@stigmer/react 3.40.1 → 3.41.1-dev.20261003094357.g39d6aa748646

package/src/internal/markdown-components.tsx

@@ -97,7 +97,7 @@ export function unwrapEnclosingMarkdownFence(
  * blank lines only). Group 1 is the heading text; the match spans through the
  * heading's trailing newline(s) so `body` starts at the first content line.
  */
-const LEADING_H1_RE = /^#[ \t]+(.+?)[ \t]*(?:\r?\n+|$)/;
+const LEADING_H1_MARKER = /^#[ \t]+/;
 
 /**
  * Splits a markdown document into its leading `# H1` title and the remaining
@@ -115,10 +115,21 @@ export function extractLeadingH1(markdown: string): {
   readonly title: string | null;
   readonly body: string;
 } {
+  // Read line by line: a single pattern over the heading and the newlines
+  // after it backtracks on a long run of spaces.
   const trimmed = markdown.trim();
-  const match = LEADING_H1_RE.exec(trimmed);
-  if (!match) return { title: null, body: markdown };
-  return { title: match[1], body: trimmed.slice(match[0].length) };
+  const lineEnd = trimmed.indexOf("\n");
+  const firstLine = lineEnd === -1 ? trimmed : trimmed.slice(0, lineEnd);
+  const marker = LEADING_H1_MARKER.exec(firstLine);
+  if (!marker) return { title: null, body: markdown };
+  const rawTitle = firstLine.slice(marker[0].length).replace(/\r$/, "");
+  let titleEnd = rawTitle.length;
+  while (titleEnd > 0 && (rawTitle[titleEnd - 1] === " " || rawTitle[titleEnd - 1] === "\t")) titleEnd -= 1;
+  const title = rawTitle.slice(0, titleEnd);
+  if (title === "") return { title: null, body: markdown };
+  let bodyStart = lineEnd === -1 ? trimmed.length : lineEnd + 1;
+  while (trimmed[bodyStart] === "\n") bodyStart += 1;
+  return { title, body: trimmed.slice(bodyStart) };
 }
 
 /**

package/src/internal/trim.ts

@@ -0,0 +1,10 @@
+/**
+ * `value` without its trailing run of `char`. A `/x+$/` regex rescans the run
+ * from every starting position, so a long run costs quadratic time; this walks
+ * it once.
+ */
+export function trimTrailing(value: string, char: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === char) end -= 1;
+  return end === value.length ? value : value.slice(0, end);
+}

package/src/invitation/InvitationManager.tsx

@@ -21,6 +21,7 @@ import { RoleSelector } from "../iam-policy/RoleSelector.js";
 import { useOwnerAssignment } from "../iam-policy/useOwnerAssignment.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
 import { useCopyFeedback } from "../internal/useCopyFeedback.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -115,10 +116,9 @@ export function InvitationManager({
 
   if (isLoading) {
     return (
-      <div
+      <LoadingRegion
         className={cn("stg:space-y-2", className)}
-        aria-busy="true"
-        aria-label="Loading invitations"
+        label="Loading invitations"
       >
         {Array.from({ length: 2 }, (_, i) => (
           <div
@@ -126,7 +126,7 @@ export function InvitationManager({
             className="stg:bg-muted-subtle stg:h-14 stg:animate-pulse stg:rounded-lg"
           />
         ))}
-      </div>
+      </LoadingRegion>
     );
   }
 

package/src/invitation/InvitationRedemption.tsx

@@ -8,6 +8,7 @@ import { timestampDate } from "@bufbuild/protobuf/wkt";
 import { useInvitationPreview } from "./useInvitationPreview.js";
 import { useRedeemInvitation } from "./useRedeemInvitation.js";
 import { SpinnerIcon } from "../internal/SpinnerIcon.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 // ---------------------------------------------------------------------------
 // Public API
@@ -141,13 +142,12 @@ export function InvitationRedemption({
   // Loading state
   if (isLoading) {
     return (
-      <div
+      <LoadingRegion
         className={cn("stg:mx-auto stg:max-w-sm", className)}
-        aria-busy="true"
-        aria-label="Loading invitation"
+        label="Loading invitation"
       >
         <LoadingSkeleton />
-      </div>
+      </LoadingRegion>
     );
   }
 
@@ -174,7 +174,7 @@ export function InvitationRedemption({
 
   // Redemption success
   if (accepted) {
-    const orgName = preview.organizationName || "the organization";
+    const orgName = preview.orgName || "the organization";
     const roleName = iamRoleDisplayName(preview.role);
     return (
       <div className={cn("stg:mx-auto stg:max-w-sm", className)}>
@@ -191,8 +191,8 @@ export function InvitationRedemption({
     );
   }
 
-  const orgName = preview.organizationName || "Unknown organization";
-  const orgLogo = preview.organizationLogoUrl;
+  const orgName = preview.orgName || "Unknown organization";
+  const orgLogo = preview.orgLogoUrl;
   const orgInitial = orgName.charAt(0).toUpperCase();
   const roleName = iamRoleDisplayName(preview.role);
   const expiresAt = preview.expiresAt ? timestampDate(preview.expiresAt) : null;

package/src/invitation/useInvitationPreview.ts

@@ -54,7 +54,7 @@ export interface UseInvitationPreviewReturn {
  * if (!preview) return <NotFound />;
  * if (!preview.isValid) return <Expired reason={preview.invalidReason} />;
  *
- * return <p>Join {preview.organizationName} as {preview.role}</p>;
+ * return <p>Join {preview.orgName} as {preview.role}</p>;
  * ```
  */
 export function useInvitationPreview(

package/src/library/InstanceVisibilitySelector.tsx

@@ -26,7 +26,7 @@ export interface InstanceVisibilitySelectorProps {
   readonly mode?: VisibilitySelectorMode;
   /** Shows a spinner/disabled state while the RPC is in flight. */
   readonly isPending?: boolean;
-  /** Disables all interaction (e.g., when the user lacks can_edit). */
+  /** Disables all interaction (e.g., when the user lacks can_manage_audience). */
   readonly disabled?: boolean;
   /** Additional CSS classes applied to the root element. */
   readonly className?: string;

package/src/library/ResourceVisibilityControl.tsx

@@ -71,10 +71,13 @@ export interface ResourceVisibilityControlProps {
  *
  * Behavior:
  * - Always renders a legible state: a read-only {@link VisibilityBadge}
- *   is shown to viewers without `can_edit` and while the permission check
- *   is in flight — never a silent blank.
+ *   is shown to anyone without `can_manage_audience` and while the
+ *   permission check is in flight — never a silent blank.
  * - Upgrades to the interactive {@link VisibilitySelector} for users with
- *   `can_edit`, persisting changes via {@link useUpdateVisibility} and invoking
+ *   `can_manage_audience`, the server's bar on every `updateVisibility`:
+ *   visibility decides who reaches the resource, so an editor, who may
+ *   change the definition, sees the badge. Persists changes via
+ *   {@link useUpdateVisibility} and invokes
  *   {@link ResourceVisibilityControlProps.onChanged} on success.
  *
  * Offered levels are kind- and context-aware (`visibilityLevels.ts`):
@@ -166,7 +169,7 @@ export function ResourceVisibilityControl({
   return (
     <PermissionGate
       resource={{ kind: FGA_KIND[kind], id: resourceId }}
-      relation="can_edit"
+      relation="can_manage_audience"
       fallback={badge}
       loading={badge}
     >

package/src/library/VisibilitySelector.tsx

@@ -54,7 +54,7 @@ export interface VisibilitySelectorProps {
   readonly mode?: VisibilitySelectorMode;
   /** Shows a spinner/disabled state while the RPC is in flight. */
   readonly isPending?: boolean;
-  /** Disables all interaction (e.g., when the user lacks can_edit). */
+  /** Disables all interaction (e.g., when the user lacks can_manage_audience). */
   readonly disabled?: boolean;
   /** Accessible name for the control. Defaults to "Resource visibility". */
   readonly ariaLabel?: string;
@@ -444,7 +444,7 @@ export interface VisibilityBadgeProps {
  * for a row from before its retirement).
  *
  * Rendered wherever the interactive {@link VisibilitySelector} is not
- * available — for viewers who lack `can_edit`, and while a permission check
+ * available — for anyone who lacks `can_manage_audience`, and while a permission check
  * is in flight — so a resource's visibility is always legible rather than
  * silently blank. Shares the chip styling with the selector trigger so the
  * read-only and editable states are visually consistent.

package/src/licenses/LicenseDetail.tsx

@@ -116,8 +116,8 @@ export function LicenseDetail({
         <Row label="Customer">
           <span className="stg:block">{customer?.displayName}</span>
           <span className="stg:block stg:text-muted-foreground">{customer?.contactEmail}</span>
-          {customer?.organization && (
-            <span className="stg:block stg:text-muted-foreground">{`Cloud organization ${customer.organization}`}</span>
+          {customer?.org && (
+            <span className="stg:block stg:text-muted-foreground">{`Cloud organization ${customer.org}`}</span>
           )}
         </Row>
         <Row label="Term">{spec ? termLabel(spec.term) : "Unknown"}</Row>
@@ -140,8 +140,8 @@ export function LicenseDetail({
             {limits?.maxUsers !== undefined ? `${limits.maxUsers} users` : "Unlimited users"}
           </span>
           <span className="stg:block">
-            {limits?.maxOrganizations !== undefined
-              ? `${limits.maxOrganizations} organizations`
+            {limits?.maxOrgs !== undefined
+              ? `${limits.maxOrgs} organizations`
               : "Unlimited organizations"}
           </span>
         </Row>
@@ -157,10 +157,12 @@ export function LicenseDetail({
         <Row label="Issued">
           {issuedAt ? <Instant date={issuedAt}>{formatInstantUtc(issuedAt)}</Instant> : "Unknown"}
           {/* The audit names the account, not only its role-like display name:
-              with several operators, "who issued this contract" needs the address. */}
+              with several operators, "who issued this contract" needs the address.
+              An account with no name of its own is called by its email, so
+              the address is shown once. */}
           {issuer && (issuer.email || issuer.displayName) && (
             <span className="stg:block stg:text-muted-foreground">
-              {issuer.displayName && issuer.email
+              {issuer.displayName && issuer.email && issuer.displayName !== issuer.email
                 ? `by ${issuer.displayName} (${issuer.email})`
                 : `by ${issuer.displayName || issuer.email}`}
             </span>

package/src/licenses/LicenseIssueForm.tsx

@@ -71,7 +71,7 @@ type CustomerMode = "existing" | "new";
  * browser-blue control inside its brand.
  */
 const NATIVE_CONTROL =
-  "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:accent-primary stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:focus-visible:ring-offset-1";
+  "stg:size-3.5 stg:shrink-0 stg:cursor-pointer stg:focus-visible:outline-none stg:focus-visible:ring-2 stg:focus-visible:ring-ring stg:focus-visible:ring-offset-1";
 
 const TERM_PRESET_HINT: Readonly<Record<IssuableTerm, string>> = {
   [LicenseTerm.trial]: "30 days",
@@ -87,7 +87,7 @@ const VIOLATION_COPY: Readonly<Record<string, string>> = {
   "spec.customer.display_name": "Name the customer.",
   "spec.customer.contact_email": "Enter the address renewal notices go to.",
   "spec.entitlements.limits.max_users": "Enter at least 1, or leave it empty for unlimited.",
-  "spec.entitlements.limits.max_organizations": "Enter at least 1, or leave it empty for unlimited.",
+  "spec.entitlements.limits.max_orgs": "Enter at least 1, or leave it empty for unlimited.",
   "spec.notes": "Notes are limited to 4,096 characters.",
 };
 
@@ -134,7 +134,7 @@ export function LicenseIssueForm({
   });
   const [maxUsers, setMaxUsers] = useState(limitText(renewing?.spec?.entitlements?.limits?.maxUsers));
   const [maxOrganizations, setMaxOrganizations] = useState(
-    limitText(renewing?.spec?.entitlements?.limits?.maxOrganizations),
+    limitText(renewing?.spec?.entitlements?.limits?.maxOrgs),
   );
   const [features, setFeatures] = useState<readonly GrantableFeature[]>(() =>
     (renewing?.spec?.entitlements?.features ?? []).filter(isGrantableFeature),
@@ -154,9 +154,9 @@ export function LicenseIssueForm({
           id: selected.customer.id,
           displayName: selected.customer.displayName,
           contactEmail: selected.customer.contactEmail,
-          organization: selected.customer.organization,
+          org: selected.customer.org,
         }
-      : { id: mintedId, displayName: newName, contactEmail: newEmail, organization: newOrganization };
+      : { id: mintedId, displayName: newName, contactEmail: newEmail, org: newOrganization };
   const matches =
     mode === "new" ? findCustomerMatches(customers, { displayName: newName, contactEmail: newEmail }) : [];
 
@@ -179,7 +179,7 @@ export function LicenseIssueForm({
       lastCoveredDay,
       graceDays: grace.value,
       maxUsers: users.value,
-      maxOrganizations: organizations.value,
+      maxOrgs: organizations.value,
       features,
       notes,
     };
@@ -473,7 +473,7 @@ export function LicenseIssueForm({
               message={shown(
                 maxOrganizations !== "",
                 organizations.ok
-                  ? violationAt("spec.entitlements.limits.max_organizations")
+                  ? violationAt("spec.entitlements.limits.max_orgs")
                   : organizations.error,
               )}
             />

package/src/licenses/license-draft.ts

@@ -65,7 +65,7 @@ export interface LicenseDraft {
   /** `undefined` means unlimited, as the contract reads an absent limit. */
   readonly maxUsers: number | undefined;
   /** `undefined` means unlimited, as the contract reads an absent limit. */
-  readonly maxOrganizations: number | undefined;
+  readonly maxOrgs: number | undefined;
   readonly features: readonly GrantableFeature[];
   /** Operator notes; never signed, never shown to the customer. */
   readonly notes: string;
@@ -148,9 +148,9 @@ export function toLicenseInput(draft: LicenseDraft): LicenseInput {
   const graceUntil = new Date(expiresAt.getTime() + draft.graceDays * DAY_MS);
   const limits: EntitlementLimitsInput = {
     ...(draft.maxUsers !== undefined && { maxUsers: draft.maxUsers }),
-    ...(draft.maxOrganizations !== undefined && { maxOrganizations: draft.maxOrganizations }),
+    ...(draft.maxOrgs !== undefined && { maxOrgs: draft.maxOrgs }),
   };
-  const organization = draft.customer.organization?.trim();
+  const organization = draft.customer.org?.trim();
   const notes = draft.notes.trim();
 
   return {
@@ -162,7 +162,7 @@ export function toLicenseInput(draft: LicenseDraft): LicenseInput {
       id: draft.customer.id,
       displayName: collapse(draft.customer.displayName),
       contactEmail: draft.customer.contactEmail.trim(),
-      ...(organization ? { organization } : {}),
+      ...(organization ? { org: organization } : {}),
     },
     entitlements: {
       ...(Object.keys(limits).length > 0 && { limits }),

package/src/licenses/license-format.ts

@@ -27,11 +27,17 @@ export type IssuableTerm = LicenseTerm.trial | LicenseTerm.paid;
 
 /**
  * Features a Cloud plan sells but a license never carries: they tier the
- * hosted runtime, and an Enterprise deployment has them by edition, so
- * offering one on a license would sell a capability the license does not
- * control.
+ * Cloud's hosted runtime, and on a self-hosted deployment the edition
+ * decides whether they exist, never a license, so offering one on a
+ * license would sell a capability the license does not control. A license
+ * issued before a value joined this list may still carry it; the console
+ * shows it nowhere.
  */
-export type PlanOnlyFeature = Feature.teams | Feature.managed_organizations;
+export type PlanOnlyFeature =
+  | Feature.channels
+  | Feature.sharing
+  | Feature.teams
+  | Feature.managed_organizations;
 
 /**
  * Features the contract names but nothing gates: every edition serves them
@@ -71,8 +77,6 @@ export const FEATURE_LABELS: Readonly<
 > = {
   [Feature.sso_enforcement]: FEATURE_COPY[Feature.sso_enforcement],
   [Feature.byo_provider_keys]: FEATURE_COPY[Feature.byo_provider_keys],
-  [Feature.channels]: FEATURE_COPY[Feature.channels],
-  [Feature.sharing]: FEATURE_COPY[Feature.sharing],
 };
 
 /** Every grantable feature, in contract order (derived from the label map). */
@@ -153,7 +157,7 @@ export function entitlementParts(entitlements: Entitlements | undefined): readon
   const features = entitlements?.features.filter(isGrantableFeature).length ?? 0;
   return [
     limitPart(limits?.maxUsers, "user"),
-    limitPart(limits?.maxOrganizations, "organization"),
+    limitPart(limits?.maxOrgs, "organization"),
     features === 0 ? "No features" : plural(features, "feature"),
   ];
 }
@@ -163,7 +167,7 @@ export function limitPart(limit: number | undefined, noun: string): string {
   return limit === undefined ? `Unlimited ${noun}s` : plural(limit, noun);
 }
 
-/** The granted features by name, in contract order: "SSO enforcement, Channels". */
+/** The granted features by name, in contract order: "SSO enforcement, Bring your own provider keys". */
 export function featureNames(features: readonly number[]): string {
   const names = GRANTABLE_FEATURES.filter((f) => features.includes(f)).map((f) => FEATURE_LABELS[f].label);
   return names.length === 0 ? "No features" : names.join(", ");

package/src/mcp-server/McpServerConnectDialog.tsx

@@ -156,20 +156,18 @@ function ConnectDialogContent({
 
   const serverName = mcpServer?.metadata?.name ?? slug;
   const serverId = mcpServer?.metadata?.id ?? "";
-  const declaredEnvKeys = Object.keys(mcpServer?.spec?.env ?? {});
-
   const handleConnect = useCallback(async () => {
     if (!serverId) return;
 
     setPhase("connecting");
     try {
-      await connect(serverId, activeOrg, undefined, declaredEnvKeys);
+      await connect(serverId, activeOrg);
       setPhase("success");
       onConnected?.(serverName);
     } catch {
       setPhase("error");
     }
-  }, [serverId, activeOrg, declaredEnvKeys, connect, onConnected, serverName]);
+  }, [serverId, activeOrg, connect, onConnected, serverName]);
 
   const handleCredentialSubmit = useCallback(
     async (values: Record<string, EnvVarInput>) => {
@@ -188,7 +186,7 @@ function ConnectDialogContent({
       void handleConnect();
       return;
     }
-    oauth.startOAuth(serverId, activeOrg, declaredEnvKeys).then(
+    oauth.startOAuth(serverId, activeOrg).then(
       () => {
         creds.refetch();
         setPhase("success");
@@ -203,7 +201,7 @@ function ConnectDialogContent({
         setPhase("error");
       },
     );
-  }, [serverId, activeOrg, declaredEnvKeys, oauth, creds, onConnected, serverName, handleConnect]);
+  }, [serverId, activeOrg, oauth, creds, onConnected, serverName, handleConnect]);
 
   // Auto-trigger connect when credentials become ready (manual-only servers)
   useEffect(() => {

package/src/mcp-server/McpServerDetailView.tsx

@@ -50,6 +50,7 @@ import { InlineEditKeyValue } from "../inline-edit/InlineEditKeyValue.js";
 import type { KeyValueRow, SelectOption } from "../inline-edit/types.js";
 import { ManagedByPluginNotice } from "../plugin/ManagedByPluginNotice.js";
 import { useManagingPlugin } from "../plugin/useManagingPlugin.js";
+import { LoadingRegion } from "../internal/LoadingRegion.js";
 
 /** Tab identifier for the MCP server capability panel. */
 export type CapabilityTab = "tools" | "policies" | "resources";
@@ -263,9 +264,8 @@ export function McpServerDetailView({
   const handleOAuthSignIn = useCallback(async () => {
     if (!mcpServer?.metadata?.id) return;
 
-    const envKeys = Object.keys(mcpServer.spec?.env ?? {});
     try {
-      await oauth.startOAuth(mcpServer.metadata.id, activeOrg ?? org, envKeys);
+      await oauth.startOAuth(mcpServer.metadata.id, activeOrg ?? org);
       credentials.refetch();
       refetch();
     } catch {
@@ -305,9 +305,8 @@ export function McpServerDetailView({
       return;
     }
 
-    const envKeys = Object.keys(mcpServer.spec?.env ?? {});
     try {
-      await connection.connect(mcpServer.metadata.id, activeOrg ?? org, undefined, envKeys);
+      await connection.connect(mcpServer.metadata.id, activeOrg ?? org);
       // Discovery succeeded — retire the OAuth chain's stale
       // discovery-failure error so the banner doesn't outlive the state
       // it described.
@@ -330,9 +329,8 @@ export function McpServerDetailView({
         }
 
         if (mcpServer?.metadata?.id) {
-          const envKeys = Object.keys(mcpServer.spec?.env ?? {});
           const connectOrg = activeOrg ?? org;
-          await connection.connect(mcpServer.metadata.id, connectOrg, values, envKeys);
+          await connection.connect(mcpServer.metadata.id, connectOrg, values);
           refetch();
         }
 
@@ -2205,10 +2203,9 @@ function Dot() {
 
 function LoadingSkeleton({ className }: { readonly className?: string }) {
   return (
-    <div
+    <LoadingRegion
       className={cn("stg:flex stg:flex-col stg:gap-6", className)}
-      aria-busy="true"
-      aria-label="Loading MCP server details"
+      label="Loading MCP server details"
     >
       <div className="stg:flex stg:items-start stg:gap-3">
         <div className="stg:mt-1 stg:size-6 stg:shrink-0 stg:animate-pulse stg:rounded stg:bg-muted" />
@@ -2227,7 +2224,7 @@ function LoadingSkeleton({ className }: { readonly className?: string }) {
           />
         </div>
       ))}
-    </div>
+    </LoadingRegion>
   );
 }
 

package/src/mcp-server/McpServerPicker.tsx

@@ -428,11 +428,6 @@ export function McpServerPicker({
       (oauthStatus?.vendorApprovalStatus === VendorApprovalStatus.PENDING ||
         oauthStatus?.vendorApprovalStatus === VendorApprovalStatus.REJECTED);
 
-    // System env vars are only injected when the server declares them —
-    // the dialog and detail view pass these on every OAuth chain and
-    // bare connect; the picker must too.
-    const declaredEnvKeys = Object.keys(entry.mcpServer.spec?.env ?? {});
-
     // Scope the shared hooks' signals to the server they belong to.
     const isOwnOAuthAttempt = oauthAttemptKey === view.serverKey;
     const oauthError = isOwnOAuthAttempt ? oauth.error : null;
@@ -476,12 +471,7 @@ export function McpServerPicker({
                 // server-side. Retry bare discovery; never relaunch the
                 // popup (stigmer/stigmer#418).
                 try {
-                  await discovery.connect(
-                    serverId,
-                    connectOrg,
-                    undefined,
-                    declaredEnvKeys,
-                  );
+                  await discovery.connect(serverId, connectOrg);
                   // Discovery succeeded — retire the chain's stale
                   // failure and re-evaluate the entry so it resolves
                   // ready with the discovered tools.
@@ -494,7 +484,7 @@ export function McpServerPicker({
               }
 
               try {
-                await oauth.startOAuth(serverId, connectOrg, declaredEnvKeys);
+                await oauth.startOAuth(serverId, connectOrg);
                 setup.onServerAdded(ref);
               } catch {
                 // error state managed by oauth hook

package/src/mcp-server/McpToolSelector.tsx

@@ -178,7 +178,7 @@ export function McpToolSelector({
                     onChange={() => handleToggle(tool.name)}
                     disabled={disabled}
                     aria-describedby={descId}
-                    className="stg:mt-0.5 stg:size-3 stg:shrink-0 stg:accent-primary stg:disabled:pointer-events-none stg:disabled:opacity-50"
+                    className="stg:mt-0.5 stg:size-3 stg:shrink-0 stg:disabled:pointer-events-none stg:disabled:opacity-50"
                   />
                   <span className="stg:min-w-0 stg:flex-1">
                     <span className="stg:flex stg:items-center stg:gap-1.5">

package/src/mcp-server/useMcpServerConnect.ts

@@ -6,7 +6,6 @@ import type { McpServer } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/
 import { ConnectInputSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
 import { connectAndWait, type EnvVarInput } from "@stigmer/sdk";
 import { useStigmer } from "../hooks.js";
-import { resolveDeclaredSystemEnvVars } from "../environment/systemEnvVars.js";
 import { toError } from "../internal/toError.js";
 
 /** Return value of {@link useMcpServerConnect}. */
@@ -22,23 +21,19 @@ export interface UseMcpServerConnectReturn {
    * survives browser transport limits. Backends without the lane fall
    * back to the blocking `connect` RPC transparently.
    *
-   * Platform system env vars (`STIGMER_SERVER_ADDRESS`,
-   * `STIGMER_API_KEY`) are injected only when the MCP server
-   * declares them in its `spec.env`. Pass `declaredEnvKeys` so the
-   * hook can determine which system vars the server actually needs.
-   * When omitted, no system vars are injected.
+   * Without `runtimeEnv`, the backend resolves the server's declared
+   * variables itself: OAuth tokens from the managed grant, the rest from
+   * the caller's personal environment. The platform's own keys are
+   * filled by the runner, never sent from here (`SYSTEM_ENV_VAR_KEYS`).
    *
-   * When `runtimeEnv` is provided, those values are merged on top
-   * (caller values win). The backend merges the result on top of
-   * the user's personal environment so saved credentials (e.g.,
-   * OAuth tokens) are still resolved.
+   * With `runtimeEnv`, the backend connects with exactly those values
+   * and resolves nothing else (stigmer/stigmer#1453), so pass it only
+   * for a one-time connect whose values the caller supplies whole.
    *
    * @param mcpServerId - System-generated ID of the MCP server (metadata.id).
    * @param org - The caller's active organization slug. Required for
    *   OAuth grant lookup and personal environment resolution.
-   * @param runtimeEnv - Optional additional environment variables.
-   * @param declaredEnvKeys - Keys from the server's `spec.env` declaration.
-   *   System vars are only injected when declared here.
+   * @param runtimeEnv - Optional one-time values for this connect.
    * @returns The updated McpServer with populated status.discovered_capabilities
    *          and status.tool_approvals.
    */
@@ -46,7 +41,6 @@ export interface UseMcpServerConnectReturn {
     mcpServerId: string,
     org: string,
     runtimeEnv?: Record<string, EnvVarInput>,
-    declaredEnvKeys?: readonly string[],
   ) => Promise<McpServer>;
   /** `true` while the connect operation is in flight (start through settle). */
   readonly isConnecting: boolean;
@@ -64,14 +58,9 @@ export interface UseMcpServerConnectReturn {
  * server's tools and resource templates, then classifies each tool's
  * approval policy via a structured-output LLM call.
  *
- * Platform system env vars (`STIGMER_SERVER_ADDRESS`,
- * `STIGMER_API_KEY`) are injected only when the target MCP server
- * declares them in `spec.env`. Pass the server's declared env keys
- * via `declaredEnvKeys` so the hook knows which system vars to
- * include. When not provided, no system vars are injected.
- *
- * Additional one-time credentials can be passed via `runtimeEnv`
- * and will override both system vars and personal env values.
+ * Saved credentials need nothing from the caller: the backend resolves
+ * them. One-time credentials ride `runtimeEnv` and replace that
+ * resolution for this connect.
  *
  * @example
  * ```tsx
@@ -80,15 +69,13 @@ export interface UseMcpServerConnectReturn {
  *
  * // Saved credentials: already in personal environment
  * async function handleConnectSaved() {
- *   const envKeys = Object.keys(mcpServer.spec?.env ?? {});
- *   await connect(mcpServer.metadata.id, undefined, envKeys);
+ *   await connect(mcpServer.metadata.id, org);
  *   refetch();
  * }
  *
  * // One-time use: pass credentials directly
  * async function handleConnectTemporary(values: Record<string, EnvVarInput>) {
- *   const envKeys = Object.keys(mcpServer.spec?.env ?? {});
- *   await connect(mcpServer.metadata.id, values, envKeys);
+ *   await connect(mcpServer.metadata.id, org, values);
  *   refetch();
  * }
  * ```
@@ -105,19 +92,13 @@ export function useMcpServerConnect(): UseMcpServerConnectReturn {
       mcpServerId: string,
       org: string,
       runtimeEnv?: Record<string, EnvVarInput>,
-      declaredEnvKeys?: readonly string[],
     ): Promise<McpServer> => {
       setIsConnecting(true);
       setError(null);
 
       try {
-        const systemEnv = declaredEnvKeys
-          ? await resolveDeclaredSystemEnvVars(stigmer, declaredEnvKeys)
-          : {};
-        const mergedEnv = { ...systemEnv, ...(runtimeEnv ?? {}) };
-
         const runtimeEnvMap: Record<string, { value: string; isSecret: boolean }> = {};
-        for (const [key, envInput] of Object.entries(mergedEnv)) {
+        for (const [key, envInput] of Object.entries(runtimeEnv ?? {})) {
           runtimeEnvMap[key] = {
             value: envInput.value,
             isSecret: envInput.isSecret ?? false,