fix(cloud-task): resume a terminal cloud run with the selected question answer

tatoalo · web-flow · commit b15cdd413154 · 2026-07-07T10:34:55.000+01:00
When a cloud run terminalizes with an unanswered question, its log carries a permission_request with no resolution, so the recovered card still renders — but clicking an answer sent a permission_response command that only proxies to an active sandbox. complete_task has already drained the pending permission promise, so the answer went nowhere.

Route answers on terminal cloud runs through the same path as a follow-up message instead: format the selected answer (question quoted above it) and hand it to sendCloudPrompt, which resumes the thread as a fresh run seeded with the message via resumeCloudRun. Plain approvals on a dead run are dropped rather than spinning a pointless run, and cancelling a stale card resolves locally without proxying a command.

Generated-By: PostHog Code
Task-Id: a25fda42-de0e-402e-9392-35c4fcc20bf3
diff --git a/packages/core/src/sessions/permissionResponse.test.ts b/packages/core/src/sessions/permissionResponse.test.ts
@@ -1,6 +1,7 @@
 import type { PermissionRequest } from "@posthog/shared";
 import { describe, expect, it } from "vitest";
 import {
+  formatPermissionAnswerPrompt,
   isOtherPermissionOption,
   planPermissionResponse,
 } from "./permissionResponse";
@@ -78,3 +79,74 @@ describe("planPermissionResponse", () => {
     expect(plan.resendPromptText).toBeNull();
   });
 });
+
+describe("formatPermissionAnswerPrompt", () => {
+  const questionPermission = (questions: Array<{ question: string }>) =>
+    ({
+      taskRunId: "run-1",
+      receivedAt: 0,
+      toolCall: {
+        toolCallId: "tool-1",
+        _meta: { codeToolKind: "question", questions },
+      },
+      options: [
+        { optionId: "option_0", name: "MIT", kind: "allow_once" },
+        { optionId: "option_1", name: "Apache 2.0", kind: "allow_once" },
+      ],
+    }) as unknown as PermissionRequest;
+
+  it("quotes each question above its answer", () => {
+    const prompt = formatPermissionAnswerPrompt(
+      questionPermission([{ question: "Which license should I use?" }]),
+      "option_0",
+      undefined,
+      { "Which license should I use?": "MIT" },
+    );
+    expect(prompt).toBe(
+      "Answering your earlier question:\n\n> Which license should I use?\n\nMIT",
+    );
+  });
+
+  it("carries every entry of a multi-question answers map", () => {
+    const prompt = formatPermissionAnswerPrompt(
+      questionPermission([{ question: "Q1?" }, { question: "Q2?" }]),
+      "option_0",
+      undefined,
+      { "Q1?": "A1", "Q2?": "A2" },
+    );
+    expect(prompt).toBe(
+      "Answering your earlier questions:\n\n> Q1?\n\nA1\n\n> Q2?\n\nA2",
+    );
+  });
+
+  it("falls back to the picked option label when no answers map is sent", () => {
+    const prompt = formatPermissionAnswerPrompt(
+      questionPermission([{ question: "Which license should I use?" }]),
+      "option_1",
+    );
+    expect(prompt).toBe(
+      "Answering your earlier question:\n\n> Which license should I use?\n\nApache 2.0",
+    );
+  });
+
+  it("uses free-text custom input for a question", () => {
+    const prompt = formatPermissionAnswerPrompt(
+      questionPermission([{ question: "Which license should I use?" }]),
+      "_other",
+      "BSD, actually",
+    );
+    expect(prompt).toBe(
+      "Answering your earlier question:\n\n> Which license should I use?\n\nBSD, actually",
+    );
+  });
+
+  it("returns null for a plain approval so no resume run is spun", () => {
+    const approval = makePermission([
+      { optionId: "allow", kind: "allow_once" },
+    ]);
+    expect(formatPermissionAnswerPrompt(approval, "allow")).toBeNull();
+    expect(
+      formatPermissionAnswerPrompt(approval, "reject", "not like this"),
+    ).toBeNull();
+  });
+});
diff --git a/packages/core/src/sessions/permissionResponse.ts b/packages/core/src/sessions/permissionResponse.ts
@@ -52,3 +52,92 @@ export function planPermissionResponse(
     resendPromptText: null,
   };
 }
+
+interface QuestionMeta {
+  codeToolKind?: unknown;
+  questions?: unknown;
+}
+
+function questionMeta(
+  permission: PermissionRequest | undefined,
+): QuestionMeta | null {
+  const meta = permission?.toolCall?._meta;
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) {
+    return null;
+  }
+  return meta as QuestionMeta;
+}
+
+export function isQuestionPermission(
+  permission: PermissionRequest | undefined,
+): boolean {
+  return questionMeta(permission)?.codeToolKind === "question";
+}
+
+function firstQuestionText(
+  permission: PermissionRequest | undefined,
+): string | null {
+  const questions = questionMeta(permission)?.questions;
+  if (!Array.isArray(questions)) {
+    return null;
+  }
+  for (const entry of questions) {
+    const question =
+      entry && typeof entry === "object"
+        ? (entry as { question?: unknown }).question
+        : undefined;
+    if (typeof question === "string" && question.trim()) {
+      return question.trim();
+    }
+  }
+  return null;
+}
+
+/**
+ * Builds the follow-up prompt that carries a question's selected answer into a
+ * resumed run. Once a cloud run has terminalized, its sandbox (and the pending
+ * permission promise inside it) is gone, so a permission_response command has
+ * nothing left to resolve — the answer travels as a fresh user message on a
+ * resume run instead. Each question is quoted above its answer so the agent can
+ * match the reply against the question(s) it parked before the run ended.
+ * Returns null when there is nothing meaningful to carry forward (a plain
+ * approval), so callers can drop the response rather than spin a pointless run.
+ */
+export function formatPermissionAnswerPrompt(
+  permission: PermissionRequest | undefined,
+  optionId: string,
+  customInput?: string,
+  answers?: Record<string, string>,
+): string | null {
+  const blocks: string[] = [];
+  for (const [question, answer] of Object.entries(answers ?? {})) {
+    if (question.trim() && answer.trim()) {
+      blocks.push(`> ${question.trim()}\n\n${answer.trim()}`);
+    }
+  }
+
+  if (blocks.length === 0) {
+    if (!isQuestionPermission(permission)) {
+      return null;
+    }
+    // A question answered without an answers map: free text, or a bare option pick.
+    const answerText =
+      customInput?.trim() ||
+      permission?.options
+        .find((option) => option.optionId === optionId)
+        ?.name?.trim();
+    if (!answerText) {
+      return null;
+    }
+    const question = firstQuestionText(permission);
+    blocks.push(question ? `> ${question}\n\n${answerText}` : answerText);
+  } else {
+    const extraInput = customInput?.trim();
+    if (extraInput && !blocks.some((block) => block.includes(extraInput))) {
+      blocks.push(extraInput);
+    }
+  }
+
+  const noun = blocks.length > 1 ? "questions" : "question";
+  return `Answering your earlier ${noun}:\n\n${blocks.join("\n\n")}`;
+}
diff --git a/packages/core/src/sessions/sessionService.ts b/packages/core/src/sessions/sessionService.ts
@@ -65,6 +65,7 @@ import {
   routeLocalConnect,
 } from "./connectRouting";
 import {
+  formatPermissionAnswerPrompt,
   type PermissionSelectionPlan,
   planPermissionResponse,
 } from "./permissionResponse";
@@ -3138,6 +3139,35 @@ export class SessionService {
     this.resolvePermission(session, toolCallId);
 
     try {
+      if (session.isCloud && isTerminalStatus(session.cloudStatus)) {
+        // The run is over: complete_task drained the sandbox's pending permission
+        // promise, and the permission_response command only proxies to an active
+        // sandbox — there is nothing left for it to resolve. Carry the selected
+        // answer forward as a user message instead: sendCloudPrompt routes
+        // terminal runs through resumeCloudRun, which spins a fresh run seeded
+        // with it.
+        this.cloudPermissionRequestIds.delete(toolCallId);
+        const answerPrompt = formatPermissionAnswerPrompt(
+          permission,
+          optionId,
+          customInput,
+          answers,
+        );
+        if (!answerPrompt) {
+          this.d.log.info(
+            "Dropped permission response for terminal cloud run",
+            { taskId, toolCallId, optionId },
+          );
+          return;
+        }
+        await this.sendCloudPrompt(session, answerPrompt);
+        this.d.log.info("Permission answer resumed terminal cloud run", {
+          taskId,
+          toolCallId,
+          optionId,
+        });
+        return;
+      }
       if (session.isCloud && cloudRequestId) {
         this.cloudPermissionRequestIds.delete(toolCallId);
         await this.sendCloudCommand(session, "permission_response", {
@@ -3195,6 +3225,12 @@ export class SessionService {
     this.resolvePermission(session, toolCallId);
 
     try {
+      if (session.isCloud && isTerminalStatus(session.cloudStatus)) {
+        // The run is over — the card was resolved locally above and there is no
+        // live permission promise left to reject.
+        this.cloudPermissionRequestIds.delete(toolCallId);
+        return;
+      }
       if (session.isCloud && cloudRequestId) {
         this.cloudPermissionRequestIds.delete(toolCallId);
         await this.sendCloudCommand(session, "permission_response", {
diff --git a/packages/ui/src/features/sessions/sessionServiceHost.test.ts b/packages/ui/src/features/sessions/sessionServiceHost.test.ts
@@ -4984,6 +4984,128 @@ describe("SessionService", () => {
         answers: undefined,
       });
     });
+
+    const mockTerminalCloudRun = () => {
+      mockAuthenticatedClient.getTaskRun.mockResolvedValue({
+        id: "run-123",
+        task: "task-123",
+        team: 123,
+        branch: "feature/cloud-run",
+        environment: "cloud",
+        status: "completed",
+        log_url: "https://example.com/logs/run-123",
+        error_message: null,
+        output: {},
+        state: {},
+        created_at: "2026-04-14T00:00:00Z",
+        updated_at: "2026-04-14T00:00:00Z",
+        completed_at: "2026-04-14T00:05:00Z",
+      });
+      mockAuthenticatedClient.runTaskInCloud.mockResolvedValue(
+        createMockTask({
+          latest_run: {
+            id: "run-456",
+            task: "task-123",
+            team: 123,
+            branch: "feature/cloud-run",
+            environment: "cloud",
+            status: "queued",
+            log_url: "https://example.com/logs/run-456",
+            error_message: null,
+            output: {},
+            state: {},
+            created_at: "2026-04-14T00:06:00Z",
+            updated_at: "2026-04-14T00:06:00Z",
+            completed_at: null,
+          } as Task["latest_run"],
+        }),
+      );
+    };
+
+    it("resumes a terminal cloud run with the selected answer as the prompt", async () => {
+      const service = getSessionService();
+      const permissions = new Map([
+        [
+          "tool-1",
+          {
+            taskRunId: "run-123",
+            receivedAt: Date.now(),
+            toolCall: {
+              toolCallId: "tool-1",
+              _meta: {
+                codeToolKind: "question",
+                questions: [{ question: "Which license should I use?" }],
+              },
+            },
+            options: [
+              { optionId: "option_0", name: "MIT", kind: "allow_once" },
+            ],
+          },
+        ],
+      ]);
+      mockSessionStoreSetters.getSessionByTaskId.mockReturnValue(
+        createMockSession({
+          isCloud: true,
+          cloudStatus: "completed",
+          cloudBranch: "feature/cloud-run",
+          pendingPermissions: permissions as AgentSession["pendingPermissions"],
+        }),
+      );
+      mockTerminalCloudRun();
+
+      await service.respondToPermission(
+        "task-123",
+        "tool-1",
+        "option_0",
+        undefined,
+        {
+          "Which license should I use?": "MIT",
+        },
+      );
+
+      // The dead run's permission promise can't be resolved — no command is proxied.
+      expect(mockTrpcCloudTask.sendCommand.mutate).not.toHaveBeenCalled();
+      expect(mockTrpcAgent.respondToPermission.mutate).not.toHaveBeenCalled();
+      expect(mockAuthenticatedClient.runTaskInCloud).toHaveBeenCalledWith(
+        "task-123",
+        "feature/cloud-run",
+        expect.objectContaining({
+          resumeFromRunId: "run-123",
+          pendingUserMessage:
+            "Answering your earlier question:\n\n> Which license should I use?\n\nMIT",
+        }),
+      );
+    });
+
+    it("drops a plain approval on a terminal cloud run instead of resuming", async () => {
+      const service = getSessionService();
+      const permissions = new Map([
+        [
+          "tool-1",
+          {
+            taskRunId: "run-123",
+            receivedAt: Date.now(),
+            toolCall: { toolCallId: "tool-1", kind: "execute" },
+            options: [{ optionId: "allow", name: "Allow", kind: "allow_once" }],
+          },
+        ],
+      ]);
+      mockSessionStoreSetters.getSessionByTaskId.mockReturnValue(
+        createMockSession({
+          isCloud: true,
+          cloudStatus: "completed",
+          pendingPermissions: permissions as AgentSession["pendingPermissions"],
+        }),
+      );
+      mockTerminalCloudRun();
+
+      await service.respondToPermission("task-123", "tool-1", "allow");
+
+      expect(mockSessionStoreSetters.setPendingPermissions).toHaveBeenCalled();
+      expect(mockTrpcCloudTask.sendCommand.mutate).not.toHaveBeenCalled();
+      expect(mockTrpcAgent.respondToPermission.mutate).not.toHaveBeenCalled();
+      expect(mockAuthenticatedClient.runTaskInCloud).not.toHaveBeenCalled();
+    });
   });
 
   describe("cancelPermission", () => {
@@ -5010,6 +5132,19 @@ describe("SessionService", () => {
         toolCallId: "tool-1",
       });
     });
+
+    it("resolves locally without proxying a command on a terminal cloud run", async () => {
+      const service = getSessionService();
+      mockSessionStoreSetters.getSessionByTaskId.mockReturnValue(
+        createMockSession({ isCloud: true, cloudStatus: "completed" }),
+      );
+
+      await service.cancelPermission("task-123", "tool-1");
+
+      expect(mockSessionStoreSetters.setPendingPermissions).toHaveBeenCalled();
+      expect(mockTrpcCloudTask.sendCommand.mutate).not.toHaveBeenCalled();
+      expect(mockTrpcAgent.cancelPermission.mutate).not.toHaveBeenCalled();
+    });
   });
 
   describe("setSessionConfigOption", () => {
