@memberjunction/server 6.2.0-edge.0 → 6.2.0-edge.2

package/src/generic/CacheInvalidationResolver.ts

@@ -1,7 +1,57 @@
 import { Field, ObjectType, Resolver, Root, Subscription } from 'type-graphql';
+import { Metadata, UserInfo } from '@memberjunction/core';
 
 export const CACHE_INVALIDATION_TOPIC = 'CACHE_INVALIDATION';
 
+/**
+ * Entities whose rows may ride along with an invalidation event. Empty until the server entry point
+ * supplies the configured list, so the default — including in any process that never configures it
+ * — is to broadcast nothing.
+ */
+let allowedRecordDataEntities: readonly string[] = [];
+
+/**
+ * Supply the configured allowlist. Called once from the server entry point during bootstrap.
+ *
+ * INJECTED rather than read from `configInfo` here, deliberately. `config.ts` runs `loadConfig()` at
+ * module scope, so importing it from this module would drag full config validation into every
+ * import chain that touches the resolver — including unit tests, which have no server config and
+ * would fail at import with "Configuration validation failed". This module deliberately imports
+ * nothing from MJServer itself — only type-graphql and `@memberjunction/core` (for the entity
+ * permission check in the subscription filter), neither of which loads config.
+ */
+export function ConfigureRecordDataBroadcast(entities: readonly string[] | undefined | null): void {
+  // Normalised HERE, once, rather than at each comparison. The wildcard used to be matched raw
+  // (`includes('*')`) while entity names were trimmed and lowercased two lines below, so a
+  // hand-edited `[' * ']` matched neither branch and silently opted nothing in — a config that
+  // looks like it disables the gate while leaving it fully on. Empty entries are dropped so a
+  // stray `''` cannot match an entity whose name is somehow blank.
+  allowedRecordDataEntities = (entities ?? [])
+    .map((e) => e.trim().toLowerCase())
+    .filter((e) => e.length > 0);
+}
+
+/**
+ * May the full row of `entityName` be broadcast alongside its cache-invalidation event?
+ *
+ * The subscription below is filtered only by ENTITY-level read permission, so anything included
+ * here is disclosed to every signed-in session that may read the entity at all — regardless of
+ * row-level security or any tenant scoping a consumer applies on the read path, neither of which
+ * this push traverses. The answer is therefore NO unless a deployment has explicitly opted the
+ * entity in via `cacheSettings.recordDataBroadcastEntities`.
+ *
+ * Callers that get `false` simply omit `recordData`; the event still carries the entity name and
+ * primary key, so clients evict and re-fetch through the normal access-controlled read path.
+ *
+ * Matching is exact (trimmed, case-insensitive) rather than substring: a loose match would let an
+ * allowlisted name drag in every entity whose name contains it.
+ */
+export function MayBroadcastRecordData(entityName: string): boolean {
+  if (allowedRecordDataEntities.length === 0) return false;
+  if (allowedRecordDataEntities.includes('*')) return true;
+  return allowedRecordDataEntities.includes(entityName.trim().toLowerCase());
+}
+
 @ObjectType()
 export class CacheInvalidationNotification {
     @Field(() => String)
@@ -40,17 +90,111 @@ export interface CacheInvalidationPayload {
     recordData?: string;
 }
 
+/**
+ * What the subscription filter needs off the WS connection.
+ *
+ * Declared structurally rather than importing MJServer's `UserPayload`, which reaches `types.ts`
+ * and through it `auth/index.js` and config. Keeping this module's imports minimal is not fussiness
+ * — importing `configInfo` here is what previously broke every unit test that touched the resolver,
+ * and the import-surface test in this package exists to keep it that way.
+ */
+export interface CacheInvalidationFilterContext {
+    userPayload?: { userRecord?: unknown };
+}
+
+/**
+ * Should this subscriber hear about this event at all?
+ *
+ * Entity-level narrowing, raised in review: an event for an entity a session has no read
+ * permission on tells that session the record exists, its stable key, and when it changed — and
+ * the session could never have read it anyway, so nothing is lost by withholding it. This is a
+ * monotonic reduction in disclosure that needs no tenancy model, which is why it is here and the
+ * row-level question is not.
+ *
+ * What it does NOT close: two sessions that both hold read permission on an entity still see each
+ * other's keys, because what separates them is row-level. That predicate is tracked separately —
+ * see the class docblock below.
+ *
+ * `GetUserPermisions` is an in-memory match of the entity's permission rows against the user's
+ * roles, so this stays cheap enough to run per subscriber per event. It is not free: it runs for
+ * every connected socket on every save, so keep it free of I/O.
+ */
+export function CacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean {
+    const user = data.context?.userPayload?.userRecord as UserInfo | undefined;
+    // FAIL CLOSED on identity, matching `statusUpdatesFilter`. `onConnect` rejects a socket whose
+    // token does not validate, so a subscriber with no user record should not exist; if one does,
+    // it is the case least deserving of an unfiltered firehose.
+    if (!user) {
+        return false;
+    }
+
+    const entityName = data.payload?.entityName;
+    if (!entityName) {
+        return false;
+    }
+
+    // A pub/sub subscription filter has no per-request provider to thread: it runs on the server's
+    // own metadata, which is the one place the entity's permission rows can be answered from.
+    const entity = new Metadata().EntityByName(entityName); // global-provider-ok: subscription filter — server-wide metadata, no request-scoped provider exists here
+    // DELIVER when the entity is unknown here, deliberately — the opposite of the choice above.
+    // A name absent from metadata cannot be permission-checked, and withholding would silently
+    // stop invalidating a legitimately cacheable entity, which is a correctness bug rather than a
+    // disclosure one. All it discloses is the name and key of something this server cannot
+    // describe.
+    if (!entity) {
+        return true;
+    }
+
+    return entity.GetUserPermisions(user).CanRead;
+}
+
+/** @deprecated Use {@link CacheInvalidationFilter}. */
+export function cacheInvalidationFilter(data: {
+    payload: CacheInvalidationPayload;
+    context: CacheInvalidationFilterContext | undefined;
+}): boolean {
+  return CacheInvalidationFilter(data);
+}
+
 @Resolver()
 export class CacheInvalidationResolver {
     /**
-     * Subscription that broadcasts cache invalidation events to ALL connected clients.
-     * No session filter — every browser connected via WebSocket receives every event.
-     * This enables cross-server cache invalidation to propagate to browser clients.
+     * Subscription that broadcasts cache invalidation events to connected clients, so cross-server
+     * cache invalidation reaches browsers.
+     *
+     * Delivery is filtered only by ENTITY-level read permission (see {@link CacheInvalidationFilter}).
+     * Every session that may read an entity at all still receives every event for it, from every
+     * other session and tenant.
+     *
+     * Because that narrowing stops well short of row level, `RecordData` is only populated for entities a
+     * deployment has opted in through `cacheSettings.recordDataBroadcastEntities` — see
+     * {@link MayBroadcastRecordData}, applied at both publish sites.
+     *
+     * `EntityName`, `PrimaryKeyValues`, `Action` and `Timestamp` ARE still broadcast to every
+     * session, and that is a disclosure, not a safe residue. An earlier version of this comment
+     * called them "safe to broadcast" on the grounds that reading the record still goes through
+     * the access-controlled path — true of the row's CONTENTS, and beside the point for the
+     * metadata itself. A session with no relationship to a record still learns that it exists,
+     * its stable key, and every time it changes; across entities it learns the cadence and volume
+     * of another tenant's activity.
+     *
+     * The key is kept deliberately, because consumers need it to re-read the record they were
+     * told about (see `ResolveEntityEventKey` in @memberjunction/core) and because the alternative
+     * — a coarse "something in this entity changed" — forces whole-entity invalidation on the
+     * hottest write paths. That is a trade, not an absence of cost. Narrowing it means filtering
+     * delivery per subscriber, which needs an authorization predicate cheap enough to run per
+     * subscriber per event; entity-level permissions (`EntityInfo.GetUserPermisions`, an in-memory
+     * role match) would cover part of it, row-level tenancy would not.
      */
     @Subscription(() => CacheInvalidationNotification, {
         topics: CACHE_INVALIDATION_TOPIC,
+        filter: (data: { payload: CacheInvalidationPayload; context: CacheInvalidationFilterContext | undefined }) =>
+            CacheInvalidationFilter(data),
     })
-    cacheInvalidation(
+    cacheInvalidation(  // case-violation-ok-legacy-back-compat: the property name is the GraphQL schema field name — renaming it breaks every client query
         @Root() payload: CacheInvalidationPayload
     ): CacheInvalidationNotification {
         return {

package/src/generic/DeleteOptionsInput.ts

@@ -50,9 +50,16 @@ export class DeleteOptionsInput {
      * schema-sync gate requires `DeleteOptionsInput` to carry every `EntityDeleteOptions` field;
      * {@link DeleteOptionsInput.SanitizeFromWire} forces it back to false on every request. See
      * that method for why.
+     *
+     * **Optional on the wire, on purpose.** This field did not exist in 5.51.x, and every other
+     * field here is required, so making it required too turned a 6.1 upgrade into a hard failure
+     * for every client that spells out `options___` on a delete (`Field
+     * "DeleteOptionsInput.SkipRecordChanges" of required type "Boolean!" was not provided`). A
+     * 5.51 client that omits it and a 6.1 client that sends `false` mean the same thing, and the
+     * server forces it to `false` regardless, so `null`/absent defaults to `false` here.
      */
-    @Field(() => Boolean)
-    SkipRecordChanges: boolean;
+    @Field(() => Boolean, { nullable: true, defaultValue: false })
+    SkipRecordChanges?: boolean;
 
     /**
      * Strips wire-unreachable capabilities from client-supplied delete options.

package/src/generic/FireAndForgetHeartbeat.ts

@@ -1,9 +1,23 @@
 import { PubSubEngine } from 'type-graphql';
 import { LogError } from '@memberjunction/core';
-import { publishStatusUpdate } from './PushStatusResolver.js';
+import { PublishStatusUpdate } from './PushStatusResolver.js';
 
-/** Default cadence for fire-and-forget liveness pulses (5 minutes). */
-export const DEFAULT_PULSE_INTERVAL_MS = 5 * 60 * 1000;
+/**
+ * Default cadence for fire-and-forget liveness pulses (60 seconds).
+ *
+ * MATCHED PAIR — do not change alone. The client's inactivity window
+ * (`DEFAULT_IDLE_TIMEOUT_MS` in GraphQLDataProvider's fireAndForgetHelper) is sized at roughly
+ * 3x this value, so a healthy run always refreshes the timer well before it expires. Lengthening
+ * this without lengthening that window makes every quiet stretch of a long agent run look like a
+ * stall and trips reconciliation; shortening the window without shortening this does the same.
+ *
+ * WAS 5 MINUTES (MJ #4222). Paired with the old 12-minute window, a client whose transport had
+ * silently died waited 12 minutes to notice — on runs that typically finish in 20 seconds. The
+ * pulse is a few dozen bytes and exists only while an operation is actually running, so the
+ * added traffic is negligible: a 40-minute run now sends ~40 pulses instead of ~8, and the
+ * 20-second run that motivated the change still sends none.
+ */
+export const DEFAULT_PULSE_INTERVAL_MS = 60 * 1000;
 
 /** The `type` discriminator carried by liveness pulse messages. */
 export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
@@ -15,38 +29,38 @@ export const HEARTBEAT_MESSAGE_TYPE = 'Heartbeat';
  */
 export interface PulseStatus {
     /** Primary key of the persisted run record (AIAgentRun, TestRun, TestSuiteRun). */
-    runId?: string;
+    runId?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
     /** Current run status, e.g. 'Running'. */
-    status?: string;
+    status?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
     /** Optional human-readable current step for UI display. */
-    currentStep?: string;
+    currentStep?: string;  // case-violation-ok-legacy-back-compat: optional, and the old name is also read off a value the checker cannot type; renaming it stays assignable and silently yields undefined
 }
 
 /** Handle returned by {@link startLivenessPulse}; call `stop()` when the work settles. */
 export interface LivenessPulseHandle {
-    stop(): void;
+    Stop(): void;
 }
 
 export interface LivenessPulseOptions {
     /** PubSub engine used to publish on the shared push-status topic. */
-    pubSub: PubSubEngine;
+    pubSub: PubSubEngine;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /** Session the client is subscribed on (used by the subscription filter). */
-    sessionId: string;
+    sessionId: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
     /**
      * Authenticated user the operation belongs to (B49). Stamped on every pulse so the
      * subscription filter binds delivery to identity, not just the client-chosen sessionId.
      */
-    ownerUserId: string;
+    ownerUserId: string;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /** Resolver label echoed in the message envelope (e.g. 'RunAIAgentResolver'). */
-    resolver: string;
+    resolver: string;  // case-violation-ok-legacy-back-compat: the old name is also read off a value typed `any`, where a rename would compile and silently return undefined
     /** Pulse cadence in ms. Defaults to {@link DEFAULT_PULSE_INTERVAL_MS}. */
-    intervalMs?: number;
+    intervalMs?: number;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
     /**
      * Optional cheap status reader invoked on each tick. Should read from an
      * in-memory ref, not the database. Errors are swallowed so a transient read
      * never kills the pulse loop.
      */
-    readStatus?: () => PulseStatus | undefined;
+    readStatus?: () => PulseStatus | undefined;  // case-violation-ok-legacy-back-compat: renaming it broke a use the checker could not see from the declaration — the compile proved it
 }
 
 /**
@@ -60,7 +74,7 @@ export interface LivenessPulseOptions {
  * (`{ message: JSON.stringify({ resolver, type, status, data }), sessionId }`),
  * so the client receives it through the same subscription with no special parsing.
  */
-export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
+export function StartLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
     const { pubSub, sessionId, ownerUserId, resolver, readStatus } = options;
     const intervalMs = options.intervalMs ?? DEFAULT_PULSE_INTERVAL_MS;
 
@@ -73,7 +87,7 @@ export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulse
             LogError(`[LivenessPulse:${resolver}] readStatus failed: ${(e as Error).message}`);
         }
 
-        publishStatusUpdate(pubSub, {
+        PublishStatusUpdate(pubSub, {
             sessionId,
             ownerUserId,
             message: JSON.stringify({
@@ -86,6 +100,11 @@ export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulse
     }, intervalMs);
 
     return {
-        stop: () => clearInterval(timer),
+        Stop: () => clearInterval(timer),
     };
 }
+
+/** @deprecated Use {@link StartLivenessPulse}. */
+export function startLivenessPulse(options: LivenessPulseOptions): LivenessPulseHandle {
+    return StartLivenessPulse(options);
+}

package/src/generic/OrphanedConversationDetailReconciler.ts

@@ -0,0 +1,267 @@
+import { LogError, LogStatus, RunView } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/sqlserver-dataprovider';
+import type { IMetadataProvider, UserInfo } from '@memberjunction/core';
+import type { MJAIAgentRunEntity, MJConversationDetailEntity } from '@memberjunction/core-entities';
+
+/**
+ * Grace period after a run reaches a terminal state before its conversation detail is considered
+ * abandoned. The normal path closes the detail moments after the run finishes; this waits well past
+ * that so a reconcile can never race a completion that is already on its way.
+ */
+export const ORPHAN_DETAIL_GRACE_MS = 2 * 60 * 1000;
+
+/** Ceiling on details closed per pass, so a large backlog cannot stall startup. */
+const MAX_DETAILS_PER_PASS = 200;
+
+/**
+ * Agent-run statuses that mean the run succeeded. `AwaitingFeedback` is the normal end of a chat
+ * turn: the agent replied and the next move is the user's.
+ */
+const SUCCESSFUL_RUN_STATUSES: MJAIAgentRunEntity['Status'][] = ['Completed', 'AwaitingFeedback'];
+
+/**
+ * Agent-run statuses that mean execution is over, whatever the outcome. `Paused` is absent: the
+ * run is parked on a workflow that is still executing.
+ */
+const TERMINAL_RUN_STATUSES: MJAIAgentRunEntity['Status'][] = [...SUCCESSFUL_RUN_STATUSES, 'Failed', 'Cancelled'];
+
+/**
+ * Close conversation details left `In-Progress` by a run that is already over (MJ #4222).
+ *
+ * WHY THIS EXISTS. `AgentRunner` closes the detail as the final step of a run, so a process that
+ * dies mid-run never reaches it. The agent-run watchdog repairs the RUN — force-failing it once the
+ * heartbeat goes stale — but nothing repairs the detail, and the detail is the row the chat renders
+ * from. The result is durable state that disagrees with itself: a terminal run beside a message
+ * that still says it is being generated, spinning forever for anyone who opens it.
+ *
+ * WHY NOT IN THE SWEEP PROC. `spSweepStaleAIAgentRuns` is a single set-based UPDATE, and extending
+ * it to the detail would be the obvious fix. It would also be the wrong one: `MJ: Conversation
+ * Details` declares `TrustServerCacheCompletely`, so the server's RunView cache relies on
+ * `BaseEntity` events for invalidation and a stored procedure fires none. The row would change
+ * while every instance kept serving `In-Progress` from cache — a worse failure than the one being
+ * fixed, because reconciliation itself would read the stale value back. Going through
+ * `BaseEntity.Save()` costs a per-row write and buys correct invalidation everywhere.
+ *
+ * Idempotent and safe to run concurrently on several instances: the write is a no-op once the
+ * status is terminal, and each pass re-reads state before deciding.
+ *
+ * @returns How many details were closed.
+ */
+export async function ReconcileOrphanedConversationDetails(
+    provider: IMetadataProvider,
+    contextUser: UserInfo,
+    graceMs: number = ORPHAN_DETAIL_GRACE_MS
+): Promise<number> {
+    try {
+        const rv = RunView.FromMetadataProvider(provider);
+
+        const detailResult = await rv.RunView<MJConversationDetailEntity>(
+            {
+                EntityName: 'MJ: Conversation Details',
+                ExtraFilter: `Status = 'In-Progress' AND Role = 'AI'${hasTerminalRunClause(provider)}`,
+                OrderBy: '__mj_CreatedAt ASC',
+                MaxRows: MAX_DETAILS_PER_PASS,
+                ResultType: 'entity_object',
+            },
+            contextUser
+        );
+        if (!detailResult.Success || !detailResult.Results?.length) {
+            return 0;
+        }
+
+        const runsByDetail = await loadTerminalRuns(rv, detailResult.Results.map(d => d.ID), contextUser);
+        if (runsByDetail.size === 0) {
+            return 0;
+        }
+
+        const ownersByConversation = await loadConversationOwners(
+            rv,
+            detailResult.Results.map(d => d.ConversationID).filter((id): id is string => !!id),
+            contextUser
+        );
+
+        const cutoff = Date.now() - graceMs;
+        let closed = 0;
+
+        for (const detail of detailResult.Results) {
+            const run = runsByDetail.get(detail.ID);
+            if (!run) {
+                // No run yet, or its run is still executing. Both are legitimately in progress.
+                continue;
+            }
+            const completedAt = run.CompletedAt ? new Date(run.CompletedAt).getTime() : NaN;
+            if (!Number.isFinite(completedAt) || completedAt > cutoff) {
+                // Inside the grace window — the owning process may still be closing this itself.
+                continue;
+            }
+
+            // Write as the conversation's OWNER, not as the system user.
+            //
+            // `MJConversationDetailEntityExtended.Save()` gates writes on conversation ownership: a
+            // non-owner without a resource grant is refused, returning false with no result
+            // registered anywhere — indistinguishable from a crash, and the reason this pass
+            // silently wrote nothing at all until it was traced. The system user owns no
+            // conversations, so it is exactly the caller that gate exists to stop. Saving as the
+            // owner satisfies the gate on its own terms rather than routing around it, and keeps
+            // the write attributable to the person whose message it is.
+            const owner = detail.ConversationID ? ownersByConversation.get(detail.ConversationID) : undefined;
+            if (!owner) {
+                LogError(`[OrphanDetailReconciler] No owner resolved for conversation ${detail.ConversationID}; leaving detail ${detail.ID}`);
+                continue;
+            }
+            const writable = await provider.GetEntityObject<MJConversationDetailEntity>('MJ: Conversation Details', owner);
+            if (!(await writable.Load(detail.ID))) {
+                LogError(`[OrphanDetailReconciler] Could not load detail ${detail.ID} for write`);
+                continue;
+            }
+            if (writable.Status !== 'In-Progress') {
+                // Closed by something else since the list query. Its outcome stands.
+                continue;
+            }
+            // The failure marker belongs only to the error branch. A completed run has nothing to
+            // report, so an empty message stays empty rather than contradicting its own status.
+            if (SUCCESSFUL_RUN_STATUSES.includes(run.Status)) {
+                writable.Status = 'Complete';
+            } else {
+                writable.Status = 'Error';
+                if (!writable.Message) {
+                    writable.Message = run.ErrorMessage ?? '❌ Failed';
+                }
+            }
+
+            if (await writable.Save()) {
+                closed++;
+            } else {
+                const result = writable.LatestResult;
+                LogError(
+                    `[OrphanDetailReconciler] Failed to close detail ${detail.ID}: ` +
+                    `${result?.CompleteMessage || result?.Message || 'no message'}`
+                );
+            }
+        }
+
+        if (closed > 0) {
+            LogStatus(`[OrphanDetailReconciler] Closed ${closed} conversation detail(s) left behind by finished runs`);
+        }
+        return closed;
+    } catch (err) {
+        // Maintenance work must never take the server down with it.
+        LogError(`[OrphanDetailReconciler] Pass failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 0;
+    }
+}
+
+/** The quoting a database provider offers. Present on every server-side provider. */
+interface QuotingProvider {
+    QuoteIdentifier(name: string): string;
+    QuoteSchemaAndView(schemaName: string, objectName: string): string;
+}
+
+function isQuotingProvider(provider: IMetadataProvider): provider is IMetadataProvider & QuotingProvider {
+    const p = provider as IMetadataProvider & Partial<QuotingProvider>;
+    return typeof p.QuoteIdentifier === 'function' && typeof p.QuoteSchemaAndView === 'function';
+}
+
+/**
+ * Filter clause that keeps only details with at least one finished run.
+ *
+ * Details with no run, or whose run is still executing, are never closed here. Without this clause
+ * they fill the oldest-first window, and once 200 of them accumulate no closable orphan is reached.
+ * The newest-run check in {@link loadTerminalRuns} still decides each remaining detail.
+ *
+ * @returns An ` AND ...` clause, or an empty string when the provider cannot quote names.
+ */
+function hasTerminalRunClause(provider: IMetadataProvider): string {
+    const runs = provider.EntityByName('MJ: AI Agent Runs');
+    if (!runs || !isQuotingProvider(provider)) {
+        return '';
+    }
+    const statuses = TERMINAL_RUN_STATUSES.map(s => `'${s}'`).join(',');
+    return (
+        ` AND ID IN (SELECT ${provider.QuoteIdentifier('ConversationDetailID')}` +
+        ` FROM ${provider.QuoteSchemaAndView(runs.SchemaName, runs.BaseView)}` +
+        ` WHERE ${provider.QuoteIdentifier('Status')} IN (${statuses}))`
+    );
+}
+
+/**
+ * Newest terminal run per conversation detail. Details whose newest run is still executing are
+ * deliberately absent, so a retried message is judged on its latest attempt rather than an older
+ * finished one.
+ */
+async function loadTerminalRuns(
+    rv: RunView,
+    detailIds: string[],
+    contextUser: UserInfo
+): Promise<Map<string, MJAIAgentRunEntity>> {
+    const quoted = detailIds.map(id => `'${id.replace(/'/g, "''")}'`).join(',');
+    const result = await rv.RunView<MJAIAgentRunEntity>(
+        {
+            EntityName: 'MJ: AI Agent Runs',
+            ExtraFilter: `ConversationDetailID IN (${quoted})`,
+            OrderBy: '__mj_CreatedAt DESC',
+            ResultType: 'entity_object',
+        },
+        contextUser
+    );
+    if (!result.Success) {
+        return new Map();
+    }
+
+    const newest = new Map<string, MJAIAgentRunEntity>();
+    for (const run of result.Results ?? []) {
+        const detailId = run.ConversationDetailID;
+        if (!detailId || newest.has(detailId)) {
+            continue; // DESC order puts the newest run first
+        }
+        newest.set(detailId, run);
+    }
+
+    // Drop any detail whose newest attempt is still running.
+    for (const [detailId, run] of newest) {
+        if (!TERMINAL_RUN_STATUSES.includes(run.Status)) {
+            newest.delete(detailId);
+        }
+    }
+    return newest;
+}
+
+/**
+ * Owner `UserInfo` per conversation, resolved through {@link UserCache}. The reconciler writes as
+ * the owner so the conversation-detail permission gate is satisfied on its own terms.
+ */
+async function loadConversationOwners(
+    rv: RunView,
+    conversationIds: string[],
+    contextUser: UserInfo
+): Promise<Map<string, UserInfo>> {
+    const owners = new Map<string, UserInfo>();
+    if (conversationIds.length === 0) {
+        return owners;
+    }
+    const quoted = [...new Set(conversationIds)].map(id => `'${id.replace(/'/g, "''")}'`).join(',');
+    const result = await rv.RunView<{ ID: string; UserID: string }>(
+        {
+            EntityName: 'MJ: Conversations',
+            ExtraFilter: `ID IN (${quoted})`,
+            Fields: ['ID', 'UserID'],
+            ResultType: 'simple',
+        },
+        contextUser
+    );
+    if (!result.Success) {
+        return owners;
+    }
+    const users = UserCache.Instance.Users;
+    for (const row of result.Results ?? []) {
+        if (!row.UserID) {
+            continue;
+        }
+        const user = users.find(u => UUIDsEqual(u.ID, row.UserID));
+        if (user) {
+            owners.set(row.ID, user);
+        }
+    }
+    return owners;
+}