fix(ai-harness): do not run a no-user input as the session owner

.changeset/harness-anonymous-input.md

@@ -0,0 +1,5 @@
+---
+'@tanstack/ai-harness': patch
+---
+
+An input with no user no longer runs as the user who opened the session that owns the thread. A host with access refuses that input.

docs/harness/shared-threads.md

@@ -146,7 +146,7 @@ await bobSession.send('Summarize the open issues.')
 
 Each message, command, and agent runs as the person who started it:
 
-- The log keeps the sender of each input, also of a cancel, an answer, and a change of settings. After a restart, a message runs again as its sender.
+- The log keeps the sender of each input, also of a cancel, an answer, and a change of settings. After a restart, a message runs again as its sender. An input with no sender runs with no user, so it does not use the credentials of the session that owns the thread. A host with access refuses that input.
 - Tools and middleware read the run as `ctx.context.run`. It has the user, the credentials, and the provider keys of the sender.
 - The model call uses the provider key of the sender. So the sender pays for the call.
 - An answer does not change the sender. When the owner approves a tool in the turn of Bob, the rest of that turn still runs as Bob.

packages/ai-harness/src/session/agents.ts

@@ -245,7 +245,7 @@ export abstract class SessionAgents<
     if (runInputId === undefined) {
       return { inputId, status: 'rejected', reason: 'not_running' }
     }
-    const user = options.user ?? this.user
+    const user = this.actor(options.user)
     return this.admitting(async () => {
       const { admission, input } = await this.accept(
         inputId,
@@ -688,7 +688,10 @@ export abstract class SessionAgents<
     // The agent runs for the user who starts it, also after the turn that
     // starts it ends. A child of agent code runs for its parent run's user.
     // Without either, it runs for the user that opened the session.
-    const user = options.user ?? (parent ? parent.current.user : this.user)
+    const user = this.actor(
+      options.user,
+      parent ? parent.current.user : this.user,
+    )
     const sender = user ? { user } : {}
     const fromParent = parent
       ? {
@@ -2448,7 +2451,7 @@ export abstract class SessionAgents<
       const connector = opened && signInOf(interruptOf(opened))?.connector
       if (!connector) continue
       // Another user's credential never answers this sign-in.
-      const user = wait.user ?? this.user
+      const user = wait.user
       if (!(await this.credentialsOf(user).get(connector))) continue
       await this.resolve({
         resume: [

packages/ai-harness/src/session/base.ts

@@ -396,6 +396,11 @@ export abstract class SessionBase<THarness extends AnyHarness = AnyHarness> {
   protected activeTurn: OperationImpl<ChatTurnResult> | undefined
   /** The open skipped recovery: another host owned the thread then. */
   protected recoveryDeferred = false
+  /**
+   * The call stack is applying an offered input whose record has no user.
+   * Entry points then keep that absence. They do not use `this.user`.
+   */
+  protected anonymousOffer = false
   /**
    * Agent runs that another host runs for an input that this host offered.
    * They wait for the log, so they do not keep the thread busy here.
@@ -902,12 +907,27 @@ export abstract class SessionBase<THarness extends AnyHarness = AnyHarness> {
   }
 
   /**
-   * Who sent the input of the running turn, else the user that opened
+   * Who sent the input of the running turn. While a turn runs, that is
+   * `turnUser`, also when the input has no user. Else the user that opened
    * the session. Turns run one at a time, so one value is enough. It never
    * picks credentials or keys: those come from the run context of each run.
    */
   protected sender(): HarnessUser | undefined {
-    return this.turnUser ?? this.user
+    if (this.activeTurn) return this.turnUser
+    return this.user
+  }
+
+  /**
+   * The user an input runs as. While `anonymousOffer` is set, the input
+   * has no user. Else `user` when the caller passed one, else `fallback`
+   * (the user that opened the session).
+   */
+  protected actor(
+    user: HarnessUser | undefined,
+    fallback: HarnessUser | undefined = this.user,
+  ): HarnessUser | undefined {
+    if (this.anonymousOffer) return undefined
+    return user ?? fallback
   }
 
   /**

packages/ai-harness/src/session/harness-session.ts

@@ -930,14 +930,34 @@ export class SessionImpl<THarness extends AnyHarness = AnyHarness>
     const runs = this.runStore
     const maxAttempts = this.harness.durability?.maxAttempts ?? 10
     const logged = [...writer.state.inputs.values()]
+    // An input with no user does not take this session's user. A host
+    // with access refuses it. The same check runs in the loop below.
+    const refuseAnonymous = async (input: InputState) => {
+      if (!this.hasAccess || input.user) return false
+      if (input.status !== 'pending' && input.status !== 'applied') return true
+      if (isTaken(input)) return true
+      if (input.status === 'pending') {
+        this.reject(input.inputId, 'no_user')
+      } else {
+        await this.settle({
+          inputId: input.inputId,
+          ...(input.operationId ? { operationId: input.operationId } : {}),
+          outcome: 'failed',
+          error: { message: 'This input has no user.' },
+        })
+      }
+      return true
+    }
     for (const input of logged) {
+      if (await refuseAnonymous(input)) continue
       const isControl =
         input.status === 'pending' && CONTROL_OPS.has(input.input.op)
       if (isControl && !isTaken(input)) await this.recoverControl(writer, input)
     }
     // Read again: the pass above changed the inputs it applied to.
     const inputs = [...writer.state.inputs.values()]
     for (const input of inputs) {
+      if (await refuseAnonymous(input)) continue
       // A reset that did not settle applies now. Its marker goes in once.
       if (input.input.op === 'reset') {
         const isOpen =