@stigmer/react 3.12.6 → 3.12.8

package/src/session/useSessionPageFlow.ts

@@ -20,7 +20,9 @@ import { useAgentRefFromSession } from "./useAgentRefFromSession.js";
 import { usePersistedModel, type UsePersistedModelReturn } from "./usePersistedModel.js";
 import { toSessionUpdateInput } from "@stigmer/sdk";
 import type { SessionAudience } from "./audience.js";
+import { isChannelOriginSession } from "./channelOrigin.js";
 import { assertValidRunConfig, type SessionRunConfig } from "./run-config.js";
+import type { AccountExecutionDefaults } from "../identity-account/useAccountExecutionDefaults.js";
 
 /**
  * Well-known Daytona sandbox workspace root. Used as the SDK safety-net
@@ -68,6 +70,18 @@ export interface UseSessionPageFlowOptions {
    * config). See {@link SessionRunConfig}.
    */
   readonly runConfig?: SessionRunConfig;
+  /**
+   * The user's account-level execution defaults, typically from
+   * `useAccountExecutionDefaults()`. On the session page only
+   * `autoApprove` applies — it seeds the session-scoped auto-approve
+   * state so a user whose `default_auto_approve` preference is ON gets
+   * armed follow-ups on every session, not just newly created ones. An
+   * explicit in-session flip always wins for this session; the seed may
+   * arrive after mount (whoAmI resolves async) and still applies, being
+   * part of the derivation rather than an initializer. Ignored for the
+   * `"guest"` audience (guests inherit no identity-derived preference).
+   */
+  readonly accountDefaults?: AccountExecutionDefaults;
 }
 
 /** Return value of {@link useSessionPageFlow}. */
@@ -140,20 +154,38 @@ export interface UseSessionPageFlowReturn {
   readonly sessionVariables: UseSessionVariablesReturn;
 
   /**
-   * Session-scoped "auto-approve tool calls" preference.
+   * Session-scoped "auto-approve tool calls" state (stigmer/stigmer#816).
+   *
+   * `false` by default. `true` when any of its sources arms it — the user's
+   * explicit choice always winning:
    *
-   * `false` by default; a host can pre-arm it app-wide via
-   * `StigmerProvider`'s `approvalDefaults` (#302, guests excluded). Flipped
-   * to `true` when the user chooses "Approve & don't ask again" at an
-   * approval gate (see {@link submitApproval}), and carried into every
-   * subsequent follow-up via {@link handleSubmit}. Held in memory only —
-   * reset on reload / new session back to the host default, never persisted
-   * server-side.
+   * 1. the user's Config facet switch ({@link setAutoApproveAll});
+   * 2. "Approve & don't ask again" at an approval gate (see
+   *    {@link submitApproval});
+   * 3. the account's `default_auto_approve` preference
+   *    (`UseSessionPageFlowOptions.accountDefaults`, guests excluded);
+   * 4. the host's app-wide `StigmerProvider` `approvalDefaults` (#302,
+   *    guests excluded);
+   * 5. the active in-flight execution having been created with
+   *    `spec.auto_approve_all` (e.g. armed on the new-session surface), so
+   *    the state survives the launcher → session-page handoff.
+   *
+   * While `true`, follow-ups carry `auto_approve_all` ({@link handleSubmit})
+   * and gates appearing in the in-flight run are auto-released (never for
+   * guest/observer/channel-origin surfaces). The explicit per-session flip is
+   * held in memory only — reset on reload back to the seeds; the account
+   * preference is the one persisted default, declared by the user in
+   * Account Preferences.
    */
   readonly autoApproveAll: boolean;
   /**
-   * Toggle the session-scoped auto-approve preference. The reversible "Turn off"
-   * control in the UI calls this with `false`.
+   * Set the user's explicit session-scoped auto-approve choice. Wired to the
+   * Config facet's switch; an explicit `false` wins over both seeds and over
+   * an armed in-flight run for everything the client controls (follow-up
+   * carry, gate auto-release) — an already-armed run's server-side bypass
+   * cannot be revoked mid-run, exactly as with today's gate-time "Approve &
+   * don't ask again". Never written back to the account preference: the
+   * flip is scoped to THIS conversation.
    */
   readonly setAutoApproveAll: (value: boolean) => void;
 
@@ -322,17 +354,40 @@ export function useSessionPageFlow(
   const [skillRefs, setSkillRefs] = useState<ResourceRef[]>([]);
   const initialSyncDone = useRef(false);
 
-  // Session-scoped auto-approve. Armed either at the approval gate ("Approve &
-  // don't ask again") or from the host's provider-level approvalDefaults
-  // (#302) — an app-level trust judgment, so it seeds the INITIAL state only;
-  // the user's in-session "Turn off" always wins from then on. Guests never
-  // inherit the host default (a share-link visitor is not the operator the
-  // host's trust judgment covers). Lives only in memory for the life of this
-  // page — reset on reload re-applies the host default, never a user choice.
+  // Session-scoped auto-approve (#816). Derived like interactionMode above —
+  // the user's explicit in-session decision wins, otherwise the truth is
+  // computed from its sources — never an effect-synced copy:
+  //
+  //   effective = userChoice ?? (accountSeed || hostSeed || runArmed)
+  //
+  // - `userChoice`: the Config facet's switch, or the gate-time "Approve &
+  //   don't ask again" (which has always escalated the session preference).
+  // - `accountSeed`: the account's default_auto_approve preference — the
+  //   user's own persisted walk-away default. Resolves async with whoAmI;
+  //   being part of the derivation (not an initializer), a late arrival
+  //   still applies unless the user has already flipped this session.
+  // - `hostSeed`: the host's provider-level approvalDefaults (#302) — an
+  //   app-level trust judgment. Guests inherit neither seed (a share-link
+  //   visitor is not the operator either trust judgment covers).
+  // - `runArmed`: the ACTIVE execution was created with
+  //   spec.auto_approve_all, so the switch reflects an armed in-flight run —
+  //   this is what carries the state across the new-session → session-page
+  //   handoff. Deliberately derived from the active execution ONLY, never
+  //   from history: deriving from past executions would silently survive a
+  //   reload independent of the seeds above.
+  //
+  // The explicit choice lives only in memory for the life of this page —
+  // reset on reload re-applies the seeds (the account preference now being
+  // the persisted one the user actually declared), never a per-session flip.
   const approvalDefaults = useApprovalDefaults();
-  const [autoApproveAll, setAutoApproveAll] = useState(
-    () => !isGuest && (approvalDefaults?.autoApproveAll ?? false),
-  );
+  const [autoApproveChoice, setAutoApproveChoice] = useState<boolean | null>(null);
+  const accountSeed = !isGuest && (options.accountDefaults?.autoApprove ?? false);
+  const hostSeed = !isGuest && (approvalDefaults?.autoApproveAll ?? false);
+  const runArmed = conv.activeStreamExecution?.spec?.autoApproveAll === true;
+  const autoApproveAll = autoApproveChoice ?? (accountSeed || hostSeed || runArmed);
+  const setAutoApproveAll = useCallback((value: boolean) => {
+    setAutoApproveChoice(value);
+  }, []);
 
   const submitApproval = useCallback<UseSessionConversationReturn["submitApproval"]>(
     async (toolCallId, action, comment) => {
@@ -341,13 +396,45 @@ export function useSessionPageFlow(
       // plane separately resolves the current execution's remaining gates and
       // the runner skips the gate for the rest of that run.
       if (action === ApprovalAction.APPROVE_ALL) {
-        setAutoApproveAll(true);
+        setAutoApproveChoice(true);
       }
       await conv.submitApproval(toolCallId, action, comment);
     },
     [conv.submitApproval],
   );
 
+  // Armed responder (#816, the walk-away scenario): while auto-approve is ON,
+  // answer each approval gate as it appears in the in-flight run. This must be
+  // a standing responder, not a flip-time one-shot: a gate-time APPROVE_ALL
+  // grants a lease scoped to ONE tool class (see APPROVAL_ACTION_APPROVE_ALL
+  // in agentexecution enum.proto), so a later gate of a different class would
+  // still park the run — the responder covers each class as it surfaces, and
+  // every released call keeps an honest audit decision.
+  //
+  // Read-only surfaces must never auto-submit approvals on a viewer's behalf:
+  // the predicate mirrors SessionViewer's read-only derivation (guest audience,
+  // observer audience, channel-origin session) exactly.
+  const canRespondToGates =
+    !isGuest &&
+    options.audience !== "observer" &&
+    !isChannelOriginSession(conv.session);
+  const respondedToolCallIds = useRef<Set<string>>(new Set());
+  useEffect(() => {
+    if (!autoApproveAll || !canRespondToGates) return;
+    for (const approval of conv.pendingApprovals) {
+      const toolCallId = approval.toolCallId;
+      // Marked before the submit resolves so a re-render mid-flight cannot
+      // double-submit. A failed submission is deliberately NOT retried — the
+      // approval card stays for a manual decision instead of a retry storm.
+      if (!toolCallId || respondedToolCallIds.current.has(toolCallId)) continue;
+      respondedToolCallIds.current.add(toolCallId);
+      void conv.submitApproval(toolCallId, ApprovalAction.APPROVE_ALL).catch(() => {
+        // Swallowed by design (see above); the card's own error surface
+        // reports the failure where the user can act on it.
+      });
+    }
+  }, [autoApproveAll, canRespondToGates, conv.pendingApprovals, conv.submitApproval]);
+
   // -------------------------------------------------------------------------
   // Agent — derive from session, allow mid-session changes
   // -------------------------------------------------------------------------

package/src/settings/MemorySection.tsx

@@ -0,0 +1,45 @@
+"use client";
+
+import { useId } from "react";
+import { MemoryListPanel } from "../memory/MemoryListPanel.js";
+import { useActiveOrgSlug } from "../organization/OrgProvider.js";
+
+/**
+ * Settings section listing everything the platform remembers about the
+ * caller in the active organization.
+ *
+ * The helper copy carries the DD-006 D6 transparency statement: a
+ * confirmed memory is injected into the caller's future sessions and
+ * appears in those executions' records. Memory content everywhere else
+ * is subject-only — this page shows the caller their own records and
+ * nobody else's.
+ */
+export function MemorySection() {
+  const headingId = useId();
+  const org = useActiveOrgSlug();
+
+  return (
+    <section aria-labelledby={headingId}>
+      <h2
+        id={headingId}
+        className="stg:text-foreground stg:mb-1 stg:text-sm stg:font-semibold"
+      >
+        Memory
+      </h2>
+      <p className="stg:text-muted-foreground stg:mb-6 stg:text-xs">
+        Facts agents proposed to remember about you in this organization.
+        Confirmed memories are shared with agents in your future sessions
+        and appear in those executions&apos; records. Only you can see
+        them here, and you can edit or delete any of them at any time.
+      </p>
+
+      {!org ? (
+        <p className="stg:text-muted-foreground stg:py-4 stg:text-center stg:text-xs">
+          Select an organization to view its memories.
+        </p>
+      ) : (
+        <MemoryListPanel org={org} />
+      )}
+    </section>
+  );
+}

package/src/settings/index.ts

@@ -12,6 +12,7 @@ export { MembersSection } from "./MembersSection.js";
 export { OrgProfileSection } from "./OrgProfileSection.js";
 export { OrgPreferencesSection } from "./OrgPreferencesSection.js";
 export { AccountPreferencesSection } from "./AccountPreferencesSection.js";
+export { MemorySection } from "./MemorySection.js";
 export { EnvironmentsSection } from "./EnvironmentsSection.js";
 export { InvitationsSection } from "./InvitationsSection.js";
 export { IdentityProvidersSection } from "./IdentityProvidersSection.js";

package/src/settings/settings-nav.ts

@@ -4,6 +4,7 @@ import {
   AppWindow,
   BarChart3,
   Box,
+  Brain,
   Building2,
   CreditCard,
   KeyRound,
@@ -108,6 +109,7 @@ export const SETTINGS_NAV_GROUPS: readonly SettingsNavGroup[] = [
         label: "Preferences",
         icon: UserCog,
       },
+      { href: "/settings/memory", label: "Memory", icon: Brain },
     ],
   },
 ];

package/src/switch/Switch.tsx

@@ -17,6 +17,8 @@ export interface SwitchProps {
   readonly "aria-label"?: string;
   /** ID of the element that labels this switch. */
   readonly "aria-labelledby"?: string;
+  /** ID of the element that describes this switch (helper copy). */
+  readonly "aria-describedby"?: string;
   /** Element ID, for association with an external `<label htmlFor>`. */
   readonly id?: string;
   /** Additional CSS classes for the root button. */
@@ -54,6 +56,7 @@ export function Switch({
   disabled,
   "aria-label": ariaLabel,
   "aria-labelledby": ariaLabelledby,
+  "aria-describedby": ariaDescribedby,
   id,
   className,
 }: SwitchProps) {
@@ -65,6 +68,7 @@ export function Switch({
       aria-checked={checked}
       aria-label={ariaLabel}
       aria-labelledby={ariaLabelledby}
+      aria-describedby={ariaDescribedby}
       disabled={disabled}
       onClick={() => onCheckedChange(!checked)}
       className={cn(

package/src/usage/useExportCSV.ts

@@ -2,6 +2,7 @@
 
 import { useCallback, useState } from "react";
 import type { GetOrgUsageReportOutput } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/io_pb";
+import { downloadTextFile } from "../internal/download.js";
 
 /** Export format for the CSV download. */
 export type ExportFormat = "daily_summary" | "model_breakdown";
@@ -41,7 +42,7 @@ export function useExportCSV(
           ? buildDailySummaryCSV(report, orgId)
           : buildModelBreakdownCSV(report, orgId);
 
-        downloadCSV(csv, filename);
+        downloadTextFile(csv, filename, "text/csv");
       } finally {
         setIsExporting(false);
       }
@@ -100,16 +101,3 @@ function escapeCsvField(value: string): string {
   }
   return value;
 }
-
-function downloadCSV(csv: string, filename: string): void {
-  const blob = new Blob([csv], { type: "text/csv;charset=utf-8;" });
-  const url = URL.createObjectURL(blob);
-  const link = document.createElement("a");
-  link.href = url;
-  link.download = filename;
-  link.style.display = "none";
-  document.body.appendChild(link);
-  link.click();
-  document.body.removeChild(link);
-  URL.revokeObjectURL(url);
-}

package/src/workflow/__tests__/useWorkflowCanvas.dirty.test.tsx

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import { renderHook, act } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { ReactFlowProvider } from "@xyflow/react";
-import type { Node } from "@xyflow/react";
+import type { Node, OnNodeDrag } from "@xyflow/react";
 import { useWorkflowCanvas } from "../useWorkflowCanvas";
 
 // Regression tests for oss#609: isDirty was a model-reference comparison
@@ -54,7 +54,12 @@ function renderCanvas() {
 
 type CanvasResult = ReturnType<typeof renderCanvas>["result"];
 
-const DRAG_EVENT = {} as React.MouseEvent;
+// The drag fixture derives its type from the handler itself, so it tracks
+// whatever event type the installed @xyflow/react declares (the pinned
+// 12.10.2 takes the React synthetic event; newer majors take the native
+// event) — a dependency bump can never strand this cast again (#821's
+// hand-written native-MouseEvent cast did not compile under npm ci).
+const DRAG_EVENT = {} as Parameters<OnNodeDrag>[0];
 
 /** Drives one full drag gesture the way React Flow produces it. */
 function drag(result: CanvasResult, id: string, to: { x: number; y: number }) {

package/src/workflow/__tests__/useWorkflowCanvas.drag.test.tsx

@@ -2,7 +2,7 @@ import { describe, it, expect } from "vitest";
 import { renderHook, act } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { ReactFlowProvider } from "@xyflow/react";
-import type { Node } from "@xyflow/react";
+import type { Node, OnNodeDrag } from "@xyflow/react";
 import { useWorkflowCanvas } from "../useWorkflowCanvas";
 
 // Regression tests for oss#602: node drags updated only React Flow's copy
@@ -51,7 +51,12 @@ function renderCanvas() {
 
 type CanvasResult = ReturnType<typeof renderCanvas>["result"];
 
-const DRAG_EVENT = {} as React.MouseEvent;
+// The drag fixture derives its type from the handler itself, so it tracks
+// whatever event type the installed @xyflow/react declares (the pinned
+// 12.10.2 takes the React synthetic event; newer majors take the native
+// event) — a dependency bump can never strand this cast again (#821's
+// hand-written native-MouseEvent cast did not compile under npm ci).
+const DRAG_EVENT = {} as Parameters<OnNodeDrag>[0];
 
 function canvasPosition(result: CanvasResult, id: string): { x: number; y: number } {
   const node = result.current.nodes.find((n) => n.id === id);

package/src/workspace/WorkspaceSurface.tsx

@@ -695,8 +695,16 @@ function EditorArea({
     <div className="stg:flex stg:h-full stg:min-h-0 stg:flex-col">
       {/* Collapse control + tab strip. The far right is kept clear (pr-24):
           the session viewer floats its top-right controls (host
-          `headerActions` and the panel chip) over this region. */}
-      <div className="stg:flex stg:shrink-0 stg:items-stretch stg:border-b stg:border-border stg:pr-24">
+          `headerActions` and the panel chip) over this region. Fixed to the
+          shared HEADER_ROW_HEIGHT so this row's bottom border stays flush
+          with the sidebar facet header's — and so an empty tab strip (no
+          open editors) cannot collapse the row. */}
+      <div
+        className={cn(
+          HEADER_ROW_HEIGHT,
+          "stg:flex stg:shrink-0 stg:items-stretch stg:border-b stg:border-border stg:pr-24",
+        )}
+      >
         <Tooltip>
           <TooltipTrigger
             render={
@@ -843,9 +851,24 @@ function Breadcrumbs({
 // Shared sidebar chrome
 // ---------------------------------------------------------------------------
 
+/**
+ * One fixed height for every header row across the surface — the sidebar
+ * facet header AND the editor area's tab-strip row — so their bottom borders
+ * form a single continuous line across the panel. Fixed rather than
+ * padding-derived: the two rows have different content (micro-caps title vs
+ * text-xs tabs, sometimes no tabs at all), so padding math can never keep
+ * them aligned.
+ */
+const HEADER_ROW_HEIGHT = "stg:h-8";
+
 function SidebarHeader({ title }: { readonly title: string }) {
   return (
-    <div className="stg:shrink-0 stg:border-b stg:border-border stg:px-3 stg:py-2 stg:text-[0.65rem] stg:font-semibold stg:uppercase stg:tracking-wide stg:text-muted-foreground">
+    <div
+      className={cn(
+        HEADER_ROW_HEIGHT,
+        "stg:flex stg:shrink-0 stg:items-center stg:border-b stg:border-border stg:px-3 stg:text-[0.65rem] stg:font-semibold stg:uppercase stg:tracking-wide stg:text-muted-foreground",
+      )}
+    >
       {title}
     </div>
   );