@memberjunction/server 6.1.5 → 6.1.6

package/src/resolvers/GetDataContextDataResolver.ts

@@ -1,9 +1,13 @@
 import { Arg, Ctx, Field, ObjectType, Query, Resolver } from "type-graphql";
+import type { DatabaseProviderBase, UserInfo } from "@memberjunction/core";
+import { IsValidUUID, UUIDsEqual } from "@memberjunction/global";
+import { DataContext, DataContextItem } from "@memberjunction/data-context";
+import { MJDataContextEntity, MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { RenderPipeline } from "@memberjunction/generic-database-provider";
 import { AppContext } from "../types.js";
-import { DataContext } from "@memberjunction/data-context";
-import { GetReadOnlyDataSource, GetReadOnlyProvider } from "../util.js";
-import { MJDataContextItemEntity } from "@memberjunction/core-entities";
+import { GetReadOnlyProvider } from "../util.js";
 import { ResolverBase } from "../generic/ResolverBase.js";
+import { IsScopeLimitedPrincipal } from "../auth/scopeLimitedPrincipal.js";
 
 @ObjectType()
 export class GetDataContextItemDataOutputType {
@@ -39,6 +43,28 @@ export class GetDataContextDataOutputType {
 }
 
 
+/** The outcome of loading one data context item: its data as JSON, or why it has none. */
+interface ItemOutcome {
+    Result: string | null;
+    Error: string | null;
+}
+
+/** Which `sql` items of a data context may run: the read-only provider, and each refused item's reason. */
+interface SQLItemGate {
+    Provider: DatabaseProviderBase | null;
+    Refusals: Map<DataContextItem, string>;
+}
+
+/**
+ * Loads the data of data contexts and their items.
+ *
+ * Items of type `sql` hold raw SQL, which is held to the rules ExecuteAdhocQuery applies to
+ * caller-supplied SQL. It runs only for the data context's owner or an administrator (Owner-type
+ * user), never for a scope-limited session, only on the read-only provider, and only as a single read
+ * statement over entity base views the caller may read in full. A SQL item that may not run is
+ * refused on its own, and the other items still load. Items of the other types load through entity
+ * permissions for the calling user.
+ */
 @Resolver()
 export class GetDataContextDataResolver extends ResolverBase {
     /**
@@ -52,30 +78,25 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextItemID, appCtx.userPayload);
+        if (!IsValidUUID(DataContextItemID)) {
+            return { Success: false, ErrorMessage: 'DataContextItemID must be a UUID', Result: null };
+        }
 
         try {
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
+            const user: UserInfo = appCtx.userPayload.userRecord;
             const md = GetReadOnlyProvider(appCtx.providers, {allowFallbackToReadWrite: true});
-            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", appCtx.userPayload.userRecord);
+            const dciData = await md.GetEntityObject<MJDataContextItemEntity>("MJ: Data Context Items", user);
             if (await dciData.Load(DataContextItemID)) {
                 const dci = DataContext.CreateDataContextItem(); // use class factory to get whatever lowest level sub-class is registered
-                await dci.LoadMetadataFromEntityRecord(dciData, md, appCtx.userPayload.userRecord);
+                await dci.LoadMetadataFromEntityRecord(dciData, md, user);
+                const ownerID = dci.Type === 'sql' ? await this.loadDataContextOwnerID(dciData.DataContextID, md, user) : null;
+                const gate = this.authorizeSQLItems([dci], ownerID, appCtx);
                 // now the metadata is loaded so we can call the regular load function
-                if (await dci.LoadData(ds)) {
-                    return {
-                        Success: true,
-                        ErrorMessage: null,
-                        Result: JSON.stringify(dci.Data),
-                    }
-                }
-                else {
-                    return {
-                        Success: false,
-                        ErrorMessage: 'Error loading data context item data',
-                        Result: null,
-                    }
+                const outcome = await this.loadItem(dci, gate, user, false);
+                return {
+                    Success: outcome.Error === null,
+                    ErrorMessage: outcome.Error,
+                    Result: outcome.Result,
                 }
             }
             else {
@@ -89,14 +110,15 @@ export class GetDataContextDataResolver extends ResolverBase {
         catch (e) {
             return {
                 Success: false,
-                ErrorMessage: e,
+                ErrorMessage: e instanceof Error ? e.message : String(e),
                 Result: null,
             }
         }
     }
 
     /**
-     * Returns data for a given data context.
+     * Returns data for a given data context. `Results` and `ErrorMessages` hold one entry per item, in
+     * item order. `Success` is true, and `ErrorMessages` null, only when every item loaded.
      * @param DataContextID
      */
     @Query(() => GetDataContextDataOutputType)
@@ -106,38 +128,114 @@ export class GetDataContextDataResolver extends ResolverBase {
     ) {
         // Check API key scope authorization for data context read
         await this.CheckAPIKeyScopeAuthorization('datacontext:read', DataContextID, appCtx.userPayload);
+        // DataContext.LoadMetadata places this ID in the item filter, so it must be a plain UUID.
+        if (!IsValidUUID(DataContextID)) {
+            return { Success: false, ErrorMessages: ['DataContextID must be a UUID'], Results: null };
+        }
 
         try {
             // our job here is to load the entire data context, so we do that with the Data Context object
+            const user: UserInfo = appCtx.userPayload.userRecord;
+            const md = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: true });
             const dc = new DataContext();
-            const ds = GetReadOnlyDataSource(appCtx.dataSources, {
-                allowFallbackToReadWrite: true,
-            })
-            const success = await dc.Load(DataContextID, ds, true, false, 0, appCtx.userPayload.userRecord);
-            if (success) {
-                const retVal =   {
-                    Success: true,
-                    ErrorMessages: null,
-                    Results: dc.Items.map((item) => {
-                        return JSON.stringify(item.Data);
-                    }),
-                }
-                return retVal;
-            }
-            else {
+            if (!(await dc.LoadMetadata(DataContextID, user, md))) {
                 return {
                     Success: false,
                     ErrorMessages: ['Error loading data context'],
-                    Results: null,    
+                    Results: null,
                 }
             }
+            const gate = this.authorizeSQLItems(dc.Items, dc.MJDataContextEntity.UserID, appCtx);
+            const outcomes = await Promise.all(dc.Items.map((item) => this.loadItem(item, gate, user, true)));
+            const allLoaded = outcomes.every((outcome) => outcome.Error === null);
+            return {
+                Success: allLoaded,
+                ErrorMessages: allLoaded ? null : outcomes.map((outcome) => outcome.Error),
+                Results: outcomes.map((outcome) => outcome.Result),
+            }
         }
         catch (e) {
             return {
                 Success: false,
-                ErrorMessages: [e],
+                ErrorMessages: [e instanceof Error ? e.message : String(e)],
                 Results: null,
             }
         }
     }
-}
+
+    /**
+     * Decides which `sql` items among `items` may run. Returns the read-only provider they run on, and
+     * the reason for each SQL item that may not run.
+     */
+    private authorizeSQLItems(items: DataContextItem[], ownerID: string | null, appCtx: AppContext): SQLItemGate {
+        const refusals = new Map<DataContextItem, string>();
+        const sqlItems = items.filter((item) => item.Type === 'sql');
+        if (sqlItems.length === 0) {
+            return { Provider: null, Refusals: refusals };
+        }
+        const user: UserInfo | undefined = appCtx.userPayload?.userRecord;
+        const provider = GetReadOnlyProvider(appCtx.providers, { allowFallbackToReadWrite: false });
+        for (const item of sqlItems) {
+            const refusal = this.sqlItemRefusal(item, ownerID, user, provider);
+            if (refusal !== null) {
+                refusals.set(item, refusal);
+            }
+        }
+        return { Provider: provider, Refusals: refusals };
+    }
+
+    /** Returns why `item` may not run for `user`, or null when it may. */
+    private sqlItemRefusal(item: DataContextItem, ownerID: string | null, user: UserInfo | undefined, provider: DatabaseProviderBase | null): string | null {
+        if (!user || IsScopeLimitedPrincipal(user)) {
+            return 'SQL data context items cannot be run by a scope-limited or unidentified session.';
+        }
+        if (!this.mayRunDataContextSQL(ownerID, user)) {
+            return 'Only the owner of this data context, or an administrator, may run its SQL items.';
+        }
+        if (!provider) {
+            return 'No read-only data source is configured, so SQL data context items cannot run.';
+        }
+        return this.screenItemSQL(item.SQL ?? '', provider, user);
+    }
+
+    /** True when `user` owns the data context or is an administrator (Owner-type user). */
+    private mayRunDataContextSQL(ownerID: string | null, user: UserInfo): boolean {
+        const isOwner = !!ownerID && UUIDsEqual(ownerID, user.ID);
+        return isOwner || user.Type?.trim().toLowerCase() === 'owner';
+    }
+
+    /**
+     * Returns why `sqlText` may not run, or null when it is a single read statement whose every table
+     * reference is an entity base view `user` may read without row-level or field-level narrowing. It is
+     * the check ExecuteAdhocQuery makes on the rendered SQL.
+     */
+    private screenItemSQL(sqlText: string, provider: DatabaseProviderBase, user: UserInfo): string | null {
+        try {
+            const rendered = RenderPipeline.Run(sqlText, { Platform: provider.PlatformKey, ContextUser: user, RequireReadStatement: true });
+            this.assertFullQueryUsesReadableEntityViews(rendered.Trace.AfterTemplates, provider, user, 'data context SQL');
+            return null;
+        }
+        catch (e) {
+            const reason = e instanceof Error ? e.message : String(e);
+            return reason || 'The SQL of this item did not pass the read-only check.';
+        }
+    }
+
+    /** Loads one item's data unless `gate` refused it. Returns the data as JSON, or why there is none. */
+    private async loadItem(item: DataContextItem, gate: SQLItemGate, user: UserInfo, forceRefresh: boolean): Promise<ItemOutcome> {
+        const refusal = gate.Refusals.get(item);
+        if (refusal !== undefined) {
+            return { Result: null, Error: refusal };
+        }
+        if (await item.LoadData(gate.Provider, forceRefresh, false, 0, user)) {
+            return { Result: JSON.stringify(item.Data), Error: null };
+        }
+        return { Result: null, Error: item.DataLoadingError || 'Error loading data context item data' };
+    }
+
+    /** Returns the owner (`UserID`) of a data context, or null when the caller cannot load it. */
+    private async loadDataContextOwnerID(dataContextID: string, provider: DatabaseProviderBase, user: UserInfo): Promise<string | null> {
+        const dataContext = await provider.GetEntityObject<MJDataContextEntity>('MJ: Data Contexts', user);
+        return (await dataContext.Load(dataContextID)) ? dataContext.UserID : null;
+    }
+}

package/src/resolvers/GetDataResolver.ts

@@ -1,4 +1,5 @@
 import { Arg, Ctx, Field, InputType, ObjectType, Query } from 'type-graphql';
+import { SQLExpressionValidator } from '@memberjunction/global';
 import { AppContext } from '../types.js';
 import { LogError, LogStatus, LogStatusEx, Metadata } from '@memberjunction/core';
 import { QueryCompositionEngine } from '@memberjunction/generic-database-provider';
@@ -154,8 +155,20 @@ export class GetDataResolver {
                             resolvedSQL = compositionResult.ResolvedSQL;
                         }
 
+                        // Defense-in-depth: even system-token holders get SELECT-only SQL here.
+                        // The read-only pool is the primary control, but if it is ever
+                        // misconfigured to a read-write login this validator still refuses DML/DDL
+                        // (mirrors AdhocQueryResolver). The validator reads exactly the text that
+                        // runs: it is trimmed here as validate() trims it, and literal \n sequences
+                        // are not rewritten as validateFullQuery would.
+                        const sqlToRun = resolvedSQL.trim();
+                        const validation = SQLExpressionValidator.Instance.validate(sqlToRun, { context: 'full_query', Dialect: platform });
+                        if (!validation.valid) {
+                            return { result: null, error: validation.error || 'SQL validation failed' };
+                        }
+
                         const request = new sql.Request(readOnlyDataSource);
-                        const result = await request.query(resolvedSQL);
+                        const result = await request.query(sqlToRun);
                         return { result: result.recordset, error: null };
                     } catch (err) {
                         // Extract clean SQL error message

package/src/resolvers/QuerySystemUserResolver.ts

@@ -6,6 +6,7 @@ import { MJQueryResolver, MJQuery_, MJQueryField_, MJQueryParameter_, MJQueryEnt
 import { GetReadWriteProvider } from '../util.js';
 import { DeleteOptionsInput } from '../generic/DeleteOptionsInput.js';
 import { MJQueryEntityServer } from '@memberjunction/core-entities-server';
+import { EscapeSQLString } from '@memberjunction/global';
 
 /**
  * Minimal shape of a query row returned by RunView lookups (plain object, not entity instance).
@@ -493,7 +494,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             // now make sure there is NO existing query by the same name in the specified category
             const existingQueryResult = await provider.RunView({
                 EntityName: 'MJ: Queries',
-                ExtraFilter: `Name='${input.Name}' AND CategoryID='${finalCategoryID}'` 
+                ExtraFilter: `Name='${EscapeSQLString(input.Name)}' AND CategoryID='${EscapeSQLString(finalCategoryID)}'`
             }, context.userPayload.userRecord);
             if (existingQueryResult.Success && existingQueryResult.Results?.length > 0) {
                 // we have a match! Let's return an error

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -11,9 +11,9 @@
  * and **executes** every tool call the browser relays back. The three mutations here cover the MVP:
  *
  * 1. {@link RealtimeClientSessionResolver.StartRealtimeClientSession} — authorize, create the
- *    session (storing the target agent id server-side, authoritatively), mint the ephemeral config.
- * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call,
- *    reading the target agent id from the session (NOT the client) so the browser can't swap targets.
+ *    session (storing the target agent id on it), mint the ephemeral config.
+ * 2. {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} — execute a relayed tool call
+ *    for the target agent stored on the session, re-authorized for the caller on every call.
  * 3. {@link RealtimeClientSessionResolver.RelayRealtimeTranscript} — persist a transcript turn as a
  *    `Conversation Detail`.
  *
@@ -21,6 +21,13 @@
  * - **Start**: the caller must have `CanRun` on the *target* agent (the Realtime Co-Agent is an internal
  *   orchestration agent, so the meaningful gate is the agent doing the real work).
  * - **Execute / Relay**: inbound ownership — the session's `UserID` must equal `contextUser.ID`.
+ * - **Session `Config`**: the owner can edit it through the generic entity API, so nothing in it is
+ *   trusted. Execute re-checks `CanRun` on its target, direct actions never come from it, and its
+ *   run ids are used only when {@link SessionRunIDVerifier} finds them to be records of the session.
+ * - **Scope-limited callers** (anonymous and resource-scoped magic-link sessions, including public
+ *   web-widget guests): no direct actions. Their scope exists only as row-level filters, which an
+ *   action can read around, and a scoped anonymous caller's relay runs as the system user. They
+ *   reach the target agent only through `invoke-target-agent`.
  *
  * @module @memberjunction/server
  */
@@ -48,6 +55,7 @@ import {
     FindIgnoredRealtimeConfigKeys,
     ParseRealtimeTypeConfiguration,
     ResolveEffectiveRealtimeConfig,
+    INVOKE_TARGET_AGENT_TOOL_NAME,
     RealtimeAllowedAgent,
     RealtimeDirectActionsConfig,
     REALTIME_ADVANCED_SESSION_CONTROLS_AUTHORIZATION,
@@ -62,6 +70,8 @@ import { ResolverBase } from '../generic/ResolverBase.js';
 import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { GetReadWriteProvider } from '../util.js';
 import { SessionManager } from '../agentSessions/index.js';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
 import { resolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser } from '../realtimeWidget/widgetGuestElevation.js';
 
 /**
@@ -137,9 +147,9 @@ const MAX_PRIOR_TRANSCRIPT_CHARS = 8_000;
 const MAX_PRIOR_TRANSCRIPT_LEGS = 5;
 
 /**
- * Authoritative shape persisted in `AIAgentSession.Config_` for a client-direct voice session.
- * The target agent id is stored here at start and read back on every relay — the browser never
- * re-supplies it, so it cannot swap targets mid-session.
+ * Shape persisted in `AIAgentSession.Config_` for a client-direct voice session. The server writes
+ * it, but the session owner can also edit it through the generic entity API, so relays re-check
+ * what they read from it (see the authorization model above).
  */
 interface RealtimeSessionConfig {
     /** The top-level target agent the co-agent voices on behalf of. */
@@ -375,6 +385,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     // state on — otherwise that cleanup silently no-ops on a freshly-constructed instance.
     private readonly clientSessionService = new RealtimeClientSessionService();
     private readonly sessionManager = new SessionManager(this.clientSessionService);
+    private readonly runIDVerifier = new SessionRunIDVerifier();
 
     /**
      * The reason a `Save()`/`Delete()` returned false, for a log line. `CompleteMessage` renders
@@ -411,7 +422,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      *    agent's `DefaultCoAgentID` → type-level `AIAgentCoAgent` default row → global Realtime Co-Agent) —
      *    see {@link RealtimeClientSessionResolver.resolveCoAgentID} for the full contract.
      * 3. Create the durable `AIAgentSession` (run by the co-agent), storing `targetAgentID` in its
-     *    config server-side — this is the authoritative target for all later relays.
+     *    config — the target later relays use, re-authorized for the caller on each relay.
      * 4. Mint the {@link import('@memberjunction/ai').ClientRealtimeSessionConfig} via the service.
      *    On failure the just-created session is closed so no half-open session leaks.
      *
@@ -526,8 +537,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      * Execute a single tool call the browser relayed from its provider socket and return the
      * serialized result for the browser to relay back to the model.
      *
-     * Ownership-gated; the target agent id is read from the **session config** (authoritative), never
-     * from the client. Heartbeats the session on success.
+     * Ownership-gated. The target agent id is read from the session config and `CanRun` on it is
+     * checked for the caller on every call, because the owner can edit the config. A direct-action
+     * call from a scope-limited caller is refused before any elevation. Heartbeats the session on
+     * success.
      *
      * @returns The serialized tool result JSON.
      */
@@ -543,13 +556,23 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
         const config = this.readSessionConfig(session);
+        await this.assertCanRunTarget(config.targetAgentID, contextUser, provider);
+        if (toolName !== INVOKE_TARGET_AGENT_TOOL_NAME && IsScopeLimitedPrincipal(contextUser)) {
+            return this.refuseDirectAction(agentSessionId, toolName);
+        }
 
         // SCOPED-ANONYMOUS ELEVATION (issue #3371): once ownership is proven above, the delegated
         // run + its AI-run-entity writes execute as the system user for a scoped anonymous caller
         // (the caller's role deliberately holds no grants on the run entities). The lead
-        // targetAgentID comes from the session config and was CanRun-gated at start; the colleague
-        // union is gated just below, against the CALLER, so elevation never widens agent authority.
+        // targetAgentID is CanRun-gated against the CALLER just above, and the colleague union
+        // just below, so elevation never widens agent authority.
         const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const runIDs = await this.runIDVerifier.Verify(
+            session.ID,
+            { CoAgentRunID: config.coAgentRunID, PendingFeedbackRunID: config.pendingFeedbackRunID },
+            runUser,
+            provider,
+        );
         if (runUser !== contextUser) {
             LogStatus(
                 `ExecuteRealtimeSessionTool: dispatching relayed tool '${toolName}' for session ${agentSessionId} ` +
@@ -567,16 +590,17 @@ export class RealtimeClientSessionResolver extends ResolverBase {
                 // Multi-target (Move 4): the session's persisted allowed-agent union — a model-named
                 // colleague in the call is validated against this; absent ⇒ single-target behavior.
                 AllowedAgents: await this.filterAllowedAgentsByCanRun(config.allowedAgents, contextUser),
-                DirectActions: config.directActions,
+                // No DirectActions: the service takes them from the session's start-time projection
+                // or the target agent's metadata, never from the owner-editable config.
                 // Attribution follows the VISITOR even when `runUser` is elevated: the delegated run
                 // row and its context-memory scope must stay the person's, not the system user's.
                 AttributionUserID: contextUser.ID,
                 // Nest the delegated target-agent run under the co-agent observability run (when present).
-                ParentRunID: config.coAgentRunID,
+                ParentRunID: runIDs.CoAgentRunID,
                 Call: { CallID: callId, ToolName: toolName, Arguments: argsJson },
                 OnProgress: this.buildDelegationProgressCallback(pubSub, userPayload, agentSessionId, callId),
                 // Resume a previously-paused delegated run (if any) with the user's answer.
-                ResumeRunID: config.pendingFeedbackRunID,
+                ResumeRunID: runIDs.PendingFeedbackRunID,
             },
             runUser,
             provider,
@@ -586,7 +610,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             `ExecuteRealtimeSessionTool: completed relayed tool '${toolName}' (callId: ${callId}) in ${durationMs}ms`,
         );
 
-        if (toolName !== 'invoke-target-agent') {
+        if (toolName !== INVOKE_TARGET_AGENT_TOOL_NAME) {
             await this.persistDirectActionTurn(
                 session,
                 callId,
@@ -643,6 +667,19 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         };
     }
 
+    /**
+     * The tool result for a direct-action call from a scope-limited caller (see the authorization
+     * model above). It has the broker's result shape, so the model hears that the tool is not
+     * available and can ask the target agent through `invoke-target-agent` instead.
+     */
+    private refuseDirectAction(agentSessionId: string, toolName: string): string {
+        LogStatus(`ExecuteRealtimeSessionTool: refused direct action '${toolName}' for a scope-limited caller on session ${agentSessionId}.`);
+        return JSON.stringify({
+            success: false,
+            output: `The tool '${toolName}' is not available in this session. Ask the agent to do it with ${INVOKE_TARGET_AGENT_TOOL_NAME}.`,
+        });
+    }
+
     /**
      * Rolls the session's `pendingFeedbackRunID` forward after a relayed tool call. The id we just
      * consumed (resumed or none) is dropped; a new paused run id is stored only when the run paused
@@ -713,14 +750,15 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         // conversation (run-viewer observability parity). Best-effort — never fails the transcript relay.
         // The prompt-run write runs as the scoped-anonymous elevated user (issue #3371) — the visible
         // Conversation Detail above deliberately stays on the caller.
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (promptRunID) {
             await this.clientSessionService.AppendPromptRunMessage(
                 promptRunID,
                 this.mapTranscriptRoleToChatRole(role),
                 text,
                 replacesPrevious ?? false,
-                ResolveScopedAnonymousRunUser(contextUser),
+                runUser,
                 provider,
             );
         }
@@ -918,7 +956,8 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             provider,
         );
 
-        const promptRunID = this.readPromptRunID(session);
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false;
         }
@@ -927,7 +966,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             'assistant',
             this.formatToolTurn(toolName, argsJson, resultJson),
             false,
-            ResolveScopedAnonymousRunUser(contextUser),
+            runUser,
             provider,
         );
     }
@@ -1019,16 +1058,15 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             return true; // nothing to add — a no-op flush is a success, not a failure
         }
 
-        const promptRunID = this.readPromptRunID(session);
+        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
+        const runUser = ResolveScopedAnonymousRunUser(contextUser);
+        const promptRunID = await this.readPromptRunID(session, runUser, provider);
         if (!promptRunID) {
             return false; // no observability prompt run for this session — logged in the helper
         }
         // Delegate to the service so usage writes share the per-run serialization with transcript-message
         // appends — otherwise the frequent usage save clobbers freshly-appended Messages (and vice-versa).
-        // Runs as the scoped-anonymous elevated user (issue #3371) — the caller's role holds no prompt-run grants.
-        return this.clientSessionService.AccumulatePromptRunUsage(
-            promptRunID, inputDelta, outputDelta, ResolveScopedAnonymousRunUser(contextUser), provider,
-        );
+        return this.clientSessionService.AccumulatePromptRunUsage(promptRunID, inputDelta, outputDelta, runUser, provider);
     }
 
     /** Clamps a relayed token delta: negative / non-finite values become 0. */
@@ -1055,24 +1093,40 @@ export class RealtimeClientSessionResolver extends ResolverBase {
 
     /**
      * Reads the co-agent `AIPromptRun` id from the session config WITHOUT the relay path's
-     * throw-on-missing-target semantics — usage relay is best-effort, so a missing/malformed
-     * config or absent id just logs and returns `null`.
+     * throw-on-missing-target semantics, and keeps it only when it is the prompt run of the
+     * session's co-agent run (the owner can edit the config). Usage relay is best-effort, so a
+     * missing/malformed config, an absent id, or an id of another session just logs and returns `null`.
+     *
+     * @param runUser The user the prompt-run write runs as; the check runs as the same user.
      */
-    private readPromptRunID(session: MJAIAgentSessionEntity): string | null {
-        try {
-            const config = this.readSessionConfig(session);
-            if (config.promptRunID) {
-                return config.promptRunID;
-            }
+    private async readPromptRunID(
+        session: MJAIAgentSessionEntity,
+        runUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<string | null> {
+        const config = this.tryReadSessionConfig(session);
+        if (!config) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+            return null;
+        }
+        if (!config.promptRunID) {
             LogStatus(
                 `RelayRealtimeUsage: session ${session.ID} has no co-agent promptRunID (observability run ` +
                     'creation was skipped or failed) — usage delta dropped.',
             );
             return null;
-        } catch {
-            LogError(`RelayRealtimeUsage: session ${session.ID} has no parseable config — usage delta dropped.`);
+        }
+        const verified = await this.runIDVerifier.Verify(
+            session.ID,
+            { CoAgentRunID: config.coAgentRunID, PromptRunID: config.promptRunID },
+            runUser,
+            provider,
+        );
+        if (!verified.PromptRunID) {
+            LogError(`RelayRealtimeUsage: session ${session.ID} names a promptRunID that is not its co-agent prompt run — ignored.`);
             return null;
         }
+        return verified.PromptRunID;
     }
 
     /**
@@ -1222,8 +1276,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     }
 
     /**
-     * Authorization gate for {@link RealtimeClientSessionResolver.StartRealtimeClientSession}: the
-     * caller must be able to run the **target** agent. Denial throws (no session is created).
+     * Authorization gate for the **target** agent: the caller must be able to run it. Denial throws.
+     * {@link RealtimeClientSessionResolver.StartRealtimeClientSession} runs it before any session is
+     * created, and {@link RealtimeClientSessionResolver.ExecuteRealtimeSessionTool} runs it on every
+     * relayed call, because the owner can edit the target in the session config.
      */
     private async assertCanRunTarget(
         targetAgentId: string,
@@ -1752,6 +1808,9 @@ export class RealtimeClientSessionResolver extends ResolverBase {
                 // (allowed-agent union); the snapshot is injected into the system prompt at mint.
                 ApplicationID: applicationId,
                 AppContext: appContext,
+                // Scope-limited callers get no direct actions (see the authorization model above), so
+                // the model is not given tools that the relay refuses.
+                ExcludeDirectActions: IsScopeLimitedPrincipal(contextUser),
             },
             // SCOPED-ANONYMOUS ELEVATION (issue #3371): the prepare creates the co-agent
             // observability AIAgentRun/AIPromptRun/run-step, which a scoped anonymous caller's role
@@ -1793,9 +1852,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
 
     /**
      * Writes the co-agent observability run ids into the session's `Config_` alongside the
-     * authoritative `targetAgentID`, then saves the session. These ids are read back on close to
-     * finalize the runs (and on relay to nest delegated runs). Best-effort: a save failure is logged,
-     * not thrown — the voice session still proceeds, it just won't carry the run ids.
+     * `targetAgentID`, then saves the session. These ids are read back on close to
+     * finalize the runs (and on relay to nest delegated runs). Relays never read the direct actions
+     * from it. Best-effort: a save failure is logged, not thrown — the voice session still proceeds,
+     * it just won't carry the run ids.
      */
     private async persistObservabilityRunIDs(
         session: MJAIAgentSessionEntity,
@@ -2537,9 +2597,10 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     }
 
     /**
-     * Parses the session's persisted config, returning the authoritative `targetAgentID` plus any
-     * observability run ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed
-     * or carries no target — a relay cannot proceed without a target.
+     * Parses the session's persisted config, returning its `targetAgentID` plus any observability run
+     * ids (`coAgentRunID`/`promptRunID`). Throws when the config is missing/malformed or carries no
+     * target — a relay cannot proceed without a target. The owner can edit the config, so callers
+     * re-check what they act on.
      */
     private readSessionConfig(session: MJAIAgentSessionEntity): RealtimeSessionConfig {
         const raw = session.Config_;

package/src/resolvers/RemoteBrowserActionResolver.ts

@@ -24,6 +24,7 @@ import { MJAIAgentSessionEntity, MJAIAgentEntity } from '@memberjunction/core-en
 import { NormalizeInstanceKey, RemoteBrowserEngine } from '@memberjunction/remote-browser-server';
 import { beginBrowserGoalStep, finalizeBrowserGoalStep, extractCoAgentRunID } from '../agentSessions/remoteBrowserGoalEngine.js';
 import { RemoteBrowserGoalRegistry } from '../agentSessions/remoteBrowserGoalRegistry.js';
+import { SessionRunIDVerifier } from '../agentSessions/SessionRunIDVerifier.js';
 import { randomUUID } from 'node:crypto';
 import {
   RemoteBrowserAction,
@@ -261,6 +262,9 @@ export class RemoteBrowserActionResolver extends ResolverBase {
    */
   private startedScreencasts = new Map<string, number>();
 
+  /** Checks the co-agent run id read from a session's owner-editable `Config_` before a step is attached to it. */
+  private readonly runIDVerifier = new SessionRunIDVerifier();
+
   /**
    * Surfaces whose live tab-audio stream this resolver has already started, keyed by
    * {@link RemoteBrowserActionResolver.streamKey} for the same reason the screencast map is. Entries
@@ -400,7 +404,13 @@ export class RemoteBrowserActionResolver extends ResolverBase {
     const providerName = await this.resolveProviderName(session, contextUser, provider);
     // Observability: nest this goal's many prompt runs under ONE "Browser goal" step on the realtime
     // co-agent run (when the session has one). Best-effort — a null step just means the goal runs unlinked.
-    const coAgentRunID = extractCoAgentRunID(session.Config_);
+    // The owner can edit Config_, so its run id is used only when it is a run of this session.
+    const { CoAgentRunID: coAgentRunID } = await this.runIDVerifier.Verify(
+      session.ID,
+      { CoAgentRunID: extractCoAgentRunID(session.Config_) },
+      contextUser,
+      provider,
+    );
     const goalStep = await beginBrowserGoalStep(provider, contextUser, coAgentRunID, goal);
 
     // ASYNC START: a goal loop can run for minutes; do NOT hold this request open for it (browser