feat(web): authorize a whole installation from Authorize repository

[zfy0701]

Summary

Part of #2398. This makes adding repository access a single flow, and makes the Workspace card's count honest:

• Edit workspace had two add entries, Authorize repository and Authorize an installation, while the Workspace card's dropdown offered only the first. Installations can now be authorized from Authorize repository.
• The card's +N repos trigger counted an installation grant, which covers a whole account, as one repository.

Changes

• AddAgentRepoModal.tsx

  • When Edit workspace passes onInstallationCreated, the GitHub picker lists, first, "All repositories in <account>" for each installation the agent can still be granted: live, unsuspended and not already held (grantableInstallations, moved here). Search matches the account name.

  • Organization owners can pick it. Everyone else sees it disabled, with the existing owner-only tooltip.

  • Picking an installation:

    • keeps the Read only / Read & write tiers, and the write tier names every repository as its reach;
    • limits the checkout to By decision / On demand, defaulting to On demand;
    • submits through createAgentInstallation.

    Picking a repository afterwards puts the checkout back to Always.

• EditWorkspaceModal.tsx: passes the grants, the owner check and the created-grant handler. The separate Authorize an installation button and its subview are removed, and AuthorizeInstallationModal.tsx is deleted.
• WorkspaceCard.tsx: the trigger reads +3 repos, +1 org, +3 repos · 1 org, or Repos when there is nothing, in en and zh-CN.
• i18n: the strings only the deleted subview used are removed from both locales.
• Docs:
  • product-conventions.md: one add flow whose GitHub picker also offers whole installations.
  • agent-multi-repo-authorization.md: the status note, the Web section, and walkthrough F.

A manual GitHub workspace's picker stays locked to its own repository, so it offers no installation.

Tests

• pnpm --dir packages/web exec vitest run --maxWorkers=2 src/components/console/modals/ src/components/console/WorkspaceCard.test.tsx: 24 files, 204 tests passed. The installation cases now go through Authorize repository:
  • which installations are offered;
  • the tiers, the reach wording and the checkout options;
  • the POST body, and the grant handed back to the dialog;
  • a server refusal, which keeps the step open;
  • the owner-only choice for a non-owner;
  • By decision from the picker.
• pnpm --dir packages/web exec vitest run --maxWorkers=2 (the whole web unit suite): 308 files, 3305 tests passed.
• pnpm --filter @agentconnect.md/web typecheck and node scripts/check-i18n.mjs pass, and prettier and eslint are clean on the changed files.

Not checked in a browser: the web mock preview has no GitHub installations. I'll check it on the test environment after deploy.

🤖 Generated with Claude Code . Opus 5.5

[agentconnect-md-test]

Approved. The consolidated GitHub picker offers grantable installations with the owner gate, submits grants through the existing API, and the Workspace card counts repositories and installations separately.

Non-blocking edge case: after selecting an installation, switching to GitLab or Gitea, choosing “Always,” and returning to GitHub leaves the installation selected with an invalid checkout value. Add then sends materialize: always, which the installation endpoint rejects. Normalize checkout when returning to the selected installation.

I reviewed the verified PR revision and its existing tests. I could not run tests locally because this checkout has no installed dependencies and pnpm is unavailable.

_{sent by review-bot (Codex · gpt-6-sol) · open in session}