fix(mobile): replay the gated turn's effective config on approval resume

The lite resume answered a HITL gate with a references-only body, so the SDK
hydrated the referenced variant's HEAD revision. For a dirty run that is a
different model and — the security-relevant half — a different tool-permission
map than the gate was approved under.

The runner now stamps the turn's post-hydration config onto the interaction row
as data.parameters. Read it off the same row the references come from and send
it inline, which suppresses hydration and reproduces the turn exactly.

Emit the key ONLY when the stamped config is a non-empty object: an empty {}
also suppresses hydration and would run an unconfigured agent. Rows without it
(legacy, over-cap, pre-stamping runner) keep today's references-only path.

Declare parameters on the interaction zod schema too — objects strip unknown
keys by default, so an undeclared field would be silently dropped and the fix
would no-op with everything green.

Author: ardaerzin

web/mobile/src/features/chat/useApprovalActions.ts

@@ -42,9 +42,16 @@ const sanitizeReferences = (
     return Object.keys(out).length > 0 ? out : null
 }
 
+/** The gated turn's stamped effective config, or null when the row predates stamping. */
+const sanitizeParameters = (raw: unknown): Record<string, unknown> | null => {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null
+    const params = raw as Record<string, unknown>
+    return Object.keys(params).length > 0 ? params : null
+}
+
 /**
  * Approve/deny pending HITL gates from the phone — the lite resume path (plan M1.3):
- * fresh records → stamp `approval-responded` on the tail → ONE references-only invoke POST
+ * fresh records → stamp `approval-responded` on the tail → ONE resume invoke POST
  * (`buildAgentResumeRequest`), fire-and-forget. No live SSE consumption: the response is
  * drained in the background and the tightened records poll repaints the transcript until the
  * turn settles (`phase` drops back to idle once no gate is pending).
@@ -96,8 +103,8 @@ export const useApprovalActions = ({
                 if (stamped === messages) {
                     throw new Error("This approval is no longer pending — refresh and retry.")
                 }
-                // The interaction row stores the run's role-keyed workflow references —
-                // the resolver hydrates config from them server-side (references-only body).
+                // The interaction row stores the run's role-keyed workflow references and,
+                // when the runner stamped it, the turn's effective config.
                 const interactions = await queryInteractions({
                     sessionId,
                     projectId,
@@ -112,7 +119,13 @@ export const useApprovalActions = ({
                 const matched = answeredId
                     ? withRefs.find((row) => row.token === answeredId)
                     : undefined
-                const references = sanitizeReferences((matched ?? withRefs[0])?.data?.references)
+                const row = matched ?? withRefs[0]
+                const references = sanitizeReferences(row?.data?.references)
+                // Replay the turn's own config when the runner stamped it — references alone
+                // hydrate the variant's HEAD, which is a different model and, worse, a
+                // different tool-permission map than the gate was approved under. Rows without
+                // it (legacy, over-cap, pre-restart runner) fall back to hydration silently.
+                const parameters = sanitizeParameters(row?.data?.parameters)
                 if (!references) {
                     throw new Error(
                         "This approval carries no workflow reference — answer on desktop.",
@@ -132,6 +145,7 @@ export const useApprovalActions = ({
                     references,
                     sessionId,
                     messages: stamped,
+                    parameters,
                     projectId,
                     applicationId: references.application?.id ?? undefined,
                 })

web/packages/agenta-chat/src/transport/agentResumeRequest.ts

@@ -1,13 +1,19 @@
 /**
- * Lite agent resume request — the references-only invoke body for answering a HITL approval
- * without the hydrated workflow molecule (mobile, or any client that can't run the full
+ * Lite agent resume request — the invoke body for answering a HITL approval without the
+ * hydrated workflow molecule (mobile, or any client that can't run the full
  * `buildAgentRequest` pipeline).
  *
- * Load-bearing invariant: the body carries NO `data.parameters`. The SDK resolver hydrates the
- * config server-side ONLY when the request has `references` and no `data.parameters`
- * (`sdks/python/agenta/sdk/middlewares/running/resolver.py` `needs_reference_hydration`), so
- * emitting a `parameters` key — even empty — would skip hydration and run an unconfigured
- * draft. The unit test pins this.
+ * Load-bearing invariant: the body carries NO `parameters` key unless we are deliberately
+ * replaying the gated turn's stamped effective config (the interaction row's
+ * `data.parameters`, written by the runner from the SDK's `effectiveParameters`). The SDK
+ * resolver hydrates config server-side ONLY when the request has `references` and no
+ * `data.parameters` (`sdks/python/agenta/sdk/middlewares/running/resolver.py`
+ * `needs_reference_hydration`), so:
+ *   - non-empty stamped parameters  -> emit them; hydration is skipped and the resume runs
+ *     under the exact config the gated turn ran under (including its tool permissions);
+ *   - absent / empty parameters     -> emit NO key at all; an empty `{}` would suppress
+ *     hydration and run an unconfigured agent, which is worse than the wrong revision.
+ * The unit tests pin both directions.
  */
 
 /** A `{id, slug, version}` platform reference (values may be partial). */
@@ -26,6 +32,9 @@ export interface AgentResumeRequestArgs {
     sessionId: string
     /** The full v6 UIMessage history with the approval decision stamped on the tail. */
     messages: unknown[]
+    /** The gated turn's stamped effective config (interaction row `data.parameters`). Sent
+     * inline to replay that exact config; omit/empty falls back to reference hydration. */
+    parameters?: Record<string, unknown> | null
     /** ALWAYS rides the query string — the invoke routing middleware reads it for cookie-auth
      * permission checks (auth.py). Do not copy desktop's Authorization-gated omission. */
     projectId?: string
@@ -38,10 +47,19 @@ export interface AgentResumeRequest {
     requestBody: {
         session_id: string
         references: Record<string, AgentResumeReference> | null
-        data: {inputs: {messages: unknown[]}}
+        data: {inputs: {messages: unknown[]}; parameters?: Record<string, unknown>}
     }
 }
 
+/** A stamped config is replayable only if it is a plain object with at least one key. */
+const hasStampedConfig = (
+    parameters: Record<string, unknown> | null | undefined,
+): parameters is Record<string, unknown> =>
+    !!parameters &&
+    typeof parameters === "object" &&
+    !Array.isArray(parameters) &&
+    Object.keys(parameters).length > 0
+
 const withQuery = (url: string, params: Record<string, string | undefined>): string => {
     const qs = new URLSearchParams()
     for (const [key, value] of Object.entries(params)) {
@@ -51,12 +69,13 @@ const withQuery = (url: string, params: Record<string, string | undefined>): str
     return suffix ? `${url}${url.includes("?") ? "&" : "?"}${suffix}` : url
 }
 
-/** Compose the references-only resume invoke request (see module docstring). */
+/** Compose the resume invoke request (see module docstring). */
 export const buildAgentResumeRequest = ({
     invocationUrl,
     references,
     sessionId,
     messages,
+    parameters,
     projectId,
     applicationId,
 }: AgentResumeRequestArgs): AgentResumeRequest => ({
@@ -73,6 +92,8 @@ export const buildAgentResumeRequest = ({
     requestBody: {
         session_id: sessionId,
         references,
-        data: {inputs: {messages}},
+        // Spread, never assign: an explicit `parameters: undefined` still creates the key,
+        // and `JSON.stringify` dropping it is not enough for a structural caller.
+        data: {inputs: {messages}, ...(hasStampedConfig(parameters) ? {parameters} : {})},
     },
 })

web/packages/agenta-chat/tests/unit/transport/agentResumeRequest.test.ts

@@ -10,11 +10,41 @@ const baseArgs = {
 }
 
 describe("buildAgentResumeRequest", () => {
-    it("never emits a data.parameters key (references-only server-side hydration)", () => {
-        const req = buildAgentResumeRequest(baseArgs)
-        expect("parameters" in req.requestBody.data).toBe(false)
-        // Belt-and-braces: the serialized wire body must not carry the key either.
-        expect(JSON.stringify(req.requestBody)).not.toContain('"parameters"')
+    // The hydration switch: a `parameters` key — even empty — makes the SDK resolver skip
+    // reference hydration, so it must appear ONLY when we have a real config to replay.
+    describe("data.parameters (hydration switch)", () => {
+        it("omits the key entirely when no parameters are supplied", () => {
+            const req = buildAgentResumeRequest(baseArgs)
+            expect("parameters" in req.requestBody.data).toBe(false)
+            // Belt-and-braces: the serialized wire body must not carry the key either.
+            expect(JSON.stringify(req.requestBody)).not.toContain('"parameters"')
+        })
+
+        it.each([
+            ["undefined", undefined],
+            ["null", null],
+            ["an empty object", {}],
+        ])(
+            "omits the key when parameters is %s (an empty {} would run unconfigured)",
+            (_label, parameters) => {
+                const req = buildAgentResumeRequest({...baseArgs, parameters})
+                expect("parameters" in req.requestBody.data).toBe(false)
+                expect(JSON.stringify(req.requestBody)).not.toContain('"parameters"')
+            },
+        )
+
+        it("emits the stamped effective config verbatim when it is non-empty", () => {
+            const parameters = {agent: {llm: {model: "anthropic/claude-sonnet-4-5"}}}
+            const req = buildAgentResumeRequest({...baseArgs, parameters})
+            expect("parameters" in req.requestBody.data).toBe(true)
+            expect(req.requestBody.data.parameters).toBe(parameters)
+        })
+
+        it("still sends references alongside inline parameters", () => {
+            const req = buildAgentResumeRequest({...baseArgs, parameters: {agent: {}}})
+            expect(req.requestBody.references).toEqual({workflow_revision: {id: "rev-1"}})
+            expect(req.requestBody.data.inputs.messages).toBe(baseArgs.messages)
+        })
     })
 
     it("carries the session id, references, and messages under data.inputs", () => {

web/packages/agenta-entities/src/session/core/schema.ts

@@ -60,6 +60,11 @@ export const sessionInteractionSchema = z.object({
         .object({
             request: z.record(z.string(), z.unknown()).nullish(),
             references: z.record(z.string(), z.unknown()).nullish(),
+            // The gated turn's stamped effective config; must be declared or zod's default
+            // strip-unknown-keys would silently drop it and the resume falls back to
+            // reference hydration (i.e. the wrong config). Rows written before the runner
+            // started stamping simply have no key.
+            parameters: z.record(z.string(), z.unknown()).nullish(),
             selector: z.record(z.string(), z.unknown()).nullish(),
             resolution: z.record(z.string(), z.unknown()).nullish(),
         })

web/packages/agenta-entities/tests/unit/session-interaction-schema.test.ts

@@ -0,0 +1,66 @@
+/**
+ * Pins the interaction row's `data.parameters` — the gated turn's stamped effective config.
+ * zod objects strip unknown keys by default, so an undeclared field validates fine and
+ * arrives as `undefined`: the resume would silently fall back to reference hydration and run
+ * the committed config (wrong model, wrong tool permissions) with tsc and tests all green.
+ * These assert the field survives parsing, and that legacy rows without it still parse.
+ */
+import {describe, expect, it} from "vitest"
+
+import {
+    sessionInteractionSchema,
+    sessionInteractionsResponseSchema,
+} from "../../src/session/core/schema"
+
+const effectiveParameters = {
+    agent: {
+        llm: {model: "anthropic/claude-sonnet-4-5", provider: "anthropic"},
+        runner: {kind: "sidecar", permissions: {default: "allow_reads"}},
+    },
+}
+
+const wireInteraction = {
+    id: "int-1",
+    session_id: "sess-1",
+    turn_id: "turn-1",
+    token: "tok-1",
+    kind: "user_approval",
+    status: "pending",
+    created_at: "2026-07-29T00:00:00Z",
+    data: {
+        request: {tool: "Bash", args: {command: "echo hi"}},
+        references: {workflow: {id: "wf-1", slug: "agent"}},
+        parameters: effectiveParameters,
+    },
+}
+
+describe("sessionInteractionSchema", () => {
+    it("keeps data.parameters (the stamped effective config) verbatim", () => {
+        const out = sessionInteractionSchema.parse(wireInteraction)
+        expect(out.data?.parameters).toEqual(effectiveParameters)
+    })
+
+    it("keeps request and references alongside parameters", () => {
+        const out = sessionInteractionSchema.parse(wireInteraction)
+        expect(out.data?.references).toEqual({workflow: {id: "wf-1", slug: "agent"}})
+        expect(out.data?.request).toEqual({tool: "Bash", args: {command: "echo hi"}})
+    })
+
+    it("parses a legacy row that carries no parameters (pre-stamping runner)", () => {
+        const legacy = {
+            ...wireInteraction,
+            data: {references: {workflow: {id: "wf-1"}}},
+        }
+        const out = sessionInteractionSchema.parse(legacy)
+        expect(out.data?.parameters).toBeUndefined()
+        expect(out.data?.references).toEqual({workflow: {id: "wf-1"}})
+    })
+
+    it("carries parameters through the query response envelope", () => {
+        const out = sessionInteractionsResponseSchema.parse({
+            count: 1,
+            interactions: [wireInteraction],
+        })
+        expect(out.interactions?.[0].data?.parameters).toEqual(effectiveParameters)
+    })
+})