@stigmer/react 3.4.1 → 3.5.1

package/src/mcp-server/StdioSandboxNotice.tsx

@@ -11,9 +11,10 @@ type McpServerType = McpServerSpec["serverType"];
 /**
  * Whether an MCP server's transport is stdio while connected to Stigmer Cloud.
  *
- * stdio servers run as a subprocess inside an isolated Daytona sandbox in the
- * cloud — not on the user's own computer. This predicate identifies exactly
- * that combination so the connect UI can set accurate expectations. HTTP
+ * stdio is local-runner-only: cloud-hosted sessions refuse stdio servers at
+ * execution create, and the cloud connect flow refuses to spawn them. This
+ * predicate identifies exactly that combination so the UI can explain the
+ * policy and its remediation (run the session on a local runner). HTTP
  * servers and any transport in local mode return `false`.
  *
  * Pure and framework-free so it can be unit-tested without rendering.
@@ -34,15 +35,15 @@ export interface StdioSandboxNoticeProps {
 }
 
 /**
- * Sets accurate expectations for connecting an **stdio** MCP server from
- * **Stigmer Cloud**.
+ * Explains the local-runner-only policy for an **stdio** MCP server viewed
+ * from **Stigmer Cloud**.
  *
- * stdio servers are a supported cloud capability — Stigmer runs them in an
- * isolated Daytona sandbox. But that sandbox is not the user's own machine,
- * so a server that expects access to local files, applications, or a private
- * network (e.g. a filesystem server) won't behave as the user intends. This
- * notice explains that up front; Connect itself stays enabled because
- * self-contained servers work fine.
+ * stdio servers spawn subprocesses on the machine that runs the agent, so
+ * they run only on local runners — Stigmer-managed cloud compute refuses
+ * them (at execution create, and in the connect flow). The server remains
+ * fully usable on sessions that execute on a local runner (desktop app,
+ * `stigmer server`), where tools are discovered automatically at session
+ * start. This notice states that up front so the refusal never surprises.
  *
  * Self-gating: reads the deployment mode from context and renders `null`
  * unless the server is stdio and the backend is cloud. Callers render it
@@ -68,9 +69,10 @@ export function StdioSandboxNotice({
     >
       <SandboxIcon className="mt-0.5 size-4 shrink-0" />
       <p className="text-xs leading-relaxed">
-        This stdio server runs in an isolated cloud sandbox, not on your own
-        computer. Tools that need access to your local files, applications, or
-        private network won&apos;t be available here.
+        This stdio server runs only on local runners — it won&apos;t be
+        available to sessions on Stigmer-managed cloud compute. Run the
+        session on a local runner (desktop app or CLI) to use it, or choose
+        a remote (HTTP) server instead.
       </p>
     </div>
   );

package/src/mcp-server/__tests__/StdioSandboxNotice.test.tsx

@@ -44,10 +44,11 @@ function withMode(mode: "cloud" | "local", children: ReactNode) {
 }
 
 describe("StdioSandboxNotice", () => {
-  it("renders the sandbox-isolation caveat for stdio in cloud", () => {
+  it("renders the local-runner-only policy for stdio in cloud", () => {
     render(withMode("cloud", <StdioSandboxNotice serverType={STDIO} />));
     expect(screen.getByRole("status")).toBeTruthy();
-    expect(screen.getByText(/isolated cloud sandbox/i)).toBeTruthy();
+    expect(screen.getByText(/only on local runners/i)).toBeTruthy();
+    expect(screen.getByText(/remote \(HTTP\) server/i)).toBeTruthy();
   });
 
   it("does not suggest the CLI (avoids inaccurate guidance)", () => {

package/src/mcp-server/steps/IdentityTransportStep.tsx

@@ -223,6 +223,13 @@ export function IdentityTransportStep({
             onChange={() => updateData({ transportType: "stdio" })}
           />
         </div>
+        {data.transportType === "stdio" && (
+          <p className="text-xs text-muted-foreground">
+            Stdio servers run only on local runners (desktop app or CLI).
+            Sessions on Stigmer-managed cloud compute require a remote (HTTP)
+            server.
+          </p>
+        )}
 
         {/* HTTP fields */}
         {data.transportType === "http" && (

package/src/resource-creation/templates/mcp-server-templates.ts

@@ -62,41 +62,44 @@ export const MCP_SERVER_TEMPLATES: readonly ResourceTemplate<McpServerWizardData
       },
     },
     {
-      id: "postgresql",
-      name: "PostgreSQL",
+      id: "neon",
+      name: "Neon",
       description:
-        "Connect to a PostgreSQL database for querying, schema inspection, and data management.",
+        "Connect to Neon's hosted MCP endpoint for serverless PostgreSQL — querying, schema inspection, and branch management.",
       category: "integration",
-      tags: ["postgres", "postgresql", "database", "sql", "data"],
+      tags: ["neon", "postgres", "postgresql", "database", "sql", "data"],
       data: {
-        name: "PostgreSQL",
+        name: "Neon",
         description:
-          "PostgreSQL database connection for querying, schema inspection, and data management.",
-        transportType: "stdio",
-        stdioCommand: "npx",
-        stdioArgs: "-y @modelcontextprotocol/server-postgres",
+          "Neon serverless PostgreSQL — querying, schema inspection, database provisioning, and branch management.",
+        transportType: "http",
+        httpUrl: "https://mcp.neon.tech/mcp",
         env: [
           {
-            key: "DATABASE_URL",
+            key: "NEON_API_KEY",
             description:
-              "PostgreSQL connection string (e.g. postgresql://user:pass@host:5432/db).",
+              "Neon API key (generate at console.neon.tech/app/settings/api-keys).",
             isSecret: true,
             optional: false,
           },
         ],
       },
     },
+    // Deliberately stdio: the canonical example of a tool that must run on
+    // the user's own machine. Stdio servers are local-runner-only — the
+    // wizard's transport step states this, and cloud-targeted sessions
+    // refuse them at execution create.
     {
       id: "filesystem",
-      name: "Filesystem",
+      name: "Filesystem (local runners)",
       description:
-        "Provide read and write access to a local directory for file management and content operations.",
+        "Provide read and write access to a local directory for file management and content operations. Runs on local runners only.",
       category: "general",
       tags: ["filesystem", "files", "local", "directory"],
       data: {
         name: "Filesystem",
         description:
-          "Local filesystem access for reading, writing, and managing files within a directory.",
+          "Local filesystem access for reading, writing, and managing files within a directory. Stdio transport — runs on local runners only.",
         transportType: "stdio",
         stdioCommand: "npx",
         stdioArgs:

package/src/session/__tests__/useSessionExecutions.test.ts

@@ -0,0 +1,63 @@
+import { describe, it, expect } from "vitest";
+import { create } from "@bufbuild/protobuf";
+import {
+  AgentExecutionSchema,
+  type AgentExecution,
+} from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/api_pb";
+import { ApiResourceMetadataSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/metadata_pb";
+import { sortChronologically } from "../useSessionExecutions";
+
+function exec(id: string): AgentExecution {
+  const e = create(AgentExecutionSchema);
+  const metadata = create(ApiResourceMetadataSchema);
+  metadata.id = id;
+  e.metadata = metadata;
+  return e;
+}
+
+function ids(list: readonly AgentExecution[]): string[] {
+  return list.map((e) => e.metadata?.id ?? "");
+}
+
+describe("sortChronologically", () => {
+  it("orders executions oldest-first by their ULID id", () => {
+    // Real ids from the pilot session, returned by the server in scrambled
+    // heap order — the afternoon turns (…vk…) interleaved with the evening
+    // turns (…w3…/…w4…). Chronological order is ascending ULID.
+    const scrambled = [
+      exec("aex_01kyw3zeq8cre6cc8gznf31y13"),
+      exec("aex_01kyvk1hxyrhch1q23p5j177pb"),
+      exec("aex_01kyw416w9mg6ezzpkc6q9y71x"),
+      exec("aex_01kyvk2sh0vjc69c7z3q4c9r1m"),
+      exec("aex_01kyw45qkf88x28pf9bxmrr3bf"),
+      exec("aex_01kyw3y0rfx9vd7dhnawgqgnb0"),
+      exec("aex_01kyvk3v34vh9phedx2ezajxtr"),
+    ];
+
+    expect(ids(sortChronologically(scrambled))).toEqual([
+      "aex_01kyvk1hxyrhch1q23p5j177pb",
+      "aex_01kyvk2sh0vjc69c7z3q4c9r1m",
+      "aex_01kyvk3v34vh9phedx2ezajxtr",
+      "aex_01kyw3y0rfx9vd7dhnawgqgnb0",
+      "aex_01kyw3zeq8cre6cc8gznf31y13",
+      "aex_01kyw416w9mg6ezzpkc6q9y71x",
+      "aex_01kyw45qkf88x28pf9bxmrr3bf",
+    ]);
+  });
+
+  it("does not mutate the input array", () => {
+    const input = [exec("aex_02"), exec("aex_01")];
+    const before = ids(input);
+    sortChronologically(input);
+    expect(ids(input)).toEqual(before);
+  });
+
+  it("sorts entries missing an id last", () => {
+    const list = [exec("aex_02"), exec(""), exec("aex_01")];
+    expect(ids(sortChronologically(list))).toEqual(["aex_01", "aex_02", ""]);
+  });
+
+  it("returns an empty array unchanged", () => {
+    expect(sortChronologically([])).toEqual([]);
+  });
+});

package/src/session/useSessionExecutions.ts

@@ -71,6 +71,32 @@ export interface UseSessionExecutionsReturn {
  * const { executions } = useSessionExecutions(sessionId ?? null);
  * ```
  */
+/**
+ * Returns the executions in chronological (oldest-first) order — the order
+ * the conversation thread renders top-to-bottom.
+ *
+ * Defense-in-depth against an unordered list response: the executions ARE the
+ * transcript, so a scrambled order drops the newest turns out of view (they no
+ * longer sort to the bottom). The server orders this list, but the thread must
+ * never depend on that alone. Resource ids are time-sortable ULIDs
+ * (`aex_01k…`), so an ascending id sort is creation order without parsing
+ * timestamps; entries missing an id sort last but keep a stable relative order.
+ *
+ * @internal Exported for testing — not part of the public API.
+ */
+export function sortChronologically(
+  executions: readonly AgentExecution[],
+): AgentExecution[] {
+  return [...executions].sort((a, b) => {
+    const aId = a.metadata?.id ?? "";
+    const bId = b.metadata?.id ?? "";
+    if (aId === bId) return 0;
+    if (!aId) return 1;
+    if (!bId) return -1;
+    return aId < bId ? -1 : 1;
+  });
+}
+
 export function useSessionExecutions(
   sessionId: string | null,
   options?: UseSessionExecutionsOptions,
@@ -87,7 +113,7 @@ export function useSessionExecutions(
                 pageSize: 100,
               }),
             )
-            .then((result) => result.entries)
+            .then((result) => sortChronologically(result.entries))
       : null,
     [sessionId, stigmer],
     [] as AgentExecution[],

package/src/sidebar/SettingsSidebar.tsx

@@ -0,0 +1,173 @@
+"use client";
+
+import type { ReactNode } from "react";
+import { ArrowLeft } from "lucide-react";
+import type { Organization } from "@stigmer/protos/ai/stigmer/tenancy/organization/v1/api_pb";
+import type { SettingsNavGroup } from "../settings/settings-nav.js";
+import { SidebarChrome, SidebarSeparator, navRowClassName } from "./chrome.js";
+import type { RenderSidebarLink } from "./types.js";
+
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+
+/** Props for {@link SettingsSidebar}. */
+export interface SettingsSidebarProps {
+  /**
+   * Grouped settings navigation to render. The console passes
+   * `useSettingsNavGroups()` (permission-aware); deterministic hosts
+   * pass `SETTINGS_NAV_GROUPS` or a fixture subset.
+   */
+  readonly groups: readonly SettingsNavGroup[];
+  /**
+   * Current pathname for active-row matching: a row is active when the
+   * path equals its `href` or sits under `href + "/"`. Omit for hosts
+   * with no location (deterministic embeds pass the depicted route).
+   */
+  readonly activePath?: string | null;
+  /** Renders each interactive row. See {@link RenderSidebarLink}. */
+  readonly renderLink: RenderSidebarLink;
+  /**
+   * "Back to Sessions" target — the last workspace-zone location, so
+   * leaving settings restores where the user was. @default "/"
+   */
+  readonly backHref?: string;
+  /** Footer content — typically the host app's `UserMenu` wrapper. */
+  readonly footer: ReactNode;
+  /** Reflected as `aria-expanded` on the collapse toggle. @default true */
+  readonly isOpen?: boolean;
+  /** Called when the collapse toggle is pressed. */
+  readonly onCollapse?: () => void;
+  /** Passed through to the embedded `OrgSwitcher`. */
+  readonly onOrgChanged?: (org: Organization) => void;
+}
+
+/**
+ * The console's settings-zone (management) sidebar: org switcher, a
+ * "Back to Sessions" exit, and grouped settings navigation driven by
+ * the SDK's settings-nav model, with a user footer.
+ *
+ * Like {@link WorkspaceSidebar}, this is the exact component the web
+ * console, desktop app, and documentation tours all render; hosts vary
+ * only `renderLink`, `groups`, and the `footer` slot.
+ *
+ * Row identifiers passed to `renderLink` are the settings route
+ * basenames (`"api-keys"`, `"members"`, …) plus `"back-to-sessions"`,
+ * so consumers can address specific rows without parsing hrefs.
+ *
+ * @example
+ * ```tsx
+ * <SettingsSidebar
+ *   groups={useSettingsNavGroups()}
+ *   activePath={usePathname()}
+ *   backHref={lastSessionZonePath ?? "/"}
+ *   renderLink={({ href, children, ...rest }) => (
+ *     <Link href={href} {...rest}>{children}</Link>
+ *   )}
+ *   footer={<UserMenu />}
+ * />
+ * ```
+ */
+export function SettingsSidebar({
+  groups,
+  activePath = null,
+  renderLink,
+  backHref = "/",
+  footer,
+  isOpen = true,
+  onCollapse,
+  onOrgChanged,
+}: SettingsSidebarProps) {
+  return (
+    <SidebarChrome
+      ariaLabel="Management navigation"
+      isOpen={isOpen}
+      onCollapse={onCollapse}
+      onOrgChanged={onOrgChanged}
+      footer={footer}
+    >
+      {/* Back to Sessions */}
+      <div className="flex-none px-3 py-1">
+        {renderLink({
+          id: "back-to-sessions",
+          href: backHref,
+          active: false,
+          className: navRowClassName(false, { muted: true }),
+          "aria-current": undefined,
+          children: (
+            <>
+              <ArrowLeft className="size-4 shrink-0" />
+              Back to Sessions
+            </>
+          ),
+        })}
+      </div>
+
+      <SidebarSeparator />
+
+      {/* Settings nav links — grouped, permission-aware via `groups` */}
+      <div className="flex flex-col gap-4 px-3 py-1">
+        {groups.map((group) => (
+          <div key={group.label} className="flex flex-col gap-0.5">
+            <span className="text-sidebar-muted-foreground px-2 pb-1 text-[11px] font-medium tracking-wider uppercase">
+              {group.label}
+            </span>
+            {group.items.map((item) => {
+              const active =
+                activePath != null &&
+                (activePath === item.href ||
+                  activePath.startsWith(`${item.href}/`));
+
+              return (
+                <SettingsNavRow
+                  key={item.href}
+                  href={item.href}
+                  label={item.label}
+                  icon={<item.icon className="size-4 shrink-0" />}
+                  active={active}
+                  renderLink={renderLink}
+                />
+              );
+            })}
+          </div>
+        ))}
+      </div>
+
+      {/* Spacer pushes the footer to the bottom (no scrollable middle). */}
+      <div className="flex-1" />
+    </SidebarChrome>
+  );
+}
+
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+
+function SettingsNavRow({
+  href,
+  label,
+  icon,
+  active,
+  renderLink,
+}: {
+  readonly href: string;
+  readonly label: string;
+  readonly icon: ReactNode;
+  readonly active: boolean;
+  readonly renderLink: RenderSidebarLink;
+}) {
+  return renderLink({
+    // Route basename as the stable id: "/settings/api-keys" → "api-keys".
+    id: href.slice(href.lastIndexOf("/") + 1),
+    href,
+    active,
+    className: navRowClassName(active),
+    "aria-current": active ? "page" : undefined,
+    children: (
+      <>
+        {icon}
+        {label}
+      </>
+    ),
+  });
+}