@copilotkit/runtime 1.82.0 → 1.83.0

package/dist/v2/runtime/handlers/handle-run.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"handle-run.cjs","names":["telemetry","readGuardrailsEnabled","cloneAgentForRequest","parseRunRequest","attachIntelligenceEnterpriseLearning","isIntelligenceRuntime","handleIntelligenceRun","handleSseRun"],"sources":["../../../../src/v2/runtime/handlers/handle-run.ts"],"sourcesContent":["import { readCopilotKitUIEnvelope } from \"@copilotkit/shared\";\nimport { isIntelligenceRuntime } from \"../core/runtime\";\nimport { telemetry } from \"../telemetry\";\nimport { readGuardrailsEnabled } from \"./shared/cloud-telemetry\";\nimport type { RunAgentParameters } from \"./shared/agent-utils\";\nimport {\n  attachIntelligenceEnterpriseLearning,\n  cloneAgentForRequest,\n  configureAgentForRequest,\n  parseRunRequest,\n} from \"./shared/agent-utils\";\nimport { handleIntelligenceRun } from \"./intelligence/run\";\nimport { handleSseRun } from \"./sse/run\";\nimport { getRuntimeErrorReporter } from \"../core/runtime-error-reporter\";\n\nexport async function handleRunAgent({\n  runtime,\n  request,\n  agentId,\n}: RunAgentParameters) {\n  const startTime = Date.now();\n  const publicApiKey = request.headers.get(\"x-copilotcloud-public-api-key\");\n  (runtime.telemetry ?? telemetry).capture(\n    \"oss.runtime.copilot_request_created\",\n    {\n      \"cloud.guardrails.enabled\": await readGuardrailsEnabled(request),\n      requestType: \"run\",\n      \"cloud.api_key_provided\": !!publicApiKey,\n      ...(publicApiKey ? { \"cloud.public_api_key\": publicApiKey } : {}),\n    },\n  );\n\n  try {\n    const agent = await cloneAgentForRequest(runtime, agentId, request);\n    if (agent instanceof Response) {\n      return agent;\n    }\n\n    // Ensure the clone carries the registry key so InMemoryAgentRunner can\n    // tag historic runs with the correct agentId for filtering.\n    agent.agentId = agentId;\n\n    // Parse the body before configuring middleware: the request is single-read,\n    // and middleware configuration needs the A2UI catalog signal the React\n    // provider forwards (see `a2uiCatalogAvailable` below). Middleware is applied\n    // to the agent here; the run itself is kicked off later, so this is safe.\n    const input = await parseRunRequest(request);\n    if (input instanceof Response) {\n      return input;\n    }\n\n    // `<CopilotKit a2ui={{ catalog }}>` forwards this flag on every run. Its\n    // presence alone is enough to turn A2UI on end-to-end — no runtime-side\n    // `a2ui` config required.\n    const providerA2UIHasCatalog =\n      (input.forwardedProps as Record<string, unknown> | undefined)\n        ?.a2uiCatalogAvailable === true;\n    // The generative UI envelope (`forwardedProps.copilotkit.ui`) picks the\n    // transport of this run.\n    const providerGenerativeUITransport = readCopilotKitUIEnvelope(\n      input.forwardedProps,\n    )?.metadata.extensions.copilotkit_transport;\n\n    configureAgentForRequest({\n      runtime,\n      request,\n      agentId,\n      agent,\n      providerA2UIHasCatalog,\n      providerGenerativeUITransport,\n      isMcpProxyRequest: Object.prototype.hasOwnProperty.call(\n        input.forwardedProps ?? {},\n        \"__proxiedMCPRequest\",\n      ),\n    });\n    const memoryResponse = await attachIntelligenceEnterpriseLearning({\n      runtime,\n      request,\n      agent,\n    });\n    if (memoryResponse instanceof Response) return memoryResponse;\n\n    agent.setMessages(input.messages);\n    agent.setState(input.state);\n    agent.threadId = input.threadId;\n\n    if (runtime.debug?.lifecycle && runtime.debugLogger) {\n      runtime.debugLogger.debug(\n        { agentName: agentId, threadId: input.threadId },\n        \"Agent run started\",\n      );\n    }\n\n    if (isIntelligenceRuntime(runtime)) {\n      return handleIntelligenceRun({\n        runtime,\n        request,\n        agentId,\n        agent,\n        input,\n        startTime,\n      });\n    }\n\n    return handleSseRun({\n      runtime,\n      request,\n      agent,\n      input,\n      agentId,\n      debug: runtime.debug,\n      logger: runtime.debugLogger,\n      startTime,\n    });\n  } catch (error) {\n    getRuntimeErrorReporter(runtime)?.report({\n      request,\n      error,\n      operation: \"agent.run\",\n      agentId,\n      phase: \"common\",\n      startTime,\n    });\n    console.error(\"Error running agent:\", error);\n    console.error(\n      \"Error stack:\",\n      error instanceof Error ? error.stack : \"No stack trace\",\n    );\n    console.error(\"Error details:\", {\n      name: error instanceof Error ? error.name : \"Unknown\",\n      message: error instanceof Error ? error.message : String(error),\n      cause: error instanceof Error ? error.cause : undefined,\n    });\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to run agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAeA,eAAsB,eAAe,EACnC,SACA,SACA,WACqB;CACrB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,eAAe,QAAQ,QAAQ,IAAI,gCAAgC;AACzE,EAAC,QAAQ,aAAaA,kCAAW,QAC/B,uCACA;EACE,4BAA4B,MAAMC,8CAAsB,QAAQ;EAChE,aAAa;EACb,0BAA0B,CAAC,CAAC;EAC5B,GAAI,eAAe,EAAE,wBAAwB,cAAc,GAAG,EAAE;EACjE,CACF;AAED,KAAI;EACF,MAAM,QAAQ,MAAMC,yCAAqB,SAAS,SAAS,QAAQ;AACnE,MAAI,iBAAiB,SACnB,QAAO;AAKT,QAAM,UAAU;EAMhB,MAAM,QAAQ,MAAMC,oCAAgB,QAAQ;AAC5C,MAAI,iBAAiB,SACnB,QAAO;EAMT,MAAM,yBACH,MAAM,gBACH,yBAAyB;EAG/B,MAAM,iFACJ,MAAM,eACP,EAAE,SAAS,WAAW;AAEvB,+CAAyB;GACvB;GACA;GACA;GACA;GACA;GACA;GACA,mBAAmB,OAAO,UAAU,eAAe,KACjD,MAAM,kBAAkB,EAAE,EAC1B,sBACD;GACF,CAAC;EACF,MAAM,iBAAiB,MAAMC,yDAAqC;GAChE;GACA;GACA;GACD,CAAC;AACF,MAAI,0BAA0B,SAAU,QAAO;AAE/C,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,MAAM,MAAM;AAC3B,QAAM,WAAW,MAAM;AAEvB,MAAI,QAAQ,OAAO,aAAa,QAAQ,YACtC,SAAQ,YAAY,MAClB;GAAE,WAAW;GAAS,UAAU,MAAM;GAAU,EAChD,oBACD;AAGH,MAAIC,wCAAsB,QAAQ,CAChC,QAAOC,kCAAsB;GAC3B;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;AAGJ,SAAOC,2BAAa;GAClB;GACA;GACA;GACA;GACA;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB;GACD,CAAC;UACK,OAAO;AACd,yDAAwB,QAAQ,EAAE,OAAO;GACvC;GACA;GACA,WAAW;GACX;GACA,OAAO;GACP;GACD,CAAC;AACF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,UAAQ,MACN,gBACA,iBAAiB,QAAQ,MAAM,QAAQ,iBACxC;AACD,UAAQ,MAAM,kBAAkB;GAC9B,MAAM,iBAAiB,QAAQ,MAAM,OAAO;GAC5C,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC/D,OAAO,iBAAiB,QAAQ,MAAM,QAAQ;GAC/C,CAAC;AAEF,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}
+{"version":3,"file":"handle-run.cjs","names":["telemetry","readGuardrailsEnabled","cloneAgentForRequest","parseRunRequest","isIntelligenceRuntime","resolveLocalThreadOwner","enforcesThreadOwnership","threadAccessDeniedResponse","attachIntelligenceEnterpriseLearning","handleIntelligenceRun","handleSseRun"],"sources":["../../../../src/v2/runtime/handlers/handle-run.ts"],"sourcesContent":["import { readCopilotKitUIEnvelope } from \"@copilotkit/shared\";\nimport { isIntelligenceRuntime } from \"../core/runtime\";\nimport { telemetry } from \"../telemetry\";\nimport { readGuardrailsEnabled } from \"./shared/cloud-telemetry\";\nimport type { RunAgentParameters } from \"./shared/agent-utils\";\nimport {\n  attachIntelligenceEnterpriseLearning,\n  cloneAgentForRequest,\n  configureAgentForRequest,\n  parseRunRequest,\n} from \"./shared/agent-utils\";\nimport { handleIntelligenceRun } from \"./intelligence/run\";\nimport { handleSseRun } from \"./sse/run\";\nimport { getRuntimeErrorReporter } from \"../core/runtime-error-reporter\";\nimport { enforcesThreadOwnership } from \"../runner/agent-runner\";\nimport {\n  resolveLocalThreadOwner,\n  threadAccessDeniedResponse,\n} from \"./shared/thread-access\";\n\nexport async function handleRunAgent({\n  runtime,\n  request,\n  agentId,\n}: RunAgentParameters) {\n  const startTime = Date.now();\n  const publicApiKey = request.headers.get(\"x-copilotcloud-public-api-key\");\n  (runtime.telemetry ?? telemetry).capture(\n    \"oss.runtime.copilot_request_created\",\n    {\n      \"cloud.guardrails.enabled\": await readGuardrailsEnabled(request),\n      requestType: \"run\",\n      \"cloud.api_key_provided\": !!publicApiKey,\n      ...(publicApiKey ? { \"cloud.public_api_key\": publicApiKey } : {}),\n    },\n  );\n\n  try {\n    const agent = await cloneAgentForRequest(runtime, agentId, request);\n    if (agent instanceof Response) {\n      return agent;\n    }\n\n    // Ensure the clone carries the registry key so InMemoryAgentRunner can\n    // tag historic runs with the correct agentId for filtering.\n    agent.agentId = agentId;\n\n    // Parse the body before configuring middleware: middleware configuration\n    // needs the A2UI catalog signal the React provider forwards (see\n    // `a2uiCatalogAvailable` below). Middleware is applied to the agent here;\n    // the run itself is kicked off later, so this is safe. The body is read\n    // from a clone, so `identifyUser` can still read the original request.\n    const input = await parseRunRequest(request.clone());\n    if (input instanceof Response) {\n      return input;\n    }\n\n    // A thread belongs to the identity of its first run. Running needs no\n    // configured identity (anonymous runs keep working), but nobody may add to\n    // a thread that another identity owns.\n    let ownerId: string | undefined;\n    if (!isIntelligenceRuntime(runtime)) {\n      const owner = await resolveLocalThreadOwner({\n        runtime,\n        request,\n        operation: \"run\",\n      });\n      if (owner instanceof Response) return owner;\n      if (\n        enforcesThreadOwnership(runtime.runner) &&\n        !(await runtime.runner.isThreadAccessible(input.threadId, {\n          ownerId: owner,\n        }))\n      ) {\n        return threadAccessDeniedResponse();\n      }\n      ownerId = owner;\n    }\n\n    // `<CopilotKit a2ui={{ catalog }}>` forwards this flag on every run. Its\n    // presence alone is enough to turn A2UI on end-to-end — no runtime-side\n    // `a2ui` config required.\n    const providerA2UIHasCatalog =\n      (input.forwardedProps as Record<string, unknown> | undefined)\n        ?.a2uiCatalogAvailable === true;\n    // The generative UI envelope (`forwardedProps.copilotkit.ui`) picks the\n    // transport of this run.\n    const providerGenerativeUITransport = readCopilotKitUIEnvelope(\n      input.forwardedProps,\n    )?.metadata.extensions.copilotkit_transport;\n\n    configureAgentForRequest({\n      runtime,\n      request,\n      agentId,\n      agent,\n      providerA2UIHasCatalog,\n      providerGenerativeUITransport,\n      isMcpProxyRequest: Object.prototype.hasOwnProperty.call(\n        input.forwardedProps ?? {},\n        \"__proxiedMCPRequest\",\n      ),\n    });\n    const memoryResponse = await attachIntelligenceEnterpriseLearning({\n      runtime,\n      request,\n      agent,\n    });\n    if (memoryResponse instanceof Response) return memoryResponse;\n\n    agent.setMessages(input.messages);\n    agent.setState(input.state);\n    agent.threadId = input.threadId;\n\n    if (runtime.debug?.lifecycle && runtime.debugLogger) {\n      runtime.debugLogger.debug(\n        { agentName: agentId, threadId: input.threadId },\n        \"Agent run started\",\n      );\n    }\n\n    if (isIntelligenceRuntime(runtime)) {\n      return handleIntelligenceRun({\n        runtime,\n        request,\n        agentId,\n        agent,\n        input,\n        startTime,\n      });\n    }\n\n    return handleSseRun({\n      runtime,\n      request,\n      agent,\n      input,\n      agentId,\n      debug: runtime.debug,\n      logger: runtime.debugLogger,\n      startTime,\n      ownerId,\n    });\n  } catch (error) {\n    getRuntimeErrorReporter(runtime)?.report({\n      request,\n      error,\n      operation: \"agent.run\",\n      agentId,\n      phase: \"common\",\n      startTime,\n    });\n    console.error(\"Error running agent:\", error);\n    console.error(\n      \"Error stack:\",\n      error instanceof Error ? error.stack : \"No stack trace\",\n    );\n    console.error(\"Error details:\", {\n      name: error instanceof Error ? error.name : \"Unknown\",\n      message: error instanceof Error ? error.message : String(error),\n      cause: error instanceof Error ? error.cause : undefined,\n    });\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to run agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,eAAsB,eAAe,EACnC,SACA,SACA,WACqB;CACrB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,eAAe,QAAQ,QAAQ,IAAI,gCAAgC;AACzE,EAAC,QAAQ,aAAaA,kCAAW,QAC/B,uCACA;EACE,4BAA4B,MAAMC,8CAAsB,QAAQ;EAChE,aAAa;EACb,0BAA0B,CAAC,CAAC;EAC5B,GAAI,eAAe,EAAE,wBAAwB,cAAc,GAAG,EAAE;EACjE,CACF;AAED,KAAI;EACF,MAAM,QAAQ,MAAMC,yCAAqB,SAAS,SAAS,QAAQ;AACnE,MAAI,iBAAiB,SACnB,QAAO;AAKT,QAAM,UAAU;EAOhB,MAAM,QAAQ,MAAMC,oCAAgB,QAAQ,OAAO,CAAC;AACpD,MAAI,iBAAiB,SACnB,QAAO;EAMT,IAAI;AACJ,MAAI,CAACC,wCAAsB,QAAQ,EAAE;GACnC,MAAM,QAAQ,MAAMC,8CAAwB;IAC1C;IACA;IACA,WAAW;IACZ,CAAC;AACF,OAAI,iBAAiB,SAAU,QAAO;AACtC,OACEC,6CAAwB,QAAQ,OAAO,IACvC,CAAE,MAAM,QAAQ,OAAO,mBAAmB,MAAM,UAAU,EACxD,SAAS,OACV,CAAC,CAEF,QAAOC,kDAA4B;AAErC,aAAU;;EAMZ,MAAM,yBACH,MAAM,gBACH,yBAAyB;EAG/B,MAAM,iFACJ,MAAM,eACP,EAAE,SAAS,WAAW;AAEvB,+CAAyB;GACvB;GACA;GACA;GACA;GACA;GACA;GACA,mBAAmB,OAAO,UAAU,eAAe,KACjD,MAAM,kBAAkB,EAAE,EAC1B,sBACD;GACF,CAAC;EACF,MAAM,iBAAiB,MAAMC,yDAAqC;GAChE;GACA;GACA;GACD,CAAC;AACF,MAAI,0BAA0B,SAAU,QAAO;AAE/C,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,MAAM,MAAM;AAC3B,QAAM,WAAW,MAAM;AAEvB,MAAI,QAAQ,OAAO,aAAa,QAAQ,YACtC,SAAQ,YAAY,MAClB;GAAE,WAAW;GAAS,UAAU,MAAM;GAAU,EAChD,oBACD;AAGH,MAAIJ,wCAAsB,QAAQ,CAChC,QAAOK,kCAAsB;GAC3B;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;AAGJ,SAAOC,2BAAa;GAClB;GACA;GACA;GACA;GACA;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB;GACA;GACD,CAAC;UACK,OAAO;AACd,yDAAwB,QAAQ,EAAE,OAAO;GACvC;GACA;GACA,WAAW;GACX;GACA,OAAO;GACP;GACD,CAAC;AACF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,UAAQ,MACN,gBACA,iBAAiB,QAAQ,MAAM,QAAQ,iBACxC;AACD,UAAQ,MAAM,kBAAkB;GAC9B,MAAM,iBAAiB,QAAQ,MAAM,OAAO;GAC5C,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC/D,OAAO,iBAAiB,QAAQ,MAAM,QAAQ;GAC/C,CAAC;AAEF,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}

package/dist/v2/runtime/handlers/handle-run.mjs

@@ -1,4 +1,6 @@
 import "reflect-metadata";
+import { enforcesThreadOwnership } from "../runner/agent-runner.mjs";
+import { resolveLocalThreadOwner, threadAccessDeniedResponse } from "./shared/thread-access.mjs";
 import telemetry from "../telemetry/telemetry-client.mjs";
 import { getRuntimeErrorReporter } from "../core/runtime-error-reporter.mjs";
 import { isIntelligenceRuntime } from "../core/runtime.mjs";
@@ -22,8 +24,19 @@ async function handleRunAgent({ runtime, request, agentId }) {
 		const agent = await cloneAgentForRequest(runtime, agentId, request);
 		if (agent instanceof Response) return agent;
 		agent.agentId = agentId;
-		const input = await parseRunRequest(request);
+		const input = await parseRunRequest(request.clone());
 		if (input instanceof Response) return input;
+		let ownerId;
+		if (!isIntelligenceRuntime(runtime)) {
+			const owner = await resolveLocalThreadOwner({
+				runtime,
+				request,
+				operation: "run"
+			});
+			if (owner instanceof Response) return owner;
+			if (enforcesThreadOwnership(runtime.runner) && !await runtime.runner.isThreadAccessible(input.threadId, { ownerId: owner })) return threadAccessDeniedResponse();
+			ownerId = owner;
+		}
 		const providerA2UIHasCatalog = input.forwardedProps?.a2uiCatalogAvailable === true;
 		const providerGenerativeUITransport = readCopilotKitUIEnvelope(input.forwardedProps)?.metadata.extensions.copilotkit_transport;
 		configureAgentForRequest({
@@ -64,7 +77,8 @@ async function handleRunAgent({ runtime, request, agentId }) {
 			agentId,
 			debug: runtime.debug,
 			logger: runtime.debugLogger,
-			startTime
+			startTime,
+			ownerId
 		});
 	} catch (error) {
 		getRuntimeErrorReporter(runtime)?.report({

package/dist/v2/runtime/handlers/handle-run.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"handle-run.mjs","names":[],"sources":["../../../../src/v2/runtime/handlers/handle-run.ts"],"sourcesContent":["import { readCopilotKitUIEnvelope } from \"@copilotkit/shared\";\nimport { isIntelligenceRuntime } from \"../core/runtime\";\nimport { telemetry } from \"../telemetry\";\nimport { readGuardrailsEnabled } from \"./shared/cloud-telemetry\";\nimport type { RunAgentParameters } from \"./shared/agent-utils\";\nimport {\n  attachIntelligenceEnterpriseLearning,\n  cloneAgentForRequest,\n  configureAgentForRequest,\n  parseRunRequest,\n} from \"./shared/agent-utils\";\nimport { handleIntelligenceRun } from \"./intelligence/run\";\nimport { handleSseRun } from \"./sse/run\";\nimport { getRuntimeErrorReporter } from \"../core/runtime-error-reporter\";\n\nexport async function handleRunAgent({\n  runtime,\n  request,\n  agentId,\n}: RunAgentParameters) {\n  const startTime = Date.now();\n  const publicApiKey = request.headers.get(\"x-copilotcloud-public-api-key\");\n  (runtime.telemetry ?? telemetry).capture(\n    \"oss.runtime.copilot_request_created\",\n    {\n      \"cloud.guardrails.enabled\": await readGuardrailsEnabled(request),\n      requestType: \"run\",\n      \"cloud.api_key_provided\": !!publicApiKey,\n      ...(publicApiKey ? { \"cloud.public_api_key\": publicApiKey } : {}),\n    },\n  );\n\n  try {\n    const agent = await cloneAgentForRequest(runtime, agentId, request);\n    if (agent instanceof Response) {\n      return agent;\n    }\n\n    // Ensure the clone carries the registry key so InMemoryAgentRunner can\n    // tag historic runs with the correct agentId for filtering.\n    agent.agentId = agentId;\n\n    // Parse the body before configuring middleware: the request is single-read,\n    // and middleware configuration needs the A2UI catalog signal the React\n    // provider forwards (see `a2uiCatalogAvailable` below). Middleware is applied\n    // to the agent here; the run itself is kicked off later, so this is safe.\n    const input = await parseRunRequest(request);\n    if (input instanceof Response) {\n      return input;\n    }\n\n    // `<CopilotKit a2ui={{ catalog }}>` forwards this flag on every run. Its\n    // presence alone is enough to turn A2UI on end-to-end — no runtime-side\n    // `a2ui` config required.\n    const providerA2UIHasCatalog =\n      (input.forwardedProps as Record<string, unknown> | undefined)\n        ?.a2uiCatalogAvailable === true;\n    // The generative UI envelope (`forwardedProps.copilotkit.ui`) picks the\n    // transport of this run.\n    const providerGenerativeUITransport = readCopilotKitUIEnvelope(\n      input.forwardedProps,\n    )?.metadata.extensions.copilotkit_transport;\n\n    configureAgentForRequest({\n      runtime,\n      request,\n      agentId,\n      agent,\n      providerA2UIHasCatalog,\n      providerGenerativeUITransport,\n      isMcpProxyRequest: Object.prototype.hasOwnProperty.call(\n        input.forwardedProps ?? {},\n        \"__proxiedMCPRequest\",\n      ),\n    });\n    const memoryResponse = await attachIntelligenceEnterpriseLearning({\n      runtime,\n      request,\n      agent,\n    });\n    if (memoryResponse instanceof Response) return memoryResponse;\n\n    agent.setMessages(input.messages);\n    agent.setState(input.state);\n    agent.threadId = input.threadId;\n\n    if (runtime.debug?.lifecycle && runtime.debugLogger) {\n      runtime.debugLogger.debug(\n        { agentName: agentId, threadId: input.threadId },\n        \"Agent run started\",\n      );\n    }\n\n    if (isIntelligenceRuntime(runtime)) {\n      return handleIntelligenceRun({\n        runtime,\n        request,\n        agentId,\n        agent,\n        input,\n        startTime,\n      });\n    }\n\n    return handleSseRun({\n      runtime,\n      request,\n      agent,\n      input,\n      agentId,\n      debug: runtime.debug,\n      logger: runtime.debugLogger,\n      startTime,\n    });\n  } catch (error) {\n    getRuntimeErrorReporter(runtime)?.report({\n      request,\n      error,\n      operation: \"agent.run\",\n      agentId,\n      phase: \"common\",\n      startTime,\n    });\n    console.error(\"Error running agent:\", error);\n    console.error(\n      \"Error stack:\",\n      error instanceof Error ? error.stack : \"No stack trace\",\n    );\n    console.error(\"Error details:\", {\n      name: error instanceof Error ? error.name : \"Unknown\",\n      message: error instanceof Error ? error.message : String(error),\n      cause: error instanceof Error ? error.cause : undefined,\n    });\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to run agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;AAeA,eAAsB,eAAe,EACnC,SACA,SACA,WACqB;CACrB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,eAAe,QAAQ,QAAQ,IAAI,gCAAgC;AACzE,EAAC,QAAQ,aAAa,WAAW,QAC/B,uCACA;EACE,4BAA4B,MAAM,sBAAsB,QAAQ;EAChE,aAAa;EACb,0BAA0B,CAAC,CAAC;EAC5B,GAAI,eAAe,EAAE,wBAAwB,cAAc,GAAG,EAAE;EACjE,CACF;AAED,KAAI;EACF,MAAM,QAAQ,MAAM,qBAAqB,SAAS,SAAS,QAAQ;AACnE,MAAI,iBAAiB,SACnB,QAAO;AAKT,QAAM,UAAU;EAMhB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ;AAC5C,MAAI,iBAAiB,SACnB,QAAO;EAMT,MAAM,yBACH,MAAM,gBACH,yBAAyB;EAG/B,MAAM,gCAAgC,yBACpC,MAAM,eACP,EAAE,SAAS,WAAW;AAEvB,2BAAyB;GACvB;GACA;GACA;GACA;GACA;GACA;GACA,mBAAmB,OAAO,UAAU,eAAe,KACjD,MAAM,kBAAkB,EAAE,EAC1B,sBACD;GACF,CAAC;EACF,MAAM,iBAAiB,MAAM,qCAAqC;GAChE;GACA;GACA;GACD,CAAC;AACF,MAAI,0BAA0B,SAAU,QAAO;AAE/C,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,MAAM,MAAM;AAC3B,QAAM,WAAW,MAAM;AAEvB,MAAI,QAAQ,OAAO,aAAa,QAAQ,YACtC,SAAQ,YAAY,MAClB;GAAE,WAAW;GAAS,UAAU,MAAM;GAAU,EAChD,oBACD;AAGH,MAAI,sBAAsB,QAAQ,CAChC,QAAO,sBAAsB;GAC3B;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;AAGJ,SAAO,aAAa;GAClB;GACA;GACA;GACA;GACA;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB;GACD,CAAC;UACK,OAAO;AACd,0BAAwB,QAAQ,EAAE,OAAO;GACvC;GACA;GACA,WAAW;GACX;GACA,OAAO;GACP;GACD,CAAC;AACF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,UAAQ,MACN,gBACA,iBAAiB,QAAQ,MAAM,QAAQ,iBACxC;AACD,UAAQ,MAAM,kBAAkB;GAC9B,MAAM,iBAAiB,QAAQ,MAAM,OAAO;GAC5C,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC/D,OAAO,iBAAiB,QAAQ,MAAM,QAAQ;GAC/C,CAAC;AAEF,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}
+{"version":3,"file":"handle-run.mjs","names":[],"sources":["../../../../src/v2/runtime/handlers/handle-run.ts"],"sourcesContent":["import { readCopilotKitUIEnvelope } from \"@copilotkit/shared\";\nimport { isIntelligenceRuntime } from \"../core/runtime\";\nimport { telemetry } from \"../telemetry\";\nimport { readGuardrailsEnabled } from \"./shared/cloud-telemetry\";\nimport type { RunAgentParameters } from \"./shared/agent-utils\";\nimport {\n  attachIntelligenceEnterpriseLearning,\n  cloneAgentForRequest,\n  configureAgentForRequest,\n  parseRunRequest,\n} from \"./shared/agent-utils\";\nimport { handleIntelligenceRun } from \"./intelligence/run\";\nimport { handleSseRun } from \"./sse/run\";\nimport { getRuntimeErrorReporter } from \"../core/runtime-error-reporter\";\nimport { enforcesThreadOwnership } from \"../runner/agent-runner\";\nimport {\n  resolveLocalThreadOwner,\n  threadAccessDeniedResponse,\n} from \"./shared/thread-access\";\n\nexport async function handleRunAgent({\n  runtime,\n  request,\n  agentId,\n}: RunAgentParameters) {\n  const startTime = Date.now();\n  const publicApiKey = request.headers.get(\"x-copilotcloud-public-api-key\");\n  (runtime.telemetry ?? telemetry).capture(\n    \"oss.runtime.copilot_request_created\",\n    {\n      \"cloud.guardrails.enabled\": await readGuardrailsEnabled(request),\n      requestType: \"run\",\n      \"cloud.api_key_provided\": !!publicApiKey,\n      ...(publicApiKey ? { \"cloud.public_api_key\": publicApiKey } : {}),\n    },\n  );\n\n  try {\n    const agent = await cloneAgentForRequest(runtime, agentId, request);\n    if (agent instanceof Response) {\n      return agent;\n    }\n\n    // Ensure the clone carries the registry key so InMemoryAgentRunner can\n    // tag historic runs with the correct agentId for filtering.\n    agent.agentId = agentId;\n\n    // Parse the body before configuring middleware: middleware configuration\n    // needs the A2UI catalog signal the React provider forwards (see\n    // `a2uiCatalogAvailable` below). Middleware is applied to the agent here;\n    // the run itself is kicked off later, so this is safe. The body is read\n    // from a clone, so `identifyUser` can still read the original request.\n    const input = await parseRunRequest(request.clone());\n    if (input instanceof Response) {\n      return input;\n    }\n\n    // A thread belongs to the identity of its first run. Running needs no\n    // configured identity (anonymous runs keep working), but nobody may add to\n    // a thread that another identity owns.\n    let ownerId: string | undefined;\n    if (!isIntelligenceRuntime(runtime)) {\n      const owner = await resolveLocalThreadOwner({\n        runtime,\n        request,\n        operation: \"run\",\n      });\n      if (owner instanceof Response) return owner;\n      if (\n        enforcesThreadOwnership(runtime.runner) &&\n        !(await runtime.runner.isThreadAccessible(input.threadId, {\n          ownerId: owner,\n        }))\n      ) {\n        return threadAccessDeniedResponse();\n      }\n      ownerId = owner;\n    }\n\n    // `<CopilotKit a2ui={{ catalog }}>` forwards this flag on every run. Its\n    // presence alone is enough to turn A2UI on end-to-end — no runtime-side\n    // `a2ui` config required.\n    const providerA2UIHasCatalog =\n      (input.forwardedProps as Record<string, unknown> | undefined)\n        ?.a2uiCatalogAvailable === true;\n    // The generative UI envelope (`forwardedProps.copilotkit.ui`) picks the\n    // transport of this run.\n    const providerGenerativeUITransport = readCopilotKitUIEnvelope(\n      input.forwardedProps,\n    )?.metadata.extensions.copilotkit_transport;\n\n    configureAgentForRequest({\n      runtime,\n      request,\n      agentId,\n      agent,\n      providerA2UIHasCatalog,\n      providerGenerativeUITransport,\n      isMcpProxyRequest: Object.prototype.hasOwnProperty.call(\n        input.forwardedProps ?? {},\n        \"__proxiedMCPRequest\",\n      ),\n    });\n    const memoryResponse = await attachIntelligenceEnterpriseLearning({\n      runtime,\n      request,\n      agent,\n    });\n    if (memoryResponse instanceof Response) return memoryResponse;\n\n    agent.setMessages(input.messages);\n    agent.setState(input.state);\n    agent.threadId = input.threadId;\n\n    if (runtime.debug?.lifecycle && runtime.debugLogger) {\n      runtime.debugLogger.debug(\n        { agentName: agentId, threadId: input.threadId },\n        \"Agent run started\",\n      );\n    }\n\n    if (isIntelligenceRuntime(runtime)) {\n      return handleIntelligenceRun({\n        runtime,\n        request,\n        agentId,\n        agent,\n        input,\n        startTime,\n      });\n    }\n\n    return handleSseRun({\n      runtime,\n      request,\n      agent,\n      input,\n      agentId,\n      debug: runtime.debug,\n      logger: runtime.debugLogger,\n      startTime,\n      ownerId,\n    });\n  } catch (error) {\n    getRuntimeErrorReporter(runtime)?.report({\n      request,\n      error,\n      operation: \"agent.run\",\n      agentId,\n      phase: \"common\",\n      startTime,\n    });\n    console.error(\"Error running agent:\", error);\n    console.error(\n      \"Error stack:\",\n      error instanceof Error ? error.stack : \"No stack trace\",\n    );\n    console.error(\"Error details:\", {\n      name: error instanceof Error ? error.name : \"Unknown\",\n      message: error instanceof Error ? error.message : String(error),\n      cause: error instanceof Error ? error.cause : undefined,\n    });\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to run agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsB,eAAe,EACnC,SACA,SACA,WACqB;CACrB,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,eAAe,QAAQ,QAAQ,IAAI,gCAAgC;AACzE,EAAC,QAAQ,aAAa,WAAW,QAC/B,uCACA;EACE,4BAA4B,MAAM,sBAAsB,QAAQ;EAChE,aAAa;EACb,0BAA0B,CAAC,CAAC;EAC5B,GAAI,eAAe,EAAE,wBAAwB,cAAc,GAAG,EAAE;EACjE,CACF;AAED,KAAI;EACF,MAAM,QAAQ,MAAM,qBAAqB,SAAS,SAAS,QAAQ;AACnE,MAAI,iBAAiB,SACnB,QAAO;AAKT,QAAM,UAAU;EAOhB,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,OAAO,CAAC;AACpD,MAAI,iBAAiB,SACnB,QAAO;EAMT,IAAI;AACJ,MAAI,CAAC,sBAAsB,QAAQ,EAAE;GACnC,MAAM,QAAQ,MAAM,wBAAwB;IAC1C;IACA;IACA,WAAW;IACZ,CAAC;AACF,OAAI,iBAAiB,SAAU,QAAO;AACtC,OACE,wBAAwB,QAAQ,OAAO,IACvC,CAAE,MAAM,QAAQ,OAAO,mBAAmB,MAAM,UAAU,EACxD,SAAS,OACV,CAAC,CAEF,QAAO,4BAA4B;AAErC,aAAU;;EAMZ,MAAM,yBACH,MAAM,gBACH,yBAAyB;EAG/B,MAAM,gCAAgC,yBACpC,MAAM,eACP,EAAE,SAAS,WAAW;AAEvB,2BAAyB;GACvB;GACA;GACA;GACA;GACA;GACA;GACA,mBAAmB,OAAO,UAAU,eAAe,KACjD,MAAM,kBAAkB,EAAE,EAC1B,sBACD;GACF,CAAC;EACF,MAAM,iBAAiB,MAAM,qCAAqC;GAChE;GACA;GACA;GACD,CAAC;AACF,MAAI,0BAA0B,SAAU,QAAO;AAE/C,QAAM,YAAY,MAAM,SAAS;AACjC,QAAM,SAAS,MAAM,MAAM;AAC3B,QAAM,WAAW,MAAM;AAEvB,MAAI,QAAQ,OAAO,aAAa,QAAQ,YACtC,SAAQ,YAAY,MAClB;GAAE,WAAW;GAAS,UAAU,MAAM;GAAU,EAChD,oBACD;AAGH,MAAI,sBAAsB,QAAQ,CAChC,QAAO,sBAAsB;GAC3B;GACA;GACA;GACA;GACA;GACA;GACD,CAAC;AAGJ,SAAO,aAAa;GAClB;GACA;GACA;GACA;GACA;GACA,OAAO,QAAQ;GACf,QAAQ,QAAQ;GAChB;GACA;GACD,CAAC;UACK,OAAO;AACd,0BAAwB,QAAQ,EAAE,OAAO;GACvC;GACA;GACA,WAAW;GACX;GACA,OAAO;GACP;GACD,CAAC;AACF,UAAQ,MAAM,wBAAwB,MAAM;AAC5C,UAAQ,MACN,gBACA,iBAAiB,QAAQ,MAAM,QAAQ,iBACxC;AACD,UAAQ,MAAM,kBAAkB;GAC9B,MAAM,iBAAiB,QAAQ,MAAM,OAAO;GAC5C,SAAS,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC/D,OAAO,iBAAiB,QAAQ,MAAM,QAAQ;GAC/C,CAAC;AAEF,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}

package/dist/v2/runtime/handlers/handle-stop.cjs

@@ -1,9 +1,10 @@
 require("reflect-metadata");
 const require_runtime = require('../../../_virtual/_rolldown/runtime.cjs');
-const require_runtime$1 = require('../core/runtime.cjs');
 const require_json_response = require('./shared/json-response.cjs');
 const require_intelligence_utils = require('./shared/intelligence-utils.cjs');
 const require_resolve_intelligence_user = require('./shared/resolve-intelligence-user.cjs');
+const require_thread_access = require('./shared/thread-access.cjs');
+const require_runtime$1 = require('../core/runtime.cjs');
 let _ag_ui_client = require("@ag-ui/client");
 
 //#region src/v2/runtime/handlers/handle-stop.ts
@@ -28,7 +29,16 @@ async function handleStopAgent({ runtime, request, agentId, threadId }) {
 		if (require_json_response.isHandlerResponse(scope)) return scope;
 		const { runId } = scope;
 		let stopThreadId = threadId;
-		if (require_runtime$1.isIntelligenceRuntime(runtime)) {
+		let ownerId;
+		if (!require_runtime$1.isIntelligenceRuntime(runtime)) {
+			const owner = await require_thread_access.resolveLocalThreadOwner({
+				runtime,
+				request,
+				operation: "stop"
+			});
+			if (require_json_response.isHandlerResponse(owner)) return owner;
+			ownerId = owner;
+		} else {
 			const user = await require_resolve_intelligence_user.resolveIntelligenceUser({
 				runtime,
 				request
@@ -56,7 +66,8 @@ async function handleStopAgent({ runtime, request, agentId, threadId }) {
 		});
 		if (!await runtime.runner.stop({
 			threadId: stopThreadId,
-			...runId === void 0 ? {} : { runId }
+			...runId === void 0 ? {} : { runId },
+			...ownerId === void 0 ? {} : { ownerId }
 		})) return new Response(JSON.stringify({
 			stopped: false,
 			message: runId === void 0 ? `No active run for thread '${threadId}'.` : `Run '${runId}' is not the active run for thread '${threadId}'.`

package/dist/v2/runtime/handlers/handle-stop.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"handle-stop.cjs","names":["isHandlerResponse","isIntelligenceRuntime","resolveIntelligenceUser","getPlatformErrorStatus","resolveAgents","EventType"],"sources":["../../../../src/v2/runtime/handlers/handle-stop.ts"],"sourcesContent":["import type { CopilotRuntimeLike } from \"../core/runtime\";\nimport { isIntelligenceRuntime, resolveAgents } from \"../core/runtime\";\nimport { EventType } from \"@ag-ui/client\";\nimport { resolveIntelligenceUser } from \"./shared/resolve-intelligence-user\";\nimport { isHandlerResponse } from \"./shared/json-response\";\nimport { getPlatformErrorStatus } from \"./shared/intelligence-utils\";\n\ninterface StopAgentParameters {\n  request: Request;\n  runtime: CopilotRuntimeLike;\n  agentId: string;\n  threadId: string;\n}\n\n/** Read `{ runId? }` from a stop request body; a 400 Response when the body is not a valid scope. */\nasync function parseStopScope(\n  request: Request,\n): Promise<{ runId?: string } | Response> {\n  try {\n    const raw = await request.text();\n    const body: unknown = raw.trim() ? JSON.parse(raw) : {};\n    if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    // Only `runId` is allowed. A misspelt key must not fall through to a\n    // thread-wide stop, because a stop cannot be undone.\n    if (Object.keys(body).some((key) => key !== \"runId\")) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    if (!(\"runId\" in body)) return {};\n    if (typeof body.runId !== \"string\" || !body.runId.trim()) {\n      return Response.json({ error: \"Invalid runId\" }, { status: 400 });\n    }\n    return { runId: body.runId };\n  } catch {\n    return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n  }\n}\n\n/** Stop an active run after applying the runtime's application identity policy. */\nexport async function handleStopAgent({\n  runtime,\n  request,\n  agentId,\n  threadId,\n}: StopAgentParameters): Promise<Response> {\n  try {\n    // Parse the optional run scope for every runtime kind, from a clone so an\n    // identity callback can still read the original body. No body or `{}`\n    // keeps the thread-wide stop existing clients rely on.\n    const scope = await parseStopScope(request.clone());\n    if (isHandlerResponse(scope)) return scope;\n    const { runId } = scope;\n    let stopThreadId = threadId;\n    if (isIntelligenceRuntime(runtime)) {\n      const user = await resolveIntelligenceUser({ runtime, request });\n      if (isHandlerResponse(user)) return user;\n      try {\n        const thread = await runtime.intelligence.getThread({\n          threadId,\n          userId: user.id,\n        });\n        if (!thread || typeof thread.id !== \"string\" || !thread.id.trim()) {\n          return Response.json(\n            { error: \"Invalid thread response\" },\n            { status: 502 },\n          );\n        }\n        if (thread.agentId !== undefined && thread.agentId !== agentId) {\n          return Response.json(\n            { error: \"Thread access denied\" },\n            { status: 403 },\n          );\n        }\n        stopThreadId = thread.id;\n      } catch (error) {\n        const status = getPlatformErrorStatus(error);\n        return Response.json(\n          { error: \"Thread access denied\" },\n          { status: status && status >= 400 && status < 500 ? status : 502 },\n        );\n      }\n    }\n    const agents = await resolveAgents(runtime.agents, request);\n\n    if (!agents[agentId]) {\n      return new Response(\n        JSON.stringify({\n          error: \"Agent not found\",\n          message: `Agent '${agentId}' does not exist`,\n        }),\n        {\n          status: 404,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    const stopped = await runtime.runner.stop({\n      threadId: stopThreadId,\n      ...(runId === undefined ? {} : { runId }),\n    });\n\n    if (!stopped) {\n      return new Response(\n        JSON.stringify({\n          stopped: false,\n          message:\n            runId === undefined\n              ? `No active run for thread '${threadId}'.`\n              : `Run '${runId}' is not the active run for thread '${threadId}'.`,\n        }),\n        {\n          status: 200,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    return new Response(\n      JSON.stringify({\n        stopped: true,\n        interrupt: {\n          type: EventType.RUN_ERROR,\n          message: \"Run stopped by user\",\n          code: \"STOPPED\",\n        },\n      }),\n      {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  } catch (error) {\n    console.error(\"Error stopping agent run:\", error);\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to stop agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;AAeA,eAAe,eACb,SACwC;AACxC,KAAI;EACF,MAAM,MAAM,MAAM,QAAQ,MAAM;EAChC,MAAM,OAAgB,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,EAAE;AACvD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,KAAK,CAClE,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAI1E,MAAI,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,QAAQ,QAAQ,CAClD,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE1E,MAAI,EAAE,WAAW,MAAO,QAAO,EAAE;AACjC,MAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAM,MAAM,CACtD,QAAO,SAAS,KAAK,EAAE,OAAO,iBAAiB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAEnE,SAAO,EAAE,OAAO,KAAK,OAAO;SACtB;AACN,SAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;;;;AAK5E,eAAsB,gBAAgB,EACpC,SACA,SACA,SACA,YACyC;AACzC,KAAI;EAIF,MAAM,QAAQ,MAAM,eAAe,QAAQ,OAAO,CAAC;AACnD,MAAIA,wCAAkB,MAAM,CAAE,QAAO;EACrC,MAAM,EAAE,UAAU;EAClB,IAAI,eAAe;AACnB,MAAIC,wCAAsB,QAAQ,EAAE;GAClC,MAAM,OAAO,MAAMC,0DAAwB;IAAE;IAAS;IAAS,CAAC;AAChE,OAAIF,wCAAkB,KAAK,CAAE,QAAO;AACpC,OAAI;IACF,MAAM,SAAS,MAAM,QAAQ,aAAa,UAAU;KAClD;KACA,QAAQ,KAAK;KACd,CAAC;AACF,QAAI,CAAC,UAAU,OAAO,OAAO,OAAO,YAAY,CAAC,OAAO,GAAG,MAAM,CAC/D,QAAO,SAAS,KACd,EAAE,OAAO,2BAA2B,EACpC,EAAE,QAAQ,KAAK,CAChB;AAEH,QAAI,OAAO,YAAY,UAAa,OAAO,YAAY,QACrD,QAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,KAAK,CAChB;AAEH,mBAAe,OAAO;YACf,OAAO;IACd,MAAM,SAASG,kDAAuB,MAAM;AAC5C,WAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,UAAU,UAAU,OAAO,SAAS,MAAM,SAAS,KAAK,CACnE;;;AAKL,MAAI,EAFW,MAAMC,gCAAc,QAAQ,QAAQ,QAAQ,EAE/C,SACV,QAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,UAAU,QAAQ;GAC5B,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAQH,MAAI,CALY,MAAM,QAAQ,OAAO,KAAK;GACxC,UAAU;GACV,GAAI,UAAU,SAAY,EAAE,GAAG,EAAE,OAAO;GACzC,CAAC,CAGA,QAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,SACE,UAAU,SACN,6BAA6B,SAAS,MACtC,QAAQ,MAAM,sCAAsC,SAAS;GACpE,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAGH,SAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,WAAW;IACT,MAAMC,wBAAU;IAChB,SAAS;IACT,MAAM;IACP;GACF,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;UACM,OAAO;AACd,UAAQ,MAAM,6BAA6B,MAAM;AAEjD,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}
+{"version":3,"file":"handle-stop.cjs","names":["isHandlerResponse","isIntelligenceRuntime","resolveLocalThreadOwner","resolveIntelligenceUser","getPlatformErrorStatus","resolveAgents","EventType"],"sources":["../../../../src/v2/runtime/handlers/handle-stop.ts"],"sourcesContent":["import type { CopilotRuntimeLike } from \"../core/runtime\";\nimport { isIntelligenceRuntime, resolveAgents } from \"../core/runtime\";\nimport { EventType } from \"@ag-ui/client\";\nimport { resolveIntelligenceUser } from \"./shared/resolve-intelligence-user\";\nimport { isHandlerResponse } from \"./shared/json-response\";\nimport { getPlatformErrorStatus } from \"./shared/intelligence-utils\";\nimport { resolveLocalThreadOwner } from \"./shared/thread-access\";\n\ninterface StopAgentParameters {\n  request: Request;\n  runtime: CopilotRuntimeLike;\n  agentId: string;\n  threadId: string;\n}\n\n/** Read `{ runId? }` from a stop request body; a 400 Response when the body is not a valid scope. */\nasync function parseStopScope(\n  request: Request,\n): Promise<{ runId?: string } | Response> {\n  try {\n    const raw = await request.text();\n    const body: unknown = raw.trim() ? JSON.parse(raw) : {};\n    if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    // Only `runId` is allowed. A misspelt key must not fall through to a\n    // thread-wide stop, because a stop cannot be undone.\n    if (Object.keys(body).some((key) => key !== \"runId\")) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    if (!(\"runId\" in body)) return {};\n    if (typeof body.runId !== \"string\" || !body.runId.trim()) {\n      return Response.json({ error: \"Invalid runId\" }, { status: 400 });\n    }\n    return { runId: body.runId };\n  } catch {\n    return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n  }\n}\n\n/** Stop an active run after applying the runtime's application identity policy. */\nexport async function handleStopAgent({\n  runtime,\n  request,\n  agentId,\n  threadId,\n}: StopAgentParameters): Promise<Response> {\n  try {\n    // Parse the optional run scope for every runtime kind, from a clone so an\n    // identity callback can still read the original body. No body or `{}`\n    // keeps the thread-wide stop existing clients rely on.\n    const scope = await parseStopScope(request.clone());\n    if (isHandlerResponse(scope)) return scope;\n    const { runId } = scope;\n    let stopThreadId = threadId;\n    let ownerId: string | undefined;\n    if (!isIntelligenceRuntime(runtime)) {\n      // A run on another identity's thread reports \"no active run\".\n      const owner = await resolveLocalThreadOwner({\n        runtime,\n        request,\n        operation: \"stop\",\n      });\n      if (isHandlerResponse(owner)) return owner;\n      ownerId = owner;\n    } else {\n      const user = await resolveIntelligenceUser({ runtime, request });\n      if (isHandlerResponse(user)) return user;\n      try {\n        const thread = await runtime.intelligence.getThread({\n          threadId,\n          userId: user.id,\n        });\n        if (!thread || typeof thread.id !== \"string\" || !thread.id.trim()) {\n          return Response.json(\n            { error: \"Invalid thread response\" },\n            { status: 502 },\n          );\n        }\n        if (thread.agentId !== undefined && thread.agentId !== agentId) {\n          return Response.json(\n            { error: \"Thread access denied\" },\n            { status: 403 },\n          );\n        }\n        stopThreadId = thread.id;\n      } catch (error) {\n        const status = getPlatformErrorStatus(error);\n        return Response.json(\n          { error: \"Thread access denied\" },\n          { status: status && status >= 400 && status < 500 ? status : 502 },\n        );\n      }\n    }\n    const agents = await resolveAgents(runtime.agents, request);\n\n    if (!agents[agentId]) {\n      return new Response(\n        JSON.stringify({\n          error: \"Agent not found\",\n          message: `Agent '${agentId}' does not exist`,\n        }),\n        {\n          status: 404,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    const stopped = await runtime.runner.stop({\n      threadId: stopThreadId,\n      ...(runId === undefined ? {} : { runId }),\n      ...(ownerId === undefined ? {} : { ownerId }),\n    });\n\n    if (!stopped) {\n      return new Response(\n        JSON.stringify({\n          stopped: false,\n          message:\n            runId === undefined\n              ? `No active run for thread '${threadId}'.`\n              : `Run '${runId}' is not the active run for thread '${threadId}'.`,\n        }),\n        {\n          status: 200,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    return new Response(\n      JSON.stringify({\n        stopped: true,\n        interrupt: {\n          type: EventType.RUN_ERROR,\n          message: \"Run stopped by user\",\n          code: \"STOPPED\",\n        },\n      }),\n      {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  } catch (error) {\n    console.error(\"Error stopping agent run:\", error);\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to stop agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;AAgBA,eAAe,eACb,SACwC;AACxC,KAAI;EACF,MAAM,MAAM,MAAM,QAAQ,MAAM;EAChC,MAAM,OAAgB,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,EAAE;AACvD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,KAAK,CAClE,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAI1E,MAAI,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,QAAQ,QAAQ,CAClD,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE1E,MAAI,EAAE,WAAW,MAAO,QAAO,EAAE;AACjC,MAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAM,MAAM,CACtD,QAAO,SAAS,KAAK,EAAE,OAAO,iBAAiB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAEnE,SAAO,EAAE,OAAO,KAAK,OAAO;SACtB;AACN,SAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;;;;AAK5E,eAAsB,gBAAgB,EACpC,SACA,SACA,SACA,YACyC;AACzC,KAAI;EAIF,MAAM,QAAQ,MAAM,eAAe,QAAQ,OAAO,CAAC;AACnD,MAAIA,wCAAkB,MAAM,CAAE,QAAO;EACrC,MAAM,EAAE,UAAU;EAClB,IAAI,eAAe;EACnB,IAAI;AACJ,MAAI,CAACC,wCAAsB,QAAQ,EAAE;GAEnC,MAAM,QAAQ,MAAMC,8CAAwB;IAC1C;IACA;IACA,WAAW;IACZ,CAAC;AACF,OAAIF,wCAAkB,MAAM,CAAE,QAAO;AACrC,aAAU;SACL;GACL,MAAM,OAAO,MAAMG,0DAAwB;IAAE;IAAS;IAAS,CAAC;AAChE,OAAIH,wCAAkB,KAAK,CAAE,QAAO;AACpC,OAAI;IACF,MAAM,SAAS,MAAM,QAAQ,aAAa,UAAU;KAClD;KACA,QAAQ,KAAK;KACd,CAAC;AACF,QAAI,CAAC,UAAU,OAAO,OAAO,OAAO,YAAY,CAAC,OAAO,GAAG,MAAM,CAC/D,QAAO,SAAS,KACd,EAAE,OAAO,2BAA2B,EACpC,EAAE,QAAQ,KAAK,CAChB;AAEH,QAAI,OAAO,YAAY,UAAa,OAAO,YAAY,QACrD,QAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,KAAK,CAChB;AAEH,mBAAe,OAAO;YACf,OAAO;IACd,MAAM,SAASI,kDAAuB,MAAM;AAC5C,WAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,UAAU,UAAU,OAAO,SAAS,MAAM,SAAS,KAAK,CACnE;;;AAKL,MAAI,EAFW,MAAMC,gCAAc,QAAQ,QAAQ,QAAQ,EAE/C,SACV,QAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,UAAU,QAAQ;GAC5B,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AASH,MAAI,CANY,MAAM,QAAQ,OAAO,KAAK;GACxC,UAAU;GACV,GAAI,UAAU,SAAY,EAAE,GAAG,EAAE,OAAO;GACxC,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAC7C,CAAC,CAGA,QAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,SACE,UAAU,SACN,6BAA6B,SAAS,MACtC,QAAQ,MAAM,sCAAsC,SAAS;GACpE,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAGH,SAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,WAAW;IACT,MAAMC,wBAAU;IAChB,SAAS;IACT,MAAM;IACP;GACF,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;UACM,OAAO;AACd,UAAQ,MAAM,6BAA6B,MAAM;AAEjD,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}

package/dist/v2/runtime/handlers/handle-stop.mjs

@@ -1,8 +1,9 @@
 import "reflect-metadata";
-import { isIntelligenceRuntime, resolveAgents } from "../core/runtime.mjs";
 import { isHandlerResponse } from "./shared/json-response.mjs";
 import { getPlatformErrorStatus } from "./shared/intelligence-utils.mjs";
 import { resolveIntelligenceUser } from "./shared/resolve-intelligence-user.mjs";
+import { resolveLocalThreadOwner } from "./shared/thread-access.mjs";
+import { isIntelligenceRuntime, resolveAgents } from "../core/runtime.mjs";
 import { EventType } from "@ag-ui/client";
 
 //#region src/v2/runtime/handlers/handle-stop.ts
@@ -27,7 +28,16 @@ async function handleStopAgent({ runtime, request, agentId, threadId }) {
 		if (isHandlerResponse(scope)) return scope;
 		const { runId } = scope;
 		let stopThreadId = threadId;
-		if (isIntelligenceRuntime(runtime)) {
+		let ownerId;
+		if (!isIntelligenceRuntime(runtime)) {
+			const owner = await resolveLocalThreadOwner({
+				runtime,
+				request,
+				operation: "stop"
+			});
+			if (isHandlerResponse(owner)) return owner;
+			ownerId = owner;
+		} else {
 			const user = await resolveIntelligenceUser({
 				runtime,
 				request
@@ -55,7 +65,8 @@ async function handleStopAgent({ runtime, request, agentId, threadId }) {
 		});
 		if (!await runtime.runner.stop({
 			threadId: stopThreadId,
-			...runId === void 0 ? {} : { runId }
+			...runId === void 0 ? {} : { runId },
+			...ownerId === void 0 ? {} : { ownerId }
 		})) return new Response(JSON.stringify({
 			stopped: false,
 			message: runId === void 0 ? `No active run for thread '${threadId}'.` : `Run '${runId}' is not the active run for thread '${threadId}'.`

package/dist/v2/runtime/handlers/handle-stop.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"handle-stop.mjs","names":[],"sources":["../../../../src/v2/runtime/handlers/handle-stop.ts"],"sourcesContent":["import type { CopilotRuntimeLike } from \"../core/runtime\";\nimport { isIntelligenceRuntime, resolveAgents } from \"../core/runtime\";\nimport { EventType } from \"@ag-ui/client\";\nimport { resolveIntelligenceUser } from \"./shared/resolve-intelligence-user\";\nimport { isHandlerResponse } from \"./shared/json-response\";\nimport { getPlatformErrorStatus } from \"./shared/intelligence-utils\";\n\ninterface StopAgentParameters {\n  request: Request;\n  runtime: CopilotRuntimeLike;\n  agentId: string;\n  threadId: string;\n}\n\n/** Read `{ runId? }` from a stop request body; a 400 Response when the body is not a valid scope. */\nasync function parseStopScope(\n  request: Request,\n): Promise<{ runId?: string } | Response> {\n  try {\n    const raw = await request.text();\n    const body: unknown = raw.trim() ? JSON.parse(raw) : {};\n    if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    // Only `runId` is allowed. A misspelt key must not fall through to a\n    // thread-wide stop, because a stop cannot be undone.\n    if (Object.keys(body).some((key) => key !== \"runId\")) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    if (!(\"runId\" in body)) return {};\n    if (typeof body.runId !== \"string\" || !body.runId.trim()) {\n      return Response.json({ error: \"Invalid runId\" }, { status: 400 });\n    }\n    return { runId: body.runId };\n  } catch {\n    return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n  }\n}\n\n/** Stop an active run after applying the runtime's application identity policy. */\nexport async function handleStopAgent({\n  runtime,\n  request,\n  agentId,\n  threadId,\n}: StopAgentParameters): Promise<Response> {\n  try {\n    // Parse the optional run scope for every runtime kind, from a clone so an\n    // identity callback can still read the original body. No body or `{}`\n    // keeps the thread-wide stop existing clients rely on.\n    const scope = await parseStopScope(request.clone());\n    if (isHandlerResponse(scope)) return scope;\n    const { runId } = scope;\n    let stopThreadId = threadId;\n    if (isIntelligenceRuntime(runtime)) {\n      const user = await resolveIntelligenceUser({ runtime, request });\n      if (isHandlerResponse(user)) return user;\n      try {\n        const thread = await runtime.intelligence.getThread({\n          threadId,\n          userId: user.id,\n        });\n        if (!thread || typeof thread.id !== \"string\" || !thread.id.trim()) {\n          return Response.json(\n            { error: \"Invalid thread response\" },\n            { status: 502 },\n          );\n        }\n        if (thread.agentId !== undefined && thread.agentId !== agentId) {\n          return Response.json(\n            { error: \"Thread access denied\" },\n            { status: 403 },\n          );\n        }\n        stopThreadId = thread.id;\n      } catch (error) {\n        const status = getPlatformErrorStatus(error);\n        return Response.json(\n          { error: \"Thread access denied\" },\n          { status: status && status >= 400 && status < 500 ? status : 502 },\n        );\n      }\n    }\n    const agents = await resolveAgents(runtime.agents, request);\n\n    if (!agents[agentId]) {\n      return new Response(\n        JSON.stringify({\n          error: \"Agent not found\",\n          message: `Agent '${agentId}' does not exist`,\n        }),\n        {\n          status: 404,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    const stopped = await runtime.runner.stop({\n      threadId: stopThreadId,\n      ...(runId === undefined ? {} : { runId }),\n    });\n\n    if (!stopped) {\n      return new Response(\n        JSON.stringify({\n          stopped: false,\n          message:\n            runId === undefined\n              ? `No active run for thread '${threadId}'.`\n              : `Run '${runId}' is not the active run for thread '${threadId}'.`,\n        }),\n        {\n          status: 200,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    return new Response(\n      JSON.stringify({\n        stopped: true,\n        interrupt: {\n          type: EventType.RUN_ERROR,\n          message: \"Run stopped by user\",\n          code: \"STOPPED\",\n        },\n      }),\n      {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  } catch (error) {\n    console.error(\"Error stopping agent run:\", error);\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to stop agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;AAeA,eAAe,eACb,SACwC;AACxC,KAAI;EACF,MAAM,MAAM,MAAM,QAAQ,MAAM;EAChC,MAAM,OAAgB,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,EAAE;AACvD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,KAAK,CAClE,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAI1E,MAAI,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,QAAQ,QAAQ,CAClD,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE1E,MAAI,EAAE,WAAW,MAAO,QAAO,EAAE;AACjC,MAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAM,MAAM,CACtD,QAAO,SAAS,KAAK,EAAE,OAAO,iBAAiB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAEnE,SAAO,EAAE,OAAO,KAAK,OAAO;SACtB;AACN,SAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;;;;AAK5E,eAAsB,gBAAgB,EACpC,SACA,SACA,SACA,YACyC;AACzC,KAAI;EAIF,MAAM,QAAQ,MAAM,eAAe,QAAQ,OAAO,CAAC;AACnD,MAAI,kBAAkB,MAAM,CAAE,QAAO;EACrC,MAAM,EAAE,UAAU;EAClB,IAAI,eAAe;AACnB,MAAI,sBAAsB,QAAQ,EAAE;GAClC,MAAM,OAAO,MAAM,wBAAwB;IAAE;IAAS;IAAS,CAAC;AAChE,OAAI,kBAAkB,KAAK,CAAE,QAAO;AACpC,OAAI;IACF,MAAM,SAAS,MAAM,QAAQ,aAAa,UAAU;KAClD;KACA,QAAQ,KAAK;KACd,CAAC;AACF,QAAI,CAAC,UAAU,OAAO,OAAO,OAAO,YAAY,CAAC,OAAO,GAAG,MAAM,CAC/D,QAAO,SAAS,KACd,EAAE,OAAO,2BAA2B,EACpC,EAAE,QAAQ,KAAK,CAChB;AAEH,QAAI,OAAO,YAAY,UAAa,OAAO,YAAY,QACrD,QAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,KAAK,CAChB;AAEH,mBAAe,OAAO;YACf,OAAO;IACd,MAAM,SAAS,uBAAuB,MAAM;AAC5C,WAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,UAAU,UAAU,OAAO,SAAS,MAAM,SAAS,KAAK,CACnE;;;AAKL,MAAI,EAFW,MAAM,cAAc,QAAQ,QAAQ,QAAQ,EAE/C,SACV,QAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,UAAU,QAAQ;GAC5B,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAQH,MAAI,CALY,MAAM,QAAQ,OAAO,KAAK;GACxC,UAAU;GACV,GAAI,UAAU,SAAY,EAAE,GAAG,EAAE,OAAO;GACzC,CAAC,CAGA,QAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,SACE,UAAU,SACN,6BAA6B,SAAS,MACtC,QAAQ,MAAM,sCAAsC,SAAS;GACpE,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAGH,SAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,WAAW;IACT,MAAM,UAAU;IAChB,SAAS;IACT,MAAM;IACP;GACF,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;UACM,OAAO;AACd,UAAQ,MAAM,6BAA6B,MAAM;AAEjD,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}
+{"version":3,"file":"handle-stop.mjs","names":[],"sources":["../../../../src/v2/runtime/handlers/handle-stop.ts"],"sourcesContent":["import type { CopilotRuntimeLike } from \"../core/runtime\";\nimport { isIntelligenceRuntime, resolveAgents } from \"../core/runtime\";\nimport { EventType } from \"@ag-ui/client\";\nimport { resolveIntelligenceUser } from \"./shared/resolve-intelligence-user\";\nimport { isHandlerResponse } from \"./shared/json-response\";\nimport { getPlatformErrorStatus } from \"./shared/intelligence-utils\";\nimport { resolveLocalThreadOwner } from \"./shared/thread-access\";\n\ninterface StopAgentParameters {\n  request: Request;\n  runtime: CopilotRuntimeLike;\n  agentId: string;\n  threadId: string;\n}\n\n/** Read `{ runId? }` from a stop request body; a 400 Response when the body is not a valid scope. */\nasync function parseStopScope(\n  request: Request,\n): Promise<{ runId?: string } | Response> {\n  try {\n    const raw = await request.text();\n    const body: unknown = raw.trim() ? JSON.parse(raw) : {};\n    if (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    // Only `runId` is allowed. A misspelt key must not fall through to a\n    // thread-wide stop, because a stop cannot be undone.\n    if (Object.keys(body).some((key) => key !== \"runId\")) {\n      return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n    }\n    if (!(\"runId\" in body)) return {};\n    if (typeof body.runId !== \"string\" || !body.runId.trim()) {\n      return Response.json({ error: \"Invalid runId\" }, { status: 400 });\n    }\n    return { runId: body.runId };\n  } catch {\n    return Response.json({ error: \"Invalid stop request\" }, { status: 400 });\n  }\n}\n\n/** Stop an active run after applying the runtime's application identity policy. */\nexport async function handleStopAgent({\n  runtime,\n  request,\n  agentId,\n  threadId,\n}: StopAgentParameters): Promise<Response> {\n  try {\n    // Parse the optional run scope for every runtime kind, from a clone so an\n    // identity callback can still read the original body. No body or `{}`\n    // keeps the thread-wide stop existing clients rely on.\n    const scope = await parseStopScope(request.clone());\n    if (isHandlerResponse(scope)) return scope;\n    const { runId } = scope;\n    let stopThreadId = threadId;\n    let ownerId: string | undefined;\n    if (!isIntelligenceRuntime(runtime)) {\n      // A run on another identity's thread reports \"no active run\".\n      const owner = await resolveLocalThreadOwner({\n        runtime,\n        request,\n        operation: \"stop\",\n      });\n      if (isHandlerResponse(owner)) return owner;\n      ownerId = owner;\n    } else {\n      const user = await resolveIntelligenceUser({ runtime, request });\n      if (isHandlerResponse(user)) return user;\n      try {\n        const thread = await runtime.intelligence.getThread({\n          threadId,\n          userId: user.id,\n        });\n        if (!thread || typeof thread.id !== \"string\" || !thread.id.trim()) {\n          return Response.json(\n            { error: \"Invalid thread response\" },\n            { status: 502 },\n          );\n        }\n        if (thread.agentId !== undefined && thread.agentId !== agentId) {\n          return Response.json(\n            { error: \"Thread access denied\" },\n            { status: 403 },\n          );\n        }\n        stopThreadId = thread.id;\n      } catch (error) {\n        const status = getPlatformErrorStatus(error);\n        return Response.json(\n          { error: \"Thread access denied\" },\n          { status: status && status >= 400 && status < 500 ? status : 502 },\n        );\n      }\n    }\n    const agents = await resolveAgents(runtime.agents, request);\n\n    if (!agents[agentId]) {\n      return new Response(\n        JSON.stringify({\n          error: \"Agent not found\",\n          message: `Agent '${agentId}' does not exist`,\n        }),\n        {\n          status: 404,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    const stopped = await runtime.runner.stop({\n      threadId: stopThreadId,\n      ...(runId === undefined ? {} : { runId }),\n      ...(ownerId === undefined ? {} : { ownerId }),\n    });\n\n    if (!stopped) {\n      return new Response(\n        JSON.stringify({\n          stopped: false,\n          message:\n            runId === undefined\n              ? `No active run for thread '${threadId}'.`\n              : `Run '${runId}' is not the active run for thread '${threadId}'.`,\n        }),\n        {\n          status: 200,\n          headers: { \"Content-Type\": \"application/json\" },\n        },\n      );\n    }\n\n    return new Response(\n      JSON.stringify({\n        stopped: true,\n        interrupt: {\n          type: EventType.RUN_ERROR,\n          message: \"Run stopped by user\",\n          code: \"STOPPED\",\n        },\n      }),\n      {\n        status: 200,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  } catch (error) {\n    console.error(\"Error stopping agent run:\", error);\n\n    return new Response(\n      JSON.stringify({\n        error: \"Failed to stop agent\",\n        message: error instanceof Error ? error.message : \"Unknown error\",\n      }),\n      {\n        status: 500,\n        headers: { \"Content-Type\": \"application/json\" },\n      },\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;AAgBA,eAAe,eACb,SACwC;AACxC,KAAI;EACF,MAAM,MAAM,MAAM,QAAQ,MAAM;EAChC,MAAM,OAAgB,IAAI,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,EAAE;AACvD,MAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,KAAK,CAClE,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAI1E,MAAI,OAAO,KAAK,KAAK,CAAC,MAAM,QAAQ,QAAQ,QAAQ,CAClD,QAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAE1E,MAAI,EAAE,WAAW,MAAO,QAAO,EAAE;AACjC,MAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,MAAM,MAAM,CACtD,QAAO,SAAS,KAAK,EAAE,OAAO,iBAAiB,EAAE,EAAE,QAAQ,KAAK,CAAC;AAEnE,SAAO,EAAE,OAAO,KAAK,OAAO;SACtB;AACN,SAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,EAAE,EAAE,QAAQ,KAAK,CAAC;;;;AAK5E,eAAsB,gBAAgB,EACpC,SACA,SACA,SACA,YACyC;AACzC,KAAI;EAIF,MAAM,QAAQ,MAAM,eAAe,QAAQ,OAAO,CAAC;AACnD,MAAI,kBAAkB,MAAM,CAAE,QAAO;EACrC,MAAM,EAAE,UAAU;EAClB,IAAI,eAAe;EACnB,IAAI;AACJ,MAAI,CAAC,sBAAsB,QAAQ,EAAE;GAEnC,MAAM,QAAQ,MAAM,wBAAwB;IAC1C;IACA;IACA,WAAW;IACZ,CAAC;AACF,OAAI,kBAAkB,MAAM,CAAE,QAAO;AACrC,aAAU;SACL;GACL,MAAM,OAAO,MAAM,wBAAwB;IAAE;IAAS;IAAS,CAAC;AAChE,OAAI,kBAAkB,KAAK,CAAE,QAAO;AACpC,OAAI;IACF,MAAM,SAAS,MAAM,QAAQ,aAAa,UAAU;KAClD;KACA,QAAQ,KAAK;KACd,CAAC;AACF,QAAI,CAAC,UAAU,OAAO,OAAO,OAAO,YAAY,CAAC,OAAO,GAAG,MAAM,CAC/D,QAAO,SAAS,KACd,EAAE,OAAO,2BAA2B,EACpC,EAAE,QAAQ,KAAK,CAChB;AAEH,QAAI,OAAO,YAAY,UAAa,OAAO,YAAY,QACrD,QAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,KAAK,CAChB;AAEH,mBAAe,OAAO;YACf,OAAO;IACd,MAAM,SAAS,uBAAuB,MAAM;AAC5C,WAAO,SAAS,KACd,EAAE,OAAO,wBAAwB,EACjC,EAAE,QAAQ,UAAU,UAAU,OAAO,SAAS,MAAM,SAAS,KAAK,CACnE;;;AAKL,MAAI,EAFW,MAAM,cAAc,QAAQ,QAAQ,QAAQ,EAE/C,SACV,QAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,UAAU,QAAQ;GAC5B,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AASH,MAAI,CANY,MAAM,QAAQ,OAAO,KAAK;GACxC,UAAU;GACV,GAAI,UAAU,SAAY,EAAE,GAAG,EAAE,OAAO;GACxC,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAC7C,CAAC,CAGA,QAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,SACE,UAAU,SACN,6BAA6B,SAAS,MACtC,QAAQ,MAAM,sCAAsC,SAAS;GACpE,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;AAGH,SAAO,IAAI,SACT,KAAK,UAAU;GACb,SAAS;GACT,WAAW;IACT,MAAM,UAAU;IAChB,SAAS;IACT,MAAM;IACP;GACF,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF;UACM,OAAO;AACd,UAAQ,MAAM,6BAA6B,MAAM;AAEjD,SAAO,IAAI,SACT,KAAK,UAAU;GACb,OAAO;GACP,SAAS,iBAAiB,QAAQ,MAAM,UAAU;GACnD,CAAC,EACF;GACE,QAAQ;GACR,SAAS,EAAE,gBAAgB,oBAAoB;GAChD,CACF"}

package/dist/v2/runtime/handlers/handle-trajectory-connect.cjs

@@ -1,7 +1,7 @@
 require("reflect-metadata");
-const require_runtime = require('../core/runtime.cjs');
 const require_trajectories = require('../intelligence-platform/trajectories.cjs');
 const require_resolve_intelligence_user = require('./shared/resolve-intelligence-user.cjs');
+const require_runtime = require('../core/runtime.cjs');
 
 //#region src/v2/runtime/handlers/handle-trajectory-connect.ts
 function trajectoryErrorResponse(code, message, status) {

package/dist/v2/runtime/handlers/handle-trajectory-connect.mjs

@@ -1,7 +1,7 @@
 import "reflect-metadata";
-import { isIntelligenceRuntime } from "../core/runtime.mjs";
 import { TrajectoryConnectionError, isValidTrajectoryId } from "../intelligence-platform/trajectories.mjs";
 import { resolveIntelligenceUser } from "./shared/resolve-intelligence-user.mjs";
+import { isIntelligenceRuntime } from "../core/runtime.mjs";
 
 //#region src/v2/runtime/handlers/handle-trajectory-connect.ts
 function trajectoryErrorResponse(code, message, status) {

package/dist/v2/runtime/handlers/intelligence/annotate.cjs

@@ -1,9 +1,9 @@
 require("reflect-metadata");
 const require_runtime = require('../../../../_virtual/_rolldown/runtime.cjs');
-const require_runtime$1 = require('../../core/runtime.cjs');
-const require_client = require('../../intelligence-platform/client.cjs');
 const require_json_response = require('../shared/json-response.cjs');
+const require_client = require('../../intelligence-platform/client.cjs');
 const require_resolve_intelligence_user = require('../shared/resolve-intelligence-user.cjs');
+const require_runtime$1 = require('../../core/runtime.cjs');
 let _copilotkit_shared = require("@copilotkit/shared");
 
 //#region src/v2/runtime/handlers/intelligence/annotate.ts

package/dist/v2/runtime/handlers/intelligence/annotate.mjs

@@ -1,8 +1,8 @@
 import "reflect-metadata";
-import { isIntelligenceRuntime } from "../../core/runtime.mjs";
-import { PlatformRequestError } from "../../intelligence-platform/client.mjs";
 import { errorResponse, isHandlerResponse } from "../shared/json-response.mjs";
+import { PlatformRequestError } from "../../intelligence-platform/client.mjs";
 import { resolveIntelligenceUser } from "../shared/resolve-intelligence-user.mjs";
+import { isIntelligenceRuntime } from "../../core/runtime.mjs";
 import { logger } from "@copilotkit/shared";
 
 //#region src/v2/runtime/handlers/intelligence/annotate.ts

package/dist/v2/runtime/handlers/intelligence/memories.cjs

@@ -1,8 +1,8 @@
 require("reflect-metadata");
 const require_runtime = require('../../../../_virtual/_rolldown/runtime.cjs');
-const require_runtime$1 = require('../../core/runtime.cjs');
 const require_json_response = require('../shared/json-response.cjs');
 const require_resolve_intelligence_user = require('../shared/resolve-intelligence-user.cjs');
+const require_runtime$1 = require('../../core/runtime.cjs');
 const require_memory_policy = require('../shared/memory-policy.cjs');
 const require_platform_error = require('../shared/platform-error.cjs');
 let _copilotkit_shared = require("@copilotkit/shared");

package/dist/v2/runtime/handlers/intelligence/memories.mjs

@@ -1,7 +1,7 @@
 import "reflect-metadata";
-import { isIntelligenceRuntime } from "../../core/runtime.mjs";
 import { errorResponse, isHandlerResponse } from "../shared/json-response.mjs";
 import { resolveIntelligenceUser } from "../shared/resolve-intelligence-user.mjs";
+import { isIntelligenceRuntime } from "../../core/runtime.mjs";
 import { grantAllowsMemory, resolveWebMemory } from "../shared/memory-policy.mjs";
 import { platformErrorResponse } from "../shared/platform-error.mjs";
 import { logger } from "@copilotkit/shared";

package/dist/v2/runtime/handlers/intelligence/run.cjs

@@ -1,12 +1,12 @@
 require("reflect-metadata");
 const require_runtime = require('../../../../_virtual/_rolldown/runtime.cjs');
-const require_telemetry_client = require('../../telemetry/telemetry-client.cjs');
-const require_runtime_error_reporter = require('../../core/runtime-error-reporter.cjs');
-const require_learning = require('../../core/learning.cjs');
-const require_thread_lock_heartbeat = require('../../intelligence-platform/thread-lock-heartbeat.cjs');
 const require_json_response = require('../shared/json-response.cjs');
+const require_learning = require('../../core/learning.cjs');
 const require_intelligence_utils = require('../shared/intelligence-utils.cjs');
 const require_resolve_intelligence_user = require('../shared/resolve-intelligence-user.cjs');
+const require_telemetry_client = require('../../telemetry/telemetry-client.cjs');
+const require_runtime_error_reporter = require('../../core/runtime-error-reporter.cjs');
+const require_thread_lock_heartbeat = require('../../intelligence-platform/thread-lock-heartbeat.cjs');
 const require_thread_names = require('./thread-names.cjs');
 let _copilotkit_shared = require("@copilotkit/shared");
 let _ag_ui_client = require("@ag-ui/client");

package/dist/v2/runtime/handlers/intelligence/run.mjs

@@ -1,11 +1,11 @@
 import "reflect-metadata";
-import telemetry from "../../telemetry/telemetry-client.mjs";
-import { getRuntimeErrorReporter } from "../../core/runtime-error-reporter.mjs";
-import { resolveLearningContainerId, resolveLearningContainerSelector } from "../../core/learning.mjs";
-import { startThreadLockHeartbeat } from "../../intelligence-platform/thread-lock-heartbeat.mjs";
 import { isHandlerResponse } from "../shared/json-response.mjs";
+import { resolveLearningContainerId, resolveLearningContainerSelector } from "../../core/learning.mjs";
 import { getPlatformErrorStatus } from "../shared/intelligence-utils.mjs";
 import { resolveIntelligenceUser } from "../shared/resolve-intelligence-user.mjs";
+import telemetry from "../../telemetry/telemetry-client.mjs";
+import { getRuntimeErrorReporter } from "../../core/runtime-error-reporter.mjs";
+import { startThreadLockHeartbeat } from "../../intelligence-platform/thread-lock-heartbeat.mjs";
 import { generateThreadNameForNewThread } from "./thread-names.mjs";
 import { logger } from "@copilotkit/shared";
 import { EventType } from "@ag-ui/client";

package/dist/v2/runtime/handlers/intelligence/threads.cjs

@@ -1,10 +1,11 @@
 require("reflect-metadata");
 const require_runtime = require('../../../../_virtual/_rolldown/runtime.cjs');
 const require_agent_runner = require('../../runner/agent-runner.cjs');
-const require_runtime$1 = require('../../core/runtime.cjs');
 const require_json_response = require('../shared/json-response.cjs');
 const require_intelligence_utils = require('../shared/intelligence-utils.cjs');
 const require_resolve_intelligence_user = require('../shared/resolve-intelligence-user.cjs');
+const require_thread_access = require('../shared/thread-access.cjs');
+const require_runtime$1 = require('../../core/runtime.cjs');
 const require_platform_error = require('../shared/platform-error.cjs');
 let _copilotkit_shared = require("@copilotkit/shared");
 
@@ -37,6 +38,42 @@ async function resolveThreadMutationContext(runtime, request) {
 		agentId
 	};
 }
+/**
+* The platform's `_inspect` events and state endpoints are scoped by the
+* project key only. Before calling them, confirm the thread is visible to the
+* resolved user through the user-scoped thread lookup, and return its
+* canonical id for the read, so the check and the read name the same thread.
+*
+* Returns the error Response instead when the lookup refuses: the platform's
+* 4xx for a thread the user cannot see (an expected denial, logged as a
+* warning), 502 for a malformed lookup result, and the mapped platform error
+* for anything else (logged as an error).
+*/
+async function requireUserThread(runtime, threadId, userId, failure) {
+	let thread;
+	try {
+		thread = await runtime.intelligence.getThread({
+			threadId,
+			userId
+		});
+	} catch (error) {
+		const status = require_intelligence_utils.getPlatformErrorStatus(error);
+		if (status !== void 0 && status >= 400 && status < 500 && status !== 401) _copilotkit_shared.logger.warn({
+			threadId,
+			status
+		}, "Thread not visible to the user");
+		else _copilotkit_shared.logger.error({
+			err: error,
+			threadId
+		}, "Error resolving thread");
+		return require_platform_error.platformErrorResponse(error, failure);
+	}
+	if (!thread || typeof thread.id !== "string" || !thread.id.trim()) {
+		_copilotkit_shared.logger.error({ threadId }, "Invalid thread response from getThread");
+		return require_json_response.errorResponse("Invalid thread response", 502);
+	}
+	return { threadId: thread.id };
+}
 async function handleListThreads({ runtime, request }) {
 	if (require_runtime$1.isIntelligenceRuntime(runtime)) try {
 		const url = new URL(request.url);
@@ -63,27 +100,54 @@ async function handleListThreads({ runtime, request }) {
 		return require_json_response.errorResponse("Failed to list threads", 500);
 	}
 	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) {
-		const agentId = new URL(request.url).searchParams.get("agentId");
-		let threads = runtime.runner.listThreads();
-		if (agentId) threads = threads.filter((t) => t.agentId === agentId);
-		return Response.json({
-			threads,
-			nextCursor: null
+		const ownerId = await require_thread_access.resolveLocalThreadOwner({
+			runtime,
+			request,
+			operation: "list"
 		});
+		if (require_json_response.isHandlerResponse(ownerId)) return ownerId;
+		try {
+			const agentId = new URL(request.url).searchParams.get("agentId");
+			let threads = runtime.runner.listThreads({ ownerId });
+			if (agentId) threads = threads.filter((t) => t.agentId === agentId);
+			return Response.json({
+				threads,
+				nextCursor: null
+			});
+		} catch (error) {
+			_copilotkit_shared.logger.error({ err: error }, "Error listing threads");
+			return require_json_response.errorResponse("Failed to list threads", 500);
+		}
 	}
 	return require_json_response.errorResponse("Missing CopilotKitIntelligence configuration. Thread operations require a CopilotKitIntelligence instance to be provided in CopilotRuntime options.", 422);
 }
 /**
-* Clears all in-memory thread history for the local-dev InMemory fallback.
+* Clears the caller's in-memory thread history for the local-dev fallback.
 *
 * The local-dev fallback exposes this so consumers (e.g. the demo's Clear
 * button) can wipe in-memory thread history without restarting the runtime.
+* Only the caller's own threads are cleared, and a thread whose run is
+* still active is kept. Without `identifyUser`, the access policy refuses it
+* unless `threads: { access: "open" }` is set.
 * Intentionally a no-op when CopilotKit Intelligence is configured: real
 * thread history lives in the database and must not be wiped by a
 * client-side page load.
 */
-function handleClearThreads({ runtime }) {
-	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) runtime.runner.clearThreads();
+async function handleClearThreads({ runtime, request }) {
+	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) {
+		const ownerId = await require_thread_access.resolveLocalThreadOwner({
+			runtime,
+			request,
+			operation: "clear"
+		});
+		if (require_json_response.isHandlerResponse(ownerId)) return ownerId;
+		try {
+			runtime.runner.clearThreads({ ownerId });
+		} catch (error) {
+			_copilotkit_shared.logger.error({ err: error }, "Error clearing threads");
+			return require_json_response.errorResponse("Failed to clear threads", 500);
+		}
+	}
 	return new Response(null, { status: 204 });
 }
 async function handleUpdateThread({ runtime, request, threadId }) {
@@ -191,7 +255,23 @@ async function handleGetThreadMessages({ runtime, request, threadId }) {
 		return require_platform_error.platformErrorResponse(error, "Failed to fetch thread messages");
 	}
 	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) {
-		const mapped = runtime.runner.getThreadMessages(threadId).map((msg) => {
+		const ownerId = await require_thread_access.resolveLocalThreadOwner({
+			runtime,
+			request,
+			operation: "read"
+		});
+		if (require_json_response.isHandlerResponse(ownerId)) return ownerId;
+		let messages;
+		try {
+			messages = runtime.runner.getThreadMessages(threadId, { ownerId });
+		} catch (error) {
+			_copilotkit_shared.logger.error({
+				err: error,
+				threadId
+			}, "Error fetching thread messages");
+			return require_json_response.errorResponse("Failed to fetch thread messages", 500);
+		}
+		const mapped = messages.map((msg) => {
 			switch (msg.role) {
 				case "assistant": {
 					const toolCalls = msg.toolCalls ?? [];
@@ -230,7 +310,12 @@ async function handleGetThreadEvents({ runtime, request, threadId }) {
 			request
 		});
 		if (require_json_response.isHandlerResponse(user)) return user;
-		const data = await runtime.intelligence.getThreadEvents({ threadId });
+		const thread = await requireUserThread(runtime, threadId, user.id, "Failed to fetch thread events");
+		if (require_json_response.isHandlerResponse(thread)) return thread;
+		const data = await runtime.intelligence.getThreadEvents({
+			threadId: thread.threadId,
+			userId: user.id
+		});
 		return Response.json({ events: data.events });
 	} catch (error) {
 		_copilotkit_shared.logger.error({
@@ -239,15 +324,23 @@ async function handleGetThreadEvents({ runtime, request, threadId }) {
 		}, "Error fetching thread events");
 		return require_platform_error.platformErrorResponse(error, "Failed to fetch thread events");
 	}
-	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) try {
-		const events = runtime.runner.getThreadEvents(threadId);
-		return Response.json({ events });
-	} catch (error) {
-		_copilotkit_shared.logger.error({
-			err: error,
-			threadId
-		}, "Error fetching thread events");
-		return require_json_response.errorResponse("Failed to fetch thread events", 500);
+	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) {
+		const ownerId = await require_thread_access.resolveLocalThreadOwner({
+			runtime,
+			request,
+			operation: "read"
+		});
+		if (require_json_response.isHandlerResponse(ownerId)) return ownerId;
+		try {
+			const events = runtime.runner.getThreadEvents(threadId, { ownerId });
+			return Response.json({ events });
+		} catch (error) {
+			_copilotkit_shared.logger.error({
+				err: error,
+				threadId
+			}, "Error fetching thread events");
+			return require_json_response.errorResponse("Failed to fetch thread events", 500);
+		}
 	}
 	return require_json_response.errorResponse("Missing CopilotKitIntelligence configuration. Thread operations require a CopilotKitIntelligence instance to be provided in CopilotRuntime options.", 422);
 }
@@ -258,7 +351,12 @@ async function handleGetThreadState({ runtime, request, threadId }) {
 			request
 		});
 		if (require_json_response.isHandlerResponse(user)) return user;
-		const data = await runtime.intelligence.getThreadState({ threadId });
+		const thread = await requireUserThread(runtime, threadId, user.id, "Failed to fetch thread state");
+		if (require_json_response.isHandlerResponse(thread)) return thread;
+		const data = await runtime.intelligence.getThreadState({
+			threadId: thread.threadId,
+			userId: user.id
+		});
 		const state = data.kind === "snapshot" ? data.state : null;
 		return Response.json({ state });
 	} catch (error) {
@@ -268,15 +366,23 @@ async function handleGetThreadState({ runtime, request, threadId }) {
 		}, "Error fetching thread state");
 		return require_platform_error.platformErrorResponse(error, "Failed to fetch thread state");
 	}
-	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) try {
-		const state = runtime.runner.getThreadState(threadId);
-		return Response.json({ state });
-	} catch (error) {
-		_copilotkit_shared.logger.error({
-			err: error,
-			threadId
-		}, "Error fetching thread state");
-		return require_json_response.errorResponse("Failed to fetch thread state", 500);
+	if (require_agent_runner.supportsLocalThreadEndpoints(runtime.runner)) {
+		const ownerId = await require_thread_access.resolveLocalThreadOwner({
+			runtime,
+			request,
+			operation: "read"
+		});
+		if (require_json_response.isHandlerResponse(ownerId)) return ownerId;
+		try {
+			const state = runtime.runner.getThreadState(threadId, { ownerId });
+			return Response.json({ state });
+		} catch (error) {
+			_copilotkit_shared.logger.error({
+				err: error,
+				threadId
+			}, "Error fetching thread state");
+			return require_json_response.errorResponse("Failed to fetch thread state", 500);
+		}
 	}
 	return require_json_response.errorResponse("Missing CopilotKitIntelligence configuration. Thread operations require a CopilotKitIntelligence instance to be provided in CopilotRuntime options.", 422);
 }