@pikku/mongodb 0.12.14 → 0.12.15

package/CHANGELOG.md

@@ -1,5 +1,49 @@
 # @pikku/mongodb
 
+## 0.12.15
+
+### Patch Changes
+
+- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
+
+  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
+  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
+  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
+  which names a declared entry node anyway.
+
+  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
+  step claim rejects a queue message naming a different function with
+  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
+  the run owner's identity and without the `expose` gate, so the message must not
+  choose what runs.
+
+  `approveStep` takes the caller's session, and the generated status routes and
+  streams assert the same `assertWorkflowRunOwner` check: a run started through a
+  session may only be read and approved by that session's user. A run with no
+  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
+  against and is still gated by the entrypoint's own `auth`/`permissions`.
+
+  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
+  _this_ caller made the claim, and both agent resume paths run a tool only for the
+  approvals they claimed — concurrent approvals of one tool call no longer all
+  execute it.
+
+- Updated dependencies [41c1a95]
+- Updated dependencies [ce96383]
+- Updated dependencies [7e60867]
+- Updated dependencies [f8f1244]
+- Updated dependencies [dcf20cb]
+- Updated dependencies [6512384]
+- Updated dependencies [e3b4c14]
+- Updated dependencies [efd0ed1]
+- Updated dependencies [cba98fb]
+- Updated dependencies [ce96383]
+- Updated dependencies [f8f1244]
+- Updated dependencies [f8f1244]
+- Updated dependencies [6e93a35]
+- Updated dependencies [6dada45]
+  - @pikku/core@0.12.80
+
 ## 0.12.14
 
 ### Patch Changes

package/dist/src/mongodb-ai-storage-service.d.ts

@@ -36,6 +36,6 @@ export declare class MongoDBAIStorageService implements AIStorageService, AIRunS
         run: AgentRunState;
         approval: NonNullable<AgentRunState['pendingApprovals']>[number];
     } | null>;
-    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<void>;
+    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<boolean>;
     close(): Promise<void>;
 }

package/dist/src/mongodb-ai-storage-service.js

@@ -402,7 +402,9 @@ export class MongoDBAIStorageService {
         return { run, approval };
     }
     async resolveApproval(toolCallId, status) {
-        await this.toolCalls.updateOne({ _id: toolCallId }, { $set: { approvalStatus: status } });
+        // Only the caller that moves the tool call off 'pending' has claimed it.
+        const result = await this.toolCalls.updateOne({ _id: toolCallId, approvalStatus: 'pending' }, { $set: { approvalStatus: status } });
+        return result.modifiedCount > 0;
     }
     async close() { }
 }

package/dist/src/mongodb-workflow-service.js

@@ -85,6 +85,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId,
             status: 'pending',
+            rpcName,
             result: undefined,
             error: undefined,
             attemptCount: 1,
@@ -109,6 +110,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,
@@ -238,6 +240,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.14",
+  "version": "0.12.15",
   "description": "MongoDB services for Pikku — workflow state, agent runs, secrets and channel stores",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.76"
+    "@pikku/core": "^0.12.80"
   },
   "dependencies": {
     "mongodb": "^6.12.0"

package/src/mongodb-ai-storage-service.ts

@@ -565,11 +565,13 @@ export class MongoDBAIStorageService
   async resolveApproval(
     toolCallId: string,
     status: 'approved' | 'denied'
-  ): Promise<void> {
-    await this.toolCalls.updateOne(
-      { _id: toolCallId },
+  ): Promise<boolean> {
+    // Only the caller that moves the tool call off 'pending' has claimed it.
+    const result = await this.toolCalls.updateOne(
+      { _id: toolCallId, approvalStatus: 'pending' },
       { $set: { approvalStatus: status } }
     )
+    return result.modifiedCount > 0
   }
 
   public async close(): Promise<void> {}

package/src/mongodb-workflow-service.ts

@@ -203,6 +203,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId,
       status: 'pending',
+      rpcName,
       result: undefined,
       error: undefined,
       attemptCount: 1,
@@ -233,6 +234,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,
@@ -426,6 +428,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,