[dolho]

Summary

• Credentials gets its own pane in the Settings rail, directly after General ("What secrets it runs with"). feat(ui): one Settings home for the agent — rail, General, Guardrails, Storage, People, one restart banner (ent#887, #888, #890, #891, #353) #3798 had made it one section of Storage. ?tab=settings&section=credentials opens it, and the legacy ?tab=credentials link now lands here instead of on Storage.
• Storage loses the Credentials section and is otherwise unchanged. The credential search words ("credentials", "secrets", "env", …) move from Storage to the new pane.
• The system agent gets Credentials back. The old Credentials tab was shown to it; folding the panel into Storage, which is hidden for the system agent, had removed it.
• The file list only reports what it could actually read. On a stopped agent, all three rows said "Not present" because the panel could not read them. Now:
  • a stopped agent shows "The agent is stopped. Start it to see and change its credential files".
  • a failed first read shows LoadFailed with a retry. A failed refresh keeps the data already on screen.
  • an agent with no .env gets a next action: Quick Inject, or Add .env, which opens the editor on an empty .env. This is keyed on .env because every agent has a platform-written .mcp.json. A "no credential file at all" test would never fire on a real agent; the mocks hid this and the live run caught it.
• Nothing reports to the restart banner from this pane. Credential changes need no restart: .env is re-read at every spawn, per the requirements. The acceptance criteria item about restart-required rows therefore has nothing to wire.
• OSS-core, by operator decision: this relocates an existing OSS panel, so it is not entitlement-gated.

Changes

• src/frontend/src/utils/agentSettings.js: the credentials section, LEGACY_TAB_SECTIONS.credentials, the system agent's panes, and keywords.
• src/frontend/src/components/agent-settings/CredentialsPane.vue (new), wired into views/AgentDetail.vue. StoragePane.vue drops the section.
• src/frontend/src/components/CredentialsPanel.vue: the stopped, failed and no-.env states (primitives only: LoadFailed, BaseButton).
• src/frontend/raw-color-baseline.json: re-frozen in its own commit, with the growth named. CredentialsPanel.vue raw_gray goes from 65 to 69 because of two neutral-ink pairs for the new lines. No non-gray class or hex was added. Only that one entry changed; a full regeneration would have rewritten about 500 lines of unrelated drift.
• Docs: docs/memory/requirements/core-agent.md §1.7 (FR-1, FR-2, FR-5, status), feature-flows/agent-settings-home.md, architecture/frontend.md.

Test Plan

• npm run test:unit: 388 files, 6145 tests pass. That covers the raw-colour, loading-gate and source-text ratchets. npm run check:tokens is OK and vite build succeeds.
• New tests/unit/credentialsPane.mount.spec.js (7 mounted cases): the pane hosts the panel; Storage does not; the no-.env next action, with Add .env opening the editor; a .env hides it; a stopped agent shows no rows; a failed read shows LoadFailed and the retry recovers.
• agentSettingsHome.spec.js and agentSettingsHome.mount.spec.js are updated for the new pane order, the alias, the system agent's panes and search.
• Live in a browser, light and dark: this branch's Vite server against a running local stack, with a throwaway agent that was deleted afterwards.
  • ?tab=credentials lands on Credentials, and the rail order is General, Credentials, Guardrails, People, Channels, Integrations, Storage.
  • Storage has no Credentials section, and the system agent's rail is General, Credentials, Guardrails, Integrations.
  • The running agent with no .env shows the next-action row; the stopped agent shows the stopped line and no fake "Not present" rows.
  • Screenshots are local only; none are committed.
• Not touched, out of scope: on a stopped agent the footer still says "No encrypted backup", which is just as unknowable there.

Fixes abilityai/trinity-enterprise#951

🤖 Generated with Claude Code

[obasilakis]

Design-system clean (gray only, increase named in the baseline, LoadFailed/BaseButton reused, no new loading gates), ?tab=credentials and the import wizard's goTo('credentials') land on the new pane, nothing gated leaks.

Minor:

• src/frontend/src/utils/agentTabs.js:87 — comment still says Credentials is a section of Settings › Storage.