@memberjunction/server 5.51.2 → 5.51.4

package/src/__tests__/RealtimeClientSessionResolver.configTamper.test.ts

@@ -0,0 +1,318 @@
+/**
+ * A realtime session's `Config` JSON is writable by the session owner: the UI and Widget Guest
+ * roles hold Create/Update on `MJ: AI Agent Sessions`, row-scoped only to their own sessions. These
+ * tests edit `Config` the way such an owner could and check that the relay mutations do not take
+ * authority from it: the target agent is re-authorized for the caller, and run ids are used only
+ * when they are records of the session.
+ */
+// type-graphql decorators on the resolver need the reflect-metadata polyfill loaded first.
+import 'reflect-metadata';
+
+import { describe, it, expect, vi, beforeEach, type Mock } from 'vitest';
+
+const hasPermissionMock = vi.fn(async (_agentID: string, _user?: unknown, _permission?: string): Promise<boolean> => true);
+vi.mock('@memberjunction/ai-engine-base', () => ({
+    AIAgentPermissionHelper: {
+        HasPermission: (agentID: string, user: unknown, permission: string) => hasPermissionMock(agentID, user, permission),
+    },
+    AIEngineBase: {
+        GetProviderInstance: vi.fn(),
+    },
+}));
+
+vi.mock('@memberjunction/aiengine', () => ({
+    AIEngine: {
+        Instance: {
+            Config: vi.fn(async () => undefined),
+            Agents: [],
+            AgentTypes: [],
+        },
+    },
+}));
+
+const executeRelayedToolMock = vi.fn();
+const appendPromptRunMessageMock = vi.fn<RealtimeClientSessionService['AppendPromptRunMessage']>(async () => true);
+const accumulatePromptRunUsageMock = vi.fn<RealtimeClientSessionService['AccumulatePromptRunUsage']>(async () => true);
+vi.mock('@memberjunction/ai-agents', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return {
+        ...actual,
+        RealtimeClientSessionService: class {
+            ExecuteRelayedTool = executeRelayedToolMock;
+            AppendPromptRunMessage = appendPromptRunMessageMock;
+            AccumulatePromptRunUsage = accumulatePromptRunUsageMock;
+        },
+    };
+});
+
+const heartbeatMock = vi.fn(async () => true);
+vi.mock('../agentSessions/index.js', () => ({
+    SessionManager: class {
+        Heartbeat = heartbeatMock;
+    },
+}));
+
+let currentProvider: unknown;
+vi.mock('../util.js', () => ({
+    GetReadWriteProvider: () => currentProvider,
+}));
+
+const getSystemUserMock = vi.fn<() => UserInfo | undefined>();
+vi.mock('@memberjunction/sqlserver-dataprovider', async (importOriginal) => {
+    const actual = await importOriginal<Record<string, unknown>>();
+    return {
+        ...actual,
+        UserCache: {
+            get Instance() {
+                return { GetSystemUser: getSystemUserMock };
+            },
+        },
+    };
+});
+
+import { RealtimeClientSessionResolver } from '../resolvers/RealtimeClientSessionResolver.js';
+import type { AppContext } from '../types.js';
+import { IsPlatformSQL, type RunViewParams, type RunViewResult, type UserInfo } from '@memberjunction/core';
+import type { ExecuteRelayedToolInput, RealtimeClientSessionService } from '@memberjunction/ai-agents';
+import type { PubSubEngine } from 'type-graphql';
+
+const SESSION_ID = 'c3c3c3c3-0000-4000-8000-000000000001';
+const USER_ID = 'c3c3c3c3-0000-4000-8000-000000000002';
+const TARGET_ID = 'c3c3c3c3-0000-4000-8000-000000000003';
+const OTHER_AGENT_ID = 'c3c3c3c3-0000-4000-8000-000000000004';
+const CO_RUN_ID = 'c3c3c3c3-0000-4000-8000-000000000005';
+const PROMPT_RUN_ID = 'c3c3c3c3-0000-4000-8000-000000000006';
+const STEP_ID = 'c3c3c3c3-0000-4000-8000-000000000007';
+const PAUSED_RUN_ID = 'c3c3c3c3-0000-4000-8000-000000000008';
+/** A run that exists, but belongs to someone else's session. */
+const FOREIGN_RUN_ID = 'c3c3c3c3-0000-4000-8000-0000000000f1';
+/** Harmless text that is not a UUID and would change the meaning of a quoted filter. */
+const NOT_A_UUID = "x' OR '1'='1";
+
+const USER = { ID: USER_ID, Email: 'owner@example.com' };
+
+interface FakeEntity {
+    [key: string]: unknown;
+    Save: () => Promise<boolean>;
+    Load: (id: string) => Promise<boolean>;
+    NewRecord: () => void;
+}
+
+/** Rows the fake RunView returns, keyed by entity name. */
+type FakeRows = Record<string, Array<Record<string, unknown>>>;
+
+/** The fake provider's `RunView`: it returns the rows for the requested entity. */
+type FakeRunView = (params: RunViewParams) => Promise<RunViewResult<Record<string, unknown>>>;
+
+function makeSession(config: Record<string, unknown>, overrides: Partial<FakeEntity> = {}): FakeEntity {
+    return {
+        ID: SESSION_ID,
+        Status: 'Active',
+        UserID: USER_ID,
+        ConversationID: 'c3c3c3c3-0000-4000-8000-0000000000c1',
+        Config_: JSON.stringify(config),
+        Save: vi.fn(async () => true),
+        Load: vi.fn(async () => true),
+        NewRecord: vi.fn(),
+        LatestResult: null,
+        ...overrides,
+    };
+}
+
+function makeDetail(): FakeEntity {
+    return { ID: 'c3c3c3c3-0000-4000-8000-0000000000d1', Save: vi.fn(async () => true), Load: vi.fn(async () => true), NewRecord: vi.fn() };
+}
+
+/** A provider serving the session plus view rows per entity name; `runView` records every view run. */
+function makeProvider(session: FakeEntity, rows: FakeRows = {}): { runView: Mock<FakeRunView> } {
+    const runView = vi.fn<FakeRunView>(async (params) => {
+        const results = rows[params.EntityName ?? ''] ?? [];
+        return { Success: true, Results: results, RowCount: results.length, TotalRowCount: results.length, ExecutionTime: 0, ErrorMessage: '' };
+    });
+    currentProvider = {
+        GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Agent Sessions' ? session : makeDetail())),
+        RunView: runView,
+        RunViews: vi.fn(async (paramsList: RunViewParams[]) => Promise.all(paramsList.map((params) => runView(params)))),
+    };
+    return { runView };
+}
+
+/** Rows that make every run id in `ids` a record of this session. */
+function sessionRuns(...ids: string[]): FakeRows {
+    return { 'MJ: AI Agent Runs': ids.map((ID) => ({ ID })) };
+}
+
+function makeResolver(user: object = USER): RealtimeClientSessionResolver {
+    const resolver = new RealtimeClientSessionResolver();
+    (resolver as unknown as { GetUserFromPayload: () => unknown }).GetUserFromPayload = () => user;
+    return resolver;
+}
+
+function makeCtx(): AppContext {
+    return { userPayload: { sessionId: 'c3-pubsub-session' }, providers: [] } as unknown as AppContext;
+}
+
+function makePubSub(): PubSubEngine {
+    return { publish: vi.fn(async () => undefined) } as unknown as PubSubEngine;
+}
+
+function relay(resolver: RealtimeClientSessionResolver): Promise<string> {
+    return relayTool(resolver, 'invoke-target-agent', '{"request":"hi"}');
+}
+
+function relayTool(resolver: RealtimeClientSessionResolver, toolName: string, argsJson = '{}'): Promise<string> {
+    return resolver.ExecuteRealtimeSessionTool(SESSION_ID, 'call-1', toolName, argsJson, makeCtx(), makePubSub());
+}
+
+/** A scoped anonymous magic-link caller: the relay runs its work as the system user. */
+const SCOPED_ANONYMOUS = { ID: USER_ID, Email: 'guest@magic-link.local', IsMagicLinkAnonymous: true, MagicLinkScope: { ResourceID: 'c3-scope' } };
+/** A public web-widget guest: anonymous, but not elevated. */
+const WIDGET_GUEST = { ID: USER_ID, Email: 'guest@widget.local', IsMagicLinkAnonymous: true, WidgetGuestContext: { WidgetID: 'c3c3c3c3-0000-4000-8000-0000000000b1' } };
+/** A resource-scoped magic-link session: a normal role pinned to one shared resource. */
+const RESOURCE_SCOPED = { ID: USER_ID, Email: 'invitee@example.com', MagicLinkScope: { ResourceID: 'c3-shared-resource' } };
+const SYSTEM_USER = { ID: 'c3c3c3c3-0000-4000-8000-0000000000aa', Email: 'system@example.com' } as UserInfo;
+
+function relayInput(): ExecuteRelayedToolInput {
+    return executeRelayedToolMock.mock.calls[0][0] as ExecuteRelayedToolInput;
+}
+
+/** The SQL text of each filter the fake RunView received, with every variant of a platform-specific filter. */
+function issuedFilters(runView: Mock<FakeRunView>): string[] {
+    return runView.mock.calls.map(([params]) => {
+        const filter = params.ExtraFilter;
+        return IsPlatformSQL(filter) ? [filter.default, filter.sqlserver, filter.postgresql].join('\n') : (filter ?? '');
+    });
+}
+
+beforeEach(() => {
+    hasPermissionMock.mockReset();
+    hasPermissionMock.mockImplementation(async () => true);
+    executeRelayedToolMock.mockReset();
+    executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
+    appendPromptRunMessageMock.mockReset();
+    appendPromptRunMessageMock.mockResolvedValue(true);
+    accumulatePromptRunUsageMock.mockReset();
+    accumulatePromptRunUsageMock.mockResolvedValue(true);
+    heartbeatMock.mockClear();
+    getSystemUserMock.mockReset();
+    getSystemUserMock.mockReturnValue(undefined);
+});
+
+describe('ExecuteRealtimeSessionTool — target agent named in Config', () => {
+    it('refuses to relay when the caller cannot run the target agent in the session config', async () => {
+        hasPermissionMock.mockImplementation(async (agentID: string) => agentID !== OTHER_AGENT_ID);
+        makeProvider(makeSession({ targetAgentID: OTHER_AGENT_ID }));
+
+        await expect(relay(makeResolver())).rejects.toThrow(/not authorized/i);
+        expect(executeRelayedToolMock).not.toHaveBeenCalled();
+    });
+
+    it('refuses before elevating a scoped anonymous caller to the system user', async () => {
+        getSystemUserMock.mockReturnValue(SYSTEM_USER);
+        hasPermissionMock.mockImplementation(async (agentID: string) => agentID !== OTHER_AGENT_ID);
+        makeProvider(makeSession({ targetAgentID: OTHER_AGENT_ID }));
+
+        await expect(relay(makeResolver(SCOPED_ANONYMOUS))).rejects.toThrow(/not authorized/i);
+        expect(executeRelayedToolMock).not.toHaveBeenCalled();
+        // CanRun was asked about the caller, never the system user.
+        expect(hasPermissionMock).toHaveBeenCalledWith(OTHER_AGENT_ID, SCOPED_ANONYMOUS, 'run');
+        expect(hasPermissionMock.mock.calls.every(([, user]) => user === SCOPED_ANONYMOUS)).toBe(true);
+    });
+
+    it('relays when the caller can run the target agent', async () => {
+        makeProvider(makeSession({ targetAgentID: TARGET_ID }));
+
+        await expect(relay(makeResolver())).resolves.toBe('{"ok":true}');
+        expect(relayInput().TargetAgentID).toBe(TARGET_ID);
+    });
+});
+
+describe('ExecuteRealtimeSessionTool — run ids in Config', () => {
+    it('drops run ids that are not UUIDs, and never puts them in a filter', async () => {
+        const { runView } = makeProvider(makeSession({ targetAgentID: TARGET_ID, coAgentRunID: NOT_A_UUID, pendingFeedbackRunID: NOT_A_UUID }));
+
+        await relay(makeResolver());
+
+        expect(relayInput().ParentRunID).toBeUndefined();
+        expect(relayInput().ResumeRunID).toBeUndefined();
+        expect(issuedFilters(runView).filter((f) => f.includes(NOT_A_UUID))).toEqual([]);
+    });
+
+    it('drops run ids that are not records of this session', async () => {
+        const { runView } = makeProvider(
+            makeSession({ targetAgentID: TARGET_ID, coAgentRunID: FOREIGN_RUN_ID, pendingFeedbackRunID: FOREIGN_RUN_ID }),
+        );
+
+        await relay(makeResolver());
+
+        expect(relayInput().ParentRunID).toBeUndefined();
+        expect(relayInput().ResumeRunID).toBeUndefined();
+        expect(issuedFilters(runView).some((f) => f.includes(`AgentSessionID='${SESSION_ID}'`))).toBe(true);
+    });
+
+    it('passes run ids that are records of this session', async () => {
+        makeProvider(
+            makeSession({ targetAgentID: TARGET_ID, coAgentRunID: CO_RUN_ID, pendingFeedbackRunID: PAUSED_RUN_ID }),
+            sessionRuns(CO_RUN_ID, PAUSED_RUN_ID),
+        );
+
+        await relay(makeResolver());
+
+        expect(relayInput().ParentRunID).toBe(CO_RUN_ID);
+        expect(relayInput().ResumeRunID).toBe(PAUSED_RUN_ID);
+    });
+
+    it('stops passing run ids that stopped being records of this session since the last relay', async () => {
+        const rows = sessionRuns(CO_RUN_ID, PAUSED_RUN_ID);
+        makeProvider(makeSession({ targetAgentID: TARGET_ID, coAgentRunID: CO_RUN_ID, pendingFeedbackRunID: PAUSED_RUN_ID }), rows);
+        // The delegated run pauses again, so the session config still names it on the next relay.
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true, PausedRunID: PAUSED_RUN_ID });
+        const resolver = makeResolver();
+
+        await relay(resolver);
+        // Both runs are moved to another session between the relays.
+        rows['MJ: AI Agent Runs'] = [];
+        await relay(resolver);
+
+        const [first, second] = executeRelayedToolMock.mock.calls.map(([input]) => input as ExecuteRelayedToolInput);
+        expect(first.ParentRunID).toBe(CO_RUN_ID);
+        expect(first.ResumeRunID).toBe(PAUSED_RUN_ID);
+        expect(second.ParentRunID).toBeUndefined();
+        expect(second.ResumeRunID).toBeUndefined();
+    });
+});
+
+describe('prompt-run mirrors — promptRunID in Config', () => {
+    const PROMPT_STEP_ROWS: FakeRows = {
+        ...sessionRuns(CO_RUN_ID),
+        'MJ: AI Agent Run Steps': [{ ID: STEP_ID, StepType: 'Prompt', TargetLogID: PROMPT_RUN_ID }],
+    };
+
+    it('RelayRealtimeUsage does not write to a prompt run that is not this session\'s', async () => {
+        makeProvider(makeSession({ targetAgentID: TARGET_ID, coAgentRunID: CO_RUN_ID, promptRunID: FOREIGN_RUN_ID }), sessionRuns(CO_RUN_ID));
+
+        const out = await makeResolver().RelayRealtimeUsage(SESSION_ID, 10, 5, makeCtx());
+
+        expect(out).toBe(false);
+        expect(accumulatePromptRunUsageMock).not.toHaveBeenCalled();
+    });
+
+    it('RelayRealtimeTranscript does not append to a prompt run that is not this session\'s', async () => {
+        makeProvider(makeSession({ targetAgentID: TARGET_ID, coAgentRunID: CO_RUN_ID, promptRunID: FOREIGN_RUN_ID }), sessionRuns(CO_RUN_ID));
+
+        const out = await makeResolver().RelayRealtimeTranscript(SESSION_ID, 'User', 'hello', makeCtx());
+
+        expect(out).toBe(true);
+        expect(appendPromptRunMessageMock).not.toHaveBeenCalled();
+    });
+
+    it('RelayRealtimeUsage writes to the prompt run of this session\'s co-agent run', async () => {
+        makeProvider(makeSession({ targetAgentID: TARGET_ID, coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }), PROMPT_STEP_ROWS);
+
+        const out = await makeResolver().RelayRealtimeUsage(SESSION_ID, 10, 5, makeCtx());
+
+        expect(out).toBe(true);
+        expect(accumulatePromptRunUsageMock).toHaveBeenCalledTimes(1);
+        expect(accumulatePromptRunUsageMock.mock.calls[0][0]).toBe(PROMPT_RUN_ID);
+    });
+});

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -227,13 +227,44 @@ function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     };
 }
 
-/** Provider whose GetEntityObject returns a fixed entity per entity name. */
-function makeProvider(factory: (entityName: string) => FakeSession): unknown {
-    return { GetEntityObject: vi.fn(async (name: string) => factory(name)) };
+/** Co-agent observability and paused-run ids, as a voice session's Config holds them. */
+const CO_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000001';
+const PROMPT_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000002';
+const PAUSED_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000003';
+
+/** `RunView`/`RunViews` stubs for a provider. */
+interface RunLookups {
+    RunView: ReturnType<typeof vi.fn>;
+    RunViews: ReturnType<typeof vi.fn>;
+}
+
+/**
+ * Answers the session run-id lookups: each id in `runIDs` is a run of the session, and
+ * `promptRunID` (when given) is the TargetLogID of the co-agent run's Prompt step.
+ */
+function sessionRunLookups(runIDs: string[], promptRunID?: string): RunLookups {
+    const runView = vi.fn(async (params: { EntityName?: string }) => {
+        if (params.EntityName === 'MJ: AI Agent Runs') {
+            return { Success: true, Results: runIDs.map((ID) => ({ ID })) };
+        }
+        if (params.EntityName === 'MJ: AI Agent Run Steps' && promptRunID) {
+            return { Success: true, Results: [{ ID: 'c0c0c0c0-0000-4000-8000-0000000000a1', StepType: 'Prompt', TargetLogID: promptRunID }] };
+        }
+        return { Success: true, Results: [] };
+    });
+    const runViews = vi.fn(async (paramsList: Array<{ EntityName?: string }>) => Promise.all(paramsList.map((params) => runView(params))));
+    return { RunView: runView, RunViews: runViews };
+}
+
+/** Provider whose GetEntityObject returns a fixed entity per entity name, plus optional run-id lookups. */
+function makeProvider(factory: (entityName: string) => FakeSession, lookups?: RunLookups): unknown {
+    return { GetEntityObject: vi.fn(async (name: string) => factory(name)), ...lookups };
 }
 
 beforeEach(() => {
     hasPermissionMock.mockReset();
+    // Callers may run the agents in play unless a test says otherwise; relays re-check CanRun on the target.
+    hasPermissionMock.mockResolvedValue(true);
     engineCoAgentsMock.mockReset();
     engineCoAgentsMock.mockReturnValue([]);
     engineChannelsMock.mockReset();
@@ -670,10 +701,12 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
     });
 
     it('reads the target + co-agent run id from the session config and returns ResultJson', async () => {
-        currentProvider = makeProvider(() =>
-            makeSessionEntity({
-                Config_: JSON.stringify({ targetAgentID: 'target-from-session', coAgentRunID: 'co-run-77' }),
-            }),
+        currentProvider = makeProvider(
+            () =>
+                makeSessionEntity({
+                    Config_: JSON.stringify({ targetAgentID: 'target-from-session', coAgentRunID: CO_RUN_ID }),
+                }),
+            sessionRunLookups([CO_RUN_ID]),
         );
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
         const resolver = makeResolver();
@@ -696,7 +729,7 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
         // Target comes from the session, NOT the client.
         expect(relayArg.TargetAgentID).toBe('target-from-session');
         // Delegated run nests under the co-agent observability run from the session config.
-        expect(relayArg.ParentRunID).toBe('co-run-77');
+        expect(relayArg.ParentRunID).toBe(CO_RUN_ID);
         expect(relayArg.Call).toEqual({ CallID: 'call-1', ToolName: 'invoke-target-agent', Arguments: '{"request":"do it"}' });
         expect(heartbeatMock).toHaveBeenCalledWith('session-1', USER, currentProvider);
     });
@@ -760,9 +793,9 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
     it('consumes pendingFeedbackRunID as ResumeRunID and clears it on the next call', async () => {
         const session = makeSessionEntity({
-            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: 'paused-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: PAUSED_RUN_ID }),
         });
-        currentProvider = makeProvider(() => session);
+        currentProvider = makeProvider(() => session, sessionRunLookups([PAUSED_RUN_ID]));
         // Resumed run completes (no new pause).
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"done":1}', Success: true });
         const resolver = makeResolver();
@@ -771,7 +804,7 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
         // The paused id was passed in to resume the run...
         const relayArg = executeRelayedToolMock.mock.calls[0][0] as { ResumeRunID?: string };
-        expect(relayArg.ResumeRunID).toBe('paused-1');
+        expect(relayArg.ResumeRunID).toBe(PAUSED_RUN_ID);
         // ...and cleared from the session config afterward.
         expect(JSON.parse(session.Config_ as string).pendingFeedbackRunID).toBeUndefined();
         expect(session.Save).toHaveBeenCalled();
@@ -779,16 +812,16 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
     it('re-stores a new pendingFeedbackRunID when a resumed run pauses again', async () => {
         const session = makeSessionEntity({
-            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: 'paused-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: PAUSED_RUN_ID }),
         });
-        currentProvider = makeProvider(() => session);
+        currentProvider = makeProvider(() => session, sessionRunLookups([PAUSED_RUN_ID]));
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":2}', Success: true, PausedRunID: 'paused-2' });
         const resolver = makeResolver();
 
         await resolver.ExecuteRealtimeSessionTool('session-1', 'call-3', 'invoke-target-agent', '{"request":"yes"}', makeCtx(), makePubSub());
 
         const relayArg = executeRelayedToolMock.mock.calls[0][0] as { ResumeRunID?: string };
-        expect(relayArg.ResumeRunID).toBe('paused-1');
+        expect(relayArg.ResumeRunID).toBe(PAUSED_RUN_ID);
         expect(JSON.parse(session.Config_ as string).pendingFeedbackRunID).toBe('paused-2');
     });
 
@@ -2192,10 +2225,11 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
     }): { provider: unknown; promptRun: FakeSession } {
         const session =
             opts.session ??
-            makeSessionEntity({ Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }) });
-        const promptRun = opts.promptRun ?? makeSessionEntity({ ID: 'prompt-run-1', TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
+            makeSessionEntity({ Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }) });
+        const promptRun = opts.promptRun ?? makeSessionEntity({ ID: PROMPT_RUN_ID, TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
         const provider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         return { provider, promptRun };
     }
@@ -2221,7 +2255,7 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
         const ok = await resolver.RelayRealtimeUsage('session-1', 30, 5, makeCtx());
 
         expect(ok).toBe(true);
-        expect(promptRun.Load).toHaveBeenCalledWith('prompt-run-1');
+        expect(promptRun.Load).toHaveBeenCalledWith(PROMPT_RUN_ID);
         expect(promptRun.TokensPrompt).toBe(130);
         expect(promptRun.TokensCompletion).toBe(45);
         expect(promptRun.TokensUsed).toBe(175);
@@ -2318,7 +2352,7 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
         const { provider, promptRun } = makeUsageProvider({
             session: makeSessionEntity({
                 Status: 'Closed',
-                Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+                Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
             }),
         });
         currentProvider = provider;
@@ -2808,11 +2842,12 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
     it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
@@ -2827,9 +2862,9 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
     it('mirrors the transcript turn onto the prompt run as SYSTEM while the Conversation Detail stays the caller', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
         const detail = makeSessionEntity({ ID: 'detail-1' });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => {
@@ -2837,6 +2872,7 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
                 if (name === 'MJ: Conversation Details') return detail;
                 return session;
             }),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
@@ -2853,11 +2889,12 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
     it('records the co-agent tool turn (RelayRealtimeToolTurn) under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
@@ -3070,7 +3107,8 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
 
     it('excludes every colleague when the caller can run none of them', async () => {
         currentProvider = makeProvider(() => makeMultiTargetSession('user-1'));
-        hasPermissionMock.mockResolvedValue(false);
+        // The caller can run the lead target, and none of the colleagues.
+        hasPermissionMock.mockImplementation((...args: unknown[]) => Promise.resolve(args[0] === 'target-1'));
 
         await makeResolver().ExecuteRealtimeSessionTool(
             'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
@@ -3079,7 +3117,7 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
         expect(dispatchedAgentIDs()).toEqual([]);
     });
 
-    it('passes a single-target session through with no permission checks', async () => {
+    it('passes a single-target session through with only the target permission check', async () => {
         currentProvider = makeProvider(() => makeSessionEntity());
         hasPermissionMock.mockResolvedValue(true);
 
@@ -3089,6 +3127,7 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
 
         const input = executeRelayedToolMock.mock.calls[0][0] as { AllowedAgents?: unknown };
         expect(input.AllowedAgents).toBeUndefined();
-        expect(hasPermissionMock).not.toHaveBeenCalled();
+        expect(hasPermissionMock).toHaveBeenCalledTimes(1);
+        expect((hasPermissionMock.mock.calls[0] as unknown[])[0]).toBe('target-1');
     });
 });