@stigmer/react 3.1.12 → 3.1.13

package/src/sharing/ShareAgentDialog.tsx

@@ -65,6 +65,16 @@ export interface ShareAgentDialogProps {
    * the agent data hook's `refetch`.
    */
   readonly onSharingChanged?: () => void;
+  /**
+   * The org that owns (and pays for) the share. Defaults to the agent's
+   * own org — the owner's channel. Pass the viewer's org to manage a
+   * **cross-org share** of another org's marketplace-public agent
+   * (decision 013): the share, its billing, its credentials, and its
+   * hosted URL all belong to this org, while the agent stays live in its
+   * own. Cross-org shares are public-audience only, so the audience
+   * selector is hidden in that mode.
+   */
+  readonly shareOrg?: string;
   /**
    * When `false`, renders as an in-flow open dialog instead of a
    * top-layer modal — no `showModal()`, no backdrop, no focus trap.
@@ -106,6 +116,7 @@ export function ShareAgentDialog({
   agent,
   buildShareUrl,
   onSharingChanged,
+  shareOrg,
   modal = true,
 }: ShareAgentDialogProps) {
   const dialogRef = useRef<HTMLDialogElement>(null);
@@ -150,6 +161,7 @@ export function ShareAgentDialog({
           agent={agent}
           buildShareUrl={buildShareUrl}
           onSharingChanged={onSharingChanged}
+          shareOrg={shareOrg}
           onClose={handleClose}
         />
       )}
@@ -171,14 +183,18 @@ function ShareAgentDialogBody({
   agent,
   buildShareUrl,
   onSharingChanged,
+  shareOrg,
   onClose,
 }: {
   readonly agent: Agent;
   readonly buildShareUrl?: (org: string, slug: string) => string;
   readonly onSharingChanged?: () => void;
+  readonly shareOrg?: string;
   readonly onClose: () => void;
 }) {
-  const { share, isLoading, error, refetch } = useAgentShare(agent);
+  const { share, isLoading, error, refetch } = useAgentShare(agent, shareOrg);
+  const isCrossOrg =
+    !!shareOrg && shareOrg !== (agent.metadata?.org ?? "");
 
   return (
     <div className="flex flex-col">
@@ -192,7 +208,11 @@ function ShareAgentDialogBody({
             Share
           </h2>
           <p className="mt-0.5 truncate text-xs text-muted-foreground">
-            {agent.metadata?.name || agent.metadata?.slug}
+            {/* Cross-org: qualify the agent so it's clear whose blueprint
+                this channel serves — the URL and billing are still yours. */}
+            {isCrossOrg
+              ? `${agent.metadata?.org}/${agent.metadata?.slug}`
+              : agent.metadata?.name || agent.metadata?.slug}
           </p>
         </div>
         <button
@@ -244,6 +264,7 @@ function ShareAgentDialogBody({
           initialShare={share}
           buildShareUrl={buildShareUrl}
           onSharingChanged={onSharingChanged}
+          shareOrg={shareOrg}
         />
       )}
 
@@ -298,11 +319,13 @@ function ShareAgentForm({
   initialShare,
   buildShareUrl,
   onSharingChanged,
+  shareOrg,
 }: {
   readonly agent: Agent;
   readonly initialShare: AgentShare | null;
   readonly buildShareUrl?: (org: string, slug: string) => string;
   readonly onSharingChanged?: () => void;
+  readonly shareOrg?: string;
 }) {
   const agentName = agent.metadata?.name || (agent.metadata?.slug ?? "");
 
@@ -315,17 +338,24 @@ function ShareAgentForm({
   );
   const [activeTab, setActiveTab] = useState("link");
 
-  const { save, isPending } = useSaveAgentShare(agent);
+  const { save, isPending } = useSaveAgentShare(agent, shareOrg);
   const { rotateShareLink, isPending: isRotating } = useRotateShareLink(
     share?.metadata?.id ?? null,
   );
 
   // The share's own org/slug form the hosted URL. Before the first save
-  // the agent's stand in — exactly the identity the server will assign
-  // on create (D2: share slug defaults to the agent's).
-  const org = share?.metadata?.org || (agent.metadata?.org ?? "");
+  // the sharing org + the agent's slug stand in — exactly the identity
+  // the server will assign on create (D2: share slug defaults to the
+  // agent's; the org is the channel owner's, which for a cross-org share
+  // is the viewer's org, not the agent's — decision 013).
+  const org =
+    share?.metadata?.org || shareOrg || (agent.metadata?.org ?? "");
   const slug = share?.metadata?.slug || (agent.metadata?.slug ?? "");
   const linkToken = share?.status?.shareLinkToken ?? "";
+  // Cross-org shares are public-audience only (decision 013 D3) — the
+  // audience selector disappears rather than offering a choice the
+  // server would refuse.
+  const isCrossOrg = org !== (agent.metadata?.org ?? "");
 
   // Single commit path: apply the complete draft, adopt the server's
   // returned share as the new baseline, notify the host.
@@ -431,11 +461,13 @@ function ShareAgentForm({
             aria-labelledby="share-enabled-label"
           />
         </div>
-        <AudienceSelector
-          audience={draft.audience}
-          onChange={handleAudienceChange}
-          disabled={isPending}
-        />
+        {!isCrossOrg && (
+          <AudienceSelector
+            audience={draft.audience}
+            onChange={handleAudienceChange}
+            disabled={isPending}
+          />
+        )}
         <ToolReadinessHint agent={agent} draft={draft} />
       </div>
 

package/src/sharing/__tests__/ShareAgentDialog.test.tsx

@@ -464,6 +464,54 @@ describe("ShareAgentDialog", () => {
     });
   });
 
+  describe("cross-org mode (shareOrg — decision 013)", () => {
+    it("qualifies the agent in the header and hides the audience selector", async () => {
+      // No share yet in the consumer org: the owner's share exists but
+      // belongs to acme, so the consumer's dialog starts never-shared.
+      const client = createMockStigmer({
+        getByAgent: withShare(makeShare({ enabled: true })),
+      });
+      await renderOpenDialog(client, { shareOrg: "consumer-org" });
+
+      // The header names whose blueprint this channel serves.
+      expect(screen.getByText("acme/support-agent")).toBeTruthy();
+      // Cross-org shares are public-audience only — no choice to offer.
+      expect(screen.queryByRole("radiogroup", { hidden: true })).toBeNull();
+    });
+
+    it("builds the link, billing line, and create identity from the sharing org", async () => {
+      const apply = vi.fn().mockResolvedValue({});
+      const client = createMockStigmer({ apply });
+      await renderOpenDialog(client, { shareOrg: "consumer-org" });
+
+      // The hosted URL lives in the sharing org's namespace even before
+      // the first save.
+      expect(
+        screen.getByText("https://app.example.com/chat/consumer-org/support-agent"),
+      ).toBeTruthy();
+      // Who-pays names the sharing org, not the agent's.
+      expect(screen.getByText("consumer-org")).toBeTruthy();
+
+      fireEvent.click(screen.getByRole("switch", { hidden: true }));
+
+      await waitFor(() => expect(apply).toHaveBeenCalledTimes(1));
+      const input = apply.mock.calls[0][0] as AgentShareInput;
+      expect(input.org).toBe("consumer-org");
+      expect(input.agentRef).toEqual({ org: "acme", slug: "support-agent" });
+      expect(input.audience).toBe(AgentShareAudience.public);
+    });
+
+    it("same-org dialogs are unchanged when shareOrg equals the agent's org", async () => {
+      const client = createMockStigmer({
+        getByAgent: withShare(makeShare({ enabled: true })),
+      });
+      await renderOpenDialog(client, { shareOrg: "acme" });
+
+      expect(screen.getByText("Support Agent")).toBeTruthy();
+      expect(screen.getByRole("radiogroup", { hidden: true })).toBeTruthy();
+    });
+  });
+
   it("enabling applies the complete spec and notifies the host", async () => {
     const apply = vi.fn().mockResolvedValue({});
     const onSharingChanged = vi.fn();

package/src/sharing/__tests__/useAgentShare.test.tsx

@@ -132,6 +132,67 @@ describe("useAgentShare", () => {
     expect(getByAgent).not.toHaveBeenCalled();
   });
 
+  describe("cross-org share resolution (shareOrg — decision 013)", () => {
+    it("scopes the canonical pick to the sharing org's channel", async () => {
+      // The same agent shared in two orgs: the owner's share AND another
+      // org's external share. Each org's dialog must resolve its own row.
+      const ownerShare = makeShare("support-agent");
+      const externalShare = {
+        metadata: { id: "ash_ext", org: "consumer-org", slug: "support-agent" },
+        spec: { enabled: true },
+      };
+      const getByAgent = vi
+        .fn()
+        .mockResolvedValue({ totalCount: 2, items: [ownerShare, externalShare] });
+      const client = createMockStigmer({ getByAgent });
+
+      const { result } = renderHook(
+        () => useAgentShare(AGENT, "consumer-org"),
+        { wrapper: wrapper(client) },
+      );
+
+      await waitFor(() => expect(result.current.isLoading).toBe(false));
+      expect(result.current.share).toBe(externalShare);
+    });
+
+    it("resolves null when only OTHER orgs' shares exist — never edits a foreign channel", async () => {
+      const ownerShare = makeShare("support-agent");
+      const getByAgent = vi
+        .fn()
+        .mockResolvedValue({ totalCount: 1, items: [ownerShare] });
+      const client = createMockStigmer({ getByAgent });
+
+      const { result } = renderHook(
+        () => useAgentShare(AGENT, "consumer-org"),
+        { wrapper: wrapper(client) },
+      );
+
+      await waitFor(() => expect(result.current.isLoading).toBe(false));
+      // Without the org filter this would fall back to the owner's share
+      // and a save would overwrite the wrong org's configuration.
+      expect(result.current.share).toBeNull();
+    });
+
+    it("defaults shareOrg to the agent's own org (Phase A behavior unchanged)", async () => {
+      const ownerShare = makeShare("support-agent");
+      const externalShare = {
+        metadata: { id: "ash_ext", org: "consumer-org", slug: "support-agent" },
+        spec: { enabled: true },
+      };
+      const getByAgent = vi
+        .fn()
+        .mockResolvedValue({ totalCount: 2, items: [externalShare, ownerShare] });
+      const client = createMockStigmer({ getByAgent });
+
+      const { result } = renderHook(() => useAgentShare(AGENT), {
+        wrapper: wrapper(client),
+      });
+
+      await waitFor(() => expect(result.current.isLoading).toBe(false));
+      expect(result.current.share).toBe(ownerShare);
+    });
+  });
+
   it("exposes fetch failures as errors", async () => {
     const getByAgent = vi
       .fn()

package/src/sharing/__tests__/useCreateExternalShareLink.test.tsx

@@ -0,0 +1,194 @@
+import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
+import { renderHook, waitFor, cleanup } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
+import { StigmerContext } from "../../context";
+import { FetchCacheContext } from "../../internal/FetchCacheProvider";
+import { useCreateExternalShareLink } from "../useCreateExternalShareLink";
+
+// happy-dom does not implement the native dialog show/close methods.
+beforeAll(() => {
+  HTMLDialogElement.prototype.showModal = function showModal() {
+    this.open = true;
+  };
+  HTMLDialogElement.prototype.close = function close() {
+    this.open = false;
+  };
+});
+
+afterEach(cleanup);
+
+function createMockStigmer(overrides: {
+  isAuthorized?: boolean;
+  checkMyPermission?: (...args: unknown[]) => Promise<unknown>;
+} = {}) {
+  return {
+    iamPolicy: {
+      checkMyPermission:
+        overrides.checkMyPermission ??
+        vi.fn().mockResolvedValue({
+          isAuthorized: overrides.isAuthorized ?? true,
+        }),
+    },
+    agentShare: {
+      getByAgent: vi.fn().mockResolvedValue({ totalCount: 0, items: [] }),
+      apply: vi.fn().mockResolvedValue({}),
+      rotateShareLink: vi.fn().mockResolvedValue({}),
+    },
+    billing: { getOrCreateBillingAccount: vi.fn().mockResolvedValue(null) },
+  } as never;
+}
+
+function wrapper(client: unknown) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <FetchCacheContext.Provider value={null}>
+        <StigmerContext.Provider value={client as never}>
+          {children}
+        </StigmerContext.Provider>
+      </FetchCacheContext.Provider>
+    );
+  };
+}
+
+function makeAgent(visibility: ApiResourceVisibility) {
+  return {
+    metadata: {
+      id: "agt_1",
+      org: "provider-org",
+      slug: "public-helper",
+      name: "Public Helper",
+      visibility,
+    },
+    spec: {},
+  } as never;
+}
+
+const PUBLIC_AGENT = makeAgent(ApiResourceVisibility.visibility_public);
+const PRIVATE_AGENT = makeAgent(ApiResourceVisibility.visibility_private);
+
+describe("useCreateExternalShareLink", () => {
+  it("offers the action on another org's public agent when the viewer holds the org bar", async () => {
+    const { result } = renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PUBLIC_AGENT,
+          viewerOrg: "consumer-org",
+        }),
+      { wrapper: wrapper(createMockStigmer({ isAuthorized: true })) },
+    );
+
+    await waitFor(() => expect(result.current.action).not.toBeNull());
+    expect(result.current.action?.id).toBe("create-share-link");
+    expect(result.current.action?.label).toBe("Create share link");
+    expect(result.current.action?.group).toBe("sharing");
+  });
+
+  it("checks can_create_agent_share on the VIEWER's org (id = slug)", async () => {
+    const client = createMockStigmer({ isAuthorized: true });
+    renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PUBLIC_AGENT,
+          viewerOrg: "consumer-org",
+        }),
+      { wrapper: wrapper(client) },
+    );
+
+    const check = (
+      client as { iamPolicy: { checkMyPermission: ReturnType<typeof vi.fn> } }
+    ).iamPolicy.checkMyPermission;
+    await waitFor(() => expect(check).toHaveBeenCalled());
+    const input = check.mock.calls[0][0] as {
+      resource?: { kind: string; id: string };
+      relation: string;
+    };
+    expect(input.relation).toBe("can_create_agent_share");
+    expect(input.resource?.kind).toBe("organization");
+    expect(input.resource?.id).toBe("consumer-org");
+  });
+
+  it("stays null on the viewer's OWN agents — the same-org Share entry covers those", () => {
+    const checkMyPermission = vi.fn();
+    const { result } = renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PUBLIC_AGENT,
+          viewerOrg: "provider-org",
+        }),
+      { wrapper: wrapper(createMockStigmer({ checkMyPermission })) },
+    );
+
+    expect(result.current.action).toBeNull();
+    expect(result.current.dialog).toBeNull();
+    // Not applicable structurally: no permission round-trip is spent.
+    expect(checkMyPermission).not.toHaveBeenCalled();
+  });
+
+  it("stays null on a non-public agent — visibility is the origin org's consent", () => {
+    const checkMyPermission = vi.fn();
+    const { result } = renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PRIVATE_AGENT,
+          viewerOrg: "consumer-org",
+        }),
+      { wrapper: wrapper(createMockStigmer({ checkMyPermission })) },
+    );
+
+    expect(result.current.action).toBeNull();
+    expect(checkMyPermission).not.toHaveBeenCalled();
+  });
+
+  it("stays null while the agent is loading or the viewer org is unknown", () => {
+    const client = createMockStigmer();
+    const { result: loading } = renderHook(
+      () => useCreateExternalShareLink({ agent: null, viewerOrg: "consumer-org" }),
+      { wrapper: wrapper(client) },
+    );
+    const { result: orgless } = renderHook(
+      () => useCreateExternalShareLink({ agent: PUBLIC_AGENT, viewerOrg: "" }),
+      { wrapper: wrapper(client) },
+    );
+
+    expect(loading.current.action).toBeNull();
+    expect(orgless.current.action).toBeNull();
+  });
+
+  it("hides the action when the viewer lacks the org-side permission", async () => {
+    const client = createMockStigmer({ isAuthorized: false });
+    const { result } = renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PUBLIC_AGENT,
+          viewerOrg: "consumer-org",
+        }),
+      { wrapper: wrapper(client) },
+    );
+
+    await waitFor(() =>
+      expect(
+        (client as { iamPolicy: { checkMyPermission: ReturnType<typeof vi.fn> } })
+          .iamPolicy.checkMyPermission,
+      ).toHaveBeenCalled(),
+    );
+    await waitFor(() => expect(result.current.action).toBeNull());
+  });
+
+  it("opens the cross-org dialog via the action", async () => {
+    const { result } = renderHook(
+      () =>
+        useCreateExternalShareLink({
+          agent: PUBLIC_AGENT,
+          viewerOrg: "consumer-org",
+        }),
+      { wrapper: wrapper(createMockStigmer({ isAuthorized: true })) },
+    );
+
+    await waitFor(() => expect(result.current.action).not.toBeNull());
+    expect(result.current.isOpen).toBe(false);
+
+    result.current.action?.onAction();
+    await waitFor(() => expect(result.current.isOpen).toBe(true));
+  });
+});

package/src/sharing/__tests__/useSaveAgentShare.test.tsx

@@ -163,6 +163,54 @@ describe("useSaveAgentShare", () => {
     expect(second.audience).toBe(AgentShareAudience.org);
   });
 
+  describe("cross-org create identity (shareOrg — decision 013)", () => {
+    it("a first save lands the share in the sharing org, agent_ref stays the agent's", async () => {
+      const apply = vi.fn().mockResolvedValue({});
+      const client = createMockStigmer({ apply });
+
+      const { result } = renderHook(
+        () => useSaveAgentShare(AGENT, "consumer-org"),
+        { wrapper: wrapper(client) },
+      );
+
+      await act(() => result.current.save(FULL_DRAFT, null));
+
+      const input = apply.mock.calls[0][0] as AgentShareInput;
+      // The share is the sharing org's resource (its URL, billing, and
+      // credentials), while agent_ref keeps pointing at the provider's
+      // blueprint — the whole point of a cross-org share.
+      expect(input.org).toBe("consumer-org");
+      expect(input.slug).toBe("support-agent");
+      expect(input.agentRef).toEqual({ org: "acme", slug: "support-agent" });
+    });
+
+    it("editing an existing cross-org share keeps ITS identity, not the hook argument's", async () => {
+      const apply = vi.fn().mockResolvedValue({});
+      const client = createMockStigmer({ apply });
+      const externalShare = {
+        metadata: {
+          id: "ash_ext",
+          org: "consumer-org",
+          slug: "renamed-channel",
+          name: "Renamed Channel",
+        },
+        spec: { enabled: true },
+      } as AgentShare;
+
+      const { result } = renderHook(
+        () => useSaveAgentShare(AGENT, "consumer-org"),
+        { wrapper: wrapper(client) },
+      );
+
+      await act(() => result.current.save(FULL_DRAFT, externalShare));
+
+      const input = apply.mock.calls[0][0] as AgentShareInput;
+      expect(input.org).toBe("consumer-org");
+      expect(input.slug).toBe("renamed-channel");
+      expect(input.agentRef).toEqual({ org: "acme", slug: "support-agent" });
+    });
+  });
+
   it("is a stable no-op when the agent is null", async () => {
     const apply = vi.fn();
     const client = createMockStigmer({ apply });

package/src/sharing/index.ts

@@ -25,6 +25,11 @@ export type {
   UseShareAgentArgs,
   UseShareAgentReturn,
 } from "./useShareAgent.js";
+export { useCreateExternalShareLink } from "./useCreateExternalShareLink.js";
+export type {
+  UseCreateExternalShareLinkArgs,
+  UseCreateExternalShareLinkReturn,
+} from "./useCreateExternalShareLink.js";
 export { useShareToolReadiness } from "./useShareToolReadiness.js";
 export type { ShareToolReadiness } from "./useShareToolReadiness.js";
 // Origin validation moved to @stigmer/sdk (framework-free, shared with the

package/src/sharing/useAgentShare.ts

@@ -26,20 +26,24 @@ export interface UseAgentShareReturn {
 }
 
 /**
- * The canonical share among an agent's shares: the one whose slug equals
- * the agent's slug (the server's default when a share is created without
- * an explicit slug), falling back to the first entry. The data model
- * allows N shares per agent (decision 011 D3); the console manages the
- * canonical one in Phase A, so extra shares created via manifests never
- * confuse the dialog.
+ * The canonical share among an agent's shares **within one sharing org**:
+ * the one whose slug equals the agent's slug (the server's default when a
+ * share is created without an explicit slug), falling back to the first
+ * entry in that org. The data model allows N shares per agent across N
+ * orgs (decision 011 D3 + decision 013), so the org filter is what keeps
+ * each org's dialog on its own channel — without it, an owner who can
+ * also see another org's share of the same agent would edit the wrong
+ * one. Extra shares created via manifests never confuse the dialog.
  */
 function pickCanonicalShare(
   shares: readonly AgentShare[],
+  shareOrg: string,
   agentSlug: string,
 ): AgentShare | null {
+  const inOrg = shares.filter((share) => share.metadata?.org === shareOrg);
   return (
-    shares.find((share) => share.metadata?.slug === agentSlug) ??
-    shares[0] ??
+    inOrg.find((share) => share.metadata?.slug === agentSlug) ??
+    inOrg[0] ??
     null
   );
 }
@@ -54,9 +58,15 @@ function pickCanonicalShare(
  * tell whether it is shared. This hook is how owner-side surfaces (the
  * Share dialog) resolve that state.
  *
+ * `shareOrg` scopes resolution to one sharing org's channel and defaults
+ * to the agent's own org (the owner's share). Pass the viewer's org to
+ * manage a **cross-org share** — the viewer's own channel of another
+ * org's marketplace-public agent (decision 013).
+ *
  * Pass `null` for `agent` to skip fetching (stable no-op) — useful
  * while the agent is still loading. A resolved `null` share means the
- * agent has never been shared; the first save creates the share.
+ * agent has never been shared in `shareOrg`; the first save creates the
+ * share.
  *
  * @example
  * ```tsx
@@ -66,24 +76,28 @@ function pickCanonicalShare(
  * const enabled = share?.spec?.enabled ?? false;
  * ```
  */
-export function useAgentShare(agent: Agent | null): UseAgentShareReturn {
+export function useAgentShare(
+  agent: Agent | null,
+  shareOrg?: string,
+): UseAgentShareReturn {
   const stigmer = useStigmer();
 
   const agentId = agent?.metadata?.id ?? "";
   const agentSlug = agent?.metadata?.slug ?? "";
+  const resolvedShareOrg = shareOrg || (agent?.metadata?.org ?? "");
 
   const fetchFn = agentId
     ? async () => {
         const result = await stigmer.agentShare.getByAgent(
           create(GetAgentSharesByAgentRequestSchema, { agentId }),
         );
-        return pickCanonicalShare(result.items, agentSlug);
+        return pickCanonicalShare(result.items, resolvedShareOrg, agentSlug);
       }
     : null;
 
   const { data: share, isLoading, isRefetching, error, refetch } = useFetch(
     fetchFn,
-    [agentId, agentSlug, stigmer],
+    [agentId, agentSlug, resolvedShareOrg, stigmer],
     null as AgentShare | null,
   );