@stigmer/react 0.0.80 → 0.0.82

package/mcp-server/useMcpServerCredentials.js

@@ -1,5 +1,6 @@
 "use client";
-import { useCallback, useMemo } from "react";
+import { useCallback, useMemo, useState } from "react";
+import { VendorApprovalStatus } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
 import { usePersonalEnvironment } from "../environment/usePersonalEnvironment";
 import { diffEnv } from "../environment/diffEnv";
 import { SYSTEM_ENV_VAR_KEYS } from "../environment/systemEnvVars";
@@ -32,9 +33,31 @@ import { useOAuthGrantStatus } from "./useOAuthGrantStatus";
  * ```tsx
  * const creds = useMcpServerCredentials("acme", mcpServer);
  *
- * // OAuth server — sign-in button + optional manual form
+ * // OAuth server — sign-in button + manual override escape hatch
  * if (creds.authMode === "oauth" && !creds.isOAuthConnected) {
- *   return <button onClick={startOAuth}>Sign in</button>;
+ *   if (creds.manualOverride) {
+ *     // User opted to enter the token manually
+ *     return (
+ *       <>
+ *         <EnvVarForm
+ *           variables={creds.missingVariables}
+ *           onSubmit={(values) => creds.saveCredentials(values)}
+ *           isSubmitting={creds.isSaving}
+ *         />
+ *         <button onClick={() => creds.setManualOverride(false)}>
+ *           Sign in with OAuth instead
+ *         </button>
+ *       </>
+ *     );
+ *   }
+ *   return (
+ *     <>
+ *       <button onClick={startOAuth}>Sign in</button>
+ *       <button onClick={() => creds.setManualOverride(true)}>
+ *         Enter token manually
+ *       </button>
+ *     </>
+ *   );
  * }
  *
  * // Manual vars still needed (mixed mode or manual-only)
@@ -52,10 +75,14 @@ import { useOAuthGrantStatus } from "./useOAuthGrantStatus";
  */
 export function useMcpServerCredentials(org, mcpServer) {
     const personalEnv = usePersonalEnvironment(org);
+    const [manualOverride, setManualOverride] = useState(false);
     const auth = mcpServer?.spec?.auth;
     const authMode = auth ? "oauth" : "manual";
     const oauthTargetEnvVar = auth?.targetEnvVar || null;
     const tokenLifetimeHint = auth?.tokenLifetimeHint || null;
+    const isVendorApprovalPending = authMode === "oauth" &&
+        auth?.vendorApprovalStatus === VendorApprovalStatus.PENDING;
+    const vendorApprovalDocsUrl = auth?.vendorApprovalDocsUrl || null;
     const grantStatus = useOAuthGrantStatus(authMode === "oauth" ? (mcpServer?.metadata?.id ?? null) : null, authMode === "oauth" ? org : null);
     const isOAuthConnected = authMode === "oauth" && grantStatus.connected;
     const existingKeys = useMemo(() => new Set(Object.keys(personalEnv.environment?.spec?.data ?? {})), [personalEnv.environment]);
@@ -69,14 +96,14 @@ export function useMcpServerCredentials(org, mcpServer) {
     }, [mcpServer, existingKeys]);
     const requiredMissing = useMemo(() => allMissingVariables.filter((v) => !v.optional), [allMissingVariables]);
     const missingVariables = useMemo(() => {
-        if (!oauthTargetEnvVar)
+        if (!oauthTargetEnvVar || manualOverride)
             return requiredMissing;
         return requiredMissing.filter((v) => v.key !== oauthTargetEnvVar);
-    }, [requiredMissing, oauthTargetEnvVar]);
+    }, [requiredMissing, oauthTargetEnvVar, manualOverride]);
     const isReady = !personalEnv.isLoading &&
         !grantStatus.isLoading &&
         missingVariables.length === 0 &&
-        (authMode === "manual" || isOAuthConnected);
+        (authMode === "manual" || manualOverride || isOAuthConnected);
     const saveCredentials = useCallback(async (values) => {
         await personalEnv.getOrCreate();
         await personalEnv.addVariables(values);
@@ -91,6 +118,8 @@ export function useMcpServerCredentials(org, mcpServer) {
         isOAuthConnected,
         accessTokenExpiresAt: grantStatus.accessTokenExpiresAt,
         tokenLifetimeHint,
+        isVendorApprovalPending,
+        vendorApprovalDocsUrl,
         missingVariables,
         isReady,
         isLoading: personalEnv.isLoading || grantStatus.isLoading,
@@ -98,6 +127,8 @@ export function useMcpServerCredentials(org, mcpServer) {
         saveCredentials,
         isSaving: personalEnv.isMutating,
         refetch,
+        manualOverride,
+        setManualOverride,
     };
 }
 //# sourceMappingURL=useMcpServerCredentials.js.map

package/mcp-server/useMcpServerCredentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMcpServerCredentials.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAG7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAsF5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,SAA2B;IAE3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAEhD,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAsB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,iBAAiB,GAAG,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;IACrD,MAAM,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC;IAE1D,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/D,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EACrE,CAAC,WAAW,CAAC,WAAW,CAAC,CAC1B,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAC5C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE7E,OAAO,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACvC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9B,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACpD,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,IAAI,CAAC,iBAAiB;YAAE,OAAO,eAAe,CAAC;QAC/C,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IACpE,CAAC,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAEzC,MAAM,OAAO,GACX,CAAC,WAAW,CAAC,SAAS;QACtB,CAAC,WAAW,CAAC,SAAS;QACtB,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,CAAC;IAE9C,MAAM,eAAe,GAAG,WAAW,CACjC,KAAK,EAAE,MAAmC,EAAiB,EAAE;QAC3D,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,gBAAgB;QAChB,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,iBAAiB;QACjB,gBAAgB;QAChB,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS;QACzD,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK;QAC7C,eAAe;QACf,QAAQ,EAAE,WAAW,CAAC,UAAU;QAChC,OAAO;KACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useMcpServerCredentials.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerCredentials.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oDAAoD,CAAC;AAC1F,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAmH5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmEG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAkB,EAClB,SAA2B;IAE3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5D,MAAM,IAAI,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAsB,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC9D,MAAM,iBAAiB,GAAG,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC;IACrD,MAAM,iBAAiB,GAAG,IAAI,EAAE,iBAAiB,IAAI,IAAI,CAAC;IAE1D,MAAM,uBAAuB,GAC3B,QAAQ,KAAK,OAAO;QACpB,IAAI,EAAE,oBAAoB,KAAK,oBAAoB,CAAC,OAAO,CAAC;IAC9D,MAAM,qBAAqB,GAAG,IAAI,EAAE,qBAAqB,IAAI,IAAI,CAAC;IAElE,MAAM,WAAW,GAAG,mBAAmB,CACrC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAC/D,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAClC,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,KAAK,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC;IAEvE,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,EACrE,CAAC,WAAW,CAAC,WAAW,CAAC,CAC1B,CAAC;IAEF,MAAM,mBAAmB,GAAG,OAAO,CAAC,GAAG,EAAE;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,EAAE,GAAG,CAAC;QAC5C,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAE7E,OAAO,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CACvC,CAAC;IACJ,CAAC,EAAE,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;IAE9B,MAAM,eAAe,GAAG,OAAO,CAC7B,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EACpD,CAAC,mBAAmB,CAAC,CACtB,CAAC;IAEF,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,EAAE;QACpC,IAAI,CAAC,iBAAiB,IAAI,cAAc;YAAE,OAAO,eAAe,CAAC;QACjE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,iBAAiB,CAAC,CAAC;IACpE,CAAC,EAAE,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;IAEzD,MAAM,OAAO,GACX,CAAC,WAAW,CAAC,SAAS;QACtB,CAAC,WAAW,CAAC,SAAS;QACtB,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,IAAI,gBAAgB,CAAC,CAAC;IAEhE,MAAM,eAAe,GAAG,WAAW,CACjC,KAAK,EAAE,MAAmC,EAAiB,EAAE;QAC3D,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,EACD,CAAC,WAAW,CAAC,CACd,CAAC;IAEF,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE;QAC/B,WAAW,CAAC,OAAO,EAAE,CAAC;QACtB,WAAW,CAAC,OAAO,EAAE,CAAC;IACxB,CAAC,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IAE/B,OAAO;QACL,QAAQ;QACR,iBAAiB;QACjB,gBAAgB;QAChB,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,iBAAiB;QACjB,uBAAuB;QACvB,qBAAqB;QACrB,gBAAgB;QAChB,OAAO;QACP,SAAS,EAAE,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,SAAS;QACzD,KAAK,EAAE,WAAW,CAAC,KAAK,IAAI,WAAW,CAAC,KAAK;QAC7C,eAAe;QACf,QAAQ,EAAE,WAAW,CAAC,UAAU;QAChC,OAAO;QACP,cAAc;QACd,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/mcp-server/useMcpServerOAuthConnect.d.ts

@@ -5,6 +5,13 @@ import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/
  * @internal
  */
 export declare const OAUTH_CALLBACK_MESSAGE_TYPE = "stigmer:oauth:callback";
+/**
+ * BroadcastChannel name used as a fallback when `window.opener` is severed
+ * by `Cross-Origin-Opener-Policy` headers on the OAuth provider.
+ *
+ * @internal
+ */
+export declare const OAUTH_BROADCAST_CHANNEL = "stigmer:oauth:broadcast";
 /**
  * Shape of the `postMessage` payload sent from the OAuth callback popup.
  *
@@ -33,9 +40,11 @@ export interface UseMcpServerOAuthConnectReturn {
      *
      * @param mcpServerId - System-generated ID (metadata.id) of the MCP server.
      * @param org - Organization context for token storage (caller's active org).
+     * @param declaredEnvKeys - Keys from the server's `spec.env` declaration.
+     *   System vars are only injected when declared here.
      * @returns The updated McpServer after tool discovery completes.
      */
-    readonly startOAuth: (mcpServerId: string, org: string) => Promise<McpServer>;
+    readonly startOAuth: (mcpServerId: string, org: string, declaredEnvKeys?: readonly string[]) => Promise<McpServer>;
     /** `true` while any phase of the OAuth flow is in progress. */
     readonly isInProgress: boolean;
     /** Current phase of the OAuth flow. */

package/mcp-server/useMcpServerOAuthConnect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useMcpServerOAuthConnect.d.ts","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerOAuthConnect.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AAUxF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,2BAA2B,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,YAAY,GACZ,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,MAAM,CAAC;AAEX,wDAAwD;AACxD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9E,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,wBAAwB,IAAI,8BAA8B,CAiHzE"}
+{"version":3,"file":"useMcpServerOAuthConnect.d.ts","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerOAuthConnect.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wDAAwD,CAAC;AAUxF;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AAEjE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,OAAO,2BAA2B,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,YAAY,GACZ,mBAAmB,GACnB,YAAY,GACZ,YAAY,GACZ,MAAM,CAAC;AAEX,wDAAwD;AACxD,MAAM,WAAW,8BAA8B;IAC7C;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACnH,+DAA+D;IAC/D,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,uCAAuC;IACvC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC;CACjC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,wBAAwB,IAAI,8BAA8B,CAsHzE"}

package/mcp-server/useMcpServerOAuthConnect.js

@@ -3,7 +3,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { create } from "@bufbuild/protobuf";
 import { InitiateOAuthConnectInputSchema, CompleteOAuthConnectInputSchema, ConnectInputSchema, } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import { useStigmer } from "../hooks";
-import { resolveSystemEnvVarValues } from "../environment/systemEnvVars";
+import { resolveDeclaredSystemEnvVars } from "../environment/systemEnvVars";
 import { toError } from "../internal/toError";
 /**
  * Message type posted by {@link OAuthCallbackHandler} to the opener window.
@@ -11,6 +11,13 @@ import { toError } from "../internal/toError";
  * @internal
  */
 export const OAUTH_CALLBACK_MESSAGE_TYPE = "stigmer:oauth:callback";
+/**
+ * BroadcastChannel name used as a fallback when `window.opener` is severed
+ * by `Cross-Origin-Opener-Policy` headers on the OAuth provider.
+ *
+ * @internal
+ */
+export const OAUTH_BROADCAST_CHANNEL = "stigmer:oauth:broadcast";
 const POPUP_WIDTH = 600;
 const POPUP_HEIGHT = 700;
 const POPUP_CALLBACK_TIMEOUT_MS = 120_000;
@@ -62,7 +69,7 @@ export function useMcpServerOAuthConnect() {
         setPhase("idle");
         setError(null);
     }, []);
-    const startOAuth = useCallback(async (mcpServerId, org) => {
+    const startOAuth = useCallback(async (mcpServerId, org, declaredEnvKeys) => {
         setPhase("initiating");
         setError(null);
         cleanupRef.current?.();
@@ -91,7 +98,9 @@ export function useMcpServerOAuthConnect() {
                 state,
             }));
             setPhase("connecting");
-            const systemEnv = await resolveSystemEnvVarValues(stigmer);
+            const systemEnv = declaredEnvKeys
+                ? await resolveDeclaredSystemEnvVars(stigmer, declaredEnvKeys)
+                : {};
             const runtimeEnvMap = {};
             for (const [key, envInput] of Object.entries(systemEnv)) {
                 runtimeEnvMap[key] = {
@@ -99,10 +108,14 @@ export function useMcpServerOAuthConnect() {
                     isSecret: envInput.isSecret ?? false,
                 };
             }
-            const server = await stigmer.mcpServer.connect(create(ConnectInputSchema, {
+            const input = create(ConnectInputSchema, {
                 mcpServerId,
-                runtimeEnv: runtimeEnvMap,
-            }));
+                org,
+                ...(Object.keys(runtimeEnvMap).length > 0
+                    ? { runtimeEnv: runtimeEnvMap }
+                    : {}),
+            });
+            const server = await stigmer.mcpServer.connect(input);
             setPhase("done");
             return server;
         }
@@ -129,17 +142,29 @@ export function useMcpServerOAuthConnect() {
 // ---------------------------------------------------------------------------
 // Popup callback listener
 // ---------------------------------------------------------------------------
+/**
+ * Grace period (ms) after `popup.closed` is first detected before treating
+ * it as a user-initiated close. COOP providers sever the opener reference
+ * immediately, making `popup.closed` appear `true` while the popup is still
+ * active. The grace period lets the BroadcastChannel callback arrive.
+ */
+const POPUP_CLOSED_GRACE_MS = 5_000;
 function waitForOAuthCallback(popup, expectedState, onDispose) {
     return new Promise((resolve, reject) => {
         let settled = false;
         let timeoutId;
         let pollId;
+        let bc = null;
         function cleanup() {
             if (timeoutId)
                 clearTimeout(timeoutId);
             if (pollId)
                 clearInterval(pollId);
             window.removeEventListener("message", onMessage);
+            try {
+                bc?.close();
+            }
+            catch { /* ignore */ }
         }
         function settle(outcome) {
             if (settled)
@@ -157,10 +182,7 @@ function waitForOAuthCallback(popup, expectedState, onDispose) {
             settle(new Error("OAuth flow was cancelled."));
             closePopup(popup);
         });
-        function onMessage(event) {
-            if (event.origin !== window.location.origin)
-                return;
-            const data = event.data;
+        function validateAndSettle(data) {
             if (data?.type !== OAUTH_CALLBACK_MESSAGE_TYPE)
                 return;
             if (data.state !== expectedState) {
@@ -174,16 +196,43 @@ function waitForOAuthCallback(popup, expectedState, onDispose) {
             }
             settle({ code: data.code, state: data.state });
         }
+        function onMessage(event) {
+            if (event.origin !== window.location.origin)
+                return;
+            validateAndSettle(event.data);
+        }
         window.addEventListener("message", onMessage);
+        // BroadcastChannel — works even when COOP severs window.opener.
+        try {
+            bc = new BroadcastChannel(OAUTH_BROADCAST_CHANNEL);
+            bc.onmessage = (event) => {
+                validateAndSettle(event.data);
+            };
+        }
+        catch {
+            // BroadcastChannel unsupported — rely on postMessage only.
+        }
         timeoutId = setTimeout(() => {
             settle(new Error("OAuth authentication timed out. Ensure your callback page " +
                 "renders <OAuthCallbackHandler /> from @stigmer/react at " +
                 "the URL configured as your OAuth redirect URI."));
             closePopup(popup);
         }, POPUP_CALLBACK_TIMEOUT_MS);
+        // COOP providers make popup.closed appear true immediately after
+        // cross-origin navigation. Wait a grace period before treating it
+        // as a real user-initiated close.
+        let popupClosedAt = null;
         pollId = setInterval(() => {
             if (popup.closed) {
-                settle(new Error("The authentication window was closed before completing sign-in."));
+                if (popupClosedAt === null) {
+                    popupClosedAt = Date.now();
+                }
+                else if (Date.now() - popupClosedAt > POPUP_CLOSED_GRACE_MS) {
+                    settle(new Error("The authentication window was closed before completing sign-in."));
+                }
+            }
+            else {
+                popupClosedAt = null;
             }
         }, 500);
     });

package/mcp-server/useMcpServerOAuthConnect.js.map

@@ -1 +1 @@
-{"version":3,"file":"useMcpServerOAuthConnect.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerOAuthConnect.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAmDpE,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAoB,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAErD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,WAAmB,EAAE,GAAW,EAAsB,EAAE;QAC7D,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,aAAa,EACb,eAAe,EACf,SAAS,WAAW,WAAW,YAAY,SAAS,IAAI,QAAQ,GAAG,YAAY,CAChF,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,iDAAiD;gBAC/C,kDAAkD,CACrD,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;QAED,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAC7D,MAAM,CAAC,+BAA+B,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC;YAEF,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC;YAClD,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAE9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,CAChD,KAAK,EACL,UAAU,CAAC,KAAK,EAChB,CAAC,OAAO,EAAE,EAAE;gBACV,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;YAC/B,CAAC,CACF,CAAC;YAEF,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEvB,MAAM,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAC1C,MAAM,CAAC,+BAA+B,EAAE;gBACtC,WAAW;gBACX,iBAAiB,EAAE,IAAI;gBACvB,KAAK;aACN,CAAC,CACH,CAAC;YAEF,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEvB,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;YAC3D,MAAM,aAAa,GAAyD,EAAE,CAAC;YAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,aAAa,CAAC,GAAG,CAAC,GAAG;oBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,KAAK;iBACrC,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAC5C,MAAM,CAAC,kBAAkB,EAAE;gBACzB,WAAW;gBACX,UAAU,EAAE,aAAa;aAC1B,CAAC,CACH,CAAC;YAEF,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,OAAO,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YACxB,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,OAAO;QACL,UAAU;QACV,YAAY,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;QAClD,KAAK;QACL,KAAK;QACL,UAAU;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,SAAS,oBAAoB,CAC3B,KAAa,EACb,aAAqB,EACrB,SAAwC;IAExC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAwC,CAAC;QAC7C,IAAI,MAAsC,CAAC;QAE3C,SAAS,OAAO;YACd,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;QAED,SAAS,MAAM,CACb,OAAgD;YAEhD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YAC/C,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,SAAS,SAAS,CAAC,KAAmB;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO;YAEpD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAwC,CAAC;YAC5D,IAAI,IAAI,EAAE,IAAI,KAAK,2BAA2B;gBAAE,OAAO;YAEvD,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACjC,MAAM,CACJ,IAAI,KAAK,CACP,wDAAwD;oBACtD,mCAAmC,CACtC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE9C,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,CACJ,IAAI,KAAK,CACP,4DAA4D;gBAC1D,0DAA0D;gBAC1D,gDAAgD,CACnD,CACF,CAAC;YACF,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAE9B,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YACxB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,CAAC;QACH,KAAK,EAAE,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC"}
+{"version":3,"file":"useMcpServerOAuthConnect.js","sourceRoot":"","sources":["../../src/mcp-server/useMcpServerOAuthConnect.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,OAAO,EACL,+BAA+B,EAC/B,+BAA+B,EAC/B,kBAAkB,GACnB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAqDjE,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAoB,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAe,IAAI,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAErD,SAAS,CAAC,GAAG,EAAE;QACb,OAAO,GAAG,EAAE;YACV,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;QAClC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjB,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,UAAU,GAAG,WAAW,CAC5B,KAAK,EAAE,WAAmB,EAAE,GAAW,EAAE,eAAmC,EAAsB,EAAE;QAClG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEf,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAEvB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,aAAa,EACb,eAAe,EACf,SAAS,WAAW,WAAW,YAAY,SAAS,IAAI,QAAQ,GAAG,YAAY,CAChF,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,iDAAiD;gBAC/C,kDAAkD,CACrD,CAAC;YACF,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;QAED,QAAQ,CAAC,OAAO,GAAG,KAAK,CAAC;QAEzB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAC7D,MAAM,CAAC,+BAA+B,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAC9D,CAAC;YAEF,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC;YAClD,QAAQ,CAAC,mBAAmB,CAAC,CAAC;YAE9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,oBAAoB,CAChD,KAAK,EACL,UAAU,CAAC,KAAK,EAChB,CAAC,OAAO,EAAE,EAAE;gBACV,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC;YAC/B,CAAC,CACF,CAAC;YAEF,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEvB,MAAM,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAC1C,MAAM,CAAC,+BAA+B,EAAE;gBACtC,WAAW;gBACX,iBAAiB,EAAE,IAAI;gBACvB,KAAK;aACN,CAAC,CACH,CAAC;YAEF,QAAQ,CAAC,YAAY,CAAC,CAAC;YAEvB,MAAM,SAAS,GAAG,eAAe;gBAC/B,CAAC,CAAC,MAAM,4BAA4B,CAAC,OAAO,EAAE,eAAe,CAAC;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,aAAa,GAAyD,EAAE,CAAC;YAC/E,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxD,aAAa,CAAC,GAAG,CAAC,GAAG;oBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,KAAK;iBACrC,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,CAAC,kBAAkB,EAAE;gBACvC,WAAW;gBACX,GAAG;gBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;oBACvC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE;oBAC/B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAEtD,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClB,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjB,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,MAAM,OAAO,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,OAAO,GAAG,IAAI,CAAC;YACxB,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IAEF,OAAO;QACL,UAAU;QACV,YAAY,EAAE,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;QAClD,KAAK;QACL,KAAK;QACL,UAAU;KACX,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,SAAS,oBAAoB,CAC3B,KAAa,EACb,aAAqB,EACrB,SAAwC;IAExC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,SAAwC,CAAC;QAC7C,IAAI,MAAsC,CAAC;QAC3C,IAAI,EAAE,GAA4B,IAAI,CAAC;QAEvC,SAAS,OAAO;YACd,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,MAAM;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAC,EAAE,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC;QAED,SAAS,MAAM,CACb,OAAgD;YAEhD,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,CAAC;YACV,IAAI,OAAO,YAAY,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,CAAC,CAAC;YAClB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QAED,SAAS,CAAC,GAAG,EAAE;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;YAC/C,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,SAAS,iBAAiB,CAAC,IAAsC;YAC/D,IAAI,IAAI,EAAE,IAAI,KAAK,2BAA2B;gBAAE,OAAO;YAEvD,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACjC,MAAM,CACJ,IAAI,KAAK,CACP,wDAAwD;oBACtD,mCAAmC,CACtC,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC,CAAC;gBAC7E,OAAO;YACT,CAAC;YAED,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,SAAS,SAAS,CAAC,KAAmB;YACpC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAAE,OAAO;YACpD,iBAAiB,CAAC,KAAK,CAAC,IAAwC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAE9C,gEAAgE;QAChE,IAAI,CAAC;YACH,EAAE,GAAG,IAAI,gBAAgB,CAAC,uBAAuB,CAAC,CAAC;YACnD,EAAE,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;gBACrC,iBAAiB,CAAC,KAAK,CAAC,IAAwC,CAAC,CAAC;YACpE,CAAC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,MAAM,CACJ,IAAI,KAAK,CACP,4DAA4D;gBAC1D,0DAA0D;gBAC1D,gDAAgD,CACnD,CACF,CAAC;YACF,UAAU,CAAC,KAAK,CAAC,CAAC;QACpB,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAE9B,iEAAiE;QACjE,kEAAkE;QAClE,kCAAkC;QAClC,IAAI,aAAa,GAAkB,IAAI,CAAC;QAExC,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE;YACxB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;oBAC3B,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC7B,CAAC;qBAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,GAAG,qBAAqB,EAAE,CAAC;oBAC9D,MAAM,CAAC,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,IAAI,CAAC;QACH,KAAK,EAAE,KAAK,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "0.0.80",
+  "version": "0.0.82",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -35,7 +35,7 @@
     }
   },
   "dependencies": {
-    "@stigmer/theme": "0.0.80",
+    "@stigmer/theme": "0.0.82",
     "react-markdown": "^10.1.0",
     "remark-gfm": "^4.0.1",
     "yaml": "^2.8.2"
@@ -43,8 +43,8 @@
   "peerDependencies": {
     "@base-ui/react": "^1.0.0",
     "@bufbuild/protobuf": "^2.0.0",
-    "@stigmer/protos": "0.0.80",
-    "@stigmer/sdk": "0.0.80",
+    "@stigmer/protos": "0.0.82",
+    "@stigmer/sdk": "0.0.82",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   }

package/src/environment/index.ts

@@ -46,4 +46,5 @@ export {
   toGrpcAddress,
   buildSystemEnvVars,
   resolveSystemEnvVarValues,
+  resolveDeclaredSystemEnvVars,
 } from "./systemEnvVars";

package/src/environment/systemEnvVars.ts

@@ -102,3 +102,42 @@ export async function resolveSystemEnvVarValues(
   const credential = await stigmer.getAuthCredential();
   return buildSystemEnvVars(stigmer.baseUrl, credential);
 }
+
+/**
+ * Resolve only the system env vars that the target resource actually
+ * declares in its environment specification.
+ *
+ * System vars (`STIGMER_SERVER_ADDRESS`, `STIGMER_API_KEY`) should
+ * only be injected when the resource needs them — blindly injecting
+ * them causes `runtime_env` to be non-empty on the wire, which
+ * changes the backend's missing-credential tolerance semantics.
+ *
+ * @param stigmer - Live Stigmer client for credential resolution.
+ * @param declaredEnvKeys - The set of env var keys the target
+ *   resource declares (e.g., `Object.keys(mcpServer.spec.env)`).
+ *   Only system vars whose keys appear here are included.
+ * @returns Filtered system env vars (may be empty).
+ */
+export async function resolveDeclaredSystemEnvVars(
+  stigmer: Stigmer,
+  declaredEnvKeys: ReadonlySet<string> | readonly string[],
+): Promise<Record<string, EnvVarInput>> {
+  const keys =
+    declaredEnvKeys instanceof Set
+      ? declaredEnvKeys
+      : new Set(declaredEnvKeys);
+
+  const hasDeclared = [...SYSTEM_ENV_VAR_KEYS].some((k) => keys.has(k));
+  if (!hasDeclared) {
+    return {};
+  }
+
+  const all = await resolveSystemEnvVarValues(stigmer);
+  const filtered: Record<string, EnvVarInput> = {};
+  for (const [key, value] of Object.entries(all)) {
+    if (keys.has(key)) {
+      filtered[key] = value;
+    }
+  }
+  return filtered;
+}

package/src/index.ts

@@ -355,6 +355,7 @@ export {
   toGrpcAddress,
   buildSystemEnvVars,
   resolveSystemEnvVarValues,
+  resolveDeclaredSystemEnvVars,
 } from "./environment";
 export type {
   UseEnvironmentReturn,

package/src/mcp-server/McpServerConfigPanel.tsx

@@ -76,6 +76,16 @@ export interface McpServerOAuthSignInProps {
   readonly error: Error | null;
   /** Clear the OAuth error state. */
   readonly onClearError: () => void;
+  /**
+   * `true` when the platform's OAuth app is pending vendor approval.
+   * Disables the sign-in button and shows an informational message.
+   */
+  readonly isVendorApprovalPending?: boolean;
+  /**
+   * Documentation URL for bringing your own OAuth token.
+   * Shown as a help link when `isVendorApprovalPending` is `true`.
+   */
+  readonly vendorApprovalDocsUrl?: string | null;
 }
 
 // ---------------------------------------------------------------------------
@@ -113,6 +123,18 @@ export interface McpServerConfigPanelProps {
   readonly onEnabledToolsChange: (enabledTools: string[]) => void;
   /** Called when the user clicks "Back" to return to the picker list. */
   readonly onBack: () => void;
+  /**
+   * When provided, a "Enter token manually" link is shown below the
+   * OAuth sign-in section. Clicking it switches the panel to manual
+   * token entry mode — the caller is responsible for updating the
+   * `credentials` and `oauthSignIn` props accordingly.
+   */
+  readonly onSwitchToManual?: () => void;
+  /**
+   * When provided, a "Sign in with OAuth instead" link is shown near
+   * the credentials form. Clicking it reverts to the OAuth flow.
+   */
+  readonly onSwitchToOAuth?: () => void;
   /** Error to display inline (e.g., from credential submission failure). */
   readonly error?: Error | null;
   /** Disables all interaction. */
@@ -179,6 +201,8 @@ export function McpServerConfigPanel({
   enabledTools,
   onEnabledToolsChange,
   onBack,
+  onSwitchToManual,
+  onSwitchToOAuth,
   error,
   disabled,
   className,
@@ -257,9 +281,23 @@ export function McpServerConfigPanel({
           onSignIn={oauthSignIn.onSignIn}
           error={oauthSignIn.error}
           onClearError={oauthSignIn.onClearError}
+          isVendorApprovalPending={oauthSignIn.isVendorApprovalPending}
+          vendorApprovalDocsUrl={oauthSignIn.vendorApprovalDocsUrl}
+          onSwitchToManual={onSwitchToManual}
         />
       )}
 
+      {/* Switch back to OAuth — shown in manual override mode */}
+      {!oauthSignIn && onSwitchToOAuth && (
+        <button
+          type="button"
+          onClick={onSwitchToOAuth}
+          className="text-[0.65rem] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
+        >
+          Sign in with OAuth instead
+        </button>
+      )}
+
       {/* Credentials form — only when credentials prop is provided */}
       {credentials && (
         <EnvVarForm
@@ -308,6 +346,9 @@ function InlineOAuthSignIn({
   onSignIn,
   error,
   onClearError,
+  isVendorApprovalPending,
+  vendorApprovalDocsUrl,
+  onSwitchToManual,
 }: {
   readonly serverName: string;
   readonly isConnected: boolean;
@@ -315,6 +356,9 @@ function InlineOAuthSignIn({
   readonly onSignIn: () => void;
   readonly error: Error | null;
   readonly onClearError: () => void;
+  readonly isVendorApprovalPending?: boolean;
+  readonly vendorApprovalDocsUrl?: string | null;
+  readonly onSwitchToManual?: () => void;
 }) {
   const isBusy =
     phase === "initiating" ||
@@ -322,28 +366,38 @@ function InlineOAuthSignIn({
     phase === "completing" ||
     phase === "connecting";
 
+  const signInDisabled = isBusy || !!isVendorApprovalPending;
+
   return (
     <div className="space-y-1.5">
       <div className="flex items-center justify-between">
         <span
           className={cn(
             "inline-flex items-center gap-1 text-[0.65rem] font-medium",
-            isConnected ? "text-success" : "text-muted-foreground",
+            isConnected
+              ? "text-success"
+              : isVendorApprovalPending
+                ? "text-amber-600 dark:text-amber-400"
+                : "text-muted-foreground",
           )}
         >
           <span
             className={cn(
               "size-1.5 rounded-full",
-              isConnected ? "bg-success" : "bg-muted-foreground",
+              isConnected
+                ? "bg-success"
+                : isVendorApprovalPending
+                  ? "bg-amber-500"
+                  : "bg-muted-foreground",
             )}
             aria-hidden="true"
           />
-          {isConnected ? "Signed in" : "Sign-in required"}
+          {isConnected ? "Signed in" : isVendorApprovalPending ? "Pending approval" : "Sign-in required"}
         </span>
         <button
           type="button"
           onClick={onSignIn}
-          disabled={isBusy}
+          disabled={signInDisabled}
           className={cn(
             "inline-flex items-center gap-1 rounded px-2 py-0.5 text-[0.65rem] font-medium",
             isConnected
@@ -361,6 +415,21 @@ function InlineOAuthSignIn({
           )}
         </button>
       </div>
+      {isVendorApprovalPending && !isConnected && (
+        <div className="text-[0.65rem] text-amber-700 dark:text-amber-300">
+          <p>OAuth sign-in is pending vendor approval.</p>
+          {vendorApprovalDocsUrl && (
+            <a
+              href={vendorApprovalDocsUrl}
+              target="_blank"
+              rel="noopener noreferrer"
+              className="underline decoration-amber-600/40 underline-offset-2 hover:decoration-amber-600 dark:decoration-amber-400/40 dark:hover:decoration-amber-400"
+            >
+              Learn how to bring your own token
+            </a>
+          )}
+        </div>
+      )}
       {error && (
         <div className="flex items-start gap-1.5 text-[0.65rem] text-destructive">
           <span className="flex-1">{error.message}</span>
@@ -373,6 +442,15 @@ function InlineOAuthSignIn({
           </button>
         </div>
       )}
+      {onSwitchToManual && !isConnected && !isBusy && (
+        <button
+          type="button"
+          onClick={onSwitchToManual}
+          className="text-[0.65rem] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
+        >
+          Enter token manually
+        </button>
+      )}
     </div>
   );
 }