@memberjunction/server 6.2.0-edge.4 → 6.2.0-edge.6

package/src/resolvers/QuerySystemUserResolver.ts

@@ -1,6 +1,6 @@
 import { Arg, Ctx, Field, InputType, Mutation, ObjectType, registerEnumType, Resolver, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext } from '../types.js';
-import { LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
+import { AssertClientInputWritableForUser, LogError, UserInfo, CompositeKey, DatabaseProviderBase, LogStatus } from '@memberjunction/core';
 import { MJQueryCategoryEntity, MJQueryPermissionEntity, MJQueryFieldEntity, MJQueryParameterEntity, MJQueryEntityEntity, QueryEngine } from '@memberjunction/core-entities';
 import { MJQueryResolver, MJQuery_, MJQueryField_, MJQueryParameter_, MJQueryEntity_, MJQueryPermission_ } from '../generated/generated.js';
 import { GetReadWriteProvider } from '../util.js';
@@ -301,6 +301,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 CacheMaxSize: input.CacheMaxSize || null
             };
 
+            // Field-level security: refuse a key the caller may not read, or that names no field
+            AssertClientInputWritableForUser(record.EntityInfo, fieldsToSet, context.userPayload.userRecord);
             record.SetMany(fieldsToSet, true);
 
             // Pass caller-provided parameter sample values to override LLM guesses
@@ -324,7 +326,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 }
 
 
-                return await this.buildSuccessResult(record);
+                return await this.buildSuccessResult(record, context.userPayload.userRecord, provider);
             }
             else {
                 // Save failed - check if another request created the same query (race condition)
@@ -337,7 +339,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                     LogStatus(`[CreateQuery] Unique constraint detected for query '${input.Name}'. Using existing query (ID: ${existingQuery.ID}) created by concurrent request.`);
                     const existingEntity = await provider.GetEntityObject<MJQueryEntityServer>('MJ: Queries', context.userPayload.userRecord);
                     if (await existingEntity.Load(existingQuery.ID)) {
-                        return await this.buildSuccessResult(existingEntity);
+                        return await this.buildSuccessResult(existingEntity, context.userPayload.userRecord, provider);
                     }
                     // Entity load failed after confirming the row exists — extremely rare
                     return {
@@ -367,11 +369,16 @@ export class MJQueryResolverExtended extends MJQueryResolver {
      * Maps an MJQueryEntityServer (with loaded related metadata) to a QueryMutationResultType.
      * Uses entity.GetAll() for scalar fields so that new CodeGen-generated fields are included
      * automatically without manual updates. Related entity arrays are mapped explicitly.
+     *
+     * @param contextUser The caller the result is for. Field security projects the record for them.
      */
-    private async buildSuccessResult(entity: MJQueryEntityServer): Promise<QueryMutationResultType> {
+    private async buildSuccessResult(entity: MJQueryEntityServer, contextUser: UserInfo, provider: DatabaseProviderBase): Promise<QueryMutationResultType> {
         return {
             Success: true,
-            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll()) as MJQuery_,
+            // Mapped for the caller, so the field-security projection applies: the record was just
+            // saved, and a save re-reads the whole row.
+            // fls-guard: projected for contextUser by MapFieldNamesToCodeNames
+            Query: await this.MapFieldNamesToCodeNames('MJ: Queries', entity.GetAll(), contextUser, provider) as MJQuery_,
             Fields: this.mapFields(entity.QueryFields),
             Parameters: this.mapParameters(entity.QueryParameters),
             Entities: this.mapEntities(entity.QueryEntities),
@@ -523,6 +530,8 @@ export class MJQueryResolverExtended extends MJQueryResolver {
             if (input.CacheTTLMinutes !== undefined) updateFields.CacheTTLMinutes = input.CacheTTLMinutes;
             if (input.CacheMaxSize !== undefined) updateFields.CacheMaxSize = input.CacheMaxSize;
 
+            // Field-level security: refuse a key the caller may not read
+            AssertClientInputWritableForUser(queryEntity.EntityInfo, updateFields, context.userPayload.userRecord);
             // Use SetMany to update all fields at once
             queryEntity.SetMany(updateFields);
 
@@ -554,7 +563,7 @@ export class MJQueryResolverExtended extends MJQueryResolver {
                 await this.createPermissions(provider, input.Permissions, queryID, context.userPayload.userRecord);
             }
 
-            return await this.buildSuccessResult(queryEntity);
+            return await this.buildSuccessResult(queryEntity, context.userPayload.userRecord, provider);
 
         } catch (err) {
             LogError(err);

package/src/resolvers/RSUResolver.ts

@@ -318,6 +318,18 @@ export class RSUResolver {
             SkipRestart: input.SkipRestart ?? undefined,
         }));
 
+        // MJ-APPLY-6 — deliberately the BARE call, not RunPipelineBatchWithRetry. Everywhere else
+        // the MigrationSQL was generated by SchemaBuilder, so the manager knows what a replay would
+        // re-execute. Here it is arbitrary SQL handed in by the caller, and `executeMigration` is
+        // NOT transactional: it splits on GO/statement boundaries and issues one ExecuteSQL per
+        // chunk, so a migration that fails on chunk 3 leaves chunks 1-2 committed while the step is
+        // recorded `failed` — which is exactly the state `canSafelyRetry` reads as "nothing was
+        // applied, safe to replay". The replay then re-runs the committed chunks and reports THEIR
+        // "already exists" error in place of the real one. For generated DDL that risk is accepted
+        // upstream (SchemaBuilder.RunSchemaPipeline); for caller-authored DDL it is not ours to
+        // take. This is also an attended operator mutation with no in-repo caller — the human on
+        // the other end sees the failure and decides. Keep it in step with the singular
+        // RunRuntimeSchemaUpdate above, which uses bare RunPipeline for the same reason.
         const batchResult = await rsm.RunPipelineBatch(pipelineInputs);
 
         return {

package/src/resolvers/RealtimeClientSessionResolver.ts

@@ -33,7 +33,7 @@
  */
 import { Resolver, Mutation, Arg, Ctx, Int, Float, ObjectType, Field, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
-import { AuthorizationEvaluator, UserInfo, IMetadataProvider, LogError, LogErrorEx, LogStatus, RunView, BaseEntity } from '@memberjunction/core';
+import { AuthorizationEvaluator, UserInfo, IMetadataProvider, DatabaseProviderBase, LogError, LogErrorEx, LogStatus, RunView, BaseEntity } from '@memberjunction/core';
 import { UUIDsEqual, IsValidUUID } from '@memberjunction/global';
 import {
     MJAIAgentEntity,
@@ -44,6 +44,8 @@ import {
     MJConversationDetailArtifactEntity,
     MJConversationDetailEntity,
     ConversationEngine,
+    MJConversationDetailEntityExtended,
+    MJConversationEntity,
 } from '@memberjunction/core-entities';
 import { AIEngine } from '@memberjunction/aiengine';
 import { AIAgentPermissionHelper, AIEngineBase, HasRealtimeUsage, ParseRealtimeUsageRecord, type RealtimeUsageRecord } from '@memberjunction/ai-engine-base';
@@ -62,6 +64,7 @@ import {
     RealtimeAllowedAgent,
     RealtimeDirectActionsConfig,
     REALTIME_ADVANCED_SESSION_CONTROLS_AUTHORIZATION,
+    SqlRealtimeRecordingLedger,
     resolveRecordingStorageAccountID,
     storeRealtimeRecording,
     writeRealtimeRecordingSegment,
@@ -87,6 +90,8 @@ import { ResolveWidgetGuestRunContext, ResolveScopedAnonymousRunUser, ResolveRec
 import { RunWithTrustedSessionConfigWrites } from '@memberjunction/core-entities-server';
 import { BuildMintConfigStamps, LoadInheritedVerifiedIdentity } from '../realtimeSessions/sessionConfigStamps.js';
 import { ParseConfigObject } from '../realtimeSessions/verificationCore.js';
+import { LoadOwnedRealtimeSession } from '../realtimeSessions/ownedRealtimeSession.js';
+import { AuthorizeSessionAccess, LoadSessionForAccess } from '../realtimeSessions/sessionAccess.js';
 
 /**
  * Progress steps worth narrating to the realtime model — mirrors the normal agent-run path's filter
@@ -102,7 +107,6 @@ const SIGNIFICANT_PROGRESS_STEPS = ['prompt_execution', 'action_execution', 'sub
 const MAX_USAGE_DETAILS_JSON_LENGTH = 4096;
 
 /** Entity name — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
-const SESSION_ENTITY = 'MJ: AI Agent Sessions';
 const CO_AGENT_ENTITY = 'MJ: AI Agent Co Agents';
 const CONVERSATION_DETAIL_ENTITY = 'MJ: Conversation Details';
 const CHANNEL_ENTITY = 'MJ: AI Agent Channels';
@@ -415,7 +419,7 @@ export class CancelRealtimeSessionToolResult {
  * Result of {@link RealtimeClientSessionResolver.UploadRealtimeRecording} — a structured
  * success/failure envelope. A recording-storage failure must never throw to the browser (the
  * session it belongs to has already ended), so problems come back as `Success: false` with a
- * human-readable reason; only ownership/authn violations (from `loadOwnedSession`) still throw.
+ * human-readable reason; only ownership/authn violations (from `LoadOwnedRealtimeSession`) still throw.
  */
 @ObjectType()
 export class UploadRealtimeRecordingResult {
@@ -595,7 +599,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         );
 
         // Best-effort: stamp recording-start metadata when the browser captured (with consent) at start.
-        await this.stampRecordingStart(session, recordingConsent, recordingStartedAt);
+        await this.stampRecordingStart(session, recordingConsent, recordingStartedAt, contextUser, provider);
 
         const clientTools = this.parseClientTools(clientToolsJson);
         const channelCandidates = this.parseChannelCandidates(channelCandidatesJson);
@@ -664,10 +668,18 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<void> {
+        let inheritedVerified: Awaited<ReturnType<typeof LoadInheritedVerifiedIdentity>> = undefined;
+        try {
+            inheritedVerified = await LoadInheritedVerifiedIdentity(lastSessionId, contextUser, provider);
+        } catch (error) {
+            LogError(
+                `StartRealtimeClientSession: failed to load inherited verified identity for prior session ${lastSessionId}: ${(error as Error).message}`,
+            );
+        }
         const plan = BuildMintConfigStamps({
             EffectiveRealtime: this.readEffectiveRealtime(effectiveConfigJson),
             ExistingConfigRaw: session.Config_,
-            InheritedVerified: await LoadInheritedVerifiedIdentity(lastSessionId, contextUser, provider),
+            InheritedVerified: inheritedVerified,
             NowMs: Date.now(),
         });
         if (!plan) {
@@ -902,12 +914,15 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
         const session = await this.loadOwnedActiveSession(agentSessionId, contextUser, provider);
-
-        const saved = replacesPrevious
-            ? await this.replacePreviousTranscriptTurn(session, role, text, contextUser, provider, utteranceStartMs, utteranceEndMs)
-            : await this.persistTranscriptTurn(session, role, text, contextUser, provider, utteranceStartMs, utteranceEndMs);
-        if (!saved) {
-            return false;
+        const persistDetail =
+            this.mapTranscriptRole(role) === 'User' || (await this.callerOwnsConversation(session, contextUser, provider));
+        if (persistDetail) {
+            const saved = replacesPrevious
+                ? await this.replacePreviousTranscriptTurn(session, role, text, contextUser, provider, utteranceStartMs, utteranceEndMs)
+                : await this.persistTranscriptTurn(session, role, text, contextUser, provider, utteranceStartMs, utteranceEndMs);
+            if (!saved) {
+                return false;
+            }
         }
         // Mirror the turn onto the co-agent's long-lived prompt run so its Messages capture the full
         // conversation (run-viewer observability parity). Best-effort — never fails the transcript relay.
@@ -926,7 +941,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             );
         }
         await this.sessionManager.Heartbeat(agentSessionId, contextUser, provider);
-        return true;
+        return persistDetail;
     }
 
     /**
@@ -944,7 +959,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
      * the call and uploads the assembled blob (base64) once the session ends.
      *
      * Hard gates (in order):
-     * 1. Ownership — `loadOwnedSession` enforces `UserID === contextUser.ID` (throws on violation).
+     * 1. Ownership — `LoadOwnedRealtimeSession` enforces `UserID === contextUser.ID` (throws on violation).
      * 2. Consent — `consent !== true` is a hard refusal: no audio is ever stored without it.
      * 3. Storage configuration — the session's agent must resolve a recording storage account (the
      *    agent's `RecordingStorageProviderID`, else `AttachmentStorageProviderID`).
@@ -973,7 +988,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('peaks', () => [Float], { nullable: true }) peaks?: number[],
     ): Promise<UploadRealtimeRecordingResult> {
         const { contextUser, provider } = this.requireUserAndProvider(ctx.userPayload, ctx.providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         // HARD consent gate — no audio is ever stored without an explicit grant.
         if (consent !== true) {
@@ -1015,16 +1030,21 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             });
 
             // Canonical consolidated file written — drop the crash-recovery shards (best-effort).
-            if (stored.FileID) {
+            // A FileID with an ErrorMessage is an uploaded file the session was not stamped with: the
+            // shards are then the only recording the janitor could still recover, so keep them.
+            const storedAndStamped = !!stored.FileID && !stored.ErrorMessage;
+            if (storedAndStamped) {
                 await deleteRealtimeRecordingSegments(agentSessionId, accountID, runUser);
+            } else if (stored.FileID) {
+                LogError(`RealtimeClientSessionResolver.UploadRealtimeRecording: session ${agentSessionId} has file ${stored.FileID} but it is not stamped (${stored.ErrorMessage}); shards kept`);
             }
 
             return {
-                Success: !!stored.FileID,
+                Success: storedAndStamped,
                 FileID: stored.FileID ?? undefined,
                 // Report the reason the storage layer knew (e.g. Drive's "Service Accounts do not have
                 // storage quota"); the generic sentence is only for when no layer supplied one.
-                ErrorMessage: stored.FileID ? undefined : (stored.ErrorMessage ?? 'Storage upload failed.'),
+                ErrorMessage: storedAndStamped ? undefined : (stored.ErrorMessage ?? 'Storage upload failed.'),
             };
         } catch (error) {
             const message = error instanceof Error ? error.message : String(error);
@@ -1060,7 +1080,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     ): Promise<boolean> {
         try {
             const { contextUser, provider } = this.requireUserAndProvider(ctx.userPayload, ctx.providers);
-            const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+            const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
             // The consolidated recording already landed and its upload deleted the shards; a shard
             // arriving now (one still on the wire at hang-up) would be an orphan nothing deletes.
             if (session.RecordingFileID) {
@@ -1183,7 +1203,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('callId', () => String, { nullable: true }) callId?: string,
     ): Promise<CancelRealtimeSessionToolResult> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
         try {
             const aborted = this.clientSessionService.CancelInFlightDelegations(agentSessionId, callId);
             return { AbortedCount: aborted, Success: true };
@@ -1230,7 +1250,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Arg('usageDetailsJson', () => String, { nullable: true }) usageDetailsJson?: string,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         const inputDelta = this.clampTokenDelta(inputTokens);
         const outputDelta = this.clampTokenDelta(outputTokens);
@@ -1358,7 +1378,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<boolean> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         if (!this.isChannelInSessionScope(session, channelName)) {
             LogError(`SaveSessionChannelState: channel '${channelName}' is not in session ${agentSessionId}'s resolved scope — state not saved.`);
@@ -1441,7 +1461,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         @Ctx() { userPayload, providers }: AppContext,
     ): Promise<SaveSessionChannelArtifactResult> {
         const { contextUser, provider } = this.requireUserAndProvider(userPayload, providers);
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
 
         if (!this.isChannelInSessionScope(session, channelName)) {
             const message = `SaveSessionChannelArtifact: channel '${channelName}' is not in session ${agentSessionId}'s resolved scope — nothing saved.`;
@@ -1476,7 +1496,7 @@ export class RealtimeClientSessionResolver extends ResolverBase {
     private requireUserAndProvider(
         userPayload: AppContext['userPayload'],
         providers: AppContext['providers'],
-    ): { contextUser: UserInfo; provider: IMetadataProvider } {
+    ): { contextUser: UserInfo; provider: DatabaseProviderBase } {
         const contextUser = this.GetUserFromPayload(userPayload);
         if (!contextUser) {
             throw new Error('Not authenticated: no user context for realtime session operation');
@@ -1954,37 +1974,13 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<MJAIAgentSessionEntity> {
-        const session = await this.loadOwnedSession(agentSessionId, contextUser, provider);
+        const session = await LoadOwnedRealtimeSession(agentSessionId, contextUser, provider);
         if (session.Status === 'Closed') {
             throw new Error(`Realtime session ${agentSessionId} is closed`);
         }
         return session;
     }
 
-    /**
-     * Loads a session and enforces inbound ownership (`UserID === contextUser.ID`) WITHOUT
-     * rejecting `Closed` sessions — {@link SaveSessionChannelState}'s final on-end flush
-     * legitimately arrives after the session closed. Throws when not found / not owned.
-     */
-    private async loadOwnedSession(
-        agentSessionId: string,
-        contextUser: UserInfo,
-        provider: IMetadataProvider,
-    ): Promise<MJAIAgentSessionEntity> {
-        const session = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
-        const loaded = await session.Load(agentSessionId);
-        if (!loaded) {
-            throw new Error(`Realtime session ${agentSessionId} not found`);
-        }
-        if (!UUIDsEqual(session.UserID, contextUser.ID)) {
-            LogError(
-                `RealtimeClientSessionResolver: ownership check failed — user ${contextUser.ID} attempted to operate on session ${agentSessionId} owned by ${session.UserID}`,
-            );
-            throw new Error('Not authorized: you do not own this realtime session');
-        }
-        return session;
-    }
-
     /**
      * Resolves an ACTIVE channel definition (`MJ: AI Agent Channels`) by name from
      * {@link AIEngineBase}'s cached `AgentChannels` (provider-scoped engine instance, lazy
@@ -2087,14 +2083,18 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             return null;
         }
         try {
-            const prior = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
-            if (!(await prior.Load(lastSessionId))) {
+            const loaded = await LoadSessionForAccess(lastSessionId, contextUser, provider);
+            if (!loaded) {
                 LogError(`StartRealtimeClientSession: prior session ${lastSessionId} not found — skipping channel-state restore.`);
                 return null;
             }
-            if (!UUIDsEqual(prior.UserID, contextUser.ID)) {
+            const access = AuthorizeSessionAccess(
+                { SessionUserID: loaded.Session.UserID, ConversationExternalID: loaded.ConversationExternalID, ConversationReadable: loaded.ConversationReadable },
+                contextUser,
+            );
+            if (!access.Allowed) {
                 LogError(
-                    `StartRealtimeClientSession: prior session ${lastSessionId} is not owned by user ${contextUser.ID} — ` +
+                    `StartRealtimeClientSession: prior session ${lastSessionId} is not owned by user ${contextUser.ID} (${access.Reason}) — ` +
                         'skipping channel-state restore.',
                 );
                 return null;
@@ -2301,24 +2301,28 @@ export class RealtimeClientSessionResolver extends ResolverBase {
                 break;
             }
             visited.add(key);
-            const leg = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
-            if (!(await leg.Load(cursor))) {
+            const loaded = await LoadSessionForAccess(cursor, contextUser, provider);
+            if (!loaded) {
                 if (legIDs.length === 0) {
                     LogError(`StartRealtimeClientSession: prior session ${cursor} not found — skipping transcript hydration.`);
                 }
                 break;
             }
-            if (!UUIDsEqual(leg.UserID, contextUser.ID)) {
+            const access = AuthorizeSessionAccess(
+                { SessionUserID: loaded.Session.UserID, ConversationExternalID: loaded.ConversationExternalID, ConversationReadable: loaded.ConversationReadable },
+                contextUser,
+            );
+            if (!access.Allowed) {
                 if (legIDs.length === 0) {
                     LogError(
-                        `StartRealtimeClientSession: prior session ${cursor} is not owned by user ${contextUser.ID} — ` +
+                        `StartRealtimeClientSession: prior session ${cursor} is not owned by user ${contextUser.ID} (${access.Reason}) — ` +
                             'skipping transcript hydration.',
                     );
                 }
                 break;
             }
-            legIDs.push(leg.ID);
-            cursor = leg.LastSessionID ?? null;
+            legIDs.push(loaded.Session.ID);
+            cursor = loaded.Session.LastSessionID ?? null;
         }
         return legIDs;
     }
@@ -2599,8 +2603,9 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         callerUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<string | null> {
-        const detail = await provider.GetEntityObject<MJConversationDetailEntity>(CONVERSATION_DETAIL_ENTITY, callerUser);
+        const detail = await provider.GetEntityObject<MJConversationDetailEntityExtended>(CONVERSATION_DETAIL_ENTITY, callerUser);
         detail.NewRecord();
+        detail.MarkServerAuthoredReply(); // a server-written system anchor, not the caller's words
         detail.ConversationID = session.ConversationID;
         detail.BranchID = this.sessionBranchIdOf(session);
         detail.Role = 'AI';
@@ -2868,17 +2873,26 @@ export class RealtimeClientSessionResolver extends ResolverBase {
 
     /**
      * Stamps `RecordingStartedAt` (the recording `t0` alignment origin) + `RecordingMedia` on a
-     * just-started session when the browser captured WITH consent. Best-effort: a parse/save failure
-     * is logged and swallowed — a recording-metadata problem must never fail the session start.
+     * just-started session when the browser captured WITH consent. `RecordingStartedAt` goes through
+     * the entity save (and stays set on the in-memory session, so a later save of it cannot clear it);
+     * `RecordingMedia` is a recording-ledger column that an entity save cannot write (#6010), so it goes
+     * through the ledger's `spStampAIAgentSessionRecordingFile` proc. The proc stamps `t0` as well, so it
+     * lands even when the entity save fails: the janitor recovers only sessions that carry a
+     * `RecordingStartedAt`. Best-effort: a parse/save/stamp failure is logged and swallowed — a
+     * recording-metadata problem must never fail the session start.
      *
      * @param session The freshly created/loaded session.
      * @param recordingConsent Whether the user consented to recording — only `true` stamps anything.
      * @param recordingStartedAt ISO-8601 recording start timestamp from the browser.
+     * @param contextUser The caller, on whose behalf the proc runs.
+     * @param provider The server-side database provider the proc runs through.
      */
     private async stampRecordingStart(
         session: MJAIAgentSessionEntity,
         recordingConsent: boolean | undefined,
         recordingStartedAt: string | undefined,
+        contextUser: UserInfo,
+        provider: DatabaseProviderBase,
     ): Promise<void> {
         if (recordingConsent !== true || !recordingStartedAt) {
             return;
@@ -2889,12 +2903,19 @@ export class RealtimeClientSessionResolver extends ResolverBase {
             return;
         }
         session.RecordingStartedAt = startedAt;
-        session.RecordingMedia = 'Audio';
         if (!(await session.Save())) {
             LogError(
                 `RealtimeClientSessionResolver.stampRecordingStart save failed for session ${session.ID}: ${this.describeSaveFailure(session)}`,
             );
         }
+        try {
+            await new SqlRealtimeRecordingLedger(provider, contextUser).StampFile(session.ID, { media: 'Audio', startedAt });
+        } catch (error) {
+            LogError(
+                `RealtimeClientSessionResolver.stampRecordingStart media stamp failed for session ${session.ID}: ` +
+                    `${error instanceof Error ? error.message : String(error)}`,
+            );
+        }
     }
 
     /**
@@ -2913,11 +2934,14 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         utteranceStartMs?: number,
         utteranceEndMs?: number,
     ): Promise<boolean> {
-        const detail = await provider.GetEntityObject<MJConversationDetailEntity>(
+        const detail = await provider.GetEntityObject<MJConversationDetailEntityExtended>(
             CONVERSATION_DETAIL_ENTITY,
             contextUser,
         );
         detail.NewRecord();
+        // The agent's side of the session's transcript is written here, on the server, for the session's owner
+        // (the user's side is theirs and the marker does not touch it).
+        detail.MarkServerAuthoredReply();
         detail.ConversationID = session.ConversationID;
         detail.BranchID = this.sessionBranchIdOf(session);
         detail.Role = this.mapTranscriptRole(role);
@@ -3006,10 +3030,11 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         // failure here looked like before the re-load. The insert path beside this one has
         // always used `GetEntityObject`; this now matches it, which is also why they now succeed
         // and fail for the same reasons.
-        const previous = await provider.GetEntityObject<MJConversationDetailEntity>(
+        const previous = await provider.GetEntityObject<MJConversationDetailEntityExtended>(
             CONVERSATION_DETAIL_ENTITY,
             writeUser,
         );
+        previous.MarkServerAuthoredReply(); // as persistTranscriptTurn: the session's own transcript turn
         if (!(await previous.Load(found.ID))) {
             LogError(
                 `RealtimeClientSessionResolver.replacePreviousTranscriptTurn could not re-load turn `
@@ -3050,6 +3075,28 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         return role.trim().toLowerCase() === 'user' ? 'User' : 'AI';
     }
 
+    /**
+     * True when the session's conversation belongs to the caller. In client-direct mode the agent's
+     * words and tool facts reach the server only from the browser, so the server can't vouch for them:
+     * they are stored as the agent's reply only in the caller's own conversation (A19). In a
+     * conversation shared with the caller, only the caller's own side of the session is kept.
+     */
+    private async callerOwnsConversation(
+        session: MJAIAgentSessionEntity,
+        contextUser: UserInfo,
+        provider: IMetadataProvider,
+    ): Promise<boolean> {
+        if (!session.ConversationID) {
+            return false;
+        }
+        const conversation = await provider.GetEntityObject<MJConversationEntity>('MJ: Conversations', contextUser);
+        const owned = (await conversation.Load(session.ConversationID)) && UUIDsEqual(conversation.UserID, contextUser.ID);
+        if (!owned) {
+            LogStatus(`RealtimeClientSessionResolver: session ${session.ID} relays the agent's side only into the caller's own conversation; conversation ${session.ConversationID} is not the caller's, so the agent's turn is not stored.`);
+        }
+        return owned;
+    }
+
     /**
      * Persists a direct action or channel tool execution as a hidden ConversationDetail turn.
      * Stored as stable facts (Role: 'AI', HiddenToUser: true, ExternalID: callId, CompletionTime: durationMs,
@@ -3083,15 +3130,16 @@ export class RealtimeClientSessionResolver extends ResolverBase {
         contextUser: UserInfo,
         provider: IMetadataProvider,
     ): Promise<boolean> {
-        if (!session.ConversationID) {
+        if (!(await this.callerOwnsConversation(session, contextUser, provider))) {
             return false;
         }
         try {
-            const detail = await provider.GetEntityObject<MJConversationDetailEntity>(
+            const detail = await provider.GetEntityObject<MJConversationDetailEntityExtended>(
                 CONVERSATION_DETAIL_ENTITY,
                 contextUser,
             );
             detail.NewRecord();
+            detail.MarkServerAuthoredReply(); // the tool's facts are recorded by the server, as the session's owner
             detail.ConversationID = session.ConversationID;
             detail.BranchID = this.sessionBranchIdOf(session);
             detail.Role = 'AI';

package/src/resolvers/RemoteBrowserActionResolver.ts

@@ -19,7 +19,6 @@
 import { Resolver, Mutation, Query, Arg, Ctx, Float, Int, ObjectType, Field, PubSub, PubSubEngine } from 'type-graphql';
 import { AppContext, UserPayload } from '../types.js';
 import { UserInfo, IMetadataProvider, LogError } from '@memberjunction/core';
-import { UUIDsEqual } from '@memberjunction/global';
 import { MJAIAgentSessionEntity, MJAIAgentEntity } from '@memberjunction/core-entities';
 import { NormalizeInstanceKey, RemoteBrowserEngine } from '@memberjunction/remote-browser-server';
 import { BeginBrowserGoalStep, FinalizeBrowserGoalStep, ExtractCoAgentRunID } from '../agentSessions/remoteBrowserGoalEngine.js';
@@ -35,13 +34,16 @@ import {
 } from '@memberjunction/remote-browser-base';
 import { ResolverBase } from '../generic/ResolverBase.js';
 import { GetReadWriteProvider } from '../util.js';
+import {
+  LoadOwnedRealtimeSession,
+  RealtimeSessionNotFoundError,
+  RealtimeSessionOwnershipError,
+} from '../realtimeSessions/ownedRealtimeSession.js';
 import { PUSH_STATUS_UPDATES_TOPIC } from '../generic/PushStatusResolver.js';
 import { AIEngine } from '@memberjunction/aiengine';
 import { AIPromptRunner } from '@memberjunction/ai-prompts';
 import { AIPromptParams } from '@memberjunction/ai-core-plus';
 
-/** Entity name — centralised so the `MJ:`-prefix convention is applied in exactly one place. */
-const SESSION_ENTITY = 'MJ: AI Agent Sessions';
 /** Entity name for the agent whose `TypeConfiguration` carries the remote-browser provider preference. */
 const AGENT_ENTITY = 'MJ: AI Agents';
 /**
@@ -1084,14 +1086,17 @@ export class RemoteBrowserActionResolver extends ResolverBase {
    * @returns The loaded, owned session entity.
    */
   protected async loadOwnedSession(agentSessionID: string, contextUser: UserInfo, provider: IMetadataProvider): Promise<MJAIAgentSessionEntity> {
-    const session = await provider.GetEntityObject<MJAIAgentSessionEntity>(SESSION_ENTITY, contextUser);
-    if (!(await session.Load(agentSessionID))) {
-      throw new Error(`Remote-browser session ${agentSessionID} not found.`);
-    }
-    if (!UUIDsEqual(session.UserID, contextUser.ID)) {
-      throw new Error(`Not authorized: remote-browser session ${agentSessionID} is not owned by you.`);
+    try {
+      return await LoadOwnedRealtimeSession(agentSessionID, contextUser, provider);
+    } catch (err) {
+      if (err instanceof RealtimeSessionNotFoundError) {
+        throw new Error(`Remote-browser session ${agentSessionID} not found.`);
+      }
+      if (err instanceof RealtimeSessionOwnershipError) {
+        throw new Error(`Not authorized: remote-browser session ${agentSessionID} is not owned by you.`);
+      }
+      throw err;
     }
-    return session;
   }
 
   /**