@cat-factory/app 0.85.0 → 0.87.0

package/app/components/board/AddTaskModal.vue

@@ -16,7 +16,7 @@ import { DOC_KINDS } from '~/types/domain'
 import ContextDocumentPicker from '~/components/documents/ContextDocumentPicker.vue'
 import ContextIssuePicker from '~/components/tasks/ContextIssuePicker.vue'
 import { mergePresetOptionLabel, mergePresetThresholds } from '~/utils/mergePreset'
-import { pipelineAllowedForFrame } from '~/utils/pipeline'
+import { pipelineAllowedForManualStart } from '~/utils/pipeline'
 
 const ui = useUiStore()
 const board = useBoardStore()
@@ -197,9 +197,10 @@ const selectedModelPresetLabel = computed(() => {
 })
 
 // Hide UI-testing pipelines (`tester-ui` / `visual-confirmation`) when the target frame has no
-// UI to exercise — they'd be refused server-side (see utils/pipeline + the backend gate).
+// UI to exercise — they'd be refused server-side (see utils/pipeline + the backend gate). Also
+// hide `'recurring'`-only pipelines: a one-off task start of one is refused at run start.
 const selectablePipelines = computed(() =>
-  pipelines.pipelines.filter((p) => pipelineAllowedForFrame(p, frame.value, board.blocks)),
+  pipelines.pipelines.filter((p) => pipelineAllowedForManualStart(p, frame.value, board.blocks)),
 )
 const pipelineMenu = computed(() => [
   [

package/app/components/board/RecurringPipelineModal.vue

@@ -6,7 +6,7 @@
 // pipeline is picked, the workspace issue-tracker choice is surfaced inline (it is
 // where that pipeline files its ticket) and saved alongside.
 import type { Recurrence, ScheduleTemplate } from '~/types/recurring'
-import { pipelineAllowedForFrame } from '~/utils/pipeline'
+import { pipelineAllowedForSchedule } from '~/utils/pipeline'
 
 const ui = useUiStore()
 const board = useBoardStore()
@@ -52,8 +52,9 @@ function defaultRecurrence(): Recurrence {
 }
 
 // Hide UI-testing pipelines when the frame has no UI to exercise — they'd be refused at run start.
+// Also hide `'one-off'`-only pipelines: attaching one to a schedule is refused server-side.
 const selectablePipelines = computed(() =>
-  pipelines.pipelines.filter((p) => pipelineAllowedForFrame(p, frame.value, board.blocks)),
+  pipelines.pipelines.filter((p) => pipelineAllowedForSchedule(p, frame.value, board.blocks)),
 )
 const pipelineMenu = computed(() => [
   selectablePipelines.value.map((p) => ({

package/app/components/board/nodes/BlockNode.vue

@@ -201,8 +201,32 @@ const ITEM_ICON: Record<string, string> = {
 </script>
 
 <template>
+  <!-- ===================== Redacted: repo access denied ===================== -->
+  <!-- This service frame is backed by a repo linked via another member's personal access
+       token that the signed-in user can't reach. The server scrubbed its contents; the SPA
+       shows only the internal id + a "Permission denied" placeholder (never the repo). -->
   <div
-    v-if="block"
+    v-if="block?.accessDenied"
+    class="w-56 overflow-hidden rounded-xl border border-slate-700 bg-slate-900/90 shadow-xl backdrop-blur"
+    :data-block-id="block.id"
+    data-testid="frame-access-denied"
+  >
+    <div class="flex items-center gap-2 border-b border-slate-800 px-3 py-2">
+      <span class="i-lucide-lock h-4 w-4 shrink-0 text-slate-400" />
+      <span class="truncate text-sm font-semibold text-slate-200">{{
+        t('board.frame.accessDenied.title')
+      }}</span>
+    </div>
+    <div class="px-3 py-3">
+      <p class="text-[11px] leading-snug text-slate-400">
+        {{ t('board.frame.accessDenied.hint') }}
+      </p>
+      <code class="mt-2 block truncate font-mono text-[11px] text-slate-500">{{ block.id }}</code>
+    </div>
+  </div>
+
+  <div
+    v-else-if="block"
     class="relative"
     :data-block-id="block.id"
     @pointerenter="enterFrame(block.id)"

package/app/components/focus/BlockFocusView.vue

@@ -2,7 +2,7 @@
 import { onKeyStroke } from '@vueuse/core'
 import type { Block } from '~/types/domain'
 import { blockTypeMeta, STATUS_META } from '~/utils/catalog'
-import { pipelineAllowedForFrame } from '~/utils/pipeline'
+import { pipelineAllowedForManualStart } from '~/utils/pipeline'
 import PipelineProgress from '~/components/pipeline/PipelineProgress.vue'
 
 const board = useBoardStore()
@@ -27,11 +27,12 @@ const deps = computed(() =>
   (block.value?.dependsOn ?? []).map((id) => board.getBlock(id)).filter((b): b is Block => !!b),
 )
 
-// Hide UI-testing pipelines when this block's frame has no UI to exercise (see the backend gate).
+// Hide UI-testing pipelines when this block's frame has no UI to exercise, and `'recurring'`-only
+// pipelines (a manual run of one is refused server-side) — see the backend gate.
 const runMenu = computed(() => {
   const frame = block.value ? board.serviceOf(block.value) : undefined
   return pipelines.pipelines
-    .filter((p) => pipelineAllowedForFrame(p, frame, board.blocks))
+    .filter((p) => pipelineAllowedForManualStart(p, frame, board.blocks))
     .map((p) => ({
       label: p.name,
       icon: 'i-lucide-play',

package/app/components/github/AddServiceFromRepoModal.vue

@@ -27,6 +27,7 @@ const typeItems = useFrameRepoTypeItems()
 const ui = useUiStore()
 const github = useGitHubStore()
 const board = useBoardStore()
+const services = useServicesStore()
 const toast = useToast()
 const { freeFramePosition, focusFrame } = useFramePlacement()
 
@@ -65,9 +66,12 @@ watch(
 const needsGitHub = computed(() => github.available === true && !github.connected)
 
 // Repos already backing a board service can't be added again — UNLESS they're a
-// monorepo, which can host several services (each at its own subdirectory).
+// monorepo, which can host several services (each at its own subdirectory). Derived from
+// the account's service catalog (each service carries the repo it targets), since the repo
+// projection no longer carries a repo→block link.
 const onBoardIds = computed(
-  () => new Set(github.repos.filter((r) => r.blockId).map((r) => r.githubId)),
+  () =>
+    new Set(services.catalog.map((s) => s.repoGithubId).filter((id): id is number => id != null)),
 )
 
 // Map an available repo to a combobox item. The label carries the private/monorepo/
@@ -77,6 +81,9 @@ function toRepoItem(r: GitHubAvailableRepo) {
   const suffix = [
     r.private ? t('github.addService.repoLabel.private') : '',
     r.isMonorepo ? t('github.addService.repoLabel.monorepo') : '',
+    // Reachable only via the signed-in user's PAT (not the workspace App) — its frame is
+    // hidden from members without their own access.
+    r.personal ? t('github.addService.repoLabel.personal') : '',
     onBoard ? t('github.addService.repoLabel.onBoard') : '',
   ].join('')
   return { label: `${r.owner}/${r.name}${suffix}`, value: r.githubId, disabled: onBoard }

package/app/components/panels/InspectorPanel.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import type { Block, BlockStatus } from '~/types/domain'
 import { blockTypeMeta, STATUS_META } from '~/utils/catalog'
-import { pipelineAllowedForFrame } from '~/utils/pipeline'
+import { pipelineAllowedForManualStart } from '~/utils/pipeline'
 import TaskContextDocs from '~/components/documents/TaskContextDocs.vue'
 import TaskContextIssues from '~/components/tasks/TaskContextIssues.vue'
 import TaskAgentConfig from '~/components/panels/inspector/TaskAgentConfig.vue'
@@ -169,12 +169,13 @@ const taskBranchUrl = computed(() => {
   return base ? `${base}/tree/${pr.branch}` : null
 })
 
-// Hide UI-testing pipelines when this block's frame has no UI to exercise — they'd be refused
-// at run start (see utils/pipeline + the backend gate).
+// Hide UI-testing pipelines when this block's frame has no UI to exercise, and `'recurring'`-only
+// pipelines (a manual run of one is refused server-side) — they'd be refused at run start (see
+// utils/pipeline + the backend gate).
 const runMenu = computed(() => {
   const frame = block.value ? board.serviceOf(block.value) : undefined
   return pipelines.pipelines
-    .filter((p) => pipelineAllowedForFrame(p, frame, board.blocks))
+    .filter((p) => pipelineAllowedForManualStart(p, frame, board.blocks))
     .map((p) => ({
       label: p.name,
       icon: 'i-lucide-play',

package/app/components/panels/inspector/TaskRunSettings.vue

@@ -4,7 +4,7 @@ import { connectionNeighborIds } from '@cat-factory/contracts'
 import type { Block } from '~/types/domain'
 import type { WritebackOverride } from '~/types/tracker'
 import { mergePresetOptionLabel, mergePresetThresholds } from '~/utils/mergePreset'
-import { pipelineAllowedForFrame } from '~/utils/pipeline'
+import { pipelineAllowedForManualStart } from '~/utils/pipeline'
 import InspectorSection from '~/components/panels/inspector/InspectorSection.vue'
 
 const props = defineProps<{ block: Block }>()
@@ -132,11 +132,14 @@ function setModelPreset(id: string) {
 const selectedPipeline = computed(() =>
   props.block.pipelineId ? pipelines.getPipeline(props.block.pipelineId) : undefined,
 )
-// Hide UI-testing pipelines when this task's frame has no UI to exercise — they'd be refused at
-// run start (see utils/pipeline + the backend gate).
+// Hide UI-testing pipelines when this task's frame has no UI to exercise, and `'recurring'`-only
+// pipelines (the task's manual Run control can't start one) — they'd be refused at run start
+// (see utils/pipeline + the backend gate).
 const taskFrame = computed(() => board.serviceOf(props.block))
 const selectablePipelines = computed(() =>
-  pipelines.pipelines.filter((p) => pipelineAllowedForFrame(p, taskFrame.value, board.blocks)),
+  pipelines.pipelines.filter((p) =>
+    pipelineAllowedForManualStart(p, taskFrame.value, board.blocks),
+  ),
 )
 const pipelineMenu = computed(() => [
   [

package/app/stores/github.ts

@@ -14,6 +14,7 @@ import type {
   ResyncRequest,
 } from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
+import { useServicesStore } from '~/stores/services'
 
 /**
  * GitHub integration state: the workspace's App installation, the projected
@@ -62,9 +63,14 @@ export const useGitHubStore = defineStore('github', () => {
     return repos.value.find((r) => r.githubId === repoGithubId)
   }
 
-  /** The repo linked to a board block (its backing service repo), if any. */
+  /**
+   * The repo backing a board service frame, if any — resolved through the account-owned
+   * Service bound to the frame (the sole repo↔frame linkage; the projection carries no
+   * repo→block column).
+   */
   function repoForBlock(blockId: string): GitHubRepo | undefined {
-    return repos.value.find((r) => r.blockId === blockId)
+    const service = useServicesStore().serviceByFrameBlock[blockId]
+    return service?.repoGithubId != null ? repoFor(service.repoGithubId) : undefined
   }
 
   function pullsForRepo(repoGithubId: number): GitHubPullRequest[] {

package/app/utils/pipeline.ts

@@ -20,3 +20,33 @@ export function pipelineAllowedForFrame(
 ): boolean {
   return !pipelineHasVisualStep(pipeline) || frameAllowsVisualPipeline(frame, blocks)
 }
+
+// Launch-availability filters, the surface counterpart to the backend's start-origin gate (a
+// `'recurring'`-only pipeline can't be started as a one-off manual task, and a `'one-off'`-only
+// pipeline can't be attached to a schedule). `availability` absent ⇒ `'both'` (unrestricted), so
+// legacy/unset pipelines pass both. Composed with {@link pipelineAllowedForFrame} at each picker.
+
+/**
+ * Whether `pipeline` may be started as a MANUAL one-off task run (the board/inspector Run menus,
+ * the add-task modal, the task run-settings default). Excludes `'recurring'`-only pipelines the
+ * backend would refuse.
+ */
+export function pipelineAllowedForManualStart(
+  pipeline: Pipeline,
+  frame: Block | undefined,
+  blocks: readonly Block[],
+): boolean {
+  return pipeline.availability !== 'recurring' && pipelineAllowedForFrame(pipeline, frame, blocks)
+}
+
+/**
+ * Whether `pipeline` may be attached to a RECURRING schedule (the recurring-pipeline modal).
+ * Excludes `'one-off'`-only pipelines the backend would refuse.
+ */
+export function pipelineAllowedForSchedule(
+  pipeline: Pipeline,
+  frame: Block | undefined,
+  blocks: readonly Block[],
+): boolean {
+  return pipeline.availability !== 'one-off' && pipelineAllowedForFrame(pipeline, frame, blocks)
+}

package/i18n/locales/en.json

@@ -281,7 +281,11 @@
       "dragTask": "Drag task",
       "dragToResize": "Drag to resize",
       "addFirstTask": "Add the first task",
-      "createInitiativeTitle": "Create initiative"
+      "createInitiativeTitle": "Create initiative",
+      "accessDenied": {
+        "title": "Permission denied",
+        "hint": "You don't have access to the repository backing this service."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Decision needed",
@@ -2557,7 +2561,8 @@
       "repoLabel": {
         "private": " (private)",
         "monorepo": " · monorepo",
-        "onBoard": " · already on board"
+        "onBoard": " · already on board",
+        "personal": " · personal (your token)"
       },
       "monorepoLabel": "This is a monorepo (hosts more than one service)",
       "monorepoDescription": "Add several services from one repo, each pinned to a subdirectory.",

package/i18n/locales/es.json

@@ -251,7 +251,11 @@
       "dragTask": "Arrastrar tarea",
       "dragToResize": "Arrastra para cambiar el tamaño",
       "addFirstTask": "Añade la primera tarea",
-      "createInitiativeTitle": "Crear iniciativa"
+      "createInitiativeTitle": "Crear iniciativa",
+      "accessDenied": {
+        "title": "Permiso denegado",
+        "hint": "No tienes acceso al repositorio que respalda este servicio."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Decisión necesaria",
@@ -2481,7 +2485,8 @@
       "repoLabel": {
         "private": " (privado)",
         "monorepo": " · monorepo",
-        "onBoard": " · ya en el tablero"
+        "onBoard": " · ya en el tablero",
+        "personal": " · personal (tu token)"
       },
       "monorepoLabel": "Es un monorepo (aloja más de un servicio)",
       "monorepoDescription": "Añade varios servicios desde un repositorio, cada uno fijado a un subdirectorio.",

package/i18n/locales/fr.json

@@ -251,7 +251,11 @@
       "dragTask": "Faire glisser la tâche",
       "dragToResize": "Glisser pour redimensionner",
       "addFirstTask": "Ajouter la première tâche",
-      "createInitiativeTitle": "Creer une initiative"
+      "createInitiativeTitle": "Creer une initiative",
+      "accessDenied": {
+        "title": "Autorisation refusée",
+        "hint": "Vous n'avez pas accès au dépôt sur lequel repose ce service."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Décision requise",
@@ -2481,7 +2485,8 @@
       "repoLabel": {
         "private": " (privé)",
         "monorepo": " · monorepo",
-        "onBoard": " · déjà sur le tableau"
+        "onBoard": " · déjà sur le tableau",
+        "personal": " · personnel (votre jeton)"
       },
       "monorepoLabel": "Ceci est un monorepo (héberge plusieurs services)",
       "monorepoDescription": "Ajoutez plusieurs services depuis un même dépôt, chacun rattaché à un sous-répertoire.",

package/i18n/locales/he.json

@@ -251,7 +251,11 @@
       "dragTask": "גרור משימה",
       "dragToResize": "גרור לשינוי גודל",
       "addFirstTask": "הוסף את המשימה הראשונה",
-      "createInitiativeTitle": "יצירת יוזמה"
+      "createInitiativeTitle": "יצירת יוזמה",
+      "accessDenied": {
+        "title": "הגישה נדחתה",
+        "hint": "אין לך גישה למאגר שעליו מבוסס שירות זה."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "נדרשת החלטה",
@@ -2492,7 +2496,8 @@
       "repoLabel": {
         "private": " (פרטי)",
         "monorepo": " · מונורפו",
-        "onBoard": " · כבר על הלוח"
+        "onBoard": " · כבר על הלוח",
+        "personal": " · אישי (הטוקן שלך)"
       },
       "monorepoLabel": "זהו מונורפו (מארח יותר משירות אחד)",
       "monorepoDescription": "הוסף כמה שירותים ממאגר אחד, כל אחד מוצמד לתת-ספרייה.",

package/i18n/locales/ja.json

@@ -251,7 +251,11 @@
       "dragTask": "タスクをドラッグ",
       "dragToResize": "ドラッグしてサイズ変更",
       "addFirstTask": "最初のタスクを追加",
-      "createInitiativeTitle": "イニシアチブを作成"
+      "createInitiativeTitle": "イニシアチブを作成",
+      "accessDenied": {
+        "title": "アクセスが拒否されました",
+        "hint": "このサービスの基盤となるリポジトリにアクセスする権限がありません。"
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "判断が必要",
@@ -2494,7 +2498,8 @@
       "repoLabel": {
         "private": " (プライベート)",
         "monorepo": " · モノレポ",
-        "onBoard": " · すでにボード上"
+        "onBoard": " · すでにボード上",
+        "personal": " · 個人（自分のトークン）"
       },
       "monorepoLabel": "これはモノレポです (複数のサービスをホストしています)",
       "monorepoDescription": "1つのリポジトリから複数のサービスを追加し、それぞれをサブディレクトリに固定します。",

package/i18n/locales/pl.json

@@ -251,7 +251,11 @@
       "dragTask": "Przeciągnij zadanie",
       "dragToResize": "Przeciągnij, aby zmienić rozmiar",
       "addFirstTask": "Dodaj pierwsze zadanie",
-      "createInitiativeTitle": "Utworz inicjatywe"
+      "createInitiativeTitle": "Utworz inicjatywe",
+      "accessDenied": {
+        "title": "Brak uprawnień",
+        "hint": "Nie masz dostępu do repozytorium powiązanego z tą usługą."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Wymagana decyzja",
@@ -2481,7 +2485,8 @@
       "repoLabel": {
         "private": " (prywatne)",
         "monorepo": " · monorepo",
-        "onBoard": " · już na tablicy"
+        "onBoard": " · już na tablicy",
+        "personal": " · osobiste (Twój token)"
       },
       "monorepoLabel": "To jest monorepo (zawiera więcej niż jedną usługę)",
       "monorepoDescription": "Dodaj kilka usług z jednego repozytorium, każdą przypiętą do podkatalogu.",

package/i18n/locales/tr.json

@@ -251,7 +251,11 @@
       "dragTask": "Görevi sürükle",
       "dragToResize": "Yeniden boyutlandırmak için sürükle",
       "addFirstTask": "İlk görevi ekle",
-      "createInitiativeTitle": "Girisim olustur"
+      "createInitiativeTitle": "Girisim olustur",
+      "accessDenied": {
+        "title": "İzin reddedildi",
+        "hint": "Bu hizmetin dayandığı depoya erişiminiz yok."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Karar gerekiyor",
@@ -2494,7 +2498,8 @@
       "repoLabel": {
         "private": " (özel)",
         "monorepo": " · monorepo",
-        "onBoard": " · zaten panoda"
+        "onBoard": " · zaten panoda",
+        "personal": " · kişisel (kendi belirteciniz)"
       },
       "monorepoLabel": "Bu bir monorepo (birden fazla servis barındırır)",
       "monorepoDescription": "Tek depodan, her biri bir alt dizine sabitlenmiş birkaç servis ekleyin.",

package/i18n/locales/uk.json

@@ -251,7 +251,11 @@
       "dragTask": "Перетягнути завдання",
       "dragToResize": "Перетягніть, щоб змінити розмір",
       "addFirstTask": "Додати перше завдання",
-      "createInitiativeTitle": "Створити ініціативу"
+      "createInitiativeTitle": "Створити ініціативу",
+      "accessDenied": {
+        "title": "Доступ заборонено",
+        "hint": "У вас немає доступу до репозиторію, що стоїть за цією службою."
+      }
     },
     "decisionBadge": {
       "decisionNeeded": "Потрібне рішення",
@@ -2481,7 +2485,8 @@
       "repoLabel": {
         "private": " (приватний)",
         "monorepo": " · монорепозиторій",
-        "onBoard": " · уже на дошці"
+        "onBoard": " · уже на дошці",
+        "personal": " · особистий (ваш токен)"
       },
       "monorepoLabel": "Це монорепозиторій (містить більше одного сервісу)",
       "monorepoDescription": "Додайте кілька сервісів з одного репозиторію, кожен прикріплений до підкаталогу.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.85.0",
+  "version": "0.87.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "^3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.92.0"
+    "@cat-factory/contracts": "0.94.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",