@cat-factory/app 0.63.1 → 0.65.0

package/app/components/auth/LoginScreen.vue

@@ -32,6 +32,9 @@ const configuredProviders = computed<PatProvider[]>(
 )
 const isLocalMode = computed(() => auth.localMode?.enabled === true)
 const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
+// Mothership mode: identity + org data live on a hosted mothership, so the primary sign-in is a
+// round-trip to the mothership's OAuth (the node then exchanges the session for a machine token).
+const isMothership = computed(() => auth.localMode?.mothership === true)
 
 const patBusy = ref(false)
 const patError = ref<string | null>(null)
@@ -186,6 +189,29 @@ const noSignInMethod = computed(
         </p>
       </div>
 
+      <!-- Mothership mode: sign in through the hosted mothership (it owns identity + the
+           allowlist). The node exchanges the returned session for a machine token. -->
+      <div v-if="isMothership && mode !== 'forgot'" class="mb-4 space-y-2">
+        <UButton
+          block
+          size="lg"
+          color="primary"
+          icon="i-lucide-cloud"
+          data-testid="mothership-signin"
+          @click="auth.signInViaMothership()"
+        >
+          {{ t('auth.mothership.signIn') }}
+        </UButton>
+        <p class="px-1 text-xs text-slate-400">{{ t('auth.mothership.hint') }}</p>
+        <p
+          v-if="auth.mothershipError"
+          class="px-1 text-xs text-rose-400"
+          data-testid="mothership-error"
+        >
+          {{ t('auth.mothership.error') }}
+        </p>
+      </div>
+
       <!-- Local mode: sign in with the env-configured source-control PAT. The token lives
            server-side (GITHUB_PAT / GITLAB_PAT); we only pick a provider here. -->
       <div v-if="isLocalMode && mode !== 'forgot'" class="space-y-3">

package/app/components/panels/inspector/ServiceTestConfig.vue

@@ -10,8 +10,11 @@ import type {
 import type {
   KubernetesManifestSource,
   KubernetesRenderer,
+  ProvisioningComposeServiceCandidate,
+  ProvisioningManifestRootCandidate,
   ProvisioningOverlayCandidate,
   ProvisioningRecommendation,
+  ProvisioningServiceDirCandidate,
 } from '@cat-factory/contracts'
 import RepoTreeBrowser from '~/components/github/RepoTreeBrowser.vue'
 
@@ -204,6 +207,11 @@ function applyPicked() {
 const detecting = ref(false)
 const detectError = ref(false)
 const detectResult = ref<ProvisioningRecommendation | null>(null)
+// Advisory, LOCAL-ONLY selection: which compose `services:` key the user picked. It is NOT persisted
+// (the compose backend targets the file, not a single service), so it lives only in component state
+// and merely drives the chip highlight. Without it the highlight would compare `composePath` — which
+// every candidate shares — and light up ALL chips at once, making the picker look non-functional.
+const pickedComposeService = ref<string | null>(null)
 
 // A detection result is scoped to the inspected block — clear it (and any error) when the
 // selection changes, so block B never shows block A's stale recommendation / overlay chips.
@@ -212,6 +220,7 @@ watch(
   () => {
     detectResult.value = null
     detectError.value = false
+    pickedComposeService.value = null
   },
 )
 
@@ -235,6 +244,9 @@ async function detectFromRepo() {
       prefer: provisionType.value,
     })
     detectResult.value = rec
+    // Pre-select the recommended compose service so the picker opens on a real choice.
+    pickedComposeService.value =
+      rec.composeServiceCandidates?.find((c) => c.recommended)?.service ?? null
     // Only prefill when the detector actually inferred something. A `detected: false`
     // recommendation is `infraless`; applying it would WIPE the service's existing
     // provisioning (board.updateBlock persists immediately). Leave the current config
@@ -255,6 +267,25 @@ function applyOverlay(candidate: ProvisioningOverlayCandidate) {
   setKubePath(candidate.path)
 }
 
+// Point the manifest path at a different k8s root (and match its renderer) the user picks.
+function applyManifestRoot(candidate: ProvisioningManifestRootCandidate) {
+  setKubePath(candidate.path)
+  setKubeRenderer(candidate.renderer)
+}
+
+// Point the manifest path at a different root-shared monorepo deploy slice the user picks.
+function applyServiceDir(candidate: ProvisioningServiceDirCandidate) {
+  setKubePath(candidate.path)
+}
+
+// Point the compose file at the picked candidate's file and record the advisory service selection.
+// The service KEY is not persisted (the compose backend targets the file, not a single service); the
+// picked key is tracked locally only to drive the chip highlight and the note.
+function applyComposeService(candidate: ProvisioningComposeServiceCandidate) {
+  setComposePath(candidate.composePath)
+  pickedComposeService.value = candidate.service
+}
+
 function provisionTypeLabel(type: ProvisionType): string {
   return t(`inspector.testConfig.provisionTypes.${type}`)
 }
@@ -350,6 +381,42 @@ function setSize(value: InstanceSize) {
             }}
           </p>
 
+          <div v-if="detectResult.serviceDirCandidates?.length" class="space-y-1">
+            <span class="text-[11px] text-slate-400">{{
+              t('inspector.testConfig.detect.serviceDirTitle')
+            }}</span>
+            <div class="flex flex-wrap gap-1">
+              <UButton
+                v-for="s in detectResult.serviceDirCandidates"
+                :key="s.path"
+                :color="kubePath === s.path ? 'primary' : 'neutral'"
+                :variant="kubePath === s.path ? 'soft' : 'ghost'"
+                size="xs"
+                @click="applyServiceDir(s)"
+              >
+                {{ s.name }}
+              </UButton>
+            </div>
+          </div>
+
+          <div v-if="detectResult.manifestRootCandidates?.length" class="space-y-1">
+            <span class="text-[11px] text-slate-400">{{
+              t('inspector.testConfig.detect.manifestRootTitle')
+            }}</span>
+            <div class="flex flex-wrap gap-1">
+              <UButton
+                v-for="r in detectResult.manifestRootCandidates"
+                :key="r.path"
+                :color="kubePath === r.path ? 'primary' : 'neutral'"
+                :variant="kubePath === r.path ? 'soft' : 'ghost'"
+                size="xs"
+                @click="applyManifestRoot(r)"
+              >
+                {{ r.name }}
+              </UButton>
+            </div>
+          </div>
+
           <div v-if="detectResult.overlayCandidates?.length" class="space-y-1">
             <span class="text-[11px] text-slate-400">{{
               t('inspector.testConfig.detect.overlayTitle')
@@ -368,6 +435,24 @@ function setSize(value: InstanceSize) {
             </div>
           </div>
 
+          <div v-if="detectResult.composeServiceCandidates?.length" class="space-y-1">
+            <span class="text-[11px] text-slate-400">{{
+              t('inspector.testConfig.detect.composeServiceTitle')
+            }}</span>
+            <div class="flex flex-wrap gap-1">
+              <UButton
+                v-for="c in detectResult.composeServiceCandidates"
+                :key="c.service"
+                :color="pickedComposeService === c.service ? 'primary' : 'neutral'"
+                :variant="pickedComposeService === c.service ? 'soft' : 'ghost'"
+                size="xs"
+                @click="applyComposeService(c)"
+              >
+                {{ c.service }}
+              </UButton>
+            </div>
+          </div>
+
           <p v-if="detectResult.urlSource" class="text-[11px] text-slate-500">
             {{
               t('inspector.testConfig.detect.urlSource', { source: detectResult.urlSource.source })

package/app/composables/api/auth.ts

@@ -1,6 +1,7 @@
 import {
   acceptInvitationContract,
   authConfigContract,
+  connectMothershipContract,
   forgotPasswordContract,
   logoutContract,
   meContract,
@@ -51,6 +52,11 @@ export function authApi({ http, send, ws }: ApiContext) {
 
     logout: () => send(logoutContract, { pathPrefix: '/auth' }),
 
+    // Mothership mode (local facade): hand the local node a mothership SESSION token (captured
+    // from the mothership OAuth redirect fragment). The node exchanges it for a cached machine
+    // token and returns a LOCAL session for the same user. Mounted at the app root (no prefix).
+    connectMothership: (session: string) => send(connectMothershipContract, { body: { session } }),
+
     // Mint a short-lived, workspace-scoped ticket for the events WebSocket. A
     // browser can't set Authorization on a WS handshake, so the socket auths from
     // this `?ticket=` instead of the long-lived session token. Empty string when

package/app/stores/auth.ts

@@ -60,6 +60,12 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * Mothership mode: the last mothership sign-in failure (node unreachable / rejected session),
+     * or null. Set when the post-OAuth connect exchange fails, so the login screen can tell the
+     * user the click didn't take instead of silently returning them to the sign-in button.
+     */
+    const mothershipError = ref<string | null>(null)
     /**
      * True only once `getAuthConfig()` has resolved successfully. Distinguishes "the backend
      * told us auth is off" from "we never reached the backend" (the bootstrap catch path),
@@ -109,9 +115,59 @@ export const useAuthStore = defineStore(
       history.replaceState(null, '', window.location.pathname + window.location.search)
     }
 
+    /**
+     * Mothership mode: when the mothership OAuth redirect returns here (flagged
+     * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
+     * Hand it to our OWN node, which exchanges it for a cached machine token and returns a LOCAL
+     * session for the same user. Returns true when it handled the redirect (so the caller skips
+     * the normal `consumeRedirectToken`, which would wrongly store the mothership session locally).
+     */
+    async function maybeConnectMothership(): Promise<boolean> {
+      if (typeof window === 'undefined') return false
+      const params = new URLSearchParams(window.location.search)
+      if (params.get('mothership_connect') !== '1') return false
+      const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
+      const session = match ? decodeURIComponent(match[1]!) : null
+      // Clean the flag + fragment from the URL regardless of outcome, so it isn't left in history.
+      params.delete('mothership_connect')
+      const qs = params.toString()
+      history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+      if (!session) return true
+      try {
+        const result = await api.connectMothership(session)
+        applySession({ token: result.session, user: result.user })
+        mothershipError.value = null
+      } catch (err) {
+        // Surface the failure so the login screen shows it, rather than silently dropping the
+        // user back on the sign-in button as if the click did nothing. The captured session is
+        // already stripped from the URL, so recovery is a fresh "Sign in via mothership".
+        mothershipError.value =
+          err instanceof Error ? err.message : 'Could not connect to the mothership'
+      }
+      return true
+    }
+
+    /**
+     * Mothership mode: sign in through the hosted mothership. The mothership owns identity + the
+     * allowlist, so we send the browser to ITS OAuth and return here flagged for the connect
+     * exchange (`maybeConnectMothership`). No-op if the mothership URL isn't known.
+     */
+    function signInViaMothership() {
+      if (typeof window === 'undefined') return
+      const base = localMode.value?.mothershipUrl
+      if (!base) return
+      mothershipError.value = null
+      const here = new URL(window.location.origin + window.location.pathname)
+      here.searchParams.set('mothership_connect', '1')
+      const redirect = new URLSearchParams({ redirect: here.toString() })
+      window.location.href = `${base.replace(/\/$/, '')}/auth/login?${redirect}`
+    }
+
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
-      consumeRedirectToken()
+      // A returning mothership-connect redirect is handled first (it carries a mothership session,
+      // which must be exchanged — not stored as a local token by `consumeRedirectToken`).
+      if (!(await maybeConnectMothership())) consumeRedirectToken()
       try {
         const config = await api.getAuthConfig()
         required.value = config.enabled
@@ -277,6 +333,7 @@ export const useAuthStore = defineStore(
       infrastructure,
       autoLoginProvider,
       ready,
+      mothershipError,
       configLoaded,
       isLocalFacade,
       isAuthenticated,
@@ -284,6 +341,7 @@ export const useAuthStore = defineStore(
       bootstrap,
       login,
       loginWithGoogle,
+      signInViaMothership,
       signup,
       passwordLogin,
       patLogin,

package/i18n/locales/en.json

@@ -483,6 +483,9 @@
         "none": "No Kubernetes manifests or Compose file were detected.",
         "applied": "Suggested a {type} config. Review and adjust the fields below.",
         "overlayTitle": "Ephemeral overlay",
+        "serviceDirTitle": "Service deploy folder",
+        "manifestRootTitle": "Manifest location",
+        "composeServiceTitle": "Compose service",
         "urlSource": "Suggested environment URL source: {source}. The workspace handler owns this; set it there.",
         "namespace": "Manifests pin namespace \"{namespace}\"; recommend honoring it on the workspace handler.",
         "confidenceHigh": "Detected",
@@ -869,6 +872,11 @@
     "userMenu": {
       "mySetup": "My setup",
       "signOut": "Sign out"
+    },
+    "mothership": {
+      "signIn": "Sign in via mothership",
+      "hint": "Your projects and identity live on the hosted mothership. Sign in there to connect this node.",
+      "error": "Could not sign in via the mothership. Try again."
     }
   },
   "layout": {

package/i18n/locales/es.json

@@ -446,6 +446,9 @@
         "none": "No se detectaron manifiestos de Kubernetes ni archivo Compose.",
         "applied": "Se sugirió una configuración {type}. Revisa y ajusta los campos de abajo.",
         "overlayTitle": "Overlay efímero",
+        "serviceDirTitle": "Carpeta de despliegue del servicio",
+        "manifestRootTitle": "Ubicación del manifiesto",
+        "composeServiceTitle": "Servicio de Compose",
         "urlSource": "Fuente de URL del entorno sugerida: {source}. El gestor del espacio de trabajo la controla; configúrala allí.",
         "namespace": "Los manifiestos fijan el espacio de nombres \"{namespace}\"; se recomienda respetarlo en el gestor del espacio de trabajo.",
         "confidenceHigh": "Detectado",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "Mi configuración",
       "signOut": "Cerrar sesión"
+    },
+    "mothership": {
+      "signIn": "Iniciar sesión con la central",
+      "hint": "Tus proyectos e identidad están en la central alojada: inicia sesión allí para conectar este nodo.",
+      "error": "No se pudo iniciar sesión con la central. Inténtalo de nuevo."
     }
   },
   "layout": {

package/i18n/locales/fr.json

@@ -446,6 +446,9 @@
         "none": "Aucun manifeste Kubernetes ni fichier Compose détecté.",
         "applied": "Configuration {type} suggérée. Vérifiez et ajustez les champs ci-dessous.",
         "overlayTitle": "Overlay éphémère",
+        "serviceDirTitle": "Dossier de déploiement du service",
+        "manifestRootTitle": "Emplacement du manifeste",
+        "composeServiceTitle": "Service Compose",
         "urlSource": "Source d'URL d'environnement suggérée : {source}. Le gestionnaire de l'espace de travail la contrôle ; définissez-la là.",
         "namespace": "Les manifestes fixent l'espace de noms « {namespace} » ; il est recommandé de le respecter sur le gestionnaire de l'espace de travail.",
         "confidenceHigh": "Détecté",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "Ma configuration",
       "signOut": "Se déconnecter"
+    },
+    "mothership": {
+      "signIn": "Se connecter via le serveur central",
+      "hint": "Vos projets et votre identité sont sur le serveur central hébergé. Connectez-vous là-bas pour relier ce nœud.",
+      "error": "Impossible de se connecter via le serveur central. Réessayez."
     }
   },
   "layout": {

package/i18n/locales/he.json

@@ -446,6 +446,9 @@
         "none": "לא זוהו מניפסטים של Kubernetes או קובץ Compose.",
         "applied": "הוצעה תצורת {type}. בדוק והתאם את השדות למטה.",
         "overlayTitle": "שכבת סביבה זמנית",
+        "serviceDirTitle": "תיקיית פריסת השירות",
+        "manifestRootTitle": "מיקום המניפסט",
+        "composeServiceTitle": "שירות Compose",
         "urlSource": "מקור כתובת הסביבה המוצע: {source}. המטפל של המרחב שולט בכך; הגדר זאת שם.",
         "namespace": "המניפסטים מקבעים את מרחב השמות \"{namespace}\"; מומלץ לכבד אותו במטפל של המרחב.",
         "confidenceHigh": "זוהה",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "ההגדרות שלי",
       "signOut": "התנתק"
+    },
+    "mothership": {
+      "signIn": "התחברות דרך שרת המרכז",
+      "hint": "הפרויקטים והזהות שלך נמצאים בשרת המרכז המתארח. התחבר שם כדי לחבר את הצומת הזה.",
+      "error": "לא ניתן להתחבר דרך שרת המרכז. נסה שוב."
     }
   },
   "layout": {

package/i18n/locales/ja.json

@@ -446,6 +446,9 @@
         "none": "Kubernetes マニフェストや Compose ファイルは検出されませんでした。",
         "applied": "{type} の設定を提案しました。以下のフィールドを確認して調整してください。",
         "overlayTitle": "一時環境のオーバーレイ",
+        "serviceDirTitle": "サービスのデプロイフォルダ",
+        "manifestRootTitle": "マニフェストの場所",
+        "composeServiceTitle": "Compose サービス",
         "urlSource": "推奨される環境 URL ソース: {source}。これはワークスペースのハンドラーが管理します。そちらで設定してください。",
         "namespace": "マニフェストは名前空間「{namespace}」を固定しています。ワークスペースのハンドラーでそれを尊重することを推奨します。",
         "confidenceHigh": "検出",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "マイセットアップ",
       "signOut": "サインアウト"
+    },
+    "mothership": {
+      "signIn": "マザーシップ経由でサインイン",
+      "hint": "プロジェクトと認証情報はホスト型のマザーシップにあります。そこでサインインしてこのノードを接続してください。",
+      "error": "マザーシップ経由でサインインできませんでした。もう一度お試しください。"
     }
   },
   "layout": {

package/i18n/locales/pl.json

@@ -446,6 +446,9 @@
         "none": "Nie wykryto manifestów Kubernetes ani pliku Compose.",
         "applied": "Zaproponowano konfigurację {type}. Przejrzyj i dostosuj pola poniżej.",
         "overlayTitle": "Tymczasowy overlay",
+        "serviceDirTitle": "Folder wdrożenia usługi",
+        "manifestRootTitle": "Lokalizacja manifestu",
+        "composeServiceTitle": "Usługa Compose",
         "urlSource": "Sugerowane źródło adresu URL środowiska: {source}. Zarządza tym handler przestrzeni roboczej; ustaw to tam.",
         "namespace": "Manifesty ustalają przestrzeń nazw \"{namespace}\"; zaleca się jej przestrzeganie w handlerze przestrzeni roboczej.",
         "confidenceHigh": "Wykryto",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "Moja konfiguracja",
       "signOut": "Wyloguj się"
+    },
+    "mothership": {
+      "signIn": "Zaloguj się przez serwer centralny",
+      "hint": "Twoje projekty i tożsamość znajdują się na hostowanym serwerze centralnym. Zaloguj się tam, aby połączyć ten węzeł.",
+      "error": "Nie udało się zalogować przez serwer centralny. Spróbuj ponownie."
     }
   },
   "layout": {

package/i18n/locales/tr.json

@@ -446,6 +446,9 @@
         "none": "Kubernetes manifesti veya Compose dosyası algılanmadı.",
         "applied": "{type} yapılandırması önerildi. Aşağıdaki alanları gözden geçirip ayarlayın.",
         "overlayTitle": "Geçici overlay",
+        "serviceDirTitle": "Servis dağıtım klasörü",
+        "manifestRootTitle": "Manifest konumu",
+        "composeServiceTitle": "Compose servisi",
         "urlSource": "Önerilen ortam URL kaynağı: {source}. Bunu çalışma alanı işleyicisi yönetir; oradan ayarlayın.",
         "namespace": "Manifestler \"{namespace}\" ad alanını sabitliyor; çalışma alanı işleyicisinde buna uymanız önerilir.",
         "confidenceHigh": "Algılandı",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "Kurulumum",
       "signOut": "Oturumu kapat"
+    },
+    "mothership": {
+      "signIn": "Ana sunucu üzerinden oturum aç",
+      "hint": "Projeleriniz ve kimliğiniz barındırılan ana sunucuda tutulur. Bu düğümü bağlamak için orada oturum açın.",
+      "error": "Ana sunucu üzerinden oturum açılamadı. Tekrar deneyin."
     }
   },
   "layout": {

package/i18n/locales/uk.json

@@ -446,6 +446,9 @@
         "none": "Маніфести Kubernetes або файл Compose не виявлено.",
         "applied": "Запропоновано конфігурацію {type}. Перегляньте та скоригуйте поля нижче.",
         "overlayTitle": "Тимчасовий overlay",
+        "serviceDirTitle": "Тека розгортання сервісу",
+        "manifestRootTitle": "Розташування маніфесту",
+        "composeServiceTitle": "Сервіс Compose",
         "urlSource": "Запропоноване джерело URL середовища: {source}. Цим керує обробник робочого простору; налаштуйте його там.",
         "namespace": "Маніфести фіксують простір імен \"{namespace}\"; рекомендуємо дотримуватися його в обробнику робочого простору.",
         "confidenceHigh": "Виявлено",
@@ -829,6 +832,11 @@
     "userMenu": {
       "mySetup": "Моє налаштування",
       "signOut": "Вийти"
+    },
+    "mothership": {
+      "signIn": "Увійти через центральний сервер",
+      "hint": "Ваші проєкти та обліковий запис зберігаються на центральному сервері. Увійдіть там, щоб приєднати цей вузол.",
+      "error": "Не вдалося увійти через центральний сервер. Спробуйте ще раз."
     }
   },
   "layout": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.63.1",
+  "version": "0.65.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.70.1"
+    "@cat-factory/contracts": "0.72.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",