{{ d.label }}</span>
         <div class="flex items-center gap-1.5">
-          <span v-if="isInherited(d)" class="text-[10px] text-slate-500">{{
-            t('inspector.agentConfig.inherited')
-          }}</span>
           <UIcon
             v-if="isFrozen(d.agentKind)"
             name="i-lucide-lock"
@@ -99,8 +69,8 @@ function setValue(id: string, value: string) {
         <UButton
           v-for="opt in d.options"
           :key="opt.value"
-          :color="valueOf(d.id, effectiveDefault(d)) === opt.value ? 'primary' : 'neutral'"
-          :variant="valueOf(d.id, effectiveDefault(d)) === opt.value ? 'soft' : 'ghost'"
+          :color="valueOf(d.id, d.default) === opt.value ? 'primary' : 'neutral'"
+          :variant="valueOf(d.id, d.default) === opt.value ? 'soft' : 'ghost'"
           size="xs"
           :disabled="isFrozen(d.agentKind)"
           @click="setValue(d.id, opt.value)"

package/app/components/settings/InfrastructureBackendPicker.vue

@@ -117,12 +117,18 @@ const poolConfigurable = computed(
     providerConnections.isAvailable(connectionKind.value),
 )
 
-// The delegation flag is a genuine per-workspace toggle ONLY in local mode.
-const writable = computed(() => isLocal.value && (cap.value?.available.length ?? 0) > 1)
+// The delegation flag is a genuine per-workspace toggle ONLY in local mode, and ONLY on the
+// execution axis: the Tester's environment is now driven by the SERVICE's declared provision
+// type + per-type workspace handlers (no per-workspace test-env delegation toggle), so the
+// testEnv axis is registration-driven (read-only "Active: …" + the connect forms) until the
+// per-type infra configurator lands. See docs/initiatives/per-service-provision-types.md.
+const writable = computed(
+  () => isLocal.value && props.axis === 'execution' && (cap.value?.available.length ?? 0) > 1,
+)
 const delegated = computed(() =>
   props.axis === 'execution'
     ? settings.settings.delegateAgentsToRunnerPool
-    : settings.settings.delegateTestEnvToProvider,
+    : connectionRegistered.value,
 )
 
 // The effective active backend (matches the prior ExecutionBackendSelector logic): local
@@ -214,11 +220,8 @@ const saving = ref(false)
 async function setDelegate(value: boolean) {
   saving.value = true
   try {
-    await settings.update(
-      props.axis === 'execution'
-        ? { delegateAgentsToRunnerPool: value }
-        : { delegateTestEnvToProvider: value },
-    )
+    // Only reachable on the execution axis (`writable` is false for testEnv now).
+    await settings.update({ delegateAgentsToRunnerPool: value })
   } catch (e) {
     toast.add({
       title: t('settings.infrastructure.updateFailed'),

package/app/stores/auth.ts

@@ -25,6 +25,18 @@ export const useAuthStore = defineStore(
     const required = ref(false)
     /** Which login providers the backend offers (drives the login UI). */
     const providers = ref({ github: false, password: false, google: false })
+    /**
+     * Source-control providers a HOSTED facade (remote node) accepts a user-supplied PAT for.
+     * Drives the login screen's "sign in with a PAT" option on non-local deployments. Empty on
+     * the Worker (OAuth-only) and in local mode (which uses `localMode.patLogin` instead).
+     */
+    const patProviders = ref<('github' | 'gitlab')[]>([])
+    /**
+     * Test-only: the backend advertised that it runs with NO authentication (its
+     * `TESTING_NO_AUTH` opt-in). When set, the SPA renders the board anonymously instead of
+     * gating to the login screen — even on a remote facade. Only ever true under the e2e suite.
+     */
+    const testingNoAuth = ref(false)
     /**
      * Local-mode signals from the backend. Present only when running the local facade;
      * `githubPatSetupUrl` is set when local mode has no GitHub PAT configured (drives the
@@ -48,18 +60,44 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * True only once `getAuthConfig()` has resolved successfully. Distinguishes "the backend
+     * told us auth is off" from "we never reached the backend" (the bootstrap catch path),
+     * so an unreachable backend falls through to the board's own error UI instead of being
+     * mistaken for an unauthenticated session and gated to the login screen.
+     */
+    const configLoaded = ref(false)
+    /**
+     * Whether this is the local-mode facade. Only the local facade reports `localMode`; the
+     * remote node service and the Cloudflare Worker never do. Used to tell "a developer's
+     * own machine (anonymous-but-dev-open is its own thing)" apart from "a remote deployment
+     * that has no anonymous tier".
+     */
+    const isLocalFacade = computed(() => localMode.value !== null)
 
     /** May the app render? True when auth is off, or on with a known user. */
     const isAuthenticated = computed(() => !required.value || user.value !== null)
 
     /**
-     * Whether the SPA must show the login screen before the board. Auth-enabled deployments
-     * gate on a user as before; local mode ALSO gates (even though its API stays dev-open),
-     * because anonymous local use can't store per-user credentials — see the login flow.
+     * Whether the SPA must show the login screen before the board.
+     *
+     * - Auth-enabled deployments gate on a user as before.
+     * - Local mode ALSO gates (even though its API stays dev-open), because anonymous local
+     *   use can't store per-user credentials — see the login flow.
+     * - A REMOTE facade (node service / Worker) has NO anonymous tier: once the auth handshake
+     *   has resolved and there's no user, gate — even when the backend reports auth "disabled"
+     *   (a misconfigured/dev-open remote running without a provider). Previously this slipped
+     *   through and dropped the user onto a board where every per-user action silently failed
+     *   with no sign-in affordance; the login screen now surfaces that state (offering a
+     *   provider, or explaining that none is configured).
      */
-    const needsLogin = computed(
-      () => (required.value || localMode.value?.enabled === true) && user.value === null,
-    )
+    const needsLogin = computed(() => {
+      if (!configLoaded.value || user.value !== null) return false
+      // A deployment that explicitly runs with no auth (the test opt-in) renders anonymously.
+      if (testingNoAuth.value) return false
+      if (isLocalFacade.value) return required.value || localMode.value?.enabled === true
+      return true
+    })
 
     /** Pull a token handed back in the post-login URL fragment (#token=…). */
     function consumeRedirectToken() {
@@ -78,10 +116,14 @@ export const useAuthStore = defineStore(
         const config = await api.getAuthConfig()
         required.value = config.enabled
         if (config.providers) providers.value = config.providers
+        patProviders.value = config.patLogin?.providers ?? []
+        testingNoAuth.value = config.testingNoAuth ?? false
         localMode.value = config.localMode ?? null
         infrastructure.value = config.infrastructure ?? null
+        configLoaded.value = true
       } catch {
-        // Backend unreachable — let the board's own error UI handle it.
+        // Backend unreachable — let the board's own error UI handle it (configLoaded stays
+        // false, so we never mistake this for an unauthenticated session and gate it).
         required.value = false
         ready.value = true
         return
@@ -229,10 +271,14 @@ export const useAuthStore = defineStore(
       user,
       required,
       providers,
+      patProviders,
+      testingNoAuth,
       localMode,
       infrastructure,
       autoLoginProvider,
       ready,
+      configLoaded,
+      isLocalFacade,
       isAuthenticated,
       needsLogin,
       bootstrap,

package/app/stores/workspaceSettings.ts

@@ -13,7 +13,6 @@ const DEFAULTS: WorkspaceSettings = {
   artifactRetentionDays: 14,
   kaizenEnabled: true,
   delegateAgentsToRunnerPool: false,
-  delegateTestEnvToProvider: false,
   spendCurrency: null,
   spendMonthlyLimit: null,
 }

package/app/types/domain.ts

@@ -27,6 +27,7 @@ export type {
   PullRequestRef,
   CloudProvider,
   InstanceSize,
+  ProvisionType,
   AgentConfigOption,
   AgentConfigDescriptor,
   TestConcernSeverity,

package/i18n/locales/en.json

@@ -424,13 +424,13 @@
     },
     "testConfig": {
       "title": "Test infrastructure",
-      "defaultEnv": "Default test environment",
-      "defaultEnvHint": "The default tasks under this service are spawned with. Each task can override it in its agent settings.",
-      "env": {
-        "ephemeral": "Ephemeral environment",
-        "ephemeralHint": "tests run against a provisioned env",
-        "local": "Local (docker-compose)",
-        "localHint": "the Tester stands deps up locally"
+      "provisionType": "Provision type",
+      "provisionTypeHint": "How this service stands up its environment for the Tester. The workspace configures how each type is handled (the engine + connection).",
+      "provisionTypes": {
+        "infraless": "No infrastructure",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Custom"
       },
       "composePath": "docker-compose path",
       "browseRepo": "Browse the repository for the compose file",
@@ -440,8 +440,6 @@
       "selected": "Selected: {path}",
       "noFileSelected": "No file selected.",
       "useThisFile": "Use this file",
-      "noInfra": "No infra dependencies (the Tester spins nothing up)",
-      "missingInfra": "Set a docker-compose path or enable no infra dependencies, otherwise a pipeline with a Tester won't start.",
       "provisioningTitle": "Ephemeral environment provisioning",
       "provisioningHint": "A hint for provisioning this service's ephemeral test environment: which cloud provider to deploy to and how large an instance to request. Ignored for local (docker-compose) testing.",
       "cloudProvider": "Cloud provider",
@@ -814,7 +812,11 @@
       "sendResetLink": "Send reset link",
       "backToSignIn": "Back to sign in",
       "signInFailed": "Sign-in failed. Check your details and try again.",
-      "genericError": "Something went wrong. Please try again."
+      "genericError": "Something went wrong. Please try again.",
+      "notConfiguredTitle": "Authentication isn't configured",
+      "notConfiguredBody": "This deployment has no sign-in method enabled, so you can't sign in or access your workspaces. An administrator needs to configure an authentication provider (GitHub or Google OAuth, or email and password login).",
+      "patPlaceholder": "{provider} personal access token",
+      "signInWithPat": "Sign in with {provider} PAT"
     },
     "resetPassword": {
       "title": "Reset password",

package/i18n/locales/es.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "Infraestructura de pruebas",
-      "defaultEnv": "Entorno de pruebas predeterminado",
-      "defaultEnvHint": "El entorno predeterminado con el que se generan las tareas de este servicio. Cada tarea puede anularlo en su configuración de agente.",
-      "env": {
-        "ephemeral": "Entorno efímero",
-        "ephemeralHint": "las pruebas se ejecutan contra un entorno aprovisionado",
-        "local": "Local (docker-compose)",
-        "localHint": "el Tester levanta las dependencias localmente"
+      "provisionType": "Tipo de aprovisionamiento",
+      "provisionTypeHint": "Cómo este servicio levanta su entorno para el Tester. El espacio de trabajo configura cómo se gestiona cada tipo (el motor + la conexión).",
+      "provisionTypes": {
+        "infraless": "Sin infraestructura",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Personalizado"
       },
       "composePath": "Ruta de docker-compose",
       "browseRepo": "Explorar el repositorio en busca del archivo de compose",
@@ -403,8 +403,6 @@
       "selected": "Seleccionado: {path}",
       "noFileSelected": "Ningún archivo seleccionado.",
       "useThisFile": "Usar este archivo",
-      "noInfra": "Sin dependencias de infraestructura (el Tester no levanta nada)",
-      "missingInfra": "Define una ruta de docker-compose o habilita sin dependencias de infraestructura; de lo contrario, un pipeline con un Tester no se iniciará.",
       "provisioningTitle": "Aprovisionamiento del entorno efímero",
       "provisioningHint": "Una indicación para aprovisionar el entorno de pruebas efímero de este servicio: en qué proveedor de nube desplegar y qué tamaño de instancia solicitar. Se ignora en las pruebas locales (docker-compose).",
       "cloudProvider": "Proveedor de nube",
@@ -774,7 +772,11 @@
       "sendResetLink": "Enviar enlace de restablecimiento",
       "backToSignIn": "Volver al inicio de sesión",
       "signInFailed": "Error al iniciar sesión. Revisa tus datos e inténtalo de nuevo.",
-      "genericError": "Algo salió mal. Inténtalo de nuevo."
+      "genericError": "Algo salió mal. Inténtalo de nuevo.",
+      "notConfiguredTitle": "La autenticación no está configurada",
+      "notConfiguredBody": "Este despliegue no tiene ningún método de inicio de sesión habilitado, por lo que no puedes iniciar sesión ni acceder a tus espacios de trabajo. Un administrador debe configurar un proveedor de autenticación (OAuth de GitHub o Google, o inicio de sesión con correo y contraseña).",
+      "patPlaceholder": "Token de acceso personal de {provider}",
+      "signInWithPat": "Iniciar sesión con un PAT de {provider}"
     },
     "resetPassword": {
       "title": "Restablecer contraseña",

package/i18n/locales/fr.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "Infrastructure de test",
-      "defaultEnv": "Environnement de test par défaut",
-      "defaultEnvHint": "Celui avec lequel les tâches par défaut de ce service sont créées. Chaque tâche peut le remplacer dans ses paramètres d'agent.",
-      "env": {
-        "ephemeral": "Environnement éphémère",
-        "ephemeralHint": "les tests s'exécutent sur un environnement provisionné",
-        "local": "Local (docker-compose)",
-        "localHint": "le Testeur met en place les dépendances localement"
+      "provisionType": "Type de provisionnement",
+      "provisionTypeHint": "Comment ce service met en place son environnement pour le Tester. L'espace de travail configure la gestion de chaque type (le moteur + la connexion).",
+      "provisionTypes": {
+        "infraless": "Aucune infrastructure",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Personnalisé"
       },
       "composePath": "Chemin docker-compose",
       "browseRepo": "Parcourir le dépôt pour trouver le fichier compose",
@@ -403,8 +403,6 @@
       "selected": "Sélectionné : {path}",
       "noFileSelected": "Aucun fichier sélectionné.",
       "useThisFile": "Utiliser ce fichier",
-      "noInfra": "Aucune dépendance d'infrastructure (le Testeur ne met rien en place)",
-      "missingInfra": "Définissez un chemin docker-compose ou activez l'absence de dépendances d'infrastructure, sinon un pipeline avec un Testeur ne démarrera pas.",
       "provisioningTitle": "Provisionnement de l'environnement éphémère",
       "provisioningHint": "Une indication pour provisionner l'environnement de test éphémère de ce service : quel fournisseur cloud cibler et quelle taille d'instance demander. Ignoré pour les tests locaux (docker-compose).",
       "cloudProvider": "Fournisseur cloud",
@@ -774,7 +772,11 @@
       "sendResetLink": "Envoyer le lien de réinitialisation",
       "backToSignIn": "Retour à la connexion",
       "signInFailed": "Échec de la connexion. Vérifiez vos informations et réessayez.",
-      "genericError": "Une erreur s'est produite. Veuillez réessayer."
+      "genericError": "Une erreur s'est produite. Veuillez réessayer.",
+      "notConfiguredTitle": "L'authentification n'est pas configurée",
+      "notConfiguredBody": "Ce déploiement n'a aucune méthode de connexion activée, vous ne pouvez donc pas vous connecter ni accéder à vos espaces de travail. Un administrateur doit configurer un fournisseur d'authentification (OAuth GitHub ou Google, ou connexion par e-mail et mot de passe).",
+      "patPlaceholder": "Jeton d'accès personnel {provider}",
+      "signInWithPat": "Se connecter avec un PAT {provider}"
     },
     "resetPassword": {
       "title": "Réinitialiser le mot de passe",

package/i18n/locales/he.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "תשתית בדיקות",
-      "defaultEnv": "סביבת בדיקות ברירת מחדל",
-      "defaultEnvHint": "ברירת המחדל שאיתה נוצרות המשימות תחת שירות זה. כל משימה יכולה לעקוף אותה בהגדרות הסוכן שלה.",
-      "env": {
-        "ephemeral": "סביבה זמנית",
-        "ephemeralHint": "הבדיקות רצות מול סביבה שהוקצתה",
-        "local": "מקומי (docker-compose)",
-        "localHint": "ה-Tester מקים את התלויות מקומית"
+      "provisionType": "סוג ההקצאה",
+      "provisionTypeHint": "כיצד שירות זה מקים את הסביבה שלו עבור ה-Tester. סביבת העבודה מגדירה כיצד מטופל כל סוג (המנוע + החיבור).",
+      "provisionTypes": {
+        "infraless": "ללא תשתית",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "מותאם אישית"
       },
       "composePath": "נתיב docker-compose",
       "browseRepo": "עיין במאגר עבור קובץ ה-compose",
@@ -403,8 +403,6 @@
       "selected": "נבחר: {path}",
       "noFileSelected": "לא נבחר קובץ.",
       "useThisFile": "השתמש בקובץ זה",
-      "noInfra": "אין תלויות תשתית (ה-Tester אינו מקים דבר)",
-      "missingInfra": "הגדר נתיב docker-compose או הפעל ללא תלויות תשתית, אחרת פייפליין עם Tester לא יתחיל.",
       "provisioningTitle": "הקצאת סביבת בדיקות זמנית",
       "provisioningHint": "רמז להקצאת סביבת הבדיקות הזמנית של שירות זה: לאיזה ספק ענן לפרוס וכמה גדול מופע לבקש. מתעלם בבדיקות מקומיות (docker-compose).",
       "cloudProvider": "ספק ענן",
@@ -774,7 +772,11 @@
       "sendResetLink": "שלח קישור איפוס",
       "backToSignIn": "חזרה להתחברות",
       "signInFailed": "ההתחברות נכשלה. בדוק את הפרטים שלך ונסה שוב.",
-      "genericError": "משהו השתבש. אנא נסה שוב."
+      "genericError": "משהו השתבש. אנא נסה שוב.",
+      "notConfiguredTitle": "האימות אינו מוגדר",
+      "notConfiguredBody": "בפריסה זו לא מופעלת אף שיטת התחברות, ולכן לא ניתן להתחבר או לגשת למרחבי העבודה שלך. מנהל המערכת צריך להגדיר ספק אימות (GitHub או Google OAuth, או התחברות עם אימייל וסיסמה).",
+      "patPlaceholder": "אסימון גישה אישי של {provider}",
+      "signInWithPat": "התחברות עם PAT של {provider}"
     },
     "resetPassword": {
       "title": "אפס סיסמה",

package/i18n/locales/ja.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "テストインフラ",
-      "defaultEnv": "デフォルトのテスト環境",
-      "defaultEnvHint": "このサービス配下のタスクが生成されるデフォルトの環境です。各タスクはエージェント設定で上書きできます。",
-      "env": {
-        "ephemeral": "エフェメラル環境",
-        "ephemeralHint": "プロビジョニングされた環境に対してテストを実行します",
-        "local": "ローカル (docker-compose)",
-        "localHint": "Tester が依存関係をローカルで立ち上げます"
+      "provisionType": "プロビジョニングの種類",
+      "provisionTypeHint": "このサービスが Tester 用の環境をどのように立ち上げるか。各種類の扱い方（エンジンと接続）はワークスペースで設定します。",
+      "provisionTypes": {
+        "infraless": "インフラなし",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "カスタム"
       },
       "composePath": "docker-compose のパス",
       "browseRepo": "リポジトリ内の compose ファイルを参照",
@@ -403,8 +403,6 @@
       "selected": "選択中: {path}",
       "noFileSelected": "ファイルが選択されていません。",
       "useThisFile": "このファイルを使用",
-      "noInfra": "インフラ依存なし (Tester は何も立ち上げません)",
-      "missingInfra": "docker-compose のパスを設定するか、インフラ依存なしを有効にしてください。そうしないと Tester を含むパイプラインは開始しません。",
       "provisioningTitle": "エフェメラルテスト環境のプロビジョニング",
       "provisioningHint": "このサービスのエフェメラルテスト環境をプロビジョニングするためのヒント: どのクラウドプロバイダーにデプロイするか、どの程度の大きさのインスタンスを要求するか。ローカル (docker-compose) テストでは無視されます。",
       "cloudProvider": "クラウドプロバイダー",
@@ -774,7 +772,11 @@
       "sendResetLink": "リセットリンクを送信",
       "backToSignIn": "サインインに戻る",
       "signInFailed": "サインインに失敗しました。入力内容を確認して、もう一度お試しください。",
-      "genericError": "問題が発生しました。もう一度お試しください。"
+      "genericError": "問題が発生しました。もう一度お試しください。",
+      "notConfiguredTitle": "認証が設定されていません",
+      "notConfiguredBody": "このデプロイにはサインイン方法が有効になっていないため、サインインやワークスペースへのアクセスができません。管理者が認証プロバイダー（GitHub または Google の OAuth、あるいはメールアドレスとパスワードによるログイン）を設定する必要があります。",
+      "patPlaceholder": "{provider} のパーソナルアクセストークン",
+      "signInWithPat": "{provider} の PAT でサインイン"
     },
     "resetPassword": {
       "title": "パスワードをリセット",

package/i18n/locales/pl.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "Infrastruktura testowa",
-      "defaultEnv": "Domyślne środowisko testowe",
-      "defaultEnvHint": "Środowisko, z którym uruchamiane są domyślnie zadania w tej usłudze. Każde zadanie może je nadpisać w swoich ustawieniach agenta.",
-      "env": {
-        "ephemeral": "Środowisko efemeryczne",
-        "ephemeralHint": "testy uruchamiane wobec udostępnionego środowiska",
-        "local": "Lokalne (docker-compose)",
-        "localHint": "Tester stawia zależności lokalnie"
+      "provisionType": "Typ provisioningu",
+      "provisionTypeHint": "Jak ta usługa uruchamia swoje środowisko dla Testera. Obszar roboczy konfiguruje sposób obsługi każdego typu (silnik + połączenie).",
+      "provisionTypes": {
+        "infraless": "Bez infrastruktury",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Niestandardowy"
       },
       "composePath": "Ścieżka docker-compose",
       "browseRepo": "Przeglądaj repozytorium w poszukiwaniu pliku compose",
@@ -403,8 +403,6 @@
       "selected": "Wybrano: {path}",
       "noFileSelected": "Nie wybrano pliku.",
       "useThisFile": "Użyj tego pliku",
-      "noInfra": "Brak zależności infrastrukturalnych (Tester niczego nie stawia)",
-      "missingInfra": "Ustaw ścieżkę docker-compose lub włącz brak zależności infrastrukturalnych, w przeciwnym razie potok z Testerem się nie uruchomi.",
       "provisioningTitle": "Udostępnianie środowiska efemerycznego",
       "provisioningHint": "Wskazówka dotycząca udostępniania efemerycznego środowiska testowego tej usługi: do którego dostawcy chmury wdrożyć i jak duży zażądać instancji. Ignorowane przy testach lokalnych (docker-compose).",
       "cloudProvider": "Dostawca chmury",
@@ -774,7 +772,11 @@
       "sendResetLink": "Wyślij link resetujący",
       "backToSignIn": "Powrót do logowania",
       "signInFailed": "Logowanie nie powiodło się. Sprawdź swoje dane i spróbuj ponownie.",
-      "genericError": "Coś poszło nie tak. Spróbuj ponownie."
+      "genericError": "Coś poszło nie tak. Spróbuj ponownie.",
+      "notConfiguredTitle": "Uwierzytelnianie nie jest skonfigurowane",
+      "notConfiguredBody": "To wdrożenie nie ma włączonej żadnej metody logowania, więc nie możesz się zalogować ani uzyskać dostępu do swoich przestrzeni roboczych. Administrator musi skonfigurować dostawcę uwierzytelniania (OAuth GitHub lub Google albo logowanie e-mailem i hasłem).",
+      "patPlaceholder": "Osobisty token dostępu {provider}",
+      "signInWithPat": "Zaloguj się tokenem PAT {provider}"
     },
     "resetPassword": {
       "title": "Zresetuj hasło",

package/i18n/locales/tr.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "Test altyapısı",
-      "defaultEnv": "Varsayılan test ortamı",
-      "defaultEnvHint": "Bu servisin altındaki görevlerin oluşturulduğu varsayılan ortam. Her görev kendi ajan ayarlarında bunu geçersiz kılabilir.",
-      "env": {
-        "ephemeral": "Geçici ortam",
-        "ephemeralHint": "testler sağlanan bir ortama karşı çalışır",
-        "local": "Yerel (docker-compose)",
-        "localHint": "Tester bağımlılıkları yerel olarak ayağa kaldırır"
+      "provisionType": "Sağlama türü",
+      "provisionTypeHint": "Bu hizmetin Tester için ortamını nasıl ayağa kaldırdığı. Her türün nasıl ele alınacağını (motor + bağlantı) çalışma alanı yapılandırır.",
+      "provisionTypes": {
+        "infraless": "Altyapısız",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Özel"
       },
       "composePath": "docker-compose yolu",
       "browseRepo": "compose dosyası için depoya göz at",
@@ -403,8 +403,6 @@
       "selected": "Seçildi: {path}",
       "noFileSelected": "Dosya seçilmedi.",
       "useThisFile": "Bu dosyayı kullan",
-      "noInfra": "Altyapı bağımlılığı yok (Tester hiçbir şey ayağa kaldırmaz)",
-      "missingInfra": "Bir docker-compose yolu ayarlayın veya altyapı bağımlılığı yok seçeneğini etkinleştirin, aksi halde Tester içeren bir pipeline başlamaz.",
       "provisioningTitle": "Geçici ortam sağlama",
       "provisioningHint": "Bu servisin geçici test ortamını sağlamak için bir ipucu: hangi bulut sağlayıcısına dağıtılacağı ve ne kadar büyük bir örnek isteneceği. Yerel (docker-compose) testleri için yok sayılır.",
       "cloudProvider": "Bulut sağlayıcı",
@@ -774,7 +772,11 @@
       "sendResetLink": "Sıfırlama bağlantısı gönder",
       "backToSignIn": "Oturum açmaya dön",
       "signInFailed": "Oturum açma başarısız. Bilgilerinizi kontrol edip tekrar deneyin.",
-      "genericError": "Bir şeyler ters gitti. Lütfen tekrar deneyin."
+      "genericError": "Bir şeyler ters gitti. Lütfen tekrar deneyin.",
+      "notConfiguredTitle": "Kimlik doğrulama yapılandırılmamış",
+      "notConfiguredBody": "Bu dağıtımda etkin bir oturum açma yöntemi yok, bu nedenle oturum açamaz veya çalışma alanlarınıza erişemezsiniz. Bir yönetici, bir kimlik doğrulama sağlayıcısı (GitHub veya Google OAuth ya da e-posta ve parola ile oturum açma) yapılandırmalıdır.",
+      "patPlaceholder": "{provider} kişisel erişim belirteci",
+      "signInWithPat": "{provider} PAT ile oturum aç"
     },
     "resetPassword": {
       "title": "Parolayı sıfırla",

package/i18n/locales/uk.json

@@ -387,13 +387,13 @@
     },
     "testConfig": {
       "title": "Тестова інфраструктура",
-      "defaultEnv": "Типове тестове середовище",
-      "defaultEnvHint": "Середовище, з яким за замовчуванням створюються завдання цього сервісу. Кожне завдання може перевизначити його в налаштуваннях агента.",
-      "env": {
-        "ephemeral": "Тимчасове середовище",
-        "ephemeralHint": "тести виконуються в наданому середовищі",
-        "local": "Локально (docker-compose)",
-        "localHint": "Тестувальник піднімає залежності локально"
+      "provisionType": "Тип провіженінгу",
+      "provisionTypeHint": "Як ця служба піднімає своє середовище для Tester. Робочий простір налаштовує, як обробляється кожен тип (рушій + підключення).",
+      "provisionTypes": {
+        "infraless": "Без інфраструктури",
+        "docker-compose": "Docker Compose",
+        "kubernetes": "Kubernetes",
+        "custom": "Власний"
       },
       "composePath": "Шлях docker-compose",
       "browseRepo": "Переглянути репозиторій у пошуках файлу compose",
@@ -403,8 +403,6 @@
       "selected": "Вибрано: {path}",
       "noFileSelected": "Файл не вибрано.",
       "useThisFile": "Використати цей файл",
-      "noInfra": "Без інфраструктурних залежностей (Тестувальник нічого не піднімає)",
-      "missingInfra": "Вкажіть шлях docker-compose або увімкніть відсутність інфраструктурних залежностей, інакше конвеєр з Тестувальником не запуститься.",
       "provisioningTitle": "Надання тимчасового середовища",
       "provisioningHint": "Підказка для надання тимчасового тестового середовища цього сервісу: до якого хмарного провайдера розгортати та яку величину інстансу запитувати. Ігнорується для локального (docker-compose) тестування.",
       "cloudProvider": "Хмарний провайдер",
@@ -774,7 +772,11 @@
       "sendResetLink": "Надіслати посилання для скидання",
       "backToSignIn": "Повернутися до входу",
       "signInFailed": "Не вдалося увійти. Перевірте свої дані та спробуйте ще раз.",
-      "genericError": "Щось пішло не так. Спробуйте ще раз."
+      "genericError": "Щось пішло не так. Спробуйте ще раз.",
+      "notConfiguredTitle": "Автентифікацію не налаштовано",
+      "notConfiguredBody": "У цьому розгортанні не ввімкнено жодного способу входу, тому ви не можете увійти чи отримати доступ до своїх робочих просторів. Адміністратор має налаштувати постачальника автентифікації (OAuth GitHub або Google чи вхід за електронною поштою та паролем).",
+      "patPlaceholder": "Особистий токен доступу {provider}",
+      "signInWithPat": "Увійти за допомогою PAT {provider}"
     },
     "resetPassword": {
       "title": "Скинути пароль",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.58.4",
+  "version": "0.59.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.61.0"
+    "@cat-factory/contracts": "0.63.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",