@stigmer/react 3.0.5 → 3.0.7-dev.20260611143057

package/src/session/SessionViewer.tsx

@@ -17,6 +17,8 @@ import { SessionComposer } from "../composer";
 import { SecretFlowErrorGuide, isSecretFlowError } from "../error";
 import { useSessionPageFlow } from "./useSessionPageFlow";
 import { SessionInspector } from "./inspector/SessionInspector";
+import type { RuntimeEnvProvider } from "./runtime-env";
+import type { SessionAudience } from "./audience";
 
 /**
  * Message submitted when the user implements a plan. References the published
@@ -67,6 +69,27 @@ export interface SessionViewerProps {
    * expandable file tree. (DD-004 capability injection, DD-011 opt-in.)
    */
   readonly workspaceFileLister?: WorkspaceFileLister;
+  /**
+   * Supplies host-app environment variables for every follow-up
+   * execution (e.g. short-lived credentials for MCP tools, minted as
+   * the signed-in user). Evaluated fresh at each send; host values win
+   * over composer-collected env on key collisions. If the provider
+   * throws, the send is blocked and an error banner is shown — see
+   * {@link RuntimeEnvProvider}.
+   */
+  readonly getRuntimeEnv?: RuntimeEnvProvider;
+  /**
+   * Presentation audience for the viewer. `"endUser"` locks the
+   * session's agent and hides the MCP server, skill, and
+   * session-variable configuration in both the composer and the
+   * inspector's Setup tab — for product-embedded chat where the agent
+   * is configured upstream by the platform. The model selector,
+   * interaction mode, attachments, and workspace picker remain. See
+   * {@link SessionAudience}.
+   *
+   * @default "integrator"
+   */
+  readonly audience?: SessionAudience;
   /**
    * Slot for host-injected header actions (e.g., Share button with
    * PermissionGate). Rendered in the top-right corner of the viewer.
@@ -126,12 +149,15 @@ export function SessionViewer({
   enableLocal = false,
   onBrowseLocalFolder,
   workspaceFileLister,
+  getRuntimeEnv,
+  audience = "integrator",
   headerActions,
   onApplied,
   className,
 }: SessionViewerProps) {
-  const flow = useSessionPageFlow({ sessionId, org });
+  const flow = useSessionPageFlow({ sessionId, org, getRuntimeEnv });
   const { conv } = flow;
+  const isEndUser = audience === "endUser";
 
   const [modelId, setModelId] = flow.model;
   const [interactionMode, setInteractionMode] = flow.interactionMode;
@@ -202,6 +228,7 @@ export function SessionViewer({
               enableLocal={enableLocal}
               onBrowseLocalFolder={onBrowseLocalFolder}
               onBuildFromPlan={handleBuildFromPlan}
+              isEndUser={isEndUser}
             />
           }
           secondary={
@@ -216,6 +243,7 @@ export function SessionViewer({
               gitHubConnection={gitHubConnection}
               onBrowseLocalFolder={onBrowseLocalFolder}
               workspaceFileLister={workspaceFileLister}
+              isEndUser={isEndUser}
             />
           }
         />
@@ -241,6 +269,7 @@ interface ConversationColumnProps {
   readonly enableLocal: boolean;
   readonly onBrowseLocalFolder?: () => Promise<string | null>;
   readonly onBuildFromPlan: () => void;
+  readonly isEndUser: boolean;
 }
 
 function ConversationColumn({
@@ -256,8 +285,10 @@ function ConversationColumn({
   enableLocal,
   onBrowseLocalFolder,
   onBuildFromPlan,
+  isEndUser,
 }: ConversationColumnProps) {
   const { conv } = flow;
+  const sendError = flow.submitError ?? conv.sendError ?? conv.approvalError;
 
   return (
     <div className="flex h-full min-w-0 flex-col">
@@ -282,9 +313,7 @@ function ConversationColumn({
             onReconnect={conv.reconnectStream}
           />
         )}
-        {(conv.sendError || conv.approvalError) && (
-          <SendErrorBanner error={(conv.sendError ?? conv.approvalError)!} />
-        )}
+        {sendError && <SendErrorBanner error={sendError} />}
         {flow.autoApproveAll && (
           <AutoApproveIndicator onTurnOff={() => flow.setAutoApproveAll(false)} />
         )}
@@ -309,11 +338,12 @@ function ConversationColumn({
           onAgentRefChange={flow.setAgentRef}
           onAgentResolutionChange={flow.setResolution}
           isDefaultAgent={flow.isDefaultAgent}
-          mcpServerUsages={flow.mcpServerUsages}
-          onMcpServerUsagesChange={flow.setMcpServerUsages}
-          skillRefs={flow.skillRefs}
-          onSkillRefsChange={flow.setSkillRefs}
-          sessionVariables={flow.sessionVariables}
+          lockAgent={isEndUser}
+          mcpServerUsages={isEndUser ? undefined : flow.mcpServerUsages}
+          onMcpServerUsagesChange={isEndUser ? undefined : flow.setMcpServerUsages}
+          skillRefs={isEndUser ? undefined : flow.skillRefs}
+          onSkillRefsChange={isEndUser ? undefined : flow.setSkillRefs}
+          sessionVariables={isEndUser ? undefined : flow.sessionVariables}
           className="px-4 py-3"
         />
       </div>
@@ -337,6 +367,7 @@ interface InspectorPanelProps {
   readonly gitHubConnection?: UseGitHubConnectionReturn;
   readonly onBrowseLocalFolder?: () => Promise<string | null>;
   readonly workspaceFileLister?: WorkspaceFileLister;
+  readonly isEndUser: boolean;
 }
 
 function InspectorPanel({
@@ -350,6 +381,7 @@ function InspectorPanel({
   gitHubConnection,
   onBrowseLocalFolder,
   workspaceFileLister,
+  isEndUser,
 }: InspectorPanelProps) {
   const selectedItem = useSelectedThreadItem();
 
@@ -390,16 +422,20 @@ function InspectorPanel({
       harness: flow.harness,
       executionTarget: flow.executionTarget,
       modelId: flow.model[0],
-      mutations: {
-        onRemoveAgent: flow.isDefaultAgent ? undefined : handleRemoveAgent,
-        onRemoveMcp: handleRemoveMcp,
-        onRemoveSkill: handleRemoveSkill,
-      },
+      // End users see the configuration but cannot strip it — the Setup
+      // tab renders read-only without mutation callbacks (DD-011).
+      mutations: isEndUser
+        ? undefined
+        : {
+            onRemoveAgent: flow.isDefaultAgent ? undefined : handleRemoveAgent,
+            onRemoveMcp: handleRemoveMcp,
+            onRemoveSkill: handleRemoveSkill,
+          },
     }),
     [
       flow.agentRef, flow.isDefaultAgent, flow.mcpServerUsages, flow.skillRefs,
       flow.sessionVariables, flow.harness, flow.executionTarget, flow.model,
-      handleRemoveAgent, handleRemoveMcp, handleRemoveSkill,
+      isEndUser, handleRemoveAgent, handleRemoveMcp, handleRemoveSkill,
     ],
   );
 

package/src/session/__tests__/audienceWiring.test.tsx

@@ -0,0 +1,274 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+
+// ---------------------------------------------------------------------------
+// Wiring-contract tests for the `audience` preset on the session organisms.
+//
+// The composer and inspector are replaced with prop-capturing probes so the
+// tests assert exactly what `audience="endUser"` maps to: a locked agent,
+// unwired MCP/skill/session-variable pickers, and a read-only Setup tab.
+// The molecules' own behavior is covered by their co-located tests.
+// ---------------------------------------------------------------------------
+
+type CapturedProps = Record<string, unknown>;
+
+const composerProps: CapturedProps[] = [];
+vi.mock("../../composer", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../composer")>();
+  return {
+    ...actual,
+    SessionComposer: (props: CapturedProps) => {
+      composerProps.push(props);
+      return <div data-testid="composer-probe" />;
+    },
+  };
+});
+
+const inspectorProps: CapturedProps[] = [];
+vi.mock("../inspector/SessionInspector", () => ({
+  SessionInspector: (props: CapturedProps) => {
+    inspectorProps.push(props);
+    return <div data-testid="inspector-probe" />;
+  },
+}));
+
+vi.mock("../../execution/MessageThread", () => ({
+  MessageThread: () => <div data-testid="thread-probe" />,
+}));
+
+// ---------------------------------------------------------------------------
+// Flow stubs — the organisms own these hooks; stub them to a loaded state.
+// ---------------------------------------------------------------------------
+
+const stubWorkspace = {
+  entries: [],
+  hasEntries: false,
+  toInput: vi.fn().mockReturnValue([]),
+  addGitRepo: vi.fn(),
+  addLocalPath: vi.fn(),
+  removeEntry: vi.fn(),
+  clear: vi.fn(),
+};
+
+const stubSessionVariables = { entries: [], isEmpty: true, clear: vi.fn() };
+
+const stubNewSessionFlow = {
+  harness: "native" as const,
+  setHarness: vi.fn(),
+  modelId: undefined,
+  setModelId: vi.fn(),
+  agentRef: { org: "acme", slug: "support-bot" },
+  setAgentRef: vi.fn(),
+  resolution: null,
+  setResolution: vi.fn(),
+  mcpServerUsages: [],
+  setMcpServerUsages: vi.fn(),
+  skillRefs: [],
+  setSkillRefs: vi.fn(),
+  workspace: stubWorkspace,
+  sessionVariables: stubSessionVariables,
+  isSubmitting: false,
+  submitError: null,
+  submit: vi.fn(),
+};
+const mockUseNewSessionFlow = vi.fn((_options: unknown) => stubNewSessionFlow);
+vi.mock("../useNewSessionFlow", () => ({
+  useNewSessionFlow: (options: unknown) => mockUseNewSessionFlow(options),
+}));
+
+const stubConv = {
+  session: { spec: {} },
+  isLoading: false,
+  loadError: null,
+  completedExecutions: [],
+  activeStreamExecution: null,
+  activePhase: null,
+  isStreaming: false,
+  isConnecting: false,
+  sendFollowUp: vi.fn(),
+  canSendFollowUp: true,
+  isSending: false,
+  sendError: null,
+  clearSendError: vi.fn(),
+  pendingUserMessage: null,
+  workspaceEntries: [],
+  mcpServerUsages: [],
+  skillRefs: [],
+  pendingApprovals: [],
+  submitApproval: vi.fn(),
+  submittingApprovalIds: new Set<string>(),
+  streamError: null,
+  reconnectStream: vi.fn(),
+  approvalError: null,
+};
+
+const stubSessionPageFlow = {
+  conv: stubConv,
+  harness: "native" as const,
+  executionTarget: undefined,
+  model: [undefined, vi.fn()] as const,
+  interactionMode: ["agent" as const, vi.fn()] as const,
+  agentRef: { org: "acme", slug: "support-bot" },
+  setAgentRef: vi.fn(),
+  resolution: null,
+  setResolution: vi.fn(),
+  isDefaultAgent: false,
+  mcpServerUsages: [],
+  setMcpServerUsages: vi.fn(),
+  skillRefs: [],
+  setSkillRefs: vi.fn(),
+  workspace: stubWorkspace,
+  sessionVariables: stubSessionVariables,
+  autoApproveAll: false,
+  setAutoApproveAll: vi.fn(),
+  submitApproval: vi.fn(),
+  handleSubmit: vi.fn(),
+  submitError: null as Error | null,
+  displayExecution: null,
+  allExecutions: [],
+  sandboxWorkspaceRoot: undefined,
+};
+const mockUseSessionPageFlow = vi.fn((_options: unknown) => stubSessionPageFlow);
+vi.mock("../useSessionPageFlow", () => ({
+  useSessionPageFlow: (options: unknown) => mockUseSessionPageFlow(options),
+}));
+
+import { NewSessionViewer } from "../NewSessionViewer";
+import { SessionViewer } from "../SessionViewer";
+
+const AGENT_REF = { org: "acme", slug: "support-bot" };
+
+function lastComposerProps(): CapturedProps {
+  expect(composerProps.length).toBeGreaterThan(0);
+  return composerProps.at(-1)!;
+}
+
+function lastSessionConfig(): { mutations?: unknown } {
+  expect(inspectorProps.length).toBeGreaterThan(0);
+  return inspectorProps.at(-1)!.sessionConfig as { mutations?: unknown };
+}
+
+beforeEach(() => {
+  composerProps.length = 0;
+  inspectorProps.length = 0;
+  stubSessionPageFlow.submitError = null;
+});
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe("NewSessionViewer — audience wiring", () => {
+  it("integrator (default): full configuration surface, agent unlocked", () => {
+    render(
+      <NewSessionViewer
+        org="acme"
+        onSessionCreated={vi.fn()}
+        initialAgentRef={AGENT_REF}
+      />,
+    );
+
+    const props = lastComposerProps();
+    expect(props.lockAgent).toBe(false);
+    expect(props.onMcpServerUsagesChange).toBeDefined();
+    expect(props.onSkillRefsChange).toBeDefined();
+    expect(props.sessionVariables).toBeDefined();
+    expect(lastSessionConfig().mutations).toBeDefined();
+  });
+
+  it("endUser with a pinned agent: locked agent, integrator pickers unwired", () => {
+    render(
+      <NewSessionViewer
+        org="acme"
+        onSessionCreated={vi.fn()}
+        audience="endUser"
+        initialAgentRef={AGENT_REF}
+      />,
+    );
+
+    const props = lastComposerProps();
+    expect(props.lockAgent).toBe(true);
+    expect(props.onMcpServerUsagesChange).toBeUndefined();
+    expect(props.onSkillRefsChange).toBeUndefined();
+    expect(props.sessionVariables).toBeUndefined();
+    // End-user controls survive the curation.
+    expect(props.showHarnessSelector).toBe(true);
+    expect(props.showInteractionModePicker).toBe(true);
+    // Setup tab is read-only: no remove affordances for pinned config.
+    expect(lastSessionConfig().mutations).toBeUndefined();
+  });
+
+  it("endUser without a pinned agent: pickers hidden but agent not locked", () => {
+    render(
+      <NewSessionViewer
+        org="acme"
+        onSessionCreated={vi.fn()}
+        audience="endUser"
+      />,
+    );
+
+    expect(lastComposerProps().lockAgent).toBe(false);
+  });
+
+  it("forwards getRuntimeEnv and defaultHarness to the flow", () => {
+    const getRuntimeEnv = vi.fn();
+    render(
+      <NewSessionViewer
+        org="acme"
+        onSessionCreated={vi.fn()}
+        getRuntimeEnv={getRuntimeEnv}
+        defaultHarness="cursor"
+      />,
+    );
+
+    expect(mockUseNewSessionFlow).toHaveBeenCalledWith(
+      expect.objectContaining({ getRuntimeEnv, defaultHarness: "cursor" }),
+    );
+  });
+});
+
+describe("SessionViewer — audience wiring", () => {
+  it("integrator (default): full configuration surface, agent unlocked", () => {
+    render(<SessionViewer sessionId="ses_1" org="acme" />);
+
+    const props = lastComposerProps();
+    expect(props.lockAgent).toBe(false);
+    expect(props.onMcpServerUsagesChange).toBeDefined();
+    expect(props.onSkillRefsChange).toBeDefined();
+    expect(props.sessionVariables).toBeDefined();
+    expect(lastSessionConfig().mutations).toBeDefined();
+  });
+
+  it("endUser: locked agent, integrator pickers unwired, read-only Setup tab", () => {
+    render(<SessionViewer sessionId="ses_1" org="acme" audience="endUser" />);
+
+    const props = lastComposerProps();
+    expect(props.lockAgent).toBe(true);
+    expect(props.onMcpServerUsagesChange).toBeUndefined();
+    expect(props.onSkillRefsChange).toBeUndefined();
+    expect(props.sessionVariables).toBeUndefined();
+    // End-user controls survive the curation.
+    expect(props.showInteractionModePicker).toBe(true);
+    expect(lastSessionConfig().mutations).toBeUndefined();
+  });
+
+  it("forwards getRuntimeEnv to the flow", () => {
+    const getRuntimeEnv = vi.fn();
+    render(
+      <SessionViewer sessionId="ses_1" org="acme" getRuntimeEnv={getRuntimeEnv} />,
+    );
+
+    expect(mockUseSessionPageFlow).toHaveBeenCalledWith(
+      expect.objectContaining({ getRuntimeEnv }),
+    );
+  });
+
+  it("renders the flow's submitError through the send-error banner", () => {
+    stubSessionPageFlow.submitError = new Error("token mint failed");
+    render(<SessionViewer sessionId="ses_1" org="acme" />);
+
+    const alert = screen.getByRole("alert");
+    expect(alert.textContent).toContain("token mint failed");
+  });
+});

package/src/session/__tests__/useNewSessionFlow.test.tsx

@@ -468,6 +468,128 @@ describe("useNewSessionFlow", () => {
     });
   });
 
+  describe("host runtime env (getRuntimeEnv)", () => {
+    it("merges host env into the first execution, host wins on collisions", async () => {
+      const getRuntimeEnv = vi.fn().mockResolvedValue({
+        PLATFORM_TOKEN: { value: "fresh-token", isSecret: true },
+      });
+      const opts = { ...defaultOptions(), getRuntimeEnv };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      await act(async () => {
+        await result.current.submit("Hello", undefined, {
+          runtimeEnv: {
+            PLATFORM_TOKEN: { value: "stale-token", isSecret: true },
+            USER_VAR: { value: "kept" },
+          },
+        });
+      });
+
+      expect(getRuntimeEnv).toHaveBeenCalledTimes(1);
+      const execInput = mockCreateExecution.mock.calls[0][0];
+      expect(execInput.runtimeEnv).toEqual({
+        PLATFORM_TOKEN: { value: "fresh-token", isSecret: true },
+        USER_VAR: { value: "kept" },
+      });
+    });
+
+    it("evaluates the provider fresh on every submission", async () => {
+      let mint = 0;
+      const getRuntimeEnv = vi.fn(() => ({
+        TOKEN: { value: `token-${++mint}` },
+      }));
+      const opts = { ...defaultOptions(), getRuntimeEnv };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      await act(async () => {
+        await result.current.submit("First");
+      });
+      await act(async () => {
+        await result.current.submit("Second");
+      });
+
+      expect(getRuntimeEnv).toHaveBeenCalledTimes(2);
+      expect(mockCreateExecution.mock.calls[0][0].runtimeEnv).toEqual({
+        TOKEN: { value: "token-1" },
+      });
+      expect(mockCreateExecution.mock.calls[1][0].runtimeEnv).toEqual({
+        TOKEN: { value: "token-2" },
+      });
+    });
+
+    it("aborts before session creation when the provider throws", async () => {
+      const getRuntimeEnv = vi.fn().mockRejectedValue(new Error("token mint failed"));
+      const opts = { ...defaultOptions(), getRuntimeEnv };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      await act(async () => {
+        await result.current.submit("Hello");
+      });
+
+      // No orphan session, no execution — the failure is fully pre-flight.
+      expect(mockCreateSession).not.toHaveBeenCalled();
+      expect(mockCreateExecution).not.toHaveBeenCalled();
+      expect(result.current.submitError).toContain("token mint failed");
+      expect(opts.onError).toHaveBeenCalled();
+      expect(result.current.isSubmitting).toBe(false);
+    });
+
+    it("passes composer env through untouched when no provider is configured", async () => {
+      const opts = defaultOptions();
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      await act(async () => {
+        await result.current.submit("Hello", undefined, {
+          runtimeEnv: { USER_VAR: { value: "composer-only" } },
+        });
+      });
+
+      expect(mockCreateExecution.mock.calls[0][0].runtimeEnv).toEqual({
+        USER_VAR: { value: "composer-only" },
+      });
+    });
+  });
+
+  describe("defaultHarness", () => {
+    it("seeds the embedder default when no harness is stored", () => {
+      const opts = { ...defaultOptions(), defaultHarness: "cursor" as const };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      expect(result.current.harness).toBe("cursor");
+    });
+
+    it("stored user choice outranks the embedder default", () => {
+      localStorage.setItem(STORAGE_KEY_HARNESS, "native");
+      const opts = { ...defaultOptions(), defaultHarness: "cursor" as const };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      expect(result.current.harness).toBe("native");
+    });
+
+    it("does not persist the seeded default — only explicit choices", () => {
+      const opts = { ...defaultOptions(), defaultHarness: "cursor" as const };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      // Seeding must not masquerade as a user choice, otherwise the
+      // embedder default would stop applying after the first visit.
+      expect(localStorage.getItem(STORAGE_KEY_HARNESS)).toBeNull();
+
+      act(() => result.current.setHarness("native"));
+      expect(localStorage.getItem(STORAGE_KEY_HARNESS)).toBe("native");
+    });
+
+    it("submits sessions with the seeded default harness", async () => {
+      const opts = { ...defaultOptions(), defaultHarness: "cursor" as const };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: createWrapper() });
+
+      await act(async () => {
+        await result.current.submit("Hello");
+      });
+
+      expect(mockCreateSession.mock.calls[0][0].harness).toBe("cursor");
+    });
+  });
+
   describe("submit while default agent is loading", () => {
     it("awaits default agent and creates session when fetch resolves", async () => {
       const resolvedAgent = { status: { defaultInstanceId: "awaited-inst" } };