@cat-factory/app 0.64.0 → 0.66.0

package/app/components/auth/LoginScreen.vue

@@ -32,6 +32,9 @@ const configuredProviders = computed<PatProvider[]>(
 )
 const isLocalMode = computed(() => auth.localMode?.enabled === true)
 const hasConfiguredPat = computed(() => configuredProviders.value.length > 0)
+// Mothership mode: identity + org data live on a hosted mothership, so the primary sign-in is a
+// round-trip to the mothership's OAuth (the node then exchanges the session for a machine token).
+const isMothership = computed(() => auth.localMode?.mothership === true)
 
 const patBusy = ref(false)
 const patError = ref<string | null>(null)
@@ -186,6 +189,29 @@ const noSignInMethod = computed(
         </p>
       </div>
 
+      <!-- Mothership mode: sign in through the hosted mothership (it owns identity + the
+           allowlist). The node exchanges the returned session for a machine token. -->
+      <div v-if="isMothership && mode !== 'forgot'" class="mb-4 space-y-2">
+        <UButton
+          block
+          size="lg"
+          color="primary"
+          icon="i-lucide-cloud"
+          data-testid="mothership-signin"
+          @click="auth.signInViaMothership()"
+        >
+          {{ t('auth.mothership.signIn') }}
+        </UButton>
+        <p class="px-1 text-xs text-slate-400">{{ t('auth.mothership.hint') }}</p>
+        <p
+          v-if="auth.mothershipError"
+          class="px-1 text-xs text-rose-400"
+          data-testid="mothership-error"
+        >
+          {{ t('auth.mothership.error') }}
+        </p>
+      </div>
+
       <!-- Local mode: sign in with the env-configured source-control PAT. The token lives
            server-side (GITHUB_PAT / GITLAB_PAT); we only pick a provider here. -->
       <div v-if="isLocalMode && mode !== 'forgot'" class="space-y-3">

package/app/components/settings/InfraHandlersConfigurator.vue

@@ -29,6 +29,7 @@ import CustomManifestTypeEditor from '~/components/settings/CustomManifestTypeEd
 const { t } = useI18n()
 const infra = useInfraConfigStore()
 const auth = useAuthStore()
+const ui = useUiStore()
 const toast = useToast()
 
 const isLocal = computed(() => auth.localMode?.enabled === true)
@@ -77,6 +78,18 @@ watch(
   { immediate: true },
 )
 
+// A `cat-factory k3s` CLI deep-link (captured by the ui store on app load) always targets the
+// `local-k3s` engine — select it so the workspace form below seeds from the prefill, provided the
+// mode offers it (it's local-mode only). Runs after the handler/engine watcher above so the CLI
+// hand-off wins over the saved-handler default.
+watch(
+  () => ui.k3sSetupPrefill,
+  (prefill) => {
+    if (prefill && kubeEngines.value.includes('local-k3s')) selectedKubeEngine.value = 'local-k3s'
+  },
+  { immediate: true },
+)
+
 const busy = ref(false)
 
 // Connection-probe state for the kube engine forms (workspace + per-user override kept
@@ -384,6 +397,7 @@ function notifyError(e: unknown) {
         :testing="kubeTesting"
         :busy="busy"
         :test-result="kubeTestResult"
+        :prefill="ui.k3sSetupPrefill"
         @test="testKube"
         @save="saveKube"
       />

package/app/components/settings/KubernetesEngineForm.vue

@@ -13,6 +13,7 @@ import type {
   InfraEngine,
   InfraHandlerConfig,
 } from '@cat-factory/contracts'
+import type { K3sSetupPrefill } from '~/stores/ui'
 
 // The kube branch of the discriminated handler config this form produces (the `local-k3s` /
 // `remote-kubernetes` engines share `kubernetesEngineConfigSchema`). Emitting this typed
@@ -30,6 +31,11 @@ const props = defineProps<{
   testing: boolean
   busy: boolean
   testResult: { ok: boolean; message?: string } | null
+  /**
+   * Non-secret values from a `cat-factory k3s` CLI deep-link, seeded into a FRESH `local-k3s`
+   * form so the user only pastes the token + saves. Ignored when editing a saved handler.
+   */
+  prefill?: K3sSetupPrefill | null
 }>()
 
 const emit = defineEmits<{
@@ -144,6 +150,27 @@ watch(
   { immediate: true },
 )
 
+// Seed a FRESH `local-k3s` form from a `cat-factory k3s` CLI deep-link (see the ui store's
+// `consumeK3sSetupDeepLink`). Applied AFTER the engine-default seed above so the CLI's concrete
+// values win, but never over a saved handler (an edit is authoritative) and only for the engine
+// the link targets. Non-empty fields only, so a partial link falls back to the loopback defaults.
+watch(
+  () => props.prefill,
+  (prefill) => {
+    if (!prefill || props.handler || props.engine !== 'local-k3s') return
+    if (prefill.label.trim()) form.label = prefill.label.trim()
+    if (prefill.apiServerUrl.trim()) form.apiServerUrl = prefill.apiServerUrl.trim()
+    if (prefill.insecureSkipTlsVerify !== undefined)
+      form.insecureSkipTlsVerify = prefill.insecureSkipTlsVerify
+    if (prefill.namespaceTemplate.trim()) form.namespaceTemplate = prefill.namespaceTemplate.trim()
+    if (prefill.hostTemplate.trim()) {
+      form.urlSource = 'ingressTemplate'
+      form.hostTemplate = prefill.hostTemplate.trim()
+    }
+  },
+  { immediate: true },
+)
+
 const servicePortValid = computed(() => {
   const raw = form.servicePort.trim()
   if (!raw) return true
@@ -202,6 +229,14 @@ function buildPayload(): KubeHandlerPayload {
 function optional(label: string): string {
   return t('settings.providerConnection.form.optionalLabel', { label })
 }
+
+// The guided-setup CLI command shown in the local-k3s "Auto-setup" affordance. A literal command
+// example (not prose), so it stays inline rather than in the i18n catalog — mirroring the format
+// examples the i18n rules keep out of message bodies.
+const AUTO_SETUP_COMMAND = 'cat-factory k3s'
+async function copyAutoSetupCommand() {
+  await navigator.clipboard?.writeText(AUTO_SETUP_COMMAND)
+}
 </script>
 
 <template>
@@ -221,6 +256,37 @@ function optional(label: string): string {
       {{ t('settings.infrastructure.kubernetesEngine.localK3sHint') }}
     </p>
 
+    <!-- Auto-setup: point the user at the `cat-factory k3s` CLI, which probes/provisions a local
+         cluster, mints the ServiceAccount token, and deep-links back here to pre-fill this form
+         (the token is pasted, never in the link). -->
+    <div
+      v-if="engine === 'local-k3s'"
+      class="rounded-md border border-slate-700 bg-slate-900/40 p-2 space-y-1.5"
+    >
+      <p class="flex items-center gap-1.5 text-[11px] font-semibold text-slate-300">
+        <UIcon name="i-lucide-wand-2" class="h-3.5 w-3.5 text-slate-400" />
+        {{ t('settings.infrastructure.kubernetesEngine.autoSetup.title') }}
+      </p>
+      <p class="text-[11px] text-slate-400">
+        {{ t('settings.infrastructure.kubernetesEngine.autoSetup.description') }}
+      </p>
+      <div class="flex items-center gap-1.5">
+        <code
+          class="flex-1 rounded bg-slate-950 px-2 py-1 font-mono text-[11px] text-slate-200 select-all"
+        >
+          {{ AUTO_SETUP_COMMAND }}
+        </code>
+        <UButton
+          icon="i-lucide-copy"
+          color="neutral"
+          variant="ghost"
+          size="xs"
+          :aria-label="t('common.copy')"
+          @click="copyAutoSetupCommand"
+        />
+      </div>
+    </div>
+
     <UFormField :label="t('settings.infrastructure.kubernetesEngine.label')">
       <UInput
         v-model="form.label"

package/app/composables/api/auth.ts

@@ -1,6 +1,7 @@
 import {
   acceptInvitationContract,
   authConfigContract,
+  connectMothershipContract,
   forgotPasswordContract,
   logoutContract,
   meContract,
@@ -51,6 +52,11 @@ export function authApi({ http, send, ws }: ApiContext) {
 
     logout: () => send(logoutContract, { pathPrefix: '/auth' }),
 
+    // Mothership mode (local facade): hand the local node a mothership SESSION token (captured
+    // from the mothership OAuth redirect fragment). The node exchanges it for a cached machine
+    // token and returns a LOCAL session for the same user. Mounted at the app root (no prefix).
+    connectMothership: (session: string) => send(connectMothershipContract, { body: { session } }),
+
     // Mint a short-lived, workspace-scoped ticket for the events WebSocket. A
     // browser can't set Authorization on a WS handshake, so the socket auths from
     // this `?ticket=` instead of the long-lived session token. Empty string when

package/app/pages/index.vue

@@ -114,7 +114,12 @@ const ui = useUiStore()
 const aiReadiness = useAiReadiness()
 
 // Load the board from the backend before rendering it.
-onMounted(() => workspace.init())
+onMounted(() => {
+  void workspace.init()
+  // Honour a `cat-factory k3s` CLI hand-off (`?infraSetup=local-k3s&…`): open the Infrastructure
+  // window pre-seeded with the provisioned connection so the user only pastes the token + saves.
+  ui.consumeK3sSetupDeepLink()
+})
 
 // Per-session guards so each AI-onboarding dialog auto-opens at most once (later opens are
 // user-driven from the banner). Reset on workspace switch by the catalog watcher below.

package/app/stores/auth.ts

@@ -60,6 +60,12 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * Mothership mode: the last mothership sign-in failure (node unreachable / rejected session),
+     * or null. Set when the post-OAuth connect exchange fails, so the login screen can tell the
+     * user the click didn't take instead of silently returning them to the sign-in button.
+     */
+    const mothershipError = ref<string | null>(null)
     /**
      * True only once `getAuthConfig()` has resolved successfully. Distinguishes "the backend
      * told us auth is off" from "we never reached the backend" (the bootstrap catch path),
@@ -109,9 +115,59 @@ export const useAuthStore = defineStore(
       history.replaceState(null, '', window.location.pathname + window.location.search)
     }
 
+    /**
+     * Mothership mode: when the mothership OAuth redirect returns here (flagged
+     * `?mothership_connect=1`), the URL fragment carries a MOTHERSHIP session — not a local one.
+     * Hand it to our OWN node, which exchanges it for a cached machine token and returns a LOCAL
+     * session for the same user. Returns true when it handled the redirect (so the caller skips
+     * the normal `consumeRedirectToken`, which would wrongly store the mothership session locally).
+     */
+    async function maybeConnectMothership(): Promise<boolean> {
+      if (typeof window === 'undefined') return false
+      const params = new URLSearchParams(window.location.search)
+      if (params.get('mothership_connect') !== '1') return false
+      const match = /(?:^#|[#&])token=([^&]+)/.exec(window.location.hash)
+      const session = match ? decodeURIComponent(match[1]!) : null
+      // Clean the flag + fragment from the URL regardless of outcome, so it isn't left in history.
+      params.delete('mothership_connect')
+      const qs = params.toString()
+      history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
+      if (!session) return true
+      try {
+        const result = await api.connectMothership(session)
+        applySession({ token: result.session, user: result.user })
+        mothershipError.value = null
+      } catch (err) {
+        // Surface the failure so the login screen shows it, rather than silently dropping the
+        // user back on the sign-in button as if the click did nothing. The captured session is
+        // already stripped from the URL, so recovery is a fresh "Sign in via mothership".
+        mothershipError.value =
+          err instanceof Error ? err.message : 'Could not connect to the mothership'
+      }
+      return true
+    }
+
+    /**
+     * Mothership mode: sign in through the hosted mothership. The mothership owns identity + the
+     * allowlist, so we send the browser to ITS OAuth and return here flagged for the connect
+     * exchange (`maybeConnectMothership`). No-op if the mothership URL isn't known.
+     */
+    function signInViaMothership() {
+      if (typeof window === 'undefined') return
+      const base = localMode.value?.mothershipUrl
+      if (!base) return
+      mothershipError.value = null
+      const here = new URL(window.location.origin + window.location.pathname)
+      here.searchParams.set('mothership_connect', '1')
+      const redirect = new URLSearchParams({ redirect: here.toString() })
+      window.location.href = `${base.replace(/\/$/, '')}/auth/login?${redirect}`
+    }
+
     /** Resolve auth state: capture any redirect token, then check the backend. */
     async function bootstrap() {
-      consumeRedirectToken()
+      // A returning mothership-connect redirect is handled first (it carries a mothership session,
+      // which must be exchanged — not stored as a local token by `consumeRedirectToken`).
+      if (!(await maybeConnectMothership())) consumeRedirectToken()
       try {
         const config = await api.getAuthConfig()
         required.value = config.enabled
@@ -277,6 +333,7 @@ export const useAuthStore = defineStore(
       infrastructure,
       autoLoginProvider,
       ready,
+      mothershipError,
       configLoaded,
       isLocalFacade,
       isAuthenticated,
@@ -284,6 +341,7 @@ export const useAuthStore = defineStore(
       bootstrap,
       login,
       loginWithGoogle,
+      signInViaMothership,
       signup,
       passwordLogin,
       patLogin,

package/app/stores/ui.ts

@@ -14,6 +14,21 @@ export interface AddTaskPrefill {
   context?: PendingContext[]
 }
 
+/**
+ * Non-secret `local-k3s` connection values captured from the `cat-factory k3s` CLI deep-link
+ * (`?infraSetup=local-k3s&…`). Mirrors the params `buildK3sSetupUrl` emits (the CLI-side
+ * `k3s-handler.ts`); the ServiceAccount token is intentionally absent — the user pastes it.
+ */
+export interface K3sSetupPrefill {
+  label: string
+  apiServerUrl: string
+  namespaceTemplate: string
+  hostTemplate: string
+  // Absent when the link omitted the param, so the form keeps its engine default rather than
+  // forcing verification back on (which would break a self-signed local cluster).
+  insecureSkipTlsVerify?: boolean
+}
+
 /** Transient UI state: selection, panels, zoom level. */
 export const useUiStore = defineStore('ui', () => {
   const selectedBlockId = ref<string | null>(null)
@@ -143,6 +158,11 @@ export const useUiStore = defineStore('ui', () => {
   // `openProviderConnection(kind)` remains for deep-links (a banner's "Configure…" button).
   const infrastructureOpen = ref(false)
   const infrastructureTab = ref<'environment' | 'runner-pool'>('runner-pool')
+  // Non-secret prefill captured from the `cat-factory k3s` CLI deep-link (see
+  // `consumeK3sSetupDeepLink`). When set, the Test-environments tab's kube engine form seeds the
+  // `local-k3s` connection from it; the ServiceAccount token is deliberately NOT in the link (a
+  // secret in a URL leaks into history/logs), so the user still pastes it before Test → Save.
+  const k3sSetupPrefill = ref<K3sSetupPrefill | null>(null)
   const modelConfigOpen = ref(false)
   // LLM-vendor subscription credentials (the token pool powering the Claude Code
   // / Codex harnesses). `vendorCredentialsTab` lets a caller deep-link to one tab —
@@ -530,6 +550,44 @@ export const useUiStore = defineStore('ui', () => {
   }
   function closeProviderConnection() {
     infrastructureOpen.value = false
+    // Drop any consumed CLI prefill so re-opening the window normally doesn't re-seed the form.
+    k3sSetupPrefill.value = null
+  }
+  // Capture a `cat-factory k3s` deep-link (`?infraSetup=local-k3s&…`) on app load: stash the
+  // non-secret connection values, open the Infrastructure window on the Test-environments tab so
+  // the kube engine form seeds from them, then strip the params from the URL (mirrors the
+  // `?invite=` handling in the auth store) so a reload doesn't re-trigger and the link isn't left
+  // in history. No-op when the query param is absent.
+  function consumeK3sSetupDeepLink() {
+    if (typeof window === 'undefined') return
+    const params = new URLSearchParams(window.location.search)
+    if (params.get('infraSetup') !== 'local-k3s') return
+    k3sSetupPrefill.value = {
+      label: params.get('label') ?? 'Local k3s',
+      apiServerUrl: params.get('apiServerUrl') ?? '',
+      namespaceTemplate: params.get('namespaceTemplate') ?? '',
+      hostTemplate: params.get('hostTemplate') ?? '',
+      // Only carry the flag the link actually set — a missing param leaves the form's engine
+      // default (skip-TLS on for a local self-signed cluster) untouched.
+      insecureSkipTlsVerify: params.has('insecureSkipTlsVerify')
+        ? params.get('insecureSkipTlsVerify') === '1'
+        : undefined,
+    }
+    resetHubReturn()
+    infrastructureTab.value = 'environment'
+    infrastructureOpen.value = true
+    for (const key of [
+      'infraSetup',
+      'label',
+      'apiServerUrl',
+      'namespaceTemplate',
+      'hostTemplate',
+      'insecureSkipTlsVerify',
+    ]) {
+      params.delete(key)
+    }
+    const qs = params.toString()
+    history.replaceState(null, '', window.location.pathname + (qs ? `?${qs}` : ''))
   }
   function openModelConfig() {
     modelConfigOpen.value = true
@@ -792,6 +850,8 @@ export const useUiStore = defineStore('ui', () => {
     closeObservabilityConnection,
     openProviderConnection,
     closeProviderConnection,
+    k3sSetupPrefill,
+    consumeK3sSetupDeepLink,
     openModelConfig,
     closeModelConfig,
     openVendorCredentials,

package/i18n/locales/en.json

@@ -12,6 +12,7 @@
     "save": "Save",
     "cancel": "Cancel",
     "retry": "Retry",
+    "copy": "Copy",
     "block": "Block",
     "@block": {
       "description": "Generic fallback NOUN for a board item whose title is unknown (a service / module / task node). Not the verb 'to block'."
@@ -872,6 +873,11 @@
     "userMenu": {
       "mySetup": "My setup",
       "signOut": "Sign out"
+    },
+    "mothership": {
+      "signIn": "Sign in via mothership",
+      "hint": "Your projects and identity live on the hosted mothership. Sign in there to connect this node.",
+      "error": "Could not sign in via the mothership. Try again."
     }
   },
   "layout": {
@@ -1348,6 +1354,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Prefilled for a local k3s/k3d/kind cluster on this machine. Bind a ServiceAccount to a role, mint its token with `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+), and paste it below. Then choose how the environment URL is derived, and edit the API server URL if your cluster listens on a different port.",
+        "autoSetup": {
+          "title": "Auto-setup with the CLI",
+          "description": "Run this in your terminal to probe or provision a local cluster, mint a ServiceAccount token, and open this form pre-filled. Paste the token it prints, then Test and Save."
+        },
         "label": "Connection label",
         "labelPlaceholder": "Preview cluster",
         "apiServerUrl": "API server URL",

package/i18n/locales/es.json

@@ -12,6 +12,7 @@
     "save": "Guardar",
     "cancel": "Cancelar",
     "retry": "Reintentar",
+    "copy": "Copiar",
     "actionFailed": "La acción falló",
     "close": "Cerrar",
     "block": "Bloque"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "Mi configuración",
       "signOut": "Cerrar sesión"
+    },
+    "mothership": {
+      "signIn": "Iniciar sesión con la central",
+      "hint": "Tus proyectos e identidad están en la central alojada: inicia sesión allí para conectar este nodo.",
+      "error": "No se pudo iniciar sesión con la central. Inténtalo de nuevo."
     }
   },
   "layout": {
@@ -1757,6 +1763,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Precargado para un clúster local k3s/k3d/kind en esta máquina. Vincula una ServiceAccount a un rol, genera su token con `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) y pégalo abajo. Luego elige cómo se deriva la URL del entorno y edita la URL del API server si tu clúster escucha en otro puerto.",
+        "autoSetup": {
+          "title": "Configuración automática con la CLI",
+          "description": "Ejecútalo en tu terminal para detectar o aprovisionar un clúster local, generar un token de ServiceAccount y abrir este formulario ya rellenado. Pega el token que muestra y luego pulsa Probar y Guardar."
+        },
         "label": "Etiqueta de la conexión",
         "labelPlaceholder": "Clúster de vista previa",
         "apiServerUrl": "URL del API server",

package/i18n/locales/fr.json

@@ -12,6 +12,7 @@
     "save": "Enregistrer",
     "cancel": "Annuler",
     "retry": "Réessayer",
+    "copy": "Copier",
     "actionFailed": "Échec de l’action",
     "close": "Fermer",
     "block": "Bloc"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "Ma configuration",
       "signOut": "Se déconnecter"
+    },
+    "mothership": {
+      "signIn": "Se connecter via le serveur central",
+      "hint": "Vos projets et votre identité sont sur le serveur central hébergé. Connectez-vous là-bas pour relier ce nœud.",
+      "error": "Impossible de se connecter via le serveur central. Réessayez."
     }
   },
   "layout": {
@@ -1757,6 +1763,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Prérempli pour un cluster local k3s/k3d/kind sur cette machine. Liez un ServiceAccount à un rôle, générez son token avec `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) et collez-le ci-dessous. Choisissez ensuite comment l'URL de l'environnement est dérivée, et modifiez l'URL de l'API server si votre cluster écoute sur un autre port.",
+        "autoSetup": {
+          "title": "Configuration automatique avec la CLI",
+          "description": "Exécutez-le dans votre terminal pour détecter ou provisionner un cluster local, générer un jeton de ServiceAccount et ouvrir ce formulaire prérempli. Collez le jeton affiché, puis cliquez sur Tester et Enregistrer."
+        },
         "label": "Libellé de la connexion",
         "labelPlaceholder": "Cluster de prévisualisation",
         "apiServerUrl": "URL de l'API server",

package/i18n/locales/he.json

@@ -12,6 +12,7 @@
     "save": "שמור",
     "cancel": "ביטול",
     "retry": "נסה שוב",
+    "copy": "העתק",
     "block": "בלוק",
     "actionFailed": "הפעולה נכשלה",
     "close": "סגור"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "ההגדרות שלי",
       "signOut": "התנתק"
+    },
+    "mothership": {
+      "signIn": "התחברות דרך שרת המרכז",
+      "hint": "הפרויקטים והזהות שלך נמצאים בשרת המרכז המתארח. התחבר שם כדי לחבר את הצומת הזה.",
+      "error": "לא ניתן להתחבר דרך שרת המרכז. נסה שוב."
     }
   },
   "layout": {
@@ -1306,6 +1312,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "מולא מראש עבור אשכול k3s/k3d/kind מקומי במחשב הזה. קשרו ServiceAccount לתפקיד, הנפיקו עבורו token באמצעות `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) והדביקו אותו למטה. לאחר מכן בחרו כיצד נגזרת כתובת ה-URL של הסביבה, וערכו את כתובת ה-API server אם האשכול שלכם מאזין ביציאה אחרת.",
+        "autoSetup": {
+          "title": "הגדרה אוטומטית באמצעות ה-CLI",
+          "description": "הרץ זאת בטרמינל כדי לזהות או להקצות אשכול מקומי, ליצור אסימון ServiceAccount ולפתוח טופס זה כשהוא ממולא מראש. הדבק את האסימון המוצג, ולאחר מכן בצע בדיקה ושמירה."
+        },
         "label": "תווית החיבור",
         "labelPlaceholder": "אשכול תצוגה מקדימה",
         "apiServerUrl": "כתובת ה-API server",

package/i18n/locales/ja.json

@@ -12,6 +12,7 @@
     "save": "保存",
     "cancel": "キャンセル",
     "retry": "再試行",
+    "copy": "コピー",
     "block": "ブロック",
     "actionFailed": "操作に失敗しました",
     "close": "閉じる"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "マイセットアップ",
       "signOut": "サインアウト"
+    },
+    "mothership": {
+      "signIn": "マザーシップ経由でサインイン",
+      "hint": "プロジェクトと認証情報はホスト型のマザーシップにあります。そこでサインインしてこのノードを接続してください。",
+      "error": "マザーシップ経由でサインインできませんでした。もう一度お試しください。"
     }
   },
   "layout": {
@@ -1308,6 +1314,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "このマシン上のローカル k3s/k3d/kind クラスター向けにあらかじめ入力されています。ServiceAccount をロールにバインドし、`kubectl create token NAME -n NAMESPACE`（Kubernetes 1.24 以降）でトークンを発行して下記に貼り付けてください。その後、環境 URL の導出方法を選択し、クラスターが別のポートで待ち受けている場合は API サーバー URL を編集してください。",
+        "autoSetup": {
+          "title": "CLI による自動セットアップ",
+          "description": "これをターミナルで実行すると、ローカルクラスターを検出またはプロビジョニングし、ServiceAccount トークンを生成して、このフォームを事前入力した状態で開きます。表示されたトークンを貼り付けてから、テストして保存してください。"
+        },
         "label": "接続ラベル",
         "labelPlaceholder": "プレビュークラスター",
         "apiServerUrl": "API サーバー URL",

package/i18n/locales/pl.json

@@ -12,6 +12,7 @@
     "save": "Zapisz",
     "cancel": "Anuluj",
     "retry": "Ponów",
+    "copy": "Kopiuj",
     "actionFailed": "Akcja nie powiodła się",
     "close": "Zamknij",
     "block": "Blok"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "Moja konfiguracja",
       "signOut": "Wyloguj się"
+    },
+    "mothership": {
+      "signIn": "Zaloguj się przez serwer centralny",
+      "hint": "Twoje projekty i tożsamość znajdują się na hostowanym serwerze centralnym. Zaloguj się tam, aby połączyć ten węzeł.",
+      "error": "Nie udało się zalogować przez serwer centralny. Spróbuj ponownie."
     }
   },
   "layout": {
@@ -1757,6 +1763,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Wstępnie wypełnione dla lokalnego klastra k3s/k3d/kind na tym komputerze. Powiąż ServiceAccount z rolą, wygeneruj jego token poleceniem `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) i wklej go poniżej. Następnie wybierz sposób ustalania adresu URL środowiska i zmień URL serwera API, jeśli Twój klaster nasłuchuje na innym porcie.",
+        "autoSetup": {
+          "title": "Automatyczna konfiguracja przez CLI",
+          "description": "Uruchom to w terminalu, aby wykryć lub udostępnić lokalny klaster, wygenerować token ServiceAccount i otworzyć ten formularz wstępnie wypełniony. Wklej wyświetlony token, a następnie kliknij Przetestuj i Zapisz."
+        },
         "label": "Etykieta połączenia",
         "labelPlaceholder": "Klaster podglądu",
         "apiServerUrl": "URL serwera API",

package/i18n/locales/tr.json

@@ -12,6 +12,7 @@
     "save": "Kaydet",
     "cancel": "İptal",
     "retry": "Yeniden dene",
+    "copy": "Kopyala",
     "block": "Blok",
     "actionFailed": "İşlem başarısız oldu",
     "close": "Kapat"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "Kurulumum",
       "signOut": "Oturumu kapat"
+    },
+    "mothership": {
+      "signIn": "Ana sunucu üzerinden oturum aç",
+      "hint": "Projeleriniz ve kimliğiniz barındırılan ana sunucuda tutulur. Bu düğümü bağlamak için orada oturum açın.",
+      "error": "Ana sunucu üzerinden oturum açılamadı. Tekrar deneyin."
     }
   },
   "layout": {
@@ -1308,6 +1314,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Bu makinedeki yerel bir k3s/k3d/kind kümesi için önceden dolduruldu. Bir ServiceAccount'u bir role bağlayın, `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) ile token'ını oluşturun ve aşağıya yapıştırın. Ardından ortam URL'sinin nasıl türetileceğini seçin ve kümeniz farklı bir bağlantı noktasını dinliyorsa API sunucu URL'sini düzenleyin.",
+        "autoSetup": {
+          "title": "CLI ile otomatik kurulum",
+          "description": "Yerel bir kümeyi algılamak veya sağlamak, bir ServiceAccount belirteci oluşturmak ve bu formu önceden doldurulmuş olarak açmak için bunu terminalinizde çalıştırın. Yazdırdığı belirteci yapıştırın, ardından Test edin ve Kaydedin."
+        },
         "label": "Bağlantı etiketi",
         "labelPlaceholder": "Önizleme kümesi",
         "apiServerUrl": "API sunucu URL'si",

package/i18n/locales/uk.json

@@ -12,6 +12,7 @@
     "save": "Зберегти",
     "cancel": "Скасувати",
     "retry": "Повторити",
+    "copy": "Копіювати",
     "actionFailed": "Не вдалося виконати дію",
     "close": "Закрити",
     "block": "Блок"
@@ -832,6 +833,11 @@
     "userMenu": {
       "mySetup": "Моє налаштування",
       "signOut": "Вийти"
+    },
+    "mothership": {
+      "signIn": "Увійти через центральний сервер",
+      "hint": "Ваші проєкти та обліковий запис зберігаються на центральному сервері. Увійдіть там, щоб приєднати цей вузол.",
+      "error": "Не вдалося увійти через центральний сервер. Спробуйте ще раз."
     }
   },
   "layout": {
@@ -1757,6 +1763,10 @@
       },
       "kubernetesEngine": {
         "localK3sHint": "Попередньо заповнено для локального кластера k3s/k3d/kind на цьому комп'ютері. Прив'яжіть ServiceAccount до ролі, згенеруйте його токен командою `kubectl create token NAME -n NAMESPACE` (Kubernetes 1.24+) і вставте його нижче. Потім виберіть, як визначається URL середовища, і змініть URL сервера API, якщо ваш кластер слухає на іншому порту.",
+        "autoSetup": {
+          "title": "Автоматичне налаштування через CLI",
+          "description": "Запустіть це в терміналі, щоб виявити або підготувати локальний кластер, згенерувати токен ServiceAccount і відкрити цю форму заздалегідь заповненою. Вставте показаний токен, потім натисніть «Перевірити» та «Зберегти»."
+        },
         "label": "Мітка з'єднання",
         "labelPlaceholder": "Кластер попереднього перегляду",
         "apiServerUrl": "URL сервера API",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.64.0",
+  "version": "0.66.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.71.0"
+    "@cat-factory/contracts": "0.72.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",