@stigmer/react 3.1.6 → 3.1.7

package/src/mcp-server/__tests__/StdioSandboxNotice.test.tsx

@@ -0,0 +1,71 @@
+import { describe, it, expect, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+import type { ReactNode } from "react";
+import type { McpServerSpec } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/spec_pb";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { StdioSandboxNotice, isStdioInCloud } from "../StdioSandboxNotice";
+
+type McpServerType = McpServerSpec["serverType"];
+
+const STDIO = { case: "stdio" } as McpServerType;
+const HTTP = { case: "http" } as McpServerType;
+const UNSET = { case: undefined } as McpServerType;
+
+afterEach(cleanup);
+
+describe("isStdioInCloud", () => {
+  it("is true only for stdio transport in cloud mode", () => {
+    expect(isStdioInCloud("cloud", STDIO)).toBe(true);
+  });
+
+  it("is false for stdio transport in local mode", () => {
+    expect(isStdioInCloud("local", STDIO)).toBe(false);
+  });
+
+  it("is false for http transport in cloud mode", () => {
+    expect(isStdioInCloud("cloud", HTTP)).toBe(false);
+  });
+
+  it("is false when the transport oneof is unset", () => {
+    expect(isStdioInCloud("cloud", UNSET)).toBe(false);
+  });
+
+  it("is false when serverType is undefined", () => {
+    expect(isStdioInCloud("cloud", undefined)).toBe(false);
+  });
+});
+
+function withMode(mode: "cloud" | "local", children: ReactNode) {
+  return (
+    <DeploymentModeContext.Provider value={mode}>
+      {children}
+    </DeploymentModeContext.Provider>
+  );
+}
+
+describe("StdioSandboxNotice", () => {
+  it("renders the sandbox-isolation caveat for stdio in cloud", () => {
+    render(withMode("cloud", <StdioSandboxNotice serverType={STDIO} />));
+    expect(screen.getByRole("status")).toBeTruthy();
+    expect(screen.getByText(/isolated cloud sandbox/i)).toBeTruthy();
+  });
+
+  it("does not suggest the CLI (avoids inaccurate guidance)", () => {
+    render(withMode("cloud", <StdioSandboxNotice serverType={STDIO} />));
+    expect(screen.queryByText(/stigmer connect/i)).toBeNull();
+  });
+
+  it("renders nothing for http servers in cloud", () => {
+    const { container } = render(
+      withMode("cloud", <StdioSandboxNotice serverType={HTTP} />),
+    );
+    expect(container.firstChild).toBeNull();
+  });
+
+  it("renders nothing for stdio servers in local mode", () => {
+    const { container } = render(
+      withMode("local", <StdioSandboxNotice serverType={STDIO} />),
+    );
+    expect(container.firstChild).toBeNull();
+  });
+});

package/src/mcp-server/useMcpServerCredentials.ts

@@ -153,6 +153,18 @@ export interface UseMcpServerCredentialsReturn {
    * link (when vendor approval is granted).
    */
   readonly canBringOwnApp: boolean;
+  /**
+   * `true` when a manually-entered static token is a valid way to
+   * authenticate this server. `false` for `oauth_only` servers whose
+   * hosted endpoint rejects static tokens (`spec.auth.oauth_only`), where
+   * OAuth is the sole credential path.
+   *
+   * Connect surfaces use this to decide whether to offer the "enter token
+   * manually" affordance — offering it on an `oauth_only` server would send
+   * the user down a path that cannot succeed. Always `true` for manual-only
+   * and PAT-capable servers.
+   */
+  readonly manualEntrySupported: boolean;
   /**
    * When `true`, the user has opted to bypass OAuth and enter the
    * `target_env_var` token manually. In this state:
@@ -251,6 +263,14 @@ export function useMcpServerCredentials(
   const oauthTargetEnvVar = auth?.targetEnvVar || null;
   const tokenLifetimeHint = auth?.tokenLifetimeHint || null;
 
+  // A static token is a valid credential for every server except those whose
+  // endpoint declares it rejects them (`oauth_only`). This is the single source
+  // of truth the connect surfaces consult before offering manual entry.
+  const manualEntrySupported = !auth?.oauthOnly;
+  // Defensively force manual override off for oauth_only servers so no surface
+  // can enter a dead-end manual-entry state, even if a stale toggle is set.
+  const effectiveManualOverride = manualOverride && manualEntrySupported;
+
   const oauthStatus = mcpServer?.status?.oauthStatus;
   const isVendorApprovalPending =
     authMode === "oauth" &&
@@ -298,15 +318,15 @@ export function useMcpServerCredentials(
   );
 
   const missingVariables = useMemo(() => {
-    if (!oauthTargetEnvVar || manualOverride) return requiredMissing;
+    if (!oauthTargetEnvVar || effectiveManualOverride) return requiredMissing;
     return requiredMissing.filter((v) => v.key !== oauthTargetEnvVar);
-  }, [requiredMissing, oauthTargetEnvVar, manualOverride]);
+  }, [requiredMissing, oauthTargetEnvVar, effectiveManualOverride]);
 
   const isReady =
     !personalEnv.isLoading &&
     !grantStatus.isLoading &&
     missingVariables.length === 0 &&
-    (authMode === "manual" || manualOverride || isOAuthConnected);
+    (authMode === "manual" || effectiveManualOverride || isOAuthConnected);
 
   const saveCredentials = useCallback(
     async (values: Record<string, EnvVarInput>): Promise<void> => {
@@ -335,6 +355,7 @@ export function useMcpServerCredentials(
     effectiveOAuthSource,
     isOrgOAuthApp,
     canBringOwnApp,
+    manualEntrySupported,
     missingVariables,
     isReady,
     isLoading: personalEnv.isLoading || grantStatus.isLoading,
@@ -342,7 +363,7 @@ export function useMcpServerCredentials(
     saveCredentials,
     isSaving: personalEnv.isMutating,
     refetch,
-    manualOverride,
+    manualOverride: effectiveManualOverride,
     setManualOverride,
   };
 }