@wjarka/cezarion 0.14.5 → 0.14.6

package/dist/workflows/run.js

@@ -1,4 +1,4 @@
-import { workerContextHash, captureWorkerAccount, boundWorkerAccountEnv, WorkerIdentityError } from '../delegation/execution-identity.js';
+import { workerContextHash, workerWorkflowHash, workerStepIdentity, captureWorkerAccount, boundWorkerAccountEnv, WorkerIdentityError } from '../delegation/execution-identity.js';
 import { buildChildEnv } from '../core/agent-env.js';
 import { randomUUID } from 'node:crypto';
 import { spawn } from 'node:child_process';
@@ -796,8 +796,12 @@ export class RunManager {
      * spawning a CLI. Never throws: an unreadable home degrades to the default profile, which is
      * exactly the behaviour that predates profiles.
      */
-    /** Ordinary runs retain mutable discovery; owned runs require explicit durable evidence. */
-    workerIdentity(runId) {
+    /**
+     * Ordinary runs retain mutable discovery; owned runs require explicit durable evidence. With a
+     * `stepId`, the step's own pinned entry is checked too (#452): its account must still be
+     * available and its model/effort must clear the lock, exactly as the run-level fields must.
+     */
+    workerIdentity(runId, stepId) {
         const run = this.store.getRun(runId);
         if (run?.delegation?.role !== 'worker')
             return undefined;
@@ -809,6 +813,7 @@ export class RunManager {
         if (identity.contextHash !== undefined && (!run.delegation.context || workerContextHash(run.delegation.context) !== identity.contextHash)) {
             throw new WorkerIdentityError('Accepted worker context recipe is unavailable or changed');
         }
+        this.ownedWorkflow(run, identity);
         if (agentModelsLocked(this.repoRoot) && (identity.model !== undefined || identity.effort !== undefined)) {
             throw new WorkerIdentityError(`Accepted worker settings cannot run: ${AGENT_MODELS_LOCKED_ERROR}`);
         }
@@ -816,17 +821,69 @@ export class RunManager {
             run.model !== identity.model || run.effort !== identity.effort) {
             throw new WorkerIdentityError('Accepted worker execution identity does not match its run');
         }
-        boundWorkerAccountEnv(identity.account, buildChildEnv({ backend: identity.account.provider }));
+        // Availability is checked for the account about to be USED: the selected step's entry when
+        // there is one, and the single run-level account only for a legacy identity that has no
+        // per-step list. A per-step identity checked without a step (the evidence-only calls in
+        // `execute`, `runContinuation` and `ownedJob`) binds nothing here — the launch resolves its
+        // step and binds that account — so a first-step login removed after its step finished never
+        // stops a later step, a Continue or a recovery whose own account is intact (#465).
+        const step = stepId === undefined ? undefined : workerStepIdentity(identity, stepId);
+        if (step && agentModelsLocked(this.repoRoot) && (step.model !== undefined || step.effort !== undefined)) {
+            throw new WorkerIdentityError(`Accepted worker settings cannot run: ${AGENT_MODELS_LOCKED_ERROR}`);
+        }
+        const account = step?.account ?? (identity.steps === undefined ? identity.account : undefined);
+        if (account)
+            boundWorkerAccountEnv(account, buildChildEnv({ backend: account.provider }));
         return identity;
     }
+    /** The pinned identity one agent step of an owned worker runs under; undefined for ordinary and internal runs. */
+    workerStep(runId, stepId) {
+        const identity = this.workerIdentity(runId, stepId);
+        if (!identity)
+            return undefined;
+        return stepId === undefined
+            ? { account: identity.account, grants: identity.grants, ...(identity.model === undefined ? {} : { model: identity.model }), ...(identity.effort === undefined ? {} : { effort: identity.effort }) }
+            : workerStepIdentity(identity, stepId);
+    }
+    /**
+     * The steps a continuation may extend. An accepted worker's public `workflowDef` is authority
+     * only while its identity binds it: a catalog chain through `ownedWorkflow`, and the default
+     * quick-task from the built-in constant, exactly the definition `ownedJob` launches — a salvaged
+     * or edited public record never picks which pinned identity a turn runs under.
+     */
+    continuationDefSteps(record) {
+        if (record?.delegation?.role === 'worker') {
+            const identity = this.store.readWorkerIdentity(record.id);
+            if (identity?.kind === 'accepted')
+                return (this.ownedWorkflow(record, identity) ?? QUICK_TASK_WORKFLOW).steps;
+        }
+        return record?.workflowDef?.steps;
+    }
+    /**
+     * The definition step a continuation extends: the one owning the resumed session, else the
+     * chain's last agent step — a synthetic `continue-N` owner and a fresh-session continuation
+     * both extend the run's tail. Shared by `continueRun` (which identity to hold the override
+     * against) and `runContinuation` (which tools, model, effort and account the turn gets).
+     */
+    continuationDefStep(record, sessionId) {
+        const defSteps = this.continuationDefSteps(record);
+        if (defSteps === undefined)
+            return undefined;
+        const owningStep = sessionId === undefined ? undefined : record?.steps.find((s) => s.sessionId === sessionId);
+        if (sessionId !== undefined && owningStep === undefined)
+            return undefined;
+        return defSteps.find((s) => s.id === owningStep?.id) ?? [...defSteps].reverse().find((s) => stepKind(s) === 'agent');
+    }
     async agentEnvForStep(runId, backend, options = {}) {
-        const identity = this.workerIdentity(runId);
-        if (identity) {
-            if (backend !== identity.account.provider)
+        // An owned worker binds the account its identity pinned for THIS step (#452); a legacy identity
+        // answers every step with its single run-level account, so the one-provider rule still holds there.
+        const step = this.workerStep(runId, options.stepId);
+        if (step) {
+            if (backend !== step.account.provider)
                 throw new WorkerIdentityError('Accepted worker provider identity cannot change');
             const env = this.agentEnv(runId, options.generateFollowups);
-            return { env: { ...env, ...boundWorkerAccountEnv(identity.account, buildChildEnv({ backend, extraEnv: env })) },
-                profileId: identity.account.profileId, accountBinding: identity.account };
+            return { env: { ...env, ...boundWorkerAccountEnv(step.account, buildChildEnv({ backend, extraEnv: env })) },
+                profileId: step.account.profileId, accountBinding: step.account };
         }
         const run = this.store.getRun(runId);
         const profileId = options.recordedProfileId
@@ -867,7 +924,14 @@ export class RunManager {
             throw new DelegationPolicyError('incompatible_state', 'Parent session settings unavailable');
         return structuredClone(state.delegationSettings);
     }
-    /** Resolve caller selection once, before acceptance; permission grants always come from the parent. */
+    /**
+     * Resolve one agent step's selection before acceptance; permission grants always come from the
+     * parent. Called once per agent step of the accepted chain (#452): a same-backend step inherits
+     * the parent's account, model and effort, another runner resolves its own project/default
+     * account, and an explicit `agentProfile` names the account for either — an id the registry
+     * does not know is refused rather than degraded to the default, because a worker silently
+     * running on another login is a billing boundary crossed without anyone choosing it.
+     */
     async selectDelegationExecutionSettings(runId, selection) {
         const parent = this.delegationExecutionSettings(runId);
         const runner = selection.backend ?? parent.runner;
@@ -880,8 +944,11 @@ export class RunManager {
             }
             let accountBinding = parent.accountBinding;
             let env = buildChildEnv({ backend: runner });
-            if (!sameBackend) {
-                const resolved = await resolveProfileEnvForRoot(this.repoRoot, runner);
+            if (!sameBackend || selection.agentProfile !== undefined) {
+                const resolved = await resolveProfileEnvForRoot(this.repoRoot, runner, selection.agentProfile);
+                if (selection.agentProfile !== undefined && resolved.profile.id !== selection.agentProfile) {
+                    throw new Error(`Unknown ${runner} account "${selection.agentProfile}"`);
+                }
                 env = buildChildEnv({ backend: runner, extraEnv: resolved.env });
                 accountBinding = captureWorkerAccount(resolved.profile, env);
             }
@@ -989,7 +1056,7 @@ export class RunManager {
         const grants = this.workerIdentity(run.id)?.grants
             ?? run.workflowDef?.steps.find(step => step.id === QUICK_TASK_WORKFLOW.steps[0].id);
         return {
-            workflow: { ...QUICK_TASK_WORKFLOW, steps: [{ ...QUICK_TASK_WORKFLOW.steps[0],
+            workflow: this.ownedWorkflow(run, this.store.readWorkerIdentity(run.id)) ?? { ...QUICK_TASK_WORKFLOW, steps: [{ ...QUICK_TASK_WORKFLOW.steps[0],
                         ...(grants?.allowedTools === undefined ? {} : { allowedTools: [...grants.allowedTools] }),
                         ...(grants?.bashAllowlist === undefined ? {} : { bashAllowlist: [...grants.bashAllowlist] }), }] },
             input: {
@@ -999,6 +1066,20 @@ export class RunManager {
             },
         };
     }
+    /**
+     * The catalog chain an owned worker runs (#451), or undefined for the built-in quick-task.
+     * The public `workflowDef` is mutable state, so it is authority only while the private
+     * identity's hash binds it — the same shape as the context recipe. A tampered or lost
+     * definition refuses execution instead of quietly running quick-task or the edit.
+     */
+    ownedWorkflow(run, identity) {
+        if (identity?.workflowHash === undefined)
+            return undefined;
+        if (!run.workflowDef || workerWorkflowHash(run.workflowDef) !== identity.workflowHash) {
+            throw new WorkerIdentityError('Accepted worker workflow definition is unavailable or changed');
+        }
+        return run.workflowDef;
+    }
     /**
      * Parallel variants (spec 010): N runs of the same workflow on the same
      * task, sharing a groupId. Variant A gets the task verbatim; B and C get a
@@ -1240,10 +1321,23 @@ export class RunManager {
             ? [...run.steps].reverse().find((step) => step.id !== queuedContinuation.id && step.sessionId)
             : undefined;
         if (queuedContinuation && sessionStep?.sessionId) {
-            const backend = run.runner ?? 'claude';
+            // An accepted worker's continuation extends the step owning the resumed session, so its
+            // runner and account come from that step's pinned identity (#452), never the run-level
+            // first-step fields — those would re-queue a claude review's Continue as a codex turn with
+            // no session to resume (#465). Broken identity evidence is left for the launch to report.
+            let resumeIdentity;
+            try {
+                resumeIdentity = this.workerStep(run.id, this.continuationDefStep(run, sessionStep.sessionId)?.id);
+            }
+            catch (error) {
+                if (!(error instanceof WorkerIdentityError))
+                    throw error;
+            }
+            const backend = resumeIdentity?.account.provider ?? run.runner ?? 'claude';
             const sessionBackend = sessionStep.backend ?? backend;
             const sessionAccount = sessionStep.profileId ?? DEFAULT_AGENT_ACCOUNT_ID;
-            const sameAccount = run.agentProfile === undefined || run.agentProfile === sessionAccount;
+            const agentProfile = resumeIdentity?.account.profileId ?? run.agentProfile;
+            const sameAccount = agentProfile === undefined || agentProfile === sessionAccount;
             this.pendingContinuations.set(run.id, {
                 stepId: queuedContinuation.id,
                 sessionId: sessionBackend === backend && sameAccount ? sessionStep.sessionId : undefined,
@@ -3270,12 +3364,16 @@ export class RunManager {
         if (run.delegation?.role === 'worker' && this.store.getRun(run.delegation.parentRunId)?.status === 'review') {
             return { ok: false, error: 'Continue the reviewing parent before continuing its worker' };
         }
+        // Held against the identity of the step this continuation extends (#452), which for a mixed
+        // chain is not the run-level (first-step) one; `runContinuation` resolves the same step.
+        let resumeIdentity;
         try {
-            const identity = this.workerIdentity(runId);
-            if (identity && ((opts.runner !== undefined && opts.runner !== identity.account.provider) ||
-                (opts.agentProfile !== undefined && opts.agentProfile !== identity.account.profileId) ||
-                (opts.model !== undefined && opts.model !== identity.model) ||
-                (opts.effort !== undefined && opts.effort !== identity.effort))) {
+            const resumeSession = [...run.steps].reverse().find((s) => s.sessionId)?.sessionId;
+            resumeIdentity = this.workerStep(runId, this.continuationDefStep(run, resumeSession)?.id);
+            if (resumeIdentity && ((opts.runner !== undefined && opts.runner !== resumeIdentity.account.provider) ||
+                (opts.agentProfile !== undefined && opts.agentProfile !== resumeIdentity.account.profileId) ||
+                (opts.model !== undefined && opts.model !== resumeIdentity.model) ||
+                (opts.effort !== undefined && opts.effort !== resumeIdentity.effort))) {
                 return { ok: false, error: 'Accepted worker execution identity cannot change' };
             }
         }
@@ -3316,7 +3414,9 @@ export class RunManager {
         const untouched = isUntouchedCancelledRun(run);
         if (!sessionStep?.sessionId && !untouched)
             return { ok: false, error: 'no agent session to resume' };
-        const originalRunner = run.runner ?? (untouched ? opts.originalRunner : undefined) ?? 'claude';
+        // An accepted worker continues under the identity of the step it extends, whatever the
+        // run-level (first-step) runner says.
+        const originalRunner = resumeIdentity?.account.provider ?? run.runner ?? (untouched ? opts.originalRunner : undefined) ?? 'claude';
         const targetRunner = opts.runner ?? originalRunner;
         // Session ids are provider-owned opaque values. New records carry explicit
         // affinity; for legacy records, the run's current runner is the conservative
@@ -3328,7 +3428,9 @@ export class RunManager {
         // open a fresh conversation while the thread claimed it had resumed. A step that recorded no
         // account predates the feature and therefore ran under the discovered one.
         const sessionAccount = sessionStep?.profileId ?? DEFAULT_AGENT_ACCOUNT_ID;
-        const accountSwitched = (opts.agentProfile ?? run.agentProfile ?? sessionAccount) !== sessionAccount;
+        // A mixed-chain worker's run-level account is its FIRST step's; the resumed step's own pinned
+        // account is what decides whether the session can be reattached (#452).
+        const accountSwitched = (opts.agentProfile ?? resumeIdentity?.account.profileId ?? run.agentProfile ?? sessionAccount) !== sessionAccount;
         const resume = sessionBackend === targetRunner && !accountSwitched;
         // Follow-up runner/model/account override (#401, spec 2026-07-29-agent-profiles): the composer
         // lets the user pick which backend, model and login handle this continuation — the same flat
@@ -3337,10 +3439,13 @@ export class RunManager {
         // run's current backend — `runContinuation` reads it off the record, later continuations
         // default to it, and the header reflects the active engine. An empty model ('') clears the
         // pin, letting the runner pick the model (auto).
-        if (opts.runner !== undefined ||
+        // An accepted worker's identity is frozen, and the check above already required any override
+        // to equal the resumed step's entry, so there is nothing to persist — and writing a step-level
+        // runner onto a mixed chain's record would break the run-level identity match.
+        if (resumeIdentity === undefined && (opts.runner !== undefined ||
             opts.model !== undefined ||
             opts.effort !== undefined ||
-            opts.agentProfile !== undefined) {
+            opts.agentProfile !== undefined)) {
             // Guard the pairing before persisting anything: the model override applies to the runner
             // this continuation will actually use (`opts.runner ?? record.runner ?? 'claude'` — the
             // same resolution `runContinuation` reads off the record). A model that is recognizably
@@ -3825,19 +3930,6 @@ export class RunManager {
         // instead of `opus`). Fail loud here too rather than let the backend pick a default.
         let continueModel;
         let resumeWorkflow;
-        try {
-            const normalized = normalizeModelForBackend(continueBackend, agentModelsLocked(this.repoRoot) ? undefined : record?.model, { configuredProvider: await configuredModelProvider(continueBackend, state.cwd) });
-            continueModel = normalized?.backendModel;
-            this.store.updateRun(runId, {
-                modelIdentity: normalized ? formatModelIdentity(normalized.identity) : undefined,
-            });
-        }
-        catch (err) {
-            if (!(err instanceof ModelIdentityError))
-                throw err;
-            failBeforeSpawn(err.message);
-            return;
-        }
         // Resuming reattaches to a session that lives inside ONE account's config dir, so the
         // continuation must run under the account that created it — not whatever the project has
         // been switched to since. The owning step is the one carrying this session id.
@@ -3845,6 +3937,9 @@ export class RunManager {
             ? undefined
             : record?.steps.find((s) => s.sessionId === sessionId);
         const resumedProfileId = owningStep?.profileId;
+        // An owned worker's turn runs under the identity pinned for the step it extends (#452).
+        const toolsStep = this.continuationDefStep(record, sessionId);
+        const stepIdentity = this.workerStep(runId, toolsStep?.id);
         // The owning step also names the session's tools: resolve `allowedTools`/`bashAllowlist`
         // from the persisted `workflowDef` exactly as the first spawn did (`runAgentStep`).
         // Rebuilding with the bare DEFAULT_ALLOWED_TOOLS silently revoked every per-step grant
@@ -3855,14 +3950,26 @@ export class RunManager {
         // owning session) both extend the run's tail, so they resolve from the definition's last
         // agent step. A legacy record without `workflowDef` (#367), or a session no step owns,
         // keeps today's defaults.
-        const defSteps = record?.workflowDef?.steps;
-        const toolsStep = (defSteps === undefined || (sessionId !== undefined && owningStep === undefined)
-            ? undefined
-            : defSteps.find((s) => s.id === owningStep?.id)
-                ?? [...defSteps].reverse().find((s) => stepKind(s) === 'agent'));
-        const grants = this.workerIdentity(runId)?.grants ?? {
+        const grants = stepIdentity?.grants ?? {
             allowedTools: allowedToolsForStep(toolsStep, continueBackend), bashAllowlist: toolsStep?.bashAllowlist,
         };
+        // The owning step's authored `model` wins over the run-level pin, exactly as the first
+        // spawn resolved `step.model ?? input.model` (#464 review): a catalog worker keeps the
+        // parent's inherited model at run level, so reading only the record silently switched a
+        // step authored for another model on Continue.
+        try {
+            const normalized = normalizeModelForBackend(continueBackend, agentModelsLocked(this.repoRoot) ? undefined : stepIdentity ? stepIdentity.model : toolsStep?.model ?? record?.model, { configuredProvider: await configuredModelProvider(continueBackend, state.cwd) });
+            continueModel = normalized?.backendModel;
+            this.store.updateRun(runId, {
+                modelIdentity: normalized ? formatModelIdentity(normalized.identity) : undefined,
+            });
+        }
+        catch (err) {
+            if (!(err instanceof ModelIdentityError))
+                throw err;
+            failBeforeSpawn(err.message);
+            return;
+        }
         let continueEffort;
         try {
             const modelsLocked = agentModelsLocked(this.repoRoot);
@@ -3872,7 +3979,7 @@ export class RunManager {
             const stepEffort = parseDelegationEffort(toolsStep?.effort);
             continueEffort = modelsLocked
                 ? undefined
-                : authoredStepEffort ? stepEffort : record?.effort;
+                : stepIdentity ? stepIdentity.effort : authoredStepEffort ? stepEffort : record?.effort;
         }
         catch (err) {
             failBeforeSpawn(err instanceof Error ? err.message : String(err));
@@ -3886,6 +3993,7 @@ export class RunManager {
             continueProfile = await this.agentEnvForStep(runId, continueBackend, {
                 generateFollowups,
                 recordedProfileId: resumedProfileId,
+                stepId: toolsStep?.id,
             });
         }
         catch (err) {
@@ -4644,6 +4752,10 @@ export class RunManager {
             }
         };
         const stepBackend = step.runner ?? taskBackend;
+        // An owned worker's step runs under what its identity pinned for it (#452): model, effort,
+        // account and grants alike. The bound `workflowDef` carries the same values; the private
+        // evidence is the authority.
+        const stepIdentity = this.workerStep(runId, step.id);
         // Normalise the selected model to canonical `provider/model` and back to the
         // backend's own wire form via the ONE shared mapper (#405). Fail-loud: an
         // unresolvable model (e.g. a bare id on opencode) returns the step error
@@ -4658,8 +4770,8 @@ export class RunManager {
             const stepEffort = parseDelegationEffort(step.effort);
             effectiveEffort = modelsLocked
                 ? undefined
-                : authoredStepEffort ? stepEffort : this.store.getRun(runId)?.effort ?? input.effort;
-            const normalized = normalizeModelForBackend(stepBackend, modelsLocked ? undefined : step.model ?? input.model, { configuredProvider: await configuredModelProvider(stepBackend, state.cwd) });
+                : stepIdentity ? stepIdentity.effort : authoredStepEffort ? stepEffort : this.store.getRun(runId)?.effort ?? input.effort;
+            const normalized = normalizeModelForBackend(stepBackend, modelsLocked ? undefined : stepIdentity ? stepIdentity.model : step.model ?? input.model, { configuredProvider: await configuredModelProvider(stepBackend, state.cwd) });
             backendModel = normalized?.backendModel;
             // Persist the identity of what ACTUALLY runs (#405, review M1). The run-start echo
             // (line ~993) is best-effort from `taskBackend`/`input.model`; a per-step `runner`/`model`
@@ -4683,6 +4795,7 @@ export class RunManager {
         try {
             stepProfile = await this.agentEnvForStep(runId, stepBackend, {
                 generateFollowups: followupsEnabled() && input.generateFollowups !== false,
+                stepId: step.id,
             });
         }
         catch (err) {
@@ -4694,7 +4807,7 @@ export class RunManager {
         if (state.cancelled || (beforeSpawn && this.executionBlockedByRootFinish(beforeSpawn)))
             return null;
         this.store.updateStep(runId, step.id, { profileId: stepProfile.profileId });
-        const grants = this.workerIdentity(runId)?.grants ?? {
+        const grants = stepIdentity?.grants ?? {
             allowedTools: allowedToolsForStep(step, stepBackend), bashAllowlist: step.bashAllowlist,
         };
         state.delegationSettings = { cwd: state.cwd, runner: stepBackend, model: backendModel,