@mastra/server 1.72.0-alpha.4 → 1.72.0-alpha.6

package/dist/server/handlers/agents.cjs

@@ -128,7 +128,7 @@ function hasSuspendedToolCall(snapshot, toolCallId) {
 function getDurableLoopWorkflowName(agent) {
 	return agent.durableLoopWorkflowName ?? _mastra_core_agent_durable.DurableStepIds.AGENTIC_LOOP;
 }
-async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId, requestContext }) {
+async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId, requestContext, threadId }) {
 	if (!(0, _mastra_core_agent.isDurableAgentLike)(agent)) return;
 	const workflowRun = await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
 		workflowName: getDurableLoopWorkflowName(agent),
@@ -151,7 +151,9 @@ async function validateDurableToolCallAccess({ mastra, agent, runId, toolCallId,
 	const effectiveResourceId = require_utils$1.getEffectiveResourceId(requestContext, void 0);
 	const [persistedResourceId] = persistedResourceIds;
 	if (persistedResourceIds.size > 1 || persistedResourceId && persistedResourceId !== effectiveResourceId) throw new require_http_exception.HTTPException(403, { message: "Access denied: durable run belongs to a different resource" });
-	if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent.id || !hasSuspendedToolCall(snapshot, toolCallId)) throw new require_http_exception.HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
+	const persistedThreadId = input?.state?.threadId ?? input?.messageListState?.memoryInfo?.threadId;
+	if (threadId && persistedThreadId !== threadId) throw new require_http_exception.HTTPException(403, { message: "Access denied: durable run belongs to a different thread" });
+	if (!snapshot || snapshot.status !== "suspended" || input?.agentId !== agent.id || toolCallId !== void 0 && !hasSuspendedToolCall(snapshot, toolCallId)) throw new require_http_exception.HTTPException(403, { message: "Access denied: tool call is not suspended on this durable run" });
 }
 /**
 * Providers whose apiKeyEnvVar entries are aliases for the same credential (any one
@@ -2019,6 +2021,14 @@ const RESUME_STREAM_ROUTE = require_route_builder.createRoute({
 				...effectiveResourceId ? { resource: effectiveResourceId } : {},
 				...effectiveThreadId ? { thread: effectiveThreadId } : {}
 			};
+			await validateDurableToolCallAccess({
+				mastra,
+				agent,
+				runId,
+				toolCallId,
+				requestContext: serverRequestContext,
+				threadId: effectiveThreadId
+			});
 			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
 				workflowName: "agentic-loop",
 				runId
@@ -2131,6 +2141,14 @@ const RESUME_STREAM_UNTIL_IDLE_ROUTE = require_route_builder.createRoute({
 				...effectiveResourceId ? { resource: effectiveResourceId } : {},
 				...effectiveThreadId ? { thread: effectiveThreadId } : {}
 			};
+			await validateDurableToolCallAccess({
+				mastra,
+				agent,
+				runId,
+				toolCallId,
+				requestContext: serverRequestContext,
+				threadId: effectiveThreadId
+			});
 			await require_utils$1.validateRunOwnership(await (await mastra.getStorage()?.getStore("workflows"))?.getWorkflowRunById({
 				workflowName: "agentic-loop",
 				runId