@myagentroam/node 0.11.38 → 0.11.40

package/dist/service/marctl-caller.js

@@ -0,0 +1,80 @@
+import { isPlainRecord } from '../util/records.js';
+import { assertSessionControlOwner } from './run-ownership-policy.js';
+const executionReadOperations = new Set([
+    'agent.network',
+    'session.cli.context',
+    'session.get',
+    'session.list',
+    'session.graph',
+    'session.runs',
+    'session.goal.get',
+    'session.turns.list',
+    'workspace.queue.get',
+    'session.schedule.list',
+    'session.schedule.get',
+    'runner.profiles.list',
+    'session.watch',
+    'session.unwatch'
+]);
+const executionManagementOperations = new Set([
+    'session.metadata.update',
+    'session.config.update',
+    'session.schedule.agent.save'
+]);
+/** Prevent execution credentials from reaching legacy writes outside their Session tree. */
+export async function authorizeMarctlExecutionOperation(input) {
+    if (!isPlainRecord(input.caller))
+        throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
+    if (input.caller.type === 'terminal')
+        return;
+    if (input.caller.type !== 'execution' || typeof input.caller.sessionId !== 'string')
+        throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
+    if (executionReadOperations.has(input.operation))
+        return;
+    if (!executionManagementOperations.has(input.operation) ||
+        !isPlainRecord(input.data) ||
+        typeof input.data.sessionId !== 'string' ||
+        typeof input.data.workspaceId !== 'string')
+        throw new Error('MARCTL_AGENT_NETWORK_REQUIRED');
+    const source = input.runtime.getAgentSession(input.caller.sessionId);
+    const target = input.runtime.getAgentSession(input.data.sessionId) ??
+        (await input.resolveSession(input.data.sessionId));
+    if (!source ||
+        !target ||
+        source.workspaceId !== input.data.workspaceId ||
+        target.workspaceId !== source.workspaceId ||
+        (target.id !== source.id && target.parentSessionId !== source.id))
+        throw new Error('AGENT_TARGET_NOT_AUTHORIZED');
+    assertSessionControlOwner(input.runtime, target.id, input.userId);
+}
+/** Resolve only Server-verified credentials against the current Node Execution owner. */
+export function resolveMarctlCaller(input) {
+    if (!isPlainRecord(input.caller))
+        return undefined;
+    if (input.caller.type === 'terminal')
+        return { type: 'terminal' };
+    if (input.caller.type !== 'execution' ||
+        typeof input.caller.sessionId !== 'string' ||
+        typeof input.caller.executionId !== 'string' ||
+        !isPlainRecord(input.data) ||
+        typeof input.data.workspaceId !== 'string')
+        return undefined;
+    const session = input.runtime.getAgentSession(input.caller.sessionId);
+    const execution = input.runtime.executionSnapshot(input.caller.executionId);
+    const prepared = input.coordinator.pending(input.caller.executionId);
+    const run = execution && input.runtime.getRun(execution.runId);
+    if (!session ||
+        !execution ||
+        !prepared ||
+        !run ||
+        session.workspaceId !== input.data.workspaceId ||
+        execution.sessionId !== session.id ||
+        prepared.sessionId !== session.id ||
+        prepared.workspaceId !== session.workspaceId ||
+        run.initiatedByUserId !== input.userId ||
+        !['STARTING', 'RUNNING'].includes(execution.status) ||
+        input.runtime.activeSessionRun(session.id)?.id !== run.id ||
+        input.runtime.currentExecutionId(run.id) !== execution.executionId)
+        return undefined;
+    return { type: 'execution', sessionId: session.id, executionId: execution.executionId };
+}

package/dist/service/marctl-execution-credential-control.js

@@ -0,0 +1,65 @@
+import { createEnvelope, marctlExecutionCredentialRequestSchema, marctlExecutionCredentialResponseSchema } from '@myagentroam/protocol';
+/** Correlates private credential exchanges on the authenticated Node connection. */
+export class MarctlExecutionCredentialControl {
+    send;
+    pending = new Map();
+    available = false;
+    connectedToServer = false;
+    constructor(send) {
+        this.send = send;
+    }
+    setFeatures(payload) {
+        const features = payload;
+        this.available = features?.marctlExecutionCredential?.apiVersion === 1;
+    }
+    connected() {
+        this.connectedToServer = true;
+    }
+    disconnected() {
+        this.connectedToServer = false;
+        this.available = false;
+        for (const entry of this.pending.values()) {
+            clearTimeout(entry.timer);
+            entry.reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_UNAVAILABLE'));
+        }
+        this.pending.clear();
+    }
+    handle(envelope) {
+        if (envelope.type !== 'marctl.execution-credential.response')
+            return false;
+        const entry = envelope.replyTo ? this.pending.get(envelope.replyTo) : undefined;
+        if (!entry)
+            return true;
+        this.pending.delete(envelope.replyTo);
+        clearTimeout(entry.timer);
+        const response = marctlExecutionCredentialResponseSchema.safeParse(envelope.payload);
+        if (!response.success || 'error' in response.data)
+            entry.reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_INVALID'));
+        else
+            entry.resolve(response.data.token);
+        return true;
+    }
+    request(input) {
+        if (!this.connectedToServer || !this.available)
+            return Promise.reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_UNAVAILABLE'));
+        const request = marctlExecutionCredentialRequestSchema.safeParse(input);
+        if (!request.success)
+            return Promise.reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_INVALID'));
+        const envelope = createEnvelope('marctl.execution-credential.request', request.data);
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(envelope.id);
+                reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_UNAVAILABLE'));
+            }, 15_000);
+            this.pending.set(envelope.id, { resolve, reject, timer });
+            try {
+                this.send(envelope);
+            }
+            catch {
+                clearTimeout(timer);
+                this.pending.delete(envelope.id);
+                reject(new Error('MARCTL_EXECUTION_AUTHORIZATION_UNAVAILABLE'));
+            }
+        });
+    }
+}

package/dist/service/model-usage-service.js

@@ -19,6 +19,15 @@ export class NodeModelUsageService {
         if (!this.bindings.has(runId))
             this.bind(runId, this.scope.getStore(), sessionId, runner);
     }
+    /** Reuse only the current Run's attribution for an authorized child submission. */
+    grantForRun(runId, sessionId, userId) {
+        const binding = this.bindings.get(runId);
+        if (!binding ||
+            binding.sessionId !== sessionId ||
+            (userId !== undefined && binding.userId !== userId))
+            return undefined;
+        return binding.grant;
+    }
     bind(runId, grant, sessionId, runner) {
         this.bindings.delete(runId);
         if (grant === undefined)

package/dist/service/node-config-mutations.js

@@ -0,0 +1,27 @@
+/** Serializes runtime configuration writes, including transient state and rollback. */
+export class NodeConfigMutations {
+    #pending;
+    run(operation) {
+        const previous = this.#pending;
+        let release;
+        const pending = new Promise((resolve) => {
+            release = resolve;
+        });
+        this.#pending = pending;
+        const finish = () => {
+            if (this.#pending === pending)
+                this.#pending = undefined;
+            release();
+        };
+        let result;
+        try {
+            // Start an uncontended mutation synchronously so disable closes admission before yielding.
+            result = previous === undefined ? operation() : previous.then(operation);
+        }
+        catch (error) {
+            result = Promise.reject(error);
+        }
+        void result.then(finish, finish);
+        return result;
+    }
+}

package/dist/service/node-control-message-service.js

@@ -33,12 +33,22 @@ export class NodeControlMessageService {
             void this.options.handleNodeRequest(envelope);
             return;
         }
+        if (envelope.type === 'node.request.cancel') {
+            const payload = envelope.payload;
+            if (typeof payload?.requestId === 'string')
+                this.options.cancelNodeWait?.(payload.requestId);
+            return;
+        }
         if (this.options.handleRuntimeCredentialResponse(envelope))
             return;
         if (this.options.handleScheduledRunAuthorizeResponse?.(envelope) === true)
             return;
         if (this.options.handleMailNotificationResponse?.(envelope) === true)
             return;
+        if (this.options.handleMarctlExecutionCredentialResponse?.(envelope) === true)
+            return;
+        if (this.options.handleUpgradeCredentialResponse?.(envelope) === true)
+            return;
         if (envelope.type.startsWith('direct.') &&
             this.options.handleDirectTransfer?.(envelope) === true)
             return;

package/dist/service/node-request-service.js

@@ -4,9 +4,18 @@ import { safePublicError } from '../util/safe-error.js';
 /** Validates and executes the closed Admin-facing Node operation envelope. */
 export class NodeRequestService {
     options;
+    waits = new Map();
     constructor(options) {
         this.options = options;
     }
+    cancelWait(requestId) {
+        this.waits.get(requestId)?.abort();
+    }
+    disconnect() {
+        for (const controller of this.waits.values())
+            controller.abort();
+        this.waits.clear();
+    }
     async handle(envelope) {
         const payload = envelope.payload;
         if (typeof payload.operation !== 'string' || !this.options.databaseAvailable()) {
@@ -18,16 +27,48 @@ export class NodeRequestService {
             return;
         }
         const startedAt = performance.now();
+        const waiting = payload.operation === 'agent.network' &&
+            payload.data !== null &&
+            typeof payload.data === 'object' &&
+            payload.data.action === 'wait';
+        const controller = waiting ? new AbortController() : undefined;
+        if (controller)
+            this.waits.set(envelope.id, controller);
         try {
+            const authorization = payload.userAuthorization;
+            const marctlCaller = authorization.marctlCaller === undefined
+                ? undefined
+                : this.options.resolveMarctlCaller?.(authorization.marctlCaller, authorization.userId, payload.data);
+            if (authorization.marctlCaller !== undefined && marctlCaller === undefined)
+                throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
+            if (marctlCaller !== undefined) {
+                if (!this.options.authorizeMarctlOperation)
+                    throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
+                await this.options.authorizeMarctlOperation(marctlCaller, payload.operation, payload.data, authorization.userId);
+            }
             const usageGrant = payload.userAuthorization.usageGrant;
             const data = payload.data !== null && typeof payload.data === 'object'
-                ? {
-                    ...payload.data,
-                    __workspaceWatchSessionHash: payload.userAuthorization
-                        .sessionHash,
-                    __requestUserId: payload.userAuthorization.userId,
-                    ...(usageGrant === undefined ? {} : { __usageGrant: usageGrant })
-                }
+                ? (() => {
+                    const { __marctlCaller: _untrustedCaller, __usageGrant: _untrustedGrant, __marctlExecutionResources: _untrustedExecutionResources, __requestAbortSignal: _untrustedSignal, ...input } = payload.data;
+                    return {
+                        ...input,
+                        __workspaceWatchSessionHash: payload.userAuthorization
+                            .sessionHash,
+                        __requestUserId: payload.userAuthorization.userId,
+                        ...(marctlCaller === undefined ? {} : { __marctlCaller: marctlCaller }),
+                        ...(payload.operation === 'agent.network' &&
+                            marctlCaller !== null &&
+                            typeof marctlCaller === 'object' &&
+                            marctlCaller.type === 'execution' &&
+                            authorization.marctlExecutionResources !== null &&
+                            typeof authorization.marctlExecutionResources === 'object' &&
+                            !Array.isArray(authorization.marctlExecutionResources)
+                            ? { __marctlExecutionResources: authorization.marctlExecutionResources }
+                            : {}),
+                        ...(usageGrant === undefined ? {} : { __usageGrant: usageGrant }),
+                        ...(controller === undefined ? {} : { __requestAbortSignal: controller.signal })
+                    };
+                })()
                 : payload.data;
             const result = await this.options.execute(payload.operation, data);
             this.options.send('node.response', { result }, envelope.id);
@@ -52,6 +93,10 @@ export class NodeRequestService {
             });
             this.options.send('node.response', nodeResponseFailure(failure), envelope.id);
         }
+        finally {
+            if (controller && this.waits.get(envelope.id) === controller)
+                this.waits.delete(envelope.id);
+        }
     }
     sendError(replyTo, error, fallback) {
         const failure = safePublicError(error, fallback);

package/dist/service/node-upgrade-coordinator.js

@@ -7,14 +7,17 @@ export class NodeUpgradeCoordinator {
     onStatus;
     onReady;
     now;
+    prepareHandoff;
     status = { state: 'IDLE', updatedAt: Date.now() };
     timer;
-    constructor(requestPath, activeRunCount, onStatus, onReady, now = Date.now) {
+    attemptId;
+    constructor(requestPath, activeRunCount, onStatus, onReady, now = Date.now, prepareHandoff) {
         this.requestPath = requestPath;
         this.activeRunCount = activeRunCount;
         this.onStatus = onStatus;
         this.onReady = onReady;
         this.now = now;
+        this.prepareHandoff = prepareHandoff;
     }
     snapshot() {
         return this.status;
@@ -34,14 +37,22 @@ export class NodeUpgradeCoordinator {
         }
     }
     request(data) {
-        const targetVersion = record(data).targetVersion;
+        const input = record(data);
+        const targetVersion = input.targetVersion;
         if (typeof targetVersion !== 'string' || !STABLE_VERSION.test(targetVersion))
             throw new Error('NODE_UPGRADE_VERSION_INVALID');
+        const attemptId = input.attemptId;
+        if (attemptId !== undefined &&
+            (typeof attemptId !== 'string' ||
+                !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(attemptId) ||
+                this.prepareHandoff === undefined))
+            throw new Error('NODE_UPGRADE_REQUEST_INVALID');
         if (this.status.state !== 'IDLE' && this.status.state !== 'FAILED') {
-            if (this.status.targetVersion !== targetVersion)
+            if (this.status.targetVersion !== targetVersion || this.attemptId !== attemptId)
                 throw new Error('NODE_UPGRADE_ALREADY_PENDING');
             return { status: 'ALREADY_PENDING', targetVersion, activeRunCount: this.activeRunCount() };
         }
+        this.attemptId = attemptId;
         this.update({
             state: 'WAITING_FOR_RUNS',
             targetVersion,
@@ -56,7 +67,13 @@ export class NodeUpgradeCoordinator {
         if (this.status.state !== 'WAITING_FOR_RUNS')
             throw new Error('NODE_UPGRADE_NOT_CANCELLABLE');
         this.clearTimer();
-        this.update({ state: 'IDLE', updatedAt: this.now() });
+        const attemptId = this.attemptId;
+        this.attemptId = undefined;
+        this.update({
+            state: 'IDLE',
+            ...(attemptId === undefined ? {} : { attemptId }),
+            updatedAt: this.now()
+        });
         return { cancelled: true };
     }
     blocks(operation) {
@@ -95,12 +112,42 @@ export class NodeUpgradeCoordinator {
         const path = this.requestPath();
         const temporary = `${path}.${process.pid}.tmp`;
         await mkdir(dirname(path), { recursive: true, mode: 0o700 });
-        await writeFile(temporary, `${JSON.stringify({ schemaVersion: 1, targetVersion, createdAt: this.now() })}\n`, { mode: 0o600 });
+        await writeFile(temporary, `${JSON.stringify({
+            schemaVersion: 1,
+            targetVersion,
+            createdAt: this.now(),
+            ...(this.attemptId === undefined ? {} : { attemptId: this.attemptId })
+        })}\n`, { mode: 0o600 });
         await rename(temporary, path).catch(async (error) => {
             await rm(temporary, { force: true });
             throw error;
         });
-        this.onReady();
+        try {
+            if (this.attemptId !== undefined)
+                await this.prepareHandoff(this.attemptId, targetVersion);
+            this.onReady();
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === 'NODE_UPGRADE_HANDOFF_UNCERTAIN') {
+                this.update({
+                    state: 'READY_TO_RESTART',
+                    targetVersion,
+                    activeRunCount: 0,
+                    errorCode: 'NODE_UPGRADE_HANDOFF_UNCERTAIN',
+                    updatedAt: this.now()
+                });
+                return;
+            }
+            await rm(path, { force: true });
+            this.update({
+                state: 'FAILED',
+                targetVersion,
+                errorCode: error instanceof Error && /^NODE_UPGRADE_[A-Z_]+$/u.test(error.message)
+                    ? error.message
+                    : 'NODE_UPGRADE_HANDOFF_UNAVAILABLE',
+                updatedAt: this.now()
+            });
+        }
     }
     async checkReadySafely() {
         try {
@@ -117,8 +164,11 @@ export class NodeUpgradeCoordinator {
         }
     }
     update(status) {
-        this.status = status;
-        this.onStatus(status);
+        this.status =
+            status.state !== 'IDLE' && this.attemptId !== undefined
+                ? { ...status, attemptId: this.attemptId }
+                : status;
+        this.onStatus(this.status);
     }
     clearTimer() {
         if (this.timer !== undefined)
@@ -134,3 +184,24 @@ function record(value) {
         throw new Error('NODE_UPGRADE_REQUEST_INVALID');
     return value;
 }
+export function upgradeMetadata(metadata, status, progressAvailable) {
+    const next = { ...(metadata ?? {}) };
+    if (process.env['MAR_NODE_SUPERVISED'] === '1')
+        next.supervisedUpgrade = true;
+    else
+        delete next.supervisedUpgrade;
+    if (progressAvailable)
+        next.upgradeProgress = { apiVersion: 1 };
+    else
+        delete next.upgradeProgress;
+    const attemptId = process.env['MAR_NODE_UPGRADE_ATTEMPT_ID'];
+    if (progressAvailable && attemptId && /^[0-9a-f-]{36}$/iu.test(attemptId))
+        next.upgradeAttemptId = attemptId;
+    else
+        delete next.upgradeAttemptId;
+    if (status.state === 'IDLE' && status.attemptId === undefined)
+        delete next.upgrade;
+    else
+        next.upgrade = status;
+    return next;
+}

package/dist/service/node-upgrade-credential-control.js

@@ -0,0 +1,57 @@
+import { createEnvelope } from '@myagentroam/protocol';
+/** One short-lived request over the authenticated Node control connection. */
+export class NodeUpgradeCredentialControl {
+    send;
+    pending;
+    available = false;
+    constructor(send) {
+        this.send = send;
+    }
+    setFeatures(payload) {
+        const features = payload;
+        this.available = features?.nodeUpgradeProgress?.apiVersion === 1;
+    }
+    disconnect() {
+        this.available = false;
+        if (this.pending) {
+            clearTimeout(this.pending.timer);
+            this.pending.reject(new Error('NODE_UPGRADE_CREDENTIAL_UNAVAILABLE'));
+            this.pending = undefined;
+        }
+    }
+    handle(envelope) {
+        if (envelope.type !== 'node.upgrade.credential.response')
+            return false;
+        const pending = this.pending;
+        if (!pending || pending.id !== envelope.replyTo)
+            return true;
+        this.pending = undefined;
+        clearTimeout(pending.timer);
+        const payload = envelope.payload;
+        if (typeof payload?.token !== 'string' || !/^[A-Za-z0-9_-]{43}$/u.test(payload.token))
+            pending.reject(new Error('NODE_UPGRADE_CREDENTIAL_REJECTED'));
+        else
+            pending.resolve(payload.token);
+        return true;
+    }
+    request(attemptId) {
+        if (!this.available || this.pending)
+            return Promise.reject(new Error('NODE_UPGRADE_CREDENTIAL_UNAVAILABLE'));
+        const envelope = createEnvelope('node.upgrade.credential.request', { attemptId });
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending = undefined;
+                reject(new Error('NODE_UPGRADE_CREDENTIAL_UNAVAILABLE'));
+            }, 15_000);
+            this.pending = { id: envelope.id, resolve, reject, timer };
+            try {
+                this.send(envelope);
+            }
+            catch {
+                clearTimeout(timer);
+                this.pending = undefined;
+                reject(new Error('NODE_UPGRADE_CREDENTIAL_UNAVAILABLE'));
+            }
+        });
+    }
+}

package/dist/service/node-upgrade-reporter.js

@@ -0,0 +1,108 @@
+/** A single in-flight report; changes replace the pending snapshot rather than queuing events. */
+export class NodeUpgradeReporter {
+    credential;
+    send;
+    endpoint;
+    timer;
+    pending;
+    current;
+    inFlight = false;
+    stopped = false;
+    controller;
+    idleWaiters = new Set();
+    constructor(serverUrl, nodeId, credential, send = fetch) {
+        this.credential = credential;
+        this.send = send;
+        const endpoint = new URL(serverUrl);
+        if (endpoint.protocol === 'ws:')
+            endpoint.protocol = 'http:';
+        if (endpoint.protocol === 'wss:')
+            endpoint.protocol = 'https:';
+        if (endpoint.username ||
+            endpoint.password ||
+            (endpoint.protocol !== 'https:' &&
+                !(endpoint.protocol === 'http:' &&
+                    ['localhost', '127.0.0.1', '[::1]'].includes(endpoint.hostname))))
+            throw new Error('NODE_UPGRADE_REPORT_ORIGIN_INVALID');
+        endpoint.pathname = `/api/nodes/${encodeURIComponent(nodeId)}/upgrade/report`;
+        endpoint.search = '';
+        endpoint.hash = '';
+        this.endpoint = endpoint;
+        this.timer = setInterval(() => {
+            if (this.current !== undefined)
+                this.update(this.current);
+        }, 15_000);
+        this.timer.unref();
+    }
+    update(report) {
+        if (this.stopped)
+            return;
+        this.current = report;
+        this.pending = report;
+        void this.flush();
+    }
+    stop() {
+        this.stopped = true;
+        this.pending = undefined;
+        clearInterval(this.timer);
+        this.controller?.abort();
+    }
+    async finish(report) {
+        this.update(report);
+        if (this.inFlight || this.pending !== undefined) {
+            await new Promise((resolve) => {
+                const finish = () => {
+                    clearTimeout(timeout);
+                    this.idleWaiters.delete(finish);
+                    resolve();
+                };
+                const timeout = setTimeout(finish, 5_000);
+                this.idleWaiters.add(finish);
+            });
+        }
+        this.stop();
+    }
+    async flush() {
+        if (this.stopped || this.inFlight || this.pending === undefined)
+            return;
+        const report = this.pending;
+        this.pending = undefined;
+        this.inFlight = true;
+        const controller = new AbortController();
+        this.controller = controller;
+        const timeout = setTimeout(() => controller.abort(), 5_000);
+        timeout.unref();
+        try {
+            const response = await this.send(this.endpoint, {
+                method: 'POST',
+                redirect: 'manual',
+                signal: controller.signal,
+                headers: { authorization: `Bearer ${this.credential}`, 'content-type': 'application/json' },
+                body: JSON.stringify(report)
+            });
+            if (response.status === 401)
+                this.stop();
+            else if (response.ok) {
+                const payload = await response.json();
+                if (typeof payload === 'object' &&
+                    payload !== null &&
+                    'state' in payload &&
+                    payload.state === 'SUCCEEDED')
+                    this.stop();
+            }
+        }
+        catch {
+            // A failed report does not affect a local install; the next interval sends the latest snapshot.
+        }
+        finally {
+            clearTimeout(timeout);
+            this.controller = undefined;
+            this.inFlight = false;
+            if (this.pending !== undefined && !this.stopped)
+                void this.flush();
+            else
+                for (const waiter of this.idleWaiters)
+                    waiter();
+        }
+    }
+}

package/dist/service/run-event-service.js

@@ -155,6 +155,14 @@ export class RunEventService {
         if (!terminalExecution)
             this.options.refreshAttachments?.(run.sessionId);
         const publicStatus = terminalExecution ? finalStatus : status;
+        if (recorded !== undefined && targetsCurrentTurn)
+            this.options.observeAgentEvent?.({
+                run,
+                executionId,
+                eventType,
+                payload,
+                ...(terminalExecution && finalStatus !== undefined ? { terminalStatus: finalStatus } : {})
+            });
         const notificationPayload = this.notificationPayload(runId, eventType, payload, publicStatus, manuallyInterrupted || !targetsCurrentTurn);
         if (publicStatus !== undefined) {
             const currentRun = this.options.runtime.getRun(runId);

package/dist/service/run-workbench-service.js

@@ -22,6 +22,17 @@ export class RunWorkbenchService {
             'run.approval.decide': (data) => this.decideApproval(record(data))
         };
     }
+    /** Atomically validate the target Execution before invoking the existing stop path. */
+    stopAgentExecution(input) {
+        const run = this.options.runtime.activeSessionRun(input.sessionId);
+        if (run === undefined ||
+            (this.options.runtime.currentExecutionId(run.id) ?? run.id) !== input.executionId)
+            throw new Error('RUN_EXECUTION_STALE');
+        return this.cancelOrInterrupt('run.cancel', {
+            runId: run.id,
+            ...(input.requestUserId === undefined ? {} : { __requestUserId: input.requestUserId })
+        });
+    }
     async modelResource(input) {
         const parsed = modelResourceReadInputSchema.safeParse(nodeOperationData(input));
         if (!parsed.success)