fix(runtime): reject a mixed tightening while a Turn is active (#3349)

Review finding: session.configuration.update is a full configuration
operation, but the fast tightening path commits the entire record while
the live backend keeps its frozen composition. For bypass/agent →
ask/plan the permission half applies per dispatch while the stale agent
collaboration keeps combining with the fresh ask boundary — so a
write-capable dispatch can still be admitted after the stored
configuration already says the session is read-only Plan.

A tightening that also changes any backend-composed field (backend,
connection, model, thinking level, collaboration mode, orchestration
mode) now rejects session_busy while a run is live — never partially
committed; the retry lands whole once the run ends and the queued path
recomposes the backend with every field. Permission-only projections
keep the immediate-revocation path. The regression drives the reviewer's
scenario end to end: live rejection with zero partial commit, then a
read-only dispatch (plan downgrades ask to explore) after the retry.

Generated-by: ZCode (Z.ai GLM)

Author: chinawch007

packages/runtime/src/__tests__/session-manager.test.ts

@@ -5341,6 +5341,87 @@ describe('SessionManager permission mode updates', () => {
     expect(composedModes).toEqual(['bypass', 'ask']);
   });
 
+  test('a mixed bypass/agent → ask/plan tightening rejects while a run is live and lands read-only on retry', async () => {
+    const store = new VersionedConfigurationMemorySessionStore();
+    const runStore = new MemoryAgentRunStore();
+    const backends = new BackendRegistry();
+    const gate = makeGate();
+    backends.register('ai-sdk', (ctx) => new TestBackend(ctx, gate));
+    const manager = new SessionManager({
+      store,
+      runStore,
+      runtimeEventStore: runStore,
+      backends,
+      shellRuns: {
+        async terminateSession() {
+          return undefined;
+        },
+        async commitSessionClose() {},
+        rollbackSessionClose() {},
+        resumeSession() {},
+      } as never,
+      planStore: {
+        readState: async () => ({ activeExecutionId: null, latestProposalId: null, proposals: [] }),
+      } as never,
+      newId: nextId(),
+      now: nextNow(8_000),
+    });
+    const session = await manager.createSession(
+      makeInput({ permissionMode: 'bypass', collaborationMode: 'agent' }),
+    );
+    const mixedConfiguration = {
+      backend: session.backend,
+      llmConnectionSlug: session.llmConnectionSlug,
+      connectionLocked: true,
+      model: session.model,
+      thinkingLevel: session.thinkingLevel,
+      permissionMode: 'ask',
+      collaborationMode: 'plan',
+      orchestrationMode: session.orchestrationMode ?? 'default',
+    } as const;
+
+    // The turn is live under bypass/agent when the one-shot tightening to
+    // ask/plan arrives. Only the permission half could apply per dispatch; the
+    // plan half is backend-composed, so committing now would publish a
+    // read-only configuration the live composition cannot enforce.
+    const turn = manager
+      .sendMessage(session.id, { turnId: 'turn-1', text: 'work' })
+      [Symbol.asyncIterator]();
+    expect((await turn.next()).value?.type).toBe('text_delta');
+
+    await expectRejects(
+      manager.transitionSessionConfiguration(session.id, {
+        expectedRevision: 1,
+        configuration: mixedConfiguration,
+      }),
+      /while a Turn is active/,
+    );
+
+    // Nothing partially committed: the record and a dispatch in this turn
+    // still agree on the old authority.
+    const header = await store.readHeader(session.id);
+    expect(header.permissionMode).toBe('bypass');
+    expect(header.collaborationMode).toBe('agent');
+    const dispatch = await dispatchProbeTool(store, session.id);
+    expect(dispatch.boundaryKind).toBe('bypass');
+    expect(dispatch.permissionMode).toBe('bypass');
+
+    gate.release();
+    while (!(await turn.next()).done) {}
+
+    // Once the run ended the retry lands whole, and a write-capable dispatch
+    // cannot receive writable authority: plan downgrades ask to explore.
+    const committed = await manager.transitionSessionConfiguration(session.id, {
+      expectedRevision: 1,
+      configuration: mixedConfiguration,
+    });
+    expect(committed.header.permissionMode).toBe('ask');
+    expect(committed.header.collaborationMode).toBe('plan');
+    const narrowed = await dispatchProbeTool(store, session.id);
+    expect(narrowed.boundaryKind).toBe('managed');
+    expect(narrowed.permissionMode).toBe('explore');
+  });
+
   test('a switch queued behind a turn that pauses on an interaction rejects busy', async () => {
     const store = new MemorySessionStore();
     const runStore = new MemoryAgentRunStore();

packages/runtime/src/session-manager.ts

@@ -1135,9 +1135,24 @@ export class SessionManager {
     input: SessionConfigurationTransitionRequest,
   ): Promise<VersionedSessionHeader> {
     const store = this.requireSessionConfigurationStore();
+    // A tightening that also changes any backend-composed field cannot use the
+    // immediate-commit path while a run is live: the frozen composition (for
+    // example a stale collaboration mode) would keep combining with the fresh
+    // boundary, so a plan/ask session could still admit writable dispatches.
+    const header = await this.deps.store.readHeader(sessionId);
+    const changesBackendComposition =
+      input.configuration.backend !== header.backend ||
+      input.configuration.llmConnectionSlug !== header.llmConnectionSlug ||
+      input.configuration.model !== header.model ||
+      (input.configuration.thinkingLevel ?? undefined) !== header.thinkingLevel ||
+      (input.configuration.collaborationMode ?? 'agent') !==
+        (header.collaborationMode ?? 'agent') ||
+      (input.configuration.orchestrationMode ?? 'default') !==
+        (header.orchestrationMode ?? 'default');
     const next = await this.commitExecutionResourceTransition(
       sessionId,
       input.configuration.permissionMode,
+      changesBackendComposition,
       async () => {
         const current = await store.readHeaderRecordSnapshot(sessionId);
         if (current.revision !== input.expectedRevision) {
@@ -1673,21 +1688,28 @@ export class SessionManager {
     },
   ): Promise<ExecutionBoundary> {
     const nextPermissionMode = projection?.permissionMode ?? (kind === 'bypass' ? 'bypass' : 'ask');
-    return this.commitExecutionResourceTransition(sessionId, nextPermissionMode, async () => {
-      const latest = await this.deps.store.readExecutionBoundary(sessionId);
-      if (latest.revision !== current.revision) {
-        throw new SessionConfigurationTransitionError(
-          'operation_conflict',
-          'Session execution boundary changed before the transition',
-        );
-      }
-      return () => this.deps.store.setExecutionBoundaryKind(sessionId, kind, projection);
-    });
+    // Permission-only projection: no backend-composed field rides along.
+    return this.commitExecutionResourceTransition(
+      sessionId,
+      nextPermissionMode,
+      false,
+      async () => {
+        const latest = await this.deps.store.readExecutionBoundary(sessionId);
+        if (latest.revision !== current.revision) {
+          throw new SessionConfigurationTransitionError(
+            'operation_conflict',
+            'Session execution boundary changed before the transition',
+          );
+        }
+        return () => this.deps.store.setExecutionBoundaryKind(sessionId, kind, projection);
+      },
+    );
   }
 
   private async commitExecutionResourceTransition<T>(
     sessionId: string,
     nextPermissionMode: PermissionMode,
+    changesBackendComposition: boolean,
     prepareCommit: () => Promise<() => Promise<T>>,
   ): Promise<T> {
     const initialBoundary = await this.deps.store.readExecutionBoundary(sessionId);
@@ -1698,6 +1720,7 @@ export class SessionManager {
     return this.commitTighteningTransition<T>(
       sessionId,
       [sessionId, ...initialDescendants],
+      changesBackendComposition,
       prepareCommit,
     );
   }
@@ -1734,6 +1757,7 @@ export class SessionManager {
   private async commitTighteningTransition<T>(
     sessionId: string,
     fencedSessionIds: readonly string[],
+    changesBackendComposition: boolean,
     prepareCommit: () => Promise<() => Promise<T>>,
   ): Promise<T> {
     if (!this.runtimeKernel.runSessionAdmissionMutation) {
@@ -1755,6 +1779,18 @@ export class SessionManager {
           'Session lineage changed before the configuration transition',
         );
       }
+      if (changesBackendComposition && this.runtimeKernel.hasActiveRuns(sessionId)) {
+        // The permission half of this update could apply per dispatch, but the
+        // composed half only refreshes on rebuild — committing both now would
+        // publish a read-only configuration the live backend cannot enforce
+        // (a stale agent composition keeps admitting writable dispatches).
+        // Reject the atomic update whole; the retry lands once the run ends
+        // and the queued path recomposes the backend with every field.
+        throw new SessionConfigurationTransitionError(
+          'session_busy',
+          'A mixed permission and configuration tightening cannot commit while a Turn is active',
+        );
+      }
       if (!this.deps.shellRuns) {
         throw new SessionConfigurationTransitionError(
           'operation_unavailable',