@vertesia/ui 1.0.0 → 1.1.0-dev.20260427.060440Z

package/src/i18n/locales/zh.json

@@ -1,11 +1,11 @@
 {
-  "agent.actions": "操作",
   "agent.activeWorkstreams_one": "代理有{{count}}个活跃的工作流正在运行",
   "agent.activeWorkstreams_other": "代理有{{count}}个活跃的工作流正在运行",
   "agent.agentConversation": "代理对话",
   "agent.agentInterrupted": "代理已中断",
   "agent.agentPlan": "代理计划",
   "agent.agentProcessing": "代理正在处理中，完成后即可继续...",
+  "agent.agentRunIdCopied": "已复制代理运行ID",
   "agent.agentStarted": "代理已启动",
   "agent.agentWorking": "代理工作中...(按两次Esc停止)",
   "agent.agentWorkingStop": "代理工作中...按两次Esc或点击停止来中断",
@@ -13,24 +13,28 @@
   "agent.artifacts": "产物",
   "agent.askAnything": "随便问...(拖放或粘贴文件)",
   "agent.batch": "批次",
+  "agent.canceled": "",
   "agent.cancelWorkflow": "取消工作流",
-  "agent.canceling": "正在取消",
   "agent.clickToEnlarge": "点击放大",
+  "agent.cloneConversation": "克隆对话",
   "agent.close": "关闭",
   "agent.closeFullscreen": "关闭全屏",
   "agent.completed": "已完成",
-  "agent.conversationForked": "对话已分支",
-  "agent.conversationRestarted": "对话已重新开始",
+  "agent.continueConversation": "继续对话",
+  "agent.conversationCloned": "对话已克隆",
+  "agent.conversationContinued": "对话已继续",
   "agent.copied": "已复制",
   "agent.copiedAllToolCalls": "所有工具调用已复制到剪贴板",
   "agent.copiedBatchDetails": "批次详情已复制到剪贴板",
   "agent.copiedToClipboard": "已复制到剪贴板",
   "agent.copy": "复制",
+  "agent.copyAgentRunId": "复制代理运行ID",
   "agent.copyAllToolCalls": "复制所有工具调用",
   "agent.copyBatchDetails": "复制批次详情",
   "agent.copyMessage": "复制消息",
-  "agent.copyRunId": "复制运行ID",
+  "agent.copyRunId": "复制运行 ID",
   "agent.copyToClipboard": "复制到剪贴板",
+  "agent.copyWorkflowRunId": "复制工作流运行ID",
   "agent.dashboard": "仪表板",
   "agent.details": "详情",
   "agent.document": "文档",
@@ -52,21 +56,19 @@
   "agent.exportAsPdf": "导出为PDF",
   "agent.exportAsPng": "导出为 PNG",
   "agent.exportAsWord": "导出为 Word",
-  "agent.exportMessage": "导出消息",
   "agent.exporting": "正在导出...",
+  "agent.exportMessage": "导出消息",
   "agent.failedToCancelWorkflow": "取消工作流失败",
+  "agent.failedToCloneConversation": "克隆对话失败",
+  "agent.failedToContinueConversation": "继续对话失败",
   "agent.failedToDownload": "下载对话失败",
-  "agent.failedToForkConversation": "分支对话失败",
   "agent.failedToInterrupt": "中断失败",
   "agent.failedToLoadDocument": "加载文档失败",
-  "agent.failedToRenderMessage": "消息渲染失败",
-  "agent.failedToRestartConversation": "重新开始对话失败",
   "agent.failedToSend": "发送消息失败",
   "agent.filesProcessing": "文件处理中",
   "agent.filesStagedCount_one": "{{count}}个文件已暂存 - 对话开始时将上传",
   "agent.filesStagedCount_other": "{{count}}个文件已暂存 - 对话开始时将上传",
   "agent.filesUploadedDescription": "上传到此对话的文件始终可用。代理可以随时访问它们。",
-  "agent.forkConversation": "分支对话",
   "agent.fullscreen": "全屏",
   "agent.hideDetails": "隐藏详情",
   "agent.hideSidebar": "隐藏侧边栏",
@@ -94,6 +96,7 @@
   "agent.olderPlan": "较旧的计划",
   "agent.openDocument": "打开文档",
   "agent.openInNewTab": "在新标签页中打开",
+  "agent.payload": "载荷",
   "agent.pdfExportFailed": "PDF导出失败",
   "agent.pdfExportReady": "PDF导出已就绪",
   "agent.pending": "待处理",
@@ -105,11 +108,8 @@
   "agent.ready": "就绪",
   "agent.refresh": "刷新",
   "agent.remaining": "剩余{{seconds}}秒",
-  "agent.resizeRightPanel": "调整右侧面板大小",
-  "agent.restartConversation": "重新开始对话",
   "agent.retry": "重试",
-  "agent.runIdCopied": "已复制运行ID",
-  "agent.running": "运行中",
+  "agent.runIdCopied": "运行 ID 已复制",
   "agent.searchDocuments": "搜索文档",
   "agent.selectInteraction": "选择一个交互并点击开始以启动代理",
   "agent.send": "发送",
@@ -118,9 +118,9 @@
   "agent.showSidebar": "显示侧边栏",
   "agent.staged": "已暂存",
   "agent.startAgent": "启动代理",
-  "agent.startNewConversation": "开始新对话",
   "agent.startingAgent": "正在启动代理...",
   "agent.startingAgentUploading": "正在启动代理并上传文件...",
+  "agent.startNewConversation": "开始新对话",
   "agent.stepByStepPlan": "分步计划",
   "agent.stop": "停止",
   "agent.stopAgent": "停止代理",
@@ -138,8 +138,8 @@
   "agent.unknownError": "未知错误",
   "agent.unknownTime": "未知时间",
   "agent.upload": "上传",
-  "agent.uploadFailed": "上传失败",
   "agent.uploadedFiles": "已上传文件",
+  "agent.uploadFailed": "上传失败",
   "agent.uploading": "上传中...",
   "agent.uploads": "上传",
   "agent.waitForFiles": "请等待文件处理完成",
@@ -147,6 +147,7 @@
   "agent.waiting": "等待中...",
   "agent.waitingForAgentResponse": "等待代理响应...",
   "agent.workflowCancelled": "工作流已取消",
+  "agent.workflowRunIdCopied": "已复制工作流运行ID",
   "agent.working": "工作中...",
   "agent.workstreams": "工作流",
   "agent.yes": "是",
@@ -183,11 +184,7 @@
   "filter.noResultsFound": "未找到结果。",
   "filter.selectRange": "选择范围",
   "filter.to": "至：",
-  "form.clickToRemove": "点击移除",
-  "form.createValue": "创建\"{{value}}\"",
   "form.filter": "筛选...",
-  "form.noMoreOptions": "没有更多可用选项",
-  "form.noOptionsFound": "未找到选项",
   "layout.pageNotFound": "页面未找到",
   "layout.search": "搜索",
   "layout.searchPlaceholder": "搜索...",
@@ -197,10 +194,10 @@
   "login.terminal.account": "账户",
   "login.terminal.accountRequired": "账户为必填项",
   "login.terminal.accountRequiredDesc": "请选择一个账户以授权客户端访问ComposablePrompts服务器",
+  "login.terminal.authorizeClient": "授权客户端",
   "login.terminal.authPayloadCopied": "认证信息已复制",
   "login.terminal.authPayloadCopiedSuccess": "您可以关闭此页面。CLI应已接收到令牌。",
   "login.terminal.authPayloadCopiedWithError": "您可以将认证信息粘贴到终端中。注意：CLI未接收到令牌。发生错误：{{error}}",
-  "login.terminal.authorizeClient": "授权客户端",
   "login.terminal.browserPermissionNote": "注意：如果浏览器要求访问本地网络的权限，请允许。这是将授权令牌发回CLI工具所必需的。否则，您需要手动将令牌复制/粘贴到终端中。",
   "login.terminal.chooseAccountProject": "您必须选择客户端要访问的目标账户和项目。",
   "login.terminal.clientAuthenticated": "客户端已认证。您可以关闭此页面。",
@@ -225,6 +222,13 @@
   "login.terminal.projectRequiredDesc": "请选择一个项目以授权客户端访问ComposablePrompts服务器",
   "login.terminal.selectAccount": "选择账户",
   "login.terminal.selectProject": "选择项目",
+  "mcpOAuth.authenticate": "身份验证",
+  "mcpOAuth.authenticating": "正在验证身份...",
+  "mcpOAuth.connect": "连接",
+  "mcpOAuth.connected": "已连接",
+  "mcpOAuth.connecting": "正在连接...",
+  "mcpOAuth.disconnect": "断开连接",
+  "mcpOAuth.notConnected": "未连接",
   "misc.copiedToClipboard": "已复制到剪贴板",
   "misc.copy": "复制",
   "misc.failedToCopy": "复制失败",
@@ -249,45 +253,10 @@
   "modal.saveVersion.versionLabel": "版本标签（可选）",
   "modal.saveVersion.versionLabelDescription": "新版本的可选标签。",
   "modal.saveVersion.versionLabelPlaceholder": "例如 v1.2、已批准、审核后",
-  "oauthApps.authenticate": "认证",
-  "oauthApps.authenticating": "正在认证...",
-  "oauthApps.authorizationEndpoint": "授权端点",
-  "oauthApps.cancel": "取消",
-  "oauthApps.clientId": "Client ID",
-  "oauthApps.clientSecret": "Client Secret",
-  "oauthApps.clientSecretConfigured": "Secret 已配置（留空以保留当前值）",
-  "oauthApps.clientSecretHelp": "可选。机密客户端需要此项。静态加密存储。",
-  "oauthApps.clientSecretPlaceholder": "输入 Client Secret",
-  "oauthApps.connect": "连接",
-  "oauthApps.connected": "已连接",
-  "oauthApps.create": "创建",
-  "oauthApps.createDescription": "为此项目配置新的 OAuth 应用。",
-  "oauthApps.created": "OAuth 应用已创建",
-  "oauthApps.defaultScopes": "默认权限范围",
-  "oauthApps.defaultScopesHelp": "以空格分隔的 OAuth 权限范围列表。",
-  "oauthApps.deleteConfirm": "删除 OAuth 应用",
-  "oauthApps.deleteConfirmMessage": "您确定要删除吗",
-  "oauthApps.deleteFailed": "删除 OAuth 应用失败",
-  "oauthApps.deleted": "OAuth 应用已删除",
-  "oauthApps.description": "配置用于第三方集成的 OAuth 应用。",
-  "oauthApps.disconnect": "断开连接",
-  "oauthApps.displayName": "显示名称",
-  "oauthApps.edit": "编辑 OAuth 应用",
-  "oauthApps.editDescription": "更新 OAuth 应用配置。",
-  "oauthApps.empty": "尚未配置任何 OAuth 应用。",
-  "oauthApps.endpointsOptionalHelp": "可选。对于支持 .well-known 发现的 MCP 服务器，请留空。",
-  "oauthApps.name": "名称",
-  "oauthApps.nameHelp": "Kebab-case 标识符（例如 my-oauth-app）。创建后不可更改。",
-  "oauthApps.notConnected": "未连接",
-  "oauthApps.revocationEndpoint": "撤销端点",
-  "oauthApps.save": "保存",
-  "oauthApps.saveFailed": "保存 OAuth 应用失败",
-  "oauthApps.saving": "正在保存...",
-  "oauthApps.status": "状态",
-  "oauthApps.title": "OAuth 应用",
-  "oauthApps.tokenEndpoint": "令牌端点",
-  "oauthApps.updated": "OAuth 应用已更新",
-  "oauthApps.usePkce": "使用 PKCE（推荐）",
+  "oauthProvider.authenticate": "认证",
+  "oauthProvider.authenticating": "正在认证...",
+  "oauthProvider.connected": "已连接",
+  "oauthProvider.disconnect": "断开连接",
   "pdf.close": "关闭",
   "pdf.closeFullscreen": "关闭全屏",
   "pdf.download": "下载",
@@ -343,7 +312,8 @@
   "store.actions.addToCollectionFailure": "添加到集合失败",
   "store.actions.addToCollectionFailureDesc": "无法将选中的对象添加到集合",
   "store.actions.addToCollectionSuccess": "添加到集合成功",
-  "store.actions.addToCollectionSuccessDesc": "已将{{count}}个对象添加到所选集合",
+  "store.actions.addToCollectionSuccessDesc_one": "已将 {{count}} 个对象添加到集合",
+  "store.actions.addToCollectionSuccessDesc_other": "已将 {{count}} 个对象添加到集合",
   "store.actions.addToCollectionTitle": "添加到集合",
   "store.actions.areYouSure": "确定吗？",
   "store.actions.cannotRemoveNoCollection": "无法移除对象：未指定集合",
@@ -354,7 +324,6 @@
   "store.actions.chooseWorkflowRule": "选择要启动的工作流规则：",
   "store.actions.confirmDeleteAll": "确定要删除所有选中的对象吗？此操作无法撤销。",
   "store.actions.confirmDeleteSelected": "确定要删除选中的对象吗？\n这不是从集合中移除。",
-  "store.actions.confirmRemoveFromCollection": "确定要从此集合中移除选中的对象吗？",
   "store.actions.createNew": "新建",
   "store.actions.delete": "删除",
   "store.actions.deleteObjects": "删除对象",
@@ -370,8 +339,6 @@
   "store.actions.noObjectsSelected": "未选择任何对象",
   "store.actions.pleaseSelectObjectsToDelete": "请选择要删除的对象",
   "store.actions.pleaseSelectObjectsToRemove": "请选择要从集合中移除的对象",
-  "store.actions.removeFromCollection": "从集合中移除",
-  "store.actions.removeFromCollectionDesc": "从此集合中移除选中的对象",
   "store.actions.selectCollection": "选择集合",
   "store.actions.startWorkflow": "启动工作流",
   "store.actions.startWorkflowByRule": "按规则启动工作流",
@@ -395,9 +362,10 @@
   "store.collectionDeleted": "集合已删除",
   "store.collectionFetchFailed": "获取集合失败",
   "store.collectionPropertiesUpdated": "集合属性已更新",
+  "store.collectionsSelected_one": "已选择 {{count}} 个集合",
+  "store.collectionsSelected_other": "已选择 {{count}} 个集合",
   "store.collectionUpdated": "集合已更新",
   "store.collectionUpdatedSuccess": "集合已成功更新",
-  "store.collectionsSelected": "已选择{{count}}个集合",
   "store.configuration": "配置",
   "store.confirmSelection": "确认选择",
   "store.contentCopied": "{{type}}已复制",
@@ -407,9 +375,9 @@
   "store.copyFailed": "复制失败",
   "store.createACollection": "创建集合",
   "store.createCollection": "创建集合",
-  "store.createType": "创建类型",
   "store.created": "创建时间",
   "store.createdBy": "创建者",
+  "store.createType": "创建类型",
   "store.deleteCollection": "删除集合",
   "store.documentExported": "文档已导出",
   "store.documentInformation": "文档信息",
@@ -419,11 +387,11 @@
   "store.downloadFailed": "下载失败",
   "store.dynamicCollection": "动态集合",
   "store.dynamicCollectionDescription": "基于查询动态获取集合内容。如果未启用，则内容必须由用户或代理添加。",
+  "store.editingGenericDocument": "编辑通用文档属性",
   "store.editJson": "编辑JSON",
   "store.editProperties": "编辑属性",
   "store.editSchema": "编辑模式",
   "store.editText": "编辑文本",
-  "store.editingGenericDocument": "编辑通用文档属性",
   "store.embeddings": "嵌入向量",
   "store.enableSyncMemberHeads": "启用同步成员HEAD",
   "store.error": "错误",
@@ -483,6 +451,7 @@
   "store.noCollectionsAvailable": "没有可用的集合。",
   "store.noCollectionsFound": "未找到集合。",
   "store.noFilesSelected": "未选择文件",
+  "store.none": "无",
   "store.noObjectsDragAndDrop": "没有对象。只需将文档或图片拖放到此处即可创建内容对象。",
   "store.noPreviewAvailable": "此文档类型没有可用的预览。",
   "store.noProjectSelected": "未选择项目",
@@ -492,7 +461,6 @@
   "store.noType": "无类型",
   "store.noValidFilesSelected": "未选择有效文件",
   "store.noVideoRendition": "没有可用的Web兼容视频格式",
-  "store.none": "无",
   "store.openFullDocument": "打开完整文档",
   "store.openFullDocumentView": "打开完整文档视图",
   "store.optional": "（可选）",
@@ -521,11 +489,10 @@
   "store.search": "搜索",
   "store.searchCollections": "搜索集合",
   "store.searchFailed": "搜索失败",
+  "store.searching": "搜索中...",
   "store.searchPlaceholder": "输入您要查找的内容，或选择筛选条件",
   "store.searchTypes": "搜索类型",
-  "store.searching": "搜索中...",
   "store.selectACollection": "选择一个集合",
-  "store.selectContent": "选择内容",
   "store.selectContentType": "选择内容类型",
   "store.selectContentTypeAuto": "选择内容类型，或留空以自动检测",
   "store.selectContentTypeLabel": "选择内容类型",
@@ -567,14 +534,14 @@
   "store.viewAsPdf": "以PDF查看",
   "store.viewAudio": "查看音频",
   "store.viewImage": "查看图片",
+  "store.viewingNewVersion": "正在查看新版本",
+  "store.viewingNewVersionDefault": "正在查看新版本",
+  "store.viewingVersionLabel": "正在查看版本'{{label}}'",
   "store.viewInJsonFormat": "以JSON格式查看",
   "store.viewPdf": "查看PDF",
   "store.viewText": "查看文本",
   "store.viewTranscript": "查看转录",
   "store.viewVideo": "查看视频",
-  "store.viewingNewVersion": "正在查看新版本",
-  "store.viewingNewVersionDefault": "正在查看新版本",
-  "store.viewingVersionLabel": "正在查看版本'{{label}}'",
   "theme.dark": "深色",
   "theme.label": "主题",
   "theme.light": "浅色",
@@ -582,7 +549,9 @@
   "type.description": "描述",
   "type.name": "名称",
   "type.nameRequired": "名称为必填项",
-  "upload.allFilesExist": "所有{{count}}个文件已存在于系统中，将被跳过。您可以继续查看结果。",
+  "type.type": "类型",
+  "upload.allFilesExist_one": "{{count}} 个文件已存在",
+  "upload.allFilesExist_other": "{{count}} 个文件已存在",
   "upload.analyzingFiles": "正在分析文件...",
   "upload.checkingForDuplicates": "正在检查重复项和更新",
   "upload.collectionLabel": "集合：",
@@ -620,15 +589,17 @@
   "upload.update": "更新",
   "upload.uploadComplete": "上传完成",
   "upload.uploadFiles": "上传文件",
+  "upload.uploadingFiles": "正在上传文件",
   "upload.uploadLocation": "上传位置：",
   "upload.uploadMore": "上传更多",
   "upload.uploadProcessInterrupted": "上传过程已中断",
-  "upload.uploadingFiles": "正在上传文件",
   "upload.useAutoDetection": "使用自动类型检测",
   "upload.useTypeName": "使用{{typeName}}",
   "user.account": "账户：",
   "user.agentOnBehalfOf": "代理代表",
   "user.agentOnBehalfOfApiKey": "代理代表API密钥",
+  "user.allProjectMembers": "所有项目成员",
+  "user.allProjectMembersDescription": "此项目的每个成员都拥有此权限。",
   "user.appVersion": "应用版本",
   "user.environment": "环境",
   "user.failedToFetchApiKey": "获取API密钥失败",

package/src/session/UserSession.ts

@@ -6,6 +6,7 @@ import { AuthTokenPayload } from '@vertesia/common';
 import { Env } from '@vertesia/ui/env';
 
 import { getComposableToken } from './auth/composable';
+import { shouldRedirectToCentralAuth } from './auth/domainRouting';
 import { getFirebaseAuth } from './auth/firebase';
 
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY } from './constants';
@@ -114,11 +115,7 @@ class UserSession {
     logout() {
         console.log('Logging out');
 
-        // Check if we should use central auth for logout
-        const devDomains = [".composable.sh", ".vertesia.dev", "vertesia.app"];
-        const shouldUseCentralAuth = Env.isDocker || devDomains.some((domain) => window.location.hostname.endsWith(domain));
-
-        if (shouldUseCentralAuth) {
+        if (shouldRedirectToCentralAuth()) {
             // Redirect to central auth for logout
             // Central auth will handle Firebase logout
             console.log('Using central auth logout');

package/src/session/UserSessionProvider.tsx

@@ -1,26 +1,14 @@
 import { Env } from "@vertesia/ui/env";
 import { onAuthStateChanged } from "firebase/auth";
 import { ReactNode, useEffect, useRef, useState } from "react";
-import { UserNotFoundError, getComposableToken } from "./auth/composable";
+import { STSError, UserNotFoundError, getComposableToken } from "./auth/composable";
+import { shouldRedirectToCentralAuth } from "./auth/domainRouting";
 import { getFirebaseAuth } from "./auth/firebase";
 import { useAuthState } from "./auth/useAuthState";
 import { LastSelectedAccountId_KEY, LastSelectedProjectId_KEY, UserSession, UserSessionContext } from "./UserSession";
 
-const devDomains = [".composable.sh", ".vertesia.dev", "vertesia.app"];
 const CENTRAL_AUTH_REDIRECT = "https://internal-auth.vertesia.app/";
 
-export function shouldRedirectToCentralAuth() {
-    // Authentication is not supported in Docker environment.
-    // See https://github.com/vertesia/studio/wiki/Composable-UI-Hosting-Options
-    if (Env.isDocker) {
-        return true;
-    }
-    if (window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1") {
-        return true;
-    }
-    return devDomains.some((domain) => window.location.hostname.endsWith(domain));
-}
-
 interface UserSessionProviderProps {
     children: ReactNode | ReactNode[];
 }
@@ -101,6 +89,23 @@ export function UserSessionProvider({ children }: UserSessionProviderProps) {
                         return;
                     }
 
+                    if (err instanceof STSError) {
+                        console.error("STS error during token exchange", err);
+                        Env.logger.error("STS error during token exchange", {
+                            vertesia: {
+                                account_id: selectedAccount,
+                                project_id: selectedProject,
+                                sts_url: err.stsURL,
+                                error: err,
+                            },
+                        });
+                        window.alert("Authentication failed due to an issue with the authentication service. Please try again later.");
+                        session.logout();
+                        setSession(session.clone());
+                        window.location.hash = "";
+                        return;
+                    }
+
                     console.error("Failed to fetch user token from studio, redirecting to central auth", err);
                     Env.logger.error("Failed to fetch user token from studio, redirecting to central auth", {
                         vertesia: {
@@ -111,7 +116,7 @@ export function UserSessionProvider({ children }: UserSessionProviderProps) {
                 });
             return;
         } else {
-            //if on a dev domain and not logged in, redirect to central auth
+            // If the current host is not in the Firebase allowlist, central auth owns sign-in.
             if (!session.isLoggedIn()) {
                 console.log("Auth: not logged in & no token/state");
                 Env.logger.info("Not logged in & no token/state", {
@@ -122,7 +127,7 @@ export function UserSessionProvider({ children }: UserSessionProviderProps) {
                 });
                 if (shouldRedirectToCentralAuth()) {
                     console.log(
-                        "Auth: on dev domain, redirecting to central auth with selection",
+                        "Auth: host is not in Firebase auth allowlist, redirecting to central auth with selection",
                         selectedAccount,
                         selectedProject,
                     );
@@ -135,8 +140,8 @@ export function UserSessionProvider({ children }: UserSessionProviderProps) {
                     redirectToCentralAuth();
                     return; // Don't register onAuthStateChanged listener when redirecting
                 } else {
-                    console.log("Auth: not on dev domain");
-                    Env.logger.info("Not on dev domain", {
+                    console.log("Auth: host is in Firebase auth allowlist");
+                    Env.logger.info("Host is in Firebase auth allowlist", {
                         vertesia: {
                             account_id: selectedAccount,
                             project_id: selectedProject,

package/src/session/auth/auth-flow.md

@@ -12,7 +12,7 @@ The authentication system uses:
 
 ### STS Endpoints
 - Production/Preview: `https://sts.vertesia.io`
-- Staging: `https://sts-staging.vertesia.io`
+- Staging: `https://sts.dev1.vertesia.io`
 
 **Important**: STS is the single source of truth for generating Vertesia JWT tokens. Both authentication paths (Central Auth and Direct Firebase) ultimately call STS to get the JWT.
 

package/src/session/auth/composable.ts

@@ -61,6 +61,16 @@ export async function fetchComposableToken(getIdToken: () => Promise<string | nu
                 'Authorization': `Bearer ${idToken}` // Firebase token for authentication
             },
             body: JSON.stringify(requestBody)
+        }).catch((error) => {
+            console.error('Failed to call STS endpoint', error);
+            Env.logger.error('Failed to call STS endpoint', {
+                vertesia: {
+                    account_id: accountId,
+                    project_id: projectId,
+                    error: error,
+                },
+            });
+            throw new STSError('Failed to call STS endpoint', stsEndpoint);
         });
 
         if (idToken && stsRes?.status === 404) {
@@ -207,8 +217,8 @@ export async function fetchComposableToken(getIdToken: () => Promise<string | nu
         return token;
 
     } catch (error) {
-        if (error instanceof UserNotFoundError) {
-            throw error; // Re-throw UserNotFoundError
+        if (error instanceof UserNotFoundError || error instanceof STSError) {
+            throw error; // Re-throw UserNotFoundError and STSError to be handled separately in the caller
         }
 
         // Clear any stale account/project from localStorage on error
@@ -293,3 +303,12 @@ export class UserNotFoundError extends Error {
         this.email = email;
     }
 }
+
+export class STSError extends Error {
+    stsURL: string;
+    constructor(message: string, stsURL: string) {
+        super(message);
+        this.name = 'STSError';
+        this.stsURL = stsURL;
+    }
+}

package/src/session/auth/domainRouting.test.ts

@@ -0,0 +1,26 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { shouldRedirectToCentralAuth, shouldUseFirebaseAuth } from "./domainRouting";
+
+describe("domainRouting", () => {
+    afterEach(() => {
+        delete (globalThis as any).window;
+    });
+
+    it("uses Firebase auth when AUTH_MODE is 'firebase'", () => {
+        (globalThis as any).window = { AUTH_MODE: "firebase" };
+        expect(shouldUseFirebaseAuth()).toBe(true);
+        expect(shouldRedirectToCentralAuth()).toBe(false);
+    });
+
+    it("uses central auth when AUTH_MODE is 'central'", () => {
+        (globalThis as any).window = { AUTH_MODE: "central" };
+        expect(shouldUseFirebaseAuth()).toBe(false);
+        expect(shouldRedirectToCentralAuth()).toBe(true);
+    });
+
+    it("defaults to central auth when AUTH_MODE is not set", () => {
+        (globalThis as any).window = {};
+        expect(shouldUseFirebaseAuth()).toBe(false);
+        expect(shouldRedirectToCentralAuth()).toBe(true);
+    });
+});

package/src/session/auth/domainRouting.ts

@@ -0,0 +1,13 @@
+declare global {
+    interface Window {
+        AUTH_MODE?: 'firebase' | 'central';
+    }
+}
+
+export function shouldUseFirebaseAuth(_hostname?: string) {
+    return window.AUTH_MODE === 'firebase';
+}
+
+export function shouldRedirectToCentralAuth(_hostname?: string) {
+    return !shouldUseFirebaseAuth();
+}

package/src/shell/login/InviteAcceptModal.tsx

@@ -39,6 +39,7 @@ export function InviteAcceptModal() {
 
     const accept = async (invite: TransientToken<UserInviteTokenData>) => {
         await client.account.acceptInvite(invite.id);
+        await session.authCallback;
         await session.fetchAccounts();
         await session.fetchProjects(invite.data.account.id);
         const remainingInvites = invites.filter(i => i.id !== invite.id)

package/src/widgets/form/Form.tsx

@@ -154,7 +154,7 @@ function ListField({ object }: ListFieldProps) {
                 })
             }
             <div>
-                <Button variant='secondary' onClick={addItem} disabled={disabled}><Plus className="size-6" /> Add</Button>
+                <Button variant='outline' onClick={addItem} disabled={disabled}><Plus className="size-6" /> Add</Button>
             </div>
         </div>
     )
@@ -174,7 +174,7 @@ function ListItem({ list, object, onDelete, disabled }: ListItemProps) {
                     renderItemProperty(object, list.schema.arraySchema.editor)
                 }
             </div>
-            <Button variant='secondary' onClick={onDelete} disabled={disabled}><Trash2 className='size-4' /></Button>
+            <Button variant='ghost' onClick={onDelete} disabled={disabled} alt="Delete"><Trash2 className='size-4 text-destructive' /></Button>
         </div>
     )
 }

package/src/widgets/markdown/MarkdownRenderer.tsx

@@ -16,6 +16,7 @@ import {
     isExpandLanguage,
 } from './codeBlockHandlers';
 import { useCodeBlockRendererRegistry } from './CodeBlockRendering';
+import { preprocessMathDelimiters } from './preprocessMathDelimiters';
 import { MarkdownFigure } from './MarkdownFigure';
 import { MarkdownImage } from './MarkdownImage';
 import { MarkdownLink } from './MarkdownLink';
@@ -104,7 +105,7 @@ export function MarkdownRenderer({
 }: MarkdownRendererProps) {
     const codeBlockRegistry = useCodeBlockRendererRegistry();
     const normalizedMarkdown = React.useMemo(
-        () => normalizeDirectives(normalizeCustomSchemeLinks(children)),
+        () => normalizeDirectives(normalizeCustomSchemeLinks(preprocessMathDelimiters(children))),
         [children]
     );
 

package/src/widgets/markdown/markdown.css

@@ -190,3 +190,15 @@
     margin-top: 0.5rem;
     font-style: italic;
 }
+
+/* ------------------------------------------------------------------ */
+/* KaTeX: hide the unstyled HTML layer, keep browser-rendered MathML  */
+/* rehype-katex emits two children inside .katex:                     */
+/*   .katex-mathml — MathML markup (browsers render this natively)    */
+/*   .katex-html   — HTML markup (needs full katex.css to look right) */
+/* Since we don't load the full KaTeX CSS, hide the broken HTML layer */
+/* ------------------------------------------------------------------ */
+
+.katex .katex-html {
+    display: none;
+}