@stigmer/react 3.1.8 → 3.1.9

package/src/sharing/__tests__/useAgentShare.test.tsx

@@ -0,0 +1,149 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { renderHook, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import type { GetAgentSharesByAgentRequest } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
+import { StigmerContext } from "../../context";
+import { FetchCacheContext } from "../../internal/FetchCacheProvider";
+import { useAgentShare } from "../useAgentShare";
+
+function createMockStigmer(overrides: {
+  getByAgent?: (input: GetAgentSharesByAgentRequest) => Promise<unknown>;
+} = {}) {
+  return {
+    agentShare: {
+      getByAgent:
+        overrides.getByAgent ??
+        vi.fn().mockResolvedValue({ totalCount: 0, items: [] }),
+    },
+  } as never;
+}
+
+function wrapper(client: unknown) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <FetchCacheContext.Provider value={null}>
+        <StigmerContext.Provider value={client as never}>
+          {children}
+        </StigmerContext.Provider>
+      </FetchCacheContext.Provider>
+    );
+  };
+}
+
+const AGENT = {
+  metadata: {
+    id: "agt_1",
+    org: "acme",
+    slug: "support-agent",
+    name: "Support Agent",
+  },
+} as never;
+
+function makeShare(slug: string, id = `ash_${slug}`) {
+  return {
+    metadata: { id, org: "acme", slug },
+    spec: { enabled: true },
+  };
+}
+
+describe("useAgentShare", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("loads the agent's shares by agent id", async () => {
+    const share = makeShare("support-agent");
+    const getByAgent = vi
+      .fn()
+      .mockResolvedValue({ totalCount: 1, items: [share] });
+    const client = createMockStigmer({ getByAgent });
+
+    const { result } = renderHook(() => useAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    expect(result.current.isLoading).toBe(true);
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    expect(result.current.share).toBe(share);
+    expect(result.current.error).toBeNull();
+    expect(getByAgent).toHaveBeenCalledWith(
+      expect.objectContaining({ agentId: "agt_1" }),
+    );
+  });
+
+  it("resolves null (no share yet) when the agent has never been shared", async () => {
+    const client = createMockStigmer();
+
+    const { result } = renderHook(() => useAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    // The no-share state is not an error: the first save creates the share.
+    expect(result.current.share).toBeNull();
+    expect(result.current.error).toBeNull();
+  });
+
+  it("picks the slug-matching share as canonical when several exist", async () => {
+    const canonical = makeShare("support-agent");
+    const renamed = makeShare("support-help-desk");
+    const getByAgent = vi
+      .fn()
+      .mockResolvedValue({ totalCount: 2, items: [renamed, canonical] });
+    const client = createMockStigmer({ getByAgent });
+
+    const { result } = renderHook(() => useAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.share).toBe(canonical);
+  });
+
+  it("falls back to the first share when none matches the agent slug", async () => {
+    // A manifest-created share with a custom slug is still manageable —
+    // preferring it over "no share" keeps the dialog editing the real row.
+    const renamed = makeShare("support-help-desk");
+    const getByAgent = vi
+      .fn()
+      .mockResolvedValue({ totalCount: 1, items: [renamed] });
+    const client = createMockStigmer({ getByAgent });
+
+    const { result } = renderHook(() => useAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.share).toBe(renamed);
+  });
+
+  it("skips fetching while the agent is null (stable no-op)", () => {
+    const getByAgent = vi.fn();
+    const client = createMockStigmer({ getByAgent });
+
+    const { result } = renderHook(() => useAgentShare(null), {
+      wrapper: wrapper(client),
+    });
+
+    expect(result.current.isLoading).toBe(false);
+    expect(result.current.share).toBeNull();
+    expect(getByAgent).not.toHaveBeenCalled();
+  });
+
+  it("exposes fetch failures as errors", async () => {
+    const getByAgent = vi
+      .fn()
+      .mockRejectedValue(new Error("backend unavailable"));
+    const client = createMockStigmer({ getByAgent });
+
+    const { result } = renderHook(() => useAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.error).toBeTruthy();
+    expect(result.current.share).toBeNull();
+  });
+});

package/src/sharing/__tests__/useRotateShareLink.test.tsx

@@ -1,7 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { renderHook, act } from "@testing-library/react";
 import type { ReactNode } from "react";
-import type { RotateShareLinkInput } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/io_pb";
+import type { RotateShareLinkInput } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/io_pb";
 import { StigmerContext } from "../../context";
 import { useRotateShareLink } from "../useRotateShareLink";
 
@@ -9,7 +9,7 @@ function createMockStigmer(overrides: {
   rotateShareLink?: (input: RotateShareLinkInput) => Promise<unknown>;
 } = {}) {
   return {
-    agent: {
+    agentShare: {
       rotateShareLink:
         overrides.rotateShareLink ?? vi.fn().mockResolvedValue({}),
     },
@@ -31,15 +31,15 @@ describe("useRotateShareLink", () => {
     vi.restoreAllMocks();
   });
 
-  it("calls rotateShareLink with the agent id and returns the updated agent", async () => {
+  it("calls rotateShareLink with the share id and returns the updated share", async () => {
     const rotated = {
-      metadata: { id: "agt_1" },
+      metadata: { id: "ash_1" },
       status: { shareLinkToken: "fresh-token" },
     };
     const rotateShareLink = vi.fn().mockResolvedValue(rotated);
     const client = createMockStigmer({ rotateShareLink });
 
-    const { result } = renderHook(() => useRotateShareLink("agt_1"), {
+    const { result } = renderHook(() => useRotateShareLink("ash_1"), {
       wrapper: wrapper(client),
     });
 
@@ -50,7 +50,7 @@ describe("useRotateShareLink", () => {
 
     expect(rotateShareLink).toHaveBeenCalledTimes(1);
     const input = rotateShareLink.mock.calls[0][0] as RotateShareLinkInput;
-    expect(input.resourceId).toBe("agt_1");
+    expect(input.resourceId).toBe("ash_1");
     // The server generates the token — the request carries nothing but the id.
     expect(Object.keys(input)).not.toContain("linkToken");
     expect(returned).toBe(rotated);
@@ -58,7 +58,7 @@ describe("useRotateShareLink", () => {
     expect(result.current.isPending).toBe(false);
   });
 
-  it("is a stable no-op while agentId is null", async () => {
+  it("is a stable no-op while shareId is null (agent never shared)", async () => {
     const rotateShareLink = vi.fn();
     const client = createMockStigmer({ rotateShareLink });
 
@@ -80,7 +80,7 @@ describe("useRotateShareLink", () => {
     const rotateShareLink = vi.fn().mockRejectedValue(failure);
     const client = createMockStigmer({ rotateShareLink });
 
-    const { result } = renderHook(() => useRotateShareLink("agt_1"), {
+    const { result } = renderHook(() => useRotateShareLink("ash_1"), {
       wrapper: wrapper(client),
     });
 

package/src/sharing/__tests__/useSaveAgentShare.test.tsx

@@ -0,0 +1,241 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { renderHook, act, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { AgentShareAudience } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/spec_pb";
+import type { AgentShare } from "@stigmer/protos/ai/stigmer/agentic/agentshare/v1/api_pb";
+import type { AgentShareInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import {
+  sharingAudienceFromProto,
+  useSaveAgentShare,
+  type AgentShareDraft,
+} from "../useSaveAgentShare";
+
+function createMockStigmer(overrides: {
+  apply?: (input: AgentShareInput) => Promise<unknown>;
+} = {}) {
+  return {
+    agentShare: {
+      apply: overrides.apply ?? vi.fn().mockResolvedValue({}),
+    },
+  } as never;
+}
+
+function wrapper(client: unknown) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <StigmerContext.Provider value={client as never}>
+        {children}
+      </StigmerContext.Provider>
+    );
+  };
+}
+
+const AGENT = {
+  metadata: {
+    id: "agt_1",
+    org: "acme",
+    slug: "support-agent",
+    name: "Support Agent",
+  },
+} as never;
+
+const FULL_DRAFT: AgentShareDraft = {
+  enabled: true,
+  audience: "public",
+  allowedOrigins: ["https://example.com", "https://docs.example.com"],
+  messages: {
+    rateLimited: "Slow down, please.",
+    unavailable: "We're out of credits.",
+    conversationEnded: "This conversation has ended.",
+  },
+  environmentRefs: [{ org: "acme", slug: "github-org-shared" }],
+};
+
+describe("useSaveAgentShare", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("applies the complete configuration — identity, agent_ref, origins, messages, and bindings", async () => {
+    const apply = vi.fn().mockResolvedValue({});
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    // No existing share: the apply creates the canonical one, keyed on
+    // the agent's own org/slug (the server's D2 default, made explicit).
+    await act(() => result.current.save(FULL_DRAFT, null));
+
+    expect(apply).toHaveBeenCalledTimes(1);
+    const input = apply.mock.calls[0][0] as AgentShareInput;
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("support-agent");
+    expect(input.name).toBe("Support Agent");
+    expect(input.agentRef).toEqual({ org: "acme", slug: "support-agent" });
+    expect(input.enabled).toBe(true);
+    expect(input.allowedOrigins).toEqual([
+      "https://example.com",
+      "https://docs.example.com",
+    ]);
+    expect(input.messages?.rateLimited).toBe("Slow down, please.");
+    expect(input.messages?.unavailable).toBe("We're out of credits.");
+    expect(input.messages?.conversationEnded).toBe(
+      "This conversation has ended.",
+    );
+    expect(input.environmentRefs).toEqual([
+      { org: "acme", slug: "github-org-shared" },
+    ]);
+  });
+
+  it("keeps the existing share's identity when editing (a renamed share is never forked)", async () => {
+    const apply = vi.fn().mockResolvedValue({});
+    const client = createMockStigmer({ apply });
+    // A share created via manifest with a non-default slug: applying with
+    // the agent's slug would create a SECOND share instead of updating.
+    const renamedShare = {
+      metadata: { id: "ash_1", org: "acme", slug: "help-desk", name: "Help Desk" },
+      spec: { enabled: true },
+    } as AgentShare;
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await act(() => result.current.save(FULL_DRAFT, renamedShare));
+
+    const input = apply.mock.calls[0][0] as AgentShareInput;
+    expect(input.slug).toBe("help-desk");
+    expect(input.name).toBe("Help Desk");
+    // The agent reference is the agent's identity regardless of share slug.
+    expect(input.agentRef).toEqual({ org: "acme", slug: "support-agent" });
+  });
+
+  it("disabling still carries origins, messages, bindings, and audience (toggle never clobbers config)", async () => {
+    const apply = vi.fn().mockResolvedValue({});
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await act(() =>
+      result.current.save(
+        { ...FULL_DRAFT, enabled: false, audience: "org", environmentRefs: [] },
+        null,
+      ),
+    );
+
+    const input = apply.mock.calls[0][0] as AgentShareInput;
+    expect(input.enabled).toBe(false);
+    // Apply replaces the spec wholesale — a disable that dropped these
+    // fields would silently erase the owner's configuration (an audience
+    // drop would silently revert an org-only share to public).
+    expect(input.allowedOrigins).toEqual(FULL_DRAFT.allowedOrigins);
+    expect(input.messages?.rateLimited).toBe(FULL_DRAFT.messages.rateLimited);
+    expect(input.audience).toBe(AgentShareAudience.org);
+  });
+
+  it("maps the audience union to the proto enum, writing public explicitly", async () => {
+    const apply = vi.fn().mockResolvedValue({});
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    await act(() => result.current.save(FULL_DRAFT, null));
+    await act(() =>
+      result.current.save(
+        { ...FULL_DRAFT, audience: "org", environmentRefs: [] },
+        null,
+      ),
+    );
+
+    const first = apply.mock.calls[0][0] as AgentShareInput;
+    const second = apply.mock.calls[1][0] as AgentShareInput;
+    // "public" persists as the explicit enum value, never unspecified —
+    // a console-managed share can't be downgraded by a later manifest
+    // that relies on the unspecified-means-public default.
+    expect(first.audience).toBe(AgentShareAudience.public);
+    expect(second.audience).toBe(AgentShareAudience.org);
+  });
+
+  it("is a stable no-op when the agent is null", async () => {
+    const apply = vi.fn();
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(null), {
+      wrapper: wrapper(client),
+    });
+
+    const returned = await act(() => result.current.save(FULL_DRAFT, null));
+    expect(returned).toBeUndefined();
+    expect(apply).not.toHaveBeenCalled();
+  });
+
+  it("exposes isPending during the request", async () => {
+    let resolveRpc: (v: unknown) => void = () => {};
+    const apply = vi.fn().mockReturnValue(
+      new Promise((resolve) => {
+        resolveRpc = resolve;
+      }),
+    );
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    let pending: Promise<unknown>;
+    act(() => {
+      pending = result.current.save(FULL_DRAFT, null);
+    });
+    expect(result.current.isPending).toBe(true);
+
+    await act(async () => {
+      resolveRpc({});
+      await pending;
+    });
+    expect(result.current.isPending).toBe(false);
+  });
+
+  it("captures and rethrows RPC errors", async () => {
+    const failure = new Error("permission denied");
+    const apply = vi.fn().mockRejectedValue(failure);
+    const client = createMockStigmer({ apply });
+
+    const { result } = renderHook(() => useSaveAgentShare(AGENT), {
+      wrapper: wrapper(client),
+    });
+
+    let caught: unknown;
+    await act(async () => {
+      try {
+        await result.current.save(FULL_DRAFT, null);
+      } catch (err) {
+        caught = err;
+      }
+    });
+
+    expect(caught).toBe(failure);
+    await waitFor(() => expect(result.current.error).toBe(failure));
+    expect(result.current.isPending).toBe(false);
+  });
+});
+
+describe("sharingAudienceFromProto", () => {
+  it("maps unspecified to public (a share without an audience is anyone-with-link)", () => {
+    expect(sharingAudienceFromProto(undefined)).toBe("public");
+    expect(sharingAudienceFromProto(AgentShareAudience.unspecified)).toBe(
+      "public",
+    );
+  });
+
+  it("maps the explicit values", () => {
+    expect(sharingAudienceFromProto(AgentShareAudience.public)).toBe("public");
+    expect(sharingAudienceFromProto(AgentShareAudience.org)).toBe("org");
+  });
+});

package/src/sharing/__tests__/useShareAgent.test.tsx

@@ -29,7 +29,11 @@ function createMockStigmer(overrides: {
           isAuthorized: overrides.isAuthorized ?? true,
         }),
     },
-    agent: { updateSharing: vi.fn().mockResolvedValue({}) },
+    agentShare: {
+      getByAgent: vi.fn().mockResolvedValue({ totalCount: 0, items: [] }),
+      apply: vi.fn().mockResolvedValue({}),
+      rotateShareLink: vi.fn().mockResolvedValue({}),
+    },
     billing: { getOrCreateBillingAccount: vi.fn().mockResolvedValue(null) },
   } as never;
 }
@@ -53,7 +57,7 @@ const AGENT = {
     slug: "support-agent",
     name: "Support Agent",
   },
-  spec: { sharing: undefined },
+  spec: {},
 } as never;
 
 describe("useShareAgent", () => {

package/src/sharing/__tests__/useShareToolReadiness.test.tsx

@@ -8,11 +8,9 @@ import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apires
 import { StigmerContext } from "../../context";
 import { DeploymentModeContext } from "../../deployment-mode";
 import { useShareToolReadiness } from "../useShareToolReadiness";
+import type { AgentShareDraft, SharingAudience } from "../useSaveAgentShare";
 
-function toolAgent(overrides?: {
-  mcpUsages?: boolean;
-  defaultInstanceId?: string;
-}): Agent {
+function toolAgent(overrides?: { mcpUsages?: boolean }): Agent {
   return create(AgentSchema, {
     metadata: { id: "agt_1", org: "acme", slug: "helper" },
     spec: {
@@ -22,23 +20,28 @@ function toolAgent(overrides?: {
           ? [{ mcpServerRef: { org: "acme", slug: "github" } }]
           : [],
     },
-    status: {
-      defaultInstanceId: overrides?.defaultInstanceId ?? "agi_1",
-    },
   });
 }
 
+function makeDraft(overrides?: {
+  enabled?: boolean;
+  audience?: SharingAudience;
+  environmentRefs?: { org: string; slug: string }[];
+}): AgentShareDraft {
+  return {
+    enabled: overrides?.enabled ?? true,
+    audience: overrides?.audience ?? "public",
+    allowedOrigins: [],
+    messages: { rateLimited: "", unavailable: "", conversationEnded: "" },
+    environmentRefs: overrides?.environmentRefs ?? [],
+  };
+}
+
 function mockStigmer(overrides: {
-  instanceEnvRefs?: { org: string; slug: string }[];
   envVisibility?: Record<string, ApiResourceVisibility>;
   envError?: boolean;
 }) {
   return {
-    agentInstance: {
-      get: vi.fn().mockResolvedValue({
-        spec: { environmentRefs: overrides.instanceEnvRefs ?? [] },
-      }),
-    },
     environment: {
       getByReference: vi.fn().mockImplementation(
         ({ slug }: { org: string; slug: string }) => {
@@ -70,20 +73,46 @@ function wrapper(client: unknown, mode: "cloud" | "local" = "cloud") {
   };
 }
 
+function envLookup(client: unknown) {
+  return (
+    client as { environment: { getByReference: ReturnType<typeof vi.fn> } }
+  ).environment.getByReference;
+}
+
 describe("useShareToolReadiness", () => {
+  it("reports needs-credentials when a tool-using share has no bindings — no lookups fire", async () => {
+    const client = mockStigmer({});
+    const { result } = renderHook(
+      () => useShareToolReadiness(toolAgent(), makeDraft()),
+      { wrapper: wrapper(client) },
+    );
+
+    // A tool-using agent with zero bound environments is broken for
+    // visitors BY CONSTRUCTION (guests receive credentials only from the
+    // share's bindings) — the hook says so instead of staying silent,
+    // and needs no server round-trip to know it.
+    expect(result.current).toEqual({ status: "needs-credentials" });
+    await waitFor(() => expect(envLookup(client)).not.toHaveBeenCalled());
+  });
+
   it("reports blocked with the private environment refs listed", async () => {
     const client = mockStigmer({
-      instanceEnvRefs: [
-        { org: "acme", slug: "private-creds" },
-        { org: "acme", slug: "shared-creds" },
-      ],
       envVisibility: {
         "shared-creds": ApiResourceVisibility.visibility_org,
       },
     });
 
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), true),
+      () =>
+        useShareToolReadiness(
+          toolAgent(),
+          makeDraft({
+            environmentRefs: [
+              { org: "acme", slug: "private-creds" },
+              { org: "acme", slug: "shared-creds" },
+            ],
+          }),
+        ),
       { wrapper: wrapper(client) },
     );
 
@@ -97,14 +126,19 @@ describe("useShareToolReadiness", () => {
 
   it("reports ready when every bound environment is org-shared", async () => {
     const client = mockStigmer({
-      instanceEnvRefs: [{ org: "acme", slug: "shared-creds" }],
       envVisibility: {
         "shared-creds": ApiResourceVisibility.visibility_org,
       },
     });
 
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), true),
+      () =>
+        useShareToolReadiness(
+          toolAgent(),
+          makeDraft({
+            environmentRefs: [{ org: "acme", slug: "shared-creds" }],
+          }),
+        ),
       { wrapper: wrapper(client) },
     );
 
@@ -112,13 +146,16 @@ describe("useShareToolReadiness", () => {
   });
 
   it("treats an unreadable environment ref as blocking", async () => {
-    const client = mockStigmer({
-      instanceEnvRefs: [{ org: "acme", slug: "deleted-env" }],
-      envError: true,
-    });
+    const client = mockStigmer({ envError: true });
 
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), true),
+      () =>
+        useShareToolReadiness(
+          toolAgent(),
+          makeDraft({
+            environmentRefs: [{ org: "acme", slug: "deleted-env" }],
+          }),
+        ),
       { wrapper: wrapper(client) },
     );
 
@@ -133,50 +170,50 @@ describe("useShareToolReadiness", () => {
   it("is n/a for agents without MCP tools — no lookups fire", async () => {
     const client = mockStigmer({});
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent({ mcpUsages: false }), true),
+      () =>
+        useShareToolReadiness(
+          toolAgent({ mcpUsages: false }),
+          makeDraft({
+            environmentRefs: [{ org: "acme", slug: "shared-creds" }],
+          }),
+        ),
       { wrapper: wrapper(client) },
     );
 
     expect(result.current).toEqual({ status: "na" });
-    await waitFor(() => {
-      expect(
-        (client as { agentInstance: { get: ReturnType<typeof vi.fn> } })
-          .agentInstance.get,
-      ).not.toHaveBeenCalled();
-    });
+    await waitFor(() => expect(envLookup(client)).not.toHaveBeenCalled());
   });
 
   it("is n/a when sharing is disabled", () => {
-    const client = mockStigmer({
-      instanceEnvRefs: [{ org: "acme", slug: "private-creds" }],
-    });
+    const client = mockStigmer({});
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), false),
+      () => useShareToolReadiness(toolAgent(), makeDraft({ enabled: false })),
       { wrapper: wrapper(client) },
     );
 
     expect(result.current).toEqual({ status: "na" });
   });
 
-  it("is n/a in local mode — no guest runtime, no secret gating", () => {
-    const client = mockStigmer({
-      instanceEnvRefs: [{ org: "acme", slug: "private-creds" }],
-    });
+  it("is n/a for org-audience shares — bindings are public-audience only", () => {
+    const client = mockStigmer({});
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), true),
-      { wrapper: wrapper(client, "local") },
+      () => useShareToolReadiness(toolAgent(), makeDraft({ audience: "org" })),
+      { wrapper: wrapper(client) },
     );
 
+    // Org-audience shares reject environment_refs at the proto boundary
+    // (member sessions carry no share linkage in Phase A), so there is
+    // no credential state to advise on.
     expect(result.current).toEqual({ status: "na" });
   });
 
-  it("is n/a when the instance has no bound environments (no warning on a guess)", async () => {
-    const client = mockStigmer({ instanceEnvRefs: [] });
+  it("is n/a in local mode — no guest runtime, no secret gating", () => {
+    const client = mockStigmer({});
     const { result } = renderHook(
-      () => useShareToolReadiness(toolAgent(), true),
-      { wrapper: wrapper(client) },
+      () => useShareToolReadiness(toolAgent(), makeDraft()),
+      { wrapper: wrapper(client, "local") },
     );
 
-    await waitFor(() => expect(result.current).toEqual({ status: "na" }));
+    expect(result.current).toEqual({ status: "na" });
   });
 });