@stigmer/react 3.12.4 → 3.12.5

package/src/organization/__tests__/OrgPreferencesPanel.test.tsx

@@ -0,0 +1,145 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  OrganizationSchema,
+  type Organization,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import type { OrganizationInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { OrgPreferencesPanel } from "../OrgPreferencesPanel";
+
+const ORG: Organization = create(OrganizationSchema, {
+  metadata: { id: "acme", name: "Acme Corp", slug: "acme", org: "acme" },
+  spec: {
+    description: "We make everything.",
+    logoUrl: "https://acme.example/logo.png",
+    preferences: { standingContext: "We deploy to us-east-1." },
+  },
+});
+
+function createMockStigmer(overrides?: {
+  update?: ReturnType<typeof vi.fn>;
+  canEdit?: boolean;
+}) {
+  return {
+    organization: {
+      get: vi.fn(async () => ORG),
+      update: overrides?.update ?? vi.fn(async () => ORG),
+    },
+    iamPolicy: {
+      checkMyPermission: vi.fn(async () => ({
+        isAuthorized: overrides?.canEdit ?? true,
+      })),
+    },
+  } as never;
+}
+
+function renderPanel(client: unknown) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <DeploymentModeContext.Provider value="local">
+        <OrgPreferencesPanel orgId="acme" />
+      </DeploymentModeContext.Provider>
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+/**
+ * Waits until the form has synced from server data (the panel copies the
+ * fetched value into local state in a passive effect, one flush after the
+ * field first renders) — interacting earlier races the sync.
+ */
+async function findSyncedField(value: string) {
+  const field = await screen.findByLabelText("Standing context");
+  await waitFor(() => expect(field).toHaveProperty("value", value));
+  return field;
+}
+
+describe("OrgPreferencesPanel", () => {
+  it("loads and displays the declared standing context", async () => {
+    renderPanel(createMockStigmer());
+
+    await findSyncedField("We deploy to us-east-1.");
+  });
+
+  it("saves the full mapped input — unedited profile fields survive (wipe-bug guard)", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "Prefer terse answers." } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    expect(input.preferences).toEqual({
+      standingContext: "Prefer terse answers.",
+    });
+    // Fields this form never renders must round-trip untouched.
+    expect(input.name).toBe("Acme Corp");
+    expect(input.description).toBe("We make everything.");
+    expect(input.logoUrl).toBe("https://acme.example/logo.png");
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("acme");
+  });
+
+  it("clears the standing context when the text is emptied", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0].preferences).toEqual({
+      standingContext: undefined,
+    });
+  });
+
+  it("discard resets the field to the server value", async () => {
+    renderPanel(createMockStigmer());
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "Edited but regretted" } });
+    fireEvent.click(screen.getByRole("button", { name: "Discard" }));
+
+    expect(field).toHaveProperty("value", "We deploy to us-east-1.");
+  });
+
+  it("renders read-only with an explanation when the caller lacks can_edit", async () => {
+    renderPanel(createMockStigmer({ canEdit: false }));
+
+    const field = await screen.findByLabelText("Standing context");
+    await waitFor(() =>
+      expect(field).toHaveProperty("readOnly", true),
+    );
+    expect(
+      screen.getByText("Only organization admins can edit these preferences."),
+    ).toBeTruthy();
+    expect(screen.queryByRole("button", { name: "Save changes" })).toBeNull();
+  });
+
+  it("shows the fetch error with a retry action when loading fails", async () => {
+    const client = {
+      organization: {
+        get: vi.fn(async () => {
+          throw new Error("boom");
+        }),
+        update: vi.fn(),
+      },
+      iamPolicy: {
+        checkMyPermission: vi.fn(async () => ({ isAuthorized: true })),
+      },
+    } as never;
+    renderPanel(client);
+
+    expect(await screen.findByRole("alert")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
+  });
+});

package/src/organization/__tests__/OrgProfilePanel.test.tsx

@@ -0,0 +1,108 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  OrganizationSchema,
+  type Organization,
+} from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import type { OrganizationInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { DeploymentModeContext } from "../../deployment-mode";
+import { OrgProfilePanel } from "../OrgProfilePanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug (oss#293 Phase 1):
+ * `organization.update()` wholesale replaces the stored spec, so a profile
+ * save that sends only the edited fields silently wipes every other mutable
+ * spec field — most visibly `spec.preferences.standing_context` set via the
+ * CLI or the preferences page. The panel must spread the complete mapped
+ * input and override only what it edits.
+ */
+
+const ORG: Organization = create(OrganizationSchema, {
+  metadata: {
+    id: "acme",
+    name: "Acme Corp",
+    slug: "acme",
+    org: "acme",
+  },
+  spec: {
+    description: "We make everything.",
+    logoUrl: "https://acme.example/logo.png",
+    preferences: { standingContext: "We deploy to us-east-1." },
+  },
+});
+
+function createMockStigmer(overrides?: {
+  update?: ReturnType<typeof vi.fn>;
+}) {
+  return {
+    organization: {
+      get: vi.fn(async () => ORG),
+      update: overrides?.update ?? vi.fn(async () => ORG),
+    },
+  } as never;
+}
+
+// Deployment mode "local" keeps the IdentityProvidersSummary sub-panel
+// inert (identity_provider is cloud-only), so no extra client stubs are
+// needed — the suite tests the form, not the summary.
+function renderPanel(client: unknown) {
+  return render(
+    <StigmerContext.Provider value={client as never}>
+      <DeploymentModeContext.Provider value="local">
+        <OrgProfilePanel orgId="acme" />
+      </DeploymentModeContext.Provider>
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("OrgProfilePanel save payload", () => {
+  it("round-trips unedited spec fields — preferences survive a profile save", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    const client = createMockStigmer({ update });
+    renderPanel(client);
+
+    // Wait for the server-sync effect to fill the form before editing —
+    // interacting on first appearance races the sync.
+    const description = await screen.findByLabelText("Description");
+    await waitFor(() =>
+      expect(description).toHaveProperty("value", "We make everything."),
+    );
+    fireEvent.change(description, { target: { value: "New description" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // The edited field.
+    expect(input.description).toBe("New description");
+    // The unedited fields the form does not render — the wipe-bug guard.
+    expect(input.preferences).toEqual({
+      standingContext: "We deploy to us-east-1.",
+    });
+    expect(input.logoUrl).toBe("https://acme.example/logo.png");
+    // Addressing fields for the update pipeline's org+slug lookup.
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("acme");
+    expect(input.name).toBe("Acme Corp");
+  });
+
+  it("sends the edited name and keeps discard/dirty semantics intact", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+
+    const name = await screen.findByLabelText("Name");
+    await waitFor(() => expect(name).toHaveProperty("value", "Acme Corp"));
+    fireEvent.change(name, { target: { value: "Acme Corporation" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0].name).toBe("Acme Corporation");
+    expect(update.mock.calls[0]![0].preferences).toEqual({
+      standingContext: "We deploy to us-east-1.",
+    });
+  });
+});

package/src/organization/index.ts

@@ -16,5 +16,7 @@ export { CreateOrganizationForm } from "./CreateOrganizationForm.js";
 export type { CreateOrganizationFormProps } from "./CreateOrganizationForm.js";
 export { OrgProfilePanel } from "./OrgProfilePanel.js";
 export type { OrgProfilePanelProps } from "./OrgProfilePanel.js";
+export { OrgPreferencesPanel } from "./OrgPreferencesPanel.js";
+export type { OrgPreferencesPanelProps } from "./OrgPreferencesPanel.js";
 export { OrgSwitcher } from "./OrgSwitcher.js";
 export type { OrgSwitcherProps } from "./OrgSwitcher.js";

package/src/session/NewSessionViewer.tsx

@@ -9,6 +9,7 @@ import type { WorkspaceContentSearcher } from "../workspace/WorkspaceContentSear
 import type { InteractionModeOption } from "../composer/index.js";
 import { SessionComposer } from "../composer/index.js";
 import type { HarnessOption } from "../models/harness.js";
+import type { AccountExecutionDefaults } from "../identity-account/useAccountExecutionDefaults.js";
 import { SessionViewerLayout } from "./SessionViewerLayout.js";
 import { useWorkspaceEditors } from "../internal/store/index.js";
 import { WorkspaceSurface } from "../workspace/WorkspaceSurface.js";
@@ -163,6 +164,15 @@ export interface NewSessionViewerProps {
    */
   readonly defaultHarness?: HarnessOption;
 
+  /**
+   * The user's account-level execution defaults, typically from
+   * `useAccountExecutionDefaults()`. Seeds the harness and model pickers
+   * under the layered precedence documented on
+   * {@link UseNewSessionFlowOptions.accountDefaults}; explicit device
+   * picks always win. Ignored for the `"guest"` audience.
+   */
+  readonly accountDefaults?: AccountExecutionDefaults;
+
   /** Agent to auto-select on mount (used for draft flows). */
   readonly initialAgentRef?: ResourceRef;
   /**
@@ -253,6 +263,7 @@ export function NewSessionViewer({
   panelOpen,
   onPanelOpenChange,
   defaultHarness,
+  accountDefaults,
   initialAgentRef,
   initialInstanceId,
   initialAttachments,
@@ -269,6 +280,7 @@ export function NewSessionViewer({
     onError,
     getRuntimeEnv,
     defaultHarness,
+    accountDefaults,
     audience,
     runConfig,
   });

package/src/session/__tests__/useNewSessionFlow.test.tsx

@@ -805,6 +805,157 @@ describe("useNewSessionFlow", () => {
     });
   });
 
+  describe("accountDefaults (oss#293 Phase 1.5 layered seed)", () => {
+    // Two native models so "stored pick outranks account default" is
+    // distinguishable; the shared TEST_MODELS carries one per harness.
+    const SEED_MODELS = parseRegistryJson({
+      models: [
+        { id: "claude-sonnet-4.6", displayName: "Claude Sonnet 4.6", shortDescription: "", speedTier: "fast", provider: "anthropic", harness: "native", costTier: "standard", featured: true, pricing: { inputPricePerMillion: 3, outputPricePerMillion: 15, cacheWritePricePerMillion: 3.75, cacheReadPricePerMillion: 0.3 } },
+        { id: "gpt-5.3", displayName: "GPT 5.3", shortDescription: "", speedTier: "fast", provider: "openai", harness: "native", costTier: "standard", featured: false, pricing: { inputPricePerMillion: 2, outputPricePerMillion: 8, cacheWritePricePerMillion: 2, cacheReadPricePerMillion: 0.2 } },
+        { id: "default", displayName: "Cursor Auto", shortDescription: "", speedTier: "fast", provider: "cursor", harness: "cursor", costTier: "standard", featured: true, pricing: { inputPricePerMillion: 1.25, outputPricePerMillion: 6, cacheWritePricePerMillion: 1.25, cacheReadPricePerMillion: 0.25 } },
+        { id: "composer-2.5", displayName: "Composer 2.5", shortDescription: "", speedTier: "fast", provider: "cursor", harness: "cursor", costTier: "standard", featured: false, pricing: { inputPricePerMillion: 1, outputPricePerMillion: 5, cacheWritePricePerMillion: 1, cacheReadPricePerMillion: 0.1 } },
+      ],
+    });
+
+    function seedWrapper() {
+      const state: ModelRegistryState = { models: SEED_MODELS, isLoading: false, error: null, refetch: () => {} };
+      return function Wrapper({ children }: { children: ReactNode }) {
+        return (
+          <ModelRegistryContext.Provider value={state}>
+            {children}
+          </ModelRegistryContext.Provider>
+        );
+      };
+    }
+
+    it("seeds the harness when nothing is stored", () => {
+      const opts = { ...defaultOptions(), accountDefaults: { harness: "cursor" as const } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.harness).toBe("cursor");
+    });
+
+    it("a stored harness choice outranks the account default", () => {
+      localStorage.setItem(STORAGE_KEY_HARNESS, "native");
+      const opts = { ...defaultOptions(), accountDefaults: { harness: "cursor" as const } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.harness).toBe("native");
+    });
+
+    it("the account harness outranks the embedder defaultHarness", () => {
+      const opts = {
+        ...defaultOptions(),
+        defaultHarness: "native" as const,
+        accountDefaults: { harness: "cursor" as const },
+      };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.harness).toBe("cursor");
+    });
+
+    it("never persists the seeded harness — only explicit choices", () => {
+      const opts = { ...defaultOptions(), accountDefaults: { harness: "cursor" as const } };
+      renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(localStorage.getItem(STORAGE_KEY_HARNESS)).toBeNull();
+    });
+
+    it("a late-arriving harness seed applies when the user has not picked (whoAmI resolves after mount)", () => {
+      const base: Parameters<typeof useNewSessionFlow>[0] = defaultOptions();
+      const { result, rerender } = renderHook(
+        (opts: Parameters<typeof useNewSessionFlow>[0]) => useNewSessionFlow(opts),
+        { wrapper: seedWrapper(), initialProps: base },
+      );
+      expect(result.current.harness).toBe("native");
+
+      rerender({ ...base, accountDefaults: { harness: "cursor" as const } });
+
+      expect(result.current.harness).toBe("cursor");
+      expect(localStorage.getItem(STORAGE_KEY_HARNESS)).toBeNull();
+    });
+
+    it("a late-arriving harness seed never overrides an explicit pick this mount", () => {
+      const base: Parameters<typeof useNewSessionFlow>[0] = defaultOptions();
+      const { result, rerender } = renderHook(
+        (opts: Parameters<typeof useNewSessionFlow>[0]) => useNewSessionFlow(opts),
+        { wrapper: seedWrapper(), initialProps: base },
+      );
+      act(() => result.current.setHarness("native"));
+
+      rerender({ ...base, accountDefaults: { harness: "cursor" as const } });
+
+      expect(result.current.harness).toBe("native");
+    });
+
+    it("seeds the model for the active harness when nothing is stored", () => {
+      const opts = { ...defaultOptions(), accountDefaults: { nativeModel: "gpt-5.3" } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.modelId).toBe("gpt-5.3");
+    });
+
+    it("a stored model pick outranks the account default", async () => {
+      localStorage.setItem(STORAGE_KEY_MODEL_NATIVE, "claude-sonnet-4.6");
+      const opts = { ...defaultOptions(), accountDefaults: { nativeModel: "gpt-5.3" } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      // The stored restore lands in a passive effect once the registry is
+      // ready; the account seed must not win the race before it.
+      await act(async () => {});
+      expect(result.current.modelId).toBe("claude-sonnet-4.6");
+    });
+
+    it("self-heals a stale account model to the platform default (undefined)", () => {
+      const opts = { ...defaultOptions(), accountDefaults: { nativeModel: "retired-model" } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.modelId).toBeUndefined();
+    });
+
+    it("never persists the seeded model — only explicit choices", () => {
+      const opts = { ...defaultOptions(), accountDefaults: { nativeModel: "gpt-5.3" } };
+      renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(localStorage.getItem(STORAGE_KEY_MODEL_NATIVE)).toBeNull();
+    });
+
+    it("follows the active harness: cursorModel seeds cursor sessions", () => {
+      const opts = {
+        ...defaultOptions(),
+        accountDefaults: { harness: "cursor" as const, nativeModel: "gpt-5.3", cursorModel: "composer-2.5" },
+      };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      expect(result.current.harness).toBe("cursor");
+      expect(result.current.modelId).toBe("composer-2.5");
+    });
+
+    it("submits the seeded model explicitly — the pill promise (#663) and the DD-003 seed rule", async () => {
+      const opts = { ...defaultOptions(), accountDefaults: { nativeModel: "gpt-5.3" } };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      await act(async () => {
+        await result.current.submit("Hello");
+      });
+
+      expect(mockCreateExecution.mock.calls[0][0].modelName).toBe("gpt-5.3");
+    });
+
+    it("guest audience ignores accountDefaults entirely", () => {
+      const opts = {
+        ...defaultOptions(),
+        audience: "guest" as const,
+        accountDefaults: { harness: "native" as const, nativeModel: "gpt-5.3", cursorModel: "composer-2.5" },
+      };
+      const { result } = renderHook(() => useNewSessionFlow(opts), { wrapper: seedWrapper() });
+
+      // Platform share policy: cursor harness, no client model.
+      expect(result.current.harness).toBe("cursor");
+      expect(result.current.modelId).toBeUndefined();
+    });
+  });
+
   describe("submit while default agent is loading", () => {
     it("awaits default agent and creates session when fetch resolves", async () => {
       const resolvedAgent = { status: { defaultInstanceId: "awaited-inst" } };

package/src/session/useNewSessionFlow.ts

@@ -1,7 +1,8 @@
 "use client";
 
-import { useCallback, useEffect, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import { getUserMessage, type McpServerUsageInput, type ResourceRef } from "@stigmer/sdk";
+import type { AccountExecutionDefaults } from "../identity-account/useAccountExecutionDefaults.js";
 import type { AgentResolution } from "../agent/index.js";
 import { useDefaultAgent } from "../agent/index.js";
 import { useModelRegistry } from "../models/index.js";
@@ -102,6 +103,26 @@ export interface UseNewSessionFlowOptions {
    * @default DEFAULT_HARNESS ("native")
    */
   readonly defaultHarness?: HarnessOption;
+  /**
+   * The user's account-level execution defaults
+   * (`IdentityAccountPreferences.default_*`), typically from
+   * `useAccountExecutionDefaults()`. A SEED in the layered precedence —
+   * explicit device-local choices always outrank it:
+   *
+   * - harness: stored choice > `accountDefaults.harness` >
+   *   {@link defaultHarness} > platform default. May arrive after mount
+   *   (whoAmI resolves async); a late value still seeds unless the user
+   *   has already picked a harness this mount.
+   * - model: stored per-harness choice > the account's model for the
+   *   active harness (validated against the registry; a stale model
+   *   silently falls through) > the harness default.
+   *
+   * Seeded values are never persisted to localStorage — the account
+   * preference keeps applying until the user decides. Ignored for the
+   * `"guest"` audience (platform share policy owns guest config), and
+   * consumers must not fetch identity for guest/embed surfaces.
+   */
+  readonly accountDefaults?: AccountExecutionDefaults;
   /**
    * Who this flow serves. `"guest"` adapts the orchestration to the
    * guest principal's permission model: the org default-agent lookup
@@ -162,7 +183,12 @@ export interface UseNewSessionFlowReturn {
   /** Switch the harness. Resets the model if invalid for the new harness. */
   readonly setHarness: (harness: HarnessOption) => void;
 
-  /** Currently selected model ID (persisted per-harness to localStorage). */
+  /**
+   * The model an untouched send will run: the explicit device pick when
+   * one exists (persisted per-harness to localStorage), else the account
+   * default for the active harness. `undefined` resolves to the harness
+   * default downstream.
+   */
   readonly modelId: string | undefined;
   /** Update the selected model. Automatically persists to localStorage. */
   readonly setModelId: (id: string) => void;
@@ -269,6 +295,10 @@ export function useNewSessionFlow(
     sessionContext,
   } = options;
   const isGuest = options.audience === "guest";
+  // Guests never inherit account defaults — the platform share policy owns
+  // guest execution config (GUEST_HARNESS reasoning), and identity-derived
+  // preferences must never shape a share/embed surface.
+  const accountDefaults = isGuest ? undefined : options.accountDefaults;
   // Guests never carry a client pin: guest execution config is owned by
   // the server-side share policy (GUEST_HARNESS reasoning). Validated at
   // render so a statically-wrong pin (fast tier, no model) fails in the
@@ -293,13 +323,30 @@ export function useNewSessionFlow(
     // touch localStorage: a browser previously used in the Console must not
     // leak its stored harness into a share/embed session.
     if (isGuest) return GUEST_HARNESS;
-    if (typeof window === "undefined") return defaultHarness ?? DEFAULT_HARNESS;
+    if (typeof window === "undefined")
+      return accountDefaults?.harness ?? defaultHarness ?? DEFAULT_HARNESS;
     // Only explicit user choices are persisted (see setHarness), so a
-    // stored value always outranks the embedder's defaultHarness.
+    // stored value always outranks the account default and the embedder's
+    // defaultHarness.
     const stored = localStorage.getItem(STORAGE_KEY_HARNESS);
     if (stored === "native" || stored === "cursor") return stored;
-    return defaultHarness ?? DEFAULT_HARNESS;
+    return accountDefaults?.harness ?? defaultHarness ?? DEFAULT_HARNESS;
   });
+  // Set once the user picks a harness this mount — a late-arriving account
+  // default must never override an explicit choice (the composer's
+  // userOverrodeModel idiom).
+  const harnessTouchedRef = useRef(false);
+
+  // Account defaults resolve async (whoAmI): when the harness seed arrives
+  // after mount, apply it once — unless the user has picked or a stored
+  // choice exists. Never persisted: seeding must not masquerade as a user
+  // choice, or the account preference would stop applying elsewhere.
+  useEffect(() => {
+    const seed = accountDefaults?.harness;
+    if (isGuest || harnessTouchedRef.current || !seed) return;
+    if (typeof window !== "undefined" && localStorage.getItem(STORAGE_KEY_HARNESS)) return;
+    setHarnessRaw(seed);
+  }, [isGuest, accountDefaults?.harness]);
 
   const stigmer = useStigmer();
   const { getModel, isLoading: isModelsLoading } = useModelRegistry({ harness });
@@ -326,8 +373,26 @@ export function useNewSessionFlow(
 
   const validModelId = modelId && getModel(modelId) ? modelId : undefined;
 
+  // The account's model for the active harness, registry-validated the same
+  // way as the stored choice (a stale/removed preference silently falls
+  // through to the harness default — self-healing). Derived, never written
+  // into `modelId` state: the persist effect below stores only explicit
+  // choices, and a derived seed cannot leak into localStorage.
+  const accountModelForHarness =
+    harness === "cursor" ? accountDefaults?.cursorModel : accountDefaults?.nativeModel;
+  const accountModelId =
+    accountModelForHarness && getModel(accountModelForHarness)
+      ? accountModelForHarness
+      : undefined;
+
+  // Layered precedence: explicit device pick > account default. The result
+  // feeds the composer's model pill AND the submit path, so the pill always
+  // shows what an untouched send will run (#663).
+  const effectiveModelId = validModelId ?? accountModelId;
+
   const setHarness = useCallback(
     (h: HarnessOption) => {
+      harnessTouchedRef.current = true;
       setHarnessRaw(h);
       // Guests have no harness picker; if a caller invokes this anyway, the
       // guest surface must never write into the Console's preference keys.
@@ -415,8 +480,10 @@ export function useNewSessionFlow(
           // The owner pin wins over the composer and the restored
           // preference (#664); the pinned tier is stamped only as
           // "fast" — standard stays off the wire, preserving the #357
-          // UNSPECIFIED-vs-explicit telemetry distinction.
-          modelName: pinnedModelName ?? selectedModel ?? validModelId,
+          // UNSPECIFIED-vs-explicit telemetry distinction. The effective
+          // model carries the account-default seed explicitly (DD-003:
+          // the preference is a seed; the execution spec is the record).
+          modelName: pinnedModelName ?? selectedModel ?? effectiveModelId,
           runtimeEnv,
           attachments: context?.attachments,
           interactionMode: context?.interactionMode,
@@ -514,7 +581,7 @@ export function useNewSessionFlow(
       autoApproveAll,
       adapter,
       getRuntimeEnv,
-      validModelId,
+      effectiveModelId,
       pinnedModelName,
       pinnedServiceTier,
       workspace,
@@ -539,7 +606,7 @@ export function useNewSessionFlow(
   return {
     harness,
     setHarness,
-    modelId: validModelId,
+    modelId: effectiveModelId,
     setModelId,
     agentRef,
     setAgentRef,

package/src/settings/AccountPreferencesSection.tsx

@@ -0,0 +1,25 @@
+"use client";
+
+import { useId } from "react";
+import { AccountPreferencesPanel } from "../identity-account/AccountPreferencesPanel.js";
+
+/** Settings section for editing the current user's declared preferences. */
+export function AccountPreferencesSection() {
+  const headingId = useId();
+
+  return (
+    <section aria-labelledby={headingId}>
+      <h2
+        id={headingId}
+        className="stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold"
+      >
+        Account Preferences
+      </h2>
+      <p className="stg:text-muted-foreground stg:mb-6 stg:text-xs">
+        Personal standing context shared with agents on executions you run.
+      </p>
+
+      <AccountPreferencesPanel />
+    </section>
+  );
+}

package/src/settings/OrgPreferencesSection.tsx

@@ -0,0 +1,35 @@
+"use client";
+
+import { useId } from "react";
+import { OrgPreferencesPanel } from "../organization/OrgPreferencesPanel.js";
+import { useOrg } from "../organization/OrgProvider.js";
+
+/** Settings section for editing the active organization's declared preferences. */
+export function OrgPreferencesSection() {
+  const headingId = useId();
+  const { activeOrg } = useOrg();
+  const orgId = activeOrg?.metadata?.id ?? "";
+
+  return (
+    <section aria-labelledby={headingId}>
+      <h2
+        id={headingId}
+        className="stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold"
+      >
+        Organization Preferences
+      </h2>
+      <p className="stg:text-muted-foreground stg:mb-6 stg:text-xs">
+        Standing context shared with agents on every execution run by this
+        organization&apos;s members.
+      </p>
+
+      {!orgId ? (
+        <p className="stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs">
+          Select an organization to view its preferences.
+        </p>
+      ) : (
+        <OrgPreferencesPanel orgId={orgId} />
+      )}
+    </section>
+  );
+}