@stigmer/react 3.1.5 → 3.1.7

package/session/facets/ChangesTab.js

@@ -3,21 +3,30 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { useSessionWriteBacks } from "../useSessionWriteBacks.js";
 import { WriteBackCard } from "../../execution/WriteBackCard.js";
 /**
- * Changes facet for the session panel — the session's git write-backs
- * (branch/commit/PR), one `WriteBackCard` per entry.
+ * Changes facet for the session panel — the definitive "where did my work go"
+ * surface: the session's git write-backs (branch/commit/PR), one
+ * `WriteBackCard` per entry, with honest pre-push states for cloud git
+ * sessions whose write-back hasn't happened yet.
  *
  * Local file changes deliberately do NOT render here: they live in the
  * transcript, where each stamped edit row shows its diff in place and the
  * per-turn decision bar carries the review controls and file list
- * (`FileReviewCard`). Duplicating them in a side panel gave the same change a
- * third rendering with no added authority. The facet therefore only surfaces
- * once a write-back exists (see `useSessionRailViews`).
+ * (`FileReviewCard`). This facet is exclusively the git OUTCOME surface —
+ * what was reviewed there lands here as a branch and pull request.
  */
-export function ChangesTab({ executions }) {
+export function ChangesTab({ executions, expectsWriteBack = false, isSettled = false, }) {
     const { writeBacks, hasWriteBacks } = useSessionWriteBacks(executions);
     if (hasWriteBacks) {
         return (_jsx("div", { role: "list", className: "space-y-2", children: writeBacks.map((entry) => (_jsx("div", { role: "listitem", children: _jsx(WriteBackCard, { writeBack: entry.writeBack }) }, entry.writeBack.workspaceEntryName))) }));
     }
+    if (expectsWriteBack) {
+        return (_jsx("div", { className: "flex flex-col items-center justify-center px-4 py-8 text-center", children: _jsx("p", { className: "text-xs text-muted-foreground", children: isSettled
+                    ? "No changes have been pushed yet. When the agent changes files " +
+                        "and you approve them, they are pushed to a branch and pull " +
+                        "request here."
+                    : "Changes stay in the session workspace while you review them. " +
+                        "Approved changes are pushed to a branch and pull request here." }) }));
+    }
     return (_jsx("div", { className: "flex flex-col items-center justify-center px-4 py-8 text-center", children: _jsx("p", { className: "text-xs text-muted-foreground", children: "No changes yet. Pull requests will appear here once the agent pushes its work back to your repository." }) }));
 }
 //# sourceMappingURL=ChangesTab.js.map

package/session/facets/ChangesTab.js.map

@@ -1 +1 @@
-{"version":3,"file":"ChangesTab.js","sourceRoot":"","sources":["../../../src/session/facets/ChangesTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAMjE;;;;;;;;;;GAUG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,UAAU,EAAmB;IACxD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,cAAK,IAAI,EAAC,MAAM,EAAC,SAAS,EAAC,WAAW,YACnC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,cAA8C,IAAI,EAAC,UAAU,YAC3D,KAAC,aAAa,IAAC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAI,IADrC,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAEtC,CACP,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,cAAK,SAAS,EAAC,iEAAiE,YAC9E,YAAG,SAAS,EAAC,+BAA+B,uHAGxC,GACA,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ChangesTab.js","sourceRoot":"","sources":["../../../src/session/facets/ChangesTab.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAGb,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAuBjE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,EACzB,UAAU,EACV,gBAAgB,GAAG,KAAK,EACxB,SAAS,GAAG,KAAK,GACD;IAChB,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvE,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CACL,cAAK,IAAI,EAAC,MAAM,EAAC,SAAS,EAAC,WAAW,YACnC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CACzB,cAA8C,IAAI,EAAC,UAAU,YAC3D,KAAC,aAAa,IAAC,SAAS,EAAE,KAAK,CAAC,SAAS,GAAI,IADrC,KAAK,CAAC,SAAS,CAAC,kBAAkB,CAEtC,CACP,CAAC,GACE,CACP,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,CACL,cAAK,SAAS,EAAC,iEAAiE,YAC9E,YAAG,SAAS,EAAC,+BAA+B,YACzC,SAAS;oBACR,CAAC,CAAC,gEAAgE;wBAChE,6DAA6D;wBAC7D,eAAe;oBACjB,CAAC,CAAC,+DAA+D;wBAC/D,gEAAgE,GAClE,GACA,CACP,CAAC;IACJ,CAAC;IAED,OAAO,CACL,cAAK,SAAS,EAAC,iEAAiE,YAC9E,YAAG,SAAS,EAAC,+BAA+B,uHAGxC,GACA,CACP,CAAC;AACJ,CAAC"}

package/session/useSessionRailViews.d.ts

@@ -42,6 +42,21 @@ export interface UseSessionRailViewsOptions {
      * @default true
      */
     readonly includeExecutionFacets?: boolean;
+    /**
+     * Whether the session is expected to push approved changes to a git remote
+     * (a cloud session with git workspace entries). When `true` the Changes
+     * facet is offered from the start — with an honest pre-push state — instead
+     * of only materializing once a write-back exists, so "where does my work
+     * go?" always has an answer. See {@link ChangesTabProps.expectsWriteBack}.
+     * @default false
+     */
+    readonly expectsWriteBack?: boolean;
+    /**
+     * Whether the session's latest execution is settled (terminal) — forwarded
+     * to the Changes facet's pre-push states. See {@link ChangesTabProps.isSettled}.
+     * @default false
+     */
+    readonly changesSettled?: boolean;
 }
 /**
  * Composes the session facets (Config / Changes / Artifacts / Usage / Inspect)
@@ -53,5 +68,5 @@ export interface UseSessionRailViewsOptions {
  * tab rules — Changes/Artifacts surface only when data exists (with count
  * badges), Inspect only when a thread item is selected.
  */
-export declare function useSessionRailViews({ allExecutions, org, sessionConfig, selectedItem, onApplied, onImplementPlan, onOpenPlan, onOpenArtifact, onActivateArtifact, includeExecutionFacets, }: UseSessionRailViewsOptions): readonly SurfaceRailView[];
+export declare function useSessionRailViews({ allExecutions, org, sessionConfig, selectedItem, onApplied, onImplementPlan, onOpenPlan, onOpenArtifact, onActivateArtifact, includeExecutionFacets, expectsWriteBack, changesSettled, }: UseSessionRailViewsOptions): readonly SurfaceRailView[];
 //# sourceMappingURL=useSessionRailViews.d.ts.map

package/session/useSessionRailViews.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionRailViews.d.ts","sourceRoot":"","sources":["../../src/session/useSessionRailViews.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMpE,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3D,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACpE;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAC3C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,aAAa,EACb,GAAG,EACH,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,sBAA6B,GAC9B,EAAE,0BAA0B,GAAG,SAAS,eAAe,EAAE,CAiFzD"}
+{"version":3,"file":"useSessionRailViews.d.ts","sourceRoot":"","sources":["../../src/session/useSessionRailViews.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6DAA6D,CAAC;AAClG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAE1E,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAMpE,+CAA+C;AAC/C,MAAM,WAAW,0BAA0B;IACzC,sEAAsE;IACtE,QAAQ,CAAC,aAAa,EAAE,SAAS,cAAc,EAAE,CAAC;IAClD,gDAAgD;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IAClD,mEAAmE;IACnE,QAAQ,CAAC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACjD,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAC3D,6EAA6E;IAC7E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,IAAI,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,IAAI,CAAC;IACpD;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAChE;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACpE;;;;;OAKG;IACH,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,aAAa,EACb,GAAG,EACH,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,sBAA6B,EAC7B,gBAAwB,EACxB,cAAsB,GACvB,EAAE,0BAA0B,GAAG,SAAS,eAAe,EAAE,CA4FzD"}

package/session/useSessionRailViews.js

@@ -18,7 +18,7 @@ import { InspectTab } from "./facets/InspectTab.js";
  * tab rules — Changes/Artifacts surface only when data exists (with count
  * badges), Inspect only when a thread item is selected.
  */
-export function useSessionRailViews({ allExecutions, org, sessionConfig, selectedItem, onApplied, onImplementPlan, onOpenPlan, onOpenArtifact, onActivateArtifact, includeExecutionFacets = true, }) {
+export function useSessionRailViews({ allExecutions, org, sessionConfig, selectedItem, onApplied, onImplementPlan, onOpenPlan, onOpenArtifact, onActivateArtifact, includeExecutionFacets = true, expectsWriteBack = false, changesSettled = false, }) {
     const { hasWriteBacks, writeBackCount } = useSessionWriteBacks(allExecutions);
     const { hasArtifacts, artifactCount } = useSessionArtifacts(allExecutions);
     return useMemo(() => {
@@ -32,13 +32,16 @@ export function useSessionRailViews({ allExecutions, org, sessionConfig, selecte
             });
         }
         if (includeExecutionFacets) {
-            if (hasWriteBacks) {
+            // Offered when a write-back exists OR the session is expected to
+            // produce one — the facet then carries an honest pre-push state
+            // instead of being invisible until the first push.
+            if (hasWriteBacks || expectsWriteBack) {
                 views.push({
                     id: "changes",
                     label: "Changes",
                     icon: _jsx(ChangesIcon, {}),
-                    badge: writeBackCount,
-                    content: _jsx(ChangesTab, { executions: allExecutions }),
+                    badge: writeBackCount > 0 ? writeBackCount : undefined,
+                    content: (_jsx(ChangesTab, { executions: allExecutions, expectsWriteBack: expectsWriteBack, isSettled: changesSettled })),
                 });
             }
             if (hasArtifacts) {
@@ -69,6 +72,8 @@ export function useSessionRailViews({ allExecutions, org, sessionConfig, selecte
     }, [
         sessionConfig,
         includeExecutionFacets,
+        expectsWriteBack,
+        changesSettled,
         hasWriteBacks,
         writeBackCount,
         hasArtifacts,

package/session/useSessionRailViews.js.map

@@ -1 +1 @@
-{"version":3,"file":"useSessionRailViews.js","sourceRoot":"","sources":["../../src/session/useSessionRailViews.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAKhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AA0CpD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,aAAa,EACb,GAAG,EACH,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,GAAG,IAAI,GACF;IAC3B,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAE3E,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,IAAI,aAAa,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,KAAC,QAAQ,KAAG;gBAClB,OAAO,EAAE,KAAC,QAAQ,OAAK,aAAa,GAAI;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,EAAE,CAAC;YAC3B,IAAI,aAAa,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,KAAC,WAAW,KAAG;oBACrB,KAAK,EAAE,cAAc;oBACrB,OAAO,EAAE,KAAC,UAAU,IAAC,UAAU,EAAE,aAAa,GAAI;iBACnD,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,KAAC,aAAa,KAAG;oBACvB,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,CACP,KAAC,YAAY,IACX,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,cAAc,EAC9B,kBAAkB,EAAE,kBAAkB,GACtC,CACH;iBACF,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,OAAO;gBACX,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,KAAC,SAAS,KAAG;gBACnB,OAAO,EAAE,KAAC,QAAQ,IAAC,UAAU,EAAE,aAAa,GAAI;aACjD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,KAAC,WAAW,KAAG;gBACrB,OAAO,EAAE,KAAC,UAAU,IAAC,YAAY,EAAE,YAAY,GAAI;aACpD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,EAAE;QACD,aAAa;QACb,sBAAsB;QACtB,aAAa;QACb,cAAc;QACd,YAAY;QACZ,aAAa;QACb,aAAa;QACb,GAAG;QACH,SAAS;QACT,eAAe;QACf,UAAU;QACV,cAAc;QACd,kBAAkB;QAClB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,uCAAuC;AACvC,8EAA8E;AAE9E,SAAS,QAAQ;IACf,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,GAAG,GAAG,EAChC,eAAM,CAAC,EAAC,ynBAAynB,GAAG,IAChoB,CACP,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW;IAClB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,KAAK,GAAG,EAChC,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,KAAK,GAAG,EACjC,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,KAAK,GAAG,EACjC,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,4BAA4B,GAAG,IACnC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,eAAM,CAAC,EAAC,2BAA2B,GAAG,EACtC,eAAM,CAAC,EAAC,cAAc,GAAG,EACzB,eAAM,CAAC,EAAC,UAAU,GAAG,IACjB,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,WAAW,GAAG,EACtB,eAAM,CAAC,EAAC,UAAU,GAAG,IACjB,CACP,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW;IAClB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,GAAG,GAAG,EAChC,eAAM,CAAC,EAAC,gCAAgC,GAAG,IACvC,CACP,CAAC;AACJ,CAAC"}
+{"version":3,"file":"useSessionRailViews.js","sourceRoot":"","sources":["../../src/session/useSessionRailViews.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAKhC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAsB,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAyDpD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAClC,aAAa,EACb,GAAG,EACH,aAAa,EACb,YAAY,EACZ,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,sBAAsB,GAAG,IAAI,EAC7B,gBAAgB,GAAG,KAAK,EACxB,cAAc,GAAG,KAAK,GACK;IAC3B,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC9E,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAE3E,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,KAAK,GAAsB,EAAE,CAAC;QAEpC,IAAI,aAAa,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,KAAC,QAAQ,KAAG;gBAClB,OAAO,EAAE,KAAC,QAAQ,OAAK,aAAa,GAAI;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,sBAAsB,EAAE,CAAC;YAC3B,iEAAiE;YACjE,gEAAgE;YAChE,mDAAmD;YACnD,IAAI,aAAa,IAAI,gBAAgB,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,SAAS;oBACb,KAAK,EAAE,SAAS;oBAChB,IAAI,EAAE,KAAC,WAAW,KAAG;oBACrB,KAAK,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;oBACtD,OAAO,EAAE,CACP,KAAC,UAAU,IACT,UAAU,EAAE,aAAa,EACzB,gBAAgB,EAAE,gBAAgB,EAClC,SAAS,EAAE,cAAc,GACzB,CACH;iBACF,CAAC,CAAC;YACL,CAAC;YAED,IAAI,YAAY,EAAE,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC;oBACT,EAAE,EAAE,WAAW;oBACf,KAAK,EAAE,WAAW;oBAClB,IAAI,EAAE,KAAC,aAAa,KAAG;oBACvB,KAAK,EAAE,aAAa;oBACpB,OAAO,EAAE,CACP,KAAC,YAAY,IACX,UAAU,EAAE,aAAa,EACzB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,eAAe,EAChC,UAAU,EAAE,UAAU,EACtB,cAAc,EAAE,cAAc,EAC9B,kBAAkB,EAAE,kBAAkB,GACtC,CACH;iBACF,CAAC,CAAC;YACL,CAAC;YAED,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,OAAO;gBACX,KAAK,EAAE,OAAO;gBACd,IAAI,EAAE,KAAC,SAAS,KAAG;gBACnB,OAAO,EAAE,KAAC,QAAQ,IAAC,UAAU,EAAE,aAAa,GAAI;aACjD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC;gBACT,EAAE,EAAE,SAAS;gBACb,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,KAAC,WAAW,KAAG;gBACrB,OAAO,EAAE,KAAC,UAAU,IAAC,YAAY,EAAE,YAAY,GAAI;aACpD,CAAC,CAAC;QACL,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,EAAE;QACD,aAAa;QACb,sBAAsB;QACtB,gBAAgB;QAChB,cAAc;QACd,aAAa;QACb,cAAc;QACd,YAAY;QACZ,aAAa;QACb,aAAa;QACb,GAAG;QACH,SAAS;QACT,eAAe;QACf,UAAU;QACV,cAAc;QACd,kBAAkB;QAClB,YAAY;KACb,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,uCAAuC;AACvC,8EAA8E;AAE9E,SAAS,QAAQ;IACf,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,GAAG,GAAG,EAChC,eAAM,CAAC,EAAC,ynBAAynB,GAAG,IAChoB,CACP,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,WAAW;IAClB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,KAAK,GAAG,EAChC,iBAAQ,EAAE,EAAC,GAAG,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,KAAK,GAAG,EACjC,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,GAAG,EAAC,CAAC,EAAC,KAAK,GAAG,EACjC,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,4BAA4B,GAAG,IACnC,CACP,CAAC;AACJ,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,eAAM,CAAC,EAAC,2BAA2B,GAAG,EACtC,eAAM,CAAC,EAAC,cAAc,GAAG,EACzB,eAAM,CAAC,EAAC,UAAU,GAAG,IACjB,CACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,UAAU,GAAG,EACrB,eAAM,CAAC,EAAC,WAAW,GAAG,EACtB,eAAM,CAAC,EAAC,UAAU,GAAG,IACjB,CACP,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,SAAS,WAAW;IAClB,OAAO,CACL,eAAK,KAAK,EAAC,IAAI,EAAC,MAAM,EAAC,IAAI,EAAC,OAAO,EAAC,WAAW,EAAC,IAAI,EAAC,MAAM,EAAC,MAAM,EAAC,cAAc,EAAC,WAAW,EAAC,KAAK,EAAC,aAAa,EAAC,OAAO,EAAC,cAAc,EAAC,OAAO,iBAAa,MAAM,aACjK,iBAAQ,EAAE,EAAC,IAAI,EAAC,EAAE,EAAC,IAAI,EAAC,CAAC,EAAC,GAAG,GAAG,EAChC,eAAM,CAAC,EAAC,gCAAgC,GAAG,IACvC,CACP,CAAC;AACJ,CAAC"}

package/src/execution/WriteBackCard.tsx

@@ -17,7 +17,13 @@ export interface WriteBackCardProps {
  *
  * Shows the workspace entry name, branch, diff summary, phase
  * indicator, and a "View PR" link when the pull request was
- * successfully created. On failure, displays the error message.
+ * successfully created.
+ *
+ * Error rendering follows the record's phase honestly (DD-006):
+ * a FAILED record's error is destructive (the work did not reach the
+ * remote), while a PUSHED record carrying an error renders it as a
+ * degraded notice — the branch is live and its info stays usable; only
+ * the PR step failed.
  *
  * Themed via standard semantic tokens — no hardcoded colors, no
  * Console dependencies. Embedders can theme this card through
@@ -85,9 +91,17 @@ export function WriteBackCard({ writeBack, className }: WriteBackCardProps) {
         </div>
       )}
 
-      {/* Error message */}
-      {isFailed && writeBack.error && (
-        <div className="mt-1.5 rounded bg-destructive-subtle px-2 py-1 text-xs text-destructive">
+      {/* Error message: destructive when the write-back itself failed,
+          degraded when the branch pushed but a later step (the PR) did not. */}
+      {writeBack.error && (
+        <div
+          className={cn(
+            "mt-1.5 rounded px-2 py-1 text-xs",
+            isFailed
+              ? "bg-destructive-subtle text-destructive"
+              : "bg-status-degraded-subtle text-status-degraded",
+          )}
+        >
           {writeBack.error}
         </div>
       )}

package/src/execution/__tests__/WriteBackCard.test.tsx

@@ -0,0 +1,83 @@
+/**
+ * WriteBackCard — phase-honest rendering of a workspace write-back record.
+ * The high-stakes matrix is the error treatment: FAILED errors are
+ * destructive, while a PUSHED record carrying a PR error renders it as a
+ * degraded notice with the branch info intact (the branch IS live).
+ */
+import { describe, it, expect, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  WorkspaceWriteBackSchema,
+  WorkspaceWriteBackPhase,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/writeback_pb";
+import { WriteBackCard } from "../WriteBackCard";
+
+function makeWriteBack(overrides: Record<string, unknown> = {}) {
+  return create(WorkspaceWriteBackSchema, {
+    workspaceEntryName: "acme/api",
+    branchName: "stigmer/ses-01test",
+    baseBranch: "main",
+    commitSha: "abc123",
+    diffSummary: " 2 files changed",
+    phase: WorkspaceWriteBackPhase.WORKSPACE_WRITE_BACK_PR_CREATED,
+    pullRequestUrl: "https://github.com/acme/api/pull/12",
+    pullRequestNumber: 12,
+    ...overrides,
+  });
+}
+
+afterEach(() => cleanup());
+
+describe("WriteBackCard", () => {
+  it("renders branch, diff summary, and the PR link for a PR_CREATED record", () => {
+    render(<WriteBackCard writeBack={makeWriteBack()} />);
+    expect(screen.getByText("stigmer/ses-01test")).toBeTruthy();
+    expect(screen.getByText(/2 files changed/)).toBeTruthy();
+    const link = screen.getByRole("link", { name: /view pr #12/i });
+    expect(link.getAttribute("href")).toBe("https://github.com/acme/api/pull/12");
+    expect(screen.getByText("PR Created")).toBeTruthy();
+  });
+
+  it("renders a FAILED record's error destructively", () => {
+    render(
+      <WriteBackCard
+        writeBack={makeWriteBack({
+          phase: WorkspaceWriteBackPhase.WORKSPACE_WRITE_BACK_FAILED,
+          error: "git push failed: connection reset",
+          pullRequestUrl: "",
+          pullRequestNumber: 0,
+        })}
+      />,
+    );
+    const error = screen.getByText(/git push failed/);
+    expect(error.className).toContain("text-destructive");
+    expect(screen.getByText("Failed")).toBeTruthy();
+  });
+
+  it("renders a PUSHED record's PR error as a degraded notice, branch info intact", () => {
+    render(
+      <WriteBackCard
+        writeBack={makeWriteBack({
+          phase: WorkspaceWriteBackPhase.WORKSPACE_WRITE_BACK_PUSHED,
+          error: "No GitHub token available to open a pull request.",
+          pullRequestUrl: "",
+          pullRequestNumber: 0,
+        })}
+      />,
+    );
+    // The branch is live — never styled as a failure.
+    expect(screen.getByText("stigmer/ses-01test")).toBeTruthy();
+    expect(screen.getByText("Pushed")).toBeTruthy();
+    const notice = screen.getByText(/no github token/i);
+    expect(notice.className).toContain("text-status-degraded");
+    expect(notice.className).not.toContain("text-destructive");
+    expect(screen.queryByRole("link")).toBeNull();
+  });
+
+  it("renders no error block for a clean record", () => {
+    const { container } = render(<WriteBackCard writeBack={makeWriteBack()} />);
+    expect(container.querySelector(".bg-destructive-subtle")).toBeNull();
+    expect(container.querySelector(".bg-status-degraded-subtle")).toBeNull();
+  });
+});

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -11,6 +11,8 @@ import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useDisconnectOAuth } from "./useDisconnectOAuth.js";
 import { EnvVarForm } from "../environment/EnvVarForm.js";
 import { ErrorMessage } from "../error/ErrorMessage.js";
+import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
+import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
 
 /** Props for {@link McpServerConnectDialog}. */
 export interface McpServerConnectDialogProps {
@@ -276,6 +278,9 @@ function ConnectDialogContent({
         </p>
       )}
 
+      <StdioSandboxNotice serverType={mcpServer.spec?.serverType} className="mb-4" />
+      <OAuthRequiredNotice oauthOnly={mcpServer.spec?.auth?.oauthOnly} className="mb-4" />
+
       {activeError && (
         <div className="mb-4">
           <ErrorMessage
@@ -295,7 +300,11 @@ function ConnectDialogContent({
           phase={oauth.phase}
           onSignIn={handleOAuthSignIn}
           isVendorApprovalBlocked={creds.isVendorApprovalBlocked}
-          onSwitchToManual={() => creds.setManualOverride(true)}
+          onSwitchToManual={
+            creds.manualEntrySupported
+              ? () => creds.setManualOverride(true)
+              : undefined
+          }
           disabled={isConnectingPhase}
         />
       )}
@@ -408,7 +417,8 @@ function OAuthSection({
   readonly phase: OAuthConnectPhase;
   readonly onSignIn: () => void;
   readonly isVendorApprovalBlocked: boolean;
-  readonly onSwitchToManual: () => void;
+  /** When omitted (e.g. `oauth_only` servers), no manual-entry link is shown. */
+  readonly onSwitchToManual?: () => void;
   readonly disabled?: boolean;
 }) {
   if (isConnected) {
@@ -445,19 +455,21 @@ function OAuthSection({
         {isInProgress && <LoadingSpinner size="sm" />}
         {isInProgress ? (phaseLabel[phase] ?? "Connecting...") : "Sign in with OAuth"}
       </button>
-      {isVendorApprovalBlocked && (
+      {isVendorApprovalBlocked && onSwitchToManual && (
         <p className="text-xs text-muted-foreground">
           OAuth sign-in is pending vendor approval. You can enter your token manually instead.
         </p>
       )}
-      <button
-        type="button"
-        onClick={onSwitchToManual}
-        disabled={disabled || isInProgress}
-        className="text-xs text-muted-foreground underline hover:text-foreground"
-      >
-        Enter token manually
-      </button>
+      {onSwitchToManual && (
+        <button
+          type="button"
+          onClick={onSwitchToManual}
+          disabled={disabled || isInProgress}
+          className="text-xs text-muted-foreground underline hover:text-foreground"
+        >
+          Enter token manually
+        </button>
+      )}
     </div>
   );
 }

package/src/mcp-server/McpServerDetailView.tsx

@@ -20,6 +20,8 @@ import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useMcpServerCredentials } from "./useMcpServerCredentials.js";
 import { useMcpServerOAuthConnect } from "./useMcpServerOAuthConnect.js";
 import type { OAuthConnectPhase } from "./useMcpServerOAuthConnect.js";
+import { StdioSandboxNotice } from "./StdioSandboxNotice.js";
+import { OAuthRequiredNotice } from "./OAuthRequiredNotice.js";
 import { useDisconnectOAuth } from "./useDisconnectOAuth.js";
 import { useOrgOAuthApp } from "./useOrgOAuthApp.js";
 import { OAuthAppForm } from "./OAuthAppForm.js";
@@ -488,7 +490,10 @@ export function McpServerDetailView({
       )}
 
       <Section title="Connection">
+        <StdioSandboxNotice serverType={spec?.serverType} className="mb-3" />
+        <OAuthRequiredNotice oauthOnly={spec?.auth?.oauthOnly} className="mb-3" />
         <ConnectBar
+          manualEntrySupported={credentials.manualEntrySupported}
           isConnecting={connection.isConnecting || oauth.isInProgress}
           connectionError={combinedError}
           onConnect={handleConnectClick}
@@ -709,6 +714,7 @@ function ConnectBar({
   isRemovingOrgApp,
   removeOrgAppError,
   onClearRemoveOrgAppError,
+  manualEntrySupported,
   manualOverride,
   onManualOverride,
   onBackToOAuth,
@@ -742,6 +748,8 @@ function ConnectBar({
   readonly isRemovingOrgApp: boolean;
   readonly removeOrgAppError: Error | null;
   readonly onClearRemoveOrgAppError: () => void;
+  /** `false` for `oauth_only` servers — the manual-entry link is suppressed. */
+  readonly manualEntrySupported: boolean;
   readonly manualOverride: boolean;
   readonly onManualOverride: () => void;
   readonly onBackToOAuth: () => void;
@@ -1047,8 +1055,11 @@ function ConnectBar({
         </div>
       )}
 
-      {/* Secondary actions: manual entry, BYOA, back to OAuth */}
-      {authMode === "oauth" && !isOAuthConnected && !isOAuthBusy && !isConnecting && (
+      {/* Secondary actions: manual entry, BYOA, back to OAuth. Suppressed
+          entirely for oauth_only servers with no BYOA option, so no empty
+          action bar renders. */}
+      {authMode === "oauth" && !isOAuthConnected && !isOAuthBusy && !isConnecting &&
+        (manualOverride || manualEntrySupported || canBringOwnApp) && (
         <div className="flex items-center gap-3 border-t border-border px-3 py-1.5">
           {manualOverride ? (
             <button
@@ -1060,13 +1071,15 @@ function ConnectBar({
             </button>
           ) : (
             <>
-              <button
-                type="button"
-                onClick={onManualOverride}
-                className="text-[11px] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
-              >
-                Enter token manually
-              </button>
+              {manualEntrySupported && (
+                <button
+                  type="button"
+                  onClick={onManualOverride}
+                  className="text-[11px] text-muted-foreground underline decoration-muted-foreground/40 underline-offset-2 hover:text-foreground hover:decoration-foreground"
+                >
+                  Enter token manually
+                </button>
+              )}
               {canBringOwnApp && !isVendorApprovalBlocked && (
                 <button
                   type="button"

package/src/mcp-server/McpServerPicker.tsx

@@ -404,6 +404,8 @@ export function McpServerPicker({
     const auth = entry.mcpServer.spec?.auth;
     const oauthTargetEnvVar = auth?.targetEnvVar || null;
     const hasOAuth = !!auth;
+    // oauth_only endpoints reject static tokens — never offer manual entry.
+    const manualEntrySupported = !auth?.oauthOnly;
     const isManualOverride = manualOverrideKeys.has(view.serverKey);
 
     const entryMissingVars =
@@ -454,15 +456,16 @@ export function McpServerPicker({
           }
         : undefined;
 
-    const handleSwitchToManual = hasOAuth
-      ? () => {
-          setManualOverrideKeys((prev) => {
-            const next = new Set(prev);
-            next.add(view.serverKey);
-            return next;
-          });
-        }
-      : undefined;
+    const handleSwitchToManual =
+      hasOAuth && manualEntrySupported
+        ? () => {
+            setManualOverrideKeys((prev) => {
+              const next = new Set(prev);
+              next.add(view.serverKey);
+              return next;
+            });
+          }
+        : undefined;
 
     const handleSwitchToOAuth =
       hasOAuth && isManualOverride

package/src/mcp-server/OAuthRequiredNotice.tsx

@@ -0,0 +1,77 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+
+/** Props for {@link OAuthRequiredNotice}. */
+export interface OAuthRequiredNoticeProps {
+  /**
+   * The server's `spec.auth.oauth_only` flag. When `true`, the endpoint
+   * rejects manually-entered static tokens and OAuth is the only path.
+   */
+  readonly oauthOnly: boolean | undefined;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * Sets accurate expectations for connecting an **OAuth-only** MCP server —
+ * one whose hosted endpoint rejects manually-entered static tokens
+ * (`spec.auth.oauth_only`, e.g. Notion, Monday).
+ *
+ * Without this notice a user might expect the (now-hidden) manual token
+ * option and wonder why only "Sign in" is offered. It explains, in one line,
+ * that OAuth is required and a pasted API token would be rejected — turning a
+ * silent constraint into a clear one (Nielsen: visibility of system status).
+ *
+ * Self-gating: renders `null` unless the server is `oauth_only`. Callers
+ * render it unconditionally next to their Connect action, mirroring
+ * {@link StdioSandboxNotice}.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function OAuthRequiredNotice({
+  oauthOnly,
+  className,
+}: OAuthRequiredNoticeProps) {
+  if (!oauthOnly) return null;
+
+  return (
+    <div
+      role="status"
+      className={cn(
+        "bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3",
+        className,
+      )}
+    >
+      <KeyIcon className="mt-0.5 size-4 shrink-0" />
+      <p className="text-xs leading-relaxed">
+        This server requires OAuth. Sign in to connect — its hosted endpoint
+        rejects manually-entered API tokens, so a pasted token won&apos;t work
+        here.
+      </p>
+    </div>
+  );
+}
+
+function KeyIcon({ className }: { className?: string }) {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 16 16"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      className={className}
+      aria-hidden="true"
+    >
+      <circle cx="5" cy="11" r="2.5" />
+      <path d="M6.8 9.2 13 3" />
+      <path d="M11 5l1.5 1.5" />
+      <path d="M9 7l1.5 1.5" />
+    </svg>
+  );
+}

package/src/mcp-server/StdioSandboxNotice.tsx

@@ -0,0 +1,98 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+import type { DeploymentMode } from "@stigmer/sdk";
+import type { McpServerSpec } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { useDeploymentMode } from "../deployment-mode.js";
+
+/** The `server_type` oneof discriminator from an MCP server's spec. */
+type McpServerType = McpServerSpec["serverType"];
+
+/**
+ * Whether an MCP server's transport is stdio while connected to Stigmer Cloud.
+ *
+ * stdio servers run as a subprocess inside an isolated Daytona sandbox in the
+ * cloud — not on the user's own computer. This predicate identifies exactly
+ * that combination so the connect UI can set accurate expectations. HTTP
+ * servers and any transport in local mode return `false`.
+ *
+ * Pure and framework-free so it can be unit-tested without rendering.
+ */
+export function isStdioInCloud(
+  mode: DeploymentMode,
+  serverType: McpServerType | undefined,
+): boolean {
+  return mode === "cloud" && serverType?.case === "stdio";
+}
+
+/** Props for {@link StdioSandboxNotice}. */
+export interface StdioSandboxNoticeProps {
+  /** The MCP server's `spec.serverType` oneof. */
+  readonly serverType: McpServerType | undefined;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * Sets accurate expectations for connecting an **stdio** MCP server from
+ * **Stigmer Cloud**.
+ *
+ * stdio servers are a supported cloud capability — Stigmer runs them in an
+ * isolated Daytona sandbox. But that sandbox is not the user's own machine,
+ * so a server that expects access to local files, applications, or a private
+ * network (e.g. a filesystem server) won't behave as the user intends. This
+ * notice explains that up front; Connect itself stays enabled because
+ * self-contained servers work fine.
+ *
+ * Self-gating: reads the deployment mode from context and renders `null`
+ * unless the server is stdio and the backend is cloud. Callers render it
+ * unconditionally next to their Connect action.
+ *
+ * All visual properties flow through `--stgm-*` design tokens. No
+ * Console-specific dependencies — safe for platform-builder embedding.
+ */
+export function StdioSandboxNotice({
+  serverType,
+  className,
+}: StdioSandboxNoticeProps) {
+  const mode = useDeploymentMode();
+  if (!isStdioInCloud(mode, serverType)) return null;
+
+  return (
+    <div
+      role="status"
+      className={cn(
+        "bg-muted-subtle text-muted-foreground flex items-start gap-2.5 rounded-lg border border-transparent px-4 py-3",
+        className,
+      )}
+    >
+      <SandboxIcon className="mt-0.5 size-4 shrink-0" />
+      <p className="text-xs leading-relaxed">
+        This stdio server runs in an isolated cloud sandbox, not on your own
+        computer. Tools that need access to your local files, applications, or
+        private network won&apos;t be available here.
+      </p>
+    </div>
+  );
+}
+
+function SandboxIcon({ className }: { className?: string }) {
+  return (
+    <svg
+      width="16"
+      height="16"
+      viewBox="0 0 16 16"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.5"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      className={className}
+      aria-hidden="true"
+    >
+      <path d="M2 5.5 8 2.5l6 3-6 3-6-3Z" />
+      <path d="M2 5.5v5l6 3 6-3v-5" />
+      <path d="M8 8.5v5" />
+    </svg>
+  );
+}

package/src/mcp-server/__tests__/OAuthRequiredNotice.test.tsx

@@ -0,0 +1,25 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+import { OAuthRequiredNotice } from "../OAuthRequiredNotice";
+
+afterEach(cleanup);
+
+describe("OAuthRequiredNotice", () => {
+  it("renders the OAuth-required caveat when oauth_only is true", () => {
+    render(<OAuthRequiredNotice oauthOnly={true} />);
+    expect(screen.getByRole("status")).toBeTruthy();
+    expect(screen.getByText(/requires OAuth/i)).toBeTruthy();
+    // It explains why manual entry is gone, not just that OAuth is used.
+    expect(screen.getByText(/rejects manually-entered API tokens/i)).toBeTruthy();
+  });
+
+  it("renders nothing when oauth_only is false", () => {
+    const { container } = render(<OAuthRequiredNotice oauthOnly={false} />);
+    expect(container.firstChild).toBeNull();
+  });
+
+  it("renders nothing when oauth_only is undefined", () => {
+    const { container } = render(<OAuthRequiredNotice oauthOnly={undefined} />);
+    expect(container.firstChild).toBeNull();
+  });
+});