@stigmer/react 3.40.0 → 3.41.0

package/src/channel-app/ChannelAppDetailPanel.tsx

@@ -4,7 +4,7 @@ import { type FormEvent, useCallback, useId, useMemo, useState } from "react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage, toChannelAppUpdateInput } from "@stigmer/sdk";
 import type { ChannelApp } from "@stigmer/protos/ai/stigmer/agentic/channelapp/v1/api_pb";
-import { useStigmer } from "../hooks.js";
+import { usePublicBaseUrl } from "../public-base-url-context.js";
 import { useUpdateChannelApp } from "./useUpdateChannelApp.js";
 import { useDeleteChannelApp } from "./useDeleteChannelApp.js";
 import type { ChannelAppCreateHandoff } from "./CreateChannelAppForm.js";
@@ -17,7 +17,8 @@ import {
   WHATSAPP_CHANNEL_APP_WEBHOOK_FIELDS,
   whatsappChannelAppWebhookUrl,
 } from "./whatsappAppSetup.js";
-import { CopyBlock, CopyRow, FormField } from "./internal.js";
+import { CopyBlock, CopyRow, FormField, UnknownAddressRow } from "./internal.js";
+import { PermissionGate } from "../iam-policy/PermissionGate.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 
 // ---------------------------------------------------------------------------
@@ -66,6 +67,11 @@ export interface ChannelAppDetailPanelProps {
  * untouched preserves the stored values (rotate one secret without
  * re-entering the others). Deletion is refused server-side while any
  * agent channel still installs through this app.
+ *
+ * The credentials form is offered to a caller who may edit the app
+ * (`can_edit`) and the deletion section to one who may delete it
+ * (`can_delete`): the organization's admins. Someone granted viewer on an
+ * app sees its setup values with no actions.
  */
 export function ChannelAppDetailPanel({
   channelApp,
@@ -127,50 +133,55 @@ export function ChannelAppDetailPanel({
       ) : null}
 
       {/* Deletion */}
-      <section className="stg:border-t stg:border-border stg:pt-3" aria-label="Danger zone">
-        {deleteError && (
-          <p className="stg:text-destructive stg:mb-2 stg:text-[0.65rem]" role="alert">
-            {getUserMessage(deleteError)}
-          </p>
-        )}
-        {confirmingDelete ? (
-          <div className="stg:flex stg:items-center stg:gap-2">
-            <p className="stg:text-xs stg:text-foreground">
-              Delete this channel app? Channels installing through it must be
-              disconnected first.
+      <PermissionGate
+        resource={{ kind: "channel_app", id: appId }}
+        relation="can_delete"
+      >
+        <section className="stg:border-t stg:border-border stg:pt-3" aria-label="Danger zone">
+          {deleteError && (
+            <p className="stg:text-destructive stg:mb-2 stg:text-[0.65rem]" role="alert">
+              {getUserMessage(deleteError)}
             </p>
+          )}
+          {confirmingDelete ? (
+            <div className="stg:flex stg:items-center stg:gap-2">
+              <p className="stg:text-xs stg:text-foreground">
+                Delete this channel app? Channels installing through it must be
+                disconnected first.
+              </p>
+              <button
+                type="button"
+                onClick={handleDelete}
+                disabled={isDeleting}
+                className={cn(
+                  "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-2.5 stg:py-1 stg:text-xs stg:font-medium",
+                  "stg:bg-destructive stg:text-destructive-foreground stg:hover:opacity-90",
+                  "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+                )}
+              >
+                {isDeleting && <SpinnerIcon size={12} />}
+                Delete
+              </button>
+              <button
+                type="button"
+                onClick={() => setConfirmingDelete(false)}
+                disabled={isDeleting}
+                className="stg:text-muted-foreground stg:hover:text-foreground stg:text-xs stg:transition-colors"
+              >
+                Keep
+              </button>
+            </div>
+          ) : (
             <button
               type="button"
-              onClick={handleDelete}
-              disabled={isDeleting}
-              className={cn(
-                "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-2.5 stg:py-1 stg:text-xs stg:font-medium",
-                "stg:bg-destructive stg:text-destructive-foreground stg:hover:opacity-90",
-                "stg:disabled:pointer-events-none stg:disabled:opacity-40",
-              )}
-            >
-              {isDeleting && <SpinnerIcon size={12} />}
-              Delete
-            </button>
-            <button
-              type="button"
-              onClick={() => setConfirmingDelete(false)}
-              disabled={isDeleting}
-              className="stg:text-muted-foreground stg:hover:text-foreground stg:text-xs stg:transition-colors"
+              onClick={() => setConfirmingDelete(true)}
+              className="stg:text-destructive stg:text-xs stg:font-medium stg:hover:opacity-80"
             >
-              Keep
+              Delete channel app
             </button>
-          </div>
-        ) : (
-          <button
-            type="button"
-            onClick={() => setConfirmingDelete(true)}
-            className="stg:text-destructive stg:text-xs stg:font-medium stg:hover:opacity-80"
-          >
-            Delete channel app
-          </button>
-        )}
-      </section>
+          )}
+        </section>
+      </PermissionGate>
     </div>
   );
 }
@@ -189,7 +200,7 @@ function SlackAppDetail({
   readonly onUpdated?: (app: ChannelApp) => void;
 }) {
   const baseId = useId();
-  const stigmer = useStigmer();
+  const publicBaseUrl = usePublicBaseUrl();
   const { update, isUpdating, error: updateError, clearError } = useUpdateChannelApp();
 
   const slack = channelApp.spec?.providerConfig?.case === "slack"
@@ -203,9 +214,14 @@ function SlackAppDetail({
   const appId = channelApp.metadata?.id ?? "";
   const name = channelApp.metadata?.name ?? "";
 
+  // `undefined` while the server's public address is unknown: the row
+  // says so, and the manifest leaves out its event subscriptions.
   const webhookUrl = useMemo(
-    () => slackChannelAppWebhookUrl(stigmer.baseUrl, appId),
-    [stigmer.baseUrl, appId],
+    () =>
+      publicBaseUrl === null
+        ? undefined
+        : slackChannelAppWebhookUrl(publicBaseUrl, appId),
+    [publicBaseUrl, appId],
   );
   const redirectUrl = useMemo(
     () => slackChannelAppRedirectUrl(consoleOrigin),
@@ -260,73 +276,82 @@ function SlackAppDetail({
           below (Slack verifies it immediately). The completed manifest is
           also available for review or re-paste.
         </p>
-        <CopyRow
-          label="Events request URL"
-          value={webhookUrl}
-          copyTargetId="stgm-chapp-webhook-copy"
-        />
+        {webhookUrl !== undefined ? (
+          <CopyRow
+            label="Events request URL"
+            value={webhookUrl}
+            copyTargetId="stgm-chapp-webhook-copy"
+          />
+        ) : (
+          <UnknownAddressRow label="Events request URL" subject="the events request URL" />
+        )}
         <CopyRow label="OAuth redirect URL" value={redirectUrl} />
         <CopyBlock label="Completed app manifest" value={manifest} />
       </section>
 
       {/* Credential rotation */}
-      <form onSubmit={handleSave} className="stg:space-y-3" aria-label="Credentials">
-        <p className="stg:text-xs stg:font-medium stg:text-foreground">Credentials</p>
-        <p className="stg:-mt-2 stg:text-[0.65rem] stg:text-muted-foreground">
-          Secrets show as <code className="stg:font-mono">***REDACTED***</code>;
-          leave a field untouched to keep its stored value, or paste a new
-          one to rotate it.
-        </p>
-
-        <FormField
-          id={`${baseId}-client-id`}
-          label="Client ID"
-          value={clientId}
-          onChange={setClientId}
-          placeholder="1234567890.0987654321"
-          disabled={isUpdating}
-          required
-        />
-        <FormField
-          id={`${baseId}-client-secret`}
-          label="Client secret"
-          value={clientSecret}
-          onChange={setClientSecret}
-          placeholder="Client secret"
-          type="password"
-          disabled={isUpdating}
-          required
-        />
-        <FormField
-          id={`${baseId}-signing-secret`}
-          label="Signing secret"
-          value={signingSecret}
-          onChange={setSigningSecret}
-          placeholder="Signing secret"
-          type="password"
-          disabled={isUpdating}
-          required
-        />
-
-        {updateError && (
-          <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
-            {getUserMessage(updateError)}
+      <PermissionGate
+        resource={{ kind: "channel_app", id: appId }}
+        relation="can_edit"
+      >
+        <form onSubmit={handleSave} className="stg:space-y-3" aria-label="Credentials">
+          <p className="stg:text-xs stg:font-medium stg:text-foreground">Credentials</p>
+          <p className="stg:-mt-2 stg:text-[0.65rem] stg:text-muted-foreground">
+            Secrets show as <code className="stg:font-mono">***REDACTED***</code>;
+            leave a field untouched to keep its stored value, or paste a new
+            one to rotate it.
           </p>
-        )}
 
-        <button
-          type="submit"
-          disabled={!canSave}
-          className={cn(
-            "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
-            "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
-            "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+          <FormField
+            id={`${baseId}-client-id`}
+            label="Client ID"
+            value={clientId}
+            onChange={setClientId}
+            placeholder="1234567890.0987654321"
+            disabled={isUpdating}
+            required
+          />
+          <FormField
+            id={`${baseId}-client-secret`}
+            label="Client secret"
+            value={clientSecret}
+            onChange={setClientSecret}
+            placeholder="Client secret"
+            type="password"
+            disabled={isUpdating}
+            required
+          />
+          <FormField
+            id={`${baseId}-signing-secret`}
+            label="Signing secret"
+            value={signingSecret}
+            onChange={setSigningSecret}
+            placeholder="Signing secret"
+            type="password"
+            disabled={isUpdating}
+            required
+          />
+
+          {updateError && (
+            <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
+              {getUserMessage(updateError)}
+            </p>
           )}
-        >
-          {isUpdating && <SpinnerIcon size={12} />}
-          Save credentials
-        </button>
-      </form>
+
+          <button
+            type="submit"
+            disabled={!canSave}
+            className={cn(
+              "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
+              "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
+              "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+            )}
+          >
+            {isUpdating && <SpinnerIcon size={12} />}
+            Save credentials
+          </button>
+        </form>
+      </PermissionGate>
     </>
   );
 }
@@ -345,7 +370,7 @@ function WhatsAppAppDetail({
   readonly onUpdated?: (app: ChannelApp) => void;
 }) {
   const baseId = useId();
-  const stigmer = useStigmer();
+  const publicBaseUrl = usePublicBaseUrl();
   const { update, isUpdating, error: updateError, clearError } = useUpdateChannelApp();
 
   const whatsapp = channelApp.spec?.providerConfig?.case === "whatsapp"
@@ -360,9 +385,13 @@ function WhatsAppAppDetail({
   const appId = channelApp.metadata?.id ?? "";
   const name = channelApp.metadata?.name ?? "";
 
+  // `undefined` while the server's public address is unknown: the row says so.
   const webhookUrl = useMemo(
-    () => whatsappChannelAppWebhookUrl(stigmer.baseUrl, appId),
-    [stigmer.baseUrl, appId],
+    () =>
+      publicBaseUrl === null
+        ? undefined
+        : whatsappChannelAppWebhookUrl(publicBaseUrl, appId),
+    [publicBaseUrl, appId],
   );
 
   const canSave =
@@ -416,11 +445,15 @@ function WhatsAppAppDetail({
           </span>{" "}
           webhook field.
         </p>
-        <CopyRow
-          label="Callback URL"
-          value={webhookUrl}
-          copyTargetId="stgm-chapp-webhook-copy"
-        />
+        {webhookUrl !== undefined ? (
+          <CopyRow
+            label="Callback URL"
+            value={webhookUrl}
+            copyTargetId="stgm-chapp-webhook-copy"
+          />
+        ) : (
+          <UnknownAddressRow label="Callback URL" subject="the callback URL" />
+        )}
         {createHandoff?.verifyToken ? (
           <CopyRow
             label="Verify token"
@@ -440,74 +473,79 @@ function WhatsAppAppDetail({
       </section>
 
       {/* Credential rotation */}
-      <form onSubmit={handleSave} className="stg:space-y-3" aria-label="Credentials">
-        <p className="stg:text-xs stg:font-medium stg:text-foreground">Credentials</p>
-        <p className="stg:-mt-2 stg:text-[0.65rem] stg:text-muted-foreground">
-          Secrets show as <code className="stg:font-mono">***REDACTED***</code>;
-          leave a field untouched to keep its stored value, or paste a new
-          one to rotate it.
-        </p>
-
-        <FormField
-          id={`${baseId}-app-id`}
-          label="App ID"
-          value={metaAppId}
-          onChange={setMetaAppId}
-          placeholder="1234567890123456"
-          disabled={isUpdating}
-          required
-        />
-        <FormField
-          id={`${baseId}-app-secret`}
-          label="App secret"
-          value={appSecret}
-          onChange={setAppSecret}
-          placeholder="App secret"
-          type="password"
-          disabled={isUpdating}
-          required
-        />
-        <FormField
-          id={`${baseId}-access-token`}
-          label="Access token"
-          value={accessToken}
-          onChange={setAccessToken}
-          placeholder="Long-lived system-user access token"
-          type="password"
-          disabled={isUpdating}
-          required
-        />
-        <FormField
-          id={`${baseId}-verify-token`}
-          label="Verify token"
-          value={verifyToken}
-          onChange={setVerifyToken}
-          placeholder="Verify token"
-          type="password"
-          hint="Rotating it? Update Meta's webhook configuration to the same value."
-          disabled={isUpdating}
-          required
-        />
-
-        {updateError && (
-          <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
-            {getUserMessage(updateError)}
+      <PermissionGate
+        resource={{ kind: "channel_app", id: appId }}
+        relation="can_edit"
+      >
+        <form onSubmit={handleSave} className="stg:space-y-3" aria-label="Credentials">
+          <p className="stg:text-xs stg:font-medium stg:text-foreground">Credentials</p>
+          <p className="stg:-mt-2 stg:text-[0.65rem] stg:text-muted-foreground">
+            Secrets show as <code className="stg:font-mono">***REDACTED***</code>;
+            leave a field untouched to keep its stored value, or paste a new
+            one to rotate it.
           </p>
-        )}
 
-        <button
-          type="submit"
-          disabled={!canSave}
-          className={cn(
-            "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
-            "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
-            "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+          <FormField
+            id={`${baseId}-app-id`}
+            label="App ID"
+            value={metaAppId}
+            onChange={setMetaAppId}
+            placeholder="1234567890123456"
+            disabled={isUpdating}
+            required
+          />
+          <FormField
+            id={`${baseId}-app-secret`}
+            label="App secret"
+            value={appSecret}
+            onChange={setAppSecret}
+            placeholder="App secret"
+            type="password"
+            disabled={isUpdating}
+            required
+          />
+          <FormField
+            id={`${baseId}-access-token`}
+            label="Access token"
+            value={accessToken}
+            onChange={setAccessToken}
+            placeholder="Long-lived system-user access token"
+            type="password"
+            disabled={isUpdating}
+            required
+          />
+          <FormField
+            id={`${baseId}-verify-token`}
+            label="Verify token"
+            value={verifyToken}
+            onChange={setVerifyToken}
+            placeholder="Verify token"
+            type="password"
+            hint="Rotating it? Update Meta's webhook configuration to the same value."
+            disabled={isUpdating}
+            required
+          />
+
+          {updateError && (
+            <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
+              {getUserMessage(updateError)}
+            </p>
           )}
-        >
-          {isUpdating && <SpinnerIcon size={12} />}
-          Save credentials
-        </button>
-      </form>
+
+          <button
+            type="submit"
+            disabled={!canSave}
+            className={cn(
+              "stg:inline-flex stg:items-center stg:gap-1.5 stg:rounded-md stg:px-3 stg:py-1.5 stg:text-xs stg:font-medium",
+              "stg:bg-primary stg:text-primary-foreground stg:hover:bg-primary-hover",
+              "stg:disabled:pointer-events-none stg:disabled:opacity-40",
+            )}
+          >
+            {isUpdating && <SpinnerIcon size={12} />}
+            Save credentials
+          </button>
+        </form>
+      </PermissionGate>
     </>
   );
 }

package/src/channel-app/ChannelAppListPanel.tsx

@@ -1,5 +1,6 @@
 "use client";
 
+import type { ReactNode } from "react";
 import { cn } from "@stigmer/theme";
 import { getUserMessage } from "@stigmer/sdk";
 import { timestampDate } from "@bufbuild/protobuf/wkt";
@@ -22,14 +23,22 @@ export interface ChannelAppListPanelProps {
   readonly onEdit?: (app: ChannelApp) => void;
   /** Re-expose refetch so parents can trigger a list refresh. */
   readonly onRefetchRef?: (refetch: () => void) => void;
+  /**
+   * Shown when the list is empty. Defaults to "No channel apps registered
+   * yet." The list holds only the apps the caller may view (the
+   * organization's admins, and anyone granted viewer on an app), so a host
+   * that knows the caller may not manage channel apps should say who does
+   * instead.
+   */
+  readonly emptyState?: ReactNode;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
 }
 
 /**
- * Displays the {@link ChannelApp} resources owned by an organization —
- * the customer's own provider apps (Slack, Meta/WhatsApp) that agent
- * channels can install through.
+ * Displays the {@link ChannelApp} resources of an organization that the
+ * caller may view — the customer's own provider apps (Slack,
+ * Meta/WhatsApp) that agent channels can install through.
  *
  * Each row shows the app name, provider, the provider's non-secret app
  * identifier, and creation date. Secret fields never appear (they
@@ -49,6 +58,7 @@ export function ChannelAppListPanel({
   org,
   onEdit,
   onRefetchRef,
+  emptyState = "No channel apps registered yet.",
   className,
 }: ChannelAppListPanelProps) {
   const { channelApps, isLoading, error, refetch } = useChannelAppList(org);
@@ -87,7 +97,7 @@ export function ChannelAppListPanel({
           className,
         )}
       >
-        No channel apps registered yet.
+        {emptyState}
       </p>
     );
   }

package/src/channel-app/CreateChannelAppForm.tsx

@@ -311,7 +311,6 @@ function ProviderPicker({
                 checked={checked}
                 onChange={() => onChange(p.id)}
                 disabled={disabled}
-                className="stg:accent-current"
               />
               <p.Icon className="stg:size-3.5 stg:shrink-0 stg:text-foreground" />
               <span className="stg:text-xs stg:font-medium stg:text-foreground">{p.label}</span>

package/src/channel-app/copy.ts

@@ -0,0 +1,16 @@
+/**
+ * Channel-app copy shared by more than one surface, so the settings section
+ * and anything else that lists an organization's channel apps say the same
+ * thing.
+ *
+ * A channel app carries its organization's Slack or Meta app secrets, so the
+ * model shows it to the organization's admins and anyone granted viewer on
+ * it, and plain members and viewers may not see it at all
+ * (stigmer/stigmer#1384, #1409). An empty list is therefore not evidence that none
+ * is registered, so a caller who may not create channel apps is told who
+ * manages them instead of being told that nothing exists.
+ */
+
+/** Shown in place of the empty state to a caller who may not create channel apps. */
+export const CHANNEL_APPS_MANAGED_BY_ADMINS =
+  "Channel apps are managed by your organization's admins.";

package/src/channel-app/internal.tsx

@@ -3,6 +3,7 @@
 import { useCallback } from "react";
 import { cn } from "@stigmer/theme";
 import { TruncatedText } from "../internal/truncated-text.js";
+import { UnknownPublicAddressNotice } from "../internal/UnknownPublicAddressNotice.js";
 import { useCopyFeedback } from "../internal/useCopyFeedback.js";
 
 /**
@@ -89,6 +90,26 @@ export function CopyRow({
   );
 }
 
+/**
+ * The place of a {@link CopyRow} whose URL cannot be built because the
+ * server's public address is unknown: the same label, then the shared
+ * notice in place of the value and its copy button.
+ */
+export function UnknownAddressRow({
+  label,
+  subject,
+}: {
+  label: string;
+  subject: string;
+}) {
+  return (
+    <div className="stg:space-y-1">
+      <p className="stg:text-xs stg:font-medium stg:text-foreground">{label}</p>
+      <UnknownPublicAddressNotice subject={subject} />
+    </div>
+  );
+}
+
 /** A multi-line copyable value (the app manifest) in a scrollable block. */
 export function CopyBlock({
   label,

package/src/channel-app/slackAppSetup.ts

@@ -53,7 +53,9 @@ export const SLACK_CHANNEL_APP_BOT_EVENTS = [
  * The events webhook URL for one ChannelApp: the per-app route the
  * receiver resolves the app's signing secret by.
  *
- * @param apiBaseUrl the Stigmer API origin (`stigmer.baseUrl`)
+ * @param apiBaseUrl the server's public base URL, absolute (the one
+ *                   `StigmerProvider`'s `publicBaseUrl` names, or the
+ *                   client's `baseUrl` when that is absolute)
  * @param channelAppId the ChannelApp resource id (`chapp_...`)
  */
 export function slackChannelAppWebhookUrl(

package/src/channel-app/whatsappAppSetup.ts

@@ -36,7 +36,9 @@ export const WHATSAPP_CHANNEL_APP_WEBHOOK_FIELDS = ["messages"] as const;
  * The events webhook URL for one ChannelApp: the per-app route the
  * receiver resolves the app's secret and verify token by.
  *
- * @param apiBaseUrl the Stigmer API origin (`stigmer.baseUrl`)
+ * @param apiBaseUrl the server's public base URL, absolute (the one
+ *                   `StigmerProvider`'s `publicBaseUrl` names, or the
+ *                   client's `baseUrl` when that is absolute)
  * @param channelAppId the ChannelApp resource id (`chapp_...`)
  */
 export function whatsappChannelAppWebhookUrl(

package/src/composer/SessionComposer.tsx

@@ -39,11 +39,7 @@ import { FileReferenceChipList } from "../file-reference/FileReferenceChipList.j
 import { FILE_REF_MIME } from "../internal/file-tree/index.js";
 import { useSessionEnvPool } from "../environment/useSessionEnvPool.js";
 import { usePersonalEnvironment } from "../environment/usePersonalEnvironment.js";
-import { useStigmer } from "../hooks.js";
-import {
-  SYSTEM_ENV_VAR_KEYS,
-  resolveSystemEnvVarValues,
-} from "../environment/systemEnvVars.js";
+import { SYSTEM_ENV_VAR_KEYS } from "../environment/systemEnvVars.js";
 import { useRenderTracer } from "../internal/dev/index.js";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import {
@@ -714,8 +710,6 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
     [personalEnv.environment],
   );
 
-  const stigmer = useStigmer();
-
   const pool = useSessionEnvPool({
     personalEnvKeys,
     manualSecrets: sessionVariables?.entries,
@@ -1025,14 +1019,11 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
         }
       }
 
+      // Only what the page collected for this run: the platform's own keys
+      // are filled in the runner, below every value a user saved
+      // (systemEnvVars.ts header, stigmer/stigmer#1446).
       const env: Record<string, EnvVarInput> = {};
 
-      // System env vars first (lowest priority) — auto-resolved from
-      // the Stigmer client's connection context so MCP servers and
-      // agents can reach the backend without manual user input.
-      const systemVars = await resolveSystemEnvVarValues(stigmer);
-      Object.assign(env, systemVars);
-
       if (
         agentSetup.state.status === "ready" &&
         agentSetup.state.resolution.mode === "oneTime"
@@ -1108,7 +1099,7 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
         fileRefs.clear();
       }
     },
-    [onSubmit, effective, stigmer, agentSetup.state, mcpSetup.pendingRuntimeEnv, sessionVariables, enableAttachments, attachments, personalEnv, showInteractionModePicker, interactionMode],
+    [onSubmit, effective, agentSetup.state, mcpSetup.pendingRuntimeEnv, sessionVariables, enableAttachments, attachments, personalEnv, showInteractionModePicker, interactionMode],
   );
 
   const composer = useComposer({