@cat-factory/app 0.70.1 → 0.71.0

package/app/components/settings/InfraHandlersConfigurator.vue

@@ -31,6 +31,7 @@ const infra = useInfraConfigStore()
 const auth = useAuthStore()
 const ui = useUiStore()
 const toast = useToast()
+const { confirmAction } = useConfirmAction()
 
 const isLocal = computed(() => auth.localMode?.enabled === true)
 
@@ -116,6 +117,26 @@ async function testKube(payload: { config: KubeHandlerConfig; secrets: Record<st
   }
 }
 
+// Test the ALREADY-SAVED workspace kube handler as-is (from its stored non-secret config), so
+// an operator can verify an established connection straight from the list without re-opening the
+// form or re-typing the token — the backend fills the stored token for the probe (empty secrets
+// here ⇒ "use the saved one"). Distinct state from the form's own test so results don't cross.
+const kubeSavedTesting = ref(false)
+const kubeSavedTestResult = ref<TestResult>(null)
+async function testSavedKube() {
+  const config = kubeHandler.value?.config
+  if (!config) return
+  kubeSavedTesting.value = true
+  kubeSavedTestResult.value = null
+  try {
+    kubeSavedTestResult.value = await infra.testHandler({ config, secrets: {} })
+  } catch (e) {
+    kubeSavedTestResult.value = { ok: false, message: e instanceof Error ? e.message : String(e) }
+  } finally {
+    kubeSavedTesting.value = false
+  }
+}
+
 async function testKubeOverride(payload: {
   config: KubeHandlerConfig
   secrets: Record<string, string>
@@ -154,6 +175,7 @@ async function saveKube(payload: { config: KubeHandlerConfig; secrets: Record<st
 }
 
 async function removeKube() {
+  if (!(await confirmAction('remove', t('settings.infrastructure.handler.kubeNoun')))) return
   busy.value = true
   try {
     await infra.unregisterHandler('kubernetes')
@@ -190,6 +212,8 @@ async function saveKubeOverride(payload: {
 }
 
 async function removeKubeOverride() {
+  if (!(await confirmAction('remove', t('settings.infrastructure.handler.kubeOverrideNoun'))))
+    return
   busy.value = true
   try {
     await infra.removeUserHandler('kubernetes')
@@ -311,6 +335,7 @@ async function saveCustom(payload: {
 
 async function removeCustom() {
   if (!selectedCustomId.value) return
+  if (!(await confirmAction('remove', t('settings.infrastructure.handler.customNoun')))) return
   busy.value = true
   try {
     await infra.unregisterHandler('custom', selectedCustomId.value)
@@ -354,22 +379,57 @@ function notifyError(e: unknown) {
       <h3 class="text-sm font-semibold text-slate-200">
         {{ t('inspector.testConfig.provisionTypes.kubernetes') }}
       </h3>
-      <p
+      <!-- Established-connection card: a prominent checkbox signals a connection is stored, and
+           a Test button verifies the SAVED connection (the token is reused server-side) without
+           re-opening the form. Absent ⇒ the "not connected yet" hint. -->
+      <div
         v-if="kubeHandler"
-        class="flex items-center justify-between gap-2 text-[12px] text-slate-300"
+        class="space-y-2 rounded-md border border-emerald-500/30 bg-emerald-500/5 p-2.5"
       >
-        <span>
+        <div class="flex items-start justify-between gap-2">
+          <UCheckbox
+            :model-value="true"
+            disabled
+            size="lg"
+            :label="t('settings.infrastructure.handler.connectionEstablished')"
+            :ui="{ label: 'text-[13px] font-semibold text-emerald-300' }"
+          />
+          <UButton
+            icon="i-lucide-trash-2"
+            color="error"
+            variant="ghost"
+            size="xs"
+            :disabled="busy"
+            :aria-label="t('settings.infrastructure.handler.disconnect')"
+            @click="removeKube"
+          />
+        </div>
+        <p class="pl-7 text-[11px] text-slate-300">
           {{ t('settings.infrastructure.handler.activeEngine') }}
           <span class="text-slate-200">{{ kubeHandlerEngineLabel }}</span>
-        </span>
-        <UButton
-          icon="i-lucide-trash-2"
-          color="error"
-          variant="ghost"
-          size="xs"
-          :disabled="busy"
-          @click="removeKube"
-        />
+        </p>
+        <div class="flex items-center gap-2 pl-7">
+          <UButton
+            color="neutral"
+            variant="soft"
+            size="xs"
+            icon="i-lucide-plug-zap"
+            :loading="kubeSavedTesting"
+            @click="testSavedKube"
+          >
+            {{ t('settings.providerConnection.test.button') }}
+          </UButton>
+          <span v-if="kubeSavedTestResult?.ok" class="text-xs text-emerald-400">
+            {{ kubeSavedTestResult.message ?? t('settings.providerConnection.test.ok') }}
+          </span>
+          <span v-else-if="kubeSavedTestResult" class="text-xs text-rose-400">
+            {{ kubeSavedTestResult.message ?? t('settings.providerConnection.test.failed') }}
+          </span>
+        </div>
+      </div>
+      <p v-else class="flex items-center gap-1.5 text-[12px] text-slate-500">
+        <UIcon name="i-lucide-circle-dashed" class="h-3.5 w-3.5" />
+        {{ t('settings.infrastructure.handler.notConnected') }}
       </p>
 
       <div class="space-y-1">

package/app/components/settings/KubernetesEngineForm.vue

@@ -184,9 +184,19 @@ const urlValid = computed(() => {
 })
 
 const connected = computed(() => !!props.handler)
+// Whether a token is already SAVED for this handler. The value is write-only (never returned),
+// so on edit the token field starts blank and the operator may leave it blank to keep the stored
+// token — the backend falls back to it for both the connection test and the save. A new value
+// entered here replaces it.
+const tokenStored = computed(
+  () => !!props.handler && props.handler.secretKeys.includes(KUBERNETES_ENV_TOKEN_SECRET_KEY),
+)
 const canSave = computed(
   () =>
-    !!form.label.trim() && !!form.apiServerUrl.trim() && !!apiToken.value.trim() && urlValid.value,
+    !!form.label.trim() &&
+    !!form.apiServerUrl.trim() &&
+    (tokenStored.value || !!apiToken.value.trim()) &&
+    urlValid.value,
 )
 
 // Why the Connect button is disabled, surfaced as a red hint next to it so a mandatory-field gap
@@ -198,7 +208,10 @@ const connectBlockedReason = computed(() => {
   if (!form.label.trim()) missing.push(t('settings.infrastructure.kubernetesEngine.label'))
   if (!form.apiServerUrl.trim())
     missing.push(t('settings.infrastructure.kubernetesEngine.apiServerUrl'))
-  if (!apiToken.value.trim()) missing.push(t('settings.infrastructure.kubernetesEngine.apiToken'))
+  // The token is required only for a FIRST connect; on edit a saved token is preserved when
+  // the field is left blank, so don't flag it as missing.
+  if (!tokenStored.value && !apiToken.value.trim())
+    missing.push(t('settings.infrastructure.kubernetesEngine.apiToken'))
   if (form.urlSource === 'ingressTemplate' && !form.hostTemplate.trim())
     missing.push(t('settings.infrastructure.kubernetesEngine.hostTemplate'))
   if (form.urlSource === 'serviceStatus' && !form.serviceName.trim())
@@ -239,9 +252,12 @@ function buildPayload(): KubeHandlerPayload {
   if (form.imageTemplate.trim()) kubernetes.imageTemplate = form.imageTemplate.trim()
   // One honest assertion at the boundary that actually builds the shape (the reactive form is
   // dynamically assembled, then validated server-side); the emitted config flows typed onward.
+  // OMIT the token when the field is blank so the backend preserves the saved one (a blank
+  // secret means "keep it") — only a typed value is sent, and it replaces the stored token.
+  const token = apiToken.value.trim()
   return {
     config: { engine: props.engine, kubernetes } as unknown as KubeHandlerConfig,
-    secrets: { [KUBERNETES_ENV_TOKEN_SECRET_KEY]: apiToken.value.trim() },
+    secrets: token ? { [KUBERNETES_ENV_TOKEN_SECRET_KEY]: token } : {},
   }
 }
 
@@ -322,9 +338,29 @@ async function copyAutoSetupCommand() {
 
     <UFormField
       :label="t('settings.infrastructure.kubernetesEngine.apiToken')"
-      :help="t('settings.infrastructure.kubernetesEngine.apiTokenHelp')"
+      :help="
+        tokenStored
+          ? t('settings.infrastructure.kubernetesEngine.apiTokenHelpStored')
+          : t('settings.infrastructure.kubernetesEngine.apiTokenHelp')
+      "
     >
-      <UInput v-model="apiToken" type="password" class="font-mono" autocomplete="off" />
+      <template v-if="tokenStored" #hint>
+        <span class="inline-flex items-center gap-1 text-[11px] text-emerald-400">
+          <UIcon name="i-lucide-check-circle-2" class="h-3.5 w-3.5" />
+          {{ t('settings.infrastructure.kubernetesEngine.tokenSaved') }}
+        </span>
+      </template>
+      <UInput
+        v-model="apiToken"
+        type="password"
+        class="font-mono"
+        autocomplete="off"
+        :placeholder="
+          tokenStored
+            ? t('settings.infrastructure.kubernetesEngine.apiTokenPlaceholderStored')
+            : undefined
+        "
+      />
     </UFormField>
 
     <!-- URL derivation: how the live environment URL is resolved once the service's

package/app/components/settings/ObservabilityConnectionPanel.vue

@@ -12,6 +12,7 @@ const { t } = useI18n()
 const ui = useUiStore()
 const store = useReleaseHealthStore()
 const toast = useToast()
+const { confirmAction, toastDone } = useConfirmAction()
 
 const open = computed({
   get: () => ui.observabilityConnectionOpen,
@@ -95,9 +96,12 @@ async function saveIncident() {
 }
 
 async function disconnectIncident() {
+  const noun = t('settings.observabilityConnection.incidentNoun')
+  if (!(await confirmAction('disconnect', noun))) return
   incidentBusy.value = true
   try {
     await store.removeIncident()
+    toastDone('disconnect', noun)
   } catch (e) {
     notifyError(t('settings.observabilityConnection.toast.incidentDisconnectFailed'), e)
   } finally {
@@ -127,9 +131,12 @@ async function saveConnection() {
 }
 
 async function disconnect() {
+  const noun = t('settings.observabilityConnection.connectionNoun')
+  if (!(await confirmAction('disconnect', noun))) return
   busy.value = true
   try {
     await store.removeConnection()
+    toastDone('disconnect', noun)
   } catch (e) {
     notifyError(t('settings.observabilityConnection.toast.disconnectFailed'), e)
   } finally {

package/app/components/settings/ProviderConnectionTab.vue

@@ -29,6 +29,7 @@ const emit = defineEmits<{ connected: [] }>()
 const { t } = useI18n()
 const store = useProviderConnectionsStore()
 const toast = useToast()
+const { confirmAction } = useConfirmAction()
 
 const descriptor = computed(() => store.descriptorFor(props.kind))
 const connection = computed(() => store.connectionFor(props.kind))
@@ -250,6 +251,7 @@ async function saveConfig(payload: {
 }
 
 async function remove() {
+  if (!(await confirmAction('remove', descriptor.value?.label ?? props.kind))) return
   busy.value = true
   try {
     await store.remove(props.kind)

package/app/components/tasks/TaskSourceConnectModal.vue

@@ -17,6 +17,7 @@ const { t } = useI18n()
 const ui = useUiStore()
 const tasks = useTasksStore()
 const toast = useToast()
+const { confirmAction } = useConfirmAction()
 
 const source = computed(() => ui.taskConnect?.source ?? null)
 const descriptor = computed(() => (source.value ? tasks.descriptorFor(source.value) : undefined))
@@ -99,12 +100,12 @@ async function startOAuth() {
 
 async function disconnect() {
   if (!source.value) return
+  const label = descriptor.value?.label ?? t('tasks.connect.sourceFallback')
+  if (!(await confirmAction('disconnect', label))) return
   await tasks.disconnect(source.value)
   await tasks.probe()
   toast.add({
-    title: t('tasks.connect.disconnectedToast', {
-      label: descriptor.value?.label ?? t('tasks.connect.sourceFallback'),
-    }),
+    title: t('tasks.connect.disconnectedToast', { label }),
     icon: 'i-lucide-unplug',
   })
   ui.closeTaskConnect()

package/app/composables/useConfirmAction.ts

@@ -0,0 +1,96 @@
+/**
+ * Confirm-gate + success-toast for the recurring destructive actions that aren't board
+ * blocks (disconnect a connection, remove/revoke a credential, clear a config, destroy an
+ * environment). Built on the same `useConfirm()` singleton + `useToast()` the board delete
+ * path uses, so every destructive affordance across the settings/connection surfaces routes
+ * through ONE confirm-then-mutate + toast path rather than each re-inventing its own copy.
+ *
+ * A call site becomes:
+ *
+ *   const { confirmAction, toastDone } = useConfirmAction()
+ *   async function disconnect() {
+ *     if (!(await confirmAction('disconnect', providerName))) return
+ *     await store.remove()
+ *     toastDone('disconnect', providerName)
+ *   }
+ *
+ * The copy is generic (`common.confirm.*` / `common.toast.*`) with the target's name
+ * interpolated, so the irreversibility warning is translated once per locale — not re-worded
+ * per surface. `name` is a short noun for the target (a brand like "Slack", a data value like
+ * the invite email, or a feature noun like "the test environment").
+ */
+type ConfirmShape = 'disconnect' | 'remove' | 'revoke' | 'clear' | 'destroy'
+
+/**
+ * Per-shape copy + iconography. An exhaustive `Record<ConfirmShape, …>` (not an inline
+ * template key) so adding a shape without wiring its copy is a typecheck failure — the
+ * sanctioned guard for enum→message-key lookups the tier-1 typed-keys check can't see.
+ */
+const SHAPE_META: Record<
+  ConfirmShape,
+  { titleKey: string; bodyKey: string; labelKey: string; icon: string; toastKey: string }
+> = {
+  disconnect: {
+    titleKey: 'common.confirm.titles.disconnect',
+    bodyKey: 'common.confirm.reconnectHint',
+    labelKey: 'common.disconnect',
+    icon: 'i-lucide-unplug',
+    toastKey: 'common.toast.disconnected',
+  },
+  remove: {
+    titleKey: 'common.confirm.titles.remove',
+    bodyKey: 'common.confirm.irreversible',
+    labelKey: 'common.remove',
+    icon: 'i-lucide-trash-2',
+    toastKey: 'common.toast.removed',
+  },
+  revoke: {
+    titleKey: 'common.confirm.titles.revoke',
+    bodyKey: 'common.confirm.irreversible',
+    labelKey: 'common.revoke',
+    icon: 'i-lucide-ban',
+    toastKey: 'common.toast.revoked',
+  },
+  clear: {
+    titleKey: 'common.confirm.titles.clear',
+    // A cleared config/connection is re-enterable, so warn it must be reconfigured — not
+    // the harsher `irreversible` copy the remove/revoke/destroy shapes use.
+    bodyKey: 'common.confirm.reconfigureHint',
+    labelKey: 'common.clear',
+    icon: 'i-lucide-eraser',
+    toastKey: 'common.toast.cleared',
+  },
+  destroy: {
+    titleKey: 'common.confirm.titles.destroy',
+    bodyKey: 'common.confirm.irreversible',
+    labelKey: 'common.destroy',
+    icon: 'i-lucide-trash-2',
+    toastKey: 'common.toast.destroyed',
+  },
+}
+
+export function useConfirmAction() {
+  const { confirm } = useConfirm()
+  const toast = useToast()
+  const { t } = useI18n()
+
+  /** Prompt before a destructive action against `name`. Resolves `true` only if confirmed. */
+  async function confirmAction(shape: ConfirmShape, name: string): Promise<boolean> {
+    const meta = SHAPE_META[shape]
+    return confirm({
+      title: t(meta.titleKey, { name }),
+      description: t(meta.bodyKey),
+      variant: 'destructive',
+      confirmLabel: t(meta.labelKey),
+      icon: meta.icon,
+    })
+  }
+
+  /** Toast the completed destructive action (call only on real success). */
+  function toastDone(shape: ConfirmShape, name: string): void {
+    const meta = SHAPE_META[shape]
+    toast.add({ title: t(meta.toastKey, { name }), color: 'success', icon: 'i-lucide-check' })
+  }
+
+  return { confirmAction, toastDone }
+}

package/app/composables/usePipelineErrorToast.ts

@@ -46,6 +46,8 @@ const CONFLICT_TITLE_KEYS: Record<
   bootstrap_not_retryable: 'errors.conflict.title.bootstrap_not_retryable',
   bootstrap_reference_missing: 'errors.conflict.title.bootstrap_reference_missing',
   provision_type_unhandled: 'errors.conflict.title.provision_type_unhandled',
+  preset_unsatisfiable: 'errors.conflict.title.preset_unsatisfiable',
+  visual_pipeline_no_frontend: 'errors.conflict.title.visual_pipeline_no_frontend',
 }
 
 /**

package/app/composables/useWorkspaceStream.ts

@@ -133,12 +133,32 @@ export function useWorkspaceStream() {
 
     socket.onopen = () => {
       attempt = 0
-      connected.value = true
-      // Resync on (re)connect: any event missed while disconnected is reconciled.
-      // The snapshot carries `bootstrapJobs` + executions, so one refresh rehydrates
-      // agentRuns too — a missed terminal event (e.g. a container eviction that
-      // failed the run) can't leave a frame stuck on a stale "bootstrapping…" badge.
-      void workspace.refresh()
+      // Resync on (re)connect BEFORE announcing `connected`: any event missed while
+      // disconnected is reconciled first. The snapshot carries `bootstrapJobs` +
+      // executions, so one refresh rehydrates agentRuns too — a missed terminal event
+      // (e.g. a container eviction that failed the run) can't leave a frame stuck on a
+      // stale "bootstrapping…" badge.
+      //
+      // We flip `connected` only AFTER that refresh settles so it means "connected AND
+      // reconciled". Otherwise `board.hydrate`/`agentRuns.hydrate` reconcile with a
+      // snapshot fetched at connect time, which — under load — can resolve AFTER a fresh
+      // live event and clobber it: e.g. `board.hydrate` REPLACES the block list and drops
+      // a just-created provisional bootstrap frame the stale snapshot never saw, so its
+      // live "bootstrapping…" badge flickers out with no further board event to restore
+      // it. Anything acting on a `connected` board (a user, or an e2e spec gating on
+      // `data-connected`) then does so only after this reconcile, so a lagging resync
+      // can't drop the state that action produces. `connected` is still set on failure
+      // (we ARE connected; a transient refresh error must not wedge the indicator/tests).
+      void workspace
+        .refresh()
+        .catch(() => {})
+        .finally(() => {
+          // A workspace switch (or stop()) may have happened while the refresh was in
+          // flight — don't announce a connection for a socket we've since abandoned.
+          if (!stopped && socket && workspace.workspaceId === workspaceId) {
+            connected.value = true
+          }
+        })
     }
     socket.onmessage = (e) => onMessage(typeof e.data === 'string' ? e.data : '')
     socket.onclose = () => {

package/app/pages/index.vue

@@ -7,6 +7,7 @@ import TranslationWarningBanner from '~/components/layout/TranslationWarningBann
 import GitHubPatBanner from '~/components/layout/GitHubPatBanner.vue'
 import AiProvidersBanner from '~/components/layout/AiProvidersBanner.vue'
 import ProviderConfigBanner from '~/components/layout/ProviderConfigBanner.vue'
+import InfraSetupBanner from '~/components/layout/InfraSetupBanner.vue'
 // Always-mounted, fast-path surfaces (opened frequently during a run / board edits, or
 // store-driven so they must react from anywhere — kept eager for snappy open/close).
 import PipelineBuilder from '~/components/pipeline/PipelineBuilder.vue'
@@ -147,6 +148,8 @@ watch(
       autoOpenedSetup.value = false
       autoOpenedPreset.value = false
       ui.resetAiOnboarding()
+      // Infra-setup banner session dismissals are per-workspace too — clear them on switch.
+      ui.resetInfraSetupDismissals()
       // A different board has its own pipeline library, so re-arm the once-per-session advisory.
       ui.pipelineHealthSeen = false
     }
@@ -248,10 +251,23 @@ watch(
     <TranslationWarningBanner />
     <!-- Local-mode setup prompt (missing GitHub PAT); floats over whatever is shown below. -->
     <GitHubPatBanner />
-    <!-- AI-readiness prompt (no usable model source, or default preset uses unavailable models). -->
-    <AiProvidersBanner v-if="workspace.ready && !needsGitHubInstall && !githubProbePending" />
-    <!-- Infrastructure provider prompt (env/runner-pool wired but missing mandatory config). -->
-    <ProviderConfigBanner v-if="workspace.ready && !needsGitHubInstall && !githubProbePending" />
+    <!-- Stacked advisory banners: one click-through column so concurrent prompts never draw on
+         top of each other (a fresh, unconfigured deployment can raise all three at once — no AI
+         model + no runner pool + no storage). The wrapper is `pointer-events-none`; each banner
+         re-enables pointer events on its own card, so the empty strip never intercepts clicks on
+         the board chrome underneath.
+         - AI-readiness (no usable model source, or default preset uses unavailable models).
+         - Infrastructure provider (env/runner-pool wired but missing mandatory config).
+         - Infra-setup (this deployment needs an executor / test env / storage the operator hasn't
+           defined yet, so a class of agents can't run). -->
+    <div
+      v-if="workspace.ready && !needsGitHubInstall && !githubProbePending"
+      class="pointer-events-none absolute inset-x-0 top-0 z-40 flex flex-col items-center gap-2 px-4 pt-4"
+    >
+      <AiProvidersBanner />
+      <ProviderConfigBanner />
+      <InfraSetupBanner />
+    </div>
 
     <!-- Resolving whether the GitHub App is installed, before we decide what to show. -->
     <div

package/app/stores/agentRuns.spec.ts

@@ -35,14 +35,32 @@ describe('agentRuns store — monotonic bootstrap reconcile', () => {
     store.upsertBootstrap(job('j1', { status: 'failed', updatedAt: 5 }))
     // A lagging `workspace.refresh()` then hydrates a STALE snapshot that still saw
     // the run as `running` (older updatedAt) — it must NOT clobber the terminal state.
-    store.hydrate([job('j1', { status: 'running', updatedAt: 2 })])
+    store.hydrate([job('j1', { status: 'running', updatedAt: 2 })], 'ws_test')
     expect(store.bootstrapJobs[0]!.status).toBe('failed')
     expect(store.byBlock.blk_j1!.status).toBe('failed')
   })
 
+  it('hydrate does NOT drop a live-added run the stale snapshot never saw', () => {
+    // The on-connect resync fires a snapshot fetch BEFORE the bootstrap starts, then a live
+    // `bootstrap: failed` event lands while that fetch is in flight. When the (older) snapshot
+    // finally resolves it does not contain the run at all — mapping over the snapshot alone
+    // would silently drop it, stranding the frame with no further event to correct it.
+    store.upsertBootstrap(job('j1', { status: 'failed', updatedAt: 5 }))
+    store.hydrate([], 'ws_test') // stale snapshot: fetched before the run existed
+    expect(store.bootstrapJobs[0]?.status).toBe('failed')
+    expect(store.byBlock.blk_j1!.status).toBe('failed')
+  })
+
+  it('hydrate DROPS a cached run from a different workspace (board switch starts clean)', () => {
+    store.upsertBootstrap(job('j1', { status: 'failed', updatedAt: 5, workspaceId: 'ws_other' }))
+    // Switching to ws_test: its snapshot must not leak the previous board's run.
+    store.hydrate([job('j2', { workspaceId: 'ws_test' })], 'ws_test')
+    expect(store.bootstrapJobs.map((j) => j.id)).toEqual(['j2'])
+  })
+
   it('hydrate DOES apply a genuinely newer snapshot', () => {
     store.upsertBootstrap(job('j1', { status: 'running', updatedAt: 2 }))
-    store.hydrate([job('j1', { status: 'succeeded', updatedAt: 9 })])
+    store.hydrate([job('j1', { status: 'succeeded', updatedAt: 9 })], 'ws_test')
     expect(store.bootstrapJobs[0]!.status).toBe('succeeded')
   })
 

package/app/stores/agentRuns.ts

@@ -60,23 +60,33 @@ export const useAgentRunsStore = defineStore('agentRuns', () => {
   const envConfigRepairJobs = ref<EnvConfigRepairJob[]>([])
 
   /**
-   * Reconcile the cached bootstrap runs with a server snapshot. A snapshot is
-   * authoritative EXCEPT where a live event has already advanced a run past what
-   * this (possibly stale) read observed: a `board` event triggers a debounced
-   * `workspace.refresh()`, and that snapshot read can resolve AFTER a newer
-   * `bootstrap` event already landed. A blind replace would then REGRESS a terminal
-   * run — e.g. a `failed` bootstrap reverting to `running`, leaving the frame stuck
-   * on the "bootstrapping…" badge with no further event to correct it (a failed run
-   * emits nothing more). Keep the newer-by-`updatedAt` version per id so a lagging
-   * refresh can't clobber a live transition.
+   * Reconcile the cached bootstrap runs with a server snapshot for `workspaceId`. A snapshot is
+   * authoritative EXCEPT where a live event has already advanced (or ADDED) a run past what this
+   * (possibly stale) read observed: a `board` event triggers a debounced `workspace.refresh()`,
+   * and the stream's on-(re)connect resync also refetches — either read can resolve AFTER a newer
+   * `bootstrap` event already landed. Two clobber hazards, both handled here:
+   *   - REGRESS: a run present in BOTH the snapshot and the cache — keep the newer-by-`updatedAt`
+   *     version so a lagging refresh can't revert a `failed`/`succeeded` run to `running`.
+   *   - DROP: a run a live event just ADDED that the (older) snapshot never saw — mapping over the
+   *     snapshot alone would silently drop it, and a terminal bootstrap emits nothing further, so
+   *     the frame would be stranded on a stale "bootstrapping…" badge with no event to correct it.
+   *     Preserve such cached runs. Scoped to `workspaceId` (bootstrap runs carry it), so a board
+   *     SWITCH — whose snapshot is for a different workspace — still discards the previous board's
+   *     runs instead of leaking them onto the new board.
    */
-  function hydrate(jobs: BootstrapJob[]) {
+  function hydrate(jobs: BootstrapJob[], workspaceId: string) {
+    const incomingIds = new Set(jobs.map((j) => j.id))
     const held = new Map(bootstrapJobs.value.map((j) => [j.id, j]))
     const reconciled = jobs.map((incoming) => {
       const current = held.get(incoming.id)
       return current && current.updatedAt > incoming.updatedAt ? current : incoming
     })
-    bootstrapJobs.value = reconciled.sort((a, b) => b.createdAt - a.createdAt)
+    // Live-added runs the snapshot hasn't observed yet — keep only this workspace's (a switch
+    // starts clean), so a resync that races a fresh `bootstrap` event can't drop the run.
+    const preserved = [...held.values()].filter(
+      (j) => !incomingIds.has(j.id) && j.workspaceId === workspaceId,
+    )
+    bootstrapJobs.value = [...reconciled, ...preserved].sort((a, b) => b.createdAt - a.createdAt)
   }
 
   /** Replace the cached env-config-repair runs with a server snapshot. */

package/app/stores/ui.ts

@@ -1,6 +1,6 @@
 import { defineStore } from 'pinia'
 import { ref, computed } from 'vue'
-import type { DocumentSourceKind, TaskSourceKind, LodLevel } from '~/types/domain'
+import type { DocumentSourceKind, TaskSourceKind, LodLevel, InfraSetupArea } from '~/types/domain'
 import type { PendingContext } from '~/composables/useContextLinking'
 import { zoomToLod } from '~/composables/useSemanticZoom'
 import { useExecutionStore } from '~/stores/execution'
@@ -190,6 +190,19 @@ export const useUiStore = defineStore('ui', () => {
   const aiSetupDismissed = ref(false)
   const aiPresetDismissed = ref(false)
 
+  // Infra-setup banner: per-SESSION dismissals, one flag per area, cleared on workspace switch
+  // exactly like the AI-onboarding flags (a dismissal in one workspace must not suppress the
+  // independent prompt for another). The PERMANENT "don't notify me again" dismissal is per-USER
+  // and persists in localStorage from the banner component; this only covers "hide for now".
+  const infraSetupSessionDismissed = ref<InfraSetupArea[]>([])
+  function dismissInfraSetupForSession(area: InfraSetupArea) {
+    if (!infraSetupSessionDismissed.value.includes(area))
+      infraSetupSessionDismissed.value = [...infraSetupSessionDismissed.value, area]
+  }
+  function resetInfraSetupDismissals() {
+    infraSetupSessionDismissed.value = []
+  }
+
   // Dedicated result-view overlay: a step whose agent kind declares a bespoke
   // visualization (via the archetype's `resultView`) opens here instead of the generic
   // prose step-detail panel. `view` is the registry id (e.g. 'requirements-review');
@@ -792,6 +805,9 @@ export const useUiStore = defineStore('ui', () => {
     aiPresetMismatchOpen,
     aiSetupDismissed,
     aiPresetDismissed,
+    infraSetupSessionDismissed,
+    dismissInfraSetupForSession,
+    resetInfraSetupDismissals,
     resultView,
     closeResultView,
     stepDetail,

package/app/stores/workspace.ts

@@ -1,6 +1,6 @@
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
-import type { SpendStatus, Workspace, WorkspaceSnapshot } from '~/types/domain'
+import type { InfraSetup, SpendStatus, Workspace, WorkspaceSnapshot } from '~/types/domain'
 import { useAccountsStore } from '~/stores/accounts'
 import { useBoardStore } from '~/stores/board'
 import { usePipelinesStore } from '~/stores/pipelines'
@@ -49,6 +49,12 @@ export const useWorkspaceStore = defineStore(
     const error = ref<string | null>(null)
     /** Latest spend-safeguard status from the server (null until first load). */
     const spend = ref<SpendStatus | null>(null)
+    /**
+     * Per-area infrastructure-setup status (ephemeral environments / agent executor / binary
+     * storage) from the snapshot, driving the infra-setup banner. Null on an older backend that
+     * doesn't compute it (⇒ no banner).
+     */
+    const infraSetup = ref<InfraSetup | null>(null)
 
     /** The boards belonging to the active account (all boards when auth is off). */
     const accountWorkspaces = computed(() => {
@@ -78,6 +84,7 @@ export const useWorkspaceStore = defineStore(
       }
       workspaceId.value = snapshot.workspace.id
       spend.value = snapshot.spend ?? null
+      infraSetup.value = snapshot.infraSetup ?? null
       // Keep the board list in step (e.g. a freshly created board, or a rename).
       const i = workspaces.value.findIndex((w) => w.id === snapshot.workspace.id)
       if (i >= 0) workspaces.value[i] = snapshot.workspace
@@ -85,7 +92,7 @@ export const useWorkspaceStore = defineStore(
       useBoardStore().hydrate(snapshot.blocks)
       usePipelinesStore().hydrate(snapshot.pipelines, snapshot.pipelineCatalogVersions)
       useExecutionStore().hydrate(snapshot.executions)
-      useAgentRunsStore().hydrate(snapshot.bootstrapJobs ?? [])
+      useAgentRunsStore().hydrate(snapshot.bootstrapJobs ?? [], snapshot.workspace.id)
       useAgentRunsStore().hydrateEnvConfigRepair(snapshot.envConfigRepairJobs ?? [])
       useNotificationsStore().hydrate(snapshot.notifications ?? [])
       useMergePresetsStore().hydrate(
@@ -236,6 +243,7 @@ export const useWorkspaceStore = defineStore(
       ready,
       error,
       spend,
+      infraSetup,
       init,
       switchTo,
       selectAccount,

package/app/types/domain.ts

@@ -54,6 +54,9 @@ export type {
   TaskLimitMode,
   WorkspaceSettings,
   UpdateWorkspaceSettingsInput,
+  InfraSetup,
+  InfraSetupStatus,
+  InfraSetupArea,
   ServiceFragmentDefaults,
   KaizenGradingStatus,
   KaizenGrading,