@abot-ai/runtime 1.7.0 → 1.8.0

package/dist/src/web-ui/client-state/preferences.js

@@ -0,0 +1,84 @@
+import { isDeepStrictEqual } from "node:util";
+import { ClientStateError } from "./contracts.js";
+import { assertPreferenceShape, isPreferenceObject as isObject } from "./preference-shapes.js";
+const scalarKeys = new Set(["abot-web.environmentId", "abot-web.lastToolPermissionMode"]);
+const jsonKeys = new Set([
+    "abot-web.pinnedSessions", "abot-web.currentSessionByEnvironment", "abot-web.sessionModes",
+    "abot-web.sessionModels", "abot-web.lastModelByEnvironment", "abot-web.sessionSidebarByEnvironment",
+    "abot.spark.launcher.position.v1",
+]);
+const modes = new Set(["ask", "full_access", "full_plus"]);
+function assertBoundedJson(value, depth = 0) {
+    if (depth > 8)
+        throw new ClientStateError("invalid_preferences", "Workspace preferences are too deeply nested.");
+    if (!value || typeof value !== "object")
+        return;
+    for (const child of Object.values(value)) {
+        assertBoundedJson(child, depth + 1);
+    }
+}
+function isGuidanceKey(key) {
+    // encodeURIComponent leaves these punctuation characters unescaped. The
+    // request and state byte limits bound keys without restricting profile IDs.
+    return /^abot-web\.homeGuidance\.(?:[A-Za-z0-9_.!~*'()-]|%[0-9A-Fa-f]{2})+$/.test(key);
+}
+export function decodePreference(key, value) {
+    if (!scalarKeys.has(key) && !jsonKeys.has(key) && !isGuidanceKey(key))
+        throw new ClientStateError("invalid_preferences", "Unknown workspace preference.");
+    if (value === null)
+        return undefined;
+    if (typeof value !== "string" || value.length > 524_288)
+        throw new ClientStateError("invalid_preferences", "Invalid workspace preference value.");
+    if (scalarKeys.has(key)) {
+        if (key.endsWith("lastToolPermissionMode") && !modes.has(value))
+            throw new ClientStateError("invalid_preferences", "Select Ask, Full or Full+.");
+        return value;
+    }
+    let decoded;
+    try {
+        decoded = JSON.parse(value);
+    }
+    catch {
+        throw new ClientStateError("invalid_preferences", "Workspace preferences must contain JSON.");
+    }
+    assertBoundedJson(decoded);
+    assertPreferenceShape(key, decoded);
+    return decoded;
+}
+function ownPreferenceField(record, key) {
+    return Object.hasOwn(record, key) ? record[key] : undefined;
+}
+function mergeChangedFields(before, after, current) {
+    if (isDeepStrictEqual(before, after))
+        return current;
+    if (before === undefined && isObject(after) && isObject(current))
+        return mergeChangedFields({}, after, current);
+    if (isObject(before) && isObject(after) && isObject(current)) {
+        const result = Object.assign(Object.create(null), current);
+        for (const key of new Set([...Object.keys(before), ...Object.keys(after)])) {
+            const next = mergeChangedFields(ownPreferenceField(before, key), ownPreferenceField(after, key), ownPreferenceField(current, key));
+            if (next === undefined)
+                delete result[key];
+            else
+                result[key] = next;
+        }
+        return result;
+    }
+    if (!isDeepStrictEqual(current, before) && !isDeepStrictEqual(current, after))
+        throw new ClientStateError("preferences_changed", "These settings changed in another window. Reload before saving again.", 409);
+    return after;
+}
+export function updatePreference(preferences, input) {
+    const key = typeof input.key === "string" ? input.key : "";
+    const before = decodePreference(key, input.before);
+    const after = decodePreference(key, input.value);
+    const current = decodePreference(key, preferences[key] ?? null);
+    const merged = mergeChangedFields(before, after, current);
+    if (merged === undefined) {
+        delete preferences[key];
+        return;
+    }
+    const value = scalarKeys.has(key) ? String(merged) : JSON.stringify(merged);
+    decodePreference(key, value);
+    preferences[key] = value;
+}

package/dist/src/web-ui/client-state/queue.d.ts

@@ -0,0 +1,3 @@
+import { type ClientState } from "./contracts.js";
+/** Runs within the store transaction: a queue item can be released by only one caller. */
+export declare function changeClientQueue(state: ClientState, input: Record<string, unknown>): unknown;

package/dist/src/web-ui/client-state/queue.js

@@ -0,0 +1,43 @@
+import { createSessionComposerQueue } from "../app/lib/session-composer-queue.js";
+import { ClientStateError } from "./contracts.js";
+function queueScope(input) {
+    if (!input || typeof input !== "object")
+        throw new ClientStateError("invalid_queue_scope", "A conversation is required.");
+    const scope = input;
+    for (const value of [scope.environmentId, scope.sessionId]) {
+        if (typeof value !== "string" || !value.trim())
+            throw new ClientStateError("invalid_queue_scope", "Invalid conversation identity.");
+    }
+    return { environmentId: scope.environmentId, sessionId: scope.sessionId };
+}
+/** Runs within the store transaction: a queue item can be released by only one caller. */
+export function changeClientQueue(state, input) {
+    const scope = queueScope(input.scope);
+    const ownerId = typeof input.ownerId === "string" && input.ownerId.length <= 128 ? input.ownerId : null;
+    const requiresRecoveryOwner = ["claim", "begin", "uncertain"].includes(String(input.action));
+    if (requiresRecoveryOwner && !ownerId)
+        throw new ClientStateError("invalid_queue_owner", "A window identity is required to recover a queued message.");
+    const queue = createSessionComposerQueue({ ownerId, storage: {
+            getItem: () => state.queue || null,
+            setItem: (_key, value) => { state.queue = value; },
+        } });
+    const token = typeof input.releaseToken === "string" ? input.releaseToken : "";
+    const requestId = typeof input.requestId === "string" ? input.requestId : "";
+    if (input.action === "claim")
+        return queue.claimBlockedRelease(scope, token, { takeover: input.takeover === true });
+    if (input.action === "begin")
+        return queue.beginBlockedSend(scope, token);
+    if (input.action === "uncertain")
+        return queue.markBlockedUncertain(scope, token);
+    if (input.action === "enqueue")
+        return queue.enqueue(scope, input.item);
+    if (input.action === "release")
+        return queue.releaseForTerminal(scope, requestId);
+    if (input.action === "bind")
+        return queue.bindReleasedSuccess(scope, token, requestId);
+    if (input.action === "rebind")
+        return queue.rebindBlocked(scope, requestId);
+    if (input.action === "update")
+        return queue.updateBlockedRelease(scope, token, input.item);
+    throw new ClientStateError("invalid_queue_action", "Unknown message queue operation.");
+}

package/dist/src/web-ui/client-state/routes.d.ts

@@ -0,0 +1,7 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+export declare class WebClientStateRoutes {
+    private readonly changed;
+    private readonly store;
+    constructor(rootDir: string, changed?: () => void);
+    handle(request: IncomingMessage, response: ServerResponse, pathname: string): Promise<boolean>;
+}

package/dist/src/web-ui/client-state/routes.js

@@ -0,0 +1,58 @@
+import { acceptConfigMutationRequest } from "../local-runtime/config-mutation-request.js";
+import { readBody, readJsonBody, sendJson } from "../local-runtime/http.js";
+import { ClientStateError } from "./contracts.js";
+import { updatePreference } from "./preferences.js";
+import { WebClientStateStore } from "./store.js";
+import { changeClientQueue } from "./queue.js";
+export class WebClientStateRoutes {
+    changed;
+    store;
+    constructor(rootDir, changed = () => { }) {
+        this.changed = changed;
+        this.store = new WebClientStateStore(rootDir);
+    }
+    async handle(request, response, pathname) {
+        if (pathname !== "/web-ui-state")
+            return false;
+        response.setHeader("cache-control", "no-store");
+        try {
+            if (request.method === "GET") {
+                const { state } = await this.store.transaction(() => null);
+                sendJson(response, 200, { ok: true, state });
+                return true;
+            }
+            if (request.method !== "POST") {
+                sendJson(response, 405, { ok: false, error: "method_not_allowed" });
+                return true;
+            }
+            if (!acceptConfigMutationRequest(request, response))
+                return true;
+            const input = readJsonBody(await readBody(request, { maxBytes: 1024 * 1024 }));
+            const saved = await this.store.transaction((state) => {
+                if (input.kind === "preference") {
+                    updatePreference(state.preferences, input);
+                    return null;
+                }
+                if (input.kind === "queue")
+                    return changeClientQueue(state, input);
+                if (input.kind === "introduction") {
+                    state.introductionSeen = true;
+                    return null;
+                }
+                throw new ClientStateError("invalid_state_operation", "Unknown workspace state operation.");
+            });
+            sendJson(response, 200, { ok: true, ...saved });
+            try {
+                this.changed();
+            }
+            catch { /* Persistence already succeeded; clients also refresh on focus. */ }
+        }
+        catch (error) {
+            const known = error instanceof ClientStateError;
+            sendJson(response, known ? error.status : 500, { ok: false,
+                error: known ? error.code : "workspace_state_unavailable",
+                message: known ? error.message : "Workspace settings could not be saved or loaded. Existing data was preserved. Reload before continuing." });
+        }
+        return true;
+    }
+}

package/dist/src/web-ui/client-state/store.d.ts

@@ -0,0 +1,14 @@
+import { type ClientState } from "./contracts.js";
+/** One installation; independent of listener ports, browser profiles and operating system. */
+export declare class WebClientStateStore {
+    private initialization?;
+    readonly directory: string;
+    readonly path: string;
+    constructor(rootDir: string);
+    private load;
+    private save;
+    transaction<T>(operation: (state: ClientState) => T): Promise<{
+        result: T;
+        state: ClientState;
+    }>;
+}

package/dist/src/web-ui/client-state/store.js

@@ -0,0 +1,88 @@
+import { open, readFile, rm, lstat } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
+import { withFileLock } from "../../runtime/adapters/long-term-memory/file-lock.js";
+import { ensurePrivateRuntimeDirectory } from "../../runtime/local-host/private-directory.js";
+import { replacePreparedSessionFile } from "../../sessions/prepared-session-replacement.js";
+import { isPersistedStore } from "../app/lib/session-composer-queue.js";
+import { ClientStateError, emptyClientState } from "./contracts.js";
+import { decodePreference } from "./preferences.js";
+const maxStateBytes = 8 * 1024 * 1024;
+function decodeState(raw) {
+    const state = JSON.parse(raw);
+    if (state?.version !== 1 || !Number.isSafeInteger(state.revision) || state.revision < 0 ||
+        typeof state.introductionSeen !== "boolean" || !state.preferences ||
+        typeof state.preferences !== "object" || Array.isArray(state.preferences) || typeof state.queue !== "string")
+        throw new Error("Workspace state is invalid. Its existing file has been preserved.");
+    for (const [key, value] of Object.entries(state.preferences))
+        decodePreference(key, value);
+    if (state.queue && !isPersistedStore(JSON.parse(state.queue)))
+        throw new Error("Saved message queue is invalid. Its existing file has been preserved.");
+    return state;
+}
+/** One installation; independent of listener ports, browser profiles and operating system. */
+export class WebClientStateStore {
+    initialization;
+    directory;
+    path;
+    constructor(rootDir) {
+        this.directory = resolve(rootDir, ".runtime", "web-ui", "client-state");
+        this.path = join(this.directory, "state.json");
+    }
+    async load() {
+        try {
+            const info = await lstat(this.path);
+            if (!info.isFile() || info.isSymbolicLink() || info.size > maxStateBytes)
+                throw new Error("Workspace state must be a bounded regular file.");
+            return decodeState(await readFile(this.path, "utf8"));
+        }
+        catch (error) {
+            if (error && typeof error === "object" && "code" in error && error.code === "ENOENT")
+                return emptyClientState();
+            throw error;
+        }
+    }
+    async save(state) {
+        const raw = JSON.stringify(state);
+        if (Buffer.byteLength(raw) > maxStateBytes)
+            throw new ClientStateError("workspace_storage_full", "Workspace settings and queued messages exceed their storage limit. No saved data was discarded.", 413);
+        decodeState(raw);
+        const temporary = `${this.path}.${randomUUID()}.tmp`;
+        try {
+            const file = await open(temporary, "wx", 0o600);
+            try {
+                await file.writeFile(raw);
+                await file.sync();
+            }
+            finally {
+                await file.close();
+            }
+            await replacePreparedSessionFile(temporary, this.path);
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+    async transaction(operation) {
+        const initializing = this.initialization ??= ensurePrivateRuntimeDirectory(this.directory);
+        try {
+            await initializing;
+        }
+        catch (error) {
+            // A later explicit reload may try again after the directory is repaired.
+            if (this.initialization === initializing)
+                this.initialization = undefined;
+            throw error;
+        }
+        return withFileLock(join(this.directory, "state.lock"), async () => {
+            const state = await this.load();
+            const before = JSON.stringify(state);
+            const result = operation(state);
+            if (JSON.stringify(state) !== before) {
+                state.revision += 1;
+                await this.save(state);
+            }
+            return { result, state };
+        });
+    }
+}

package/dist/src/web-ui/local-runtime/configuration-activation-source.js

@@ -1,3 +1,4 @@
+import { requireRuntimeSetupEditSettled } from "./runtime-setup-edit-recovery.js";
 import { withPluginConfigurationLock } from "../../runtime/plugins/configuration-write.js";
 import { ConfigFileConflictError, withConfigFileTransaction, } from "../../runtime/adapters/config-file-transaction.js";
 import { resolveRequestRunnerConfigReference } from "../../runtime/config/request-runner-config.js";
@@ -10,6 +11,7 @@ function restoreUnappliedRequestRunner(activation, preparation) {
 /** Cooperating root and linked-file saves wait for activation or restoration to finish. */
 export function withConfigurationActivationSource(configPath, operation, expectedRevision, pluginRootDir) {
     return withConfigFileTransaction(configPath, async (transaction) => {
+        requireRuntimeSetupEditSettled(pluginRootDir ?? process.cwd());
         if (expectedRevision !== undefined &&
             transaction.snapshot.revision !== expectedRevision)
             throw new ConfigFileConflictError();

package/dist/src/web-ui/local-runtime/http.js

@@ -1,3 +1,4 @@
+import { RequestBodyInputError } from "./request-body-error.js";
 export function sendJson(res, statusCode, payload) {
     res.writeHead(statusCode, {
         "content-type": "application/json; charset=utf-8",
@@ -52,9 +53,17 @@ export function getNumber(value) {
 export function readJsonBody(body) {
     if (body.length === 0)
         return {};
-    const parsed = JSON.parse(body.toString("utf8"));
+    let parsed;
+    try {
+        parsed = JSON.parse(body.toString("utf8"));
+    }
+    catch (error) {
+        if (!(error instanceof SyntaxError))
+            throw error;
+        throw new RequestBodyInputError("invalid_json");
+    }
     if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-        throw new Error("JSON object body required");
+        throw new RequestBodyInputError("json_object_required");
     }
     return parsed;
 }

package/dist/src/web-ui/local-runtime/model-context-capacity-error.d.ts

@@ -0,0 +1,14 @@
+import type { ModelContextCapacityIssue } from "../../runtime/config/model-context-capacity.js";
+export type PublicContextWindowIssue = Readonly<{
+    field: "contextWindowTokens";
+    declaredTokens: number;
+    effectiveTokens: number;
+    reservedTokens: number;
+    minimumTokens: number;
+    allocationTokens?: number;
+    environmentId?: string;
+}>;
+export declare function readModelContextCapacityIssue(error: unknown, profileId: string): ModelContextCapacityIssue | undefined;
+export declare function modelContextCapacityMessage(issue: ModelContextCapacityIssue): string;
+/** Project known capacity evidence without exposing config paths or raw issues. */
+export declare function publicContextWindowIssue(issue: ModelContextCapacityIssue, environmentId?: string): PublicContextWindowIssue;

package/dist/src/web-ui/local-runtime/model-context-capacity-error.js

@@ -0,0 +1,28 @@
+import { RuntimeConfigValidationError } from "../../runtime/config/validation.js";
+export function readModelContextCapacityIssue(error, profileId) {
+    if (!(error instanceof RuntimeConfigValidationError))
+        return undefined;
+    return error.capacityIssues.find((issue) => issue.profileId === profileId);
+}
+export function modelContextCapacityMessage(issue) {
+    const capacity = `The effective context window is ${issue.effectiveTokens} tokens, but the configured reserves require more than ${issue.reservedTokens} tokens. Use a model-supported context window of at least ${issue.minimumTokens} tokens or adjust the configured reserves.`;
+    if (issue.allocationTokens === undefined)
+        return capacity;
+    if (issue.allocationTokens >= issue.minimumTokens)
+        return capacity;
+    return `${capacity} The Ollama num_ctx allocation of ${issue.allocationTokens} tokens must also support that window.`;
+}
+/** Project known capacity evidence without exposing config paths or raw issues. */
+export function publicContextWindowIssue(issue, environmentId) {
+    return {
+        field: "contextWindowTokens",
+        declaredTokens: issue.declaredTokens,
+        effectiveTokens: issue.effectiveTokens,
+        reservedTokens: issue.reservedTokens,
+        minimumTokens: issue.minimumTokens,
+        ...(issue.allocationTokens === undefined
+            ? {}
+            : { allocationTokens: issue.allocationTokens }),
+        ...(environmentId === undefined ? {} : { environmentId }),
+    };
+}

package/dist/src/web-ui/local-runtime/model-setup-context-window.d.ts

@@ -0,0 +1,15 @@
+import type { ModelContextCapacityIssue } from "../../runtime/config/model-context-capacity.js";
+import { ModelSetupError } from "./model-setup-input.js";
+import { type PublicContextWindowIssue } from "./model-context-capacity-error.js";
+type ModelSetupContextWindowIssue = PublicContextWindowIssue & Readonly<{
+    profileId: string;
+}>;
+export declare class ModelSetupContextWindowError extends ModelSetupError {
+    readonly contextWindow: ModelSetupContextWindowIssue;
+    constructor(issue: ModelContextCapacityIssue, environmentId?: string);
+}
+export declare function throwModelSetupValidationError(error: unknown, profileId: string | undefined, environmentId?: string): never;
+export declare function modelSetupContextWindowErrorDetails(error: unknown): {
+    contextWindow?: ModelSetupContextWindowIssue;
+};
+export {};

package/dist/src/web-ui/local-runtime/model-setup-context-window.js

@@ -0,0 +1,25 @@
+import { ModelSetupError } from "./model-setup-input.js";
+import { modelContextCapacityMessage, publicContextWindowIssue, readModelContextCapacityIssue, } from "./model-context-capacity-error.js";
+export class ModelSetupContextWindowError extends ModelSetupError {
+    contextWindow;
+    constructor(issue, environmentId) {
+        super("context_window_too_small", modelContextCapacityMessage(issue));
+        this.contextWindow = {
+            ...publicContextWindowIssue(issue, environmentId),
+            profileId: issue.profileId,
+        };
+    }
+}
+export function throwModelSetupValidationError(error, profileId, environmentId) {
+    if (profileId === undefined)
+        throw error;
+    const issue = readModelContextCapacityIssue(error, profileId);
+    if (!issue)
+        throw error;
+    throw new ModelSetupContextWindowError(issue, environmentId);
+}
+export function modelSetupContextWindowErrorDetails(error) {
+    if (!(error instanceof ModelSetupContextWindowError))
+        return {};
+    return { contextWindow: error.contextWindow };
+}

package/dist/src/web-ui/local-runtime/model-setup-routes.js

@@ -1,5 +1,6 @@
 import { assertConfigMutationRequest, ConfigMutationRequestError, } from "./config-mutation-request.js";
 import { readBody, readJsonBody, sendJson } from "./http.js";
+import { modelSetupContextWindowErrorDetails } from "./model-setup-context-window.js";
 import { ModelSetupError } from "./model-setup-input.js";
 export class ModelSetupRoutes {
     service;
@@ -40,6 +41,7 @@ export class ModelSetupRoutes {
                 error instanceof ConfigMutationRequestError;
             sendJson(params.response, known ? error.statusCode : 400, {
                 ok: false,
+                ...modelSetupContextWindowErrorDetails(error),
                 error: error instanceof ModelSetupError ? error.code : "model_setup_failed",
                 message: known
                     ? error.message

package/dist/src/web-ui/local-runtime/model-setup-service.js

@@ -92,14 +92,17 @@ export class ModelSetupService {
             provider: provider.config,
             profile,
         };
-        await validateModelAddition(mergeRuntimeModelAddition(source, addition).config, options);
+        await validateModelAddition(mergeRuntimeModelAddition(source, addition).config, { ...options, modelProfileId: input.profileId });
         const credential = await prepareModelCredential(options, provider.config, input.apiKey);
         return withModelSetupProfile(options, transaction, input.profileId, profile, async (declaration, assertProfileUnchanged) => {
             const candidate = mergeRuntimeModelAddition(source, {
                 ...addition,
                 profile: declaration,
             }).config;
-            await validateModelAddition(candidate, options);
+            await validateModelAddition(candidate, {
+                ...options,
+                modelProfileId: input.profileId,
+            });
             await assertProfileUnchanged();
             await this.commit(options, candidate, transaction, credential, assertProfileUnchanged);
             return modelSetupResult(provider, input);

package/dist/src/web-ui/local-runtime/model-setup-validation.d.ts

@@ -2,5 +2,6 @@
 export declare function validateModelConfigurationChange(config: Record<string, unknown>, options: {
     rootDir: string;
     configPath: string;
+    modelProfileId?: string;
 }): Promise<void>;
 export { validateModelConfigurationChange as validateModelAddition };

package/dist/src/web-ui/local-runtime/model-setup-validation.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { rm, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
+import { throwModelSetupValidationError } from "./model-setup-context-window.js";
 import { loadRuntimeConfig } from "../../runtime/config.js";
 import { isRecord } from "../../runtime/config/utils.js";
 import { validateRuntimeConfigFile } from "../../runtime/config/validation.js";
@@ -19,13 +20,19 @@ export async function validateModelConfigurationChange(config, options) {
             ? Object.keys(environment.profiles)
             : [];
         const environments = profileIds.length ? profileIds : [undefined];
-        for (const profileId of environments)
-            loadRuntimeConfig({
-                rootDir: options.rootDir,
-                configPath: temporary,
-                profileId,
-                env: { ...process.env },
-            });
+        for (const environmentId of environments) {
+            try {
+                loadRuntimeConfig({
+                    rootDir: options.rootDir,
+                    configPath: temporary,
+                    profileId: environmentId,
+                    env: { ...process.env },
+                });
+            }
+            catch (error) {
+                throwModelSetupValidationError(error, options.modelProfileId, environmentId);
+            }
+        }
     }
     finally {
         await rm(temporary, { force: true });

package/dist/src/web-ui/local-runtime/request-body-error.d.ts

@@ -0,0 +1,11 @@
+declare const REQUEST_BODY_ERROR_MESSAGES: {
+    readonly invalid_json: "Request body must contain valid JSON.";
+    readonly json_object_required: "Request body must be a JSON object.";
+};
+/** A client syntax/shape failure, distinct from unexpected backend exceptions. */
+export declare class RequestBodyInputError extends Error {
+    readonly code: keyof typeof REQUEST_BODY_ERROR_MESSAGES;
+    readonly statusCode = 400;
+    constructor(code: keyof typeof REQUEST_BODY_ERROR_MESSAGES);
+}
+export {};

package/dist/src/web-ui/local-runtime/request-body-error.js

@@ -0,0 +1,14 @@
+const REQUEST_BODY_ERROR_MESSAGES = {
+    invalid_json: "Request body must contain valid JSON.",
+    json_object_required: "Request body must be a JSON object.",
+};
+/** A client syntax/shape failure, distinct from unexpected backend exceptions. */
+export class RequestBodyInputError extends Error {
+    code;
+    statusCode = 400;
+    constructor(code) {
+        super(REQUEST_BODY_ERROR_MESSAGES[code]);
+        this.code = code;
+        this.name = "RequestBodyInputError";
+    }
+}

package/dist/src/web-ui/local-runtime/request-control-observation.js

@@ -22,10 +22,10 @@ export function traceWebProjection(event, requestId, active, reason, removed) {
     });
 }
 export function webSteerRoute(active, steer) {
-    if (!active)
-        return "web_projection_missing";
     if (steer)
         return "runtime_owner";
+    if (!active)
+        return "web_projection_missing";
     return "local_inbox";
 }
 /** Observes the existing routing decision; it never queries or changes an owner. */

package/dist/src/web-ui/local-runtime/request-execution.js

@@ -174,26 +174,15 @@ export class LocalRequestExecution {
                 observation.selectRoute("interactive_session_check");
                 const sessions = resolveEnvironment(active.environmentId).services
                     .sessions;
-                try {
-                    await sessions.assertInteractiveSession?.(active.sessionId);
-                }
-                catch (error) {
-                    if (!isAutomationSessionLockedError(error))
-                        throw error;
-                    const acknowledgement = {
-                        type: "steer_ack",
-                        requestId,
-                        steerId,
-                        accepted: false,
-                        reason: "automation_session_locked",
-                    };
-                    observation.result(acknowledgement);
-                    return acknowledgement;
-                }
+                await sessions.assertInteractiveSession?.(active.sessionId);
             }
             observation.selectRoute("environment_resolution");
-            const steer = active
-                ? resolveEnvironment(active.environmentId).requests.steer
+            // Saved approval waits retire the Web view; their resumed owner remains
+            // authoritative. Never infer inactivity from a missing local projection.
+            const steeringEnvironmentId = active?.environmentId ?? getString(message.environment).trim();
+            const hasSteeringEnvironment = steeringEnvironmentId.length > 0;
+            const steer = hasSteeringEnvironment
+                ? resolveEnvironment(steeringEnvironmentId).requests.steer
                 : undefined;
             observation.selectRoute(webSteerRoute(active, steer));
             const result = (steer
@@ -219,6 +208,17 @@ export class LocalRequestExecution {
             return acknowledgement;
         }
         catch (error) {
+            if (isAutomationSessionLockedError(error)) {
+                const acknowledgement = {
+                    type: "steer_ack",
+                    requestId,
+                    steerId,
+                    accepted: false,
+                    reason: "automation_session_locked",
+                };
+                observation.result(acknowledgement);
+                return acknowledgement;
+            }
             observation.failed(error);
             throw error;
         }

package/dist/src/web-ui/local-runtime/runtime-setup-connection-edit.d.ts

@@ -1,3 +1,4 @@
+import { type RuntimeSetupCredentialWrite } from "./runtime-setup-credentials.js";
 import { type RuntimeSetupInput } from "./runtime-setup-input.js";
 import { type RuntimeSetupDraft } from "./runtime-setup-draft.js";
 /** Applies only fields owned by the unfinished wizard, retaining optional-step edits. */
@@ -7,6 +8,7 @@ export declare function editRuntimeSetupConnection(params: {
     draft: RuntimeSetupDraft;
     input: RuntimeSetupInput;
     credentialChanged: boolean;
+    credentialWrite: RuntimeSetupCredentialWrite;
 }): Promise<{
     draft: RuntimeSetupDraft;
     embeddingInvalidated: boolean;