@memberjunction/server 6.2.0-edge.3 → 6.2.0-edge.5

package/src/services/MJStorageBlobStore.ts

@@ -1,7 +1,7 @@
 import { LogError, UserInfo, IMetadataProvider, Metadata } from '@memberjunction/core';
 import { MJGlobal } from '@memberjunction/global';
 import type { MJFileEntity, MJFileStorageProviderEntity } from '@memberjunction/core-entities';
-import { FileStorageBase, FileStorageEngine } from '@memberjunction/storage';
+import { FileStorageBase, FileStorageEngine, StorageAccessEvaluator, StorageAccountAccess, StorageObjectKeyOf } from '@memberjunction/storage';
 import type {
     AttachmentBlobUploadInput,
     AttachmentBlobUploadResult,
@@ -113,7 +113,7 @@ export class MJStorageBlobStore implements IAttachmentBlobStore {
         provider?: IMetadataProvider
     ): Promise<string | null> {
         try {
-            const resolved = await this.resolveFileAndDriver(fileId, contextUser, provider);
+            const resolved = await this.resolveFileAndDriver(fileId, contextUser, 'Read', provider);
             if (!resolved) return null;
 
             const content = await resolved.driver.GetObject({ fullPath: resolved.objectKey });
@@ -132,7 +132,7 @@ export class MJStorageBlobStore implements IAttachmentBlobStore {
         provider?: IMetadataProvider
     ): Promise<string | null> {
         try {
-            const resolved = await this.resolveFileAndDriver(fileId, contextUser, provider);
+            const resolved = await this.resolveFileAndDriver(fileId, contextUser, 'Read', provider);
             if (!resolved) return null;
             return resolved.driver.CreatePreAuthDownloadUrl(resolved.objectKey);
         } catch (err) {
@@ -148,7 +148,7 @@ export class MJStorageBlobStore implements IAttachmentBlobStore {
         provider?: IMetadataProvider
     ): Promise<boolean> {
         try {
-            const resolved = await this.resolveFileAndDriver(fileId, contextUser, provider);
+            const resolved = await this.resolveFileAndDriver(fileId, contextUser, 'Write', provider);
             if (!resolved) return false;
 
             const deleted = await resolved.driver.DeleteObject(resolved.objectKey);
@@ -165,45 +165,46 @@ export class MJStorageBlobStore implements IAttachmentBlobStore {
     }
 
     /**
-     * Loads a file, its storage provider, and a driver able to act on it.
+     * Loads a file (as the caller), and a driver able to act on it — through the storage gate.
      *
      * Shared by download, URL and delete, which previously repeated this block three times with
      * subtly different fallbacks — the account-credential path existed in only one of them.
+     *
+     * When an account links to the file's provider, `FileStorageEngine.ResolveFileObject` resolves it and refuses unless
+     * the caller may use that account for `access` and may read every `MJ: Files` row tracking the object (a row can
+     * alias another row's object). Otherwise the environment-configured driver serves the file; there is no account to
+     * gate, so only the tracked-file rule applies. A refusal throws, and each caller logs it and reports failure.
      */
     private async resolveFileAndDriver(
         fileId: string,
         contextUser: UserInfo,
+        access: StorageAccountAccess,
         provider?: IMetadataProvider
     ): Promise<{ file: MJFileEntity; driver: FileStorageBase; objectKey: string } | null> {
         const md = provider ?? Metadata.Provider;
-
-        // Load the engine before asking it anything. `Accounts` returns an empty array when it has
-        // not been configured, so on a cold process the account-credential branch below would be
-        // skipped silently and the driver would fall back to environment-only credentials — which
-        // then fails to read a file that is perfectly readable. Every other MJServer call site
-        // configures immediately before use for the same reason.
-        await FileStorageEngine.Instance.Config(false, contextUser);
-
         const file = await md.GetEntityObject<MJFileEntity>('MJ: Files', contextUser);
         if (!(await file.Load(fileId))) return null;
 
-        const storageProvider = await md.GetEntityObject<MJFileStorageProviderEntity>(
-            'MJ: File Storage Providers',
-            contextUser
-        );
-        if (!(await storageProvider.Load(file.ProviderID))) return null;
-
-        // Prefer account-scoped credentials when an account links to this provider; fall back to
-        // environment-configured credentials otherwise.
-        const matchingAccounts = FileStorageEngine.Instance.GetAccountsByProviderID(file.ProviderID);
-        const driver =
-            matchingAccounts.length > 0
-                ? await FileStorageEngine.Instance.GetDriver(matchingAccounts[0].ID, contextUser)
-                : MJGlobal.Instance.ClassFactory.CreateInstance<FileStorageBase>(
-                      FileStorageBase,
-                      storageProvider.ServerDriverKey
-                  );
+        // Prefer account-scoped credentials (gated) when an account links to this provider. ResolveFileObject configures
+        // the engine first, so a cold process does not silently skip this branch.
+        const resolved = await FileStorageEngine.Instance.ResolveFileObject(file, contextUser, access, md);
+        if (resolved) {
+            return { file, driver: resolved.Driver, objectKey: resolved.ObjectKey };
+        }
+        return this.environmentDriverFor(file, contextUser, md);
+    }
 
-        return { file, driver, objectKey: file.ProviderKey || file.Name };
+    /** The environment-configured driver for a file whose provider has no account — after the tracked-file rule. */
+    private async environmentDriverFor(
+        file: MJFileEntity,
+        contextUser: UserInfo,
+        md: IMetadataProvider
+    ): Promise<{ file: MJFileEntity; driver: FileStorageBase; objectKey: string } | null> {
+        const storageProvider = await md.GetEntityObject<MJFileStorageProviderEntity>('MJ: File Storage Providers', contextUser);
+        if (!(await storageProvider.Load(file.ProviderID))) return null;
+        const objectKey = StorageObjectKeyOf(file);
+        await StorageAccessEvaluator.Instance.AssertTrackedObjectsReadable(file.ProviderID, [objectKey], contextUser, md);
+        const driver = MJGlobal.Instance.ClassFactory.CreateInstance<FileStorageBase>(FileStorageBase, storageProvider.ServerDriverKey);
+        return { file, driver, objectKey };
     }
 }

package/src/services/StartTaskGraphDispatcher.ts

@@ -75,10 +75,10 @@ export async function StartTaskGraphDispatcher(
         { InstanceID: instanceID ?? defaultInstanceID() },
         // Without this the dispatcher had nowhere to deliver: a finished graph logged its outcome,
         // marked itself delivered, and said nothing to the conversation that asked for it.
-        new TaskGraphContinuationDeliverer(providerFactory, contextUser),
+        new TaskGraphContinuationDeliverer(providerFactory, contextUser, pubSub),
         // Live signal. Supplied only when a PubSub engine exists — in a worker or a test there is
         // nobody to publish to, and the dispatcher runs identically without one.
-        pubSub ? new TaskGraphFrameBroadcaster(pubSub) : undefined,
+        pubSub ? new TaskGraphFrameBroadcaster(pubSub, true) : undefined,
         // Action nodes — the third execution shape, beside agents and people. Durable After* entity
         // actions land as these.
         new TaskGraphActionRunner(),

package/src/services/TaskGraphActionRunner.ts

@@ -35,7 +35,7 @@ export class TaskGraphActionRunner implements TaskActionRunner {
                 Filters: [],
             });
 
-            const output = this.buildOutput(result.Params);
+            const output = this.buildOutput(result.Params, result.Message);
             const unstorable = this.findUnstorableOutput(output);
             if (unstorable) {
                 const message =
@@ -90,15 +90,35 @@ export class TaskGraphActionRunner implements TaskActionRunner {
      * is exactly what the Demo workflow did: step 1 completed with an output payload of `{}` and
      * every downstream branch was skipped, with nothing anywhere reporting a problem.
      *
-     * Only `Output` and `Both` params are included. Echoing the inputs back would let a step's own
-     * parameters masquerade as its results, so an output mapping could "succeed" by reading the
-     * value the step was given rather than the one it produced.
+     * Only `Output` and `Both` params are included (plus any structured JSON object returned in
+     * `resultMessage`, such as `Create Document`'s `{ handle, documentType, fileName }`). Echoing
+     * `Input`-only params back would let a step's own parameters masquerade as its results, so an
+     * output mapping could "succeed" by reading the value the step was given rather than the one it
+     * produced.
      */
-    private buildOutput(actionParams: ActionParam[]): Record<string, unknown> {
+    private buildOutput(actionParams: ActionParam[], resultMessage?: string | null): Record<string, unknown> {
         const output: Record<string, unknown> = {};
+        if (typeof resultMessage === 'string') {
+            const trimmed = resultMessage.trim();
+            if (trimmed.startsWith('{') && trimmed.endsWith('}')) {
+                try {
+                    const parsed: unknown = JSON.parse(trimmed);
+                    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                        Object.assign(output, parsed as Record<string, unknown>);
+                    }
+                } catch {
+                    // Non-JSON prose message; ignore.
+                }
+            }
+        }
         for (const p of actionParams ?? []) {
             if (p.Type === 'Output' || p.Type === 'Both') output[p.Name] = p.Value;
         }
+        if (typeof output.handle === 'string' && output.Handle === undefined) {
+            output.Handle = output.handle;
+        } else if (typeof output.Handle === 'string' && output.handle === undefined) {
+            output.handle = output.Handle;
+        }
         return output;
     }
 

package/src/services/TaskGraphAgentRunner.ts

@@ -13,8 +13,12 @@
  * @module @memberjunction/server
  */
 import { AgentRunner } from '@memberjunction/ai-agents';
+import { AIEngine } from '@memberjunction/aiengine';
 import { ChatMessageRole } from '@memberjunction/ai';
-import { LogError } from '@memberjunction/core';
+import { LogError, type UserInfo } from '@memberjunction/core';
+import { UUIDsEqual } from '@memberjunction/global';
+import { UserCache } from '@memberjunction/generic-database-provider';
+import { MJTaskEntity } from '@memberjunction/core-entities';
 import { MJAIAgentEntityExtended, MJAIAgentRunEntityExtended } from '@memberjunction/ai-core-plus';
 import type { AgentExecutionProgressCallback } from '@memberjunction/ai-core-plus';
 import type { TaskAgentRunner, TaskAgentRunParams, TaskAgentRunResult } from '@memberjunction/task-graph';
@@ -27,14 +31,41 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
                 return { Success: false, ErrorMessage: `Agent ${params.AgentID} could not be loaded.` };
             }
 
-            const result = await new AgentRunner().RunAgent({
+            const parentRun = await this.loadSubmittingRun(params);
+            const actingUser = this.resolveActingUser(parentRun?.UserID, params.ContextUser);
+            const engineLoaded = (AIEngine.Instance?.Agents?.length ?? 0) > 0;
+            if (engineLoaded && actingUser && typeof AIEngine.Instance.CanUserRunAgent === 'function') {
+                const permitted = await AIEngine.Instance.CanUserRunAgent(agent.ID, actingUser);
+                if (!permitted) {
+                    return {
+                        Success: false,
+                        ErrorMessage: `User does not have permission to run agent "${agent.Name}".`,
+                    };
+                }
+            }
+            const taskContext = await this.resolveTaskContext(params);
+            const conversationDetailId =
+                parentRun?.ConversationDetailID ?? taskContext.conversationDetailId ?? undefined;
+
+            const runner = new AgentRunner(params.Provider);
+            const result = await runner.RunAgent({
                 agent,
-                conversationMessages: [{ role: ChatMessageRole.user, content: this.buildPrompt(params) }],
-                contextUser: params.ContextUser,
+                provider: params.Provider,
+                conversationMessages: [{
+                    role: ChatMessageRole.user,
+                    content: this.buildPrompt(params, taskContext.name, taskContext.description),
+                }],
+                contextUser: actingUser,
+                conversationId: parentRun?.ConversationID ?? undefined,
+                // A task-graph step receives its explicit InputPayload and DependencyOutputs.
+                // Passing an empty inputArtifacts array prevents AgentRunner.hydrateConversationArtifacts
+                // from loading unrelated artifacts from earlier turns in the conversation and tempting
+                // the step agent to emit `version-source` against a prior turn's artifact.
+                inputArtifacts: [],
                 // Inherited from the graph, so a graph this run goes on to emit is one hop deeper
                 // rather than starting the chain over. Without it MAX_REINVOKE_DEPTH never fires.
                 continuationDepth: params.ContinuationDepth ?? 0,
-                parentRun: await this.loadSubmittingRun(params),
+                parentRun,
                 // The bridge from the agent's own progress stream up to graph-level observers: the
                 // dispatcher turns these into rate-limited `NodeProgress` frames, which is how a
                 // running Agent step shows "what it is doing right now" on the workflow canvas.
@@ -42,6 +73,41 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
             });
 
             const success = result?.success === true;
+            if (
+                success &&
+                result?.payload != null &&
+                conversationDetailId &&
+                result.artifactDirective?.behavior !== 'suppress' &&
+                typeof runner.ProcessAgentArtifacts === 'function'
+            ) {
+                try {
+                    // Each step in a task graph is an independent workflow node and multiple steps
+                    // in the same graph share the originating ConversationDetailID. Enforcing
+                    // `behavior: 'create-new'` (while preserving any directive name/description)
+                    // prevents a step from accidentally versioning an earlier turn's artifact or
+                    // overwriting a sibling DAG step's artifact via FindPreviousArtifactForMessage.
+                    const stepArtifactResult = {
+                        ...result,
+                        artifactDirective: {
+                            ...result.artifactDirective,
+                            behavior: 'create-new' as const,
+                        },
+                    };
+                    await runner.ProcessAgentArtifacts(
+                        stepArtifactResult,
+                        conversationDetailId,
+                        undefined,
+                        actingUser,
+                        params.Provider,
+                    );
+                } catch (artifactErr) {
+                    LogError(
+                        `[TaskGraphAgentRunner] Task ${params.TaskID}: artifact persistence failed (non-fatal): ` +
+                        `${artifactErr instanceof Error ? artifactErr.message : String(artifactErr)}`,
+                    );
+                }
+            }
+
             return {
                 Success: success,
                 Output: this.extractOutput(result),
@@ -55,6 +121,58 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
         }
     }
 
+    private resolveActingUser(ownerUserId: string | null | undefined, fallback: UserInfo): UserInfo {
+        if (!ownerUserId) {
+            return fallback;
+        }
+        try {
+            const users = UserCache.Instance?.Users ?? UserCache.Users ?? [];
+            const matched = users.find((u) => UUIDsEqual(u.ID, ownerUserId));
+            if (matched) {
+                return matched;
+            }
+        } catch {
+            // Fall back to params.ContextUser when UserCache is not initialized.
+        }
+        return fallback;
+    }
+
+    /**
+     * Resolves the step task's `Name`, `Description`, and originating `ConversationDetailID`
+     * (falling back to the parent workflow task row for `ConversationDetailID`).
+     */
+    private async resolveTaskContext(params: TaskAgentRunParams): Promise<{
+        name: string | null;
+        description: string | null;
+        conversationDetailId: string | null;
+    }> {
+        if (!params.TaskID) {
+            return { name: null, description: null, conversationDetailId: null };
+        }
+        try {
+            const task = await params.Provider.GetEntityObject<MJTaskEntity>('MJ: Tasks', params.ContextUser);
+            if (!(await task.Load(params.TaskID))) {
+                return { name: null, description: null, conversationDetailId: null };
+            }
+            const rawDesc = (task.Description || '').trim();
+            const cleanDesc = rawDesc.split(/\n\n--- (?:Output|Error) ---\n/)[0]?.trim() || null;
+            let conversationDetailId = task.ConversationDetailID ?? null;
+            if (!conversationDetailId && task.ParentID) {
+                const parentTask = await params.Provider.GetEntityObject<MJTaskEntity>('MJ: Tasks', params.ContextUser);
+                if (await parentTask.Load(task.ParentID)) {
+                    conversationDetailId = parentTask.ConversationDetailID ?? null;
+                }
+            }
+            return {
+                name: task.Name?.trim() || null,
+                description: cleanDesc,
+                conversationDetailId,
+            };
+        } catch {
+            return { name: null, description: null, conversationDetailId: null };
+        }
+    }
+
     /**
      * Adapts the agent framework's progress callback onto the dispatcher's plain sink.
      *
@@ -104,15 +222,25 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
     }
 
     /**
-     * Builds the agent's instruction from the task's own input plus its dependencies' outputs.
+     * Builds the agent's instruction from the task's name/description, its structured input payload,
+     * and its dependencies' outputs.
      *
      * Dependency outputs are included inline because a task's whole reason for depending on another
      * is to consume what it produced. They are rendered as labelled JSON rather than prose so the
      * agent can parse them reliably rather than inferring structure from formatting.
      */
-    private buildPrompt(params: TaskAgentRunParams): string {
+    private buildPrompt(
+        params: TaskAgentRunParams,
+        taskName?: string | null,
+        taskDescription?: string | null,
+    ): string {
         const sections: string[] = [];
 
+        if (taskName || taskDescription) {
+            const header = taskName ? `## Task: ${taskName}` : '## Task Description';
+            sections.push(taskDescription ? `${header}\n${taskDescription}` : header);
+        }
+
         if (params.InputPayload != null) {
             sections.push(`## Task input\n\`\`\`json\n${JSON.stringify(params.InputPayload, null, 2)}\n\`\`\``);
         }
@@ -129,10 +257,59 @@ export class TaskGraphAgentRunner implements TaskAgentRunner {
             : 'Execute this task.';
     }
 
-    /** Prefers a structured payload over prose, so downstream tasks get data rather than text. */
+    /**
+     * Prefers a structured payload over prose so downstream tasks get data rather than text,
+     * while preserving `agentRun.Message` when the payload object has no `message`/`summary`
+     * property (e.g., when a sub-agent returns a clarification question or human-readable summary)
+     * and normalizing `results` / `result` / `succeeded` for downstream condition evaluation.
+     */
     private extractOutput(result: unknown): unknown {
-        const r = result as { payload?: unknown; agentRun?: { Message?: string } } | null;
-        if (r?.payload != null) return r.payload;
-        return r?.agentRun?.Message ?? null;
+        const r = result as {
+            success?: boolean;
+            payload?: unknown;
+            agentRun?: { Message?: string; FinalStep?: string };
+        } | null;
+        const runMessage = typeof r?.agentRun?.Message === 'string' ? r.agentRun.Message.trim() : '';
+        const isChatStop = r?.agentRun?.FinalStep === 'Chat';
+        if (r?.payload != null) {
+            if (typeof r.payload === 'object' && !Array.isArray(r.payload)) {
+                const payloadObj = r.payload as Record<string, unknown>;
+                const enriched: Record<string, unknown> = { ...payloadObj };
+
+                if (
+                    enriched.results &&
+                    typeof enriched.results === 'object' &&
+                    !Array.isArray(enriched.results)
+                ) {
+                    for (const [k, v] of Object.entries(enriched.results as Record<string, unknown>)) {
+                        if (enriched[k] === undefined) {
+                            enriched[k] = v;
+                        }
+                    }
+                }
+                if (enriched.results !== undefined && enriched.result === undefined) {
+                    enriched.result = enriched.results;
+                } else if (enriched.result !== undefined && enriched.results === undefined) {
+                    enriched.results = enriched.result;
+                }
+
+                if (runMessage && enriched.message == null && enriched.summary == null) {
+                    enriched.message = runMessage;
+                }
+                if (isChatStop) {
+                    enriched.finalStep = 'Chat';
+                } else if (typeof r.success === 'boolean' && enriched.succeeded === undefined) {
+                    enriched.succeeded = r.success;
+                }
+                return enriched;
+            }
+            return r.payload;
+        }
+        if (runMessage) {
+            return isChatStop
+                ? { message: runMessage, finalStep: 'Chat' }
+                : { message: runMessage, succeeded: r?.success === true };
+        }
+        return null;
     }
 }