agent-relay-server 0.36.1 → 0.36.2

package/docs/openapi.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.0",
   "info": {
     "title": "Agent Relay API",
-    "version": "0.36.1",
+    "version": "0.36.2",
     "description": "Real-time message bus for inter-agent communication. Agent-first: this spec is designed for machine consumption — agents can self-discover the full API surface via GET /api/spec.",
     "license": {
       "name": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-relay-server",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Lightweight HTTP message relay for inter-agent communication across machines",
   "module": "src/index.ts",
   "type": "module",

package/src/bus.ts

@@ -16,7 +16,7 @@ import {
   type RegisterFrame,
 } from "agent-relay-sdk/protocol";
 import { errMessage, isRecord, stringValue } from "agent-relay-sdk";
-import { getComponentAuth, isComponentAuthorizedFor, isAuthorized, isOriginAllowed, unauthorized } from "./security";
+import { getComponentAuth, isComponentAuthorizedFor, isAuthorized, isOriginAllowed, resolveSpawnLineage, unauthorized } from "./security";
 import type { AgentCard, Command, ComponentToken, ContextState, Message, ProviderCapabilities, Task } from "./types";
 
 interface BusSocketData {
@@ -273,6 +273,10 @@ function handleRegister(ws: BusWebSocket, frame: RegisterFrame): void {
   if (payload.agentId) {
     const label = stringMeta(payload.meta, "label");
     const context = contextFromMeta(payload.meta);
+    // Authoritative parent lineage — spawned/managed agents register over THIS bus path, not the
+    // HTTP `postAgent` route, so `spawned_by` must be set here too or it stays NULL (breaking the
+    // parent→child shutdown gate, the `spawnedBy:` filter, and the live-children quota).
+    const lineage = resolveSpawnLineage(ws.data.componentAuth?.constraints);
     const agent = upsertAgent({
       id: payload.agentId,
       name: stringMeta(payload.meta, "name") ?? payload.componentId,
@@ -286,6 +290,7 @@ function handleRegister(ws: BusWebSocket, frame: RegisterFrame): void {
       instanceId: payload.instanceId,
       ...(providerCapabilities ? { providerCapabilities } : {}),
       ...(context ? { context } : {}),
+      ...(lineage ? { spawnedBy: lineage } : {}),
       meta: payload.meta,
     });
     epoch = agent.epoch;

package/src/routes/agents-spawn.ts

@@ -11,7 +11,7 @@ import { emitAgentStatus, emitManagedAgentStateChanged, emitMessageAvailable, em
 import { getAgentProfile, getManagedAgentState, updateManagedAgentState } from "../config-store";
 import { notifyAgentReady } from "../agent-lifecycle-events";
 import { getCompactionWatch } from "../compaction-watch";
-import { getComponentAuth } from "../security";
+import { getComponentAuth, resolveSpawnLineage } from "../security";
 import { isPathWithinBase } from "../utils";
 import { listHostDirectories } from "../agent-spawn";
 import { rankRouteCandidates, type RouteAdvisorInput } from "../context-router";
@@ -67,8 +67,7 @@ export const postAgent: Handler = async (req) => {
     // Lineage is authoritative from the registering token's signed constraints — never the
     // client-sent body (a child can't forge its own parent). Set by relay at spawn for
     // agent-initiated spawns (`spawnedBy`) and the delegating-component path (`parentAgents`).
-    const constraints = getComponentAuth(req)?.constraints;
-    const lineage = constraints?.spawnedBy ?? constraints?.parentAgents?.[0];
+    const lineage = resolveSpawnLineage(getComponentAuth(req)?.constraints);
     if (lineage) input.spawnedBy = lineage;
     const existing = getAgent(input.id);
     const agent = upsertAgent(input);

package/src/security.ts

@@ -397,6 +397,14 @@ function hasScope(scopes: string[], requiredScope: string): boolean {
   return false;
 }
 
+/** Authoritative parent lineage from a registering token's signed constraints — agent-initiated
+ * spawn (`spawnedBy`) or the delegating-component path (`parentAgents`). One home, used by both the
+ * HTTP `postAgent` route and the bus register path so `spawned_by` is set however a child registers
+ * (drives the parent→child shutdown gate, the `spawnedBy:` filter, and the live-children quota). */
+export function resolveSpawnLineage(constraints: TokenConstraints | undefined): string | undefined {
+  return constraints?.spawnedBy ?? constraints?.parentAgents?.[0];
+}
+
 function constraintsAllow(constraints: TokenConstraints | undefined, resource: AuthorizationResource | undefined): boolean {
   if (!constraints || !resource) return true;
   const hasConstraints = Object.keys(constraints).length > 0;