@stigmer/react 3.40.1 → 3.41.1-dev.20261003094357.g39d6aa748646

package/src/execution/sandbox-path-normalizer.ts

@@ -9,6 +9,7 @@
  *
  * @module
  */
+import { trimTrailing } from "../internal/trim.js";
 
 /**
  * Replace absolute sandbox workspace paths with workspace-relative
@@ -49,7 +50,7 @@ export function normalizeSandboxPaths(
 ): string {
   if (!text || !workspaceRoot) return text;
 
-  const wsRoot = workspaceRoot.replace(/\/+$/, "");
+  const wsRoot = trimTrailing(workspaceRoot, "/");
 
   // 1) Strip workspace root prefix (with trailing slash) → workspace-relative
   text = replaceAll(text, wsRoot + "/", "");

package/src/github/parseGitUrl.ts

@@ -9,7 +9,7 @@ export interface ParsedGitRepo {
   readonly repo: string;
 }
 
-const GITHUB_URL_RE = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$/;
+const GITHUB_HOST = "github.com";
 
 /**
  * Extract the owner and repository name from a GitHub URL.
@@ -22,7 +22,16 @@ const GITHUB_URL_RE = /github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$/;
  * Returns `null` for non-GitHub or unparseable URLs.
  */
 export function parseGitUrl(url: string): ParsedGitRepo | null {
-  const match = url.match(GITHUB_URL_RE);
-  if (!match) return null;
-  return { owner: match[1], repo: match[2] };
+  // Read by position rather than by a pattern: the lazy repository group of
+  // `github\.com[/:]([^/]+)\/([^/.]+?)(?:\.git)?$` backtracks on a long input.
+  const at = url.indexOf(GITHUB_HOST);
+  if (at === -1) return null;
+  const separator = url[at + GITHUB_HOST.length];
+  if (separator !== "/" && separator !== ":") return null;
+  const parts = url.slice(at + GITHUB_HOST.length + 1).split("/");
+  if (parts.length !== 2) return null;
+  const [owner, name] = parts as [string, string];
+  const repo = name.endsWith(".git") ? name.slice(0, -".git".length) : name;
+  if (owner === "" || repo === "" || repo.includes(".")) return null;
+  return { owner, repo };
 }

package/src/iam-policy/GrantAccessForm.tsx

@@ -45,7 +45,7 @@ export interface GrantAccessFormProps {
    * Organization whose people (and teams) can be granted access. Drives
    * the {@link PrincipalPicker} typeahead.
    */
-  readonly orgId: string;
+  readonly org: string;
   /**
    * Offer the organization's teams beside its people. Set it where the
    * resource can be shared with a team (`useShareFlow().canShareWithTeams`).
@@ -72,7 +72,7 @@ export interface GrantAccessFormProps {
  *   resourceKind={ApiResourceKind.agent}
  *   resourceKindString="agent"
  *   resourceId={agentId}
- *   orgId={orgId}
+ *   org={org}
  *   includeTeams={share.canShareWithTeams}
  *   onGranted={() => share.refetch()}
  *   onCancel={() => setShowForm(false)}
@@ -83,7 +83,7 @@ export function GrantAccessForm({
   resourceKind,
   resourceKindString,
   resourceId,
-  orgId,
+  org,
   includeTeams = false,
   excludeGrantees,
   onGranted,
@@ -150,7 +150,7 @@ export function GrantAccessForm({
     <form onSubmit={handleSubmit} className={cn("stg:space-y-3", className)}>
       <div className="stg:space-y-3">
         <PrincipalPicker
-          orgId={orgId}
+          org={org}
           value={grantee}
           onChange={chooseGrantee}
           includeTeams={includeTeams}

package/src/iam-policy/OrgMembersPanel.tsx

@@ -26,6 +26,7 @@ import { useDeleteIamPolicy } from "./useDeleteIamPolicy.js";
 import { RoleSelector } from "./RoleSelector.js";
 import { ProviderBadge } from "./ProviderBadge.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -34,7 +35,7 @@ import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 /** Props for {@link OrgMembersPanel}. */
 export interface OrgMembersPanelProps {
   /** Organization ID (`metadata.id`) whose members to manage. */
-  readonly orgId: string;
+  readonly org: string;
   /** Exposed refetch for parent-triggered refresh. */
   readonly onRefetchRef?: (refetch: () => void) => void;
   /** Additional CSS class names for the root container. */
@@ -71,11 +72,11 @@ export interface OrgMembersPanelProps {
  *
  * @example
  * ```tsx
- * <OrgMembersPanel orgId={activeOrg.metadata.id} />
+ * <OrgMembersPanel org={activeOrg.metadata.id} />
  * ```
  */
 export function OrgMembersPanel({
-  orgId,
+  org: orgId,
   onRefetchRef,
   className,
 }: OrgMembersPanelProps) {
@@ -127,10 +128,9 @@ export function OrgMembersPanel({
 
   if (isLoading) {
     return (
-      <div
+      <LoadingRegion
         className={cn("stg:space-y-2", className)}
-        aria-busy="true"
-        aria-label="Loading members"
+        label="Loading members"
       >
         {Array.from({ length: 3 }, (_, i) => (
           <div
@@ -138,7 +138,7 @@ export function OrgMembersPanel({
             className="stg:bg-muted-subtle stg:h-14 stg:animate-pulse stg:rounded-lg"
           />
         ))}
-      </div>
+      </LoadingRegion>
     );
   }
 
@@ -496,7 +496,9 @@ function RemoveCopy({
     case "member":
       return (
         <>
-          Remove {name} from this organization? This revokes all their access.
+          Remove {name} from this organization? They lose access to everything
+          in it, including what was shared with them and their teams. What
+          they created stays with the organization.
         </>
       );
     case "productUser":

package/src/iam-policy/PeopleWithAccess.tsx

@@ -42,7 +42,7 @@ export interface PeopleWithAccessProps {
    * Organization the resource belongs to (`metadata.org`). Drives the
    * people-and-teams typeahead in the grant form.
    */
-  readonly orgId: string;
+  readonly org: string;
   /** Additional CSS class names for the root container. */
   readonly className?: string;
 }
@@ -72,7 +72,7 @@ export function PeopleWithAccess({
   resource,
   resourceKindString,
   resourceKind,
-  orgId,
+  org,
   className,
 }: PeopleWithAccessProps) {
   const {
@@ -155,7 +155,7 @@ export function PeopleWithAccess({
                 resourceKind={resourceKind}
                 resourceKindString={resourceKindString}
                 resourceId={resource.id}
-                orgId={orgId}
+                org={org}
                 includeTeams={canShareWithTeams}
                 excludeGrantees={existingGrantees}
                 onGranted={() => {

package/src/iam-policy/PrincipalPicker.tsx

@@ -37,7 +37,7 @@ export type SelectedGrantee = GranteeCandidate;
 /** Props for {@link PrincipalPicker}. */
 export interface PrincipalPickerProps {
   /** Organization whose people (and teams) are selectable. */
-  readonly orgId: string;
+  readonly org: string;
   /** Currently selected grantee, or `null`. Controlled. */
   readonly value: SelectedGrantee | null;
   /** Fired when the selection changes. */
@@ -73,7 +73,7 @@ export interface PrincipalPickerProps {
  * All visual properties flow through `--stgm-*` design tokens.
  */
 export function PrincipalPicker({
-  orgId,
+  org,
   value,
   onChange,
   includeTeams = false,
@@ -85,7 +85,7 @@ export function PrincipalPicker({
 }: PrincipalPickerProps) {
   const listboxId = useId();
   const { people, teams, isLoading, error } = useGranteeCandidates({
-    orgId: orgId || null,
+    org: org || null,
     includeTeams,
   });
 

package/src/iam-policy/SharePanel.tsx

@@ -17,7 +17,7 @@ export interface SharePanelProps {
    * Organization the resource belongs to (`metadata.org`). Drives the
    * org-member typeahead in the grant form.
    */
-  readonly orgId: string;
+  readonly org: string;
   /** Fired when the user closes the panel. */
   readonly onClose?: () => void;
   /** Additional CSS class names for the root container. */
@@ -42,7 +42,7 @@ export interface SharePanelProps {
  *   resource={{ kind: "session", id: sessionId, resourceKind: ApiResourceKind.session }}
  *   resourceKindString="session"
  *   resourceKind={ApiResourceKind.session}
- *   orgId={orgId}
+ *   org={org}
  *   onClose={() => setOpen(false)}
  * />
  * ```
@@ -51,7 +51,7 @@ export function SharePanel({
   resource,
   resourceKindString,
   resourceKind,
-  orgId,
+  org,
   onClose,
   className,
 }: SharePanelProps) {
@@ -85,7 +85,7 @@ export function SharePanel({
         resource={resource}
         resourceKindString={resourceKindString}
         resourceKind={resourceKind}
-        orgId={orgId}
+        org={org}
       />
     </div>
   );

package/src/iam-policy/useCheckPermission.ts

@@ -69,7 +69,10 @@ interface SettledCheck {
  * `false` (so operator-only navigation never appears where the seat
  * does not exist), `can_grant_access` on a resource the edition does not
  * share per person is `false` (open source grants roles on organizations
- * only), and everything else is the edition's authorizer's answer. By
+ * only), and everything else is the edition's authorizer's answer. So a
+ * control that changes who reaches a resource (its visibility, a share, a
+ * channel) asks `can_manage_audience`, never `can_grant_access`: the owner
+ * holds it in every edition. By
  * default the hook *fails open* while the check is in flight or when the
  * RPC fails, so a transient error never hides a control the server would
  * honor. Pass `{ fail: "closed" }` for surfaces that must stay hidden

package/src/iam-policy/useCreateIamPolicy.ts

@@ -33,7 +33,7 @@ export interface UseCreateIamPolicyReturn {
  *
  * await create({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/src/iam-policy/useDeleteIamPolicy.ts

@@ -32,7 +32,7 @@ export interface UseDeleteIamPolicyReturn {
  *
  * await remove({
  *   principal: { kind: "identity_account", id: accountId },
- *   resource: { kind: "organization", id: orgId },
+ *   resource: { kind: "organization", id: org },
  *   relation: "admin",
  * });
  * ```

package/src/iam-policy/useGrantableRoles.ts

@@ -26,7 +26,7 @@ export interface UseGrantableRolesReturn {
  * @example
  * ```tsx
  * const { roles, hasRoles } = useGrantableRoles(ApiResourceKind.agent);
- * // roles = [IamRole.owner, IamRole.viewer]
+ * // roles = [IamRole.owner, IamRole.editor, IamRole.viewer]
  * // hasRoles = true
  * ```
  */

package/src/iam-policy/useGranteeCandidates.ts

@@ -49,7 +49,7 @@ export type GranteeCandidate = PersonCandidate | TeamCandidate;
 /** Options for {@link useGranteeCandidates}. */
 export interface UseGranteeCandidatesOptions {
   /** The organization whose people (and teams) are offered, or `null` to skip. */
-  readonly orgId: string | null;
+  readonly org: string | null;
   /** Offer the organization's teams too. Pass `false` where teams cannot be granted. */
   readonly includeTeams: boolean;
 }
@@ -70,13 +70,13 @@ export interface UseGranteeCandidatesReturn {
  * @example
  * ```tsx
  * const { people, teams } = useGranteeCandidates({
- *   orgId,
+ *   org,
  *   includeTeams: share.canShareWithTeams,
  * });
  * ```
  */
 export function useGranteeCandidates({
-  orgId,
+  org: orgId,
   includeTeams,
 }: UseGranteeCandidatesOptions): UseGranteeCandidatesReturn {
   const access = useResourceAccess(orgId ? { kind: "organization", id: orgId } : null);

package/src/iam-policy/useOwnerAssignment.ts

@@ -26,11 +26,11 @@ export interface UseOwnerAssignmentReturn {
  * change asks the same question here. Fails open, like every capability
  * gate: the server refuses whatever this lets through.
  *
- * @param orgId - The organization's id, or `null` to skip the check.
+ * @param org - The organization's id, or `null` to skip the check.
  */
-export function useOwnerAssignment(orgId: string | null): UseOwnerAssignmentReturn {
+export function useOwnerAssignment(org: string | null): UseOwnerAssignmentReturn {
   const { allowed } = useCheckPermission(
-    orgId ? { kind: "organization", id: orgId } : null,
+    org ? { kind: "organization", id: org } : null,
     "can_assign_roles",
   );
   return {

package/src/iam-policy/usePrincipalsCount.ts

@@ -33,33 +33,33 @@ export interface UsePrincipalsCountReturn {
  * `isPlatformClientAccount` (from `@stigmer/sdk`) marks, as
  * `OrgMembersPanel` does.
  *
- * Pass `null` as `orgId` to skip fetching (stable no-op).
+ * Pass `null` as `org` to skip fetching (stable no-op).
  *
- * @param orgId         - Organization ID, or `null` to skip.
+ * @param org         - Organization ID, or `null` to skip.
  * @param principalKind - Kind of principals to count. Defaults to `"identity_account"`.
  *
  * @example
  * ```tsx
- * const { count, isLoading } = usePrincipalsCount(orgId);
+ * const { count, isLoading } = usePrincipalsCount(org);
  * // count = 5
  * ```
  */
 export function usePrincipalsCount(
-  orgId: string | null,
+  org: string | null,
   principalKind: string = "identity_account",
 ): UsePrincipalsCountReturn {
   const stigmer = useStigmer();
 
   const { data: count, isLoading, isRefetching, error, refetch } = useFetch(
-    orgId
+    org
       ? () =>
           stigmer.iamPolicy
             .getPrincipalsCount(
-              create(GetPrincipalsCountInputSchema, { orgId, principalKind }),
+              create(GetPrincipalsCountInputSchema, { org, principalKind }),
             )
             .then((r) => r.count)
       : null,
-    [orgId, principalKind, stigmer],
+    [org, principalKind, stigmer],
     0,
   );
 

package/src/iam-policy/useResourceAccess.ts

@@ -57,7 +57,7 @@ export interface UseResourceAccessReturn {
  * @example
  * ```tsx
  * const { members, isLoading } = useResourceAccess(
- *   { kind: "organization", id: orgId },
+ *   { kind: "organization", id: org },
  *   { includeInherited: true },
  * );
  * ```

package/src/iam-policy/useRevokeOrgAccess.ts

@@ -9,13 +9,15 @@ import { toError } from "../internal/toError.js";
 /** Return value of {@link useRevokeOrgAccess}. */
 export interface UseRevokeOrgAccessReturn {
   /**
-   * Remove all of a user's access to an organization.
+   * Remove a person from an organization.
    *
-   * Deletes every IAM policy granting the identity account access
-   * to the organization and its child resources (agents, environments,
-   * etc.) in a single operation.
+   * Revokes their roles on the organization and everything they hold on
+   * its resources: what was shared with them (agents, environments,
+   * sessions and the rest) and their team memberships, in a single
+   * operation. What they created stays with the organization; it is
+   * theirs again only if they are invited back.
    */
-  readonly revoke: (accountId: string, orgId: string) => Promise<void>;
+  readonly revoke: (accountId: string, org: string) => Promise<void>;
   /** `true` while the revoke request is in flight. */
   readonly isRevoking: boolean;
   /** Error from the last failed revoke, or `null` when healthy. */
@@ -28,10 +30,10 @@ export interface UseRevokeOrgAccessReturn {
  * Behavior hook that wraps `iamPolicy.revokeOrgAccess()` with
  * loading/error state.
  *
- * Removes all IAM policy bindings for a specific identity account
- * within an organization — including bindings on child resources
- * (agents, environments, etc.). This is the "remove member from org"
- * operation.
+ * Removes a person from an organization: their roles on it, what was
+ * shared with them on its resources and their team memberships. From
+ * then on they reach nothing in the organization; what they created
+ * stays with it. This is the "remove member from org" operation.
  *
  * @example
  * ```tsx
@@ -49,7 +51,7 @@ export function useRevokeOrgAccess(): UseRevokeOrgAccessReturn {
   const clearError = useCallback(() => setError(null), []);
 
   const revoke = useCallback(
-    async (accountId: string, orgId: string): Promise<void> => {
+    async (accountId: string, org: string): Promise<void> => {
       setIsRevoking(true);
       setError(null);
 
@@ -57,7 +59,7 @@ export function useRevokeOrgAccess(): UseRevokeOrgAccessReturn {
         await stigmer.iamPolicy.revokeOrgAccess(
           create(RevokeOrgAccessInputSchema, {
             identityAccountId: accountId,
-            organizationId: orgId,
+            org,
           }),
         );
       } catch (err) {

package/src/identity-account/AccountPreferencesPanel.tsx

@@ -15,11 +15,13 @@ import type { IdentityAccount } from "@stigmer/protos/ai/stigmer/iam/identityacc
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
 import { useUpdateIdentityAccount } from "./useUpdateIdentityAccount.js";
 import { useModelRegistry } from "../models/index.js";
+import { useServerInfo } from "../server-info.js";
 import { HARNESS_META, type HarnessOption } from "../models/harness.js";
 import { MemoryEnabledRow } from "../internal/MemoryEnabledRow.js";
 import { StandingContextField } from "../internal/StandingContextField.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { Switch } from "../switch/Switch.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 /** Props for {@link AccountPreferencesPanel}. */
 export interface AccountPreferencesPanelProps {
@@ -49,6 +51,12 @@ export interface AccountPreferencesPanelProps {
  * answer with. A server that cannot answer surfaces its error through the
  * fetch-error state below, never a hidden branch.
  *
+ * The one posture question it does ask is about memory. The person's own
+ * memory switch is honoured only by a server that authenticates its
+ * callers; on a server that trusts every request (the single-operator
+ * laptop), memory is the organization's switch alone, so the panel says
+ * that in the switch's place rather than offering one that does nothing.
+ *
  * All visual properties flow through `--stgm-*` design tokens. Zero
  * dependencies on Console routing, auth context, or layout — platform
  * builders can embed it directly:
@@ -86,6 +94,8 @@ export function AccountPreferencesPanel({
     error: memoryFlagError,
   } = useUpdateIdentityAccount();
 
+  const memoryGovernance = useMemoryGovernance();
+
   const [standingContext, setStandingContext] = useState("");
   const [defaultHarness, setDefaultHarness] = useState("");
   const [defaultNativeModel, setDefaultNativeModel] = useState("");
@@ -223,14 +233,13 @@ export function AccountPreferencesPanel({
 
   if (isFetching && !account) {
     return (
-      <div
+      <LoadingRegion
         className={cn("stg:space-y-4", className)}
-        aria-busy="true"
-        aria-label="Loading account preferences"
+        label="Loading account preferences"
       >
         <div className="stg:bg-muted-subtle stg:h-28 stg:animate-pulse stg:rounded" />
         <div className="stg:bg-muted-subtle stg:h-8 stg:w-32 stg:animate-pulse stg:rounded" />
-      </div>
+      </LoadingRegion>
     );
   }
 
@@ -377,14 +386,17 @@ export function AccountPreferencesPanel({
         </div>
       </div>
 
-      <MemoryEnabledRow
-        id={`${baseId}-memory-enabled`}
-        checked={account.spec?.preferences?.memoryEnabled ?? false}
-        onToggle={(next) => void handleMemoryToggle(next)}
-        saving={isSavingMemoryFlag}
-        error={memoryFlagError}
-        helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
-      />
+      {memoryGovernance === "organization" && <OrganizationGovernedMemory />}
+      {memoryGovernance === "person" && (
+        <MemoryEnabledRow
+          id={`${baseId}-memory-enabled`}
+          checked={account.spec?.preferences?.memoryEnabled ?? false}
+          onToggle={(next) => void handleMemoryToggle(next)}
+          saving={isSavingMemoryFlag}
+          error={memoryFlagError}
+          helperText="When on, agents may propose facts to remember about you; only facts you confirm are stored. Confirmed memories are shared with your future sessions and appear on those executions' records; once you have many, each conversation recalls the most relevant ones, shown on the execution. Requires your organization to have memory enabled. Changes apply immediately."
+        />
+      )}
 
       {updateError && (
         <p className="stg:text-destructive stg:text-[0.65rem]" role="alert">
@@ -494,7 +506,7 @@ function HarnessOptionRow({
           disabled={disabled}
           aria-labelledby={titleId}
           aria-describedby={descriptionId}
-          className="stg:mt-0.5 stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
+          className="stg:mt-0.5 stg:focus-visible:outline-none stg:focus-visible:ring-1 stg:focus-visible:ring-ring"
         />
         <span className="stg:min-w-0 stg:flex-1">
           <span
@@ -584,3 +596,38 @@ function DefaultModelSelect({
     </div>
   );
 }
+
+/**
+ * Who decides memory on the connected server, for the memory row.
+ *
+ * - `"person"`: the person's own switch counts (a server that authenticates
+ *   its callers, one too old to report its posture, or one whose answer
+ *   failed: an unknown posture offers the control and lets the server
+ *   decide, as `authentication_required`'s contract says).
+ * - `"organization"`: the server trusts every request, so its one operator
+ *   decides memory through the organization's switch alone.
+ * - `null`: the server has not answered yet, so the row renders nothing
+ *   rather than a switch that flashes and disappears.
+ */
+function useMemoryGovernance(): "person" | "organization" | null {
+  const { serverInfo, error } = useServerInfo();
+  if (serverInfo !== null) {
+    return serverInfo.authenticationRequired === false ? "organization" : "person";
+  }
+  return error !== null ? "person" : null;
+}
+
+/** The memory row on a server where the organization's switch alone decides. */
+function OrganizationGovernedMemory() {
+  return (
+    <div className="stg:space-y-1">
+      <span className="stg:block stg:text-xs stg:font-medium stg:text-foreground">
+        Memory
+      </span>
+      <p className="stg:text-[0.65rem] stg:leading-snug stg:text-muted-foreground">
+        On this server, memory follows your organization&apos;s setting. Turn it
+        on or off in the organization&apos;s preferences.
+      </p>
+    </div>
+  );
+}

package/src/identity-account/useAccountExecutionDefaults.ts

@@ -2,7 +2,7 @@
 
 import { useMemo } from "react";
 import { useMyIdentityAccount } from "./useMyIdentityAccount.js";
-import type { HarnessOption } from "../models/harness.js";
+import { isHarnessOption, type HarnessOption } from "../models/harness.js";
 
 /**
  * The current user's account-level execution defaults, shaped for the
@@ -57,10 +57,7 @@ export function useAccountExecutionDefaults(): AccountExecutionDefaults | undefi
     // The proto validates default_harness to the shipped set, but a client
     // must not trust persisted data it did not write — unknown values are
     // treated as undeclared.
-    const harness =
-      prefs.defaultHarness === "native" || prefs.defaultHarness === "cursor"
-        ? (prefs.defaultHarness satisfies HarnessOption)
-        : undefined;
+    const harness = isHarnessOption(prefs.defaultHarness) ? prefs.defaultHarness : undefined;
     const nativeModel = prefs.defaultNativeModel || undefined;
     const cursorModel = prefs.defaultCursorModel || undefined;
     // Only a declared `true` travels — an unset bool is "no preference",

package/src/identity-provider/IdentityProviderDetailPanel.tsx

@@ -136,8 +136,8 @@ export function IdentityProviderDetailPanel({
       clearError();
       try {
         // Full-spec-replace safety: spread the complete mapped input and
-        // override only the edited fields, so unlisted spec fields (e.g.
-        // rate_limit_budget) survive the save. Fields the form clears
+        // override only the edited fields, so a spec field the form does
+        // not list survives the save. Fields the form clears
         // (SSO providers have no JIT settings) are set to undefined
         // explicitly — omitting them would carry the stale mapped value.
         const updated = await update({
@@ -289,7 +289,7 @@ export function IdentityProviderDetailPanel({
             value={userinfoEndpoint}
             onChange={setUserinfoEndpoint}
             placeholder="https://example.com/userinfo"
-            hint="Optional — used to fetch user profile data"
+            hint="Optional. Read only when Stigmer creates an account from a token with no email claim"
             disabled={isUpdating}
           />
 
@@ -421,12 +421,6 @@ function ViewMode({
           hint="Share this URL with your team members to sign in via SSO"
         />
       )}
-      {(spec?.rateLimitBudget ?? 0) > 0 && (
-        <Field
-          label="Rate limit"
-          value={`${spec!.rateLimitBudget} req/min`}
-        />
-      )}
 
       {/* JIT provisioning fields */}
       {!spec?.isSsoProvider && spec?.autoProvisionAccounts && (

package/src/identity-provider/IdentityProviderListPanel.tsx

@@ -10,6 +10,7 @@ import { Tooltip, TooltipContent, TooltipTrigger } from "../internal/tooltip.js"
 import { useIdentityProviderList } from "./useIdentityProviderList.js";
 import { useDeleteIdentityProvider } from "./useDeleteIdentityProvider.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 /** Props for {@link IdentityProviderListPanel}. */
 export interface IdentityProviderListPanelProps {
@@ -75,10 +76,9 @@ export function IdentityProviderListPanel({
 
   if (isLoading) {
     return (
-      <div
+      <LoadingRegion
         className={cn("stg:space-y-2", className)}
-        aria-busy="true"
-        aria-label="Loading identity providers"
+        label="Loading identity providers"
       >
         {Array.from({ length: 2 }, (_, i) => (
           <div
@@ -86,7 +86,7 @@ export function IdentityProviderListPanel({
             className="stg:bg-muted-subtle stg:h-14 stg:animate-pulse stg:rounded-lg"
           />
         ))}
-      </div>
+      </LoadingRegion>
     );
   }
 

package/src/identity-provider/IdentityProviderWizard.tsx

@@ -557,7 +557,7 @@ function ReviewStep({
         value={userinfoEndpoint}
         onChange={onUserinfoEndpointChange}
         placeholder="https://example.com/userinfo"
-        hint="Optional — used to fetch user profile data during token exchange"
+        hint="Optional. Read only when Stigmer creates an account from a token with no email claim"
         disabled={isCreating}
       />