@stigmer/react 3.40.1 → 3.41.0

package/src/channel-app/CreateChannelAppForm.tsx

@@ -311,7 +311,6 @@ function ProviderPicker({
                 checked={checked}
                 onChange={() => onChange(p.id)}
                 disabled={disabled}
-                className="stg:accent-current"
               />
               <p.Icon className="stg:size-3.5 stg:shrink-0 stg:text-foreground" />
               <span className="stg:text-xs stg:font-medium stg:text-foreground">{p.label}</span>

package/src/channel-app/copy.ts

@@ -4,9 +4,9 @@
  * thing.
  *
  * A channel app carries its organization's Slack or Meta app secrets, so the
- * model shows it to its creator, anyone granted viewer on it and the
- * organization's admins, and plain members and viewers may not see it at all
- * (stigmer/stigmer#1384). An empty list is therefore not evidence that none
+ * model shows it to the organization's admins and anyone granted viewer on
+ * it, and plain members and viewers may not see it at all
+ * (stigmer/stigmer#1384, #1409). An empty list is therefore not evidence that none
  * is registered, so a caller who may not create channel apps is told who
  * manages them instead of being told that nothing exists.
  */

package/src/channel-app/internal.tsx

@@ -3,6 +3,7 @@
 import { useCallback } from "react";
 import { cn } from "@stigmer/theme";
 import { TruncatedText } from "../internal/truncated-text.js";
+import { UnknownPublicAddressNotice } from "../internal/UnknownPublicAddressNotice.js";
 import { useCopyFeedback } from "../internal/useCopyFeedback.js";
 
 /**
@@ -89,6 +90,26 @@ export function CopyRow({
   );
 }
 
+/**
+ * The place of a {@link CopyRow} whose URL cannot be built because the
+ * server's public address is unknown: the same label, then the shared
+ * notice in place of the value and its copy button.
+ */
+export function UnknownAddressRow({
+  label,
+  subject,
+}: {
+  label: string;
+  subject: string;
+}) {
+  return (
+    <div className="stg:space-y-1">
+      <p className="stg:text-xs stg:font-medium stg:text-foreground">{label}</p>
+      <UnknownPublicAddressNotice subject={subject} />
+    </div>
+  );
+}
+
 /** A multi-line copyable value (the app manifest) in a scrollable block. */
 export function CopyBlock({
   label,

package/src/channel-app/slackAppSetup.ts

@@ -53,7 +53,9 @@ export const SLACK_CHANNEL_APP_BOT_EVENTS = [
  * The events webhook URL for one ChannelApp: the per-app route the
  * receiver resolves the app's signing secret by.
  *
- * @param apiBaseUrl the Stigmer API origin (`stigmer.baseUrl`)
+ * @param apiBaseUrl the server's public base URL, absolute (the one
+ *                   `StigmerProvider`'s `publicBaseUrl` names, or the
+ *                   client's `baseUrl` when that is absolute)
  * @param channelAppId the ChannelApp resource id (`chapp_...`)
  */
 export function slackChannelAppWebhookUrl(

package/src/channel-app/whatsappAppSetup.ts

@@ -36,7 +36,9 @@ export const WHATSAPP_CHANNEL_APP_WEBHOOK_FIELDS = ["messages"] as const;
  * The events webhook URL for one ChannelApp: the per-app route the
  * receiver resolves the app's secret and verify token by.
  *
- * @param apiBaseUrl the Stigmer API origin (`stigmer.baseUrl`)
+ * @param apiBaseUrl the server's public base URL, absolute (the one
+ *                   `StigmerProvider`'s `publicBaseUrl` names, or the
+ *                   client's `baseUrl` when that is absolute)
  * @param channelAppId the ChannelApp resource id (`chapp_...`)
  */
 export function whatsappChannelAppWebhookUrl(

package/src/composer/SessionComposer.tsx

@@ -39,11 +39,7 @@ import { FileReferenceChipList } from "../file-reference/FileReferenceChipList.j
 import { FILE_REF_MIME } from "../internal/file-tree/index.js";
 import { useSessionEnvPool } from "../environment/useSessionEnvPool.js";
 import { usePersonalEnvironment } from "../environment/usePersonalEnvironment.js";
-import { useStigmer } from "../hooks.js";
-import {
-  SYSTEM_ENV_VAR_KEYS,
-  resolveSystemEnvVarValues,
-} from "../environment/systemEnvVars.js";
+import { SYSTEM_ENV_VAR_KEYS } from "../environment/systemEnvVars.js";
 import { useRenderTracer } from "../internal/dev/index.js";
 import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js";
 import {
@@ -714,8 +710,6 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
     [personalEnv.environment],
   );
 
-  const stigmer = useStigmer();
-
   const pool = useSessionEnvPool({
     personalEnvKeys,
     manualSecrets: sessionVariables?.entries,
@@ -1025,14 +1019,11 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
         }
       }
 
+      // Only what the page collected for this run: the platform's own keys
+      // are filled in the runner, below every value a user saved
+      // (systemEnvVars.ts header, stigmer/stigmer#1446).
       const env: Record<string, EnvVarInput> = {};
 
-      // System env vars first (lowest priority) — auto-resolved from
-      // the Stigmer client's connection context so MCP servers and
-      // agents can reach the backend without manual user input.
-      const systemVars = await resolveSystemEnvVarValues(stigmer);
-      Object.assign(env, systemVars);
-
       if (
         agentSetup.state.status === "ready" &&
         agentSetup.state.resolution.mode === "oneTime"
@@ -1108,7 +1099,7 @@ const SessionComposerInner = forwardRef<SessionComposerHandle, SessionComposerPr
         fileRefs.clear();
       }
     },
-    [onSubmit, effective, stigmer, agentSetup.state, mcpSetup.pendingRuntimeEnv, sessionVariables, enableAttachments, attachments, personalEnv, showInteractionModePicker, interactionMode],
+    [onSubmit, effective, agentSetup.state, mcpSetup.pendingRuntimeEnv, sessionVariables, enableAttachments, attachments, personalEnv, showInteractionModePicker, interactionMode],
   );
 
   const composer = useComposer({

package/src/environment/EnvironmentVariableEditor.tsx

@@ -586,7 +586,7 @@ function AddVariableForm({
             checked={isSecret}
             onChange={(e) => setIsSecret(e.target.checked)}
             disabled={isAdding}
-            className="stg:accent-primary stg:size-3"
+            className="stg:size-3"
           />
           Secret
         </label>

package/src/environment/index.ts

@@ -41,13 +41,7 @@ export type {
   SessionEnvPoolInput,
   UseSessionEnvPoolReturn,
 } from "./useSessionEnvPool.js";
-export {
-  SYSTEM_ENV_VAR_KEYS,
-  toGrpcAddress,
-  buildSystemEnvVars,
-  resolveSystemEnvVarValues,
-  resolveDeclaredSystemEnvVars,
-} from "./systemEnvVars.js";
+export { SYSTEM_ENV_VAR_KEYS } from "./systemEnvVars.js";
 export { EnvironmentPicker } from "./EnvironmentPicker.js";
 export type { EnvironmentPickerProps } from "./EnvironmentPicker.js";
 export { useToolCredentialsReadiness } from "./useToolCredentialsReadiness.js";

package/src/environment/systemEnvVars.ts

@@ -1,143 +1,31 @@
-import type { EnvVarInput, Stigmer } from "@stigmer/sdk";
-
 // ---------------------------------------------------------------------------
 // Well-known Stigmer platform environment variable keys
 //
-// These env vars configure MCP server subprocesses (and agents) to
-// communicate back to the Stigmer backend. Because the SDK client
-// already knows the server address and auth credential, the setup
-// hooks can skip prompting users for these values and inject them
-// automatically at session creation time.
+// A platform value comes from the component that knows it, fills only a key
+// that is still missing, and reaches only a server that declares it
+// (stigmer/stigmer#1446). The page is not that component for any key, so
+// this SDK supplies none: a value it wrote into a run's runtime env would
+// sit in the top merge layer, above every value a user saved, and a run
+// whose agent declares no env would carry it into the agent's shell.
+//
+// STIGMER_SERVER_ADDRESS is the one key the platform fills. The runner
+// writes it for a server that declares it and holds no value: from the
+// server's public address, which the server hands every sandbox it
+// provisions, or for a stdio child from the endpoint the runner dials
+// itself (backend/services/runner, the platform-server-address module).
+//
+// STIGMER_API_KEY is not a platform key. A server that calls the Stigmer
+// API declares it like any other secret, and its user saves an API key for
+// it; nothing hands a user-defined server the signed-in user's bearer.
 // ---------------------------------------------------------------------------
 
-const STIGMER_SERVER_ADDRESS = "STIGMER_SERVER_ADDRESS";
-const STIGMER_API_KEY = "STIGMER_API_KEY";
-
 /**
- * Environment variable keys that the SDK can resolve automatically
- * from the current {@link Stigmer} client context.
+ * Environment variable keys the platform fills itself, so the setup hooks
+ * never prompt a user for them and the credential forms never ask for them.
  *
- * Used by setup hooks to exclude these keys from the "missing
- * variables" prompt and by the session composer to inject their
- * values into runtime env at submit time.
- *
- * Platform builders who manage setup hooks directly can use this
- * set to extend their own `poolKeys`.
+ * Platform builders who manage setup hooks directly can use this set to
+ * extend their own `poolKeys`.
  */
 export const SYSTEM_ENV_VAR_KEYS: ReadonlySet<string> = new Set([
-  STIGMER_SERVER_ADDRESS,
-  STIGMER_API_KEY,
+  "STIGMER_SERVER_ADDRESS",
 ]);
-
-/**
- * Convert an HTTP(S) base URL to a gRPC host:port address.
- *
- * The Stigmer server serves both gRPC and gRPC-Web on the same
- * endpoint, so stripping the protocol and extracting host:port
- * produces a valid gRPC dial target.
- *
- * @example
- * ```ts
- * toGrpcAddress("http://localhost:7234")   // "localhost:7234"
- * toGrpcAddress("https://api.stigmer.ai")  // "api.stigmer.ai:443"
- * toGrpcAddress("https://api.stigmer.ai:8443") // "api.stigmer.ai:8443"
- * ```
- */
-export function toGrpcAddress(httpUrl: string): string {
-  try {
-    const url = new URL(httpUrl);
-    const host = url.hostname;
-    const port =
-      url.port || (url.protocol === "https:" ? "443" : "80");
-    return `${host}:${port}`;
-  } catch {
-    return httpUrl;
-  }
-}
-
-/**
- * Build system env var entries from raw connection parameters.
- *
- * Pure function — no side effects, no async. Suitable for unit
- * testing without a live Stigmer client.
- *
- * @param baseUrl - The Stigmer client's base URL (HTTP).
- * @param credential - Current auth credential, or `null` for
- *   unauthenticated (OSS) backends. When `null`, a placeholder
- *   value is used so the MCP server env var is always populated.
- */
-export function buildSystemEnvVars(
-  baseUrl: string,
-  credential: string | null,
-): Record<string, EnvVarInput> {
-  return {
-    [STIGMER_SERVER_ADDRESS]: {
-      value: toGrpcAddress(baseUrl),
-      isSecret: false,
-      description:
-        "Auto-resolved from the current Stigmer connection.",
-    },
-    [STIGMER_API_KEY]: {
-      value: credential || "unused",
-      isSecret: true,
-      description:
-        "Auto-resolved from the current Stigmer auth context.",
-    },
-  };
-}
-
-/**
- * Resolve system env var values from a live {@link Stigmer} client.
- *
- * Calls {@link Stigmer.getAuthCredential} to obtain the current
- * credential, then delegates to {@link buildSystemEnvVars}.
- *
- * Intended for use at session submit time — the returned values
- * are injected into `runtimeEnv` at the **lowest priority** so
- * any user-provided values (personal env, manual secrets) win.
- */
-export async function resolveSystemEnvVarValues(
-  stigmer: Stigmer,
-): Promise<Record<string, EnvVarInput>> {
-  const credential = await stigmer.getAuthCredential();
-  return buildSystemEnvVars(stigmer.baseUrl, credential);
-}
-
-/**
- * Resolve only the system env vars that the target resource actually
- * declares in its environment specification.
- *
- * System vars (`STIGMER_SERVER_ADDRESS`, `STIGMER_API_KEY`) should
- * only be injected when the resource needs them — blindly injecting
- * them causes `runtime_env` to be non-empty on the wire, which
- * changes the backend's missing-credential tolerance semantics.
- *
- * @param stigmer - Live Stigmer client for credential resolution.
- * @param declaredEnvKeys - The set of env var keys the target
- *   resource declares (e.g., `Object.keys(mcpServer.spec.env)`).
- *   Only system vars whose keys appear here are included.
- * @returns Filtered system env vars (may be empty).
- */
-export async function resolveDeclaredSystemEnvVars(
-  stigmer: Stigmer,
-  declaredEnvKeys: ReadonlySet<string> | readonly string[],
-): Promise<Record<string, EnvVarInput>> {
-  const keys =
-    declaredEnvKeys instanceof Set
-      ? declaredEnvKeys
-      : new Set(declaredEnvKeys);
-
-  const hasDeclared = [...SYSTEM_ENV_VAR_KEYS].some((k) => keys.has(k));
-  if (!hasDeclared) {
-    return {};
-  }
-
-  const all = await resolveSystemEnvVarValues(stigmer);
-  const filtered: Record<string, EnvVarInput> = {};
-  for (const [key, value] of Object.entries(all)) {
-    if (keys.has(key)) {
-      filtered[key] = value;
-    }
-  }
-  return filtered;
-}

package/src/execution/RecalledMemoriesCard.tsx

@@ -90,7 +90,7 @@ export const RecalledMemoriesCard = memo(function RecalledMemoriesCard({
         onClick={() => setExpanded((prev) => !prev)}
         className={cn(
           "stg:flex stg:w-full stg:items-center stg:gap-3 stg:px-3 stg:py-2 stg:text-left",
-          "stg:text-xs stg:text-muted-foreground hover:stg:text-foreground",
+          "stg:text-xs stg:text-muted-foreground stg:hover:text-foreground",
         )}
       >
         <MemoryIcon />

package/src/iam-policy/OrgMembersPanel.tsx

@@ -496,7 +496,9 @@ function RemoveCopy({
     case "member":
       return (
         <>
-          Remove {name} from this organization? This revokes all their access.
+          Remove {name} from this organization? They lose access to everything
+          in it, including what was shared with them and their teams. What
+          they created stays with the organization.
         </>
       );
     case "productUser":

package/src/iam-policy/useCheckPermission.ts

@@ -69,7 +69,10 @@ interface SettledCheck {
  * `false` (so operator-only navigation never appears where the seat
  * does not exist), `can_grant_access` on a resource the edition does not
  * share per person is `false` (open source grants roles on organizations
- * only), and everything else is the edition's authorizer's answer. By
+ * only), and everything else is the edition's authorizer's answer. So a
+ * control that changes who reaches a resource (its visibility, a share, a
+ * channel) asks `can_manage_audience`, never `can_grant_access`: the owner
+ * holds it in every edition. By
  * default the hook *fails open* while the check is in flight or when the
  * RPC fails, so a transient error never hides a control the server would
  * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden

package/src/iam-policy/useGrantableRoles.ts

@@ -26,7 +26,7 @@ export interface UseGrantableRolesReturn {
  * @example
  * ```tsx
  * const { roles, hasRoles } = useGrantableRoles(ApiResourceKind.agent);
- * // roles = [IamRole.owner, IamRole.viewer]
+ * // roles = [IamRole.owner, IamRole.editor, IamRole.viewer]
  * // hasRoles = true
  * ```
  */

package/src/iam-policy/useRevokeOrgAccess.ts

@@ -9,11 +9,13 @@ import { toError } from "../internal/toError.js";
 /** Return value of {@link useRevokeOrgAccess}. */
 export interface UseRevokeOrgAccessReturn {
   /**
-   * Remove all of a user's access to an organization.
+   * Remove a person from an organization.
    *
-   * Deletes every IAM policy granting the identity account access
-   * to the organization and its child resources (agents, environments,
-   * etc.) in a single operation.
+   * Revokes their roles on the organization and everything they hold on
+   * its resources: what was shared with them (agents, environments,
+   * sessions and the rest) and their team memberships, in a single
+   * operation. What they created stays with the organization; it is
+   * theirs again only if they are invited back.
    */
   readonly revoke: (accountId: string, orgId: string) => Promise<void>;
   /** `true` while the revoke request is in flight. */
@@ -28,10 +30,10 @@ export interface UseRevokeOrgAccessReturn {
  * Behavior hook that wraps `iamPolicy.revokeOrgAccess()` with
  * loading/error state.
  *
- * Removes all IAM policy bindings for a specific identity account
- * within an organization — including bindings on child resources
- * (agents, environments, etc.). This is the "remove member from org"
- * operation.
+ * Removes a person from an organization: their roles on it, what was
+ * shared with them on its resources and their team memberships. From
+ * then on they reach nothing in the organization; what they created
+ * stays with it. This is the "remove member from org" operation.
  *
  * @example
  * ```tsx

package/src/identity-account/AccountPreferencesPanel.tsx

@@ -15,6 +15,7 @@ import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityacc
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
 import { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
 import { useModelRegistry } from "../models/index.js";
+import { useServerInfo } from "../server-info.js";
 import { HARNESS_META, type HarnessOption } from "../models/harness.js";
 import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
@@ -49,6 +50,12 @@ export interface AccountPreferencesPanelProps {
  * answer with. A server that cannot answer surfaces its error through the
  * fetch-error state below, never a hidden branch.
  *
+ * The one posture question it does ask is about memory. The person's own
+ * memory switch is honoured only by a server that authenticates its
+ * callers; on a server that trusts every request (the single-operator
+ * laptop), memory is the organization's switch alone, so the panel says
+ * that in the switch's place rather than offering one that does nothing.
+ *
  * All visual properties flow through `--stgm-*` design tokens. Zero
  * dependencies on Console routing, auth context, or layout — platform
  * builders can embed it directly:
@@ -86,6 +93,8 @@ export function AccountPreferencesPanel({
     error: memoryFlagError,
   } = useUpdateIdentityAccount();
 
+  const memoryGovernance = useMemoryGovernance();
+
   const [standingContext, setStandingContext] = useState("");
   const [defaultHarness, setDefaultHarness] = useState("");
   const [defaultNativeModel, setDefaultNativeModel] = useState("");
@@ -377,14 +386,17 @@ export function AccountPreferencesPanel({
         </div>
       </div>
 
-      <MemoryEnabledRow
-        id={`${baseId}-memory-enabled`}
-        checked={account.spec?.preferences?.memoryEnabled ?? false}
-        onToggle={(next) => void handleMemoryToggle(next)}
-        saving={isSavingMemoryFlag}
-        error={memoryFlagError}
-        helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
-      />
+      {memoryGovernance === "organization" && <OrganizationGovernedMemory />}
+      {memoryGovernance === "person" && (
+        <MemoryEnabledRow
+          id={`${baseId}-memory-enabled`}
+          checked={account.spec?.preferences?.memoryEnabled ?? false}
+          onToggle={(next) => void handleMemoryToggle(next)}
+          saving={isSavingMemoryFlag}
+          error={memoryFlagError}
+          helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
+        />
+      )}
 
       {updateError && (
         <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
@@ -494,7 +506,7 @@ function HarnessOptionRow({
           disabled={disabled}
           aria-labelledby={titleId}
           aria-describedby={descriptionId}
-          className="stg:mt-0.5 stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
+          className="stg:mt-0.5 stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
         />
         <span className="stg:min-w-0 stg:flex-1">
           <span
@@ -584,3 +596,38 @@ function DefaultModelSelect({
     </div>
   );
 }
+
+/**
+ * Who decides memory on the connected server, for the memory row.
+ *
+ * - `"person"`: the person's own switch counts (a server that authenticates
+ *   its callers, one too old to report its posture, or one whose answer
+ *   failed: an unknown posture offers the control and lets the server
+ *   decide, as `authentication_required`'s contract says).
+ * - `"organization"`: the server trusts every request, so its one operator
+ *   decides memory through the organization's switch alone.
+ * - `null`: the server has not answered yet, so the row renders nothing
+ *   rather than a switch that flashes and disappears.
+ */
+function useMemoryGovernance(): "person" | "organization" | null {
+  const { serverInfo, error } = useServerInfo();
+  if (serverInfo !== null) {
+    return serverInfo.authenticationRequired === false ? "organization" : "person";
+  }
+  return error !== null ? "person" : null;
+}
+
+/** The memory row on a server where the organization's switch alone decides. */
+function OrganizationGovernedMemory() {
+  return (
+    <div className="stg:space-y-1">
+      <span className="stg:block stg:text-xs stg:font-medium stg:text-foreground">
+        Memory
+      </span>
+      <p className="stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground">
+        On this server, memory follows your organization&apos;s setting. Turn it
+        on or off in the organization&apos;s preferences.
+      </p>
+    </div>
+  );
+}

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -2,7 +2,7 @@
 
 import { useMemo } from "react";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
-import type { HarnessOption } from "../models/harness.js";
+import { isHarnessOption, type HarnessOption } from "../models/harness.js";
 
 /**
  * The current user's account-level execution defaults, shaped for the
@@ -57,10 +57,7 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
     // The proto validates default_harness to the shipped set, but a client
     // must not trust persisted data it did not write — unknown values are
     // treated as undeclared.
-    const harness =
-      prefs.defaultHarness === "native" || prefs.defaultHarness === "cursor"
-        ? (prefs.defaultHarness satisfies HarnessOption)
-        : undefined;
+    const harness = isHarnessOption(prefs.defaultHarness) ? prefs.defaultHarness : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
     // Only a declared `true` travels — an unset bool is "no preference",

package/src/index.ts

@@ -948,7 +948,7 @@ export type {
   UseUpdateScheduleSpecReturn,
 } from "./schedule/index.js";
 
-// Environment — data hooks, list hook, personal convenience hook, secret reveal, variable management, env var form, system env vars, and styled components
+// Environment — data hooks, list hook, personal convenience hook, secret reveal, variable management, env var form, the platform-filled key set, and styled components
 export {
   useEnvironment,
   useEnvironmentList,
@@ -964,10 +964,6 @@ export {
   EnvVarForm,
   useSessionEnvPool,
   SYSTEM_ENV_VAR_KEYS,
-  toGrpcAddress,
-  buildSystemEnvVars,
-  resolveSystemEnvVarValues,
-  resolveDeclaredSystemEnvVars,
   EnvironmentPicker,
   useToolCredentialsReadiness,
 } from "./environment/index.js";
@@ -1164,6 +1160,9 @@ export {
   useSubscription,
   useEntitlements,
   usePeriodEstimate,
+  useProviderKeys,
+  useProviderKeyActions,
+  ProviderKeysSection,
   useChangePlan,
   useCancelSubscription,
   useCreatePaymentMethodSetupSession,
@@ -1206,6 +1205,11 @@ export type {
   UseEntitlementsReturn,
   UsePeriodEstimateOptions,
   UsePeriodEstimateReturn,
+  ProviderKeyProvider,
+  UseProviderKeysOptions,
+  UseProviderKeysReturn,
+  UseProviderKeyActionsReturn,
+  ProviderKeysSectionProps,
   UseChangePlanReturn,
   UseCancelSubscriptionReturn,
   UseCreatePaymentMethodSetupSessionReturn,

package/src/internal/UnknownPublicAddressNotice.tsx

@@ -0,0 +1,31 @@
+"use client";
+
+/** Props for {@link UnknownPublicAddressNotice}. */
+export interface UnknownPublicAddressNoticeProps {
+  /** What cannot be shown, as it reads mid-sentence ("the callback URL"). */
+  readonly subject: string;
+}
+
+/**
+ * Shown in place of a copyable URL or snippet when the server's public
+ * address is unknown (`usePublicBaseUrl` answered `null`): the client talks
+ * to the server through a relative `baseUrl` and the host named no
+ * `publicBaseUrl`. One sentence, shared by every copy surface, so a user is
+ * told plainly why there is nothing to copy instead of being offered an
+ * address Slack, Meta or a backend cannot call.
+ *
+ * The surface keeps its own label above the notice, the shape the channel
+ * app panel already uses for a verify token it can no longer show. The
+ * reader is the host's user, not its developer, so the copy names no prop
+ * or configuration.
+ */
+export function UnknownPublicAddressNotice({
+  subject,
+}: UnknownPublicAddressNoticeProps) {
+  return (
+    <p className="stg:text-[0.65rem] stg:text-muted-foreground">
+      This app doesn&apos;t know your Stigmer server&apos;s public address, so
+      it can&apos;t show {subject}.
+    </p>
+  );
+}

package/src/internal/features.ts

@@ -23,7 +23,7 @@ export const FEATURE_COPY: Readonly<
   },
   [Feature.byo_provider_keys]: {
     label: "Bring your own provider keys",
-    description: "Use the customer's own LLM provider keys instead of the metered proxy.",
+    description: "Run agents on your own Anthropic and OpenAI keys, with no Stigmer commission on those tokens.",
   },
   [Feature.channels]: {
     label: "Channels",
@@ -31,7 +31,7 @@ export const FEATURE_COPY: Readonly<
   },
   [Feature.sharing]: {
     label: "Sharing",
-    description: "Share agents with individuals and guests through hosted links.",
+    description: "Share agents through hosted links, with your organization or with anyone who has the link.",
   },
   [Feature.teams]: {
     label: "Teams",

package/src/library/InstanceVisibilitySelector.tsx

@@ -26,7 +26,7 @@ export interface InstanceVisibilitySelectorProps {
   readonly mode?: VisibilitySelectorMode;
   /** Shows a spinner/disabled state while the RPC is in flight. */
   readonly isPending?: boolean;
-  /** Disables all interaction (e.g., when the user lacks can_edit). */
+  /** Disables all interaction (e.g., when the user lacks can_manage_audience). */
   readonly disabled?: boolean;
   /** Additional CSS classes applied to the root element. */
   readonly className?: string;