@stigmer/react 3.12.5 → 3.12.7

package/src/platform-client/PlatformClientDetailPanel.tsx

@@ -3,7 +3,7 @@
 import { type FormEvent, type KeyboardEvent, useCallback, useId, useState } from "react";
 import { cn } from "@stigmer/theme";
 import { UNSTYLED_FIELDSET } from "../internal/element-resets.js";
-import { getUserMessage } from "@stigmer/sdk";
+import { getUserMessage, toPlatformClientUpdateInput } from "@stigmer/sdk";
 import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
 import { timestampDate, type Timestamp } from "@bufbuild/protobuf/wkt";
 import type { PlatformClient } from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
@@ -176,21 +176,22 @@ export function PlatformClientDetailPanel({
       e.preventDefault();
       clearUpdateError();
       try {
+        // Full-spec-replace safety: spread the complete mapped input and
+        // override only the edited fields, so unlisted spec fields (e.g.
+        // environment_refs, the embedded-assistant credential binding)
+        // survive the save. Cleared fields are set to undefined
+        // explicitly — omitting them would carry the stale mapped value.
         const updated = await update({
-          name: meta?.name ?? "",
-          slug: meta?.slug,
-          org: meta?.org ?? "",
+          ...toPlatformClientUpdateInput(platformClient),
           neverExpires,
-          ...(!neverExpires &&
-            expiresAt && {
-              expiresAt: new Date(expiresAt).toISOString(),
-            }),
+          expiresAt:
+            !neverExpires && expiresAt ? new Date(expiresAt) : undefined,
           autoProvisionAccounts: autoProvision,
           autoGrantOnOrg: autoGrant,
-          ...(autoGrant &&
-            autoGrantRole !== IamRole.iam_role_unspecified && {
-              autoGrantRole,
-            }),
+          autoGrantRole:
+            autoGrant && autoGrantRole !== IamRole.iam_role_unspecified
+              ? autoGrantRole
+              : undefined,
           allowedOrigins: origins,
         });
         setMode("view");
@@ -200,7 +201,7 @@ export function PlatformClientDetailPanel({
       }
     },
     [
-      meta,
+      platformClient,
       neverExpires,
       expiresAt,
       autoProvision,

package/src/platform-client/__tests__/PlatformClientDetailPanel.test.tsx

@@ -0,0 +1,82 @@
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import { timestampFromDate } from "@bufbuild/protobuf/wkt";
+import {
+  PlatformClientSchema,
+  type PlatformClient,
+} from "@stigmer/protos/ai/stigmer/iam/platformclient/v1/api_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import { IamRole } from "@stigmer/protos/ai/stigmer/iam/v1/enum_pb";
+import type { PlatformClientInput } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { PlatformClientDetailPanel } from "../PlatformClientDetailPanel";
+
+/**
+ * Regression suite for the full-spec-replace wipe bug: before the
+ * generated-mapper migration, this panel hand-built its update input and
+ * NEVER sent `environment_refs` — saving any edit silently wiped the
+ * client's credential-delivery environment bindings. The panel must
+ * spread `toPlatformClientUpdateInput` and override only what it edits.
+ */
+
+const PLATFORM_CLIENT: PlatformClient = create(PlatformClientSchema, {
+  metadata: {
+    id: "pc-1",
+    name: "Embed Client",
+    slug: "embed-client",
+    org: "acme",
+  },
+  spec: {
+    clientId: "client-abc",
+    expiresAt: timestampFromDate(new Date("2027-06-01T00:00:00Z")),
+    neverExpires: false,
+    autoProvisionAccounts: true,
+    autoGrantOnOrg: true,
+    autoGrantRole: IamRole.admin,
+    allowedOrigins: ["https://embed.acme.example"],
+    environmentRefs: [
+      { org: "acme", slug: "prod", kind: ApiResourceKind.environment },
+    ],
+  },
+});
+
+function renderPanel(update: ReturnType<typeof vi.fn>) {
+  const client = {
+    platformclient: { update },
+  } as never;
+  return render(
+    <StigmerContext.Provider value={client}>
+      <PlatformClientDetailPanel platformClient={PLATFORM_CLIENT} />
+    </StigmerContext.Provider>,
+  );
+}
+
+afterEach(cleanup);
+
+describe("PlatformClientDetailPanel save payload", () => {
+  it("round-trips environment_refs on an origins-only edit (the wipe bug)", async () => {
+    const update = vi.fn(async (_input: PlatformClientInput) => PLATFORM_CLIENT);
+    renderPanel(update);
+
+    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+
+    // The wipe-bug guard: the form does not render environment bindings,
+    // yet they must survive the save.
+    expect(input.environmentRefs).toEqual([
+      { org: "acme", slug: "prod", kind: ApiResourceKind.environment },
+    ]);
+    // Form-owned fields round-trip from the edit state.
+    expect(input.allowedOrigins).toEqual(["https://embed.acme.example"]);
+    expect(input.autoGrantRole).toBe(IamRole.admin);
+    expect(input.expiresAt).toBeInstanceOf(Date);
+    // Addressing fields for the update pipeline's org+slug lookup.
+    expect(input.org).toBe("acme");
+    expect(input.slug).toBe("embed-client");
+    expect(input.name).toBe("Embed Client");
+  });
+});

package/src/schedule/ScheduleDetailView.tsx

@@ -37,7 +37,7 @@ import {
   type RunConfig,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/invocation_pb";
 import { Harness } from "@stigmer/protos/ai/stigmer/agentic/session/v1/enum_pb";
-import { ServiceTier } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { ServiceTier, ThinkingMode } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
 import type { WorkspaceEntry } from "@stigmer/protos/ai/stigmer/agentic/session/v1/workspace_pb";
 import {
   cadenceToCron,
@@ -60,6 +60,11 @@ import {
   toProtoServiceTier,
   type ServiceTierOption,
 } from "../models/service-tier.js";
+import {
+  fromProtoThinkingMode,
+  toProtoThinkingMode,
+  type ThinkingModeOption,
+} from "../models/thinking-mode.js";
 import { deriveScheduleState, formatNextFire } from "./scheduleState.js";
 import {
   ScheduleRunsCompactList,
@@ -599,10 +604,10 @@ export function ScheduleDetailView({
             {editable && target ? (
               <EngineModelInlineEditor
                 invocation={target}
-                onSave={(harness, modelName, serviceTier) =>
+                onSave={(harness, modelName, serviceTier, thinkingMode) =>
                   saveSpecField("engine-model", (s) => {
                     if (s.target.case === "agent") {
-                      applyEngineModel(s.target.value, harness, modelName, serviceTier);
+                      applyEngineModel(s.target.value, harness, modelName, serviceTier, thinkingMode);
                     }
                   })
                 }
@@ -1016,6 +1021,7 @@ function EngineModelInlineEditor({
     harness: Harness,
     modelName: string,
     serviceTier: ServiceTierOption,
+    thinkingMode: ThinkingModeOption,
   ) => Promise<boolean>;
   readonly isSaving: boolean;
   readonly error?: string;
@@ -1024,6 +1030,7 @@ function EngineModelInlineEditor({
   const [modelName, setModelName] = useState("");
   const [harness, setHarness] = useState<HarnessOption>("cursor");
   const [serviceTier, setServiceTier] = useState<ServiceTierOption>("standard");
+  const [thinkingMode, setThinkingMode] = useState<ThinkingModeOption>("disabled");
 
   const startEdit = () => {
     setModelName(invocation.runConfig?.modelName ?? "");
@@ -1035,6 +1042,9 @@ function EngineModelInlineEditor({
     setServiceTier(
       fromProtoServiceTier(invocation.runConfig?.serviceTier) ?? "standard",
     );
+    setThinkingMode(
+      fromProtoThinkingMode(invocation.runConfig?.thinkingMode) ?? "disabled",
+    );
     setIsEditing(true);
   };
 
@@ -1056,6 +1066,8 @@ function EngineModelInlineEditor({
           onHarnessChange={setHarness}
           serviceTier={serviceTier}
           onServiceTierChange={setServiceTier}
+          thinkingMode={thinkingMode}
+          onThinkingModeChange={setThinkingMode}
           placeholderLabel="Platform default"
           disabled={isSaving}
         />
@@ -1065,6 +1077,7 @@ function EngineModelInlineEditor({
             onClick={() => {
               setModelName("");
               setServiceTier("standard");
+              setThinkingMode("disabled");
             }}
             disabled={isSaving}
             className="stg:rounded-md stg:px-2 stg:py-1 stg:text-[0.65rem] stg:text-muted-foreground stg:hover:text-foreground stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:disabled:pointer-events-none stg:disabled:opacity-50"
@@ -1084,6 +1097,7 @@ function EngineModelInlineEditor({
             modelName !== "" ? toProtoHarness(harness) : Harness.UNSPECIFIED,
             modelName,
             serviceTier,
+            thinkingMode,
           );
           if (ok) setIsEditing(false);
         }}
@@ -1169,14 +1183,17 @@ function applyEngineModel(
   harness: Harness,
   modelName: string,
   serviceTier: ServiceTierOption,
+  thinkingMode: ThinkingModeOption,
 ): void {
   invocation.harness = harness;
   invocation.runConfig = normalizeRunConfig(
     modelName,
     invocation.runConfig?.maxCostUsd ?? 0,
     invocation.runConfig?.maxToolRounds ?? 0,
-    // The tier rides the model choice: no model, no tier (#357).
+    // The variant attributes ride the model choice: no model, no tier and
+    // no thinking (#357/#772).
     modelName.trim() !== "" ? serviceTier : "standard",
+    modelName.trim() !== "" ? thinkingMode : "disabled",
   );
 }
 
@@ -1190,6 +1207,7 @@ function applyBudget(
     maxCostUsd ?? 0,
     invocation.runConfig?.maxToolRounds ?? 0,
     fromProtoServiceTier(invocation.runConfig?.serviceTier) ?? "standard",
+    fromProtoThinkingMode(invocation.runConfig?.thinkingMode) ?? "disabled",
   );
 }
 
@@ -1198,12 +1216,14 @@ function normalizeRunConfig(
   maxCostUsd: number,
   maxToolRounds: number,
   serviceTier: ServiceTierOption,
+  thinkingMode: ThinkingModeOption,
 ): RunConfig | undefined {
   const fields: {
     modelName?: string;
     maxCostUsd?: number;
     maxToolRounds?: number;
     serviceTier?: ServiceTier;
+    thinkingMode?: ThinkingMode;
   } = {};
   if (modelName.trim() !== "") fields.modelName = modelName.trim();
   if (maxCostUsd > 0) fields.maxCostUsd = maxCostUsd;
@@ -1211,6 +1231,8 @@ function normalizeRunConfig(
   // Only an active fast choice is carried — an untouched tier stays
   // absent, preserving the unspecified-vs-explicit ledger distinction (#357).
   if (serviceTier === "fast") fields.serviceTier = toProtoServiceTier(serviceTier);
+  // The tier's #772 twin: only an active enabled choice is carried.
+  if (thinkingMode === "enabled") fields.thinkingMode = toProtoThinkingMode(thinkingMode);
 
   return Object.keys(fields).length > 0
     ? create(RunConfigSchema, fields)
@@ -1429,6 +1451,9 @@ function EngineModelSummary({
   if (invocation?.runConfig?.serviceTier === ServiceTier.FAST) {
     parts.push("Fast tier");
   }
+  if (invocation?.runConfig?.thinkingMode === ThinkingMode.ENABLED) {
+    parts.push("Thinking");
+  }
   return <span className="stg:text-sm stg:text-foreground">{parts.join(" · ")}</span>;
 }
 

package/src/schedule/ScheduleForm.tsx

@@ -16,6 +16,7 @@ import { useGitHubConnection } from "../github/useGitHubConnection.js";
 import { ModelSelector } from "../models/ModelSelector.js";
 import { toProtoHarness, type HarnessOption } from "../models/harness.js";
 import { toProtoServiceTier, type ServiceTierOption } from "../models/service-tier.js";
+import { toProtoThinkingMode, type ThinkingModeOption } from "../models/thinking-mode.js";
 import { Switch } from "../switch/Switch.js";
 import { useStigmerPortalContainer } from "../portal-container.js";
 import { useWorkspaceEntries } from "../workspace/useWorkspaceEntries.js";
@@ -116,6 +117,8 @@ export function ScheduleForm({
   // is picked. No model pinned = no tier pinned (fast requires a model,
   // and the form's reset button clears both).
   const [serviceTier, setServiceTier] = useState<ServiceTierOption>("standard");
+  // Thinking mode: the tier's #772 twin, capability-scoped the same way.
+  const [thinkingMode, setThinkingMode] = useState<ThinkingModeOption>("disabled");
 
   const [budgetUsd, setBudgetUsd] = useState("");
 
@@ -152,7 +155,7 @@ export function ScheduleForm({
       if (!canSubmit || !agentRef) return;
 
       clearError();
-      const runConfig = buildRunConfig(modelName, budgetUsd, serviceTier);
+      const runConfig = buildRunConfig(modelName, budgetUsd, serviceTier, thinkingMode);
       try {
         const schedule = await create({
           name: trimmedName,
@@ -195,6 +198,7 @@ export function ScheduleForm({
       modelName,
       modelHarness,
       serviceTier,
+      thinkingMode,
       budgetUsd,
       workspace,
       onComplete,
@@ -362,6 +366,8 @@ export function ScheduleForm({
             onHarnessChange={setModelHarness}
             serviceTier={serviceTier}
             onServiceTierChange={setServiceTier}
+            thinkingMode={thinkingMode}
+            onThinkingModeChange={setThinkingMode}
             placeholderLabel="Platform default"
             disabled={isCreating}
           />
@@ -371,6 +377,7 @@ export function ScheduleForm({
               onClick={() => {
                 setModelName("");
                 setServiceTier("standard");
+                setThinkingMode("disabled");
               }}
               disabled={isCreating}
               className={cn(
@@ -514,6 +521,7 @@ function buildRunConfig(
   modelName: string,
   budgetUsd: string,
   serviceTier: ServiceTierOption,
+  thinkingMode: ThinkingModeOption,
 ): RunConfigInput | undefined {
   const model = modelName.trim();
   const cost = Number.parseFloat(budgetUsd);
@@ -528,6 +536,11 @@ function buildRunConfig(
   if (serviceTier === "fast" && model !== "") {
     config.serviceTier = toProtoServiceTier(serviceTier);
   }
+  // The tier's #772 twin: thinking is a per-model capability, same
+  // only-explicit-enabled + requires-a-model contract.
+  if (thinkingMode === "enabled" && model !== "") {
+    config.thinkingMode = toProtoThinkingMode(thinkingMode);
+  }
 
   return Object.keys(config).length > 0 ? config : undefined;
 }

package/src/session/NewSessionViewer.tsx

@@ -6,7 +6,7 @@ import type { UseGitHubConnectionReturn } from "../github/useGitHubConnection.js
 import type { WorkspaceFileLister } from "../workspace/WorkspaceFileLister.js";
 import type { WorkspaceFileReader } from "../workspace/WorkspaceFileReader.js";
 import type { WorkspaceContentSearcher } from "../workspace/WorkspaceContentSearcher.js";
-import type { InteractionModeOption } from "../composer/index.js";
+import type { ComposerAutoApproveProps, InteractionModeOption } from "../composer/index.js";
 import { SessionComposer } from "../composer/index.js";
 import type { HarnessOption } from "../models/harness.js";
 import type { AccountExecutionDefaults } from "../identity-account/useAccountExecutionDefaults.js";
@@ -299,6 +299,19 @@ export function NewSessionViewer({
   // SessionViewer derives (DD-016), gating the chip and the region together.
   const panelEnabled = panelMode !== "none" && !isGuest;
 
+  // Always-visible auto-approve toggle (#816), present before the first
+  // message is ever typed — the walk-away user arms it here and the create
+  // carries spec.auto_approve_all server-side. Guests never get it (the
+  // operator-consent reasoning as the #302 host default). Memoized per
+  // DD-010 — the composer is memo'd and an inline object would defeat it.
+  const autoApprove = useMemo<ComposerAutoApproveProps | undefined>(
+    () =>
+      isGuest
+        ? undefined
+        : { armed: flow.autoApproveAll, onChange: flow.setAutoApproveAll },
+    [isGuest, flow.autoApproveAll, flow.setAutoApproveAll],
+  );
+
   // Guest agent binding is host configuration, not a picker interaction:
   // the composer's agent machinery (picker, env-collection, personal
   // environments — all org reads a guest token cannot make) stays fully
@@ -452,6 +465,7 @@ export function NewSessionViewer({
           onInteractionModeChange={setInteractionMode}
           showInteractionModePicker={!isGuest}
           showModelSelector={modelSelectorVisible}
+          autoApprove={autoApprove}
           enableAttachments={!isGuest}
           defaultModelId={flow.modelId}
           onModelChange={flow.setModelId}

package/src/session/SessionViewer.tsx

@@ -17,7 +17,7 @@ import {
   WorkspaceSurface,
   type SurfaceVirtualDocument,
 } from "../workspace/WorkspaceSurface.js";
-import type { InteractionModeOption, SessionComposerHandle, SessionComposerSubmitContext } from "../composer/index.js";
+import type { ComposerAutoApproveProps, InteractionModeOption, SessionComposerHandle, SessionComposerSubmitContext } from "../composer/index.js";
 import type { ApplyResourceResult } from "../library/useApplyResource.js";
 import { SessionViewerLayout } from "./SessionViewerLayout.js";
 import { useWorkspaceEditors, isVirtualEntryId } from "../internal/store/index.js";
@@ -51,6 +51,7 @@ import { ArtifactDocument } from "../execution/ArtifactDocument.js";
 import { useSessionRailViews } from "./useSessionRailViews.js";
 import { useSessionPanel, type SessionPanelController } from "./useSessionPanel.js";
 import { SessionPanelChip } from "./SessionPanelChip.js";
+import { TranscriptExportMenu } from "./TranscriptExportMenu.js";
 import { useSessionWriteBacks } from "./useSessionWriteBacks.js";
 import { useWorkspaceReadRefs } from "./useWorkspaceReadRefs.js";
 import {
@@ -293,6 +294,19 @@ export interface SessionViewerProps {
    * unopinionated about Console auth (DD-004).
    */
   readonly headerActions?: ReactNode;
+  /**
+   * Whether the viewer renders its built-in whole-conversation export
+   * control ({@link TranscriptExportMenu}) in the header corner
+   * (stigmer/stigmer#814). Default ON — a deliberate DD-011 divergence,
+   * owner-ratified: wherever a conversation can be viewed its transcript
+   * should be one click away, the control is an additive header button (no
+   * rendering-strategy or DOM-structure change to existing content), and
+   * the export carries only what the current caller can already read.
+   * Hosts that own their export surface (or inert demo scenes) opt out.
+   *
+   * @default true
+   */
+  readonly transcriptExport?: boolean;
   /**
    * Host-injected access management control (e.g. the Console's
    * `ManageAccessButton` with its own permission gating). Rendered inside
@@ -374,6 +388,7 @@ export function SessionViewer({
   panelOpen,
   onPanelOpenChange,
   headerActions,
+  transcriptExport = true,
   accessSlot,
   onApplied,
   threadSlots,
@@ -646,13 +661,23 @@ export function SessionViewer({
   return (
     <SessionViewerLayout
       className={className}
-      // Top-right controls: host actions + the panel chip. The chip is the
-      // panel's always-mounted toggle; while collapsed it carries only the
-      // pending-item count. Execution status is never surfaced as header
-      // chrome — the thread itself communicates run state. A viewer without
-      // a panel (guests — session configuration is not a visitor's business
-      // — or a host's panel="none") has no toggle: it is simply absent.
-      headerActions={headerActions}
+      // Top-right controls: host actions + the built-in transcript export +
+      // the panel chip. The chip is the panel's always-mounted toggle; while
+      // collapsed it carries only the pending-item count. Execution status
+      // is never surfaced as header chrome — the thread itself communicates
+      // run state. A viewer without a panel (guests — session configuration
+      // is not a visitor's business — or a host's panel="none") has no
+      // toggle: it is simply absent.
+      headerActions={
+        transcriptExport ? (
+          <>
+            {headerActions}
+            <TranscriptExportMenu sessionId={sessionId} />
+          </>
+        ) : (
+          headerActions
+        )
+      }
       chip={
         panelEnabled ? (
           <SessionPanelChip
@@ -824,6 +849,20 @@ const ConversationColumn = memo(function ConversationColumn({
     void conv.stop();
   }, [conv.stop]);
 
+  // Always-visible auto-approve toggle (#816), replacing the old armed-only
+  // indicator banner: the walk-away user needs a way ON before any gate
+  // exists, not just a way off after one. Guests never get it (they don't
+  // inherit the host default and this is the operator's consent surface);
+  // observers have no composer at all. Memoized per DD-010 — the composer
+  // is memo'd and an inline object would defeat it.
+  const autoApprove = useMemo<ComposerAutoApproveProps | undefined>(
+    () =>
+      isGuest
+        ? undefined
+        : { armed: flow.autoApproveAll, onChange: flow.setAutoApproveAll },
+    [isGuest, flow.autoApproveAll, flow.setAutoApproveAll],
+  );
+
   // Edit-and-resubmit: stop the in-flight turn, pre-fill the composer with
   // the original text, and remember which execution is being edited. The
   // append-only execution log is never rewritten — submitting while editing
@@ -948,9 +987,6 @@ const ConversationColumn = memo(function ConversationColumn({
           />
         )}
         {!isObserver && sendError && <SendErrorBanner error={sendError} />}
-        {!isObserver && flow.autoApproveAll && (
-          <AutoApproveIndicator onTurnOff={() => flow.setAutoApproveAll(false)} />
-        )}
         {/* Pending file reviews dock here — pinned above the composer so the
             decision the agent is blocked on can never scroll out of view. The
             thread renders only observational rows (badges) and read-only
@@ -992,6 +1028,7 @@ const ConversationColumn = memo(function ConversationColumn({
             onInteractionModeChange={setInteractionMode}
             showInteractionModePicker={!isGuest}
             showModelSelector={modelSelectorVisible}
+            autoApprove={autoApprove}
             enableAttachments={!isGuest}
             workspace={isGuest ? undefined : flow.workspace}
             gitHubConnection={isGuest ? undefined : gitHubConnection}
@@ -1386,36 +1423,6 @@ function SessionStarting() {
   );
 }
 
-/**
- * Low-weight, always-visible indicator shown while the session-scoped
- * auto-approve preference is active. The "Turn off" control reverts the
- * preference in one click — the safety affordance for "Approve & don't ask
- * again". Visible from the first render when the host pre-armed the
- * preference via `StigmerProvider`'s `approvalDefaults` (#302); otherwise
- * nothing about approvals appears until the user opts in at a gate. Either
- * way the user keeps the last word.
- */
-function AutoApproveIndicator({ onTurnOff }: { onTurnOff: () => void }) {
-  return (
-    <div
-      role="status"
-      className="stg:flex stg:items-center stg:gap-2 stg:border-t stg:border-border-muted stg:px-4 stg:py-1.5 stg:text-xs stg:text-muted-foreground"
-    >
-      <ShieldCheckIcon />
-      <span className="stg:min-w-0 stg:flex-1 stg:truncate">
-        Auto-approving tool calls for this session
-      </span>
-      <button
-        type="button"
-        onClick={onTurnOff}
-        className="stg:shrink-0 stg:rounded stg:font-medium stg:text-foreground stg:underline-offset-2 stg:hover:underline stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring"
-      >
-        Turn off
-      </button>
-    </div>
-  );
-}
-
 /**
  * The plan document tab's empty state — reachable only when a streaming plan
  * auto-opened the tab and its turn then ended without publishing (stopped or
@@ -1616,11 +1623,3 @@ function LoaderIcon() {
   );
 }
 
-function ShieldCheckIcon() {
-  return (
-    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="stg:shrink-0 stg:text-success" aria-hidden="true">
-      <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
-      <path d="m9 12 2 2 4-4" />
-    </svg>
-  );
-}

package/src/session/TranscriptExportMenu.tsx

@@ -0,0 +1,78 @@
+"use client";
+
+import { Copy, Download, FileJson, FileText } from "lucide-react";
+import { cn } from "@stigmer/theme";
+import { ActionMenu } from "../action-menu/ActionMenu.js";
+import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import {
+  useExportTranscript,
+  type UseExportTranscriptOptions,
+} from "./useExportTranscript.js";
+
+/** Props for {@link TranscriptExportMenu}. */
+export interface TranscriptExportMenuProps extends UseExportTranscriptOptions {
+  /** The session whose conversation is exported. */
+  readonly sessionId: string | null;
+  /** Additional CSS classes for the trigger button. */
+  readonly className?: string;
+}
+
+/**
+ * The whole-conversation export control (stigmer/stigmer#814): a quiet
+ * icon-button menu offering **Copy transcript**, **Download Markdown**, and
+ * **Download JSON**, powered by {@link useExportTranscript} — the canonical
+ * transcript assembly, thinking and resolved tool outputs included.
+ *
+ * `SessionViewer` renders it in its header corner by default; it is exported
+ * so hosts can mount the same control on any other surface a conversation is
+ * reachable from (a session list's row menu, a custom header).
+ *
+ * The export serializes exactly what the viewer already shows the current
+ * caller — the RPCs behind it enforce the same `can_view` permission — so
+ * offering it to every audience adds convenience, not exposure.
+ */
+export function TranscriptExportMenu({
+  sessionId,
+  includeSuperseded,
+  className,
+}: TranscriptExportMenuProps) {
+  const exporter = useExportTranscript(sessionId, { includeSuperseded });
+
+  return (
+    <ActionMenu>
+      <ActionMenu.Trigger
+        aria-label="Export transcript"
+        className={cn("stg:size-7", className)}
+      >
+        {exporter.isExporting ? (
+          <SpinnerIcon size={14} />
+        ) : (
+          <Download className="stg:size-3.5" aria-hidden="true" />
+        )}
+      </ActionMenu.Trigger>
+      <ActionMenu.Content>
+        <ActionMenu.Item
+          icon={<Copy className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.copyMarkdown()}
+          disabled={exporter.isExporting}
+        >
+          Copy transcript
+        </ActionMenu.Item>
+        <ActionMenu.Item
+          icon={<FileText className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.downloadMarkdown()}
+          disabled={exporter.isExporting}
+        >
+          Download Markdown
+        </ActionMenu.Item>
+        <ActionMenu.Item
+          icon={<FileJson className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.downloadJson()}
+          disabled={exporter.isExporting}
+        >
+          Download JSON
+        </ActionMenu.Item>
+      </ActionMenu.Content>
+    </ActionMenu>
+  );
+}