n8n 2.43.3 → 2.44.0

package/dist/modules/agents/agent-execution-orchestrator.service.js

@@ -19,6 +19,7 @@ const external_hooks_1 = require("../../external-hooks");
 const telemetry_1 = require("../../telemetry");
 const agent_execution_service_1 = require("./agent-execution.service");
 const agent_chat_execution_service_1 = require("./agent-chat-execution.service");
+const agent_n8n_chat_unavailable_error_1 = require("./agent-n8n-chat-unavailable.error");
 const agent_memory_scope_1 = require("./utils/agent-memory-scope");
 const agent_thread_access_1 = require("./utils/agent-thread-access");
 const agent_run_tracing_service_1 = require("./agent-run-tracing.service");
@@ -26,6 +27,7 @@ const agent_runtime_cache_service_1 = require("./agent-runtime-cache.service");
 const agent_sandbox_principal_1 = require("./agent-sandbox-principal");
 const agent_sandbox_runtime_service_1 = require("./agent-sandbox-runtime.service");
 const agents_settings_service_1 = require("./agents-settings.service");
+const agent_skill_refs_service_1 = require("./agent-skill-refs.service");
 const agent_telemetry_1 = require("./agent-telemetry");
 const agent_turn_execution_service_1 = require("./agent-turn-execution.service");
 const budget_guardrail_1 = require("./budget-guardrail");
@@ -43,7 +45,7 @@ const agent_published_snapshot_1 = require("./utils/agent-published-snapshot");
 const inbound_attachments_1 = require("./utils/inbound-attachments");
 const execution_to_message_mapper_1 = require("./utils/execution-to-message-mapper");
 let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService {
-    constructor(logger, n8nCheckpointStorage, agentExecutionService, turnExecutionService, telemetry, runtimeCacheService, integrationMessageContextService, agentRunTracingService, externalHooks, agentSandboxRuntimeService, agentRepository, aiConfig, chatExecutionService, backgroundJobRepository, backgroundJobService, settingsService) {
+    constructor(logger, n8nCheckpointStorage, agentExecutionService, turnExecutionService, telemetry, runtimeCacheService, integrationMessageContextService, agentRunTracingService, externalHooks, agentSandboxRuntimeService, agentRepository, aiConfig, chatExecutionService, backgroundJobRepository, backgroundJobService, settingsService, agentSkillRefs) {
         this.logger = logger;
         this.n8nCheckpointStorage = n8nCheckpointStorage;
         this.agentExecutionService = agentExecutionService;
@@ -60,6 +62,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         this.backgroundJobRepository = backgroundJobRepository;
         this.backgroundJobService = backgroundJobService;
         this.settingsService = settingsService;
+        this.agentSkillRefs = agentSkillRefs;
     }
     async getSessionMode(threadId) {
         return await this.agentExecutionService.getSessionMode(threadId);
@@ -79,9 +82,8 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
     }
     async loadResumeCheckpoint(config) {
         const memoryScope = await this.loadResumeMemory(config);
-        const access = await this.resolveResumeAccess(config, memoryScope);
-        const sandboxPrincipalHash = this.validateResumeSandbox(config, memoryScope);
-        return { memoryScope, sandboxPrincipalHash, access };
+        const { scope, sandboxPrincipalHash } = await this.resolveResumeScope(config, memoryScope);
+        return { memoryScope, sandboxPrincipalHash, scope };
     }
     async loadResumeMemory({ agentId, runId, expectedMemory }) {
         const checkpointStatus = await this.n8nCheckpointStorage.getStatus(runId, agentId);
@@ -106,61 +108,87 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         }
         return memoryScope;
     }
-    async resolveResumeAccess({ agentId, projectId, runId, user, usePublishedVersion, previewChat, source }, memoryScope) {
-        const isPreview = !usePublishedVersion && !(0, agent_memory_scope_1.isTaskRunMemoryResourceId)(memoryScope.resourceId);
-        const isProductionChat = source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE;
-        let access = { accessScope: 'project', ownerId: null };
-        if (isPreview || isProductionChat) {
-            if (!user ||
-                memoryScope.resourceId !==
-                    (isPreview
-                        ? (0, agent_memory_scope_1.draftChatMemoryResourceId)(user.id)
-                        : (0, agent_memory_scope_1.productionChatMemoryResourceId)(user.id)) ||
-                (isPreview
-                    ? !(await this.agentExecutionService.canUseDraftThread(memoryScope.threadId, projectId, agentId, user.id, { previewChat, sessionMode: 'existing' }))
-                    : !(await this.agentExecutionService.canUseProductionChatThread(memoryScope.threadId, projectId, agentId, user.id, 'existing')))) {
-                throw new n8n_workflow_1.UserError(`Checkpoint ${runId} does not belong to this chat`);
-            }
-            access = { accessScope: 'user', ownerId: user.id };
+    async resolveResumeScope(config, memoryScope) {
+        const { agentId, projectId, runId, user, usePublishedVersion, chatSurface } = config;
+        const notThisChat = () => new n8n_workflow_1.UserError(`Checkpoint ${runId} does not belong to this chat`);
+        const isDraft = !usePublishedVersion && !(0, agent_memory_scope_1.isTaskRunMemoryResourceId)(memoryScope.resourceId);
+        if (isDraft || chatSurface === 'n8n-chat') {
+            if (!user)
+                throw notThisChat();
+            const thread = {
+                agentId,
+                projectId,
+                threadId: memoryScope.threadId,
+                resourceId: memoryScope.resourceId,
+                sessionMode: 'existing',
+                denied: notThisChat,
+            };
+            const setup = isDraft
+                ? await this.preparePreviewChat({
+                    ...thread,
+                    user,
+                    previewChat: chatSurface === 'preview',
+                })
+                : await this.prepareN8nChat({
+                    ...thread,
+                    userId: user.id,
+                    skipPublishedCheck: true,
+                });
+            const sandboxPrincipalHash = this.checkResumeSandbox(config, memoryScope, {
+                always: setup.alwaysSandboxed,
+                owner: { principalHash: setup.sandboxPrincipalHash },
+            });
+            return { scope: setup, sandboxPrincipalHash };
         }
-        else {
-            const thread = await this.agentExecutionService.findThreadById(memoryScope.threadId);
-            if ((0, agent_memory_scope_1.userIdFromDraftChatMemoryResourceId)(memoryScope.resourceId) ||
-                (0, agent_memory_scope_1.userIdFromProductionChatMemoryResourceId)(memoryScope.resourceId) ||
-                !thread ||
-                thread.projectId !== projectId ||
-                thread.agentId !== agentId ||
-                thread.accessScope !== 'project') {
-                throw new n8n_workflow_1.UserError(`Checkpoint ${runId} does not belong to this chat`);
-            }
+        const thread = await this.agentExecutionService.findThreadById(memoryScope.threadId);
+        if ((0, agent_memory_scope_1.userIdFromDraftChatMemoryResourceId)(memoryScope.resourceId) ||
+            (0, agent_memory_scope_1.userIdFromProductionChatMemoryResourceId)(memoryScope.resourceId) ||
+            !thread ||
+            thread.projectId !== projectId ||
+            thread.agentId !== agentId ||
+            thread.accessScope !== 'project') {
+            throw notThisChat();
         }
-        return access;
+        const owner = usePublishedVersion ? undefined : user;
+        const sandboxPrincipalHash = this.checkResumeSandbox(config, memoryScope, {
+            always: false,
+            owner: usePublishedVersion
+                ? undefined
+                : {
+                    principalHash: owner
+                        ? (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: owner.id })
+                        : undefined,
+                },
+        });
+        return {
+            scope: { access: { accessScope: 'project', ownerId: null }, runtime: { user: owner } },
+            sandboxPrincipalHash,
+        };
     }
-    validateResumeSandbox({ projectId, runId, user, usePublishedVersion, source }, memoryScope) {
+    checkResumeSandbox({ projectId, runId }, memoryScope, rule) {
         const sandboxScope = (0, agent_sandbox_principal_1.decodeAgentSandboxHostMetadata)(memoryScope.hostMetadata);
         const sandboxPrincipalHash = sandboxScope?.principalHash;
-        if ((this.agentSandboxRuntimeService.isEnabled() || source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE) &&
+        if ((this.agentSandboxRuntimeService.isEnabled() || rule.always) &&
             (!sandboxScope ||
                 sandboxScope.projectId !== projectId ||
                 !sandboxPrincipalHash ||
-                ((!usePublishedVersion || source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE) &&
-                    (!user ||
-                        sandboxPrincipalHash !==
-                            (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: user.id }))))) {
+                (rule.owner !== undefined &&
+                    (!rule.owner.principalHash || sandboxPrincipalHash !== rule.owner.principalHash)))) {
             throw new n8n_workflow_1.UserError(`Checkpoint ${runId} is unavailable and cannot be resumed`);
         }
         return sandboxPrincipalHash;
     }
     async *resumeForChat(config) {
-        if (await this.resumeBackgroundForChat(config))
-            return;
         const resume = { ...config, usePublishedVersion: config.usePublishedVersion ?? true };
-        if (resume.source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE &&
+        if (resume.chatSurface === 'n8n-chat' &&
             !(await this.agentRepository.isN8nChatPublished(resume.agentId, resume.projectId))) {
-            throw new n8n_workflow_1.UserError('This agent is not available in n8n Chat');
+            throw new agent_n8n_chat_unavailable_error_1.AgentN8nChatUnavailableError();
         }
+        if (await this.resumeBackgroundForChat(resume))
+            return;
         const checkpoint = await this.loadResumeCheckpoint(resume);
-        yield* this.withRuntimeLease(async () => await this.getResumeRuntime(resume, checkpoint), (runtime) => this.resumeRuntimeTurn(resume, checkpoint, runtime));
+        const run = { ...resume, source: resume.source ?? checkpoint.scope.source };
+        yield* this.withRuntimeLease(async () => await this.getResumeRuntime(run, checkpoint), (runtime) => this.resumeRuntimeTurn(run, checkpoint, runtime));
     }
     async resumeBackgroundForChat(config) {
         if (!config.runId.startsWith(sub_agent_background_state_1.BACKGROUND_APPROVAL_RUN_PREFIX))
@@ -191,9 +219,8 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                 config.expectedMemory.resourceId !== memoryScope.resourceId)) {
             throw new n8n_workflow_1.UserError('This background approval does not belong to this chat');
         }
-        await this.resolveResumeAccess(resume, memoryScope);
-        this.validateResumeSandbox(resume, memoryScope);
-        if (resume.usePublishedVersion) {
+        const { scope } = await this.resolveResumeScope(resume, memoryScope);
+        if (resume.chatSurface === undefined && resume.usePublishedVersion) {
             const expected = approval.metadata.messageContext;
             const actual = config.messageContext;
             const destination = expected?.replyTarget ?? expected?.target;
@@ -209,25 +236,41 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         const { SubAgentBackgroundRunner } = await import('./background/sub-agent-background-runner.js');
         const { AgentsCredentialProvider } = await import('./adapters/agents-credential-provider.js');
         const { CredentialsService } = await import('../../credentials/credentials.service.js');
+        const credentialUser = scope.runtime.user;
         await di_1.Container.get(SubAgentBackgroundRunner).resume(job, { token: config.toolCallId, resumeData: config.resumeData }, {
             projectId: config.projectId,
             parentAgentId: job.parentAgentId,
-            credentialProvider: new AgentsCredentialProvider(di_1.Container.get(CredentialsService), config.projectId, config.user, job.subAgentId ?? undefined),
+            credentialProvider: new AgentsCredentialProvider(di_1.Container.get(CredentialsService), config.projectId, credentialUser, job.subAgentId ?? undefined),
             runType: resume.usePublishedVersion ? 'production' : 'test',
             workflowToolExecutionMode: resume.usePublishedVersion ? 'integrated' : 'manual',
-            user: config.user,
+            user: credentialUser,
         });
         return true;
     }
     async deliverBackgroundApproval(config, title, approval) {
         if (config.identity.type === 'draft') {
-            await this.assertDraftChatAccess({
-                ...config,
+            await this.preparePreviewChat({
+                agentId: config.agentId,
+                projectId: config.projectId,
+                threadId: config.memory.threadId,
+                resourceId: config.memory.resourceId,
                 user: config.identity.user,
                 sessionMode: 'existing',
             });
             return;
         }
+        const productionUserId = (0, agent_memory_scope_1.userIdFromProductionChatMemoryResourceId)(config.memory.resourceId);
+        if (productionUserId) {
+            await this.prepareN8nChat({
+                agentId: config.agentId,
+                projectId: config.projectId,
+                threadId: config.memory.threadId,
+                resourceId: config.memory.resourceId,
+                userId: productionUserId,
+                sessionMode: 'existing',
+            });
+            return;
+        }
         const delivery = await this.getWakeDelivery(config.agentId, config.identity.integrationType, approval.metadata.messageContext);
         await delivery.bridge.deliverBackgroundApproval(delivery.threadId, {
             jobId: approval.metadata.jobId,
@@ -245,14 +288,18 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         });
     }
     async *executeForChat(config) {
-        const draft = { ...config, sessionMode: config.sessionMode ?? 'new' };
-        const sandboxPrincipalHash = (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({
-            type: 'n8n-user',
-            userId: config.user.id,
+        const sessionMode = config.sessionMode ?? 'new';
+        const setup = await this.preparePreviewChat({
+            agentId: config.agentId,
+            projectId: config.projectId,
+            threadId: config.memory.threadId,
+            resourceId: config.memory.resourceId,
+            user: config.user,
+            previewChat: config.previewChat,
+            sessionMode,
         });
-        await this.assertDraftChatAccess(draft);
-        const access = { accessScope: 'user', ownerId: config.user.id };
-        yield* this.withRuntimeLease(async () => await this.getDraftChatRuntime(draft, access, sandboxPrincipalHash), async (runtime) => await this.streamDraftChatResponse(draft, runtime, access, sandboxPrincipalHash));
+        const draft = { ...config, sessionMode };
+        yield* this.withRuntimeLease(async () => await this.getDraftChatRuntime(draft, setup), async (runtime) => await this.streamDraftChatResponse(draft, runtime, setup));
     }
     async *executeForChatPublished(config) {
         const { agentId, projectId, message, modelMessage, author, memory, integrationType, attachments, sandboxPrincipalHash, sessionMode = 'new', } = config;
@@ -315,30 +362,29 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
     }
     async *executeForN8nChatPublished(config) {
         const { agentId, projectId, message, memory, attachments, user, abortSignal, sessionMode = 'new', } = config;
-        if (!(await this.agentRepository.isN8nChatPublished(agentId, projectId))) {
-            throw new n8n_workflow_1.UserError('This agent is not available in n8n Chat');
-        }
-        if (memory.resourceId !== (0, agent_memory_scope_1.productionChatMemoryResourceId)(user.id) ||
-            !(await this.agentExecutionService.canUseProductionChatThread(memory.threadId, projectId, agentId, user.id, sessionMode))) {
-            throw new n8n_workflow_1.UserError('Session not found');
-        }
-        const sandboxPrincipalHash = (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: user.id });
+        const setup = await this.prepareN8nChat({
+            agentId,
+            projectId,
+            threadId: memory.threadId,
+            resourceId: memory.resourceId,
+            userId: user.id,
+            sessionMode,
+        });
         await this.externalHooks.run('agent.preExecute', [agentId]);
         yield* this.withRuntimeLease(async () => await this.getRuntimeOrRecordFailure({
             agentId,
             projectId,
-            integrationType: api_types_1.N8N_CHAT_INTEGRATION_TYPE,
-            usePublishedVersion: true,
-            sandboxPrincipalHash,
-            allowBackgroundTasks: false,
-            attributionUserId: user.id,
+            integrationType: setup.runtime.integrationType,
+            usePublishedVersion: setup.runtime.usePublishedVersion,
+            sandboxPrincipalHash: setup.sandboxPrincipalHash,
+            attributionUserId: setup.runtime.attributionUserId,
         }, {
             threadId: memory.threadId,
             resourceId: memory.resourceId,
             userMessage: message,
             attachments,
-            source: agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE,
-            access: { accessScope: 'user', ownerId: user.id },
+            source: setup.source,
+            access: setup.access,
             sessionMode,
             abortSignal,
             admittedExecution: config.admittedExecution,
@@ -346,7 +392,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             const messageContext = this.createN8nChatMessageContext(memory, user.id);
             return this.streamChatResponse({
                 admittedExecution: config.admittedExecution,
-                access: { accessScope: 'user', ownerId: user.id },
+                access: setup.access,
                 messageContext,
                 onAdmitted: async () => await this.integrationMessageContextService.setLatest(memory.threadId, memory.resourceId, messageContext),
                 agentInstance: runtime.agent,
@@ -359,10 +405,10 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                 memory,
                 attachments,
                 userId: user.id,
-                productionN8nChat: true,
-                source: agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE,
+                chatSurface: setup.surface,
+                source: setup.source,
                 telemetry: { runType: 'production', configuration: runtime.telemetryConfiguration },
-                sandboxPrincipalHash,
+                sandboxPrincipalHash: setup.sandboxPrincipalHash,
                 sessionMode,
                 abortSignal,
                 onExecutionStarted: config.onExecutionStarted,
@@ -454,31 +500,47 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         const productionUserId = isDraft
             ? undefined
             : (0, agent_memory_scope_1.userIdFromProductionChatMemoryResourceId)(memory.resourceId);
-        if (productionUserId &&
-            (isDraft ||
-                identity.integrationType !== api_types_1.N8N_CHAT_INTEGRATION_TYPE ||
+        let setup;
+        if (productionUserId && !isDraft) {
+            if (identity.integrationType !== api_types_1.N8N_CHAT_INTEGRATION_TYPE ||
                 identity.principalHash !==
-                    (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: productionUserId }) ||
-                !(await this.agentRepository.isN8nChatPublished(agentId, config.projectId)) ||
-                !(await this.agentExecutionService.canUseProductionChatThread(memory.threadId, config.projectId, agentId, productionUserId, 'existing'))))
-            return;
-        const access = isDraft
-            ? { accessScope: 'user', ownerId: identity.user.id }
-            : productionUserId
-                ? { accessScope: 'user', ownerId: productionUserId }
-                : { accessScope: 'project', ownerId: null };
+                    (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: productionUserId })) {
+                throw new n8n_workflow_1.OperationalError('Production n8n Chat wake identity is no longer valid');
+            }
+            try {
+                setup = await this.prepareN8nChat({
+                    agentId,
+                    projectId: config.projectId,
+                    threadId: memory.threadId,
+                    resourceId: memory.resourceId,
+                    userId: productionUserId,
+                    sessionMode: 'existing',
+                });
+            }
+            catch {
+                throw new n8n_workflow_1.OperationalError('Production n8n Chat wake identity is no longer valid');
+            }
+        }
         if (isDraft) {
-            await this.assertDraftChatAccess({ ...config, user: identity.user, sessionMode: 'existing' });
+            setup = await this.preparePreviewChat({
+                agentId,
+                projectId: config.projectId,
+                threadId: memory.threadId,
+                resourceId: memory.resourceId,
+                user: identity.user,
+                sessionMode: 'existing',
+            });
         }
         else {
             await this.externalHooks.run('agent.preExecute', [agentId]);
         }
+        const access = setup?.access ?? { accessScope: 'project', ownerId: null };
         const integrationType = isDraft ? api_types_1.N8N_CHAT_INTEGRATION_TYPE : identity.integrationType;
         const messageContext = await this.integrationMessageContextService.getLatest(memory.threadId);
-        const delivery = isDraft || productionUserId
+        const delivery = setup
             ? undefined
             : await this.getWakeDelivery(agentId, integrationType, messageContext);
-        const stream = this.withRuntimeLease(async () => await this.getWakeRuntime(config, access, integrationType, productionUserId), (runtime) => this.streamWakeResponse(this.streamWakeTurn(config, runtime, access, integrationType, messageContext, productionUserId), abortSignal, delivery, messageContext?.interactingUserId));
+        const stream = this.withRuntimeLease(async () => await this.getWakeRuntime(config, setup, access, integrationType), (runtime) => this.streamWakeResponse(this.streamWakeTurn(config, runtime, setup, access, integrationType, messageContext), abortSignal, delivery, messageContext?.interactingUserId));
         for await (const _chunk of stream) {
         }
     }
@@ -536,8 +598,8 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             },
             backgroundJobSignal: config.backgroundJobSignal,
             onExecutionRecorded: config.onExecutionRecorded,
-            previewChat: config.previewChat,
-            productionN8nChat: config.source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE,
+            chatSurface: config.chatSurface,
+            isWakeRun: config.isWakeRun,
             onExecutionStarted: config.onExecutionStarted,
             onSettled: config.isWakeRun
                 ? undefined
@@ -576,21 +638,22 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             abortSignal?.throwIfAborted();
             const { agentId, projectId } = params;
             let agent;
+            let selected;
             try {
                 agent = await this.agentRepository.findByIdAndProjectId(agentId, projectId);
+                if (agent) {
+                    selected = await (0, agent_published_snapshot_1.resolveAgentRunSource)(agent, params.usePublishedVersion === true && Boolean(agent.activeVersion?.schema), this.agentSkillRefs, {});
+                }
             }
             catch (cause) {
                 throw new agent_execution_recording_error_1.AgentExecutionRecordingError({ phase: 'create', cause, executionError: error });
             }
             abortSignal?.throwIfAborted();
-            if (agent) {
-                const selected = params.usePublishedVersion && agent.activeVersion?.schema
-                    ? (0, agent_published_snapshot_1.getPublishedAgentSnapshot)(agent)
-                    : agent;
+            if (agent && selected) {
                 const failed = {
                     ...recording,
                     agentId,
-                    agentName: selected.schema?.name ?? agent.name,
+                    agentName: selected.agent.schema?.name ?? agent.name,
                     projectId,
                     telemetry: {
                         userId: params.attributionUserId ?? params.user?.id,
@@ -612,16 +675,16 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         }
     }
     async getResumeRuntime(config, checkpoint) {
-        const { agentId, projectId, runId, source, integrationType, user, usePublishedVersion, onExecutionRecorded, abortSignal, previewChat, } = config;
-        const { memoryScope, sandboxPrincipalHash, access } = checkpoint;
+        const { agentId, projectId, runId, source, integrationType, usePublishedVersion, onExecutionRecorded, abortSignal, chatSurface, } = config;
+        const previewChat = chatSurface === 'preview';
+        const { memoryScope, sandboxPrincipalHash, scope } = checkpoint;
         return await this.getRuntimeOrRecordFailure({
             agentId,
             projectId,
             usePublishedVersion,
             integrationType,
-            user: usePublishedVersion ? undefined : user,
-            attributionUserId: source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE ? user?.id : undefined,
-            allowBackgroundTasks: source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE ? false : undefined,
+            user: scope.runtime.user,
+            attributionUserId: scope.runtime.attributionUserId,
             ...(sandboxPrincipalHash ? { sandboxPrincipalHash } : {}),
             previewChat,
         }, {
@@ -632,7 +695,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             source,
             onExecutionRecorded,
             abortSignal,
-            access,
+            access: scope.access,
             automaticContinuationRunId: previewChat && config.automaticPreviewContinuation ? runId : undefined,
             sessionMode: 'existing',
         });
@@ -644,8 +707,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             toolRegistry: runtime.toolRegistry,
             mcpServerAttributions: runtime.mcpServerAttributions,
             context: { projectId: config.projectId, agentId: config.agentId, threadId },
-            previewChat: config.previewChat,
-            productionN8nChat: config.source === agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE,
+            chatSurface: config.chatSurface,
             automaticPreviewContinuation: config.automaticPreviewContinuation,
             onExecutionStarted: config.onExecutionStarted,
             onExecutionRecorded: config.onExecutionRecorded,
@@ -663,11 +725,11 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         return {
             type: 'resume',
             resumeData: config.resumeData,
-            options: (0, budget_guardrail_1.withBudgetGuardrail)(this.createResumeOptions(config, memoryScope, messageContext, tracing), {
+            options: (0, budget_guardrail_1.withBudgetGuardrail)(this.createResumeOptions(config, memoryScope, messageContext, executionSource, tracing), {
                 budget: runtime.budget,
                 sessionId: memoryScope.threadId,
                 agentId: config.agentId,
-                ...(config.previewChat && config.onBudgetNotice
+                ...(config.chatSurface === 'preview' && config.onBudgetNotice
                     ? { onNotice: config.onBudgetNotice }
                     : {}),
             }),
@@ -676,7 +738,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
     }
     async getResumeTracing(config, threadId, runtime) {
         const { agentId, projectId, source, user } = config;
-        const suspendedExecution = this.agentRunTracingService.enabled && source === undefined
+        const suspendedExecution = source === undefined
             ? await this.agentExecutionService.findLatestSuspendedRun(threadId)
             : undefined;
         const executionSource = source ?? suspendedExecution?.source ?? undefined;
@@ -690,7 +752,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         });
         return { executionSource, tracing };
     }
-    createResumeOptions(config, memoryScope, selectedContext, tracing) {
+    createResumeOptions(config, memoryScope, selectedContext, source, tracing) {
         const { runId, toolCallId, agentId, user, usePublishedVersion, abortSignal } = config;
         const runType = usePublishedVersion ? 'production' : 'test';
         const conversation = config.contextConversation;
@@ -707,18 +769,19 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                 agentId,
                 userId: user?.id,
                 runType,
+                source,
             }),
             ...(0, model_stream_stall_options_1.modelStreamStallOptions)(this.aiConfig),
             ...(tracing ? { telemetry: tracing } : {}),
             ...(abortSignal ? { abortSignal } : {}),
         };
     }
-    createResumeRecording(config, { memoryScope, access }, runtime, executionSource) {
+    createResumeRecording(config, { memoryScope, scope }, runtime, executionSource) {
         const { agentId, projectId, user, usePublishedVersion } = config;
         const threadId = memoryScope.threadId;
         const runType = usePublishedVersion ? 'production' : 'test';
         return {
-            access,
+            access: scope.access,
             threadId,
             agentId,
             agentName: runtime.agent.name,
@@ -744,25 +807,68 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
         }
         return messageContext;
     }
-    async assertDraftChatAccess({ agentId, projectId, memory, user, previewChat, sessionMode, }) {
-        if (memory.resourceId !== (0, agent_memory_scope_1.draftChatMemoryResourceId)(user.id) ||
-            !(await this.agentExecutionService.canUseDraftThread(memory.threadId, projectId, agentId, user.id, { previewChat, sessionMode }))) {
-            throw new n8n_workflow_1.UserError('Session not found');
+    async preparePreviewChat(params) {
+        const { agentId, projectId, threadId, resourceId, user, previewChat, sessionMode, denied } = params;
+        const fail = denied ?? (() => new n8n_workflow_1.UserError('Session not found'));
+        if (resourceId !== (0, agent_thread_access_1.chatSurfaceMemoryResourceId)('preview', user.id) ||
+            !(await this.agentExecutionService.canUseDraftThread(threadId, projectId, agentId, user.id, {
+                previewChat,
+                sessionMode,
+            }))) {
+            throw fail();
         }
+        return {
+            surface: previewChat ? 'preview' : undefined,
+            access: { accessScope: 'user', ownerId: user.id },
+            sandboxPrincipalHash: (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId: user.id }),
+            alwaysSandboxed: false,
+            runtime: {
+                usePublishedVersion: false,
+                integrationType: api_types_1.N8N_CHAT_INTEGRATION_TYPE,
+                user,
+                previewChat,
+            },
+        };
+    }
+    async prepareN8nChat(params) {
+        const { agentId, projectId, threadId, resourceId, userId, sessionMode, skipPublishedCheck, denied, } = params;
+        if (!skipPublishedCheck &&
+            !(await this.agentRepository.isN8nChatPublished(agentId, projectId))) {
+            throw new agent_n8n_chat_unavailable_error_1.AgentN8nChatUnavailableError();
+        }
+        const fail = denied ?? (() => new n8n_workflow_1.UserError('Session not found'));
+        if (resourceId !== (0, agent_thread_access_1.chatSurfaceMemoryResourceId)('n8n-chat', userId)) {
+            throw fail();
+        }
+        if (!(await this.agentExecutionService.canUseProductionChatThread(threadId, projectId, agentId, userId, sessionMode))) {
+            throw fail();
+        }
+        return {
+            surface: 'n8n-chat',
+            access: { accessScope: 'user', ownerId: userId },
+            sandboxPrincipalHash: (0, agent_sandbox_principal_1.hashAgentSandboxPrincipal)({ type: 'n8n-user', userId }),
+            alwaysSandboxed: true,
+            source: agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE,
+            runtime: {
+                usePublishedVersion: true,
+                integrationType: api_types_1.N8N_CHAT_INTEGRATION_TYPE,
+                attributionUserId: userId,
+            },
+        };
     }
-    async getDraftChatRuntime(config, access, sandboxPrincipalHash) {
-        const { agentId, projectId, user, previewChat, memory, message, attachments, source, onExecutionRecorded, abortSignal, sessionMode, } = config;
+    async getDraftChatRuntime(config, setup) {
+        const { agentId, projectId, memory, message, attachments, source, onExecutionRecorded, abortSignal, sessionMode, } = config;
         return await this.getRuntimeOrRecordFailure({
             agentId,
             projectId,
-            integrationType: api_types_1.N8N_CHAT_INTEGRATION_TYPE,
-            user,
-            sandboxPrincipalHash,
-            previewChat,
+            integrationType: setup.runtime.integrationType,
+            user: setup.runtime.user,
+            sandboxPrincipalHash: setup.sandboxPrincipalHash,
+            previewChat: setup.runtime.previewChat,
         }, {
             threadId: memory.threadId,
             resourceId: memory.resourceId,
-            access,
+            access: setup.access,
             admittedExecution: config.admittedExecution,
             userMessage: message,
             attachments,
@@ -772,13 +878,13 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             sessionMode,
         });
     }
-    async streamDraftChatResponse(config, runtime, access, sandboxPrincipalHash) {
-        const { agentId, user, message, attachments, memory, source, onExecutionRecorded, abortSignal, previewChat, sessionMode, } = config;
+    async streamDraftChatResponse(config, runtime, setup) {
+        const { agentId, user, memory, message, attachments, source, onExecutionRecorded, abortSignal, sessionMode, } = config;
         const messageContext = this.createN8nChatMessageContext(memory, user.id);
         return this.streamChatResponse({
             admittedExecution: config.admittedExecution,
             onAdmitted: async () => await this.integrationMessageContextService.setLatest(memory.threadId, memory.resourceId, messageContext),
-            access,
+            access: setup.access,
             messageContext,
             agentInstance: runtime.agent,
             toolRegistry: runtime.toolRegistry,
@@ -794,10 +900,10 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             telemetry: { runType: 'test', configuration: runtime.telemetryConfiguration },
             onExecutionRecorded,
             abortSignal,
-            previewChat,
+            chatSurface: setup.surface,
             onBudgetNotice: config.onBudgetNotice,
             onExecutionStarted: config.onExecutionStarted,
-            sandboxPrincipalHash,
+            sandboxPrincipalHash: setup.sandboxPrincipalHash,
             sessionMode,
         });
     }
@@ -833,7 +939,9 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                 principalHash: sandboxPrincipalHash,
             }),
             ...(0, integration_message_context_1.encodeIntegrationMessageContext)(messageContext),
-            ...(config.previewChat && !config.isWakeRun && !config.hideUserMessageFromTranscript
+            ...(config.chatSurface !== undefined &&
+                !config.isWakeRun &&
+                !config.hideUserMessageFromTranscript
                 ? { [sub_agent_background_state_1.BACKGROUND_PAUSE_USER_TURN_KEY]: true }
                 : {}),
         };
@@ -861,6 +969,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                     agentId,
                     userId,
                     runType: telemetry.runType,
+                    source,
                 }),
                 ...(0, model_stream_stall_options_1.modelStreamStallOptions)(this.aiConfig),
                 ...(tracing ? { telemetry: tracing } : {}),
@@ -869,7 +978,7 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
                 budget: config.budget,
                 sessionId: threadId,
                 agentId,
-                ...(config.previewChat && config.onBudgetNotice
+                ...(config.chatSurface === 'preview' && config.onBudgetNotice
                     ? { onNotice: config.onBudgetNotice }
                     : {}),
             }),
@@ -903,18 +1012,17 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             telemetry: { ...telemetry, userId },
         };
     }
-    async getWakeRuntime(config, access, integrationType, productionUserId) {
+    async getWakeRuntime(config, setup, access, integrationType) {
         const { agentId, projectId, memory, identity, abortSignal } = config;
-        const isDraft = identity.type === 'draft';
         return await this.getRuntimeOrRecordFailure({
             agentId,
             projectId,
             integrationType,
-            usePublishedVersion: !isDraft,
-            ...(productionUserId
-                ? { attributionUserId: productionUserId, allowBackgroundTasks: false }
+            usePublishedVersion: identity.type !== 'draft',
+            ...(setup?.runtime.attributionUserId
+                ? { attributionUserId: setup.runtime.attributionUserId }
                 : {}),
-            ...(isDraft ? { user: identity.user } : {}),
+            ...(setup?.runtime.user ? { user: setup.runtime.user } : {}),
             sandboxPrincipalHash: identity.principalHash,
         }, {
             threadId: memory.threadId,
@@ -922,15 +1030,14 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             userMessage: config.message,
             hideUserMessageFromTranscript: true,
             isWakeRun: true,
-            source: productionUserId ? agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE : integrationType,
+            source: setup?.source ?? integrationType,
             abortSignal,
             access,
             sessionMode: 'existing',
         });
     }
-    streamWakeTurn(config, runtime, access, integrationType, messageContext, productionUserId) {
+    streamWakeTurn(config, runtime, setup, access, integrationType, messageContext) {
         const { agentId, message, memory, identity, abortSignal } = config;
-        const isDraft = identity.type === 'draft';
         return this.streamChatResponse({
             access,
             messageContext,
@@ -939,17 +1046,14 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
             mcpServerAttributions: runtime.mcpServerAttributions,
             budget: runtime.budget,
             agentId,
-            ...(isDraft
-                ? { userId: identity.user.id }
-                : productionUserId
-                    ? { userId: productionUserId }
-                    : {}),
+            ...(access.ownerId ? { userId: access.ownerId } : {}),
             message,
             memory,
             projectId: runtime.projectId,
-            source: productionUserId ? agent_thread_access_1.N8N_CHAT_PRODUCTION_SOURCE : integrationType,
+            source: setup?.source ?? integrationType,
+            chatSurface: setup?.surface,
             telemetry: {
-                runType: isDraft ? 'test' : 'production',
+                runType: identity.type === 'draft' ? 'test' : 'production',
                 configuration: runtime.telemetryConfiguration,
             },
             abortSignal,
@@ -965,6 +1069,6 @@ let AgentExecutionOrchestratorService = class AgentExecutionOrchestratorService
 exports.AgentExecutionOrchestratorService = AgentExecutionOrchestratorService;
 exports.AgentExecutionOrchestratorService = AgentExecutionOrchestratorService = __decorate([
     (0, di_1.Service)(),
-    __metadata("design:paramtypes", [backend_common_1.Logger, n8n_checkpoint_storage_1.N8NCheckpointStorage, agent_execution_service_1.AgentExecutionService, agent_turn_execution_service_1.AgentTurnExecutionService, telemetry_1.Telemetry, agent_runtime_cache_service_1.AgentRuntimeCacheService, integration_message_context_service_1.IntegrationMessageContextService, agent_run_tracing_service_1.AgentRunTracingService, external_hooks_1.ExternalHooks, agent_sandbox_runtime_service_1.AgentSandboxRuntimeService, agent_repository_1.AgentRepository, config_1.AiConfig, agent_chat_execution_service_1.AgentChatExecutionService, agent_background_job_repository_1.AgentBackgroundJobRepository, agent_background_job_service_1.AgentBackgroundJobService, agents_settings_service_1.AgentsSettingsService])
+    __metadata("design:paramtypes", [backend_common_1.Logger, n8n_checkpoint_storage_1.N8NCheckpointStorage, agent_execution_service_1.AgentExecutionService, agent_turn_execution_service_1.AgentTurnExecutionService, telemetry_1.Telemetry, agent_runtime_cache_service_1.AgentRuntimeCacheService, integration_message_context_service_1.IntegrationMessageContextService, agent_run_tracing_service_1.AgentRunTracingService, external_hooks_1.ExternalHooks, agent_sandbox_runtime_service_1.AgentSandboxRuntimeService, agent_repository_1.AgentRepository, config_1.AiConfig, agent_chat_execution_service_1.AgentChatExecutionService, agent_background_job_repository_1.AgentBackgroundJobRepository, agent_background_job_service_1.AgentBackgroundJobService, agents_settings_service_1.AgentsSettingsService, agent_skill_refs_service_1.AgentSkillRefsService])
 ], AgentExecutionOrchestratorService);
 //# sourceMappingURL=agent-execution-orchestrator.service.js.map