@catalyst-cloud/cli 0.14.4 → 0.14.6

package/dist/onboard-github.js

@@ -0,0 +1,329 @@
+import { loadConfig, normalizeBaseUrl } from "./config.js";
+import { pollConsent } from "./onboard-consent.js";
+const STATUS = "/api/v1/me/connections/github/workspace";
+const HANDOFF = "/connect/github/workspace/handoff";
+const idPattern = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+const states = new Set([
+    "connected",
+    "missing-scope",
+    "expired-or-revoked",
+    "unreachable",
+    "not-connected",
+]);
+const object = (v) => v !== null && typeof v === "object" && !Array.isArray(v)
+    ? v
+    : null;
+const waiting = (reason) => ({
+    state: "waiting",
+    reason,
+});
+const nullableText = (v) => v === null || typeof v === "string";
+/** A bounded read never rotates credentials or writes a token after the receipt lock is released. */
+async function read(ctx, journal, path, timeoutMs, external) {
+    const cfg = loadConfig(ctx.home);
+    if (!cfg?.user)
+        return { reason: "personal_login_required" };
+    const personId = cfg.user.id;
+    if ((journal.account ?? journal.tenant) !== cfg.account ||
+        journal.membershipId !== cfg.user.id ||
+        !journal.baseUrl ||
+        normalizeBaseUrl(journal.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+        return { reason: "github_installation_identity_refused" };
+    const expiry = cfg.auth
+        ? Date.parse(cfg.auth.expiresAt) - ctx.now().getTime()
+        : 0;
+    const bearer = cfg.key ||
+        (cfg.auth && Number.isFinite(expiry) && expiry > 30_000
+            ? cfg.auth.accessToken
+            : undefined);
+    if (!bearer)
+        return { reason: "github_installation_login_refresh_required" };
+    const deadline = new AbortController();
+    const timer = setTimeout(() => deadline.abort(), timeoutMs);
+    const signal = external
+        ? AbortSignal.any([external, deadline.signal])
+        : deadline.signal;
+    let remove = () => { };
+    try {
+        return await new Promise((resolve) => {
+            const stopped = () => resolve({
+                reason: external?.aborted
+                    ? "interrupted"
+                    : "github_installation_status_unavailable",
+            });
+            if (signal.aborted) {
+                stopped();
+                return;
+            }
+            signal.addEventListener("abort", stopped, { once: true });
+            remove = () => signal.removeEventListener("abort", stopped);
+            Promise.resolve()
+                .then(async () => {
+                if (signal.aborted)
+                    return { reason: "interrupted" };
+                const response = await ctx.fetch(`${normalizeBaseUrl(cfg.baseUrl)}${path}`, {
+                    method: "GET",
+                    redirect: "error",
+                    headers: {
+                        authorization: `Bearer ${bearer}`,
+                        accept: "application/json",
+                    },
+                    signal,
+                });
+                // Refusal bodies and provider diagnostics are never parsed, returned or printed.
+                if (response.status !== 200)
+                    return { status: response.status };
+                const body = await response.json();
+                const current = loadConfig(ctx.home);
+                if (!current?.user ||
+                    current.account !== cfg.account ||
+                    current.user.id !== personId ||
+                    normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                    return { reason: "github_installation_identity_refused" };
+                return { status: 200, body };
+            })
+                .then((value) => (signal.aborted ? stopped() : resolve(value)), () => signal.aborted
+                ? stopped()
+                : resolve({ reason: "github_installation_status_unavailable" }));
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        remove();
+    }
+}
+function readFailure(value) {
+    if ("reason" in value)
+        return value.reason === "github_installation_identity_refused" ||
+            value.reason === "personal_login_required"
+            ? { state: "refused", reason: value.reason }
+            : waiting(value.reason);
+    if (value.status === 401 || value.status === 403)
+        return { state: "refused", reason: "github_installation_consent_refused" };
+    return value.status === 200
+        ? null
+        : waiting("github_installation_status_unavailable");
+}
+/** Every reported installation must have a fresh live installation/App-permission probe.
+ * This proves installation connectivity, not access to repositories selected later in Q3. */
+function observation(body, now) {
+    const row = object(body);
+    if (!row ||
+        typeof row.connected !== "boolean" ||
+        !Array.isArray(row.installations) ||
+        !Array.isArray(row.pending) ||
+        row.installations.length + row.pending.length > 100)
+        return waiting("github_installation_status_shape");
+    const ids = [];
+    let unknown = false;
+    let allConnected = row.installations.length > 0;
+    let checkedAt = now + 30_000;
+    for (const value of row.installations) {
+        const item = object(value);
+        const verification = object(item?.verification);
+        if (!item ||
+            typeof item.installationId !== "string" ||
+            !idPattern.test(item.installationId) ||
+            ids.includes(item.installationId) ||
+            !nullableText(item.githubOrg) ||
+            (typeof item.githubOrg === "string" &&
+                !/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/.test(item.githubOrg)) ||
+            !verification)
+            return waiting("github_installation_status_shape");
+        ids.push(item.installationId);
+        if (verification.source === "none" &&
+            verification.state === "not-run" &&
+            verification.checkedAt === null) {
+            unknown = true;
+            allConnected = false;
+            continue;
+        }
+        if (verification.source !== "live-probe" ||
+            typeof verification.state !== "string" ||
+            !states.has(verification.state) ||
+            typeof verification.checkedAt !== "number" ||
+            !Number.isFinite(verification.checkedAt) ||
+            verification.checkedAt < now - 120_000 ||
+            verification.checkedAt > now + 30_000)
+            return waiting("github_installation_status_shape");
+        if (verification.missing !== undefined &&
+            (!Array.isArray(verification.missing) ||
+                verification.missing.length > 128 ||
+                !verification.missing.every((name) => typeof name === "string" &&
+                    (/^[A-Za-z0-9_-]{1,128}$/.test(name) ||
+                        /^[A-Za-z0-9_-]{1,80} \((?:read|write|admin)\)$/.test(name)))))
+            return waiting("github_installation_status_shape");
+        checkedAt = Math.min(checkedAt, verification.checkedAt);
+        if (verification.state === "unreachable")
+            unknown = true;
+        if (verification.state !== "connected")
+            allConnected = false;
+    }
+    for (const value of row.pending) {
+        const pending = object(value);
+        if (!pending ||
+            !nullableText(pending.githubOrg) ||
+            (typeof pending.githubOrg === "string" &&
+                !/^[A-Za-z0-9][A-Za-z0-9-]{0,127}$/.test(pending.githubOrg)) ||
+            typeof pending.requestedAt !== "number" ||
+            !Number.isFinite(pending.requestedAt) ||
+            pending.requestedAt < 0)
+            return waiting("github_installation_status_shape");
+    }
+    if (row.connected !== allConnected)
+        return waiting("github_installation_status_shape");
+    if (unknown)
+        return waiting("github_installation_status_unavailable");
+    if (!allConnected)
+        return { state: "pending" };
+    return {
+        state: "done",
+        evidence: {
+            provider: "github",
+            installation: JSON.stringify(ids),
+            checkedAt,
+        },
+    };
+}
+function safeHandoff(body, ctx) {
+    const row = object(body);
+    const cfg = loadConfig(ctx.home);
+    if (!cfg ||
+        !row ||
+        typeof row.authorizationUrl !== "string" ||
+        row.authorizationUrl.length > 8192 ||
+        /[\u0000-\u0020\u007f]/.test(row.authorizationUrl) ||
+        typeof row.expiresAt !== "number" ||
+        !Number.isFinite(row.expiresAt))
+        return null;
+    const remaining = row.expiresAt - ctx.now().getTime();
+    // Thirty seconds accommodates clock skew; an expired link is never launched.
+    if (remaining <= 0 || remaining > 630_000)
+        return null;
+    try {
+        const url = new URL(row.authorizationUrl);
+        const keys = [...url.searchParams.keys()];
+        const handoff = url.searchParams.get("handoff");
+        if (url.protocol !== "https:" ||
+            url.origin !== new URL(normalizeBaseUrl(cfg.baseUrl)).origin ||
+            url.username ||
+            url.password ||
+            url.pathname !== HANDOFF ||
+            url.hash ||
+            keys.length !== 1 ||
+            keys[0] !== "handoff" ||
+            !handoff ||
+            handoff.length > 4096 ||
+            /[\s\u0000-\u001f\u007f]/.test(handoff))
+            return null;
+        return url.toString();
+    }
+    catch {
+        return null;
+    }
+}
+/** Uses personal bearer App-install routes. Older clouds wait without a browser/session fallback. */
+export function githubInstallationAdapter(options) {
+    const timeoutMs = options.requestTimeoutMs ?? 30_000;
+    const consentTimeoutMs = options.consentTimeoutMs ?? 600_000;
+    if (!Number.isSafeInteger(timeoutMs) ||
+        timeoutMs < 1 ||
+        timeoutMs > 30_000 ||
+        !Number.isSafeInteger(consentTimeoutMs) ||
+        consentTimeoutMs < 1 ||
+        consentTimeoutMs > 600_000)
+        throw new Error("github_installation_timeout_invalid");
+    const inspect = async (ctx, journal, signal) => {
+        const result = await read(ctx, journal, STATUS, timeoutMs, signal);
+        if ("status" in result && [404, 405].includes(result.status))
+            return {
+                result: waiting("cloud_capability_unavailable"),
+                unsupported: true,
+            };
+        const failure = readFailure(result);
+        return {
+            result: failure ??
+                observation("body" in result ? result.body : undefined, ctx.now().getTime()),
+        };
+    };
+    return {
+        check: async (ctx, journal, signal) => (await inspect(ctx, journal, signal)).result,
+        act: async (ctx, journal, signal) => {
+            const cfg = loadConfig(ctx.home);
+            if (!cfg?.user || !["owner", "admin"].includes(cfg.user.role))
+                return {
+                    state: "refused",
+                    reason: "github_installation_admin_required",
+                };
+            if (signal?.aborted)
+                return waiting("interrupted");
+            const before = await inspect(ctx, journal, signal);
+            if (before.result.state !== "pending")
+                return before.result;
+            if (before.unsupported)
+                return waiting("cloud_capability_unavailable");
+            const start = await read(ctx, journal, `${STATUS}/start`, timeoutMs, signal);
+            if ("status" in start && [404, 405].includes(start.status))
+                return waiting("cloud_capability_unavailable");
+            const failure = readFailure(start);
+            if (failure)
+                return failure;
+            const url = safeHandoff("body" in start ? start.body : undefined, ctx);
+            if (!url)
+                return {
+                    state: "refused",
+                    reason: "github_installation_consent_handoff",
+                };
+            if (signal?.aborted)
+                return waiting("interrupted");
+            const current = loadConfig(ctx.home);
+            if (!current?.user ||
+                current.account !== cfg.account ||
+                current.user.id !== cfg.user.id ||
+                normalizeBaseUrl(current.baseUrl) !== normalizeBaseUrl(cfg.baseUrl))
+                return {
+                    state: "refused",
+                    reason: "github_installation_identity_refused",
+                };
+            if (!["owner", "admin"].includes(current.user.role))
+                return {
+                    state: "refused",
+                    reason: "github_installation_admin_required",
+                };
+            ctx.stderr("Approve the GitHub App installation in your browser. Your personal GitHub connection is checked separately.");
+            // The signed URL is transient credential material: only the browser receives it.
+            try {
+                options.openBrowser(url);
+            }
+            catch {
+                return waiting("github_installation_browser_unavailable");
+            }
+            let latest = waiting("github_installation_status_unavailable");
+            const run = () => pollConsent({
+                timeoutMs: consentTimeoutMs,
+                signal,
+                sleep: options.sleep,
+                readStatus: async (pollSignal) => {
+                    const value = await inspect(ctx, journal, pollSignal);
+                    latest = value.result;
+                    if (value.unsupported)
+                        return {
+                            outcome: "waiting",
+                            reason: "cloud_capability_unavailable",
+                        };
+                    if (latest.state === "done")
+                        return { outcome: "connected" };
+                    if (latest.state === "refused" || latest.state === "failed")
+                        return { outcome: latest.state, reason: latest.reason };
+                    return {
+                        outcome: latest.state === "pending" ? "absent" : "unavailable",
+                    };
+                },
+            });
+            const result = options.wait
+                ? await options.wait("Waiting for GitHub App approval", run)
+                : await run();
+            return result.state === "done" ? latest : result;
+        },
+    };
+}

package/dist/onboard-personal.js

@@ -90,7 +90,7 @@ function failure(value, start = false) {
         return { state: "refused", reason: "personal_consent_refused" };
     if (value.status === 503)
         return waiting("personal_status_unavailable");
-    if (value.status === 404)
+    if ([404, 405].includes(value.status))
         return waiting("cloud_capability_unavailable");
     return value.status === 200
         ? null
@@ -211,6 +211,8 @@ export function personalConsentAdapter(options) {
                 sleep: options.sleep,
                 readStatus: async (pollSignal) => {
                     latest = await inspect(ctx, journal, pollSignal);
+                    if (latest.reason === "cloud_capability_unavailable")
+                        return { outcome: "waiting", reason: latest.reason };
                     if (latest.state === "done")
                         return { outcome: "connected" };
                     if (latest.state === "refused" || latest.state === "failed")

package/dist/onboard-runtime.js

@@ -11,6 +11,8 @@ import { boundedOnboardSignin } from "./onboard-signin.js";
 import { existingLinearAdapters } from "./onboard-existing.js";
 import { linearWorkspaceAdapter } from "./onboard-workspace.js";
 import { existingRepositoryAdapter } from "./onboard-repositories.js";
+import { githubInstallationAdapter } from "./onboard-github.js";
+import { guardOnboardCapabilities, } from "./onboard-capabilities.js";
 import { fetchMe } from "./transport.js";
 const waiting = (reason) => ({
     state: "waiting",
@@ -67,10 +69,6 @@ export function createOnboardRuntime(args, ctx, hooks) {
             evidence: { found, remaining: found },
         };
     };
-    const unsupported = {
-        check: async () => waiting("cloud_capability_unavailable"),
-        act: async () => waiting("cloud_capability_unavailable"),
-    };
     const personalAdapter = (provider) => personalConsentAdapter({
         provider,
         openBrowser: hooks.openBrowser ?? openBrowser,
@@ -82,102 +80,174 @@ export function createOnboardRuntime(args, ctx, hooks) {
     const linear = existingLinearAdapters(args, hooks.ui?.chooseTeam
         ? (teams) => hooks.ui.chooseTeam(teams.map((team) => ({ ...team })))
         : undefined);
-    return {
-        identity: (journal) => identity(ctx, journal),
-        bindSignals: true,
-        ui: hooks.ui,
-        adapters: {
-            machine: {
-                check: async () => process.platform === "darwin" || process.platform === "linux"
-                    ? { state: "done", evidence: { provider: process.platform } }
-                    : waiting("machine_platform_unsupported"),
+    const adapters = {
+        machine: {
+            check: async () => process.platform === "darwin" || process.platform === "linux"
+                ? { state: "done", evidence: { provider: process.platform } }
+                : waiting("machine_platform_unsupported"),
+        },
+        cli: {
+            check: async () => ({
+                state: "done",
+                evidence: { version: readManifest().version },
+            }),
+        },
+        skills: {
+            check: async (stepCtx) => {
+                const cfg = loadConfig(stepCtx.home);
+                const dir = stepCtx.env.CATALYST_SKILLS_DIR ??
+                    cfg?.skillsDir ??
+                    defaultSkillsDirFor(stepCtx.home);
+                const names = hooks.skillNames ?? [];
+                const count = names.filter((name) => existsSync(join(dir, name, "SKILL.md"))).length;
+                return names.length > 0 && count === names.length
+                    ? { state: "done", evidence: { count, path: dir } }
+                    : waiting("skills_install_unverified");
             },
-            cli: {
-                check: async () => ({
-                    state: "done",
-                    evidence: { version: readManifest().version },
-                }),
+        },
+        legacy: {
+            check: legacyCheck,
+            act: async (stepCtx) => {
+                const before = await legacyCheck(stepCtx);
+                if (before.state !== "pending")
+                    return before;
+                // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
+                const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
+                const code = await cmdLegacy({
+                    ...args,
+                    command: "legacy",
+                    subcommand: null,
+                    rest: [],
+                    flags: { remove: true, yes: true },
+                    json: false,
+                }, quiet, hooks.legacy);
+                return code === 0
+                    ? legacyCheck(stepCtx)
+                    : { state: "failed", reason: "legacy_cleanup_failed" };
             },
-            skills: {
-                check: async (stepCtx) => {
-                    const cfg = loadConfig(stepCtx.home);
-                    const dir = stepCtx.env.CATALYST_SKILLS_DIR ??
-                        cfg?.skillsDir ??
-                        defaultSkillsDirFor(stepCtx.home);
-                    const names = hooks.skillNames ?? [];
-                    const count = names.filter((name) => existsSync(join(dir, name, "SKILL.md"))).length;
-                    return names.length > 0 && count === names.length
-                        ? { state: "done", evidence: { count, path: dir } }
-                        : waiting("skills_install_unverified");
-                },
+        },
+        signin: {
+            check: async (stepCtx, journal) => {
+                const who = await identity(stepCtx, journal);
+                return who
+                    ? {
+                        state: "done",
+                        evidence: {
+                            account: who.account,
+                            membershipId: who.membershipId,
+                            role: who.role,
+                        },
+                    }
+                    : { state: "pending" };
             },
-            legacy: {
-                check: legacyCheck,
-                act: async (stepCtx) => {
-                    const before = await legacyCheck(stepCtx);
-                    if (before.state !== "pending")
-                        return before;
-                    // Provider/process output is not trusted to be secret-free; keep it out of the receipt/log.
-                    const quiet = { ...stepCtx, stdout: () => { }, stderr: () => { } };
-                    const code = await cmdLegacy({
-                        ...args,
-                        command: "legacy",
-                        subcommand: null,
-                        rest: [],
-                        flags: { remove: true, yes: true },
-                        json: false,
-                    }, quiet, hooks.legacy);
-                    return code === 0
-                        ? legacyCheck(stepCtx)
-                        : { state: "failed", reason: "legacy_cleanup_failed" };
-                },
+            act: async (stepCtx, _journal, signal) => {
+                return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
             },
-            signin: {
-                check: async (stepCtx, journal) => {
-                    const who = await identity(stepCtx, journal);
-                    return who
-                        ? {
-                            state: "done",
-                            evidence: {
-                                account: who.account,
-                                membershipId: who.membershipId,
-                                role: who.role,
-                            },
-                        }
-                        : { state: "pending" };
-                },
-                act: async (stepCtx, _journal, signal) => {
-                    return boundedOnboardSignin({ ...stepCtx, stdout: stepCtx.stderr }, hooks.login, signal, hooks.signinTimeoutMs);
+        },
+        ...linear,
+        "linear.workspace": linearWorkspaceAdapter({
+            fallback: linear["linear.workspace"],
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.install": githubInstallationAdapter({
+            openBrowser: hooks.openBrowser ?? openBrowser,
+            wait: hooks.ui
+                ? (message, work) => hooks.ui.wait(message, work)
+                : undefined,
+            sleep: hooks.sleep,
+        }),
+        "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
+            ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
+            : undefined),
+        "linear.personal": personalAdapter("linear"),
+        "github.personal": personalAdapter("github"),
+        daemon: {
+            check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true)
+                ? waiting("local_sync_capability_unavailable")
+                : {
+                    state: "skipped",
+                    reason: "local_sync_not_selected",
+                    evidence: { provider: "cloud" },
                 },
-            },
-            ...linear,
-            "linear.workspace": linearWorkspaceAdapter({
-                fallback: linear["linear.workspace"],
-                openBrowser: hooks.openBrowser ?? openBrowser,
-                wait: hooks.ui
-                    ? (message, work) => hooks.ui.wait(message, work)
-                    : undefined,
-                sleep: hooks.sleep,
-            }),
-            "github.install": unsupported,
-            "github.repos": existingRepositoryAdapter(args, hooks.ui?.chooseRepositories
-                ? (repositories) => hooks.ui.chooseRepositories(repositories.map((row) => ({ ...row })))
-                : undefined),
-            "linear.personal": personalAdapter("linear"),
-            "github.personal": personalAdapter("github"),
-            daemon: {
-                check: async (_stepCtx, journal) => (journal.localSync ?? args.flags["local-sync"] === true)
-                    ? waiting("local_sync_capability_unavailable")
-                    : {
-                        state: "skipped",
-                        reason: "local_sync_not_selected",
-                        evidence: { provider: "cloud" },
-                    },
-            },
-            housekeeping: {
-                check: async () => waiting("housekeeping_service_unverified"),
-            },
-            ready: { check: hooks.ready },
         },
+        housekeeping: {
+            check: async () => waiting("housekeeping_service_unverified"),
+        },
+        ready: { check: hooks.ready },
+    };
+    const get = (path) => ({ method: "GET", path });
+    const capabilities = {
+        "linear.workspace": {
+            check: [get("/api/v1/me/connections/linear/workspace")],
+            act: [
+                get("/api/v1/me/connections/linear/workspace"),
+                get("/api/v1/me/connections/linear/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "linear.personal": {
+            check: [get("/api/v1/me/connections/linear/personal")],
+            act: [
+                get("/api/v1/me/connections/linear/personal"),
+                get("/connect/linear/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "github.install": {
+            check: [get("/api/v1/me/connections/github/workspace")],
+            act: [
+                get("/api/v1/me/connections/github/workspace"),
+                get("/api/v1/me/connections/github/workspace/start"),
+            ],
+            fallback: "connections",
+        },
+        "github.personal": {
+            check: [get("/api/v1/me/connections/github/personal")],
+            act: [
+                get("/api/v1/me/connections/github/personal"),
+                get("/connect/github/personal/start"),
+            ],
+            fallback: "personalConnections",
+        },
+        "linear.team": {
+            check: [
+                get("/api/v1/agent/teams"),
+                get("/api/v1/agent/tenant/readiness"),
+            ],
+            fallback: "connections",
+        },
+        "linear.automations": {
+            check: [get("/api/v1/agent/tenant/readiness")],
+            fallback: "connections",
+        },
+        "github.repos": {
+            check: [get("/api/v1/repos"), get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+        ready: {
+            check: [get("/api/v1/agent/contract")],
+            fallback: "connections",
+        },
+    };
+    for (const [id, options] of Object.entries(capabilities)) {
+        const step = id;
+        const adapter = adapters[step];
+        if (adapter)
+            adapters[step] = guardOnboardCapabilities(adapter, {
+                ...options,
+                message: (text) => hooks.ui ? hooks.ui.message(text) : ctx.stderr(text),
+            });
+    }
+    // Public auth discovery and the existing /me sign-in bootstrap establish identity before the
+    // tenant-bound step guards can run. Unsupported/local-only steps make no endpoint requests.
+    return {
+        identity: (journal) => identity(ctx, journal),
+        bindSignals: true,
+        ui: hooks.ui,
+        adapters,
     };
 }

package/dist/onboard-ui.js

@@ -141,7 +141,19 @@ export function createClackOnboardUi(prompts, streams, deps = {}) {
                 personal_login_refresh_required: "Renew your login with catalyst login, then run catalyst onboard to resume.",
                 personal_status_unavailable: "Your personal connection could not be checked. Run catalyst onboard to try again.",
                 personal_browser_unavailable: "The browser could not open. Run catalyst onboard to try again.",
-                cloud_capability_unavailable: "Your cloud does not support this setup step yet.",
+                cloud_capability_unavailable: "This setup step is not available on this server yet. Use the web app link shown above, then resume after the server update.",
+                onboarding_capability_unavailable: "The server's setup capabilities could not be checked. Run catalyst onboard to try again.",
+                onboarding_capability_identity_unverified: "The server's setup capabilities belong to another login or workspace. Sign in to the original workspace to resume.",
+                onboarding_capability_login_refresh_required: "Your login needs a refresh before setup capabilities can be checked. Run catalyst login, then catalyst onboard.",
+                workspace_consent_refused: "The server did not accept this login for Linear workspace setup. Sign in again or ask your workspace administrator.",
+                github_installation_status_unavailable: "Your GitHub App installation could not be checked. Run catalyst onboard to try again.",
+                github_installation_status_shape: "The server returned a GitHub installation result that could not be verified.",
+                github_installation_consent_handoff: "The GitHub installation approval link could not be verified. Run catalyst onboard to try again.",
+                github_installation_consent_refused: "The server did not accept this login for GitHub App setup. Sign in again or ask your workspace administrator.",
+                github_installation_identity_refused: "GitHub setup belongs to another login or workspace. Sign in to the original workspace to resume.",
+                github_installation_admin_required: "A workspace owner or administrator approves the GitHub App installation.",
+                github_installation_login_refresh_required: "Your login needs a refresh. Run catalyst onboard to resume.",
+                github_installation_browser_unavailable: "The GitHub App approval page could not be opened. Use your workspace's Connections page, then resume.",
                 step_not_available_in_this_release: "This setup step is not available yet.",
                 prerequisite_not_ready: "Waiting for an earlier setup step.",
                 local_sync_not_selected: "Using cloud reads. Local sync was not selected.",