agent_run subject: company Agent code execution with a private run namespace (Team chat)

api/src/execution-manifest-request.test.ts

@@ -366,3 +366,25 @@ describe('execute request manifest validation', () => {
     }), 'malformed');
   });
 });
+
+describe('agent_run manifest subject', () => {
+  const { user_id: _userId, ...withoutUser } = claims({
+    principal_source: 'agent_run',
+    session_key: 'session:opaque',
+  });
+
+  test('accepts an agent_run manifest that carries agent_id and run_id and no user_id', () => {
+    const token = signExecutionManifest({ ...withoutUser, agent_id: 'agent:opaque', run_id: 'run:opaque' }, SECRET);
+    expect(verifyExecutionManifest(token, SECRET, { nowSeconds: 150 })).toMatchObject({
+      principal_source: 'agent_run',
+      agent_id: 'agent:opaque',
+      run_id: 'run:opaque',
+    });
+  });
+
+  test('refuses an ambiguous or incomplete subject', () => {
+    expect(() => signExecutionManifest({ ...withoutUser, agent_id: 'a', run_id: 'r', user_id: 'u' }, SECRET)).toThrow(ExecutionManifestError);
+    expect(() => signExecutionManifest({ ...withoutUser, agent_id: 'a' }, SECRET)).toThrow(ExecutionManifestError);
+    expect(() => signExecutionManifest(claims({ agent_id: 'a', run_id: 'r' }), SECRET)).toThrow(ExecutionManifestError);
+  });
+});

api/src/execution-manifest.ts

@@ -61,7 +61,10 @@ export interface ExecutionManifestClaims {
   v: typeof EXECUTION_MANIFEST_VERSION;
   exec_id: string;
   tenant_id: string;
-  user_id: string;
+  /** Personal subject. Absent for agent_run, which carries agent_id/run_id. */
+  user_id?: string;
+  agent_id?: string;
+  run_id?: string;
   session_key: string;
   input_files: ExecutionManifestInputFile[];
   read_sessions: string[];
@@ -174,10 +177,15 @@ function validateClaimsShape(value: unknown): asserts value is ExecutionManifest
     throw new ExecutionManifestError('malformed', 'Execution manifest claims must be an object');
   }
 
+  /* Exactly one subject: a user, or an agent_run (agent_id + run_id). */
+  const isAgentRun = claims.principal_source === 'agent_run';
+  if (isAgentRun ? claims.user_id !== undefined : claims.agent_id !== undefined || claims.run_id !== undefined) {
+    throw new ExecutionManifestError('malformed', 'Execution manifest subject is ambiguous');
+  }
   const stringFields: Array<keyof ExecutionManifestClaims> = [
     'exec_id',
     'tenant_id',
-    'user_id',
+    ...(isAgentRun ? (['agent_id', 'run_id'] as const) : (['user_id'] as const)),
     'session_key',
     'output_session_id',
   ];