@pikku/core 0.12.78 → 0.12.80

package/src/types/core.types.ts

@@ -298,6 +298,11 @@ export interface CoreUserSession {
    * Populated by whoever builds the session — core reads them, never fetches.
    */
   scopes?: string[]
+  /**
+   * Restricts the session to functions declared `readonly`. The function runner
+   * throws `ReadonlySessionError` for anything else.
+   */
+  readonly?: boolean
 }
 
 /**
@@ -378,7 +383,11 @@ export type PikkuWire<
   MCPTools extends string | never = never,
   TypedWorkflow extends PikkuWorkflowWire | never = PikkuWorkflowWire,
   TriggerOutput = unknown,
-  TypedScenario extends PikkuScenarioWire | never = PikkuScenarioWire,
+  // Defaulted to `any` rather than to `Out`: the emitted `TypedScenario<Out>`
+  // supplies the real context, while `PikkuWire`'s own defaults are what other
+  // generics constrain against — and a constraint that pinned the context to
+  // `Out` would reject every wire whose scenario output is anything else.
+  TypedScenario extends PikkuScenarioWire<any> | never = PikkuScenarioWire<any>,
   TypedActors extends ScenarioPersonas = ScenarioPersonas,
 > = {
   /** Always present — lazily initialised on first access for every function invocation */
@@ -386,6 +395,11 @@ export type PikkuWire<
 } & Partial<{
   wireType: PikkuWiringTypes
   wireId: string
+  /**
+   * A logger scoped to this invocation, when a host attaches one. Core never
+   * sets it; services that log fall back to the singleton logger.
+   */
+  logger: Logger
   /** Trace ID for distributed tracing — propagated across remote RPC calls via x-trace-id header */
   traceId: string
   functionId: string

package/src/types/state.types.ts

@@ -119,7 +119,7 @@ export interface PikkuPackageState {
     meta: HTTPWiringsMeta
   }
   channel: {
-    channels: Map<string, CoreChannel<any, any>>
+    channels: Map<string, CoreChannel<any, any, any, any, any>>
     meta: ChannelsMeta
   }
   scheduler: {

package/src/utils/node-host-resolver.ts

@@ -0,0 +1,20 @@
+import { lookup } from 'node:dns/promises'
+
+import { setDefaultHostResolver, type HostResolver } from './safe-fetch.js'
+
+/**
+ * Resolves a hostname through the platform resolver, returning every address it
+ * points at so `safeFetch` can reject a public name aimed at an internal one.
+ *
+ * This module is Node-only and is never imported by core itself — Workers has no
+ * DNS API, and a static `node:dns` import in the shared path would break that
+ * build.
+ */
+export const nodeHostResolver: HostResolver = async (hostname) => {
+  const results = await lookup(hostname, { all: true, verbatim: true })
+  return results.map(({ address }) => address)
+}
+
+/** Installs {@link nodeHostResolver} as the default for every `safeFetch`. */
+export const installNodeHostResolver = () =>
+  setDefaultHostResolver(nodeHostResolver)

package/src/utils/safe-fetch.test.ts

@@ -41,15 +41,54 @@ describe('isPrivateHost', () => {
     }
   })
 
+  test('flags reserved IPv4 blocks that are not routable public space', () => {
+    for (const host of [
+      '100.64.0.1', // carrier-grade NAT
+      '100.100.100.200', // Alibaba Cloud metadata endpoint
+      '100.127.255.255', // top of 100.64.0.0/10
+      '192.0.0.192', // IETF protocol assignments
+      '198.18.0.1', // benchmarking
+      '198.19.255.255', // top of 198.18.0.0/15
+      '192.88.99.1', // 6to4 anycast
+      '192.0.2.1', // TEST-NET-1
+      '198.51.100.1', // TEST-NET-2
+      '203.0.113.1', // TEST-NET-3
+      '224.0.0.1', // multicast
+      '240.0.0.1', // reserved
+      '255.255.255.255', // broadcast
+    ]) {
+      assert.equal(isPrivateHost(host), true, `${host} should be private`)
+    }
+  })
+
+  test('flags IPv6 forms that tunnel to an internal IPv4 address', () => {
+    for (const host of [
+      '64:ff9b::a9fe:a9fe', // NAT64 wrapping 169.254.169.254
+      '[64:ff9b::169.254.169.254]', // same, dotted-quad tail
+      '2002:a9fe:a9fe::', // 6to4 wrapping 169.254.169.254
+      '2002:6464:64c8::', // 6to4 wrapping 100.100.100.200
+      'fec0::1', // deprecated site-local
+      'ff02::1', // multicast
+      '100::1', // discard-only
+    ]) {
+      assert.equal(isPrivateHost(host), true, `${host} should be private`)
+    }
+  })
+
   test('allows public hosts', () => {
     for (const host of [
       'example.com',
       '8.8.8.8',
       '172.32.0.1',
       '11.0.0.1',
+      '100.63.255.255', // just below the CGNAT block
+      '100.128.0.0', // just above the CGNAT block
+      '198.17.255.255', // just below the benchmarking block
+      '198.20.0.0', // just above the benchmarking block
       '134744072', // decimal-encoded 8.8.8.8 — public
       '2001:db8::1', // documentation range — public
-      'fec0::1', // deprecated site-local, outside fe80::/10 — treated public
+      '2002:808:808::', // 6to4 wrapping public 8.8.8.8
+      '64:ff9b::808:808', // NAT64 wrapping public 8.8.8.8
     ]) {
       assert.equal(isPrivateHost(host), false, `${host} should be public`)
     }
@@ -138,6 +177,109 @@ describe('safeFetch', () => {
     )
   })
 
+  test('refuses a public hostname that resolves to a private address', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        // The shape the literal-only check misses: a name that parses as public
+        // but whose A record points at the cloud metadata endpoint.
+        await assert.rejects(
+          safeFetch(
+            'https://169-254-169-254.nip.io/latest/meta-data/',
+            {},
+            {
+              resolveHost: async () => ['169.254.169.254'],
+            }
+          ),
+          /resolves to 169\.254\.169\.254/
+        )
+        assert.equal(calls.length, 0)
+      }
+    )
+  })
+
+  test('refuses when any one resolved address is private', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        await assert.rejects(
+          safeFetch(
+            'https://split-horizon.example.com/',
+            {},
+            {
+              resolveHost: async () => ['93.184.216.34', '10.0.0.5'],
+            }
+          ),
+          /resolves to 10\.0\.0\.5/
+        )
+        assert.equal(calls.length, 0)
+      }
+    )
+  })
+
+  test('re-resolves the host of a redirect hop', async () => {
+    await withStubbedFetch(
+      (url) =>
+        url.includes('start.com')
+          ? new Response(null, {
+              status: 302,
+              headers: { location: 'https://rebound.example.com/next' },
+            })
+          : new Response('ok', { status: 200 }),
+      async (calls) => {
+        await assert.rejects(
+          safeFetch(
+            'https://start.com',
+            {},
+            {
+              resolveHost: async (hostname) =>
+                hostname === 'start.com' ? ['93.184.216.34'] : ['127.0.0.1'],
+            }
+          ),
+          /resolves to 127\.0\.0\.1/
+        )
+        assert.equal(calls.length, 1)
+      }
+    )
+  })
+
+  test('allows a public hostname that resolves to public addresses', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async (calls) => {
+        const res = await safeFetch(
+          'https://example.com/',
+          {},
+          {
+            resolveHost: async () => ['93.184.216.34'],
+          }
+        )
+        assert.equal(res.status, 200)
+        assert.equal(calls.length, 1)
+      }
+    )
+  })
+
+  test('does not resolve an IP literal or an allowlisted host', async () => {
+    await withStubbedFetch(
+      () => new Response('ok', { status: 200 }),
+      async () => {
+        let resolverCalls = 0
+        const resolveHost = async () => {
+          resolverCalls++
+          return ['10.0.0.1']
+        }
+        await safeFetch('https://93.184.216.34/', {}, { resolveHost })
+        await safeFetch(
+          'https://internal.example.com/',
+          {},
+          { resolveHost, allowedHosts: ['internal.example.com'] }
+        )
+        assert.equal(resolverCalls, 0)
+      }
+    )
+  })
+
   test('follows a redirect to another public host', async () => {
     await withStubbedFetch(
       (url) =>

package/src/utils/safe-fetch.ts

@@ -32,6 +32,134 @@ function parseIPv4Octets(
   return octets as [number, number, number, number]
 }
 
+/**
+ * IPv4 blocks that must never be reachable from user-supplied URLs: private,
+ * loopback, link-local (cloud metadata), carrier-grade NAT (Alibaba's
+ * `100.100.100.200` metadata endpoint), IETF protocol assignments, benchmarking,
+ * 6to4 anycast, the documentation TEST-NETs, multicast and reserved space.
+ */
+const PRIVATE_IPV4_BLOCKS: ReadonlyArray<readonly [string, number]> = [
+  ['0.0.0.0', 8],
+  ['10.0.0.0', 8],
+  ['100.64.0.0', 10],
+  ['127.0.0.0', 8],
+  ['169.254.0.0', 16],
+  ['172.16.0.0', 12],
+  ['192.0.0.0', 24],
+  ['192.0.2.0', 24],
+  ['192.88.99.0', 24],
+  ['192.168.0.0', 16],
+  ['198.18.0.0', 15],
+  ['198.51.100.0', 24],
+  ['203.0.113.0', 24],
+  ['224.0.0.0', 4],
+  ['240.0.0.0', 4],
+]
+
+const toUint32 = (octets: [number, number, number, number]): number =>
+  ((octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]) >>> 0
+
+const PRIVATE_IPV4_RANGES = PRIVATE_IPV4_BLOCKS.map(([base, prefix]) => {
+  const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0
+  return [(toUint32(parseIPv4Octets(base)!) & mask) >>> 0, mask] as const
+})
+
+const isPrivateIPv4 = (octets: [number, number, number, number]): boolean => {
+  const addr = toUint32(octets)
+  return PRIVATE_IPV4_RANGES.some(
+    ([base, mask]) => (addr & mask) >>> 0 === base
+  )
+}
+
+/**
+ * Expands an IPv6 literal into its eight 16-bit groups, handling `::` elision
+ * and a trailing dotted-quad. `null` when not a well-formed IPv6 literal.
+ */
+function parseIPv6Groups(host: string): number[] | null {
+  const zoneless = host.split('%')[0]!
+  const halves = zoneless.split('::')
+  if (halves.length > 2) return null
+
+  const parseSide = (side: string): number[] | null => {
+    if (side === '') return []
+    const parts = side.split(':')
+    const groups: number[] = []
+    for (let i = 0; i < parts.length; i++) {
+      const part = parts[i]!
+      if (i === parts.length - 1 && part.includes('.')) {
+        const v4 = parseIPv4Octets(part)
+        if (!v4) return null
+        groups.push((v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3])
+        continue
+      }
+      if (!/^[0-9a-f]{1,4}$/.test(part)) return null
+      groups.push(parseInt(part, 16))
+    }
+    return groups
+  }
+
+  const head = parseSide(halves[0]!)
+  if (head === null) return null
+
+  if (halves.length === 1) {
+    return head.length === 8 ? head : null
+  }
+
+  const tail = parseSide(halves[1]!)
+  if (tail === null) return null
+  if (head.length + tail.length > 7) return null
+  return [...head, ...new Array(8 - head.length - tail.length).fill(0), ...tail]
+}
+
+const embeddedIPv4 = (
+  hi: number,
+  lo: number
+): [number, number, number, number] => [
+  (hi >> 8) & 0xff,
+  hi & 0xff,
+  (lo >> 8) & 0xff,
+  lo & 0xff,
+]
+
+function isPrivateIPv6(groups: number[]): boolean {
+  const [g0, g1, g2, g3, g4, g5, g6, g7] = groups as [
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+    number,
+  ]
+
+  if (groups.every((g) => g === 0)) return true // :: unspecified
+  if (groups.slice(0, 7).every((g) => g === 0) && g7 === 1) return true // ::1
+
+  // IPv4-mapped ::ffff:0:0/96 and IPv4-compatible ::/96
+  if (g0 === 0 && g1 === 0 && g2 === 0 && g3 === 0 && g4 === 0) {
+    if (g5 === 0xffff || g5 === 0) return isPrivateIPv4(embeddedIPv4(g6, g7))
+  }
+  // NAT64 well-known prefix 64:ff9b::/96
+  if (
+    g0 === 0x64 &&
+    g1 === 0xff9b &&
+    g2 === 0 &&
+    g3 === 0 &&
+    g4 === 0 &&
+    g5 === 0
+  )
+    return isPrivateIPv4(embeddedIPv4(g6, g7))
+  // 6to4 2002::/16 carries the IPv4 address in the next 32 bits
+  if (g0 === 0x2002) return isPrivateIPv4(embeddedIPv4(g1, g2))
+  if (g0 === 0x100 && g1 === 0 && g2 === 0 && g3 === 0) return true // discard-only 100::/64
+  if ((g0 & 0xffc0) === 0xfe80) return true // link-local fe80::/10
+  if ((g0 & 0xfe00) === 0xfc00) return true // unique-local fc00::/7
+  if ((g0 & 0xffc0) === 0xfec0) return true // deprecated site-local fec0::/10
+  if ((g0 & 0xff00) === 0xff00) return true // multicast ff00::/8
+  return false
+}
+
 /**
  * Whether a hostname is an obvious internal target. Best-effort literal
  * matching only: it cannot catch a public hostname that *resolves* to a
@@ -46,31 +174,30 @@ export function isPrivateHost(hostname: string): boolean {
     return true
 
   if (host.includes(':')) {
-    if (host === '::' || host === '::1') return true
-    const mappedV4 = host.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/)
-    if (mappedV4) return isPrivateHost(mappedV4[1]!)
-    const mappedHex = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/)
-    if (mappedHex) {
-      const hi = parseInt(mappedHex[1]!, 16)
-      const lo = parseInt(mappedHex[2]!, 16)
-      return isPrivateHost(
-        `${(hi >> 8) & 0xff}.${hi & 0xff}.${(lo >> 8) & 0xff}.${lo & 0xff}`
-      )
-    }
-    if (/^fe[89ab]/.test(host)) return true // link-local fe80::/10
-    if (host.startsWith('fc') || host.startsWith('fd')) return true // unique-local fc00::/7
-    return false
+    const groups = parseIPv6Groups(host)
+    return groups ? isPrivateIPv6(groups) : false
   }
 
   const v4 = parseIPv4Octets(host)
-  if (v4) {
-    const [a, b] = v4
-    if (a === 127 || a === 10 || a === 0) return true
-    if (a === 169 && b === 254) return true // link-local incl. cloud metadata
-    if (a === 172 && b >= 16 && b <= 31) return true
-    if (a === 192 && b === 168) return true
-  }
-  return false
+  return v4 ? isPrivateIPv4(v4) : false
+}
+
+/** Resolves a hostname to the IP addresses it points at. */
+export type HostResolver = (hostname: string) => Promise<string[]>
+
+let defaultHostResolver: HostResolver | undefined
+
+/**
+ * Installs the resolver {@link safeFetch} uses when a call passes no
+ * `resolveHost` of its own.
+ *
+ * Core cannot resolve DNS itself — Workers has no DNS API — so without a
+ * resolver the guard is literal-only and a public name pointing at
+ * `169.254.169.254` passes. Node runtimes install
+ * `nodeHostResolver` from `@pikku/core/node-host-resolver` at startup.
+ */
+export function setDefaultHostResolver(resolver: HostResolver | undefined) {
+  defaultHostResolver = resolver
 }
 
 export interface SafeFetchOptions {
@@ -81,6 +208,50 @@ export interface SafeFetchOptions {
   allowedHosts?: string[]
   /** Maximum redirect hops to follow (each re-validated). Defaults to 3. */
   maxRedirects?: number
+  /**
+   * Resolves a hostname so a *public* name pointing at a private address is
+   * refused. Defaults to whatever {@link setDefaultHostResolver} installed;
+   * pass `null` to opt a call out of resolution entirely.
+   */
+  resolveHost?: HostResolver | null
+}
+
+/** Whether a hostname is already an IP literal, which the sync check covers. */
+function isIpLiteral(hostname: string): boolean {
+  const host = hostname.replace(/^\[|\]$/g, '').replace(/\.$/, '')
+  if (host.includes(':')) return parseIPv6Groups(host.toLowerCase()) !== null
+  return parseIPv4Octets(host) !== null
+}
+
+/**
+ * Rejects a hostname that resolves to an internal address.
+ *
+ * Resolution happens once per hop and the connection is not pinned to the
+ * address checked, so a rebind between this check and the socket connecting is
+ * still possible; catching that needs a runtime-level connect hook.
+ */
+async function assertResolvedHostAllowed(
+  hostname: string,
+  options: SafeFetchOptions
+): Promise<void> {
+  if (options.allowedHosts) return
+  const resolver =
+    options.resolveHost === null
+      ? undefined
+      : (options.resolveHost ?? defaultHostResolver)
+  if (!resolver || isIpLiteral(hostname)) return
+
+  const addresses = await resolver(hostname)
+  if (addresses.length === 0) {
+    throw new Error(`Refusing to fetch: '${hostname}' resolved to no addresses`)
+  }
+  for (const address of addresses) {
+    if (isPrivateHost(address)) {
+      throw new Error(
+        `Refusing to fetch from a private/internal host: '${hostname}' resolves to ${address}`
+      )
+    }
+  }
 }
 
 export function assertFetchableUrl(
@@ -142,7 +313,9 @@ export async function safeFetch(
   options: SafeFetchOptions = {}
 ): Promise<Response> {
   const maxRedirects = options.maxRedirects ?? 3
-  let currentUrl = assertFetchableUrl(url, options).toString()
+  const initial = assertFetchableUrl(url, options)
+  await assertResolvedHostAllowed(initial.hostname, options)
+  let currentUrl = initial.toString()
   let currentInit = init
 
   for (let hop = 0; ; hop++) {
@@ -157,10 +330,12 @@ export async function safeFetch(
     if (!location || hop >= maxRedirects) {
       return response
     }
-    const nextUrl = assertFetchableUrl(
+    const next = assertFetchableUrl(
       new URL(location, currentUrl).toString(),
       options
-    ).toString()
+    )
+    await assertResolvedHostAllowed(next.hostname, options)
+    const nextUrl = next.toString()
     await response.body?.cancel()
     let nextInit = redirectInit(response.status, currentInit)
     if (new URL(nextUrl).origin !== new URL(currentUrl).origin) {

package/src/wirings/actor-flow/run-conversation.ts

@@ -119,12 +119,7 @@ function actorInstructions(persona: ResolvedPersona, task: string): string {
       : '',
     `Your goal in this conversation: ${task}.`,
     `Send one message at a time. Set "done" to true only once your goal is clearly accomplished, or clearly impossible.`,
-    // Every call the actor makes wants a schema'd object back, and a gateway
-    // that cannot take a JSON *schema* degrades to OpenAI's `json_object`
-    // mode — which refuses the request outright unless the word "json" appears
-    // somewhere in the prompt. Saying it once here covers all three call sites
-    // (turn, approvals, verdict), since each builds on these instructions, and
-    // it costs nothing on providers that never needed telling.
+    // knowledge: decisions/internals/the-actor-prompt-says-json-because-of-json-object-mode.md
     `Reply with json matching the schema you are given, and nothing else.`,
   ]
     .filter(Boolean)

package/src/wirings/ai-agent/agent-rpc.ts

@@ -0,0 +1,120 @@
+import type { PikkuRawWire } from '../../types/core.types.js'
+import type { SessionService } from '../../services/user-session-service.js'
+import type { CoreUserSession } from '../../types/core.types.js'
+import type { PikkuRPC } from '../rpc/rpc-types.js'
+import type { AIAgentInput, AIStreamChannel } from './ai-agent.types.js'
+import type { StreamAIAgentOptions } from './ai-agent-prepare.js'
+import { runAIAgent, resumeAIAgentSync } from './ai-agent-runner.js'
+import {
+  streamAIAgent,
+  resumeAIAgent,
+  interruptAIAgent,
+} from './ai-agent-stream.js'
+import { wrapChannelWithAGUI } from './ai-agent-agui.js'
+
+export type AgentRPCOptions = {
+  sessionService?: SessionService<CoreUserSession>
+}
+
+/**
+ * `wire.rpc.agent`, implemented.
+ *
+ * Lives here rather than in `rpc-runner` so the agent surface is one file next
+ * to the runner and stream code it delegates to, instead of a wing of the RPC
+ * primitive.
+ */
+export const createAgentRPC = (
+  wire: PikkuRawWire,
+  options: AgentRPCOptions
+): PikkuRPC['agent'] => {
+  const params = () => ({
+    sessionService: options.sessionService,
+    getCredential: wire.getCredential?.bind(wire),
+  })
+
+  const streamingChannel = (): AIStreamChannel => {
+    const channel = wire.channel as unknown as AIStreamChannel | undefined
+    if (!channel) throw new Error('No channel available for streaming')
+    return channel
+  }
+
+  /** `run` and `approve` return the same shape; only the call differs. */
+  const asRunResult = (result: Awaited<ReturnType<typeof runAIAgent>>) => ({
+    runId: result.runId,
+    result: result.object ?? result.text,
+    usage: result.usage,
+    ...(result.status === 'suspended' && {
+      status: 'suspended' as const,
+      pendingApprovals: result.pendingApprovals,
+    }),
+  })
+
+  return {
+    run: async (agentName: string, input: AIAgentInput) =>
+      asRunResult(await runAIAgent(agentName, input, params())),
+
+    stream: async (
+      agentName: string,
+      input: {
+        message: string
+        threadId: string
+        resourceId: string
+        model?: string
+        temperature?: number
+      },
+      streamOptions?: StreamAIAgentOptions
+    ) => {
+      let currentRunId: string | undefined
+      await streamAIAgent(
+        agentName,
+        input,
+        wrapChannelWithAGUI(streamingChannel(), {
+          threadId: input.threadId,
+          getRunId: () => currentRunId,
+        }),
+        params(),
+        undefined,
+        {
+          ...streamOptions,
+          onRunCreated: (runId) => {
+            currentRunId = runId
+            streamOptions?.onRunCreated?.(runId)
+          },
+        }
+      )
+    },
+
+    resume: async (
+      runId: string,
+      input: { toolCallId: string; approved: boolean },
+      streamOptions?: StreamAIAgentOptions
+    ) => {
+      await resumeAIAgent(
+        { runId, ...input },
+        wrapChannelWithAGUI(streamingChannel(), { runId }),
+        params(),
+        streamOptions
+      )
+    },
+
+    interrupt: async (runId: string, reason?: 'speech' | 'user' | 'timeout') =>
+      interruptAIAgent(
+        { runId, ...(reason ? { reason } : {}) },
+        { sessionService: options.sessionService }
+      ),
+
+    approve: async (
+      runId: string,
+      approvals: { toolCallId: string; approved: boolean }[],
+      expectedAgentName?: string
+    ) =>
+      asRunResult(
+        await resumeAIAgentSync(
+          runId,
+          approvals,
+          { sessionService: options.sessionService },
+          expectedAgentName
+        )
+      ),
+  }
+}

package/src/wirings/ai-agent/ai-agent-agui.ts

@@ -372,11 +372,7 @@ export function wrapChannelWithAGUI(
           break
         }
 
-        // AG-UI has no event for speech, so it travels as CUSTOM like the other
-        // pikku-specific ones. Dropping it instead — which is what this did —
-        // means a voice agent reached over HTTP is inaudible: `voiceOutput`
-        // synthesizes every sentence, the provider bills for it, and nothing
-        // gets past the mapper.
+        // knowledge: decisions/internals/agent-speech-travels-as-a-custom-agui-event.md
         case 'audio-delta': {
           send({
             type: 'CUSTOM',

package/src/wirings/ai-agent/ai-agent-interrupt.test.ts

@@ -574,7 +574,7 @@ describe('non-streaming agent interruption', () => {
         updateRun: async (_runId: string, patch: unknown) => {
           updates.push(patch)
         },
-        resolveApproval: async () => {},
+        resolveApproval: async () => true,
       },
     } as any)
 
@@ -648,6 +648,7 @@ describe('streaming resume interruption', () => {
         // for approvals that have already been given.
         resolveApproval: async () => {
           run.pendingApprovals = []
+          return true
         },
       },
     } as any)

package/src/wirings/ai-agent/ai-agent-memory.ts

@@ -19,7 +19,14 @@ export function resolveMemoryServices(
 } {
   const memoryConfig = agent.memory
   const storage = memoryConfig?.storage
-    ? (singletonServices as any)[memoryConfig.storage]
+    ? // The service is named by string in agent config, so the lookup cannot be
+      // checked — only the shape it is required to have.
+      (
+        singletonServices as unknown as Record<
+          string,
+          AIStorageService | undefined
+        >
+      )[memoryConfig.storage]
     : singletonServices.aiStorage
   return { storage }
 }