fix(dashboard-agent): apply the token's cap as a second ceiling, and finalise only this turn's messages

Review of #4418: the cloud path builds the ability from the user's role, so a read-only delegated token could exchange it for a write JWT; and the finalisable set was the whole replayed transcript rather than what the turn produced.

Author: kathiekiwi

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -9,7 +9,12 @@
  */
 
 import { json } from "@remix-run/server-runtime";
-import { type RbacAbility, scopesWithinAbility, type UserActorClaims } from "@trigger.dev/rbac";
+import {
+  buildJwtAbility,
+  type RbacAbility,
+  scopesWithinAbility,
+  type UserActorClaims,
+} from "@trigger.dev/rbac";
 import { $replica } from "~/db.server";
 
 export const FORBIDDEN_ENVIRONMENT_CODE = "forbidden_environment";
@@ -112,20 +117,28 @@ export async function resolveUserActorEnvironmentScope(
 /** Mirrors the RBAC fallback's own default. */
 const CAPLESS_USER_ACTOR_SCOPES = ["read:all"];
 
-/** A delegated token must never mint something more capable than itself, so it is the ceiling. */
+/**
+ * A delegated token must never mint something more capable than itself. Two ceilings apply:
+ * the actor's own ability (their role) and the token's `cap`. The role alone is not enough —
+ * a read-only agent token belongs to a user who may well be allowed to write.
+ */
 export function clampUserActorScopes(
   requestedScopes: string[] | undefined,
   userActor: UserActorClaims,
   ability: RbacAbility
 ): { scopes: string[]; deniedScopes: string[] } {
-  const requested =
-    requestedScopes && requestedScopes.length > 0
-      ? requestedScopes
-      : (userActor.cap ?? CAPLESS_USER_ACTOR_SCOPES);
+  const cap = userActor.cap ?? CAPLESS_USER_ACTOR_SCOPES;
+  const requested = requestedScopes && requestedScopes.length > 0 ? requestedScopes : cap;
 
-  const { deniedScopes } = scopesWithinAbility(requested, ability);
+  const denied = new Set([
+    ...scopesWithinAbility(requested, ability).deniedScopes,
+    ...scopesWithinAbility(requested, buildJwtAbility(cap)).deniedScopes,
+  ]);
 
-  return { scopes: requested.filter((scope) => !deniedScopes.includes(scope)), deniedScopes };
+  return {
+    scopes: requested.filter((scope) => !denied.has(scope)),
+    deniedScopes: [...denied],
+  };
 }
 
 function assertClaimIsOptional(userActor: UserActorClaims): void {

apps/webapp/test/dashboardAgentDelegatedScopeCeiling.test.ts

@@ -58,6 +58,18 @@ it("still hands over the reads the cap does carry", async () => {
   expect(clamped.scopes).toEqual(["read:runs"]);
 });
 
+it("refuses a write the cap forbids even when the user's role allows it", async () => {
+  // The cloud path builds the ability from the user's role, not from the token's cap —
+  // so the role alone would hand a read-only agent token a write JWT.
+  const { claims } = await abilityFor(AGENT_CAP);
+  const roleAllowsEverything = { can: () => true, canSuper: () => false } as never;
+
+  const clamped = clampUserActorScopes(["write:runs"], claims, roleAllowsEverything);
+
+  expect(clamped.scopes).toEqual([]);
+  expect(clamped.deniedScopes).toContain("write:runs");
+});
+
 it("keeps a capless delegated token read-only", async () => {
   const { ability, claims } = await abilityFor();
 

apps/webapp/test/dashboardAgentTranscriptStore.test.ts

@@ -311,6 +311,7 @@ describe("invariant 3: an ordinary transcript write can never change a stored me
       await persistTurn(agentDb, {
         chatId,
         messages: [toolMessage("a1", "output-available")],
+        finalizeMessageIds: ["a1"],
         session: { publicAccessToken: "pat_store" },
       });
 
@@ -645,6 +646,8 @@ describe("a write can no longer lose a message another process appended", () =>
       await persistTurn(agentDb, {
         chatId,
         messages: [{ ...(card.message as Record<string, unknown>), tampered: true }],
+        // Even named outright, a durable event is not this turn's to rewrite.
+        finalizeMessageIds: [cardId],
         session: { publicAccessToken: "pat_store" },
       });
       const afterCard = (await rows(prisma, chatId)).find(

internal-packages/dashboard-agent-db/drizzle/meta/0002_snapshot.json

@@ -74,20 +74,14 @@
       "compositePrimaryKeys": {
         "chat_messages_chat_id_message_id_pk": {
           "name": "chat_messages_chat_id_message_id_pk",
-          "columns": [
-            "chat_id",
-            "message_id"
-          ]
+          "columns": ["chat_id", "message_id"]
         }
       },
       "uniqueConstraints": {
         "chat_messages_chat_position_key": {
           "name": "chat_messages_chat_position_key",
           "nullsNotDistinct": false,
-          "columns": [
-            "chat_id",
-            "position"
-          ]
+          "columns": ["chat_id", "position"]
         }
       },
       "policies": {},
@@ -408,10 +402,7 @@
       "compositePrimaryKeys": {
         "chat_turn_evals_chat_id_turn_pk": {
           "name": "chat_turn_evals_chat_id_turn_pk",
-          "columns": [
-            "chat_id",
-            "turn"
-          ]
+          "columns": ["chat_id", "turn"]
         }
       },
       "uniqueConstraints": {},
@@ -690,10 +681,7 @@
       "compositePrimaryKeys": {
         "watch_batches_environment_id_cadence_minutes_pk": {
           "name": "watch_batches_environment_id_cadence_minutes_pk",
-          "columns": [
-            "environment_id",
-            "cadence_minutes"
-          ]
+          "columns": ["environment_id", "cadence_minutes"]
         }
       },
       "uniqueConstraints": {},
@@ -846,10 +834,7 @@
       "compositePrimaryKeys": {
         "watch_submissions_chat_id_client_request_id_pk": {
           "name": "watch_submissions_chat_id_client_request_id_pk",
-          "columns": [
-            "chat_id",
-            "client_request_id"
-          ]
+          "columns": ["chat_id", "client_request_id"]
         }
       },
       "uniqueConstraints": {},
@@ -1298,4 +1283,4 @@
     "schemas": {},
     "tables": {}
   }
-}
+}

internal-packages/dashboard-agent-db/drizzle/meta/_journal.json

@@ -24,4 +24,4 @@
       "breakpoints": true
     }
   ]
-}
+}

internal-packages/dashboard-agent-db/src/queries.ts

@@ -571,6 +571,12 @@ export async function persistTurn(
       runId?: string | null;
     };
     settlements?: PendingInvestigationSettlement[];
+    /**
+     * The ids this turn produced. Only these may be rewritten in place — `messages` is the
+     * whole replayed transcript, so finalising all of it would let a later turn overwrite a
+     * durable event that happens to be in the agent's history.
+     */
+    finalizeMessageIds?: string[];
   }
 ): Promise<PersistTurnResult> {
   return db.transaction(async (tx) => {
@@ -608,14 +614,15 @@ export async function persistTurn(
     );
     const messages = [...params.messages, ...cards.filter((card) => !existing.has(card.id))];
 
-    // `onTurnStart` stores the turn's messages mid-flight, so the completed bodies arrive
-    // here against ids that already exist: without finalisation the transcript would keep
-    // the half-finished tool call the user never saw the end of. Settlement cards are
-    // durable events and stay insert-only.
+    // `onTurnStart` stores this turn's messages mid-flight, so their completed bodies arrive
+    // here against ids that already exist: without finalisation the transcript would keep the
+    // half-finished tool call the user never saw the end of. Everything else — earlier turns,
+    // settlement cards, host-appended wakes — stays insert-only.
+    // A settlement card is never the turn's to rewrite, however it was named.
     const finalizable = new Set(
-      params.messages
-        .map((message) => messageIdOf(params.chatId, message))
-        .filter((id) => !id.startsWith(`${INVESTIGATION_SETTLEMENT_MESSAGE_ID_PREFIX}:`))
+      (params.finalizeMessageIds ?? []).filter(
+        (id) => !id.startsWith(`${INVESTIGATION_SETTLEMENT_MESSAGE_ID_PREFIX}:`)
+      )
     );
 
     await storeChatMessages(tx, { chatId: params.chatId, messages, finalizable });

internal-packages/dashboard-agent/src/dashboard-agent.ts

@@ -456,9 +456,15 @@ export const dashboardAgent = chat.agent({
     // and closing cards of whatever was left running. Settling a row on a separate
     // operation is what could leave a terminal row whose card never arrived — and the
     // stale sweep only selects `in_progress`, so nothing would ever repair it.
+    // Only what this turn produced may be finalised; the rest of the snapshot is history.
+    const produced = [...(newMessages ?? []), ...(responseMessage ? [responseMessage] : [])]
+      .map((message) => (message as { id?: unknown }).id)
+      .filter((id): id is string => typeof id === "string");
+
     const { settled } = await store.persistTurn({
       chatId,
       messages: mergeMessagesById(uiMessages, failure ? [failure] : []),
+      finalizeMessageIds: [...produced, ...(failure ? [failure.id] : [])],
       session: {
         publicAccessToken: chatAccessToken,
         lastEventId,