@stigmer/react 3.12.7 → 3.12.8

package/src/identity-account/__tests__/useAccountExecutionDefaults.test.tsx

@@ -12,7 +12,7 @@ import { DeploymentModeContext } from "../../deployment-mode";
 import { useAccountExecutionDefaults } from "../useAccountExecutionDefaults";
 
 function accountWithPreferences(
-  preferences: Record<string, string>,
+  preferences: Record<string, string | boolean>,
 ): IdentityAccount {
   return create(IdentityAccountSchema, {
     metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
@@ -102,6 +102,39 @@ describe("useAccountExecutionDefaults", () => {
     );
   });
 
+  it("a declared auto-approve default alone counts as a declared default", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({ defaultAutoApprove: true }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() =>
+      expect(result.current).toEqual({
+        harness: undefined,
+        nativeModel: undefined,
+        cursorModel: undefined,
+        autoApprove: true,
+      }),
+    );
+  });
+
+  it("an unset auto-approve bool is no preference, not an explicit false", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({
+        defaultHarness: "native",
+        defaultAutoApprove: false,
+      }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() => expect(result.current?.harness).toBe("native"));
+    expect(result.current?.autoApprove).toBeUndefined();
+  });
+
   it("returns undefined on a whoAmI failure — degrades to platform defaults", async () => {
     const whoAmI = vi.fn(async () => {
       throw new Error("boom");

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -16,6 +16,13 @@ export interface AccountExecutionDefaults {
   readonly nativeModel?: string;
   /** Preferred model for cursor-harness sessions, when declared. */
   readonly cursorModel?: string;
+  /**
+   * Start sessions with "auto-approve tool calls" armed
+   * (`default_auto_approve`, stigmer/stigmer#816). A seed like every other
+   * field here: an explicit in-session flip beats it for that conversation,
+   * and it is never applied to guest/observer surfaces.
+   */
+  readonly autoApprove?: boolean;
 }
 
 /**
@@ -56,8 +63,11 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
         : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
+    // Only a declared `true` travels — an unset bool is "no preference",
+    // matching the empty-string convention of the fields above.
+    const autoApprove = prefs.defaultAutoApprove || undefined;
 
-    if (!harness && !nativeModel && !cursorModel) return undefined;
-    return { harness, nativeModel, cursorModel };
+    if (!harness && !nativeModel && !cursorModel && !autoApprove) return undefined;
+    return { harness, nativeModel, cursorModel, autoApprove };
   }, [account]);
 }

package/src/index.ts

@@ -234,6 +234,7 @@ export type {
   SessionRunConfig,
   SetupTabProps,
   SetupTabMutationCallbacks,
+  SetupTabAutoApprove,
 } from "./session/index.js";
 
 // Activity — unified recent activity (sessions + workflow executions)
@@ -551,7 +552,6 @@ export type {
   SessionComposerHandle,
   SessionComposerProps,
   SessionComposerSubmitContext,
-  ComposerAutoApproveProps,
   InteractionModePickerProps,
   InteractionModeOption,
 } from "./composer/index.js";
@@ -866,6 +866,7 @@ export type {
 // hooks (confirm/reject/delete/edit), grouping helpers, and the list panel
 export {
   useMemories,
+  useMemory,
   useConfirmMemory,
   useRejectMemory,
   useDeleteMemory,
@@ -873,15 +874,18 @@ export {
   groupMemoriesByLifecycle,
   formatMemoryProvenance,
   MemoryListPanel,
+  MemoryProposalCardBody,
 } from "./memory/index.js";
 export type {
   UseMemoriesReturn,
+  UseMemoryReturn,
   UseConfirmMemoryReturn,
   UseRejectMemoryReturn,
   UseDeleteMemoryReturn,
   UseUpdateMemoryContentReturn,
   MemoryGroups,
   MemoryListPanelProps,
+  MemoryProposalCardBodyProps,
 } from "./memory/index.js";
 
 // IAM Policy — data hooks, behavior hooks, headless hook, and styled components for access management

package/src/internal/MemoryEnabledRow.tsx

@@ -0,0 +1,92 @@
+"use client";
+
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import { Switch } from "../switch/Switch.js";
+import { SpinnerIcon } from "./SpinnerIcon.js";
+
+/** Props for {@link MemoryEnabledRow}. */
+export interface MemoryEnabledRowProps {
+  /** Id for the switch control (aria-labelledby wiring). */
+  readonly id: string;
+  /** The stored flag value (server state, or an optimistic pending value). */
+  readonly checked: boolean;
+  /** Fired with the next value when the user flips the switch. */
+  readonly onToggle: (next: boolean) => void;
+  /** `true` while the flip is being saved (switch disabled, spinner shown). */
+  readonly saving: boolean;
+  /** `true` when the caller may not edit the flag (read-only rendering). */
+  readonly readOnly?: boolean;
+  /** Error from the last failed flip, or `null`. */
+  readonly error: Error | null;
+  /**
+   * The scope-specific helper copy (DD-006 D6's transparency statement
+   * belongs here). Rendered under the title, wired as the switch's
+   * accessible description.
+   */
+  readonly helperText: string;
+}
+
+/**
+ * The `memory_enabled` consent toggle — one row, shared verbatim by
+ * {@link OrgPreferencesPanel} and {@link AccountPreferencesPanel} so the
+ * two scopes of the double opt-in (DD-006 D1) present identically.
+ *
+ * INSTANT-APPLY by deliberate exception (UX checkpoint, owner-approved
+ * 2026-08-22): both host panels are save-button forms, but a consent bit
+ * flipped-and-unsaved that silently reverts on navigation is exactly the
+ * failure consent UX must not have — so this row saves the moment it is
+ * flipped, matching the Switch primitive's own contract ("instant binary
+ * changes") and every peer product's memory toggle. The helper copy
+ * states it. Hosts wire `onToggle` to their own full-spec-replace update
+ * and pass the in-flight/error state back down.
+ */
+export function MemoryEnabledRow({
+  id,
+  checked,
+  onToggle,
+  saving,
+  readOnly = false,
+  error,
+  helperText,
+}: MemoryEnabledRowProps) {
+  const titleId = `${id}-title`;
+  const descriptionId = `${id}-description`;
+
+  return (
+    <div className="stg:space-y-1">
+      <div className="stg:flex stg:items-start stg:justify-between stg:gap-3">
+        <div className="stg:min-w-0 stg:flex-1">
+          <span
+            id={titleId}
+            className="stg:block stg:text-xs stg:font-medium stg:text-foreground"
+          >
+            Memory
+          </span>
+          <p
+            id={descriptionId}
+            className="stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground"
+          >
+            {helperText}
+          </p>
+        </div>
+        <span className="stg:flex stg:shrink-0 stg:items-center stg:gap-1.5">
+          {saving && <SpinnerIcon size={12} />}
+          <Switch
+            id={id}
+            checked={checked}
+            onCheckedChange={onToggle}
+            disabled={saving || readOnly}
+            aria-labelledby={titleId}
+            aria-describedby={descriptionId}
+          />
+        </span>
+      </div>
+      {error && (
+        <p className="stg:text-[0.65rem] stg:text-destructive" role="alert">
+          {getUserMessage(error)}
+        </p>
+      )}
+    </div>
+  );
+}

package/src/memory/MemoryProposalCard.tsx

@@ -0,0 +1,181 @@
+"use client";
+
+import { useCallback, useState } from "react";
+import { cn } from "@stigmer/theme";
+import { getUserMessage } from "@stigmer/sdk";
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { formatMemoryProvenance } from "./memoryGroups.js";
+import { useConfirmMemory } from "./useConfirmMemory.js";
+import { useMemory } from "./useMemory.js";
+import { useRejectMemory } from "./useRejectMemory.js";
+
+/** Props for {@link MemoryProposalCardBody}. */
+export interface MemoryProposalCardBodyProps {
+  /** The proposed memory's resource id (from the remember tool's answer). */
+  readonly memoryId: string;
+  /**
+   * The proposed fact as frozen in the tool result — shown VERBATIM
+   * (DD-005 D6: what you confirm is what future prompts inject, byte for
+   * byte). The live record's text supersedes it once fetched, so an edit
+   * made on the memory page is reflected here too.
+   */
+  readonly fact: string;
+  /** Additional CSS class names for the root container. */
+  readonly className?: string;
+}
+
+/**
+ * The in-session consent surface for a memory proposal (DD-005 D4): the
+ * body of a `remember` tool call's row in the message thread, rendering
+ * the proposed fact verbatim with one-click Confirm / Reject actions.
+ *
+ * Lifecycle honesty across surfaces and reloads: the tool result this
+ * renders from is FROZEN at capture time, so the card fetches the
+ * record's current state ({@link useMemory}) — a proposal decided from
+ * the memory settings page (or another device) shows its decided state
+ * here instead of stale action buttons, and a deleted record reads
+ * "no longer stored" rather than failing. Rejection is one click, no
+ * confirmation dialog (the T04 Cursor lesson: expensive review teaches
+ * users to ignore the queue); deletion-with-confirmation lives on the
+ * memory page, the catch-up surface.
+ *
+ * Borderless by design (the {@link ApprovalCardBody} posture): the tool
+ * row's card owns the chrome, this component owns only the body. All
+ * visual properties flow through `--stgm-*` design tokens.
+ */
+export function MemoryProposalCardBody({
+  memoryId,
+  fact,
+  className,
+}: MemoryProposalCardBodyProps) {
+  const { memory, isLoading, notFound, error: fetchError } = useMemory(memoryId);
+  const { confirmMemory, isConfirming, error: confirmError } = useConfirmMemory();
+  const { rejectMemory, isRejecting, error: rejectError } = useRejectMemory();
+
+  // The card's own decision lands here so the settled state renders
+  // immediately — the fetch stays the authority for every OTHER writer
+  // (the memory page, another device), read once on mount.
+  const [decided, setDecided] = useState<Memory | null>(null);
+
+  const act = useCallback(
+    async (action: (id: string) => Promise<Memory>) => {
+      try {
+        setDecided(await action(memoryId));
+      } catch {
+        // Error state is surfaced via the hooks.
+      }
+    },
+    [memoryId],
+  );
+
+  const record = decided ?? memory;
+  const state = record?.status?.lifecycleState;
+  // The live record's text supersedes the frozen tool result (the subject
+  // may have edited the fact on the memory page before deciding).
+  const displayFact = record?.spec?.content || fact;
+  const provenance = record ? formatMemoryProvenance(record) : null;
+  const actionError = confirmError ?? rejectError;
+  const isBusy = isConfirming || isRejecting;
+
+  const showActions =
+    !notFound &&
+    fetchError == null &&
+    (state === undefined ||
+      state === MemoryLifecycleState.lifecycle_state_unspecified ||
+      state === MemoryLifecycleState.lifecycle_state_proposed);
+
+  return (
+    <div className={cn("stg:space-y-2", className)} data-cursor-target="memory-proposal">
+      <p className="stg:text-sm stg:text-foreground stg:whitespace-pre-wrap">
+        {displayFact}
+      </p>
+
+      <p className="stg:text-xs stg:text-muted-foreground">
+        {provenance ? `${provenance} · ` : ""}
+        Proposed to remember — nothing is stored in your sessions until you
+        confirm it.
+      </p>
+
+      {notFound ? (
+        <p className="stg:text-xs stg:text-muted-foreground" role="status">
+          No longer stored.
+        </p>
+      ) : fetchError ? (
+        // The fact stays visible (it is frozen in the tool result); only
+        // the actionable state is unavailable. Decide from the memory
+        // page instead — the catch-up surface.
+        <p className="stg:text-xs stg:text-muted-foreground" role="status">
+          Couldn&apos;t load this proposal&apos;s current state — review it in
+          Settings → Memory.
+        </p>
+      ) : showActions ? (
+        <div className="stg:flex stg:items-center stg:gap-1.5">
+          <ChipButton
+            label={`Confirm memory: ${displayFact}`}
+            onClick={() => void act(confirmMemory)}
+            disabled={isBusy || isLoading}
+            emphasis="primary"
+          >
+            {isConfirming && <SpinnerIcon size={12} />}
+            Confirm
+          </ChipButton>
+          <ChipButton
+            label={`Reject memory: ${displayFact}`}
+            onClick={() => void act(rejectMemory)}
+            disabled={isBusy || isLoading}
+          >
+            {isRejecting && <SpinnerIcon size={12} />}
+            Reject
+          </ChipButton>
+        </div>
+      ) : (
+        <p className="stg:text-xs stg:text-muted-foreground" role="status">
+          {state === MemoryLifecycleState.lifecycle_state_confirmed
+            ? "Confirmed — recalled in your future sessions."
+            : "Rejected — not stored."}
+        </p>
+      )}
+
+      {actionError && (
+        <p className="stg:text-[0.65rem] stg:text-destructive" role="alert">
+          {getUserMessage(actionError)}
+        </p>
+      )}
+    </div>
+  );
+}
+
+function ChipButton({
+  label,
+  onClick,
+  disabled,
+  emphasis,
+  children,
+}: {
+  readonly label: string;
+  readonly onClick: () => void;
+  readonly disabled?: boolean;
+  readonly emphasis?: "primary";
+  readonly children: React.ReactNode;
+}) {
+  return (
+    <button
+      type="button"
+      aria-label={label}
+      onClick={onClick}
+      disabled={disabled}
+      className={cn(
+        "stg:inline-flex stg:items-center stg:gap-1 stg:rounded-md stg:px-2.5 stg:py-1 stg:text-xs stg:font-medium",
+        emphasis === "primary"
+          ? "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover"
+          : "stg:border stg:border-input stg:bg-background stg:text-foreground stg:hover:bg-accent stg:hover:text-accent-foreground",
+        "stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring",
+        "stg:disabled:pointer-events-none stg:disabled:opacity-50",
+      )}
+    >
+      {children}
+    </button>
+  );
+}

package/src/memory/__tests__/MemoryProposalCard.test.tsx

@@ -0,0 +1,236 @@
+// The in-session consent surface (DD-005 D4): verbatim fact, one-click
+// Confirm/Reject, and lifecycle honesty — the frozen tool result never
+// shows stale action buttons over a record that was already decided,
+// deleted, or unreachable.
+
+import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import { MemorySchema, type Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { StigmerError } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { FetchCacheContext } from "../../internal/FetchCacheProvider";
+import { MemoryProposalCardBody } from "../MemoryProposalCard";
+
+function wrapper(client: unknown) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <FetchCacheContext.Provider value={null}>
+        <StigmerContext.Provider value={client as never}>
+          {children}
+        </StigmerContext.Provider>
+      </FetchCacheContext.Provider>
+    );
+  };
+}
+
+const FACT = "Prefers concise answers with code examples.";
+
+function makeMemory(state: MemoryLifecycleState, content = FACT): Memory {
+  return create(MemorySchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Memory",
+    metadata: { id: "mem_1", name: "mem_1", slug: "mem-1", org: "test-org" },
+    spec: {
+      content,
+      provenance: { agentId: "agt_1", sessionId: "ses_1" },
+    },
+    status: { lifecycleState: state },
+  });
+}
+
+function renderCard(client: unknown) {
+  return render(<MemoryProposalCardBody memoryId="mem_1" fact={FACT} />, {
+    wrapper: wrapper(client),
+  });
+}
+
+/** Waits for the record fetch to settle and the named action to arm. */
+async function waitForAction(name: string): Promise<HTMLElement> {
+  let button: HTMLElement | null = null;
+  await waitFor(() => {
+    button = screen.getByRole("button", { name });
+    expect(button.hasAttribute("disabled")).toBe(false);
+  });
+  return button!;
+}
+
+beforeEach(() => vi.clearAllMocks());
+afterEach(cleanup);
+
+describe("MemoryProposalCardBody", () => {
+  it("renders the verbatim fact with Confirm/Reject while the record is proposed", async () => {
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    // The exact stored text — never paraphrased (DD-005 D6).
+    expect(screen.getByText(FACT)).toBeTruthy();
+    await waitForAction(`Confirm memory: ${FACT}`);
+    expect(screen.getByRole("button", { name: `Reject memory: ${FACT}` })).toBeTruthy();
+    // Provenance renders beside the fact (DD-005 D6: origin builds trust).
+    expect(screen.getByText(/Proposed by agent agt_1/)).toBeTruthy();
+  });
+
+  it("confirms in one click and settles into the confirmed state line", async () => {
+    const confirm = vi
+      .fn()
+      .mockResolvedValue(makeMemory(MemoryLifecycleState.lifecycle_state_confirmed));
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        confirm,
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const confirmButton = await waitForAction(`Confirm memory: ${FACT}`);
+
+    await user.click(confirmButton);
+
+    expect(confirm).toHaveBeenCalledWith("mem_1");
+    await waitFor(() =>
+      expect(
+        screen.getByText("Confirmed — recalled in your future sessions."),
+      ).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("rejects in ONE click — no confirmation dialog (the T04 Cursor lesson)", async () => {
+    const reject = vi
+      .fn()
+      .mockResolvedValue(makeMemory(MemoryLifecycleState.lifecycle_state_rejected));
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        reject,
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const rejectButton = await waitForAction(`Reject memory: ${FACT}`);
+
+    await user.click(rejectButton);
+
+    expect(reject).toHaveBeenCalledWith("mem_1");
+    await waitFor(() =>
+      expect(screen.getByText("Rejected — not stored.")).toBeTruthy(),
+    );
+  });
+
+  it("shows the decided state instead of stale actions when another surface decided it", async () => {
+    // The tool result is frozen; the record was confirmed from the
+    // memory page (or another device) — the reloaded chip must say so.
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_confirmed),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(
+        screen.getByText("Confirmed — recalled in your future sessions."),
+      ).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("renders the live record's text when the fact was edited before deciding", async () => {
+    const edited = "Prefers concise answers, with Go examples.";
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed, edited),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() => expect(screen.getByText(edited)).toBeTruthy());
+    expect(screen.queryByText(FACT)).toBeNull();
+  });
+
+  it("reads 'no longer stored' for a deleted record — a state, never an error", async () => {
+    const client = {
+      memory: {
+        get: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("not-found", "memory not found", 5)),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(screen.getByText("No longer stored.")).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  it("keeps the frozen fact visible when the state fetch fails, pointing at the memory page", async () => {
+    const client = {
+      memory: {
+        get: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("unavailable", "server down", 14)),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(screen.getByText(/review it in Settings → Memory/)).toBeTruthy(),
+    );
+    // The fact is frozen in the tool result — it never disappears.
+    expect(screen.getByText(FACT)).toBeTruthy();
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("surfaces a failed decision inline and keeps the actions available", async () => {
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        confirm: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("unavailable", "server down", 14)),
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const confirmButton = await waitForAction(`Confirm memory: ${FACT}`);
+
+    await user.click(confirmButton);
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeTruthy());
+    expect(
+      screen
+        .getByRole("button", { name: `Confirm memory: ${FACT}` })
+        .hasAttribute("disabled"),
+    ).toBe(false);
+  });
+});