@@ -0,0 +1,21 @@
+---
+'@objectstack/mcp': patch
+'@objectstack/platform-objects': patch
+'@objectstack/runtime': patch
+'@object-ui/app-shell': patch
+'@object-ui/i18n': patch
+---
+
+feat: put Connect an AI Assistant where each person looks, and call it that
+
+Clause-②: no
+Metadata-protocol: none
+
+The Connect an Agent page is now Connect an AI Assistant (连接 AI 助手, AI アシスタントを接続, Conectar un asistente de IA): the page title, its header and both of its navigation entries, in every shipped language. "Agent" already names the agents an author builds in Studio, and this page connects the AI assistant a person uses, such as Claude, Doubao or Cursor.
+
+Where to find it:
+
+- **Every signed-in person**: the avatar menu has a Connect an AI Assistant item, under Profile. In the Account app the entry has a group of its own, AI Assistant, open by default, instead of sitting inside the collapsed Developer group.
+- **Platform administrators**: in Setup the entry is in the top group, Overview, under System Overview, instead of near the bottom of Integrations. Who sees it does not change: both groups need `manage_platform_settings`.
+
+All three doors appear only where the MCP server is enabled; with `OS_MCP_SERVER_ENABLED=false` the page, both menu entries and the avatar item are absent. The page address (`page/connect_agent`) and the nav item id (`nav_connect_agent`) are unchanged, so bookmarks and links keep working. The stdio start-up refusal and the API-key session refusal name the new page and paths.
@@ -53,7 +53,7 @@ architecture.
 Every deployment serves MCP at `/api/v1/mcp` by default (a core platform
 capability — set `OS_MCP_SERVER_ENABLED=false` to opt out), with two
 authentication tracks: The in-product entry point is the
-**Connect an Agent** page: per-client connect snippets, the portable
+**Connect an AI Assistant** page: per-client connect snippets, the portable
 SKILL.md download (`GET /api/v1/mcp/skill`), and API-key minting.
 
 - **OAuth 2.1 (interactive clients — recommended).** Each deployment is its
 
@@ -13,7 +13,7 @@ about the only thing left to do: **connecting a client and proving it works**.
 <Callout type="info">
 To turn the surface off, set `OS_MCP_SERVER_ENABLED=false` — the endpoint then
 returns 404 to a caller with an API key or token (an anonymous caller still gets
-401 first, with no OAuth metadata advertised), and the **Connect an Agent** page
+401 first, with no OAuth metadata advertised), and the **Connect an AI Assistant** page
 disappears with it, along with both its Setup and Account navigation entries. See
 [environment variables](/docs/deployment/environment-variables#mcp-server).
 </Callout>
@@ -95,7 +95,7 @@ client version offers none, add the request header
 | **Doubao Work** (豆包工作) | Skills · Connectors → New → New custom connector | Name `objectstack`, transport `HTTP`, server URL `<MCP URL>` |
 | **QwenWork** (千问办公) | Extensions → Connectors → + Add → Paste JSON config | `{ "mcpServers": { "objectstack": { "type": "streamable-http", "url": "<MCP URL>" } } }` |
 
-The **Connect an Agent** page renders each of these with your deployment's URL
+The **Connect an AI Assistant** page renders each of these with your deployment's URL
 filled in. A client task that runs in the vendor's cloud, rather than on your
 machine, reaches only a deployment on public HTTPS — the same constraint as
 [claude.ai](#claude-desktop-and-claudeai).
@@ -118,13 +118,14 @@ Clients that read an `mcpServers` map connect the same way. With an API key:
 
 ## Headless: API keys
 
-Mint a key from the **Connect an Agent** page in the Console. One page, two
+Mint a key from the **Connect an AI Assistant** page in the Console. One page, two
 doors — which one you have depends on your permissions:
 
-- **Any signed-in user** — open the avatar menu (top right) → **Profile** to
-  enter the Account app, then **Developer → Connect an Agent** in its sidebar.
+- **Any signed-in user** — open the avatar menu (top right) → **Connect an AI
+  Assistant**. It opens the page in the Account app, whose sidebar lists it
+  under **AI Assistant**.
   Direct link: `/_console/apps/com.objectstack.account/page/connect_agent`.
-- **Platform admins** — **Setup → Connect an Agent**, at
+- **Platform admins** — **Setup → Overview → Connect an AI Assistant**, at
   `/_console/apps/com.objectstack.setup/page/connect_agent`, reached from the
   Setup sidebar. The Setup app requires the `setup.access` permission, so this
   door alone is not enough for an ordinary member; the Account one needs none.
 
@@ -66,9 +66,9 @@ permission model grants anonymous users. Two ways to authenticate:
   `curl -c cookies.txt` / `-b cookies.txt`. On a fresh dev database the seeded
   admin is `admin@objectos.ai` / `admin123`.
 - **API key** (scripts, CI, headless agents): mint one with `POST /api/v1/keys`
-  (the key is shown once), or from the **Connect an Agent** page in the Console
-  — **Account → Developer** for any signed-in user, **Setup → Connect an Agent**
-  for platform admins. Minting needs a signed-in session: a request
+  (the key is shown once), or from the **Connect an AI Assistant** page in the Console
+  — the avatar menu or **Account → AI Assistant** for any signed-in user,
+  **Setup → Overview** for platform admins. Minting needs a signed-in session: a request
   authenticated with an API key is refused `403 PERMISSION_DENIED`, so a key
   cannot mint another key. Send the key as `x-api-key: osk_…` or
   `Authorization: Bearer osk_…`. Keys expire (90 days by default, at most a
 
@@ -292,7 +292,7 @@ OS_MCP_STDIO_ENABLED=true OS_MCP_STDIO_API_KEY=osk_... os start   # start the lo
 |:---|:---|:---|:---|
 | `OS_MCP_SERVER_ENABLED` | boolean | `true` | The MCP **HTTP** surface (`/api/v1/mcp`) is a core capability and defaults **on**. Set `false` to disable it (the endpoint answers 404 to a caller with an API key or token and 401 to an anonymous one, and the Connect-an-Agent page disappears). |
 | `OS_MCP_STDIO_ENABLED` | boolean | `false` | Auto-start the long-lived **stdio** transport at boot. Opt-in and **stricter** than the HTTP surface. **Requires `OS_MCP_STDIO_API_KEY`** — stdio runs as that key's identity with RLS/FLS/tenant applied; if the key is missing or invalid, boot **fails closed** (stdio refuses to start). See ADR-0101. |
-| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from the **Connect an Agent** page — **Account → Developer** for any signed-in user, **Setup → Connect an Agent** for platform admins — or `POST /api/v1/keys`. For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. |
+| `OS_MCP_STDIO_API_KEY` | string | — | The `osk_...` API key the **stdio** transport runs as. Resolved through the same verify chain as the HTTP/REST surfaces, so reads are scoped to that identity's permissions. Mint one from the **Connect an AI Assistant** page — the avatar menu or **Account → AI Assistant** for any signed-in user, **Setup → Overview** for platform admins — or `POST /api/v1/keys`. For full authority, mint a key on a platform-admin or dedicated **service** identity — there is deliberately no `system`/unscoped bypass. |
 | `OS_MCP_SERVER_NAME` | string | `objectstack` | Server name advertised to MCP clients. |
 | `OS_MCP_SERVER_TRANSPORT` | enum | `stdio` | `stdio` \| `http`. Use `http` (Streamable HTTP) for a remote client; `stdio` for a local one. |
 
 
@@ -487,8 +487,9 @@ claude plugin marketplace add objectstack-ai/claude-plugin
 ```
 
 Every client's copy-paste-ready connect snippet — plus the SKILL.md download and
-API-key minting — lives on the **Connect an Agent** page: **Account → Developer**
-for any signed-in user, **Setup → Connect an Agent** for platform admins.
+API-key minting — lives on the **Connect an AI Assistant** page: the avatar menu
+or **Account → AI Assistant** for any signed-in user, **Setup → Overview** for
+platform admins.
 
 For headless callers (CI, scripts), mint an API key instead
 (`POST /api/v1/keys`, shown once) and pass it as a header:
 
@@ -145,7 +145,7 @@ const CLI_ROOT = join(HERE, '..');
 //
 // `account` satisfied both halves all along and was invisible anyway:
 // `@objectstack/mcp` contributes `nav_connect_agent` into
-// `grp_account_developer` (`connect-ui.ts`, #16746) and commit c744c0af3 supplied its
+// `grp_account_ai_assistant` (`connect-ui.ts`, #16746) and commit c744c0af3 supplied its
 // label in all four locales — while this gate printed a BYTE-IDENTICAL
 // `OK (…)` line before and after that landing, because every site below
 // narrowed to one app name. Widening the three obvious filters is NOT the fix:
@@ -407,8 +407,8 @@ const CONTRIBUTORS = [
     source: '@objectstack/mcp (CONNECT_AGENT_UI_BUNDLE)',
     // The one contributor that lands in BOTH apps: `CONNECT_AGENT_UI_BUNDLE`
     // carries two `navigationContributions` entries pointing at one page —
-    // `setup`/`group_integrations` for admins and `account`/
-    // `grp_account_developer` for the per-user half (#16746). The Account half
+    // `setup`/`group_overview` for admins and `account`/
+    // `grp_account_ai_assistant` for the per-user half (#16746). The Account half
     // is the contribution this gate was blind to.
     apps: ['setup', 'account'],
     async load() {
 
@@ -9,7 +9,7 @@
 // promise TOGETHER:
 //
 //   1. a PERMISSIONLESS principal gets `200` on `GET /api/v1/meta/apps/account`
-//      with `nav_connect_agent` present in `grp_account_developer`; and
+//      with `nav_connect_agent` present in `grp_account_ai_assistant`; and
 //   2. that SAME principal still gets `403` / `PERMISSION_DENIED` on
 //      `GET /api/v1/meta/apps/setup`, with `connect_agent` absent from the body.
 //
@@ -215,12 +215,16 @@ describe('#17647 — Connect-an-Agent visibility: BOTH halves, over the wire', (
 
         // `ACCOUNT_APP` declares no `requiredPermissions` — deliberately, so
         // every authenticated user reaches their own security surface — and the
-        // fold puts the contributed entry inside the group that already carries
-        // `nav_account_api_keys`.
+        // fold puts the contributed entry into the AI Assistant slot the app
+        // declares for it (#30895), leaving the collapsed Developer group as
+        // authored.
+        expect(groupChildren(account.body?.item, 'grp_account_ai_assistant'))
+            .toEqual(['nav_connect_agent']);
         expect(groupChildren(account.body?.item, 'grp_account_developer'))
-            .toEqual(['nav_account_api_keys', 'nav_account_oauth_apps', 'nav_connect_agent']);
-        // The whole served tree, counted: 11 authored ids + the one contributed.
-        expect(navIds(account.body?.item)).toHaveLength(12);
+            .toEqual(['nav_account_api_keys', 'nav_account_oauth_apps']);
+        // The whole served tree, counted: 12 authored ids (the AI Assistant
+        // slot among them) + the one contributed.
+        expect(navIds(account.body?.item)).toHaveLength(13);
         // …and the entry's TARGET rode along, so the menu item resolves.
         expect(JSON.stringify(account.body)).toContain('connect_agent');
 
@@ -250,20 +254,23 @@ describe('#17647 — Connect-an-Agent visibility: BOTH halves, over the wire', (
         expect(setupAllowed.body?.error).toBeUndefined();
         const allowedIds = navIds(setupAllowed.body?.item);
         expect(allowedIds).toContain('nav_connect_agent');
-        expect(groupChildren(setupAllowed.body?.item, 'group_integrations'))
-            .toContain('nav_connect_agent');
+        // The top group, behind System Overview (#30895).
+        expect(groupChildren(setupAllowed.body?.item, 'group_overview'))
+            .toEqual(['nav_system_overview', 'nav_connect_agent']);
         // The Setup tree the platform admin is served BY THIS COMPOSITION: 9
-        // authored groups less `group_approvals`, which nothing contributes
-        // into and the filter collapses, plus the 23 entries
-        // `SETUP_NAV_CONTRIBUTIONS` carries, plus the MCP one. (25 until
-        // #25098 moved the unfiltered Packages entry to Studio; 24 until
-        // #30204 removed the Feature Flags entry with its namespace.)
+        // authored groups less `group_approvals` and `group_integrations`,
+        // which nothing in it contributes into and the filter collapses, plus
+        // the 23 entries `SETUP_NAV_CONTRIBUTIONS` carries, plus the MCP one.
+        // (25 until #25098 moved the unfiltered Packages entry to Studio; 24
+        // until #30204 removed the Feature Flags entry with its namespace; 32
+        // until #30895 moved the MCP entry out of `group_integrations`, the
+        // one entry this composition put there.)
         // `nav_settings_branding` is not among them, and not because of a
         // tenancy wall (this harness boots none): since #24766 it is
         // contributed by `@objectstack/service-settings` together with the
         // `branding` namespace, offered only where no organization wall stands,
         // and this harness composes platform-objects and the MCP bundle alone.
-        expect(allowedIds).toHaveLength(32);
+        expect(allowedIds).toHaveLength(31);
         expect(allowedIds).not.toContain('nav_settings_branding');
         // The two per-user stores are reached from the User record page, not
         // from Setup's menu (#23803).
@@ -286,8 +293,8 @@ describe('#17647 — Connect-an-Agent visibility: BOTH halves, over the wire', (
         expect(withAccountHalf.statusCode).toBe(200);
         expect(withoutAccountHalf.statusCode).toBe(200);
         expect(navIds(withAccountHalf.body?.item)).toEqual(navIds(withoutAccountHalf.body?.item));
-        // 32: the composition the count in the test above states.
-        expect(navIds(withAccountHalf.body?.item)).toHaveLength(32);
+        // 31: the composition the count in the test above states.
+        expect(navIds(withAccountHalf.body?.item)).toHaveLength(31);
 
         // The mechanism behind the invariance, asserted rather than assumed:
         // the bundle aims exactly one contribution at `setup` and one at
 
@@ -12,14 +12,13 @@
 //
 //   Webhooks / HTTP Deliveries   `@objectstack/plugin-webhooks`
 //   Datasources                  `@objectstack/service-datasource`
-//   Connect an Agent             `@objectstack/mcp`
 //   Connector Credentials        `@objectstack/service-automation`
 //   Connector Connections        `@objectstack/service-automation` (same contribution)
 //   Cloud Connection             `@objectstack/cloud-connection`
 //
 // Each contributor states the group's other priorities in its own header so
 // that its number sorts where it means to — and nothing held those headers to
-// the code. A later contributor could renumber one of the five and silently
+// the code. A later contributor could renumber one of the four and silently
 // reorder the menu an administrator reads. This file is that hold.
 //
 // ⛔ The priorities are READ from the real contributions, never copied here as
@@ -66,7 +65,6 @@ const GROUP = 'group_integrations';
  */
 const EXPECTED_TIERS: readonly (readonly string[])[] = [
     ['nav_webhooks', 'nav_http_deliveries', 'nav_datasources'],
-    ['nav_connect_agent'],
     // One contribution carries both, in this order (ADR-0143 D5 added the second).
     ['nav_connector_credentials', 'nav_connector_connections'],
     ['nav_cloud_connection'],
@@ -101,6 +99,10 @@ async function setupContributions(): Promise<Array<{ packageId: string; contribu
     const sources: Array<[string, AnyRec[]]> = [
         ['@objectstack/plugin-webhooks', await manifestsRegisteredBy(new WebhookOutboxPlugin({ autoEnqueue: false }))],
         ['@objectstack/service-datasource', await manifestsRegisteredBy(new DatasourceAdminServicePlugin({}) as any)],
+        // Still read although it no longer contributes here: Connect an AI
+        // Assistant sits in `group_overview` (#30895), and the "nothing
+        // contributes into the group that this pin does not order" check below
+        // reds if it moves back.
         ['@objectstack/mcp', [CONNECT_AGENT_UI_BUNDLE as AnyRec]],
         ['@objectstack/service-automation', [CONNECTOR_CREDENTIALS_UI_BUNDLE as AnyRec]],
         ['@objectstack/cloud-connection', [CLOUD_CONNECTION_UI_BUNDLE as AnyRec]],
@@ -126,7 +128,7 @@ function groupChildren(app: AnyRec | undefined, groupId: string): string[] {
 }
 
 describe('Setup → Integrations: the merged order follows each contributor\'s priority', () => {
-    it('serves the five contributors in priority order, read from the contributions themselves', async () => {
+    it('serves the four contributors in priority order, read from the contributions themselves', async () => {
         const contributions = await setupContributions();
 
         // `structuredClone`: `registerApp` writes the `_lock` envelope onto
 
@@ -83,8 +83,9 @@ export const CloudConnectionSettingsPage: Page = {
  * `priority` orders contributions within a group, lowest first. The group's
  * other contributors, read where they are declared: Webhooks / HTTP Deliveries
  * (`@objectstack/plugin-webhooks`) and Datasources
- * (`@objectstack/service-datasource`) at 100, Connect an Agent
- * (`@objectstack/mcp`) at 110 — so 200 sorts this entry last.
+ * (`@objectstack/service-datasource`) at 100, Connector Credentials and
+ * Connector Connections (`@objectstack/service-automation`) at 120 — so 200
+ * sorts this entry last.
  *
  * The group's own `requiredPermissions` (`manage_platform_settings`, on
  * `SETUP_APP` in `@objectstack/platform-objects`) applies to the entry, and