@stigmer/react 3.12.6 → 3.12.7

package/src/memory/useMemories.ts

@@ -0,0 +1,66 @@
+"use client";
+
+import { create } from "@bufbuild/protobuf";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { ListMemoriesRequestSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import { useStigmer } from "../hooks.js";
+import { useFetch } from "../internal/useFetch.js";
+
+/**
+ * The server-enforced per-subject-per-org record ceiling (all lifecycle
+ * states). Requesting one page of exactly this size fetches EVERY record
+ * the caller can see, by construction — the cap is why this list needs
+ * no pagination UI.
+ */
+const MEMORY_CAP = 100;
+
+/** Return value of {@link useMemories}. */
+export interface UseMemoriesReturn {
+  /** Every memory the caller can view in the org, newest first. */
+  readonly memories: readonly Memory[];
+  /** `true` while the initial fetch is in flight. */
+  readonly isLoading: boolean;
+  /** `true` while a background refetch is in flight. */
+  readonly isRefetching: boolean;
+  /** Error from the last failed request, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Discard cached data and re-fetch the list from the server. */
+  readonly refetch: () => void;
+}
+
+/**
+ * Data hook that fetches the caller's memories in an organization.
+ *
+ * Memory content is subject-only: the server returns exactly the records
+ * that are about the caller (FGA-filtered in cloud; single-user in local
+ * mode), so this list is always "what the platform remembers about ME
+ * here". Ordering is newest first; group by lifecycle state for display
+ * with {@link groupMemoriesByLifecycle}.
+ *
+ * Pass `null` as `org` to skip fetching (stable no-op).
+ *
+ * @example
+ * ```tsx
+ * const { memories, isLoading, refetch } = useMemories(org);
+ * const groups = groupMemoriesByLifecycle(memories);
+ * ```
+ */
+export function useMemories(org: string | null): UseMemoriesReturn {
+  const stigmer = useStigmer();
+
+  const { data: memories, isLoading, isRefetching, error, refetch } = useFetch(
+    org
+      ? () =>
+          stigmer.memory
+            .list(create(ListMemoriesRequestSchema, {
+              org,
+              pageInfo: { num: 1, size: MEMORY_CAP },
+            }))
+            .then((r) => [...r.items])
+      : null,
+    [stigmer, org],
+    [] as Memory[],
+  );
+
+  return { memories, isLoading, isRefetching, error, refetch };
+}

package/src/memory/useRejectMemory.ts

@@ -0,0 +1,65 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useRejectMemory}. */
+export interface UseRejectMemoryReturn {
+  /** Reject a proposed memory by its resource ID. Resolves with the rejected record. */
+  readonly rejectMemory: (id: string) => Promise<Memory>;
+  /** `true` while the reject request is in flight. */
+  readonly isRejecting: boolean;
+  /** Error from the last failed reject, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Behavior hook that wraps `memory.reject()`. A rejected memory is never
+ * recalled; the record is kept as an audit trail until deleted.
+ *
+ * Rejecting an already-rejected memory succeeds and changes nothing.
+ * Rejecting a confirmed memory fails with FAILED_PRECONDITION —
+ * deleting a confirmed memory is how it is revoked.
+ *
+ * Rejection is deliberately one click on every surface, with no
+ * confirmation dialog (DD-005 D4): expensive review teaches users to
+ * ignore the proposal queue.
+ *
+ * @example
+ * ```tsx
+ * const { rejectMemory, isRejecting } = useRejectMemory();
+ *
+ * await rejectMemory(memory.metadata?.id ?? "");
+ * refetch(); // refresh the list after the decision
+ * ```
+ */
+export function useRejectMemory(): UseRejectMemoryReturn {
+  const stigmer = useStigmer();
+  const [isRejecting, setIsRejecting] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const rejectMemory = useCallback(
+    async (id: string): Promise<Memory> => {
+      setIsRejecting(true);
+      setError(null);
+
+      try {
+        return await stigmer.memory.reject(id);
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsRejecting(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { rejectMemory, isRejecting, error, clearError };
+}

package/src/memory/useUpdateMemoryContent.ts

@@ -0,0 +1,67 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { toMemoryUpdateInput } from "@stigmer/sdk";
+import { useStigmer } from "../hooks.js";
+import { toError } from "../internal/toError.js";
+
+/** Return value of {@link useUpdateMemoryContent}. */
+export interface UseUpdateMemoryContentReturn {
+  /** Replace a memory's fact text. Resolves with the updated record. */
+  readonly updateContent: (memory: Memory, content: string) => Promise<Memory>;
+  /** `true` while the update request is in flight. */
+  readonly isUpdating: boolean;
+  /** Error from the last failed update, or `null` when healthy. */
+  readonly error: Error | null;
+  /** Reset `error` to `null`. */
+  readonly clearError: () => void;
+}
+
+/**
+ * Behavior hook that edits a memory's fact text — the one field the
+ * subject owns after capture (DD-004).
+ *
+ * The update RPC replaces the entire spec, so the loaded record is
+ * mapped through the generated `toMemoryUpdateInput` and only `content`
+ * is overridden — the wipe-safe editing rule. Subject and provenance
+ * ride along verbatim (they are update-immutable server-side), and the
+ * consent lifecycle is never touched by updates.
+ *
+ * @example
+ * ```tsx
+ * const { updateContent, isUpdating } = useUpdateMemoryContent();
+ *
+ * await updateContent(memory, editedText);
+ * refetch(); // refresh the list after the edit
+ * ```
+ */
+export function useUpdateMemoryContent(): UseUpdateMemoryContentReturn {
+  const stigmer = useStigmer();
+  const [isUpdating, setIsUpdating] = useState(false);
+  const [error, setError] = useState<Error | null>(null);
+
+  const clearError = useCallback(() => setError(null), []);
+
+  const updateContent = useCallback(
+    async (memory: Memory, content: string): Promise<Memory> => {
+      setIsUpdating(true);
+      setError(null);
+
+      try {
+        return await stigmer.memory.update({
+          ...toMemoryUpdateInput(memory),
+          content,
+        });
+      } catch (err) {
+        setError(toError(err));
+        throw err;
+      } finally {
+        setIsUpdating(false);
+      }
+    },
+    [stigmer],
+  );
+
+  return { updateContent, isUpdating, error, clearError };
+}

package/src/session/NewSessionViewer.tsx

@@ -6,7 +6,7 @@ import type { UseGitHubConnectionReturn } from "../github/useGitHubConnection.js
 import type { WorkspaceFileLister } from "../workspace/WorkspaceFileLister.js";
 import type { WorkspaceFileReader } from "../workspace/WorkspaceFileReader.js";
 import type { WorkspaceContentSearcher } from "../workspace/WorkspaceContentSearcher.js";
-import type { InteractionModeOption } from "../composer/index.js";
+import type { ComposerAutoApproveProps, InteractionModeOption } from "../composer/index.js";
 import { SessionComposer } from "../composer/index.js";
 import type { HarnessOption } from "../models/harness.js";
 import type { AccountExecutionDefaults } from "../identity-account/useAccountExecutionDefaults.js";
@@ -299,6 +299,19 @@ export function NewSessionViewer({
   // SessionViewer derives (DD-016), gating the chip and the region together.
   const panelEnabled = panelMode !== "none" && !isGuest;
 
+  // Always-visible auto-approve toggle (#816), present before the first
+  // message is ever typed — the walk-away user arms it here and the create
+  // carries spec.auto_approve_all server-side. Guests never get it (the
+  // operator-consent reasoning as the #302 host default). Memoized per
+  // DD-010 — the composer is memo'd and an inline object would defeat it.
+  const autoApprove = useMemo<ComposerAutoApproveProps | undefined>(
+    () =>
+      isGuest
+        ? undefined
+        : { armed: flow.autoApproveAll, onChange: flow.setAutoApproveAll },
+    [isGuest, flow.autoApproveAll, flow.setAutoApproveAll],
+  );
+
   // Guest agent binding is host configuration, not a picker interaction:
   // the composer's agent machinery (picker, env-collection, personal
   // environments — all org reads a guest token cannot make) stays fully
@@ -452,6 +465,7 @@ export function NewSessionViewer({
           onInteractionModeChange={setInteractionMode}
           showInteractionModePicker={!isGuest}
           showModelSelector={modelSelectorVisible}
+          autoApprove={autoApprove}
           enableAttachments={!isGuest}
           defaultModelId={flow.modelId}
           onModelChange={flow.setModelId}

package/src/session/SessionViewer.tsx

@@ -17,7 +17,7 @@ import {
   WorkspaceSurface,
   type SurfaceVirtualDocument,
 } from "../workspace/WorkspaceSurface.js";
-import type { InteractionModeOption, SessionComposerHandle, SessionComposerSubmitContext } from "../composer/index.js";
+import type { ComposerAutoApproveProps, InteractionModeOption, SessionComposerHandle, SessionComposerSubmitContext } from "../composer/index.js";
 import type { ApplyResourceResult } from "../library/useApplyResource.js";
 import { SessionViewerLayout } from "./SessionViewerLayout.js";
 import { useWorkspaceEditors, isVirtualEntryId } from "../internal/store/index.js";
@@ -51,6 +51,7 @@ import { ArtifactDocument } from "../execution/ArtifactDocument.js";
 import { useSessionRailViews } from "./useSessionRailViews.js";
 import { useSessionPanel, type SessionPanelController } from "./useSessionPanel.js";
 import { SessionPanelChip } from "./SessionPanelChip.js";
+import { TranscriptExportMenu } from "./TranscriptExportMenu.js";
 import { useSessionWriteBacks } from "./useSessionWriteBacks.js";
 import { useWorkspaceReadRefs } from "./useWorkspaceReadRefs.js";
 import {
@@ -293,6 +294,19 @@ export interface SessionViewerProps {
    * unopinionated about Console auth (DD-004).
    */
   readonly headerActions?: ReactNode;
+  /**
+   * Whether the viewer renders its built-in whole-conversation export
+   * control ({@link TranscriptExportMenu}) in the header corner
+   * (stigmer/stigmer#814). Default ON — a deliberate DD-011 divergence,
+   * owner-ratified: wherever a conversation can be viewed its transcript
+   * should be one click away, the control is an additive header button (no
+   * rendering-strategy or DOM-structure change to existing content), and
+   * the export carries only what the current caller can already read.
+   * Hosts that own their export surface (or inert demo scenes) opt out.
+   *
+   * @default true
+   */
+  readonly transcriptExport?: boolean;
   /**
    * Host-injected access management control (e.g. the Console's
    * `ManageAccessButton` with its own permission gating). Rendered inside
@@ -374,6 +388,7 @@ export function SessionViewer({
   panelOpen,
   onPanelOpenChange,
   headerActions,
+  transcriptExport = true,
   accessSlot,
   onApplied,
   threadSlots,
@@ -646,13 +661,23 @@ export function SessionViewer({
   return (
     <SessionViewerLayout
       className={className}
-      // Top-right controls: host actions + the panel chip. The chip is the
-      // panel's always-mounted toggle; while collapsed it carries only the
-      // pending-item count. Execution status is never surfaced as header
-      // chrome — the thread itself communicates run state. A viewer without
-      // a panel (guests — session configuration is not a visitor's business
-      // — or a host's panel="none") has no toggle: it is simply absent.
-      headerActions={headerActions}
+      // Top-right controls: host actions + the built-in transcript export +
+      // the panel chip. The chip is the panel's always-mounted toggle; while
+      // collapsed it carries only the pending-item count. Execution status
+      // is never surfaced as header chrome — the thread itself communicates
+      // run state. A viewer without a panel (guests — session configuration
+      // is not a visitor's business — or a host's panel="none") has no
+      // toggle: it is simply absent.
+      headerActions={
+        transcriptExport ? (
+          <>
+            {headerActions}
+            <TranscriptExportMenu sessionId={sessionId} />
+          </>
+        ) : (
+          headerActions
+        )
+      }
       chip={
         panelEnabled ? (
           <SessionPanelChip
@@ -824,6 +849,20 @@ const ConversationColumn = memo(function ConversationColumn({
     void conv.stop();
   }, [conv.stop]);
 
+  // Always-visible auto-approve toggle (#816), replacing the old armed-only
+  // indicator banner: the walk-away user needs a way ON before any gate
+  // exists, not just a way off after one. Guests never get it (they don't
+  // inherit the host default and this is the operator's consent surface);
+  // observers have no composer at all. Memoized per DD-010 — the composer
+  // is memo'd and an inline object would defeat it.
+  const autoApprove = useMemo<ComposerAutoApproveProps | undefined>(
+    () =>
+      isGuest
+        ? undefined
+        : { armed: flow.autoApproveAll, onChange: flow.setAutoApproveAll },
+    [isGuest, flow.autoApproveAll, flow.setAutoApproveAll],
+  );
+
   // Edit-and-resubmit: stop the in-flight turn, pre-fill the composer with
   // the original text, and remember which execution is being edited. The
   // append-only execution log is never rewritten — submitting while editing
@@ -948,9 +987,6 @@ const ConversationColumn = memo(function ConversationColumn({
           />
         )}
         {!isObserver && sendError && <SendErrorBanner error={sendError} />}
-        {!isObserver && flow.autoApproveAll && (
-          <AutoApproveIndicator onTurnOff={() => flow.setAutoApproveAll(false)} />
-        )}
         {/* Pending file reviews dock here — pinned above the composer so the
             decision the agent is blocked on can never scroll out of view. The
             thread renders only observational rows (badges) and read-only
@@ -992,6 +1028,7 @@ const ConversationColumn = memo(function ConversationColumn({
             onInteractionModeChange={setInteractionMode}
             showInteractionModePicker={!isGuest}
             showModelSelector={modelSelectorVisible}
+            autoApprove={autoApprove}
             enableAttachments={!isGuest}
             workspace={isGuest ? undefined : flow.workspace}
             gitHubConnection={isGuest ? undefined : gitHubConnection}
@@ -1386,36 +1423,6 @@ function SessionStarting() {
   );
 }
 
-/**
- * Low-weight, always-visible indicator shown while the session-scoped
- * auto-approve preference is active. The "Turn off" control reverts the
- * preference in one click — the safety affordance for "Approve & don't ask
- * again". Visible from the first render when the host pre-armed the
- * preference via `StigmerProvider`'s `approvalDefaults` (#302); otherwise
- * nothing about approvals appears until the user opts in at a gate. Either
- * way the user keeps the last word.
- */
-function AutoApproveIndicator({ onTurnOff }: { onTurnOff: () => void }) {
-  return (
-    <div
-      role="status"
-      className="stg:flex stg:items-center stg:gap-2 stg:border-t stg:border-border-muted stg:px-4 stg:py-1.5 stg:text-xs stg:text-muted-foreground"
-    >
-      <ShieldCheckIcon />
-      <span className="stg:min-w-0 stg:flex-1 stg:truncate">
-        Auto-approving tool calls for this session
-      </span>
-      <button
-        type="button"
-        onClick={onTurnOff}
-        className="stg:shrink-0 stg:rounded stg:font-medium stg:text-foreground stg:underline-offset-2 stg:hover:underline stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring"
-      >
-        Turn off
-      </button>
-    </div>
-  );
-}
-
 /**
  * The plan document tab's empty state — reachable only when a streaming plan
  * auto-opened the tab and its turn then ended without publishing (stopped or
@@ -1616,11 +1623,3 @@ function LoaderIcon() {
   );
 }
 
-function ShieldCheckIcon() {
-  return (
-    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="stg:shrink-0 stg:text-success" aria-hidden="true">
-      <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
-      <path d="m9 12 2 2 4-4" />
-    </svg>
-  );
-}

package/src/session/TranscriptExportMenu.tsx

@@ -0,0 +1,78 @@
+"use client";
+
+import { Copy, Download, FileJson, FileText } from "lucide-react";
+import { cn } from "@stigmer/theme";
+import { ActionMenu } from "../action-menu/ActionMenu.js";
+import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import {
+  useExportTranscript,
+  type UseExportTranscriptOptions,
+} from "./useExportTranscript.js";
+
+/** Props for {@link TranscriptExportMenu}. */
+export interface TranscriptExportMenuProps extends UseExportTranscriptOptions {
+  /** The session whose conversation is exported. */
+  readonly sessionId: string | null;
+  /** Additional CSS classes for the trigger button. */
+  readonly className?: string;
+}
+
+/**
+ * The whole-conversation export control (stigmer/stigmer#814): a quiet
+ * icon-button menu offering **Copy transcript**, **Download Markdown**, and
+ * **Download JSON**, powered by {@link useExportTranscript} — the canonical
+ * transcript assembly, thinking and resolved tool outputs included.
+ *
+ * `SessionViewer` renders it in its header corner by default; it is exported
+ * so hosts can mount the same control on any other surface a conversation is
+ * reachable from (a session list's row menu, a custom header).
+ *
+ * The export serializes exactly what the viewer already shows the current
+ * caller — the RPCs behind it enforce the same `can_view` permission — so
+ * offering it to every audience adds convenience, not exposure.
+ */
+export function TranscriptExportMenu({
+  sessionId,
+  includeSuperseded,
+  className,
+}: TranscriptExportMenuProps) {
+  const exporter = useExportTranscript(sessionId, { includeSuperseded });
+
+  return (
+    <ActionMenu>
+      <ActionMenu.Trigger
+        aria-label="Export transcript"
+        className={cn("stg:size-7", className)}
+      >
+        {exporter.isExporting ? (
+          <SpinnerIcon size={14} />
+        ) : (
+          <Download className="stg:size-3.5" aria-hidden="true" />
+        )}
+      </ActionMenu.Trigger>
+      <ActionMenu.Content>
+        <ActionMenu.Item
+          icon={<Copy className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.copyMarkdown()}
+          disabled={exporter.isExporting}
+        >
+          Copy transcript
+        </ActionMenu.Item>
+        <ActionMenu.Item
+          icon={<FileText className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.downloadMarkdown()}
+          disabled={exporter.isExporting}
+        >
+          Download Markdown
+        </ActionMenu.Item>
+        <ActionMenu.Item
+          icon={<FileJson className="stg:size-3.5" aria-hidden="true" />}
+          onSelect={() => void exporter.downloadJson()}
+          disabled={exporter.isExporting}
+        >
+          Download JSON
+        </ActionMenu.Item>
+      </ActionMenu.Content>
+    </ActionMenu>
+  );
+}

package/src/session/__tests__/SessionViewer-autoApproveToggle.test.tsx

@@ -0,0 +1,178 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { render, screen, cleanup } from "@testing-library/react";
+
+// ---------------------------------------------------------------------------
+// Wiring-contract tests for the always-visible auto-approve toggle
+// (stigmer/stigmer#816): SessionViewer hands the composer the flow's
+// auto-approve state for every audience that may submit approvals
+// (integrator AND endUser — the walk-away persona is an embedder's end
+// user), never for guests, and the old armed-only indicator banner is gone
+// (the toggle IS the indicator now).
+// ---------------------------------------------------------------------------
+
+type CapturedProps = Record<string, unknown>;
+
+const composerProps: CapturedProps[] = [];
+vi.mock("../../composer", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../composer")>();
+  return {
+    ...actual,
+    SessionComposer: (props: CapturedProps) => {
+      composerProps.push(props);
+      return <div data-testid="composer-probe" />;
+    },
+  };
+});
+
+vi.mock("../../execution/MessageThread", () => ({
+  MessageThread: () => <div data-testid="thread-probe" />,
+}));
+
+vi.mock("../../execution/FileReviewDock", () => ({
+  FileReviewDock: () => <div data-testid="file-review-dock-probe" />,
+}));
+
+vi.mock("../facets/SetupTab", () => ({
+  SetupTab: () => <div data-testid="setup-probe" />,
+}));
+
+const stubWorkspace = {
+  entries: [],
+  hasEntries: false,
+  toInput: vi.fn().mockReturnValue([]),
+  addGitRepo: vi.fn(),
+  addLocalPath: vi.fn(),
+  removeEntry: vi.fn(),
+  clear: vi.fn(),
+};
+
+const stubConv = {
+  session: { spec: {} } as Record<string, unknown>,
+  isLoading: false,
+  loadError: null,
+  completedExecutions: [],
+  activeStreamExecution: null,
+  activePhase: null,
+  isStreaming: false,
+  isConnecting: false,
+  sendFollowUp: vi.fn(),
+  canSendFollowUp: true,
+  isSending: false,
+  sendError: null,
+  clearSendError: vi.fn(),
+  pendingUserMessage: null,
+  workspaceEntries: [],
+  mcpServerUsages: [],
+  skillRefs: [],
+  pendingApprovals: [],
+  submitApproval: vi.fn(),
+  submittingApprovalIds: new Set<string>(),
+  fileChangeSets: [],
+  submitFileDecision: vi.fn(),
+  submittingFileDecisionKeys: new Set<string>(),
+  fileDecisionErrors: new Map<string, Error>(),
+  streamError: null,
+  reconnectStream: vi.fn(),
+  approvalError: null,
+  retryLastSend: vi.fn(),
+};
+
+const setAutoApproveAll = vi.fn();
+const stubSessionPageFlow = {
+  conv: stubConv,
+  harness: "native" as const,
+  executionTarget: undefined,
+  model: [undefined, vi.fn()] as const,
+  interactionMode: ["agent" as const, vi.fn()] as const,
+  agentRef: { org: "acme", slug: "support-bot" },
+  setAgentRef: vi.fn(),
+  resolution: null,
+  setResolution: vi.fn(),
+  isDefaultAgent: false,
+  mcpServerUsages: [],
+  setMcpServerUsages: vi.fn(),
+  skillRefs: [],
+  setSkillRefs: vi.fn(),
+  workspace: stubWorkspace,
+  sessionVariables: { entries: [], isEmpty: true, clear: vi.fn() },
+  autoApproveAll: false,
+  setAutoApproveAll,
+  submitApproval: vi.fn(),
+  handleSubmit: vi.fn(),
+  submitError: null as Error | null,
+  displayExecution: null,
+  allExecutions: [],
+  sandboxWorkspaceRoot: undefined,
+};
+vi.mock("../useSessionPageFlow", () => ({
+  useSessionPageFlow: () => stubSessionPageFlow,
+}));
+
+vi.mock("../../hooks", () => ({
+  useStigmer: () => ({
+    agentExecution: {
+      uploadAttachment: vi.fn(),
+      getArtifactContent: vi.fn(),
+    },
+  }),
+}));
+
+import { SessionViewer } from "../SessionViewer";
+
+function lastComposerProps(): CapturedProps {
+  expect(composerProps.length).toBeGreaterThan(0);
+  return composerProps.at(-1)!;
+}
+
+beforeEach(() => {
+  composerProps.length = 0;
+  stubConv.session = { spec: {} };
+  stubSessionPageFlow.autoApproveAll = false;
+});
+
+afterEach(() => {
+  cleanup();
+  vi.clearAllMocks();
+});
+
+describe("SessionViewer — auto-approve toggle wiring (#816)", () => {
+  it("hands the composer the flow's auto-approve state (integrator)", () => {
+    render(<SessionViewer sessionId="ses_1" org="acme" />);
+
+    const autoApprove = lastComposerProps().autoApprove as
+      | { armed: boolean; onChange: (v: boolean) => void }
+      | undefined;
+    expect(autoApprove).toBeDefined();
+    expect(autoApprove!.armed).toBe(false);
+    expect(autoApprove!.onChange).toBe(setAutoApproveAll);
+  });
+
+  it("mirrors an armed flow state into the composer", () => {
+    stubSessionPageFlow.autoApproveAll = true;
+    render(<SessionViewer sessionId="ses_1" org="acme" />);
+
+    const autoApprove = lastComposerProps().autoApprove as { armed: boolean };
+    expect(autoApprove.armed).toBe(true);
+  });
+
+  it("endUser gets the toggle — the walk-away persona is an end user", () => {
+    render(<SessionViewer sessionId="ses_1" org="acme" audience="endUser" />);
+
+    expect(lastComposerProps().autoApprove).toBeDefined();
+  });
+
+  it("guests never get the toggle", () => {
+    render(<SessionViewer sessionId="ses_1" org="acme" audience="guest" />);
+
+    expect(lastComposerProps().autoApprove).toBeUndefined();
+  });
+
+  it("the armed-only indicator banner is gone — the toggle is the indicator", () => {
+    stubSessionPageFlow.autoApproveAll = true;
+    render(<SessionViewer sessionId="ses_1" org="acme" />);
+
+    expect(
+      screen.queryByText("Auto-approving tool calls for this session"),
+    ).toBeNull();
+  });
+});