@stigmer/react 3.12.4 → 3.12.6

package/src/library/__tests__/VisibilitySelector.test.tsx

@@ -13,10 +13,14 @@ import {
   VisibilityBadge,
 } from "../VisibilitySelector";
 import {
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
   blueprintVisibilityLevels,
 } from "../visibilityLevels";
 
+const INSTANCE_VISIBILITY_LEVELS = instanceVisibilityLevels({
+  canSetPublicVisibility: true,
+});
+
 // Base UI's Popover positioner observes its anchor; happy-dom lacks
 // ResizeObserver, so provide a no-op shim.
 beforeAll(() => {
@@ -35,6 +39,7 @@ afterEach(cleanup);
 const BLUEPRINT_LEVELS = blueprintVisibilityLevels({
   deploymentMode: "cloud",
   hasIdentityProvider: true,
+  canSetPublicVisibility: true,
 });
 
 // Option accessible names are "<label> <description>"; anchor on the label so
@@ -118,6 +123,48 @@ describe("VisibilitySelector — create mode (inline list)", () => {
   });
 });
 
+describe("VisibilitySelector — operator-gated Public (locked row)", () => {
+  // The caller may not publish: the level builders lock the Public row.
+  const GATED_LEVELS = instanceVisibilityLevels({
+    canSetPublicVisibility: false,
+  });
+
+  it("renders the locked Public row non-interactive with the platform-team copy", () => {
+    const onChange = vi.fn();
+    render(
+      <VisibilitySelector
+        mode="create"
+        visibility={ApiResourceVisibility.visibility_private}
+        options={GATED_LEVELS}
+        onVisibilityChange={onChange}
+      />,
+    );
+
+    const publicRow = screen.getByRole("radio", { name: /Public/i });
+    expect((publicRow as HTMLButtonElement).disabled).toBe(true);
+    expect(publicRow.getAttribute("aria-disabled")).toBe("true");
+    expect(publicRow.textContent).toContain("granted by the platform team");
+
+    fireEvent.click(publicRow);
+    expect(onChange).not.toHaveBeenCalled();
+  });
+
+  it("keeps every other level selectable — only publishing is operator-granted", () => {
+    const onChange = vi.fn();
+    render(
+      <VisibilitySelector
+        mode="create"
+        visibility={ApiResourceVisibility.visibility_private}
+        options={GATED_LEVELS}
+        onVisibilityChange={onChange}
+      />,
+    );
+
+    fireEvent.click(screen.getByRole("radio", { name: /^Organization/i }));
+    expect(onChange).toHaveBeenCalledWith(ApiResourceVisibility.visibility_org);
+  });
+});
+
 describe("VisibilitySelector — manage mode (popover + confirmation)", () => {
   it("shows the current level on the trigger and lists levels on open", async () => {
     render(

package/src/library/__tests__/visibilityLevels.test.ts

@@ -1,6 +1,12 @@
 import { describe, it, expect } from "vitest";
 import { ApiResourceVisibility } from "@stigmer/protos/ai/stigmer/commons/apiresource/enum_pb";
-import { environmentVisibilityLevels } from "../visibilityLevels";
+import {
+  blueprintVisibilityLevels,
+  environmentVisibilityLevels,
+  instanceVisibilityLevels,
+  PUBLIC_LOCKED_REASON,
+  type VisibilityLevelOption,
+} from "../visibilityLevels";
 
 describe("environmentVisibilityLevels", () => {
   it("offers exactly Private and Organization in cloud mode", () => {
@@ -31,3 +37,63 @@ describe("environmentVisibilityLevels", () => {
     expect(environmentVisibilityLevels("local")).toHaveLength(1);
   });
 });
+
+describe("operator-gated PUBLIC level", () => {
+  const publicOf = (levels: readonly VisibilityLevelOption[]) =>
+    levels.find((l) => l.value === ApiResourceVisibility.visibility_public);
+
+  it("locks Public with the platform-team copy when the caller may not publish", () => {
+    const blueprint = publicOf(
+      blueprintVisibilityLevels({
+        deploymentMode: "cloud",
+        hasIdentityProvider: false,
+        canSetPublicVisibility: false,
+      }),
+    );
+    const instance = publicOf(
+      instanceVisibilityLevels({ canSetPublicVisibility: false }),
+    );
+
+    expect(blueprint?.lockedReason).toBe(PUBLIC_LOCKED_REASON);
+    expect(instance?.lockedReason).toBe(PUBLIC_LOCKED_REASON);
+  });
+
+  it("offers Public unlocked for callers with the publish grant", () => {
+    const blueprint = publicOf(
+      blueprintVisibilityLevels({
+        deploymentMode: "cloud",
+        hasIdentityProvider: true,
+        canSetPublicVisibility: true,
+      }),
+    );
+    const instance = publicOf(
+      instanceVisibilityLevels({ canSetPublicVisibility: true }),
+    );
+
+    expect(blueprint?.lockedReason).toBeUndefined();
+    expect(instance?.lockedReason).toBeUndefined();
+  });
+
+  it("never locks any level below Public — org/platform sharing stays self-service", () => {
+    const levels = blueprintVisibilityLevels({
+      deploymentMode: "cloud",
+      hasIdentityProvider: true,
+      canSetPublicVisibility: false,
+    });
+    for (const level of levels) {
+      if (level.value === ApiResourceVisibility.visibility_public) continue;
+      expect(level.lockedReason, `${level.label} must stay self-service`).toBeUndefined();
+    }
+  });
+
+  it("keeps the instance Public row's execution-oriented description when locked", () => {
+    // The lock replaces the rendered detail line, but the option data keeps
+    // its identity (label, tone, confirmation) so an unlock is a pure
+    // context change.
+    const instance = publicOf(
+      instanceVisibilityLevels({ canSetPublicVisibility: false }),
+    );
+    expect(instance?.lockedReason).toBe(PUBLIC_LOCKED_REASON);
+    expect(instance?.confirmDialog).toBeDefined();
+  });
+});

package/src/library/index.ts

@@ -63,12 +63,14 @@ export type {
 
 export {
   blueprintVisibilityLevels,
-  INSTANCE_VISIBILITY_LEVELS,
+  instanceVisibilityLevels,
+  PUBLIC_LOCKED_REASON,
   visibilityLabel,
   visibilityOption,
 } from "./visibilityLevels.js";
 export type {
   BlueprintVisibilityLevelsContext,
+  InstanceVisibilityLevelsContext,
   VisibilityLevelOption,
 } from "./visibilityLevels.js";
 
@@ -81,5 +83,8 @@ export type {
   UseUpdateVisibilityReturn,
 } from "./useUpdateVisibility.js";
 
+export { useCanSetPublicVisibility } from "./useCanSetPublicVisibility.js";
+export type { UseCanSetPublicVisibilityReturn } from "./useCanSetPublicVisibility.js";
+
 export { InstanceVisibilitySelector } from "./InstanceVisibilitySelector.js";
 export type { InstanceVisibilitySelectorProps } from "./InstanceVisibilitySelector.js";

package/src/library/useCanSetPublicVisibility.ts

@@ -0,0 +1,56 @@
+"use client";
+
+import { useDeploymentMode } from "../deployment-mode.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
+
+/**
+ * The `platform` singleton — platform-level permissions are always checked
+ * against this one resource (mirrors the server-side `resource_id = "stigmer"`
+ * RPC config).
+ */
+const PLATFORM_RESOURCE = { kind: "platform", id: "stigmer" } as const;
+
+/** Return value of {@link useCanSetPublicVisibility}. */
+export interface UseCanSetPublicVisibilityReturn {
+  /** Whether the current user may set resources to PUBLIC visibility. */
+  readonly allowed: boolean;
+  /** `true` while the permission check is in flight (cloud only). */
+  readonly isLoading: boolean;
+}
+
+/**
+ * Whether the current user may set a resource's visibility to PUBLIC — the
+ * only level that crosses every org boundary (the cross-org "explore"
+ * catalog).
+ *
+ * In the cloud edition, publishing is a curation decision: the backend
+ * gates both write doors (updateVisibility escalation and
+ * create-with-public) on `can_set_public_visibility` on `platform:stigmer`,
+ * an explicit platform-operator capability. This hook runs the same check
+ * so selectors can present the Public option as locked instead of letting
+ * the request fail.
+ *
+ * Fail-closed, deliberately the opposite of the `useCheckPermission`
+ * default: an escalation gate must not open while the check is loading or
+ * when it errors — a locked option that unlocks a moment later is a far
+ * better failure than an unlocked option the server then rejects.
+ *
+ * In `local` deployment mode (OSS Go backend) the answer is always `true`:
+ * the self-hosted operator owns the store, the same scoping cloud#320
+ * applied to reserved labels.
+ */
+export function useCanSetPublicVisibility(): UseCanSetPublicVisibilityReturn {
+  const deploymentMode = useDeploymentMode();
+  // Hooks run unconditionally; in local mode the null resource skips the
+  // RPC entirely and the fail mode's answer is discarded below.
+  const { allowed, isLoading } = useCheckPermission(
+    deploymentMode === "cloud" ? PLATFORM_RESOURCE : null,
+    "can_set_public_visibility",
+    { fail: "closed" },
+  );
+
+  if (deploymentMode === "local") {
+    return { allowed: true, isLoading: false };
+  }
+  return { allowed, isLoading };
+}

package/src/library/visibilityLevels.ts

@@ -43,8 +43,28 @@ export interface VisibilityLevelOption {
   };
   /** Color treatment for the selected segment and the confirmation prompt. */
   readonly tone: "private" | "org" | "platform" | "public";
+  /**
+   * When present, the level cannot be selected by the current caller and the
+   * row renders locked (disabled, lock affordance) with this copy explaining
+   * why and what to do instead. Computed by the level builders from caller
+   * context — the component stays free of per-level branching, exactly like
+   * the confirmation ladder.
+   *
+   * Today's only locked level is Public in the cloud edition for callers
+   * without `can_set_public_visibility` (publishing is operator-granted);
+   * the backend independently enforces the same gate.
+   */
+  readonly lockedReason?: string;
 }
 
+/**
+ * The locked-row copy for a caller who may not set PUBLIC visibility. Names
+ * the path forward (ask the platform team) rather than a bare "disabled" —
+ * the option stays discoverable even though it is not self-service.
+ */
+export const PUBLIC_LOCKED_REASON =
+  "Public listing is granted by the platform team — contact us to publish this resource.";
+
 const PRIVATE_OPTION: VisibilityLevelOption = {
   value: ApiResourceVisibility.visibility_private,
   label: "Private",
@@ -97,10 +117,27 @@ const PUBLIC_OPTION: VisibilityLevelOption = {
  *   operate an IdentityProvider — the backend rejects it otherwise
  *   (`ValidateVisibilityStep`), so the option only renders when the signal
  *   is present (use `useSsoProvider`, the permission-free lookup).
+ * - `canSetPublicVisibility`: entering PUBLIC is operator-gated in the
+ *   cloud edition; when the caller lacks the grant the Public option
+ *   renders locked instead of disappearing (use
+ *   `useCanSetPublicVisibility`, which is always `true` in local mode).
  */
 export interface BlueprintVisibilityLevelsContext {
   readonly deploymentMode: "cloud" | "local";
   readonly hasIdentityProvider: boolean;
+  readonly canSetPublicVisibility: boolean;
+}
+
+/**
+ * The PUBLIC option, locked with {@link PUBLIC_LOCKED_REASON} when the
+ * caller may not publish. Locked rather than hidden: the level (and the
+ * path to it) stays discoverable, matching how the option keeps rendering
+ * as the current state on already-public resources.
+ */
+function publicOption(canSetPublicVisibility: boolean): VisibilityLevelOption {
+  return canSetPublicVisibility
+    ? PUBLIC_OPTION
+    : { ...PUBLIC_OPTION, lockedReason: PUBLIC_LOCKED_REASON };
 }
 
 /**
@@ -114,12 +151,22 @@ export interface BlueprintVisibilityLevelsContext {
 export function blueprintVisibilityLevels(
   context: BlueprintVisibilityLevelsContext,
 ): readonly VisibilityLevelOption[] {
+  const publicLevel = publicOption(context.canSetPublicVisibility);
   if (context.deploymentMode === "local") {
-    return [PRIVATE_OPTION, PUBLIC_OPTION];
+    return [PRIVATE_OPTION, publicLevel];
   }
   return context.hasIdentityProvider
-    ? [PRIVATE_OPTION, ORG_OPTION, PLATFORM_OPTION, PUBLIC_OPTION]
-    : [PRIVATE_OPTION, ORG_OPTION, PUBLIC_OPTION];
+    ? [PRIVATE_OPTION, ORG_OPTION, PLATFORM_OPTION, publicLevel]
+    : [PRIVATE_OPTION, ORG_OPTION, publicLevel];
+}
+
+/**
+ * Inputs that gate the instance level set — only the publish gate; the set
+ * itself is fixed (instances have no platform level and no deployment-mode
+ * collapse).
+ */
+export interface InstanceVisibilityLevelsContext {
+  readonly canSetPublicVisibility: boolean;
 }
 
 /**
@@ -131,17 +178,21 @@ export function blueprintVisibilityLevels(
  * boundary). Descriptions are execution-oriented because org visibility on
  * an instance is about who can run it and see its executions.
  */
-export const INSTANCE_VISIBILITY_LEVELS: readonly VisibilityLevelOption[] = [
-  PRIVATE_OPTION,
-  {
-    ...ORG_OPTION,
-    description: "All org members can view executions",
-  },
-  {
-    ...PUBLIC_OPTION,
-    description: "All authenticated users can view",
-  },
-];
+export function instanceVisibilityLevels(
+  context: InstanceVisibilityLevelsContext,
+): readonly VisibilityLevelOption[] {
+  return [
+    PRIVATE_OPTION,
+    {
+      ...ORG_OPTION,
+      description: "All org members can view executions",
+    },
+    {
+      ...publicOption(context.canSetPublicVisibility),
+      description: "All authenticated users can view",
+    },
+  ];
+}
 
 /**
  * The levels an environment selector offers, in escalation order:

package/src/mcp-server/McpServerDetailView.tsx

@@ -16,7 +16,7 @@ import type { EnvVarDeclaration } from "@stigmer/protos/ai/stigmer/agentic/envir
 import { useMcpServer } from "./useMcpServer.js";
 import type { UseMcpServerReturn } from "./useMcpServer.js";
 import { useUpdateMcpServer } from "./useUpdateMcpServer.js";
-import { mcpServerToInput } from "./internal/mcpServerToInput.js";
+import { toMcpServerUpdateInput } from "@stigmer/sdk";
 import { useMcpServerConnect } from "./useMcpServerConnect.js";
 import { useMcpServerCredentials } from "./useMcpServerCredentials.js";
 import {
@@ -214,7 +214,7 @@ export function McpServerDetailView({
       value: import("@stigmer/sdk").McpServerInput[K],
     ): Promise<boolean> => {
       if (!mcpServer) return false;
-      const input = mcpServerToInput(mcpServer);
+      const input = toMcpServerUpdateInput(mcpServer);
       (input as unknown as Record<string, unknown>)[field] = value;
       try {
         const updated = await updateMcpServer(input);

package/src/mcp-server/__tests__/useMcpServerConnect.asyncLane.test.tsx

@@ -0,0 +1,117 @@
+// Pins the connect hook's ride on the async connect lane (stigmer#425):
+// startConnect + poll on a backend that serves it, and the blocking-RPC
+// fallback on one that does not (the byoaEditionDegradation idiom — every
+// OTHER mcp-server test in this suite exercises the fallback implicitly, this
+// file pins BOTH lanes explicitly so neither can regress silently). The
+// protocol's own edge cases (deadlines, rehydration codes) are pinned in
+// @stigmer/sdk's mcpserver-connect.test.ts — this is the hook-level contract.
+
+import { describe, it, expect, afterEach } from "vitest";
+import { renderHook, act, cleanup } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import { createRouterTransport } from "@connectrpc/connect";
+import { Stigmer } from "@stigmer/sdk";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import { McpServerQueryController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/query_pb";
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import { ConnectPhase } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/status_pb";
+import { StigmerContext } from "../../context";
+import { useMcpServerConnect } from "../useMcpServerConnect";
+
+afterEach(cleanup);
+
+const SERVER_ID = "mcps_01test";
+const ORG = "acme";
+
+function mcpServer(phase: ConnectPhase, extras?: { failureMessage?: string; toolName?: string }) {
+  return create(McpServerSchema, {
+    metadata: { id: SERVER_ID, name: "Test Server" },
+    status: {
+      ...(extras?.toolName !== undefined
+        ? { discoveredCapabilities: { tools: [{ name: extras.toolName }] } }
+        : {}),
+      connectStatus: {
+        phase,
+        workflowId: `stigmer/mcp-server/connect/${SERVER_ID}`,
+        failureCode: extras?.failureMessage !== undefined ? "FailedPrecondition" : "",
+        failureMessage: extras?.failureMessage ?? "",
+      },
+    },
+  });
+}
+
+function renderConnectHook(register: Parameters<typeof createRouterTransport>[0]) {
+  const client = new Stigmer({
+    baseUrl: "/",
+    getAccessToken: () => "test-token",
+    customTransport: createRouterTransport(register),
+  });
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <StigmerContext.Provider value={client}>{children}</StigmerContext.Provider>
+  );
+  return renderHook(() => useMcpServerConnect(), { wrapper });
+}
+
+describe("useMcpServerConnect — async lane", () => {
+  it("resolves through startConnect + polling when the backend serves the lane", async () => {
+    let blockingConnectCalled = false;
+    const { result } = renderConnectHook((router) => {
+      router.service(McpServerCommandController, {
+        startConnect: () => mcpServer(ConnectPhase.connecting),
+        connect: () => {
+          blockingConnectCalled = true;
+          return mcpServer(ConnectPhase.succeeded);
+        },
+      });
+      router.service(McpServerQueryController, {
+        get: () => mcpServer(ConnectPhase.succeeded, { toolName: "search_code" }),
+      });
+    });
+
+    await act(async () => {
+      const settled = await result.current.connect(SERVER_ID, ORG);
+      expect(settled.status?.discoveredCapabilities?.tools[0]?.name).toBe("search_code");
+    });
+    expect(blockingConnectCalled).toBe(false);
+    expect(result.current.error).toBeNull();
+    expect(result.current.isConnecting).toBe(false);
+  }, 15_000);
+
+  it("surfaces a failed operation with the persisted user-facing message", async () => {
+    const { result } = renderConnectHook((router) => {
+      router.service(McpServerCommandController, {
+        startConnect: () => mcpServer(ConnectPhase.connecting),
+      });
+      router.service(McpServerQueryController, {
+        get: () =>
+          mcpServer(ConnectPhase.failed, {
+            failureMessage: "connect failed for MCP server 'Test Server': missing credentials",
+          }),
+      });
+    });
+
+    await act(async () => {
+      await expect(result.current.connect(SERVER_ID, ORG)).rejects.toThrow("missing credentials");
+    });
+    expect(result.current.error?.message).toContain("missing credentials");
+    expect(result.current.isConnecting).toBe(false);
+  }, 15_000);
+
+  it("falls back to the blocking connect on a backend without the lane", async () => {
+    // startConnect deliberately unregistered: the router answers
+    // UNIMPLEMENTED, exactly what a pre-#425 backend (e.g. the hosted
+    // edition until its parity lands) returns.
+    const { result } = renderConnectHook((router) => {
+      router.service(McpServerCommandController, {
+        connect: () => mcpServer(ConnectPhase.succeeded, { toolName: "search_code" }),
+      });
+    });
+
+    await act(async () => {
+      const settled = await result.current.connect(SERVER_ID, ORG);
+      expect(settled.status?.discoveredCapabilities?.tools[0]?.name).toBe("search_code");
+    });
+    expect(result.current.error).toBeNull();
+  });
+});

package/src/mcp-server/index.ts

@@ -95,8 +95,6 @@ export type { UseCreateMcpServerReturn } from "./useCreateMcpServer.js";
 export { useUpdateMcpServer } from "./useUpdateMcpServer.js";
 export type { UseUpdateMcpServerReturn } from "./useUpdateMcpServer.js";
 
-export { mcpServerToInput } from "./internal/mcpServerToInput.js";
-
 export { McpServerCreationWizard } from "./McpServerCreationWizard.js";
 export type {
   McpServerCreationWizardProps,

package/src/mcp-server/internal/definitionDrift.ts

@@ -1,6 +1,5 @@
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
-import type { McpServerInput } from "@stigmer/sdk";
-import { mcpServerToInput } from "./mcpServerToInput.js";
+import { toMcpServerUpdateInput, type McpServerInput } from "@stigmer/sdk";
 
 /**
  * Connection-defining field groups a marketplace definition can drift on.
@@ -24,9 +23,9 @@ export type DriftFieldId =
 
 /**
  * Deep equality over the plain-object projections produced by
- * `mcpServerToInput`. Key order is irrelevant (proto map iteration order
- * is not canonical); `undefined` values and absent keys are equivalent
- * (the conversion uses `undefined` for proto defaults).
+ * `toMcpServerUpdateInput`. Key order is irrelevant (proto map iteration
+ * order is not canonical); `undefined` values and absent keys are
+ * equivalent (the conversion uses `undefined` for proto defaults).
  */
 function deepEqual(a: unknown, b: unknown): boolean {
   if (Object.is(a, b)) return true;
@@ -72,17 +71,18 @@ function functionalEnvShape(env: McpServerInput["env"]) {
  * mirrors and reports which connection-defining field groups differ, or
  * `null` when the connection-defining configuration matches.
  *
- * The comparison runs on `mcpServerToInput` projections rather than raw
- * protos: that conversion is the SDK's canonical read-modify-write lens,
- * and its exhaustiveness is fence-tested — so a new spec field cannot
- * silently bypass this comparison either.
+ * The comparison runs on `toMcpServerUpdateInput` projections rather than
+ * raw protos: that generated mapper is the SDK's canonical
+ * read-modify-write lens, and its completeness is guaranteed by codegen
+ * plus the SDK's schema-tripwire fixture suite — so a new spec field
+ * cannot silently bypass this comparison either.
  */
 export function computeDefinitionDrift(
   current: McpServer,
   template: McpServer,
 ): readonly DriftFieldId[] | null {
-  const cur = mcpServerToInput(current);
-  const tpl = mcpServerToInput(template);
+  const cur = toMcpServerUpdateInput(current);
+  const tpl = toMcpServerUpdateInput(template);
 
   const changed: DriftFieldId[] = [];
 
@@ -128,21 +128,22 @@ export function computeDefinitionDrift(
  *
  * Definition fields — transport, env declarations, auth, and the cosmetic
  * description/icon/tags/repository metadata — come from the template.
- * The user's own choices survive: identity (name/org/slug/labels), tool
- * enablement, and pinned approval policies. Visibility is not part of the
- * input contract at all (the backend preserves it on update;
- * `updateVisibility` is its dedicated write path).
+ * The user's own choices survive: identity (name/org/slug/labels/
+ * visibility — the backend ignores visibility on update anyway;
+ * `updateVisibility` is its dedicated write path), tool enablement, and
+ * pinned approval policies.
  *
- * Built by merging two `mcpServerToInput` projections, so the preserved
- * set is the explicit override list below and nothing can be lost in
- * translation (the conversion is fence-tested exhaustive).
+ * Built by merging two `toMcpServerUpdateInput` projections, so the
+ * preserved set is the explicit override list below and nothing can be
+ * lost in translation (the mapper is generated complete and guarded by
+ * the SDK's schema-tripwire fixture suite).
  */
 export function buildRefreshInput(
   current: McpServer,
   template: McpServer,
 ): McpServerInput {
-  const cur = mcpServerToInput(current);
-  const tpl = mcpServerToInput(template);
+  const cur = toMcpServerUpdateInput(current);
+  const tpl = toMcpServerUpdateInput(template);
 
   return {
     ...tpl,
@@ -151,6 +152,7 @@ export function buildRefreshInput(
     org: cur.org,
     slug: cur.slug,
     labels: cur.labels,
+    visibility: cur.visibility,
     // User policy: never reset by a definition refresh.
     defaultEnabledTools: cur.defaultEnabledTools,
     pinnedToolApprovals: cur.pinnedToolApprovals,

package/src/mcp-server/useMcpServerConnect.ts

@@ -4,7 +4,7 @@ import { useCallback, useState } from "react";
 import { create } from "@bufbuild/protobuf";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import { ConnectInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
-import type { EnvVarInput } from "@stigmer/sdk";
+import { connectAndWait, type EnvVarInput } from "@stigmer/sdk";
 import { useStigmer } from "../hooks.js";
 import { resolveDeclaredSystemEnvVars } from "../environment/systemEnvVars.js";
 import { toError } from "../internal/toError.js";
@@ -15,9 +15,12 @@ export interface UseMcpServerConnectReturn {
    * Connect to an MCP server: discover its tools, resource templates,
    * and classify tool approval policies via a lightweight LLM call.
    *
-   * Calls the `connect` RPC which starts a Temporal workflow on the
-   * runner. The RPC blocks until the workflow completes
-   * (typically 5-15 seconds, ~30s timeout).
+   * Uses the async connect lane (`startConnect` + polling via the SDK's
+   * `connectAndWait`, stigmer/stigmer#425): the promise still resolves
+   * when the operation settles — legitimately tens of seconds to minutes
+   * for heavy servers — but no RPC stays open that long, so the wait
+   * survives browser transport limits. Backends without the lane fall
+   * back to the blocking `connect` RPC transparently.
    *
    * Platform system env vars (`STIGMER_SERVER_ADDRESS`,
    * `STIGMER_API_KEY`) are injected only when the MCP server
@@ -45,7 +48,7 @@ export interface UseMcpServerConnectReturn {
     runtimeEnv?: Record<string, EnvVarInput>,
     declaredEnvKeys?: readonly string[],
   ) => Promise<McpServer>;
-  /** `true` while the connect RPC is in flight. */
+  /** `true` while the connect operation is in flight (start through settle). */
   readonly isConnecting: boolean;
   /** Error from the most recent failed connect, or `null`. */
   readonly error: Error | null;
@@ -129,7 +132,7 @@ export function useMcpServerConnect(): UseMcpServerConnectReturn {
             : {}),
         });
 
-        return await stigmer.mcpServer.connect(input);
+        return await connectAndWait(stigmer.mcpServer, input);
       } catch (err) {
         const wrapped = toError(err);
         setError(wrapped);

package/src/mcp-server/useMcpServerOAuthConnect.ts

@@ -2,7 +2,7 @@
 
 import { useCallback, useEffect, useRef, useState } from "react";
 import { create } from "@bufbuild/protobuf";
-import { getUserMessage } from "@stigmer/sdk";
+import { connectAndWait, getUserMessage } from "@stigmer/sdk";
 import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
 import {
   InitiateOAuthConnectInputSchema,
@@ -248,7 +248,12 @@ export function useMcpServerOAuthConnect(): UseMcpServerOAuthConnectReturn {
             : {}),
         });
 
-        const server = await stigmer.mcpServer.connect(input);
+        // Async connect lane (stigmer/stigmer#425): startConnect + poll via
+        // the SDK's shared protocol, so the discovery wait can outlive the
+        // browser's ~300s no-bytes unary limit that used to fail this phase
+        // spuriously. Old backends without the lane fall back to the
+        // blocking RPC inside connectAndWait.
+        const server = await connectAndWait(stigmer.mcpServer, input);
 
         advancePhase("done");
         return server;

package/src/mcp-server/useUpdateMcpServer.ts

@@ -23,9 +23,9 @@ export interface UseUpdateMcpServerReturn {
  *
  * Wraps `stigmer.mcpServer.update(input)` with loading and error state.
  * The caller must provide a **complete** `McpServerInput` — the backend
- * performs full spec replacement. Use `mcpServerToInput()` to reconstruct
- * the input from a fetched server, modify the desired field, and pass
- * the result here.
+ * performs full spec replacement. Use `toMcpServerUpdateInput()` (from
+ * `@stigmer/sdk`) to reconstruct the input from a fetched server, modify
+ * the desired field, and pass the result here.
  */
 export function useUpdateMcpServer(): UseUpdateMcpServerReturn {
   const stigmer = useStigmer();