chainlesschain 0.162.188 → 0.162.193

package/src/gateways/ws/session-protocol.js

@@ -7,6 +7,296 @@ import {
 import { createSessionRecord } from "../../runtime/contracts/session-record.js";
 import { loadSideEffectLedger } from "../../lib/side-effect-ledger-store.js";
 import { reconcileSideEffects } from "../../lib/side-effect-ledger.js";
+import {
+  formatMcpLedgerRecoveryNotice,
+  loadMcpLedgerRecovery,
+} from "../../lib/mcp-call-ledger-store.js";
+import { isProxy } from "node:util/types";
+import {
+  MCP_RECOVERY_INVALID_CODE,
+  classifyMcpRecoveryAdmission,
+} from "../../lib/mcp-ledger-recovery-admission.js";
+import { readSessionHostResumeState } from "../../lib/session-host-snapshot.js";
+import { sanitizePersistedMessages } from "../../lib/session-message-provenance.js";
+
+const PAYLOAD_DIGEST = /^sha256:[0-9a-f]{64}$/;
+const RAW_AUTHORITY_HASH = /^[0-9a-f]{64}$/;
+const MCP_REPLAY_DENY_FIELDS = new Set([
+  "ledgerId",
+  "serverName",
+  "toolName",
+  "inputBytes",
+  "replayDigest",
+]);
+const MCP_RECOVERY_REMEDIATIONS = new Set([
+  "inspect_transcript",
+  "adjudicate_started_calls",
+  "exact_replay_denied",
+]);
+const RESUME_RECOVERY_NOTICE = Symbol("cc.resume-recovery-notice");
+
+function captureCanonicalHostSystemPrefix(session) {
+  if (Array.isArray(session?._canonicalHostSystemPrefix)) {
+    const explicit = sanitizePersistedMessages(
+      session._canonicalHostSystemPrefix,
+      { strict: true },
+    );
+    if (explicit.some((message) => message.role !== "system")) {
+      throw new TypeError("Canonical WS host prefix is invalid");
+    }
+    return Object.freeze(explicit.map((message) => Object.freeze(message)));
+  }
+  const persisted = sanitizePersistedMessages(session?.messages || [], {
+    strict: true,
+  });
+  const firstMessage = persisted[0] || null;
+  const prefix = [];
+  if (firstMessage?.role === "system") {
+    // A WS session is created with exactly one host-owned system prompt. Any
+    // later leading systems may be canonical summaries or recovery notices
+    // serialized by the DB compatibility mirror; they must not be promoted
+    // into the host prefix after a process restart.
+    prefix.push(Object.freeze(firstMessage));
+  }
+  const frozenPrefix = Object.freeze(prefix);
+  Object.defineProperty(session, "_canonicalHostSystemPrefix", {
+    configurable: true,
+    value: frozenPrefix,
+  });
+  return frozenPrefix;
+}
+
+function replaceResumeRecoveryNotice(session, notice) {
+  const previous = session?._resumeRecoveryNoticeMessage || null;
+  const messages = (
+    Array.isArray(session?.messages) ? session.messages : []
+  ).filter(
+    (message) =>
+      message !== previous && message?.[RESUME_RECOVERY_NOTICE] !== true,
+  );
+  let insertionIndex = 0;
+  while (messages[insertionIndex]?.role === "system") insertionIndex += 1;
+
+  let recoveryMessage = null;
+  if (typeof notice === "string" && notice.trim()) {
+    recoveryMessage = { role: "system", content: notice };
+    Object.defineProperty(recoveryMessage, RESUME_RECOVERY_NOTICE, {
+      value: true,
+    });
+    messages.splice(insertionIndex, 0, recoveryMessage);
+  }
+  session.messages = messages;
+  Object.defineProperty(session, "_resumeRecoveryNoticeMessage", {
+    configurable: true,
+    writable: true,
+    value: recoveryMessage,
+  });
+}
+
+function recoveryErrorCode(error, fallbackCode) {
+  try {
+    return typeof error?.code === "string" && error.code
+      ? error.code
+      : fallbackCode;
+  } catch {
+    return fallbackCode;
+  }
+}
+
+function ownDataValue(record, key, fallback = null) {
+  if (!record || typeof record !== "object" || isProxy(record)) {
+    const error = new TypeError(`MCP recovery ${key} record is not plain data`);
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const descriptor = Object.getOwnPropertyDescriptor(record, key);
+  if (!descriptor) return fallback;
+  if (!("value" in descriptor)) {
+    const error = new TypeError(`MCP recovery ${key} must be a data property`);
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  return descriptor.value;
+}
+
+function recoveryString(value, fallback) {
+  if (value == null) return fallback;
+  if (typeof value === "string") return value;
+  const error = new TypeError("MCP recovery scalar must be a string");
+  error.code = MCP_RECOVERY_INVALID_CODE;
+  throw error;
+}
+
+function snapshotMcpRecord(record) {
+  const effectContract = ownDataValue(record, "effectContract", null);
+  let effect = "unknown";
+  if (effectContract != null) {
+    if (typeof effectContract !== "object" || isProxy(effectContract)) {
+      const error = new TypeError("MCP recovery effect contract is malformed");
+      error.code = MCP_RECOVERY_INVALID_CODE;
+      throw error;
+    }
+    effect = recoveryString(
+      ownDataValue(effectContract, "effect", "unknown"),
+      "unknown",
+    );
+  }
+  return Object.freeze({
+    ledgerId: recoveryString(ownDataValue(record, "ledgerId", null), null),
+    serverName: recoveryString(
+      ownDataValue(record, "serverName", "unknown"),
+      "unknown",
+    ),
+    toolName: recoveryString(
+      ownDataValue(record, "toolName", "unknown"),
+      "unknown",
+    ),
+    effect,
+  });
+}
+
+function snapshotMcpIncident(incident) {
+  return Object.freeze({
+    code: recoveryString(
+      ownDataValue(incident, "code", MCP_RECOVERY_INVALID_CODE),
+      MCP_RECOVERY_INVALID_CODE,
+    ),
+    ledgerId: recoveryString(ownDataValue(incident, "ledgerId", null), null),
+  });
+}
+
+function snapshotMcpReplayDeny(entry) {
+  if (!entry || typeof entry !== "object" || isProxy(entry)) {
+    const error = new TypeError("MCP replay deny entry is malformed");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const descriptors = Object.getOwnPropertyDescriptors(entry);
+  const fields = Object.keys(descriptors);
+  if (
+    fields.length !== MCP_REPLAY_DENY_FIELDS.size ||
+    fields.some((field) => !MCP_REPLAY_DENY_FIELDS.has(field)) ||
+    [...MCP_REPLAY_DENY_FIELDS].some(
+      (field) => !descriptors[field] || !("value" in descriptors[field]),
+    )
+  ) {
+    const error = new TypeError("MCP replay deny entry schema is invalid");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const snapshot = Object.freeze({
+    ledgerId: recoveryString(descriptors.ledgerId.value, null),
+    serverName: recoveryString(descriptors.serverName.value, null),
+    toolName: recoveryString(descriptors.toolName.value, null),
+    inputBytes: descriptors.inputBytes.value,
+    replayDigest: recoveryString(descriptors.replayDigest.value, null),
+  });
+  if (
+    !snapshot.ledgerId ||
+    !snapshot.serverName ||
+    !snapshot.toolName ||
+    !Number.isInteger(snapshot.inputBytes) ||
+    snapshot.inputBytes < 0 ||
+    !PAYLOAD_DIGEST.test(snapshot.replayDigest || "")
+  ) {
+    const error = new TypeError("MCP replay deny identity is invalid");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  return snapshot;
+}
+
+function strictMcpRecoverySnapshot(recovery) {
+  if (recovery == null) {
+    const error = new TypeError("MCP recovery projection is missing");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const admission = classifyMcpRecoveryAdmission(recovery);
+  if (admission.reasonCode) {
+    const error = new TypeError("MCP recovery projection is malformed");
+    error.code = admission.reasonCode;
+    throw error;
+  }
+
+  // classifyMcpRecoveryAdmission rejects proxies/accessors first. Capture the
+  // two authority arrays exactly once as own data descriptors so a formatter
+  // or time-varying getter can never turn an unsafe projection into clean state.
+  const descriptors = Object.getOwnPropertyDescriptors(recovery);
+  const unsettledSource = descriptors.unsettled?.value;
+  const incidentsSource = descriptors.incidents?.value;
+  const replayDeniedSource = descriptors.replayDenied?.value;
+  if (
+    !Array.isArray(unsettledSource) ||
+    !Array.isArray(incidentsSource) ||
+    !Array.isArray(replayDeniedSource)
+  ) {
+    const error = new TypeError("MCP recovery arrays are unavailable");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const unsettled = Object.freeze(unsettledSource.map(snapshotMcpRecord));
+  const incidents = Object.freeze(incidentsSource.map(snapshotMcpIncident));
+  const replayDenied = Object.freeze(
+    replayDeniedSource.map(snapshotMcpReplayDeny),
+  );
+  const headHash = recoveryString(
+    ownDataValue(recovery, "headHash", null),
+    null,
+  );
+  const recoveryDigest = recoveryString(
+    ownDataValue(recovery, "recoveryDigest", null),
+    null,
+  );
+  if (
+    (headHash != null && !RAW_AUTHORITY_HASH.test(headHash)) ||
+    (recoveryDigest != null && !PAYLOAD_DIGEST.test(recoveryDigest))
+  ) {
+    const error = new TypeError("MCP recovery authority digest is invalid");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  const remediation = recoveryString(
+    ownDataValue(recovery, "remediation", null),
+    null,
+  );
+  if (remediation !== null && !MCP_RECOVERY_REMEDIATIONS.has(remediation)) {
+    const error = new TypeError("MCP recovery remediation is invalid");
+    error.code = MCP_RECOVERY_INVALID_CODE;
+    throw error;
+  }
+  return Object.freeze({
+    admission,
+    unsettled,
+    incidents,
+    replayDenied,
+    headHash,
+    recoveryDigest,
+    remediation,
+  });
+}
+
+function failClosedMcpRecovery(
+  error,
+  fallbackCode = "CC_MCP_LEDGER_EVENT_READ_FAILED",
+) {
+  const code = recoveryErrorCode(error, fallbackCode);
+  const incident = Object.freeze({ code, ledgerId: null });
+  return Object.freeze({
+    count: 1,
+    unsettled: Object.freeze([]),
+    incidents: Object.freeze([incident]),
+    replayDenied: Object.freeze([]),
+    blockMode: "all",
+    headHash: null,
+    recoveryDigest: null,
+    remediation: "inspect_transcript",
+    notice:
+      "MCP recovery notice — the durable MCP ledger could not be verified. " +
+      "Do NOT automatically retry prior MCP actions; inspect the session " +
+      `transcript first (${code}).`,
+  });
+}
 
 /**
  * P0-2: on a bridge/IDE resume, surface any irreversible tool that was in flight
@@ -14,9 +304,9 @@ import { reconcileSideEffects } from "../../lib/side-effect-ledger.js";
  * + short key + reason, never argument values) plus a human-readable notice, or
  * null when nothing needs verification. PURE apart from reading the ledger.
  */
-function buildResumeRecovery(sessionId) {
+function buildSideEffectResumeRecovery(sessionId, loadLedger) {
   try {
-    const ledger = loadSideEffectLedger(sessionId);
+    const ledger = loadLedger(sessionId);
     const plan = reconcileSideEffects(ledger);
     if (!plan.inspect.length) return null;
     const items = plan.plans
@@ -40,12 +330,116 @@ function buildResumeRecovery(sessionId) {
             `  • [${it.kind}]${it.key ? ` (${it.key})` : ""} — ${it.reason}`,
         )
         .join("\n");
-    return { count: items.length, items, notice };
-  } catch {
-    return null;
+    return { count: items.length, items, incidents: [], notice };
+  } catch (error) {
+    const code = recoveryErrorCode(
+      error,
+      "CC_SIDE_EFFECT_LEDGER_RECOVERY_FAILED",
+    );
+    return {
+      count: 1,
+      items: [],
+      incidents: [{ code }],
+      notice:
+        "Side-effect recovery notice — the durable side-effect ledger could " +
+        "not be verified. Do NOT automatically retry prior irreversible " +
+        `operations until the transcript is inspected (${code}).`,
+    };
   }
 }
 
+function buildMcpResumeRecovery(sessionId, loadRecovery, formatNotice) {
+  try {
+    const snapshot = strictMcpRecoverySnapshot(loadRecovery(sessionId));
+    const unsettled = Object.freeze(
+      snapshot.unsettled.map((record) =>
+        Object.freeze({
+          ledgerId: record.ledgerId,
+          serverName: record.serverName,
+          toolName: record.toolName,
+          effect: record.effect,
+          status: "outcome_unknown",
+        }),
+      ),
+    );
+    const incidents = snapshot.incidents;
+    const requiresInspection =
+      unsettled.length > 0 ||
+      incidents.length > 0 ||
+      snapshot.replayDenied.length > 0 ||
+      snapshot.admission.blockMode != null;
+    let notice = null;
+    if (requiresInspection) {
+      const formatterProjection = Object.freeze({
+        unsettled: Object.freeze(
+          snapshot.unsettled.map((record) =>
+            Object.freeze({
+              ledgerId: record.ledgerId,
+              serverName: record.serverName,
+              toolName: record.toolName,
+              effectContract: Object.freeze({ effect: record.effect }),
+            }),
+          ),
+        ),
+        incidents,
+        replayDenied: snapshot.replayDenied,
+      });
+      notice = formatNotice(formatterProjection);
+      if (notice != null && typeof notice !== "string") {
+        const error = new TypeError(
+          "MCP recovery formatter must return a synchronous string or null",
+        );
+        error.code = MCP_RECOVERY_INVALID_CODE;
+        throw error;
+      }
+      notice ||=
+        "MCP recovery notice — durable MCP state requires inspection. Do NOT " +
+        "automatically retry prior MCP actions until recovery is adjudicated.";
+    }
+    return Object.freeze({
+      count: unsettled.length + incidents.length + snapshot.replayDenied.length,
+      unsettled,
+      incidents,
+      headHash: snapshot.headHash,
+      recoveryDigest: snapshot.recoveryDigest,
+      replayDenied: snapshot.replayDenied,
+      remediation: snapshot.remediation,
+      notice,
+      ...(snapshot.admission.blockMode
+        ? { blockMode: snapshot.admission.blockMode }
+        : {}),
+    });
+  } catch (error) {
+    return failClosedMcpRecovery(error);
+  }
+}
+
+/**
+ * Build the de-identified recovery payload shared by the IDE envelope and the
+ * resumed model. Dependencies are injectable so fail-closed recovery can be
+ * tested without touching a user's durable session directory.
+ */
+export function buildResumeRecovery(sessionId, dependencies = {}) {
+  const sideEffects = buildSideEffectResumeRecovery(
+    sessionId,
+    dependencies.loadSideEffectLedger || loadSideEffectLedger,
+  );
+  const mcp = buildMcpResumeRecovery(
+    sessionId,
+    dependencies.loadMcpLedgerRecovery || loadMcpLedgerRecovery,
+    dependencies.formatMcpLedgerRecoveryNotice || formatMcpLedgerRecoveryNotice,
+  );
+  if (!sideEffects && !mcp) return null;
+
+  return {
+    count: (sideEffects?.count || 0) + (mcp?.count || 0),
+    items: sideEffects?.items || [],
+    sideEffectIncidents: sideEffects?.incidents || [],
+    ...(mcp ? { mcp } : {}),
+    notice: [sideEffects?.notice, mcp?.notice].filter(Boolean).join("\n\n"),
+  };
+}
+
 // Build a unified envelope for a solicited WS response. The bridge correlates
 // by `requestId` (the inbound request's id) and unwraps `payload` for callers
 // so existing flat-shape consumers keep working unchanged.
@@ -57,10 +451,10 @@ function envelopeResponse(type, id, payload, sessionId) {
   });
 }
 
-function envelopeError(id, code, message, sessionId) {
+function envelopeError(id, code, message, sessionId, details = {}) {
   return createCodingAgentEvent(
     CODING_AGENT_EVENT_TYPES.ERROR,
-    { code, message },
+    { ...details, code, message },
     {
       requestId: id,
       sessionId: sessionId || null,
@@ -94,6 +488,18 @@ async function ensureSessionHandler(server, ws, session) {
   session.interaction = new WebSocketInteractionAdapter(ws, session.id, {
     enablePhase5Envelopes,
     envelopeBus: server.envelopeBus || null,
+    onPendingApprovalChange: ({ type, payload }) => {
+      if (
+        server.sessionManager &&
+        typeof server.sessionManager.recordSessionStateEvent === "function"
+      ) {
+        server.sessionManager.recordSessionStateEvent(
+          session.id,
+          type,
+          payload,
+        );
+      }
+    },
   });
 
   // Route MCP elicitation through the authenticated WS question channel. The
@@ -257,6 +663,20 @@ export async function handleSessionResume(server, id, ws, message) {
   }
 
   const { sessionId } = message;
+  const canonicalResume = readSessionHostResumeState(sessionId);
+  if (canonicalResume && !canonicalResume.snapshot.verified) {
+    server._send(
+      ws,
+      envelopeError(
+        id,
+        "CC_SESSION_HOST_SNAPSHOT_UNVERIFIED",
+        "Canonical JSONL session is not verified; resume was refused",
+        sessionId,
+        { sessionSnapshot: canonicalResume.snapshot },
+      ),
+    );
+    return;
+  }
   const session = server.sessionManager.resumeSession(sessionId);
 
   if (!session) {
@@ -272,28 +692,116 @@ export async function handleSessionResume(server, id, ws, message) {
     return;
   }
 
+  // A JSONL transcript is the cross-host fact source. A fully verified one
+  // replaces a stale DB/WS copy. The damaged case returned above before the
+  // manager or agent handler could be resumed; only a genuinely absent JSONL
+  // transcript keeps the legacy WS-store compatibility path.
+  const sessionSnapshot = canonicalResume?.snapshot || null;
+  if (canonicalResume) {
+    // Capture the fresh host-owned prefix exactly once. Canonical refreshes
+    // later in the WS handler must never rescan a message array that already
+    // contains a durable compact-summary system turn, or the summary would be
+    // mistaken for host context and duplicated after each claim/settlement.
+    let hostSystemPrefix;
+    try {
+      hostSystemPrefix = captureCanonicalHostSystemPrefix(session);
+    } catch {
+      server._send(
+        ws,
+        envelopeError(
+          id,
+          "CC_SESSION_HOST_PREFIX_INVALID",
+          "Canonical WS host system prefix is invalid; resume was refused",
+          sessionId,
+          { sessionSnapshot },
+        ),
+      );
+      return;
+    }
+    session.messages = [...hostSystemPrefix, ...canonicalResume.messages];
+    session.canonicalJsonlSession = true;
+    session.sessionHostSnapshot = sessionSnapshot;
+  } else {
+    session.canonicalJsonlSession = false;
+    session.sessionHostSnapshot = null;
+  }
+
+  // P0-2: reconcile the crash-safe side-effect ledger. If a dangerous tool was
+  // in flight when the prior worker died, warn the IDE client AND inject a
+  // system note so the resumed model does not silently replay it.
+  const recoveryDependencies = {
+    ...(server.resumeRecoveryDependencies || {}),
+  };
+  if (canonicalResume?.recovery) {
+    recoveryDependencies.loadMcpLedgerRecovery = () => canonicalResume.recovery;
+  }
+  let recovery = buildResumeRecovery(session.id, recoveryDependencies);
+  session.mcpLedgerRecovery = recovery?.mcp || {
+    count: 0,
+    unsettled: [],
+    incidents: [],
+    replayDenied: [],
+    notice: null,
+  };
+  session.mcpLedgerRecoveryRevision =
+    Number(session.mcpLedgerRecoveryRevision || 0) + 1;
+  replaceResumeRecoveryNotice(session, recovery?.notice || null);
+
+  // Recovery authority must be attached before a handler is created/refreshed
+  // or history is exposed. Otherwise an existing clean controller can admit a
+  // turn in the resume window before the unsafe projection reaches it.
   if (!server.sessionHandlers.has(sessionId)) {
     try {
       await ensureSessionHandler(server, ws, session);
     } catch (_err) {
-      // Session resumed without live handler.
+      // Session resumed without live handler. A future handler still reads the
+      // already-attached fail-closed recovery authority from the session.
+    }
+  }
+  const handler = server.sessionHandlers.get(sessionId);
+  if (typeof handler?.refreshMcpRecoveryRuntime === "function") {
+    try {
+      await handler.refreshMcpRecoveryRuntime();
+    } catch (error) {
+      const failedMcp = failClosedMcpRecovery(
+        error,
+        "CC_MCP_RECOVERY_REFRESH_FAILED",
+      );
+      session.mcpLedgerRecovery = failedMcp;
+      session.mcpLedgerRecoveryRevision =
+        Number(session.mcpLedgerRecoveryRevision || 0) + 1;
+      recovery = Object.freeze({
+        ...recovery,
+        count:
+          Math.max(
+            0,
+            Number(recovery?.count || 0) - Number(recovery?.mcp?.count || 0),
+          ) + failedMcp.count,
+        mcp: failedMcp,
+        notice: [recovery?.notice, failedMcp.notice]
+          .filter(Boolean)
+          .join("\n\n"),
+      });
+      replaceResumeRecoveryNotice(session, recovery.notice);
     }
   }
 
-  const history = (session.messages || []).filter((m) => m.role !== "system");
+  const history = (
+    Array.isArray(session.messages) ? session.messages : []
+  ).filter((m) => m?.role !== "system");
   const record = createSessionRecord(session, {
     history,
     messageCount: history.length,
     status: "resumed",
   });
-
-  // P0-2: reconcile the crash-safe side-effect ledger. If a dangerous tool was
-  // in flight when the prior worker died, warn the IDE client AND inject a
-  // system note so the resumed model does not silently replay it.
-  const recovery = buildResumeRecovery(session.id);
-  if (recovery && Array.isArray(session.messages)) {
-    session.messages.push({ role: "system", content: recovery.notice });
-  }
+  // Runtime-bus subscribers receive control-plane continuity metadata, not
+  // transcript content. The direct resume response below still carries the
+  // requested history to the authenticated IDE client.
+  const runtimeRecord = { ...record, history: [] };
+  const stateSnapshot =
+    typeof server.sessionManager.getSessionStateSnapshot === "function"
+      ? server.sessionManager.getSessionStateSnapshot(session.id)
+      : null;
 
   server.emit(
     RUNTIME_EVENTS.SESSION_RESUME,
@@ -303,8 +811,10 @@ export async function handleSessionResume(server, id, ws, message) {
         sessionId: session.id,
         historyCount: history.length,
         sessionType: session.type || null,
-        record,
+        record: runtimeRecord,
+        ...(stateSnapshot ? { stateSnapshot } : {}),
         ...(recovery ? { recovery } : {}),
+        ...(sessionSnapshot ? { sessionSnapshot } : {}),
       },
       { kind: "server", sessionId: session.id },
     ),
@@ -319,7 +829,9 @@ export async function handleSessionResume(server, id, ws, message) {
         sessionId: session.id,
         history,
         record,
+        ...(stateSnapshot ? { stateSnapshot } : {}),
         ...(recovery ? { recovery } : {}),
+        ...(sessionSnapshot ? { sessionSnapshot } : {}),
       },
       session.id,
     ),
@@ -546,15 +1058,31 @@ export async function handleSessionInterrupt(server, id, ws, message) {
   }
 
   const handler = server.sessionHandlers.get(sessionId);
-  const result =
-    handler && typeof handler.interrupt === "function"
-      ? await handler.interrupt()
-      : {
-          sessionId,
-          interrupted: true,
-          wasProcessing: false,
-          interruptedRequestId: null,
-        };
+  const handlerCanInterrupt =
+    handler && typeof handler.interrupt === "function";
+  const result = handlerCanInterrupt
+    ? await handler.interrupt()
+    : {
+        sessionId,
+        interrupted: true,
+        wasProcessing: false,
+        interruptedRequestId: null,
+      };
+
+  if (
+    !handlerCanInterrupt &&
+    typeof server.sessionManager.recordSessionStateEvent === "function"
+  ) {
+    server.sessionManager.recordSessionStateEvent(
+      sessionId,
+      "run.interrupted",
+      {
+        requestId: result.interruptedRequestId,
+        interruptedAt: new Date().toISOString(),
+        reason: "client_interrupt",
+      },
+    );
+  }
 
   server._send(
     ws,