@desplega.ai/agent-swarm 2.3.0 → 2.4.0

package/src/http/sessions.ts

@@ -7,18 +7,40 @@ import {
   getTaskById,
   listRecentSessions,
 } from "../be/db";
+import {
+  getSessionRoot,
+  listActiveSessionShares,
+  type SessionAccess,
+  sessionAccessForRoot,
+  setSessionShares,
+  toSessionSharesState,
+} from "../be/session-shares";
 import { getTaskSteeringFieldsForTasks } from "../be/steering";
 import { getTaskCitationsForTasks, TaskCitationSchema } from "../be/task-citations";
 import {
+  findUserById,
   InvalidRuntimeTokenError,
   mintRuntimeToken,
   mintSessionToken,
   revokeSessionToken,
 } from "../be/users";
-import { type AgentTask, AgentTaskSchema, AgentTaskStatusSchema, SteerModeSchema } from "../types";
+import { can } from "../rbac";
+import { sessionAccessTopic } from "../realtime/auth";
+import { realtimeBus } from "../realtime/bus";
+import {
+  type AgentTask,
+  AgentTaskSchema,
+  AgentTaskStatusSchema,
+  SessionAccessSchema,
+  SessionOwnerSchema,
+  SessionSharesSchema,
+  SessionSharesUpdateSchema,
+  SteerModeSchema,
+} from "../types";
 import { getRequestAuth } from "../utils/request-auth-context";
 import { isRuntimePoolsEnabled } from "../utils/runtime-pools-flag";
 import { route } from "./route-def";
+import { resolveSessionActor, type SessionActor } from "./session-access";
 import { jsonError } from "./utils";
 
 // ─── Response Schemas ────────────────────────────────────────────────────────
@@ -91,6 +113,9 @@ const mintSessionTokenRoute = route({
   method: "post",
   path: "/api/sessions/tokens",
   pattern: ["api", "sessions", "tokens"],
+  session: {
+    none: "user tokens cannot mint: the handler admits only the operator key or the task's own runtime",
+  },
   summary: "Mint an ephemeral task or runtime token",
   description:
     "Operators can mint task or runtime tokens. Runtime tokens can mint task tokens for their own assigned tasks. Child tokens expire with their parent runtime.",
@@ -175,6 +200,14 @@ const listSessions = route({
     contextKeyPrefix: z.string().min(1).optional(),
     /** `full` restores the legacy shape (full root `AgentTask`); default is slim. */
     fields: z.enum(["full", "slim"]).optional(),
+    /**
+     * `mine`: sessions the caller owns. `shared`: sessions someone else owns
+     * with an active share to the caller or to everyone. Omit for every
+     * session the caller can open. Callers that act for no user (agents, the
+     * operator key with no picked dashboard user) see every session, and
+     * an empty list for either scope.
+     */
+    scope: z.enum(["mine", "shared"]).optional(),
   }),
   responses: {
     200: {
@@ -195,23 +228,78 @@ const getSession = route({
   method: "get",
   path: "/api/sessions/{rootTaskId}",
   pattern: ["api", "sessions", null],
+  session: { taskParam: "rootTaskId" },
   summary: "Get a session — root task + the entire descendant chain",
   tags: ["Sessions"],
   params: z.object({ rootTaskId: z.string() }),
   responses: {
     200: {
-      description: "Root task + chain (ordered by createdAt)",
+      description:
+        "Root task + chain (ordered by createdAt), plus the caller's `access` and the session `owner`",
       schema: z.object({
         root: TaskWithSteeringSchema,
         chain: z.array(TaskWithSteeringSchema),
+        access: SessionAccessSchema,
+        owner: SessionOwnerSchema.nullable(),
       }),
     },
     401: { description: "Unauthorized" },
+    403: { description: "The caller has no access to this session" },
+    404: { description: "Root task not found" },
+  },
+  auth: { apiKey: true },
+});
+
+const getSessionShares = route({
+  method: "get",
+  path: "/api/sessions/{rootTaskId}/shares",
+  pattern: ["api", "sessions", null, "shares"],
+  session: { taskParam: "rootTaskId" },
+  summary: "List a session's active shares",
+  description:
+    "Active shares only. `everyone` is the access every user has; `users` are per-person shares. A session with no shares is private to its owner.",
+  tags: ["Sessions"],
+  params: z.object({ rootTaskId: z.string() }),
+  responses: {
+    200: { description: "Active shares", schema: SessionSharesSchema },
+    401: { description: "Unauthorized" },
+    403: { description: "The caller has no access to this session" },
+    404: { description: "Root task not found" },
+  },
+  auth: { apiKey: true },
+});
+
+const putSessionShares = route({
+  method: "put",
+  path: "/api/sessions/{rootTaskId}/shares",
+  pattern: ["api", "sessions", null, "shares"],
+  session: { taskParam: "rootTaskId" },
+  summary: "Set who can view or edit a session",
+  description:
+    "Owner only. The body is the full desired state: users left out lose access. Changed targets have their active share revoked and a new one inserted in one transaction; shares are never deleted.",
+  tags: ["Sessions"],
+  params: z.object({ rootTaskId: z.string() }),
+  body: SessionSharesUpdateSchema,
+  responses: {
+    200: { description: "Active shares after the change", schema: SessionSharesSchema },
+    400: { description: "Validation error or unknown user" },
+    401: { description: "Unauthorized" },
+    403: { description: "Only the session owner can share it" },
     404: { description: "Root task not found" },
+    409: { description: "The session has no owner, so it is already open to everyone" },
   },
   auth: { apiKey: true },
+  rbac: { permission: "session.share" },
 });
 
+/** The actor's access to the session rooted at `root`; `owner` when the actor bypasses checks. */
+async function accessForRoot(
+  actor: SessionActor,
+  root: { id: string; requestedByUserId: string | null },
+): Promise<SessionAccess> {
+  return actor.kind === "bypass" ? "owner" : sessionAccessForRoot(actor.userId, root);
+}
+
 // ─── Handler ─────────────────────────────────────────────────────────────────
 
 export async function handleSessions(
@@ -219,6 +307,7 @@ export async function handleSessions(
   res: ServerResponse,
   pathSegments: string[],
   queryParams: URLSearchParams,
+  myAgentId?: string,
 ): Promise<boolean> {
   if (mintSessionTokenRoute.match(req.method, pathSegments)) {
     const auth = getRequestAuth(req);
@@ -312,13 +401,30 @@ export async function handleSessions(
           .map((s) => s.trim())
           .filter(Boolean)
       : undefined;
-    const baseOpts = {
-      limit: parsed.query.limit,
-      offset: parsed.query.offset,
+    const actor = await resolveSessionActor(req, myAgentId);
+    if (actor.kind === "bypass" && parsed.query.scope) {
+      // No user to own or receive a share.
+      listSessions.respond(res, 200, {
+        sessions: [],
+        total: 0,
+        limit: parsed.query.limit ?? 25,
+        offset: parsed.query.offset ?? 0,
+      });
+      return true;
+    }
+    const filterOpts = {
       source: sources,
       q: parsed.query.q,
       requestedByUserId: parsed.query.requestedByUserId,
       contextKeyPrefix: parsed.query.contextKeyPrefix,
+      ...(actor.kind === "user"
+        ? { viewer: { userId: actor.userId, scope: parsed.query.scope ?? "all" } as const }
+        : {}),
+    };
+    const baseOpts = {
+      ...filterOpts,
+      limit: parsed.query.limit,
+      offset: parsed.query.offset,
     };
     // List responses default to slim (root is a task summary); `?fields=full` restores it.
     const sessions =
@@ -327,12 +433,7 @@ export async function handleSessions(
         : await listRecentSessions({ ...baseOpts, slim: true });
     // Filter-aware total: same WHERE as the list query, so the UI pager
     // reflects the filtered result set.
-    const total = await countSessions({
-      source: sources,
-      q: parsed.query.q,
-      requestedByUserId: parsed.query.requestedByUserId,
-      contextKeyPrefix: parsed.query.contextKeyPrefix,
-    });
+    const total = await countSessions(filterOpts);
     listSessions.respond(res, 200, {
       sessions,
       total,
@@ -350,6 +451,25 @@ export async function handleSessions(
       jsonError(res, "Root task not found", 404);
       return true;
     }
+    // The route accepts any task id; access follows the topmost root.
+    const sessionRoot = (await getSessionRoot(root.id)) ?? {
+      id: root.id,
+      requestedByUserId: root.requestedByUserId ?? null,
+    };
+    const access = await accessForRoot(await resolveSessionActor(req, myAgentId), sessionRoot);
+    if (access === "none") {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
+    const ownerUser = sessionRoot.requestedByUserId
+      ? await findUserById(sessionRoot.requestedByUserId)
+      : null;
+    const owner = sessionRoot.requestedByUserId
+      ? {
+          id: sessionRoot.requestedByUserId,
+          name: ownerUser?.name ?? sessionRoot.requestedByUserId,
+        }
+      : null;
     const chain = await getRootTaskChain(parsed.params.rootTaskId);
     // Fixed query count regardless of chain length: one agents lookup and one
     // citations lookup for the whole chain (chunked past 500 ids).
@@ -363,7 +483,87 @@ export async function handleSessions(
       ...steering.get(task.id)!,
       citations: citations.get(task.id)!,
     });
-    getSession.respond(res, 200, { root: decorate(root), chain: chain.map(decorate) });
+    getSession.respond(res, 200, {
+      root: decorate(root),
+      chain: chain.map(decorate),
+      access,
+      owner,
+    });
+    return true;
+  }
+
+  if (getSessionShares.match(req.method, pathSegments)) {
+    const parsed = await getSessionShares.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    const root = await getSessionRoot(parsed.params.rootTaskId);
+    if (!root) {
+      jsonError(res, "Root task not found", 404);
+      return true;
+    }
+    const access = await accessForRoot(await resolveSessionActor(req, myAgentId), root);
+    if (access === "none") {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
+    getSessionShares.respond(
+      res,
+      200,
+      toSessionSharesState(await listActiveSessionShares(root.id)),
+    );
+    return true;
+  }
+
+  if (putSessionShares.match(req.method, pathSegments)) {
+    const parsed = await putSessionShares.parse(req, res, pathSegments, queryParams);
+    if (!parsed) return true;
+    const auth = getRequestAuth(req);
+    const actor = await resolveSessionActor(req, myAgentId);
+    // Sharing is a dashboard action: a person, or the operator key itself.
+    const principal =
+      auth?.kind === "user"
+        ? ({ kind: "user", userId: auth.userId } as const)
+        : auth?.kind === "operator" && !myAgentId
+          ? ({ kind: "operator" } as const)
+          : null;
+    if (
+      !principal ||
+      !can({ principal, verb: "session.share", resource: { kind: "none" }, source: "http" }).allow
+    ) {
+      jsonError(res, "Only the session owner can share it", 403);
+      return true;
+    }
+    const root = await getSessionRoot(parsed.params.rootTaskId);
+    if (!root) {
+      jsonError(res, "Root task not found", 404);
+      return true;
+    }
+    if (!root.requestedByUserId) {
+      jsonError(res, "This session has no owner, so it is already open to everyone", 409);
+      return true;
+    }
+    if (actor.kind === "user" && actor.userId !== root.requestedByUserId) {
+      jsonError(res, "Only the session owner can share it", 403);
+      return true;
+    }
+    const userIds = [...new Set(parsed.body.users.map((user) => user.userId))];
+    if (userIds.length !== parsed.body.users.length) {
+      jsonError(res, "Each user may appear only once", 400);
+      return true;
+    }
+    for (const userId of userIds) {
+      if (!(await findUserById(userId))) {
+        jsonError(res, `Unknown user ${userId}`, 400);
+        return true;
+      }
+    }
+    const state = await setSessionShares(
+      root,
+      parsed.body,
+      actor.kind === "user" ? actor.userId : null,
+    );
+    // Committed: presence sockets re-check access, so a revoked viewer leaves.
+    realtimeBus.publish(sessionAccessTopic(root.id), null);
+    putSessionShares.respond(res, 200, state);
     return true;
   }
 

package/src/http/stats.ts

@@ -19,6 +19,7 @@ import { isMultiRuntimeEnabled } from "../utils/multi-runtime";
 import { resolveHttpFavoriteOwner } from "./favorite-owner";
 import { route } from "./route-def";
 import { scheduleSummaryWithFavoriteSchema } from "./schedules";
+import { readableByFor, resolveSessionActor } from "./session-access";
 
 // ─── Response schemas ────────────────────────────────────────────────────────
 
@@ -222,11 +223,12 @@ export async function handleStats(
     if (!parsed) return true;
     const limit = parsed.query.limit ?? 100;
     const agentId = parsed.query.agentId;
+    const readableBy = readableByFor(await resolveSessionActor(req, myAgentId));
     let logs: AgentLog[] = [];
     if (agentId) {
-      logs = (await getLogsByAgentId(agentId)).slice(0, limit);
+      logs = (await getLogsByAgentId(agentId, readableBy)).slice(0, limit);
     } else {
-      logs = await getAllLogs(limit);
+      logs = await getAllLogs(limit, readableBy);
     }
     listLogs.respond(res, 200, { logs });
     return true;
@@ -306,7 +308,9 @@ export async function handleStats(
   }
 
   if (getConcurrentContextRoute.match(req.method, pathSegments)) {
-    const context = await getConcurrentContext();
+    const context = await getConcurrentContext(
+      readableByFor(await resolveSessionActor(req, myAgentId)),
+    );
     getConcurrentContextRoute.respond(res, 200, context);
     return true;
   }

package/src/http/tasks.ts

@@ -37,6 +37,7 @@ import {
 } from "../be/db";
 import { modelProfileRefError, taskProfileError } from "../be/db/model-profiles";
 import { explicitModelErrorForAgent } from "../be/model-validation";
+import { hasSessionAccess, type SessionAccess } from "../be/session-shares";
 import {
   getTaskSteeringFields,
   markSteeringUndeliverable,
@@ -80,7 +81,15 @@ import { getRequestAuth } from "../utils/request-auth-context";
 import { scrubSecrets } from "../utils/secret-scrubber";
 import { rejectGuest } from "./request-principal";
 import { buildTaskRequestedBy, TaskRequestedBySchema } from "./requested-by";
-import { route } from "./route-def";
+import { bodyTask, route } from "./route-def";
+import {
+  canReadSession,
+  readableByFor,
+  resolveSessionActor,
+  SESSION_READ_DENIED,
+  SESSION_WRITE_DENIED,
+  sessionAccessFor,
+} from "./session-access";
 import { jsonError, parseBody } from "./utils";
 
 // ─── Response Schemas ────────────────────────────────────────────────────────
@@ -207,7 +216,7 @@ const listTasks = route({
   pattern: ["api", "tasks"],
   summary: "List tasks with filters",
   description:
-    "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
+    "Returns tasks with the full `task` text replaced by a bounded `taskPreview` and completion/integration blobs dropped by default — list views only need the preview. Pass `fields=full` to restore the full `AgentTask`, or `fields=timeline` for the narrow shape the dashboard timeline draws. Every shape gives a user caller only tasks of sessions they can read. Fetch a single task in full via `GET /api/tasks/{id}`. `total` (the filtered row count, ignoring limit/offset) is computed only with `includeTotal=true`.",
   tags: ["Tasks"],
   query: z.object({
     /** Single status, or comma-separated list (e.g. "failed,cancelled"). */
@@ -263,6 +272,7 @@ const createTask = route({
   method: "post",
   path: "/api/tasks",
   pattern: ["api", "tasks"],
+  session: bodyTask("parentTaskId"),
   summary: "Create a new task",
   tags: ["Tasks"],
   body: z
@@ -340,6 +350,7 @@ const promoteDraftTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/promote-draft",
   pattern: ["api", "tasks", null, "promote-draft"],
+  session: { taskParam: "id" },
   summary: "Promote a draft task out of the pre-dispatch draft state",
   description:
     "Transitions a `draft` task (#1240 — created with attachments still uploading) to its normal dispatch-eligible status: `offered` if it was offered to an agent, `pending` if it has an owning agent (the common case — UI-composer tasks default to Lead), otherwise `unassigned`. Called by the UI composer once its attachment upload batch settles, whether every file uploaded, some failed, or all failed — a draft must never be stranded by an upload error. Idempotent: calling it on a task that already left `draft` returns the current task unchanged rather than erroring, so a retried request is safe.",
@@ -357,6 +368,7 @@ const updateSession = route({
   method: "put",
   path: "/api/tasks/{id}/session",
   pattern: ["api", "tasks", null, "session"],
+  session: { taskParam: "id" },
   summary: "Update provider session ID and harness metadata for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -392,6 +404,7 @@ const cancelTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/cancel",
   pattern: ["api", "tasks", null, "cancel"],
+  session: { taskParam: "id" },
   summary: "Cancel a pending or in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -407,6 +420,7 @@ const steerTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/steer",
   pattern: ["api", "tasks", null, "steer"],
+  session: { taskParam: "id" },
   summary: "Deliver a steering message to a running task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -439,6 +453,7 @@ const getTaskSteeringMessagesRoute = route({
   method: "get",
   path: "/api/tasks/{id}/steering-messages",
   pattern: ["api", "tasks", null, "steering-messages"],
+  session: { taskParam: "id" },
   summary: "List steering messages for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -467,6 +482,7 @@ const markSteeringDeliveredRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/delivered",
   pattern: ["api", "steering-messages", null, "delivered"],
+  session: { steeringParam: "id" },
   summary: "Mark a steering message delivered",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -492,6 +508,7 @@ const markSteeringHandledRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/handled",
   pattern: ["api", "steering-messages", null, "handled"],
+  session: { steeringParam: "id" },
   summary: "Mark a steering message handled",
   description:
     "Optionally accepts a JSON body `{ note?: string }` — a short acceptance note describing how the steering was incorporated, persisted as `handledNote`.",
@@ -517,6 +534,7 @@ const markSteeringUndeliverableRoute = route({
   method: "post",
   path: "/api/steering-messages/{id}/undeliverable",
   pattern: ["api", "steering-messages", null, "undeliverable"],
+  session: { steeringParam: "id" },
   summary: "Promote an undeliverable steering message",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -542,6 +560,7 @@ const getTask = route({
   method: "get",
   path: "/api/tasks/{id}",
   pattern: ["api", "tasks", null],
+  session: { taskParam: "id" },
   summary: "Get task details with logs and attachments",
   description:
     "Returns the full `AgentTask` row decorated with `logs` (capped by `logsLimit`) and `attachments` (pointer-based artifacts stored on the task, ordered by `created_at`).",
@@ -553,6 +572,7 @@ const getTask = route({
   }),
   responses: {
     200: { description: "Task with logs and attachments", schema: GetTaskResponseSchema },
+    403: { description: "A user caller cannot read the task's session" },
     404: { description: "Task not found" },
   },
 });
@@ -561,6 +581,7 @@ const updateTaskProgressRoute = route({
   method: "post",
   path: "/api/tasks/{id}/progress",
   pattern: ["api", "tasks", null, "progress"],
+  session: { taskParam: "id" },
   summary: "Update task progress text",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -579,6 +600,7 @@ const finishTask = route({
   method: "post",
   path: "/api/tasks/{id}/finish",
   pattern: ["api", "tasks", null, "finish"],
+  session: { taskParam: "id" },
   summary: "Mark task as completed or failed (runner endpoint)",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -631,6 +653,7 @@ const pauseTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/pause",
   pattern: ["api", "tasks", null, "pause"],
+  session: { taskParam: "id" },
   summary: "Pause an in-progress task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -646,6 +669,7 @@ const resumeTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/resume",
   pattern: ["api", "tasks", null, "resume"],
+  session: { taskParam: "id" },
   summary: "Resume a paused task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -661,6 +685,7 @@ const supersedeTaskRoute = route({
   method: "post",
   path: "/api/tasks/{id}/supersede",
   pattern: ["api", "tasks", null, "supersede"],
+  session: { taskParam: "id" },
   summary: "Supersede an in-progress task (terminate + spawn resume follow-up)",
   description:
     'Marks the original task `superseded` (terminal) and creates a fresh `taskType="resume"` follow-up so a worker can pick up the work in a new provider session. Workflow-step tasks (those with `workflowRunStepId`) are carved out: the original is marked `failed` with reason `superseded_workflow_task` and no follow-up is created — the workflow engine\'s retry/failure policy applies.',
@@ -683,6 +708,7 @@ const updateTaskVcsRoute = route({
   method: "patch",
   path: "/api/tasks/{id}/vcs",
   pattern: ["api", "tasks", null, "vcs"],
+  session: { taskParam: "id" },
   summary: "Update VCS (PR/MR) info for a task",
   tags: ["Tasks"],
   params: z.object({ id: z.string() }),
@@ -704,6 +730,7 @@ const updateTaskTitleRoute = route({
   method: "patch",
   path: "/api/tasks/{id}/title",
   pattern: ["api", "tasks", null, "title"],
+  session: { taskParam: "id" },
   summary: "Set or clear a task's display title (session rename)",
   description:
     "Sets a human-facing display title override on a task. The sessions UI only reads this from root tasks (session list items), but titles on child tasks are harmless. Pass `title: null` (or an empty string) to clear the override and fall back to the task prompt.",
@@ -722,22 +749,37 @@ const updateTaskTitleRoute = route({
   },
 });
 
+/** True unless the request acts for a user who lacks write access to the task's session. */
+async function hasSessionWrite(
+  req: IncomingMessage,
+  myAgentId: string | undefined,
+  taskId: string,
+): Promise<boolean> {
+  const access = await sessionAccessFor(await resolveSessionActor(req, myAgentId), taskId);
+  return hasSessionAccess(access, "write");
+}
+
 async function canSteerTask(
   req: IncomingMessage,
   myAgentId: string | undefined,
   task: AgentTask,
+  sessionAccess: SessionAccess = "none",
 ): Promise<boolean> {
+  const auth = getRequestAuth(req);
   const resource: RbacResource = {
     kind: "task",
     taskId: task.id,
-    requestedByUserId: task.requestedByUserId,
+    // A user with a write share steers as if the session were their own; the
+    // verb gate (and any role grant) still applies. Only an actual share
+    // counts: `owner` from an ownerless root must not widen steering.
+    requestedByUserId:
+      auth?.kind === "user" && sessionAccess === "write" ? auth.userId : task.requestedByUserId,
     creatorAgentId: task.creatorAgentId,
     agentId: task.agentId,
   };
   let principal: RbacPrincipal;
   let verb: "task.steer.any" | "task.steer.own";
 
-  const auth = getRequestAuth(req);
   if (auth?.kind === "operator") {
     principal = { kind: "operator" };
     verb = "task.steer.own";
@@ -906,6 +948,9 @@ export async function handleTasks(
       if (validated.length > 0) source = validated;
     }
 
+    // Every shape carries task text, so a user sees only sessions they can
+    // read, and `total` counts the same rows.
+    const actor = await resolveSessionActor(req, myAgentId);
     const filters = {
       status,
       agentId: parsed.query.agentId || undefined,
@@ -925,6 +970,7 @@ export async function handleTasks(
       orderBy: parsed.query.orderBy,
       limit: parsed.query.limit,
       offset: parsed.query.offset,
+      readableBy: actor.kind === "user" ? { userId: actor.userId } : undefined,
     };
     // List responses default to slim (full `task` text → bounded `taskPreview`,
     // heavy blobs dropped); `?fields=full` restores the full `AgentTask`.
@@ -1013,6 +1059,11 @@ export async function handleTasks(
       jsonError(res, `You don't have context for parent task ${parentTask.id}.`, 403);
       return true;
     }
+    // A follow-up in someone else's session needs a write share.
+    if (parentTask && !(await hasSessionWrite(req, myAgentId, parentTask.id))) {
+      jsonError(res, SESSION_WRITE_DENIED, 403);
+      return true;
+    }
     // A chat-sdk contextKey binds the task to a chat thread that its assignee and creator
     // may then read and post to. An agent may only name a thread other than the parent's
     // with the lead's chat post permission.
@@ -1285,7 +1336,13 @@ export async function handleTasks(
       jsonError(res, "Task not found", 404);
       return true;
     }
-    if (!(await canSteerTask(req, myAgentId, task))) {
+    const sessionActor = await resolveSessionActor(req, myAgentId);
+    const steerAccess = await sessionAccessFor(sessionActor, task.id);
+    if (!hasSessionAccess(steerAccess, "write")) {
+      jsonError(res, SESSION_WRITE_DENIED, 403);
+      return true;
+    }
+    if (!(await canSteerTask(req, myAgentId, task, steerAccess))) {
       jsonError(res, "Forbidden: caller cannot steer this task", 403);
       return true;
     }
@@ -1338,6 +1395,10 @@ export async function handleTasks(
       jsonError(res, "Task not found", 404);
       return true;
     }
+    if (!(await canReadSession(req, myAgentId, parsed.params.id))) {
+      jsonError(res, SESSION_READ_DENIED, 403);
+      return true;
+    }
     getTaskSteeringMessagesRoute.respond(res, 200, {
       messages: await getSteeringMessagesForTask(parsed.params.id),
     });
@@ -1357,7 +1418,12 @@ export async function handleTasks(
       return true;
     }
 
+    // A user token naming an agent in X-Agent-ID still reads only its sessions.
     if (parsed.query.taskId) {
+      if (!(await canReadSession(req, myAgentId, parsed.query.taskId))) {
+        jsonError(res, SESSION_READ_DENIED, 403);
+        return true;
+      }
       const task = await getTaskById(parsed.query.taskId);
       const messages =
         task?.agentId === myAgentId ? await getPendingSteeringForTask(parsed.query.taskId) : [];
@@ -1365,8 +1431,9 @@ export async function handleTasks(
       return true;
     }
 
+    const actor = await resolveSessionActor(req, myAgentId);
     getPendingSteeringMessagesRoute.respond(res, 200, {
-      messages: await getPendingSteeringForAgent(myAgentId),
+      messages: await getPendingSteeringForAgent(myAgentId, readableByFor(actor)),
     });
     return true;
   }
@@ -1529,6 +1596,11 @@ export async function handleTasks(
       jsonError(res, "Task not found", 404);
       return true;
     }
+    const readAccess = await sessionAccessFor(await resolveSessionActor(req, myAgentId), task.id);
+    if (!hasSessionAccess(readAccess, "read")) {
+      jsonError(res, "You don't have access to this session. Ask the owner to share it.", 403);
+      return true;
+    }
 
     const logs = await getLogsByTaskId(parsed.params.id, parsed.query.logsLimit ?? 200);
     const attachments = await getTaskAttachments(parsed.params.id);
@@ -1758,7 +1830,11 @@ export async function handleTasks(
       jsonError(res, "Missing X-Agent-ID header", 400);
       return true;
     }
-    const pausedTasks = await getPausedTasksForAgent(myAgentId);
+    // A user token naming an agent in X-Agent-ID still reads only its sessions.
+    const pausedTasks = await getPausedTasksForAgent(
+      myAgentId,
+      readableByFor(await resolveSessionActor(req, myAgentId)),
+    );
     const tasks = await Promise.all(
       pausedTasks.map(async (task) => {
         const requestedBy = await buildTaskRequestedBy(task);