@stigmer/react 3.11.1-dev.20260812192248 → 3.12.1

package/src/internal/isUnimplemented.ts

@@ -0,0 +1,26 @@
+/**
+ * Detect gRPC/Connect UNIMPLEMENTED (code 12) from any error the SDK
+ * client can throw.
+ *
+ * UNIMPLEMENTED is how the shared SDK discovers edition capabilities:
+ * the OSS server deliberately leaves hosted-only RPCs unimplemented
+ * (e.g. the org-OAuth-app override surface, stigmer/stigmer#558), and
+ * hooks probe for it to degrade gracefully instead of surfacing an
+ * error. The SDK's generated CODE_MAP does not include Unimplemented —
+ * a `StigmerError` wrapping one reports `code: "unknown"` — so
+ * detection must go through `connectCode` (or the message shapes used
+ * by transports that never produce a structured error).
+ *
+ * @internal
+ */
+export function isUnimplemented(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  if (
+    "connectCode" in err &&
+    (err as { connectCode: unknown }).connectCode === 12
+  ) {
+    return true;
+  }
+  const msg = (err as { message?: string }).message ?? "";
+  return msg.includes("[unimplemented]") || msg.includes("UNIMPLEMENTED");
+}

package/src/library/useExportResource.ts

@@ -3,7 +3,6 @@
 import { useCallback, useMemo } from "react";
 import { parse as parseYaml } from "yaml";
 import type { Agent } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/api_pb";
-import type { Datastore } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import type { Schedule } from "@stigmer/protos/ai/stigmer/agentic/schedule/v1/api_pb";
 import type { Workflow } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/api_pb";
@@ -18,9 +17,9 @@ import { serializeWorkflowYaml } from "../workflow/serialize-workflow-yaml.js";
 /** Options for {@link useExportResource}. */
 export interface UseExportResourceOptions {
   /** The resource kind — determines which serializer is used. */
-  readonly kind: "Agent" | "McpServer" | "Workflow" | "Datastore" | "Schedule";
+  readonly kind: "Agent" | "McpServer" | "Workflow" | "Schedule";
   /** The proto resource to export, or `null` when not yet loaded. */
-  readonly resource: Agent | McpServer | Workflow | Datastore | Schedule | null;
+  readonly resource: Agent | McpServer | Workflow | Schedule | null;
 }
 
 /** Return value of {@link useExportResource}. */
@@ -45,7 +44,7 @@ export interface UseExportResourceReturn {
 
 /**
  * Headless export hook for Stigmer resources (Agent, McpServer,
- * Workflow, Datastore, Schedule).
+ * Workflow, Schedule).
  *
  * Serializes the resource into YAML and JSON formats and provides
  * stable callbacks for copying to clipboard or triggering a file

package/src/manifest/EditResourceYamlDialog.tsx

@@ -155,8 +155,7 @@ export function EditResourceYamlDialog({
           </div>
         )}
 
-        {/* Apply error — the server's refusal (e.g. a datastore
-            collection-removal rejection) rendered verbatim, with an
+        {/* Apply error — the server's refusal rendered verbatim, with an
             acknowledge-and-retry affordance: the operator reads the
             guard, edits or decides, and re-applies without reopening
             the dialog. */}

package/src/manifest/__tests__/ApplyManifestDialog.test.tsx

@@ -36,7 +36,7 @@ function entry(
 ): ManifestPreviewEntry {
   return {
     document: {
-      handler: { yamlKind: "datastore", displayName: "Datastore" },
+      handler: { yamlKind: "mcpserver", displayName: "McpServer" },
       name: slug,
       slug,
       org: "acme",
@@ -55,7 +55,7 @@ const applyAllMock = vi.fn(async () => applyAllResult);
 vi.mock("../useApplyManifest", () => ({
   useApplyManifest: (): UseApplyManifestReturn =>
     ({
-      content: "kind: Datastore",
+      content: "kind: McpServer",
       setContent: vi.fn(),
       readFile: vi.fn(),
       entries: mockEntries,

package/src/manifest/__tests__/EditResourceYamlDialog.test.tsx

@@ -1,13 +1,13 @@
 // Tests for the shared Edit-YAML dialog's apply-error affordance
 // (DD-008 SD-6): the server's refusal renders verbatim with
-// Try-again/Dismiss — shared by every kind (McpServer, Agent, Skill,
-// Datastore), so the datastore collection-removal rejection and any
-// other apply-time guard get the same acknowledge-and-retry treatment.
+// Try-again/Dismiss — shared by every kind (McpServer, Agent, Skill),
+// so any apply-time guard gets the same acknowledge-and-retry
+// treatment.
 
 import { describe, it, expect, vi, beforeAll, afterEach } from "vitest";
 import { render, screen, cleanup, fireEvent } from "@testing-library/react";
 import { create } from "@bufbuild/protobuf";
-import { DatastoreSchema } from "@stigmer/protos/ai/stigmer/agentic/datastore/v1/api_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { EditResourceYamlDialog } from "../EditResourceYamlDialog";
 import type { useEditResourceYaml } from "../useEditResourceYaml";
 
@@ -34,7 +34,7 @@ let editState: Partial<EditState>;
 
 vi.mock("../useEditResourceYaml", () => ({
   useEditResourceYaml: () => ({
-    yaml: "kind: Datastore",
+    yaml: "kind: McpServer",
     setYaml: vi.fn(),
     validation: { status: "valid" as const },
     target: { action: "update" as const, slug: "clinic" },
@@ -54,8 +54,8 @@ vi.mock("../YamlEditor", () => ({
   YamlEditor: () => <div data-testid="yaml-editor" />,
 }));
 
-const RESOURCE = create(DatastoreSchema, {
-  metadata: { id: "dst_1", slug: "clinic", org: "acme", name: "Clinic" },
+const RESOURCE = create(McpServerSchema, {
+  metadata: { id: "mcp_1", slug: "clinic", org: "acme", name: "Clinic" },
 });
 
 function renderDialog() {
@@ -73,14 +73,14 @@ describe("EditResourceYamlDialog — apply-error affordance", () => {
   it("renders the server's refusal verbatim with Try again and Dismiss", () => {
     editState = {
       error: new Error(
-        'collection "old_notes" was removed from the spec; re-apply with the removal acknowledged',
+        'spec change refused by an apply-time guard; re-apply with the change acknowledged',
       ),
     };
     renderDialog();
 
     const alert = screen.getByRole("alert");
     expect(alert.textContent).toContain(
-      'collection "old_notes" was removed from the spec',
+      "spec change refused by an apply-time guard",
     );
     expect(screen.getByRole("button", { name: "Try again" })).toBeTruthy();
     expect(screen.getByRole("button", { name: "Dismiss error" })).toBeTruthy();

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -344,6 +344,7 @@ function ConnectDialogContent({
           onSignIn={handleOAuthSignIn}
           isVendorApprovalBlocked={creds.isVendorApprovalBlocked}
           isVendorApprovalPending={creds.isVendorApprovalPending}
+          isOrgOAuthApp={creds.isOrgOAuthApp}
           manualEntrySupported={creds.manualEntrySupported}
           canBringOwnApp={creds.canBringOwnApp}
           vendorApprovalDocsUrl={creds.vendorApprovalDocsUrl}
@@ -459,6 +460,7 @@ function OAuthSection({
   onSignIn,
   isVendorApprovalBlocked,
   isVendorApprovalPending,
+  isOrgOAuthApp,
   manualEntrySupported,
   canBringOwnApp,
   vendorApprovalDocsUrl,
@@ -471,6 +473,14 @@ function OAuthSection({
   readonly onSignIn: () => void;
   readonly isVendorApprovalBlocked: boolean;
   readonly isVendorApprovalPending: boolean;
+  /**
+   * `true` when the org's own BYOA OAuth app is the effective one. The
+   * vendor-approval block describes the PLATFORM app, so it neither
+   * disables sign-in nor warrants the blocked notice when the org's own
+   * app is what sign-in will use (the caller-side org-override gate the
+   * notice's contract expects).
+   */
+  readonly isOrgOAuthApp: boolean;
   readonly manualEntrySupported: boolean;
   readonly canBringOwnApp: boolean;
   readonly vendorApprovalDocsUrl: string | null;
@@ -502,7 +512,9 @@ function OAuthSection({
       <button
         type="button"
         onClick={onSignIn}
-        disabled={disabled || isInProgress || isVendorApprovalBlocked}
+        disabled={
+          disabled || isInProgress || (isVendorApprovalBlocked && !isOrgOAuthApp)
+        }
         className={cn(
           "stg:inline-flex stg:w-full stg:items-center stg:justify-center stg:gap-2 stg:rounded-md stg:px-4 stg:py-2 stg:text-sm stg:font-medium",
           "stg:bg-primary stg:text-primary-foreground",
@@ -512,17 +524,23 @@ function OAuthSection({
         )}
       >
         {isInProgress && <LoadingSpinner size="sm" />}
-        {isInProgress ? (phaseLabel[phase] ?? "Connecting...") : "Sign in with OAuth"}
+        {isInProgress
+          ? (phaseLabel[phase] ?? "Connecting...")
+          : isOrgOAuthApp
+            ? "Sign in with your app"
+            : "Sign in with OAuth"}
       </button>
-      <VendorApprovalBlockedNotice
-        blocked={isVendorApprovalBlocked}
-        pending={isVendorApprovalPending}
-        manualEntrySupported={manualEntrySupported}
-        canBringOwnApp={canBringOwnApp}
-        docsUrl={vendorApprovalDocsUrl}
-        onBringOwnApp={onOpenDetails}
-        className="stg:rounded-md stg:border stg:border-amber-500/20"
-      />
+      {!isOrgOAuthApp && (
+        <VendorApprovalBlockedNotice
+          blocked={isVendorApprovalBlocked}
+          pending={isVendorApprovalPending}
+          manualEntrySupported={manualEntrySupported}
+          canBringOwnApp={canBringOwnApp}
+          docsUrl={vendorApprovalDocsUrl}
+          onBringOwnApp={onOpenDetails}
+          className="stg:rounded-md stg:border stg:border-amber-500/20"
+        />
+      )}
       {onSwitchToManual && (
         <button
           type="button"

package/src/mcp-server/__tests__/VendorApprovalBlocked.surfaces.test.tsx

@@ -5,7 +5,10 @@ import { create } from "@bufbuild/protobuf";
 import { createRouterTransport } from "@connectrpc/connect";
 import { Stigmer } from "@stigmer/sdk";
 import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
-import { GetOAuthGrantStatusOutputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import {
+  GetOAuthGrantStatusOutputSchema,
+  GetOrgOAuthAppOutputSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import {
   McpServerSpecSchema,
   McpServerAuthSchema,
@@ -14,7 +17,6 @@ import {
 import {
   McpServerStatusSchema,
   OAuthStatusSchema,
-  OAuthAppSource,
   ValidationState,
 } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
 import { VendorApprovalStatus } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
@@ -53,8 +55,11 @@ const DOCS_URL = "https://vendor.example.com/oauth-docs";
 
 /**
  * An oauth_only vendor-OAuth server whose platform OAuth app is blocked.
- * `withAppRef` controls the BYOA arm: with a ref and a platform-sourced
- * effective app, `canBringOwnApp` is true.
+ * `withAppRef` controls the BYOA arm: with a ref and no org override,
+ * `canBringOwnApp` is true. The org-override state itself comes from the
+ * `getOrgOAuthApp` transport handler (client-side derivation,
+ * stigmer-cloud#401) — status.oauth_status carries only the
+ * vendor-approval fields, matching what backends actually populate.
  */
 function buildBlockedOAuthOnlyServer(options: {
   status: VendorApprovalStatus;
@@ -86,7 +91,6 @@ function buildBlockedOAuthOnlyServer(options: {
     oauthStatus: create(OAuthStatusSchema, {
       vendorApprovalStatus: options.status,
       vendorApprovalDocsUrl: DOCS_URL,
-      effectiveOauthSource: OAuthAppSource.OAUTH_APP_SOURCE_PLATFORM,
     }),
   });
   return server;
@@ -96,6 +100,15 @@ function noGrant() {
   return create(GetOAuthGrantStatusOutputSchema, { connected: false });
 }
 
+// BYOA affordances render only where the org-override surface exists —
+// canBringOwnApp is gated on a getOrgOAuthApp capability probe
+// (stigmer/stigmer#558), so the BYOA arms of these tests must register the
+// RPC to simulate the hosted edition. The OSS arm (probe UNIMPLEMENTED →
+// affordances hidden) is pinned in byoaEditionDegradation.test.tsx.
+function noOverride() {
+  return create(GetOrgOAuthAppOutputSchema, { hasOverride: false });
+}
+
 function renderWithTransport(
   ui: ReactNode,
   register: Parameters<typeof createRouterTransport>[0] = () => {},
@@ -128,6 +141,7 @@ describe("McpServerConnectDialog — oauth_only + vendor-blocked", () => {
         router.service(McpServerQueryController, {
           getByReference: () => server,
           getOAuthGrantStatus: noGrant,
+          getOrgOAuthApp: noOverride,
         });
       },
     );
@@ -199,6 +213,48 @@ describe("McpServerConnectDialog — oauth_only + vendor-blocked", () => {
     });
     expect(docs.getAttribute("href")).toBe(DOCS_URL);
   });
+
+  it("enables sign-in with the org's own app when a BYOA override is active", async () => {
+    // The platform app is still vendor-blocked, but the org brought its
+    // own approved app — the block describes an app sign-in won't use
+    // (stigmer-cloud#401). Before the client-side derivation this state
+    // was a dead end: disabled button AND no way forward.
+    renderWithTransport(
+      <McpServerConnectDialog
+        org={ORG}
+        slug={SLUG}
+        open
+        onClose={() => {}}
+      />,
+      (router) => {
+        router.service(McpServerQueryController, {
+          getByReference: () =>
+            buildBlockedOAuthOnlyServer({
+              status: VendorApprovalStatus.PENDING,
+              withAppRef: true,
+            }),
+          getOAuthGrantStatus: noGrant,
+          getOrgOAuthApp: () =>
+            create(GetOrgOAuthAppOutputSchema, {
+              hasOverride: true,
+              oauthAppId: "oauthapp_01acme",
+              clientId: "acme-client-id",
+            }),
+        });
+      },
+    );
+
+    const signIn = await screen.findByRole("button", {
+      name: "Sign in with your app",
+    });
+    expect((signIn as HTMLButtonElement).disabled).toBe(false);
+    // The blocked notice describes the platform app — suppressed while
+    // the org's own app is the effective one.
+    expect(screen.queryByText(/awaiting vendor approval/)).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: "Use your own OAuth app" }),
+    ).toBeNull();
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -231,6 +287,7 @@ describe("McpServerDetailView — oauth_only + vendor-blocked", () => {
       (router) => {
         router.service(McpServerQueryController, {
           getOAuthGrantStatus: noGrant,
+          getOrgOAuthApp: noOverride,
         });
       },
     );
@@ -252,6 +309,47 @@ describe("McpServerDetailView — oauth_only + vendor-blocked", () => {
     // extraction into the shared notice.
     expect(cta.getAttribute("data-cursor-target")).toBe("byoa-cta-button");
   });
+
+  it("enables 'Sign in with your app' when the org's BYOA override is active", async () => {
+    // The vendor block gates the PLATFORM app; with the org's own app
+    // effective, sign-in must be enabled and the BYOA CTA retired
+    // (stigmer-cloud#401 — the signal these gates key on never fired).
+    renderWithTransport(
+      <McpServerDetailView
+        org={ORG}
+        slug={SLUG}
+        mcpServerState={loadedState(
+          buildBlockedOAuthOnlyServer({
+            status: VendorApprovalStatus.PENDING,
+            withAppRef: true,
+          }),
+        )}
+      />,
+      (router) => {
+        router.service(McpServerQueryController, {
+          getOAuthGrantStatus: noGrant,
+          getOrgOAuthApp: () =>
+            create(GetOrgOAuthAppOutputSchema, {
+              hasOverride: true,
+              oauthAppId: "oauthapp_01acme",
+              clientId: "acme-client-id",
+            }),
+        });
+      },
+    );
+
+    const signIn = await screen.findByRole("button", {
+      name: "Sign in with your app",
+    });
+    expect((signIn as HTMLButtonElement).disabled).toBe(false);
+    expect(screen.getByText("Using your OAuth app")).toBeTruthy();
+    // The blocked banner and BYOA offer describe the platform app —
+    // both retire while the override is active.
+    expect(screen.queryByText(/awaiting vendor approval/)).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: "Use your own OAuth app" }),
+    ).toBeNull();
+  });
 });
 
 // ---------------------------------------------------------------------------