@kortix/ui 0.14.11 → 0.14.13

package/dist/customize/connectors/use-agent-access.d.ts

@@ -3,9 +3,6 @@ import { type AgentGrants } from './agent-access.js';
  * The project's agents and their connector grants and rule sets, plus the two
  * writes: give or take a connector, and pick an agent's rule set on it. Both
  * commit kortix.yaml through `PUT …/agents/{name}/scope`.
- *
- * `supported` is false on a v1 manifest: its agents are a TOML overlay this
- * reader does not parse, and rule sets need v2.
  */
 export declare function useAgentAccess(projectId: string): {
     isPending: boolean;
@@ -17,8 +14,12 @@ export declare function useAgentAccess(projectId: string): {
             is_kortix_repo: boolean;
             signals: Record<string, boolean>;
             manifest_raw: string | null;
+            manifest_health?: import("@kortix/sdk").ProjectManifestHealth;
             open_code_raw: string | null;
             open_code_default_agent: string | null;
+            builtin_agents?: {
+                my_kortix: boolean;
+            };
             agent_discovery: "opencode" | "declarative";
             agents: Array<{
                 name: string;
@@ -27,10 +28,11 @@ export declare function useAgentAccess(projectId: string): {
                 mode: string | null;
                 hidden?: boolean;
                 model?: string | null;
-                source?: "opencode" | "kortix.toml";
+                source?: "opencode" | "kortix.yaml" | "kortix.toml";
                 enabled?: boolean;
                 platform?: boolean;
                 sandbox?: string | null;
+                space?: string | null;
                 scope?: {
                     env: string[] | "all";
                     connectors: string[] | "all";
@@ -53,13 +55,13 @@ export declare function useAgentAccess(projectId: string): {
                 required: string[];
                 optional: string[];
             };
+            spaces?: import("@kortix/sdk").ManifestSpace[];
         };
         project: import("@kortix/sdk").KortixProject;
         git_connection?: import("@kortix/sdk").ProjectGitConnection | null;
         file_count: number;
         files: import("@kortix/sdk").ProjectFileEntry[];
     }, Error>>;
-    supported: boolean;
     canEdit: boolean;
     agents: string[];
     grantsOf: (agent: string) => AgentGrants | undefined;

package/dist/customize/connectors/use-agent-access.js

@@ -12,9 +12,6 @@ const ACTIONS = [PROJECT_ACTIONS.PROJECT_AGENT_WRITE, PROJECT_ACTIONS.PROJECT_CO
  * The project's agents and their connector grants and rule sets, plus the two
  * writes: give or take a connector, and pick an agent's rule set on it. Both
  * commit kortix.yaml through `PUT …/agents/{name}/scope`.
- *
- * `supported` is false on a v1 manifest: its agents are a TOML overlay this
- * reader does not parse, and rule sets need v2.
  */
 export function useAgentAccess(projectId) {
     const queryClient = useQueryClient();
@@ -30,7 +27,7 @@ export function useAgentAccess(projectId) {
     const config = projectQuery.data?.config;
     const grants = useMemo(() => manifestAgentGrants(config?.manifest_raw), [config?.manifest_raw]);
     const agents = useMemo(() => {
-        const names = new Set(Object.keys(grants ?? {}));
+        const names = new Set(Object.keys(grants));
         for (const agent of config?.agents ?? [])
             if (!agent.hidden)
                 names.add(agent.name);
@@ -44,13 +41,12 @@ export function useAgentAccess(projectId) {
             void queryClient.invalidateQueries({ queryKey: ['connector-policy-sets', projectId] });
         },
     });
-    const grantsOf = (agent) => grants?.[agent];
+    const grantsOf = (agent) => grants[agent];
     return {
         isPending: projectQuery.isPending,
         isError: projectQuery.isError,
         error: projectQuery.error,
         refetch: projectQuery.refetch,
-        supported: grants !== null,
         canEdit,
         agents,
         grantsOf,

package/dist/customize/models/models-page.d.ts

@@ -1,3 +1,5 @@
+import type { ResourceScope } from '../shared/agent-resource-scope.js';
+import type { ReactNode } from 'react';
 /**
  * The page body for /projects/[id]/models — Models graduated out of the
  * project Settings sub-nav into its own top-level Customize tab, alongside
@@ -23,6 +25,10 @@
  * `useStandaloneCapabilityNav` is that provider's value for a page that is
  * not the overlay or `/config`.
  */
-export declare function ModelsPage({ projectId }: {
+export declare function ModelsPage({ projectId, surface, agentSettings, }: {
     projectId: string;
+    /** `agent` renders the same page on one agent's editor (`agent-page.tsx`),
+     *  with `agentSettings` as its leading "This agent" tab. */
+    surface?: ResourceScope;
+    agentSettings?: ReactNode;
 }): import("react").JSX.Element;

package/dist/customize/models/models-page.js

@@ -29,7 +29,7 @@ import { AppReturnBar } from './app-return-bar.js';
  * `useStandaloneCapabilityNav` is that provider's value for a page that is
  * not the overlay or `/config`.
  */
-export function ModelsPage({ projectId }) {
+export function ModelsPage({ projectId, surface, agentSettings, }) {
     const settingsNav = useStandaloneCapabilityNav(projectId, 'models');
-    return (_jsxs(SettingsNavProvider, { value: settingsNav, children: [_jsx(LlmManagementView, { projectId: projectId }), _jsx(AppReturnBar, { projectId: projectId })] }));
+    return (_jsxs(SettingsNavProvider, { value: settingsNav, children: [_jsx(LlmManagementView, { projectId: projectId, surface: surface, agentSettings: agentSettings }), _jsx(AppReturnBar, { projectId: projectId })] }));
 }

package/dist/customize/project-settings/project-admin-sections.d.ts

@@ -0,0 +1,63 @@
+import { type Icon } from '@phosphor-icons/react';
+import type { CapabilityTab } from '../../internal/lib/capability-tab-routes.js';
+import { type ProjectSettingsSectionKey } from './project-settings-sections.js';
+/**
+ * The sections of Project admin (`/projects/<id>/admin`).
+ *
+ * Customize is agent-first: each agent's page configures what THAT agent draws
+ * on. Project admin is the other view: the project-wide libraries an agent is
+ * granted from, plus every project setting. Two rail groups:
+ *
+ *  1. **Project resources** — the global variant of each library page.
+ *  2. **Settings** — the sections of `project-settings-sections.ts`, unchanged.
+ *
+ * A key IS its URL segment (`/admin/<key>`), so renaming one breaks live links. The
+ * settings keys are the Settings page's own keys, so `?section=git` means the
+ * same section on both surfaces.
+ */
+export type ProjectAdminResourceKey = 'connectors' | 'skills' | 'tools' | 'extensions' | 'triggers' | 'models' | 'secrets' | 'apps' | 'drives' | 'repo';
+/**
+ * The Settings sections this page lists. Review is not one: it is its own
+ * standalone surface, and `projectSettingsSections` never lists it.
+ */
+export type ProjectAdminSettingsKey = Exclude<ProjectSettingsSectionKey, 'review'>;
+export type ProjectAdminSectionKey = ProjectAdminResourceKey | ProjectAdminSettingsKey;
+export interface ProjectAdminResource {
+    key: ProjectAdminResourceKey;
+    icon: Icon;
+    /**
+     * The Customize tab whose access rule (`capabilityAccess`) decides whether
+     * the row shows. Null: the page gates itself (Apps reads `useProjectCan`).
+     */
+    capability: CapabilityTab['key'] | null;
+    /**
+     * The page lives in the host app, not in `@kortix/ui`: the host passes it
+     * through `hostSections`, and the row hides when it does not.
+     */
+    host: boolean;
+    /**
+     * The flag the row needs. Repo is a library only with `drives` on; with it
+     * off, the sidebar's Files row is the repo browser (`projectNavRows`).
+     */
+    flag?: 'drives';
+}
+/** Rail order. Icons match the agent editor's tabs (`agent-page.tsx`). */
+export declare const PROJECT_ADMIN_RESOURCES: readonly ProjectAdminResource[];
+/** `/projects/<id>/admin` with no section opens the first resource. */
+export declare const DEFAULT_PROJECT_ADMIN_SECTION: ProjectAdminSectionKey;
+export declare function isProjectAdminResource(key: ProjectAdminSectionKey): key is ProjectAdminResourceKey;
+export declare function parseProjectAdminSection(raw: string | null | undefined): ProjectAdminSectionKey | null;
+/**
+ * The link to one section: `/projects/<id>/admin/<section>`. `extra` adds page
+ * params (`scope=channels` for the Connectors page's Channels scope).
+ */
+export declare function projectAdminHref(projectId: string, key?: ProjectAdminSectionKey, extra?: Record<string, string>): string;
+/**
+ * The section a legacy settings-nav id names. Panes still call
+ * `navigate('llm-providers')`, `navigate('experimental')` or
+ * `navigate('channels')` in the overlay's vocabulary; inside Project admin
+ * each of those lands on a section of this page. Null: the id is not a
+ * section here (`members`, `review`, a personal overlay tab).
+ */
+export declare function projectAdminNavTarget(tab: string): ProjectAdminSectionKey | null;
+export declare const RESOURCE_LABEL_KEYS: Partial<Record<ProjectAdminResourceKey, string>>;

package/dist/customize/project-settings/project-admin-sections.js

@@ -0,0 +1,80 @@
+import { AppWindowIcon, BookOpenTextIcon, CpuIcon, FoldersIcon, HardDrivesIcon, KeyIcon, PlugsConnectedIcon, PuzzlePieceIcon, TimerIcon, WrenchIcon, } from '@phosphor-icons/react';
+import { adminPath } from '../../lib/routes.js';
+import { parseProjectSettingsSection, } from './project-settings-sections.js';
+/** Rail order. Icons match the agent editor's tabs (`agent-page.tsx`). */
+export const PROJECT_ADMIN_RESOURCES = [
+    { key: 'connectors', icon: PlugsConnectedIcon, capability: 'connectors', host: false },
+    { key: 'secrets', icon: KeyIcon, capability: 'secrets', host: false },
+    { key: 'skills', icon: BookOpenTextIcon, capability: 'skills', host: false },
+    { key: 'tools', icon: WrenchIcon, capability: 'agent', host: false },
+    { key: 'extensions', icon: PuzzlePieceIcon, capability: 'agent', host: false },
+    { key: 'drives', icon: HardDrivesIcon, capability: null, host: false, flag: 'drives' },
+    { key: 'apps', icon: AppWindowIcon, capability: null, host: true },
+    // Triggers: kortix.yaml triggers and runtime triggers (loops) on one page.
+    // The key stays `triggers`: it is the URL segment, and live links name it.
+    { key: 'triggers', icon: TimerIcon, capability: 'triggers', host: false },
+    { key: 'models', icon: CpuIcon, capability: 'models', host: false },
+    { key: 'repo', icon: FoldersIcon, capability: 'files', host: false, flag: 'drives' },
+];
+/** `/projects/<id>/admin` with no section opens the first resource. */
+export const DEFAULT_PROJECT_ADMIN_SECTION = 'connectors';
+export function isProjectAdminResource(key) {
+    return PROJECT_ADMIN_RESOURCES.some((r) => r.key === key);
+}
+export function parseProjectAdminSection(raw) {
+    if (!raw)
+        return null;
+    // `/admin/loops` was the Loops page until 2026-10-28: loops are triggers now.
+    if (raw === 'loops')
+        return 'triggers';
+    const resource = PROJECT_ADMIN_RESOURCES.find((r) => r.key === raw);
+    if (resource)
+        return resource.key;
+    const setting = parseProjectSettingsSection(raw);
+    return setting === 'review' ? null : setting;
+}
+/**
+ * The link to one section: `/projects/<id>/admin/<section>`. `extra` adds page
+ * params (`scope=channels` for the Connectors page's Channels scope).
+ */
+export function projectAdminHref(projectId, key = DEFAULT_PROJECT_ADMIN_SECTION, extra) {
+    const query = new URLSearchParams(extra).toString();
+    return `${adminPath(projectId, key)}${query ? `?${query}` : ''}`;
+}
+/**
+ * The section a legacy settings-nav id names. Panes still call
+ * `navigate('llm-providers')`, `navigate('experimental')` or
+ * `navigate('channels')` in the overlay's vocabulary; inside Project admin
+ * each of those lands on a section of this page. Null: the id is not a
+ * section here (`members`, `review`, a personal overlay tab).
+ */
+export function projectAdminNavTarget(tab) {
+    const direct = parseProjectAdminSection(tab);
+    if (direct)
+        return direct;
+    if (tab.startsWith('llm-'))
+        return 'models';
+    if (tab === 'channels')
+        return 'connectors';
+    if (tab === 'reminders')
+        return 'triggers';
+    if (tab === 'settings' || tab === 'workspace')
+        return 'general';
+    if (tab === 'experimental')
+        return 'feature-flags';
+    if (tab === 'snapshots')
+        return 'sandbox';
+    return null;
+}
+/* Rail labels, keyed by section: the `hardcodedUi.i18nComplete` strings the
+   Customize bar and the sidebar already show for these libraries. */
+export const RESOURCE_LABEL_KEYS = {
+    connectors: 'textc3d2e79ebdd0',
+    skills: 'text66d0f523a379',
+    // "Triggers": kortix.yaml triggers and loops are one page (2026-10-28).
+    triggers: 'texte62f2148a64d',
+    models: 'textd17d2d78d76e',
+    secrets: 'textd8707d411d99',
+    apps: 'text89dd748442c1',
+    repo: 'text91dba14806eb',
+};

package/dist/customize/project-settings/project-settings-page.d.ts

@@ -8,7 +8,7 @@ import { type ProjectSettingsSectionKey } from './project-settings-sections.js';
  *
  * These six sections used to live in the Settings overlay behind the
  * sidebar's gear icon, in its `Workspace` and `Agent` rail groups plus the
- * pinned Upgrades row and the `experimental` row. They configure a project, and
+ * `experimental` row. They configure a project, and
  * the person allowed to change them is already the person who can open
  * Customize — a second overlay with a second rail and a second keyboard
  * shortcut was one surface too many. The overlay keeps what is genuinely

package/dist/customize/project-settings/project-settings-page.js

@@ -14,8 +14,6 @@ import { SettingsSectionHeader } from '../../primitives/settings-section-header.
 import { Tabs, TabsList, TabsTrigger } from '../../primitives/tabs.js';
 import { SETTINGS_SIDEBAR_WIDTH_PX } from '../../internal/account-hub/account-settings-shell.js';
 import { useReviewSessionSummary } from '../../internal/hooks/use-review-session-summary.js';
-import { detectManifestVersion } from '../../internal/lib/manifest-version.js';
-import { UpgradesView } from '../migrate-to-v2/upgrade-view.js';
 import { GitView } from '../sections/view/git-view.js';
 import { ReviewView } from '../sections/view/review-view.js';
 import { ACCOUNT_GRADUATED, isAccountGraduatedSection, parseSettingsTab, } from '../settings/settings-tabs.js';
@@ -37,7 +35,7 @@ import { DEFAULT_PROJECT_SETTINGS_SECTION, parseProjectSettingsSection, projectS
  *
  * These six sections used to live in the Settings overlay behind the
  * sidebar's gear icon, in its `Workspace` and `Agent` rail groups plus the
- * pinned Upgrades row and the `experimental` row. They configure a project, and
+ * `experimental` row. They configure a project, and
  * the person allowed to change them is already the person who can open
  * Customize — a second overlay with a second rail and a second keyboard
  * shortcut was one surface too many. The overlay keeps what is genuinely
@@ -114,11 +112,6 @@ export function ProjectSettingsPage({ projectId }) {
         (sections.some((s) => s.key === DEFAULT_PROJECT_SETTINGS_SECTION)
             ? DEFAULT_PROJECT_SETTINGS_SECTION
             : (sections[0]?.key ?? DEFAULT_PROJECT_SETTINGS_SECTION));
-    // Pin Upgrades' attention dot only once the manifest read resolved to v1 —
-    // while the detail query is in flight (or on a v2 project) the dot stays off.
-    const upgradeAttention = detail.data
-        ? detectManifestVersion(detail.data.config.manifest_raw) === 1
-        : false;
     // "Needs you" count for the Review row — the SAME shared inbox summary the
     // sidebar Review pill and the per-session dots read, so they cannot drift.
     const reviewNeedsYou = useReviewSessionSummary(projectId).totalNeedsYou;
@@ -134,7 +127,7 @@ export function ProjectSettingsPage({ projectId }) {
         navigateTo,
     }), [projectId, active, membersTab, project?.account_id, navigateTo]);
     const activeSection = sections.find((s) => s.key === active);
-    const sectionTriggers = (horizontal) => sections.map((section) => (_jsx(SectionTrigger, { projectId: projectId, section: section, horizontal: horizontal, count: section.key === 'review' ? reviewNeedsYou : undefined, attention: section.key === 'upgrades' && upgradeAttention }, section.key)));
+    const sectionTriggers = (horizontal) => sections.map((section) => (_jsx(SectionTrigger, { projectId: projectId, section: section, horizontal: horizontal, count: section.key === 'review' ? reviewNeedsYou : undefined }, section.key)));
     return (_jsx(SettingsNavProvider, { value: settingsNav, children: _jsxs("div", { className: cn('min-h-0 flex-1', isMobile ? 'flex flex-col overflow-hidden' : 'grid overflow-hidden'), 
             // The Preferences overlay's rail width (`settings-panel.tsx`), so the
             // two settings surfaces a person meets are one shape (Marko,
@@ -160,7 +153,7 @@ export function ProjectSettingsPage({ projectId }) {
  * `onValueChange` push: the section is URL state, so it has to be a link a
  * person can middle-click, copy, and land on directly.
  */
-function SectionTrigger({ projectId, section, count, attention, horizontal = false, }) {
+function SectionTrigger({ projectId, section, count, horizontal = false, }) {
     const Icon = section.icon;
     const showCount = count != null && count > 0;
     return (_jsx(TabsTrigger, { value: section.key, asChild: true, size: horizontal ? undefined : 'md', className: horizontal
@@ -169,7 +162,7 @@ function SectionTrigger({ projectId, section, count, attention, horizontal = fal
             // The Preferences overlay's exact rail-row dialect
             // (`settings-panel.tsx`'s `TabsTrigger` in its aside), so the
             // two rails are one component in two places.
-            'gap-2 px-2.5 py-1 font-normal transition-none has-[>svg]:px-2.5', 'text-foreground data-[state=inactive]:text-foreground hover:bg-hover hover:text-foreground', 'data-[state=active]:bg-active data-[state=active]:font-medium', '[&_svg]:text-muted-foreground data-[state=active]:[&_svg]:text-foreground'), children: _jsxs(Link, { href: projectSettingsSectionHref(projectId, section.key), prefetch: true, children: [_jsx(Icon, { className: "size-4 shrink-0" }), _jsx("span", { className: cn(!horizontal && 'truncate'), children: section.label }), showCount ? (_jsx(CountBadge, { count: count, className: cn(!horizontal && 'ml-auto') })) : attention ? (_jsx("span", { "aria-hidden": true, className: cn('bg-kortix-orange size-1.5 shrink-0 rounded-full', !horizontal && 'ml-auto') })) : null] }) }));
+            'gap-2 px-2.5 py-1 font-normal transition-none has-[>svg]:px-2.5', 'text-foreground data-[state=inactive]:text-foreground hover:bg-hover hover:text-foreground', 'data-[state=active]:bg-active data-[state=active]:font-medium', '[&_svg]:text-muted-foreground data-[state=active]:[&_svg]:text-foreground'), children: _jsxs(Link, { href: projectSettingsSectionHref(projectId, section.key), prefetch: true, children: [_jsx(Icon, { className: "size-4 shrink-0" }), _jsx("span", { className: cn(!horizontal && 'truncate'), children: section.label }), showCount ? (_jsx(CountBadge, { count: count, className: cn(!horizontal && 'ml-auto') })) : null] }) }));
 }
 /**
  * The pane for the active section. Every component is mounted exactly as the
@@ -193,8 +186,6 @@ function ProjectSettingsSectionPane({ sectionKey, projectId, }) {
             return _jsx(ReviewView, { projectId: projectId });
         case 'feature-flags':
             return _jsx(ExperimentalTab, { projectId: projectId });
-        case 'upgrades':
-            return _jsx(UpgradesView, { projectId: projectId });
     }
 }
 /**

package/dist/customize/project-settings/project-settings-sections.d.ts

@@ -7,7 +7,7 @@ import type { CustomizeSection } from '../../internal/lib/project-actions.js';
  *
  * These six sections used to be part of the `Workspace` and `Agent` groups of
  * the Settings overlay's rail (`packages/ui/src/customize/settings/rail.ts`), plus
- * its pinned Upgrades row and its `experimental` row. All of them configure a
+ * its `experimental` row. All of them configure a
  * PROJECT, and every one of them is reachable by exactly the people who can
  * already see Customize — so they belong on the Customize bar, not behind a
  * separate gear icon with a separate rail. The overlay keeps only what is
@@ -33,11 +33,11 @@ import type { CustomizeSection } from '../../internal/lib/project-actions.js';
  * which is what the pane is called everywhere else in the codebase (it is
  * already the `CustomizeSection` id, see `packages/ui/src/internal/lib/project-actions.ts`).
  *
- * A `key` IS its `?section=` query value, so renaming one breaks live links.
+ * A `key` IS its Project admin segment (`/admin/<key>`), so renaming one breaks live links.
  * `settings-tabs.ts`'s `GRADUATED` map points every retired `SettingsTab` id
  * at the key below that replaced it.
  */
-export type ProjectSettingsSectionKey = 'general' | 'git' | 'sandbox' | 'review' | 'feature-flags' | 'upgrades';
+export type ProjectSettingsSectionKey = 'general' | 'git' | 'sandbox' | 'review' | 'feature-flags';
 /**
  * **One flat list, no headings.** The sub-nav used to carry the rail's three
  * group labels — `Workspace`, `Agent`, `Advanced` — over six to eight rows.
@@ -64,7 +64,7 @@ export interface ProjectSettingsSection {
     gate: CustomizeSection;
 }
 /**
- * The sub-nav: the static sections, then Feature flags and Upgrades. No row is
+ * The sub-nav: the static sections, then Feature flags. No row is
  * flag-gated any more. Marketplace and Voice were removed from the product;
  * Review is a capability tab of its own and graduated out of the flag system.
  */
@@ -78,7 +78,7 @@ export declare const ALL_PROJECT_SETTINGS_SECTIONS: readonly ProjectSettingsSect
  */
 export declare const DEFAULT_PROJECT_SETTINGS_SECTION: ProjectSettingsSectionKey;
 export declare function parseProjectSettingsSection(raw: string | null | undefined): ProjectSettingsSectionKey | null;
-/** The canonical link to one section. The default section carries no query. */
+/** The canonical link to one section: its Project admin page, `/admin/<key>`. Review is its own page. */
 export declare function projectSettingsSectionHref(projectId: string, key: ProjectSettingsSectionKey): string;
 /** The copy for one section, independent of any flag — used by pane headings. */
 export declare function projectSettingsSection(key: ProjectSettingsSectionKey): ProjectSettingsSection | undefined;

package/dist/customize/project-settings/project-settings-sections.js

@@ -1,5 +1,6 @@
-import { ArrowCircleUpIcon as ArrowUpCircle, ShippingContainerIcon as Container, FlaskIcon as Flask, GitBranchIcon as GitBranch, GearSixIcon as Settings, } from '@phosphor-icons/react';
+import { ShippingContainerIcon as Container, FlaskIcon as Flask, GitBranchIcon as GitBranch, GearSixIcon as Settings, } from '@phosphor-icons/react';
 import { capabilityTabHref } from '../../internal/lib/capability-tab-routes.js';
+import { adminPath } from '../../lib/routes.js';
 import { localizeUiCatalog } from '../../i18n/ui-catalog/localize-ui-catalog.js';
 import { REMAINING_UI_TRANSLATION_KEYS } from '../../i18n/ui-catalog/remaining-ui-translation-keys.generated.js';
 /** The sections every project shows, in sub-nav order. */
@@ -40,25 +41,12 @@ const FEATURE_FLAGS_SECTION = {
     description: 'Features you can switch on before they are generally available.',
     gate: 'feature-flags',
 };
-/**
- * Upgrades — the agent-driven codebase upgrade runner. Not billing: it opens a
- * change request against this workspace's own repo. It sat pinned at the
- * bottom of the old rail and keeps that position here, last in the list.
- */
-const UPGRADES_SECTION = {
-    key: 'upgrades',
-    label: 'Upgrades',
-    description: 'Changes an agent makes to this workspace. Every run opens a change request for you to review — nothing merges on its own.',
-    icon: ArrowUpCircle,
-    gate: 'upgrade',
-};
 const PROJECT_SETTINGS_SOURCE = {
     staticSections: STATIC_SECTIONS,
     featureFlagsSection: FEATURE_FLAGS_SECTION,
-    upgradesSection: UPGRADES_SECTION,
 };
 /**
- * The sub-nav: the static sections, then Feature flags and Upgrades. No row is
+ * The sub-nav: the static sections, then Feature flags. No row is
  * flag-gated any more. Marketplace and Voice were removed from the product;
  * Review is a capability tab of its own and graduated out of the flag system.
  */
@@ -70,7 +58,7 @@ export function projectSettingsSections(tI18nComplete) {
     // Review is NOT a section here any more: it is a capability tab of its own
     // (`capability-tab-routes.ts`, 2026-09-02). Listing it twice — as a tab and
     // as a Settings section — was the leftover of restoring this page.
-    sections.push(source.featureFlagsSection, source.upgradesSection);
+    sections.push(source.featureFlagsSection);
     return sections;
 }
 /** Every section — for copy lookups and tests. */
@@ -87,11 +75,9 @@ export function parseProjectSettingsSection(raw) {
     const hit = ALL_PROJECT_SETTINGS_SECTIONS.find((s) => s.key === raw);
     return hit ? hit.key : null;
 }
-/** The canonical link to one section. The default section carries no query. */
+/** The canonical link to one section: its Project admin page, `/admin/<key>`. Review is its own page. */
 export function projectSettingsSectionHref(projectId, key) {
-    return key === DEFAULT_PROJECT_SETTINGS_SECTION
-        ? capabilityTabHref(projectId, 'config')
-        : `${capabilityTabHref(projectId, 'config')}?section=${key}`;
+    return key === 'review' ? capabilityTabHref(projectId, 'review') : adminPath(projectId, key);
 }
 /** The copy for one section, independent of any flag — used by pane headings. */
 export function projectSettingsSection(key) {

package/dist/customize/providers/provider-accordion.js

@@ -37,7 +37,7 @@ import { errorToast, successToast } from '../../primitives/toast.js';
 import { EmptyState } from '../../primitives/empty-state.js';
 import { ErrorState } from '../../primitives/error-state.js';
 import { FIRST_CLASS_PROVIDER_IDS, PROVIDER_PAGE_SIZE, ProviderLogoStatus, connectedVia, providerMethod, supportsPooledProviderKey, useManagedProvider, usePooledProviderIds, useProviderMeta, } from './provider-connect.js';
-import { DeviceCode, ProviderKeyForm, RemoveKeyDialog, SUBSCRIPTION_BY_PROVIDER, useProviderKey, } from './provider-sheet.js';
+import { ClaudeCodeStep, DeviceCode, ProviderKeyForm, RemoveKeyDialog, SUBSCRIPTION_BY_PROVIDER, useProviderKey, } from './provider-sheet.js';
 import { ChatGptSubscriptionConnect, useSubscriptionSignIn, } from '../sections/llm-provider/chatgpt-subscription-connect.js';
 import { useConnectedProviders } from '../sections/llm-provider/use-connected-providers.js';
 import { useLiveLlmProviderCatalog, useLlmProviderCatalogRevision, } from '../sections/llm-provider/use-live-catalog.js';
@@ -142,24 +142,30 @@ function SignInSubRows({ projectId, entry, canWrite, }) {
     const sign = useSubscriptionSignIn({ projectId, kind: sub.kind, onConnected: () => undefined });
     const [confirmDisconnect, setConfirmDisconnect] = useState(false);
     const waiting = sign.phase === 'waiting';
+    // A Claude login is the member's own: any member signs in. A shared login needs write access.
+    const canSignIn = canWrite || sign.pastesCode;
     const copyCode = () => {
         if (!sign.challenge?.code)
             return;
         void navigator.clipboard?.writeText(sign.challenge.code).then(() => successToast(t('codeCopied')));
     };
-    return (_jsxs(_Fragment, { children: [_jsx(AccordionSubRow, { action: !canWrite ? null : waiting ? (_jsx(Button, { type: "button", size: "xs", variant: "ghost", onClick: sign.cancel, children: t('cancel') })) : sign.connected ? (_jsx(Button, { type: "button", size: "xs", variant: "ghost", className: "text-muted-foreground", disabled: sign.disconnect.isPending, onClick: () => setConfirmDisconnect(true), children: t('disconnect') })) : (_jsx(Button, { type: "button", size: "xs", variant: "secondary", onClick: () => void sign.start(), children: t('signInTitle', { name: sub.name }) })), children: sign.connected
+    return (_jsxs(_Fragment, { children: [_jsx(AccordionSubRow, { action: !canSignIn ? null : waiting ? (_jsx(Button, { type: "button", size: "xs", variant: "ghost", onClick: sign.cancel, children: t('cancel') })) : sign.connected ? (_jsx(Button, { type: "button", size: "xs", variant: "ghost", className: "text-muted-foreground", disabled: sign.disconnect.isPending, onClick: () => setConfirmDisconnect(true), children: t('disconnect') })) : (_jsx(Button, { type: "button", size: "xs", variant: "secondary", onClick: () => void sign.start(), children: t('signInTitle', { name: sub.name }) })), children: sign.connected
                     ? `${t('subscription', { plan: sub.plan })} · ${t('signedIn')}`
                     : waiting
                         ? t('signingIn', { name: sub.name })
-                        : `${t('subscription', { plan: sub.plan })} · ${t('notConnected')}` }), waiting ? (_jsx("div", { className: "border-border border-t py-3", children: _jsx(DeviceCode, { name: sub.name, code: sign.challenge?.code ?? null, url: sign.challenge?.url ?? null, onCopy: copyCode }) })) : null, sign.error ? (_jsx("p", { role: "alert", className: "text-destructive pb-1.5 text-xs text-pretty", children: sign.error })) : null, _jsx(AlertDialog, { open: confirmDisconnect, onOpenChange: setConfirmDisconnect, children: _jsxs(AlertDialogContent, { children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: t('disconnectTitle', { plan: sub.plan }) }), _jsx(AlertDialogDescription, { children: t('disconnectBody') })] }), _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { children: t('cancel') }), _jsx(AlertDialogAction, { variant: "destructive", disabled: sign.disconnect.isPending, onClick: () => sign.disconnect.mutate(), children: t('disconnect') })] })] }) })] }));
+                        : `${t('subscription', { plan: sub.plan })} · ${t('notConnected')}` }), waiting && sign.pastesCode ? (_jsx("div", { className: "border-border border-t py-3", children: _jsx(ClaudeCodeStep, { url: sign.challenge?.url ?? null, checking: sign.checking, onSubmit: (code) => void sign.submitCode(code) }) })) : waiting ? (_jsx("div", { className: "border-border border-t py-3", children: _jsx(DeviceCode, { name: sub.name, code: sign.challenge?.code ?? null, url: sign.challenge?.url ?? null, onCopy: copyCode }) })) : null, sign.error ? (_jsx("p", { role: "alert", className: "text-destructive pb-1.5 text-xs text-pretty", children: sign.error })) : null, _jsx(AlertDialog, { open: confirmDisconnect, onOpenChange: setConfirmDisconnect, children: _jsxs(AlertDialogContent, { children: [_jsxs(AlertDialogHeader, { children: [_jsx(AlertDialogTitle, { children: t('disconnectTitle', { plan: sub.plan }) }), _jsx(AlertDialogDescription, { children: t('disconnectBody') })] }), _jsxs(AlertDialogFooter, { children: [_jsx(AlertDialogCancel, { children: t('cancel') }), _jsx(AlertDialogAction, { variant: "destructive", disabled: sign.disconnect.isPending, onClick: () => sign.disconnect.mutate(), children: t('disconnect') })] })] }) })] }));
 }
-/** Opens the plan dialog. Nothing when billing is off: no plan to sell. */
-function ManagedUpgradeButton({ projectId }) {
+/**
+ * Kortix with no servable model, as one static row: the logo, one line and
+ * Upgrade in the place of the chevron. Nothing to expand, so it says its line
+ * once. The caller renders it only where billing sells a plan: a self-hosted
+ * deployment has no Kortix-managed models, so the row would be a dead end.
+ */
+function ManagedUpgradeRow({ projectId, row }) {
     const t = useTranslations('sessionUi.modelGate');
-    const { openUpgrade, showUpgradeOption } = useModelConnectionGate(undefined, { projectId });
-    if (!showUpgradeOption)
-        return null;
-    return (_jsxs(Button, { type: "button", size: "xs", className: "shrink-0", onClick: openUpgrade, children: [_jsx(CreditCardIcon, { className: "size-3.5 shrink-0" }), t('upgrade')] }));
+    const tAccess = useTranslations('modelAccess');
+    const { openUpgrade } = useModelConnectionGate(undefined, { projectId });
+    return (_jsxs("div", { className: "flex items-center gap-3", children: [_jsx(ProviderLogoStatus, { providerId: row.id, label: row.label, status: row.status, size: "medium" }), _jsxs("span", { className: "min-w-0 flex-1", children: [_jsx("span", { className: "text-foreground block truncate text-sm font-medium", children: row.label }), _jsx("span", { className: "text-muted-foreground block truncate text-xs", children: tAccess('managedRowHint') })] }), _jsxs(Button, { type: "button", size: "xs", className: "shrink-0", onClick: openUpgrade, children: [_jsx(CreditCardIcon, { className: "size-3.5 shrink-0" }), t('upgrade')] })] }));
 }
 /** What an open card holds, by how the provider connects. */
 function ExpandedBody({ projectId, entry, status, keyConnected, canWrite, enabled, pooled, }) {
@@ -170,19 +176,17 @@ function ExpandedBody({ projectId, entry, status, keyConnected, canWrite, enable
     const enable = status !== 'none' ? (_jsx(EnableSubRow, { projectId: projectId, entry: entry, canWrite: canWrite, enabled: enabled })) : null;
     let content;
     if (method === 'included' || (entry.envVars.length === 0 && !SUBSCRIPTION_BY_PROVIDER[entry.id])) {
-        content = (_jsx(AccordionSubRow
-        // Kortix with no servable model is the upgrade story: the row says so,
-        // so it carries the way out too.
-        , { 
-            // Kortix with no servable model is the upgrade story: the row says so,
-            // so it carries the way out too.
-            action: entry.managed && entry.models.length === 0 ? _jsx(ManagedUpgradeButton, { projectId: projectId }) : null, children: entry.hint }));
+        content = (_jsx(AccordionSubRow, { children: entry.hint }));
     }
     else if (pooled.pooledSecretsEnabled && pooled.accountId && entry.id === 'openai') {
         content = (_jsxs("div", { className: "border-border space-y-3 border-t py-3", children: [_jsx("p", { className: "text-foreground text-xs font-medium", children: tPooled('chatGptAccounts') }), _jsx(AccountSecretResourcesPanel, { accountId: pooled.accountId, projectId: projectId, providerId: "codex", providerName: "ChatGPT Plus/Pro", envVar: "CODEX_AUTH_JSON", canWrite: true, oauth: { projectId, onConnected: () => undefined } }), _jsx(ChatGptSubscriptionConnect, { projectId: projectId, onConnected: () => undefined, legacyOnly: true })] }));
     }
+    else if (pooled.pooledSecretsEnabled && pooled.accountId && entry.id === 'anthropic') {
+        // Claude accounts, exactly as OpenAI lists ChatGPT accounts; Anthropic API keys below them.
+        content = (_jsxs(_Fragment, { children: [_jsxs("div", { className: "border-border space-y-3 border-t py-3", children: [_jsx("p", { className: "text-foreground text-xs font-medium", children: tPooled('claudeAccounts') }), _jsx(AccountSecretResourcesPanel, { accountId: pooled.accountId, projectId: projectId, providerId: "claude-agent", providerName: "Claude Pro/Max", envVar: "CLAUDE_CODE_OAUTH_TOKEN", canWrite: true, oauth: { projectId, onConnected: () => undefined, kind: 'claude' } })] }), _jsx("div", { className: "border-border border-t py-3", children: _jsx(AccountSecretResourcesPanel, { accountId: pooled.accountId, projectId: projectId, providerId: entry.id, providerName: entry.label, envVar: entry.envVars[0], canWrite: true }) })] }));
+    }
     else if (pooled.pooledSecretsEnabled && pooled.accountId && supportsPooledProviderKey(entry)) {
-        content = (_jsx("div", { className: "border-border border-t py-3", children: _jsx(AccountSecretResourcesPanel, { accountId: pooled.accountId, projectId: projectId, providerId: entry.id, providerName: entry.label, envVar: entry.envVars[0], canWrite: true }) }));
+        content = (_jsxs(_Fragment, { children: [SUBSCRIPTION_BY_PROVIDER[entry.id] ? _jsx(SignInSubRows, { projectId: projectId, entry: entry, canWrite: canWrite }) : null, _jsx("div", { className: "border-border border-t py-3", children: _jsx(AccountSecretResourcesPanel, { accountId: pooled.accountId, projectId: projectId, providerId: entry.id, providerName: entry.label, envVar: entry.envVars[0], canWrite: true }) })] }));
     }
     else if (SUBSCRIPTION_BY_PROVIDER[entry.id]) {
         content = (_jsxs(_Fragment, { children: [_jsx(SignInSubRows, { projectId: projectId, entry: entry, canWrite: canWrite }), _jsx(KeySubRow, { projectId: projectId, entry: entry, saved: keyConnected, canWrite: canWrite })] }));
@@ -208,6 +212,9 @@ export function ProviderAccordion({ projectId, canWrite = false, enabled = true,
     const meta = useProviderMeta();
     const access = useModelAccess(enabled ? projectId : null);
     const managedProvider = useManagedProvider(enabled ? projectId : null);
+    // Where billing sells no plan (a self-hosted deployment) Kortix-managed
+    // models do not exist, so the managed row with no models is left out.
+    const { showUpgradeOption } = useModelConnectionGate(undefined, { projectId });
     const pooled = usePooledProviderIds(projectId, enabled);
     useLiveLlmProviderCatalog(projectId, enabled);
     const catalogRevision = useLlmProviderCatalogRevision();
@@ -278,6 +285,11 @@ export function ProviderAccordion({ projectId, canWrite = false, enabled = true,
         if (addingId === row.id && singleKey && canWrite) {
             return (_jsx(InlineAddKeyRow, { projectId: projectId, entry: entry, row: row, onDone: () => setAddingId(null) }, row.id));
         }
+        if (entry.managed && entry.models.length === 0) {
+            if (!showUpgradeOption)
+                return null;
+            return (_jsx(AccordionRowFrame, { expanded: false, children: _jsx("div", { className: "px-3.5 py-2.5", children: _jsx(ManagedUpgradeRow, { projectId: projectId, row: row }) }) }, row.id));
+        }
         const expanded = expandedId === row.id;
         // AK01: an available single-key row has nothing to show when opened
         // except a field — so it goes straight to the field.

package/dist/customize/providers/provider-connect.js

@@ -44,7 +44,7 @@ import { useQuery } from '@tanstack/react-query';
  */
 export const FIRST_CLASS_PROVIDER_IDS = ['anthropic', 'openai', 'google'];
 /** Providers whose sheet offers a subscription sign-in beside the API key. */
-export const SUBSCRIPTION_PROVIDER_IDS = new Set(['openai', 'opencode-go']);
+export const SUBSCRIPTION_PROVIDER_IDS = new Set(['openai', 'opencode-go', 'anthropic']);
 /**
  * How many Available providers render before `Show more`, and how many each
  * press adds. A query is a request for its matches — all of them — so a search

package/dist/customize/providers/provider-sheet.d.ts

@@ -1,3 +1,5 @@
+import { ClaudeCodeStep } from '../sections/llm-provider/claude-code-step.js';
+export { ClaudeCodeStep };
 import { type SubscriptionKind } from '../sections/llm-provider/chatgpt-subscription-connect.js';
 import { type LlmProviderEntry, type LlmProviderModel } from '../../internal/lib/llm-providers.js';
 /** The subscription each two-way provider signs in with, and how it is named. */
@@ -51,7 +53,8 @@ export declare function ConnectChoice({ name, plan, providerLabel, onSignIn, onU
     plan: string;
     providerLabel: string;
     onSignIn: () => void;
-    onUseKey: () => void;
+    /** Absent: the viewer can only sign in (a Claude login is the member's own; a key is a project secret). */
+    onUseKey?: () => void;
 }): import("react").JSX.Element;
 /** The device-grant step: the code, where to enter it, and that we are waiting. */
 export declare function DeviceCode({ name, code, url, onCopy, }: {