@myagentroam/node 0.11.43 → 0.11.44

package/dist/application/node-lifecycle.js

@@ -75,30 +75,53 @@ export class NodeLifecycle {
     async stopResources(handoff) {
         let snapshot;
         let failure;
+        let stage = 'waitForRecovery';
+        const failed = (error) => {
+            failure ??= { error };
+            try {
+                this.shutdown.diagnose(stage, error);
+            }
+            catch {
+                // Diagnostics must not replace the shutdown failure or prevent cleanup.
+            }
+        };
         try {
             await this.shutdown.waitForRecovery();
+            stage = 'drainInput';
             await this.shutdown.drainInput();
         }
         catch (error) {
-            failure = error;
+            failed(error);
         }
         try {
+            stage = 'closeResume';
             await this.shutdown.closeResume();
-            if (failure === undefined && handoff)
+            if (failure === undefined && handoff) {
+                stage = 'capture';
                 snapshot = this.shutdown.capture();
+            }
         }
         catch (error) {
-            failure ??= error;
+            failed(error);
         }
         try {
+            stage = 'dispose';
             await this.shutdown.dispose();
         }
         catch (error) {
-            failure ??= error;
+            failed(error);
         }
         if (failure !== undefined)
-            throw failure;
-        if (snapshot !== undefined)
-            await this.shutdown.publish(snapshot);
+            throw failure.error;
+        if (snapshot !== undefined) {
+            try {
+                await this.shutdown.publish(snapshot);
+            }
+            catch (error) {
+                stage = 'publish';
+                failed(error);
+                throw error;
+            }
+        }
     }
 }

package/dist/connector.js

@@ -197,7 +197,11 @@ export class NodeConnector {
         closeResume: () => this.externalSessionResumeService.close(),
         capture: () => (this.config?.nodeId ? this.restartHandoff.capture() : undefined),
         dispose: () => this.disposeRuntime(),
-        publish: (snapshot) => this.restartHandoff.publish(snapshot)
+        publish: (snapshot) => this.restartHandoff.publish(snapshot),
+        diagnose: (stage, error) => nodeLog('node.shutdown.failed', {
+            stage,
+            errorCode: safeErrorCode(error, 'NODE_SHUTDOWN_FAILED')
+        })
     });
     get stopped() {
         return this.lifecycle.stopped;

package/dist/main.js

@@ -45,10 +45,17 @@ if (command === 'run') {
             clearTimeout(deadline);
             releaseOwner();
             process.exit(exitCode);
-        }, () => {
+        }, (error) => {
             clearTimeout(deadline);
-            nodeLog('node.restart.diagnostic', { code: 'RESTART_HANDOFF_SHUTDOWN_FAILED' });
-            process.exit(1);
+            try {
+                nodeLog('node.restart.diagnostic', {
+                    code: 'RESTART_HANDOFF_SHUTDOWN_FAILED',
+                    errorCode: safeErrorCode(error, 'NODE_SHUTDOWN_FAILED')
+                });
+            }
+            finally {
+                process.exit(1);
+            }
         });
     };
     const supervisorHandoff = new SupervisorUpgradeHandoff();

package/dist/runner/mar-agent/agent-network-extension.js

@@ -52,7 +52,7 @@ const tools = [
     },
     {
         action: 'send',
-        description: 'Send input, decide a child approval or update a Goal; goal:null leaves it unchanged, goal:{clear:true} clears it. Prefer REPLACE_CURRENT for timely communication or course correction. QUEUE is consumed only after current work and earlier queued inputs finish; an active Goal must exit first. Sending to a non-child does not subscribe to its updates.',
+        description: 'Send input, decide an approval or update a Goal; goal:null leaves it unchanged, goal:{clear:true} clears it. Prefer REPLACE_CURRENT for timely communication or course correction. QUEUE is consumed only after current work and earlier queued inputs finish; an active Goal must exit first. Sending to a non-child does not subscribe to its updates.',
         properties: {
             agentId: text,
             content: { type: 'string' },

package/dist/runner/mar-agent/session-runtime-registry.js

@@ -240,19 +240,24 @@ export class MarAgentSessionRuntimeRegistry {
             throw failure.reason;
     }
     async #destroyRuntime(runtime, aliases, reason, runId, changedCategories = []) {
-        nodeLog('runner.mar-agent.runtime.releasing', {
-            runtimeId: runtime.runtimeId,
-            sessionId: runtime.session.id,
-            reason,
-            ...(runId === undefined ? {} : { runId }),
-            ...(changedCategories.length === 0 ? {} : { changedCategories })
-        });
+        try {
+            nodeLog('runner.mar-agent.runtime.releasing', {
+                runtimeId: runtime.runtimeId,
+                sessionId: runtime.session.id,
+                reason,
+                ...(runId === undefined ? {} : { runId }),
+                ...(changedCategories.length === 0 ? {} : { changedCategories })
+            });
+        }
+        catch {
+            // Resource release must not depend on a writable diagnostic sink.
+        }
         const results = await Promise.allSettled([
             this.#releaseComputerAliases(new Set([...aliases, runtime.session.id]))
         ]);
         results.push(...(await Promise.allSettled([releaseSessionRuntime(runtime)])));
         const failures = results.filter((result) => result.status === 'rejected');
-        if (failures.length > 1)
+        if (failures.length > 0)
             this.#logCleanupFailure(runtime.session.id);
         if (failures[0]?.status === 'rejected')
             throw failures[0].reason;
@@ -263,9 +268,14 @@ export class MarAgentSessionRuntimeRegistry {
                 this.#entries.delete(alias);
     }
     #logCleanupFailure(sessionId) {
-        nodeLog('runner.mar-agent.runtime.cleanup_failed', {
-            sessionId,
-            code: 'MAR_AGENT_RUNTIME_CLEANUP_FAILED'
-        });
+        try {
+            nodeLog('runner.mar-agent.runtime.cleanup_failed', {
+                sessionId,
+                code: 'MAR_AGENT_RUNTIME_CLEANUP_FAILED'
+            });
+        }
+        catch {
+            // Keep the original cleanup error when the diagnostic sink is unavailable.
+        }
     }
 }

package/dist/runner/mar-agent/session-runtime.js

@@ -185,25 +185,30 @@ export async function reconfigureSessionRuntime(existing, input, modelFactory) {
 }
 export async function releaseSessionRuntime(runtime) {
     const failures = [];
-    for (const cleanup of [
-        () => runtime.agent.dispose(),
-        () => runtime.releaseNetworkContext?.(),
-        () => runtime.mcpLease.release(),
-        () => runtime.releaseEnvironment?.()
+    for (const [resource, cleanup] of [
+        ['agent', () => runtime.agent.dispose()],
+        ['network', () => runtime.releaseNetworkContext?.()],
+        ['mcp', () => runtime.mcpLease.release()],
+        ['environment', () => runtime.releaseEnvironment?.()]
     ]) {
         try {
             await cleanup();
         }
         catch (error) {
             failures.push(error);
+            try {
+                nodeLog('runner.mar-agent.runtime.cleanup_failed', {
+                    sessionId: runtime.session.id,
+                    code: 'MAR_AGENT_RUNTIME_CLEANUP_FAILED',
+                    stage: 'resource_release',
+                    resource
+                });
+            }
+            catch {
+                // Keep releasing resources even when the diagnostic sink is unavailable.
+            }
         }
     }
-    if (failures.length > 1)
-        nodeLog('runner.mar-agent.runtime.cleanup_failed', {
-            sessionId: runtime.session.id,
-            code: 'MAR_AGENT_RUNTIME_CLEANUP_FAILED',
-            stage: 'resource_release'
-        });
     if (failures.length > 0)
         throw failures[0];
 }

package/dist/service/agent-network-bindings.js

@@ -3,10 +3,8 @@ import { resolvedPersonalInstructions } from '../runner/personal-instructions.js
 import { AgentNetworkService } from './agent-network-service.js';
 import { isPlainRecord } from '../util/records.js';
 import { safeErrorCode } from '../util/safe-error.js';
-import { withSessionMessageOrigin } from './composer-message-input.js';
 import { SESSION_ADMISSION_SIGNAL } from '../session/operation-admission.js';
 import { assertSessionControlOwner } from './run-ownership-policy.js';
-const approvedCalls = new WeakMap();
 const terminalCalls = new WeakMap();
 /** Bind a terminal actor only after the Node request boundary has authenticated its caller. */
 export function actorForAuthenticatedTerminal(actor, workspaceId) {
@@ -14,14 +12,6 @@ export function actorForAuthenticatedTerminal(actor, workspaceId) {
     terminalCalls.set(authenticated, { workspaceId });
     return authenticated;
 }
-/** Bind a Host-approved invocation to its exact target and domain operations. */
-export function actorForApprovedAgentCall(actor, context, agentIds, operations) {
-    if (context.permission?.decision !== 'approved')
-        return actor;
-    const approved = Object.freeze({ ...actor });
-    approvedCalls.set(approved, { agentIds: [...agentIds], operations: [...operations] });
-    return approved;
-}
 import { sessionPage } from '../session/pagination.js';
 import { marctlSessionSummary, marctlSessionDetail } from './session-recent-activity.js';
 /** Bind the collaboration use case to the existing Session, Run and Goal owners. */
@@ -50,7 +40,7 @@ export function createNodeAgentNetwork(options) {
         const parent = terminal ? undefined : await actorSession(actor);
         const workspaceId = terminal?.workspaceId ?? parent?.workspaceId;
         const session = options.runtime.getAgentSession(id) ?? (await options.projection.resolve(id, true));
-        if (!session || session.workspaceId !== workspaceId || session.id === parent?.id)
+        if (!session || session.workspaceId !== workspaceId)
             throw new Error('SESSION_NOT_FOUND');
         return session;
     }
@@ -93,11 +83,8 @@ export function createNodeAgentNetwork(options) {
         return result;
     }
     async function validateApproval(actor, session, input) {
-        if (!terminalCalls.has(actor)) {
-            const parent = await actorSession(actor);
-            if (session.parentSessionId !== parent.id)
-                throw new Error('AGENT_TARGET_NOT_AUTHORIZED');
-        }
+        if (!terminalCalls.has(actor))
+            await actorSession(actor);
         assertSessionControlOwner(options.runtime, session.id, actor.requestUserId);
         const approval = options.runtime.getApproval(input.approvalId);
         if (!approval)
@@ -118,19 +105,10 @@ export function createNodeAgentNetwork(options) {
     return new AgentNetworkService({
         observations: options.observations,
         target,
-        authorize: async (actor, session, operation) => {
+        authorize: async (actor, session) => {
+            if (!terminalCalls.has(actor))
+                await actorSession(actor);
             assertSessionControlOwner(options.runtime, session.id, actor.requestUserId);
-            if (terminalCalls.has(actor))
-                return;
-            const source = await actorSession(actor);
-            if (session.parentSessionId === source.id)
-                return;
-            if (source.parentSessionId === session.id && operation === 'send')
-                return;
-            const approved = approvedCalls.get(actor);
-            if (approved?.agentIds.includes(session.id) && approved.operations.includes(operation))
-                return;
-            throw new Error('AGENT_TARGET_NOT_AUTHORIZED');
         },
         children: async (actor) => {
             if (terminalCalls.has(actor))
@@ -144,27 +122,6 @@ export function createNodeAgentNetwork(options) {
         observe: (actor) => {
             options.ensureObservations(actor);
         },
-        isUpward: async (actor, session) => !terminalCalls.has(actor) && (await actorSession(actor)).parentSessionId === session.id,
-        reportUpward: async (actor, session, input, signal) => {
-            const child = await actorSession(actor);
-            const runId = actor.runId;
-            const executionId = actor.executionId;
-            if (!runId ||
-                !executionId ||
-                options.runtime.currentExecutionId(runId) !== executionId ||
-                child.parentSessionId !== session.id)
-                throw new Error('AGENT_ACTOR_NOT_ACTIVE');
-            signal?.throwIfAborted();
-            const parent = options.observations.get(session.id);
-            if (!parent?.report({
-                childId: child.id,
-                runId,
-                executionId,
-                value: withSessionMessageOrigin(input.content, origin(child), session.parentSessionId)
-            }))
-                throw new Error('AGENT_PARENT_NOT_WARM');
-            return { delivery: 'reported', clientMessageId: input.clientMessageId };
-        },
         freezeExecution: (session) => {
             const snapshot = options.runtime.latestSessionExecution(session.id);
             const run = options.runtime.activeSessionRun(session.id);

package/dist/service/agent-network-invoke.js

@@ -1,4 +1,4 @@
-import { actorForApprovedAgentCall, actorForAuthenticatedTerminal } from './agent-network-bindings.js';
+import { actorForAuthenticatedTerminal } from './agent-network-bindings.js';
 import { isPlainRecord } from '../util/records.js';
 import { randomUUID } from 'node:crypto';
 import { modelUsageGrantSchema } from '@myagentroam/protocol';
@@ -52,21 +52,6 @@ export function executionAgentActor(input) {
 }
 /** Shared command dispatch; callers must bind actor authority at their trusted boundary. */
 export async function invokeAgentNetwork(service, actor, action, payload, context, requestSignal) {
-    const targets = typeof payload.agentId === 'string'
-        ? [payload.agentId]
-        : Array.isArray(payload.agentIds)
-            ? payload.agentIds.filter((id) => typeof id === 'string')
-            : [];
-    const operations = action === 'send'
-        ? ['send', 'goal']
-        : action === 'stop'
-            ? ['stop']
-            : action === 'wait'
-                ? ['wait']
-                : [];
-    const authorized = context
-        ? actorForApprovedAgentCall(actor, context, targets, operations)
-        : actor;
     const signal = context?.signal ?? requestSignal;
     switch (action) {
         case 'start':
@@ -85,11 +70,11 @@ export async function invokeAgentNetwork(service, actor, action, payload, contex
                 ...(typeof payload.title === 'string' ? { title: payload.title.trim() } : {})
             }, signal);
         case 'send':
-            return service.send(authorized, payload, signal);
+            return service.send(actor, payload, signal);
         case 'stop':
-            return service.stop(authorized, payload);
+            return service.stop(actor, payload);
         case 'wait':
-            return service.wait(authorized, {
+            return service.wait(actor, {
                 ...payload,
                 ...(context
                     ? { signal: context.signal, interrupt: context.waitInterrupt }

package/dist/service/agent-network-service.js

@@ -91,22 +91,6 @@ export class AgentNetworkService {
         if (input.approval !== undefined)
             await this.options.validateApproval(actor, session, input.approval);
         signal?.throwIfAborted();
-        if (hasMessage && (await this.options.isUpward(actor, session))) {
-            signal?.throwIfAborted();
-            if (goal.kind !== 'unchanged' ||
-                input.approval !== undefined ||
-                input.deliveryIntent === 'REPLACE_CURRENT' ||
-                input.deliveryIntent === 'QUEUE' ||
-                input.attachments?.length ||
-                input.attachmentIds?.length)
-                throw new Error('AGENT_UPWARD_REPORT_INVALID');
-            const result = await this.options.reportUpward(actor, session, {
-                clientMessageId: input.clientMessageId ?? randomUUID(),
-                content
-            }, signal);
-            return { agentId: session.id, message: { status: 'accepted', result } };
-        }
-        signal?.throwIfAborted();
         if (session.parentSessionId === actor.sessionId)
             this.options.observe(actor, session);
         const approvalResult = input.approval === undefined

package/dist/service/marctl-caller.js

@@ -21,7 +21,7 @@ const executionManagementOperations = new Set([
     'session.config.update',
     'session.schedule.agent.save'
 ]);
-/** Prevent execution credentials from reaching legacy writes outside their Session tree. */
+/** Keep execution management within its authenticated Workspace and Run ownership. */
 export async function authorizeMarctlExecutionOperation(input) {
     if (!isPlainRecord(input.caller))
         throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
@@ -31,19 +31,27 @@ export async function authorizeMarctlExecutionOperation(input) {
         throw new Error('MARCTL_EXECUTION_CREDENTIAL_INVALID');
     if (executionReadOperations.has(input.operation))
         return;
-    if (!executionManagementOperations.has(input.operation) ||
-        !isPlainRecord(input.data) ||
-        typeof input.data.sessionId !== 'string' ||
-        typeof input.data.workspaceId !== 'string')
+    if (!isPlainRecord(input.data) || typeof input.data.workspaceId !== 'string')
         throw new Error('MARCTL_AGENT_NETWORK_REQUIRED');
+    let sessionId;
+    if (input.operation === 'run.approval.decide') {
+        const run = typeof input.data.runId === 'string' ? input.runtime.getRun(input.data.runId) : undefined;
+        if (!run)
+            throw new Error('RUN_NOT_FOUND');
+        sessionId = run.sessionId;
+    }
+    else {
+        if (!executionManagementOperations.has(input.operation) ||
+            typeof input.data.sessionId !== 'string')
+            throw new Error('MARCTL_AGENT_NETWORK_REQUIRED');
+        sessionId = input.data.sessionId;
+    }
     const source = input.runtime.getAgentSession(input.caller.sessionId);
-    const target = input.runtime.getAgentSession(input.data.sessionId) ??
-        (await input.resolveSession(input.data.sessionId));
+    const target = input.runtime.getAgentSession(sessionId) ?? (await input.resolveSession(sessionId));
     if (!source ||
         !target ||
         source.workspaceId !== input.data.workspaceId ||
-        target.workspaceId !== source.workspaceId ||
-        (target.id !== source.id && target.parentSessionId !== source.id))
+        target.workspaceId !== source.workspaceId)
         throw new Error('AGENT_TARGET_NOT_AUTHORIZED');
     assertSessionControlOwner(input.runtime, target.id, input.userId);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myagentroam/node",
-  "version": "0.11.43",
+  "version": "0.11.44",
   "description": "MyAgentRoam Node runtime CLI.",
   "license": "Apache-2.0 AND GPL-2.0-or-later",
   "type": "module",
@@ -38,10 +38,10 @@
     "sharp": "0.35.5",
     "ws": "^8.21.3",
     "zod": "4.4.3",
-    "@myagentroam/agent": "0.11.43",
+    "@myagentroam/agent": "0.11.44",
     "@myagentroam/marctl": "0.11.6",
-    "@myagentroam/code-navigation": "0.11.1",
-    "@myagentroam/protocol": "0.11.43"
+    "@myagentroam/protocol": "0.11.44",
+    "@myagentroam/code-navigation": "0.11.1"
   },
   "devDependencies": {
     "@types/ws": "^8.18.1"