npm - @memberjunction/server - Versions diffs - 5.50.0 → 5.51.0 - Mend

@memberjunction/server 5.50.0 → 5.51.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (18) hide show

package/dist/agentSessions/SessionManager.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;~~AAuBvC~~;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,cAAc;IACvB,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAA6B;IAEvD;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;OAIG;YACW,yBAAyB;~~IAuBvC~~,sGAAsG;IACtG,OAAO,CAAC,qBAAqB;IAgB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}
1	+ {"version":3,"file":"SessionManager.d.ts","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,MAAM,sBAAsB,CAAC;AACtF,OAAO,EACH,sBAAsB,EACtB,6BAA6B,EAEhC,MAAM,+BAA+B,CAAC;AAwBvC;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IAC/B,yFAAyF;IACzF,OAAO,EAAE,MAAM,CAAC;IAChB,iGAAiG;IACjG,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAE/E;;;;GAIG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI9B;AASD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,cAAc;IACvB,qFAAqF;IACrF,OAAO,CAAC,kBAAkB,CAA6B;IAEvD;;;;;;;;;OASG;IACU,aAAa,CACtB,KAAK,EAAE,kBAAkB,EACzB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAWlC;;;;;;;;;;;;OAYG;IACU,YAAY,CACrB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,GAAE,kBAA+B,EAC5C,iBAAiB,CAAC,EAAE,6BAA6B,EAAE,GACpD,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;;OAKG;YACW,kCAAkC;IAwBhD;;;;;OAKG;YACW,iCAAiC;IAW/C;;;;OAIG;YACW,yBAAyB;IA2BvC,sGAAsG;IACtG,OAAO,CAAC,qBAAqB;IAgB7B;;;;;OAKG;IACU,SAAS,CAClB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IASnB;;;OAGG;IACU,QAAQ,CACjB,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,OAAO,CAAC;IAcnB,0FAA0F;YAC5E,YAAY;IAS1B,8EAA8E;YAChE,kBAAkB;IA4ChC,6EAA6E;YAC/D,iBAAiB;IAkC/B,6EAA6E;YAC/D,WAAW;IAUzB,qFAAqF;YACvE,iBAAiB;IAU/B,qGAAqG;YACvF,kBAAkB;IAoBhC;;;;OAIG;YACW,kBAAkB;IAsBhC;;;;;OAKG;IACU,2BAA2B,CACpC,UAAU,EAAE,MAAM,EAAE,EACpB,WAAW,EAAE,QAAQ,EACrB,QAAQ,EAAE,iBAAiB,GAC5B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAC;IAexD,8FAA8F;IAC9F,OAAO,CAAC,iBAAiB;IAKzB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAIxB,mGAAmG;YACrF,gBAAgB;IAoB9B,8FAA8F;YAChF,SAAS;CAU1B"}

package/dist/agentSessions/SessionManager.js CHANGED Viewed

@@ -3,6 +3,7 @@ import { AIAgentPermissionHelper } from '@memberjunction/ai-engine-base';
 import { RealtimeClientSessionService, RealtimeChannelServerHost } from '@memberjunction/ai-agents';
 import { GetHostInstanceID } from './HostInstance.js';
 import { writeReturningVisitorRecap } from './ReturningVisitorRecap.js';
+import { ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 /** Entity names — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
 const SESSION_ENTITY = 'MJ: AI Agent Sessions';
 const SESSION_CHANNEL_ENTITY = 'MJ: AI Agent Session Channels';
@@ -153,7 +154,11 @@ export class SessionManager {
             return;
         }
         try {
-            await new RealtimeClientSessionService().FinalizeCoAgentRun(config.coAgentRunID ?? null, config.promptRunID ?? null, contextUser, provider, true, config.coAgentRunStepID ?? null);
+            // SCOPED-ANONYMOUS ELEVATION (issue #3371): the runs were CREATED under the system user
+            // for a scoped anonymous session, so an owner-initiated (or error) close must finalize
+            // under it too — the caller's role holds no grants on the AI run entities. Janitor and
+            // shutdown sweeps already close as the system user and pass through unchanged.
+            await new RealtimeClientSessionService().FinalizeCoAgentRun(config.coAgentRunID ?? null, config.promptRunID ?? null, ResolveScopedAnonymousRunUser(contextUser), provider, true, config.coAgentRunStepID ?? null);
         }
         catch (e) {
             LogError(`SessionManager.finalizeObservabilityRuns failed: ${e instanceof Error ? e.message : String(e)}`);

package/dist/agentSessions/SessionManager.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AAExE,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAwChD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,cAAc;IAA3B;QACI,qFAAqF;QAC7E,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAwb3D,CAAC;IAtbG;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,IAAI,4BAA4B,EAAE,CAAC,kBAAkB,CACvD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,WAAW,EACX,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,sGAAsG;IAC9F,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;YAC5D,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}
1	+ {"version":3,"file":"SessionManager.js","sourceRoot":"","sources":["../../src/agentSessions/SessionManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAMtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAC;AAE1F,iGAAiG;AACjG,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B,CAAC;AAC/D,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAwChD;;;;GAIG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAChD,YAAY,OAAe;QACvB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC5C,CAAC;CACJ;AAED;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,KAAK,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,cAAc;IAA3B;QACI,qFAAqF;QAC7E,uBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IA4b3D,CAAC;IA1bG;;;;;;;;;OASG;IACI,KAAK,CAAC,aAAa,CACtB,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAEpD,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc;eACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,kCAAkC,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,YAAY,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,cAAkC,UAAU,EAC5C,iBAAmD;QAEnD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC;QAE7D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,mFAAmF;YACnF,mFAAmF;YACnF,8EAA8E;YAC9E,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;YAC1F,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACxF,MAAM,IAAI,CAAC,yBAAyB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACrE,MAAM,IAAI,CAAC,iCAAiC,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1E,8FAA8F;QAC9F,kGAAkG;QAClG,sFAAsF;QACtF,MAAM,0BAA0B,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,kCAAkC,CAC5C,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CACrD;gBACI,cAAc,EAAE,OAAO,CAAC,EAAE;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,IAAI;gBAC9C,mFAAmF;gBACnF,gFAAgF;gBAChF,kBAAkB,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aAC9C,EACD,WAAW,EACX,QAAQ,CACX,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,6DAA6D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,iCAAiC,CAC3C,cAAsB,EACtB,WAAsC;QAEtC,IAAI,CAAC;YACD,MAAM,yBAAyB,CAAC,QAAQ,CAAC,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC1F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,4DAA4D,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvH,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,yBAAyB,CACnC,OAA+B,EAC/B,WAAqB,EACrB,QAA2B;QAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC1E,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,wFAAwF;YACxF,uFAAuF;YACvF,uFAAuF;YACvF,+EAA+E;YAC/E,MAAM,IAAI,4BAA4B,EAAE,CAAC,kBAAkB,CACvD,MAAM,CAAC,YAAY,IAAI,IAAI,EAC3B,MAAM,CAAC,WAAW,IAAI,IAAI,EAC1B,6BAA6B,CAAC,WAAW,CAAC,EAC1C,QAAQ,EACR,IAAI,EACJ,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAClC,CAAC;QACN,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,QAAQ,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;IACL,CAAC;IAED,sGAAsG;IAC9F,qBAAqB,CAAC,GAAkB;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA8B,CAAC;YAC5D,OAAO;gBACH,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS;gBACvF,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;gBACpF,gBAAgB,EAAE,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;aACtG,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,SAAS,CAClB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,GAAG,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAC,CAAC,qCAAqC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,QAAQ,CACjB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,mCAAmC;QACpD,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,4FAA4F;IAE5F,0FAA0F;IAClF,KAAK,CAAC,YAAY,CAAC,OAAe,EAAE,WAAqB;QAC7D,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;QACxF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,yBAAyB,CAC/B,QAAQ,WAAW,CAAC,KAAK,iDAAiD,OAAO,EAAE,CACtF,CAAC;QACN,CAAC;IACL,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,kBAAkB,CAC5B,KAAyB,EACzB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAuB,mBAAmB,EAAE,WAAW,CAAC,CAAC;QAC5G,YAAY,CAAC,SAAS,EAAE,CAAC;QACzB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACnC,YAAY,CAAC,IAAI,GAAG,eAAe,CAAC;QACpC,yFAAyF;QACzF,2FAA2F;QAC3F,sFAAsF;QACtF,qFAAqF;QACrF,4FAA4F;QAC5F,IAAI,WAAW,CAAC,cAAc,EAAE,UAAU,EAAE,CAAC;YACzC,YAAY,CAAC,UAAU,GAAG,WAAW,CAAC,cAAc,CAAC,UAAU,CAAC;QACpE,CAAC;QAED,gGAAgG;QAChG,oGAAoG;QACpG,gGAAgG;QAChG,gGAAgG;QAChG,kGAAkG;QAClG,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;YACtB,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;gBAC7B,YAAY,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;YACjE,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBACnD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;gBACrD,YAAY,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YACzD,CAAC;QACL,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oDAAoD,YAAY,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CACtH,CAAC;QACN,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,iBAAiB,CAC3B,KAAyB,EACzB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;QAChC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,cAAc,CAAC;QACxC,OAAO,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;QACpD,OAAO,CAAC,cAAc,GAAG,iBAAiB,EAAE,CAAC;QAC7C,OAAO,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;QACvC,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,gGAAgG;QAChG,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,OAAO,GAAG,WAAW,CAAC,uBAAuB,CAAC;QACpD,IAAI,OAAO,EAAE,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YACpD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;YAChD,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAChG,CAAC;QACN,CAAC;QACD,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,WAAW,CACrB,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAyB,cAAc,EAAE,WAAW,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,iBAAiB,CAC3B,OAA+B,EAC/B,WAA+B;QAE/B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;QAClC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,qGAAqG;IAC7F,KAAK,CAAC,kBAAkB,CAC5B,cAAsB,EACtB,WAAqB,EACrB,QAA2B,EAC3B,iBAAmD;QAEnD,wFAAwF;QACxF,0FAA0F;QAC1F,uFAAuF;QACvF,gFAAgF;QAChF,MAAM,QAAQ,GAAG,iBAAiB;eAC3B,MAAM,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,cAAc,GAAG,GAAG,CAAC;YAC7B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,kBAAkB,CAC5B,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAgC;YAC3D,UAAU,EAAE,sBAAsB;YAClC,WAAW,EAAE,sBAAsB,MAAM,gCAAgC;YACzE,UAAU,EAAE,eAAe;SAC9B,EAAE,WAAW,CAAC,CAAC;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAClB,QAAQ,CAAC,8DAA8D,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,CAAC;QACd,CAAC;QACD,OAAO,MAAM,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,2BAA2B,CACpC,UAAoB,EACpB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2C,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,IAAI,EAAE,CAAC;gBACP,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACJ,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAClC,CAAC;QACL,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,8FAA8F;IACtF,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,+BAA+B,CAAC;IAClF,CAAC;IAED;;;;OAIG;IACK,gBAAgB,CAAC,GAAW,EAAE,SAA4B;QAC9D,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,CAAC;IAED,mGAAmG;IAC3F,KAAK,CAAC,gBAAgB,CAC1B,cAAsB,EACtB,WAAqB,EACrB,QAA2B;QAE3B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,CAAC,YAAY,GAAG,IAAI,IAAI,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,CAAC;YACR,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,8FAA8F;IACtF,KAAK,CAAC,SAAS,CACnB,MAA8D,EAC9D,EAAU;QAEV,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,QAAQ,CAAC,kBAAkB,EAAE,iBAAiB,MAAM,CAAC,YAAY,EAAE,eAAe,IAAI,eAAe,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ"}

package/dist/realtimeWidget/widgetGuestElevation.d.ts CHANGED Viewed

@@ -42,6 +42,28 @@ export interface WidgetGuestRunContext {
  * so the caller falls back to the normal (guest-principal) path rather than failing the request.
  */
 export declare function resolveWidgetGuestRunContext(userPayload: UserPayload, provider: DatabaseProviderBase): Promise<WidgetGuestRunContext | null>;
+/**
+ * Returns the identity a realtime session's AI-RUN-ENTITY work (delegated tool dispatch +
+ * observability run creation/append/finalize) should execute as: the trusted SYSTEM principal when
+ * the caller is a SCOPED anonymous magic-link session, else the caller unchanged (issue #3371).
+ *
+ * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
+ * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
+ * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
+ * required: on the realtime path the agent authority is already server-side (the session config's
+ * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ *
+ * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
+ * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter
+ * depends on — elevating them here would silently break that read-side control.
+ *
+ * Fails CLOSED: when no system user is available the caller is returned unchanged, so the request
+ * fails exactly as it would today rather than proceeding unelevated-but-assumed-elevated.
+ *
+ * Ownership/RLS gates must NEVER use this — they stay on the caller; this only changes who the
+ * work RUNS AS after ownership is proven.
+ */
+export declare function ResolveScopedAnonymousRunUser(contextUser: UserInfo): UserInfo;
 /**
  * Builds an elevated {@link UserPayload} that runs subsequent agent work as `elevatedUser` while
  * preserving the guest's `sessionId` — so progress/streaming PubSub still routes to the guest's

package/dist/realtimeWidget/widgetGuestElevation.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG"}
1	+ {"version":3,"file":"widgetGuestElevation.d.ts","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAqB,KAAK,QAAQ,EAAE,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,+BAA+B,CAAC;AAExF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/C;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,mGAAmG;IACnG,YAAY,EAAE,QAAQ,CAAC;IACvB,gFAAgF;IAChF,MAAM,EAAE,kCAAkC,CAAC;IAC3C,+FAA+F;IAC/F,aAAa,EAAE,MAAM,CAAC;IACtB,2GAA2G;IAC3G,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,CAChD,WAAW,EAAE,WAAW,EACxB,QAAQ,EAAE,oBAAoB,GAC7B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,6BAA6B,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAkB7E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,GAAG,WAAW,CAOhG"}

package/dist/realtimeWidget/widgetGuestElevation.js CHANGED Viewed

@@ -48,6 +48,42 @@ export async function resolveWidgetGuestRunContext(userPayload, provider) {
         sessionScopeId: guest.MagicLinkScope?.ResourceID,
     };
 }
+/**
+ * Returns the identity a realtime session's AI-RUN-ENTITY work (delegated tool dispatch +
+ * observability run creation/append/finalize) should execute as: the trusted SYSTEM principal when
+ * the caller is a SCOPED anonymous magic-link session, else the caller unchanged (issue #3371).
+ *
+ * A scoped anonymous session (`IsMagicLinkAnonymous` + `MagicLinkScope.ResourceID`) holds only the
+ * narrow relay grants its invite's role carries — deliberately NOT the AI run entities, whose rows
+ * leak the rendered system prompt. Unlike {@link resolveWidgetGuestRunContext} no widget instance is
+ * required: on the realtime path the agent authority is already server-side (the session config's
+ * `targetAgentID`, `CanRun`-gated at session start), so there is no client-supplied agent id to pin.
+ *
+ * PUBLIC WEB-WIDGET guests are deliberately EXCLUDED (returned unchanged): their seeded role writes
+ * run rows under the guest principal, which the `Widget Guest: Own Agent Runs` RLS read filter
+ * depends on — elevating them here would silently break that read-side control.
+ *
+ * Fails CLOSED: when no system user is available the caller is returned unchanged, so the request
+ * fails exactly as it would today rather than proceeding unelevated-but-assumed-elevated.
+ *
+ * Ownership/RLS gates must NEVER use this — they stay on the caller; this only changes who the
+ * work RUNS AS after ownership is proven.
+ */
+export function ResolveScopedAnonymousRunUser(contextUser) {
+    const scopeId = contextUser?.MagicLinkScope?.ResourceID;
+    if (!contextUser?.IsMagicLinkAnonymous || !scopeId || contextUser.WidgetGuestContext?.WidgetID) {
+        return contextUser;
+    }
+    const systemUser = UserCache.Instance.GetSystemUser();
+    if (!systemUser) {
+        LogError('[Realtime] Cannot elevate scoped-anonymous run work: no system user available; ' +
+            `falling back to the anonymous caller for scope ${scopeId}.`);
+        return contextUser;
+    }
+    // Deliberately silent on success — callers include per-utterance/per-usage-delta relays, so a
+    // per-call log line would flood a live session's log. The dispatch path logs the elevation once.
+    return systemUser;
+}
 /**
  * Builds an elevated {@link UserPayload} that runs subsequent agent work as `elevatedUser` while
  * preserving the guest's `sessionId` — so progress/streaming PubSub still routes to the guest's

package/dist/realtimeWidget/widgetGuestElevation.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGnE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}
1	+ {"version":3,"file":"widgetGuestElevation.js","sourceRoot":"","sources":["../../src/realtimeWidget/widgetGuestElevation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAA4C,MAAM,sBAAsB,CAAC;AAEnG,OAAO,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAGnE,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAmB1D;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,WAAwB,EACxB,QAA8B;IAE9B,MAAM,KAAK,GAAG,WAAW,EAAE,UAAkC,CAAC;IAC9D,MAAM,QAAQ,GAAG,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC;IACrD,IAAI,CAAC,KAAK,EAAE,oBAAoB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACxD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,QAAQ,CAAC,2EAA2E,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,4BAA4B,QAAQ,mDAAmD,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,YAAY;QACZ,MAAM;QACN,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU;KACjD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,6BAA6B,CAAC,WAAqB;IACjE,MAAM,OAAO,GAAG,WAAW,EAAE,cAAc,EAAE,UAAU,CAAC;IACxD,IAAI,CAAC,WAAW,EAAE,oBAAoB,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,kBAAkB,EAAE,QAAQ,EAAE,CAAC;QAC/F,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,QAAQ,CACN,iFAAiF;YAC/E,kDAAkD,OAAO,GAAG,CAC/D,CAAC;QACF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,8FAA8F;IAC9F,iGAAiG;IACjG,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAwB,EAAE,YAAsB;IACjF,OAAO;QACL,GAAG,WAAW;QACd,KAAK,EAAE,YAAY,CAAC,KAAK;QACzB,UAAU,EAAE,YAAY;QACxB,YAAY,EAAE,IAAI;KACnB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,KAAK,UAAU,cAAc,CAC3B,QAAgB,EAChB,YAAsB,EACtB,QAA8B;IAE9B,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAC7B;QACE,UAAU,EAAE,aAAa;QACzB,WAAW,EAAE,SAAS,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;QACrD,OAAO,EAAE,CAAC;QACV,UAAU,EAAE,eAAe;KAC5B,EACD,YAAY,CACb,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,QAAQ,CAAC,2CAA2C,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACrC,CAAC"}

package/dist/resolvers/RealtimeClientSessionResolver.d.ts CHANGED Viewed

@@ -394,6 +394,27 @@ export declare class RealtimeClientSessionResolver extends ResolverBase {
      * caller must be able to run the **target** agent. Denial throws (no session is created).
      */
     private assertCanRunTarget;
+    /**
+     * Narrows a session's colleague union (`allowedAgents`) to the agents the CALLER may run.
+     *
+     * {@link assertCanRunTarget} gates the LEAD target at session start, but the union it travels
+     * with was never gated at all — a model-named colleague resolves straight to a delegated run.
+     * That was survivable while the run carried the caller's own identity, because base-agent
+     * re-checks `CanRun` against `contextUser`. Once the run user is elevated for a scoped anonymous
+     * caller (issue #3371) that check sees the SYSTEM user, so this is the only remaining place the
+     * caller's own authority is applied to a colleague. It therefore runs for EVERY caller, elevated
+     * or not — the authorization identity must never depend on the elevation decision.
+     *
+     * `HasPermission` reads AIEngineBase's in-memory caches (no DB round trip) and already fails
+     * closed on error, so an unresolvable agent drops OUT of the union rather than becoming runnable.
+     * A filtered-out colleague is not an error: the delegation layer reports it as "not available in
+     * this session" and lists what remains, which is the same answer the model gets for a typo.
+     *
+     * @param allowedAgents The session's persisted colleague union (absent/empty ⇒ single-target).
+     * @param contextUser The ORIGINAL caller — never the elevated run user.
+     * @returns The subset the caller may run, preserving order.
+     */
+    private filterAllowedAgentsByCanRun;
     /**
      * Resolves the AUTHORITATIVE target agent id under the co-agent's PAIRING CONSTRAINTS
      * (`MJ: AI Agent Co Agents`, ordered by `Sequence`):

package/dist/resolvers/RealtimeClientSessionResolver.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"RealtimeClientSessionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/RealtimeClientSessionResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAuE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjH,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AA+BtD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAqI1D;;;GAGG;AACH,qBACa,gCAAgC;IACzC,uDAAuD;IAEvD,cAAc,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IAEvF,cAAc,EAAE,MAAM,CAAC;IAEvB,iEAAiE;IAEjE,QAAQ,EAAE,MAAM,CAAC;IAEjB,qFAAqF;IAErF,KAAK,EAAE,MAAM,CAAC;IAEd,0FAA0F;IAE1F,cAAc,EAAE,MAAM,CAAC;IAEvB,mGAAmG;IAEnG,SAAS,EAAE,MAAM,CAAC;IAElB,sFAAsF;IAEtF,iBAAiB,EAAE,MAAM,CAAC;IAE1B,sGAAsG;IAEtG,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IAEH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;OAMG;IAEH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IAEH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;OAMG;IAEH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,qBACa,gCAAgC;IACzC,kEAAkE;IAElE,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,gGAAgG;IAEhG,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,kFAAkF;IAElF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;OAKG;IAEH,wBAAwB,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,qBACa,+BAA+B;IACxC;;;OAGG;IAEH,YAAY,EAAE,MAAM,CAAC;IAErB,oFAAoF;IAEpF,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBACa,6BAA6B;IACtC,0FAA0F;IAE1F,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,yFAAyF;IAEzF,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,qBACa,6BAA8B,SAAQ,YAAY;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAsC;IAE3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IAEG,0BAA0B,CAC4B,aAAa,EAAE,MAAM,GAAG,SAAS,EAClF,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACY,cAAc,CAAC,EAAE,MAAM,EACxB,aAAa,CAAC,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,EAC1B,eAAe,CAAC,EAAE,MAAM,EAC9B,SAAS,CAAC,EAAE,MAAM,EACR,mBAAmB,CAAC,EAAE,MAAM,EAC7B,kBAAkB,CAAC,EAAE,MAAM,EAC5B,gBAAgB,CAAC,EAAE,OAAO,EAC1B,iBAAiB,CAAC,EAAE,MAAM,EAC9B,aAAa,CAAC,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,MAAM,GACjF,OAAO,CAAC,gCAAgC,CAAC;IAmE5C;;;;;;;;OAQG;IAEG,0BAA0B,CACS,cAAc,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EACxC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACnC,MAAM,EAAE,YAAY,GAC/B,OAAO,CAAC,MAAM,CAAC;~~IAmClB~~;;;;;;OAMG;IACH,OAAO,CAAC,+BAA+B;IAyBvC;;;;;OAKG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAChC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACe,gBAAgB,CAAC,EAAE,OAAO,EAC9B,gBAAgB,CAAC,EAAE,MAAM,EAC3B,cAAc,CAAC,EAAE,MAAM,GAC9E,OAAO,CAAC,OAAO,CAAC;~~IA2BnB~~;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EACxC,GAAG,EAAE,UAAU,EAC4B,UAAU,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACnB,KAAK,CAAC,EAAE,MAAM,EAAE,GAClE,OAAO,CAAC,6BAA6B,CAAC;~~IAuDzC~~;;;;;;;;;;;;;OAaG;IAEG,8BAA8B,CACK,cAAc,EAAE,MAAM,EAC3B,YAAY,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EACxC,GAAG,EAAE,UAAU,GACvB,OAAO,CAAC,OAAO,CAAC;~~IA8BnB~~;;;;;;;OAOG;IAEG,qBAAqB,CACc,cAAc,EAAE,MAAM,EAC5B,QAAQ,EAAE,MAAM,EACxC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACM,QAAQ,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GACzE,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;;;OAkBG;IAEG,yBAAyB,CACU,cAAc,EAAE,MAAM,EACpD,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACI,MAAM,CAAC,EAAE,MAAM,GACjE,OAAO,CAAC,+BAA+B,CAAC;IAa3C;;;;;;;;;;;;;;;;;;;OAmBG;IAEG,kBAAkB,CACiB,cAAc,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EAC7C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,OAAO,CAAC;~~IAmBnB~~,2EAA2E;IAC3E,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;;;;;;;;;;;;;;;OAoBG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EAC1C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,OAAO,CAAC;IAqBnB;;;;;;OAMG;YACW,wBAAwB;IAoBtC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAEG,0BAA0B,CACS,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,EACL,WAAW,EAAE,MAAM,EAC9C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,gCAAgC,CAAC;IA4B5C,iGAAiG;IACjG,OAAO,CAAC,sBAAsB;IAW9B;;;OAGG;YACW,kBAAkB;IAahC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,+BAA+B;IAwC7C;;;;;;;;;OASG;YACW,eAAe;IAwB7B;;;;;OAKG;YACW,sBAAsB;IAMpC;;;;;;;;;;;;OAYG;YACW,gCAAgC;IA2B9C;;;;OAIG;IACH,OAAO,CAAC,8BAA8B;IActC;;;;;;;;OAQG;IACH,OAAO,CAAC,+BAA+B;IAiBvC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAuBtC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,gBAAgB;IAiD9B;;;;;;;OAOG;YACW,wBAAwB;IA0BtC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmB9B,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;OASG;YACW,2BAA2B;~~IAwEzC~~;;;;;OAKG;YACW,0BAA0B;IA8BxC;;;OAGG;YACW,sBAAsB;IAYpC;;;;OAIG;YACW,gBAAgB;IAmB9B;;;;;;;OAOG;YACW,gBAAgB;IA2B9B;;;;OAIG;YACW,yBAAyB;IAuCvC;;;;;;;;;;;;;OAaG;YACW,0BAA0B;IA8CxC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,uBAAuB;IAqCrC;;;OAGG;YACW,wBAAwB;IA8BtC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;;;OAIG;YACW,+BAA+B;IA0B7C;;;;;OAKG;YACW,qBAAqB;IAwCnC;;;;;;;OAOG;YACW,gCAAgC;IAqB9C;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oCAAoC;IAwBlD;;;OAGG;YACW,yBAAyB;IAsBvC;;;;;OAKG;YACW,+BAA+B;~~IAuB7C~~;;;OAGG;YACW,0BAA0B;IAwBxC;;;;OAIG;YACW,6BAA6B;IAqC3C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAcvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IA8BxB,wHAAwH;IACxH,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA0BzB,0GAA0G;IAC1G,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;OAMG;YACW,4BAA4B;IAS1C;;;;;OAKG;IACH;;;;;;;;OAQG;YACW,mBAAmB;YAsBnB,qBAAqB;IAmCnC;;;;;;OAMG;YACW,6BAA6B;IA2C3C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAG5B"}
1	+ {"version":3,"file":"RealtimeClientSessionResolver.d.ts","sourceRoot":"","sources":["../../src/resolvers/RealtimeClientSessionResolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAuE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjH,OAAO,EAAE,UAAU,EAAe,MAAM,aAAa,CAAC;AA+BtD,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAqI1D;;;GAGG;AACH,qBACa,gCAAgC;IACzC,uDAAuD;IAEvD,cAAc,EAAE,MAAM,CAAC;IAEvB,uFAAuF;IAEvF,cAAc,EAAE,MAAM,CAAC;IAEvB,iEAAiE;IAEjE,QAAQ,EAAE,MAAM,CAAC;IAEjB,qFAAqF;IAErF,KAAK,EAAE,MAAM,CAAC;IAEd,0FAA0F;IAE1F,cAAc,EAAE,MAAM,CAAC;IAEvB,mGAAmG;IAEnG,SAAS,EAAE,MAAM,CAAC;IAElB,sFAAsF;IAEtF,iBAAiB,EAAE,MAAM,CAAC;IAE1B,sGAAsG;IAEtG,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;;OAIG;IAEH,6BAA6B,CAAC,EAAE,MAAM,CAAC;IAEvC;;;;;;OAMG;IAEH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAEhC;;;;;OAKG;IAEH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;OAMG;IAEH,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;GAGG;AACH,qBACa,gCAAgC;IACzC,kEAAkE;IAElE,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,gGAAgG;IAEhG,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,kFAAkF;IAElF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;OAKG;IAEH,wBAAwB,EAAE,OAAO,CAAC;CACrC;AAED;;;;;GAKG;AACH,qBACa,+BAA+B;IACxC;;;OAGG;IAEH,YAAY,EAAE,MAAM,CAAC;IAErB,oFAAoF;IAEpF,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,qBACa,6BAA6B;IACtC,0FAA0F;IAE1F,OAAO,EAAE,OAAO,CAAC;IAEjB,sDAAsD;IAEtD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,yFAAyF;IAEzF,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,qBACa,6BAA8B,SAAQ,YAAY;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAsC;IAE3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAsCG;IAEG,0BAA0B,CAC4B,aAAa,EAAE,MAAM,GAAG,SAAS,EAClF,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACY,cAAc,CAAC,EAAE,MAAM,EACxB,aAAa,CAAC,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,EAC1B,eAAe,CAAC,EAAE,MAAM,EAC9B,SAAS,CAAC,EAAE,MAAM,EACR,mBAAmB,CAAC,EAAE,MAAM,EAC7B,kBAAkB,CAAC,EAAE,MAAM,EAC5B,gBAAgB,CAAC,EAAE,OAAO,EAC1B,iBAAiB,CAAC,EAAE,MAAM,EAC9B,aAAa,CAAC,EAAE,MAAM,EACrB,cAAc,CAAC,EAAE,MAAM,GACjF,OAAO,CAAC,gCAAgC,CAAC;IAmE5C;;;;;;;;OAQG;IAEG,0BAA0B,CACS,cAAc,EAAE,MAAM,EAC9B,MAAM,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EACxC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACnC,MAAM,EAAE,YAAY,GAC/B,OAAO,CAAC,MAAM,CAAC;IAmDlB;;;;;;OAMG;IACH,OAAO,CAAC,+BAA+B;IAyBvC;;;;;OAKG;YACW,0BAA0B;IA4BxC;;;;;;;;;;;;OAYG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EAChC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACe,gBAAgB,CAAC,EAAE,OAAO,EAC9B,gBAAgB,CAAC,EAAE,MAAM,EAC3B,cAAc,CAAC,EAAE,MAAM,GAC9E,OAAO,CAAC,OAAO,CAAC;IA6BnB;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAInC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EACxC,GAAG,EAAE,UAAU,EAC4B,UAAU,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,OAAO,EACnB,KAAK,CAAC,EAAE,MAAM,EAAE,GAClE,OAAO,CAAC,6BAA6B,CAAC;IA4DzC;;;;;;;;;;;;;OAaG;IAEG,8BAA8B,CACK,cAAc,EAAE,MAAM,EAC3B,YAAY,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EACxC,GAAG,EAAE,UAAU,GACvB,OAAO,CAAC,OAAO,CAAC;IAgCnB;;;;;;;OAOG;IAEG,qBAAqB,CACc,cAAc,EAAE,MAAM,EAC5B,QAAQ,EAAE,MAAM,EACxC,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACM,QAAQ,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,MAAM,GACzE,OAAO,CAAC,OAAO,CAAC;IAiBnB;;;OAGG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;;;OAkBG;IAEG,yBAAyB,CACU,cAAc,EAAE,MAAM,EACpD,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EACI,MAAM,CAAC,EAAE,MAAM,GACjE,OAAO,CAAC,+BAA+B,CAAC;IAa3C;;;;;;;;;;;;;;;;;;;OAmBG;IAEG,kBAAkB,CACiB,cAAc,EAAE,MAAM,EAC5B,WAAW,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EAC7C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,OAAO,CAAC;IAsBnB,2EAA2E;IAC3E,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACH,OAAO,CAAC,aAAa;IAYrB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;;;;;;;;;;;;;;;OAoBG;IAEG,uBAAuB,CACY,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EAC1C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,OAAO,CAAC;IAqBnB;;;;;;OAMG;YACW,wBAAwB;IAoBtC;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAEG,0BAA0B,CACS,cAAc,EAAE,MAAM,EACzB,WAAW,EAAE,MAAM,EAC1B,IAAI,EAAE,MAAM,EACL,WAAW,EAAE,MAAM,EAC9C,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,GAC9C,OAAO,CAAC,gCAAgC,CAAC;IA4B5C,iGAAiG;IACjG,OAAO,CAAC,sBAAsB;IAW9B;;;OAGG;YACW,kBAAkB;IAahC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,2BAA2B;IAazC;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,+BAA+B;IAwC7C;;;;;;;;;OASG;YACW,eAAe;IAwB7B;;;;;OAKG;YACW,sBAAsB;IAMpC;;;;;;;;;;;;OAYG;YACW,gCAAgC;IA2B9C;;;;OAIG;IACH,OAAO,CAAC,8BAA8B;IActC;;;;;;;;OAQG;IACH,OAAO,CAAC,+BAA+B;IAiBvC;;;;;OAKG;IACH,OAAO,CAAC,8BAA8B;IAuBtC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,gBAAgB;IAiD9B;;;;;;;OAOG;YACW,wBAAwB;IA0BtC;;;;;OAKG;IACH,OAAO,CAAC,sBAAsB;IAe9B;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAoBxB;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB;IAmB9B,4FAA4F;IAC5F,OAAO,CAAC,eAAe;IAKvB;;;;;;;;;OASG;YACW,2BAA2B;IA6EzC;;;;;OAKG;YACW,0BAA0B;IA8BxC;;;OAGG;YACW,sBAAsB;IAYpC;;;;OAIG;YACW,gBAAgB;IAmB9B;;;;;;;OAOG;YACW,gBAAgB;IA2B9B;;;;OAIG;YACW,yBAAyB;IAuCvC;;;;;;;;;;;;;OAaG;YACW,0BAA0B;IA8CxC;;;;;;;;;;;;;;;;;;;OAmBG;YACW,mBAAmB;IAwBjC;;;;OAIG;YACW,uBAAuB;IAqCrC;;;OAGG;YACW,wBAAwB;IA8BtC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IAW1B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAuB5B;;;;OAIG;YACW,+BAA+B;IA0B7C;;;;;OAKG;YACW,qBAAqB;IAwCnC;;;;;;;OAOG;YACW,gCAAgC;IAqB9C;;;;;;;;;;;;;;;;;;;;OAoBG;YACW,oCAAoC;IAwBlD;;;OAGG;YACW,yBAAyB;IAsBvC;;;;;OAKG;YACW,+BAA+B;IAyB7C;;;OAGG;YACW,0BAA0B;IAwBxC;;;;OAIG;YACW,6BAA6B;IAqC3C;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAcvB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,gBAAgB;IA8BxB,wHAAwH;IACxH,OAAO,CAAC,iBAAiB;IAYzB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IA0BzB,0GAA0G;IAC1G,OAAO,CAAC,oBAAoB;IAQ5B;;;;;;OAMG;YACW,4BAA4B;IAS1C;;;;;OAKG;IACH;;;;;;;;OAQG;YACW,mBAAmB;YAsBnB,qBAAqB;IAmCnC;;;;;;OAMG;YACW,6BAA6B;IA2C3C;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;CAG5B"}

package/dist/resolvers/RealtimeClientSessionResolver.js CHANGED Viewed

@@ -46,7 +46,7 @@ import { ResolverBase } from '../generic/ResolverBase.js';
 import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { GetReadWriteProvider } from '../util.js';
 import { SessionManager } from '../agentSessions/index.js';
-import { resolveWidgetGuestRunContext } from '../realtimeWidget/widgetGuestElevation.js';
+import { resolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 /**
  * Progress steps worth narrating to the realtime model — mirrors the normal agent-run path's filter
  * in {@link import('./RunAIAgentResolver.js').RunAIAgentResolver}. Initialization/validation/finalization
@@ -364,25 +364,39 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
         const config = this.readSessionConfig(session);
+        // SCOPED-ANONYMOUS ELEVATION (issue #3371): once ownership is proven above, the delegated
+        // run + its AI-run-entity writes execute as the system user for a scoped anonymous caller
+        // (the caller's role deliberately holds no grants on the run entities). The lead
+        // targetAgentID comes from the session config and was CanRun-gated at start; the colleague
+        // union is gated just below, against the CALLER, so elevation never widens agent authority.
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        if (runUser !== contextUser) {
+            LogStatus(`ExecuteRealtimeSessionTool: dispatching relayed tool '${toolName}' for session ${agentSessionId} ` +
+                'under the system user (scoped-anonymous caller).');
+        }
         const { ResultJson, PausedRunID, Artifacts } = await this.clientSessionService.ExecuteRelayedTool({
             AgentSessionID: agentSessionId,
             TargetAgentID: config.targetAgentID,
             // Multi-target (Move 4): the session's persisted allowed-agent union — a model-named
             // colleague in the call is validated against this; absent ⇒ single-target behavior.
-            AllowedAgents: config.allowedAgents,
+            AllowedAgents: await this.filterAllowedAgentsByCanRun(config.allowedAgents, contextUser),
+            // Attribution follows the VISITOR even when `runUser` is elevated: the delegated run
+            // row and its context-memory scope must stay the person's, not the system user's.
+            AttributionUserID: contextUser.ID,
             // Nest the delegated target-agent run under the co-agent observability run (when present).
             ParentRunID: config.coAgentRunID,
             Call: { CallID: callId, ToolName: toolName, Arguments: argsJson },
             OnProgress: this.buildDelegationProgressCallback(pubSub, userPayload, agentSessionId, callId),
             // Resume a previously-paused delegated run (if any) with the user's answer.
             ResumeRunID: config.pendingFeedbackRunID,
-        }, contextUser, provider);
+        }, runUser, provider);
         // Roll the paused-run id forward in the session config: clear the one we just consumed, and
         // store a new one only if the (resumed or fresh) run paused again awaiting feedback.
         await this.updatePendingFeedbackRunID(session, config, PausedRunID);
         // Junction-link any artifacts the delegated run produced into the session's conversation
         // history (best-effort) — so chat, session review, and resume carryover can all see them.
-        await this.linkDelegatedArtifactsToConversation(session, Artifacts, contextUser, provider);
+        // Runs as `runUser`: the junction entity is not among an anonymous caller's relay grants.
+        await this.linkDelegatedArtifactsToConversation(session, Artifacts, runUser, provider);
         await this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
         return ResultJson;
     }
@@ -463,9 +477,11 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         }
         // Mirror the turn onto the co-agent's long-lived prompt run so its Messages capture the full
         // conversation (run-viewer observability parity). Best-effort — never fails the transcript relay.
+        // The prompt-run write runs as the scoped-anonymous elevated user (issue #3371) — the visible
+        // Conversation Detail above deliberately stays on the caller.
         const promptRunID = this.readPromptRunID(session);
         if (promptRunID) {
-            await this.clientSessionService.AppendPromptRunMessage(promptRunID, this.mapTranscriptRoleToChatRole(role), text, replacesPrevious ?? false, contextUser, provider);
+            await this.clientSessionService.AppendPromptRunMessage(promptRunID, this.mapTranscriptRoleToChatRole(role), text, replacesPrevious ?? false, ResolveScopedAnonymousRunUser(contextUser), provider);
         }
         await this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
         return true;
@@ -509,12 +525,17 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         if (consent !== true) {
             return { Success: false, ErrorMessage: 'Recording consent was not granted.' };
         }
+        // SCOPED-ANONYMOUS ELEVATION (issue #3371): past the ownership + consent gates, the store is
+        // server-side plumbing over entities (MJ: AI Agents read, MJ: Files, the file-session link)
+        // the caller's narrow relay role deliberately does not hold. Attribution flows through the
+        // session link, so nothing here depends on the caller's identity.
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
         try {
-            const agent = await provider.GetEntityObject('MJ: AI Agents', contextUser);
+            const agent = await provider.GetEntityObject('MJ: AI Agents', runUser);
             if (!(await agent.Load(session.AgentID))) {
                 return { Success: false, ErrorMessage: `Co-agent ${session.AgentID} for the session could not be loaded.` };
             }
-            const accountID = await resolveRecordingStorageAccountID(agent, contextUser, provider);
+            const accountID = await resolveRecordingStorageAccountID(agent, runUser, provider);
             if (!accountID) {
                 return { Success: false, ErrorMessage: 'No recording storage account is configured for this agent.' };
             }
@@ -529,14 +550,14 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
                 StartedAt: session.RecordingStartedAt ?? new Date(),
                 StorageAccountID: accountID,
                 SessionID: agentSessionId,
-                ContextUser: contextUser,
+                ContextUser: runUser,
                 Provider: provider,
                 // Sanitized capture-time waveform peaks → persisted as a peaks.json sidecar.
                 Peaks: this.sanitizePeaks(peaks),
             });
             // Canonical consolidated file written — drop the crash-recovery shards (best-effort).
             if (fileID) {
-                await deleteRealtimeRecordingSegments(agentSessionId, accountID, contextUser);
+                await deleteRealtimeRecordingSegments(agentSessionId, accountID, runUser);
             }
             return {
                 Success: !!fileID,
@@ -568,11 +589,13 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         try {
             const { contextUser, provider } = this.requireUserAndProvider(ctx.userPayload, ctx.providers);
             const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
-            const agent = await provider.GetEntityObject('MJ: AI Agents', contextUser);
+            // Scoped-anonymous elevation (issue #3371) — same rationale as UploadRealtimeRecording.
+            const runUser = ResolveScopedAnonymousRunUser(contextUser);
+            const agent = await provider.GetEntityObject('MJ: AI Agents', runUser);
             if (!(await agent.Load(session.AgentID))) {
                 return false;
             }
-            const accountID = await resolveRecordingStorageAccountID(agent, contextUser, provider);
+            const accountID = await resolveRecordingStorageAccountID(agent, runUser, provider);
             if (!accountID) {
                 return false;
             }
@@ -586,7 +609,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
                 Audio: buffer,
                 MimeType: mimeType,
                 StorageAccountID: accountID,
-                ContextUser: contextUser,
+                ContextUser: runUser,
             });
         }
         catch (error) {
@@ -609,7 +632,7 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         if (!promptRunID) {
             return false;
         }
-        return this.clientSessionService.AppendPromptRunMessage(promptRunID, 'assistant', this.formatToolTurn(toolName, argsJson, resultJson), false, contextUser, provider);
+        return this.clientSessionService.AppendPromptRunMessage(promptRunID, 'assistant', this.formatToolTurn(toolName, argsJson, resultJson), false, ResolveScopedAnonymousRunUser(contextUser), provider);
     }
     /**
      * Formats a co-agent tool call into a compact, human-readable run line: `🔧 <tool> <args> → <result>`,
@@ -690,7 +713,8 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         }
         // Delegate to the service so usage writes share the per-run serialization with transcript-message
         // appends — otherwise the frequent usage save clobbers freshly-appended Messages (and vice-versa).
-        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, contextUser, provider);
+        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
+        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, ResolveScopedAnonymousRunUser(contextUser), provider);
     }
     /** Clamps a relayed token delta: negative / non-finite values become 0. */
     clampTokenDelta(value) {
@@ -854,6 +878,33 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             throw new Error(`Not authorized: you are not permitted to run the target agent ${targetAgentId}`);
         }
     }
+    /**
+     * Narrows a session's colleague union (`allowedAgents`) to the agents the CALLER may run.
+     *
+     * {@link assertCanRunTarget} gates the LEAD target at session start, but the union it travels
+     * with was never gated at all — a model-named colleague resolves straight to a delegated run.
+     * That was survivable while the run carried the caller's own identity, because base-agent
+     * re-checks `CanRun` against `contextUser`. Once the run user is elevated for a scoped anonymous
+     * caller (issue #3371) that check sees the SYSTEM user, so this is the only remaining place the
+     * caller's own authority is applied to a colleague. It therefore runs for EVERY caller, elevated
+     * or not — the authorization identity must never depend on the elevation decision.
+     *
+     * `HasPermission` reads AIEngineBase's in-memory caches (no DB round trip) and already fails
+     * closed on error, so an unresolvable agent drops OUT of the union rather than becoming runnable.
+     * A filtered-out colleague is not an error: the delegation layer reports it as "not available in
+     * this session" and lists what remains, which is the same answer the model gets for a typo.
+     *
+     * @param allowedAgents The session's persisted colleague union (absent/empty ⇒ single-target).
+     * @param contextUser The ORIGINAL caller — never the elevated run user.
+     * @returns The subset the caller may run, preserving order.
+     */
+    async filterAllowedAgentsByCanRun(allowedAgents, contextUser) {
+        if (!allowedAgents || allowedAgents.length === 0) {
+            return allowedAgents;
+        }
+        const verdicts = await Promise.all(allowedAgents.map((a) => AIAgentPermissionHelper.HasPermission(a.agentId, contextUser, 'run')));
+        return allowedAgents.filter((_, i) => verdicts[i]);
+    }
     /**
      * Resolves the AUTHORITATIVE target agent id under the co-agent's PAIRING CONSTRAINTS
      * (`MJ: AI Agent Co Agents`, ordered by `Sequence`):
@@ -1227,7 +1278,13 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
             // (allowed-agent union); the snapshot is injected into the system prompt at mint.
             ApplicationID: applicationId,
             AppContext: appContext,
-        }, contextUser, provider);
+        },
+        // SCOPED-ANONYMOUS ELEVATION (issue #3371): the prepare creates the co-agent
+        // observability AIAgentRun/AIPromptRun/run-step, which a scoped anonymous caller's role
+        // deliberately cannot write. `UserID` above stays the CALLER's id, so run attribution
+        // and memory scope remain the visitor's. Authorization (CanRun, runtime overrides)
+        // already ran on the caller in StartRealtimeClientSession.
+        ResolveScopedAnonymousRunUser(contextUser), provider);
         if (!prep.Success || !prep.ClientConfig) {
             // Prep failure is an ERROR close, not an explicit user hang-up — stamp it as such.
             await this.sessionManager.CloseSession(session.ID, contextUser, provider, 'Error');
@@ -1693,7 +1750,9 @@ let RealtimeClientSessionResolver = class RealtimeClientSessionResolver extends
         detail.HiddenToUser = true;
         detail.Message = 'Artifacts produced during a realtime session (system anchor).';
         detail.AgentSessionID = session.ID;
-        detail.UserID = contextUser.ID;
+        // Attribute the anchor to the SESSION owner, not the (possibly elevated) writer — identical
+        // for every non-elevated caller, whose ownership of the session is already proven.
+        detail.UserID = session.UserID;
         if (await detail.Save()) {
             return detail.ID;
         }