console: Setup → Integrations → "Connector credentials" page and the install dialog credential prompt (ruling A on #27230) #27238

Filing gate ③ (maintainer ruling). Ruled on #27230, letter A, comment 6468327468, 2026-10-28; the maintainer's words in the session thread, verbatim: 「同意」. This is the Console half; the server half (object, resolver chain, REST surface, install-local answer) is #27237 (the sibling card filed in the same batch).

Filed by session_01J8VVAjRKqdoEYQ4hXxtBuf. ⛔ Not a claim. Lane suggestion: domain:ui (ui/packages/app-shell, the Setup Integrations group and the marketplace install dialog). Triage sets labels and priority. Blocked-by: #27237 (the server card's REST surface).

Business reason. The customer's administrator who installs an app holds the vendor key and has no server access on a hosted environment. Today there is no place in the Console to supply the credential a connector declares, so the app's integration stays dark. This card is that place: one page listing every declared credential with its status, and a prompt at install time.

Who acts. The domain:ui seat, against the sibling's routes. Readers: administrators; the docs page for Setup.

Dedupe: as #27230 (two searches, 2026-10-28, nothing open).

Governing text

• [Decision] Where a customer administrator supplies a declarative connector credential: a platform credentials page over an encrypted object, an app-shipped settings manifest, env-only as today, or the OAuth connection record #27230 ruling comment 6468327468: "Setup → Integrations gains a 'Connector credentials' page listing every ref the installed apps declare with its connector and status" and "install-local prompts for the missing refs of the package being installed and lets the administrator skip".
• cloud ADR-0009 as restated in packages/cloud-connection/src/marketplace-ui.ts: a capability's nav entry lives and dies with the capability — the page is contributed by the automation service's UI bundle (the MARKETPLACE_*_UI_BUNDLE shape), not hard-coded in the shell.
• ADR-0007 render rules: secret inputs are masked; write of an empty value means "don't change".
• platform-core.marketplace-console-honesty (checklist): nav entries render the configuration conclusion, never a red "failed to load".

Protocol statement. Metadata-protocol: none. Skills-docs: follow-up owed — an administrator page under content/docs (Setup → Integrations → Connector credentials: what the list shows, env-sourced rows, rejected status, skipping at install).

Premises (each with a re-check)

1. Setup's Integrations group exists and takes plugin-contributed entries. Re-check: git grep -n "group_integrations\|Integrations" origin/main -- packages/platform-objects/src/apps/setup-nav.contributions.ts.
2. The marketplace install dialog is MarketplacePackagePage's install dialog (ui/packages/app-shell/src/console/marketplace/). Re-check: git grep -n "install" origin/main -- ui/packages/app-shell/src/console/marketplace/MarketplacePackagePage.tsx.
3. The sibling's routes exist on the runtime the Console talks to (blocked until then).

Work

1. Connector credentials page under Setup → Integrations, contributed by the automation service's UI bundle: one row per declared ref — ref, connector, package, status (set / missing / rejected with the upstream message / env read-only), last changed by/at; a masked input to set or replace (empty = unchanged), a clear action with confirm. Never displays a value.
2. Install dialog: after the package's manifest is resolved and before install, a "Credentials" step listing the refs the package declares that are missing, each with a masked input and a "skip for now" affordance; skipped refs are shown on the result screen with a link to the page.
3. Honesty states: when the runtime has no credential routes (older runtime, or walled posture refusing), the page renders the configuration conclusion, not an error.
4. Docs: the administrator page named in Skills-docs:.

Acceptance

• Install HotCRM on a fresh environment through the Console with no env vars: the dialog shows the Slack ref as missing; fill it; the connector is ready on the next reconcile without restart; the page shows set, by whom, when.
• Skip at install; the page shows missing; set it later; same result.
• A wrong key: page shows rejected with the upstream message; correcting it clears the state.
• With the ref in env: the row reads env, input disabled.
• No value ever rendered, in the DOM or in network responses.

Out of scope

• OAuth "Connect" flows: connectors: outbound OAuth in the open tier — connection-scoped authorization-code / client-credentials / app-credential tokens, refreshed per dispatch, for the openapi, mcp and rest providers #26702's Console follow-up.
• App-shipped settings pages (option B): its own card later.

Related

#27230 (ruling) · #27237 · #26702 · #27223 · ADR-0007.

Generated by Claude Code