n8n 2.26.3 → 2.27.0

package/dist/modules/instance-ai/instance-ai.service.js

@@ -60,13 +60,16 @@ const instance_ai_gateway_service_1 = require("./instance-ai-gateway.service");
 const instance_ai_memory_service_1 = require("./instance-ai-memory.service");
 const instance_ai_settings_service_1 = require("./instance-ai-settings.service");
 const instance_ai_adapter_service_1 = require("./instance-ai.adapter.service");
+const output_redaction_config_1 = require("./output-redaction-config");
 const internal_messages_1 = require("./internal-messages");
 const liveness_1 = require("./liveness");
 const mcp_1 = require("./mcp");
 const instance_ai_pending_confirmation_repository_1 = require("./repositories/instance-ai-pending-confirmation.repository");
 const instance_ai_thread_repository_1 = require("./repositories/instance-ai-thread.repository");
+const sandbox_1 = require("./sandbox");
+const suspended_run_restorer_service_1 = require("./suspended-run-restorer.service");
+const suspended_thread_persistence_service_1 = require("./suspended-thread-persistence.service");
 const run_trace_metadata_1 = require("./run-trace-metadata");
-const sandbox_provider_1 = require("./sandbox-provider");
 const db_iteration_log_storage_1 = require("./storage/db-iteration-log-storage");
 const db_snapshot_storage_1 = require("./storage/db-snapshot-storage");
 const typeorm_agent_checkpoint_store_1 = require("./storage/typeorm-agent-checkpoint-store");
@@ -83,6 +86,7 @@ const ai_service_1 = require("../../services/ai.service");
 const proxy_token_manager_1 = require("../../services/proxy-token-manager");
 const url_service_1 = require("../../services/url.service");
 const telemetry_1 = require("../../telemetry");
+const backend_network_1 = require("@n8n/backend-network");
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -103,66 +107,6 @@ function isTextMessagePart(part) {
         typeof part.text === 'string');
 }
 const ORCHESTRATOR_AGENT_ID = 'agent-001';
-const SANDBOX_NAME_MAX_LEN = 63;
-const SANDBOX_LABEL_MAX_LEN = 63;
-const NAME_PREFIX_SLUG_MAX_LEN = 24;
-const DEFAULT_SANDBOX_TTL_MS = 15 * 60 * 1000;
-function slugifySandboxName(value, maxLen) {
-    const slug = value
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '');
-    return slug.slice(0, maxLen).replace(/-+$/, '');
-}
-function slugifySandboxLabel(value, maxLen) {
-    return value
-        .replace(/[^A-Za-z0-9_.-]+/g, '-')
-        .replace(/^[-.]+|[-.]+$/g, '')
-        .slice(0, maxLen)
-        .replace(/[-.]+$/, '');
-}
-function getThreadScopedSandboxName(threadId) {
-    return `instance-ai-thread-${threadId}`;
-}
-function buildThreadScopedSandboxName(threadId, namePrefix) {
-    const parts = [];
-    if (namePrefix) {
-        const prefixSlug = slugifySandboxName(namePrefix, NAME_PREFIX_SLUG_MAX_LEN);
-        if (prefixSlug)
-            parts.push(prefixSlug);
-    }
-    const threadSlug = slugifySandboxName(getThreadScopedSandboxName(threadId), SANDBOX_NAME_MAX_LEN);
-    if (threadSlug)
-        parts.push(threadSlug);
-    const name = slugifySandboxName(parts.join('-'), SANDBOX_NAME_MAX_LEN);
-    if (!name)
-        throw new n8n_workflow_1.UnexpectedError('Failed to build thread-scoped sandbox name');
-    return name;
-}
-function buildThreadScopedSandboxLabels(threadId, namePrefix) {
-    const baseName = getThreadScopedSandboxName(threadId);
-    const labels = {
-        'n8n-builder': slugifySandboxLabel(baseName, SANDBOX_LABEL_MAX_LEN),
-        thread_id: slugifySandboxLabel(threadId, SANDBOX_LABEL_MAX_LEN),
-    };
-    if (namePrefix)
-        labels.name_prefix = slugifySandboxLabel(namePrefix, SANDBOX_LABEL_MAX_LEN);
-    return labels;
-}
-function withThreadScopedSandboxIdentity(config, threadId) {
-    if (!config.enabled || config.provider !== 'daytona')
-        return config;
-    const name = buildThreadScopedSandboxName(threadId, config.namePrefix);
-    return {
-        ...config,
-        id: name,
-        name,
-        labels: {
-            ...buildThreadScopedSandboxLabels(threadId, config.namePrefix),
-            ...config.labels,
-        },
-    };
-}
 function getUserFacingErrorMessage(error) {
     if (error instanceof n8n_workflow_1.UserError) {
         return error.message;
@@ -357,8 +301,6 @@ let InstanceAiService = class InstanceAiService {
         this.runState = new instance_ai_1.RunStateRegistry();
         this.backgroundTasks = new instance_ai_1.BackgroundTaskManager(MAX_CONCURRENT_BACKGROUND_TASKS_PER_THREAD);
         this.traceContextsByRunId = new Map();
-        this.sandboxes = new Map();
-        this.sandboxCreations = new Map();
         this.domainAccessTrackersByThread = new Map();
         this.threadPushRef = new Map();
         this.planRequestsByThread = new Map();
@@ -375,6 +317,23 @@ let InstanceAiService = class InstanceAiService {
         this.workflowObligations = new workflow_verification_obligation_service_1.WorkflowVerificationObligationService(this.agentMemory);
         this.taskProjector = new workflow_verification_task_projector_1.WorkflowVerificationTaskProjector(this.agentMemory, this.eventBus, this.logger, this.workflowObligations);
         this.instanceAiConfig = globalConfig.instanceAi;
+        this.suspendedThreads = new suspended_thread_persistence_service_1.SuspendedThreadPersistenceService({
+            logger: this.logger,
+            config: this.instanceAiConfig,
+            pendingConfirmationRepo: this.pendingConfirmationRepo,
+            agentMemory: this.agentMemory,
+        });
+        this.suspendedRunRestorer = new suspended_run_restorer_service_1.SuspendedRunRestorer({
+            logger: this.logger,
+            pendingConfirmationRepo: this.pendingConfirmationRepo,
+            runState: this.runState,
+            dbSnapshotStorage: this.dbSnapshotStorage,
+            eventBus: this.eventBus,
+            rebuilder: {
+                rebuildSuspendedRun: this.rebuildSuspendedRunFromCheckpoint.bind(this),
+                resumeSuspendedRun: this.resumeSuspendedRun.bind(this),
+            },
+        });
         const livenessPolicyConfig = (0, instance_ai_1.createInstanceAiLivenessPolicyConfig)({
             confirmationTimeoutMs: this.instanceAiConfig.confirmationTimeout,
         });
@@ -389,9 +348,18 @@ let InstanceAiService = class InstanceAiService {
                 void this.finalizeCancelledSuspendedRun(suspended, reason);
             },
             onPendingConfirmationRejected: (requestId) => {
-                void this.dropPendingConfirmation(requestId);
+                void this.suspendedThreads.dropPendingConfirmation(requestId);
             },
         });
+        this.sandboxService = new sandbox_1.InstanceAiSandboxService({
+            config: this.instanceAiConfig,
+            logger: this.logger,
+            errorReporter: this.errorReporter,
+            runState: this.runState,
+            backgroundTasks: this.backgroundTasks,
+            settingsService: this.settingsService,
+            aiService: this.aiService,
+        });
         this.defaultTimeZone = globalConfig.generic.timezone;
         const restEndpoint = globalConfig.endpoints.rest;
         this.oauth2CallbackUrl = `${this.urlService.getInstanceBaseUrl()}/${restEndpoint}/oauth2-credential/callback`;
@@ -414,216 +382,6 @@ let InstanceAiService = class InstanceAiService {
         if (this.instanceSettings.isLeader)
             this.startCheckpointPruning();
     }
-    getSandboxConfigFromEnv() {
-        const { sandboxEnabled, sandboxProvider, daytonaApiUrl, daytonaApiKey, n8nSandboxServiceUrl, n8nSandboxServiceApiKey, sandboxImage, sandboxTimeout, sandboxNamePrefix, daytonaTokenRefreshSkewMs, } = this.instanceAiConfig;
-        const provider = (0, sandbox_provider_1.normalizeSandboxProvider)(sandboxProvider);
-        if (!sandboxEnabled) {
-            return {
-                enabled: false,
-                provider,
-                timeout: sandboxTimeout,
-            };
-        }
-        if (provider === 'daytona') {
-            return {
-                enabled: true,
-                provider: 'daytona',
-                daytonaApiUrl: daytonaApiUrl || undefined,
-                daytonaApiKey: daytonaApiKey || undefined,
-                image: sandboxImage || undefined,
-                n8nVersion: constants_1.N8N_VERSION || undefined,
-                timeout: sandboxTimeout,
-                namePrefix: sandboxNamePrefix || undefined,
-                refreshSkewMs: daytonaTokenRefreshSkewMs,
-            };
-        }
-        return {
-            enabled: true,
-            provider: 'n8n-sandbox',
-            serviceUrl: (0, sandbox_provider_1.requireN8nSandboxServiceUrl)(n8nSandboxServiceUrl),
-            apiKey: n8nSandboxServiceApiKey || undefined,
-            timeout: sandboxTimeout,
-        };
-    }
-    async resolveSandboxConfig(user) {
-        const base = this.getSandboxConfigFromEnv();
-        if (!base.enabled)
-            return base;
-        if (base.provider === 'daytona') {
-            if (this.aiService.isProxyEnabled()) {
-                const client = await this.aiService.getClient();
-                const proxyConfig = await client.getSandboxProxyConfig();
-                return {
-                    ...base,
-                    daytonaApiUrl: client.getSandboxProxyBaseUrl(),
-                    image: proxyConfig.image,
-                    logger: this.logger,
-                    getAuthToken: async () => {
-                        const token = await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
-                        return token.accessToken;
-                    },
-                };
-            }
-            const daytona = await this.settingsService.resolveDaytonaConfig(user);
-            return {
-                ...base,
-                daytonaApiUrl: daytona.apiUrl ?? base.daytonaApiUrl,
-                daytonaApiKey: daytona.apiKey ?? base.daytonaApiKey,
-            };
-        }
-        const sandbox = await this.settingsService.resolveN8nSandboxConfig(user);
-        return {
-            ...base,
-            serviceUrl: sandbox.serviceUrl ?? base.serviceUrl,
-            apiKey: sandbox.apiKey ?? base.apiKey,
-        };
-    }
-    async getOrCreateWorkspaceEntry(threadId, user) {
-        const existing = this.sandboxes.get(threadId);
-        if (existing) {
-            if (this.isSandboxEntryExpired(existing) && !this.isSandboxInUse(threadId)) {
-                this.evictSandboxEntry(threadId, existing);
-            }
-            else {
-                this.touchSandboxEntry(threadId, existing);
-                return existing;
-            }
-        }
-        const pending = this.sandboxCreations.get(threadId);
-        if (pending)
-            return await pending;
-        const creation = this.createWorkspaceEntry(threadId, user);
-        this.sandboxCreations.set(threadId, creation);
-        try {
-            return await creation;
-        }
-        finally {
-            this.sandboxCreations.delete(threadId);
-        }
-    }
-    async getOrCreateWorkspace(threadId, user, context) {
-        const entry = await this.getOrCreateWorkspaceEntry(threadId, user);
-        if (entry)
-            await this.ensureWorkspaceSetup(entry, context);
-        return entry;
-    }
-    async ensureWorkspaceSetup(entry, context) {
-        if (entry.setupComplete)
-            return;
-        entry.setupPromise ??= (0, instance_ai_1.setupSandboxWorkspace)(entry.workspace, context)
-            .then(() => {
-            entry.setupComplete = true;
-        })
-            .finally(() => {
-            entry.setupPromise = undefined;
-        });
-        await entry.setupPromise;
-    }
-    async createWorkspaceEntry(threadId, user) {
-        const config = withThreadScopedSandboxIdentity(await this.resolveSandboxConfig(user), threadId);
-        if (!config.enabled)
-            return undefined;
-        const sandbox = await (0, instance_ai_1.createSandbox)(config, {
-            logger: this.logger,
-            errorReporter: this.errorReporter,
-            useSnapshotFallback: true,
-        });
-        const workspace = (0, instance_ai_1.createWorkspace)(sandbox);
-        if (!sandbox || !workspace)
-            return undefined;
-        try {
-            await workspace.init();
-        }
-        catch (error) {
-            try {
-                await workspace.destroy();
-            }
-            catch {
-            }
-            throw error;
-        }
-        const entry = {
-            sandbox,
-            workspace,
-            setupComplete: false,
-            setupPromise: undefined,
-            expiresAt: this.nextSandboxExpiry(),
-        };
-        this.sandboxes.set(threadId, entry);
-        this.scheduleSandboxExpiry(threadId, entry);
-        return entry;
-    }
-    evictSandboxEntry(threadId, entry) {
-        if (this.sandboxes.get(threadId) !== entry)
-            return;
-        this.sandboxes.delete(threadId);
-        if (entry.cleanupTimer) {
-            clearTimeout(entry.cleanupTimer);
-            entry.cleanupTimer = undefined;
-        }
-    }
-    async destroySandbox(threadId, reason = 'thread_cleanup') {
-        const entry = this.sandboxes.get(threadId);
-        if (!entry?.sandbox)
-            return;
-        this.evictSandboxEntry(threadId, entry);
-        try {
-            await entry.workspace?.destroy();
-        }
-        catch (error) {
-            this.logger.warn('Failed to destroy sandbox', {
-                threadId,
-                reason,
-                error: error instanceof Error ? error.message : String(error),
-            });
-        }
-    }
-    get sandboxTtlMs() {
-        return this.instanceAiConfig?.builderSandboxTtlMs ?? DEFAULT_SANDBOX_TTL_MS;
-    }
-    nextSandboxExpiry() {
-        return Date.now() + this.sandboxTtlMs;
-    }
-    isSandboxEntryExpired(entry) {
-        return this.sandboxTtlMs > 0 && entry.expiresAt <= Date.now();
-    }
-    touchSandboxEntry(threadId, entry) {
-        if (this.sandboxTtlMs <= 0)
-            return;
-        entry.expiresAt = this.nextSandboxExpiry();
-        this.scheduleSandboxExpiry(threadId, entry);
-    }
-    isSandboxInUse(threadId) {
-        return Boolean(this.runState.getActiveRunId(threadId) ||
-            this.runState.hasSuspendedRun(threadId) ||
-            this.backgroundTasks.getRunningTasks(threadId).length > 0);
-    }
-    scheduleSandboxExpiry(threadId, entry) {
-        if (this.sandboxTtlMs <= 0)
-            return;
-        if (entry.cleanupTimer)
-            clearTimeout(entry.cleanupTimer);
-        const delay = Math.max(0, entry.expiresAt - Date.now());
-        entry.cleanupTimer = setTimeout(() => {
-            const current = this.sandboxes.get(threadId);
-            if (current !== entry)
-                return;
-            if (this.isSandboxInUse(threadId)) {
-                this.touchSandboxEntry(threadId, entry);
-                return;
-            }
-            this.evictSandboxEntry(threadId, entry);
-        }, delay);
-        entry.cleanupTimer.unref();
-    }
-    stopSandboxExpiryTimers() {
-        for (const entry of this.sandboxes.values()) {
-            if (!entry.cleanupTimer)
-                continue;
-            clearTimeout(entry.cleanupTimer);
-            entry.cleanupTimer = undefined;
-        }
-    }
     async getProxyAuth(user) {
         const client = await this.aiService.getClient();
         const token = await client.getBuilderApiProxyToken({ id: user.id }, { userMessageId: (0, nanoid_1.nanoid)() });
@@ -1103,7 +861,7 @@ let InstanceAiService = class InstanceAiService {
             if (reason === liveness_1.INSTANCE_AI_RUN_TIMEOUT_REASON)
                 this.liveness.markRunTimedOut(active.runId);
             active.abortController.abort();
-            void this.dropPendingConfirmationsForThread(threadId);
+            void this.suspendedThreads.dropPendingConfirmationsForThread(threadId);
             return;
         }
         if (suspended) {
@@ -1112,7 +870,7 @@ let InstanceAiService = class InstanceAiService {
             suspended.abortController.abort();
             void this.finalizeCancelledSuspendedRun(suspended, reason);
         }
-        void this.dropPendingConfirmationsForThread(threadId);
+        void this.suspendedThreads.dropPendingConfirmationsForThread(threadId);
     }
     sendCorrectionToTask(threadId, taskId, correction) {
         return this.backgroundTasks.queueCorrection(threadId, taskId, correction);
@@ -1299,9 +1057,9 @@ let InstanceAiService = class InstanceAiService {
         this.threadPushRef.delete(threadId);
         this.planRequestsByThread.delete(threadId);
         this.deleteTraceContextsForThread(threadId);
-        await this.destroySandbox(threadId);
+        await this.sandboxService.destroySandbox(threadId);
         await this.reapAiTemporaryForThreadCleanup(threadId);
-        await this.dropPendingConfirmationsForThread(threadId);
+        await this.suspendedThreads.dropPendingConfirmationsForThread(threadId);
         this.eventBus.clearThread(threadId);
     }
     async shutdown() {
@@ -1348,7 +1106,7 @@ let InstanceAiService = class InstanceAiService {
             });
         }
         this.gatewayService.disconnectAll();
-        this.stopSandboxExpiryTimers();
+        this.sandboxService.stopSandboxExpiryTimers();
         this.domainAccessTrackersByThread.clear();
         this.traceContextsByRunId.clear();
         this.eventBus.clear();
@@ -1393,7 +1151,7 @@ let InstanceAiService = class InstanceAiService {
         const entry = this.userMessagePersistenceByRun.get(runId);
         if (!entry)
             return;
-        const ok = await this.persistUserMessageOnSuspend(threadId, entry.userId, entry.message);
+        const ok = await this.suspendedThreads.persistUserMessageOnSuspend(threadId, entry.userId, entry.message);
         if (ok)
             this.userMessagePersistenceByRun.delete(runId);
     }
@@ -1422,7 +1180,7 @@ let InstanceAiService = class InstanceAiService {
             else {
                 this.logger.debug('No stale Instance AI checkpoints to expire');
             }
-            await this.pruneStalePendingConfirmations(now);
+            await this.suspendedThreads.pruneStalePendingConfirmations(now);
             await this.pruneExpiredThreads();
             this.scheduleCheckpointPrune();
         }
@@ -1443,96 +1201,6 @@ let InstanceAiService = class InstanceAiService {
             });
         }
     }
-    async pruneStalePendingConfirmations(now) {
-        try {
-            const count = await this.pendingConfirmationRepo.deleteExpired(new Date(now));
-            if (count === 0) {
-                this.logger.debug('No stale Instance AI pending confirmations to drop');
-                return;
-            }
-            this.logger.info('Dropped stale Instance AI pending confirmations', { count });
-        }
-        catch (error) {
-            this.logger.warn('Failed to drop stale Instance AI pending confirmations', {
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    computePendingConfirmationExpiresAt() {
-        const timeoutMs = this.instanceAiConfig.confirmationTimeout;
-        return timeoutMs > 0 ? new Date(Date.now() + timeoutMs) : null;
-    }
-    async persistPendingConfirmation(params) {
-        try {
-            await this.pendingConfirmationRepo.save(this.pendingConfirmationRepo.create({
-                requestId: params.requestId,
-                threadId: params.threadId,
-                userId: params.userId,
-                kind: params.kind,
-                runId: params.runId,
-                messageGroupId: params.messageGroupId ?? null,
-                toolCallId: params.toolCallId ?? null,
-                checkpointKey: params.checkpointKey ?? null,
-                checkpointTaskId: params.checkpointTaskId ?? null,
-                expiresAt: this.computePendingConfirmationExpiresAt(),
-            }));
-        }
-        catch (error) {
-            this.logger.warn('Failed to persist pending confirmation', {
-                requestId: params.requestId,
-                threadId: params.threadId,
-                kind: params.kind,
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    async dropPendingConfirmation(requestId) {
-        try {
-            await this.pendingConfirmationRepo.deleteByRequestId(requestId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to drop pending confirmation', {
-                requestId,
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    async dropPendingConfirmationsForThread(threadId) {
-        try {
-            await this.pendingConfirmationRepo.deleteByThreadId(threadId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to drop pending confirmations for thread', {
-                threadId,
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    async persistUserMessageOnSuspend(threadId, userId, message) {
-        try {
-            await this.agentMemory.saveMessages({
-                threadId,
-                resourceId: userId,
-                messages: [
-                    {
-                        id: message.id,
-                        role: 'user',
-                        content: [{ type: 'text', text: message.text }],
-                        createdAt: new Date(),
-                    },
-                ],
-            });
-            return true;
-        }
-        catch (error) {
-            this.logger.warn('Failed to persist user message on HITL suspend', {
-                threadId,
-                userId,
-                error: getErrorMessage(error),
-            });
-            return false;
-        }
-    }
     async persistShutdownSnapshot(threadId, runId, messageGroupId) {
         try {
             await this.saveAgentTreeSnapshot(threadId, runId, this.dbSnapshotStorage, true, messageGroupId);
@@ -1739,7 +1407,7 @@ let InstanceAiService = class InstanceAiService {
     }
     async finishInvalidConfirmationRun(args) {
         this.runState.cancelThread(args.threadId);
-        void this.dropPendingConfirmationsForThread(args.threadId);
+        void this.suspendedThreads.dropPendingConfirmationsForThread(args.threadId);
         args.abortController.abort();
         await this.finalizeRunTracing(args.runId, args.tracing, {
             status: 'error',
@@ -2090,19 +1758,21 @@ let InstanceAiService = class InstanceAiService {
         let workspaceRoot;
         const sandboxStatus = this.settingsService.getSandboxStatus();
         if (sandboxStatus.workflowBuilderAvailable) {
-            const sandboxConfig = await this.resolveSandboxConfig(user);
+            const sandboxConfig = await this.sandboxService.resolveSandboxConfig(user);
             if (sandboxConfig.enabled) {
                 workspaceRoot = (0, instance_ai_1.getPromptWorkspaceRoot)(sandboxConfig.provider);
                 let sandboxEntryPromise;
                 const getSandboxEntry = async () => {
-                    sandboxEntryPromise ??= this.getOrCreateWorkspaceEntry(threadId, user).catch((error) => {
+                    sandboxEntryPromise ??= this.sandboxService
+                        .getOrCreateWorkspaceEntry(threadId, user)
+                        .catch((error) => {
                         sandboxEntryPromise = undefined;
                         throw error;
                     });
                     return await sandboxEntryPromise;
                 };
                 const getSetupSandboxEntry = async () => {
-                    return await this.getOrCreateWorkspace(threadId, user, context);
+                    return await this.sandboxService.getOrCreateWorkspace(threadId, user, context);
                 };
                 const scopeWorkspaceForAgent = async (workspace) => {
                     if (!workspace)
@@ -2137,6 +1807,7 @@ let InstanceAiService = class InstanceAiService {
             subAgentMaxSteps: this.instanceAiConfig.subAgentMaxSteps,
             eventBus: this.eventBus,
             logger: this.logger,
+            outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
             trackTelemetry: (eventName, properties) => {
                 this.telemetry.track(eventName, properties);
             },
@@ -2160,7 +1831,7 @@ let InstanceAiService = class InstanceAiService {
                         userId: user.id,
                         createdAt: Date.now(),
                     });
-                    void this.persistPendingConfirmation({
+                    void this.suspendedThreads.persistPendingConfirmation({
                         requestId,
                         threadId,
                         userId: user.id,
@@ -2877,6 +2548,7 @@ let InstanceAiService = class InstanceAiService {
                         eventBus: this.eventBus,
                         logger: this.logger,
                         onActivity: () => this.runState.touchActiveRun(threadId),
+                        outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
                 : await (0, instance_ai_1.streamAgentRun)(agent, streamInput, {
@@ -2897,6 +2569,7 @@ let InstanceAiService = class InstanceAiService {
                     eventBus: this.eventBus,
                     logger: this.logger,
                     onActivity: () => this.runState.touchActiveRun(threadId),
+                    outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                 });
             if (result.status === 'suspended') {
                 if (result.suspension) {
@@ -2916,7 +2589,7 @@ let InstanceAiService = class InstanceAiService {
                         checkpoint,
                         plannedBuild,
                     });
-                    void this.persistPendingConfirmation({
+                    void this.suspendedThreads.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
                         threadId,
                         userId: user.id,
@@ -3294,7 +2967,7 @@ let InstanceAiService = class InstanceAiService {
             return false;
         }
         if (this.runState.resolvePendingConfirmation(freshUser.id, requestId, data)) {
-            void this.dropPendingConfirmation(requestId);
+            void this.suspendedThreads.dropPendingConfirmation(requestId);
             this.logger.debug('Resolved pending confirmation (sub-agent HITL)', {
                 requestId,
                 approved: data.approved,
@@ -3308,95 +2981,7 @@ let InstanceAiService = class InstanceAiService {
         if (await this.resumeSuspendedRun(requestingUserId, requestId, data)) {
             return true;
         }
-        return await this.resolveOrphanedConfirmation(requestingUserId, requestId, data);
-    }
-    async resolveOrphanedConfirmation(userId, requestId, data) {
-        let orphan;
-        try {
-            orphan = await this.pendingConfirmationRepo.claim(requestId, userId);
-        }
-        catch (error) {
-            this.logger.warn('Failed to claim orphaned pending confirmation', {
-                requestId,
-                error: getErrorMessage(error),
-            });
-            return false;
-        }
-        if (!orphan)
-            return false;
-        this.logger.info('Reclaiming pending confirmation orphaned by a process restart', {
-            requestId,
-            threadId: orphan.threadId,
-            runId: orphan.runId,
-            kind: orphan.kind,
-            hasCheckpoint: Boolean(orphan.checkpointKey),
-        });
-        if (orphan.kind === 'suspended' && this.canResumeOrphan(orphan)) {
-            const resumed = await this.tryResumeFromOrphan(orphan, data);
-            if (resumed)
-                return true;
-        }
-        this.finalizeUnresumableOrphan(orphan);
-        throw new n8n_workflow_1.UserError('This confirmation was lost when the assistant restarted. Send a new message to continue.');
-    }
-    canResumeOrphan(orphan) {
-        return Boolean(orphan.toolCallId && orphan.checkpointKey);
-    }
-    finalizeUnresumableOrphan(orphan) {
-        try {
-            this.publishRunFinish(orphan.threadId, orphan.runId, 'cancelled', 'restart_lost_confirmation');
-            void this.dbSnapshotStorage
-                .markRunCancelled(orphan.threadId, orphan.runId)
-                .catch((error) => {
-                this.logger.warn('Failed to mark orphan snapshot as cancelled', {
-                    requestId: orphan.requestId,
-                    threadId: orphan.threadId,
-                    runId: orphan.runId,
-                    error: getErrorMessage(error),
-                });
-            });
-        }
-        catch (error) {
-            this.logger.warn('Failed to finalize orphaned confirmation snapshot', {
-                requestId: orphan.requestId,
-                error: getErrorMessage(error),
-            });
-        }
-    }
-    async tryResumeFromOrphan(orphan, data) {
-        const outcome = await this.rebuildSuspendedRunFromCheckpoint(orphan);
-        switch (outcome.kind) {
-            case 'ready':
-                this.runState.suspendRun(orphan.threadId, outcome.state);
-                return await this.resumeSuspendedRun(orphan.userId, orphan.requestId, data);
-            case 'no-user':
-                this.logger.warn('Cannot resume orphaned run: user no longer authorized', {
-                    requestId: orphan.requestId,
-                    userId: orphan.userId,
-                });
-                return false;
-            case 'no-checkpoint':
-                this.logger.warn('Cannot resume orphaned run: checkpoint missing or unavailable', {
-                    requestId: orphan.requestId,
-                    checkpointKey: orphan.checkpointKey,
-                    ...(outcome.error ? { error: getErrorMessage(outcome.error) } : {}),
-                });
-                return false;
-            case 'env-failure':
-                this.logger.warn('Cannot resume orphaned run: failed to build execution environment', {
-                    requestId: orphan.requestId,
-                    threadId: orphan.threadId,
-                    error: getErrorMessage(outcome.error),
-                });
-                return false;
-            case 'agent-failure':
-                this.logger.warn('Cannot resume orphaned run: failed to build agent', {
-                    requestId: orphan.requestId,
-                    threadId: orphan.threadId,
-                    error: getErrorMessage(outcome.error),
-                });
-                return false;
-        }
+        return await this.suspendedRunRestorer.resolveOrphanedConfirmation(requestingUserId, requestId, data);
     }
     async rebuildSuspendedRunFromCheckpoint(orphan) {
         const user = await this.revalidateActiveUser(orphan.userId);
@@ -3499,7 +3084,7 @@ let InstanceAiService = class InstanceAiService {
             return false;
         }
         this.runState.activateSuspendedRun(threadId);
-        void this.dropPendingConfirmation(requestId);
+        void this.suspendedThreads.dropPendingConfirmation(requestId);
         const credentialsPayload = data.nodeCredentials ?? data.credentials;
         const resumeData = {
             approved: data.approved,
@@ -3589,6 +3174,7 @@ let InstanceAiService = class InstanceAiService {
                         logger: this.logger,
                         agentRunId: opts.agentRunId,
                         onActivity: () => this.runState.touchActiveRun(opts.threadId),
+                        outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                     });
                 })
                 : await (0, instance_ai_1.resumeAgentRun)(agent, resumeData, {
@@ -3604,6 +3190,7 @@ let InstanceAiService = class InstanceAiService {
                     logger: this.logger,
                     agentRunId: opts.agentRunId,
                     onActivity: () => this.runState.touchActiveRun(opts.threadId),
+                    outputRedaction: (0, output_redaction_config_1.resolveOutputRedaction)(this.instanceAiConfig),
                 });
             if (result.status === 'suspended') {
                 if (result.suspension) {
@@ -3624,7 +3211,7 @@ let InstanceAiService = class InstanceAiService {
                         checkpoint: opts.checkpoint,
                         plannedBuild: opts.plannedBuild,
                     });
-                    void this.persistPendingConfirmation({
+                    void this.suspendedThreads.persistPendingConfirmation({
                         requestId: result.suspension.requestId,
                         threadId: opts.threadId,
                         userId: opts.user.id,
@@ -4120,7 +3707,7 @@ let InstanceAiService = class InstanceAiService {
                 ...(runTimeout ? { runTimeout } : {}),
             }),
         });
-        void this.dropPendingConfirmation(suspended.requestId);
+        void this.suspendedThreads.dropPendingConfirmation(suspended.requestId);
     }
     async reapAiTemporaryForThreadCleanup(threadId) {
         let markedWorkflows;
@@ -4402,7 +3989,7 @@ exports.InstanceAiService = InstanceAiService = __decorate([
         db_1.AiBuilderTemporaryWorkflowRepository,
         n8n_core_1.ErrorReporter,
         config_1.SsrfProtectionConfig,
-        n8n_core_1.SsrfProtectionService,
+        backend_network_1.SsrfProtectionService,
         event_service_1.EventService])
 ], InstanceAiService);
 //# sourceMappingURL=instance-ai.service.js.map