@stigmer/react 3.40.0 → 3.41.0

package/src/environment/EnvironmentVariableEditor.tsx

@@ -586,7 +586,7 @@ function AddVariableForm({
             checked={isSecret}
             onChange={(e) => setIsSecret(e.target.checked)}
             disabled={isAdding}
-            className="stg:accent-primary stg:size-3"
+            className="stg:size-3"
           />
           Secret
         </label>

package/src/environment/index.ts

@@ -41,13 +41,7 @@ export type {
   SessionEnvPoolInput,
   UseSessionEnvPoolReturn,
 } from "./useSessionEnvPool.js";
-export {
-  SYSTEM_ENV_VAR_KEYS,
-  toGrpcAddress,
-  buildSystemEnvVars,
-  resolveSystemEnvVarValues,
-  resolveDeclaredSystemEnvVars,
-} from "./systemEnvVars.js";
+export { SYSTEM_ENV_VAR_KEYS } from "./systemEnvVars.js";
 export { EnvironmentPicker } from "./EnvironmentPicker.js";
 export type { EnvironmentPickerProps } from "./EnvironmentPicker.js";
 export { useToolCredentialsReadiness } from "./useToolCredentialsReadiness.js";

package/src/environment/systemEnvVars.ts

@@ -1,143 +1,31 @@
-import type { EnvVarInput, Stigmer } from "@stigmer/sdk";
-
 // ---------------------------------------------------------------------------
 // Well-known Stigmer platform environment variable keys
 //
-// These env vars configure MCP server subprocesses (and agents) to
-// communicate back to the Stigmer backend. Because the SDK client
-// already knows the server address and auth credential, the setup
-// hooks can skip prompting users for these values and inject them
-// automatically at session creation time.
+// A platform value comes from the component that knows it, fills only a key
+// that is still missing, and reaches only a server that declares it
+// (stigmer/stigmer#1446). The page is not that component for any key, so
+// this SDK supplies none: a value it wrote into a run's runtime env would
+// sit in the top merge layer, above every value a user saved, and a run
+// whose agent declares no env would carry it into the agent's shell.
+//
+// STIGMER_SERVER_ADDRESS is the one key the platform fills. The runner
+// writes it for a server that declares it and holds no value: from the
+// server's public address, which the server hands every sandbox it
+// provisions, or for a stdio child from the endpoint the runner dials
+// itself (backend/services/runner, the platform-server-address module).
+//
+// STIGMER_API_KEY is not a platform key. A server that calls the Stigmer
+// API declares it like any other secret, and its user saves an API key for
+// it; nothing hands a user-defined server the signed-in user's bearer.
 // ---------------------------------------------------------------------------
 
-const STIGMER_SERVER_ADDRESS = "STIGMER_SERVER_ADDRESS";
-const STIGMER_API_KEY = "STIGMER_API_KEY";
-
 /**
- * Environment variable keys that the SDK can resolve automatically
- * from the current {@link Stigmer} client context.
+ * Environment variable keys the platform fills itself, so the setup hooks
+ * never prompt a user for them and the credential forms never ask for them.
  *
- * Used by setup hooks to exclude these keys from the "missing
- * variables" prompt and by the session composer to inject their
- * values into runtime env at submit time.
- *
- * Platform builders who manage setup hooks directly can use this
- * set to extend their own `poolKeys`.
+ * Platform builders who manage setup hooks directly can use this set to
+ * extend their own `poolKeys`.
  */
 export const SYSTEM_ENV_VAR_KEYS: ReadonlySet<string> = new Set([
-  STIGMER_SERVER_ADDRESS,
-  STIGMER_API_KEY,
+  "STIGMER_SERVER_ADDRESS",
 ]);
-
-/**
- * Convert an HTTP(S) base URL to a gRPC host:port address.
- *
- * The Stigmer server serves both gRPC and gRPC-Web on the same
- * endpoint, so stripping the protocol and extracting host:port
- * produces a valid gRPC dial target.
- *
- * @example
- * ```ts
- * toGrpcAddress("http://localhost:7234")   // "localhost:7234"
- * toGrpcAddress("https://api.stigmer.ai")  // "api.stigmer.ai:443"
- * toGrpcAddress("https://api.stigmer.ai:8443") // "api.stigmer.ai:8443"
- * ```
- */
-export function toGrpcAddress(httpUrl: string): string {
-  try {
-    const url = new URL(httpUrl);
-    const host = url.hostname;
-    const port =
-      url.port || (url.protocol === "https:" ? "443" : "80");
-    return `${host}:${port}`;
-  } catch {
-    return httpUrl;
-  }
-}
-
-/**
- * Build system env var entries from raw connection parameters.
- *
- * Pure function — no side effects, no async. Suitable for unit
- * testing without a live Stigmer client.
- *
- * @param baseUrl - The Stigmer client's base URL (HTTP).
- * @param credential - Current auth credential, or `null` for
- *   unauthenticated (OSS) backends. When `null`, a placeholder
- *   value is used so the MCP server env var is always populated.
- */
-export function buildSystemEnvVars(
-  baseUrl: string,
-  credential: string | null,
-): Record<string, EnvVarInput> {
-  return {
-    [STIGMER_SERVER_ADDRESS]: {
-      value: toGrpcAddress(baseUrl),
-      isSecret: false,
-      description:
-        "Auto-resolved from the current Stigmer connection.",
-    },
-    [STIGMER_API_KEY]: {
-      value: credential || "unused",
-      isSecret: true,
-      description:
-        "Auto-resolved from the current Stigmer auth context.",
-    },
-  };
-}
-
-/**
- * Resolve system env var values from a live {@link Stigmer} client.
- *
- * Calls {@link Stigmer.getAuthCredential} to obtain the current
- * credential, then delegates to {@link buildSystemEnvVars}.
- *
- * Intended for use at session submit time — the returned values
- * are injected into `runtimeEnv` at the **lowest priority** so
- * any user-provided values (personal env, manual secrets) win.
- */
-export async function resolveSystemEnvVarValues(
-  stigmer: Stigmer,
-): Promise<Record<string, EnvVarInput>> {
-  const credential = await stigmer.getAuthCredential();
-  return buildSystemEnvVars(stigmer.baseUrl, credential);
-}
-
-/**
- * Resolve only the system env vars that the target resource actually
- * declares in its environment specification.
- *
- * System vars (`STIGMER_SERVER_ADDRESS`, `STIGMER_API_KEY`) should
- * only be injected when the resource needs them — blindly injecting
- * them causes `runtime_env` to be non-empty on the wire, which
- * changes the backend's missing-credential tolerance semantics.
- *
- * @param stigmer - Live Stigmer client for credential resolution.
- * @param declaredEnvKeys - The set of env var keys the target
- *   resource declares (e.g., `Object.keys(mcpServer.spec.env)`).
- *   Only system vars whose keys appear here are included.
- * @returns Filtered system env vars (may be empty).
- */
-export async function resolveDeclaredSystemEnvVars(
-  stigmer: Stigmer,
-  declaredEnvKeys: ReadonlySet<string> | readonly string[],
-): Promise<Record<string, EnvVarInput>> {
-  const keys =
-    declaredEnvKeys instanceof Set
-      ? declaredEnvKeys
-      : new Set(declaredEnvKeys);
-
-  const hasDeclared = [...SYSTEM_ENV_VAR_KEYS].some((k) => keys.has(k));
-  if (!hasDeclared) {
-    return {};
-  }
-
-  const all = await resolveSystemEnvVarValues(stigmer);
-  const filtered: Record<string, EnvVarInput> = {};
-  for (const [key, value] of Object.entries(all)) {
-    if (keys.has(key)) {
-      filtered[key] = value;
-    }
-  }
-  return filtered;
-}

package/src/execution/RecalledMemoriesCard.tsx

@@ -90,7 +90,7 @@ export const RecalledMemoriesCard = memo(function RecalledMemoriesCard({
         onClick={() => setExpanded((prev) => !prev)}
         className={cn(
           "stg:flex stg:w-full stg:items-center stg:gap-3 stg:px-3 stg:py-2 stg:text-left",
-          "stg:text-xs stg:text-muted-foreground hover:stg:text-foreground",
+          "stg:text-xs stg:text-muted-foreground stg:hover:text-foreground",
         )}
       >
         <MemoryIcon />

package/src/iam-policy/OrgMembersPanel.tsx

@@ -496,7 +496,9 @@ function RemoveCopy({
     case "member":
       return (
         <>
-          Remove {name} from this organization? This revokes all their access.
+          Remove {name} from this organization? They lose access to everything
+          in it, including what was shared with them and their teams. What
+          they created stays with the organization.
         </>
       );
     case "productUser":

package/src/iam-policy/useCheckPermission.ts

@@ -69,7 +69,10 @@ interface SettledCheck {
  * `false` (so operator-only navigation never appears where the seat
  * does not exist), `can_grant_access` on a resource the edition does not
  * share per person is `false` (open source grants roles on organizations
- * only), and everything else is the edition's authorizer's answer. By
+ * only), and everything else is the edition's authorizer's answer. So a
+ * control that changes who reaches a resource (its visibility, a share, a
+ * channel) asks `can_manage_audience`, never `can_grant_access`: the owner
+ * holds it in every edition. By
  * default the hook *fails open* while the check is in flight or when the
  * RPC fails, so a transient error never hides a control the server would
  * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden

package/src/iam-policy/useGrantableRoles.ts

@@ -26,7 +26,7 @@ export interface UseGrantableRolesReturn {
  * @example
  * ```tsx
  * const { roles, hasRoles } = useGrantableRoles(ApiResourceKind.agent);
- * // roles = [IamRole.owner, IamRole.viewer]
+ * // roles = [IamRole.owner, IamRole.editor, IamRole.viewer]
  * // hasRoles = true
  * ```
  */

package/src/iam-policy/useRevokeOrgAccess.ts

@@ -9,11 +9,13 @@ import { toError } from "../internal/toError.js";
 /** Return value of {@link useRevokeOrgAccess}. */
 export interface UseRevokeOrgAccessReturn {
   /**
-   * Remove all of a user's access to an organization.
+   * Remove a person from an organization.
    *
-   * Deletes every IAM policy granting the identity account access
-   * to the organization and its child resources (agents, environments,
-   * etc.) in a single operation.
+   * Revokes their roles on the organization and everything they hold on
+   * its resources: what was shared with them (agents, environments,
+   * sessions and the rest) and their team memberships, in a single
+   * operation. What they created stays with the organization; it is
+   * theirs again only if they are invited back.
    */
   readonly revoke: (accountId: string, orgId: string) => Promise<void>;
   /** `true` while the revoke request is in flight. */
@@ -28,10 +30,10 @@ export interface UseRevokeOrgAccessReturn {
  * Behavior hook that wraps `iamPolicy.revokeOrgAccess()` with
  * loading/error state.
  *
- * Removes all IAM policy bindings for a specific identity account
- * within an organization — including bindings on child resources
- * (agents, environments, etc.). This is the "remove member from org"
- * operation.
+ * Removes a person from an organization: their roles on it, what was
+ * shared with them on its resources and their team memberships. From
+ * then on they reach nothing in the organization; what they created
+ * stays with it. This is the "remove member from org" operation.
  *
  * @example
  * ```tsx

package/src/identity-account/AccountPreferencesPanel.tsx

@@ -15,6 +15,7 @@ import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityacc
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
 import { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
 import { useModelRegistry } from "../models/index.js";
+import { useServerInfo } from "../server-info.js";
 import { HARNESS_META, type HarnessOption } from "../models/harness.js";
 import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
@@ -49,6 +50,12 @@ export interface AccountPreferencesPanelProps {
  * answer with. A server that cannot answer surfaces its error through the
  * fetch-error state below, never a hidden branch.
  *
+ * The one posture question it does ask is about memory. The person's own
+ * memory switch is honoured only by a server that authenticates its
+ * callers; on a server that trusts every request (the single-operator
+ * laptop), memory is the organization's switch alone, so the panel says
+ * that in the switch's place rather than offering one that does nothing.
+ *
  * All visual properties flow through `--stgm-*` design tokens. Zero
  * dependencies on Console routing, auth context, or layout — platform
  * builders can embed it directly:
@@ -86,6 +93,8 @@ export function AccountPreferencesPanel({
     error: memoryFlagError,
   } = useUpdateIdentityAccount();
 
+  const memoryGovernance = useMemoryGovernance();
+
   const [standingContext, setStandingContext] = useState("");
   const [defaultHarness, setDefaultHarness] = useState("");
   const [defaultNativeModel, setDefaultNativeModel] = useState("");
@@ -377,14 +386,17 @@ export function AccountPreferencesPanel({
         </div>
       </div>
 
-      <MemoryEnabledRow
-        id={`${baseId}-memory-enabled`}
-        checked={account.spec?.preferences?.memoryEnabled ?? false}
-        onToggle={(next) => void handleMemoryToggle(next)}
-        saving={isSavingMemoryFlag}
-        error={memoryFlagError}
-        helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
-      />
+      {memoryGovernance === "organization" && <OrganizationGovernedMemory />}
+      {memoryGovernance === "person" && (
+        <MemoryEnabledRow
+          id={`${baseId}-memory-enabled`}
+          checked={account.spec?.preferences?.memoryEnabled ?? false}
+          onToggle={(next) => void handleMemoryToggle(next)}
+          saving={isSavingMemoryFlag}
+          error={memoryFlagError}
+          helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
+        />
+      )}
 
       {updateError && (
         <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
@@ -494,7 +506,7 @@ function HarnessOptionRow({
           disabled={disabled}
           aria-labelledby={titleId}
           aria-describedby={descriptionId}
-          className="stg:mt-0.5 stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
+          className="stg:mt-0.5 stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
         />
         <span className="stg:min-w-0 stg:flex-1">
           <span
@@ -584,3 +596,38 @@ function DefaultModelSelect({
     </div>
   );
 }
+
+/**
+ * Who decides memory on the connected server, for the memory row.
+ *
+ * - `"person"`: the person's own switch counts (a server that authenticates
+ *   its callers, one too old to report its posture, or one whose answer
+ *   failed: an unknown posture offers the control and lets the server
+ *   decide, as `authentication_required`'s contract says).
+ * - `"organization"`: the server trusts every request, so its one operator
+ *   decides memory through the organization's switch alone.
+ * - `null`: the server has not answered yet, so the row renders nothing
+ *   rather than a switch that flashes and disappears.
+ */
+function useMemoryGovernance(): "person" | "organization" | null {
+  const { serverInfo, error } = useServerInfo();
+  if (serverInfo !== null) {
+    return serverInfo.authenticationRequired === false ? "organization" : "person";
+  }
+  return error !== null ? "person" : null;
+}
+
+/** The memory row on a server where the organization's switch alone decides. */
+function OrganizationGovernedMemory() {
+  return (
+    <div className="stg:space-y-1">
+      <span className="stg:block stg:text-xs stg:font-medium stg:text-foreground">
+        Memory
+      </span>
+      <p className="stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground">
+        On this server, memory follows your organization&apos;s setting. Turn it
+        on or off in the organization&apos;s preferences.
+      </p>
+    </div>
+  );
+}

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -2,7 +2,7 @@
 
 import { useMemo } from "react";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
-import type { HarnessOption } from "../models/harness.js";
+import { isHarnessOption, type HarnessOption } from "../models/harness.js";
 
 /**
  * The current user's account-level execution defaults, shaped for the
@@ -57,10 +57,7 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
     // The proto validates default_harness to the shipped set, but a client
     // must not trust persisted data it did not write — unknown values are
     // treated as undeclared.
-    const harness =
-      prefs.defaultHarness === "native" || prefs.defaultHarness === "cursor"
-        ? (prefs.defaultHarness satisfies HarnessOption)
-        : undefined;
+    const harness = isHarnessOption(prefs.defaultHarness) ? prefs.defaultHarness : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
     // Only a declared `true` travels — an unset bool is "no preference",

package/src/index.ts

@@ -948,7 +948,7 @@ export type {
   UseUpdateScheduleSpecReturn,
 } from "./schedule/index.js";
 
-// Environment — data hooks, list hook, personal convenience hook, secret reveal, variable management, env var form, system env vars, and styled components
+// Environment — data hooks, list hook, personal convenience hook, secret reveal, variable management, env var form, the platform-filled key set, and styled components
 export {
   useEnvironment,
   useEnvironmentList,
@@ -964,10 +964,6 @@ export {
   EnvVarForm,
   useSessionEnvPool,
   SYSTEM_ENV_VAR_KEYS,
-  toGrpcAddress,
-  buildSystemEnvVars,
-  resolveSystemEnvVarValues,
-  resolveDeclaredSystemEnvVars,
   EnvironmentPicker,
   useToolCredentialsReadiness,
 } from "./environment/index.js";
@@ -1164,6 +1160,9 @@ export {
   useSubscription,
   useEntitlements,
   usePeriodEstimate,
+  useProviderKeys,
+  useProviderKeyActions,
+  ProviderKeysSection,
   useChangePlan,
   useCancelSubscription,
   useCreatePaymentMethodSetupSession,
@@ -1206,6 +1205,11 @@ export type {
   UseEntitlementsReturn,
   UsePeriodEstimateOptions,
   UsePeriodEstimateReturn,
+  ProviderKeyProvider,
+  UseProviderKeysOptions,
+  UseProviderKeysReturn,
+  UseProviderKeyActionsReturn,
+  ProviderKeysSectionProps,
   UseChangePlanReturn,
   UseCancelSubscriptionReturn,
   UseCreatePaymentMethodSetupSessionReturn,

package/src/internal/UnknownPublicAddressNotice.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+/** Props for {@link UnknownPublicAddressNotice}. */
+export interface UnknownPublicAddressNoticeProps {
+  /** What cannot be shown, as it reads mid-sentence ("the callback URL"). */
+  readonly subject: string;
+}
+
+/**
+ * Shown in place of a copyable URL or snippet when the server's public
+ * address is unknown (`usePublicBaseUrl` answered `null`): the client talks
+ * to the server through a relative `baseUrl` and the host named no
+ * `publicBaseUrl`. One sentence, shared by every copy surface, so a user is
+ * told plainly why there is nothing to copy instead of being offered an
+ * address Slack, Meta or a backend cannot call.
+ *
+ * The surface keeps its own label above the notice, the shape the channel
+ * app panel already uses for a verify token it can no longer show. The
+ * reader is the host's user, not its developer, so the copy names no prop
+ * or configuration.
+ */
+export function UnknownPublicAddressNotice({
+  subject,
+}: UnknownPublicAddressNoticeProps) {
+  return (
+    <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+      This app doesn&apos;t know your Stigmer server&apos;s public address, so
+      it can&apos;t show {subject}.
+    </p>
+  );
+}

package/src/internal/features.ts

@@ -23,7 +23,7 @@ export const FEATURE_COPY: Readonly<
   },
   [Feature.byo_provider_keys]: {
     label: "Bring your own provider keys",
-    description: "Use the customer's own LLM provider keys instead of the metered proxy.",
+    description: "Run agents on your own Anthropic and OpenAI keys, with no Stigmer commission on those tokens.",
   },
   [Feature.channels]: {
     label: "Channels",
@@ -31,7 +31,7 @@ export const FEATURE_COPY: Readonly<
   },
   [Feature.sharing]: {
     label: "Sharing",
-    description: "Share agents with individuals and guests through hosted links.",
+    description: "Share agents through hosted links, with your organization or with anyone who has the link.",
   },
   [Feature.teams]: {
     label: "Teams",

package/src/library/InstanceVisibilitySelector.tsx

@@ -26,7 +26,7 @@ export interface InstanceVisibilitySelectorProps {
   readonly mode?: VisibilitySelectorMode;
   /** Shows a spinner/disabled state while the RPC is in flight. */
   readonly isPending?: boolean;
-  /** Disables all interaction (e.g., when the user lacks can_edit). */
+  /** Disables all interaction (e.g., when the user lacks can_manage_audience). */
   readonly disabled?: boolean;
   /** Additional CSS classes applied to the root element. */
   readonly className?: string;

package/src/library/ResourceVisibilityControl.tsx

@@ -71,10 +71,13 @@ export interface ResourceVisibilityControlProps {
  *
  * Behavior:
  * - Always renders a legible state: a read-only {@link VisibilityBadge}
- *   is shown to viewers without `can_edit` and while the permission check
- *   is in flight — never a silent blank.
+ *   is shown to anyone without `can_manage_audience` and while the
+ *   permission check is in flight — never a silent blank.
  * - Upgrades to the interactive {@link VisibilitySelector} for users with
- *   `can_edit`, persisting changes via {@link useUpdateVisibility} and invoking
+ *   `can_manage_audience`, the server's bar on every `updateVisibility`:
+ *   visibility decides who reaches the resource, so an editor, who may
+ *   change the definition, sees the badge. Persists changes via
+ *   {@link useUpdateVisibility} and invokes
  *   {@link ResourceVisibilityControlProps.onChanged} on success.
  *
  * Offered levels are kind- and context-aware (`visibilityLevels.ts`):
@@ -166,7 +169,7 @@ export function ResourceVisibilityControl({
   return (
     <PermissionGate
       resource={{ kind: FGA_KIND[kind], id: resourceId }}
-      relation="can_edit"
+      relation="can_manage_audience"
       fallback={badge}
       loading={badge}
     >

package/src/library/VisibilitySelector.tsx

@@ -54,7 +54,7 @@ export interface VisibilitySelectorProps {
   readonly mode?: VisibilitySelectorMode;
   /** Shows a spinner/disabled state while the RPC is in flight. */
   readonly isPending?: boolean;
-  /** Disables all interaction (e.g., when the user lacks can_edit). */
+  /** Disables all interaction (e.g., when the user lacks can_manage_audience). */
   readonly disabled?: boolean;
   /** Accessible name for the control. Defaults to "Resource visibility". */
   readonly ariaLabel?: string;
@@ -444,7 +444,7 @@ export interface VisibilityBadgeProps {
  * for a row from before its retirement).
  *
  * Rendered wherever the interactive {@link VisibilitySelector} is not
- * available — for viewers who lack `can_edit`, and while a permission check
+ * available — for anyone who lacks `can_manage_audience`, and while a permission check
  * is in flight — so a resource's visibility is always legible rather than
  * silently blank. Shares the chip styling with the selector trigger so the
  * read-only and editable states are visually consistent.

package/src/licenses/LicenseIssueForm.tsx

@@ -71,7 +71,7 @@ type CustomerMode = "existing" | "new";
  * browser-blue control inside its brand.
  */
 const NATIVE_CONTROL =
-  "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:focus-visible:ring-offset-1";
+  "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:focus-visible:ring-offset-1";
 
 const TERM_PRESET_HINT: Readonly<Record<IssuableTerm, string>> = {
   [LicenseTerm.trial]: "30 days",

package/src/licenses/license-format.ts

@@ -27,11 +27,17 @@ export type IssuableTerm = LicenseTerm.trial | LicenseTerm.paid;
 
 /**
  * Features a Cloud plan sells but a license never carries: they tier the
- * hosted runtime, and an Enterprise deployment has them by edition, so
- * offering one on a license would sell a capability the license does not
- * control.
+ * Cloud's hosted runtime, and on a self-hosted deployment the edition
+ * decides whether they exist, never a license, so offering one on a
+ * license would sell a capability the license does not control. A license
+ * issued before a value joined this list may still carry it; the console
+ * shows it nowhere.
  */
-export type PlanOnlyFeature = Feature.teams | Feature.managed_organizations;
+export type PlanOnlyFeature =
+  | Feature.channels
+  | Feature.sharing
+  | Feature.teams
+  | Feature.managed_organizations;
 
 /**
  * Features the contract names but nothing gates: every edition serves them
@@ -71,8 +77,6 @@ export const FEATURE_LABELS: Readonly<
 > = {
   [Feature.sso_enforcement]: FEATURE_COPY[Feature.sso_enforcement],
   [Feature.byo_provider_keys]: FEATURE_COPY[Feature.byo_provider_keys],
-  [Feature.channels]: FEATURE_COPY[Feature.channels],
-  [Feature.sharing]: FEATURE_COPY[Feature.sharing],
 };
 
 /** Every grantable feature, in contract order (derived from the label map). */
@@ -163,7 +167,7 @@ export function limitPart(limit: number | undefined, noun: string): string {
   return limit === undefined ? `Unlimited ${noun}s` : plural(limit, noun);
 }
 
-/** The granted features by name, in contract order: "SSO enforcement, Channels". */
+/** The granted features by name, in contract order: "SSO enforcement, Bring your own provider keys". */
 export function featureNames(features: readonly number[]): string {
   const names = GRANTABLE_FEATURES.filter((f) => features.includes(f)).map((f) => FEATURE_LABELS[f].label);
   return names.length === 0 ? "No features" : names.join(", ");

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -156,20 +156,18 @@ function ConnectDialogContent({
 
   const serverName = mcpServer?.metadata?.name ?? slug;
   const serverId = mcpServer?.metadata?.id ?? "";
-  const declaredEnvKeys = Object.keys(mcpServer?.spec?.env ?? {});
-
   const handleConnect = useCallback(async () => {
     if (!serverId) return;
 
     setPhase("connecting");
     try {
-      await connect(serverId, activeOrg, undefined, declaredEnvKeys);
+      await connect(serverId, activeOrg);
       setPhase("success");
       onConnected?.(serverName);
     } catch {
       setPhase("error");
     }
-  }, [serverId, activeOrg, declaredEnvKeys, connect, onConnected, serverName]);
+  }, [serverId, activeOrg, connect, onConnected, serverName]);
 
   const handleCredentialSubmit = useCallback(
     async (values: Record<string, EnvVarInput>) => {
@@ -188,7 +186,7 @@ function ConnectDialogContent({
       void handleConnect();
       return;
     }
-    oauth.startOAuth(serverId, activeOrg, declaredEnvKeys).then(
+    oauth.startOAuth(serverId, activeOrg).then(
       () => {
         creds.refetch();
         setPhase("success");
@@ -203,7 +201,7 @@ function ConnectDialogContent({
         setPhase("error");
       },
     );
-  }, [serverId, activeOrg, declaredEnvKeys, oauth, creds, onConnected, serverName, handleConnect]);
+  }, [serverId, activeOrg, oauth, creds, onConnected, serverName, handleConnect]);
 
   // Auto-trigger connect when credentials become ready (manual-only servers)
   useEffect(() => {