@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.4

package/src/resolvers/UserAvatarResolver.ts

@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Self-service avatar mutation: `UpdateMyAvatar(ImageURL, IconClass)`.
+ *
+ * WHY THIS EXISTS. Explorer's My Profile photo used to be a plain entity save of the caller's own
+ * `MJ: Users` row, which needs Update permission on `MJ: Users`. A deployment that locks its
+ * security model down cannot give ordinary users that permission: a row-level "own row only"
+ * filter restricts ROWS, not COLUMNS, so a user who may update their own row may also rewrite
+ * their own `Email` — and many read filters key on `{{UserEmail}}`, so the new value would match
+ * another person's memberships. MJ has no per-role field permissions (`MJUserEntityServer` in
+ * core-entities-server documents the same limit for `Type`). On such deployments every avatar save
+ * failed, and the login avatar sync failed silently.
+ *
+ * WHAT IT DOES. The caller comes ONLY from the request context — there is no user-ID argument. The
+ * input is validated at this trust boundary (`ValidateAvatarInput`). The caller's own row is then
+ * loaded AS THE SYSTEM USER, any state other than the two avatar columns is discarded, and only
+ * `UserImageURL` and `UserImageIconClass` are set before saving. Because the write is made as the
+ * system user, the caller's ID is logged. It works the same whether or not the caller holds Update
+ * on `MJ: Users`.
+ *
+ * Scope-limited sessions are refused (`IsScopeLimitedPrincipal`). An anonymous magic-link guest IS
+ * the shared Anonymous principal, so "their own row" belongs to every guest, and a system-user save
+ * goes around the entity permissions and RLS that confine any magic-link session.
+ *
+ * `MJUserEntityServer` accepts this save: the system user is the seeded `Type='Owner'` user, which
+ * is exempt from its invariants, and the save changes neither `Type` nor `Name` in any case.
+ *
+ * @module @memberjunction/server/resolvers/UserAvatarResolver
+ */
+import { Arg, Ctx, Field, Mutation, ObjectType, Resolver } from 'type-graphql';
+import { LogError, LogStatus, UserInfo } from '@memberjunction/core';
+import type { MJUserEntity } from '@memberjunction/core-entities';
+import { AppContext } from '../types.js';
+import { GetReadWriteProvider } from '../util.js';
+import { GetSystemUser } from '../auth/index.js';
+import { IsScopeLimitedPrincipal } from '../auth/scopeLimitedPrincipal.js';
+import { ResolverBase } from '../generic/ResolverBase.js';
+import { ValidateAvatarInput } from './avatarInputValidation.js';
+
+/** What the browser sees when the save fails. The server's detail goes to the log only. */
+const SAVE_FAILED_MESSAGE = 'Could not save your avatar. Please try again or contact your administrator.';
+
+@ObjectType()
+export class UpdateMyAvatarResult {
+  @Field()
+  Success: boolean;
+
+  @Field({ nullable: true })
+  ErrorMessage?: string;
+}
+
+@Resolver()
+export class UserAvatarResolver extends ResolverBase {
+  /**
+   * Sets the CALLER's avatar. Null or empty clears a column; both null reverts to the default.
+   * Validation failures and save failures are returned as `Success: false` with a message.
+   */
+  @Mutation(() => UpdateMyAvatarResult)
+  async UpdateMyAvatar(
+    @Ctx() ctx: AppContext,
+    @Arg('ImageURL', () => String, { nullable: true }) imageURL?: string | null,
+    @Arg('IconClass', () => String, { nullable: true }) iconClass?: string | null,
+  ): Promise<UpdateMyAvatarResult> {
+    const caller = ctx.userPayload?.userRecord as UserInfo | undefined;
+    if (!caller?.ID) {
+      throw new Error('User is not authenticated');
+    }
+    if (IsScopeLimitedPrincipal(caller)) {
+      return { Success: false, ErrorMessage: 'Changing your avatar is not permitted for scope-limited sessions.' };
+    }
+    await this.CheckAPIKeyScopeAuthorization('entity:update', 'MJ: Users', ctx.userPayload);
+
+    const input = ValidateAvatarInput(imageURL, iconClass);
+    if (!input.Valid) {
+      return { Success: false, ErrorMessage: input.ErrorMessage };
+    }
+
+    try {
+      return await this.saveAvatar(ctx, caller, input.ImageURL, input.IconClass);
+    } catch (e) {
+      LogError(`UpdateMyAvatar: failed for user ${caller.ID}: ${e instanceof Error ? e.message : String(e)}`);
+      return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+    }
+  }
+
+  /** Loads the caller's own row as the system user and writes ONLY the two avatar columns. */
+  private async saveAvatar(
+    ctx: AppContext,
+    caller: UserInfo,
+    imageURL: string | null,
+    iconClass: string | null,
+  ): Promise<UpdateMyAvatarResult> {
+    const systemUser = await GetSystemUser();
+    const provider = GetReadWriteProvider(ctx.providers);
+    const user = await provider.GetEntityObject<MJUserEntity>('MJ: Users', systemUser);
+    if (!(await user.Load(caller.ID))) {
+      LogError(`UpdateMyAvatar: could not load the MJ: Users row for user ${caller.ID}`);
+      return { Success: false, ErrorMessage: 'Could not load your user record.' };
+    }
+
+    user.Revert(); // nothing but the two avatar columns may reach the write
+    user.UserImageURL = imageURL;
+    user.UserImageIconClass = iconClass;
+    LogStatus(`UpdateMyAvatar: user ${caller.ID} requested an avatar change; saving as the system user`);
+    if (!(await user.Save())) {
+      const detail = user.LatestResult?.CompleteMessage ?? 'unknown error';
+      LogError(`UpdateMyAvatar: save failed for user ${caller.ID}: ${detail}`);
+      return { Success: false, ErrorMessage: SAVE_FAILED_MESSAGE };
+    }
+    return { Success: true };
+  }
+}

package/src/resolvers/UserResolver.ts

@@ -8,6 +8,7 @@ import {
   RequireContextUser,
   RequireLoadedUser,
   RequireRoleProvider,
+  SessionUserFields,
   UserIdExtraFilter,
 } from './currentUserRoles.js';
 
@@ -42,22 +43,7 @@ export class UserResolver extends MJUserResolverBase {
 
     if (context.userPayload.userRecord) {
       const userRecord = context.userPayload.userRecord;
-      const userData = {
-        ID: userRecord.ID,
-        Name: userRecord.Name,
-        FirstName: userRecord.FirstName,
-        LastName: userRecord.LastName,
-        Title: userRecord.Title,
-        Email: userRecord.Email,
-        Type: userRecord.Type,
-        IsActive: userRecord.IsActive,
-        LinkedRecordType: userRecord.LinkedRecordType,
-        EmployeeID: userRecord.EmployeeID,
-        LinkedEntityID: userRecord.LinkedEntityID,
-        LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
-        __mj_CreatedAt: userRecord.__mj_CreatedAt,
-        __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
-      };
+      const userData = SessionUserFields(userRecord);
       console.log('CurrentUser (from userRecord)', userData.Email);
       const provider = GetReadOnlyProvider(context.providers, { allowFallbackToReadWrite: true });
       const mapped = await this.MapFieldNamesToCodeNames('MJ: Users', userData, userRecord, provider) as MJUser_;

package/src/resolvers/agentVisionConsentAudit.ts

@@ -0,0 +1,82 @@
+/**
+ * @fileoverview The audit trail for agent-vision consent: one `MJ: Audit Logs` row each time a person allows, or stops
+ * letting, agents see their camera and shared screen in a meeting room, including when LiveKit refuses the change.
+ *
+ * The row is saved by the system user, as MJ's other server-written audit rows are, because the person may not be
+ * allowed to create audit rows themselves; `UserID` and `RecordID` are the person. When the audit log type has not
+ * been seeded, the entry goes to the server log instead, so a choice is never left unrecorded.
+ *
+ * Invoked from `RealtimeBridgeResolver.SetLiveKitAgentVision`.
+ *
+ * @module @memberjunction/server
+ */
+
+import { LogError, type IMetadataProvider, type UserInfo } from '@memberjunction/core';
+import type { MJAuditLogEntity } from '@memberjunction/core-entities';
+import { UserCache } from '@memberjunction/generic-database-provider';
+
+/** The seeded audit log type (see `metadata/audit-log-types/.realtime-session-audit-types.json`). */
+export const REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE = 'Realtime Agent Vision Consent';
+
+const AUDIT_LOG_ENTITY = 'MJ: Audit Logs';
+const USERS_ENTITY = 'MJ: Users';
+
+/** One consent change to record. */
+export interface AgentVisionConsentEntry {
+  /** The person who chose. */
+  User: UserInfo;
+  /** The room they chose for. */
+  RoomName: string;
+  /** `true` to let agents see their camera and shared screen, `false` to stop. */
+  Allow: boolean;
+  /** Whether LiveKit applied the change. */
+  Applied: boolean;
+  /** Why it was not applied. */
+  ErrorMessage?: string;
+}
+
+/**
+ * Writes the audit row for one consent change. Never throws: a failure to audit is logged, and the person's choice
+ * stands as LiveKit applied it.
+ *
+ * @param entry The change to record.
+ * @param provider The request's provider.
+ */
+export async function WriteAgentVisionConsentAudit(entry: AgentVisionConsentEntry, provider: IMetadataProvider | null): Promise<void> {
+  try {
+    const writer = UserCache.Instance.GetSystemUser();
+    const type = provider?.AuditLogTypes?.find((t) => t.Name?.trim().toLowerCase() === REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE.toLowerCase());
+    if (!provider || !writer || !type) {
+      LogError(`Agent vision consent not audited (${missingReason(provider, writer)}): user ${entry.User.ID}: ${describeChange(entry)}`);
+      return;
+    }
+    const row = await provider.GetEntityObject<MJAuditLogEntity>(AUDIT_LOG_ENTITY, writer);
+    row.NewRecord();
+    row.UserID = entry.User.ID;
+    row.AuditLogTypeID = type.ID;
+    row.Status = entry.Applied ? 'Success' : 'Failed';
+    row.EntityID = provider.EntityByName(USERS_ENTITY)?.ID ?? null;
+    row.RecordID = entry.User.ID;
+    row.Description = describeChange(entry);
+    row.Details = JSON.stringify({ roomName: entry.RoomName, allow: entry.Allow, error: entry.ErrorMessage ?? null });
+    if (!(await row.Save())) {
+      LogError(`Agent vision consent audit row not saved for user ${entry.User.ID}: ${row.LatestResult?.CompleteMessage ?? 'unknown error'}`);
+    }
+  } catch (error) {
+    LogError(`Agent vision consent audit write threw for user ${entry.User.ID}: ${error instanceof Error ? error.message : String(error)}`);
+  }
+}
+
+/** Why the audit row can't be written: no provider, no system user, or the audit log type isn't seeded. */
+function missingReason(provider: IMetadataProvider | null, writer: UserInfo | undefined | null): string {
+  if (!provider) {
+    return 'no provider';
+  }
+  return writer ? `audit log type '${REALTIME_AGENT_VISION_CONSENT_AUDIT_TYPE}' is not seeded` : 'no system user';
+}
+
+/** One line saying what the person chose, and whether it was applied. */
+function describeChange(entry: AgentVisionConsentEntry): string {
+  const choice = entry.Allow ? 'Let agents see their camera and shared screen' : 'Stopped letting agents see their camera and shared screen';
+  return `${choice} in room ${entry.RoomName}${entry.Applied ? '' : ' (not applied)'}.`;
+}

package/src/resolvers/avatarInputValidation.ts

@@ -0,0 +1,123 @@
+/**
+ * @fileoverview Trust-boundary validation for the self-service avatar mutation
+ * (`UpdateMyAvatar` in `UserAvatarResolver`).
+ *
+ * The browser checks these values too, but its URL check is `new URL(...)`, which happily accepts
+ * `javascript:` and every `data:` type. The server is the boundary, so everything that reaches
+ * `MJ: Users.UserImageURL` / `UserImageIconClass` through the mutation passes through here first.
+ *
+ * Pure: no I/O, no provider, no entity — so it is unit-testable on its own.
+ *
+ * @module @memberjunction/server/resolvers/avatarInputValidation
+ */
+
+/** Largest DECODED image accepted in a `data:` URI. Matches the Explorer upload cap. */
+export const AVATAR_MAX_IMAGE_BYTES = 200 * 1024;
+
+/** Longest `http:` / `https:` image URL accepted. */
+export const AVATAR_MAX_URL_LENGTH = 2048;
+
+/** Longest icon class string accepted. */
+export const AVATAR_MAX_ICON_CLASS_LENGTH = 100;
+
+/**
+ * Longest `data:` value that can still decode to {@link AVATAR_MAX_IMAGE_BYTES}: the longest accepted
+ * prefix plus the padded base64 payload. Anything longer is refused before the pattern scans it.
+ */
+const AVATAR_MAX_DATA_URI_LENGTH = 'data:image/jpeg;base64,'.length + Math.ceil(AVATAR_MAX_IMAGE_BYTES / 3) * 4;
+
+/** `data:image/<raster type>;base64,<payload>` — SVG is deliberately absent (it can carry script). */
+const DATA_URI_PATTERN = /^data:image\/(png|jpeg|jpg|gif|webp);base64,([A-Za-z0-9+/]+={0,2})$/;
+
+/** Lower-case Font Awesome class lists only, e.g. `fa-solid fa-user`. */
+const ICON_CLASS_PATTERN = /^[a-z0-9 -]+$/;
+const FA_TOKEN_PATTERN = /^fa-[a-z0-9-]+$/;
+
+/** The outcome of {@link ValidateAvatarInput}. Empty strings are normalised to `null` (clear). */
+export interface AvatarInputValidationResult {
+    Valid: boolean;
+    /** Why the input was refused. Set only when `Valid` is false. */
+    ErrorMessage?: string;
+    /** The value to store in `UserImageURL`; `null` clears it. */
+    ImageURL: string | null;
+    /** The value to store in `UserImageIconClass`; `null` clears it. */
+    IconClass: string | null;
+}
+
+/**
+ * Validates a requested avatar. Null or empty values clear the corresponding column, so both
+ * null is a valid "revert to default".
+ *
+ * - `imageURL`: a `data:image/(png|jpeg|jpg|gif|webp);base64,...` URI whose decoded size is at most
+ *   {@link AVATAR_MAX_IMAGE_BYTES}, or an absolute `http:`/`https:` URL of at most
+ *   {@link AVATAR_MAX_URL_LENGTH} characters with no whitespace. Everything else is refused.
+ * - `iconClass`: at most {@link AVATAR_MAX_ICON_CLASS_LENGTH} characters of `[a-z0-9 -]`,
+ *   containing at least one `fa-` token.
+ */
+export function ValidateAvatarInput(
+    imageURL: string | null | undefined,
+    iconClass: string | null | undefined
+): AvatarInputValidationResult {
+    const image = imageURL ? imageURL : null;
+    const icon = iconClass ? iconClass : null;
+    const error = (image === null ? undefined : imageUrlError(image)) ?? (icon === null ? undefined : iconClassError(icon));
+    return error ? { Valid: false, ErrorMessage: error, ImageURL: null, IconClass: null } : { Valid: true, ImageURL: image, IconClass: icon };
+}
+
+/** Returns why an image value is refused, or `undefined` when it is acceptable. */
+function imageUrlError(value: string): string | undefined {
+    if (value.startsWith('data:')) {
+        return dataUriError(value);
+    }
+    return httpUrlError(value);
+}
+
+function dataUriError(value: string): string | undefined {
+    if (value.length > AVATAR_MAX_DATA_URI_LENGTH) {
+        return tooLargeError(Math.floor((value.length * 3) / 4));
+    }
+    const match = DATA_URI_PATTERN.exec(value);
+    if (!match || match[2].length % 4 !== 0) {
+        return 'Avatar image must be a base64 PNG, JPEG, GIF or WEBP data URI.';
+    }
+    const decodedBytes = decodedBase64Length(match[2]);
+    return decodedBytes > AVATAR_MAX_IMAGE_BYTES ? tooLargeError(decodedBytes) : undefined;
+}
+
+function tooLargeError(bytes: number): string {
+    return `Avatar image must be ${AVATAR_MAX_IMAGE_BYTES / 1024}KB or smaller (this one is about ${Math.ceil(bytes / 1024)}KB).`;
+}
+
+/** Decoded byte length of a padded base64 string, without decoding it. */
+function decodedBase64Length(base64: string): number {
+    const padding = base64.endsWith('==') ? 2 : base64.endsWith('=') ? 1 : 0;
+    return (base64.length / 4) * 3 - padding;
+}
+
+function httpUrlError(value: string): string | undefined {
+    const refusal = 'Avatar image URL must be an absolute http or https URL.';
+    if (value.length > AVATAR_MAX_URL_LENGTH) {
+        return `Avatar image URL must be ${AVATAR_MAX_URL_LENGTH} characters or fewer.`;
+    }
+    if (/\s/.test(value) || !/^https?:\/\//i.test(value)) {
+        return refusal;
+    }
+    try {
+        const url = new URL(value);
+        return url.protocol === 'http:' || url.protocol === 'https:' ? undefined : refusal;
+    } catch {
+        return refusal;
+    }
+}
+
+/** Returns why an icon class is refused, or `undefined` when it is acceptable. */
+function iconClassError(value: string): string | undefined {
+    const valid =
+        value.length <= AVATAR_MAX_ICON_CLASS_LENGTH &&
+        ICON_CLASS_PATTERN.test(value) &&
+        value.split(' ').some((token) => FA_TOKEN_PATTERN.test(token));
+    return valid
+        ? undefined
+        : `Avatar icon must be a Font Awesome class list (lower-case letters, digits, spaces and hyphens, ` +
+              `${AVATAR_MAX_ICON_CLASS_LENGTH} characters or fewer, including an fa- class).`;
+}

package/src/resolvers/currentUserRoles.ts

@@ -1,4 +1,4 @@
-import { LogError } from '@memberjunction/core';
+import { LogError, UserInfo } from '@memberjunction/core';
 
 /**
  * Guards and filter builders for CurrentUser role loading.
@@ -6,6 +6,37 @@ import { LogError } from '@memberjunction/core';
  * without importing generated GraphQL types or the Apollo config bootstrap.
  */
 
+/**
+ * The session user's own fields, as CurrentUser returns them. The client asks for every field of
+ * `UserInfo` (GraphQLDataProvider builds its query from it), so each one belongs here; anything
+ * left out reaches the client as null (as IsTemplate once did, hiding the template-user banner).
+ */
+export function SessionUserFields(userRecord: UserInfo) {
+  return {
+    ID: userRecord.ID,
+    Name: userRecord.Name,
+    FirstName: userRecord.FirstName,
+    LastName: userRecord.LastName,
+    Title: userRecord.Title,
+    Email: userRecord.Email,
+    Type: userRecord.Type,
+    IsActive: userRecord.IsActive,
+    IsTemplate: userRecord.IsTemplate,
+    LinkedRecordType: userRecord.LinkedRecordType,
+    EmployeeID: userRecord.EmployeeID,
+    LinkedEntityID: userRecord.LinkedEntityID,
+    LinkedEntityRecordID: userRecord.LinkedEntityRecordID,
+    __mj_CreatedAt: userRecord.__mj_CreatedAt,
+    __mj_UpdatedAt: userRecord.__mj_UpdatedAt,
+    FirstLast: userRecord.FirstLast,
+    EmployeeFirstLast: userRecord.EmployeeFirstLast,
+    EmployeeEmail: userRecord.EmployeeEmail,
+    EmployeeTitle: userRecord.EmployeeTitle,
+    EmployeeSupervisor: userRecord.EmployeeSupervisor,
+    EmployeeSupervisorEmail: userRecord.EmployeeSupervisorEmail,
+  };
+}
+
 export function RequireLoadedUser<T extends { ID?: string }>(
   user: T | null | undefined,
   email: string | undefined,

package/src/resolvers/meetings/meetingMutations.ts

@@ -305,6 +305,12 @@ export async function ExecuteUpdateMeeting(
   }
 }
 
+/**
+ * Starts a meeting for the `StartMeeting` mutation (`MeetingResolver`): marks it `Live`, ensures its Interaction, starts
+ * each agent participant in the room under an agent session created for it, starts an automatic recording, and mints the
+ * caller's client token. An agent that fails to start doesn't fail the meeting; the session created for it is closed
+ * (`Error`).
+ */
 export async function ExecuteStartMeeting(
   provider: IMetadataProvider,
   user: UserInfo,
@@ -343,12 +349,15 @@ export async function ExecuteStartMeeting(
     const agentParticipants = participants.filter((p) => p.Role === 'Agent' && p.AgentID);
 
     for (const ap of agentParticipants) {
+      // Set once this agent's session exists, so a start that fails after it was created can close it.
+      let createdSessionID: string | undefined;
       try {
         const createdSession = await sessionManager.CreateSession(
           { agentID: ap.AgentID!, userID: user.ID },
           user,
           provider,
         );
+        createdSessionID = createdSession.ID;
         await LiveKitAgentRoomCoordinator.Instance.StartAgentRoomSession({
           AgentSessionID: createdSession.ID,
           RoomName: meeting.RoomName,
@@ -357,9 +366,21 @@ export async function ExecuteStartMeeting(
           MetadataProvider: provider,
           TurnMode: 'Active',
           TurnAddressing: 'Auto',
+          // The session exists for this agent's time in the room alone: it closes when the agent leaves (the meeting is
+          // ended, everyone leaves, the agent is stopped), not when the janitor finds it idle.
+          Host: {
+            OnSessionEnded: async (reason) => {
+              await sessionManager.CloseSessionForEndedBridge(createdSession.ID, reason, user, provider);
+            },
+          },
         });
       } catch (agentErr) {
         LogError(`[MeetingResolver] Failed to start agent participant ${ap.AgentID} in room ${meeting.RoomName}: ${agentErr instanceof Error ? agentErr.message : String(agentErr)}`);
+        // The agent never joined, so the hook above never runs: close its session now (Error), not when the janitor finds
+        // it idle. The coordinator has already closed any model session the start opened (#5308).
+        if (createdSessionID) {
+          await sessionManager.CloseSessionForFailedStart(createdSessionID, user, provider);
+        }
       }
     }
 

package/src/services/TaskGraphContinuationDeliverer.ts

@@ -46,7 +46,8 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
     ) {}
 
     /**
-     * Posts the roll-up as an AI-role message in the graph's conversation.
+     * Posts the roll-up as an AI-role message in the graph's conversation, on the fork of the
+     * message that started the graph (Main when that message is in Main).
      *
      * Never throws. The dispatcher calls this inside the compare-and-swap that marks a completion
      * delivered; an error escaping would either abort that guard or leave the graph looking
@@ -62,8 +63,8 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
             }
 
             const provider = await this.providerFactory.CreateProvider();
-            const conversationID = await this.resolveConversationID(params.ConversationDetailID, provider);
-            if (!conversationID) {
+            const origin = await this.resolveOrigin(params.ConversationDetailID, provider);
+            if (!origin) {
                 LogError(
                     `[TaskGraphContinuationDeliverer] Conversation detail ${params.ConversationDetailID} could not be loaded — ` +
                     `"${params.WorkflowName}" has nowhere to post its outcome.`
@@ -73,7 +74,8 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
 
             const detail = await provider.GetEntityObject<MJConversationDetailEntity>('MJ: Conversation Details', this.contextUser);
             detail.NewRecord();
-            detail.ConversationID = conversationID;
+            detail.ConversationID = origin.ConversationID;
+            detail.BranchID = origin.BranchID;
             detail.Role = 'AI';
             detail.Status = 'Complete';
             detail.HiddenToUser = false;
@@ -125,11 +127,15 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
                 return;
             }
 
+            // Run on the fork of the message that started the graph, as PostMessage posts into it:
+            // RunAgent derives the conversation from the detail, but not the fork.
+            const origin = params.ConversationDetailID ? await this.resolveOrigin(params.ConversationDetailID, provider) : null;
             await new AgentRunner().RunAgent({
                 agent,
                 conversationMessages: [{ role: ChatMessageRole.user, content: this.renderMessage(params) }],
                 contextUser: this.contextUser,
                 conversationDetailId: params.ConversationDetailID ?? undefined,
+                ConversationBranchID: origin?.BranchID ?? undefined,
                 // The load-bearing value: without it the next graph this run submits restarts the
                 // chain at zero and the cap never fires.
                 continuationDepth: params.ReinvokeDepth + 1,
@@ -149,10 +155,10 @@ export class TaskGraphContinuationDeliverer implements TaskContinuationDeliverer
         }
     }
 
-    /** The conversation a detail belongs to. */
-    private async resolveConversationID(conversationDetailID: string, provider: IMetadataProvider): Promise<string | null> {
+    /** The conversation and fork (null is Main) of the detail that started the graph; null when it cannot be loaded. */
+    private async resolveOrigin(conversationDetailID: string, provider: IMetadataProvider): Promise<{ ConversationID: string; BranchID: string | null } | null> {
         const detail = await provider.GetEntityObject<MJConversationDetailEntity>('MJ: Conversation Details', this.contextUser);
-        return (await detail.Load(conversationDetailID)) ? detail.ConversationID : null;
+        return (await detail.Load(conversationDetailID)) ? { ConversationID: detail.ConversationID, BranchID: detail.BranchID ?? null } : null;
     }
 
     /**