@stigmer/react 3.12.5 → 3.12.7

package/src/memory/useMemories.ts

@@ -0,0 +1,66 @@
+"use client";
+
+import { create } from "@bufbuild/protobuf";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ListMemoriesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import { useStigmer } from "../hooks.js";
+import { useFetch } from "../internal/useFetch.js";
+
+/**
+ * The server-enforced per-subject-per-org record ceiling (all lifecycle
+ * states). Requesting one page of exactly this size fetches EVERY record
+ * the caller can see, by construction — the cap is why this list needs
+ * no pagination UI.
+ */
+const MEMORY_CAP = 100;
+
+/** Return value of {@link useMemories}. */
+export interface UseMemoriesReturn {
+  /** Every memory the caller can view in the org, newest first. */
+  readonly memories: readonly Memory[];
+  /** `true` while the initial fetch is in flight. */
+  readonly isLoading: boolean;
+  /** `true` while a background refetch is in flight. */
+  readonly isRefetching: boolean;
+  /** Error from the last failed request, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Discard cached data and re-fetch the list from the server. */
+  readonly refetch: () => void;
+}
+
+/**
+ * Data hook that fetches the caller's memories in an organization.
+ *
+ * Memory content is subject-only: the server returns exactly the records
+ * that are about the caller (FGA-filtered in cloud; single-user in local
+ * mode), so this list is always "what the platform remembers about ME
+ * here". Ordering is newest first; group by lifecycle state for display
+ * with {@link groupMemoriesByLifecycle}.
+ *
+ * Pass `null` as `org` to skip fetching (stable no-op).
+ *
+ * @example
+ * ```tsx
+ * const { memories, isLoading, refetch } = useMemories(org);
+ * const groups = groupMemoriesByLifecycle(memories);
+ * ```
+ */
+export function useMemories(org: string | null): UseMemoriesReturn {
+  const stigmer = useStigmer();
+
+  const { data: memories, isLoading, isRefetching, error, refetch } = useFetch(
+    org
+      ? () =>
+          stigmer.memory
+            .list(create(ListMemoriesRequestSchema, {
+              org,
+              pageInfo: { num: 1, size: MEMORY_CAP },
+            }))
+            .then((r) => [...r.items])
+      : null,
+    [stigmer, org],
+    [] as Memory[],
+  );
+
+  return { memories, isLoading, isRefetching, error, refetch };
+}

package/src/memory/useRejectMemory.ts

@@ -0,0 +1,65 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useRejectMemory}. */
+export interface UseRejectMemoryReturn {
+  /** Reject a proposed memory by its resource ID. Resolves with the rejected record. */
+  readonly rejectMemory: (id: string) => Promise<Memory>;
+  /** `true` while the reject request is in flight. */
+  readonly isRejecting: boolean;
+  /** Error from the last failed reject, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Behavior hook that wraps `memory.reject()`. A rejected memory is never
+ * recalled; the record is kept as an audit trail until deleted.
+ *
+ * Rejecting an already-rejected memory succeeds and changes nothing.
+ * Rejecting a confirmed memory fails with FAILED_PRECONDITION —
+ * deleting a confirmed memory is how it is revoked.
+ *
+ * Rejection is deliberately one click on every surface, with no
+ * confirmation dialog (DD-005 D4): expensive review teaches users to
+ * ignore the proposal queue.
+ *
+ * @example
+ * ```tsx
+ * const { rejectMemory, isRejecting } = useRejectMemory();
+ *
+ * await rejectMemory(memory.metadata?.id ?? "");
+ * refetch(); // refresh the list after the decision
+ * ```
+ */
+export function useRejectMemory(): UseRejectMemoryReturn {
+  const stigmer = useStigmer();
+  const [isRejecting, setIsRejecting] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const rejectMemory = useCallback(
+    async (id: string): Promise<Memory> => {
+      setIsRejecting(true);
+      setError(null);
+
+      try {
+        return await stigmer.memory.reject(id);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsRejecting(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { rejectMemory, isRejecting, error, clearError };
+}

package/src/memory/useUpdateMemoryContent.ts

@@ -0,0 +1,67 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { toMemoryUpdateInput } from "@stigmer/sdk";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useUpdateMemoryContent}. */
+export interface UseUpdateMemoryContentReturn {
+  /** Replace a memory's fact text. Resolves with the updated record. */
+  readonly updateContent: (memory: Memory, content: string) => Promise<Memory>;
+  /** `true` while the update request is in flight. */
+  readonly isUpdating: boolean;
+  /** Error from the last failed update, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Behavior hook that edits a memory's fact text — the one field the
+ * subject owns after capture (DD-004).
+ *
+ * The update RPC replaces the entire spec, so the loaded record is
+ * mapped through the generated `toMemoryUpdateInput` and only `content`
+ * is overridden — the wipe-safe editing rule. Subject and provenance
+ * ride along verbatim (they are update-immutable server-side), and the
+ * consent lifecycle is never touched by updates.
+ *
+ * @example
+ * ```tsx
+ * const { updateContent, isUpdating } = useUpdateMemoryContent();
+ *
+ * await updateContent(memory, editedText);
+ * refetch(); // refresh the list after the edit
+ * ```
+ */
+export function useUpdateMemoryContent(): UseUpdateMemoryContentReturn {
+  const stigmer = useStigmer();
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const updateContent = useCallback(
+    async (memory: Memory, content: string): Promise<Memory> => {
+      setIsUpdating(true);
+      setError(null);
+
+      try {
+        return await stigmer.memory.update({
+          ...toMemoryUpdateInput(memory),
+          content,
+        });
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsUpdating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { updateContent, isUpdating, error, clearError };
+}

package/src/models/ModelSelector.tsx

@@ -9,6 +9,7 @@ import { useModelRegistry } from "./useModelRegistry.js";
 import type { ModelInfo, CostTier, SpeedTier } from "./registry.js";
 import { HARNESS_META, HARNESS_OPTIONS, type HarnessOption } from "./harness.js";
 import { FAST_SERVICE_TIER, type ServiceTierOption } from "./service-tier.js";
+import type { ThinkingModeOption } from "./thinking-mode.js";
 
 const COST_TIER_LABEL: Record<CostTier, string> = {
   economy: "$",
@@ -23,6 +24,17 @@ const SPEED_TIER_LABEL: Record<SpeedTier, string> = {
   slow: "Powerful",
 };
 
+/**
+ * Whether the thinking switch may act on this model (stigmer/stigmer#772):
+ * the registry declares the capability AND the model is cursor-harness —
+ * the only harness with a thinking translation in v1. Native models
+ * truthfully declare the capability too, but selecting it there would be
+ * refused at create time, so the control never renders for them.
+ */
+function supportsThinking(model: ModelInfo): boolean {
+  return model.harness === "cursor" && model.thinkingCapable === true;
+}
+
 /** Props for {@link ModelSelector}. */
 export interface ModelSelectorProps {
   /** Currently selected model ID. */
@@ -95,6 +107,30 @@ export interface ModelSelectorProps {
    */
   readonly onServiceTierChange?: (tier: ServiceTierOption) => void;
 
+  /**
+   * Current thinking mode for the selected model (stigmer/stigmer#772).
+   * Defaults to "disabled". Only meaningful together with
+   * {@link onThinkingModeChange}.
+   */
+  readonly thinkingMode?: ThinkingModeOption;
+  /**
+   * Called when the user toggles extended reasoning. Providing this enables
+   * the "Thinking" switch as a sibling of the fast-tier switch in the
+   * popover's options area, which renders ONLY while the selected model is
+   * a cursor-harness model declaring the thinking capability
+   * ({@link ModelInfo.thinkingCapable}) — no dead controls, and v1 honors
+   * the selection on the cursor harness only.
+   *
+   * The same persistence rule as the fast tier: an active thinking mode
+   * survives switches between thinking-capable models (trigger badge +
+   * options switch keep it visible) and resets to "disabled" only when the
+   * new model lacks the capability — an unsupported combination can never
+   * be submitted (#772, refused at create time). Unlike fast, thinking
+   * bills at base per-token rates; enabled turns consume more output
+   * (reasoning) tokens.
+   */
+  readonly onThinkingModeChange?: (mode: ThinkingModeOption) => void;
+
   /**
    * @deprecated Use {@link onHarnessChange} instead.
    */
@@ -125,6 +161,14 @@ export interface ModelSelectorProps {
  * switch keep the state honest — and resets only for models with no fast
  * variant, where it would be refused at create time.
  *
+ * **Thinking mode (#772).** The same options-area pattern for the second
+ * variant dimension: opting in via
+ * {@link ModelSelectorProps.onThinkingModeChange} renders a "Thinking"
+ * switch for cursor-harness models declaring the thinking capability.
+ * Capability-gated rather than priced-variant-gated — thinking bills at
+ * base per-token rates and costs more only through extra reasoning
+ * (output) tokens. Persistence and reset rules mirror the fast tier's.
+ *
  * @example
  * ```tsx
  * <ModelSelector
@@ -153,6 +197,8 @@ export function ModelSelector({
   placeholderLabel,
   serviceTier = "standard",
   onServiceTierChange,
+  thinkingMode = "disabled",
+  onThinkingModeChange,
 }: ModelSelectorProps) {
   const portalContainer = useStigmerPortalContainer();
 
@@ -277,9 +323,19 @@ export function ModelSelector({
       ) {
         onServiceTierChange("standard");
       }
+      // The identical persistence rule for the thinking mode (#772):
+      // survives between thinking-capable cursor models, resets only
+      // where the selection would be refused at create time.
+      if (
+        thinkingMode === "enabled"
+        && onThinkingModeChange
+        && !supportsThinking(model)
+      ) {
+        onThinkingModeChange("disabled");
+      }
       setOpen(false);
     },
-    [onValueChange, serviceTier, onServiceTierChange],
+    [onValueChange, serviceTier, onServiceTierChange, thinkingMode, onThinkingModeChange],
   );
 
   const scrollHighlightIntoView = useCallback((idx: number) => {
@@ -338,6 +394,15 @@ export function ModelSelector({
   const fastActive =
     serviceTier === "fast"
     && (selectedModel?.serviceTiers.includes(FAST_SERVICE_TIER) ?? false);
+  // The thinking switch renders under the same no-dead-controls rule,
+  // gated on the capability instead of a priced variant (#772).
+  const showThinkingToggle =
+    onThinkingModeChange !== undefined
+    && selectedModel !== undefined
+    && supportsThinking(selectedModel);
+  const thinkingActive =
+    thinkingMode === "enabled"
+    && (selectedModel !== undefined && supportsThinking(selectedModel));
 
   const usingPlaceholder = !value && placeholderLabel !== undefined;
   const triggerLabel = usingPlaceholder
@@ -379,6 +444,16 @@ export function ModelSelector({
             Fast
           </span>
         )}
+        {thinkingActive && (
+          <span
+            className={cn(
+              "stg:inline-flex stg:shrink-0 stg:items-center stg:gap-0.5 stg:rounded-full stg:border stg:border-primary stg:px-1.5 stg:py-px",
+              "stg:text-[0.6rem] stg:font-medium stg:uppercase stg:tracking-wider stg:text-primary",
+            )}
+          >
+            Thinking
+          </span>
+        )}
         <ChevronIcon />
       </Popover.Trigger>
 
@@ -483,6 +558,24 @@ export function ModelSelector({
               </div>
             )}
 
+            {showThinkingToggle && (
+              <div className="stg:flex stg:items-center stg:justify-between stg:border-b stg:border-border stg:px-3 stg:py-2">
+                <div className="stg:flex stg:flex-col">
+                  <span className="stg:text-xs stg:text-foreground">Thinking</span>
+                  <span className="stg:text-[0.65rem] stg:text-muted-foreground">
+                    Extended reasoning; uses more output tokens
+                  </span>
+                </div>
+                <Switch
+                  checked={thinkingActive}
+                  onCheckedChange={(next) =>
+                    onThinkingModeChange?.(next ? "enabled" : "disabled")
+                  }
+                  aria-label="Thinking"
+                />
+              </div>
+            )}
+
             {/* Search input */}
             <div className="stg:border-b stg:border-border stg:px-3 stg:py-1.5">
               <input

package/src/models/index.ts

@@ -13,3 +13,5 @@ export { DEFAULT_HARNESS, HARNESS_LABELS, HARNESS_META, HARNESS_OPTIONS, toProto
 export type { HarnessOption, HarnessDisplayInfo } from "./harness.js";
 export { FAST_SERVICE_TIER, toProtoServiceTier, fromProtoServiceTier } from "./service-tier.js";
 export type { ServiceTierOption } from "./service-tier.js";
+export { toProtoThinkingMode, fromProtoThinkingMode } from "./thinking-mode.js";
+export type { ThinkingModeOption } from "./thinking-mode.js";

package/src/models/registry.ts

@@ -114,6 +114,22 @@ export interface ModelInfo {
    * parse the same document and must agree on what absence means.
    */
   readonly visionCapability?: boolean;
+  /**
+   * Tri-state thinking capability from the registry's `capabilities` block
+   * (stigmer/stigmer#772), the same absence convention as
+   * {@link visionCapability}:
+   *
+   * - `true` — the model declares an extended-reasoning (thinking) variant;
+   *   the thinking switch in the model popover's options area may render
+   * - `false` — explicitly assessed as having none
+   * - `undefined` — never assessed; **stay silent, never treat as false**
+   *
+   * Capability-gated, not pricing-gated (unlike {@link serviceTiers}):
+   * thinking bills at base per-token rates, so no priced variant exists to
+   * key on. v1 honors the selection on the cursor harness only — gate any
+   * control on `harness === "cursor"` as well as this flag.
+   */
+  readonly thinkingCapable?: boolean;
 }
 
 /**
@@ -229,6 +245,17 @@ function parseVisionCapability(capabilities: unknown): boolean | undefined {
   return typeof vision === "boolean" ? vision : undefined;
 }
 
+/**
+ * Extract `capabilities.thinking` with the same tri-state convention as
+ * {@link parseVisionCapability} (stigmer/stigmer#772): a missing or
+ * malformed `capabilities` block stays `undefined`, never coerced to false.
+ */
+function parseThinkingCapability(capabilities: unknown): boolean | undefined {
+  if (!capabilities || typeof capabilities !== "object") return undefined;
+  const thinking = (capabilities as Record<string, unknown>).thinking;
+  return typeof thinking === "boolean" ? thinking : undefined;
+}
+
 /**
  * Parse the document-level `limits.vision` block. Returns `undefined` for
  * documents that predate the block or carry a malformed one — absence
@@ -284,6 +311,7 @@ export function parseRegistryDocument(data: unknown): ModelRegistryDocument {
     .filter(isModelEntry)
     .map((m) => {
       const visionCapability = parseVisionCapability(m.capabilities);
+      const thinkingCapable = parseThinkingCapability(m.capabilities);
       return {
         modelId: m.id,
         provider: m.provider as Provider,
@@ -300,6 +328,7 @@ export function parseRegistryDocument(data: unknown): ModelRegistryDocument {
         // Conditional spread keeps unassessed models free of the key
         // (tri-state absence, not an explicit undefined).
         ...(visionCapability !== undefined ? { visionCapability } : {}),
+        ...(thinkingCapable !== undefined ? { thinkingCapable } : {}),
       };
     });
 

package/src/models/thinking-mode.ts

@@ -0,0 +1,48 @@
+import { ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+
+/**
+ * String form of the thinking mode for component props and hook inputs
+ * (stigmer/stigmer#772). Mirrors {@link ServiceTierOption}: components
+ * speak strings, execution creation speaks proto.
+ *
+ * "disabled" is the model's base variant; "enabled" is the model's
+ * extended-reasoning variant — selectable only for models whose
+ * {@link ModelInfo.thinkingCapable} is true. Unlike the fast tier,
+ * thinking bills at base per-token rates; enabled turns simply consume
+ * more output (reasoning) tokens.
+ */
+export type ThinkingModeOption = "disabled" | "enabled";
+
+/**
+ * Convert a {@link ThinkingModeOption} string to the proto enum.
+ */
+export function toProtoThinkingMode(mode: ThinkingModeOption): ThinkingMode {
+  switch (mode) {
+    case "enabled":
+      return ThinkingMode.ENABLED;
+    case "disabled":
+    default:
+      return ThinkingMode.DISABLED;
+  }
+}
+
+/**
+ * Convert a proto {@link ThinkingMode} enum to its string form.
+ *
+ * `UNSPECIFIED` (and any unknown value) maps to `undefined` so callers can
+ * decide their own default — matching the proto contract (`UNSPECIFIED`
+ * resolves to `THINKING_MODE_DISABLED` in the runner, never the provider
+ * account default).
+ */
+export function fromProtoThinkingMode(
+  mode: ThinkingMode | undefined,
+): ThinkingModeOption | undefined {
+  switch (mode) {
+    case ThinkingMode.DISABLED:
+      return "disabled";
+    case ThinkingMode.ENABLED:
+      return "enabled";
+    default:
+      return undefined;
+  }
+}

package/src/oauth-app/OAuthAppDetailPanel.tsx

@@ -2,7 +2,7 @@
 
 import { type FormEvent, useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
-import { getUserMessage } from "@stigmer/sdk";
+import { getUserMessage, toOAuthAppUpdateInput } from "@stigmer/sdk";
 import type { OAuthApp } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
 import {
   TokenEndpointAuthMethod,
@@ -132,30 +132,32 @@ export function OAuthAppDetailPanel({
         .filter(Boolean);
 
       try {
+        // Full-spec-replace safety: spread the complete mapped input and
+        // override every field this form owns, so a future spec field the
+        // form does not know about survives the save. An empty secret
+        // input keeps the fetched value — the redaction marker — which
+        // the server's update pipeline treats as "keep the stored
+        // secret"; a non-empty input replaces it.
+        const mapped = toOAuthAppUpdateInput(oauthApp);
         const updated = await update({
-          name: meta?.name ?? "",
-          slug: meta?.slug,
-          org: meta?.org ?? "",
+          ...mapped,
           provider: provider.trim(),
           clientId: clientId.trim(),
-          ...(clientSecret.trim() && { clientSecret: clientSecret.trim() }),
+          clientSecret: clientSecret.trim() || mapped.clientSecret,
           authorizationUrl: authorizationUrl.trim(),
           tokenUrl: tokenUrl.trim(),
-          ...(parsedScopes.length > 0 && { scopes: parsedScopes }),
-          ...(userinfoUrl.trim() && { userinfoUrl: userinfoUrl.trim() }),
-          ...(scopeParameterName.trim() && {
-            scopeParameterName: scopeParameterName.trim(),
-          }),
-          ...(tokenEndpointAuthMethod !== "unspecified" && {
-            tokenEndpointAuthMethod:
-              TOKEN_AUTH_METHOD_MAP[tokenEndpointAuthMethod],
-          }),
-          ...(vendorApprovalStatus !== "unspecified" && {
-            vendorApprovalStatus: APPROVAL_STATUS_MAP[vendorApprovalStatus],
-          }),
-          ...(vendorApprovalDocsUrl.trim() && {
-            vendorApprovalDocsUrl: vendorApprovalDocsUrl.trim(),
-          }),
+          scopes: parsedScopes.length > 0 ? parsedScopes : undefined,
+          userinfoUrl: userinfoUrl.trim() || undefined,
+          scopeParameterName: scopeParameterName.trim() || undefined,
+          tokenEndpointAuthMethod:
+            tokenEndpointAuthMethod !== "unspecified"
+              ? TOKEN_AUTH_METHOD_MAP[tokenEndpointAuthMethod]
+              : undefined,
+          vendorApprovalStatus:
+            vendorApprovalStatus !== "unspecified"
+              ? APPROVAL_STATUS_MAP[vendorApprovalStatus]
+              : undefined,
+          vendorApprovalDocsUrl: vendorApprovalDocsUrl.trim() || undefined,
         });
         setMode("view");
         onUpdated?.(updated);
@@ -164,7 +166,7 @@ export function OAuthAppDetailPanel({
       }
     },
     [
-      meta, provider, clientId, clientSecret, authorizationUrl, tokenUrl,
+      oauthApp, provider, clientId, clientSecret, authorizationUrl, tokenUrl,
       scopes, userinfoUrl, scopeParameterName, tokenEndpointAuthMethod,
       vendorApprovalStatus, vendorApprovalDocsUrl, update, clearUpdateError,
       onUpdated,

package/src/oauth-app/__tests__/OAuthAppDetailPanel.test.tsx

@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  OAuthAppSchema,
+  type OAuthApp,
+} from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
+import { TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
+import type { OAuthAppInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { OAuthAppDetailPanel } from "../OAuthAppDetailPanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug: the panel must
+ * spread `toOAuthAppUpdateInput` and override only what it edits, so a
+ * spec field the form does not know about survives the save. The secret
+ * has its own contract: an empty secret input sends the fetched value —
+ * the server's redaction marker — which the update pipeline treats as
+ * "keep the stored secret" (oss#395 pins the marker/ciphertext boundary).
+ */
+
+const REDACTED = "***REDACTED***";
+
+const APP: OAuthApp = create(OAuthAppSchema, {
+  metadata: {
+    id: "oa-1",
+    name: "GitHub OAuth",
+    slug: "github-oauth",
+    org: "acme",
+  },
+  spec: {
+    provider: "github",
+    clientId: "gh-client-1",
+    clientSecret: REDACTED,
+    authorizationUrl: "https://github.com/login/oauth/authorize",
+    tokenUrl: "https://github.com/login/oauth/access_token",
+    scopes: ["repo"],
+    tokenEndpointAuthMethod: TokenEndpointAuthMethod.CLIENT_SECRET_POST,
+  },
+});
+
+function renderPanel(update: ReturnType<typeof vi.fn>) {
+  const client = {
+    oauthapp: { update },
+  } as never;
+  return render(
+    <StigmerContext.Provider value={client}>
+      <OAuthAppDetailPanel oauthApp={APP} />
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("OAuthAppDetailPanel save payload", () => {
+  it("keeps the stored secret (redaction marker) when the secret input is left empty", async () => {
+    const update = vi.fn(async (_input: OAuthAppInput) => APP);
+    renderPanel(update);
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    const provider = await screen.findByLabelText("Provider");
+    fireEvent.change(provider, { target: { value: "github-enterprise" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // Empty secret input → the redaction marker rides along → the server
+    // preserves the stored secret.
+    expect(input.clientSecret).toBe(REDACTED);
+    // The edited field.
+    expect(input.provider).toBe("github-enterprise");
+    // Unedited fields round-trip.
+    expect(input.tokenEndpointAuthMethod).toBe(
+      TokenEndpointAuthMethod.CLIENT_SECRET_POST,
+    );
+    expect(input.scopes).toEqual(["repo"]);
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("github-oauth");
+  });
+
+  it("sends a newly entered secret instead of the marker", async () => {
+    const update = vi.fn(async (_input: OAuthAppInput) => APP);
+    renderPanel(update);
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    const secret = await screen.findByLabelText("Client secret");
+    fireEvent.change(secret, { target: { value: "new-secret" } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    expect(update.mock.calls[0]![0].clientSecret).toBe("new-secret");
+  });
+});