@pikku/core 0.12.63 → 0.12.66

package/src/wirings/ai-agent/ai-agent-stream.ts

@@ -34,8 +34,13 @@ import {
   buildInstructions,
   buildToolDefs,
   createScopedChannel,
+  resolveOwnerResourceId,
+  agentSessionScope,
+  assertResourceOwner,
+  assertAgentAuthorized,
   ToolApprovalRequired,
   ToolCredentialRequired,
+  APPROVAL_REQUIRED,
   type RunAIAgentParams,
   type StreamAIAgentOptions,
   type StreamContext,
@@ -53,7 +58,8 @@ type PersistingChannel = AIStreamChannel & {
 function createPersistingChannel(
   parent: AIStreamChannel,
   storage: AIStorageService | undefined,
-  threadId: string
+  threadId: string,
+  logger?: { error: (...args: any[]) => void }
 ): PersistingChannel {
   let fullText = ''
   let stepText = ''
@@ -106,6 +112,23 @@ function createPersistingChannel(
     }
   }
 
+  /**
+   * `send` is synchronous and so cannot await the flush. A rejection would have
+   * nothing to propagate to and would take the process down as an unhandled
+   * rejection — a model reusing a toolCallId, which is a primary key in AI
+   * storage, is enough to trigger it. Persistence from inside `send` is
+   * therefore best-effort: the run carries on, and the awaited `flush()` on the
+   * suspend paths still surfaces failures to its caller.
+   */
+  const flushDetached = () => {
+    void flushStep().catch((error) => {
+      logger?.error('Failed to persist agent messages', {
+        threadId,
+        error,
+      })
+    })
+  }
+
   const channel: PersistingChannel = {
     channelId: parent.channelId,
     openingData: parent.openingData,
@@ -152,10 +175,10 @@ function createPersistingChannel(
             totalUsage.inputTokens += event.tokens.input
             totalUsage.outputTokens += event.tokens.output
             if (event.model) totalUsage.model = event.model
-            flushStep()
+            flushDetached()
             break
           case 'done':
-            flushStep()
+            flushDetached()
             break
         }
       }
@@ -328,13 +351,23 @@ export function checkForApprovals(
       continue
     }
 
+    // The approval marker is only trusted from a framework tool declared with
+    // `forwardsApproval` (the sub-agent delegating tools) AND carrying the
+    // non-forgeable `APPROVAL_REQUIRED` Symbol brand. A plain tool's output — or
+    // a delegating tool's LLM-shaped `result.object`, which an attacker can
+    // influence — is plain JSON and can never carry the Symbol, so it can never
+    // forge an approval/suspension.
+    if (!toolDef?.forwardsApproval) {
+      continue
+    }
+
     const tr = stepResult.toolResults.find(
       (r) => r.toolCallId === tc.toolCallId
     )
     if (
       tr?.result &&
       typeof tr.result === 'object' &&
-      '__approvalRequired' in (tr.result as object)
+      APPROVAL_REQUIRED in (tr.result as object)
     ) {
       const r = tr.result as {
         toolName: string
@@ -347,6 +380,7 @@ export function checkForApprovals(
           toolCallId: string
           toolName: string
           args: unknown
+          reason?: string
           runId: string
         }>
       }
@@ -357,7 +391,7 @@ export function checkForApprovals(
               sub.toolCallId,
               r.toolName,
               r.args,
-              undefined,
+              sub.reason,
               sub.toolName,
               sub.args,
               r.agentRunId
@@ -512,7 +546,7 @@ function handleApprovals(
         reason: err.reason,
         runId,
       }
-      channel.send(approvalEvent as any)
+      channel.send(approvalEvent)
     }
     channel.send({ type: 'done' })
     channel.close()
@@ -545,9 +579,22 @@ function handleCredentialRequests(
       pendingApprovals,
     })
 
-    // Don't send credential-request SSE events — the tool result with
-    // __credentialRequired was already streamed. The frontend detects it
-    // from the tool result and shows Connect/Ignore buttons.
+    // The __credentialRequired tool result is suppressed from the stream, so
+    // credential-request events (with the runId needed for /resume) are the
+    // client's signal to show Connect/Ignore buttons — mirroring how
+    // approval-request suspensions work.
+    for (const req of requests) {
+      channel.send({
+        type: 'credential-request',
+        toolCallId: req.toolCallId,
+        toolName: req.toolName,
+        args: req.args,
+        credentialName: req.credentialName,
+        credentialType: req.credentialType,
+        connectUrl: req.connectUrl,
+        runId,
+      })
+    }
     channel.send({ type: 'done' })
     channel.close()
   })()
@@ -569,7 +616,14 @@ export async function streamAIAgent(
 ): Promise<string> {
   const sessionMap = agentSessionMap ?? new Map<string, string>()
 
-  const normalizedInput = input
+  const normalizedInput = {
+    ...input,
+    resourceId: resolveOwnerResourceId(
+      params,
+      agentSessionScope(agentName),
+      input.resourceId
+    ),
+  }
 
   const streamContext: StreamContext = { channel, options }
   // delegateState is attached after prepareAgentRun resolves the agent config
@@ -654,6 +708,7 @@ export async function streamAIAgent(
     createdAt: new Date(),
     updatedAt: new Date(),
   })
+  options?.onRunCreated?.(runId)
 
   if (storage) {
     await storage.saveMessages(threadId, [userMessage])
@@ -694,7 +749,12 @@ export async function streamAIAgent(
     }
   )
 
-  const persistingChannel = createPersistingChannel(channel, storage, threadId)
+  const persistingChannel = createPersistingChannel(
+    channel,
+    storage,
+    threadId,
+    singletonServices.logger
+  )
 
   const wrappedChannel =
     allChannelMiddleware.length > 0
@@ -705,6 +765,25 @@ export async function streamAIAgent(
         ).channel as AIStreamChannel)
       : persistingChannel
 
+  // Tool results carrying the __credentialRequired marker must never reach
+  // the client or persisted history: the run suspends with credential-request
+  // events instead (mirroring approvals), and leaving the tool call
+  // unresulted is what lets the client resume it after connecting.
+  const credentialFilteredChannel: AIStreamChannel = {
+    ...wrappedChannel,
+    send: (event: AIStreamEvent) => {
+      if (
+        event.type === 'tool-result' &&
+        event.result !== null &&
+        typeof event.result === 'object' &&
+        '__credentialRequired' in event.result
+      ) {
+        return
+      }
+      wrappedChannel.send(event)
+    },
+  }
+
   // In delegate mode (default), suppress parent's text from reaching the client
   // AFTER a sub-agent has been called. If the parent responds directly (no delegation),
   // its text goes through normally. Sub-agent text bypasses this path entirely
@@ -716,18 +795,18 @@ export async function streamAIAgent(
   }
   const outputChannel = isDelegateMode
     ? {
-        ...wrappedChannel,
+        ...credentialFilteredChannel,
         send: (event: AIStreamEvent) => {
           if (
             delegateState.delegated &&
             (event.type === 'text-delta' || event.type === 'reasoning-delta')
           )
             return
-          wrappedChannel.send(event)
+          credentialFilteredChannel.send(event)
         },
         delegateState,
       }
-    : wrappedChannel
+    : credentialFilteredChannel
 
   try {
     const loopResult = await runStreamStepLoop({
@@ -824,6 +903,15 @@ export async function resumeAIAgent(
   if (!run) {
     throw new Error(`No run found for runId ${input.runId}`)
   }
+  assertResourceOwner(
+    resolveOwnerResourceId(
+      params,
+      agentSessionScope(run.agentName),
+      run.resourceId
+    ),
+    run.resourceId,
+    'run'
+  )
 
   const pending = run.pendingApprovals?.find(
     (p) => p.toolCallId === input.toolCallId
@@ -834,12 +922,19 @@ export async function resumeAIAgent(
     )
   }
 
+  const { agent, packageName, resolvedName } = resolveAgent(run.agentName)
+
+  // Gate before resolving the approval: recording it is a persisted side
+  // effect, so an unauthorized caller must not reach it. Run ownership alone is
+  // not enough — a grant revoked while the run was suspended must stop the
+  // caller from approving its pending tool calls.
+  await assertAgentAuthorized(agent, params, packageName)
+
   await aiRunState.resolveApproval(
     input.toolCallId,
     input.approved ? 'approved' : 'denied'
   )
 
-  const { agent, packageName, resolvedName } = resolveAgent(run.agentName)
   const { storage } = resolveMemoryServices(agent, singletonServices)
   const memoryConfig = agent.memory
   const agentRunner = singletonServices.aiAgentRunner
@@ -876,6 +971,16 @@ export async function resumeAIAgent(
       ])
     }
 
+    channel.send({
+      type: 'tool-result',
+      toolCallId: input.toolCallId,
+      toolName:
+        pending.type === 'tool-call' || pending.type === 'credential-request'
+          ? pending.toolName
+          : pending.agentName,
+      result: denialResult,
+    })
+
     // Check remaining pending approvals
     const updatedRun = await aiRunState.getRun(run.runId)
     const remaining = updatedRun?.pendingApprovals ?? []
@@ -1155,7 +1260,8 @@ async function continueAfterToolResult(
   const persistingChannel = createPersistingChannel(
     channel,
     storage,
-    run.threadId
+    run.threadId,
+    singletonServices.logger
   )
 
   const wrappedChannel =

package/src/wirings/ai-agent/ai-agent.types.ts

@@ -104,6 +104,20 @@ export interface AIAgentOutput {
   }>
 }
 
+/**
+ * How an agent's threads/runs are owned and partitioned.
+ * - `'user'` (default): owner is the authenticated `session.userId`; the caller's
+ *   `resourceId` becomes a sub-partition within that user (`userId:resourceId`).
+ * - `'org'`: owner is the authenticated `session.orgId` (`orgId:resourceId`), so
+ *   threads are shared across everyone in the org. Requires a session with an org
+ *   (e.g. Better Auth's `organization` plugin) — otherwise access is denied.
+ *
+ * The trusted principal is always the prefix, so a client-supplied `resourceId`
+ * can sub-divide within the caller's own boundary but can never widen access to
+ * another user's or org's threads.
+ */
+export type SessionScope = 'user' | 'org'
+
 export interface AIAgentToolDef {
   name: string
   description: string
@@ -111,6 +125,14 @@ export interface AIAgentToolDef {
   execute: (input: unknown) => Promise<unknown>
   needsApproval?: boolean
   approvalDescriptionFn?: (input: unknown) => Promise<string>
+  /**
+   * Set only by the framework on sub-agent delegating tools. Such a tool may
+   * legitimately return an `__approvalRequired` marker to forward a nested
+   * sub-agent approval. The marker is honored ONLY from a tool with this flag —
+   * a plain tool's output (which an attacker may influence) can never forge an
+   * approval request. See `checkForApprovals`.
+   */
+  forwardsApproval?: boolean
 }
 
 export interface PikkuAIMiddlewareHooks<
@@ -204,6 +226,7 @@ export type AIAgentMemoryConfig = {
 export type CoreAIAgent<
   PikkuPermission = CorePikkuPermission<any, any>,
   PikkuMiddleware = CorePikkuMiddleware<any>,
+  Scope extends string = string,
 > = {
   name: string
   description: string
@@ -214,8 +237,11 @@ export type CoreAIAgent<
   goal: string
   model: string
   temperature?: number
+  /** Ownership/partitioning of this agent's threads and runs. Defaults to `'user'`. */
+  sessionScope?: SessionScope
   tools?: unknown[]
   agents?: unknown[]
+  workflows?: unknown[]
   agentMode?: 'delegate' | 'supervise'
   memory?: AIAgentMemoryConfig
   maxSteps?: number
@@ -234,6 +260,23 @@ export type CoreAIAgent<
   middleware?: PikkuMiddleware[]
   channelMiddleware?: CorePikkuChannelMiddleware<any, any>[]
   aiMiddleware?: PikkuAIMiddlewareHooks<any, any>[]
+  /**
+   * Whether a session is required to run this agent. Defaults to `false`, since
+   * agents are commonly invoked from an already-authenticated `pikkuFunc` or
+   * from genuinely sessionless contexts (crons, queue workers). Set `true` to
+   * require a session at the agent itself. `scopes` and `permissions` are
+   * enforced either way.
+   */
+  auth?: boolean
+  /**
+   * Scopes the session must hold to run this agent. All of them are required
+   * (AND), and they are checked before `permissions` — unlike permissions,
+   * which OR together, a scope can only narrow access.
+   *
+   * Narrowed to the generated `ScopeId` union in a project's own
+   * `pikku-types.gen.ts`, so an undeclared scope is a compile error.
+   */
+  scopes?: Scope[]
   permissions?: CorePermissionGroup<PikkuPermission>
 }
 
@@ -275,6 +318,7 @@ export type AIStreamEvent =
       toolName: string
       args: unknown
       reason?: string
+      runId?: string
       agent?: string
       session?: string
     }
@@ -395,6 +439,17 @@ export interface AgentRunService {
   listThreads(options?: {
     agentName?: string
     resourceId?: string
+    /**
+     * Restrict results to threads owned by one of these session principals. A
+     * thread matches when its `resourceId` is the principal itself or one of its
+     * `principal:` sub-partitions, mirroring the composition
+     * `resolveOwnerResourceId` writes.
+     *
+     * Unlike `resourceId`, which is an optional exact-match filter, this is an
+     * authorization constraint: an empty array matches nothing. Callers exposing
+     * threads over the wire must derive it from the session, never from input.
+     */
+    owners?: string[]
     limit?: number
     offset?: number
   }): Promise<AIThread[]>
@@ -413,6 +468,7 @@ export type AIAgentMeta = Record<
     | 'output'
     | 'tools'
     | 'agents'
+    | 'workflows'
     | 'middleware'
     | 'channelMiddleware'
     | 'aiMiddleware'
@@ -420,6 +476,7 @@ export type AIAgentMeta = Record<
   > & {
     tools?: string[]
     agents?: string[]
+    workflows?: string[]
     inputSchema: string | null
     outputSchema: string | null
     workingMemorySchema: string | null

package/src/wirings/ai-agent/index.ts

@@ -4,6 +4,7 @@ export {
   agentResume,
   agentApprove,
 } from './ai-agent-helpers.js'
+export { wrapChannelWithAGUI, type AGUIEvent } from './ai-agent-agui.js'
 export { runAIAgent, resumeAIAgentSync } from './ai-agent-runner.js'
 export { streamAIAgent, resumeAIAgent } from './ai-agent-stream.js'
 export { voiceInput } from './voice-input.js'
@@ -13,6 +14,10 @@ export {
   type StreamAIAgentOptions,
   ToolApprovalRequired,
   ToolCredentialRequired,
+  canAccessThread,
+  isOwnedByPrincipal,
+  sessionPrincipals,
+  threadOwnerConstraint,
 } from './ai-agent-prepare.js'
 export {
   addAIAgent,

package/src/wirings/ai-agent/voice-input.test.ts

@@ -0,0 +1,90 @@
+import { describe, test } from 'node:test'
+import assert from 'node:assert/strict'
+
+import { voiceInput } from './voice-input.js'
+import type { AIContentPart, AIMessage } from './ai-agent.types.js'
+
+/**
+ * A runner whose `transcribe` reads instance state through `this`, mirroring the
+ * real `VercelAIAgentRunner` where `transcribe` calls `this.getModel(...)`. If
+ * the middleware grabs the method as a bare reference the receiver is lost and
+ * `this` is undefined — which is exactly the regression this guards.
+ */
+class ThisDependentRunner {
+  private readonly transcript = 'the transcribed spoken words'
+
+  async transcribe() {
+    return {
+      text: this.transcript,
+      segments: [],
+      language: 'en',
+      durationInSeconds: 1,
+      warnings: [],
+    }
+  }
+}
+
+const audioMessage = (): AIMessage => ({
+  id: 'm1',
+  role: 'user',
+  content: [
+    { type: 'file', mediaType: 'audio/wav', data: 'AAAA' },
+  ] as AIContentPart[],
+  createdAt: new Date(0),
+})
+
+describe('voiceInput', () => {
+  test('transcribes an audio part by calling the runner with its receiver intact', async () => {
+    const mw = voiceInput({ model: 'mock/whisper' })
+    const services = { aiAgentRunner: new ThisDependentRunner() }
+
+    const result = await mw.modifyInput!(services as any, {
+      messages: [audioMessage()],
+      instructions: 'sys',
+    })
+
+    const last = result.messages[result.messages.length - 1]!
+    const parts = last.content as AIContentPart[]
+    assert.equal(parts.length, 1)
+    assert.equal(parts[0]!.type, 'text')
+    assert.equal(
+      (parts[0] as { text: string }).text,
+      'the transcribed spoken words'
+    )
+    assert.ok(!parts.some((p) => p.type === 'file'))
+  })
+
+  test('leaves the message untouched when there is no audio part', async () => {
+    const mw = voiceInput({ model: 'mock/whisper' })
+    const services = { aiAgentRunner: new ThisDependentRunner() }
+    const messages: AIMessage[] = [
+      {
+        id: 'm1',
+        role: 'user',
+        content: 'just text',
+        createdAt: new Date(0),
+      },
+    ]
+
+    const result = await mw.modifyInput!(services as any, {
+      messages,
+      instructions: 'sys',
+    })
+
+    assert.equal(result.messages[0]!.content, 'just text')
+  })
+
+  test('throws when an audio part is present but no model is configured', async () => {
+    const mw = voiceInput({})
+    const services = { aiAgentRunner: new ThisDependentRunner() }
+
+    await assert.rejects(
+      () =>
+        mw.modifyInput!(services as any, {
+          messages: [audioMessage()],
+          instructions: 'sys',
+        }),
+      /voiceInput requires a transcription model/
+    )
+  })
+})

package/src/wirings/ai-agent/voice-input.ts

@@ -1,5 +1,6 @@
 import type { AIAgentRunnerService } from '../../services/ai-agent-runner-service.js'
 import { pikkuAIMiddleware } from '../../types/core.types.js'
+import { safeFetch } from '../../utils/safe-fetch.js'
 import type { AIContentPart } from './ai-agent.types.js'
 
 function base64ToUint8Array(base64: string): Uint8Array {
@@ -13,45 +14,11 @@ function base64ToUint8Array(base64: string): Uint8Array {
 
 const MAX_AUDIO_SIZE = 50 * 1024 * 1024
 
-// Portable SSRF guard: @pikku/core runs in edge runtimes (CF Workers) with no
-// Node `dns`, so we cannot resolve hostnames to check for private targets.
-// Reject the obvious internal literals; callers wanting stricter control pass
-// an explicit `allowedAudioHosts` allowlist. (Does not defend against a public
-// hostname that resolves to a private IP / DNS rebinding — out of reach here.)
-function isPrivateHost(hostname: string): boolean {
-  const host = hostname.replace(/^\[|\]$/g, '').toLowerCase()
-  if (host === 'localhost' || host === '0.0.0.0' || host === '::1') return true
-  if (host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd'))
-    return true
-  const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.\d{1,3}$/)
-  if (v4) {
-    const [a, b] = [Number(v4[1]), Number(v4[2])]
-    if (a === 127 || a === 10 || a === 0) return true
-    if (a === 169 && b === 254) return true // link-local incl. cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true
-    if (a === 192 && b === 168) return true
-  }
-  return false
-}
-
 async function fetchAsUint8Array(
   url: string,
   allowedAudioHosts?: string[]
 ): Promise<Uint8Array> {
-  const parsed = new URL(url)
-  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
-    throw new Error('Only HTTP(S) URLs are supported for audio')
-  }
-  if (allowedAudioHosts) {
-    if (!allowedAudioHosts.includes(parsed.hostname)) {
-      throw new Error(`Audio URL host is not allowed: ${parsed.hostname}`)
-    }
-  } else if (isPrivateHost(parsed.hostname)) {
-    throw new Error(
-      `Refusing to fetch audio from a private/internal host: ${parsed.hostname}`
-    )
-  }
-  const response = await fetch(url)
+  const response = await safeFetch(url, {}, { allowedHosts: allowedAudioHosts })
   const contentLength = response.headers.get('content-length')
   if (contentLength && parseInt(contentLength, 10) > MAX_AUDIO_SIZE) {
     throw new Error('Audio file exceeds maximum size')
@@ -70,10 +37,12 @@ export const voiceInput = (config?: {
 }) =>
   pikkuAIMiddleware({
     modifyInput: async (services, { messages, instructions }) => {
-      const transcribeAudio = (services as {
-        aiAgentRunner?: AIAgentRunnerService
-      }).aiAgentRunner?.transcribe
-      if (!transcribeAudio) return { messages, instructions }
+      const aiAgentRunner = (
+        services as {
+          aiAgentRunner?: AIAgentRunnerService
+        }
+      ).aiAgentRunner
+      if (!aiAgentRunner?.transcribe) return { messages, instructions }
 
       const last = messages[messages.length - 1]
       if (!last || last.role !== 'user' || typeof last.content === 'string') {
@@ -105,7 +74,7 @@ export const voiceInput = (config?: {
         const audioData = p.data
           ? base64ToUint8Array(p.data)
           : await fetchAsUint8Array(p.url!, config.allowedAudioHosts)
-        const result = await transcribeAudio({
+        const result = await aiAgentRunner.transcribe({
           model: config.model,
           audio: audioData,
           ...(config.language

package/src/wirings/channel/channel-common.ts

@@ -85,7 +85,6 @@ export const runChannelLifecycleWithMiddleware = async ({
       data: () => data as any,
       wire,
       tags: meta.tags ?? [],
-      inheritedPermissions: meta.permissions,
       packageName: meta.packageName ?? null,
     })
   }

package/src/wirings/channel/channel-handler.ts

@@ -102,11 +102,7 @@ export const processMessageHandlers = (
       routingProperty,
       routerValue
     )
-    const {
-      packageName,
-      middleware: routeInheritedMiddleware,
-      permissions: inheritedPermissions,
-    } = routeMeta
+    const { packageName, middleware: routeInheritedMiddleware } = routeMeta
 
     const pikkuFuncId = routeMeta.pikkuFuncId
 
@@ -132,8 +128,6 @@ export const processMessageHandlers = (
     // Inherited middleware comes from metadata (tag groups, non-inline wire)
     const inheritedMiddleware = routeInheritedMiddleware || []
 
-    const wirePermissions = isWrapper ? onMessage.permissions : undefined
-
     // Create unique cache key that includes routing info to avoid cache collisions
     // when multiple message handlers use the same function
     const cacheKey = routingProperty
@@ -150,8 +144,6 @@ export const processMessageHandlers = (
       wireMiddleware,
       inheritedChannelMiddleware: channelMeta?.channelMiddleware,
       wireChannelMiddleware: wireChannelMiddleware as any,
-      inheritedPermissions,
-      wirePermissions,
       coerceDataFromSchema: true,
       tags: channelConfig.tags,
       sessionService: userSession,

package/src/wirings/channel/channel-middleware-runner.test.ts

@@ -69,17 +69,17 @@ describe('combineChannelMiddleware', () => {
     void execution
   })
 
-  test('deduplicates middleware and returns cached results until the cache is cleared', () => {
+  test('caches the statically-resolved inherited middleware until the cache is cleared', () => {
     const shared = async () => {}
     addChannelMiddleware('chat:outbound', [shared])
 
     const first = combineChannelMiddleware('channel', 'cached-1', {
       wireInheritedChannelMiddleware: [{ type: 'tag', tag: 'chat:outbound' }],
-      wireChannelMiddleware: [shared],
     })
 
     assert.deepEqual(first, [shared])
 
+    // Re-registering after the first resolve does not change the cached result.
     addChannelMiddleware('chat:outbound', [async () => {}])
 
     const cached = combineChannelMiddleware('channel', 'cached-1', {
@@ -97,6 +97,32 @@ describe('combineChannelMiddleware', () => {
     assert.notStrictEqual(refreshed[0], shared)
   })
 
+  test('does not cache per-run wireChannelMiddleware across calls (C4 cross-run leak)', () => {
+    const shared = async () => {}
+    addChannelMiddleware('chat:outbound', [shared])
+
+    const runA = async () => {}
+    const first = combineChannelMiddleware('agent', 'stream:bot', {
+      wireInheritedChannelMiddleware: [{ type: 'tag', tag: 'chat:outbound' }],
+      wireChannelMiddleware: [runA],
+    })
+    assert.deepEqual(first, [shared, runA])
+
+    const runB = async () => {}
+    const second = combineChannelMiddleware('agent', 'stream:bot', {
+      wireInheritedChannelMiddleware: [{ type: 'tag', tag: 'chat:outbound' }],
+      wireChannelMiddleware: [runB],
+    })
+    assert.deepEqual(second, [shared, runB])
+    assert.strictEqual(second[1], runB)
+    assert.notStrictEqual(second[1], runA)
+
+    const third = combineChannelMiddleware('agent', 'stream:bot', {
+      wireInheritedChannelMiddleware: [{ type: 'tag', tag: 'chat:outbound' }],
+    })
+    assert.deepEqual(third, [shared])
+  })
+
   test('ignores missing named middleware references', () => {
     const combined = combineChannelMiddleware('channel', 'missing-wire', {
       wireInheritedChannelMiddleware: [{ type: 'wire', name: 'missing' }],