@memberjunction/server 6.1.4 → 6.1.6

package/src/__tests__/RealtimeClientSessionResolver.test.ts

@@ -3,7 +3,7 @@
 // bring it in automatically — this line MUST precede any import that pulls in the resolver file.
 import 'reflect-metadata';
 
-import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
 
 // --- Mock CanRun authorization (AIAgentPermissionHelper.HasPermission) plus the
 //     provider-scoped AIEngineBase whose cached metadata serves the resolver's pairing-row
@@ -210,9 +210,23 @@ interface FakeSession {
     NewRecord: () => void;
     Save: () => Promise<boolean>;
     Load: (id: string) => Promise<boolean>;
-    LatestResult?: { CompleteMessage?: string };
+    LatestResult?: { CompleteMessage?: string; Success?: boolean };
+    /** Only set on the fakes exercising `describeSaveFailure`'s "no failure detail recorded" branches. */
+    ResultHistory?: unknown[];
 }
 
+/**
+ * A `console.error` spy shared by the save-failure-log tests (#4791) below. Assigned with
+ * `vi.spyOn(console, 'error').mockImplementation(() => undefined)` inside each test that needs it
+ * — restored here so no test leaks a mocked `console.error` into the ones after it.
+ */
+let errSpy: ReturnType<typeof vi.spyOn> | undefined;
+
+afterEach(() => {
+    errSpy?.mockRestore();
+    errSpy = undefined;
+});
+
 function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     return {
         ID: 'session-1',
@@ -228,13 +242,44 @@ function makeSessionEntity(overrides: Partial<FakeSession> = {}): FakeSession {
     };
 }
 
-/** Provider whose GetEntityObject returns a fixed entity per entity name. */
-function makeProvider(factory: (entityName: string) => FakeSession): unknown {
-    return { GetEntityObject: vi.fn(async (name: string) => factory(name)) };
+/** Co-agent observability and paused-run ids, as a voice session's Config holds them. */
+const CO_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000001';
+const PROMPT_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000002';
+const PAUSED_RUN_ID = 'c0c0c0c0-0000-4000-8000-000000000003';
+
+/** `RunView`/`RunViews` stubs for a provider. */
+interface RunLookups {
+    RunView: ReturnType<typeof vi.fn>;
+    RunViews: ReturnType<typeof vi.fn>;
+}
+
+/**
+ * Answers the session run-id lookups: each id in `runIDs` is a run of the session, and
+ * `promptRunID` (when given) is the TargetLogID of the co-agent run's Prompt step.
+ */
+function sessionRunLookups(runIDs: string[], promptRunID?: string): RunLookups {
+    const runView = vi.fn(async (params: { EntityName?: string }) => {
+        if (params.EntityName === 'MJ: AI Agent Runs') {
+            return { Success: true, Results: runIDs.map((ID) => ({ ID })) };
+        }
+        if (params.EntityName === 'MJ: AI Agent Run Steps' && promptRunID) {
+            return { Success: true, Results: [{ ID: 'c0c0c0c0-0000-4000-8000-0000000000a1', StepType: 'Prompt', TargetLogID: promptRunID }] };
+        }
+        return { Success: true, Results: [] };
+    });
+    const runViews = vi.fn(async (paramsList: Array<{ EntityName?: string }>) => Promise.all(paramsList.map((params) => runView(params))));
+    return { RunView: runView, RunViews: runViews };
+}
+
+/** Provider whose GetEntityObject returns a fixed entity per entity name, plus optional run-id lookups. */
+function makeProvider(factory: (entityName: string) => FakeSession, lookups?: RunLookups): unknown {
+    return { GetEntityObject: vi.fn(async (name: string) => factory(name)), ...lookups };
 }
 
 beforeEach(() => {
     hasPermissionMock.mockReset();
+    // Callers may run the agents in play unless a test says otherwise; relays re-check CanRun on the target.
+    hasPermissionMock.mockResolvedValue(true);
     engineCoAgentsMock.mockReset();
     engineCoAgentsMock.mockReturnValue([]);
     engineChannelsMock.mockReset();
@@ -671,10 +716,12 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
     });
 
     it('reads the target + co-agent run id from the session config and returns ResultJson', async () => {
-        currentProvider = makeProvider(() =>
-            makeSessionEntity({
-                Config_: JSON.stringify({ targetAgentID: 'target-from-session', coAgentRunID: 'co-run-77' }),
-            }),
+        currentProvider = makeProvider(
+            () =>
+                makeSessionEntity({
+                    Config_: JSON.stringify({ targetAgentID: 'target-from-session', coAgentRunID: CO_RUN_ID }),
+                }),
+            sessionRunLookups([CO_RUN_ID]),
         );
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"ok":true}', Success: true });
         const resolver = makeResolver();
@@ -697,7 +744,7 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
         // Target comes from the session, NOT the client.
         expect(relayArg.TargetAgentID).toBe('target-from-session');
         // Delegated run nests under the co-agent observability run from the session config.
-        expect(relayArg.ParentRunID).toBe('co-run-77');
+        expect(relayArg.ParentRunID).toBe(CO_RUN_ID);
         expect(relayArg.Call).toEqual({ CallID: 'call-1', ToolName: 'invoke-target-agent', Arguments: '{"request":"do it"}' });
         expect(heartbeatMock).toHaveBeenCalledWith('session-1', USER, currentProvider);
     });
@@ -761,9 +808,9 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
     it('consumes pendingFeedbackRunID as ResumeRunID and clears it on the next call', async () => {
         const session = makeSessionEntity({
-            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: 'paused-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: PAUSED_RUN_ID }),
         });
-        currentProvider = makeProvider(() => session);
+        currentProvider = makeProvider(() => session, sessionRunLookups([PAUSED_RUN_ID]));
         // Resumed run completes (no new pause).
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"done":1}', Success: true });
         const resolver = makeResolver();
@@ -772,7 +819,7 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
         // The paused id was passed in to resume the run...
         const relayArg = executeRelayedToolMock.mock.calls[0][0] as { ResumeRunID?: string };
-        expect(relayArg.ResumeRunID).toBe('paused-1');
+        expect(relayArg.ResumeRunID).toBe(PAUSED_RUN_ID);
         // ...and cleared from the session config afterward.
         expect(JSON.parse(session.Config_ as string).pendingFeedbackRunID).toBeUndefined();
         expect(session.Save).toHaveBeenCalled();
@@ -780,16 +827,16 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
 
     it('re-stores a new pendingFeedbackRunID when a resumed run pauses again', async () => {
         const session = makeSessionEntity({
-            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: 'paused-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', pendingFeedbackRunID: PAUSED_RUN_ID }),
         });
-        currentProvider = makeProvider(() => session);
+        currentProvider = makeProvider(() => session, sessionRunLookups([PAUSED_RUN_ID]));
         executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":2}', Success: true, PausedRunID: 'paused-2' });
         const resolver = makeResolver();
 
         await resolver.ExecuteRealtimeSessionTool('session-1', 'call-3', 'invoke-target-agent', '{"request":"yes"}', makeCtx(), makePubSub());
 
         const relayArg = executeRelayedToolMock.mock.calls[0][0] as { ResumeRunID?: string };
-        expect(relayArg.ResumeRunID).toBe('paused-1');
+        expect(relayArg.ResumeRunID).toBe(PAUSED_RUN_ID);
         expect(JSON.parse(session.Config_ as string).pendingFeedbackRunID).toBe('paused-2');
     });
 
@@ -848,6 +895,28 @@ describe('RealtimeClientSessionResolver.ExecuteRealtimeSessionTool', () => {
             resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'x', '{}', makeCtx(), makePubSub()),
         ).rejects.toThrow(/no target agent configured/i);
     });
+
+    it('logs the session id and "no failure detail recorded" when updatePendingFeedbackRunID\'s save is refused silently (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const session = makeSessionEntity({
+            Config_: JSON.stringify({ targetAgentID: 'target-1' }),
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeProvider(() => session);
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"q":1}', Success: true, PausedRunID: 'paused-1' });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool('session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub());
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('updatePendingFeedbackRunID'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('session-1');
+        expect(failureLine).toContain('no failure detail recorded');
+        expect(failureLine).not.toContain('unknown error');
+    });
 });
 
 describe('RealtimeClientSessionResolver.RelayRealtimeTranscript', () => {
@@ -1690,6 +1759,7 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
     });
 
     it('returns a structured failure when the artifact header save fails (no version attempted)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingArtifact = makeSessionEntity({
             ID: 'artifact-fail',
             Save: vi.fn(async () => false),
@@ -1706,10 +1776,14 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
 
         expect(result.Success).toBe(false);
         expect(result.ErrorMessage).toMatch(/artifact save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('db down');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(version.Save).not.toHaveBeenCalled();
     });
 
     it('returns a structured failure (carrying the orphaned ArtifactID) when the version save fails', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
         const failingVersion = makeSessionEntity({
             ID: 'version-fail',
             Save: vi.fn(async () => false),
@@ -1728,6 +1802,10 @@ describe('RealtimeClientSessionResolver.SaveSessionChannelArtifact', () => {
         expect(result.Success).toBe(false);
         expect(result.ArtifactID).toBe('artifact-1');
         expect(result.ArtifactVersionID).toBeUndefined();
+        expect(result.ErrorMessage).toMatch(/artifact version save failed/i);
+        expect(result.ErrorMessage).toContain('session session-1');
+        expect(result.ErrorMessage).toContain('too big');
+        expect(errSpy.mock.calls.map((call) => String(call[0]))).toContain(result.ErrorMessage);
         expect(junction.Save).not.toHaveBeenCalled();
     });
 
@@ -2247,10 +2325,11 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
     }): { provider: unknown; promptRun: FakeSession } {
         const session =
             opts.session ??
-            makeSessionEntity({ Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }) });
-        const promptRun = opts.promptRun ?? makeSessionEntity({ ID: 'prompt-run-1', TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
+            makeSessionEntity({ Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }) });
+        const promptRun = opts.promptRun ?? makeSessionEntity({ ID: PROMPT_RUN_ID, TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
         const provider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         return { provider, promptRun };
     }
@@ -2276,7 +2355,7 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
         const ok = await resolver.RelayRealtimeUsage('session-1', 30, 5, makeCtx());
 
         expect(ok).toBe(true);
-        expect(promptRun.Load).toHaveBeenCalledWith('prompt-run-1');
+        expect(promptRun.Load).toHaveBeenCalledWith(PROMPT_RUN_ID);
         expect(promptRun.TokensPrompt).toBe(130);
         expect(promptRun.TokensCompletion).toBe(45);
         expect(promptRun.TokensUsed).toBe(175);
@@ -2373,7 +2452,7 @@ describe('RealtimeClientSessionResolver.RelayRealtimeUsage', () => {
         const { provider, promptRun } = makeUsageProvider({
             session: makeSessionEntity({
                 Status: 'Closed',
-                Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+                Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
             }),
         });
         currentProvider = provider;
@@ -2770,7 +2849,7 @@ describe('RealtimeClientSessionResolver — app awareness (applicationId / appCo
         expect(relayArg.AllowedAgents?.map(a => a.agentId)).toEqual(['skip-1']);
     });
 
-    it('passes the persisted directActions from the session config into ExecuteRelayedTool', async () => {
+    it('does not pass the directActions stored in the session config into ExecuteRelayedTool', async () => {
         currentProvider = makeProvider(() =>
             makeSessionEntity({
                 Config_: JSON.stringify({
@@ -2787,7 +2866,8 @@ describe('RealtimeClientSessionResolver — app awareness (applicationId / appCo
         );
 
         const relayArg = executeRelayedToolMock.mock.calls[0][0] as { DirectActions?: { enabled: boolean; actionNames: string[] } };
-        expect(relayArg.DirectActions).toEqual({ enabled: true, actionNames: ['SendEmail'] });
+        // The owner can edit Config, so the service takes direct actions from server-side state instead.
+        expect(relayArg.DirectActions).toBeUndefined();
     });
 });
 
@@ -2880,14 +2960,52 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(executeRelayedToolMock.mock.calls[0][1]).toBe(ANON_USER);
     });
 
+    it('refuses a direct action from a scoped anonymous caller without dispatching it or writing a turn as the system user (#4791)', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-1' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) =>
+                name === 'MJ: Conversation Details' ? detail : makeSessionEntity({ UserID: 'anon-1' }),
+            ),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeAnonResolver();
+
+        const out = await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        // Scope-limited callers get no direct actions, so nothing is dispatched, elevated or not…
+        expect(JSON.parse(out)).toMatchObject({ success: false });
+        expect(executeRelayedToolMock).not.toHaveBeenCalled();
+        // …and no hidden Conversation Detail turn is written, least of all as the system user.
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
+        expect(detail.Save).not.toHaveBeenCalled();
+    });
+
+    it('writes the direct-action tool turn as the caller unchanged for a normal authenticated user', async () => {
+        const detail = makeSessionEntity({ ID: 'detail-2' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: Conversation Details' ? detail : makeSessionEntity())),
+        };
+        executeRelayedToolMock.mockResolvedValue({ ResultJson: '{"success":true}', Success: true });
+        const resolver = makeResolver();
+
+        await resolver.ExecuteRealtimeSessionTool(
+            'session-1', 'call-1', 'Some Direct Action', '{}', makeCtx(), makePubSub(),
+        );
+
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', USER);
+    });
+
     it('accumulates relayed usage onto the prompt run under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, TokensPrompt: null, TokensCompletion: null, TokensUsed: null });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
@@ -2902,9 +3020,9 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
     it('mirrors the transcript turn onto the prompt run as SYSTEM while the Conversation Detail stays the caller', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
         const detail = makeSessionEntity({ ID: 'detail-1' });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => {
@@ -2912,6 +3030,7 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
                 if (name === 'MJ: Conversation Details') return detail;
                 return session;
             }),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
@@ -2928,18 +3047,46 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
     it('records the co-agent tool turn (RelayRealtimeToolTurn) under the SYSTEM user', async () => {
         const session = makeSessionEntity({
             UserID: 'anon-1',
-            Config_: JSON.stringify({ targetAgentID: 'target-1', promptRunID: 'prompt-run-1' }),
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
         });
-        const promptRun = makeSessionEntity({ ID: 'prompt-run-1', Messages: null });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
         currentProvider = {
             GetEntityObject: vi.fn(async (name: string) => (name === 'MJ: AI Prompt Runs' ? promptRun : session)),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
+        };
+        const resolver = makeAnonResolver();
+
+        const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
+
+        expect(ok).toBe(true);
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+    });
+
+    it('writes the hidden co-agent tool turn (RelayRealtimeToolTurn) as the CALLER (#4791)', async () => {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
+        });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
+        const detail = makeSessionEntity({ ID: 'detail-3' });
+        currentProvider = {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
         };
         const resolver = makeAnonResolver();
 
         const ok = await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{"url":"x"}');
 
         expect(ok).toBe(true);
+        // The co-agent run mirror stays SYSTEM…
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: AI Prompt Runs', SYSTEM_USER);
+        // …but the hidden Conversation Detail tool-turn is written as the CALLER, never SYSTEM.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
     });
 
     it('prepares the session with observability under the SYSTEM user while UserID stays the visitor', async () => {
@@ -2971,6 +3118,30 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect(prepInput.UserID).toBe('anon-1');
     });
 
+    /** Starts a session as `resolver`'s caller and returns the input the prepare service received. */
+    async function startAndCapturePrepInput(resolver: RealtimeClientSessionResolver, userID: string): Promise<{ ExcludeDirectActions?: boolean }> {
+        currentProvider = makeProvider(() => makeSessionEntity({ UserID: userID }));
+        createSessionMock.mockResolvedValue(makeSessionEntity({ ID: 'session-start', UserID: userID }));
+        prepareClientSessionMock.mockResolvedValue({
+            Success: true,
+            ClientConfig: { Provider: 'openai', Model: 'gpt-realtime', EphemeralToken: 'ek_abc', ExpiresAt: '2026-01-01T00:00:00Z', SessionConfig: {} },
+        });
+        await resolver.StartRealtimeClientSession('target-1', makeCtx());
+        return prepareClientSessionMock.mock.calls[0][0] as { ExcludeDirectActions?: boolean };
+    }
+
+    it('prepares a scope-limited caller\'s session with no direct actions', async () => {
+        const prepInput = await startAndCapturePrepInput(makeAnonResolver(), 'anon-1');
+
+        expect(prepInput.ExcludeDirectActions).toBe(true);
+    });
+
+    it('prepares a caller that is not scope-limited with direct actions', async () => {
+        const prepInput = await startAndCapturePrepInput(makeResolver(), 'user-1');
+
+        expect(prepInput.ExcludeDirectActions).toBe(false);
+    });
+
     it('junction-links delegated artifacts under the SYSTEM user and stamps the hidden anchor with the SESSION owner', async () => {
         const session = makeSessionEntity({ UserID: 'anon-1' });
         const junctions: FakeSession[] = [];
@@ -3003,6 +3174,10 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         // The junction write (an entity the anon role does NOT hold) runs as the SYSTEM user.
         expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Detail Artifacts', SYSTEM_USER);
         expect(junctions).toHaveLength(1);
+        // The hidden anchor `Conversation Detail` is written as the CALLER (#4791) — like every
+        // other `MJ: Conversation Details` write, the System user is refused as not the owner.
+        expect(getEntityObjectSpy()).toHaveBeenCalledWith('MJ: Conversation Details', ANON_USER);
+        expect(getEntityObjectSpy()).not.toHaveBeenCalledWith('MJ: Conversation Details', SYSTEM_USER);
         // The hidden anchor is attributed to the SESSION owner, not the elevated principal.
         expect(anchors).toHaveLength(1);
         expect(anchors[0].UserID).toBe('anon-1');
@@ -3102,6 +3277,108 @@ describe('RealtimeClientSessionResolver — scoped-anonymous elevation (issue #3
         expect((storeRecordingMock.mock.calls[0][0] as { ContextUser: unknown }).ContextUser).toBe(USER);
         expect(getSystemUserMock).not.toHaveBeenCalled();
     });
+
+    /** Provider routing a hidden-tool-turn RelayRealtimeToolTurn call: session, prompt run, detail. */
+    function makeToolTurnProvider(detail: FakeSession): unknown {
+        const session = makeSessionEntity({
+            UserID: 'anon-1',
+            Config_: JSON.stringify({ targetAgentID: 'target-1', coAgentRunID: CO_RUN_ID, promptRunID: PROMPT_RUN_ID }),
+        });
+        const promptRun = makeSessionEntity({ ID: PROMPT_RUN_ID, Messages: null });
+        return {
+            GetEntityObject: vi.fn(async (name: string) => {
+                if (name === 'MJ: AI Prompt Runs') return promptRun;
+                if (name === 'MJ: Conversation Details') return detail;
+                return session;
+            }),
+            ...sessionRunLookups([CO_RUN_ID], PROMPT_RUN_ID),
+        };
+    }
+
+    it('logs the session id, write user id and "no failure detail recorded" when a hidden tool turn save is refused without a LatestResult (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: undefined,
+            ResultHistory: [],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        // Exact substrings: 'anon-1' alone is the caller, session.UserID AND detail.UserID at once,
+        // so only the labelled form proves the WRITE user is what got logged.
+        expect(failureLine).toContain('session session-1');
+        expect(failureLine).toContain('write user anon-1');
+        expect(failureLine).toContain('no failure detail recorded (LatestResult null; ResultHistory length 0)');
+        expect(failureLine).toContain('the write was refused before reaching the provider');
+        expect(failureLine).not.toContain('unknown error');
+    });
+
+    it('does not claim WHERE the write was refused when a result was registered with an empty message (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: false, CompleteMessage: '   ' },
+            ResultHistory: [{}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('no failure detail recorded (LatestResult empty; ResultHistory length 1)');
+        expect(failureLine).not.toContain('refused before reaching the provider');
+    });
+
+    it('never logs a PRIOR SUCCESS entry\'s text as the failure reason when the refusal registered nothing (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { Success: true, CompleteMessage: 'previous save ok' },
+            ResultHistory: [{}, {}],
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain(
+            'no failure detail recorded (latest result entry is a prior success; ResultHistory length 2)',
+        );
+        expect(failureLine).not.toContain('previous save ok');
+    });
+
+    it('logs the real CompleteMessage when present (#4791)', async () => {
+        errSpy = vi.spyOn(console, 'error').mockImplementation(() => undefined);
+        const detail = makeSessionEntity({
+            ID: 'detail-1',
+            Save: vi.fn(async () => false),
+            LatestResult: { CompleteMessage: 'You do not have access to this conversation.' },
+        });
+        currentProvider = makeToolTurnProvider(detail);
+        const resolver = makeAnonResolver();
+
+        await resolver.RelayRealtimeToolTurn('session-1', 'browser_navigate', makeCtx(), '{}');
+
+        const loggedLines = errSpy.mock.calls.map((call) => String(call[0]));
+        const failureLine = loggedLines.find((line) => line.includes('persistDirectActionTurn'));
+        expect(failureLine).toBeDefined();
+        expect(failureLine).toContain('You do not have access to this conversation.');
+    });
 });
 
 describe('RealtimeClientSessionResolver — colleague authorization (allowedAgents)', () => {
@@ -3174,7 +3451,8 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
 
     it('excludes every colleague when the caller can run none of them', async () => {
         currentProvider = makeProvider(() => makeMultiTargetSession('user-1'));
-        hasPermissionMock.mockResolvedValue(false);
+        // The caller can run the lead target, and none of the colleagues.
+        hasPermissionMock.mockImplementation((...args: unknown[]) => Promise.resolve(args[0] === 'target-1'));
 
         await makeResolver().ExecuteRealtimeSessionTool(
             'session-1', 'call-1', 'invoke-target-agent', '{}', makeCtx(), makePubSub(),
@@ -3183,7 +3461,7 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
         expect(dispatchedAgentIDs()).toEqual([]);
     });
 
-    it('passes a single-target session through with no permission checks', async () => {
+    it('passes a single-target session through with only the target permission check', async () => {
         currentProvider = makeProvider(() => makeSessionEntity());
         hasPermissionMock.mockResolvedValue(true);
 
@@ -3193,6 +3471,7 @@ describe('RealtimeClientSessionResolver — colleague authorization (allowedAgen
 
         const input = executeRelayedToolMock.mock.calls[0][0] as { AllowedAgents?: unknown };
         expect(input.AllowedAgents).toBeUndefined();
-        expect(hasPermissionMock).not.toHaveBeenCalled();
+        expect(hasPermissionMock).toHaveBeenCalledTimes(1);
+        expect((hasPermissionMock.mock.calls[0] as unknown[])[0]).toBe('target-1');
     });
 });