From f01572b3eadff773313c27e32656a97027fceb0c Mon Sep 17 00:00:00 2001
From: Guido Vizoso <guido.vizoso9@gmail.com>
Date: Wed, 21 Oct 2026 17:46:55 -0300
Subject: [PATCH] Put Connections and Capabilities beside Bots, with
 Connections as one list

Connections (/connections) is its own page and one searchable list: your apps, apps on the organisation's account, and your GitHub and Slack links, each opening its own page. Capabilities (/capabilities) holds Skills and Memory as tabs under its title. The sidebar is Bots, Capabilities, Connections. Old addresses under /settings and /skills redirect, carrying their query parameters. Every settings screen shares one 720px column. Explore agents on the home page shows white cards with the avatar on top.
---
 .claude/skills/openbot-screen-layout/SKILL.md |   5 +-
 CHANGELOG.md                                  |  25 +
 README.md                                     |   6 +-
 app/src/components/agents/agent-card.tsx      |  27 +-
 .../components/app-sidebar/app-sidebar.tsx    |  30 +-
 app/src/components/bot-profile/access.tsx     |   5 +-
 .../capabilities/capabilities-shell.tsx       |  60 ++
 .../components/channels/connect-app-card.tsx  |   2 +-
 .../computer/demonstration-recorder.tsx       |   2 +-
 .../connections/identity-connection-page.tsx  | 144 ++++
 app/src/components/layout/page-shell.tsx      |   9 +-
 app/src/components/memory/memories.tsx        |  21 +-
 .../components/plugins/app-access-action.tsx  |   7 +-
 .../new-responsibility-dialog.tsx             |   2 +-
 .../components/settings/github-sources.tsx    |   2 +-
 .../settings/linked-accounts.test.tsx         |  27 +
 .../components/settings/linked-accounts.tsx   |  48 +-
 .../components/settings/settings-sidebar.tsx  |  17 -
 .../components/settings/team-bot-consents.tsx |  56 ++
 app/src/components/skills/edit-skill.tsx      |   2 +-
 app/src/components/skills/new-skill.tsx       |   2 +-
 app/src/components/skills/proposed-skill.tsx  |   2 +-
 app/src/lib/agents/legacy-routes.ts           |   2 +-
 app/src/lib/connections/rows.ts               | 137 ++++
 app/src/lib/plugins/provider-vocabulary.ts    |   4 +-
 app/src/routeTree.gen.ts                      | 139 ++++
 .../_authed/_app/bots.$agentId.memory.tsx     |   2 +-
 .../_authed/_app/capabilities.index.tsx       |   8 +
 .../_authed/_app/capabilities.memory.tsx      |  18 +
 .../_authed/_app/capabilities.skills.tsx      | 350 ++++++++++
 app/src/routes/_authed/_app/capabilities.tsx  |   9 +
 .../routes/_authed/_app/connections.$key.tsx  | 658 ++++++++++++++++++
 .../routes/_authed/_app/connections.index.tsx | 512 ++++++++++++++
 app/src/routes/_authed/_app/index.tsx         |   2 +-
 app/src/routes/_authed/_app/skills.tsx        | 355 +---------
 .../routes/_authed/admin/components/index.tsx |   2 +-
 app/src/routes/_authed/settings/approvals.tsx |   2 +
 .../settings/components-gallery/index.tsx     |   2 +-
 .../settings/connected-accounts/$key.tsx      | 640 +----------------
 .../settings/connected-accounts/index.tsx     | 650 +----------------
 app/src/routes/_authed/settings/memory.tsx    |  21 +-
 app/tests/app-access-action.test.tsx          |  10 +-
 app/tests/app-access-card.test.tsx            |   4 +-
 app/tests/arcade-index.test.tsx               |   2 +-
 app/tests/bot-access-apps.test.tsx            |   2 +-
 app/tests/brokered-account-row.test.tsx       |  35 +-
 .../composio-unconfigured-account.test.tsx    |  29 +-
 app/tests/connect-app-card.test.tsx           |   6 +-
 .../connected-account-confirmation.test.tsx   |  20 +-
 app/tests/connected-account-grants.test.tsx   |  20 +-
 .../connected-account-landing-param.test.tsx  |  20 +-
 ...nected-accounts-authorized-notice.test.tsx |   2 +-
 app/tests/connected-accounts-list.test.tsx    |   2 +-
 ...connected-accounts-oneshot-params.test.tsx |   8 +-
 app/tests/connection-rows.test.ts             | 119 ++++
 app/tests/legacy-agent-routes.test.ts         |   2 +-
 app/tests/plugin-read-failure.test.tsx        |  30 +-
 app/tests/shared-connected-accounts.test.tsx  |  23 +-
 app/tests/skills-read-failure.test.tsx        |   2 +-
 docs/architecture.md                          |   2 +-
 docs/configuration.md                         |  20 +-
 docs/plugins/arcade.md                        |   6 +-
 docs/plugins/composio.md                      |   6 +-
 docs/plugins/google-drive.md                  |   8 +-
 docs/plugins/notion.md                        |   4 +-
 server/src/delivery/opentag-agent.ts          |   4 +-
 server/src/identity/github-callback.ts        |   4 +-
 server/src/memory/ingestion.ts                |   4 +-
 server/src/plugins/arcade.ts                  |   4 +-
 server/src/plugins/oauth.ts                   |   2 +-
 server/tests/arcade-adapter.test.ts           |   2 +-
 server/tests/arcade-errors.test.ts            |   4 +-
 .../tests/arcade-journey.integration.test.ts  |   4 +-
 server/tests/arcade-live.test.ts              |   2 +-
 .../tests/arcade-vendor-error-engine.test.ts  |   2 +-
 server/tests/arcade-verify.test.ts            |   4 +-
 server/tests/assertion-shape.test.ts          |  14 +-
 server/tests/broker-return-url-voice.test.ts  |   5 +-
 server/tests/composio-adapter.test.ts         |  23 +-
 server/tests/composio-broker-seam.test.ts     |  34 +-
 server/tests/delivery-routes.test.ts          |   2 +-
 server/tests/identity-app-wiring.test.ts      |   6 +-
 ...entity-github-callback.integration.test.ts |   7 +-
 server/tests/identity-github-callback.test.ts |   7 +-
 server/tests/memory-store.integration.test.ts |   2 +-
 server/tests/plugin-oauth-callback.test.ts    |   5 +-
 server/tests/plugin-oauth.test.ts             |  14 +-
 server/tests/plugin-routes.test.ts            |   3 +-
 server/tests/sole-definition.test.ts          |   2 +-
 server/tests/test-network-guard.test.ts       |   2 +-
 90 files changed, 2641 insertions(+), 1917 deletions(-)
 create mode 100644 app/src/components/capabilities/capabilities-shell.tsx
 create mode 100644 app/src/components/connections/identity-connection-page.tsx
 create mode 100644 app/src/components/settings/team-bot-consents.tsx
 create mode 100644 app/src/lib/connections/rows.ts
 create mode 100644 app/src/routes/_authed/_app/capabilities.index.tsx
 create mode 100644 app/src/routes/_authed/_app/capabilities.memory.tsx
 create mode 100644 app/src/routes/_authed/_app/capabilities.skills.tsx
 create mode 100644 app/src/routes/_authed/_app/capabilities.tsx
 create mode 100644 app/src/routes/_authed/_app/connections.$key.tsx
 create mode 100644 app/src/routes/_authed/_app/connections.index.tsx
 create mode 100644 app/tests/connection-rows.test.ts

diff --git a/.claude/skills/openbot-screen-layout/SKILL.md b/.claude/skills/openbot-screen-layout/SKILL.md
index 958b5a1204..e27a721a4f 100644
--- a/.claude/skills/openbot-screen-layout/SKILL.md
+++ b/.claude/skills/openbot-screen-layout/SKILL.md
@@ -51,8 +51,9 @@ PageShell        the page: header (title, description, action, backButton) then
     PageEmpty    what a section says when it has nothing to list
 ```
 
-`PageShell` takes a `width`: `prose` (`max-w-2xl`) is the default because configuration is mostly
-reading, and a row of label-and-control has no business being wider than the sentence explaining it.
+`PageShell` takes a `width`: `prose` (`max-w-3xl`, 720px here) is the default, and every
+configuration screen uses it so no screen is wider than another. Sentences inside it are held to
+`max-w-prose`, so the column has room for a label beside its control without stretching the text.
 `wide` (`max-w-5xl`) exists for one screen — `admin/audit.tsx`, because an audit log is a table to be
 scanned and prose width would wrap every row. It is not a licence for anything else to be wide.
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7582826b80..3baa354ed8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,31 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
   request for an administrator to switch on a work app, grant it to a Bot, or connect a Shared app's
   team account is kept, with who answered it and when. It starts empty and nothing is backfilled.
 
+### Every settings screen is the same, slightly wider column
+
+Settings, Admin, Connections, Capabilities and each Bot's pages share one column width, now 720px instead of 630px, so
+no screen is wider than another and a row has room for its label beside its control. Sentences keep
+their comfortable reading width inside it. The audit log stays wider, because it is a table.
+
+### Capabilities and Connections sit beside Bots in the sidebar
+
+The sidebar's Skills entry becomes two, below Bots: **Capabilities** (`/capabilities`), with Skills
+(`/capabilities/skills`) and Memory (`/capabilities/memory`) as tabs under its title, Memory leaving
+Settings; and **Connections** (`/connections`), the apps your Bots use as you, which leaves Settings
+too. On the home page, Explore agents shows each Bot as a white card with its avatar on top, the same
+card as elsewhere. The old
+addresses — `/skills`, `/settings/connected-accounts` with any account beneath it, and
+`/settings/memory` — redirect to the new ones, keeping `?connected=`, `?linked=` and a skill being
+written or edited, so a consent begun before upgrading still lands on its page. OAuth, GitHub linking
+and the Slack link confirmation now send people to `/connections`.
+
+Connections is one searchable list. Apps you connect, apps on your organisation's account (marked
+"Team account") and your GitHub and Slack links are rows of the same kind, with those already in use
+first, and each opens its own page. GitHub's page holds your link, the repositories whose events can
+start a responsibility (formerly "GitHub events"), and a way to a Composio GitHub app where one is
+enabled, so GitHub is listed once; linking GitHub now comes back to that page. The reset for what
+you let shared Bots use moves to Settings → Approvals, as **Shared Bots**.
+
 ### Each app on a Bot says whether you can use it, and you can ask an administrator for the rest
 
 A Bot's page now says, for every work app the Bot holds, what that app is for the person looking:
diff --git a/README.md b/README.md
index 7d5b936777..1d5891d817 100644
--- a/README.md
+++ b/README.md
@@ -193,14 +193,14 @@ Leave `EMBEDDED_POSTGRES` off and set `DATABASE_URL` to point at a database you
 | `/bots/:id/reach`           | Continue a conversation with the Bot in Slack, Microsoft Teams, or by text message. |
 | `/bots/:id/memory`          | Which connected apps feed the Bot facts, and its background research. |
 | `/bots/:id/approvals`       | What the Bot may do without asking you first.                      |
-| `/skills`                   | Create and enable personal skills.                                 |
+| `/connections`              | Connect your apps so your Bots can work with them.                 |
+| `/capabilities/skills`      | Create and enable personal skills.                                 |
+| `/capabilities/memory`      | What your Bots remember about you, and facts you tell them.        |
 | `/routines`                 | See the routines that are standing, and stop one.                  |
 | `/settings`                 | User preferences.                                                  |
-| `/settings/connected-accounts` | Connect your apps so your Bots can work with them.              |
 | `/settings/passwords`       | Logins you saved when signing a Bot in to a website.               |
 | `/settings/notifications`   | Where updates go, your devices, and recent deliveries.             |
 | `/settings/approvals`       | Whether your Bots ask before acting, and rules for every Bot.      |
-| `/settings/memory`          | What your Bots remember about you, and facts you tell them.        |
 | `/admin/credentials`        | Store write-only encrypted credentials.                            |
 | `/admin/approvals`          | Team approval settings, team rules, and shared account requests.   |
 | `/admin/computers`          | View, stop, and reset Bot computers.                               |
diff --git a/app/src/components/agents/agent-card.tsx b/app/src/components/agents/agent-card.tsx
index 74f2a8216c..67cc270a06 100644
--- a/app/src/components/agents/agent-card.tsx
+++ b/app/src/components/agents/agent-card.tsx
@@ -1,6 +1,5 @@
 import { IconArrowRight } from "@tabler/icons-react";
 import { Link } from "@tanstack/react-router";
-import Avatar from "boring-avatars";
 import { AbstractAvatar } from "@/components/agents/abstract-avatar";
 import { Button } from "@/components/ui/button";
 import type { AgentProfile } from "@/lib/agents/queries";
@@ -10,21 +9,23 @@ export function AgentCard({
   appearance = "compact",
 }: {
   agent: AgentProfile;
-  appearance?: "compact" | "artwork";
+  appearance?: "compact" | "tile";
 }) {
-  if (appearance === "artwork") {
+  if (appearance === "tile") {
     return (
-      <div className="relative h-[180px] w-[144px] overflow-hidden rounded-2xl bg-foreground/10">
-        <div
-          aria-hidden="true"
-          className="absolute left-1/2 top-1/2 -translate-x-1/2 -translate-y-1/2"
-        >
-          <Avatar name={agent.avatarSeed} size={250} />
+      <div className="flex h-[180px] w-[144px] flex-col overflow-hidden rounded-2xl border border-border bg-card p-3 transition-colors hover:border-ring dark:border-transparent">
+        <div aria-hidden="true" className="flex shrink-0">
+          <AbstractAvatar name={agent.name} seed={agent.avatarSeed} size={36} />
         </div>
-        <div className="absolute top-0 left-0 h-full w-full bg-background/40 dark:bg-background/50" />
-        <div className="absolute top-0 left-0 flex h-full w-full flex-col justify-end gap-2 p-3">
-          <span className="line-clamp-1 text-sm font-medium">{agent.name}</span>
-          <span className="line-clamp-3 text-xs text-foreground dark:text-foreground/80">
+        {/* Bottom-aligned, where the text sat on the earlier artwork card; the avatar holds the top. */}
+        <div className="mt-auto flex min-w-0 flex-col gap-2">
+          <span
+            className="line-clamp-1 break-words text-sm font-medium leading-5"
+            title={agent.name}
+          >
+            {agent.name}
+          </span>
+          <span className="line-clamp-3 break-words text-xs leading-4 text-muted-foreground">
             {agent.roleDescription}
           </span>
         </div>
diff --git a/app/src/components/app-sidebar/app-sidebar.tsx b/app/src/components/app-sidebar/app-sidebar.tsx
index 0194e38ae7..0189142f40 100644
--- a/app/src/components/app-sidebar/app-sidebar.tsx
+++ b/app/src/components/app-sidebar/app-sidebar.tsx
@@ -2,6 +2,7 @@ import {
   IconBolt,
   IconBox,
   IconLogout,
+  IconPlug,
   IconPlus,
   IconSearch,
   IconSettings,
@@ -366,14 +367,18 @@ export function AppSidebar({ ...props }: React.ComponentProps<typeof Sidebar>) {
               <BotsNavBadge />
             </SidebarMenuButton>
           </SidebarMenuItem>
+          {/*
+           * Beside Bots rather than inside Admin: each is somebody's own. Capabilities are your skills
+           * and what your Bots remember about you; Connections are the apps a Bot reaches as you.
+           * Capabilities links to `/capabilities` rather than a tab, so it stays lit on both tabs.
+           */}
           <SidebarMenuItem>
-            {/* Beside Bots rather than inside Admin: writing a skill is something anybody does. */}
             <SidebarMenuButton
               className="hover:bg-foreground/5 h-10"
               render={(props) => (
                 <Link
                   {...props}
-                  to="/skills"
+                  to="/capabilities"
                   activeProps={{
                     className: "bg-foreground/5",
                   }}
@@ -383,7 +388,26 @@ export function AppSidebar({ ...props }: React.ComponentProps<typeof Sidebar>) {
               <div className="size-[28px] flex items-center justify-center">
                 <IconBox />
               </div>
-              <span className="text-sm trackint-tight">Skills</span>
+              <span className="text-sm trackint-tight">Capabilities</span>
+            </SidebarMenuButton>
+          </SidebarMenuItem>
+          <SidebarMenuItem>
+            <SidebarMenuButton
+              className="hover:bg-foreground/5 h-10"
+              render={(props) => (
+                <Link
+                  {...props}
+                  to="/connections"
+                  activeProps={{
+                    className: "bg-foreground/5",
+                  }}
+                />
+              )}
+            >
+              <div className="size-[28px] flex items-center justify-center">
+                <IconPlug />
+              </div>
+              <span className="text-sm trackint-tight">Connections</span>
             </SidebarMenuButton>
           </SidebarMenuItem>
           <SidebarMenuItem>
diff --git a/app/src/components/bot-profile/access.tsx b/app/src/components/bot-profile/access.tsx
index ca4a5ed8c6..61d994d59e 100644
--- a/app/src/components/bot-profile/access.tsx
+++ b/app/src/components/bot-profile/access.tsx
@@ -116,7 +116,10 @@ function YourSkills({ agentId }: { agentId: string }) {
       ) : skills.length === 0 ? (
         <PageEmpty>
           You have not written a skill yet.{" "}
-          <Link className="underline underline-offset-4" to="/skills">
+          <Link
+            className="underline underline-offset-4"
+            to="/capabilities/skills"
+          >
             Write one
           </Link>
           .
diff --git a/app/src/components/capabilities/capabilities-shell.tsx b/app/src/components/capabilities/capabilities-shell.tsx
new file mode 100644
index 0000000000..b43217a506
--- /dev/null
+++ b/app/src/components/capabilities/capabilities-shell.tsx
@@ -0,0 +1,60 @@
+import { Link, type LinkOptions, useMatchRoute } from "@tanstack/react-router";
+import type * as React from "react";
+import { PageShell } from "@/components/layout/page-shell";
+import { Button } from "@/components/ui/button";
+
+/**
+ * What a person gives their own Bots beyond the apps they connect: the skills they write and what
+ * their Bots remember about them. Connections, the apps a Bot reaches as them, is its own page.
+ *
+ * Skills used to sit beside Bots and Memory in Settings, though both answer the same question: what
+ * do my Bots know how to do, and what do they know about me?
+ */
+const TABS = [
+  { label: "Skills", linkOptions: { to: "/capabilities/skills" } },
+  { label: "Memory", linkOptions: { to: "/capabilities/memory" } },
+] as const satisfies readonly { label: string; linkOptions: LinkOptions }[];
+
+/**
+ * The tabs are links drawn as buttons. Each page keeps its own address, so it can be bookmarked,
+ * opened in a new tab and reached by Back. The match is fuzzy so a tab stays lit on a page beneath
+ * it.
+ */
+export function CapabilitiesTabs() {
+  const matchRoute = useMatchRoute();
+  return (
+    <nav aria-label="Capabilities" className="mt-6 flex items-center gap-1">
+      {TABS.map((tab) => (
+        <Button
+          key={tab.label}
+          render={(props) => <Link {...tab.linkOptions} {...props} />}
+          variant={
+            matchRoute({ ...tab.linkOptions, fuzzy: true })
+              ? "secondary"
+              : "ghost"
+          }
+        >
+          {tab.label}
+        </Button>
+      ))}
+    </nav>
+  );
+}
+
+/**
+ * The frame each tab draws itself in: the Capabilities title with the tabs beneath it, and no
+ * description, since every section beneath them has its own title and says what it is for.
+ *
+ * A component each page renders rather than the `/capabilities` layout route drawing it once,
+ * because Skills wraps its whole page — heading included — in the side panel that writes and edits a
+ * skill. A heading drawn by the layout would sit outside that panel and stay full width while it is
+ * open.
+ */
+export function CapabilitiesShell({ children }: { children: React.ReactNode }) {
+  return (
+    <PageShell className="@container" title="Capabilities">
+      <CapabilitiesTabs />
+      {children}
+    </PageShell>
+  );
+}
diff --git a/app/src/components/channels/connect-app-card.tsx b/app/src/components/channels/connect-app-card.tsx
index 56361a9e84..8a8910c9db 100644
--- a/app/src/components/channels/connect-app-card.tsx
+++ b/app/src/components/channels/connect-app-card.tsx
@@ -95,7 +95,7 @@ export function ConnectAppCard({
           <Link
             className="underline underline-offset-2"
             params={{ key: serverId }}
-            to="/settings/connected-accounts/$key"
+            to="/connections/$key"
           >
             Enter it on {title}'s page
           </Link>
diff --git a/app/src/components/computer/demonstration-recorder.tsx b/app/src/components/computer/demonstration-recorder.tsx
index d0c36e0b8c..6b124e916a 100644
--- a/app/src/components/computer/demonstration-recorder.tsx
+++ b/app/src/components/computer/demonstration-recorder.tsx
@@ -353,7 +353,7 @@ export function DemonstrationRecorder({
               {recording.status === "published" && recording.skillSlug ? (
                 <>
                   <Link
-                    to="/skills"
+                    to="/capabilities/skills"
                     search={{ edit: recording.skillSlug }}
                     className="text-xs underline"
                   >
diff --git a/app/src/components/connections/identity-connection-page.tsx b/app/src/components/connections/identity-connection-page.tsx
new file mode 100644
index 0000000000..2a7d2dce6b
--- /dev/null
+++ b/app/src/components/connections/identity-connection-page.tsx
@@ -0,0 +1,144 @@
+import { IconBrandGithub, IconChevronRight } from "@tabler/icons-react";
+import { useQuery } from "@tanstack/react-query";
+import { Link, useNavigate } from "@tanstack/react-router";
+import { useEffect, useState } from "react";
+import {
+  PageRows,
+  PageSection,
+  PageShell,
+} from "@/components/layout/page-shell";
+import { GithubSources } from "@/components/settings/github-sources";
+import {
+  type LinkableProvider,
+  LinkedAccountSection,
+  linkableProviderTitle,
+} from "@/components/settings/linked-accounts";
+import {
+  linkedNotice,
+  visibleLinkedNotice,
+} from "@/components/settings/linked-notice";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemMedia,
+  ItemTitle,
+} from "@/components/ui/item";
+import { IDENTITY_SUMMARIES, isBrokeredGithub } from "@/lib/connections/rows";
+import { linkedAccountsQueryOptions } from "@/lib/identity/queries";
+import {
+  connectionsQueryOptions,
+  personalConnections,
+  pluginsPageQueryOptions,
+} from "@/lib/plugins/queries";
+
+/**
+ * GitHub's or Slack's page under Connections: the person's own account there, and for GitHub what
+ * hangs off it.
+ *
+ * These used to be a "Linked accounts" section and a "GitHub events" section on the Connections
+ * page itself, beside the apps, so a person had to know a link was a different kind of thing from an
+ * app before they could find it. Now each is a row like any app, and this is the row's page.
+ *
+ * `linked` is what the GitHub callback sends back, `?linked=github` and its failures. It is said
+ * once and then dropped from the address, so a reload does not repeat the news.
+ */
+export function IdentityConnectionPage({
+  linked,
+  provider,
+}: {
+  linked: string | undefined;
+  provider: LinkableProvider;
+}) {
+  const title = linkableProviderTitle(provider);
+  const [arrival] = useState(() => linkedNotice(linked));
+  const links = useQuery(linkedAccountsQueryOptions());
+  const notice = visibleLinkedNotice(arrival, links.data);
+  const navigate = useNavigate();
+  useEffect(() => {
+    if (linked !== undefined) {
+      navigate({
+        to: ".",
+        search: (previous: Record<string, unknown>) => {
+          const { linked: _linked, ...rest } = previous;
+          return rest;
+        },
+        replace: true,
+      });
+    }
+  }, [linked, navigate]);
+
+  return (
+    <PageShell
+      backButton={{ label: "Connections", linkProps: { to: "/connections" } }}
+      description={IDENTITY_SUMMARIES[provider]}
+      title={title}
+    >
+      {notice ? (
+        <p
+          className={
+            notice.tone === "error"
+              ? "mt-4 text-destructive text-sm"
+              : "mt-4 text-muted-foreground text-sm"
+          }
+          role={notice.tone === "error" ? "alert" : "status"}
+        >
+          {notice.text}
+        </p>
+      ) : null}
+      <LinkedAccountSection provider={provider} />
+      {provider === "github" ? (
+        <>
+          <GithubSources />
+          <GithubTools />
+        </>
+      ) : null}
+    </PageShell>
+  );
+}
+
+/**
+ * A brokered GitHub app, where one is enabled. It is a separate connection — tools that read and
+ * change repositories as you — and the Connections list leaves its row out so GitHub is listed once,
+ * which makes this the way to it.
+ */
+function GithubTools() {
+  const plugins = useQuery(pluginsPageQueryOptions());
+  const connections = useQuery(connectionsQueryOptions());
+  const app = plugins.data?.composioConfigured
+    ? plugins.data.servers.find(
+        (server) => isBrokeredGithub(server) && server.accountMode !== "shared",
+      )
+    : undefined;
+  if (!app) return null;
+  const connected = personalConnections(
+    connections.data?.connections ?? [],
+  ).some((row) => row.serverId === app.id);
+  return (
+    <PageSection
+      description="Lets your Bots read and change your repositories as you. A connection of its own, separate from your account above."
+      title="Tools"
+    >
+      <PageRows>
+        <Item
+          render={<Link params={{ key: app.id }} to="/connections/$key" />}
+          size="sm"
+        >
+          <ItemMedia variant="icon">
+            <IconBrandGithub />
+          </ItemMedia>
+          <ItemContent>
+            <ItemTitle>GitHub tools</ItemTitle>
+            <ItemDescription>
+              {connected ? "Connected" : "Not connected"}
+            </ItemDescription>
+          </ItemContent>
+          <ItemActions>
+            <IconChevronRight className="size-4 text-muted-foreground" />
+          </ItemActions>
+        </Item>
+      </PageRows>
+    </PageSection>
+  );
+}
diff --git a/app/src/components/layout/page-shell.tsx b/app/src/components/layout/page-shell.tsx
index 15d9b4e009..6748f66b03 100644
--- a/app/src/components/layout/page-shell.tsx
+++ b/app/src/components/layout/page-shell.tsx
@@ -22,9 +22,10 @@ import { SidebarToggle, useSidebarToggleVisible } from "./sidebar-toggle";
  */
 
 /**
- * `prose` is the default because configuration is mostly reading. A measure of around 65 characters
- * is where prose stays comfortable, and a row of label-and-control has no business being wider than
- * the sentence explaining it.
+ * `prose` is the default because configuration is mostly reading, and every screen uses it so none is
+ * wider than another. It is `max-w-3xl`, 720px against this app's 15px root: room for a row's label
+ * and its control side by side. Sentences are held to `max-w-prose` (around 65 characters) inside it,
+ * which is where reading stays comfortable, so the column widening does not stretch them.
  *
  * `wide` exists for one page. An audit log is a table you scan, and forcing it into the prose column
  * would wrap every row. It is not a licence for anything else to be wide.
@@ -32,7 +33,7 @@ import { SidebarToggle, useSidebarToggleVisible } from "./sidebar-toggle";
 type ShellWidth = "prose" | "wide";
 
 const WIDTHS: Record<ShellWidth, string> = {
-  prose: "max-w-2xl",
+  prose: "max-w-3xl",
   wide: "max-w-5xl",
 };
 
diff --git a/app/src/components/memory/memories.tsx b/app/src/components/memory/memories.tsx
index c982de0907..4d49df8670 100644
--- a/app/src/components/memory/memories.tsx
+++ b/app/src/components/memory/memories.tsx
@@ -1,6 +1,6 @@
 import { IconPlus, IconRobot, IconUser } from "@tabler/icons-react";
 import { useMutation, useQuery } from "@tanstack/react-query";
-import { Fragment, useId, useState } from "react";
+import { Fragment, type ReactNode, useId, useState } from "react";
 import {
   PageEmpty,
   PageRows,
@@ -127,14 +127,27 @@ export function RememberFact() {
   );
 }
 
-/** Everything the person's Bots remember about them, with who formed each memory. */
-export function MemoryList() {
+/**
+ * Everything the person's Bots remember about them, with who formed each memory. `action` and
+ * `description` belong to the section, since the page heading above it is the whole Plugins screen.
+ */
+export function MemoryList({
+  action,
+  description,
+}: {
+  action?: ReactNode;
+  description?: ReactNode;
+} = {}) {
   const memories = useQuery(memoriesQueryOptions());
   const agents = useQuery(agentListQueryOptions());
   const botName = (id: string | null) =>
     agents.data?.find((agent) => agent.id === id)?.name ?? "your Bot";
   return (
-    <PageSection title="Your memories">
+    <PageSection
+      action={action}
+      description={description}
+      title="Your memories"
+    >
       {memories.isPending ? null : memories.error ? (
         <p role="alert" className="mt-4 text-destructive text-sm">
           {memories.error.message}
diff --git a/app/src/components/plugins/app-access-action.tsx b/app/src/components/plugins/app-access-action.tsx
index df9e2e9d37..2f1dcf4f5a 100644
--- a/app/src/components/plugins/app-access-action.tsx
+++ b/app/src/components/plugins/app-access-action.tsx
@@ -152,12 +152,7 @@ function ConnectAction({ access }: { access: AppAccess }) {
   if (viaSettings)
     return (
       <Button
-        render={
-          <Link
-            params={{ key: access.key }}
-            to="/settings/connected-accounts/$key"
-          />
-        }
+        render={<Link params={{ key: access.key }} to="/connections/$key" />}
         aria-label={`${label} ${access.displayName}`}
         size="sm"
         variant="outline"
diff --git a/app/src/components/responsibilities/new-responsibility-dialog.tsx b/app/src/components/responsibilities/new-responsibility-dialog.tsx
index 757abe0b9c..abd5ea0b2a 100644
--- a/app/src/components/responsibilities/new-responsibility-dialog.tsx
+++ b/app/src/components/responsibilities/new-responsibility-dialog.tsx
@@ -251,7 +251,7 @@ export function NewResponsibilityDialog({
                   {source === "github" && (
                     <FieldDescription>
                       Events come from the repositories you connected in{" "}
-                      <Link to="/settings/connected-accounts">
+                      <Link to="/connections">
                         Settings → Connected accounts
                       </Link>
                       .
diff --git a/app/src/components/settings/github-sources.tsx b/app/src/components/settings/github-sources.tsx
index 39e2b91951..33b9ee578b 100644
--- a/app/src/components/settings/github-sources.tsx
+++ b/app/src/components/settings/github-sources.tsx
@@ -55,7 +55,7 @@ export function GithubSources() {
         </Button>
       }
       description="Register a repository, then add its webhook in GitHub using the address below and the same secret. A responsibility can then start on one of its events, such as issues.opened."
-      title="GitHub events"
+      title="Repositories"
     >
       {error ? (
         <p className="mt-4 text-destructive text-sm" role="alert">
diff --git a/app/src/components/settings/linked-accounts.test.tsx b/app/src/components/settings/linked-accounts.test.tsx
index a81f6f7759..8fd6151dde 100644
--- a/app/src/components/settings/linked-accounts.test.tsx
+++ b/app/src/components/settings/linked-accounts.test.tsx
@@ -347,3 +347,30 @@ test("the GitHub Connect button stays disabled from the request until the page l
     true,
   );
 });
+
+test("one provider's page draws only that provider's link and offer", () => {
+  expect(
+    linkedAccountsSectionState({
+      data: [row, slackRow],
+      error: null,
+      only: "slack",
+      providers: { slack: true, github: true },
+    })?.entries,
+  ).toEqual([{ kind: "linked", account: slackRow }]);
+  expect(
+    linkedAccountsSectionState({
+      data: [slackRow],
+      error: null,
+      only: "github",
+      providers: { slack: true, github: true },
+    })?.entries,
+  ).toEqual([{ kind: "available", provider: "github", title: "GitHub" }]);
+  expect(
+    linkedAccountsSectionState({
+      data: [slackRow],
+      error: null,
+      only: "github",
+      providers: { slack: true, github: false },
+    }),
+  ).toBe(null);
+});
diff --git a/app/src/components/settings/linked-accounts.tsx b/app/src/components/settings/linked-accounts.tsx
index eb94374674..ecf2804ea2 100644
--- a/app/src/components/settings/linked-accounts.tsx
+++ b/app/src/components/settings/linked-accounts.tsx
@@ -1,7 +1,11 @@
 import { IconBrandGithub, IconBrandSlack, IconLink } from "@tabler/icons-react";
 import { useMutation, useQuery } from "@tanstack/react-query";
 import { useEffect, useState } from "react";
-import { PageRows, PageSection } from "@/components/layout/page-shell";
+import {
+  PageEmpty,
+  PageRows,
+  PageSection,
+} from "@/components/layout/page-shell";
 import { Button } from "@/components/ui/button";
 import {
   Dialog,
@@ -63,11 +67,21 @@ const linkableProviders = [
   { provider: "github", title: "GitHub" },
 ] as const;
 
+export type LinkableProvider = (typeof linkableProviders)[number]["provider"];
+
+/** The name a linkable provider is shown under. */
+export function linkableProviderTitle(provider: LinkableProvider): string {
+  return (
+    linkableProviders.find((entry) => entry.provider === provider)?.title ??
+    provider
+  );
+}
+
 export type LinkedAccountsEntry =
   | { kind: "linked"; account: LinkedAccount }
   | {
       kind: "available";
-      provider: (typeof linkableProviders)[number]["provider"];
+      provider: LinkableProvider;
       title: string;
     };
 
@@ -85,11 +99,14 @@ export type LinkedAccountsEntry =
 export function linkedAccountsSectionState({
   data,
   error,
+  only,
   providers,
   providersError = null,
 }: {
   data: LinkedAccount[] | undefined;
   error: Error | null;
+  /** One provider's page draws only that provider's links and offer. */
+  only?: LinkableProvider;
   providers?: IdentityProviders;
   providersError?: Error | null;
 }): {
@@ -100,13 +117,14 @@ export function linkedAccountsSectionState({
   const links = data ?? [];
   const entries: LinkedAccountsEntry[] = [];
   for (const { provider, title } of linkableProviders) {
+    if (only && provider !== only) continue;
     const linked = links.filter((account) => account.provider === provider);
     for (const account of linked) entries.push({ kind: "linked", account });
     if (linked.length === 0 && data !== undefined && providers?.[provider]) {
       entries.push({ kind: "available", provider, title });
     }
   }
-  for (const account of links) {
+  for (const account of only ? [] : links) {
     if (
       !linkableProviders.some(({ provider }) => provider === account.provider)
     )
@@ -139,7 +157,15 @@ export function connectGithubPending(mutation: {
  * Separate from the connector rows above it: those are services a Bot reads as you, these are how
  * this deployment recognises you when a message or an event arrives from somewhere else.
  */
-export function LinkedAccountsSection() {
+/**
+ * The person's own account at one provider, on that provider's Connections page: the link with a
+ * Disconnect button, or Connect where this deployment can link it.
+ */
+export function LinkedAccountSection({
+  provider,
+}: {
+  provider: LinkableProvider;
+}) {
   const links = useQuery(linkedAccountsQueryOptions());
   const providers = useQuery(identityProvidersQueryOptions());
   const issueCode = useMutation(issueSlackCodeMutationOptions());
@@ -169,10 +195,20 @@ export function LinkedAccountsSection() {
   const state = linkedAccountsSectionState({
     data: links.data,
     error: links.error,
+    only: provider,
     providers: providers.data,
     providersError: providers.error,
   });
-  if (!state) return null;
+  if (!state) {
+    return (
+      <PageSection title="Your account">
+        <PageEmpty>
+          This OpenBot cannot link {linkableProviderTitle(provider)} accounts
+          yet. An administrator has to set it up first.
+        </PageEmpty>
+      </PageSection>
+    );
+  }
   const connect = {
     slack: {
       pending: issueCode.isPending,
@@ -188,7 +224,7 @@ export function LinkedAccountsSection() {
     },
   };
   return (
-    <PageSection title="Linked accounts">
+    <PageSection title="Your account">
       {state.entries.length > 0 ? (
         <PageRows>
           {state.entries.map((entry, index) => (
diff --git a/app/src/components/settings/settings-sidebar.tsx b/app/src/components/settings/settings-sidebar.tsx
index 7697968514..a82d6f1e21 100644
--- a/app/src/components/settings/settings-sidebar.tsx
+++ b/app/src/components/settings/settings-sidebar.tsx
@@ -1,11 +1,9 @@
 import {
   IconArrowLeft,
   IconBell,
-  IconBrain,
   IconChecks,
   IconKey,
   IconLayoutGrid,
-  IconPlug,
   IconSettings,
 } from "@tabler/icons-react";
 import { Link, type LinkOptions } from "@tanstack/react-router";
@@ -54,21 +52,6 @@ const ITEMS: {
     icon: IconChecks,
     linkOptions: { to: "/settings/approvals" },
   },
-  {
-    /* What your Bots know about you, across all of them. */
-    title: "Memory",
-    icon: IconBrain,
-    linkOptions: { to: "/settings/memory" },
-  },
-  {
-    /*
-     * The same subject as Admin's Plugins, from the other side: there an administrator decides what
-     * this deployment may reach at all, here you decide what it may reach as you.
-     */
-    title: "Connected accounts",
-    icon: IconPlug,
-    linkOptions: { to: "/settings/connected-accounts" },
-  },
   {
     /* Logins saved from a Bot's private sign-in form. */
     title: "Passwords",
diff --git a/app/src/components/settings/team-bot-consents.tsx b/app/src/components/settings/team-bot-consents.tsx
new file mode 100644
index 0000000000..7fa6e16b07
--- /dev/null
+++ b/app/src/components/settings/team-bot-consents.tsx
@@ -0,0 +1,56 @@
+import { useMutation } from "@tanstack/react-query";
+import { PageRows, PageSection } from "@/components/layout/page-shell";
+import { Button } from "@/components/ui/button";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { clearTeamBotConsentsMutationOptions } from "@/lib/team-bots";
+
+/**
+ * A Bot someone shared with you uses its owner's connected apps unless you let it use yours on the
+ * card it shows you. This forgets every one of those answers, so each such Bot asks again.
+ *
+ * On Approvals rather than Connections because it is an answer to "may this Bot use my apps",
+ * which is the question every other row on Approvals answers, not a connection of its own.
+ */
+export function TeamBotConsents() {
+  const clear = useMutation(clearTeamBotConsentsMutationOptions());
+  return (
+    <PageSection
+      description="A Bot someone shared with you uses their connected apps. It uses yours only where you allowed it, on the card it showed you in a conversation."
+      title="Shared Bots"
+    >
+      {clear.error ? (
+        <p className="mt-4 text-destructive text-sm" role="alert">
+          {clear.error.message}
+        </p>
+      ) : null}
+      <PageRows>
+        <Item size="sm">
+          <ItemContent>
+            <ItemTitle>Apps you let shared Bots use</ItemTitle>
+            <ItemDescription>
+              {clear.isSuccess
+                ? "Reset. Each shared Bot will ask again."
+                : "Forget every answer, so each shared Bot asks again."}
+            </ItemDescription>
+          </ItemContent>
+          <ItemActions>
+            <Button
+              disabled={clear.isPending}
+              onClick={() => clear.mutate()}
+              size="sm"
+              variant="outline"
+            >
+              Reset
+            </Button>
+          </ItemActions>
+        </Item>
+      </PageRows>
+    </PageSection>
+  );
+}
diff --git a/app/src/components/skills/edit-skill.tsx b/app/src/components/skills/edit-skill.tsx
index 254a382f08..7d20243188 100644
--- a/app/src/components/skills/edit-skill.tsx
+++ b/app/src/components/skills/edit-skill.tsx
@@ -89,7 +89,7 @@ export function EditSkill({ slug }: { slug: string }) {
         footer={<SkillAgents grantedTo={skill.grantedTo} slug={skill.slug} />}
         onSubmit={async (values) => {
           await saveSkill.mutateAsync(values);
-          await navigate({ search: {}, to: "/skills" });
+          await navigate({ search: {}, to: "/capabilities/skills" });
         }}
         slugLocked
         submitLabel="Save changes"
diff --git a/app/src/components/skills/new-skill.tsx b/app/src/components/skills/new-skill.tsx
index 8e7fc42d22..48b8ca9090 100644
--- a/app/src/components/skills/new-skill.tsx
+++ b/app/src/components/skills/new-skill.tsx
@@ -33,7 +33,7 @@ export function NewSkill() {
           await createSkill.mutateAsync(values);
           // Panel closed rather than swapped for a detail view: there is nothing more to say about a
           // skill than the form just said, and the new row is already behind it in the list.
-          await navigate({ search: {}, to: "/skills" });
+          await navigate({ search: {}, to: "/capabilities/skills" });
         }}
         submitLabel="Save skill"
       />
diff --git a/app/src/components/skills/proposed-skill.tsx b/app/src/components/skills/proposed-skill.tsx
index 6c0fab6a67..1f914f15ee 100644
--- a/app/src/components/skills/proposed-skill.tsx
+++ b/app/src/components/skills/proposed-skill.tsx
@@ -195,7 +195,7 @@ function PutItOnABot({ slug }: { slug: string }) {
     <Link
       className="mt-2 inline-block text-sm underline underline-offset-4"
       search={{ edit: slug }}
-      to="/skills"
+      to="/capabilities/skills"
     >
       Put it on a Bot
     </Link>
diff --git a/app/src/lib/agents/legacy-routes.ts b/app/src/lib/agents/legacy-routes.ts
index c23528368d..96b5aaf1f8 100644
--- a/app/src/lib/agents/legacy-routes.ts
+++ b/app/src/lib/agents/legacy-routes.ts
@@ -24,7 +24,7 @@ export function legacyAgentsTarget(search: { new?: boolean; agent?: string }) {
  */
 export const LEGACY_PAGES = {
   "/approvals": "/settings/approvals",
-  "/memory": "/settings/memory",
+  "/memory": "/capabilities/memory",
   "/reachability": "/settings/notifications",
   "/responsibilities": "/bots",
   // A group is started from the new-conversation screen by putting two or more Bots in To:.
diff --git a/app/src/lib/connections/rows.ts b/app/src/lib/connections/rows.ts
new file mode 100644
index 0000000000..6e22ac303b
--- /dev/null
+++ b/app/src/lib/connections/rows.ts
@@ -0,0 +1,137 @@
+import type { IdentityProviders, LinkedAccount } from "@/lib/identity/queries";
+import { brokeredProvenance } from "@/lib/plugins/provider-vocabulary";
+import type { CatalogueItem, PluginServer } from "@/lib/plugins/queries";
+
+/**
+ * Every row on Connections, in one list.
+ *
+ * WHY ONE LIST. The page used to stack five sections — your apps, apps shared by your organisation,
+ * linked accounts, GitHub events and a reset for shared Bots — and a person had to know which kind
+ * of thing they were looking for before they could find it. From where they stand each of these is
+ * the same thing: a service, connected or not. So each is a row, and what is particular to one —
+ * GitHub's repositories, Slack's link code, a key app's fields — is on that row's own page.
+ */
+export type ConnectionState =
+  /** The person's own account is connected. */
+  | "connected"
+  /** It was connected and the provider no longer accepts it. */
+  | "needs_reconnect"
+  /** The organisation's account: nothing for the person to connect. */
+  | "team"
+  /** Not connected yet. */
+  | "available";
+
+export type ConnectionRow = {
+  /** Where the row's page is: `/connections/$key`. */
+  key: string;
+  title: string;
+  summary: string;
+  state: ConnectionState;
+  /** What draws the row's mark: a catalogue icon, an app's logo, or an identity provider's icon. */
+  mark:
+    | { kind: "catalogue"; key: string }
+    | { kind: "logo"; logo: string | null | undefined }
+    | { kind: "provider"; provider: "github" | "slack" };
+};
+
+/**
+ * Whether a server is a broker's GitHub app, whichever broker enabled it: the app GitHub's own page
+ * links to instead of listing it twice.
+ *
+ * A brokered row's id is its broker's prefix and the app's slug, and the prefix is the provenance it
+ * was minted under (`composio-github`, `arcade-github`), so this asks the row and names no vendor.
+ */
+export function isBrokeredGithub(
+  server: Pick<PluginServer, "id" | "provenance">,
+): boolean {
+  return (
+    brokeredProvenance(server.provenance) &&
+    server.id === `${server.provenance}-github`
+  );
+}
+
+export const IDENTITY_SUMMARIES = {
+  github:
+    "Lets OpenBot recognise you on GitHub, so a repository's events can start your Bots' work.",
+  slack: "Lets OpenBot recognise you when you message it from Slack.",
+} as const;
+
+const IDENTITY_TITLES = { github: "GitHub", slack: "Slack" } as const;
+
+export function connectionRows(input: {
+  /** Catalogue apps a person connects for themselves, already narrowed to the enabled ones. */
+  catalogue: CatalogueItem[];
+  /** Brokered apps a person connects for themselves. */
+  brokered: PluginServer[];
+  /** Brokered apps that run on the organisation's account. */
+  shared: PluginServer[];
+  /** Server ids the person holds a connection for. */
+  connected: ReadonlySet<string>;
+  links: LinkedAccount[];
+  providers: IdentityProviders | undefined;
+}): ConnectionRow[] {
+  const identity = (["github", "slack"] as const).flatMap(
+    (provider): ConnectionRow[] => {
+      const link = input.links.find((entry) => entry.provider === provider);
+      if (!link && !input.providers?.[provider]) return [];
+      return [
+        {
+          key: provider,
+          title: IDENTITY_TITLES[provider],
+          summary: link?.handle
+            ? `@${link.handle}`
+            : IDENTITY_SUMMARIES[provider],
+          state: !link
+            ? "available"
+            : link.status === "needs_reconnect"
+              ? "needs_reconnect"
+              : "connected",
+          mark: { kind: "provider", provider },
+        },
+      ];
+    },
+  );
+  /*
+   * ONE GITHUB ROW. With the GitHub link on offer, a brokered GitHub app would be a second row of the
+   * same name; GitHub's page links to it instead, so the list names the vendor once.
+   */
+  const githubListed = identity.some((row) => row.key === "github");
+  const rows: ConnectionRow[] = [
+    ...input.catalogue.map(
+      (entry): ConnectionRow => ({
+        key: entry.key,
+        title: entry.title,
+        summary: entry.summary,
+        state: input.connected.has(entry.key) ? "connected" : "available",
+        mark: { kind: "catalogue", key: entry.key },
+      }),
+    ),
+    ...input.brokered
+      .filter((server) => !(githubListed && isBrokeredGithub(server)))
+      .map(
+        (server): ConnectionRow => ({
+          key: server.id,
+          title: server.title,
+          summary: server.summary || `Connect your ${server.title} account.`,
+          state: input.connected.has(server.id) ? "connected" : "available",
+          mark: { kind: "logo", logo: server.logo },
+        }),
+      ),
+    ...input.shared.map(
+      (server): ConnectionRow => ({
+        key: server.id,
+        title: server.title,
+        summary: "Your organisation's account. Bots act as the team here.",
+        state: "team",
+        mark: { kind: "logo", logo: server.logo },
+      }),
+    ),
+    ...identity,
+  ];
+  /*
+   * What is already in use first, so the list opens on what a person has rather than on everything
+   * they could add. Stable within each half: the order above, which keeps apps before accounts.
+   */
+  const inUse = (row: ConnectionRow) => row.state !== "available";
+  return [...rows.filter(inUse), ...rows.filter((row) => !inUse(row))];
+}
diff --git a/app/src/lib/plugins/provider-vocabulary.ts b/app/src/lib/plugins/provider-vocabulary.ts
index f5c3405333..9a0e2a9147 100644
--- a/app/src/lib/plugins/provider-vocabulary.ts
+++ b/app/src/lib/plugins/provider-vocabulary.ts
@@ -171,7 +171,7 @@ export function brokeredConsentTrip(provider: PluginsProvider): string {
  * that is not there.
  *
  * `where` IS NOT DECORATION AND HAS NO DEFAULT. The two screens that draw this row do not both
- * draw the action list: the settings screen has it directly underneath, and the admin setup page
+ * draw the action list: the Connections page has it directly underneath, and the admin setup page
  * has none at all, so a single sentence saying "below" is a true direction on one screen and a
  * wrong one on the other — pointing somebody at a list that is not on their page is the same
  * failure as the Connect button this sentence replaces, one step further on. Each caller says
@@ -184,7 +184,7 @@ export function brokeredPerActionTrip(
   const stem = `${VOCABULARY[provider].name} approves one action at a time, so there is nothing to connect for the whole app.`;
   return where === "below"
     ? `${stem} Authorize the actions you want below.`
-    : `${stem} Authorize them from Connected accounts in Settings.`;
+    : `${stem} Authorize them from Connections.`;
 }
 
 /** What a person is told where the deployment has no key for the active broker. */
diff --git a/app/src/routeTree.gen.ts b/app/src/routeTree.gen.ts
index e4b110fc93..6aff6bc45f 100644
--- a/app/src/routeTree.gen.ts
+++ b/app/src/routeTree.gen.ts
@@ -18,6 +18,7 @@ import { Route as AuthedSettingsRouteRouteImport } from './routes/_authed/settin
 import { Route as AuthedAppIndexRouteImport } from './routes/_authed/_app/index'
 import { Route as AuthedAppApprovalsRouteImport } from './routes/_authed/_app/approvals'
 import { Route as AuthedAppBotRouteImport } from './routes/_authed/_app/bot'
+import { Route as AuthedAppCapabilitiesRouteImport } from './routes/_authed/_app/capabilities'
 import { Route as AuthedAppMemoryRouteImport } from './routes/_authed/_app/memory'
 import { Route as AuthedAppReachabilityRouteImport } from './routes/_authed/_app/reachability'
 import { Route as AuthedAppResponsibilitiesRouteImport } from './routes/_authed/_app/responsibilities'
@@ -44,8 +45,13 @@ import { Route as AuthedSettingsPasswordsRouteImport } from './routes/_authed/se
 import { Route as AuthedSignInRequestIdRouteImport } from './routes/_authed/sign-in/$requestId'
 import { Route as AuthedAppAgentsIndexRouteImport } from './routes/_authed/_app/agents/index'
 import { Route as AuthedAppBotsIndexRouteImport } from './routes/_authed/_app/bots.index'
+import { Route as AuthedAppCapabilitiesIndexRouteImport } from './routes/_authed/_app/capabilities.index'
+import { Route as AuthedAppCapabilitiesMemoryRouteImport } from './routes/_authed/_app/capabilities.memory'
+import { Route as AuthedAppCapabilitiesSkillsRouteImport } from './routes/_authed/_app/capabilities.skills'
 import { Route as AuthedAppChannelChannelIdRouteImport } from './routes/_authed/_app/channel/$channelId'
 import { Route as AuthedAppChannelNewRouteImport } from './routes/_authed/_app/channel/new'
+import { Route as AuthedAppConnectionsIndexRouteImport } from './routes/_authed/_app/connections.index'
+import { Route as AuthedAppConnectionsKeyRouteImport } from './routes/_authed/_app/connections.$key'
 import { Route as AuthedAppGroupChannelIdRouteImport } from './routes/_authed/_app/group/$channelId'
 import { Route as AuthedAppGroupNewRouteImport } from './routes/_authed/_app/group/new'
 import { Route as AuthedAdminComponentsIndexRouteImport } from './routes/_authed/admin/components/index'
@@ -113,6 +119,11 @@ const AuthedAppBotRoute = AuthedAppBotRouteImport.update({
   path: '/bot',
   getParentRoute: () => AuthedAppRoute,
 } as any)
+const AuthedAppCapabilitiesRoute = AuthedAppCapabilitiesRouteImport.update({
+  id: '/capabilities',
+  path: '/capabilities',
+  getParentRoute: () => AuthedAppRoute,
+} as any)
 const AuthedAppMemoryRoute = AuthedAppMemoryRouteImport.update({
   id: '/memory',
   path: '/memory',
@@ -246,6 +257,24 @@ const AuthedAppBotsIndexRoute = AuthedAppBotsIndexRouteImport.update({
   path: '/bots/',
   getParentRoute: () => AuthedAppRoute,
 } as any)
+const AuthedAppCapabilitiesIndexRoute =
+  AuthedAppCapabilitiesIndexRouteImport.update({
+    id: '/',
+    path: '/',
+    getParentRoute: () => AuthedAppCapabilitiesRoute,
+  } as any)
+const AuthedAppCapabilitiesMemoryRoute =
+  AuthedAppCapabilitiesMemoryRouteImport.update({
+    id: '/memory',
+    path: '/memory',
+    getParentRoute: () => AuthedAppCapabilitiesRoute,
+  } as any)
+const AuthedAppCapabilitiesSkillsRoute =
+  AuthedAppCapabilitiesSkillsRouteImport.update({
+    id: '/skills',
+    path: '/skills',
+    getParentRoute: () => AuthedAppCapabilitiesRoute,
+  } as any)
 const AuthedAppChannelChannelIdRoute =
   AuthedAppChannelChannelIdRouteImport.update({
     id: '/channel/$channelId',
@@ -257,6 +286,17 @@ const AuthedAppChannelNewRoute = AuthedAppChannelNewRouteImport.update({
   path: '/channel/new',
   getParentRoute: () => AuthedAppRoute,
 } as any)
+const AuthedAppConnectionsIndexRoute =
+  AuthedAppConnectionsIndexRouteImport.update({
+    id: '/connections/',
+    path: '/connections/',
+    getParentRoute: () => AuthedAppRoute,
+  } as any)
+const AuthedAppConnectionsKeyRoute = AuthedAppConnectionsKeyRouteImport.update({
+  id: '/connections/$key',
+  path: '/connections/$key',
+  getParentRoute: () => AuthedAppRoute,
+} as any)
 const AuthedAppGroupChannelIdRoute = AuthedAppGroupChannelIdRouteImport.update({
   id: '/group/$channelId',
   path: '/group/$channelId',
@@ -400,6 +440,7 @@ export interface FileRoutesByFullPath {
   '/onboarding': typeof AuthedOnboardingRoute
   '/approvals': typeof AuthedAppApprovalsRoute
   '/bot': typeof AuthedAppBotRoute
+  '/capabilities': typeof AuthedAppCapabilitiesRouteWithChildren
   '/memory': typeof AuthedAppMemoryRoute
   '/reachability': typeof AuthedAppReachabilityRoute
   '/responsibilities': typeof AuthedAppResponsibilitiesRoute
@@ -424,8 +465,11 @@ export interface FileRoutesByFullPath {
   '/sign-in/$requestId': typeof AuthedSignInRequestIdRoute
   '/admin/': typeof AuthedAdminIndexRoute
   '/settings/': typeof AuthedSettingsIndexRoute
+  '/capabilities/memory': typeof AuthedAppCapabilitiesMemoryRoute
+  '/capabilities/skills': typeof AuthedAppCapabilitiesSkillsRoute
   '/channel/$channelId': typeof AuthedAppChannelChannelIdRoute
   '/channel/new': typeof AuthedAppChannelNewRoute
+  '/connections/$key': typeof AuthedAppConnectionsKeyRoute
   '/group/$channelId': typeof AuthedAppGroupChannelIdRoute
   '/group/new': typeof AuthedAppGroupNewRoute
   '/admin/components/$name': typeof AuthedAdminComponentsNameRoute
@@ -436,6 +480,8 @@ export interface FileRoutesByFullPath {
   '/settings/connected-accounts/$key': typeof AuthedSettingsConnectedAccountsKeyRoute
   '/agents/': typeof AuthedAppAgentsIndexRoute
   '/bots/': typeof AuthedAppBotsIndexRoute
+  '/capabilities/': typeof AuthedAppCapabilitiesIndexRoute
+  '/connections/': typeof AuthedAppConnectionsIndexRoute
   '/admin/components/': typeof AuthedAdminComponentsIndexRoute
   '/admin/plugins/': typeof AuthedAdminPluginsIndexRoute
   '/settings/components-gallery/': typeof AuthedSettingsComponentsGalleryIndexRoute
@@ -482,8 +528,11 @@ export interface FileRoutesByTo {
   '/sign-in/$requestId': typeof AuthedSignInRequestIdRoute
   '/admin': typeof AuthedAdminIndexRoute
   '/settings': typeof AuthedSettingsIndexRoute
+  '/capabilities/memory': typeof AuthedAppCapabilitiesMemoryRoute
+  '/capabilities/skills': typeof AuthedAppCapabilitiesSkillsRoute
   '/channel/$channelId': typeof AuthedAppChannelChannelIdRoute
   '/channel/new': typeof AuthedAppChannelNewRoute
+  '/connections/$key': typeof AuthedAppConnectionsKeyRoute
   '/group/$channelId': typeof AuthedAppGroupChannelIdRoute
   '/group/new': typeof AuthedAppGroupNewRoute
   '/admin/components/$name': typeof AuthedAdminComponentsNameRoute
@@ -494,6 +543,8 @@ export interface FileRoutesByTo {
   '/settings/connected-accounts/$key': typeof AuthedSettingsConnectedAccountsKeyRoute
   '/agents': typeof AuthedAppAgentsIndexRoute
   '/bots': typeof AuthedAppBotsIndexRoute
+  '/capabilities': typeof AuthedAppCapabilitiesIndexRoute
+  '/connections': typeof AuthedAppConnectionsIndexRoute
   '/admin/components': typeof AuthedAdminComponentsIndexRoute
   '/admin/plugins': typeof AuthedAdminPluginsIndexRoute
   '/settings/components-gallery': typeof AuthedSettingsComponentsGalleryIndexRoute
@@ -520,6 +571,7 @@ export interface FileRoutesById {
   '/_authed/onboarding': typeof AuthedOnboardingRoute
   '/_authed/_app/approvals': typeof AuthedAppApprovalsRoute
   '/_authed/_app/bot': typeof AuthedAppBotRoute
+  '/_authed/_app/capabilities': typeof AuthedAppCapabilitiesRouteWithChildren
   '/_authed/_app/memory': typeof AuthedAppMemoryRoute
   '/_authed/_app/reachability': typeof AuthedAppReachabilityRoute
   '/_authed/_app/responsibilities': typeof AuthedAppResponsibilitiesRoute
@@ -545,8 +597,11 @@ export interface FileRoutesById {
   '/_authed/_app/': typeof AuthedAppIndexRoute
   '/_authed/admin/': typeof AuthedAdminIndexRoute
   '/_authed/settings/': typeof AuthedSettingsIndexRoute
+  '/_authed/_app/capabilities/memory': typeof AuthedAppCapabilitiesMemoryRoute
+  '/_authed/_app/capabilities/skills': typeof AuthedAppCapabilitiesSkillsRoute
   '/_authed/_app/channel/$channelId': typeof AuthedAppChannelChannelIdRoute
   '/_authed/_app/channel/new': typeof AuthedAppChannelNewRoute
+  '/_authed/_app/connections/$key': typeof AuthedAppConnectionsKeyRoute
   '/_authed/_app/group/$channelId': typeof AuthedAppGroupChannelIdRoute
   '/_authed/_app/group/new': typeof AuthedAppGroupNewRoute
   '/_authed/admin/components/$name': typeof AuthedAdminComponentsNameRoute
@@ -557,6 +612,8 @@ export interface FileRoutesById {
   '/_authed/settings/connected-accounts/$key': typeof AuthedSettingsConnectedAccountsKeyRoute
   '/_authed/_app/agents/': typeof AuthedAppAgentsIndexRoute
   '/_authed/_app/bots/': typeof AuthedAppBotsIndexRoute
+  '/_authed/_app/capabilities/': typeof AuthedAppCapabilitiesIndexRoute
+  '/_authed/_app/connections/': typeof AuthedAppConnectionsIndexRoute
   '/_authed/admin/components/': typeof AuthedAdminComponentsIndexRoute
   '/_authed/admin/plugins/': typeof AuthedAdminPluginsIndexRoute
   '/_authed/settings/components-gallery/': typeof AuthedSettingsComponentsGalleryIndexRoute
@@ -583,6 +640,7 @@ export interface FileRouteTypes {
     | '/onboarding'
     | '/approvals'
     | '/bot'
+    | '/capabilities'
     | '/memory'
     | '/reachability'
     | '/responsibilities'
@@ -607,8 +665,11 @@ export interface FileRouteTypes {
     | '/sign-in/$requestId'
     | '/admin/'
     | '/settings/'
+    | '/capabilities/memory'
+    | '/capabilities/skills'
     | '/channel/$channelId'
     | '/channel/new'
+    | '/connections/$key'
     | '/group/$channelId'
     | '/group/new'
     | '/admin/components/$name'
@@ -619,6 +680,8 @@ export interface FileRouteTypes {
     | '/settings/connected-accounts/$key'
     | '/agents/'
     | '/bots/'
+    | '/capabilities/'
+    | '/connections/'
     | '/admin/components/'
     | '/admin/plugins/'
     | '/settings/components-gallery/'
@@ -665,8 +728,11 @@ export interface FileRouteTypes {
     | '/sign-in/$requestId'
     | '/admin'
     | '/settings'
+    | '/capabilities/memory'
+    | '/capabilities/skills'
     | '/channel/$channelId'
     | '/channel/new'
+    | '/connections/$key'
     | '/group/$channelId'
     | '/group/new'
     | '/admin/components/$name'
@@ -677,6 +743,8 @@ export interface FileRouteTypes {
     | '/settings/connected-accounts/$key'
     | '/agents'
     | '/bots'
+    | '/capabilities'
+    | '/connections'
     | '/admin/components'
     | '/admin/plugins'
     | '/settings/components-gallery'
@@ -702,6 +770,7 @@ export interface FileRouteTypes {
     | '/_authed/onboarding'
     | '/_authed/_app/approvals'
     | '/_authed/_app/bot'
+    | '/_authed/_app/capabilities'
     | '/_authed/_app/memory'
     | '/_authed/_app/reachability'
     | '/_authed/_app/responsibilities'
@@ -727,8 +796,11 @@ export interface FileRouteTypes {
     | '/_authed/_app/'
     | '/_authed/admin/'
     | '/_authed/settings/'
+    | '/_authed/_app/capabilities/memory'
+    | '/_authed/_app/capabilities/skills'
     | '/_authed/_app/channel/$channelId'
     | '/_authed/_app/channel/new'
+    | '/_authed/_app/connections/$key'
     | '/_authed/_app/group/$channelId'
     | '/_authed/_app/group/new'
     | '/_authed/admin/components/$name'
@@ -739,6 +811,8 @@ export interface FileRouteTypes {
     | '/_authed/settings/connected-accounts/$key'
     | '/_authed/_app/agents/'
     | '/_authed/_app/bots/'
+    | '/_authed/_app/capabilities/'
+    | '/_authed/_app/connections/'
     | '/_authed/admin/components/'
     | '/_authed/admin/plugins/'
     | '/_authed/settings/components-gallery/'
@@ -826,6 +900,13 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthedAppBotRouteImport
       parentRoute: typeof AuthedAppRoute
     }
+    '/_authed/_app/capabilities': {
+      id: '/_authed/_app/capabilities'
+      path: '/capabilities'
+      fullPath: '/capabilities'
+      preLoaderRoute: typeof AuthedAppCapabilitiesRouteImport
+      parentRoute: typeof AuthedAppRoute
+    }
     '/_authed/_app/memory': {
       id: '/_authed/_app/memory'
       path: '/memory'
@@ -1008,6 +1089,27 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthedAppBotsIndexRouteImport
       parentRoute: typeof AuthedAppRoute
     }
+    '/_authed/_app/capabilities/': {
+      id: '/_authed/_app/capabilities/'
+      path: '/'
+      fullPath: '/capabilities/'
+      preLoaderRoute: typeof AuthedAppCapabilitiesIndexRouteImport
+      parentRoute: typeof AuthedAppCapabilitiesRoute
+    }
+    '/_authed/_app/capabilities/memory': {
+      id: '/_authed/_app/capabilities/memory'
+      path: '/memory'
+      fullPath: '/capabilities/memory'
+      preLoaderRoute: typeof AuthedAppCapabilitiesMemoryRouteImport
+      parentRoute: typeof AuthedAppCapabilitiesRoute
+    }
+    '/_authed/_app/capabilities/skills': {
+      id: '/_authed/_app/capabilities/skills'
+      path: '/skills'
+      fullPath: '/capabilities/skills'
+      preLoaderRoute: typeof AuthedAppCapabilitiesSkillsRouteImport
+      parentRoute: typeof AuthedAppCapabilitiesRoute
+    }
     '/_authed/_app/channel/$channelId': {
       id: '/_authed/_app/channel/$channelId'
       path: '/channel/$channelId'
@@ -1022,6 +1124,20 @@ declare module '@tanstack/react-router' {
       preLoaderRoute: typeof AuthedAppChannelNewRouteImport
       parentRoute: typeof AuthedAppRoute
     }
+    '/_authed/_app/connections/': {
+      id: '/_authed/_app/connections/'
+      path: '/connections'
+      fullPath: '/connections/'
+      preLoaderRoute: typeof AuthedAppConnectionsIndexRouteImport
+      parentRoute: typeof AuthedAppRoute
+    }
+    '/_authed/_app/connections/$key': {
+      id: '/_authed/_app/connections/$key'
+      path: '/connections/$key'
+      fullPath: '/connections/$key'
+      preLoaderRoute: typeof AuthedAppConnectionsKeyRouteImport
+      parentRoute: typeof AuthedAppRoute
+    }
     '/_authed/_app/group/$channelId': {
       id: '/_authed/_app/group/$channelId'
       path: '/group/$channelId'
@@ -1266,9 +1382,27 @@ const AuthedSettingsRouteRouteChildren: AuthedSettingsRouteRouteChildren = {
 const AuthedSettingsRouteRouteWithChildren =
   AuthedSettingsRouteRoute._addFileChildren(AuthedSettingsRouteRouteChildren)
 
+interface AuthedAppCapabilitiesRouteChildren {
+  AuthedAppCapabilitiesMemoryRoute: typeof AuthedAppCapabilitiesMemoryRoute
+  AuthedAppCapabilitiesSkillsRoute: typeof AuthedAppCapabilitiesSkillsRoute
+  AuthedAppCapabilitiesIndexRoute: typeof AuthedAppCapabilitiesIndexRoute
+}
+
+const AuthedAppCapabilitiesRouteChildren: AuthedAppCapabilitiesRouteChildren = {
+  AuthedAppCapabilitiesMemoryRoute: AuthedAppCapabilitiesMemoryRoute,
+  AuthedAppCapabilitiesSkillsRoute: AuthedAppCapabilitiesSkillsRoute,
+  AuthedAppCapabilitiesIndexRoute: AuthedAppCapabilitiesIndexRoute,
+}
+
+const AuthedAppCapabilitiesRouteWithChildren =
+  AuthedAppCapabilitiesRoute._addFileChildren(
+    AuthedAppCapabilitiesRouteChildren,
+  )
+
 interface AuthedAppRouteChildren {
   AuthedAppApprovalsRoute: typeof AuthedAppApprovalsRoute
   AuthedAppBotRoute: typeof AuthedAppBotRoute
+  AuthedAppCapabilitiesRoute: typeof AuthedAppCapabilitiesRouteWithChildren
   AuthedAppMemoryRoute: typeof AuthedAppMemoryRoute
   AuthedAppReachabilityRoute: typeof AuthedAppReachabilityRoute
   AuthedAppResponsibilitiesRoute: typeof AuthedAppResponsibilitiesRoute
@@ -1278,10 +1412,12 @@ interface AuthedAppRouteChildren {
   AuthedAppIndexRoute: typeof AuthedAppIndexRoute
   AuthedAppChannelChannelIdRoute: typeof AuthedAppChannelChannelIdRoute
   AuthedAppChannelNewRoute: typeof AuthedAppChannelNewRoute
+  AuthedAppConnectionsKeyRoute: typeof AuthedAppConnectionsKeyRoute
   AuthedAppGroupChannelIdRoute: typeof AuthedAppGroupChannelIdRoute
   AuthedAppGroupNewRoute: typeof AuthedAppGroupNewRoute
   AuthedAppAgentsIndexRoute: typeof AuthedAppAgentsIndexRoute
   AuthedAppBotsIndexRoute: typeof AuthedAppBotsIndexRoute
+  AuthedAppConnectionsIndexRoute: typeof AuthedAppConnectionsIndexRoute
   AuthedAppBotsAgentIdAccessRoute: typeof AuthedAppBotsAgentIdAccessRoute
   AuthedAppBotsAgentIdApprovalsRoute: typeof AuthedAppBotsAgentIdApprovalsRoute
   AuthedAppBotsAgentIdMemoryRoute: typeof AuthedAppBotsAgentIdMemoryRoute
@@ -1296,6 +1432,7 @@ interface AuthedAppRouteChildren {
 const AuthedAppRouteChildren: AuthedAppRouteChildren = {
   AuthedAppApprovalsRoute: AuthedAppApprovalsRoute,
   AuthedAppBotRoute: AuthedAppBotRoute,
+  AuthedAppCapabilitiesRoute: AuthedAppCapabilitiesRouteWithChildren,
   AuthedAppMemoryRoute: AuthedAppMemoryRoute,
   AuthedAppReachabilityRoute: AuthedAppReachabilityRoute,
   AuthedAppResponsibilitiesRoute: AuthedAppResponsibilitiesRoute,
@@ -1305,10 +1442,12 @@ const AuthedAppRouteChildren: AuthedAppRouteChildren = {
   AuthedAppIndexRoute: AuthedAppIndexRoute,
   AuthedAppChannelChannelIdRoute: AuthedAppChannelChannelIdRoute,
   AuthedAppChannelNewRoute: AuthedAppChannelNewRoute,
+  AuthedAppConnectionsKeyRoute: AuthedAppConnectionsKeyRoute,
   AuthedAppGroupChannelIdRoute: AuthedAppGroupChannelIdRoute,
   AuthedAppGroupNewRoute: AuthedAppGroupNewRoute,
   AuthedAppAgentsIndexRoute: AuthedAppAgentsIndexRoute,
   AuthedAppBotsIndexRoute: AuthedAppBotsIndexRoute,
+  AuthedAppConnectionsIndexRoute: AuthedAppConnectionsIndexRoute,
   AuthedAppBotsAgentIdAccessRoute: AuthedAppBotsAgentIdAccessRoute,
   AuthedAppBotsAgentIdApprovalsRoute: AuthedAppBotsAgentIdApprovalsRoute,
   AuthedAppBotsAgentIdMemoryRoute: AuthedAppBotsAgentIdMemoryRoute,
diff --git a/app/src/routes/_authed/_app/bots.$agentId.memory.tsx b/app/src/routes/_authed/_app/bots.$agentId.memory.tsx
index f1446edd32..cb38b83238 100644
--- a/app/src/routes/_authed/_app/bots.$agentId.memory.tsx
+++ b/app/src/routes/_authed/_app/bots.$agentId.memory.tsx
@@ -21,7 +21,7 @@ function MemoryPage() {
             What your Bots remember about you is in{" "}
             <Link
               className="underline underline-offset-4"
-              to="/settings/memory"
+              to="/capabilities/memory"
             >
               Settings → Memory
             </Link>
diff --git a/app/src/routes/_authed/_app/capabilities.index.tsx b/app/src/routes/_authed/_app/capabilities.index.tsx
new file mode 100644
index 0000000000..fe2b9fc9c4
--- /dev/null
+++ b/app/src/routes/_authed/_app/capabilities.index.tsx
@@ -0,0 +1,8 @@
+import { createFileRoute, redirect } from "@tanstack/react-router";
+
+/** `/capabilities` on its own opens the first tab, Skills. */
+export const Route = createFileRoute("/_authed/_app/capabilities/")({
+  beforeLoad: () => {
+    throw redirect({ to: "/capabilities/skills", replace: true });
+  },
+});
diff --git a/app/src/routes/_authed/_app/capabilities.memory.tsx b/app/src/routes/_authed/_app/capabilities.memory.tsx
new file mode 100644
index 0000000000..37647af15c
--- /dev/null
+++ b/app/src/routes/_authed/_app/capabilities.memory.tsx
@@ -0,0 +1,18 @@
+import { createFileRoute } from "@tanstack/react-router";
+import { CapabilitiesShell } from "@/components/capabilities/capabilities-shell";
+import { MemoryList, RememberFact } from "@/components/memory/memories";
+
+export const Route = createFileRoute("/_authed/_app/capabilities/memory")({
+  component: MemoryPage,
+});
+
+function MemoryPage() {
+  return (
+    <CapabilitiesShell>
+      <MemoryList
+        action={<RememberFact />}
+        description="What your Bots know about you. Facts you tell them reach every Bot; what a Bot learns stays with that Bot."
+      />
+    </CapabilitiesShell>
+  );
+}
diff --git a/app/src/routes/_authed/_app/capabilities.skills.tsx b/app/src/routes/_authed/_app/capabilities.skills.tsx
new file mode 100644
index 0000000000..321122fd08
--- /dev/null
+++ b/app/src/routes/_authed/_app/capabilities.skills.tsx
@@ -0,0 +1,350 @@
+import { IconDots, IconPlus } from "@tabler/icons-react";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { createFileRoute, Link } from "@tanstack/react-router";
+import { useState } from "react";
+import { z } from "zod";
+import { CapabilitiesShell } from "@/components/capabilities/capabilities-shell";
+import { DetailPanel } from "@/components/layout/detail-panel";
+import { PageRows, PageSection } from "@/components/layout/page-shell";
+import { StaggerItem } from "@/components/layout/stagger";
+import { EditSkill } from "@/components/skills/edit-skill";
+import { NewSkill } from "@/components/skills/new-skill";
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuGroup,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import { Empty, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { Separator } from "@/components/ui/separator";
+import { currentUserQueryOptions } from "@/lib/auth/queries";
+import { removeSkillMutationOptions } from "@/lib/plugins/mutations";
+import { pluginsPageQueryOptions } from "@/lib/plugins/queries";
+
+/**
+ * Personal `/` skills. They are instructions, not capabilities, and can only be granted to Bots the
+ * signed-in user owns.
+ */
+
+/**
+ * Writing a skill is a search parameter rather than a route, so the list stays on screen behind the
+ * panel and the form is linkable, reloadable, and closed by Back — the same contract the agents
+ * roster makes.
+ */
+const skillsSearchSchema = z.object({
+  new: z.boolean().optional(),
+  /** The slug being edited. Absent means nothing is. */
+  edit: z.string().optional(),
+});
+
+export const Route = createFileRoute("/_authed/_app/capabilities/skills")({
+  validateSearch: skillsSearchSchema,
+  component: SkillsPage,
+});
+
+function SkillsPage() {
+  const queryClient = useQueryClient();
+  const { new: isCreating, edit: editingSlug } = Route.useSearch();
+  const navigate = Route.useNavigate();
+  // Creating wins if both are somehow set: it is the more recent intent, the same rule the agents
+  // roster uses when `new` and `agent` arrive together.
+  const showCreate = isCreating === true;
+  const showEdit = !showCreate && editingSlug !== undefined;
+  const { data, isPending: skillsPending } = useQuery(
+    pluginsPageQueryOptions(),
+  );
+  const { data: me, isPending: mePending } = useQuery(
+    currentUserQueryOptions(),
+  );
+  /*
+   * Both, because `mine` is the intersection of the two: until the person is known, nothing matches
+   * them and the list is empty for a reason that is not "you have no skills".
+   */
+  const loading = skillsPending || mePending;
+  const [error, setError] = useState<string | null>(null);
+
+  const removeSkill = useMutation({
+    ...removeSkillMutationOptions(queryClient),
+    onError: (thrown: Error) => setError(thrown.message),
+    onSuccess: () => setError(null),
+  });
+
+  /*
+   * The server has ALREADY excluded skills this person may not see — `listSkills` scopes the query
+   * to `owner_user_id is null or owner_user_id = me`, so somebody else's private skill is never read
+   * into the process. These two lines only sort what arrived into the two things the page draws.
+   *
+   * ONE CASE FALLS THROUGH ON PURPOSE, FOR NOW: an administrator receives everybody's skills, and
+   * another person's lands in neither list. Not a leak, but an administrator cannot see here what
+   * they are entitled to. Worth an owner column or a third section before this page is called done.
+   */
+  const skills = data?.skills ?? [];
+  const mine = skills.filter((skill) => skill.ownerUserId === me?.id);
+  const deployment = skills.filter((skill) => skill.ownerUserId === null);
+
+  return (
+    <DetailPanel
+      detail={
+        showCreate ? (
+          <NewSkill />
+        ) : editingSlug ? (
+          <EditSkill slug={editingSlug} />
+        ) : null
+      }
+      onClose={() => navigate({ search: {} })}
+      open={showCreate || showEdit}
+    >
+      <CapabilitiesShell>
+        {error ? (
+          <p className="mt-4 text-sm text-destructive" role="alert">
+            {error}
+          </p>
+        ) : null}
+
+        <PageSection
+          action={
+            <Button
+              render={(props) => (
+                <Link
+                  search={{ new: true }}
+                  to="/capabilities/skills"
+                  {...props}
+                />
+              )}
+              size="sm"
+              variant="ghost"
+            >
+              <IconPlus />
+              New skill
+            </Button>
+          }
+          description={
+            <>
+              A skill is a named instruction you invoke with <code>/</code> and
+              a Bot follows. Yours are yours alone, and go on the Bots you own.
+            </>
+          }
+          title="Your skills"
+        >
+          {/*
+           * Nothing while the two queries are still in flight. The alternative is the empty state
+           * standing there saying this person has written no skills, which is a claim the page has
+           * not yet earned.
+           *
+           * And not after a read that failed, for the same reason: `isPending` goes false on a
+           * failed fetch too, and no list is no evidence of no skills. A list already held stays on
+           * screen through a failed refetch, because `data` is still there.
+           */}
+          {loading ? null : !data ? (
+            <p className="mt-4 text-destructive text-sm" role="alert">
+              Your skills could not be loaded.
+            </p>
+          ) : mine.length === 0 ? (
+            <Empty className="mt-4 h-[180px] border border-dashed">
+              <EmptyHeader>
+                <EmptyTitle className="text-muted-foreground">
+                  You don't have any skills yet.
+                </EmptyTitle>
+              </EmptyHeader>
+            </Empty>
+          ) : (
+            <PageRows>
+              {mine.map((skill, index) => (
+                <StaggerItem index={index} key={skill.id}>
+                  <Item size="sm">
+                    <ItemContent>
+                      <ItemTitle>{skill.title}</ItemTitle>
+                      {/*
+                       * THE COMMAND FIRST, because it is the only part a person has to know. The title
+                       * says what the skill is for; `/slug` is what they actually type, and a page that
+                       * lists skills without showing how to invoke one leaves them guessing at it.
+                       *
+                       * The interpunct only appears when there is a summary to separate it from —
+                       * a trailing "· " on a skill written without one reads as something missing.
+                       */}
+                      <ItemDescription>
+                        <code className="font-mono text-foreground/80 text-xs">
+                          /{skill.slug}
+                        </code>
+                        {skill.summary ? ` · ${skill.summary}` : null}
+                      </ItemDescription>
+                    </ItemContent>
+                    <ItemActions>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger
+                          render={
+                            <Button variant="ghost" size="icon-sm">
+                              <IconDots />
+                            </Button>
+                          }
+                        ></DropdownMenuTrigger>
+                        <DropdownMenuContent>
+                          <DropdownMenuGroup>
+                            <DropdownMenuItem
+                              onClick={() =>
+                                navigate({ search: { edit: skill.slug } })
+                              }
+                            >
+                              Edit
+                            </DropdownMenuItem>
+                            {/*
+                             * Deleting is immediate and there is no undo. It is behind a menu rather
+                             * than sitting on the row for that reason, and the slug is named in the
+                             * label so the destructive item says WHICH skill it destroys — a menu
+                             * opened over the wrong row is the ordinary way this goes wrong.
+                             */}
+                            <DropdownMenuItem
+                              onClick={() => {
+                                setError(null);
+                                removeSkill.mutate(skill.slug);
+                              }}
+                              variant="destructive"
+                            >
+                              Delete /{skill.slug}
+                            </DropdownMenuItem>
+                          </DropdownMenuGroup>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
+                    </ItemActions>
+                  </Item>
+                  {index !== mine?.length - 1 && <Separator />}
+                </StaggerItem>
+              ))}
+            </PageRows>
+          )}
+        </PageSection>
+
+        {/*
+         * NO MENU ON THESE ROWS, AND THAT IS THE POINT. A workspace skill belongs to the deployment,
+         * not to the person reading this page: they cannot edit it, delete it, or choose which Bots
+         * carry it. Drawing the same dropdown here and refusing on click would be a worse answer than
+         * not offering it — the server refuses either way, and an affordance that only ever fails is
+         * a promise the page cannot keep.
+         *
+         * Hidden entirely when there are none, rather than shown empty: an administrator who has
+         * written nothing yet is the normal case, and a permanently empty section reads as broken.
+         */}
+        {deployment.length > 0 ? (
+          <PageSection
+            description="Written for everyone by an administrator. Which Bots carry them is decided in Admin."
+            title="Workspace skills"
+          >
+            <PageRows>
+              {deployment.map((skill, index) => (
+                <StaggerItem index={index} key={skill.id}>
+                  <Item size="sm">
+                    <ItemContent>
+                      <ItemTitle>{skill.title}</ItemTitle>
+                      {/*
+                       * THE COMMAND FIRST, because it is the only part a person has to know. The title
+                       * says what the skill is for; `/slug` is what they actually type, and a page that
+                       * lists skills without showing how to invoke one leaves them guessing at it.
+                       *
+                       * The interpunct only appears when there is a summary to separate it from —
+                       * a trailing "· " on a skill written without one reads as something missing.
+                       */}
+                      <ItemDescription>
+                        <code className="font-mono text-foreground/80">
+                          /{skill.slug}
+                        </code>
+                        {skill.summary ? ` · ${skill.summary}` : null}
+                      </ItemDescription>
+                    </ItemContent>
+                  </Item>
+                  {index !== deployment.length - 1 && <Separator />}
+                </StaggerItem>
+              ))}
+            </PageRows>
+          </PageSection>
+        ) : null}
+
+        {/*
+         * The commented write-a-skill form that used to sit here is gone: the detail panel above is
+         * the real one now. `SkillRow` below is still parked, because its per-Bot grant toggles have
+         * no equivalent in the redesigned rows yet.
+         */}
+      </CapabilitiesShell>
+    </DetailPanel>
+  );
+}
+
+/*
+ * Parked, not deleted. Its only callers are the commented sections above, and it still holds the
+ * per-Bot grant toggles — the one piece of the old page the new one has no equivalent for yet.
+ * Whoever adds granting to the redesigned rows should start from this rather than reinvent it.
+ *
+ * function SkillRow({
+ *   skill,
+ *   bots,
+ *   onToggle,
+ *   onDelete,
+ * }: {
+ *   skill: PluginSkill;
+ *   bots: { id: string; name: string }[];
+ *   onToggle?: (agentId: string, held: boolean) => void;
+ *   onDelete?: () => void;
+ * }) {
+ *   const held = new Set(skill.grantedTo);
+ *
+ *   return (
+ *     <li className="rounded-xl border border-border p-4">
+ *       <div className="flex items-start justify-between gap-4">
+ *         <div className="min-w-0">
+ *           <div className="flex items-baseline gap-2">
+ *             <code className="font-medium">/{skill.slug}</code>
+ *             <span className="text-sm text-muted-foreground">{skill.title}</span>
+ *           </div>
+ *           {skill.summary ? (
+ *             <p className="mt-0.5 text-sm text-muted-foreground">
+ *               {skill.summary}
+ *             </p>
+ *           ) : null}
+ *         </div>
+ *         {onDelete ? (
+ *           <Button onClick={onDelete} size="sm" variant="outline">
+ *             Delete
+ *           </Button>
+ *         ) : null}
+ *       </div>
+ *
+ *       {onToggle ? (
+ *         <div className="mt-3 flex flex-wrap items-center gap-2">
+ *           {bots.length === 0 ? (
+ *             <p className="text-sm text-muted-foreground">
+ *               You do not own a Bot to put this on yet.
+ *             </p>
+ *           ) : (
+ *             bots.map((bot) => {
+ *               const on = held.has(bot.id);
+ *               return (
+ *                 <button
+ *                   className={`rounded-lg border px-2.5 py-1.5 text-sm transition-colors ${
+ *                     on
+ *                       ? "border-primary/40 bg-primary/10 text-foreground"
+ *                       : "border-border text-muted-foreground hover:text-foreground"
+ *                   }`}
+ *                   key={bot.id}
+ *                   onClick={() => onToggle(bot.id, on)}
+ *                   type="button"
+ *                 >
+ *                   {on ? "✓ " : ""}
+ *                   {bot.name}
+ *                 </button>
+ *               );
+ *             })
+ *           )}
+ *         </div>
+ *       ) : null}
+ *     </li>
+ *   );
+ * }
+ */
diff --git a/app/src/routes/_authed/_app/capabilities.tsx b/app/src/routes/_authed/_app/capabilities.tsx
new file mode 100644
index 0000000000..d8ac3dbca8
--- /dev/null
+++ b/app/src/routes/_authed/_app/capabilities.tsx
@@ -0,0 +1,9 @@
+import { createFileRoute, Outlet } from "@tanstack/react-router";
+
+/**
+ * Skills and memory under one address. Each tab draws its own frame through `CapabilitiesShell`; see
+ * there for why the heading is not drawn here.
+ */
+export const Route = createFileRoute("/_authed/_app/capabilities")({
+  component: Outlet,
+});
diff --git a/app/src/routes/_authed/_app/connections.$key.tsx b/app/src/routes/_authed/_app/connections.$key.tsx
new file mode 100644
index 0000000000..444fb6e6ad
--- /dev/null
+++ b/app/src/routes/_authed/_app/connections.$key.tsx
@@ -0,0 +1,658 @@
+import { IconArrowUpRight, IconChevronDown } from "@tabler/icons-react";
+import { useMutation, useQuery } from "@tanstack/react-query";
+import { createFileRoute, useParams } from "@tanstack/react-router";
+import { useEffect, useState } from "react";
+import { IdentityConnectionPage } from "@/components/connections/identity-connection-page";
+import {
+  PageEmpty,
+  PageRows,
+  PageSection,
+  PageShell,
+} from "@/components/layout/page-shell";
+import {
+  BrokeredAccountRow,
+  useBrokeredAccount,
+} from "@/components/plugins/brokered-account-row";
+import { GrantList } from "@/components/plugins/grant-list";
+import { Button } from "@/components/ui/button";
+import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
+} from "@/components/ui/dropdown-menu";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { Separator } from "@/components/ui/separator";
+import { currentUserQueryOptions } from "@/lib/auth/queries";
+import { connectAccountMutationOptions } from "@/lib/plugins/mutations";
+import {
+  brokeredAccountPageDescription,
+  brokeredConsentTrip,
+  brokeredDisconnectNote,
+  brokeredPerActionTrip,
+  brokeredProvenance,
+  disconnectSiblingsNotice,
+} from "@/lib/plugins/provider-vocabulary";
+import {
+  connectionSiblingsQueryOptions,
+  connectionsQueryOptions,
+  type PluginServer,
+  personalConnections,
+  pluginsPageQueryOptions,
+  pluginsProvider,
+} from "@/lib/plugins/queries";
+import { searchTextEntry } from "@/lib/search-text";
+
+/**
+ * Whether this server is reached through Composio AS THIS PERSON.
+ *
+ * A Shared app is also `provenance === "composio"` — it is still Composio that holds the account —
+ * but there is no "your account" here to confirm: the one account is the deployment's, and every
+ * Bot holding a grant acts as it regardless of who is asking. Exported so the test for this file can
+ * pin the distinction without rendering the page.
+ */
+export function brokeredFor(server: PluginServer | undefined): boolean {
+  /*
+   * A FILTER, so it asks whether the row came through a broker at all and needs no vendor name: one
+   * provider holds rows at a time (spec D3). Naming the vendor on this page is a different question
+   * and reads the active provider, below.
+   */
+  return (
+    server !== undefined &&
+    brokeredProvenance(server.provenance) &&
+    server.accountMode !== "shared"
+  );
+}
+
+/** The longest action name this page will repeat back. Real ones are far shorter. */
+const MAX_LANDED_ACTION = 200;
+
+/**
+ * The action the verifier's redirect says was just authorized, or null.
+ *
+ * A TRIMMED, BOUNDED NAME AND NOTHING ELSE: it is read off a query string, which anybody can write
+ * on this origin, so it is only ever drawn as a quoted name inside this page's own sentence and
+ * never as a sentence of its own.
+ */
+export function landedActionFrom(action: string | undefined): string | null {
+  const trimmed = (action ?? "").trim();
+  return trimmed.length > 0 && trimmed.length <= MAX_LANDED_ACTION
+    ? trimmed
+    : null;
+}
+
+/** What the landing says about the action somebody has just come back from authorizing. */
+export function landedActionNotice(action: string): string {
+  return `You just authorized ${action}.`;
+}
+
+/**
+ * One service, and whether a Bot may read it as you.
+ *
+ * Its own page rather than a switch on the list, because what a connector needs from a person is not
+ * fixed. Drive needs one consent and nothing else; a vendor that scopes access per workspace, or per
+ * folder, or asks which of several accounts to use, needs somewhere to ask. This is that somewhere,
+ * before there is anything to put in it.
+ */
+export const Route = createFileRoute("/_authed/_app/connections/$key")({
+  component: RouteComponent,
+  /*
+   * `?linked=` is how the GitHub account-link callback reports back to GitHub's page: `github` on
+   * success, `github-taken` when that account belongs to another OpenBot user, `failed` otherwise.
+   *
+   * `?action=` is the verifier's redirect saying WHICH action the consent just completed was for,
+   * so an app's page can land on it rather than on the app.
+   *
+   * Each key is omitted when absent rather than set to undefined, which would make `search` a
+   * required prop on every Link to this route. Read as text whatever the router parsed it into
+   * (`searchText`): an action name made of digits or shaped like JSON arrives as a number or an
+   * object, and a `typeof` guard would land the page on the app as though the verifier had never
+   * said which action it was.
+   */
+  validateSearch: (
+    search: Record<string, unknown>,
+  ): { linked?: string; action?: string } => ({
+    ...searchTextEntry("linked", search.linked),
+    ...searchTextEntry("action", search.action),
+  }),
+});
+
+/**
+ * GitHub and Slack are accounts this deployment links to a person, not apps an administrator
+ * enabled, so they have a page of their own; every other key is an app.
+ */
+function RouteComponent() {
+  const { key } = Route.useParams();
+  const { linked } = Route.useSearch();
+  if (key === "github" || key === "slack") {
+    return <IdentityConnectionPage linked={linked} provider={key} />;
+  }
+  return <AppConnectionPage />;
+}
+
+function AppConnectionPage() {
+  const { key } = useParams({
+    from: "/_authed/_app/connections/$key",
+  });
+  const { action } = Route.useSearch();
+  /*
+   * `?action=` IS READ ONCE HERE AND DROPPED FROM THE URL BELOW, BUT IT FEEDS TWO THINGS.
+   *
+   * Its only sender is the per-action verifier's redirect (`server/src/plugins/routes.ts`), so it is
+   * a report of a consent that has just completed — news exactly once. Left in the address bar it is
+   * read again on every reload and back-navigation, and "You just authorized X" is redrawn about a
+   * consent that may be hours old. That is the omission the Connections list closed for its own
+   * three report parameters.
+   *
+   * It is NOT only the notice, though: the same value marks the matching row of the grant list with
+   * `data-landed`, and that list draws only once its own read answers — which can be well after the
+   * strip has landed. So the strip is safe only because BOTH readers draw from this snapshot, never
+   * from the live search: read live, the notice would vanish with the parameter and the grant list
+   * would come up with nothing marked. The mark is the same news as the notice, so it is right for
+   * both to outlive the URL for this visit and for both to be gone on a reload.
+   *
+   * KEYED ON THE APP, so a snapshot taken on one app's page is never repeated on another's should the
+   * router keep this component mounted across a change of `$key`.
+   */
+  const [arrival] = useState(() => ({
+    key,
+    landedAction: landedActionFrom(action),
+  }));
+  const navigate = Route.useNavigate();
+  /*
+   * ONE NAVIGATE, the same shape as the Connections list's: `search` replaces the whole object, so
+   * a strip is written as dropping its keys from what is there and keeping the rest, never as a
+   * rebuilt object. `linked` belongs to GitHub's page, which is not this one, so `action` is the
+   * only one dropped.
+   */
+  useEffect(() => {
+    if (action === undefined) return;
+    navigate({ search: ({ action: _a, ...rest }) => rest, replace: true });
+  }, [action, navigate]);
+  const plugins = useQuery(pluginsPageQueryOptions());
+  const connections = useQuery(connectionsQueryOptions());
+  const [notice, setNotice] = useState<string | null>(null);
+
+  const connect = useMutation({
+    ...connectAccountMutationOptions(),
+    onError: (thrown: Error) => setNotice(thrown.message),
+    /*
+     * A full page navigation, not a fetch. The consent screen is the vendor's own and has to be shown
+     * to you in your own browser; there is deliberately nothing here that could complete it for you.
+     */
+    onSuccess: (authorizationUrl) => {
+      /*
+       * A 200 with no url on it is not a url to follow. Every press that reaches here is on a
+       * `user-oauth` catalogue entry, whose half of that route always mints one or refuses — so
+       * this is the server having answered something this page does not understand, and saying so
+       * is the only honest thing left. Assigning it navigated to a page called `undefined` on this
+       * deployment's own origin. See `connectAccountMutationOptions`.
+       */
+      if (authorizationUrl === null) {
+        setNotice(
+          "This deployment answered without a consent link, so there was nowhere to send you and nothing was connected. Try again, and tell an administrator if it persists.",
+        );
+        return;
+      }
+      window.location.href = authorizationUrl;
+    },
+  });
+
+  const entry = plugins.data?.catalogue.find((item) => item.key === key);
+  const server = (plugins.data?.servers ?? []).find((s) => s.id === key);
+  const enabled = server !== undefined;
+  /*
+   * READ THROUGH `personalConnections`, never the raw list: a Shared app's row is the deployment's
+   * one standing account, not this person's, and `find` over the unfiltered rows would have handed
+   * it to this page as if it were.
+   */
+  const connection = personalConnections(
+    connections.data?.connections ?? [],
+  ).find((row) => row.serverId === key);
+  /*
+   * Asked of the row rather than the catalogue, because a brokered app has no catalogue entry at
+   * all: the deployment recorded how it is reached when the app was enabled, and that record is the
+   * only thing here that knows.
+   */
+  const brokered = brokeredFor(server);
+  /*
+   * THE VENDOR'S NAME, from the active provider and never from a row: a deployment with the key set
+   * and nothing enabled has no row, and a row cannot say which broker holds the account.
+   */
+  const provider = pluginsProvider(plugins.data);
+  /*
+   * WHAT A DISCONNECT WOULD ALSO END, asked only while there is an account for it to end. The query
+   * is gated on the connection and its answer is read only through the same gate, so a cached answer
+   * from before a disconnect is never drawn beside "Connect".
+   */
+  const siblings = useQuery({
+    ...connectionSiblingsQueryOptions(key),
+    enabled: brokered && connection !== undefined,
+  });
+  const siblingsNotice =
+    brokered && connection !== undefined && siblings.data
+      ? disconnectSiblingsNotice(siblings.data)
+      : null;
+  /* From the snapshot above and never from the live search, which is stripped. */
+  const landedAction = arrival.key === key ? arrival.landedAction : null;
+  /*
+   * THE GRANT LIST IS DRAWN WHERE THE BROKER AUTHORIZES PER ACTION, read off the declared
+   * capability and never off the vendor's name. The server computes `authorizesPerAction` from the
+   * same expression `/servers/:id/authorize` behind the Authorize button gates on, so the list this
+   * screen draws and the route its buttons call cannot key on different facts. `provider ===
+   * "arcade"` keyed on a different one: the day a broker named arcade is reached with that flow
+   * absent, this drew the list and every press 503'd. False on Composio — whose auth config fixes
+   * one state for the whole toolkit — so every Composio render is unchanged.
+   */
+  const perActionGrants = plugins.data?.authorizesPerAction ?? false;
+  /* Who is asking only matters to a Shared app's Authorize, so it is not read for anything else. */
+  const sharedHere = server?.accountMode === "shared";
+  const me = useQuery({
+    ...currentUserQueryOptions(),
+    enabled: perActionGrants && sharedHere,
+  }).data;
+  const isAdmin = me?.role === "admin";
+  const appNames = [key, server?.title ?? key];
+
+  /* Everything the brokered row below reads and does. See `brokered-account-row.tsx`. */
+  const brokeredAccount = useBrokeredAccount({
+    authScheme: server?.authScheme ?? null,
+    /* The same capability the grant list below is drawn on, read once above and passed to both, so
+       the row's offer and the list's presence cannot come from different facts. */
+    authorizesPerAction: perActionGrants,
+    brokered,
+    configured: plugins.data?.composioConfigured ?? false,
+    recorded: connection !== undefined,
+    report: setNotice,
+    returnTo: "settings",
+    serverId: key,
+    /*
+     * Off the same row `recorded` is read from, and absent where you have never connected this app:
+     * with no row there is nothing that could have been checked, which is what the server's own
+     * columns default to. The three are optional on the type because that endpoint concatenates two
+     * reads and only a brokered row carries them.
+     */
+    verified: connection?.verified ?? false,
+    verifiedAt: connection?.verifiedAt ?? null,
+    /*
+     * PASSED THROUGH UNFLATTENED, unlike the two above. Their fallbacks are the server's own column
+     * defaults, so an absent field and a recorded one mean the same thing; this one's null is the
+     * server saying the last check of this key spent nothing, which is a different fact from having
+     * been told nothing. Collapsing the two would hand the row a verdict on every page load that
+     * has no record behind it.
+     */
+    probe: connection?.probe,
+    /*
+     * AND THIS ONE IS FLATTENED AGAIN, because it is a gate and not a verdict. `probe` is the
+     * record of what the last check spent and this is whether the app has anything to check with
+     * today — two questions, which is why they are two fields: gating the Re-check button on the
+     * record left a key nothing was ever spent on unable to ever have anything spent on it. A
+     * missing gate and a closed gate are the same gate, so absent collapses to false here where a
+     * missing verdict above may not collapse to a null one.
+     */
+    checkable: connection?.checkable ?? false,
+  });
+
+  /*
+   * BOTH READS ARE WAITED FOR, BECAUSE EVERY FACT THE BROKERED ROW BELOW DRAWS COMES FROM THE SECOND
+   * ONE. `recorded`, `verified`, `verifiedAt`, `probe` and `checkable` are all off `connection`,
+   * and this gated on `plugins` alone — so a connections read still in flight drew the row with the
+   * whole of its state defaulted to "you have never connected this".
+   */
+  if (plugins.isPending || connections.isPending) {
+    return <PageShell title="Account">{null}</PageShell>;
+  }
+
+  const back = {
+    label: "Connections",
+    linkProps: { to: "/connections" as const },
+  };
+
+  /*
+   * AND A CONNECTIONS READ THAT FAILED IS SAID RATHER THAN DEFAULTED, WHICH IS WHAT THIS PAGE DID
+   * WITH IT.
+   *
+   * Nothing read `connections.error`, so a 500 from `/api/plugins/connections` left `connection`
+   * undefined and the row was handed `recorded: false, verified: false, probe: undefined,
+   * checkable: false` — a connection nobody has made. For a brokered key app whose last check did
+   * not come back clean, that is the exact state this whole feature exists to keep visible: the page
+   * dropped the sentence, hid Disconnect AND Re-check, and drew Connect instead. Pressing it opens
+   * the form and the route refuses the submission — "you already have an account, disconnect it
+   * first" — so the only two controls that could end the state are the two the page just withdrew,
+   * and no error text appears anywhere, because `connect.onError` is this route's only error branch.
+   *
+   * SAID BEFORE THE ROW RATHER THAN INSTEAD OF IT, and the row is not drawn at all: a row whose
+   * entire content is connection state has nothing honest to say when that state could not be read.
+   */
+  if (connections.error) {
+    return (
+      <PageShell backButton={back} title={server?.title ?? key}>
+        <p className="mt-12 text-destructive text-sm" role="alert">
+          Whether you have connected this account could not be loaded, so
+          nothing about it is shown here rather than something that may be
+          wrong. Reload the page, and tell an administrator if it persists.
+        </p>
+      </PageShell>
+    );
+  }
+
+  /*
+   * The same for the plugin list. Every branch below decides what this connector is from it, and
+   * without it they concluded there is none: "This is not a service you connect for yourself",
+   * about a connector this person may hold right now.
+   */
+  if (!plugins.data) {
+    return (
+      <PageShell backButton={back} title={key}>
+        <p className="mt-12 text-destructive text-sm" role="alert">
+          This connector could not be loaded, so nothing about it is shown here
+          rather than something that may be wrong. Reload the page, and tell an
+          administrator if it persists.
+        </p>
+      </PageShell>
+    );
+  }
+
+  /*
+   * A COMPOSIO APP ON A DEPLOYMENT WITH NO COMPOSIO KEY, BEFORE EITHER BRANCH BELOW DRAWS A ROW.
+   *
+   * The list on the way in no longer offers one, but a link from elsewhere still lands here, and the
+   * brokered row's own sentence for this case names an environment variable — an instruction for
+   * whoever runs the deployment, read by somebody who cannot act on it.
+   */
+  if (server?.provenance === "composio" && !plugins.data.composioConfigured) {
+    return (
+      <PageShell backButton={back} title={server.title}>
+        <PageEmpty>
+          {server.title} is not available on this OpenBot yet. An administrator
+          has to finish setting it up before anybody can connect it.
+        </PageEmpty>
+      </PageShell>
+    );
+  }
+
+  /*
+   * A SHARED APP, BEFORE THE BROKERED BRANCH BELOW GETS A LOOK AT IT.
+   *
+   * `brokered` above already reads false for one of these — `brokeredFor` is what pulls a Shared
+   * app out of that branch — so without one of its own here it would fall all the way to the
+   * `user-oauth` branch and draw "Your account" with a Connect button over an account that is not
+   * this person's to connect, confirm or disconnect. There is nothing to decide: the account is the
+   * deployment's, every Bot holding a grant already acts as it, and this page says so and stops.
+   */
+  if (server?.accountMode === "shared") {
+    return (
+      <PageShell backButton={back} title={server.title}>
+        {/*
+         * THE LANDING NOTICE BELONGS HERE TOO, because a Shared app's account is the deployment's
+         * and the verifier lands BOTH holders on this page. Without it the one flow whose Authorize
+         * is admin-only completed a consent at the vendor and came back to a screen that named
+         * nothing — the grant list's mark alone, several rows down a search box, is not the page
+         * saying what just happened.
+         */}
+        {landedAction ? (
+          <p
+            className="text-sm"
+            data-landed-action={landedAction}
+            role="status"
+          >
+            {landedActionNotice(landedAction)}
+          </p>
+        ) : null}
+
+        {/* One fact, so no heading and no actions: there is nothing here for this person to do. */}
+        <PageSection>
+          <PageRows className="mt-0">
+            <Item size="sm">
+              <ItemContent>
+                <ItemTitle>Team account</ItemTitle>
+                <ItemDescription>
+                  Shared by your organisation. Bots act as the team account.
+                </ItemDescription>
+              </ItemContent>
+            </Item>
+          </PageRows>
+        </PageSection>
+
+        {/* State is shown to everyone; minting a consent is the administrator's act. */}
+        {perActionGrants ? (
+          <GrantList
+            appNames={appNames}
+            canAuthorize={isAdmin}
+            landedAction={landedAction}
+            returnTo="settings"
+            serverId={key}
+          />
+        ) : null}
+      </PageShell>
+    );
+  }
+
+  /*
+   * A brokered app, before the catalogue is consulted at all.
+   *
+   * It has no catalogue entry, so the branch below would find no `entry`, decide the deployment has
+   * no connector by that name, and say so under the raw id — about the one connector the list on the
+   * way in demonstrably drew a row for. Falling through to the `user-oauth` branch instead is no
+   * better: its title and summary are the catalogue's, and there is none.
+   */
+  if (brokered && server) {
+    /* Bound once because the row below is told it twice — once inside the whole disconnected
+       sentence and once on its own — and two copies of it would drift. */
+    const reassurance = "No Bot can read this as you.";
+
+    return (
+      <PageShell
+        backButton={back}
+        description={brokeredAccountPageDescription(provider)}
+        title={server.title}
+      >
+        {notice ? (
+          <p className="text-destructive text-sm" role="alert">
+            {notice}
+          </p>
+        ) : null}
+
+        {landedAction ? (
+          <p
+            className="text-sm"
+            data-landed-action={landedAction}
+            role="status"
+          >
+            {landedActionNotice(landedAction)}
+          </p>
+        ) : null}
+
+        {/* One decision, so no heading: it would only repeat the row's own title. */}
+        <PageSection>
+          <PageRows className="mt-0">
+            <BrokeredAccountRow
+              account={brokeredAccount}
+              /* Said beside the button rather than after it: disconnecting ends the account at
+                 Composio, so what it undoes is not the row here but the grant on your own mailbox,
+                 and connecting again is a fresh consent. */
+              connectedDescription={`A Bot granted its tools reads your ${server.title} as you. ${brokeredDisconnectNote(provider)}`}
+              disconnectedDescription={`${reassurance} ${perActionGrants ? brokeredPerActionTrip(provider, "below") : brokeredConsentTrip(provider)}`}
+              /* What is true either way. The trip to Composio is not — an app whose key somebody
+                 types never leaves this page — but which Bots can read this person's mail is the
+                 whole point of the screen and holds for both kinds. */
+              disconnectedReassurance={reassurance}
+              notice={siblingsNotice ?? undefined}
+              provider={provider}
+              title={server.title}
+            />
+          </PageRows>
+        </PageSection>
+
+        {perActionGrants ? (
+          <GrantList
+            appNames={appNames}
+            canAuthorize
+            landedAction={landedAction}
+            returnTo="settings"
+            serverId={key}
+          />
+        ) : null}
+      </PageShell>
+    );
+  }
+
+  /*
+   * A vendor that is not reached as a person has nothing here for anybody to decide, and one an
+   * administrator has not enabled cannot be consented to — there is no OAuth client behind it. Both
+   * say which it is rather than drawing a switch that cannot work.
+   */
+  if (entry?.auth !== "user-oauth") {
+    return (
+      <PageShell
+        backButton={back}
+        description="This is not a service you connect for yourself."
+        title={entry?.title ?? key}
+      >
+        <PageEmpty>
+          {entry
+            ? "A Bot reaches this one with a credential the deployment holds, the same for everybody."
+            : "This deployment has no connector by that name."}
+        </PageEmpty>
+      </PageShell>
+    );
+  }
+
+  return (
+    <PageShell
+      backButton={back}
+      description={entry.summary}
+      title={entry.title}
+    >
+      {notice ? (
+        <p className="text-destructive text-sm" role="alert">
+          {notice}
+        </p>
+      ) : null}
+
+      {/* One decision, so no heading: it would only repeat the row's own title. */}
+      <PageSection>
+        <PageRows className="mt-0">
+          <Item size="sm">
+            <ItemContent>
+              {/* Not "Connect your account": the row is also the connected state, and a title has to
+                  read for both. */}
+              <ItemTitle>Your account</ItemTitle>
+              <ItemDescription>
+                {!enabled
+                  ? "An administrator has not enabled this connector, so there is nothing to connect to yet."
+                  : connection
+                    ? "A Bot granted its tools reads this as you, and sees only what you can see."
+                    : "No Bot can read this as you. Connecting takes you to the vendor to consent."}
+              </ItemDescription>
+            </ItemContent>
+            <ItemActions>
+              {connection ? (
+                /*
+                 * A state and a menu, not a switch. Connected is a fact about a grant that lives at
+                 * the vendor, and withdrawing it is a deliberate act rather than the other half of a
+                 * position — so it is named in a menu instead of being whatever happens when
+                 * something slides back.
+                 */
+                <DropdownMenu>
+                  <DropdownMenuTrigger
+                    render={
+                      <Button size="sm" type="button" variant="outline">
+                        <span
+                          aria-hidden="true"
+                          className="size-1.5 rounded-full bg-emerald-500"
+                        />
+                        Connected
+                        <IconChevronDown />
+                      </Button>
+                    }
+                  />
+                  {/*
+                   * `w-auto`, because the default is `w-(--anchor-width)` — the width of the trigger,
+                   * which here is a small "Connected" button. Left alone, the one item inside wraps
+                   * onto three lines and a destructive action becomes hard to read at the moment it
+                   * most needs to be legible.
+                   */}
+                  <DropdownMenuContent align="end" className="w-auto">
+                    <DropdownMenuItem
+                      onClick={() =>
+                        /*
+                         * NOT BUILT YET, and it says so rather than appearing to work.
+                         *
+                         * Withdrawing is three acts — revoke at the vendor, revoke the vault
+                         * credential, delete the row — and none exist. An item that closed the menu
+                         * and changed nothing would report that access had been withdrawn when it
+                         * had not, which is the one outcome worse than not offering it.
+                         */
+                        setNotice(
+                          `Disconnecting is not built yet. Until it is, revoke it in your ${entry.vendor} account's third-party access settings — that stops this deployment reading anything immediately.`,
+                        )
+                      }
+                      className="whitespace-nowrap"
+                      variant="destructive"
+                    >
+                      Disconnect your {entry.title} account
+                    </DropdownMenuItem>
+                  </DropdownMenuContent>
+                </DropdownMenu>
+              ) : (
+                /*
+                 * The arrow says this leaves OpenBot. It does: the next thing on screen is the
+                 * vendor's own consent page, and a control that navigates away should look like one.
+                 */
+                <Button
+                  disabled={!enabled || connect.isPending}
+                  onClick={() => {
+                    setNotice(null);
+                    connect.mutate(key);
+                  }}
+                  size="sm"
+                  type="button"
+                  variant="outline"
+                >
+                  Connect
+                  <IconArrowUpRight />
+                </Button>
+              )}
+            </ItemActions>
+          </Item>
+        </PageRows>
+      </PageSection>
+
+      {connection ? (
+        <PageSection
+          description="What you agreed to, as the vendor recorded it — not what was asked for. The two differ when a consent screen is only partly accepted."
+          title="Access"
+        >
+          <PageRows>
+            <Item size="sm">
+              <ItemContent>
+                <ItemTitle>Granted</ItemTitle>
+                <ItemDescription className="line-clamp-none">
+                  {connection.scope || "The vendor named no scope."}
+                </ItemDescription>
+              </ItemContent>
+            </Item>
+            <Separator />
+            <Item size="sm">
+              <ItemContent>
+                <ItemTitle>Connected</ItemTitle>
+              </ItemContent>
+              <ItemActions>
+                <span className="text-muted-foreground text-xs">
+                  {new Date(connection.connectedAt).toLocaleString()}
+                </span>
+              </ItemActions>
+            </Item>
+          </PageRows>
+        </PageSection>
+      ) : null}
+    </PageShell>
+  );
+}
diff --git a/app/src/routes/_authed/_app/connections.index.tsx b/app/src/routes/_authed/_app/connections.index.tsx
new file mode 100644
index 0000000000..5fa96884a0
--- /dev/null
+++ b/app/src/routes/_authed/_app/connections.index.tsx
@@ -0,0 +1,512 @@
+import {
+  IconBrandGoogleDrive,
+  IconBrandNotion,
+  IconCheck,
+  IconPlug,
+  IconSearch,
+} from "@tabler/icons-react";
+import { useQuery } from "@tanstack/react-query";
+import { createFileRoute, Link } from "@tanstack/react-router";
+import * as React from "react";
+import {
+  PageEmpty,
+  PageSection,
+  PageShell,
+} from "@/components/layout/page-shell";
+import { RowMark } from "@/components/layout/row-mark";
+import { PluginLogo } from "@/components/plugins/plugin-logo";
+import { providerIcon } from "@/components/settings/linked-accounts";
+import {
+  linkedNotice,
+  visibleLinkedNotice,
+} from "@/components/settings/linked-notice";
+import {
+  InputGroup,
+  InputGroupAddon,
+  InputGroupInput,
+} from "@/components/ui/input-group";
+import {
+  Item,
+  ItemActions,
+  ItemContent,
+  ItemDescription,
+  ItemTitle,
+} from "@/components/ui/item";
+import { type ConnectionRow, connectionRows } from "@/lib/connections/rows";
+import {
+  identityProvidersQueryOptions,
+  linkedAccountsQueryOptions,
+} from "@/lib/identity/queries";
+import { keyedLookup } from "@/lib/lookup";
+import {
+  connectionsQueryOptions,
+  type PluginServer,
+  personalConnections,
+  pluginsPageQueryOptions,
+} from "@/lib/plugins/queries";
+import { searchTextEntry } from "@/lib/search-text";
+
+/**
+ * The services a Bot reads as you.
+ *
+ * Yours, not the deployment's. An administrator decides which vendors this deployment may reach at
+ * all; this is the other half of that decision, and it is one nobody can make for you — there is no
+ * endpoint for an administrator to connect an account on somebody's behalf. A Bot calling one of
+ * these runs on your own grant, so it sees exactly what you can see and nothing else.
+ */
+export const Route = createFileRoute("/_authed/_app/connections/")({
+  component: RouteComponent,
+  /*
+   * `?connected=` is how the OAuth callback reports back, carrying a server key on success and
+   * `failed` otherwise. `?linked=` is the same for the GitHub account-link callback: `github` on
+   * success, `github-taken` when that GitHub account belongs to another OpenBot user, `failed`
+   * otherwise (see linked-notice.ts). Each is the only channel available: the callback is a
+   * redirect from another company's server, so there is no response body to read.
+   *
+   * The key is omitted rather than set to undefined. Present-but-undefined makes `search` a required
+   * prop on every Link to this route, which is a lot of ripple for a parameter only the callback sets.
+   *
+   * EACH IS READ AS TEXT WHATEVER THE ROUTER PARSED IT INTO (`searchText`): the router JSON-parses
+   * search values, so a server key or reason code that happens to be digits or JSON-shaped arrives
+   * as a number or an object, and a `typeof` guard would quietly turn the callback's report into
+   * no report at all.
+   */
+  validateSearch: (
+    search: Record<string, unknown>,
+  ): { connected?: string; authorized?: string; linked?: string } => ({
+    ...searchTextEntry("connected", search.connected),
+    /*
+     * A CHANNEL OF ITS OWN, BESIDE `?connected=` AND NEVER FOLDED INTO IT. That one is the Composio
+     * OAuth callback's and carries a server key or `failed`; this one is the brokered per-action
+     * verifier's and carries a reason code. Two senders answering different questions on one
+     * parameter is how a notice comes to be drawn for the wrong thing.
+     */
+    ...searchTextEntry("authorized", search.authorized),
+    ...searchTextEntry("linked", search.linked),
+  }),
+});
+
+/**
+ * WHAT THE VERIFIER REFUSED, IN WORDS — AND THE WORDS LIVE HERE AND NOWHERE ELSE.
+ *
+ * THE SENTENCE NEVER TRAVELS IN THE URL. A message rendered from a query string is a message
+ * anybody can author on this deployment's own origin: a link could be sent around carrying whatever
+ * sentence its author liked, shown in this page's own voice under this deployment's own address.
+ * What travels is an opaque code the server chose from a closed set, and this map is the only place
+ * it becomes something a person reads — which is also what keeps one sentence from being maintained
+ * in two places that drift apart.
+ *
+ * AN UNRECOGNISED CODE DRAWS NOTHING, deliberately. A code this build does not know is either
+ * somebody probing the parameter or a deployment mid-upgrade, and a generic "something went wrong"
+ * for both would be a sentence that tells a person nothing and an invitation to keep trying.
+ *
+ * A MAP, NOT AN OBJECT, BECAUSE THE KEY COMES OUT OF A URL. An object literal inherits from
+ * `Object.prototype`, so an object lookup answers `toString`, `constructor` and `__proto__` with
+ * members nobody put here — none of them nullish, so no `?? null` turns them back into "draws
+ * nothing", and `Record<string, string>` says they cannot happen so the compiler never asks. What
+ * reached the page was a function (an alert with nothing in it) or, for `__proto__`, an object,
+ * which React refuses to draw: "Objects are not valid as a React child" took the whole Connected
+ * accounts screen down for whoever opened the link. A `Map` holds only what was put in it, so the
+ * unrecognised code and the borrowed member are once again the same case, by construction rather
+ * than by a list of names to keep out.
+ */
+export const AUTHORIZATION_NOTICES: ReadonlyMap<string, string> = new Map([
+  [
+    "no-broker",
+    "This deployment is not set up to connect apps, so nothing was recorded. Ask an administrator to set it up.",
+  ],
+  [
+    "not-supported",
+    "This deployment's apps are connected once for the whole app, with the Connect button on the app's page; they are not authorized one action at a time.",
+  ],
+  [
+    "missing-handle",
+    "That link is missing the part that says which authorization it finishes, so nothing was done. Start the authorization again from the app's page.",
+  ],
+  [
+    "no-attempt",
+    "There is no authorization in progress for you to finish — it may have expired, or it may have been started by somebody else or in another session. Start it again from the app's page.",
+  ],
+  [
+    "vendor-unavailable",
+    "The app's vendor did not answer when this deployment tried to finish that authorization, so nothing was recorded. Try the link again in a moment.",
+  ],
+  [
+    "not-your-authorization",
+    "That link does not finish the authorization you have in progress, so nothing was recorded and it is still waiting. Finish it from the tab it was started in, or start it again from the app's page.",
+  ],
+  [
+    "not-finished",
+    "That authorization has not finished yet, so nothing was recorded. Finish it at the app's vendor, then open the link again — it is still waiting.",
+  ],
+  [
+    "authorization-failed",
+    "The app's vendor did not complete that authorization, so nothing was recorded. Start it again from the app's page.",
+  ],
+  [
+    "context-changed",
+    "That app's account changed while the authorization was open, so nothing was recorded and anything granted for the old account was withdrawn. Start it again from the app's page.",
+  ],
+  [
+    "not-permitted",
+    "You can no longer connect that app's account — your access or the app's set-up changed while the authorization was open — so nothing was recorded. Ask an administrator if you expected to finish it.",
+  ],
+  [
+    "cancelled",
+    "That authorization was cancelled while it was being finished, so it was not recorded, and what it granted at the app's vendor was withdrawn.",
+  ],
+  [
+    "cancelled-left-live",
+    "That authorization was cancelled while it was being finished, so it was not recorded — but what it granted could not be withdrawn at the app's vendor, so the vendor may still allow the action you cancelled. To remove it, disconnect the app from its page, which ends its whole connection there, then connect again and authorize only what you want.",
+  ],
+  [
+    "not-recorded",
+    "This deployment could not record that authorization, so none of it was saved. Start it again from the app's page, and tell an administrator if it persists.",
+  ],
+]);
+
+/** The sentence for a code the verifier sent back, or null for one this build does not know. */
+export function authorizationNoticeFor(
+  authorized: string | undefined,
+): string | null {
+  return authorized
+    ? (keyedLookup(AUTHORIZATION_NOTICES, authorized) ?? null)
+    : null;
+}
+
+/** The same marks the admin connector list uses: these are the same vendors seen from your side. */
+const MARKS: ReadonlyMap<
+  string,
+  React.ComponentType<{ className?: string }>
+> = new Map([
+  ["google-drive", IconBrandGoogleDrive],
+  ["notion", IconBrandNotion],
+]);
+
+/* A Map for the same reason the notices above are one: a lookup answers with what was put in it and
+ * nothing a plain object would have inherited, so a catalogue key called `toString` draws the
+ * fallback mark rather than handing React `Object.prototype.toString` to render as a component.
+ * The read goes through `keyedLookup` so the rule has one home rather than one comment per page;
+ * see `app/src/lib/lookup.ts`. The `?? IconPlug` stays here, because what a missing key draws is
+ * this page's decision. */
+const markFor = (key: string) => keyedLookup(MARKS, key) ?? IconPlug;
+
+/**
+ * Whether a row came through a broker. A deployment only ever holds rows from one provider, so the
+ * page needs to recognise "brokered", not to know which broker.
+ */
+const isBrokered = (server: PluginServer): boolean =>
+  server.provenance === "composio" || server.provenance === "arcade";
+
+/**
+ * The brokered apps this page lists, which is not every brokered row.
+ *
+ * Exported as a function rather than left inline in the render, for the reason `matchingApps` on the
+ * Composio picker is: the rule is the thing worth pinning and pinning it needs no DOM, no router and
+ * no query client. See its one clause below.
+ */
+export function brokeredAccountsListedOn(
+  servers: PluginServer[],
+): PluginServer[] {
+  return servers.filter(
+    (server) =>
+      isBrokered(server) &&
+      server.authScheme !== "NO_AUTH" &&
+      server.accountMode !== "shared",
+  );
+}
+
+/**
+ * The servers this page may list at all: none reached through Composio when the deployment has no
+ * Composio key.
+ *
+ * An app an administrator enabled while a key was set keeps its row after the key is removed, and
+ * listing it offered a person an account they cannot connect, under a sentence about an environment
+ * variable only an administrator can set. Without the broker there is nothing for them to decide.
+ */
+export function serversListedFor(page: {
+  servers: PluginServer[];
+  composioConfigured: boolean;
+}): PluginServer[] {
+  return page.composioConfigured
+    ? page.servers
+    : page.servers.filter((server) => server.provenance !== "composio");
+}
+
+/** Apps whose account is the organisation's, shown so a person knows a Bot does not act as them there. */
+export function sharedAccountsListedOn(
+  servers: PluginServer[],
+): PluginServer[] {
+  return servers.filter(
+    (server) => isBrokered(server) && server.accountMode === "shared",
+  );
+}
+
+function RouteComponent() {
+  const { connected: outcome, authorized, linked } = Route.useSearch();
+  /*
+   * ALL THREE READ ONCE HERE, AND ALL THREE DROPPED FROM THE URL BELOW — not just `?linked=`.
+   *
+   * Every parameter this screen accepts is a report of something that has already happened: the
+   * Composio callback's `?connected=`, the brokered verifier's `?authorized=` and the GitHub
+   * account-link callback's `?linked=`. A report is news exactly once. Left in the address bar it
+   * is read again on every reload and on every back-navigation, so a failure that is minutes old
+   * is redrawn as though it had just happened — somebody is told again that their account could
+   * not be connected, or that there is no authorization in progress, about an attempt they have
+   * since finished successfully. Only `?linked=` was ever cleaned, which is how the other two came
+   * to replay.
+   *
+   * THE SNAPSHOT IS WHAT THE PAGE DRAWS FROM, and it is why the strip can be unconditional. Read
+   * live off the search, the notice would vanish the instant the parameter did; held here, the
+   * sentence outlives the URL it arrived in. That is what `?linked=` was already doing, and the
+   * other two now do it for the same reason rather than by accident.
+   */
+  const [arrival] = React.useState(() => ({
+    outcome,
+    authorizationNotice: authorizationNoticeFor(authorized),
+    linked: linkedNotice(linked),
+  }));
+  /* The same cached list the Linked accounts section reads, so a Disconnect there retracts a success here. */
+  const links = useQuery(linkedAccountsQueryOptions());
+  const providers = useQuery(identityProvidersQueryOptions());
+  const notice = visibleLinkedNotice(arrival.linked, links.data);
+  const navigate = Route.useNavigate();
+  /*
+   * ONE NAVIGATE FOR ALL THREE, never one per parameter. `search` replaces the whole object, so two
+   * effects each dropping their own key race: whichever lands second rebuilds from a snapshot taken
+   * before the first, and puts the key the first had just removed back.
+   */
+  React.useEffect(() => {
+    if (
+      outcome === undefined &&
+      authorized === undefined &&
+      linked === undefined
+    ) {
+      return;
+    }
+    navigate({
+      search: ({ connected: _c, authorized: _a, linked: _l, ...rest }) => rest,
+      replace: true,
+    });
+  }, [outcome, authorized, linked, navigate]);
+  const [search, setSearch] = React.useState("");
+  const plugins = useQuery(pluginsPageQueryOptions());
+  const connections = useQuery(connectionsQueryOptions());
+
+  /*
+   * ONLY THE PERSON'S OWN. A Shared app's row is the deployment's, not this person's, and the
+   * "Connected" badge this set feeds would otherwise tell them they hold an account they don't.
+   */
+  const connected = new Set(
+    personalConnections(connections.data?.connections ?? []).map(
+      (row) => row.serverId,
+    ),
+  );
+  const added = new Set((plugins.data?.servers ?? []).map((s) => s.id));
+
+  /*
+   * Only vendors reached as a person, and only ones an administrator has enabled.
+   *
+   * A vendor with a shared token has nothing for you to decide: it answers the same for everybody,
+   * so listing it here would offer a choice you do not have. And a vendor nobody has enabled cannot
+   * be connected at all, because there is no OAuth client to consent against.
+   */
+  const yours = (plugins.data?.catalogue ?? []).filter(
+    (entry) => entry.auth === "user-oauth" && added.has(entry.key),
+  );
+
+  /*
+   * Brokered apps belong here for the same reason the OAuth ones do: they answer as you.
+   *
+   * The filter above names the catalogue's `user-oauth` kind, which a brokered row cannot have
+   * because it has no catalogue entry at all — so the one connector that is nothing but per-person
+   * accounts was the one this page never listed.
+   *
+   * EXCEPT THE ONES THAT NEED NO ACCOUNT, WHICH IS THE SAME RULE THE `user-oauth` FILTER ABOVE IS.
+   * That one keeps out a vendor with a shared token because it "has nothing for you to decide"; a
+   * Composio `NO_AUTH` app has exactly as little, one layer further in. There is no account to make:
+   * `/servers/:id/connect` refuses to create one and the call gate lets it through with no row, so
+   * a row for it here can never turn green. What an admin enabling Hacker News put on every
+   * person's page was a permanently grey "Not connected" that reads as an unfinished task, opening
+   * a page that says the app needs no account and draws no button — the list and the page it opens
+   * contradicting each other, with the list the more believable of the two.
+   *
+   * ASKED OF THE RECORDED SCHEME, which this read already carries and the detail route already
+   * consumes. Anything that is not the vendor's `NO_AUTH` is an app somebody connects, an
+   * unrecorded scheme included: a row whose column was never written is far likelier to be a key or
+   * consent app, and dropping it here would hide a connection somebody does have.
+   */
+  const listed = plugins.data ? serversListedFor(plugins.data) : [];
+  const rows = connectionRows({
+    catalogue: yours,
+    brokered: brokeredAccountsListedOn(listed),
+    shared: sharedAccountsListedOn(listed),
+    connected,
+    links: links.data ?? [],
+    providers: providers.data,
+  });
+  const query = search.trim().toLocaleLowerCase();
+  const matching = rows.filter((row) =>
+    `${row.title} ${row.summary}`.toLocaleLowerCase().includes(query),
+  );
+  const inUse = rows.filter((row) => row.state !== "available").length;
+  /*
+   * The apps decide whether there is a list at all, and the account links only add to it: a failed
+   * links read costs the GitHub and Slack rows and says so, not the whole page.
+   */
+  const loading =
+    plugins.isPending ||
+    connections.isPending ||
+    links.isPending ||
+    providers.isPending;
+
+  return (
+    <PageShell className="@container" title="Connections">
+      {/*
+       * For `?connected=` only the failure is worth saying. A success needs no sentence: the row it
+       * came back to now reads "Connected", which is the same news told by the thing it is news
+       * about. `?linked=` is different and says both outcomes, through `linkedNotice` below.
+       */}
+      {arrival.outcome === "failed" ? (
+        <p className="mt-4 text-destructive text-sm" role="alert">
+          That account could not be connected. Nothing was saved — try again.
+        </p>
+      ) : null}
+      {notice ? (
+        notice.tone === "error" ? (
+          <p className="mt-4 text-destructive text-sm" role="alert">
+            {notice.text}
+          </p>
+        ) : (
+          <p className="mt-4 text-sm text-muted-foreground" role="status">
+            {notice.text}
+          </p>
+        )
+      ) : null}
+      {/*
+       * The brokered per-action verifier's own channel. It lands here rather than on an app's page
+       * because three of its refusals have no app to name, and a notice that sometimes appears one
+       * level in and sometimes here would be a notice people learn to look for in two places.
+       */}
+      {arrival.authorizationNotice ? (
+        <p className="mt-4 text-destructive text-sm" role="alert">
+          {arrival.authorizationNotice}
+        </p>
+      ) : null}
+      <PageSection
+        description="The apps and accounts your Bots use as you. Open one to connect it or change it."
+        title="Your connections"
+      >
+        {/*
+         * BOTH APP READS DECIDE THIS. A `/api/plugins` that succeeded beside a
+         * `/api/plugins/connections` that failed would leave the `connected` set empty and every row
+         * asserting "Connect" over accounts somebody already has, so either failure is one sentence:
+         * nothing is listed rather than a list that may be wrong.
+         */}
+        {loading ? null : plugins.error || connections.error ? (
+          <p className="mt-4 text-destructive text-sm" role="alert">
+            Your connections could not be loaded, so nothing is listed here
+            rather than a list that may be wrong. Reload the page, and tell an
+            administrator if it persists.
+          </p>
+        ) : rows.length === 0 ? (
+          <PageEmpty>
+            Nothing to connect yet. Apps appear here once an administrator
+            enables one that reads as the person asking.
+          </PageEmpty>
+        ) : (
+          <>
+            <p className="mt-4 text-xs text-muted-foreground">
+              {inUse} in use · {rows.length} in all
+            </p>
+            <InputGroup className="mt-3 h-9 border-transparent bg-muted/60 shadow-none dark:bg-muted/60">
+              <InputGroupAddon>
+                <IconSearch aria-hidden="true" className="size-4" />
+              </InputGroupAddon>
+              <InputGroupInput
+                aria-label="Search connections"
+                placeholder="Search connections"
+                value={search}
+                onChange={(event) => setSearch(event.target.value)}
+              />
+            </InputGroup>
+            {matching.length === 0 ? (
+              <p className="mt-8 text-sm text-muted-foreground" role="status">
+                Nothing matches “{search.trim()}”.
+              </p>
+            ) : (
+              <div className="mt-6 grid grid-cols-1 gap-x-6 gap-y-2 @min-[36rem]:grid-cols-2">
+                {matching.map((row) => (
+                  <ConnectionItem key={row.key} row={row} />
+                ))}
+              </div>
+            )}
+          </>
+        )}
+        {links.error || providers.error ? (
+          <p className="mt-4 text-destructive text-sm" role="alert">
+            Whether you can link GitHub or Slack could not be loaded, so they
+            are not listed. Reload the page to try again.
+          </p>
+        ) : null}
+      </PageSection>
+    </PageShell>
+  );
+}
+
+/** One connection: its mark, its name, one line, and where it stands. Opens its own page. */
+function ConnectionItem({ row }: { row: ConnectionRow }) {
+  return (
+    <Item
+      className="min-w-0 flex-nowrap gap-3 px-2 py-3"
+      data-testid={`account-${row.key}`}
+      render={<Link params={{ key: row.key }} to="/connections/$key" />}
+      size="sm"
+    >
+      <RowMark className="size-9">
+        <ConnectionMark mark={row.mark} />
+      </RowMark>
+      <ItemContent className="min-w-0 gap-0.5">
+        <ItemTitle className="block w-auto truncate">{row.title}</ItemTitle>
+        <ItemDescription
+          className="line-clamp-1 break-all text-xs"
+          title={row.summary}
+        >
+          {row.summary}
+        </ItemDescription>
+      </ItemContent>
+      <ItemActions className="shrink-0">
+        <ConnectionStateLabel state={row.state} />
+      </ItemActions>
+    </Item>
+  );
+}
+
+function ConnectionMark({ mark }: { mark: ConnectionRow["mark"] }) {
+  if (mark.kind === "logo") return <PluginLogo logo={mark.logo} />;
+  const Mark =
+    mark.kind === "provider" ? providerIcon(mark.provider) : markFor(mark.key);
+  return <Mark className="size-4" />;
+}
+
+function ConnectionStateLabel({ state }: { state: ConnectionRow["state"] }) {
+  if (state === "connected") {
+    return (
+      <span className="flex items-center gap-1 text-xs text-muted-foreground">
+        <IconCheck
+          aria-hidden="true"
+          className="size-3.5 text-emerald-600 dark:text-emerald-400"
+        />
+        Connected
+      </span>
+    );
+  }
+  if (state === "team") {
+    return <span className="text-xs text-muted-foreground">Team account</span>;
+  }
+  return (
+    <span className="rounded-full bg-muted px-3 py-1 text-xs font-medium">
+      {state === "needs_reconnect" ? "Reconnect" : "Connect"}
+    </span>
+  );
+}
diff --git a/app/src/routes/_authed/_app/index.tsx b/app/src/routes/_authed/_app/index.tsx
index 0c3ef384b1..da0cd0532b 100644
--- a/app/src/routes/_authed/_app/index.tsx
+++ b/app/src/routes/_authed/_app/index.tsx
@@ -178,7 +178,7 @@ function RouteComponent() {
                 {explore.map((agent) => (
                   <CarouselItem className="basis-auto pl-4" key={agent.id}>
                     <Link search={{ agent: agent.id }} to="/channel/new">
-                      <AgentCard agent={agent} appearance="artwork" />
+                      <AgentCard agent={agent} appearance="tile" />
                     </Link>
                   </CarouselItem>
                 ))}
diff --git a/app/src/routes/_authed/_app/skills.tsx b/app/src/routes/_authed/_app/skills.tsx
index 97268d0a72..a884ec2bb6 100644
--- a/app/src/routes/_authed/_app/skills.tsx
+++ b/app/src/routes/_authed/_app/skills.tsx
@@ -1,351 +1,16 @@
-import { IconDots, IconPlus } from "@tabler/icons-react";
-import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { createFileRoute, Link } from "@tanstack/react-router";
-import { useState } from "react";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { z } from "zod";
-import { DetailPanel } from "@/components/layout/detail-panel";
-import {
-  PageRows,
-  PageSection,
-  PageShell,
-} from "@/components/layout/page-shell";
-import { StaggerItem } from "@/components/layout/stagger";
-import { EditSkill } from "@/components/skills/edit-skill";
-import { NewSkill } from "@/components/skills/new-skill";
-import { Button } from "@/components/ui/button";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuGroup,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from "@/components/ui/dropdown-menu";
-import { Empty, EmptyHeader, EmptyTitle } from "@/components/ui/empty";
-import {
-  Item,
-  ItemActions,
-  ItemContent,
-  ItemDescription,
-  ItemTitle,
-} from "@/components/ui/item";
-import { Separator } from "@/components/ui/separator";
-import { currentUserQueryOptions } from "@/lib/auth/queries";
-import { removeSkillMutationOptions } from "@/lib/plugins/mutations";
-import { pluginsPageQueryOptions } from "@/lib/plugins/queries";
 
 /**
- * Personal `/` skills. They are instructions, not capabilities, and can only be granted to Bots the
- * signed-in user owns.
+ * `/skills` moved under Capabilities. Kept as a redirect because a skill proposed in a conversation links
+ * to it, and those messages stay in people's history. The panel's `new` and `edit` travel with it.
  */
-
-/**
- * Writing a skill is a search parameter rather than a route, so the list stays on screen behind the
- * panel and the form is linkable, reloadable, and closed by Back — the same contract the agents
- * roster makes.
- */
-const skillsSearchSchema = z.object({
-  new: z.boolean().optional(),
-  /** The slug being edited. Absent means nothing is. */
-  edit: z.string().optional(),
-});
-
 export const Route = createFileRoute("/_authed/_app/skills")({
-  validateSearch: skillsSearchSchema,
-  component: SkillsPage,
+  validateSearch: z.object({
+    new: z.boolean().optional(),
+    edit: z.string().optional(),
+  }),
+  beforeLoad: ({ search }) => {
+    throw redirect({ to: "/capabilities/skills", search, replace: true });
+  },
 });
-
-function SkillsPage() {
-  const queryClient = useQueryClient();
-  const { new: isCreating, edit: editingSlug } = Route.useSearch();
-  const navigate = Route.useNavigate();
-  // Creating wins if both are somehow set: it is the more recent intent, the same rule the agents
-  // roster uses when `new` and `agent` arrive together.
-  const showCreate = isCreating === true;
-  const showEdit = !showCreate && editingSlug !== undefined;
-  const { data, isPending: skillsPending } = useQuery(
-    pluginsPageQueryOptions(),
-  );
-  const { data: me, isPending: mePending } = useQuery(
-    currentUserQueryOptions(),
-  );
-  /*
-   * Both, because `mine` is the intersection of the two: until the person is known, nothing matches
-   * them and the list is empty for a reason that is not "you have no skills".
-   */
-  const loading = skillsPending || mePending;
-  const [error, setError] = useState<string | null>(null);
-
-  const removeSkill = useMutation({
-    ...removeSkillMutationOptions(queryClient),
-    onError: (thrown: Error) => setError(thrown.message),
-    onSuccess: () => setError(null),
-  });
-
-  /*
-   * The server has ALREADY excluded skills this person may not see — `listSkills` scopes the query
-   * to `owner_user_id is null or owner_user_id = me`, so somebody else's private skill is never read
-   * into the process. These two lines only sort what arrived into the two things the page draws.
-   *
-   * ONE CASE FALLS THROUGH ON PURPOSE, FOR NOW: an administrator receives everybody's skills, and
-   * another person's lands in neither list. Not a leak, but an administrator cannot see here what
-   * they are entitled to. Worth an owner column or a third section before this page is called done.
-   */
-  const skills = data?.skills ?? [];
-  const mine = skills.filter((skill) => skill.ownerUserId === me?.id);
-  const deployment = skills.filter((skill) => skill.ownerUserId === null);
-
-  return (
-    <DetailPanel
-      detail={
-        showCreate ? (
-          <NewSkill />
-        ) : editingSlug ? (
-          <EditSkill slug={editingSlug} />
-        ) : null
-      }
-      onClose={() => navigate({ search: {} })}
-      open={showCreate || showEdit}
-    >
-      <PageShell
-        description={
-          <>
-            A skill is a named instruction you invoke with <code>/</code> and a
-            Bot follows. Yours are yours alone, and go on the Bots you own.
-          </>
-        }
-        title="Agent Skills"
-      >
-        {error ? (
-          <p className="text-sm text-destructive" role="alert">
-            {error}
-          </p>
-        ) : null}
-
-        <PageSection
-          action={
-            <Button
-              render={(props) => (
-                <Link search={{ new: true }} to="/skills" {...props} />
-              )}
-              size="sm"
-              variant="ghost"
-            >
-              <IconPlus />
-              New skill
-            </Button>
-          }
-          title="Your skills"
-        >
-          {/*
-           * Nothing while the two queries are still in flight. The alternative is the empty state
-           * standing there saying this person has written no skills, which is a claim the page has
-           * not yet earned.
-           *
-           * And not after a read that failed, for the same reason: `isPending` goes false on a
-           * failed fetch too, and no list is no evidence of no skills. A list already held stays on
-           * screen through a failed refetch, because `data` is still there.
-           */}
-          {loading ? null : !data ? (
-            <p className="mt-4 text-destructive text-sm" role="alert">
-              Your skills could not be loaded.
-            </p>
-          ) : mine.length === 0 ? (
-            <Empty className="mt-4 h-[180px] border border-dashed">
-              <EmptyHeader>
-                <EmptyTitle className="text-muted-foreground">
-                  You don't have any skills yet.
-                </EmptyTitle>
-              </EmptyHeader>
-            </Empty>
-          ) : (
-            <PageRows>
-              {mine.map((skill, index) => (
-                <StaggerItem index={index} key={skill.id}>
-                  <Item size="sm">
-                    <ItemContent>
-                      <ItemTitle>{skill.title}</ItemTitle>
-                      {/*
-                       * THE COMMAND FIRST, because it is the only part a person has to know. The title
-                       * says what the skill is for; `/slug` is what they actually type, and a page that
-                       * lists skills without showing how to invoke one leaves them guessing at it.
-                       *
-                       * The interpunct only appears when there is a summary to separate it from —
-                       * a trailing "· " on a skill written without one reads as something missing.
-                       */}
-                      <ItemDescription>
-                        <code className="font-mono text-foreground/80 text-xs">
-                          /{skill.slug}
-                        </code>
-                        {skill.summary ? ` · ${skill.summary}` : null}
-                      </ItemDescription>
-                    </ItemContent>
-                    <ItemActions>
-                      <DropdownMenu>
-                        <DropdownMenuTrigger
-                          render={
-                            <Button variant="ghost" size="icon-sm">
-                              <IconDots />
-                            </Button>
-                          }
-                        ></DropdownMenuTrigger>
-                        <DropdownMenuContent>
-                          <DropdownMenuGroup>
-                            <DropdownMenuItem
-                              onClick={() =>
-                                navigate({ search: { edit: skill.slug } })
-                              }
-                            >
-                              Edit
-                            </DropdownMenuItem>
-                            {/*
-                             * Deleting is immediate and there is no undo. It is behind a menu rather
-                             * than sitting on the row for that reason, and the slug is named in the
-                             * label so the destructive item says WHICH skill it destroys — a menu
-                             * opened over the wrong row is the ordinary way this goes wrong.
-                             */}
-                            <DropdownMenuItem
-                              onClick={() => {
-                                setError(null);
-                                removeSkill.mutate(skill.slug);
-                              }}
-                              variant="destructive"
-                            >
-                              Delete /{skill.slug}
-                            </DropdownMenuItem>
-                          </DropdownMenuGroup>
-                        </DropdownMenuContent>
-                      </DropdownMenu>
-                    </ItemActions>
-                  </Item>
-                  {index !== mine?.length - 1 && <Separator />}
-                </StaggerItem>
-              ))}
-            </PageRows>
-          )}
-        </PageSection>
-
-        {/*
-         * NO MENU ON THESE ROWS, AND THAT IS THE POINT. A workspace skill belongs to the deployment,
-         * not to the person reading this page: they cannot edit it, delete it, or choose which Bots
-         * carry it. Drawing the same dropdown here and refusing on click would be a worse answer than
-         * not offering it — the server refuses either way, and an affordance that only ever fails is
-         * a promise the page cannot keep.
-         *
-         * Hidden entirely when there are none, rather than shown empty: an administrator who has
-         * written nothing yet is the normal case, and a permanently empty section reads as broken.
-         */}
-        {deployment.length > 0 ? (
-          <PageSection
-            description="Written for everyone by an administrator. Which Bots carry them is decided in Admin."
-            title="Workspace skills"
-          >
-            <PageRows>
-              {deployment.map((skill, index) => (
-                <StaggerItem index={index} key={skill.id}>
-                  <Item size="sm">
-                    <ItemContent>
-                      <ItemTitle>{skill.title}</ItemTitle>
-                      {/*
-                       * THE COMMAND FIRST, because it is the only part a person has to know. The title
-                       * says what the skill is for; `/slug` is what they actually type, and a page that
-                       * lists skills without showing how to invoke one leaves them guessing at it.
-                       *
-                       * The interpunct only appears when there is a summary to separate it from —
-                       * a trailing "· " on a skill written without one reads as something missing.
-                       */}
-                      <ItemDescription>
-                        <code className="font-mono text-foreground/80">
-                          /{skill.slug}
-                        </code>
-                        {skill.summary ? ` · ${skill.summary}` : null}
-                      </ItemDescription>
-                    </ItemContent>
-                  </Item>
-                  {index !== deployment.length - 1 && <Separator />}
-                </StaggerItem>
-              ))}
-            </PageRows>
-          </PageSection>
-        ) : null}
-
-        {/*
-         * The commented write-a-skill form that used to sit here is gone: the detail panel above is
-         * the real one now. `SkillRow` below is still parked, because its per-Bot grant toggles have
-         * no equivalent in the redesigned rows yet.
-         */}
-      </PageShell>
-    </DetailPanel>
-  );
-}
-
-/*
- * Parked, not deleted. Its only callers are the commented sections above, and it still holds the
- * per-Bot grant toggles — the one piece of the old page the new one has no equivalent for yet.
- * Whoever adds granting to the redesigned rows should start from this rather than reinvent it.
- *
- * function SkillRow({
- *   skill,
- *   bots,
- *   onToggle,
- *   onDelete,
- * }: {
- *   skill: PluginSkill;
- *   bots: { id: string; name: string }[];
- *   onToggle?: (agentId: string, held: boolean) => void;
- *   onDelete?: () => void;
- * }) {
- *   const held = new Set(skill.grantedTo);
- *
- *   return (
- *     <li className="rounded-xl border border-border p-4">
- *       <div className="flex items-start justify-between gap-4">
- *         <div className="min-w-0">
- *           <div className="flex items-baseline gap-2">
- *             <code className="font-medium">/{skill.slug}</code>
- *             <span className="text-sm text-muted-foreground">{skill.title}</span>
- *           </div>
- *           {skill.summary ? (
- *             <p className="mt-0.5 text-sm text-muted-foreground">
- *               {skill.summary}
- *             </p>
- *           ) : null}
- *         </div>
- *         {onDelete ? (
- *           <Button onClick={onDelete} size="sm" variant="outline">
- *             Delete
- *           </Button>
- *         ) : null}
- *       </div>
- *
- *       {onToggle ? (
- *         <div className="mt-3 flex flex-wrap items-center gap-2">
- *           {bots.length === 0 ? (
- *             <p className="text-sm text-muted-foreground">
- *               You do not own a Bot to put this on yet.
- *             </p>
- *           ) : (
- *             bots.map((bot) => {
- *               const on = held.has(bot.id);
- *               return (
- *                 <button
- *                   className={`rounded-lg border px-2.5 py-1.5 text-sm transition-colors ${
- *                     on
- *                       ? "border-primary/40 bg-primary/10 text-foreground"
- *                       : "border-border text-muted-foreground hover:text-foreground"
- *                   }`}
- *                   key={bot.id}
- *                   onClick={() => onToggle(bot.id, on)}
- *                   type="button"
- *                 >
- *                   {on ? "✓ " : ""}
- *                   {bot.name}
- *                 </button>
- *               );
- *             })
- *           )}
- *         </div>
- *       ) : null}
- *     </li>
- *   );
- * }
- */
diff --git a/app/src/routes/_authed/admin/components/index.tsx b/app/src/routes/_authed/admin/components/index.tsx
index 9e50d73539..8abd0a4e1e 100644
--- a/app/src/routes/_authed/admin/components/index.tsx
+++ b/app/src/routes/_authed/admin/components/index.tsx
@@ -48,7 +48,7 @@ function RouteComponent() {
           </EmptyHeader>
         </Empty>
       ) : (
-        <div className="mx-auto mt-12 grid w-full max-w-2xl grid-cols-1 gap-4 md:grid-cols-2">
+        <div className="mt-12 grid w-full grid-cols-1 gap-4 md:grid-cols-2">
           {components.data?.map((component) => (
             /*
              * A real link rather than a button, so a component can be opened in a new tab the way
diff --git a/app/src/routes/_authed/settings/approvals.tsx b/app/src/routes/_authed/settings/approvals.tsx
index 9fcad2722a..f2e9b06a61 100644
--- a/app/src/routes/_authed/settings/approvals.tsx
+++ b/app/src/routes/_authed/settings/approvals.tsx
@@ -1,6 +1,7 @@
 import { createFileRoute } from "@tanstack/react-router";
 import { ApprovalSettings } from "@/components/approvals/settings";
 import { PageShell } from "@/components/layout/page-shell";
+import { TeamBotConsents } from "@/components/settings/team-bot-consents";
 
 export const Route = createFileRoute("/_authed/settings/approvals")({
   component: ApprovalsSettingsPage,
@@ -13,6 +14,7 @@ function ApprovalsSettingsPage() {
       title="Approvals"
     >
       <ApprovalSettings />
+      <TeamBotConsents />
     </PageShell>
   );
 }
diff --git a/app/src/routes/_authed/settings/components-gallery/index.tsx b/app/src/routes/_authed/settings/components-gallery/index.tsx
index 4e145f66dd..b7334e68b3 100644
--- a/app/src/routes/_authed/settings/components-gallery/index.tsx
+++ b/app/src/routes/_authed/settings/components-gallery/index.tsx
@@ -46,7 +46,7 @@ function RouteComponent() {
           </EmptyHeader>
         </Empty>
       ) : (
-        <div className="mx-auto mt-12 grid w-full max-w-2xl grid-cols-1 gap-4 md:grid-cols-2">
+        <div className="mt-12 grid w-full grid-cols-1 gap-4 md:grid-cols-2">
           {published?.map((component) => (
             /*
              * No status dot, unlike the Admin tiles. Everything listed here is published by
diff --git a/app/src/routes/_authed/settings/connected-accounts/$key.tsx b/app/src/routes/_authed/settings/connected-accounts/$key.tsx
index 81a113072b..cd6df44b3b 100644
--- a/app/src/routes/_authed/settings/connected-accounts/$key.tsx
+++ b/app/src/routes/_authed/settings/connected-accounts/$key.tsx
@@ -1,639 +1,23 @@
-import { IconArrowUpRight, IconChevronDown } from "@tabler/icons-react";
-import { useMutation, useQuery } from "@tanstack/react-query";
-import { createFileRoute, useParams, useSearch } from "@tanstack/react-router";
-import { useEffect, useState } from "react";
-import {
-  PageEmpty,
-  PageRows,
-  PageSection,
-  PageShell,
-} from "@/components/layout/page-shell";
-import {
-  BrokeredAccountRow,
-  useBrokeredAccount,
-} from "@/components/plugins/brokered-account-row";
-import { GrantList } from "@/components/plugins/grant-list";
-import { Button } from "@/components/ui/button";
-import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-} from "@/components/ui/dropdown-menu";
-import {
-  Item,
-  ItemActions,
-  ItemContent,
-  ItemDescription,
-  ItemTitle,
-} from "@/components/ui/item";
-import { Separator } from "@/components/ui/separator";
-import { currentUserQueryOptions } from "@/lib/auth/queries";
-import { connectAccountMutationOptions } from "@/lib/plugins/mutations";
-import {
-  brokeredAccountPageDescription,
-  brokeredConsentTrip,
-  brokeredDisconnectNote,
-  brokeredPerActionTrip,
-  brokeredProvenance,
-  disconnectSiblingsNotice,
-} from "@/lib/plugins/provider-vocabulary";
-import {
-  connectionSiblingsQueryOptions,
-  connectionsQueryOptions,
-  type PluginServer,
-  personalConnections,
-  pluginsPageQueryOptions,
-  pluginsProvider,
-} from "@/lib/plugins/queries";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { searchTextEntry } from "@/lib/search-text";
 
 /**
- * Whether this server is reached through Composio AS THIS PERSON.
+ * One connected account, moved from Settings to Connections with the rest.
  *
- * A Shared app is also `provenance === "composio"` — it is still Composio that holds the account —
- * but there is no "your account" here to confirm: the one account is the deployment's, and every
- * Bot holding a grant acts as it regardless of who is asking. Exported so the test for this file can
- * pin the distinction without rendering the page.
- */
-export function brokeredFor(server: PluginServer | undefined): boolean {
-  /*
-   * A FILTER, so it asks whether the row came through a broker at all and needs no vendor name: one
-   * provider holds rows at a time (spec D3). Naming the vendor on this page is a different question
-   * and reads the active provider, below.
-   */
-  return (
-    server !== undefined &&
-    brokeredProvenance(server.provenance) &&
-    server.accountMode !== "shared"
-  );
-}
-
-/** The longest action name this page will repeat back. Real ones are far shorter. */
-const MAX_LANDED_ACTION = 200;
-
-/**
- * The action the verifier's redirect says was just authorized, or null.
- *
- * A TRIMMED, BOUNDED NAME AND NOTHING ELSE: it is read off a query string, which anybody can write
- * on this origin, so it is only ever drawn as a quoted name inside this page's own sentence and
- * never as a sentence of its own.
- */
-export function landedActionFrom(action: string | undefined): string | null {
-  const trimmed = (action ?? "").trim();
-  return trimmed.length > 0 && trimmed.length <= MAX_LANDED_ACTION
-    ? trimmed
-    : null;
-}
-
-/** What the landing says about the action somebody has just come back from authorizing. */
-export function landedActionNotice(action: string): string {
-  return `You just authorized ${action}.`;
-}
-
-/**
- * One service, and whether a Bot may read it as you.
- *
- * Its own page rather than a switch on the list, because what a connector needs from a person is not
- * fixed. Drive needs one consent and nothing else; a vendor that scopes access per workspace, or per
- * folder, or asks which of several accounts to use, needs somewhere to ask. This is that somewhere,
- * before there is anything to put in it.
+ * Carries `?action=` through, because the per-action verifier of a consent begun before an upgrade
+ * still lands here to say which action was just authorized.
  */
 export const Route = createFileRoute(
   "/_authed/settings/connected-accounts/$key",
 )({
-  component: RouteComponent,
-  /*
-   * `?action=` is the verifier's redirect saying WHICH action the consent just completed was for,
-   * so the page can land on it rather than on the app. The key is omitted when absent rather than
-   * set to undefined, which would make `search` a required prop on every Link to this route.
-   *
-   * Read as text whatever the router parsed it into (`searchText`): an action name made of digits
-   * or shaped like JSON arrives as a number or an object, and a `typeof` guard would land the page
-   * on the app as though the verifier had never said which action it was.
-   */
   validateSearch: (search: Record<string, unknown>): { action?: string } =>
     searchTextEntry("action", search.action),
+  beforeLoad: ({ params, search }) => {
+    throw redirect({
+      to: "/connections/$key",
+      params,
+      search,
+      replace: true,
+    });
+  },
 });
-
-function RouteComponent() {
-  const { key } = useParams({
-    from: "/_authed/settings/connected-accounts/$key",
-  });
-  const { action } = useSearch({
-    from: "/_authed/settings/connected-accounts/$key",
-  });
-  /*
-   * `?action=` IS READ ONCE HERE AND DROPPED FROM THE URL BELOW, BUT IT FEEDS TWO THINGS.
-   *
-   * Its only sender is the per-action verifier's redirect (`server/src/plugins/routes.ts`), so it is
-   * a report of a consent that has just completed — news exactly once. Left in the address bar it is
-   * read again on every reload and back-navigation, and "You just authorized X" is redrawn about a
-   * consent that may be hours old. That is the omission `index.tsx` closed for its own three report
-   * parameters.
-   *
-   * It is NOT only the notice, though: the same value marks the matching row of the grant list with
-   * `data-landed`, and that list draws only once its own read answers — which can be well after the
-   * strip has landed. So the strip is safe only because BOTH readers draw from this snapshot, never
-   * from the live search: read live, the notice would vanish with the parameter and the grant list
-   * would come up with nothing marked. The mark is the same news as the notice, so it is right for
-   * both to outlive the URL for this visit and for both to be gone on a reload.
-   *
-   * KEYED ON THE APP, so a snapshot taken on one app's page is never repeated on another's should the
-   * router keep this component mounted across a change of `$key`.
-   */
-  const [arrival] = useState(() => ({
-    key,
-    landedAction: landedActionFrom(action),
-  }));
-  const navigate = Route.useNavigate();
-  /*
-   * ONE NAVIGATE, the same shape as `index.tsx`'s: `search` replaces the whole object, so a strip is
-   * written as dropping its keys from what is there and keeping the rest, never as a rebuilt object.
-   * `action` is the only key this route accepts, so it is the only one dropped.
-   */
-  useEffect(() => {
-    if (action === undefined) return;
-    navigate({ search: ({ action: _a, ...rest }) => rest, replace: true });
-  }, [action, navigate]);
-  const plugins = useQuery(pluginsPageQueryOptions());
-  const connections = useQuery(connectionsQueryOptions());
-  const [notice, setNotice] = useState<string | null>(null);
-
-  const connect = useMutation({
-    ...connectAccountMutationOptions(),
-    onError: (thrown: Error) => setNotice(thrown.message),
-    /*
-     * A full page navigation, not a fetch. The consent screen is the vendor's own and has to be shown
-     * to you in your own browser; there is deliberately nothing here that could complete it for you.
-     */
-    onSuccess: (authorizationUrl) => {
-      /*
-       * A 200 with no url on it is not a url to follow. Every press that reaches here is on a
-       * `user-oauth` catalogue entry, whose half of that route always mints one or refuses — so
-       * this is the server having answered something this page does not understand, and saying so
-       * is the only honest thing left. Assigning it navigated to a page called `undefined` on this
-       * deployment's own origin. See `connectAccountMutationOptions`.
-       */
-      if (authorizationUrl === null) {
-        setNotice(
-          "This deployment answered without a consent link, so there was nowhere to send you and nothing was connected. Try again, and tell an administrator if it persists.",
-        );
-        return;
-      }
-      window.location.href = authorizationUrl;
-    },
-  });
-
-  const entry = plugins.data?.catalogue.find((item) => item.key === key);
-  const server = (plugins.data?.servers ?? []).find((s) => s.id === key);
-  const enabled = server !== undefined;
-  /*
-   * READ THROUGH `personalConnections`, never the raw list: a Shared app's row is the deployment's
-   * one standing account, not this person's, and `find` over the unfiltered rows would have handed
-   * it to this page as if it were.
-   */
-  const connection = personalConnections(
-    connections.data?.connections ?? [],
-  ).find((row) => row.serverId === key);
-  /*
-   * Asked of the row rather than the catalogue, because a brokered app has no catalogue entry at
-   * all: the deployment recorded how it is reached when the app was enabled, and that record is the
-   * only thing here that knows.
-   */
-  const brokered = brokeredFor(server);
-  /*
-   * THE VENDOR'S NAME, from the active provider and never from a row: a deployment with the key set
-   * and nothing enabled has no row, and a row cannot say which broker holds the account.
-   */
-  const provider = pluginsProvider(plugins.data);
-  /*
-   * WHAT A DISCONNECT WOULD ALSO END, asked only while there is an account for it to end. The query
-   * is gated on the connection and its answer is read only through the same gate, so a cached answer
-   * from before a disconnect is never drawn beside "Connect".
-   */
-  const siblings = useQuery({
-    ...connectionSiblingsQueryOptions(key),
-    enabled: brokered && connection !== undefined,
-  });
-  const siblingsNotice =
-    brokered && connection !== undefined && siblings.data
-      ? disconnectSiblingsNotice(siblings.data)
-      : null;
-  /* From the snapshot above and never from the live search, which is stripped. */
-  const landedAction = arrival.key === key ? arrival.landedAction : null;
-  /*
-   * THE GRANT LIST IS DRAWN WHERE THE BROKER AUTHORIZES PER ACTION, read off the declared
-   * capability and never off the vendor's name. The server computes `authorizesPerAction` from the
-   * same expression `/servers/:id/authorize` behind the Authorize button gates on, so the list this
-   * screen draws and the route its buttons call cannot key on different facts. `provider ===
-   * "arcade"` keyed on a different one: the day a broker named arcade is reached with that flow
-   * absent, this drew the list and every press 503'd. False on Composio — whose auth config fixes
-   * one state for the whole toolkit — so every Composio render is unchanged.
-   */
-  const perActionGrants = plugins.data?.authorizesPerAction ?? false;
-  /* Who is asking only matters to a Shared app's Authorize, so it is not read for anything else. */
-  const sharedHere = server?.accountMode === "shared";
-  const me = useQuery({
-    ...currentUserQueryOptions(),
-    enabled: perActionGrants && sharedHere,
-  }).data;
-  const isAdmin = me?.role === "admin";
-  const appNames = [key, server?.title ?? key];
-
-  /* Everything the brokered row below reads and does. See `brokered-account-row.tsx`. */
-  const brokeredAccount = useBrokeredAccount({
-    authScheme: server?.authScheme ?? null,
-    /* The same capability the grant list below is drawn on, read once above and passed to both, so
-       the row's offer and the list's presence cannot come from different facts. */
-    authorizesPerAction: perActionGrants,
-    brokered,
-    configured: plugins.data?.composioConfigured ?? false,
-    recorded: connection !== undefined,
-    report: setNotice,
-    returnTo: "settings",
-    serverId: key,
-    /*
-     * Off the same row `recorded` is read from, and absent where you have never connected this app:
-     * with no row there is nothing that could have been checked, which is what the server's own
-     * columns default to. The three are optional on the type because that endpoint concatenates two
-     * reads and only a brokered row carries them.
-     */
-    verified: connection?.verified ?? false,
-    verifiedAt: connection?.verifiedAt ?? null,
-    /*
-     * PASSED THROUGH UNFLATTENED, unlike the two above. Their fallbacks are the server's own column
-     * defaults, so an absent field and a recorded one mean the same thing; this one's null is the
-     * server saying the last check of this key spent nothing, which is a different fact from having
-     * been told nothing. Collapsing the two would hand the row a verdict on every page load that
-     * has no record behind it.
-     */
-    probe: connection?.probe,
-    /*
-     * AND THIS ONE IS FLATTENED AGAIN, because it is a gate and not a verdict. `probe` is the
-     * record of what the last check spent and this is whether the app has anything to check with
-     * today — two questions, which is why they are two fields: gating the Re-check button on the
-     * record left a key nothing was ever spent on unable to ever have anything spent on it. A
-     * missing gate and a closed gate are the same gate, so absent collapses to false here where a
-     * missing verdict above may not collapse to a null one.
-     */
-    checkable: connection?.checkable ?? false,
-  });
-
-  /*
-   * BOTH READS ARE WAITED FOR, BECAUSE EVERY FACT THE BROKERED ROW BELOW DRAWS COMES FROM THE SECOND
-   * ONE. `recorded`, `verified`, `verifiedAt`, `probe` and `checkable` are all off `connection`,
-   * and this gated on `plugins` alone — so a connections read still in flight drew the row with the
-   * whole of its state defaulted to "you have never connected this".
-   */
-  if (plugins.isPending || connections.isPending) {
-    return <PageShell title="Account">{null}</PageShell>;
-  }
-
-  const back = {
-    label: "Connected accounts",
-    linkProps: { to: "/settings/connected-accounts" as const },
-  };
-
-  /*
-   * AND A CONNECTIONS READ THAT FAILED IS SAID RATHER THAN DEFAULTED, WHICH IS WHAT THIS PAGE DID
-   * WITH IT.
-   *
-   * Nothing read `connections.error`, so a 500 from `/api/plugins/connections` left `connection`
-   * undefined and the row was handed `recorded: false, verified: false, probe: undefined,
-   * checkable: false` — a connection nobody has made. For a brokered key app whose last check did
-   * not come back clean, that is the exact state this whole feature exists to keep visible: the page
-   * dropped the sentence, hid Disconnect AND Re-check, and drew Connect instead. Pressing it opens
-   * the form and the route refuses the submission — "you already have an account, disconnect it
-   * first" — so the only two controls that could end the state are the two the page just withdrew,
-   * and no error text appears anywhere, because `connect.onError` is this route's only error branch.
-   *
-   * SAID BEFORE THE ROW RATHER THAN INSTEAD OF IT, and the row is not drawn at all: a row whose
-   * entire content is connection state has nothing honest to say when that state could not be read.
-   */
-  if (connections.error) {
-    return (
-      <PageShell backButton={back} title={server?.title ?? key}>
-        <p className="mt-12 text-destructive text-sm" role="alert">
-          Whether you have connected this account could not be loaded, so
-          nothing about it is shown here rather than something that may be
-          wrong. Reload the page, and tell an administrator if it persists.
-        </p>
-      </PageShell>
-    );
-  }
-
-  /*
-   * The same for the plugin list. Every branch below decides what this connector is from it, and
-   * without it they concluded there is none: "This is not a service you connect for yourself",
-   * about a connector this person may hold right now.
-   */
-  if (!plugins.data) {
-    return (
-      <PageShell backButton={back} title={key}>
-        <p className="mt-12 text-destructive text-sm" role="alert">
-          This connector could not be loaded, so nothing about it is shown here
-          rather than something that may be wrong. Reload the page, and tell an
-          administrator if it persists.
-        </p>
-      </PageShell>
-    );
-  }
-
-  /*
-   * A COMPOSIO APP ON A DEPLOYMENT WITH NO COMPOSIO KEY, BEFORE EITHER BRANCH BELOW DRAWS A ROW.
-   *
-   * The list on the way in no longer offers one, but a link from elsewhere still lands here, and the
-   * brokered row's own sentence for this case names an environment variable — an instruction for
-   * whoever runs the deployment, read by somebody who cannot act on it.
-   */
-  if (server?.provenance === "composio" && !plugins.data.composioConfigured) {
-    return (
-      <PageShell backButton={back} title={server.title}>
-        <PageEmpty>
-          {server.title} is not available on this OpenBot yet. An administrator
-          has to finish setting it up before anybody can connect it.
-        </PageEmpty>
-      </PageShell>
-    );
-  }
-
-  /*
-   * A SHARED APP, BEFORE THE BROKERED BRANCH BELOW GETS A LOOK AT IT.
-   *
-   * `brokered` above already reads false for one of these — `brokeredFor` is what pulls a Shared
-   * app out of that branch — so without one of its own here it would fall all the way to the
-   * `user-oauth` branch and draw "Your account" with a Connect button over an account that is not
-   * this person's to connect, confirm or disconnect. There is nothing to decide: the account is the
-   * deployment's, every Bot holding a grant already acts as it, and this page says so and stops.
-   */
-  if (server?.accountMode === "shared") {
-    return (
-      <PageShell backButton={back} title={server.title}>
-        {/*
-         * THE LANDING NOTICE BELONGS HERE TOO, because a Shared app's account is the deployment's
-         * and the verifier lands BOTH holders on this page. Without it the one flow whose Authorize
-         * is admin-only completed a consent at the vendor and came back to a screen that named
-         * nothing — the grant list's mark alone, several rows down a search box, is not the page
-         * saying what just happened.
-         */}
-        {landedAction ? (
-          <p
-            className="text-sm"
-            data-landed-action={landedAction}
-            role="status"
-          >
-            {landedActionNotice(landedAction)}
-          </p>
-        ) : null}
-
-        {/* One fact, so no heading and no actions: there is nothing here for this person to do. */}
-        <PageSection>
-          <PageRows className="mt-0">
-            <Item size="sm">
-              <ItemContent>
-                <ItemTitle>Team account</ItemTitle>
-                <ItemDescription>
-                  Shared by your organisation. Bots act as the team account.
-                </ItemDescription>
-              </ItemContent>
-            </Item>
-          </PageRows>
-        </PageSection>
-
-        {/* State is shown to everyone; minting a consent is the administrator's act. */}
-        {perActionGrants ? (
-          <GrantList
-            appNames={appNames}
-            canAuthorize={isAdmin}
-            landedAction={landedAction}
-            returnTo="settings"
-            serverId={key}
-          />
-        ) : null}
-      </PageShell>
-    );
-  }
-
-  /*
-   * A brokered app, before the catalogue is consulted at all.
-   *
-   * It has no catalogue entry, so the branch below would find no `entry`, decide the deployment has
-   * no connector by that name, and say so under the raw id — about the one connector the list on the
-   * way in demonstrably drew a row for. Falling through to the `user-oauth` branch instead is no
-   * better: its title and summary are the catalogue's, and there is none.
-   */
-  if (brokered && server) {
-    /* Bound once because the row below is told it twice — once inside the whole disconnected
-       sentence and once on its own — and two copies of it would drift. */
-    const reassurance = "No Bot can read this as you.";
-
-    return (
-      <PageShell
-        backButton={back}
-        description={brokeredAccountPageDescription(provider)}
-        title={server.title}
-      >
-        {notice ? (
-          <p className="text-destructive text-sm" role="alert">
-            {notice}
-          </p>
-        ) : null}
-
-        {landedAction ? (
-          <p
-            className="text-sm"
-            data-landed-action={landedAction}
-            role="status"
-          >
-            {landedActionNotice(landedAction)}
-          </p>
-        ) : null}
-
-        {/* One decision, so no heading: it would only repeat the row's own title. */}
-        <PageSection>
-          <PageRows className="mt-0">
-            <BrokeredAccountRow
-              account={brokeredAccount}
-              /* Said beside the button rather than after it: disconnecting ends the account at
-                 Composio, so what it undoes is not the row here but the grant on your own mailbox,
-                 and connecting again is a fresh consent. */
-              connectedDescription={`A Bot granted its tools reads your ${server.title} as you. ${brokeredDisconnectNote(provider)}`}
-              disconnectedDescription={`${reassurance} ${perActionGrants ? brokeredPerActionTrip(provider, "below") : brokeredConsentTrip(provider)}`}
-              /* What is true either way. The trip to Composio is not — an app whose key somebody
-                 types never leaves this page — but which Bots can read this person's mail is the
-                 whole point of the screen and holds for both kinds. */
-              disconnectedReassurance={reassurance}
-              notice={siblingsNotice ?? undefined}
-              provider={provider}
-              title={server.title}
-            />
-          </PageRows>
-        </PageSection>
-
-        {perActionGrants ? (
-          <GrantList
-            appNames={appNames}
-            canAuthorize
-            landedAction={landedAction}
-            returnTo="settings"
-            serverId={key}
-          />
-        ) : null}
-      </PageShell>
-    );
-  }
-
-  /*
-   * A vendor that is not reached as a person has nothing here for anybody to decide, and one an
-   * administrator has not enabled cannot be consented to — there is no OAuth client behind it. Both
-   * say which it is rather than drawing a switch that cannot work.
-   */
-  if (entry?.auth !== "user-oauth") {
-    return (
-      <PageShell
-        backButton={back}
-        description="This is not a service you connect for yourself."
-        title={entry?.title ?? key}
-      >
-        <PageEmpty>
-          {entry
-            ? "A Bot reaches this one with a credential the deployment holds, the same for everybody."
-            : "This deployment has no connector by that name."}
-        </PageEmpty>
-      </PageShell>
-    );
-  }
-
-  return (
-    <PageShell
-      backButton={back}
-      description={entry.summary}
-      title={entry.title}
-    >
-      {notice ? (
-        <p className="text-destructive text-sm" role="alert">
-          {notice}
-        </p>
-      ) : null}
-
-      {/* One decision, so no heading: it would only repeat the row's own title. */}
-      <PageSection>
-        <PageRows className="mt-0">
-          <Item size="sm">
-            <ItemContent>
-              {/* Not "Connect your account": the row is also the connected state, and a title has to
-                  read for both. */}
-              <ItemTitle>Your account</ItemTitle>
-              <ItemDescription>
-                {!enabled
-                  ? "An administrator has not enabled this connector, so there is nothing to connect to yet."
-                  : connection
-                    ? "A Bot granted its tools reads this as you, and sees only what you can see."
-                    : "No Bot can read this as you. Connecting takes you to the vendor to consent."}
-              </ItemDescription>
-            </ItemContent>
-            <ItemActions>
-              {connection ? (
-                /*
-                 * A state and a menu, not a switch. Connected is a fact about a grant that lives at
-                 * the vendor, and withdrawing it is a deliberate act rather than the other half of a
-                 * position — so it is named in a menu instead of being whatever happens when
-                 * something slides back.
-                 */
-                <DropdownMenu>
-                  <DropdownMenuTrigger
-                    render={
-                      <Button size="sm" type="button" variant="outline">
-                        <span
-                          aria-hidden="true"
-                          className="size-1.5 rounded-full bg-emerald-500"
-                        />
-                        Connected
-                        <IconChevronDown />
-                      </Button>
-                    }
-                  />
-                  {/*
-                   * `w-auto`, because the default is `w-(--anchor-width)` — the width of the trigger,
-                   * which here is a small "Connected" button. Left alone, the one item inside wraps
-                   * onto three lines and a destructive action becomes hard to read at the moment it
-                   * most needs to be legible.
-                   */}
-                  <DropdownMenuContent align="end" className="w-auto">
-                    <DropdownMenuItem
-                      onClick={() =>
-                        /*
-                         * NOT BUILT YET, and it says so rather than appearing to work.
-                         *
-                         * Withdrawing is three acts — revoke at the vendor, revoke the vault
-                         * credential, delete the row — and none exist. An item that closed the menu
-                         * and changed nothing would report that access had been withdrawn when it
-                         * had not, which is the one outcome worse than not offering it.
-                         */
-                        setNotice(
-                          `Disconnecting is not built yet. Until it is, revoke it in your ${entry.vendor} account's third-party access settings — that stops this deployment reading anything immediately.`,
-                        )
-                      }
-                      className="whitespace-nowrap"
-                      variant="destructive"
-                    >
-                      Disconnect your {entry.title} account
-                    </DropdownMenuItem>
-                  </DropdownMenuContent>
-                </DropdownMenu>
-              ) : (
-                /*
-                 * The arrow says this leaves OpenBot. It does: the next thing on screen is the
-                 * vendor's own consent page, and a control that navigates away should look like one.
-                 */
-                <Button
-                  disabled={!enabled || connect.isPending}
-                  onClick={() => {
-                    setNotice(null);
-                    connect.mutate(key);
-                  }}
-                  size="sm"
-                  type="button"
-                  variant="outline"
-                >
-                  Connect
-                  <IconArrowUpRight />
-                </Button>
-              )}
-            </ItemActions>
-          </Item>
-        </PageRows>
-      </PageSection>
-
-      {connection ? (
-        <PageSection
-          description="What you agreed to, as the vendor recorded it — not what was asked for. The two differ when a consent screen is only partly accepted."
-          title="Access"
-        >
-          <PageRows>
-            <Item size="sm">
-              <ItemContent>
-                <ItemTitle>Granted</ItemTitle>
-                <ItemDescription className="line-clamp-none">
-                  {connection.scope || "The vendor named no scope."}
-                </ItemDescription>
-              </ItemContent>
-            </Item>
-            <Separator />
-            <Item size="sm">
-              <ItemContent>
-                <ItemTitle>Connected</ItemTitle>
-              </ItemContent>
-              <ItemActions>
-                <span className="text-muted-foreground text-xs">
-                  {new Date(connection.connectedAt).toLocaleString()}
-                </span>
-              </ItemActions>
-            </Item>
-          </PageRows>
-        </PageSection>
-      ) : null}
-    </PageShell>
-  );
-}
diff --git a/app/src/routes/_authed/settings/connected-accounts/index.tsx b/app/src/routes/_authed/settings/connected-accounts/index.tsx
index ef34e1f7f2..ec562116d5 100644
--- a/app/src/routes/_authed/settings/connected-accounts/index.tsx
+++ b/app/src/routes/_authed/settings/connected-accounts/index.tsx
@@ -1,652 +1,28 @@
-import {
-  IconBrandGoogleDrive,
-  IconBrandNotion,
-  IconCheck,
-  IconPlug,
-  IconSearch,
-} from "@tabler/icons-react";
-import { useMutation, useQuery } from "@tanstack/react-query";
-import { createFileRoute, Link } from "@tanstack/react-router";
-import * as React from "react";
-import {
-  PageEmpty,
-  PageRows,
-  PageSection,
-  PageShell,
-} from "@/components/layout/page-shell";
-import { RowMark } from "@/components/layout/row-mark";
-import { PluginLogo } from "@/components/plugins/plugin-logo";
-import { GithubSources } from "@/components/settings/github-sources";
-import { LinkedAccountsSection } from "@/components/settings/linked-accounts";
-import {
-  linkedNotice,
-  visibleLinkedNotice,
-} from "@/components/settings/linked-notice";
-import { Button } from "@/components/ui/button";
-import {
-  InputGroup,
-  InputGroupAddon,
-  InputGroupInput,
-} from "@/components/ui/input-group";
-import {
-  Item,
-  ItemActions,
-  ItemContent,
-  ItemDescription,
-  ItemTitle,
-} from "@/components/ui/item";
-import { linkedAccountsQueryOptions } from "@/lib/identity/queries";
-import { keyedLookup } from "@/lib/lookup";
-import {
-  connectionsQueryOptions,
-  type PluginServer,
-  personalConnections,
-  pluginsPageQueryOptions,
-} from "@/lib/plugins/queries";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 import { searchTextEntry } from "@/lib/search-text";
-import { clearTeamBotConsentsMutationOptions } from "@/lib/team-bots";
 
 /**
- * The services a Bot reads as you.
+ * Connected accounts moved from Settings to their own page, Connections.
  *
- * Yours, not the deployment's. An administrator decides which vendors this deployment may reach at
- * all; this is the other half of that decision, and it is one nobody can make for you — there is no
- * endpoint for an administrator to connect an account on somebody's behalf. A Bot calling one of
- * these runs on your own grant, so it sees exactly what you can see and nothing else.
+ * Kept as a redirect, carrying `?connected=`, `?authorized=` and `?linked=`, because a consent
+ * somebody began before an upgrade still comes back here: the vendor holds the return address it was
+ * given at the time. Each is read as text whatever the router parsed it into, for the reason the
+ * page it lands on gives (`searchText`): a report that happens to be digits must not be dropped on
+ * the way through.
  */
 export const Route = createFileRoute("/_authed/settings/connected-accounts/")({
-  component: RouteComponent,
-  /*
-   * `?connected=` is how the OAuth callback reports back, carrying a server key on success and
-   * `failed` otherwise. `?linked=` is the same for the GitHub account-link callback: `github` on
-   * success, `github-taken` when that GitHub account belongs to another OpenBot user, `failed`
-   * otherwise (see linked-notice.ts). Each is the only channel available: the callback is a
-   * redirect from another company's server, so there is no response body to read.
-   *
-   * The key is omitted rather than set to undefined. Present-but-undefined makes `search` a required
-   * prop on every Link to this route, which is a lot of ripple for a parameter only the callback sets.
-   *
-   * EACH IS READ AS TEXT WHATEVER THE ROUTER PARSED IT INTO (`searchText`): the router JSON-parses
-   * search values, so a server key or reason code that happens to be digits or JSON-shaped arrives
-   * as a number or an object, and a `typeof` guard would quietly turn the callback's report into
-   * no report at all.
-   */
   validateSearch: (
     search: Record<string, unknown>,
   ): { connected?: string; authorized?: string; linked?: string } => ({
     ...searchTextEntry("connected", search.connected),
-    /*
-     * A CHANNEL OF ITS OWN, BESIDE `?connected=` AND NEVER FOLDED INTO IT. That one is the Composio
-     * OAuth callback's and carries a server key or `failed`; this one is the brokered per-action
-     * verifier's and carries a reason code. Two senders answering different questions on one
-     * parameter is how a notice comes to be drawn for the wrong thing.
-     */
     ...searchTextEntry("authorized", search.authorized),
     ...searchTextEntry("linked", search.linked),
   }),
-});
-
-/**
- * WHAT THE VERIFIER REFUSED, IN WORDS — AND THE WORDS LIVE HERE AND NOWHERE ELSE.
- *
- * THE SENTENCE NEVER TRAVELS IN THE URL. A message rendered from a query string is a message
- * anybody can author on this deployment's own origin: a link could be sent around carrying whatever
- * sentence its author liked, shown in this page's own voice under this deployment's own address.
- * What travels is an opaque code the server chose from a closed set, and this map is the only place
- * it becomes something a person reads — which is also what keeps one sentence from being maintained
- * in two places that drift apart.
- *
- * AN UNRECOGNISED CODE DRAWS NOTHING, deliberately. A code this build does not know is either
- * somebody probing the parameter or a deployment mid-upgrade, and a generic "something went wrong"
- * for both would be a sentence that tells a person nothing and an invitation to keep trying.
- *
- * A MAP, NOT AN OBJECT, BECAUSE THE KEY COMES OUT OF A URL. An object literal inherits from
- * `Object.prototype`, so an object lookup answers `toString`, `constructor` and `__proto__` with
- * members nobody put here — none of them nullish, so no `?? null` turns them back into "draws
- * nothing", and `Record<string, string>` says they cannot happen so the compiler never asks. What
- * reached the page was a function (an alert with nothing in it) or, for `__proto__`, an object,
- * which React refuses to draw: "Objects are not valid as a React child" took the whole Connected
- * accounts screen down for whoever opened the link. A `Map` holds only what was put in it, so the
- * unrecognised code and the borrowed member are once again the same case, by construction rather
- * than by a list of names to keep out.
- */
-export const AUTHORIZATION_NOTICES: ReadonlyMap<string, string> = new Map([
-  [
-    "no-broker",
-    "This deployment is not set up to connect apps, so nothing was recorded. Ask an administrator to set it up.",
-  ],
-  [
-    "not-supported",
-    "This deployment's apps are connected once for the whole app, with the Connect button on the app's page; they are not authorized one action at a time.",
-  ],
-  [
-    "missing-handle",
-    "That link is missing the part that says which authorization it finishes, so nothing was done. Start the authorization again from the app's page.",
-  ],
-  [
-    "no-attempt",
-    "There is no authorization in progress for you to finish — it may have expired, or it may have been started by somebody else or in another session. Start it again from the app's page.",
-  ],
-  [
-    "vendor-unavailable",
-    "The app's vendor did not answer when this deployment tried to finish that authorization, so nothing was recorded. Try the link again in a moment.",
-  ],
-  [
-    "not-your-authorization",
-    "That link does not finish the authorization you have in progress, so nothing was recorded and it is still waiting. Finish it from the tab it was started in, or start it again from the app's page.",
-  ],
-  [
-    "not-finished",
-    "That authorization has not finished yet, so nothing was recorded. Finish it at the app's vendor, then open the link again — it is still waiting.",
-  ],
-  [
-    "authorization-failed",
-    "The app's vendor did not complete that authorization, so nothing was recorded. Start it again from the app's page.",
-  ],
-  [
-    "context-changed",
-    "That app's account changed while the authorization was open, so nothing was recorded and anything granted for the old account was withdrawn. Start it again from the app's page.",
-  ],
-  [
-    "not-permitted",
-    "You can no longer connect that app's account — your access or the app's set-up changed while the authorization was open — so nothing was recorded. Ask an administrator if you expected to finish it.",
-  ],
-  [
-    "cancelled",
-    "That authorization was cancelled while it was being finished, so it was not recorded, and what it granted at the app's vendor was withdrawn.",
-  ],
-  [
-    "cancelled-left-live",
-    "That authorization was cancelled while it was being finished, so it was not recorded — but what it granted could not be withdrawn at the app's vendor, so the vendor may still allow the action you cancelled. To remove it, disconnect the app from its page, which ends its whole connection there, then connect again and authorize only what you want.",
-  ],
-  [
-    "not-recorded",
-    "This deployment could not record that authorization, so none of it was saved. Start it again from the app's page, and tell an administrator if it persists.",
-  ],
-]);
-
-/** The sentence for a code the verifier sent back, or null for one this build does not know. */
-export function authorizationNoticeFor(
-  authorized: string | undefined,
-): string | null {
-  return authorized
-    ? (keyedLookup(AUTHORIZATION_NOTICES, authorized) ?? null)
-    : null;
-}
-
-/** The same marks the admin connector list uses: these are the same vendors seen from your side. */
-const MARKS: ReadonlyMap<
-  string,
-  React.ComponentType<{ className?: string }>
-> = new Map([
-  ["google-drive", IconBrandGoogleDrive],
-  ["notion", IconBrandNotion],
-]);
-
-/* A Map for the same reason the notices above are one: a lookup answers with what was put in it and
- * nothing a plain object would have inherited, so a catalogue key called `toString` draws the
- * fallback mark rather than handing React `Object.prototype.toString` to render as a component.
- * The read goes through `keyedLookup` so the rule has one home rather than one comment per page;
- * see `app/src/lib/lookup.ts`. The `?? IconPlug` stays here, because what a missing key draws is
- * this page's decision. */
-const markFor = (key: string) => keyedLookup(MARKS, key) ?? IconPlug;
-
-/**
- * Whether a row came through a broker. A deployment only ever holds rows from one provider, so the
- * page needs to recognise "brokered", not to know which broker.
- */
-const isBrokered = (server: PluginServer): boolean =>
-  server.provenance === "composio" || server.provenance === "arcade";
-
-/**
- * The brokered apps this page lists, which is not every brokered row.
- *
- * Exported as a function rather than left inline in the render, for the reason `matchingApps` on the
- * Composio picker is: the rule is the thing worth pinning and pinning it needs no DOM, no router and
- * no query client. See its one clause below.
- */
-export function brokeredAccountsListedOn(
-  servers: PluginServer[],
-): PluginServer[] {
-  return servers.filter(
-    (server) =>
-      isBrokered(server) &&
-      server.authScheme !== "NO_AUTH" &&
-      server.accountMode !== "shared",
-  );
-}
-
-/**
- * The servers this page may list at all: none reached through Composio when the deployment has no
- * Composio key.
- *
- * An app an administrator enabled while a key was set keeps its row after the key is removed, and
- * listing it offered a person an account they cannot connect, under a sentence about an environment
- * variable only an administrator can set. Without the broker there is nothing for them to decide.
- */
-export function serversListedFor(page: {
-  servers: PluginServer[];
-  composioConfigured: boolean;
-}): PluginServer[] {
-  return page.composioConfigured
-    ? page.servers
-    : page.servers.filter((server) => server.provenance !== "composio");
-}
-
-/** Apps whose account is the organisation's, shown so a person knows a Bot does not act as them there. */
-export function sharedAccountsListedOn(
-  servers: PluginServer[],
-): PluginServer[] {
-  return servers.filter(
-    (server) => isBrokered(server) && server.accountMode === "shared",
-  );
-}
-
-/** Which of this page's sections are worth drawing, for a given personal-account count and server list. */
-export type ConnectedAccountSection = "personal" | "empty" | "shared";
-
-/**
- * The "which sections show" decision, pinned once rather than left as two conditions that happen
- * to agree.
- *
- * "personal" and "empty" are mutually exclusive: either there is at least one account of this
- * person's own to search and connect, or there is the empty-state copy saying so. "shared" is
- * independent of both — a deployment whose only brokered apps are all Shared has `accountCount`
- * zero (nothing personal to connect) and still has rows the Shared section must draw, because
- * those rows exist to tell a person a Bot acts as the team there, not as them. Dropping "shared"
- * whenever "empty" is chosen would hide that fact for exactly the deployments where it is the
- * only thing on this page worth saying.
- */
-export function connectedAccountSections(
-  accountCount: number,
-  servers: PluginServer[],
-): ConnectedAccountSection[] {
-  const sections: ConnectedAccountSection[] = [
-    accountCount > 0 ? "personal" : "empty",
-  ];
-  if (sharedAccountsListedOn(servers).length > 0) {
-    sections.push("shared");
-  }
-  return sections;
-}
-
-function RouteComponent() {
-  const { connected: outcome, authorized, linked } = Route.useSearch();
-  /*
-   * ALL THREE READ ONCE HERE, AND ALL THREE DROPPED FROM THE URL BELOW — not just `?linked=`.
-   *
-   * Every parameter this screen accepts is a report of something that has already happened: the
-   * Composio callback's `?connected=`, the brokered verifier's `?authorized=` and the GitHub
-   * account-link callback's `?linked=`. A report is news exactly once. Left in the address bar it
-   * is read again on every reload and on every back-navigation, so a failure that is minutes old
-   * is redrawn as though it had just happened — somebody is told again that their account could
-   * not be connected, or that there is no authorization in progress, about an attempt they have
-   * since finished successfully. Only `?linked=` was ever cleaned, which is how the other two came
-   * to replay.
-   *
-   * THE SNAPSHOT IS WHAT THE PAGE DRAWS FROM, and it is why the strip can be unconditional. Read
-   * live off the search, the notice would vanish the instant the parameter did; held here, the
-   * sentence outlives the URL it arrived in. That is what `?linked=` was already doing, and the
-   * other two now do it for the same reason rather than by accident.
-   */
-  const [arrival] = React.useState(() => ({
-    outcome,
-    authorizationNotice: authorizationNoticeFor(authorized),
-    linked: linkedNotice(linked),
-  }));
-  /* The same cached list the Linked accounts section reads, so a Disconnect there retracts a success here. */
-  const links = useQuery(linkedAccountsQueryOptions());
-  const notice = visibleLinkedNotice(arrival.linked, links.data);
-  const navigate = Route.useNavigate();
-  /*
-   * ONE NAVIGATE FOR ALL THREE, never one per parameter. `search` replaces the whole object, so two
-   * effects each dropping their own key race: whichever lands second rebuilds from a snapshot taken
-   * before the first, and puts the key the first had just removed back.
-   */
-  React.useEffect(() => {
-    if (
-      outcome === undefined &&
-      authorized === undefined &&
-      linked === undefined
-    ) {
-      return;
-    }
-    navigate({
-      search: ({ connected: _c, authorized: _a, linked: _l, ...rest }) => rest,
+  beforeLoad: ({ search }) => {
+    throw redirect({
+      to: "/connections",
+      search,
       replace: true,
     });
-  }, [outcome, authorized, linked, navigate]);
-  const [search, setSearch] = React.useState("");
-  const plugins = useQuery(pluginsPageQueryOptions());
-  const connections = useQuery(connectionsQueryOptions());
-
-  /*
-   * ONLY THE PERSON'S OWN. A Shared app's row is the deployment's, not this person's, and the
-   * "Connected" badge this set feeds would otherwise tell them they hold an account they don't.
-   */
-  const connected = new Set(
-    personalConnections(connections.data?.connections ?? []).map(
-      (row) => row.serverId,
-    ),
-  );
-  const added = new Set((plugins.data?.servers ?? []).map((s) => s.id));
-
-  /*
-   * Only vendors reached as a person, and only ones an administrator has enabled.
-   *
-   * A vendor with a shared token has nothing for you to decide: it answers the same for everybody,
-   * so listing it here would offer a choice you do not have. And a vendor nobody has enabled cannot
-   * be connected at all, because there is no OAuth client to consent against.
-   */
-  const yours = (plugins.data?.catalogue ?? []).filter(
-    (entry) => entry.auth === "user-oauth" && added.has(entry.key),
-  );
-
-  /*
-   * Brokered apps belong here for the same reason the OAuth ones do: they answer as you.
-   *
-   * The filter above names the catalogue's `user-oauth` kind, which a brokered row cannot have
-   * because it has no catalogue entry at all — so the one connector that is nothing but per-person
-   * accounts was the one this page never listed.
-   *
-   * EXCEPT THE ONES THAT NEED NO ACCOUNT, WHICH IS THE SAME RULE THE `user-oauth` FILTER ABOVE IS.
-   * That one keeps out a vendor with a shared token because it "has nothing for you to decide"; a
-   * Composio `NO_AUTH` app has exactly as little, one layer further in. There is no account to make:
-   * `/servers/:id/connect` refuses to create one and the call gate lets it through with no row, so
-   * a row for it here can never turn green. What an admin enabling Hacker News put on every
-   * person's page was a permanently grey "Not connected" that reads as an unfinished task, opening
-   * a page that says the app needs no account and draws no button — the list and the page it opens
-   * contradicting each other, with the list the more believable of the two.
-   *
-   * ASKED OF THE RECORDED SCHEME, which this read already carries and the detail route already
-   * consumes. Anything that is not the vendor's `NO_AUTH` is an app somebody connects, an
-   * unrecorded scheme included: a row whose column was never written is far likelier to be a key or
-   * consent app, and dropping it here would hide a connection somebody does have.
-   */
-  const listed = plugins.data ? serversListedFor(plugins.data) : [];
-  const brokered = brokeredAccountsListedOn(listed);
-  /*
-   * Listed, never connected here. A Shared app's account is the organisation's, not this person's to
-   * make or to break, so this list draws no Connect action and links nowhere — it exists only so a
-   * person can see that a Bot calling this app acts as the team, not as them.
-   */
-  const shared = sharedAccountsListedOn(listed);
-  const sectionsToShow = connectedAccountSections(
-    yours.length + brokered.length,
-    listed,
-  );
-  const accounts = [
-    ...yours.map((entry) => {
-      const Mark = markFor(entry.key);
-      return {
-        key: entry.key,
-        title: entry.title,
-        summary: entry.summary,
-        mark: <Mark className="size-4" />,
-      };
-    }),
-    ...brokered.map((server) => ({
-      key: server.id,
-      title: server.title,
-      summary: server.summary || `Connect your ${server.title} account.`,
-      mark: <PluginLogo logo={server.logo} />,
-    })),
-  ];
-  const query = search.trim().toLocaleLowerCase();
-  const matching = accounts.filter((account) =>
-    `${account.title} ${account.summary}`.toLocaleLowerCase().includes(query),
-  );
-  const connectedCount = accounts.filter((account) =>
-    connected.has(account.key),
-  ).length;
-  const sections = [
-    {
-      title: "Connected",
-      accounts: matching.filter((account) => connected.has(account.key)),
-    },
-    {
-      title: "Not connected",
-      accounts: matching.filter((account) => !connected.has(account.key)),
-    },
-  ];
-
-  return (
-    <PageShell
-      className="max-w-4xl @container"
-      description="Connect your apps so your Bots can work with them."
-      title="Connected accounts"
-    >
-      {/*
-       * For `?connected=` only the failure is worth saying. A success needs no sentence: the row it
-       * came back to now reads "Connected", which is the same news told by the thing it is news
-       * about. `?linked=` is different and says both outcomes, through `linkedNotice` below.
-       */}
-      {arrival.outcome === "failed" ? (
-        <p className="text-destructive text-sm" role="alert">
-          That account could not be connected. Nothing was saved — try again.
-        </p>
-      ) : null}
-      {notice ? (
-        notice.tone === "error" ? (
-          <p className="text-destructive text-sm" role="alert">
-            {notice.text}
-          </p>
-        ) : (
-          <p className="text-sm text-muted-foreground" role="status">
-            {notice.text}
-          </p>
-        )
-      ) : null}
-      {/*
-       * The brokered per-action verifier's own channel. It lands here rather than on an app's page
-       * because three of its refusals have no app to name, and a notice that sometimes appears one
-       * level in and sometimes here would be a notice people learn to look for in two places.
-       */}
-      {arrival.authorizationNotice ? (
-        <p className="text-destructive text-sm" role="alert">
-          {arrival.authorizationNotice}
-        </p>
-      ) : null}
-      {/*
-       * BOTH READS DECIDE THIS, AND ONLY ONE OF THEM USED TO. The waits were already paired here;
-       * the errors were not — this branch tested `plugins.error` alone, so a `/api/plugins` that
-       * succeeded beside a `/api/plugins/connections` that failed left the `connected` set empty and
-       * every row below asserting "Not connected", with no error text anywhere on the page. Somebody
-       * holding Gmail through Composio and Drive through OAuth was shown both as unconnected and
-       * clicked through to reconnect accounts they already had. The brokered rows make it worse than
-       * it was before they existed, because a brokered row's entire content is the connection state.
-       *
-       * ONE SENTENCE FOR BOTH, because the two failures are one fact from where the reader stands:
-       * this page could not be loaded, and what it would otherwise draw is not shown rather than
-       * drawn wrong.
-       */}
-      {plugins.isPending || connections.isPending ? null : plugins.error ||
-        connections.error ? (
-        <p className="mt-12 text-destructive text-sm" role="alert">
-          Your connected accounts could not be loaded, so nothing is listed here
-          rather than a list that may be wrong. Reload the page, and tell an
-          administrator if it persists.
-        </p>
-      ) : sectionsToShow.includes("empty") ? (
-        <PageSection>
-          <PageEmpty>
-            Nothing to connect yet. These appear once an administrator enables a
-            connector that reads as the person asking.
-          </PageEmpty>
-        </PageSection>
-      ) : (
-        <>
-          <p className="mt-5 text-xs text-muted-foreground">
-            {connectedCount} connected · {accounts.length} available
-          </p>
-          <InputGroup className="mt-3 h-9 border-transparent bg-muted/60 shadow-none dark:bg-muted/60">
-            <InputGroupAddon>
-              <IconSearch aria-hidden="true" className="size-4" />
-            </InputGroupAddon>
-            <InputGroupInput
-              aria-label="Search apps"
-              placeholder="Search apps"
-              value={search}
-              onChange={(event) => setSearch(event.target.value)}
-            />
-          </InputGroup>
-          {matching.length === 0 ? (
-            <p className="mt-8 text-sm text-muted-foreground" role="status">
-              No apps match “{search.trim()}”.
-            </p>
-          ) : (
-            sections
-              .filter((section) => section.accounts.length > 0)
-              .map((section) => (
-                <section
-                  className="mt-8"
-                  key={section.title}
-                  aria-label={section.title}
-                >
-                  <h2 className="mb-3 px-2 text-xs font-medium text-muted-foreground">
-                    {section.title}
-                  </h2>
-                  <div className="grid grid-cols-1 gap-x-6 gap-y-2 @min-[36rem]:grid-cols-2">
-                    {section.accounts.map((account) => (
-                      <Item
-                        key={account.key}
-                        className="min-w-0 flex-nowrap gap-3 px-2 py-3"
-                        data-testid={`account-${account.key}`}
-                        render={
-                          <Link
-                            params={{ key: account.key }}
-                            to="/settings/connected-accounts/$key"
-                          />
-                        }
-                        size="sm"
-                      >
-                        <RowMark className="size-9">{account.mark}</RowMark>
-                        <ItemContent className="min-w-0 gap-0.5">
-                          <ItemTitle className="block w-auto truncate">
-                            {account.title}
-                          </ItemTitle>
-                          <ItemDescription
-                            className="line-clamp-1 break-all text-xs"
-                            title={account.summary}
-                          >
-                            {account.summary}
-                          </ItemDescription>
-                        </ItemContent>
-                        <ItemActions className="shrink-0">
-                          {connected.has(account.key) ? (
-                            <span className="flex items-center gap-1 text-xs text-muted-foreground">
-                              <IconCheck
-                                aria-hidden="true"
-                                className="size-3.5 text-emerald-600 dark:text-emerald-400"
-                              />
-                              Connected
-                            </span>
-                          ) : (
-                            <span className="rounded-full bg-muted px-3 py-1 text-xs font-medium">
-                              Connect
-                            </span>
-                          )}
-                        </ItemActions>
-                      </Item>
-                    ))}
-                  </div>
-                </section>
-              ))
-          )}
-        </>
-      )}
-      {/*
-       * Below the searchable list, and never inside it: these rows answer no search and carry no
-       * Connect action, because there is nothing here for this person to do. The point of the
-       * section is the opposite of the one above it — to say plainly that a Bot calling this app
-       * acts as the organisation, not as whoever is looking at this page.
-       *
-       * RENDERED OUTSIDE THE EMPTY-STATE BRANCH, deliberately: `connectedAccountSections` can
-       * choose "empty" and "shared" together, because a deployment whose only brokered apps are
-       * all Shared has an empty `accounts` list — there is nothing personal to connect — but that
-       * is not the same as having nothing to show. Nesting this inside the empty branch's `<>…</>`
-       * used to mean the empty-state copy ("Nothing to connect yet") replaced this section outright
-       * instead of sitting above it. The gating condition matches the one guarding that branch so
-       * this section never draws while the reads are pending or failed.
-       */}
-      {!plugins.isPending &&
-      !connections.isPending &&
-      !plugins.error &&
-      !connections.error &&
-      sectionsToShow.includes("shared") ? (
-        <PageSection title="Shared by your organisation">
-          <div className="grid grid-cols-1 gap-x-6 gap-y-2 @min-[36rem]:grid-cols-2">
-            {shared.map((server) => (
-              <Item
-                key={server.id}
-                className="min-w-0 flex-nowrap gap-3 px-2 py-3"
-                data-testid={`account-${server.id}`}
-                size="sm"
-              >
-                <RowMark className="size-9">
-                  <PluginLogo logo={server.logo} />
-                </RowMark>
-                <ItemContent className="min-w-0 gap-0.5">
-                  <ItemTitle className="block w-auto truncate">
-                    {server.title}
-                  </ItemTitle>
-                  <ItemDescription
-                    className="line-clamp-1 break-all text-xs"
-                    title="Shared by your organisation. Bots act as the team account."
-                  >
-                    Shared by your organisation. Bots act as the team account.
-                  </ItemDescription>
-                </ItemContent>
-              </Item>
-            ))}
-          </div>
-        </PageSection>
-      ) : null}
-      <LinkedAccountsSection />
-      <GithubSources />
-      <TeamBotConsents />
-    </PageShell>
-  );
-}
-
-/**
- * A Bot someone shared with you uses its owner's connected apps unless you let it use yours on the
- * card it shows you. This forgets every one of those answers, so each such Bot asks again.
- */
-function TeamBotConsents() {
-  const clear = useMutation(clearTeamBotConsentsMutationOptions());
-  return (
-    <PageSection
-      description="A Bot someone shared with you uses their connected apps, and yours only where you allowed it on the card it showed you."
-      title="Bots shared with you"
-    >
-      {clear.error ? (
-        <p className="mt-4 text-destructive text-sm" role="alert">
-          {clear.error.message}
-        </p>
-      ) : null}
-      <PageRows>
-        <Item size="sm">
-          <ItemContent>
-            <ItemTitle>Your answers</ItemTitle>
-            <ItemDescription>
-              {clear.isSuccess
-                ? "Cleared. Each will ask again."
-                : "Forget them, so each asks again."}
-            </ItemDescription>
-          </ItemContent>
-          <ItemActions>
-            <Button
-              disabled={clear.isPending}
-              onClick={() => clear.mutate()}
-              size="sm"
-              variant="outline"
-            >
-              Clear
-            </Button>
-          </ItemActions>
-        </Item>
-      </PageRows>
-    </PageSection>
-  );
-}
+  },
+});
diff --git a/app/src/routes/_authed/settings/memory.tsx b/app/src/routes/_authed/settings/memory.tsx
index 01335bcd45..68654f9909 100644
--- a/app/src/routes/_authed/settings/memory.tsx
+++ b/app/src/routes/_authed/settings/memory.tsx
@@ -1,19 +1,8 @@
-import { createFileRoute } from "@tanstack/react-router";
-import { PageShell } from "@/components/layout/page-shell";
-import { MemoryList, RememberFact } from "@/components/memory/memories";
+import { createFileRoute, redirect } from "@tanstack/react-router";
 
+/** Memory moved from Settings to Capabilities. */
 export const Route = createFileRoute("/_authed/settings/memory")({
-  component: MemorySettingsPage,
+  beforeLoad: () => {
+    throw redirect({ to: "/capabilities/memory", replace: true });
+  },
 });
-
-function MemorySettingsPage() {
-  return (
-    <PageShell
-      action={<RememberFact />}
-      description="What your Bots know about you. Facts you tell them reach every Bot; what a Bot learns stays with that Bot."
-      title="Memory"
-    >
-      <MemoryList />
-    </PageShell>
-  );
-}
diff --git a/app/tests/app-access-action.test.tsx b/app/tests/app-access-action.test.tsx
index 728aac0806..67a6d20a4d 100644
--- a/app/tests/app-access-action.test.tsx
+++ b/app/tests/app-access-action.test.tsx
@@ -109,7 +109,7 @@ function mounted(
   });
   const settings = createRoute({
     getParentRoute: () => root,
-    path: "/settings/connected-accounts/$key",
+    path: "/connections/$key",
     component: () => null,
   });
   const router = createRouter({
@@ -228,17 +228,13 @@ test("an app connected with a typed key goes to its page in Settings, where the
   );
   // Drawn as a button (`Button` over a `Link`), and an anchor underneath with the address.
   const link = (await view.findByText("Connect")).closest("a");
-  expect(link?.getAttribute("href")).toBe(
-    "/settings/connected-accounts/composio-gmail",
-  );
+  expect(link?.getAttribute("href")).toBe("/connections/composio-gmail");
 });
 
 test("a Composio app to reconnect goes to Settings, because the connect route refuses a row that stands", async () => {
   const { view } = mounted(appAccess({ state: "reconnect" }));
   const link = (await view.findByText("Reconnect")).closest("a");
-  expect(link?.getAttribute("href")).toBe(
-    "/settings/connected-accounts/composio-gmail",
-  );
+  expect(link?.getAttribute("href")).toBe("/connections/composio-gmail");
 });
 
 test("this deployment's own OAuth app reconnects in place, with a fresh consent", async () => {
diff --git a/app/tests/app-access-card.test.tsx b/app/tests/app-access-card.test.tsx
index d9746cc06d..d76f4fd1c5 100644
--- a/app/tests/app-access-card.test.tsx
+++ b/app/tests/app-access-card.test.tsx
@@ -76,7 +76,7 @@ function mount(children: ReactNode) {
   });
   const settings = createRoute({
     getParentRoute: () => root,
-    path: "/settings/connected-accounts/$key",
+    path: "/connections/$key",
     component: () => null,
   });
   const router = createRouter({
@@ -178,7 +178,7 @@ test("an account the vendor lost: Reconnect, though the server still reads ready
   );
   expect(
     (await view.findByText("Reconnect")).closest("a")?.getAttribute("href"),
-  ).toBe("/settings/connected-accounts/composio-gmail");
+  ).toBe("/connections/composio-gmail");
 });
 
 test("an account lost and then connected again: the newer connection wins", async () => {
diff --git a/app/tests/arcade-index.test.tsx b/app/tests/arcade-index.test.tsx
index d64cd7086b..02645b4c94 100644
--- a/app/tests/arcade-index.test.tsx
+++ b/app/tests/arcade-index.test.tsx
@@ -3,7 +3,7 @@ import type { PluginServer } from "@/lib/plugins/queries";
 import {
   brokeredAccountsListedOn,
   sharedAccountsListedOn,
-} from "@/routes/_authed/settings/connected-accounts/index";
+} from "@/routes/_authed/_app/connections.index";
 
 /**
  * The Connected accounts index lists brokered rows from either broker. A deployment holds rows from
diff --git a/app/tests/bot-access-apps.test.tsx b/app/tests/bot-access-apps.test.tsx
index c5de93cedd..23050ab8ea 100644
--- a/app/tests/bot-access-apps.test.tsx
+++ b/app/tests/bot-access-apps.test.tsx
@@ -109,7 +109,7 @@ function draw() {
   });
   const settings = createRoute({
     getParentRoute: () => root,
-    path: "/settings/connected-accounts/$key",
+    path: "/connections/$key",
     component: () => null,
   });
   const router = createRouter({
diff --git a/app/tests/brokered-account-row.test.tsx b/app/tests/brokered-account-row.test.tsx
index 335722fd3a..a3bbdea3a8 100644
--- a/app/tests/brokered-account-row.test.tsx
+++ b/app/tests/brokered-account-row.test.tsx
@@ -26,7 +26,7 @@ import {
 import type { BrokerField } from "@/lib/plugins/mutations";
 import type { PluginServer, PluginsPage } from "@/lib/plugins/queries";
 import { Route as AdminAppRoute } from "@/routes/_authed/admin/plugins/$key";
-import { Route as ConnectedAccountRoute } from "@/routes/_authed/settings/connected-accounts/$key";
+import { Route as ConnectedAccountRoute } from "@/routes/_authed/_app/connections.$key";
 import { BROKERED_PROBE_OUTCOMES } from "../../server/src/plugins/store";
 
 /**
@@ -689,10 +689,10 @@ afterEach(() => {
 /**
  * The personal screen, at its real id.
  *
- * `routeTree.gen.ts` fixes both halves: id `/connected-accounts/$key` under `/_authed/settings`,
- * path `/connected-accounts/$key`. Decoy pathless/static parents are enough to make the join land
- * on the id `useParams({ from: … })` resolves against; the real ancestors check a session and mount
- * the settings shell, neither of which this file is about. The index route is registered only so
+ * `routeTree.gen.ts` fixes both halves: id `/$key` under `/_authed/_app/connections`, path
+ * `/connections/$key`. Decoy pathless/static parents are enough to make the join land on the id
+ * `useParams({ from: … })` resolves against; the real ancestors check a session and mount the app
+ * shell, neither of which this file is about. The index route is registered only so
  * the Back link has something to build an href from.
  */
 function renderAccountScreen(client: QueryClient) {
@@ -702,14 +702,19 @@ function renderAccountScreen(client: QueryClient) {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
+  const connectionsRoute = createRoute({
+    path: "/connections",
+    getParentRoute: () => appRoute,
+    component: Outlet,
+  });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/",
+    getParentRoute: () => connectionsRoute,
     component: () => null,
   });
   const wired = (
@@ -717,17 +722,19 @@ function renderAccountScreen(client: QueryClient) {
       update: (options: unknown) => typeof ConnectedAccountRoute;
     }
   ).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/$key",
+    path: "/$key",
+    getParentRoute: () => connectionsRoute,
   });
   const tree = rootRoute.addChildren([
-    authedRoute.addChildren([settingsRoute.addChildren([indexRoute, wired])]),
+    authedRoute.addChildren([
+      appRoute.addChildren([connectionsRoute.addChildren([indexRoute, wired])]),
+    ]),
   ]);
   const router = createRouter({
     routeTree: tree,
     history: createMemoryHistory({
-      initialEntries: [`/settings/connected-accounts/${APP_KEY}`],
+      initialEntries: [`/connections/${APP_KEY}`],
     }),
   });
   return render(
diff --git a/app/tests/composio-unconfigured-account.test.tsx b/app/tests/composio-unconfigured-account.test.tsx
index f9252f7e8e..fa6c42e8c2 100644
--- a/app/tests/composio-unconfigured-account.test.tsx
+++ b/app/tests/composio-unconfigured-account.test.tsx
@@ -23,8 +23,8 @@ import {
   type PluginsPage,
   pluginKeys,
 } from "@/lib/plugins/queries";
-import { Route as ConnectedAccountRoute } from "@/routes/_authed/settings/connected-accounts/$key";
-import { serversListedFor } from "@/routes/_authed/settings/connected-accounts/index";
+import { Route as ConnectedAccountRoute } from "@/routes/_authed/_app/connections.$key";
+import { serversListedFor } from "@/routes/_authed/_app/connections.index";
 import { settleReactWork } from "./settle-react-work";
 
 /**
@@ -141,29 +141,36 @@ function renderAccount(composioConfigured: boolean) {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
+  const connectionsRoute = createRoute({
+    path: "/connections",
+    getParentRoute: () => appRoute,
+    component: Outlet,
+  });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/",
+    getParentRoute: () => connectionsRoute,
     component: () => null,
   });
   const account = (ConnectedAccountRoute as unknown as Updatable).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/$key",
+    path: "/$key",
+    getParentRoute: () => connectionsRoute,
   });
   const router = createRouter({
     routeTree: rootRoute.addChildren([
       authedRoute.addChildren([
-        settingsRoute.addChildren([indexRoute, account as never]),
+        appRoute.addChildren([
+          connectionsRoute.addChildren([indexRoute, account as never]),
+        ]),
       ]),
     ]),
     history: createMemoryHistory({
-      initialEntries: ["/settings/connected-accounts/composio-gmail"],
+      initialEntries: ["/connections/composio-gmail"],
     }),
   });
   return render(
diff --git a/app/tests/connect-app-card.test.tsx b/app/tests/connect-app-card.test.tsx
index 72203f268d..a4dc054608 100644
--- a/app/tests/connect-app-card.test.tsx
+++ b/app/tests/connect-app-card.test.tsx
@@ -122,7 +122,7 @@ function mounted(
   // The destination the card links to for an app connected with a typed key.
   const settings = createRoute({
     getParentRoute: () => root,
-    path: "/settings/connected-accounts/$key",
+    path: "/connections/$key",
     component: () => null,
   });
   const router = createRouter({
@@ -210,9 +210,7 @@ test("says where to type a key for an app that has no page to visit", async () =
   const link = await waitFor(() =>
     card.view.getByRole("link", { name: /Enter it on Notion's page/ }),
   );
-  expect(link.getAttribute("href")).toBe(
-    "/settings/connected-accounts/srv_notion",
-  );
+  expect(link.getAttribute("href")).toBe("/connections/srv_notion");
   // The blank tab claimed on the click is let go rather than left sitting on about:blank.
   expect(card.tabsClosed()).toBe(1);
 });
diff --git a/app/tests/connected-account-confirmation.test.tsx b/app/tests/connected-account-confirmation.test.tsx
index 730f6fd188..253c269f26 100644
--- a/app/tests/connected-account-confirmation.test.tsx
+++ b/app/tests/connected-account-confirmation.test.tsx
@@ -28,7 +28,7 @@ import type { PluginServer, PluginsPage } from "@/lib/plugins/queries";
 import {
   landedActionFrom,
   Route as ConnectedAccountRoute,
-} from "@/routes/_authed/settings/connected-accounts/$key";
+} from "@/routes/_authed/_app/connections.$key";
 
 /**
  * The page a person reads before deciding to grant or end access to a mailbox, on each broker.
@@ -171,14 +171,14 @@ function renderScreen(search = "") {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/connections/",
+    getParentRoute: () => appRoute,
     component: () => null,
   });
   const wired = (
@@ -186,16 +186,16 @@ function renderScreen(search = "") {
       update: (options: unknown) => typeof ConnectedAccountRoute;
     }
   ).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/connections/$key",
+    path: "/connections/$key",
+    getParentRoute: () => appRoute,
   });
   const router = createRouter({
     routeTree: rootRoute.addChildren([
-      authedRoute.addChildren([settingsRoute.addChildren([indexRoute, wired])]),
+      authedRoute.addChildren([appRoute.addChildren([indexRoute, wired])]),
     ]),
     history: createMemoryHistory({
-      initialEntries: [`/settings/connected-accounts/${APP}${search}`],
+      initialEntries: [`/connections/${APP}${search}`],
     }),
   });
   return render(
diff --git a/app/tests/connected-account-grants.test.tsx b/app/tests/connected-account-grants.test.tsx
index 77c5b7253c..e2f83be12a 100644
--- a/app/tests/connected-account-grants.test.tsx
+++ b/app/tests/connected-account-grants.test.tsx
@@ -21,7 +21,7 @@ import userEvent from "@testing-library/user-event";
 import { consentCopy } from "@/lib/plugins/enablement-notes";
 import type { GrantState } from "@/lib/plugins/grants";
 import type { PluginServer, PluginsPage } from "@/lib/plugins/queries";
-import { Route as ConnectedAccountRoute } from "@/routes/_authed/settings/connected-accounts/$key";
+import { Route as ConnectedAccountRoute } from "@/routes/_authed/_app/connections.$key";
 
 /**
  * THE GRANT LIST on an app's own page, drawn by `GrantState`, grouped by permission, with the consent
@@ -189,14 +189,14 @@ function renderScreen(search = "") {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/connections/",
+    getParentRoute: () => appRoute,
     component: () => null,
   });
   const wired = (
@@ -204,16 +204,16 @@ function renderScreen(search = "") {
       update: (options: unknown) => typeof ConnectedAccountRoute;
     }
   ).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/connections/$key",
+    path: "/connections/$key",
+    getParentRoute: () => appRoute,
   });
   const router = createRouter({
     routeTree: rootRoute.addChildren([
-      authedRoute.addChildren([settingsRoute.addChildren([indexRoute, wired])]),
+      authedRoute.addChildren([appRoute.addChildren([indexRoute, wired])]),
     ]),
     history: createMemoryHistory({
-      initialEntries: [`/settings/connected-accounts/${APP}${search}`],
+      initialEntries: [`/connections/${APP}${search}`],
     }),
   });
   return render(
diff --git a/app/tests/connected-account-landing-param.test.tsx b/app/tests/connected-account-landing-param.test.tsx
index 2d202ab1d1..e6e3bde278 100644
--- a/app/tests/connected-account-landing-param.test.tsx
+++ b/app/tests/connected-account-landing-param.test.tsx
@@ -12,7 +12,7 @@ import {
 import { cleanup, render, waitFor } from "@testing-library/react";
 import type { GrantState } from "@/lib/plugins/grants";
 import type { PluginServer, PluginsPage } from "@/lib/plugins/queries";
-import { Route as ConnectedAccountRoute } from "@/routes/_authed/settings/connected-accounts/$key";
+import { Route as ConnectedAccountRoute } from "@/routes/_authed/_app/connections.$key";
 
 /**
  * `?action=` IS DROPPED FROM THE URL AFTER ITS ONE READ, AND THE GRANT LIST STILL MARKS ITS ROW.
@@ -136,14 +136,14 @@ function renderScreen(search: string) {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/connections/",
+    getParentRoute: () => appRoute,
     component: () => null,
   });
   const wired = (
@@ -151,16 +151,16 @@ function renderScreen(search: string) {
       update: (options: unknown) => typeof ConnectedAccountRoute;
     }
   ).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/connections/$key",
+    path: "/connections/$key",
+    getParentRoute: () => appRoute,
   });
   const router = createRouter({
     routeTree: rootRoute.addChildren([
-      authedRoute.addChildren([settingsRoute.addChildren([indexRoute, wired])]),
+      authedRoute.addChildren([appRoute.addChildren([indexRoute, wired])]),
     ]),
     history: createMemoryHistory({
-      initialEntries: [`/settings/connected-accounts/${APP}${search}`],
+      initialEntries: [`/connections/${APP}${search}`],
     }),
   });
   const view = render(
diff --git a/app/tests/connected-accounts-authorized-notice.test.tsx b/app/tests/connected-accounts-authorized-notice.test.tsx
index e13b5b089f..5e65424336 100644
--- a/app/tests/connected-accounts-authorized-notice.test.tsx
+++ b/app/tests/connected-accounts-authorized-notice.test.tsx
@@ -3,7 +3,7 @@ import {
   AUTHORIZATION_NOTICES,
   authorizationNoticeFor,
   Route,
-} from "@/routes/_authed/settings/connected-accounts/index";
+} from "@/routes/_authed/_app/connections.index";
 
 /**
  * The notice channel the brokered per-action verifier reports back on, decided without drawing
diff --git a/app/tests/connected-accounts-list.test.tsx b/app/tests/connected-accounts-list.test.tsx
index bb1e42f213..8c9fb5cc48 100644
--- a/app/tests/connected-accounts-list.test.tsx
+++ b/app/tests/connected-accounts-list.test.tsx
@@ -1,6 +1,6 @@
 import { expect, test } from "bun:test";
 import type { PluginServer } from "@/lib/plugins/queries";
-import { brokeredAccountsListedOn } from "@/routes/_authed/settings/connected-accounts/index";
+import { brokeredAccountsListedOn } from "@/routes/_authed/_app/connections.index";
 
 /**
  * Which brokered apps the Connected accounts page lists, decided without drawing anything.
diff --git a/app/tests/connected-accounts-oneshot-params.test.tsx b/app/tests/connected-accounts-oneshot-params.test.tsx
index a3b28280e8..a4f1195ecd 100644
--- a/app/tests/connected-accounts-oneshot-params.test.tsx
+++ b/app/tests/connected-accounts-oneshot-params.test.tsx
@@ -11,7 +11,7 @@ import {
 import { cleanup, render, waitFor } from "@testing-library/react";
 import { identityKeys } from "@/lib/identity/queries";
 import { pluginKeys } from "@/lib/plugins/queries";
-import { Route } from "@/routes/_authed/settings/connected-accounts/index";
+import { Route } from "@/routes/_authed/_app/connections.index";
 
 /**
  * EVERY ONE-SHOT PARAMETER THIS SCREEN CONSUMES IS DROPPED FROM THE URL, NOT JUST `?linked=`.
@@ -30,7 +30,7 @@ import { Route } from "@/routes/_authed/settings/connected-accounts/index";
  * satisfied by a screen that says nothing at all.
  */
 
-const PATH = "/settings/connected-accounts";
+const PATH = "/connections";
 
 beforeAll(() => GlobalRegistrator.register());
 afterEach(cleanup);
@@ -50,6 +50,10 @@ function renderScreen(search: string) {
   queryClient.setQueryData(pluginKeys.page(), { servers: [], catalogue: [] });
   queryClient.setQueryData(pluginKeys.connections(), { connections: [] });
   queryClient.setQueryData(identityKeys.links(), []);
+  queryClient.setQueryData(identityKeys.providers(), {
+    slack: false,
+    github: false,
+  });
 
   const root = createRootRoute({ component: () => <Outlet /> });
   const screen = Route.update({
diff --git a/app/tests/connection-rows.test.ts b/app/tests/connection-rows.test.ts
new file mode 100644
index 0000000000..8970196e29
--- /dev/null
+++ b/app/tests/connection-rows.test.ts
@@ -0,0 +1,119 @@
+import { expect, test } from "bun:test";
+import { connectionRows } from "@/lib/connections/rows";
+import type { LinkedAccount } from "@/lib/identity/queries";
+import type { CatalogueItem, PluginServer } from "@/lib/plugins/queries";
+
+/**
+ * The one list on Connections: apps, apps on the organisation's account, and the GitHub and Slack
+ * links, as rows of the same kind, with what is already in use first.
+ */
+
+const drive = {
+  key: "google-drive",
+  title: "Google Drive",
+  summary: "Files in your Drive.",
+  auth: "user-oauth",
+} as CatalogueItem;
+
+const app = (id: string, title: string, provenance = "composio") =>
+  ({
+    id,
+    title,
+    summary: "",
+    logo: null,
+    provenance,
+  }) as unknown as PluginServer;
+
+const link = (
+  provider: "github" | "slack",
+  status: LinkedAccount["status"] = "active",
+): LinkedAccount => ({
+  id: `link-${provider}`,
+  provider,
+  title: provider,
+  handle: "dana",
+  status,
+  createdAt: "2026-10-01T00:00:00Z",
+});
+
+const none = {
+  catalogue: [],
+  brokered: [],
+  shared: [],
+  connected: new Set<string>(),
+  links: [],
+  providers: { github: false, slack: false },
+};
+
+test("apps, team apps and account links are one list, in use first", () => {
+  const rows = connectionRows({
+    ...none,
+    catalogue: [drive],
+    brokered: [app("composio-gmail", "Gmail")],
+    shared: [app("composio-linear", "Linear")],
+    connected: new Set(["composio-gmail"]),
+    providers: { github: true, slack: false },
+  });
+  expect(rows.map((row) => [row.key, row.state])).toEqual([
+    ["composio-gmail", "connected"],
+    ["composio-linear", "team"],
+    ["google-drive", "available"],
+    ["github", "available"],
+  ]);
+});
+
+test("a link this deployment cannot make is not offered", () => {
+  const rows = connectionRows({ ...none });
+  expect(rows).toEqual([]);
+});
+
+test("a link already made is listed even where it can no longer be made, by its handle", () => {
+  const rows = connectionRows({ ...none, links: [link("slack")] });
+  expect(rows).toEqual([
+    expect.objectContaining({
+      key: "slack",
+      state: "connected",
+      summary: "@dana",
+    }),
+  ]);
+});
+
+test("a link the provider stopped accepting asks to be reconnected", () => {
+  const rows = connectionRows({
+    ...none,
+    links: [link("github", "needs_reconnect")],
+  });
+  expect(rows[0]?.state).toBe("needs_reconnect");
+});
+
+test("GitHub is listed once: the Composio GitHub app goes behind GitHub's own page", () => {
+  const brokered = [
+    app("composio-github", "GitHub"),
+    app("composio-gmail", "Gmail"),
+  ];
+  expect(
+    connectionRows({
+      ...none,
+      brokered,
+      providers: { github: true, slack: false },
+    }).map((row) => row.key),
+  ).toEqual(["composio-gmail", "github"]);
+  // Without the GitHub link on offer, the Composio app is the only GitHub there is, so it stays.
+  expect(connectionRows({ ...none, brokered }).map((row) => row.key)).toEqual([
+    "composio-github",
+    "composio-gmail",
+  ]);
+});
+
+test("and the same for Arcade's GitHub app, which is the same vendor through the other broker", () => {
+  expect(
+    connectionRows({
+      ...none,
+      brokered: [
+        app("arcade-github", "GitHub", "arcade"),
+        app("arcade-gmail", "Gmail", "arcade"),
+      ],
+      providers: { github: true, slack: false },
+    }).map((row) => row.key),
+  ).toEqual(["arcade-gmail", "github"]);
+});
diff --git a/app/tests/legacy-agent-routes.test.ts b/app/tests/legacy-agent-routes.test.ts
index 30bb64db07..278119edba 100644
--- a/app/tests/legacy-agent-routes.test.ts
+++ b/app/tests/legacy-agent-routes.test.ts
@@ -28,7 +28,7 @@ test("creating wins over opening, as it did on /agents", () => {
 test("pages that left the sidebar send people to where their contents went", () => {
   expect(LEGACY_PAGES).toEqual({
     "/approvals": "/settings/approvals",
-    "/memory": "/settings/memory",
+    "/memory": "/capabilities/memory",
     "/reachability": "/settings/notifications",
     "/responsibilities": "/bots",
     "/group/new": "/channel/new",
diff --git a/app/tests/plugin-read-failure.test.tsx b/app/tests/plugin-read-failure.test.tsx
index 9a9f062cdd..e08362272b 100644
--- a/app/tests/plugin-read-failure.test.tsx
+++ b/app/tests/plugin-read-failure.test.tsx
@@ -20,7 +20,7 @@ import { cleanup, render, waitFor } from "@testing-library/react";
 import { type PluginsPage, pluginKeys } from "@/lib/plugins/queries";
 import { Route as AdminAppRoute } from "@/routes/_authed/admin/plugins/$key";
 import { Route as AdminToolRoute } from "@/routes/_authed/admin/plugins/$key_.tools.$tool";
-import { Route as ConnectedAccountRoute } from "@/routes/_authed/settings/connected-accounts/$key";
+import { Route as ConnectedAccountRoute } from "@/routes/_authed/_app/connections.$key";
 
 /**
  * A connector's own pages, when `GET /api/plugins` fails.
@@ -166,7 +166,7 @@ function renderAdmin(client: QueryClient, at: string) {
   );
 }
 
-/** `/settings/connected-accounts/$key`, at the id its `useParams` reads. */
+/** `/connections/$key`, at the id its `useParams` reads. */
 function renderAccount(client: QueryClient) {
   const rootRoute = createRootRoute({ component: Outlet });
   const authedRoute = createRoute({
@@ -174,30 +174,38 @@ function renderAccount(client: QueryClient) {
     getParentRoute: () => rootRoute,
     component: Outlet,
   });
-  const settingsRoute = createRoute({
-    path: "/settings",
+  const appRoute = createRoute({
+    id: "/_app",
     getParentRoute: () => authedRoute,
     component: Outlet,
   });
+  const connectionsRoute = createRoute({
+    path: "/connections",
+    getParentRoute: () => appRoute,
+    component: Outlet,
+  });
   const indexRoute = createRoute({
-    path: "/connected-accounts/",
-    getParentRoute: () => settingsRoute,
+    path: "/",
+    getParentRoute: () => connectionsRoute,
     component: () => null,
   });
   const account = (ConnectedAccountRoute as unknown as Updatable).update({
-    id: "/connected-accounts/$key",
-    path: "/connected-accounts/$key",
-    getParentRoute: () => settingsRoute,
+    id: "/$key",
+    path: "/$key",
+    getParentRoute: () => connectionsRoute,
   });
   const tree = rootRoute.addChildren([
     authedRoute.addChildren([
-      settingsRoute.addChildren([indexRoute, account as never]),
+      appRoute.addChildren([
+        connectionsRoute.addChildren([indexRoute, account as never]),
+      ]),
     ]),
   ]);
   const router = createRouter({
     routeTree: tree,
     history: createMemoryHistory({
-      initialEntries: [`/settings/connected-accounts/${APP_KEY}`],
+      // An app's key: `slack` is the Slack link's own page under Connections, which reads no plugins.
+      initialEntries: ["/connections/notion"],
     }),
   });
   return render(
diff --git a/app/tests/shared-connected-accounts.test.tsx b/app/tests/shared-connected-accounts.test.tsx
index f768afa3b1..a50e15438d 100644
--- a/app/tests/shared-connected-accounts.test.tsx
+++ b/app/tests/shared-connected-accounts.test.tsx
@@ -12,12 +12,11 @@ import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { cleanup, render } from "@testing-library/react";
 import { useBrokeredAccount } from "../src/components/plugins/brokered-account-row";
 import type { PluginServer } from "../src/lib/plugins/queries";
-import { brokeredFor } from "../src/routes/_authed/settings/connected-accounts/$key";
+import { brokeredFor } from "../src/routes/_authed/_app/connections.$key";
 import {
   brokeredAccountsListedOn,
-  connectedAccountSections,
   sharedAccountsListedOn,
-} from "../src/routes/_authed/settings/connected-accounts/index";
+} from "../src/routes/_authed/_app/connections.index";
 
 beforeAll(() => GlobalRegistrator.register());
 afterEach(cleanup);
@@ -45,24 +44,6 @@ describe("Settings for a Shared app", () => {
     ]);
   });
 
-  test("a deployment whose apps are all Shared still shows the Shared section", () => {
-    const servers = [server("shared")];
-    expect(connectedAccountSections(0, servers)).toEqual(["empty", "shared"]);
-  });
-
-  test("a personal account list and a Shared section can both draw", () => {
-    const servers = [server("personal"), server("shared")];
-    expect(connectedAccountSections(1, servers)).toEqual([
-      "personal",
-      "shared",
-    ]);
-  });
-
-  test("no Shared apps means no Shared section", () => {
-    const servers = [server("personal")];
-    expect(connectedAccountSections(1, servers)).toEqual(["personal"]);
-  });
-
   test("the account page does not treat a Shared app as the reader's to confirm", () => {
     expect(brokeredFor(server("shared"))).toBe(false);
     expect(brokeredFor(server("personal"))).toBe(true);
diff --git a/app/tests/skills-read-failure.test.tsx b/app/tests/skills-read-failure.test.tsx
index 47d465eda8..2751175a90 100644
--- a/app/tests/skills-read-failure.test.tsx
+++ b/app/tests/skills-read-failure.test.tsx
@@ -20,7 +20,7 @@ import { cleanup, render, waitFor } from "@testing-library/react";
 import type { ComponentType } from "react";
 import { EditSkill } from "@/components/skills/edit-skill";
 import { type PluginsPage, pluginKeys } from "@/lib/plugins/queries";
-import { Route as SkillsRoute } from "@/routes/_authed/_app/skills";
+import { Route as SkillsRoute } from "@/routes/_authed/_app/capabilities.skills";
 import { Route as AdminSkillsRoute } from "@/routes/_authed/admin/skills";
 
 /**
diff --git a/docs/architecture.md b/docs/architecture.md
index fa5c727431..5c8c8546c7 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -317,7 +317,7 @@ Whether a person can use an app through a Bot is answered once, on the server, f
 
 ### Writing a skill in a conversation
 
-A skill can be written from the composer as well as from `/skills`. The deployment ships a skill called `skill-creator` whose instruction is how to interview somebody about the skill they want; a Bot holding it is also offered four tools the app registers — `list_skills`, `read_skill`, `list_skill_tools`, and `save_skill`, which suspends the run on a card showing the command, the title and the whole instruction. Nothing is written until the person presses the button.
+A skill can be written from the composer as well as from `/capabilities/skills`. The deployment ships a skill called `skill-creator` whose instruction is how to interview somebody about the skill they want; a Bot holding it is also offered four tools the app registers — `list_skills`, `read_skill`, `list_skill_tools`, and `save_skill`, which suspends the run on a card showing the command, the title and the whole instruction. Nothing is written until the person presses the button.
 
 The grant is the gate. Those four tools are offered only while the Bot holds `skill-creator`, because four extra tools on every run costs the narrowing above what it exists to buy, and a Bot for looking up transactions has no business drafting skills.
 
diff --git a/docs/configuration.md b/docs/configuration.md
index 79ff05ee35..2f0af4edf3 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -492,10 +492,12 @@ number opted out, later messages show `opted_out` in the delivery history instea
 ## Linked accounts
 
 OpenBot keeps a record of a person's accounts at outside providers, such as their GitHub account
-or their Slack user. They appear under **Linked accounts** on `/settings/connected-accounts`, one
-card per account type: the person's link with a **Disconnect** button, or, where this deployment can
-link that type, a "Not linked" card with **Connect**. The section is hidden when nothing is linked,
-nothing can be linked and nothing failed to load. Disconnecting removes the link and revokes
+or their Slack user. Each provider is a row on `/connections`, beside the apps, listed when the
+person has linked it or this deployment can link it. The row opens the provider's own page
+(`/connections/github`, `/connections/slack`), whose **Your account** section shows the link with a
+**Disconnect** button, or **Connect** where it can be linked. GitHub's page also lists the
+repositories whose events can start a responsibility, and links to a Composio GitHub app where one is
+enabled, which is then left out of the list so GitHub appears once. Disconnecting removes the link and revokes
 OpenBot's stored copy of any token kept with it, and is audited. For GitHub, the grant itself stays
 at GitHub until the person revokes it under GitHub, Settings, Applications.
 
@@ -517,7 +519,7 @@ link is recorded in the audit trail.
 
 Slack is offered only where the OpenTag Slack webhook is set up (the pairing above, so
 `OPENTAG_SHARED_SECRET` must be set) and the server can redeem identity codes. The person clicks
-**Connect** on the Slack card, which shows a message of the form `link <code>`, and sends it to the
+**Connect** on Slack's page, which shows a message of the form `link <code>`, and sends it to the
 OpenBot app in a direct message within ten minutes. A code sent in a channel is refused and stays
 valid until it expires. Teams cannot be linked this way.
 
@@ -530,16 +532,16 @@ GitHub uses a GitHub App. Create one under GitHub Settings, Developer settings,
 - A client secret, generated on the App's page.
 
 Then set `GITHUB_APP_CLIENT_ID` and `GITHUB_APP_CLIENT_SECRET`; set both or neither. People
-then use **Connect** on the GitHub card while signed in to OpenBot in the same browser. The GitHub
+then use **Connect** on GitHub's page while signed in to OpenBot in the same browser. The GitHub
 user token is stored encrypted with the link.
 
-After GitHub, the browser is sent back to `OPENBOT_APP_URL`, else the first `TRUSTED_ORIGINS` entry,
+After GitHub, the browser is sent back to GitHub's page under Connections, at `OPENBOT_APP_URL`, else the first `TRUSTED_ORIGINS` entry,
 else the public URL. Set `OPENBOT_APP_URL` when the app and the server are on different origins, as
 in local development (app on `3010`, server on `3001`); one origin needs nothing.
 
-Reachability codes and Linked accounts codes look alike, and Reachability's are checked first. A
+Reachability codes and account-link codes look alike, and Reachability's are checked first. A
 Reachability `link <code>` binds a conversation for delivery and is not recorded as a linked
-account; a `link <code>` from **Linked accounts** links the Slack user.
+account; a `link <code>` from Slack's page under Connections links the Slack user.
 
 ## Text messages and push notifications
 
diff --git a/docs/plugins/arcade.md b/docs/plugins/arcade.md
index 68c50f5af5..0b4ac3f25d 100644
--- a/docs/plugins/arcade.md
+++ b/docs/plugins/arcade.md
@@ -37,7 +37,7 @@ Setting it up takes three hands, and none of them can do another's:
 | Whoever deploys  | Sets `OPENBOT_BROKER_PROVIDER`, only where both keys are set | The deployment's environment                                      |
 | Whoever deploys  | Registers an OAuth app per provider, and sets the verifier   | Arcade's dashboard, below                                         |
 | An administrator | Enables an app and grants its actions to a Bot               | `/admin/plugins/arcade`, then the app's own page, as for Composio |
-| Each person      | Connects their own account to that app                       | `/settings/connected-accounts`                                    |
+| Each person      | Connects their own account to that app                       | `/connections`                                                    |
 
 The key is an environment variable and nothing else, as Composio's is. No administrator can turn
 Arcade on from a page; `/admin/plugins/arcade` is where a key that is already set gets used.
@@ -118,7 +118,7 @@ followed by the path, so paste:
 ```
 
 It is the API's origin, not the browser app's, where the two differ. A browser that arrives there
-is sent on to the connected-accounts page, with a reason beside it if the consent was refused.
+is sent on to the Connections page, with a reason beside it if the consent was refused.
 
 **Nothing checks this setting, so the deployment warns about it instead.** Arcade has no API that
 reads which verifier a project uses, so this deployment cannot tell a correctly pointed project from
@@ -134,7 +134,7 @@ refuses a consent for any `user_id` that is not a member of the Arcade project 
 deployment sends are its own internal ids, not project members — so in practice **nobody can
 connect**: the person is left on Arcade's
 page with _"the authorization process was not completed"_. A consent that does complete at Arcade
-that way is bound to no attempt; the connected-accounts page may later record it when it asks Arcade
+that way is bound to no attempt; the Connections page may later record it when it asks Arcade
 whether the person is connected, but without the identity check the verify leg exists to make.
 
 > **Do not save the custom-verifier setting without a URL.** It switches off the path that currently
diff --git a/docs/plugins/composio.md b/docs/plugins/composio.md
index 0e5afe5144..97b9a29f10 100644
--- a/docs/plugins/composio.md
+++ b/docs/plugins/composio.md
@@ -15,7 +15,7 @@ Setting it up takes three hands, and none of them can do another's:
 | Whoever deploys  | Sets `COMPOSIO_API_KEY`                                                    | The deployment's environment, or `secrets.composioApiKey` in the Helm chart. There is no screen for it |
 | An administrator | Enables an app                                                             | `/admin/plugins/composio`                                         |
 | An administrator | Grants its actions to a Bot                                                | `/admin/plugins/composio-<slug>`, then that page's per-Bot screen |
-| Each person      | Connects their own account to that app                                     | `/settings/connected-accounts`                                    |
+| Each person      | Connects their own account to that app                                     | `/connections`                                    |
 | An administrator | Chooses Personal or Shared for an app, and connects a Shared app's account | `/admin/plugins/composio-<slug>`                                  |
 | Each person      | Asks for access to an app a Bot needs and only an administrator can fix    | The Bot's page, or the card in a conversation                     |
 | An administrator | Approves or dismisses that request — approving does the change            | `/admin/plugins/composio-<slug>`                                  |
@@ -444,7 +444,7 @@ the deployment's account.
 
 ## What each person does
 
-At `/settings/connected-accounts`, a brokered app appears beside the OAuth connectors once an
+At `/connections`, a brokered app appears beside the OAuth connectors once an
 administrator has enabled it. Open it and press **Connect**. On a consent app — and on one whose
 OAuth client registers itself, which is the same trip from here — that leaves OpenBot for Composio's
 consent screen and returns to the same page, or, for an administrator who started from the app's own
@@ -520,7 +520,7 @@ finds out is refused with a card offering **Reconnect** (below).
 On the Bot's page, Connect opens the app's consent screen in a new tab through the same connect route
 Settings uses, and the row turns ready once the connection is recorded. An app connected with a typed
 key, and Reconnect on a Composio app (whose row has to be disconnected before a new account can be
-attached), go to the app's own page under `/settings/connected-accounts` instead.
+attached), go to the app's own page under `/connections` instead.
 
 ### In a conversation
 
diff --git a/docs/plugins/google-drive.md b/docs/plugins/google-drive.md
index 344760fd76..7f635c8407 100644
--- a/docs/plugins/google-drive.md
+++ b/docs/plugins/google-drive.md
@@ -16,7 +16,7 @@ Setting it up takes two people, and neither can do the other's half:
 | Who               | Does                                                    | Where                                    |
 | ----------------- | ------------------------------------------------------- | ---------------------------------------- |
 | An administrator  | Registers the OAuth client and enables the connector    | Google Cloud console, then `/admin/plugins/google-drive` |
-| Each person       | Consents with their own Google account                  | `/settings/connected-accounts/google-drive`              |
+| Each person       | Consents with their own Google account                  | `/connections/google-drive`              |
 
 There is deliberately no endpoint for an administrator to connect an account on somebody's behalf.
 
@@ -81,7 +81,7 @@ audit row.
 
 ## What each person does
 
-At `/settings/connected-accounts`, Google Drive appears once an administrator has enabled it. Open it
+At `/connections`, Google Drive appears once an administrator has enabled it. Open it
 and press **Connect**. That leaves OpenBot for Google's own consent screen — the arrow on the button
 says so — and returns to the same page, which then reads **Connected** with the scope Google actually
 granted.
@@ -130,7 +130,7 @@ Google client can have the URI registered on the wrong one.
 ### "Google Drive refused this request (401)."
 
 Google will not accept the token at all. Reconnecting the account at
-`/settings/connected-accounts/google-drive` is the usual fix. If it persists, the scopes granted do
+`/connections/google-drive` is the usual fix. If it persists, the scopes granted do
 not cover this connector — check what the **Access** section reports as granted against the
 `drive.readonly` scope this connector asks for.
 
@@ -156,7 +156,7 @@ than about the account.
 ### "You have not connected your Google Drive account."
 
 The Bot was asked to read as somebody with no connection stored. Connect at
-`/settings/connected-accounts/google-drive`. There is no fallback to a deployment-wide credential —
+`/connections/google-drive`. There is no fallback to a deployment-wide credential —
 by design, since a fallback would answer with somebody else's access.
 
 ### The connection worked and stopped about an hour later
diff --git a/docs/plugins/notion.md b/docs/plugins/notion.md
index 44bb133181..d396e0408b 100644
--- a/docs/plugins/notion.md
+++ b/docs/plugins/notion.md
@@ -12,7 +12,7 @@ Setting it up takes two people, and neither can do the other's half:
 | Who               | Does                                       | Where                        |
 | ----------------- | ------------------------------------------- | ----------------------------- |
 | An administrator  | Enables the connector                       | `/admin/plugins/notion`        |
-| Each person       | Consents with their own Notion account      | `/settings/connected-accounts` |
+| Each person       | Consents with their own Notion account      | `/connections` |
 
 There is deliberately no endpoint for an administrator to connect an account on somebody's behalf.
 
@@ -62,7 +62,7 @@ audit row.
 
 ## What each person does
 
-At `/settings/connected-accounts`, Notion appears once an administrator has enabled it. Open it and
+At `/connections`, Notion appears once an administrator has enabled it. Open it and
 press **Connect**. That leaves OpenBot for Notion's own consent screen — the arrow on the button says
 so — where the pages and databases to share are chosen, and returns to the same page, which then
 reads **Connected**.
diff --git a/server/src/delivery/opentag-agent.ts b/server/src/delivery/opentag-agent.ts
index 74f6e246c4..50ee2e7bc3 100644
--- a/server/src/delivery/opentag-agent.ts
+++ b/server/src/delivery/opentag-agent.ts
@@ -93,7 +93,7 @@ export type OpenTagAgentDeps = {
   /** Slack trigger ingest; defaults to the responsibilities lane's `ingestSlackEvent`. */
   ingestSlack?: (event: SlackTriggerEvent) => Promise<unknown>;
   /**
-   * OpenBot linked-account codes (Settings → Connected accounts) from a Slack sender. Reachability
+   * OpenBot linked-account codes (Connections) from a Slack sender. Reachability
    * codes are checked first; this is used for any code that is not a live one (an expired or used
    * Reachability code falls through too, matches no account code, and gets the usual expired reply).
    * An account code is redeemed only in a direct message. One posted in a shared conversation is
@@ -428,7 +428,7 @@ async function link(
     });
     if (outcome === "linked")
       return {
-        text: "Linked your Slack account to OpenBot. You can see it under Settings → Connected accounts.",
+        text: "Linked your Slack account to OpenBot. You can see it under Connections.",
       };
     if (outcome === "conflict")
       return {
diff --git a/server/src/identity/github-callback.ts b/server/src/identity/github-callback.ts
index f830434297..3318f66b80 100644
--- a/server/src/identity/github-callback.ts
+++ b/server/src/identity/github-callback.ts
@@ -51,7 +51,7 @@ function logFailed(stage: string, error: unknown): void {
 /**
  * Finishes linking a GitHub account when GitHub sends the person back.
  *
- * Every exit this router reaches is a redirect to the connected-accounts page, `?linked=github`,
+ * Every exit this router reaches is a redirect to GitHub's page under Connections, `?linked=github`,
  * `?linked=github-taken` (the account is already linked to another person) or `?linked=failed`. A request with no session never gets here: requireUser answers it with a 401
  * first. Each failed exit logs one line saying which refusal or stage it was; nothing the vendor
  * or the request carried (code, tokens, secret, state, account or session ids) is logged or returned.
@@ -60,7 +60,7 @@ export function githubCallbackRoutes(
   deps: GithubCallbackDeps,
 ): Hono<{ Variables: AppVariables }> {
   const routes = new Hono<{ Variables: AppVariables }>();
-  const base = `${(deps.appUrl ?? "").replace(/\/+$/, "")}/settings/connected-accounts?linked=`;
+  const base = `${(deps.appUrl ?? "").replace(/\/+$/, "")}/connections/github?linked=`;
   const now = deps.now ?? (() => new Date());
 
   routes.get("/", async (context) => {
diff --git a/server/src/memory/ingestion.ts b/server/src/memory/ingestion.ts
index 2ad0cf932d..99647e3da3 100644
--- a/server/src/memory/ingestion.ts
+++ b/server/src/memory/ingestion.ts
@@ -306,9 +306,9 @@ export function createMemoryIngestion(options: {
       case "shared":
         return `The shared ${prompt.title} account is not connected. An administrator has to connect it before this source can sync.`;
       case "reconnect":
-        return `Your ${prompt.title} account needs reconnecting. Reconnect it under Settings, Connected accounts, then sync again.`;
+        return `Your ${prompt.title} account needs reconnecting. Reconnect it under Connections, then sync again.`;
       default:
-        return `Your ${prompt.title} account is not connected. Connect it under Settings, Connected accounts, then sync again.`;
+        return `Your ${prompt.title} account is not connected. Connect it under Connections, then sync again.`;
     }
   }
 
diff --git a/server/src/plugins/arcade.ts b/server/src/plugins/arcade.ts
index 009786c7e8..0a42d3a71a 100644
--- a/server/src/plugins/arcade.ts
+++ b/server/src/plugins/arcade.ts
@@ -661,7 +661,7 @@ export async function callTool(
     });
     if (answer.output?.authorization) {
       return failureResult(
-        `${toolName} has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.`,
+        `${toolName} has not been authorized on this account yet. Authorize it in Connections and ask again.`,
       );
     }
     if (answer.success === false || answer.output?.error) {
@@ -685,7 +685,7 @@ export async function callTool(
     const failure = arcadeFailure(thrown);
     if (failure && isAuthorizationRequired(failure)) {
       return failureResult(
-        `${toolName} has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.`,
+        `${toolName} has not been authorized on this account yet. Authorize it in Connections and ask again.`,
       );
     }
     return failureResult(`Arcade could not run ${toolName}.`);
diff --git a/server/src/plugins/oauth.ts b/server/src/plugins/oauth.ts
index c11c4e978b..570a487f61 100644
--- a/server/src/plugins/oauth.ts
+++ b/server/src/plugins/oauth.ts
@@ -132,7 +132,7 @@ export function connectedAccountsUrlFor(
     }
   }
 
-  const base = `${origin}/settings/connected-accounts`;
+  const base = `${origin}/connections`;
 
   /*
    * Success returns to the account, not the list.
diff --git a/server/tests/arcade-adapter.test.ts b/server/tests/arcade-adapter.test.ts
index d5ffb699ce..c8c3df8c80 100644
--- a/server/tests/arcade-adapter.test.ts
+++ b/server/tests/arcade-adapter.test.ts
@@ -121,7 +121,7 @@ describe("createArcadeClient", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.text).toBe(
-      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.",
+      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Connections and ask again.",
     );
   });
 
diff --git a/server/tests/arcade-errors.test.ts b/server/tests/arcade-errors.test.ts
index d986c592be..e2759d5d10 100644
--- a/server/tests/arcade-errors.test.ts
+++ b/server/tests/arcade-errors.test.ts
@@ -64,7 +64,7 @@ describe("callTool failures", () => {
     const result = await callTool(connection, "Gmail.SendEmail", {});
     expect(result.isError).toBe(true);
     expect(result.text).toBe(
-      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.",
+      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Connections and ask again.",
     );
     expect(result.text).not.toContain("http");
     expect(result.text).not.toContain("SECRET");
@@ -153,7 +153,7 @@ describe("callTool successes", () => {
     expect(result.text).not.toContain("SECRET");
     expect(result.text).not.toContain("LEAKME");
     expect(result.text).toBe(
-      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.",
+      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Connections and ask again.",
     );
     expect(result.isError).toBe(true);
   });
diff --git a/server/tests/arcade-journey.integration.test.ts b/server/tests/arcade-journey.integration.test.ts
index 37b41c8ce7..9955e0f1de 100644
--- a/server/tests/arcade-journey.integration.test.ts
+++ b/server/tests/arcade-journey.integration.test.ts
@@ -858,7 +858,7 @@ describe("an Arcade deployment, from the picker to the disconnect", () => {
     // STILL ONE MINT. A second one here would mean the return leg was verifying somebody else's.
     expect(authorizeCalls).toEqual([{ tool_name: SEND, user_id: ADMIN }]);
     expect(response?.headers.get("location")).toBe(
-      `${APP_URL}/settings/connected-accounts/${MAIL_ROW}?action=${encodeURIComponent(SEND)}`,
+      `${APP_URL}/connections/${MAIL_ROW}?action=${encodeURIComponent(SEND)}`,
     );
 
     const connections = await connectionsOf(MAIL);
@@ -1063,7 +1063,7 @@ describe("two separately-shared apps", () => {
        * given.
        */
       expect(response.headers.get("location")).toBe(
-        `${APP_URL}/settings/connected-accounts/${rowId}?action=${encodeURIComponent(actionName)}`,
+        `${APP_URL}/connections/${rowId}?action=${encodeURIComponent(actionName)}`,
       );
 
       const connections = await connectionsOf(app);
diff --git a/server/tests/arcade-live.test.ts b/server/tests/arcade-live.test.ts
index 15d0978b79..1c16e04001 100644
--- a/server/tests/arcade-live.test.ts
+++ b/server/tests/arcade-live.test.ts
@@ -309,7 +309,7 @@ describe.skipIf(!live)("Arcade, for real", () => {
       const client = arcade();
       const action = need(run.action, "no action was chosen");
       const values = [
-        "https://app.example.com/settings/connected-accounts",
+        "https://app.example.com/connections",
         `http://localhost:${PORT}/`,
         "https://cloud.arcade.dev",
         "http://localhost:3000/",
diff --git a/server/tests/arcade-vendor-error-engine.test.ts b/server/tests/arcade-vendor-error-engine.test.ts
index a7026414a4..c576be4352 100644
--- a/server/tests/arcade-vendor-error-engine.test.ts
+++ b/server/tests/arcade-vendor-error-engine.test.ts
@@ -209,7 +209,7 @@ describe("a refusal from Arcade is an Error this deployment wrote", () => {
     );
     expect(result.isError).toBe(true);
     expect(result.text).toBe(
-      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Settings → Connected accounts and ask again.",
+      "Gmail.SendEmail has not been authorized on this account yet. Authorize it in Connections and ask again.",
     );
     // AND THE VENDOR'S WORDS ARE NOT IN WHAT A MODEL IS HANDED.
     expect(result.text).not.toContain(BEARER);
diff --git a/server/tests/arcade-verify.test.ts b/server/tests/arcade-verify.test.ts
index 667b499e80..22cbd7ac76 100644
--- a/server/tests/arcade-verify.test.ts
+++ b/server/tests/arcade-verify.test.ts
@@ -287,10 +287,10 @@ function verify(
 
 /** Where a refusal lands: the LIST, with the reason as an opaque code and no sentence. */
 const refusedTo = (reason: string) =>
-  `${APP_URL}/settings/connected-accounts?authorized=${reason}`;
+  `${APP_URL}/connections?authorized=${reason}`;
 
 /** Where a completion lands: the app's own page, built from the attempt row's `server_id`. */
-const LANDING = `${APP_URL}/settings/connected-accounts/${APP}?action=${encodeURIComponent(ACTION)}`;
+const LANDING = `${APP_URL}/connections/${APP}?action=${encodeURIComponent(ACTION)}`;
 
 /**
  * A refusal, named by its code and not merely by the fact that something redirected.
diff --git a/server/tests/assertion-shape.test.ts b/server/tests/assertion-shape.test.ts
index d8e055952c..8ab9198f2b 100644
--- a/server/tests/assertion-shape.test.ts
+++ b/server/tests/assertion-shape.test.ts
@@ -835,18 +835,20 @@ const ALLOW: Allowed[] = [
   },
   {
     file: "server/tests/composio-adapter.test.ts",
-    // Moved from 5412 by OB-05, which added fifteen lines of tests above it; the offence is the same
-    // one and is re-keyed rather than re-found.
-    line: 5427,
+    // Moved from 5412 by OB-05, which added fifteen lines of tests above it, then back three by the
+    // Plugins screen, which shortened a test above it; the offence is the same one and is re-keyed
+    // rather than re-found.
+    line: 5424,
     shape: "c",
     finding: "NEW (round 2 did not find this)",
     why: 'expect( await actions.listActions("gmail", { limit: WHOLE_LISTING }), ).toEqual([ { slug: "GMAIL_FETCH_EMAILS"',
   },
   {
     file: "server/tests/composio-adapter.test.ts",
-    // Moved from 5458 by OB-05, which added fifteen lines of tests above it; the offence is the same
-    // one and is re-keyed rather than re-found.
-    line: 5473,
+    // Moved from 5458 by OB-05, which added fifteen lines of tests above it, then back three by the
+    // Plugins screen, which shortened a test above it; the offence is the same one and is re-keyed
+    // rather than re-found.
+    line: 5470,
     shape: "c",
     finding: "NEW (round 2 did not find this)",
     why: 'expect( await actions.listActions("gmail", { limit: WHOLE_LISTING }), ).toEqual([ { slug: "GMAIL_FETCH_EMAILS"',
diff --git a/server/tests/broker-return-url-voice.test.ts b/server/tests/broker-return-url-voice.test.ts
index c60fc808a0..56162f15dc 100644
--- a/server/tests/broker-return-url-voice.test.ts
+++ b/server/tests/broker-return-url-voice.test.ts
@@ -91,14 +91,13 @@ describe("brokerReturnUrl, as an operator reads it", () => {
   });
 
   test("neither sentence quotes the address it refused", () => {
-    const address =
-      "openbot-tenant-42.internal.corp/settings/connected-accounts/9f3c";
+    const address = "openbot-tenant-42.internal.corp/connections/9f3c";
     const error = refusalOf(address, "arcade");
 
     for (const sentence of [error.message, error.operatorMessage]) {
       expect(sentence).not.toContain(address);
       expect(sentence).not.toContain("openbot-tenant-42.internal.corp");
-      expect(sentence).not.toContain("/settings/connected-accounts/9f3c");
+      expect(sentence).not.toContain("/connections/9f3c");
     }
   });
 });
diff --git a/server/tests/composio-adapter.test.ts b/server/tests/composio-adapter.test.ts
index 8649330dbf..4d3992f3c3 100644
--- a/server/tests/composio-adapter.test.ts
+++ b/server/tests/composio-adapter.test.ts
@@ -142,7 +142,7 @@ const WHOLE_LISTING = 1000;
 const PAGES_BEFORE_REFUSING = 200;
 
 /** The page this deployment sends somebody back to once the consent screen is done with them. */
-const RETURN_URL = "https://openbot.test/settings/connected-accounts/x";
+const RETURN_URL = "https://openbot.test/connections/x";
 
 /**
  * What Composio answers a withdrawal it actually performed, returned by every double that performs
@@ -1121,8 +1121,7 @@ describe("beginning one person's connection", () => {
         vendorUserId: VENDOR_USER,
       },
       toolkit: "linear",
-      returnUrl:
-        "https://openbot.test/settings/connected-accounts/composio-linear",
+      returnUrl: "https://openbot.test/connections/composio-linear",
     });
 
     // The config this deployment already holds for the app — and no `authConfigs.create`, which
@@ -1136,8 +1135,7 @@ describe("beginning one person's connection", () => {
         VENDOR_USER,
         "ac_this_deployments",
         {
-          callbackUrl:
-            "https://openbot.test/settings/connected-accounts/composio-linear",
+          callbackUrl: "https://openbot.test/connections/composio-linear",
         },
       ],
     ]);
@@ -1176,8 +1174,7 @@ describe("beginning one person's connection", () => {
         vendorUserId: VENDOR_USER,
       },
       toolkit: "linear",
-      returnUrl:
-        "https://openbot.test/settings/connected-accounts/composio-linear",
+      returnUrl: "https://openbot.test/connections/composio-linear",
     });
 
     const refusal = await failureOf(refused);
@@ -1240,7 +1237,7 @@ describe("telling this deployment's auth configs from anybody else's", () => {
         vendorUserId: VENDOR_USER,
       },
       toolkit: "linear",
-      returnUrl: "https://openbot.test/settings/connected-accounts/x",
+      returnUrl: "https://openbot.test/connections/x",
     });
 
     // A connection is a lasting attachment to whatever config it was made against: scopes, tool
@@ -1250,7 +1247,7 @@ describe("telling this deployment's auth configs from anybody else's", () => {
       [
         VENDOR_USER,
         "ac_ours",
-        { callbackUrl: "https://openbot.test/settings/connected-accounts/x" },
+        { callbackUrl: "https://openbot.test/connections/x" },
       ],
     ]);
   });
@@ -1278,7 +1275,7 @@ describe("telling this deployment's auth configs from anybody else's", () => {
         vendorUserId: VENDOR_USER,
       },
       toolkit: "linear",
-      returnUrl: "https://openbot.test/settings/connected-accounts/x",
+      returnUrl: "https://openbot.test/connections/x",
     });
 
     const refusal = await failureOf(refused);
@@ -1789,7 +1786,7 @@ describe("telling this deployment's auth configs from anybody else's", () => {
         vendorUserId: VENDOR_USER,
       },
       toolkit: "linear",
-      returnUrl: "https://openbot.test/settings/connected-accounts/x",
+      returnUrl: "https://openbot.test/connections/x",
     });
 
     // Sending somebody to consent against a disabled config spends their consent and attaches
@@ -3054,7 +3051,7 @@ describe("refusals a route can tell from an outage", () => {
           vendorUserId: VENDOR_USER,
         },
         toolkit: "linear",
-        returnUrl: "https://openbot.test/settings/connected-accounts/x",
+        returnUrl: "https://openbot.test/connections/x",
       })
       .catch((raised: unknown) => raised);
 
@@ -3089,7 +3086,7 @@ describe("refusals a route can tell from an outage", () => {
           vendorUserId: VENDOR_USER,
         },
         toolkit: "linear",
-        returnUrl: "https://openbot.test/settings/connected-accounts/x",
+        returnUrl: "https://openbot.test/connections/x",
       })
       .catch((raised: unknown) => raised);
 
diff --git a/server/tests/composio-broker-seam.test.ts b/server/tests/composio-broker-seam.test.ts
index b06d1f3673..f5a239bb66 100644
--- a/server/tests/composio-broker-seam.test.ts
+++ b/server/tests/composio-broker-seam.test.ts
@@ -64,9 +64,9 @@ describe("brokerReturnUrl", () => {
 
   test("refuses an address no browser could come back through", () => {
     for (const unusable of [
-      "openbot.example.com/settings/connected-accounts/x",
-      "localhost:3001/settings/connected-accounts/x",
-      "/settings/connected-accounts/x",
+      "openbot.example.com/connections/x",
+      "localhost:3001/connections/x",
+      "/connections/x",
       "javascript:alert(1)",
     ]) {
       expect(() => brokerReturnUrl(unusable, "composio")).toThrow(
@@ -98,8 +98,7 @@ describe("brokerReturnUrl", () => {
    * an operator is still given it lives on `operatorMessage` in the voice test.
    */
   test("never quotes the address it refused", () => {
-    const address =
-      "openbot-tenant-42.internal.corp/settings/connected-accounts/9f3c";
+    const address = "openbot-tenant-42.internal.corp/connections/9f3c";
 
     let thrown: unknown;
     try {
@@ -112,16 +111,13 @@ describe("brokerReturnUrl", () => {
     expect(sentence).not.toBeNull();
     expect(sentence).not.toContain(address);
     expect(sentence).not.toContain("openbot-tenant-42.internal.corp");
-    expect(sentence).not.toContain("/settings/connected-accounts/9f3c");
+    expect(sentence).not.toContain("/connections/9f3c");
   });
 
   test("hands back the address a configured deployment built", () => {
     expect(
-      brokerReturnUrl(
-        "https://openbot.test/settings/connected-accounts/x",
-        "composio",
-      ),
-    ).toBe("https://openbot.test/settings/connected-accounts/x");
+      brokerReturnUrl("https://openbot.test/connections/x", "composio"),
+    ).toBe("https://openbot.test/connections/x");
     expect(
       brokerReturnUrl("http://localhost:3001/admin/plugins/x", "composio"),
     ).toBe("http://localhost:3001/admin/plugins/x");
@@ -144,15 +140,15 @@ describe("brokerReturnUrl", () => {
    * trimmed would pass the first half of this table and strand somebody on the second.
    */
   test("hands back the address it checked rather than the padding around it", () => {
-    const intended = "https://openbot.test/settings/connected-accounts/x";
+    const intended = "https://openbot.test/connections/x";
 
     for (const disguised of [
-      " https://openbot.test/settings/connected-accounts/x",
-      "https://openbot.test/settings/connected-accounts/x\n",
-      "\thttps://openbot.test/settings/connected-accounts/x ",
-      "https://openbot\n.test/settings/connected-accounts/x",
-      "https://openbot.test/settings/\tconnected-accounts/x",
-      "https://openbot.test/settings\r/connected-accounts/x",
+      " https://openbot.test/connections/x",
+      "https://openbot.test/connections/x\n",
+      "\thttps://openbot.test/connections/x ",
+      "https://openbot\n.test/connections/x",
+      "https://openbot.test/conn\tections/x",
+      "https://openbot.test/connections\r/x",
     ]) {
       expect(brokerReturnUrl(disguised, "composio")).toBe(intended);
     }
@@ -214,7 +210,7 @@ describe("grantIsLocal", () => {
         .authorize({
           account: { holder: "person", userId: "u", vendorUserId: "u" },
           toolkit: "linear",
-          returnUrl: "https://openbot.test/settings/connected-accounts/x",
+          returnUrl: "https://openbot.test/connections/x",
           action: "LINEAR_CREATE_ISSUE",
         })
         .then(
diff --git a/server/tests/delivery-routes.test.ts b/server/tests/delivery-routes.test.ts
index ef331e39a1..3602a981fe 100644
--- a/server/tests/delivery-routes.test.ts
+++ b/server/tests/delivery-routes.test.ts
@@ -287,7 +287,7 @@ test("an identity code from a Slack sender is redeemed through the adapter", asy
     ...linkMessage(IDENTITY_CODE),
   });
   expect(said(result.events)).toBe(
-    "Linked your Slack account to OpenBot. You can see it under Settings → Connected accounts.",
+    "Linked your Slack account to OpenBot. You can see it under Connections.",
   );
   expect(redeemed).toEqual([[IDENTITY_CODE, { teamId: "T1", userId: "U1" }]]);
 });
diff --git a/server/tests/identity-app-wiring.test.ts b/server/tests/identity-app-wiring.test.ts
index 29cc10029b..8064d7152e 100644
--- a/server/tests/identity-app-wiring.test.ts
+++ b/server/tests/identity-app-wiring.test.ts
@@ -188,7 +188,7 @@ test("the GitHub callback is reachable with a session and redirects to the app",
   );
   expect(response.status).toBe(302);
   expect(response.headers.get("location")).toBe(
-    "https://app.test/settings/connected-accounts?linked=failed",
+    "https://app.test/connections/github?linked=failed",
   );
   expect(fetchImpl).not.toHaveBeenCalled();
 });
@@ -239,7 +239,7 @@ test("the signed-in person's session reaches the callback and completes the link
   );
   expect(response.status).toBe(302);
   expect(response.headers.get("location")).toBe(
-    "https://app.test/settings/connected-accounts?linked=github",
+    "https://app.test/connections/github?linked=github",
   );
   expect(fetchImpl).toHaveBeenCalledTimes(2);
   expect(linkVerified).toHaveBeenCalledTimes(1);
@@ -258,7 +258,7 @@ test("a session for a different person than the state's fails and never reaches
   );
   expect(response.status).toBe(302);
   expect(response.headers.get("location")).toBe(
-    "https://app.test/settings/connected-accounts?linked=failed",
+    "https://app.test/connections/github?linked=failed",
   );
   expect(fetchImpl).not.toHaveBeenCalled();
   expect(linkVerified).not.toHaveBeenCalled();
diff --git a/server/tests/identity-github-callback.integration.test.ts b/server/tests/identity-github-callback.integration.test.ts
index 2383fcdd73..4a85763ab4 100644
--- a/server/tests/identity-github-callback.integration.test.ts
+++ b/server/tests/identity-github-callback.integration.test.ts
@@ -12,10 +12,9 @@ import { createIdentityStore } from "../src/identity/store";
 import { TEST_POOL, testDatabaseUrl } from "./support/database";
 
 const encryptionKey = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-const OK = "https://app.test/settings/connected-accounts?linked=github";
-const FAILED = "https://app.test/settings/connected-accounts?linked=failed";
-const TAKEN =
-  "https://app.test/settings/connected-accounts?linked=github-taken";
+const OK = "https://app.test/connections/github?linked=github";
+const FAILED = "https://app.test/connections/github?linked=failed";
+const TAKEN = "https://app.test/connections/github?linked=github-taken";
 
 const database = createDatabase(testDatabaseUrl(), TEST_POOL);
 const vault = createCredentialStore(database);
diff --git a/server/tests/identity-github-callback.test.ts b/server/tests/identity-github-callback.test.ts
index 58514ac557..29fe6e7fee 100644
--- a/server/tests/identity-github-callback.test.ts
+++ b/server/tests/identity-github-callback.test.ts
@@ -11,10 +11,9 @@ import { IdentityConflictError } from "../src/identity/types";
 const key = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
 const now = new Date("2026-01-01T00:00:00.000Z");
 const clientSecret = "client-secret-value";
-const OK = "https://app.test/settings/connected-accounts?linked=github";
-const FAILED = "https://app.test/settings/connected-accounts?linked=failed";
-const TAKEN =
-  "https://app.test/settings/connected-accounts?linked=github-taken";
+const OK = "https://app.test/connections/github?linked=github";
+const FAILED = "https://app.test/connections/github?linked=failed";
+const TAKEN = "https://app.test/connections/github?linked=github-taken";
 
 type Harness = ReturnType<typeof build>;
 
diff --git a/server/tests/memory-store.integration.test.ts b/server/tests/memory-store.integration.test.ts
index efa8acb632..1309714dee 100644
--- a/server/tests/memory-store.integration.test.ts
+++ b/server/tests/memory-store.integration.test.ts
@@ -274,7 +274,7 @@ test("a refusal carrying an app card is said for the sources page, not stored ra
     );
     const { syncError } = await store.getSource(owner, value.id);
     expect(syncError).toBe(
-      "Your Docs account needs reconnecting. Reconnect it under Settings, Connected accounts, then sync again.",
+      "Your Docs account needs reconnecting. Reconnect it under Connections, then sync again.",
     );
     expect(syncError).not.toContain("[connect-app]");
   } finally {
diff --git a/server/tests/plugin-oauth-callback.test.ts b/server/tests/plugin-oauth-callback.test.ts
index 8f3da276fd..ca6c96acc4 100644
--- a/server/tests/plugin-oauth-callback.test.ts
+++ b/server/tests/plugin-oauth-callback.test.ts
@@ -26,8 +26,7 @@ const KEY = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
 
 const CALLBACK = "http://t/api/plugins/oauth/callback";
 
-const FAILED =
-  "https://app.example/settings/connected-accounts?connected=failed";
+const FAILED = "https://app.example/connections?connected=failed";
 
 function signedIn(): MiddlewareHandler<{ Variables: AppVariables }> {
   return async (context, next) => {
@@ -133,7 +132,7 @@ describe("a consent that came back the way it left", () => {
     const asked = await withWillingVendor(async (asked) => {
       const response = await hono.request(callbackUrl(state));
       expect(response.headers.get("location")).toBe(
-        "https://app.example/settings/connected-accounts/notion",
+        "https://app.example/connections/notion",
       );
       return asked;
     });
diff --git a/server/tests/plugin-oauth.test.ts b/server/tests/plugin-oauth.test.ts
index ba13c4a08d..58e7a2a53a 100644
--- a/server/tests/plugin-oauth.test.ts
+++ b/server/tests/plugin-oauth.test.ts
@@ -382,7 +382,7 @@ describe("where the callback sends somebody afterwards", () => {
       connectedAccountsUrlFor("http://localhost:3010", {
         serverId: "google-drive",
       }),
-    ).toBe("http://localhost:3010/settings/connected-accounts/google-drive");
+    ).toBe("http://localhost:3010/connections/google-drive");
   });
 
   test("success carries no outcome, because the account already says it", () => {
@@ -399,7 +399,7 @@ describe("where the callback sends somebody afterwards", () => {
       connectedAccountsUrlFor("http://localhost:3010", {
         serverId: "../../admin",
       }),
-    ).toBe("http://localhost:3010/settings/connected-accounts/..%2F..%2Fadmin");
+    ).toBe("http://localhost:3010/connections/..%2F..%2Fadmin");
   });
 
   test("failure goes to the list, which is the screen that says so", () => {
@@ -411,9 +411,7 @@ describe("where the callback sends somebody afterwards", () => {
      */
     expect(
       connectedAccountsUrlFor("http://localhost:3010", { failed: true }),
-    ).toBe(
-      "http://localhost:3010/settings/connected-accounts?connected=failed",
-    );
+    ).toBe("http://localhost:3010/connections?connected=failed");
   });
 
   test("still points somewhere when no app URL is configured", () => {
@@ -421,7 +419,7 @@ describe("where the callback sends somebody afterwards", () => {
     // only case where `appUrl` can be absent and the deployment still works.
     expect(
       connectedAccountsUrlFor(undefined, { serverId: "google-drive" }),
-    ).toBe("/settings/connected-accounts/google-drive");
+    ).toBe("/connections/google-drive");
   });
 
   test("a connect started on the admin page returns to the admin page", () => {
@@ -448,9 +446,7 @@ describe("where the callback sends somebody afterwards", () => {
         { failed: true },
         "admin",
       ),
-    ).toBe(
-      "http://localhost:3010/settings/connected-accounts?connected=failed",
-    );
+    ).toBe("http://localhost:3010/connections?connected=failed");
   });
 });
 
diff --git a/server/tests/plugin-routes.test.ts b/server/tests/plugin-routes.test.ts
index 3a0328e253..846cefece6 100644
--- a/server/tests/plugin-routes.test.ts
+++ b/server/tests/plugin-routes.test.ts
@@ -1524,8 +1524,7 @@ const DEV_ACTOR_ACCOUNT: AccountRef = {
  * assertion rather than a call to `connectedAccountsUrlFor`, because an assertion that builds the
  * expected value the way the code does cannot fail when the code's answer changes.
  */
-const RETURN_URL =
-  "http://localhost:3001/settings/connected-accounts/composio-linear";
+const RETURN_URL = "http://localhost:3001/connections/composio-linear";
 const ADMIN_RETURN_URL = "http://localhost:3001/admin/plugins/composio-linear";
 
 /**
diff --git a/server/tests/sole-definition.test.ts b/server/tests/sole-definition.test.ts
index 14f73724e5..47605bab3b 100644
--- a/server/tests/sole-definition.test.ts
+++ b/server/tests/sole-definition.test.ts
@@ -166,7 +166,7 @@ const KNOWN_DUPLICATES: Record<
     why: "One predicate for the app and one for the server, plus the same two-arm literal open-coded as `isBrokered` on the connected-accounts page; collapsing them is a cross-package move the fix cycle owns.",
     sites: [
       "app/src/lib/plugins/provider-vocabulary.ts",
-      "app/src/routes/_authed/settings/connected-accounts/index.tsx",
+      "app/src/routes/_authed/_app/connections.index.tsx",
       "server/src/plugins/access.ts",
     ],
   },
diff --git a/server/tests/test-network-guard.test.ts b/server/tests/test-network-guard.test.ts
index c17e9640d9..339e5a56d7 100644
--- a/server/tests/test-network-guard.test.ts
+++ b/server/tests/test-network-guard.test.ts
@@ -433,7 +433,7 @@ test("the test network guard is in force for a vendor SDK that binds its own tra
     broker.authorize({
       account: { holder: "person", userId: "u", vendorUserId: "u" },
       toolkit: "linear",
-      returnUrl: "https://openbot.test/settings/connected-accounts/x",
+      returnUrl: "https://openbot.test/connections/x",
     }),
   );