feat(cloud-ui): org credentials tab + connect-link invite flow (#11332)

[NubsCarson]

Part of #11332 — Phase 1 of team credential pooling (frontend): the Credentials tab and the shareable connect-link invite flow. Backend routes land in the companion PR #11487; this branch is UI-only and merge-independent, but the tab needs those endpoints to serve live data.

what

• Credentials tab beside Members in Settings → Organization: masked pooled-credential rows (label, provider badge, ••••last4, health dot with rate-limited-until, calls today, contributor with "(you)" marker, last-used). Owner/admin get the enable toggle and delete-any; a contributor can delete their own key; every member can view and contribute. Mirrors the route-level RBAC exactly.
• Contribute modal: provider select (the 6 Phase-1 direct-API providers only — subscription providers are never rendered), password-masked key input, live-probe failures rendered inline, and a confirmation step showing the masked last4 only — the plaintext never comes back from the API and is never rendered after the masked input.
• Connect link: the invite dialog now shows the copyable accept link (/invite/accept?token=…) after creation, with an optional connect=1 intent from the Credentials tab's "Invite & Connect". The accept page preserves the intent through the login round-trip and routes straight to dashboard/organization?tab=credentials&contribute=1 — the teammate lands with the contribute modal open. The link carries only the expiring hashed-token invite, no secrets; joining still requires an authenticated session.
• DTO contract types (PooledCredentialDto etc.) mirror the backend summaries, including epoch-ms health/usage timestamps.

evidence

• bunx vitest run src/cloud/organization/credentials-tab.test.tsx src/cloud/organization/connect-link.test.tsx — 11 pass / 0 fail (2 files): masked rows (health dot states, rate-limited-until copy, no key material beyond last4 anywhere in the DOM), RBAC gating per role (member sees no toggles, keeps own delete), PATCH on toggle + DELETE after confirm with exact request assertions, contribute happy path asserting the plaintext is not rendered on the confirmation step, inline probe-failure path, invite-link build/copy, and the ?tab=credentials&contribute=1 landing intent.
• bun run typecheck clean in packages/ui; biome clean.

billing

Pooled-key usage is zero-rated (nubs decision) — no credit decrement, no fee; the org pays the provider directly. The "future monetization" options are documented (not implemented) in packages/cloud/shared/docs/team-credential-pooling.md in the backend PR.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8be0d56b-e622-4ab8-a1f8-3e5696926387

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch nubs/team-credential-pool-ui

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[lalalune]

Rendered evidence + finishing commits (maintainer pass)

Landed on this branch:

1. Copy fix — the pooled-success dialog no longer claims "Nobody — including you — can read it back" (pooled keys reach member agent containers by design, per the backend review); it now says the key is never shown again in the dashboard.
2. Real-pixel visual e2e (packages/ui/src/cloud/organization/__e2e__/run-credentials-e2e.mjs) — boots the real mock cloud stack (Hono graph + PGlite + MOCK_REDIS) with a local provider stub as the live key-probe target, mints a real key via headless SIWE, compiles the real Tailwind stylesheet over the component sources, and drives the REAL CredentialsTab in headless Chromium. 11/11 assertions green, desktop + mobile, screenshots + video committed under .github/issue-evidence/11332-credentials-tab-e2e/.

It also surfaced and got fixed two real backend bugs along the way: fresh wallet-signup users weren't owners of their own org (#11565, merged), and RATE_LIMIT_MULTIPLIER is a dead knob on the hono-cloudflare limiter path (harness uses the RATE_LIMIT_DISABLED dev escape hatch; flagged for follow-up).

Walkthrough

Empty state
Contribute — live probe FAILURE renders inline
Contribute — pooled (masked, fixed copy)
Masked list row (••••last4, ANTHROPIC, you)
Owner toggle → disabled
Invite & connect — copyable connect=1 link, no secrets
Connect-link landing (?contribute=1 auto-opens modal)
Mobile row + contribute
Remove confirm → server confirms empty pool

Video: walkthrough.webm

Aesthetic gates asserted on computed styles: no blue anywhere, primary button orange at rest; note — BrandButton primary's designed hover is bg-accent → bg-background (system-wide cloud-ui inversion, pre-existing), flagged on #11342 for the design pass vs the darker-orange-hover rule.

🤖 Generated with Claude Code

[claude]

Claude encountered an error —— View job

---

I'll analyze this and get back to you.