@copilotkit/runtime 1.82.0 → 1.83.0

package/dist/v2/runtime/handlers/shared/thread-access.mjs

@@ -0,0 +1,133 @@
+import "reflect-metadata";
+import { enforcesThreadOwnership, supportsLocalThreadEndpoints } from "../../runner/agent-runner.mjs";
+import { errorResponse } from "./json-response.mjs";
+import { hasIdentifyUser, resolveIntelligenceUser } from "./resolve-intelligence-user.mjs";
+
+//#region src/v2/runtime/handlers/shared/thread-access.ts
+/** The one place that sets the default Thread access mode. */
+const DEFAULT_THREAD_ACCESS = "owner";
+/** Owner id of a Thread created without identity. */
+const ANONYMOUS_THREAD_OWNER = "";
+/**
+* THE anonymous-Thread policy: which operations a caller without identity
+* (no `identifyUser`) may perform, per access mode. Every such operation
+* still reaches only anonymous Threads, never a Thread an identified user
+* owns. To tighten the default, change the `owner` row; nothing else encodes
+* this policy.
+*
+* Callers identified by `identifyUser` are not in this table: every operation
+* is allowed and reaches only their own Threads.
+*/
+const ANONYMOUS_THREAD_ACCESS = {
+	owner: {
+		list: false,
+		clear: false,
+		read: true,
+		connect: true,
+		run: true,
+		stop: true,
+		isRunning: true
+	},
+	open: {
+		list: true,
+		clear: true,
+		read: true,
+		connect: true,
+		run: true,
+		stop: true,
+		isRunning: true
+	}
+};
+const THREAD_ACCESS_NOT_CONFIGURED_MESSAGE = "Listing and clearing threads need a caller identity. Pass `identifyUser: (request) => ({ id, name })` to CopilotRuntime so each user lists and clears only their own threads, or pass `threads: { access: \"open\" }` to let every caller share threads created without identity (insecure for multi-user deployments).";
+/**
+* The configuration error for `identifyUser` with a runner that cannot keep
+* users apart. Every Thread operation is refused rather than served unscoped.
+*/
+function threadOwnershipUnsupportedMessage(runner) {
+	return `identifyUser is set, but the runner ${runner.constructor?.name || "the configured runner"} does not enforce thread ownership: it has no isThreadAccessible method. Thread routes, run, connect and stop are refused so that no user can reach another user's threads. Use InMemoryAgentRunner or SqliteAgentRunner, or implement isThreadAccessible and honor ownerId in run, connect, stop and isRunning.`;
+}
+/**
+* Log once, at runtime construction, when `identifyUser` is set but the runner
+* does not enforce thread ownership. Requests then fail with the same message.
+*/
+function warnIfThreadOwnershipUnenforced(runtime) {
+	if (hasIdentifyUser(runtime) && !enforcesThreadOwnership(runtime.runner)) console.warn(`[CopilotKit] ${threadOwnershipUnsupportedMessage(runtime.runner)}`);
+}
+/**
+* The access mode `threads` selects. Throws on anything but an object whose
+* `access` is `"owner"`, `"open"` or omitted: a typo must not silently fall
+* back to the default.
+*/
+function resolveThreadAccessMode(config) {
+	if (config === void 0) return DEFAULT_THREAD_ACCESS;
+	if (typeof config !== "object" || config === null) throw new Error("`threads` must be an object, such as `{ access: \"owner\" }`; got " + JSON.stringify(config));
+	const access = config.access;
+	if (access === void 0) return DEFAULT_THREAD_ACCESS;
+	if (access !== "owner" && access !== "open") throw new Error(`threads.access must be "owner" or "open"; got ${JSON.stringify(access)}`);
+	return access;
+}
+let threadListRefusalWarned = false;
+/**
+* Log once per process, at runtime construction, when the configuration
+* refuses the Thread list and clear routes, so operators see why those
+* requests get 403.
+*/
+function warnIfThreadListRefused(runtime) {
+	if (threadListRefusalWarned) return;
+	if (!supportsLocalThreadEndpoints(runtime.runner)) return;
+	if (isThreadOperationAvailable(runtime, "list")) return;
+	threadListRefusalWarned = true;
+	console.warn(`[CopilotKit] ${THREAD_ACCESS_NOT_CONFIGURED_MESSAGE} Until then, GET /threads and POST /threads/clear return HTTP 403.`);
+}
+/**
+* True when `operation` can serve requests on this runtime at all: always
+* with `identifyUser` (scoped to the caller), otherwise per
+* {@link ANONYMOUS_THREAD_ACCESS}.
+*/
+function isThreadOperationAvailable(runtime, operation) {
+	if (hasIdentifyUser(runtime)) return enforcesThreadOwnership(runtime.runner);
+	return ANONYMOUS_THREAD_ACCESS[runtime.threadAccess ?? DEFAULT_THREAD_ACCESS][operation];
+}
+/**
+* Resolves the owner id that a local Thread request acts as, or the error
+* Response that refuses it. Every local Thread handler goes through here.
+*
+* - With `identifyUser`: the identified user's id. Refused when the runner
+*   cannot enforce owners, or when identification fails.
+* - Without it: the anonymous owner, when {@link ANONYMOUS_THREAD_ACCESS}
+*   allows `operation` in the configured mode; otherwise a 403 that names the
+*   options to set.
+*/
+async function resolveLocalThreadOwner(params) {
+	const { runtime, request, operation } = params;
+	if (hasIdentifyUser(runtime)) {
+		if (!enforcesThreadOwnership(runtime.runner)) return Response.json({
+			error: "thread_ownership_unsupported",
+			message: threadOwnershipUnsupportedMessage(runtime.runner)
+		}, { status: 500 });
+		const user = await resolveIntelligenceUser({
+			runtime,
+			request
+		});
+		return user instanceof Response ? user : user.id;
+	}
+	if (!isThreadOperationAvailable(runtime, operation)) return Response.json({
+		error: "thread_access_not_configured",
+		message: THREAD_ACCESS_NOT_CONFIGURED_MESSAGE
+	}, { status: 403 });
+	return ANONYMOUS_THREAD_OWNER;
+}
+/**
+* The response to a run on a Thread that another identity owns, whether the
+* handler's check or the runner refused it. It is the same 404 and body as an
+* unknown Thread on the inspect routes, so it does not say that the Thread
+* belongs to someone. A run on an unknown Thread id creates the Thread, so a
+* refusal still shows that the id is taken; it never shows by whom.
+*/
+function threadAccessDeniedResponse() {
+	return errorResponse("Thread not found", 404);
+}
+
+//#endregion
+export { isThreadOperationAvailable, resolveLocalThreadOwner, resolveThreadAccessMode, threadAccessDeniedResponse, warnIfThreadListRefused, warnIfThreadOwnershipUnenforced };
+//# sourceMappingURL=thread-access.mjs.map

package/dist/v2/runtime/handlers/shared/thread-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"thread-access.mjs","names":[],"sources":["../../../../../src/v2/runtime/handlers/shared/thread-access.ts"],"sourcesContent":["import type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport type { AgentRunner } from \"../../runner/agent-runner\";\nimport {\n  enforcesThreadOwnership,\n  supportsLocalThreadEndpoints,\n} from \"../../runner/agent-runner\";\nimport { errorResponse } from \"./json-response\";\nimport {\n  hasIdentifyUser,\n  resolveIntelligenceUser,\n} from \"./resolve-intelligence-user\";\n\n/**\n * How local (non-Intelligence) Threads are shared among callers that\n * `identifyUser` does not identify. The full policy is\n * {@link ANONYMOUS_THREAD_ACCESS}.\n *\n * - `\"owner\"` (default): a Thread created without identity is a capability.\n *   Whoever holds its id may read, connect to, continue and stop it, but\n *   nobody may list or bulk-clear such Threads.\n * - `\"open\"`: every caller without identity shares those Threads, list and\n *   clear included, as in earlier releases. Insecure for any deployment that\n *   more than one person can reach.\n *\n * Neither mode loosens identity: with `identifyUser`, every operation reaches\n * only the caller's own Threads, and a Thread that an identified user created\n * is never reachable by an anonymous caller or another identity.\n */\nexport type ThreadAccessMode = \"owner\" | \"open\";\n\nexport interface ThreadsConfig {\n  /** @default \"owner\" */\n  access?: ThreadAccessMode;\n}\n\n/** The one place that sets the default Thread access mode. */\nexport const DEFAULT_THREAD_ACCESS: ThreadAccessMode = \"owner\";\n\n/** Owner id of a Thread created without identity. */\nexport const ANONYMOUS_THREAD_OWNER = \"\";\n\n/**\n * Every operation on a local Thread. `read` covers\n * `/threads/:id/{messages,events,state}`; `stop` covers a stop by Thread and a\n * stop by run id. `isRunning` has no route; runners check it the same way.\n */\nexport type ThreadOperation =\n  | \"list\"\n  | \"clear\"\n  | \"read\"\n  | \"connect\"\n  | \"run\"\n  | \"stop\"\n  | \"isRunning\";\n\n/**\n * THE anonymous-Thread policy: which operations a caller without identity\n * (no `identifyUser`) may perform, per access mode. Every such operation\n * still reaches only anonymous Threads, never a Thread an identified user\n * owns. To tighten the default, change the `owner` row; nothing else encodes\n * this policy.\n *\n * Callers identified by `identifyUser` are not in this table: every operation\n * is allowed and reaches only their own Threads.\n */\nexport const ANONYMOUS_THREAD_ACCESS: Readonly<\n  Record<ThreadAccessMode, Readonly<Record<ThreadOperation, boolean>>>\n> = {\n  // A Thread id works as a capability for the Thread it names. Enumerating or\n  // wiping every anonymous Thread needs identity or an explicit opt-in.\n  owner: {\n    list: false,\n    clear: false,\n    read: true,\n    connect: true,\n    run: true,\n    stop: true,\n    isRunning: true,\n  },\n  open: {\n    list: true,\n    clear: true,\n    read: true,\n    connect: true,\n    run: true,\n    stop: true,\n    isRunning: true,\n  },\n};\n\nexport const THREAD_ACCESS_NOT_CONFIGURED_MESSAGE =\n  \"Listing and clearing threads need a caller identity. Pass `identifyUser: (request) => ({ id, name })` \" +\n  \"to CopilotRuntime so each user lists and clears only their own threads, or pass \" +\n  '`threads: { access: \"open\" }` to let every caller share threads created without identity ' +\n  \"(insecure for multi-user deployments).\";\n\n/**\n * The configuration error for `identifyUser` with a runner that cannot keep\n * users apart. Every Thread operation is refused rather than served unscoped.\n */\nexport function threadOwnershipUnsupportedMessage(runner: AgentRunner): string {\n  const name = runner.constructor?.name || \"the configured runner\";\n  return (\n    `identifyUser is set, but the runner ${name} does not enforce thread ownership: ` +\n    \"it has no isThreadAccessible method. Thread routes, run, connect and stop are refused \" +\n    \"so that no user can reach another user's threads. Use InMemoryAgentRunner or \" +\n    \"SqliteAgentRunner, or implement isThreadAccessible and honor ownerId in run, connect, \" +\n    \"stop and isRunning.\"\n  );\n}\n\n/**\n * Log once, at runtime construction, when `identifyUser` is set but the runner\n * does not enforce thread ownership. Requests then fail with the same message.\n */\nexport function warnIfThreadOwnershipUnenforced(\n  runtime: CopilotRuntimeLike,\n): void {\n  if (hasIdentifyUser(runtime) && !enforcesThreadOwnership(runtime.runner)) {\n    console.warn(\n      `[CopilotKit] ${threadOwnershipUnsupportedMessage(runtime.runner)}`,\n    );\n  }\n}\n\n/**\n * The access mode `threads` selects. Throws on anything but an object whose\n * `access` is `\"owner\"`, `\"open\"` or omitted: a typo must not silently fall\n * back to the default.\n */\nexport function resolveThreadAccessMode(\n  config: ThreadsConfig | undefined,\n): ThreadAccessMode {\n  if (config === undefined) return DEFAULT_THREAD_ACCESS;\n  if (typeof config !== \"object\" || config === null) {\n    throw new Error(\n      '`threads` must be an object, such as `{ access: \"owner\" }`; got ' +\n        JSON.stringify(config),\n    );\n  }\n  const access: unknown = config.access;\n  if (access === undefined) return DEFAULT_THREAD_ACCESS;\n  if (access !== \"owner\" && access !== \"open\") {\n    throw new Error(\n      `threads.access must be \"owner\" or \"open\"; got ${JSON.stringify(access)}`,\n    );\n  }\n  return access;\n}\n\nlet threadListRefusalWarned = false;\n\n/** Re-arm the once-per-process startup warnings. Internal: for tests. */\nexport function ɵresetThreadAccessWarnings(): void {\n  threadListRefusalWarned = false;\n}\n\n/**\n * Log once per process, at runtime construction, when the configuration\n * refuses the Thread list and clear routes, so operators see why those\n * requests get 403.\n */\nexport function warnIfThreadListRefused(runtime: CopilotRuntimeLike): void {\n  if (threadListRefusalWarned) return;\n  if (!supportsLocalThreadEndpoints(runtime.runner)) return;\n  if (isThreadOperationAvailable(runtime, \"list\")) return;\n  threadListRefusalWarned = true;\n  console.warn(\n    `[CopilotKit] ${THREAD_ACCESS_NOT_CONFIGURED_MESSAGE} Until then, ` +\n      \"GET /threads and POST /threads/clear return HTTP 403.\",\n  );\n}\n\n/**\n * True when `operation` can serve requests on this runtime at all: always\n * with `identifyUser` (scoped to the caller), otherwise per\n * {@link ANONYMOUS_THREAD_ACCESS}.\n */\nexport function isThreadOperationAvailable(\n  runtime: CopilotRuntimeLike,\n  operation: ThreadOperation,\n): boolean {\n  // The same identity test as resolveLocalThreadOwner, so a non-function\n  // value is no identity everywhere and never opens list or clear.\n  if (hasIdentifyUser(runtime)) {\n    return enforcesThreadOwnership(runtime.runner);\n  }\n  return ANONYMOUS_THREAD_ACCESS[runtime.threadAccess ?? DEFAULT_THREAD_ACCESS][\n    operation\n  ];\n}\n\n/**\n * Resolves the owner id that a local Thread request acts as, or the error\n * Response that refuses it. Every local Thread handler goes through here.\n *\n * - With `identifyUser`: the identified user's id. Refused when the runner\n *   cannot enforce owners, or when identification fails.\n * - Without it: the anonymous owner, when {@link ANONYMOUS_THREAD_ACCESS}\n *   allows `operation` in the configured mode; otherwise a 403 that names the\n *   options to set.\n */\nexport async function resolveLocalThreadOwner(params: {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  operation: ThreadOperation;\n}): Promise<string | Response> {\n  const { runtime, request, operation } = params;\n  if (hasIdentifyUser(runtime)) {\n    // Never serve an identified request through a runner that cannot keep\n    // users apart: refuse it with the configuration error instead.\n    if (!enforcesThreadOwnership(runtime.runner)) {\n      return Response.json(\n        {\n          error: \"thread_ownership_unsupported\",\n          message: threadOwnershipUnsupportedMessage(runtime.runner),\n        },\n        { status: 500 },\n      );\n    }\n    const user = await resolveIntelligenceUser({ runtime, request });\n    return user instanceof Response ? user : user.id;\n  }\n  if (!isThreadOperationAvailable(runtime, operation)) {\n    return Response.json(\n      {\n        error: \"thread_access_not_configured\",\n        message: THREAD_ACCESS_NOT_CONFIGURED_MESSAGE,\n      },\n      { status: 403 },\n    );\n  }\n  return ANONYMOUS_THREAD_OWNER;\n}\n\n/**\n * The response to a run on a Thread that another identity owns, whether the\n * handler's check or the runner refused it. It is the same 404 and body as an\n * unknown Thread on the inspect routes, so it does not say that the Thread\n * belongs to someone. A run on an unknown Thread id creates the Thread, so a\n * refusal still shows that the id is taken; it never shows by whom.\n */\nexport function threadAccessDeniedResponse(): Response {\n  return errorResponse(\"Thread not found\", 404);\n}\n"],"mappings":";;;;;;;AAoCA,MAAa,wBAA0C;;AAGvD,MAAa,yBAAyB;;;;;;;;;;;AA0BtC,MAAa,0BAET;CAGF,OAAO;EACL,MAAM;EACN,OAAO;EACP,MAAM;EACN,SAAS;EACT,KAAK;EACL,MAAM;EACN,WAAW;EACZ;CACD,MAAM;EACJ,MAAM;EACN,OAAO;EACP,MAAM;EACN,SAAS;EACT,KAAK;EACL,MAAM;EACN,WAAW;EACZ;CACF;AAED,MAAa,uCACX;;;;;AASF,SAAgB,kCAAkC,QAA6B;AAE7E,QACE,uCAFW,OAAO,aAAa,QAAQ,wBAEK;;;;;;AAYhD,SAAgB,gCACd,SACM;AACN,KAAI,gBAAgB,QAAQ,IAAI,CAAC,wBAAwB,QAAQ,OAAO,CACtE,SAAQ,KACN,gBAAgB,kCAAkC,QAAQ,OAAO,GAClE;;;;;;;AASL,SAAgB,wBACd,QACkB;AAClB,KAAI,WAAW,OAAW,QAAO;AACjC,KAAI,OAAO,WAAW,YAAY,WAAW,KAC3C,OAAM,IAAI,MACR,uEACE,KAAK,UAAU,OAAO,CACzB;CAEH,MAAM,SAAkB,OAAO;AAC/B,KAAI,WAAW,OAAW,QAAO;AACjC,KAAI,WAAW,WAAW,WAAW,OACnC,OAAM,IAAI,MACR,iDAAiD,KAAK,UAAU,OAAO,GACxE;AAEH,QAAO;;AAGT,IAAI,0BAA0B;;;;;;AAY9B,SAAgB,wBAAwB,SAAmC;AACzE,KAAI,wBAAyB;AAC7B,KAAI,CAAC,6BAA6B,QAAQ,OAAO,CAAE;AACnD,KAAI,2BAA2B,SAAS,OAAO,CAAE;AACjD,2BAA0B;AAC1B,SAAQ,KACN,gBAAgB,qCAAqC,oEAEtD;;;;;;;AAQH,SAAgB,2BACd,SACA,WACS;AAGT,KAAI,gBAAgB,QAAQ,CAC1B,QAAO,wBAAwB,QAAQ,OAAO;AAEhD,QAAO,wBAAwB,QAAQ,gBAAgB,uBACrD;;;;;;;;;;;;AAcJ,eAAsB,wBAAwB,QAIf;CAC7B,MAAM,EAAE,SAAS,SAAS,cAAc;AACxC,KAAI,gBAAgB,QAAQ,EAAE;AAG5B,MAAI,CAAC,wBAAwB,QAAQ,OAAO,CAC1C,QAAO,SAAS,KACd;GACE,OAAO;GACP,SAAS,kCAAkC,QAAQ,OAAO;GAC3D,EACD,EAAE,QAAQ,KAAK,CAChB;EAEH,MAAM,OAAO,MAAM,wBAAwB;GAAE;GAAS;GAAS,CAAC;AAChE,SAAO,gBAAgB,WAAW,OAAO,KAAK;;AAEhD,KAAI,CAAC,2BAA2B,SAAS,UAAU,CACjD,QAAO,SAAS,KACd;EACE,OAAO;EACP,SAAS;EACV,EACD,EAAE,QAAQ,KAAK,CAChB;AAEH,QAAO;;;;;;;;;AAUT,SAAgB,6BAAuC;AACrD,QAAO,cAAc,oBAAoB,IAAI"}

package/dist/v2/runtime/handlers/sse/connect.cjs

@@ -3,7 +3,7 @@ const require_header_utils = require('../header-utils.cjs');
 const require_sse_response = require('../shared/sse-response.cjs');
 
 //#region src/v2/runtime/handlers/sse/connect.ts
-function handleSseConnect({ runtime, request, agentId, threadId, agent }) {
+function handleSseConnect({ runtime, request, agentId, threadId, agent, ownerId }) {
 	return require_sse_response.createSseEventResponse({
 		request,
 		debugEventBus: runtime.debugEventBus,
@@ -13,6 +13,7 @@ function handleSseConnect({ runtime, request, agentId, threadId, agent }) {
 		observableFactory: () => runtime.runner.connect({
 			threadId,
 			agentId,
+			...ownerId === void 0 ? {} : { ownerId },
 			headers: require_header_utils.mergeForwardableHeaders(agent?.headers, request, runtime.forwardHeadersPolicy ?? require_header_utils.resolveForwardHeadersPolicy(void 0))
 		})
 	});

package/dist/v2/runtime/handlers/sse/connect.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"connect.cjs","names":["createSseEventResponse","mergeForwardableHeaders","resolveForwardHeadersPolicy"],"sources":["../../../../../src/v2/runtime/handlers/sse/connect.ts"],"sourcesContent":["import type { AbstractAgent } from \"@ag-ui/client\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\nimport {\n  mergeForwardableHeaders,\n  resolveForwardHeadersPolicy,\n} from \"../header-utils\";\n\n/**\n * `headers` lives on the HTTP-backed agent configs (e.g. `HttpAgent`), not on\n * the base `AbstractAgent`. Mirror the runtime's own optional-headers shape so\n * we can read server-configured headers off the per-request clone without a\n * cast. See `agent-utils.ts`.\n */\ntype AgentWithHeaders = AbstractAgent & {\n  headers?: Record<string, string>;\n};\n\ninterface HandleSseConnectParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agentId: string;\n  threadId: string;\n  /**\n   * The per-request agent clone, carrying any server-configured `agent.headers`\n   * (e.g. service-to-service auth). Used only to compute the merged header set\n   * threaded into `runner.connect` below — see the note there for why that\n   * merge is forward-looking plumbing rather than active outbound auth today.\n   */\n  agent?: AgentWithHeaders;\n}\n\nexport function handleSseConnect({\n  runtime,\n  request,\n  agentId,\n  threadId,\n  agent,\n}: HandleSseConnectParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    // Forward the real agentId so debug envelopes reflect the agent the\n    // route resolved to — not the literal string \"connect\".\n    agentId,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    observableFactory: () =>\n      runtime.runner.connect({\n        threadId,\n        agentId,\n        // Forward-looking plumbing: we compute the merged header set (server\n        // `agent.headers` win on collision, case-insensitively; non-colliding\n        // inbound headers still forward — see `mergeForwardableHeaders`, #5712)\n        // and thread it into `runner.connect`. NO shipped runner consumes the\n        // `headers` field of `AgentRunnerConnectRequest` today — every runner\n        // (in-memory, intelligence, telemetry, sqlite) reads only `threadId`.\n        // The real outbound header forwarding is the /run path, where\n        // `cloneAgentForRequest` mutates `agent.headers` directly\n        // (agent-utils.ts). This wiring exists so a future outbound-connecting\n        // runner can pick the merged headers up without a route change; the\n        // collision precedence noted here is purely about that merge, not about\n        // middleware/mutation parity with /run.\n        headers: mergeForwardableHeaders(\n          agent?.headers,\n          request,\n          // Optional on `CopilotRuntimeLike` (non-breaking minor release);\n          // coalesce a policy-less external implementor to the default resolved\n          // policy (default-on denylist) instead of dereffing undefined.\n          runtime.forwardHeadersPolicy ??\n            resolveForwardHeadersPolicy(undefined),\n        ),\n      }),\n  });\n}\n"],"mappings":";;;;;AAgCA,SAAgB,iBAAiB,EAC/B,SACA,SACA,SACA,UACA,SACmC;AACnC,QAAOA,4CAAuB;EAC5B;EACA,eAAe,QAAQ;EAGvB;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAClC,yBACE,QAAQ,OAAO,QAAQ;GACrB;GACA;GAaA,SAASC,6CACP,OAAO,SACP,SAIA,QAAQ,wBACNC,iDAA4B,OAAU,CACzC;GACF,CAAC;EACL,CAAC"}
+{"version":3,"file":"connect.cjs","names":["createSseEventResponse","mergeForwardableHeaders","resolveForwardHeadersPolicy"],"sources":["../../../../../src/v2/runtime/handlers/sse/connect.ts"],"sourcesContent":["import type { AbstractAgent } from \"@ag-ui/client\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\nimport {\n  mergeForwardableHeaders,\n  resolveForwardHeadersPolicy,\n} from \"../header-utils\";\n\n/**\n * `headers` lives on the HTTP-backed agent configs (e.g. `HttpAgent`), not on\n * the base `AbstractAgent`. Mirror the runtime's own optional-headers shape so\n * we can read server-configured headers off the per-request clone without a\n * cast. See `agent-utils.ts`.\n */\ntype AgentWithHeaders = AbstractAgent & {\n  headers?: Record<string, string>;\n};\n\ninterface HandleSseConnectParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agentId: string;\n  threadId: string;\n  /**\n   * The per-request agent clone, carrying any server-configured `agent.headers`\n   * (e.g. service-to-service auth). Used only to compute the merged header set\n   * threaded into `runner.connect` below — see the note there for why that\n   * merge is forward-looking plumbing rather than active outbound auth today.\n   */\n  agent?: AgentWithHeaders;\n  /** Caller identity; the runner hides threads owned by anyone else. */\n  ownerId?: string;\n}\n\nexport function handleSseConnect({\n  runtime,\n  request,\n  agentId,\n  threadId,\n  agent,\n  ownerId,\n}: HandleSseConnectParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    // Forward the real agentId so debug envelopes reflect the agent the\n    // route resolved to — not the literal string \"connect\".\n    agentId,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    observableFactory: () =>\n      runtime.runner.connect({\n        threadId,\n        agentId,\n        ...(ownerId === undefined ? {} : { ownerId }),\n        // Forward-looking plumbing: we compute the merged header set (server\n        // `agent.headers` win on collision, case-insensitively; non-colliding\n        // inbound headers still forward — see `mergeForwardableHeaders`, #5712)\n        // and thread it into `runner.connect`. NO shipped runner consumes the\n        // `headers` field of `AgentRunnerConnectRequest` today — every runner\n        // (in-memory, intelligence, telemetry, sqlite) ignores it.\n        // The real outbound header forwarding is the /run path, where\n        // `cloneAgentForRequest` mutates `agent.headers` directly\n        // (agent-utils.ts). This wiring exists so a future outbound-connecting\n        // runner can pick the merged headers up without a route change; the\n        // collision precedence noted here is purely about that merge, not about\n        // middleware/mutation parity with /run.\n        headers: mergeForwardableHeaders(\n          agent?.headers,\n          request,\n          // Optional on `CopilotRuntimeLike` (non-breaking minor release);\n          // coalesce a policy-less external implementor to the default resolved\n          // policy (default-on denylist) instead of dereffing undefined.\n          runtime.forwardHeadersPolicy ??\n            resolveForwardHeadersPolicy(undefined),\n        ),\n      }),\n  });\n}\n"],"mappings":";;;;;AAkCA,SAAgB,iBAAiB,EAC/B,SACA,SACA,SACA,UACA,OACA,WACmC;AACnC,QAAOA,4CAAuB;EAC5B;EACA,eAAe,QAAQ;EAGvB;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAClC,yBACE,QAAQ,OAAO,QAAQ;GACrB;GACA;GACA,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAa5C,SAASC,6CACP,OAAO,SACP,SAIA,QAAQ,wBACNC,iDAA4B,OAAU,CACzC;GACF,CAAC;EACL,CAAC"}

package/dist/v2/runtime/handlers/sse/connect.mjs

@@ -3,7 +3,7 @@ import { mergeForwardableHeaders, resolveForwardHeadersPolicy } from "../header-
 import { createSseEventResponse } from "../shared/sse-response.mjs";
 
 //#region src/v2/runtime/handlers/sse/connect.ts
-function handleSseConnect({ runtime, request, agentId, threadId, agent }) {
+function handleSseConnect({ runtime, request, agentId, threadId, agent, ownerId }) {
 	return createSseEventResponse({
 		request,
 		debugEventBus: runtime.debugEventBus,
@@ -13,6 +13,7 @@ function handleSseConnect({ runtime, request, agentId, threadId, agent }) {
 		observableFactory: () => runtime.runner.connect({
 			threadId,
 			agentId,
+			...ownerId === void 0 ? {} : { ownerId },
 			headers: mergeForwardableHeaders(agent?.headers, request, runtime.forwardHeadersPolicy ?? resolveForwardHeadersPolicy(void 0))
 		})
 	});

package/dist/v2/runtime/handlers/sse/connect.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"connect.mjs","names":[],"sources":["../../../../../src/v2/runtime/handlers/sse/connect.ts"],"sourcesContent":["import type { AbstractAgent } from \"@ag-ui/client\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\nimport {\n  mergeForwardableHeaders,\n  resolveForwardHeadersPolicy,\n} from \"../header-utils\";\n\n/**\n * `headers` lives on the HTTP-backed agent configs (e.g. `HttpAgent`), not on\n * the base `AbstractAgent`. Mirror the runtime's own optional-headers shape so\n * we can read server-configured headers off the per-request clone without a\n * cast. See `agent-utils.ts`.\n */\ntype AgentWithHeaders = AbstractAgent & {\n  headers?: Record<string, string>;\n};\n\ninterface HandleSseConnectParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agentId: string;\n  threadId: string;\n  /**\n   * The per-request agent clone, carrying any server-configured `agent.headers`\n   * (e.g. service-to-service auth). Used only to compute the merged header set\n   * threaded into `runner.connect` below — see the note there for why that\n   * merge is forward-looking plumbing rather than active outbound auth today.\n   */\n  agent?: AgentWithHeaders;\n}\n\nexport function handleSseConnect({\n  runtime,\n  request,\n  agentId,\n  threadId,\n  agent,\n}: HandleSseConnectParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    // Forward the real agentId so debug envelopes reflect the agent the\n    // route resolved to — not the literal string \"connect\".\n    agentId,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    observableFactory: () =>\n      runtime.runner.connect({\n        threadId,\n        agentId,\n        // Forward-looking plumbing: we compute the merged header set (server\n        // `agent.headers` win on collision, case-insensitively; non-colliding\n        // inbound headers still forward — see `mergeForwardableHeaders`, #5712)\n        // and thread it into `runner.connect`. NO shipped runner consumes the\n        // `headers` field of `AgentRunnerConnectRequest` today — every runner\n        // (in-memory, intelligence, telemetry, sqlite) reads only `threadId`.\n        // The real outbound header forwarding is the /run path, where\n        // `cloneAgentForRequest` mutates `agent.headers` directly\n        // (agent-utils.ts). This wiring exists so a future outbound-connecting\n        // runner can pick the merged headers up without a route change; the\n        // collision precedence noted here is purely about that merge, not about\n        // middleware/mutation parity with /run.\n        headers: mergeForwardableHeaders(\n          agent?.headers,\n          request,\n          // Optional on `CopilotRuntimeLike` (non-breaking minor release);\n          // coalesce a policy-less external implementor to the default resolved\n          // policy (default-on denylist) instead of dereffing undefined.\n          runtime.forwardHeadersPolicy ??\n            resolveForwardHeadersPolicy(undefined),\n        ),\n      }),\n  });\n}\n"],"mappings":";;;;;AAgCA,SAAgB,iBAAiB,EAC/B,SACA,SACA,SACA,UACA,SACmC;AACnC,QAAO,uBAAuB;EAC5B;EACA,eAAe,QAAQ;EAGvB;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAClC,yBACE,QAAQ,OAAO,QAAQ;GACrB;GACA;GAaA,SAAS,wBACP,OAAO,SACP,SAIA,QAAQ,wBACN,4BAA4B,OAAU,CACzC;GACF,CAAC;EACL,CAAC"}
+{"version":3,"file":"connect.mjs","names":[],"sources":["../../../../../src/v2/runtime/handlers/sse/connect.ts"],"sourcesContent":["import type { AbstractAgent } from \"@ag-ui/client\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\nimport {\n  mergeForwardableHeaders,\n  resolveForwardHeadersPolicy,\n} from \"../header-utils\";\n\n/**\n * `headers` lives on the HTTP-backed agent configs (e.g. `HttpAgent`), not on\n * the base `AbstractAgent`. Mirror the runtime's own optional-headers shape so\n * we can read server-configured headers off the per-request clone without a\n * cast. See `agent-utils.ts`.\n */\ntype AgentWithHeaders = AbstractAgent & {\n  headers?: Record<string, string>;\n};\n\ninterface HandleSseConnectParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agentId: string;\n  threadId: string;\n  /**\n   * The per-request agent clone, carrying any server-configured `agent.headers`\n   * (e.g. service-to-service auth). Used only to compute the merged header set\n   * threaded into `runner.connect` below — see the note there for why that\n   * merge is forward-looking plumbing rather than active outbound auth today.\n   */\n  agent?: AgentWithHeaders;\n  /** Caller identity; the runner hides threads owned by anyone else. */\n  ownerId?: string;\n}\n\nexport function handleSseConnect({\n  runtime,\n  request,\n  agentId,\n  threadId,\n  agent,\n  ownerId,\n}: HandleSseConnectParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    // Forward the real agentId so debug envelopes reflect the agent the\n    // route resolved to — not the literal string \"connect\".\n    agentId,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    observableFactory: () =>\n      runtime.runner.connect({\n        threadId,\n        agentId,\n        ...(ownerId === undefined ? {} : { ownerId }),\n        // Forward-looking plumbing: we compute the merged header set (server\n        // `agent.headers` win on collision, case-insensitively; non-colliding\n        // inbound headers still forward — see `mergeForwardableHeaders`, #5712)\n        // and thread it into `runner.connect`. NO shipped runner consumes the\n        // `headers` field of `AgentRunnerConnectRequest` today — every runner\n        // (in-memory, intelligence, telemetry, sqlite) ignores it.\n        // The real outbound header forwarding is the /run path, where\n        // `cloneAgentForRequest` mutates `agent.headers` directly\n        // (agent-utils.ts). This wiring exists so a future outbound-connecting\n        // runner can pick the merged headers up without a route change; the\n        // collision precedence noted here is purely about that merge, not about\n        // middleware/mutation parity with /run.\n        headers: mergeForwardableHeaders(\n          agent?.headers,\n          request,\n          // Optional on `CopilotRuntimeLike` (non-breaking minor release);\n          // coalesce a policy-less external implementor to the default resolved\n          // policy (default-on denylist) instead of dereffing undefined.\n          runtime.forwardHeadersPolicy ??\n            resolveForwardHeadersPolicy(undefined),\n        ),\n      }),\n  });\n}\n"],"mappings":";;;;;AAkCA,SAAgB,iBAAiB,EAC/B,SACA,SACA,SACA,UACA,OACA,WACmC;AACnC,QAAO,uBAAuB;EAC5B;EACA,eAAe,QAAQ;EAGvB;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAClC,yBACE,QAAQ,OAAO,QAAQ;GACrB;GACA;GACA,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAa5C,SAAS,wBACP,OAAO,SACP,SAIA,QAAQ,wBACN,4BAA4B,OAAU,CACzC;GACF,CAAC;EACL,CAAC"}

package/dist/v2/runtime/handlers/sse/run.cjs

@@ -1,9 +1,27 @@
 require("reflect-metadata");
+const require_agent_runner = require('../../runner/agent-runner.cjs');
+const require_thread_access = require('../shared/thread-access.cjs');
 const require_runtime_error_reporter = require('../../core/runtime-error-reporter.cjs');
 const require_sse_response = require('../shared/sse-response.cjs');
 
 //#region src/v2/runtime/handlers/sse/run.ts
-function handleSseRun({ runtime, request, agent, input, agentId, debug, logger, startTime }) {
+function handleSseRun({ runtime, request, agent, input, agentId, debug, logger, startTime, ownerId }) {
+	let started;
+	let startError;
+	try {
+		started = runtime.runner.run({
+			threadId: input.threadId,
+			agent,
+			input,
+			...ownerId === void 0 ? {} : { ownerId }
+		});
+	} catch (error) {
+		if (require_agent_runner.isThreadAccessDeniedError(error)) {
+			console.warn("[CopilotKit] Run refused: the thread belongs to another identity.");
+			return require_thread_access.threadAccessDeniedResponse();
+		}
+		startError = error;
+	}
 	return require_sse_response.createSseEventResponse({
 		request,
 		debugEventBus: runtime.debugEventBus,
@@ -15,11 +33,10 @@ function handleSseRun({ runtime, request, agent, input, agentId, debug, logger,
 		telemetry: runtime.telemetry,
 		keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,
 		executionSeed: { llmHostClass: agent.modelHostClass ?? "unknown" },
-		observableFactory: () => runtime.runner.run({
-			threadId: input.threadId,
-			agent,
-			input
-		})
+		observableFactory: () => {
+			if (started === void 0) throw startError;
+			return started;
+		}
 	});
 }
 

package/dist/v2/runtime/handlers/sse/run.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"run.cjs","names":["createSseEventResponse","getRuntimeErrorReporter"],"sources":["../../../../../src/v2/runtime/handlers/sse/run.ts"],"sourcesContent":["import type { AbstractAgent, RunAgentInput } from \"@ag-ui/client\";\nimport type { ResolvedDebugConfig, ModelHostClass } from \"@copilotkit/shared\";\nimport type { CopilotRuntimeLogger } from \"../../../../v1-deprecated/lib/logger\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { getRuntimeErrorReporter } from \"../../core/runtime-error-reporter\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\n\ninterface HandleSseRunParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agent: AbstractAgent;\n  input: RunAgentInput;\n  agentId: string;\n  debug?: ResolvedDebugConfig;\n  /** Pre-created logger instance to avoid creating a new pino logger per request. */\n  logger?: CopilotRuntimeLogger;\n  startTime?: number;\n}\n\nexport function handleSseRun({\n  runtime,\n  request,\n  agent,\n  input,\n  agentId,\n  debug,\n  logger,\n  startTime,\n}: HandleSseRunParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    agentId,\n    debug,\n    logger,\n    runtimeErrorReporter: getRuntimeErrorReporter(runtime),\n    startTime,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    // Read structurally rather than via `instanceof BuiltInAgent`, which would\n    // pull the agent module into this handler. Any agent can opt in by\n    // exposing the same property.\n    executionSeed: {\n      llmHostClass:\n        (agent as { modelHostClass?: ModelHostClass }).modelHostClass ??\n        \"unknown\",\n    },\n    observableFactory: () =>\n      runtime.runner.run({\n        threadId: input.threadId,\n        agent,\n        input,\n      }),\n  });\n}\n"],"mappings":";;;;;AAmBA,SAAgB,aAAa,EAC3B,SACA,SACA,OACA,OACA,SACA,OACA,QACA,aAC+B;AAC/B,QAAOA,4CAAuB;EAC5B;EACA,eAAe,QAAQ;EACvB;EACA;EACA;EACA,sBAAsBC,uDAAwB,QAAQ;EACtD;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAIlC,eAAe,EACb,cACG,MAA8C,kBAC/C,WACH;EACD,yBACE,QAAQ,OAAO,IAAI;GACjB,UAAU,MAAM;GAChB;GACA;GACD,CAAC;EACL,CAAC"}
+{"version":3,"file":"run.cjs","names":["isThreadAccessDeniedError","threadAccessDeniedResponse","createSseEventResponse","getRuntimeErrorReporter"],"sources":["../../../../../src/v2/runtime/handlers/sse/run.ts"],"sourcesContent":["import type { AbstractAgent, BaseEvent, RunAgentInput } from \"@ag-ui/client\";\nimport type { Observable } from \"rxjs\";\nimport { isThreadAccessDeniedError } from \"../../runner/agent-runner\";\nimport { threadAccessDeniedResponse } from \"../shared/thread-access\";\nimport type { ResolvedDebugConfig, ModelHostClass } from \"@copilotkit/shared\";\nimport type { CopilotRuntimeLogger } from \"../../../../v1-deprecated/lib/logger\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { getRuntimeErrorReporter } from \"../../core/runtime-error-reporter\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\n\ninterface HandleSseRunParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agent: AbstractAgent;\n  input: RunAgentInput;\n  agentId: string;\n  debug?: ResolvedDebugConfig;\n  /** Pre-created logger instance to avoid creating a new pino logger per request. */\n  logger?: CopilotRuntimeLogger;\n  startTime?: number;\n  /** Identity the run acts as; the runner records it as the thread owner. */\n  ownerId?: string;\n}\n\nexport function handleSseRun({\n  runtime,\n  request,\n  agent,\n  input,\n  agentId,\n  debug,\n  logger,\n  startTime,\n  ownerId,\n}: HandleSseRunParams): Response {\n  // Start the run before the stream opens. When another identity claimed the\n  // thread after the handler's owner check, the runner refuses at once, and\n  // that refusal becomes the same HTTP error as the check's, not a streamed\n  // agent failure. Any other start error still reaches the client as a\n  // RUN_ERROR on the stream, as before.\n  let started: Observable<BaseEvent> | undefined;\n  let startError: unknown;\n  try {\n    started = runtime.runner.run({\n      threadId: input.threadId,\n      agent,\n      input,\n      ...(ownerId === undefined ? {} : { ownerId }),\n    });\n  } catch (error) {\n    if (isThreadAccessDeniedError(error)) {\n      console.warn(\n        \"[CopilotKit] Run refused: the thread belongs to another identity.\",\n      );\n      return threadAccessDeniedResponse();\n    }\n    startError = error;\n  }\n\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    agentId,\n    debug,\n    logger,\n    runtimeErrorReporter: getRuntimeErrorReporter(runtime),\n    startTime,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    // Read structurally rather than via `instanceof BuiltInAgent`, which would\n    // pull the agent module into this handler. Any agent can opt in by\n    // exposing the same property.\n    executionSeed: {\n      llmHostClass:\n        (agent as { modelHostClass?: ModelHostClass }).modelHostClass ??\n        \"unknown\",\n    },\n    observableFactory: () => {\n      if (started === undefined) throw startError;\n      return started;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAwBA,SAAgB,aAAa,EAC3B,SACA,SACA,OACA,OACA,SACA,OACA,QACA,WACA,WAC+B;CAM/B,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,YAAU,QAAQ,OAAO,IAAI;GAC3B,UAAU,MAAM;GAChB;GACA;GACA,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAC7C,CAAC;UACK,OAAO;AACd,MAAIA,+CAA0B,MAAM,EAAE;AACpC,WAAQ,KACN,oEACD;AACD,UAAOC,kDAA4B;;AAErC,eAAa;;AAGf,QAAOC,4CAAuB;EAC5B;EACA,eAAe,QAAQ;EACvB;EACA;EACA;EACA,sBAAsBC,uDAAwB,QAAQ;EACtD;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAIlC,eAAe,EACb,cACG,MAA8C,kBAC/C,WACH;EACD,yBAAyB;AACvB,OAAI,YAAY,OAAW,OAAM;AACjC,UAAO;;EAEV,CAAC"}

package/dist/v2/runtime/handlers/sse/run.mjs

@@ -1,9 +1,27 @@
 import "reflect-metadata";
+import { isThreadAccessDeniedError } from "../../runner/agent-runner.mjs";
+import { threadAccessDeniedResponse } from "../shared/thread-access.mjs";
 import { getRuntimeErrorReporter } from "../../core/runtime-error-reporter.mjs";
 import { createSseEventResponse } from "../shared/sse-response.mjs";
 
 //#region src/v2/runtime/handlers/sse/run.ts
-function handleSseRun({ runtime, request, agent, input, agentId, debug, logger, startTime }) {
+function handleSseRun({ runtime, request, agent, input, agentId, debug, logger, startTime, ownerId }) {
+	let started;
+	let startError;
+	try {
+		started = runtime.runner.run({
+			threadId: input.threadId,
+			agent,
+			input,
+			...ownerId === void 0 ? {} : { ownerId }
+		});
+	} catch (error) {
+		if (isThreadAccessDeniedError(error)) {
+			console.warn("[CopilotKit] Run refused: the thread belongs to another identity.");
+			return threadAccessDeniedResponse();
+		}
+		startError = error;
+	}
 	return createSseEventResponse({
 		request,
 		debugEventBus: runtime.debugEventBus,
@@ -15,11 +33,10 @@ function handleSseRun({ runtime, request, agent, input, agentId, debug, logger,
 		telemetry: runtime.telemetry,
 		keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,
 		executionSeed: { llmHostClass: agent.modelHostClass ?? "unknown" },
-		observableFactory: () => runtime.runner.run({
-			threadId: input.threadId,
-			agent,
-			input
-		})
+		observableFactory: () => {
+			if (started === void 0) throw startError;
+			return started;
+		}
 	});
 }
 

package/dist/v2/runtime/handlers/sse/run.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"run.mjs","names":[],"sources":["../../../../../src/v2/runtime/handlers/sse/run.ts"],"sourcesContent":["import type { AbstractAgent, RunAgentInput } from \"@ag-ui/client\";\nimport type { ResolvedDebugConfig, ModelHostClass } from \"@copilotkit/shared\";\nimport type { CopilotRuntimeLogger } from \"../../../../v1-deprecated/lib/logger\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { getRuntimeErrorReporter } from \"../../core/runtime-error-reporter\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\n\ninterface HandleSseRunParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agent: AbstractAgent;\n  input: RunAgentInput;\n  agentId: string;\n  debug?: ResolvedDebugConfig;\n  /** Pre-created logger instance to avoid creating a new pino logger per request. */\n  logger?: CopilotRuntimeLogger;\n  startTime?: number;\n}\n\nexport function handleSseRun({\n  runtime,\n  request,\n  agent,\n  input,\n  agentId,\n  debug,\n  logger,\n  startTime,\n}: HandleSseRunParams): Response {\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    agentId,\n    debug,\n    logger,\n    runtimeErrorReporter: getRuntimeErrorReporter(runtime),\n    startTime,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    // Read structurally rather than via `instanceof BuiltInAgent`, which would\n    // pull the agent module into this handler. Any agent can opt in by\n    // exposing the same property.\n    executionSeed: {\n      llmHostClass:\n        (agent as { modelHostClass?: ModelHostClass }).modelHostClass ??\n        \"unknown\",\n    },\n    observableFactory: () =>\n      runtime.runner.run({\n        threadId: input.threadId,\n        agent,\n        input,\n      }),\n  });\n}\n"],"mappings":";;;;;AAmBA,SAAgB,aAAa,EAC3B,SACA,SACA,OACA,OACA,SACA,OACA,QACA,aAC+B;AAC/B,QAAO,uBAAuB;EAC5B;EACA,eAAe,QAAQ;EACvB;EACA;EACA;EACA,sBAAsB,wBAAwB,QAAQ;EACtD;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAIlC,eAAe,EACb,cACG,MAA8C,kBAC/C,WACH;EACD,yBACE,QAAQ,OAAO,IAAI;GACjB,UAAU,MAAM;GAChB;GACA;GACD,CAAC;EACL,CAAC"}
+{"version":3,"file":"run.mjs","names":[],"sources":["../../../../../src/v2/runtime/handlers/sse/run.ts"],"sourcesContent":["import type { AbstractAgent, BaseEvent, RunAgentInput } from \"@ag-ui/client\";\nimport type { Observable } from \"rxjs\";\nimport { isThreadAccessDeniedError } from \"../../runner/agent-runner\";\nimport { threadAccessDeniedResponse } from \"../shared/thread-access\";\nimport type { ResolvedDebugConfig, ModelHostClass } from \"@copilotkit/shared\";\nimport type { CopilotRuntimeLogger } from \"../../../../v1-deprecated/lib/logger\";\nimport type { CopilotRuntimeLike } from \"../../core/runtime\";\nimport { getRuntimeErrorReporter } from \"../../core/runtime-error-reporter\";\nimport { createSseEventResponse } from \"../shared/sse-response\";\n\ninterface HandleSseRunParams {\n  runtime: CopilotRuntimeLike;\n  request: Request;\n  agent: AbstractAgent;\n  input: RunAgentInput;\n  agentId: string;\n  debug?: ResolvedDebugConfig;\n  /** Pre-created logger instance to avoid creating a new pino logger per request. */\n  logger?: CopilotRuntimeLogger;\n  startTime?: number;\n  /** Identity the run acts as; the runner records it as the thread owner. */\n  ownerId?: string;\n}\n\nexport function handleSseRun({\n  runtime,\n  request,\n  agent,\n  input,\n  agentId,\n  debug,\n  logger,\n  startTime,\n  ownerId,\n}: HandleSseRunParams): Response {\n  // Start the run before the stream opens. When another identity claimed the\n  // thread after the handler's owner check, the runner refuses at once, and\n  // that refusal becomes the same HTTP error as the check's, not a streamed\n  // agent failure. Any other start error still reaches the client as a\n  // RUN_ERROR on the stream, as before.\n  let started: Observable<BaseEvent> | undefined;\n  let startError: unknown;\n  try {\n    started = runtime.runner.run({\n      threadId: input.threadId,\n      agent,\n      input,\n      ...(ownerId === undefined ? {} : { ownerId }),\n    });\n  } catch (error) {\n    if (isThreadAccessDeniedError(error)) {\n      console.warn(\n        \"[CopilotKit] Run refused: the thread belongs to another identity.\",\n      );\n      return threadAccessDeniedResponse();\n    }\n    startError = error;\n  }\n\n  return createSseEventResponse({\n    request,\n    debugEventBus: runtime.debugEventBus,\n    agentId,\n    debug,\n    logger,\n    runtimeErrorReporter: getRuntimeErrorReporter(runtime),\n    startTime,\n    telemetry: runtime.telemetry,\n    keepAliveIntervalSeconds: runtime.sseKeepAliveIntervalSeconds,\n    // Read structurally rather than via `instanceof BuiltInAgent`, which would\n    // pull the agent module into this handler. Any agent can opt in by\n    // exposing the same property.\n    executionSeed: {\n      llmHostClass:\n        (agent as { modelHostClass?: ModelHostClass }).modelHostClass ??\n        \"unknown\",\n    },\n    observableFactory: () => {\n      if (started === undefined) throw startError;\n      return started;\n    },\n  });\n}\n"],"mappings":";;;;;;;AAwBA,SAAgB,aAAa,EAC3B,SACA,SACA,OACA,OACA,SACA,OACA,QACA,WACA,WAC+B;CAM/B,IAAI;CACJ,IAAI;AACJ,KAAI;AACF,YAAU,QAAQ,OAAO,IAAI;GAC3B,UAAU,MAAM;GAChB;GACA;GACA,GAAI,YAAY,SAAY,EAAE,GAAG,EAAE,SAAS;GAC7C,CAAC;UACK,OAAO;AACd,MAAI,0BAA0B,MAAM,EAAE;AACpC,WAAQ,KACN,oEACD;AACD,UAAO,4BAA4B;;AAErC,eAAa;;AAGf,QAAO,uBAAuB;EAC5B;EACA,eAAe,QAAQ;EACvB;EACA;EACA;EACA,sBAAsB,wBAAwB,QAAQ;EACtD;EACA,WAAW,QAAQ;EACnB,0BAA0B,QAAQ;EAIlC,eAAe,EACb,cACG,MAA8C,kBAC/C,WACH;EACD,yBAAyB;AACvB,OAAI,YAAY,OAAW,OAAM;AACjC,UAAO;;EAEV,CAAC"}

package/dist/v2/runtime/index.d.cts

@@ -1,13 +1,14 @@
 
 import { experimental_d_exports } from "./intelligence-platform/experimental.cjs";
+import { AgentRunner, AgentRunnerConnectRequest, AgentRunnerIsRunningRequest, AgentRunnerRunRequest, AgentRunnerStopRequest, LocalThreadEndpointRecord, LocalThreadEndpointRunner, LocalThreadEndpointScope, THREAD_ACCESS_DENIED_ERROR_CODE, ThreadAccessDeniedError, ThreadAlreadyRunningError, ThreadOwnershipRunner, enforcesThreadOwnership, isThreadAccessDeniedError, supportsLocalThreadEndpoints, ɵSERVER_THREAD_OWNER, ɵresolveThreadOwner } from "./runner/agent-runner.cjs";
+import { ThreadAccessMode, ThreadsConfig } from "./handlers/shared/thread-access.cjs";
 import { TranscribeFileOptions, TranscriptionService } from "./transcription-service/transcription-service.cjs";
-import { AgentRunner, AgentRunnerConnectRequest, AgentRunnerIsRunningRequest, AgentRunnerRunRequest, AgentRunnerStopRequest, LocalThreadEndpointRecord, LocalThreadEndpointRunner, ThreadAlreadyRunningError, supportsLocalThreadEndpoints } from "./runner/agent-runner.cjs";
 import { GetLearnedSkillsSnapshotRequest, GetLearnedSkillsSnapshotsRequest, LearnedSkillsBatchResult, LearnedSkillsError, LearnedSkillsErrorCode, LearnedSkillsSnapshotResult } from "./intelligence-platform/learned-skills.cjs";
 import "./intelligence-platform/index.cjs";
 import { AgentFactoryContext, AgentsConfig, AgentsFactory, CopilotIntelligenceRuntime, CopilotIntelligenceRuntimeLike, CopilotIntelligenceRuntimeOptions, CopilotRuntime, CopilotRuntimeConstructor, CopilotRuntimeLike, CopilotRuntimeMemoryConfig, CopilotRuntimeOptions, CopilotSseRuntime, CopilotSseRuntimeLike, CopilotSseRuntimeOptions, IdentifyUserCallback, McpAppsConfig, McpAppsServerConfig, MemoryAccess, MemoryConsumer, MemoryGrant, OpenGenerativeUIConfig, OpenGenerativeUIOptions, RuntimeWithDeclaredChannels, VERSION, isA2UIEnabled, isIntelligenceRuntime, resolveAgents } from "./core/runtime.cjs";
 import { CopilotRuntimeLearningConfig, CopilotRuntimeLearningContext, CopilotRuntimeUser, GetLearningContainerId, GetTrajectoryLearningContainerIds, LearningContainerSelectorInput, TrajectoryLearningContainerSelectorInput } from "./core/learning.cjs";
 import { CopilotKitIntelligence, CopilotKitIntelligenceConfig, CreateThreadRequest, ListThreadsResponse, PlatformRequestError, SubscribeToThreadsRequest, SubscribeToThreadsResponse, ThreadSummary, UpdateThreadRequest } from "./intelligence-platform/client.cjs";
-import { InMemoryAgentRunner, InMemoryAgentRunnerOptions, InMemoryLimits, InMemoryThread, ɵBoundedThreadStore, ɵGLOBAL_STORE, ɵINMEMORY_DEFAULTS, ɵestimateBytes, ɵnormalizeLimits } from "./runner/in-memory.cjs";
+import { InMemoryAgentRunner, InMemoryAgentRunnerOptions, InMemoryLimits, InMemoryThread, ɵBoundedThreadStore, ɵGLOBAL_STORE, ɵINMEMORY_DEFAULTS, ɵOWNER_RETENTION_DEFAULTS, ɵOwnerRetention, ɵestimateBytes, ɵnormalizeLimits } from "./runner/in-memory.cjs";
 import { IntelligenceAgentRunner, IntelligenceAgentRunnerOptions, RunnerStartupBoundary } from "./runner/intelligence.cjs";
 import { FinalizeRunOptions, RunEventFinalizer, createRunEventFinalizer, finalizeRunEvents } from "./runner/index.cjs";
 import { ChannelStatus, ChannelsControl } from "./core/channel-manager.cjs";

package/dist/v2/runtime/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/v2/runtime/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgEY,wBAAA,IAA4B,MAAA;EACtC,OAAA,EAAS,OAAA;AAAA,MACL,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../../src/v2/runtime/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgEY,wBAAA,IAA4B,MAAA;EACtC,OAAA,EAAS,OAAA;AAAA,MACL,OAAA,CAAQ,QAAA"}

package/dist/v2/runtime/index.d.mts

@@ -1,13 +1,14 @@
 
 import { experimental_d_exports } from "./intelligence-platform/experimental.mjs";
+import { AgentRunner, AgentRunnerConnectRequest, AgentRunnerIsRunningRequest, AgentRunnerRunRequest, AgentRunnerStopRequest, LocalThreadEndpointRecord, LocalThreadEndpointRunner, LocalThreadEndpointScope, THREAD_ACCESS_DENIED_ERROR_CODE, ThreadAccessDeniedError, ThreadAlreadyRunningError, ThreadOwnershipRunner, enforcesThreadOwnership, isThreadAccessDeniedError, supportsLocalThreadEndpoints, ɵSERVER_THREAD_OWNER, ɵresolveThreadOwner } from "./runner/agent-runner.mjs";
+import { ThreadAccessMode, ThreadsConfig } from "./handlers/shared/thread-access.mjs";
 import { TranscribeFileOptions, TranscriptionService } from "./transcription-service/transcription-service.mjs";
-import { AgentRunner, AgentRunnerConnectRequest, AgentRunnerIsRunningRequest, AgentRunnerRunRequest, AgentRunnerStopRequest, LocalThreadEndpointRecord, LocalThreadEndpointRunner, ThreadAlreadyRunningError, supportsLocalThreadEndpoints } from "./runner/agent-runner.mjs";
 import { GetLearnedSkillsSnapshotRequest, GetLearnedSkillsSnapshotsRequest, LearnedSkillsBatchResult, LearnedSkillsError, LearnedSkillsErrorCode, LearnedSkillsSnapshotResult } from "./intelligence-platform/learned-skills.mjs";
 import "./intelligence-platform/index.mjs";
 import { AgentFactoryContext, AgentsConfig, AgentsFactory, CopilotIntelligenceRuntime, CopilotIntelligenceRuntimeLike, CopilotIntelligenceRuntimeOptions, CopilotRuntime, CopilotRuntimeConstructor, CopilotRuntimeLike, CopilotRuntimeMemoryConfig, CopilotRuntimeOptions, CopilotSseRuntime, CopilotSseRuntimeLike, CopilotSseRuntimeOptions, IdentifyUserCallback, McpAppsConfig, McpAppsServerConfig, MemoryAccess, MemoryConsumer, MemoryGrant, OpenGenerativeUIConfig, OpenGenerativeUIOptions, RuntimeWithDeclaredChannels, VERSION, isA2UIEnabled, isIntelligenceRuntime, resolveAgents } from "./core/runtime.mjs";
 import { CopilotRuntimeLearningConfig, CopilotRuntimeLearningContext, CopilotRuntimeUser, GetLearningContainerId, GetTrajectoryLearningContainerIds, LearningContainerSelectorInput, TrajectoryLearningContainerSelectorInput } from "./core/learning.mjs";
 import { CopilotKitIntelligence, CopilotKitIntelligenceConfig, CreateThreadRequest, ListThreadsResponse, PlatformRequestError, SubscribeToThreadsRequest, SubscribeToThreadsResponse, ThreadSummary, UpdateThreadRequest } from "./intelligence-platform/client.mjs";
-import { InMemoryAgentRunner, InMemoryAgentRunnerOptions, InMemoryLimits, InMemoryThread, ɵBoundedThreadStore, ɵGLOBAL_STORE, ɵINMEMORY_DEFAULTS, ɵestimateBytes, ɵnormalizeLimits } from "./runner/in-memory.mjs";
+import { InMemoryAgentRunner, InMemoryAgentRunnerOptions, InMemoryLimits, InMemoryThread, ɵBoundedThreadStore, ɵGLOBAL_STORE, ɵINMEMORY_DEFAULTS, ɵOWNER_RETENTION_DEFAULTS, ɵOwnerRetention, ɵestimateBytes, ɵnormalizeLimits } from "./runner/in-memory.mjs";
 import { IntelligenceAgentRunner, IntelligenceAgentRunnerOptions, RunnerStartupBoundary } from "./runner/intelligence.mjs";
 import { FinalizeRunOptions, RunEventFinalizer, createRunEventFinalizer, finalizeRunEvents } from "./runner/index.mjs";
 import { ChannelStatus, ChannelsControl } from "./core/channel-manager.mjs";

package/dist/v2/runtime/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/v2/runtime/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgEY,wBAAA,IAA4B,MAAA;EACtC,OAAA,EAAS,OAAA;AAAA,MACL,OAAA,CAAQ,QAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../../src/v2/runtime/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgEY,wBAAA,IAA4B,MAAA;EACtC,OAAA,EAAS,OAAA;AAAA,MACL,OAAA,CAAQ,QAAA"}

package/dist/v2/runtime/intelligence-platform/client.cjs

@@ -1,9 +1,9 @@
 require("reflect-metadata");
 const require_runtime = require('../../../_virtual/_rolldown/runtime.cjs');
-const require_learning = require('../core/learning.cjs');
-const require_learned_skills = require('./learned-skills.cjs');
 const require_learning_management = require('./learning-management.cjs');
+const require_learning = require('../core/learning.cjs');
 const require_trajectories = require('./trajectories.cjs');
+const require_learned_skills = require('./learned-skills.cjs');
 let _copilotkit_shared = require("@copilotkit/shared");
 let zod = require("zod");
 let crypto = require("crypto");
@@ -226,6 +226,14 @@ function cloneRuntimeEntitlementError(error) {
 * });
 * ```
 */
+/**
+* The thread events and state reads are scoped to one end user. A caller
+* that omits `userId` (a JS caller, or one built against the earlier
+* signature) would otherwise send the literal string "undefined" as the user.
+*/
+function requireThreadReadUserId(method, userId) {
+	if (typeof userId !== "string" || userId === "") throw new TypeError(`${method} requires a non-empty userId: the id identifyUser returned`);
+}
 var CopilotKitIntelligence = class {
 	#apiUrl;
 	#runnerWsUrl;
@@ -1119,7 +1127,9 @@ var CopilotKitIntelligence = class {
 	* @throws {@link PlatformRequestError} on non-2xx responses.
 	*/
 	async getThreadEvents(params) {
-		return this.#request("GET", `/api/_inspect/threads/${encodeURIComponent(params.threadId)}/events`);
+		requireThreadReadUserId("getThreadEvents", params.userId);
+		const qs = new URLSearchParams({ userId: params.userId }).toString();
+		return this.#request("GET", `/api/_inspect/threads/${encodeURIComponent(params.threadId)}/events?${qs}`);
 	}
 	/**
 	* Fetch the current agent state for a thread.
@@ -1135,7 +1145,9 @@ var CopilotKitIntelligence = class {
 	* @throws {@link PlatformRequestError} on non-2xx responses.
 	*/
 	async getThreadState(params) {
-		return this.#request("GET", `/api/_inspect/threads/${encodeURIComponent(params.threadId)}/state`);
+		requireThreadReadUserId("getThreadState", params.userId);
+		const qs = new URLSearchParams({ userId: params.userId }).toString();
+		return this.#request("GET", `/api/_inspect/threads/${encodeURIComponent(params.threadId)}/state?${qs}`);
 	}
 	/**
 	* Mark a thread as archived.