negotium 0.19.2 → 0.20.0

package/dist/runtime/src/mcp/session-comm/server.ts

@@ -21,6 +21,7 @@ import {
   isTopicBrowserProfileOwner,
   listBrowserProfiles,
 } from "#storage/browser-profiles";
+import { deleteRemoteSessionAsk, recordRemoteSessionAsk } from "#storage/remote-session";
 import {
   clearPendingAsk,
   createPendingAsk,
@@ -29,6 +30,14 @@ import {
 } from "#storage/session-asks";
 import { enqueueSessionInbox } from "#storage/session-inbox";
 import { connectStdio, mcpError, mcpOk } from "../mcp-helpers";
+import { abortTargetRefusal, remoteSessionRoute } from "./actor-policy";
+import {
+  hubRemoteAbort,
+  hubRemoteAsk,
+  hubRemotePeek,
+  hubRemoteSessions,
+  hubRemoteTell,
+} from "./hub-remote-session";
 import { forwardToPeer, peerSessionsForUser } from "./peer-forward";
 import {
   cronSessionId,
@@ -40,6 +49,7 @@ import {
   MAX_MESSAGE_LENGTH,
   MAX_TELL_DEPTH,
   peerHostQueryId,
+  sessionCommContext,
   subagentParentTopicId,
   userId,
 } from "./runtime";
@@ -51,6 +61,7 @@ import {
   setMcpConfig,
 } from "./topic-config";
 import {
+  currentSessionSurface,
   getTopicsForUser,
   listSessionTargetsForUser,
   type QueryState,
@@ -78,6 +89,11 @@ function remotePeerTarget(to: string): PeerTarget | null {
   return { node: to.slice(0, slash), topic: to.slice(slash + 1) };
 }
 
+/** Which transport serves `node/topic` targets for this turn (see `remoteSessionRoute`). */
+function currentRemoteRoute() {
+  return remoteSessionRoute(currentSessionSurface(), sessionCommContext.remoteSession);
+}
+
 // --- MCP Server ---
 
 const server = new McpServer({
@@ -166,11 +182,39 @@ server.tool(
 
     // Multi-node: append each peer node's rooms, addressed as "node/topic".
     // Disabled or unattached nodes answer with an error — skip silently so
-    // single-node behavior is untouched.
+    // single-node behavior is untouched. On Otium the remote rooms are the
+    // hub's answer for this turn's grant, and none without one (see
+    // `remoteSessionRoute`).
     const remoteSections: string[] = [];
-    const peers = currentSubagentRestricted
-      ? { ok: true as const, nodes: [] }
-      : await peerSessionsForUser(userId, peerHostQueryId || undefined, currentTopicId);
+    const route = currentSubagentRestricted ? null : currentRemoteRoute();
+    if (route?.kind === "hub") {
+      const remote = await hubRemoteSessions(route.grant);
+      if (!remote.ok) {
+        remoteSections.push(`\nRemote nodes: (${remote.error})`);
+      } else {
+        for (const node of remote.nodes) {
+          if (!node.node) continue;
+          if (node.error) {
+            remoteSections.push(`\nNode ${node.node}: (unreachable: ${node.error})`);
+            continue;
+          }
+          const lines = (node.sessions ?? [])
+            .filter((session) => Boolean(session.agent))
+            .map((s) => {
+              const status = s.status === "active" ? "active" : "fresh-start ready";
+              const desc = s.description ? ` — ${s.description.slice(0, 60)}` : "";
+              return `- ${node.node}/${s.name}: ${status}${desc}`;
+            });
+          remoteSections.push(
+            `\nNode ${node.node}:\n${lines.join("\n") || "  (no rooms for this user)"}`,
+          );
+        }
+      }
+    }
+    const peers =
+      route?.kind !== "peer"
+        ? { ok: true as const, nodes: [] }
+        : await peerSessionsForUser(userId, peerHostQueryId || undefined, currentTopicId);
     if (peers.ok && peers.nodes) {
       for (const node of peers.nodes) {
         if (!node.node) continue;
@@ -409,6 +453,46 @@ server.tool(
         ),
       );
     }
+    // Remote rooms (v1): the hub's active/ready view only — no elapsed time
+    // or task text, since the hub does not fan out to every node for a peek.
+    const route = currentSubagentRestricted ? null : currentRemoteRoute();
+    if (route?.kind === "hub") {
+      const remote = await hubRemotePeek(route.grant);
+      if (!remote.ok) {
+        lines.push(``, `원격 노드: (${remote.error})`);
+      } else {
+        const remoteRunning: string[] = [];
+        const remoteIdle: string[] = [];
+        const unreachable: string[] = [];
+        for (const node of remote.nodes) {
+          if (node.error) {
+            unreachable.push(`  ${node.node}: (unreachable: ${node.error})`);
+            continue;
+          }
+          for (const session of node.sessions ?? []) {
+            // Same policy as the listing: a room with no AI is not a session.
+            if (session.agent === null) continue;
+            (session.status === "active" ? remoteRunning : remoteIdle).push(
+              `${node.node}/${session.name}`,
+            );
+          }
+        }
+        lines.push(
+          ``,
+          `원격 실행 중 (${remoteRunning.length}): ${remoteRunning.join(", ") || "없음"}`,
+          `원격 유휴 (${remoteIdle.length}): ${remoteIdle.join(", ") || "없음"}`,
+          ...unreachable,
+        );
+        if (remote.pendingAsks.length) {
+          lines.push(
+            `내 원격 ask_session 대기:`,
+            ...remote.pendingAsks.map(
+              (ask) => `  ${ask.to}: ${ask.status} (request_id: ${ask.requestId})`,
+            ),
+          );
+        }
+      }
+    }
     return mcpOk(lines.join("\n"));
   },
 );
@@ -456,6 +540,8 @@ if (!isReplyOnly) {
         // Remote target ("node/topic") — hand to the runtime's peer forwarder.
         const remote = remotePeerTarget(to);
         if (remote) {
+          const route = currentRemoteRoute();
+          if (route.kind === "refused") return mcpError(route.error);
           const fromRef = currentTopicRef();
           if (!fromRef.topicId) {
             return mcpError(
@@ -472,6 +558,40 @@ if (!isReplyOnly) {
               `"${to}"에 이미 진행 중인 ask_session 요청이 있습니다: ${detail}. 응답이 이 세션에 자동으로 돌아올 때까지 기다리세요.`,
             );
           }
+          if (route.kind === "hub") {
+            // Durable caller record first: the hub's `ask-reply` delivery is
+            // routed back through it, possibly after this process restarted.
+            recordRemoteSessionAsk({
+              requestId,
+              callerTopicId: fromRef.topicId,
+              userId,
+              fromKey: fromRef.key,
+              toKey: to,
+              ...(sessionCommContext.currentThreadRootId
+                ? { callerThreadRootId: sessionCommContext.currentThreadRootId }
+                : {}),
+            });
+            const sent = await hubRemoteAsk(route.grant, {
+              requestId,
+              to: remote,
+              message,
+              fromDepth: currentDepth,
+              fromLabel: { key: fromRef.key, title: fromRef.title },
+            });
+            if (!sent.ok) {
+              if (sent.uncertain) {
+                return mcpOk(
+                  `"${to}" 세션(노드 ${remote.node})에 참조 요청을 보냈지만 hub의 확인을 받지 못했습니다 (${sent.error}).\n\nrequest_id: ${requestId}\n\n응답이 도착하면 '[Reply from ${remote.node}/${remote.topic}]' 형식으로 이 세션에 돌아옵니다. 같은 요청으로 ask_session을 재호출하지 마세요.`,
+                );
+              }
+              clearPendingAsk({ userId, from: fromRef.key, to, requestId });
+              deleteRemoteSessionAsk(requestId);
+              return mcpError(`Error: "${to}" 원격 세션에 전송 실패: ${sent.error}`);
+            }
+            return mcpOk(
+              `"${to}" 세션(노드 ${remote.node})에 참조 요청을 보냈습니다.\n\nrequest_id: ${requestId}\n\n응답은 '[Reply from ${remote.node}/${remote.topic}]' 형식으로 이 세션에 자동으로 돌아옵니다. 응답이 도착할 때까지 같은 요청으로 ask_session을 재호출하지 마세요.`,
+            );
+          }
           const result = await forwardToPeer({
             action: "ask",
             toNode: remote.node,
@@ -631,6 +751,16 @@ if (!isReplyOnly) {
       async ({ to }) => {
         const remote = remotePeerTarget(to);
         if (remote) {
+          const route = currentRemoteRoute();
+          if (route.kind === "refused") return mcpError(route.error);
+          if (route.kind === "hub") {
+            const sent = await hubRemoteAbort(route.grant, {
+              requestId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+              to: remote,
+            });
+            if (!sent.ok) return mcpError(`Error: "${to}" 원격 abort 실패: ${sent.error}`);
+            return mcpOk(`"${to}" 세션(노드 ${remote.node})에 abort 신호를 보냈습니다.`);
+          }
           const result = await forwardToPeer({
             action: "abort",
             toNode: remote.node,
@@ -656,6 +786,15 @@ if (!isReplyOnly) {
           if (!targetTopicId) {
             return mcpError(`Error: "${to}" 세션의 토픽 ID를 찾을 수 없습니다.`);
           }
+          // Same owner rule as the hosted host, from the same module.
+          const refused = abortTargetRefusal({
+            surface: currentSessionSurface(),
+            currentTopicId: currentTopicId || undefined,
+            actorTopicScope: sessionCommContext.actorTopicScope,
+            targetTopicId,
+            to,
+          });
+          if (refused) return mcpError(refused);
           // Send query abort signal via inbox
           enqueueSessionInbox({
             userId,
@@ -705,8 +844,32 @@ if (!isReplyOnly) {
         if (currentSubagentRestricted) {
           return mcpError("Error: subagent tell_session cannot target remote topics.");
         }
+        const route = currentRemoteRoute();
+        if (route.kind === "refused") return mcpError(route.error);
         const fromRef = currentTopicRef();
         const requestId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        if (route.kind === "hub") {
+          const sent = await hubRemoteTell(route.grant, {
+            requestId,
+            to: remote,
+            message,
+            depth: currentDepth + 1,
+            fromLabel: { key: fromRef.key, title: fromRef.title },
+          });
+          if (!sent.ok) {
+            // A timed-out response may still have been delivered; say so
+            // rather than invite a duplicate.
+            if (sent.uncertain) {
+              return mcpOk(
+                `"${to}" 토픽(노드 ${remote.node})에 메시지를 보냈지만 hub의 확인을 받지 못했습니다 (${sent.error}).\n\nrequest_id: ${requestId}\n\n같은 메시지를 다시 보내지 마세요.`,
+              );
+            }
+            return mcpError(`Error: "${to}" 원격 세션에 전송 실패: ${sent.error}`);
+          }
+          return mcpOk(
+            `"${to}" 토픽(노드 ${remote.node})에 메시지를 전달했습니다.\n\nrequest_id: ${requestId}\n\n결과는 해당 노드의 "${remote.topic}" 대화 기록에 남습니다.`,
+          );
+        }
         const result = await forwardToPeer({
           action: "tell",
           toNode: remote.node,

package/dist/runtime/src/mcp/session-comm/topic-catalog.ts

@@ -43,6 +43,12 @@ export interface SessionTargetCatalogHost<TAgent extends string = string> {
    * surface: terminal with terminal, telegram with telegram, otium with otium.
    */
   readonly currentSurface?: string;
+  /**
+   * Drop rows with no AI agent entirely instead of listing them as targets
+   * that every messaging tool then refuses. The current room and manager rooms
+   * are always dropped; this adds AI-off rooms for surfaces that want it.
+   */
+  readonly excludeAgentless?: boolean;
   readonly isAgent: (value: string | null) => value is TAgent;
 }
 
@@ -64,6 +70,7 @@ export function createSessionTargetCatalog<TAgent extends string = string>(
     const eligibleRows = listRows().filter(
       (row) =>
         row.kind !== "manager" &&
+        (!host.excludeAgentless || isAgent(row.agent)) &&
         // Rows predating the surface column report null and stay addressable
         // from the local surface rather than vanishing mid-migration.
         (!currentSurface || (row.surface ?? currentSurface) === currentSurface),

package/dist/runtime/src/mcp/session-comm/topics.ts

@@ -8,17 +8,20 @@
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { sessionInboxPath } from "#query/session-inbox-path";
+import { actorReachableTopicIds } from "#runtime/actor-topic-reach";
 import { sanitizeTopicName } from "#security/sanitize";
 // NOTE: see `runtime.ts` — import these from `@/types` directly to keep
 // `maestro-agent-sdk` (whose `bootstrapHostPath()` prints to stdout) out of
 // this stdio MCP server's import graph.
 import { type AgentKind, isAgentKind, type QueryState } from "#types";
+import { excludesAgentlessTargets } from "./actor-policy";
 import {
   currentTopic,
   currentTopicId,
   PLAYWRIGHT_PORTS_DIR,
   parseJsonField,
   SESSIONS_DB,
+  sessionCommContext,
   userId,
   withDb,
 } from "./runtime";
@@ -171,23 +174,42 @@ function currentSessionPlacement(): CurrentPlacement {
   return cachedSessionPlacement;
 }
 
+/** Surface of the room this server serves (undefined when it cannot be read). */
+export function currentSessionSurface(): string | undefined {
+  return currentSessionPlacement().surface;
+}
+
 const sessionTargetCatalog = createSessionTargetCatalog<AgentKind>({
   currentTopicId,
   currentTopicName: currentTopic,
   get currentSurface() {
     return currentSessionPlacement().surface;
   },
+  get excludeAgentless() {
+    return excludesAgentlessTargets(currentSessionPlacement().surface);
+  },
   isAgent: isAgentKind,
-  listRows: () =>
-    sessionTargetRows().map((row) => ({
-      id: row.id,
-      title: row.title,
-      kind: row.kind,
-      agent: row.agent,
-      sessionId: row.session_id,
-      description: row.description,
-      surface: row.surface,
-    })),
+  listRows: () => {
+    // On `otium` the roster join above matches the hub's execution principal,
+    // not the person who spoke, so the hub's per-turn assertion decides which
+    // of those rooms this actor may actually name. Fail-closed without one.
+    const reachable = actorReachableTopicIds({
+      surface: currentSessionPlacement().surface,
+      currentTopicId: currentTopicId || undefined,
+      actorTopicScope: sessionCommContext.actorTopicScope,
+    });
+    return sessionTargetRows()
+      .filter((row) => !reachable || reachable.has(row.id))
+      .map((row) => ({
+        id: row.id,
+        title: row.title,
+        kind: row.kind,
+        agent: row.agent,
+        sessionId: row.session_id,
+        description: row.description,
+        surface: row.surface,
+      }));
+  },
 });
 
 export function getMcpUserConfig(): McpUserConfig | null {

package/dist/runtime/src/mcp-runtime-host.ts

@@ -39,6 +39,7 @@ export { OPTIONAL_FORUM_MCP_SERVERS, REQUIRED_FORUM_MCP_SERVERS } from "#platfor
 export { isInsideDir } from "#platform/paths";
 export { abortRoom, getRoomQuery } from "#query/active-rooms";
 export { sessionInboxPath } from "#query/session-inbox-path";
+export { actorOwnedTopicIds, actorReachableTopicIds } from "#runtime/actor-topic-reach";
 export { prepareDeliveryAck } from "#runtime/delivery-ack";
 export { storeLocalFileAsUpload } from "#runtime/file-hooks";
 export {
@@ -70,6 +71,6 @@ export {
   TopicCleanupRequiredError,
 } from "#topics/lifecycle";
 export { restartTopicSession } from "#topics/session";
-export type { EffortLevel } from "#types";
+export type { ActorTopicScope, EffortLevel, RemoteSessionGrant } from "#types";
 export { EFFORT_VALUES } from "#types";
 export type { MessageDto, TopicDto, TopicSurface } from "#types/api";

package/dist/runtime/src/node-host.ts

@@ -30,6 +30,7 @@ export {
   asUserId,
 } from "#identifiers";
 export { setRuntimeMcpPort } from "#mcp/runtime-spec";
+export { MAX_PEER_MESSAGE_LENGTH } from "#mcp/session-comm/limits";
 export { killAllBgBash } from "#platform/background-bash/manager";
 export {
   DATA_DIR,
@@ -65,6 +66,8 @@ export {
   reapPlaywrightOrphans as reapOrphanBrowsers,
 } from "#platform/playwright/manager";
 export { abortAllRooms, listRunningTopicQueries } from "#query/active-rooms";
+export { parseActorTopicScope, validateActorTopicScope } from "#runtime/actor-topic-scope";
+export { failInterruptedRemoteAskCallbacks } from "#runtime/ask-callbacks";
 export { listBackgroundSessionsForUser } from "#runtime/background-sessions";
 export type {
   BashrsCompletion,
@@ -77,7 +80,22 @@ export {
 } from "#runtime/bashrs-completions";
 export type { FileHooks, UploadAccess } from "#runtime/file-hooks";
 export { setFileHooks } from "#runtime/file-hooks";
+export {
+  listRuntimeGatewayCapabilities,
+  registerRuntimeGatewayCapability,
+} from "#runtime/gateway-capabilities";
 export { startSessionInboxWorker } from "#runtime/inbox";
+export { validateRemoteSessionGrant } from "#runtime/remote-session-grant";
+export {
+  deliverRemoteSessionInbox,
+  parseRemoteSessionInboxDelivery,
+  RemoteSessionInboxError,
+  recoverRemoteSessionInbox,
+} from "#runtime/remote-session-inbox";
+export {
+  runRemoteSessionMaintenance,
+  startRemoteSessionReplyOutboxWorker,
+} from "#runtime/remote-session-reply-outbox";
 export { startAiTurn, startDurableTurnRequestWorker } from "#runtime/turn-runner";
 export type { PortableTopicVisual } from "#runtime/visual-store";
 export { getPortableTopicVisual } from "#runtime/visual-store";
@@ -99,6 +117,14 @@ export {
 export { getTopic, upsertTopic } from "#storage/api-topics";
 export { getGlobalAiName, setGlobalAiName } from "#storage/app-settings";
 export { readDecisions, writeDecisionGraphSvg } from "#storage/decisions";
+export {
+  claimRemoteSessionInbox,
+  purgeRemoteSessionInboxClaims,
+  purgeStaleRemoteSessionAsks,
+  releaseRemoteSessionInboxClaim,
+  remoteSessionPayloadHash,
+  takeRemoteSessionAsk,
+} from "#storage/remote-session";
 export type { StoredRuntimeEvent } from "#storage/runtime-events";
 export {
   earliestRuntimeEventSeq,

package/dist/runtime/src/platform/mcp-config.ts

@@ -1,6 +1,7 @@
 import { accessSync, constants as fsConstants } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { explicitAgentSwitchTargets } from "#agents/explicit-agent-switch";
 
 import { canonicalMcpBridgeEnv } from "#mcp/canonical-bridge-config";
 import {
@@ -38,10 +39,18 @@ import {
   buildPlaywrightMcpTransport,
   CODEX_BROWSER_CAPABILITY_ENV,
 } from "#platform/playwright/mcp-transport";
+import { encodeActorTopicScopeArg } from "#runtime/actor-topic-scope";
 import { getRegisteredCronSession } from "#runtime/cron-sessions";
+import { encodeRemoteSessionGrantArg } from "#runtime/remote-session-grant";
 import type { HostMcpServerSpec } from "#runtime-gateway";
 import { getTopic } from "#storage/api-topics";
-import type { AgentKind, AgentQueryOptions, PeerRuntimeBridgeContext } from "#types";
+import type {
+  ActorTopicScope,
+  AgentKind,
+  AgentQueryOptions,
+  PeerRuntimeBridgeContext,
+  RemoteSessionGrant,
+} from "#types";
 
 export type { RuntimeMcpScope } from "#platform/mcp-catalog-policy";
 
@@ -92,6 +101,14 @@ function buildBuiltinMcpServer(
   const agent = ctx.agent ?? FALLBACK_AGENT;
   return buildHostedMcpSpec(agent, surface, {
     userId: ctx.userId,
+    ...(ctx.actorUserId ? { actorUserId: ctx.actorUserId } : {}),
+    ...(ctx.actorTopicScope ? { actorTopicScope: ctx.actorTopicScope } : {}),
+    // Only the session-comm surface addresses remote rooms; the other hosted
+    // tokens (and the runtime token) never carry the grant, so it costs them
+    // no URL budget.
+    ...(surface === "session-comm" && ctx.remoteSession
+      ? { remoteSession: ctx.remoteSession }
+      : {}),
     topicTitle: ctx.session,
     ...(ctx.topicId ? { topicId: ctx.topicId } : {}),
     ...(ctx.queryId ? { queryId: ctx.queryId } : {}),
@@ -221,6 +238,10 @@ export interface RuntimeMcpBuildContext {
   userId: string;
   /** Product actor identity when it differs from the execution principal. */
   actorUserId?: string;
+  /** Hub-asserted rooms the product actor may reach; forwarded into signed tokens. */
+  actorTopicScope?: ActorTopicScope;
+  /** Hub-issued per-turn remote session-comm grant; session-comm only. */
+  remoteSession?: RemoteSessionGrant;
   /** Vault namespace when credentials belong to a different principal. */
   vaultUserId?: string;
   /** "dm" for DM scope, topic/session name for forum/fork. */
@@ -375,6 +396,7 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
     build({
       userId,
       actorUserId,
+      actorTopicScope,
       session,
       topicId,
       queryId,
@@ -389,6 +411,7 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
       peerBridge,
     }) {
       if (!topicId || !agent) return null;
+      const switchTargets = explicitAgentSwitchTargets(currentUserPrompt);
       return buildRuntimeMcpSpec(agent, {
         // Runtime tools mutate node-owned state, so authorization stays bound
         // to the canonical execution principal. Keep the product-side human
@@ -396,13 +419,17 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
         // that appears in this node's topic participant roster.
         userId,
         ...(actorUserId ? { actorUserId } : {}),
+        ...(actorTopicScope ? { actorTopicScope } : {}),
         topicId,
         topicTitle: session,
         queryId,
         cwd: cwd ?? resolveTopicWorkspaceDir(topicId),
         agent,
         model,
-        currentUserPrompt,
+        // Derived here, from the full prompt, so the signed token carries the
+        // gate's answer (bounded) instead of the prompt (unbounded); see
+        // `explicitAgentSwitchTargets`.
+        ...(switchTargets.length ? { explicitAgentSwitchTargets: switchTargets } : {}),
         autoContinue,
         visualTools,
         fileDeliveryTools,
@@ -484,6 +511,9 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
     build(ctx) {
       const {
         userId,
+        actorUserId,
+        actorTopicScope,
+        remoteSession,
         session,
         topicId,
         subagentParentTopicId,
@@ -499,6 +529,13 @@ const MCP_CATALOG: Record<string, RuntimeMcpCatalogEntry> = {
         : undefined;
       const args = [
         `--user-id=${userId}`,
+        ...(actorUserId ? [`--actor-user-id=${actorUserId}`] : []),
+        ...(actorTopicScope
+          ? [`--actor-topic-scope=${encodeActorTopicScopeArg(actorTopicScope)}`]
+          : []),
+        ...(remoteSession
+          ? [`--remote-session-grant=${encodeRemoteSessionGrantArg(remoteSession)}`]
+          : []),
         `--topic=${session}`,
         ...(topicId ? [`--topic-id=${topicId}`] : []),
         ...(subagentParentTopicId ? [`--subagent-parent-topic-id=${subagentParentTopicId}`] : []),
@@ -925,6 +962,9 @@ export function getDmMcpServers(opts: {
  */
 export function getManagerMcpServers(opts: {
   userId: string;
+  actorUserId?: string;
+  actorTopicScope?: ActorTopicScope;
+  remoteSession?: RemoteSessionGrant;
   session?: string;
   topicId?: string;
   queryId?: string;
@@ -945,6 +985,9 @@ export function getManagerMcpServers(opts: {
   const topicId = opts.topicId;
   return buildScope("manager", {
     userId: opts.userId,
+    actorUserId: opts.actorUserId,
+    actorTopicScope: opts.actorTopicScope,
+    remoteSession: opts.remoteSession,
     session: opts.session ?? "General",
     topicId,
     queryId: opts.queryId,
@@ -970,6 +1013,8 @@ export function getManagerMcpServers(opts: {
 export function getForumMcpServers(opts: {
   userId: string;
   actorUserId?: string;
+  actorTopicScope?: ActorTopicScope;
+  remoteSession?: RemoteSessionGrant;
   vaultUserId?: string;
   session: string;
   topicId?: string;
@@ -996,6 +1041,8 @@ export function getForumMcpServers(opts: {
   const {
     userId,
     actorUserId,
+    actorTopicScope,
+    remoteSession,
     vaultUserId,
     session,
     topicId,
@@ -1033,6 +1080,8 @@ export function getForumMcpServers(opts: {
     {
       userId,
       actorUserId,
+      actorTopicScope,
+      remoteSession,
       vaultUserId,
       session,
       topicId,
@@ -1146,6 +1195,9 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
       mergeHostMcpServers(
         getManagerMcpServers({
           userId: opts.userId || "local",
+          actorUserId: opts.actorUserId,
+          actorTopicScope: opts.actorTopicScope,
+          remoteSession: opts.remoteSession,
           session: opts.session,
           topicId: opts.topicId,
           queryId: opts.queryId,
@@ -1169,6 +1221,8 @@ export function getMcpServersForQuery(opts: AgentQueryOptions): Record<string, u
     getForumMcpServers({
       userId: opts.userId || "local",
       actorUserId: opts.actorUserId,
+      actorTopicScope: opts.actorTopicScope,
+      remoteSession: opts.remoteSession,
       vaultUserId: opts.vaultUserId,
       session: opts.session || "default",
       topicId: opts.topicId,

package/dist/runtime/src/query/active-rooms.ts

@@ -120,6 +120,12 @@ export interface RoomQueryControl {
   prompt: string;
   /** Original user submissions represented by prompt, in arrival order. */
   userMessages?: UserTurnEnvelope[];
+  /**
+   * Product actor a user turn speaks for, when recorded. Decides whether a
+   * later human message may steer this turn: only the same actor's follow-up
+   * aborts and folds into it; anyone else's waits its turn in the queue.
+   */
+  actorUserId?: string;
   /** Durable request rows whose messages are already represented by userMessages. */
   durableRequestIds?: string[];
   /** Attachment ids currently being processed. User-turn preemption carries them forward. */