@stigmer/react 3.12.7 → 3.12.9

package/src/execution/__tests__/message-thread-scroll-on-send.test.tsx

@@ -0,0 +1,141 @@
+// Scroll-on-send wiring pins for MessageThread (stigmer-cloud#267): the
+// send moment is the optimistic message's empty→present transition, and it
+// must pin the thread exactly once — default-ON, opt-out via
+// `scrollOnSend={false}` (the ratified DD-011 divergence). The REAL scroll
+// mechanics (pin + follow re-engagement under real layout) are pinned in
+// `internal/__tests__/useAutoScroll.layout.test.tsx`; this file pins the
+// surface's signal derivation through a spied `jumpToLatest`, with the real
+// `usePinToLatestOnSignal` connecting them.
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { render, cleanup } from "@testing-library/react";
+import { create } from "@bufbuild/protobuf";
+import {
+  AgentExecutionSchema,
+  type AgentExecution,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { AgentExecutionSpecSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+
+const jumpToLatestSpy = vi.fn();
+
+// The fake replaces only the scroll machine (browser observers happy-dom
+// lacks); `usePinToLatestOnSignal` stays REAL, so these tests exercise the
+// actual signal contract between MessageThread and its render paths.
+vi.mock("../../internal/useAutoScroll", async (importOriginal) => {
+  const original =
+    await importOriginal<typeof import("../../internal/useAutoScroll")>();
+  return {
+    ...original,
+    useAutoScroll: () => ({
+      scrollRef: { current: null },
+      sentinelRef: { current: null },
+      contentRef: () => {},
+      isFollowing: true,
+      jumpToLatest: jumpToLatestSpy,
+    }),
+  };
+});
+
+import { MessageThread } from "../MessageThread";
+
+afterEach(() => {
+  cleanup();
+  jumpToLatestSpy.mockClear();
+});
+
+function makeExecution(id: string, message: string): AgentExecution {
+  const exec = create(AgentExecutionSchema);
+  const meta = create(ApiResourceMetadataSchema);
+  meta.id = id;
+  exec.metadata = meta;
+  const spec = create(AgentExecutionSpecSchema);
+  spec.message = message;
+  exec.spec = spec;
+  return exec;
+}
+
+describe("MessageThread — scroll-on-send (stigmer-cloud#267)", () => {
+  it("pins the thread exactly once when the optimistic message appears (default-on)", () => {
+    const executions = [makeExecution("aex_1", "earlier turn")];
+    const { rerender } = render(
+      <MessageThread executions={executions} pendingUserMessage={null} />,
+    );
+    expect(jumpToLatestSpy).not.toHaveBeenCalled();
+
+    // The send: the composer sets the optimistic message.
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="do the thing" />,
+    );
+    expect(jumpToLatestSpy).toHaveBeenCalledTimes(1);
+
+    // Re-renders while the message stays pending must not re-pin — the
+    // reader may have scrolled up again to read history mid-turn.
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="do the thing" />,
+    );
+    expect(jumpToLatestSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("pins again on the NEXT send after the pending message clears", () => {
+    const executions = [makeExecution("aex_1", "earlier turn")];
+    const { rerender } = render(
+      <MessageThread executions={executions} pendingUserMessage={null} />,
+    );
+
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="first send" />,
+    );
+    rerender(<MessageThread executions={executions} pendingUserMessage={null} />);
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="second send" />,
+    );
+
+    expect(jumpToLatestSpy).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not re-pin on a failed send's retry — pending stays present throughout, and the reader was already brought to it", () => {
+    const executions = [makeExecution("aex_1", "earlier turn")];
+    const { rerender } = render(
+      <MessageThread executions={executions} pendingUserMessage={null} />,
+    );
+
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="flaky send" />,
+    );
+    rerender(
+      <MessageThread
+        executions={executions}
+        pendingUserMessage="flaky send"
+        pendingMessageFailed
+        onRetrySend={() => {}}
+      />,
+    );
+    rerender(
+      <MessageThread executions={executions} pendingUserMessage="flaky send" />,
+    );
+
+    expect(jumpToLatestSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("never pins with scrollOnSend={false} — the opt-out preserves today's leave-the-reader-alone behavior", () => {
+    const executions = [makeExecution("aex_1", "earlier turn")];
+    const { rerender } = render(
+      <MessageThread
+        executions={executions}
+        pendingUserMessage={null}
+        scrollOnSend={false}
+      />,
+    );
+
+    rerender(
+      <MessageThread
+        executions={executions}
+        pendingUserMessage="do the thing"
+        scrollOnSend={false}
+      />,
+    );
+
+    expect(jumpToLatestSpy).not.toHaveBeenCalled();
+  });
+});

package/src/execution/__tests__/message-thread-slots.test.tsx

@@ -5,11 +5,13 @@ import { create } from "@bufbuild/protobuf";
 import {
   AgentExecutionSchema,
   AgentExecutionStatusSchema,
+  RecalledMemoriesReportSchema,
   type AgentExecution,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
 import {
   AgentExecutionSpecSchema,
   ExecutionConfigSchema,
+  RecalledMemoriesSchema,
 } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/spec_pb";
 import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
 import { AgentMessageSchema } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
@@ -32,6 +34,7 @@ import type { ExecutionErrorNoticeProps } from "../ExecutionErrorNotice";
 import type { TodoCardProps } from "../TodoCard";
 import type { TodoRowProps } from "../TodoList";
 import type { SetupProgressProps } from "../SetupProgress";
+import type { RecalledMemoriesCardProps } from "../RecalledMemoriesCard";
 import type { LivenessStatusLineProps } from "../LivenessStatusLine";
 import type { PlanCompletionCardProps } from "../PlanCompletionCard";
 import type { PlanArtifactCardProps } from "../PlanArtifactCard";
@@ -318,6 +321,39 @@ describe("MessageThread slots", () => {
     expect(screen.getByTestId("custom-setup").textContent).toBe("waiting");
   });
 
+  it("renders the RecalledMemoriesCard slot for a selection-active execution", () => {
+    const CustomRecalled = ({ report, facts }: RecalledMemoriesCardProps) => (
+      <div data-testid="custom-recalled">
+        {report.injectedMemoryIds.length} of {facts.length}
+      </div>
+    );
+
+    const exec = makeExecution({ id: "e1" });
+    exec.spec!.recalledMemories = create(RecalledMemoriesSchema, {
+      enabled: true,
+      facts: [
+        { memoryId: "mem_a", content: "Prefers concise answers." },
+        { memoryId: "mem_b", content: "Deploys with Bazel." },
+      ],
+    });
+    exec.status!.recalledMemoriesReport = create(RecalledMemoriesReportSchema, {
+      selectionActive: true,
+      injectedMemoryIds: ["mem_a"],
+      embeddingModel: "text-embedding-3-small",
+    });
+
+    render(
+      <MessageThread
+        executions={[exec]}
+        slots={{ RecalledMemoriesCard: CustomRecalled }}
+      />,
+    );
+
+    expect(screen.getByTestId("custom-recalled").textContent).toBe("1 of 2");
+    // The built-in card must not render alongside the override.
+    expect(screen.queryByRole("status", { name: /Recalled/ })).toBeNull();
+  });
+
   it("renders the LivenessStatusLine slot while the execution is live between events", () => {
     const CustomLiveness = ({ label }: LivenessStatusLineProps) => (
       <div data-testid="custom-liveness">{label ?? "custom-live"}</div>

package/src/execution/index.ts

@@ -42,6 +42,8 @@ export type { SummarizationBadgeProps } from "./SummarizationBadge.js";
 
 export { SummarizationCard } from "./SummarizationCard.js";
 export type { SummarizationCardProps } from "./SummarizationCard.js";
+export { RecalledMemoriesCard, resolveInjectedFacts } from "./RecalledMemoriesCard.js";
+export type { RecalledMemoriesCardProps } from "./RecalledMemoriesCard.js";
 
 export { PlanCompletionCard } from "./PlanCompletionCard.js";
 export type { PlanCompletionCardProps } from "./PlanCompletionCard.js";

package/src/execution/tool-categories.ts

@@ -32,6 +32,7 @@ export type ToolCategory =
   | "sub-agent"
   | "internal"
   | "mcp"
+  | "memory"
   | "unknown";
 
 /**
@@ -122,6 +123,11 @@ const PREVIEW_CATEGORIES: ReadonlySet<ToolCategory> = new Set<ToolCategory>([
   "mcp",
   "web-search",
   "fetch",
+  // A memory proposal is a decision surface: the verbatim fact and the
+  // Confirm/Reject actions ARE the content — never fold it behind a chevron
+  // (DD-005 D4: a proposal the user scrolled past is caught by the memory
+  // page, but the chip must not hide itself while in view).
+  "memory",
   "unknown",
 ]);
 
@@ -232,6 +238,7 @@ const KIND_DISPLAY: Partial<Record<ToolKind, KindDisplayEntry>> = {
   [ToolKind.THINK]:       { category: "think",     label: "Thinking",  primaryField: "thought" },
   [ToolKind.SUBAGENT]:    { category: "sub-agent", label: "Sub-agent", primaryField: "description", fallbackFields: ["prompt"] },
   [ToolKind.TODO]:        { category: "internal",  label: "Todos",     primaryField: "todos" },
+  [ToolKind.MEMORY]:      { category: "memory",    label: "Remember",  primaryField: "fact" },
 };
 
 /**

package/src/identity-account/AccountPreferencesPanel.tsx

@@ -18,8 +18,10 @@ import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
 import { useModelRegistry } from "../models/index.js";
 import { HARNESS_META, type HarnessOption } from "../models/harness.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
+import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { Switch } from "../switch/Switch.js";
 
 /** Props for {@link AccountPreferencesPanel}. */
 export interface AccountPreferencesPanelProps {
@@ -32,7 +34,8 @@ export interface AccountPreferencesPanelProps {
 /**
  * Self-contained editor for the current user's declared preferences
  * (`IdentityAccountSpec.preferences`): standing context plus the
- * execution defaults (default harness and per-harness default models).
+ * execution defaults (default harness, per-harness default models, and
+ * the auto-approve default).
  *
  * The declared text is snapshotted into the user's own eligible agent
  * executions and delivered to the agent as background context.
@@ -108,16 +111,26 @@ function AccountPreferencesForm({
     clearError,
   } = useUpdateIdentityAccount();
 
+  // The memory toggle saves instantly (its own hook instance, so a flip's
+  // in-flight/error state never bleeds into the form's Save button).
+  const {
+    update: updateMemoryFlag,
+    isUpdating: isSavingMemoryFlag,
+    error: memoryFlagError,
+  } = useUpdateIdentityAccount();
+
   const [standingContext, setStandingContext] = useState("");
   const [defaultHarness, setDefaultHarness] = useState("");
   const [defaultNativeModel, setDefaultNativeModel] = useState("");
   const [defaultCursorModel, setDefaultCursorModel] = useState("");
+  const [defaultAutoApprove, setDefaultAutoApprove] = useState(false);
 
   const serverPreferences = account?.spec?.preferences;
   const serverStandingContext = serverPreferences?.standingContext ?? "";
   const serverDefaultHarness = serverPreferences?.defaultHarness ?? "";
   const serverDefaultNativeModel = serverPreferences?.defaultNativeModel ?? "";
   const serverDefaultCursorModel = serverPreferences?.defaultCursorModel ?? "";
+  const serverDefaultAutoApprove = serverPreferences?.defaultAutoApprove ?? false;
 
   // Sync the form fields when server data changes.
   useEffect(() => {
@@ -127,6 +140,7 @@ function AccountPreferencesForm({
     setDefaultHarness(prefs?.defaultHarness ?? "");
     setDefaultNativeModel(prefs?.defaultNativeModel ?? "");
     setDefaultCursorModel(prefs?.defaultCursorModel ?? "");
+    setDefaultAutoApprove(prefs?.defaultAutoApprove ?? false);
   }, [account]);
 
   const hasChanges = useMemo(
@@ -134,16 +148,19 @@ function AccountPreferencesForm({
       standingContext.trim() !== serverStandingContext ||
       defaultHarness !== serverDefaultHarness ||
       defaultNativeModel !== serverDefaultNativeModel ||
-      defaultCursorModel !== serverDefaultCursorModel,
+      defaultCursorModel !== serverDefaultCursorModel ||
+      defaultAutoApprove !== serverDefaultAutoApprove,
     [
       standingContext,
       defaultHarness,
       defaultNativeModel,
       defaultCursorModel,
+      defaultAutoApprove,
       serverStandingContext,
       serverDefaultHarness,
       serverDefaultNativeModel,
       serverDefaultCursorModel,
+      serverDefaultAutoApprove,
     ],
   );
 
@@ -154,12 +171,14 @@ function AccountPreferencesForm({
     setDefaultHarness(serverDefaultHarness);
     setDefaultNativeModel(serverDefaultNativeModel);
     setDefaultCursorModel(serverDefaultCursorModel);
+    setDefaultAutoApprove(serverDefaultAutoApprove);
     clearError();
   }, [
     serverStandingContext,
     serverDefaultHarness,
     serverDefaultNativeModel,
     serverDefaultCursorModel,
+    serverDefaultAutoApprove,
     clearError,
   ]);
 
@@ -183,6 +202,7 @@ function AccountPreferencesForm({
             defaultHarness: defaultHarness || undefined,
             defaultNativeModel: defaultNativeModel || undefined,
             defaultCursorModel: defaultCursorModel || undefined,
+            defaultAutoApprove: defaultAutoApprove || undefined,
           },
         });
         refetch();
@@ -198,6 +218,7 @@ function AccountPreferencesForm({
       defaultHarness,
       defaultNativeModel,
       defaultCursorModel,
+      defaultAutoApprove,
       update,
       clearError,
       refetch,
@@ -205,6 +226,30 @@ function AccountPreferencesForm({
     ],
   );
 
+  // The memory consent flag applies instantly (the UX-checkpoint decision):
+  // a consent bit flipped-but-unsaved that silently reverts on navigation is
+  // the failure consent UX must not have. Same wipe-safe double spread.
+  const handleMemoryToggle = useCallback(
+    async (next: boolean) => {
+      if (!account) return;
+      try {
+        const mapped = toIdentityAccountUpdateInput(account);
+        const updated = await updateMemoryFlag({
+          ...mapped,
+          preferences: {
+            ...mapped.preferences,
+            memoryEnabled: next || undefined,
+          },
+        });
+        refetch();
+        onUpdated?.(updated);
+      } catch {
+        // error state is managed by the toggle's own hook instance
+      }
+    },
+    [account, updateMemoryFlag, refetch, onUpdated],
+  );
+
   // -----------------------------------------------------------------------
   // Loading state
   // -----------------------------------------------------------------------
@@ -330,8 +375,50 @@ function AccountPreferencesForm({
             on that harness — even when it isn't your default.
           </p>
         </fieldset>
+
+        {/* Auto-approve default (stigmer/stigmer#816): a client-read seed
+            like the harness/model defaults above — the session panel's
+            Config switch beats it per conversation, and armed sessions
+            always show the "Auto-approving tool calls" strip by the
+            composer. Never applied to guest or observer surfaces. */}
+        <div
+          className={cn(
+            "stg:flex stg:items-start stg:justify-between stg:gap-3 stg:rounded-md stg:border stg:border-input stg:px-3 stg:py-2.5",
+            isUpdating && "stg:opacity-50",
+          )}
+        >
+          <div className="stg:min-w-0">
+            <span
+              id={`${baseId}-default-auto-approve-title`}
+              className="stg:block stg:text-xs stg:font-medium stg:text-foreground"
+            >
+              Auto-approve tool calls
+            </span>
+            <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+              Start your sessions with tool calls running unattended — no
+              approval prompts. Each conversation can turn this off (or on)
+              in its session panel.
+            </p>
+          </div>
+          <Switch
+            checked={defaultAutoApprove}
+            onCheckedChange={setDefaultAutoApprove}
+            disabled={isUpdating}
+            aria-labelledby={`${baseId}-default-auto-approve-title`}
+            className="stg:mt-0.5"
+          />
+        </div>
       </div>
 
+      <MemoryEnabledRow
+        id={`${baseId}-memory-enabled`}
+        checked={account.spec?.preferences?.memoryEnabled ?? false}
+        onToggle={(next) => void handleMemoryToggle(next)}
+        saving={isSavingMemoryFlag}
+        error={memoryFlagError}
+        helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
+      />
+
       {updateError && (
         <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
           {getUserMessage(updateError)}

package/src/identity-account/__tests__/AccountPreferencesPanel.test.tsx

@@ -115,6 +115,52 @@ describe("AccountPreferencesPanel", () => {
     expect(input.slug).toBe("ada");
   });
 
+  it("saves the auto-approve default when the toggle is flipped on", async () => {
+    const update = vi.fn(async (_input: IdentityAccountInput) => ACCOUNT);
+    renderPanel(createMockStigmer({ update }));
+
+    await findSyncedField("Keep answers terse.");
+    const toggle = screen.getByRole("switch", { name: "Auto-approve tool calls" });
+    expect(toggle.getAttribute("aria-checked")).toBe("false");
+
+    fireEvent.click(toggle);
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+    expect(input.preferences?.defaultAutoApprove).toBe(true);
+  });
+
+  it("reflects a declared auto-approve default and omits it when turned off", async () => {
+    const armedAccount = create(IdentityAccountSchema, {
+      metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },
+      spec: {
+        idpId: "auth0|abc",
+        email: "ada@acme.example",
+        preferences: { defaultAutoApprove: true },
+      },
+    });
+    const update = vi.fn(async (_input: IdentityAccountInput) => armedAccount);
+    renderPanel(
+      createMockStigmer({ whoAmI: vi.fn(async () => armedAccount), update }),
+    );
+
+    const toggle = await screen.findByRole("switch", {
+      name: "Auto-approve tool calls",
+    });
+    await waitFor(() =>
+      expect(toggle.getAttribute("aria-checked")).toBe("true"),
+    );
+
+    fireEvent.click(toggle);
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    // Only a declared true travels — off is the absent zero value.
+    const input = update.mock.calls[0]![0];
+    expect(input.preferences?.defaultAutoApprove).toBeUndefined();
+  });
+
   it("refetches the account after a successful save", async () => {
     const whoAmI = vi.fn(async () => ACCOUNT);
     renderPanel(createMockStigmer({ whoAmI }));
@@ -137,6 +183,72 @@ describe("AccountPreferencesPanel", () => {
     expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
   });
 
+  describe("memory consent (oss#293 Phase 2 Stage 3)", () => {
+    it("memory toggle applies instantly with the full mapped input (wipe-safe)", async () => {
+      const update = vi.fn(async (_input: IdentityAccountInput) => ACCOUNT);
+      renderPanel(createMockStigmer({ update }));
+      await findSyncedField("Keep answers terse.");
+
+      // No Save click: consent applies the moment it is flipped (the
+      // UX-checkpoint decision).
+      fireEvent.click(screen.getByRole("switch", { name: "Memory" }));
+
+      await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+      const input = update.mock.calls[0]![0];
+      expect(input.preferences?.memoryEnabled).toBe(true);
+      // The double spread: the flip preserves every sibling preference…
+      expect(input.preferences?.standingContext).toBe("Keep answers terse.");
+      // …and the identity fields the row never renders.
+      expect(input.id).toBe("ia-1");
+      expect(input.email).toBe("ada@acme.example");
+    });
+
+    it("saving the form preserves memory_enabled (the wipe-hazard regression)", async () => {
+      const accountWithMemoryOn = create(IdentityAccountSchema, {
+        metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },
+        spec: {
+          idpId: "auth0|abc",
+          email: "ada@acme.example",
+          preferences: {
+            standingContext: "Keep answers terse.",
+            memoryEnabled: true,
+          },
+        },
+      });
+      const update = vi.fn(async (_input: IdentityAccountInput) => accountWithMemoryOn);
+      renderPanel(
+        createMockStigmer({ whoAmI: vi.fn(async () => accountWithMemoryOn), update }),
+      );
+
+      const field = await findSyncedField("Keep answers terse.");
+      fireEvent.change(field, { target: { value: "Terser still." } });
+      fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+      await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+      // Update is a full-spec replace: without the nested preferences
+      // spread, this save would silently revoke the memory consent.
+      expect(update.mock.calls[0]![0].preferences?.memoryEnabled).toBe(true);
+    });
+
+    it("reflects the stored flag as the switch state", async () => {
+      const accountWithMemoryOn = create(IdentityAccountSchema, {
+        metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
+        spec: {
+          idpId: "auth0|abc",
+          preferences: { memoryEnabled: true },
+        },
+      });
+      renderPanel(createMockStigmer({ whoAmI: vi.fn(async () => accountWithMemoryOn) }));
+      await findSyncedField("");
+
+      await waitFor(() =>
+        expect(
+          screen.getByRole("switch", { name: "Memory" }).getAttribute("aria-checked"),
+        ).toBe("true"),
+      );
+    });
+  });
+
   describe("execution defaults (oss#293 Phase 1.5)", () => {
     const ACCOUNT_WITH_DEFAULTS: IdentityAccount = create(IdentityAccountSchema, {
       metadata: { id: "ia-1", name: "Ada Lovelace", slug: "ada", org: "acme" },

package/src/identity-account/__tests__/useAccountExecutionDefaults.test.tsx

@@ -12,7 +12,7 @@ import { DeploymentModeContext } from "../../deployment-mode";
 import { useAccountExecutionDefaults } from "../useAccountExecutionDefaults";
 
 function accountWithPreferences(
-  preferences: Record<string, string>,
+  preferences: Record<string, string | boolean>,
 ): IdentityAccount {
   return create(IdentityAccountSchema, {
     metadata: { id: "ia-1", name: "Ada", slug: "ada", org: "acme" },
@@ -102,6 +102,39 @@ describe("useAccountExecutionDefaults", () => {
     );
   });
 
+  it("a declared auto-approve default alone counts as a declared default", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({ defaultAutoApprove: true }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() =>
+      expect(result.current).toEqual({
+        harness: undefined,
+        nativeModel: undefined,
+        cursorModel: undefined,
+        autoApprove: true,
+      }),
+    );
+  });
+
+  it("an unset auto-approve bool is no preference, not an explicit false", async () => {
+    const whoAmI = vi.fn(async () =>
+      accountWithPreferences({
+        defaultHarness: "native",
+        defaultAutoApprove: false,
+      }),
+    );
+    const { result } = renderHook(() => useAccountExecutionDefaults(), {
+      wrapper: createWrapper(whoAmI),
+    });
+
+    await waitFor(() => expect(result.current?.harness).toBe("native"));
+    expect(result.current?.autoApprove).toBeUndefined();
+  });
+
   it("returns undefined on a whoAmI failure — degrades to platform defaults", async () => {
     const whoAmI = vi.fn(async () => {
       throw new Error("boom");

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -16,6 +16,13 @@ export interface AccountExecutionDefaults {
   readonly nativeModel?: string;
   /** Preferred model for cursor-harness sessions, when declared. */
   readonly cursorModel?: string;
+  /**
+   * Start sessions with "auto-approve tool calls" armed
+   * (`default_auto_approve`, stigmer/stigmer#816). A seed like every other
+   * field here: an explicit in-session flip beats it for that conversation,
+   * and it is never applied to guest/observer surfaces.
+   */
+  readonly autoApprove?: boolean;
 }
 
 /**
@@ -56,8 +63,11 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
         : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
+    // Only a declared `true` travels — an unset bool is "no preference",
+    // matching the empty-string convention of the fields above.
+    const autoApprove = prefs.defaultAutoApprove || undefined;
 
-    if (!harness && !nativeModel && !cursorModel) return undefined;
-    return { harness, nativeModel, cursorModel };
+    if (!harness && !nativeModel && !cursorModel && !autoApprove) return undefined;
+    return { harness, nativeModel, cursorModel, autoApprove };
   }, [account]);
 }