@stigmer/react 3.12.7 → 3.12.9

package/src/memory/__tests__/MemoryProposalCard.test.tsx

@@ -0,0 +1,236 @@
+// The in-session consent surface (DD-005 D4): verbatim fact, one-click
+// Confirm/Reject, and lifecycle honesty — the frozen tool result never
+// shows stale action buttons over a record that was already decided,
+// deleted, or unreachable.
+
+import { describe, it, expect, vi, afterEach, beforeEach } from "vitest";
+import { cleanup, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { create } from "@bufbuild/protobuf";
+import { MemorySchema, type Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
+import { StigmerError } from "@stigmer/sdk";
+import { StigmerContext } from "../../context";
+import { FetchCacheContext } from "../../internal/FetchCacheProvider";
+import { MemoryProposalCardBody } from "../MemoryProposalCard";
+
+function wrapper(client: unknown) {
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return (
+      <FetchCacheContext.Provider value={null}>
+        <StigmerContext.Provider value={client as never}>
+          {children}
+        </StigmerContext.Provider>
+      </FetchCacheContext.Provider>
+    );
+  };
+}
+
+const FACT = "Prefers concise answers with code examples.";
+
+function makeMemory(state: MemoryLifecycleState, content = FACT): Memory {
+  return create(MemorySchema, {
+    apiVersion: "agentic.stigmer.ai/v1",
+    kind: "Memory",
+    metadata: { id: "mem_1", name: "mem_1", slug: "mem-1", org: "test-org" },
+    spec: {
+      content,
+      provenance: { agentId: "agt_1", sessionId: "ses_1" },
+    },
+    status: { lifecycleState: state },
+  });
+}
+
+function renderCard(client: unknown) {
+  return render(<MemoryProposalCardBody memoryId="mem_1" fact={FACT} />, {
+    wrapper: wrapper(client),
+  });
+}
+
+/** Waits for the record fetch to settle and the named action to arm. */
+async function waitForAction(name: string): Promise<HTMLElement> {
+  let button: HTMLElement | null = null;
+  await waitFor(() => {
+    button = screen.getByRole("button", { name });
+    expect(button.hasAttribute("disabled")).toBe(false);
+  });
+  return button!;
+}
+
+beforeEach(() => vi.clearAllMocks());
+afterEach(cleanup);
+
+describe("MemoryProposalCardBody", () => {
+  it("renders the verbatim fact with Confirm/Reject while the record is proposed", async () => {
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    // The exact stored text — never paraphrased (DD-005 D6).
+    expect(screen.getByText(FACT)).toBeTruthy();
+    await waitForAction(`Confirm memory: ${FACT}`);
+    expect(screen.getByRole("button", { name: `Reject memory: ${FACT}` })).toBeTruthy();
+    // Provenance renders beside the fact (DD-005 D6: origin builds trust).
+    expect(screen.getByText(/Proposed by agent agt_1/)).toBeTruthy();
+  });
+
+  it("confirms in one click and settles into the confirmed state line", async () => {
+    const confirm = vi
+      .fn()
+      .mockResolvedValue(makeMemory(MemoryLifecycleState.lifecycle_state_confirmed));
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        confirm,
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const confirmButton = await waitForAction(`Confirm memory: ${FACT}`);
+
+    await user.click(confirmButton);
+
+    expect(confirm).toHaveBeenCalledWith("mem_1");
+    await waitFor(() =>
+      expect(
+        screen.getByText("Confirmed — recalled in your future sessions."),
+      ).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("rejects in ONE click — no confirmation dialog (the T04 Cursor lesson)", async () => {
+    const reject = vi
+      .fn()
+      .mockResolvedValue(makeMemory(MemoryLifecycleState.lifecycle_state_rejected));
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        reject,
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const rejectButton = await waitForAction(`Reject memory: ${FACT}`);
+
+    await user.click(rejectButton);
+
+    expect(reject).toHaveBeenCalledWith("mem_1");
+    await waitFor(() =>
+      expect(screen.getByText("Rejected — not stored.")).toBeTruthy(),
+    );
+  });
+
+  it("shows the decided state instead of stale actions when another surface decided it", async () => {
+    // The tool result is frozen; the record was confirmed from the
+    // memory page (or another device) — the reloaded chip must say so.
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_confirmed),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(
+        screen.getByText("Confirmed — recalled in your future sessions."),
+      ).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("renders the live record's text when the fact was edited before deciding", async () => {
+    const edited = "Prefers concise answers, with Go examples.";
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed, edited),
+        ),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() => expect(screen.getByText(edited)).toBeTruthy());
+    expect(screen.queryByText(FACT)).toBeNull();
+  });
+
+  it("reads 'no longer stored' for a deleted record — a state, never an error", async () => {
+    const client = {
+      memory: {
+        get: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("not-found", "memory not found", 5)),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(screen.getByText("No longer stored.")).toBeTruthy(),
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+    expect(screen.queryByRole("alert")).toBeNull();
+  });
+
+  it("keeps the frozen fact visible when the state fetch fails, pointing at the memory page", async () => {
+    const client = {
+      memory: {
+        get: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("unavailable", "server down", 14)),
+      },
+    };
+
+    renderCard(client);
+
+    await waitFor(() =>
+      expect(screen.getByText(/review it in Settings → Memory/)).toBeTruthy(),
+    );
+    // The fact is frozen in the tool result — it never disappears.
+    expect(screen.getByText(FACT)).toBeTruthy();
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  it("surfaces a failed decision inline and keeps the actions available", async () => {
+    const client = {
+      memory: {
+        get: vi.fn().mockResolvedValue(
+          makeMemory(MemoryLifecycleState.lifecycle_state_proposed),
+        ),
+        confirm: vi
+          .fn()
+          .mockRejectedValue(new StigmerError("unavailable", "server down", 14)),
+      },
+    };
+
+    renderCard(client);
+    const user = userEvent.setup();
+    const confirmButton = await waitForAction(`Confirm memory: ${FACT}`);
+
+    await user.click(confirmButton);
+
+    await waitFor(() => expect(screen.getByRole("alert")).toBeTruthy());
+    expect(
+      screen
+        .getByRole("button", { name: `Confirm memory: ${FACT}` })
+        .hasAttribute("disabled"),
+    ).toBe(false);
+  });
+});

package/src/memory/__tests__/memoryHooks.test.tsx

@@ -5,9 +5,11 @@ import { create } from "@bufbuild/protobuf";
 import { MemorySchema, type Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
 import { MemoryLifecycleState } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/enum_pb";
 import { MemoryListSchema } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/io_pb";
+import { StigmerError } from "@stigmer/sdk";
 import { StigmerContext } from "../../context";
 import { FetchCacheContext } from "../../internal/FetchCacheProvider";
 import { useMemories } from "../useMemories";
+import { useMemory } from "../useMemory";
 import { useConfirmMemory } from "../useConfirmMemory";
 import { useRejectMemory } from "../useRejectMemory";
 import { useDeleteMemory } from "../useDeleteMemory";
@@ -101,6 +103,67 @@ describe("useMemories", () => {
   });
 });
 
+describe("useMemory", () => {
+  it("fetches one record by id", async () => {
+    const get = vi.fn().mockResolvedValue(PROPOSED);
+    const client = { memory: { get } };
+
+    const { result } = renderHook(() => useMemory("mem_proposed"), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.memory).toBe(PROPOSED);
+    expect(result.current.notFound).toBe(false);
+    expect(result.current.error).toBeNull();
+    expect(get).toHaveBeenCalledWith("mem_proposed");
+  });
+
+  it("reports a deleted record as the notFound STATE, never an error", async () => {
+    // Deletion is the consent-revocation mechanism — a consumer must
+    // render "no longer stored", not a failure.
+    const get = vi
+      .fn()
+      .mockRejectedValue(new StigmerError("not-found", "memory not found", 5));
+    const client = { memory: { get } };
+
+    const { result } = renderHook(() => useMemory("mem_gone"), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.notFound).toBe(true);
+    expect(result.current.memory).toBeNull();
+    expect(result.current.error).toBeNull();
+  });
+
+  it("propagates every other failure as an error", async () => {
+    const failure = new StigmerError("unavailable", "server down", 14);
+    const client = { memory: { get: vi.fn().mockRejectedValue(failure) } };
+
+    const { result } = renderHook(() => useMemory("mem_x"), {
+      wrapper: wrapper(client),
+    });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.error).toBe(failure);
+    expect(result.current.notFound).toBe(false);
+  });
+
+  it("skips fetching when id is null", () => {
+    const get = vi.fn();
+    const client = { memory: { get } };
+
+    const { result } = renderHook(() => useMemory(null), {
+      wrapper: wrapper(client),
+    });
+
+    expect(result.current.isLoading).toBe(false);
+    expect(result.current.memory).toBeNull();
+    expect(get).not.toHaveBeenCalled();
+  });
+});
+
 // ---------------------------------------------------------------------------
 // Decision hooks
 // ---------------------------------------------------------------------------

package/src/memory/index.ts

@@ -4,12 +4,17 @@
 // is recalled until its subject confirms it.
 
 export { MemoryListPanel, type MemoryListPanelProps } from "./MemoryListPanel.js";
+export {
+  MemoryProposalCardBody,
+  type MemoryProposalCardBodyProps,
+} from "./MemoryProposalCard.js";
 export {
   groupMemoriesByLifecycle,
   formatMemoryProvenance,
   type MemoryGroups,
 } from "./memoryGroups.js";
 export { useMemories, type UseMemoriesReturn } from "./useMemories.js";
+export { useMemory, type UseMemoryReturn } from "./useMemory.js";
 export { useConfirmMemory, type UseConfirmMemoryReturn } from "./useConfirmMemory.js";
 export { useRejectMemory, type UseRejectMemoryReturn } from "./useRejectMemory.js";
 export { useDeleteMemory, type UseDeleteMemoryReturn } from "./useDeleteMemory.js";

package/src/memory/useMemory.ts

@@ -0,0 +1,80 @@
+"use client";
+
+import type { Memory } from "@stigmer/protos/ai/stigmer/agentic/memory/v1/api_pb";
+import { isNotFound } from "@stigmer/sdk";
+import { useStigmer } from "../hooks.js";
+import { useFetch } from "../internal/useFetch.js";
+
+/** Return value of {@link useMemory}. */
+export interface UseMemoryReturn {
+  /** The memory record, or `null` while loading / not found / on error. */
+  readonly memory: Memory | null;
+  /** `true` while the initial fetch is in flight. */
+  readonly isLoading: boolean;
+  /**
+   * `true` when the record no longer exists. A first-class STATE, not an
+   * error: deletion is the platform's consent-revocation mechanism, so a
+   * consumer (the proposal chip, a deep link) must render "no longer
+   * stored" honestly rather than a failure.
+   */
+  readonly notFound: boolean;
+  /** Error from the last failed request (never not-found), or `null`. */
+  readonly error: Error | null;
+  /** Discard cached data and re-fetch the record from the server. */
+  readonly refetch: () => void;
+}
+
+/** The fetch result shape that keeps not-found distinct from errors. */
+interface MemoryLookup {
+  readonly memory: Memory | null;
+  readonly notFound: boolean;
+}
+
+const PENDING_LOOKUP: MemoryLookup = { memory: null, notFound: false };
+
+/**
+ * Data hook that fetches one memory record by id.
+ *
+ * Built for surfaces that hold a memory's identity but not its CURRENT
+ * lifecycle state — the in-thread proposal chip is the primary consumer:
+ * the tool result it renders from is frozen at capture time, while the
+ * record may have been confirmed, rejected, or deleted since (from the
+ * chip itself, the memory settings page, or another device). Content
+ * visibility is subject-only, so the fetch answers only for the person
+ * the memory is about.
+ *
+ * Pass `null` as `id` to skip fetching (stable no-op).
+ *
+ * @example
+ * ```tsx
+ * const { memory, isLoading, notFound } = useMemory(memoryId);
+ * ```
+ */
+export function useMemory(id: string | null): UseMemoryReturn {
+  const stigmer = useStigmer();
+
+  const { data, isLoading, error, refetch } = useFetch(
+    id
+      ? () =>
+          stigmer.memory.get(id).then(
+            (memory): MemoryLookup => ({ memory, notFound: false }),
+            (err): MemoryLookup => {
+              // Deletion is a state this hook reports, never an error it
+              // throws — every other failure propagates.
+              if (isNotFound(err)) return { memory: null, notFound: true };
+              throw err;
+            },
+          )
+      : null,
+    [stigmer, id],
+    PENDING_LOOKUP,
+  );
+
+  return {
+    memory: data.memory,
+    isLoading,
+    notFound: data.notFound,
+    error,
+    refetch,
+  };
+}

package/src/organization/OrgPreferencesPanel.tsx

@@ -7,6 +7,7 @@ import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organizati
 import { useOrganization } from "./useOrganization.js";
 import { useUpdateOrganization } from "./useUpdateOrganization.js";
 import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
+import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 
@@ -60,6 +61,14 @@ export function OrgPreferencesPanel({
     clearError,
   } = useUpdateOrganization();
 
+  // The memory toggle saves instantly (its own hook instance, so a flip's
+  // in-flight/error state never bleeds into the form's Save button).
+  const {
+    update: updateMemoryFlag,
+    isUpdating: isSavingMemoryFlag,
+    error: memoryFlagError,
+  } = useUpdateOrganization();
+
   // Fail-open: OSS local mode has no IAM service, so editing stays
   // available there; cloud gets a genuine server verdict.
   const { allowed: canEdit } = useCheckPermission(
@@ -100,10 +109,16 @@ export function OrgPreferencesPanel({
       clearError();
       try {
         // update() is a full-spec replace: spread the complete mapped input
-        // so unedited spec fields survive, and override only preferences.
+        // so unedited spec fields survive. `preferences` is a nested message,
+        // so the override spreads the mapper's COMPLETE preferences too —
+        // fields this form does not own (memory_enabled) survive the save.
+        const mapped = toOrganizationUpdateInput(organization);
         const updated = await update({
-          ...toOrganizationUpdateInput(organization),
-          preferences: { standingContext: standingContext.trim() || undefined },
+          ...mapped,
+          preferences: {
+            ...mapped.preferences,
+            standingContext: standingContext.trim() || undefined,
+          },
         });
         refetch();
         onUpdated?.(updated);
@@ -114,6 +129,30 @@ export function OrgPreferencesPanel({
     [canSubmit, organization, standingContext, update, clearError, refetch, onUpdated],
   );
 
+  // The memory consent flag applies instantly (the UX-checkpoint decision):
+  // a consent bit flipped-but-unsaved that silently reverts on navigation is
+  // the failure consent UX must not have. Same wipe-safe double spread.
+  const handleMemoryToggle = useCallback(
+    async (next: boolean) => {
+      if (!organization) return;
+      try {
+        const mapped = toOrganizationUpdateInput(organization);
+        const updated = await updateMemoryFlag({
+          ...mapped,
+          preferences: {
+            ...mapped.preferences,
+            memoryEnabled: next || undefined,
+          },
+        });
+        refetch();
+        onUpdated?.(updated);
+      } catch {
+        // error state is managed by the toggle's own hook instance
+      }
+    },
+    [organization, updateMemoryFlag, refetch, onUpdated],
+  );
+
   // -----------------------------------------------------------------------
   // Loading state
   // -----------------------------------------------------------------------
@@ -175,6 +214,16 @@ export function OrgPreferencesPanel({
         helperText="Shared with agents as background context — not instructions. Applies to executions started by signed-in members of this organization and is visible on their execution records."
       />
 
+      <MemoryEnabledRow
+        id={`${baseId}-memory-enabled`}
+        checked={organization.spec?.preferences?.memoryEnabled ?? false}
+        onToggle={(next) => void handleMemoryToggle(next)}
+        saving={isSavingMemoryFlag}
+        readOnly={!canEdit}
+        error={memoryFlagError}
+        helperText="Allow agents to remember confirmed facts about members of this organization. Each member must also turn memory on in their own account preferences; once a member has many memories, each conversation recalls their most relevant ones, shown on the execution. Changes apply immediately."
+      />
+
       {!canEdit && (
         <p className="stg:text-[0.65rem] stg:text-muted-foreground">
           Only organization admins can edit these preferences.

package/src/organization/__tests__/OrgPreferencesPanel.test.tsx

@@ -125,6 +125,71 @@ describe("OrgPreferencesPanel", () => {
     expect(screen.queryByRole("button", { name: "Save changes" })).toBeNull();
   });
 
+  it("memory toggle applies instantly with the full mapped input (wipe-safe)", async () => {
+    const update = vi.fn(async (_input: OrganizationInput) => ORG);
+    renderPanel(createMockStigmer({ update }));
+    await findSyncedField("We deploy to us-east-1.");
+
+    // No Save click: consent applies the moment it is flipped (the
+    // UX-checkpoint decision — a flipped-but-unsaved consent bit that
+    // silently reverts on navigation is the failure this prevents).
+    fireEvent.click(screen.getByRole("switch", { name: "Memory" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    const input = update.mock.calls[0]![0];
+    expect(input.preferences?.memoryEnabled).toBe(true);
+    // The double spread: the flip must not wipe the sibling preference…
+    expect(input.preferences?.standingContext).toBe("We deploy to us-east-1.");
+    // …nor any profile field this row never renders.
+    expect(input.name).toBe("Acme Corp");
+    expect(input.description).toBe("We make everything.");
+  });
+
+  it("saving standing context preserves memory_enabled (the wipe-hazard regression)", async () => {
+    const orgWithMemoryOn = create(OrganizationSchema, {
+      metadata: { id: "acme", name: "Acme Corp", slug: "acme", org: "acme" },
+      spec: {
+        description: "We make everything.",
+        logoUrl: "https://acme.example/logo.png",
+        preferences: {
+          standingContext: "We deploy to us-east-1.",
+          memoryEnabled: true,
+        },
+      },
+    });
+    const update = vi.fn(async (_input: OrganizationInput) => orgWithMemoryOn);
+    const client = {
+      organization: {
+        get: vi.fn(async () => orgWithMemoryOn),
+        update,
+      },
+      iamPolicy: {
+        checkMyPermission: vi.fn(async () => ({ isAuthorized: true })),
+      },
+    } as never;
+    renderPanel(client);
+
+    const field = await findSyncedField("We deploy to us-east-1.");
+    fireEvent.change(field, { target: { value: "Prefer terse answers." } });
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+
+    await waitFor(() => expect(update).toHaveBeenCalledTimes(1));
+    // Update is a full-spec replace: without the nested preferences
+    // spread, this save would silently switch the org's memory OFF.
+    expect(update.mock.calls[0]![0].preferences?.memoryEnabled).toBe(true);
+  });
+
+  it("memory toggle is read-only without can_edit", async () => {
+    renderPanel(createMockStigmer({ canEdit: false }));
+    await screen.findByLabelText("Standing context");
+
+    await waitFor(() =>
+      expect(
+        screen.getByRole("switch", { name: "Memory" }).hasAttribute("disabled"),
+      ).toBe(true),
+    );
+  });
+
   it("shows the fetch error with a retry action when loading fails", async () => {
     const client = {
       organization: {

package/src/session/AutoApproveIndicator.tsx

@@ -0,0 +1,45 @@
+"use client";
+
+/**
+ * Armed-only indicator for the session-scoped auto-approve state, docked
+ * above the composer. Renders nothing about approvals until auto-approve is
+ * actually ON — the composer stays clean by default — and while ON it is the
+ * always-visible safety surface: the user can never be silently
+ * auto-approving without seeing this strip and its one-click "Turn off".
+ *
+ * The way ON lives elsewhere (the Config facet's Run Config switch, the
+ * gate-time "Approve & don't ask again", the account's `default_auto_approve`
+ * preference, the host's `approvalDefaults`); this strip is deliberately only
+ * the way OFF plus the disclosure. Shared by `SessionViewer` and
+ * `NewSessionViewer` (DD-016) — a persisted account preference can arm the
+ * launcher before the first message, so both surfaces need the disclosure.
+ */
+export function AutoApproveIndicator({ onTurnOff }: { readonly onTurnOff: () => void }) {
+  return (
+    <div
+      role="status"
+      className="stg:flex stg:items-center stg:gap-2 stg:border-t stg:border-border-muted stg:px-4 stg:py-1.5 stg:text-xs stg:text-muted-foreground"
+    >
+      <ShieldCheckIcon />
+      <span className="stg:min-w-0 stg:flex-1 stg:truncate">
+        Auto-approving tool calls for this session
+      </span>
+      <button
+        type="button"
+        onClick={onTurnOff}
+        className="stg:shrink-0 stg:rounded stg:font-medium stg:text-foreground stg:underline-offset-2 stg:hover:underline stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring"
+      >
+        Turn off
+      </button>
+    </div>
+  );
+}
+
+function ShieldCheckIcon() {
+  return (
+    <svg width="12" height="12" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="stg:shrink-0 stg:text-success" aria-hidden="true">
+      <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z" />
+      <path d="m9 12 2 2 4-4" />
+    </svg>
+  );
+}