@stigmer/react 3.29.0 → 3.31.0

package/oauth-app/useOAuthAppList.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useOAuthAppList.d.ts","sourceRoot":"","sources":["../../src/oauth-app/useOAuthAppList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAIlF,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,qBAAqB,CAevB"}
+{"version":3,"file":"useOAuthAppList.d.ts","sourceRoot":"","sources":["../../src/oauth-app/useOAuthAppList.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mDAAmD,CAAC;AAIlF,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,GAAG,IAAI,GACjB,qBAAqB,CAevB"}

package/oauth-app/useOAuthAppList.js

@@ -4,11 +4,13 @@ import { ListOAuthAppsByOrgInputSchema } from "@stigmer/protos/ai/stigmer/iam/oa
 import { useStigmer } from "../hooks.js";
 import { useFetch } from "../internal/useFetch.js";
 /**
- * Data hook that fetches all {@link OAuthApp} entries for an organization.
+ * Data hook that fetches the {@link OAuthApp} entries of an organization
+ * that the caller may view.
  *
- * Returns every OAuthApp whose `metadata.org` matches the input. In
- * practice these are the BYOA OAuth apps created through the "Bring
- * your own app" flow on MCP server detail pages.
+ * Returns the organization's OAuthApps that a `get` would return to the
+ * caller: each app's creator and the organization's admins see it, other
+ * members and viewers see none. In practice these are the BYOA OAuth apps
+ * created through the "Bring your own app" flow on MCP server detail pages.
  *
  * Pass `null` for `org` to skip fetching (stable no-op). Useful when
  * the active organization has not been resolved yet.

package/oauth-app/useOAuthAppList.js.map

@@ -1 +1 @@
-{"version":3,"file":"useOAuthAppList.js","sourceRoot":"","sources":["../../src/oauth-app/useOAuthAppList.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAEjG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAgBnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAkB;IAElB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAC3E,GAAG;QACD,CAAC,CAAC,GAAG,EAAE,CACH,OAAO,CAAC,QAAQ;aACb,SAAS,CAAC,MAAM,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;aACzD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,EACR,CAAC,GAAG,EAAE,OAAO,CAAC,EACd,EAAgB,CACjB,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC"}
+{"version":3,"file":"useOAuthAppList.js","sourceRoot":"","sources":["../../src/oauth-app/useOAuthAppList.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,kDAAkD,CAAC;AAEjG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAgBnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAkB;IAElB,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAE7B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,QAAQ,CAC3E,GAAG;QACD,CAAC,CAAC,GAAG,EAAE,CACH,OAAO,CAAC,QAAQ;aACb,SAAS,CAAC,MAAM,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;aACzD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,IAAI,EACR,CAAC,GAAG,EAAE,OAAO,CAAC,EACd,EAAgB,CACjB,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAChE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stigmer/react",
-  "version": "3.29.0",
+  "version": "3.31.0",
   "description": "React provider and client hook for the Stigmer platform SDK",
   "license": "Apache-2.0",
   "type": "module",
@@ -37,8 +37,8 @@
   "dependencies": {
     "@bufbuild/protovalidate": "^1.1.1",
     "@dagrejs/dagre": "^1.1.4",
-    "@stigmer/plugin-package": "3.29.0",
-    "@stigmer/theme": "3.29.0",
+    "@stigmer/plugin-package": "3.31.0",
+    "@stigmer/theme": "3.31.0",
     "diff": "^8.0.3",
     "fflate": "^0.8.2",
     "hast-util-to-jsx-runtime": "^2.3.6",
@@ -61,8 +61,8 @@
     "@codemirror/state": "^6.0.0",
     "@codemirror/view": "^6.0.0",
     "@lezer/highlight": "^1.0.0",
-    "@stigmer/protos": "3.29.0",
-    "@stigmer/sdk": "3.29.0",
+    "@stigmer/protos": "3.31.0",
+    "@stigmer/sdk": "3.31.0",
     "@tanstack/react-table": "^8.20.0",
     "@xyflow/react": "^12.0.0",
     "elkjs": "^0.9.0",

package/settings/OAuthAppsSection.d.ts

@@ -1,3 +1,11 @@
-/** Settings section for organization OAuth app credentials. */
+/**
+ * Settings section for organization OAuth app credentials.
+ *
+ * "New OAuth app" is offered once the server confirms the caller holds
+ * `can_create_oauth_app` on the organization. The list shows only the apps
+ * the caller may view (each app's creator and the organization's admins),
+ * so a caller who may not create OAuth apps is told that the
+ * organization's admins manage them rather than that none is configured.
+ */
 export declare function OAuthAppsSection(): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=OAuthAppsSection.d.ts.map

package/settings/OAuthAppsSection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthAppsSection.d.ts","sourceRoot":"","sources":["../../src/settings/OAuthAppsSection.tsx"],"names":[],"mappings":"AAgBA,+DAA+D;AAC/D,wBAAgB,gBAAgB,4CAmF/B"}
+{"version":3,"file":"OAuthAppsSection.d.ts","sourceRoot":"","sources":["../../src/settings/OAuthAppsSection.tsx"],"names":[],"mappings":"AAkBA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,4CA2F/B"}

package/settings/OAuthAppsSection.js

@@ -4,14 +4,28 @@ import { useCallback, useId, useRef, useState } from "react";
 import { OAuthAppListPanel } from "../oauth-app/OAuthAppListPanel.js";
 import { CreateOAuthAppForm } from "../oauth-app/CreateOAuthAppForm.js";
 import { OAuthAppDetailPanel } from "../oauth-app/OAuthAppDetailPanel.js";
+import { OAUTH_APPS_MANAGED_BY_ADMINS } from "../oauth-app/copy.js";
 import { useResourceAvailable, ApiResourceKind } from "../deployment-mode.js";
+import { useCheckPermission } from "../iam-policy/useCheckPermission.js";
 import { CloudFeatureNotice } from "../internal/CloudFeatureNotice.js";
-import { useActiveOrgSlug } from "../organization/OrgProvider.js";
-/** Settings section for organization OAuth app credentials. */
+import { useActiveOrgId, useActiveOrgSlug } from "../organization/OrgProvider.js";
+/**
+ * Settings section for organization OAuth app credentials.
+ *
+ * "New OAuth app" is offered once the server confirms the caller holds
+ * `can_create_oauth_app` on the organization. The list shows only the apps
+ * the caller may view (each app's creator and the organization's admins),
+ * so a caller who may not create OAuth apps is told that the
+ * organization's admins manage them rather than that none is configured.
+ */
 export function OAuthAppsSection() {
     const headingId = useId();
     const org = useActiveOrgSlug();
+    const orgId = useActiveOrgId();
     const oauthAppsAvailable = useResourceAvailable(ApiResourceKind.oauth_app);
+    const createCheck = useCheckPermission(oauthAppsAvailable && orgId ? { kind: "organization", id: orgId } : null, "can_create_oauth_app");
+    const canCreate = !createCheck.isLoading && createCheck.allowed;
+    const deniedCreate = !createCheck.isLoading && !createCheck.allowed;
     const [flow, setFlow] = useState({ phase: "idle" });
     const listRefetchRef = useRef(null);
     const handleRefetchRef = useCallback((refetch) => {
@@ -29,6 +43,6 @@ export function OAuthAppsSection() {
         listRefetchRef.current?.();
         setFlow({ phase: "idle" });
     }, []);
-    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "OAuth Apps" }), oauthAppsAvailable && org && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New OAuth app" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "OAuth app credentials configured for your organization. Create new apps here or bring your own from an MCP server's detail page." }), !oauthAppsAvailable ? (_jsx(CloudFeatureNotice, { children: "OAuth apps are not available in local mode. Bring-your-own-app OAuth requires the cloud platform." })) : flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreateOAuthAppForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(OAuthAppDetailPanel, { oauthApp: flow.oauthApp, onUpdated: handleUpdated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(OAuthAppListPanel, { org: org, onEdit: (app) => setFlow({ phase: "editing", oauthApp: app }), onRefetchRef: handleRefetchRef }))] }));
+    return (_jsxs("section", { "aria-labelledby": headingId, children: [_jsxs("div", { className: "stg:mb-3 stg:flex stg:items-center stg:justify-between", children: [_jsx("h2", { id: headingId, className: "stg:text-foreground stg:text-sm stg:font-semibold", children: "OAuth Apps" }), oauthAppsAvailable && org && canCreate && flow.phase === "idle" && (_jsx("button", { type: "button", onClick: () => setFlow({ phase: "creating" }), className: "stg:text-primary stg:hover:text-foreground stg:text-xs stg:font-medium stg:transition-colors", children: "+ New OAuth app" }))] }), _jsx("p", { className: "stg:text-muted-foreground stg:mb-4 stg:text-xs", children: "OAuth app credentials configured for your organization. Create new apps here or bring your own from an MCP server's detail page." }), !oauthAppsAvailable ? (_jsx(CloudFeatureNotice, { children: "OAuth apps are not available in local mode. Bring-your-own-app OAuth requires the cloud platform." })) : flow.phase === "creating" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(CreateOAuthAppForm, { org: org, onCreated: handleCreated, onCancel: () => setFlow({ phase: "idle" }) }) })) : flow.phase === "editing" ? (_jsx("div", { className: "stg:border-border stg:bg-card stg:rounded-lg stg:border stg:p-4", children: _jsx(OAuthAppDetailPanel, { oauthApp: flow.oauthApp, onUpdated: handleUpdated, onDeleted: handleDeleted, onBack: () => setFlow({ phase: "idle" }) }) })) : (_jsx(OAuthAppListPanel, { org: org, onEdit: (app) => setFlow({ phase: "editing", oauthApp: app }), onRefetchRef: handleRefetchRef, emptyState: deniedCreate ? OAUTH_APPS_MANAGED_BY_ADMINS : undefined }))] }));
 }
 //# sourceMappingURL=OAuthAppsSection.js.map

package/settings/OAuthAppsSection.js.map

@@ -1 +1 @@
-{"version":3,"file":"OAuthAppsSection.js","sourceRoot":"","sources":["../../src/settings/OAuthAppsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAOlE,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAE3E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,2BAG1D,EAEJ,kBAAkB,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CACrD,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,gCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,iJAGzD,EAEH,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACrB,KAAC,kBAAkB,oHAGE,CACtB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC9B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,kBAAkB,IACjB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,mBAAmB,IAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAC7D,YAAY,EAAE,gBAAgB,GAC9B,CACH,IACO,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"OAuthAppsSection.js","sourceRoot":"","sources":["../../src/settings/OAuthAppsSection.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAOlF;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,SAAS,GAAG,KAAK,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3E,MAAM,WAAW,GAAG,kBAAkB,CACpC,kBAAkB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EACxE,sBAAsB,CACvB,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC;IAChE,MAAM,YAAY,GAAG,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;IAEpE,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAsB,IAAI,CAAC,CAAC;IAEzD,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,OAAmB,EAAE,EAAE;QAC3D,cAAc,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,MAAM,aAAa,GAAG,WAAW,CAAC,GAAG,EAAE;QACrC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7B,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO,CACL,sCAA0B,SAAS,aACjC,eAAK,SAAS,EAAC,wDAAwD,aACrE,aACE,EAAE,EAAE,SAAS,EACb,SAAS,EAAC,mDAAmD,2BAG1D,EAEJ,kBAAkB,IAAI,GAAG,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,CAClE,iBACE,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAC7C,SAAS,EAAC,8FAA8F,gCAGjG,CACV,IACG,EACN,YAAG,SAAS,EAAC,gDAAgD,iJAGzD,EAEH,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACrB,KAAC,kBAAkB,oHAGE,CACtB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,CAC9B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,kBAAkB,IACjB,GAAG,EAAE,GAAG,EACR,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GAC1C,GACE,CACP,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAC7B,cAAK,SAAS,EAAC,iEAAiE,YAC9E,KAAC,mBAAmB,IAClB,QAAQ,EAAE,IAAI,CAAC,QAAQ,EACvB,SAAS,EAAE,aAAa,EACxB,SAAS,EAAE,aAAa,EACxB,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,GACxC,GACE,CACP,CAAC,CAAC,CAAC,CACF,KAAC,iBAAiB,IAChB,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAC7D,YAAY,EAAE,gBAAgB,EAC9B,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS,GACnE,CACH,IACO,CACX,CAAC;AACJ,CAAC"}

package/src/execution/McpToolDetail.tsx

@@ -2,6 +2,7 @@
 
 import { useMemo, useState } from "react";
 import type { ToolCall } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { redactSecretArgs } from "@stigmer/sdk";
 import { cn } from "@stigmer/theme";
 import { TruncatedText } from "../internal/truncated-text.js";
 import { formatDuration } from "./ToolCallDetail.js";
@@ -247,10 +248,13 @@ export interface McpArgsViewProps {
  * Renders MCP tool arguments as a structured key-value list.
  *
  * Scalars display inline; objects and arrays collapse into
- * formatted JSON blocks via {@link CollapsibleJsonBlock}.
+ * formatted JSON blocks via {@link CollapsibleJsonBlock}. A secret-keyed
+ * value renders as `[REDACTED]` (`redactSecretArgs`): the runner redacts a
+ * row's `args` at creation, but a row persisted before it did (stigmer#1119)
+ * still carries the value, and this is where it would become visible.
  */
 export function McpArgsView({ args }: McpArgsViewProps) {
-  const entries = Object.entries(args);
+  const entries = Object.entries(redactSecretArgs(args));
   if (entries.length === 0) return null;
 
   const scalars: [string, string][] = [];

package/src/execution/ToolArgsView.tsx

@@ -1,6 +1,7 @@
 "use client";
 
 import { useMemo } from "react";
+import { isSecretArgKey, redactSecretArgs } from "@stigmer/sdk";
 import { cn } from "@stigmer/theme";
 import {
   resolveToolCategory,
@@ -229,9 +230,11 @@ function McpArgsPreview({
   );
 }
 
+// Secret-keyed values are hidden here, at the sink: a row persisted before the
+// runner redacted `args` (stigmer#1119) still carries them.
 function GenericArgsView({ args }: { args: Record<string, unknown> }) {
   return (
-    <CollapsibleCode label="Arguments" content={formatJson(args)} />
+    <CollapsibleCode label="Arguments" content={formatJson(redactSecretArgs(args))} />
   );
 }
 
@@ -261,10 +264,12 @@ function extractPrimaryArgValue(
     if (v) return v;
   }
 
+  // The first argument that is not a secret: a secret is never a title
+  // (stigmer#1119), and `[REDACTED]` would read as content.
   if (info.category === "unknown" || info.category === "mcp") {
-    const keys = Object.keys(args);
-    if (keys.length > 0) {
-      const val = args[keys[0]];
+    const first = Object.keys(args).find((key) => !isSecretArgKey(key));
+    if (first !== undefined) {
+      const val = args[first];
       if (typeof val === "string") return val;
     }
   }

package/src/execution/__tests__/secret-args.test.tsx

@@ -0,0 +1,81 @@
+/**
+ * A settled tool-call row never shows a secret-keyed argument (stigmer#1119).
+ *
+ * The runner redacts a row's `args` at creation, but rows persisted before it
+ * did still carry the values, so every sink that renders `args` hides them
+ * through `@stigmer/sdk`'s `redactSecretArgs` / `isSecretArgKey` — the reader
+ * side of test/fixtures/tool-view/secret-args.json. Each case renders a row as
+ * an older runner stored it, with the secret in clear.
+ */
+
+import { describe, it, expect, afterEach } from "vitest";
+import { render, cleanup } from "@testing-library/react";
+import { create, type JsonObject } from "@bufbuild/protobuf";
+import {
+  ToolCallSchema,
+  type ToolCall,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/message_pb";
+import { ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/enum_pb";
+import { McpToolDetail } from "../McpToolDetail";
+import { ToolArgsView } from "../ToolArgsView";
+import { ToolCallDetail } from "../ToolCallDetail";
+import { extractPrimaryArg } from "../tool-categories";
+
+afterEach(cleanup);
+
+const SECRET = "s3cret-value";
+
+function settledRow(name: string, mcpServerSlug: string, args: Record<string, unknown>): ToolCall {
+  return create(ToolCallSchema, {
+    id: "tc-1",
+    name,
+    mcpServerSlug,
+    args: args as JsonObject,
+    result: "ok",
+    status: ToolCallStatus.TOOL_CALL_COMPLETED,
+  });
+}
+
+describe("the detail views hide a secret-keyed argument and keep the rest", () => {
+  it("McpToolDetail's argument list", () => {
+    const { container } = render(
+      <McpToolDetail toolCall={settledRow("push", "github", { token: SECRET, repo: "acme/x" })} />,
+    );
+    expect(container.textContent).not.toContain(SECRET);
+    expect(container.textContent).toContain("[REDACTED]");
+    expect(container.textContent).toContain("acme/x");
+  });
+
+  it("ToolArgsView's MCP branch", () => {
+    const { container } = render(
+      <ToolArgsView toolName="push" mcpServerSlug="github" args={{ Api_Key: SECRET, repo: "acme/x" }} />,
+    );
+    expect(container.textContent).not.toContain(SECRET);
+    expect(container.textContent).toContain("acme/x");
+  });
+
+  it("ToolArgsView's generic branch, and ToolCallDetail through it", () => {
+    const args = { authorization: SECRET, region: "eu-west-1" };
+    const view = render(<ToolArgsView toolName="mystery_tool" args={args} />);
+    expect(view.container.textContent).not.toContain(SECRET);
+    expect(view.container.textContent).toContain("eu-west-1");
+    cleanup();
+
+    const detail = render(<ToolCallDetail toolCall={settledRow("mystery_tool", "", args)} />);
+    expect(detail.container.textContent).not.toContain(SECRET);
+  });
+});
+
+describe("the row title never falls back to a secret", () => {
+  it("skips a secret first argument for the next argument", () => {
+    expect(extractPrimaryArg(settledRow("push", "github", { token: SECRET, repo: "acme/x" }))).toBe("acme/x");
+  });
+
+  it("has no title argument when every argument is secret", () => {
+    expect(extractPrimaryArg(settledRow("push", "github", { password: SECRET }))).toBeNull();
+  });
+
+  it("keeps the first argument when it is not secret", () => {
+    expect(extractPrimaryArg(settledRow("push", "github", { repo: "acme/x", token: SECRET }))).toBe("acme/x");
+  });
+});

package/src/execution/tool-categories.ts

@@ -3,6 +3,7 @@ import { ToolCallStatus } from "@stigmer/protos/ai/stigmer/agentic/agentexecutio
 import type { JsonObject } from "@bufbuild/protobuf";
 import {
   ToolKind,
+  isSecretArgKey,
   resolveToolKind,
   resolveToolKindByName,
   shellIntentFromArgs,
@@ -414,10 +415,12 @@ export function extractPrimaryArg(toolCall: ToolCall): string | null {
 
   if (result) return result;
 
+  // The first argument that is not a secret: a secret is never a row title
+  // (stigmer#1119), and `[REDACTED]` would read as content.
   if ((info.category === "unknown" || info.category === "mcp") && toolCall.args) {
-    const keys = Object.keys(toolCall.args);
-    if (keys.length > 0) {
-      const val = toolCall.args[keys[0]];
+    const first = Object.keys(toolCall.args).find((key) => !isSecretArgKey(key));
+    if (first !== undefined) {
+      const val = toolCall.args[first];
       if (typeof val === "string") return val;
     }
   }

package/src/oauth-app/OAuthAppDetailPanel.tsx

@@ -11,6 +11,7 @@ import {
 import { timestampDate, type Timestamp } from "@bufbuild/protobuf/wkt";
 import { useUpdateOAuthApp } from "./useUpdateOAuthApp.js";
 import { useDeleteOAuthApp } from "./useDeleteOAuthApp.js";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 
 // ---------------------------------------------------------------------------
@@ -35,7 +36,11 @@ export interface OAuthAppDetailPanelProps {
  * View and edit panel for an existing OAuth app.
  *
  * In **view mode**, displays all OAuth configuration fields in a
- * structured label/value layout with "Edit" and "Delete" buttons.
+ * structured label/value layout, with an "Edit" button for a caller who
+ * may edit the app (`can_edit`) and a "Delete" button for one who may
+ * delete it (`can_delete`). Both belong to the app's creator alone: the
+ * organization's admins may view an app they did not create, never change
+ * it.
  *
  * In **edit mode**, fields become editable inputs. The client secret
  * field shows a placeholder — leave it empty to keep the existing
@@ -223,31 +228,41 @@ export function OAuthAppDetailPanel({
 
         {mode === "view" && (
           <div className="stg:flex stg:items-center stg:gap-1">
-            <button
-              type="button"
-              onClick={enterEdit}
-              className={cn(
-                "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
-                "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
-                "stg:transition-colors",
-              )}
+            <PermissionGate
+              resource={{ kind: "oauth_app", id: meta?.id ?? "" }}
+              relation="can_edit"
             >
-              Edit
-            </button>
-            <button
-              type="button"
-              onClick={() => {
-                clearDeleteError();
-                setConfirmingDelete(true);
-              }}
-              className={cn(
-                "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
-                "stg:text-destructive-muted stg:hover:text-destructive stg:hover:bg-destructive-subtle",
-                "stg:transition-colors",
-              )}
+              <button
+                type="button"
+                onClick={enterEdit}
+                className={cn(
+                  "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
+                  "stg:text-muted-foreground stg:hover:text-foreground stg:hover:bg-accent-hover",
+                  "stg:transition-colors",
+                )}
+              >
+                Edit
+              </button>
+            </PermissionGate>
+            <PermissionGate
+              resource={{ kind: "oauth_app", id: meta?.id ?? "" }}
+              relation="can_delete"
             >
-              Delete
-            </button>
+              <button
+                type="button"
+                onClick={() => {
+                  clearDeleteError();
+                  setConfirmingDelete(true);
+                }}
+                className={cn(
+                  "stg:shrink-0 stg:rounded-md stg:px-2.5 stg:py-1.5 stg:text-xs stg:font-medium",
+                  "stg:text-destructive-muted stg:hover:text-destructive stg:hover:bg-destructive-subtle",
+                  "stg:transition-colors",
+                )}
+              >
+                Delete
+              </button>
+            </PermissionGate>
           </div>
         )}
       </div>

package/src/oauth-app/OAuthAppListPanel.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import type { ReactNode } from "react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
@@ -23,13 +24,20 @@ export interface OAuthAppListPanelProps {
   readonly onEdit?: (app: OAuthApp) => void;
   /** Re-expose refetch so parents can trigger a list refresh. */
   readonly onRefetchRef?: (refetch: () => void) => void;
+  /**
+   * Shown when the list is empty. Defaults to "No OAuth apps configured
+   * yet." The list holds only the apps the caller may view (each app's
+   * creator and the organization's admins), so a host that knows the
+   * caller may not manage OAuth apps should say who does instead.
+   */
+  readonly emptyState?: ReactNode;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
 }
 
 /**
- * Displays a list of {@link OAuthApp} resources owned by an
- * organization.
+ * Displays the {@link OAuthApp} resources of an organization that the
+ * caller may view.
  *
  * Each row shows the provider name, client ID (non-secret), and
  * creation date. When `onEdit` is provided, rows include a pencil
@@ -56,6 +64,7 @@ export function OAuthAppListPanel({
   org,
   onEdit,
   onRefetchRef,
+  emptyState = "No OAuth apps configured yet.",
   className,
 }: OAuthAppListPanelProps) {
   const { oauthApps, isLoading, error, refetch } = useOAuthAppList(org);
@@ -97,7 +106,7 @@ export function OAuthAppListPanel({
           className,
         )}
       >
-        No OAuth apps configured yet.
+        {emptyState}
       </p>
     );
   }

package/src/oauth-app/__tests__/OAuthAppDetailPanel.test.tsx

@@ -6,17 +6,24 @@ import {
   type OAuthApp,
 } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/api_pb";
 import { TokenEndpointAuthMethod } from "@stigmer/protos/ai/stigmer/iam/oauthapp/v1/spec_pb";
+import type { CheckMyPermissionInput } from "@stigmer/protos/ai/stigmer/iam/iampolicy/v1/io_pb";
 import type { OAuthAppInput } from "@stigmer/sdk";
 import { StigmerContext } from "../../context";
 import { OAuthAppDetailPanel } from "../OAuthAppDetailPanel";
 
 /**
- * Regression suite for the full-spec-replace wipe bug: the panel must
- * spread `toOAuthAppUpdateInput` and override only what it edits, so a
- * spec field the form does not know about survives the save. The secret
- * has its own contract: an empty secret input sends the fetched value —
- * the server's redaction marker — which the update pipeline treats as
- * "keep the stored secret" (oss#395 pins the marker/ciphertext boundary).
+ * Pins two things about the detail panel:
+ *
+ *   - the full-spec-replace wipe bug: the panel must spread
+ *     `toOAuthAppUpdateInput` and override only what it edits, so a spec
+ *     field the form does not know about survives the save. The secret has
+ *     its own contract: an empty secret input sends the fetched value — the
+ *     server's redaction marker — which the update pipeline treats as "keep
+ *     the stored secret" (oss#395 pins the marker/ciphertext boundary);
+ *   - Edit is offered only with `can_edit` and Delete only with
+ *     `can_delete` on the app, so an organization admin who may view an app
+ *     they did not create is never handed a control the server would
+ *     refuse (both belong to the creator; stigmer/stigmer#1257).
  */
 
 const REDACTED = "***REDACTED***";
@@ -39,9 +46,15 @@ const APP: OAuthApp = create(OAuthAppSchema, {
   },
 });
 
-function renderPanel(update: ReturnType<typeof vi.fn>) {
+function renderPanel(
+  update: ReturnType<typeof vi.fn>,
+  checkMyPermission: ReturnType<typeof vi.fn> = vi.fn(async () => ({
+    isAuthorized: true,
+  })),
+) {
   const client = {
     oauthapp: { update },
+    iamPolicy: { checkMyPermission },
   } as never;
   return render(
     <StigmerContext.Provider value={client}>
@@ -57,7 +70,7 @@ describe("OAuthAppDetailPanel save payload", () => {
     const update = vi.fn(async (_input: OAuthAppInput) => APP);
     renderPanel(update);
 
-    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Edit" }));
     const provider = await screen.findByLabelText("Provider");
     fireEvent.change(provider, { target: { value: "github-enterprise" } });
     fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
@@ -83,7 +96,7 @@ describe("OAuthAppDetailPanel save payload", () => {
     const update = vi.fn(async (_input: OAuthAppInput) => APP);
     renderPanel(update);
 
-    fireEvent.click(screen.getByRole("button", { name: "Edit" }));
+    fireEvent.click(await screen.findByRole("button", { name: "Edit" }));
     const secret = await screen.findByLabelText("Client secret");
     fireEvent.change(secret, { target: { value: "new-secret" } });
     fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
@@ -92,3 +105,38 @@ describe("OAuthAppDetailPanel save payload", () => {
     expect(update.mock.calls[0]![0].clientSecret).toBe("new-secret");
   });
 });
+
+describe("OAuthAppDetailPanel edit and delete gates", () => {
+  it("offers Edit only with can_edit and Delete only with can_delete on the app", async () => {
+    const checkMyPermission = vi.fn(async (input: CheckMyPermissionInput) => ({
+      isAuthorized: input.relation === "can_delete",
+    }));
+    renderPanel(vi.fn(), checkMyPermission);
+
+    await screen.findByRole("button", { name: "Delete" });
+    expect(screen.queryByRole("button", { name: "Edit" })).toBeNull();
+    const asked = checkMyPermission.mock.calls.map(
+      ([input]) =>
+        `${input.resource?.kind}:${input.resource?.id}:${input.relation}`,
+    );
+    expect(asked.sort()).toEqual([
+      "oauth_app:oa-1:can_delete",
+      "oauth_app:oa-1:can_edit",
+    ]);
+  });
+
+  it("an admin who did not create the app reads it with neither control", async () => {
+    const checkMyPermission = vi.fn(async (_input: CheckMyPermissionInput) => ({
+      isAuthorized: false,
+    }));
+    renderPanel(vi.fn(), checkMyPermission);
+
+    await waitFor(() => expect(checkMyPermission).toHaveBeenCalledTimes(2));
+    // The configuration stays readable; only the change affordances are withheld.
+    expect(screen.getByRole("heading", { name: "github" })).toBeTruthy();
+    await waitFor(() =>
+      expect(screen.queryByRole("button", { name: "Edit" })).toBeNull(),
+    );
+    expect(screen.queryByRole("button", { name: "Delete" })).toBeNull();
+  });
+});

package/src/oauth-app/copy.ts

@@ -0,0 +1,16 @@
+/**
+ * OAuth-app copy shared by more than one surface, so the settings section
+ * and anything else that lists an organization's OAuth apps say the same
+ * thing.
+ *
+ * OAuth apps are administrative infrastructure: an app carries its
+ * organization's vendor credentials and endpoints, so its creator and the
+ * organization's admins see it and other members may not see it at all
+ * (stigmer/stigmer#1257). An empty list is therefore not evidence that none
+ * is configured, so a caller who may not create OAuth apps is told who
+ * manages them instead of being told that nothing exists.
+ */
+
+/** Shown in place of the empty state to a caller who may not create OAuth apps. */
+export const OAUTH_APPS_MANAGED_BY_ADMINS =
+  "OAuth apps are managed by your organization's admins.";

package/src/oauth-app/useDeleteOAuthApp.ts

@@ -22,9 +22,10 @@ export interface UseDeleteOAuthAppReturn {
  * state.
  *
  * Deletes an OAuth app by its resource ID. Returns the deleted
- * {@link OAuthApp} on success so callers can confirm which app was
- * removed. The deletion is permanent — any MCP server overrides
- * referencing this app will lose their binding.
+ * {@link OAuthApp} on success, its client secret redacted like every
+ * read, so callers can confirm which app was removed. The deletion is
+ * permanent, and the server refuses it while an MCP server's
+ * `oauth_app_ref` still resolves to the app.
  *
  * @example
  * ```tsx

package/src/oauth-app/useOAuthAppList.ts

@@ -21,11 +21,13 @@ export interface UseOAuthAppListReturn {
 }
 
 /**
- * Data hook that fetches all {@link OAuthApp} entries for an organization.
+ * Data hook that fetches the {@link OAuthApp} entries of an organization
+ * that the caller may view.
  *
- * Returns every OAuthApp whose `metadata.org` matches the input. In
- * practice these are the BYOA OAuth apps created through the "Bring
- * your own app" flow on MCP server detail pages.
+ * Returns the organization's OAuthApps that a `get` would return to the
+ * caller: each app's creator and the organization's admins see it, other
+ * members and viewers see none. In practice these are the BYOA OAuth apps
+ * created through the "Bring your own app" flow on MCP server detail pages.
  *
  * Pass `null` for `org` to skip fetching (stable no-op). Useful when
  * the active organization has not been resolved yet.