Wire project run cancel through Gateway routes

Author: lookmanrays

internal/connector/project_requests.go

@@ -48,6 +48,10 @@ func (c *Client) handleProjectRequest(ctx context.Context, cfg *Config, request
 		service := localexec.NewService()
 		report, err := service.GetRun(ctx, localexec.RunOptions{BaseOptions: projectBaseOptions(cfg, project), RunID: tail[1]})
 		return projectExecutionResponse(response, report, err)
+	case len(tail) == 3 && tail[0] == "runs" && tail[2] == "cancel" && request.Method == http.MethodPost:
+		service := localexec.NewService()
+		report, err := service.CancelRun(ctx, localexec.RunOptions{BaseOptions: projectBaseOptions(cfg, project), RunID: tail[1]})
+		return projectExecutionResponse(response, report, err)
 	case len(tail) == 1 && tail[0] == "submit" && request.Method == http.MethodPost:
 		opts, err := decodeProjectSubmit(projectBaseOptions(cfg, project), request.Body)
 		if err != nil {

internal/connector/session_test.go

@@ -182,6 +182,7 @@ func TestClientHandleProjectRequestStartsRunThroughLocalexec(t *testing.T) {
 	}
 
 	var daemon *httptest.Server
+	var cancelled atomic.Bool
 	daemon = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/api/v1/instance":
@@ -193,6 +194,16 @@ func TestClientHandleProjectRequestStartsRunThroughLocalexec(t *testing.T) {
 			}
 			w.WriteHeader(http.StatusCreated)
 			_ = json.NewEncoder(w).Encode(domain.Run{ID: "run-1", ProjectID: "proj", State: domain.RunStateRunning})
+		case "/api/v1/runs/run-1":
+			switch r.Method {
+			case http.MethodPatch:
+				cancelled.Store(true)
+				_ = json.NewEncoder(w).Encode(domain.Run{ID: "run-1", ProjectID: "proj", State: domain.RunStateCancelled})
+			case http.MethodGet:
+				_ = json.NewEncoder(w).Encode(domain.Run{ID: "run-1", ProjectID: "proj", State: domain.RunStateCancelled})
+			default:
+				http.NotFound(w, r)
+			}
 		default:
 			http.NotFound(w, r)
 		}
@@ -230,6 +241,21 @@ func TestClientHandleProjectRequestStartsRunThroughLocalexec(t *testing.T) {
 	if !strings.Contains(string(response.Body), `"run-1"`) || !strings.Contains(string(response.Body), `"started"`) {
 		t.Fatalf("unexpected project response: %s", string(response.Body))
 	}
+
+	response = client.handleRequest(context.Background(), relayproto.CommandRequest{
+		RequestID: "req-project-cancel",
+		Method:    http.MethodPost,
+		Path:      "/codencer/v1/projects/proj/runs/run-1/cancel",
+	})
+	if response.StatusCode != http.StatusOK {
+		t.Fatalf("expected ok cancel response, got %+v", response)
+	}
+	if !cancelled.Load() {
+		t.Fatal("expected project cancel request to reach daemon run cancel endpoint")
+	}
+	if !strings.Contains(string(response.Body), `"run-1"`) || !strings.Contains(string(response.Body), `"cancelled"`) {
+		t.Fatalf("unexpected project cancel response: %s", string(response.Body))
+	}
 }
 
 func TestClientHandleRequestRejectsUnsafeStepPath(t *testing.T) {

internal/gateway/api.go

@@ -784,6 +784,10 @@ func (s *Server) handleProjectByID(w http.ResponseWriter, r *http.Request) {
 		s.handleProjectRunReportGet(w, r, projectID, parts[2])
 		return
 	}
+	if len(parts) == 4 && parts[1] == "runs" && parts[3] == "cancel" {
+		s.handleProjectRunCancel(w, r, projectID, parts[2])
+		return
+	}
 	if len(parts) > 1 {
 		writeAPIError(w, http.StatusNotFound, "route_not_found", "project route not found")
 		return
@@ -907,6 +911,57 @@ func (s *Server) handleProjectRunReportGet(w http.ResponseWriter, r *http.Reques
 	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "project_id": projectID, "run_id": runID, "run_history_id": runRecord.ID, "result": payload})
 }
 
+func (s *Server) handleProjectRunCancel(w http.ResponseWriter, r *http.Request, projectID, runID string) {
+	if r.Method != http.MethodPost {
+		writeAPIError(w, http.StatusMethodNotAllowed, "method_not_allowed", "method not allowed")
+		return
+	}
+	principal, ok := s.authenticateConsoleAPI(w, r, []string{"projects:read", "runs:write"})
+	if !ok {
+		return
+	}
+	args := map[string]any{"project_id": projectID, "run_id": runID}
+	var req map[string]any
+	if r.Body != nil {
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil && err != io.EOF {
+			writeAPIError(w, http.StatusBadRequest, "malformed_request", err.Error())
+			return
+		}
+	}
+	for key, value := range req {
+		args[key] = value
+	}
+	for _, key := range []string{"relay_profile_id", "machine_id", "host_label"} {
+		if value := strings.TrimSpace(r.URL.Query().Get(key)); value != "" {
+			args[key] = value
+		}
+	}
+	match, apiErr := s.resolveProject(r.Context(), principal, projectID, args, true)
+	if apiErr != nil {
+		s.recordGatewayAuditWithMetadata(r.Context(), principal, "cancel_project_run_requested", "Run cancel route resolution failed for project "+projectID+": "+apiErr.Code, map[string]any{"project_id": projectID, "run_id": runID})
+		writeAPIError(w, apiErr.Status, apiErr.Code, apiErr.Message)
+		return
+	}
+	auditMetadata := projectLifecycleAuditMetadata(match, args)
+	s.recordGatewayAuditWithMetadata(r.Context(), principal, "cancel_project_run_requested", "Requested cancel_project_run for run "+runID+" in project "+projectID, auditMetadata)
+	path, body, apiErr := cancelProjectRunRoute(args)
+	if apiErr != nil {
+		writeAPIError(w, apiErr.Status, apiErr.Code, apiErr.Message)
+		return
+	}
+	path = appendSelector(path, args)
+	_, response, apiErr := s.callRelay(r.Context(), match.Profile, http.MethodPost, path, body)
+	payload, apiErr := responsePayload(match.Profile, response, apiErr)
+	if apiErr != nil {
+		s.recordGatewayAuditWithMetadata(r.Context(), principal, "run_failed", "Run cancel failed for project "+projectID+": "+apiErr.Code, auditMetadata)
+		writeAPIError(w, apiErr.Status, apiErr.Code, apiErr.Message)
+		return
+	}
+	runRecord, auditMetadata := s.refreshRunRecordFromLifecyclePayload(r.Context(), principal, match, args, payload, reportStatusForPayload(payload, "available"))
+	s.recordGatewayAuditWithMetadata(r.Context(), principal, terminalAuditType(payload), terminalAuditSummary(projectID, payload), auditMetadata)
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true, "project_id": projectID, "run_id": runID, "run_history_id": runRecord.ID, "result": payload})
+}
+
 func (s *Server) handleAuditEvents(w http.ResponseWriter, r *http.Request) {
 	if apiErr := s.requireStore(); apiErr != nil {
 		writeAPIError(w, apiErr.Status, apiErr.Code, apiErr.Message)

internal/gateway/gateway_test.go

@@ -235,6 +235,11 @@ func TestGatewayMCPAsyncLifecycleTools(t *testing.T) {
 		t.Fatalf("expected async start response, got %s", startedBody)
 	}
 	assertNoGatewayMCPLeak(t, startedBody)
+	startedPayload, _ := mcpStructuredContent(t, started).(map[string]any)
+	startedRunHistoryID := stringValueFromAny(startedPayload["run_history_id"])
+	if startedRunHistoryID == "" {
+		t.Fatalf("start response did not return run_history_id: %s", startedBody)
+	}
 
 	asyncSubmit := mcpToolCall(t, server.URL, session, "codencer.submit_project_task", map[string]any{
 		"relay_profile_id": "default",
@@ -291,13 +296,22 @@ func TestGatewayMCPAsyncLifecycleTools(t *testing.T) {
 		"relay_profile_id": "default",
 		"project_id":       "codencer",
 		"run_id":           "run-async-gateway-test",
-		"run_history_id":   runHistoryID,
+		"run_history_id":   startedRunHistoryID,
 	})
 	cancelBody := mustJSON(t, cancel)
-	if !strings.Contains(cancelBody, `"type":"unsupported_operation"`) || !strings.Contains(cancelBody, `"operation":"cancel_project_run"`) {
-		t.Fatalf("expected structured cancel capability blocker, got %s", cancelBody)
+	if !strings.Contains(cancelBody, `"status":"cancelled"`) || !strings.Contains(cancelBody, `"run_id":"run-async-gateway-test"`) {
+		t.Fatalf("expected forwarded cancel response, got %s", cancelBody)
 	}
 	assertNoGatewayMCPLeak(t, cancelBody)
+	cancelEvents := mcpToolCall(t, server.URL, session, "codencer.get_gateway_run_events", map[string]any{
+		"run_history_id": startedRunHistoryID,
+		"limit":          20,
+	})
+	cancelEventsBody := mustJSON(t, cancelEvents)
+	if !strings.Contains(cancelEventsBody, `"cancel_project_run_requested"`) || !strings.Contains(cancelEventsBody, `"run_cancelled"`) {
+		t.Fatalf("expected cancel lifecycle audit events, got %s", cancelEventsBody)
+	}
+	assertNoGatewayMCPLeak(t, cancelEventsBody)
 
 	resume := mcpToolCall(t, server.URL, session, "codencer.resume_project_run", map[string]any{
 		"relay_profile_id": "default",
@@ -632,6 +646,17 @@ func TestGatewayStoreDeviceLoginRelayRegistryAndConnectorBinding(t *testing.T) {
 		t.Fatalf("async report endpoint returned run_history_id=%v want %s: %s", asyncReport["run_history_id"], asyncRunHistoryID, asyncReportBody)
 	}
 	assertNoGatewayMCPLeak(t, asyncReportBody)
+	cancelResult := apiPost[map[string]any](t, httpServer.URL+"/api/gateway/v1/projects/codencer/runs/run-async-console/cancel?relay_profile_id=default&machine_id=mach-1", token.AccessToken, map[string]any{
+		"reason": "operator requested stop",
+	})
+	cancelResultBody := mustJSON(t, cancelResult)
+	if !strings.Contains(cancelResultBody, `"status":"cancelled"`) || !strings.Contains(cancelResultBody, `"run_id":"run-async-console"`) {
+		t.Fatalf("project run cancel endpoint did not cancel through relay: %s", cancelResultBody)
+	}
+	if cancelResult["run_history_id"] != asyncRunHistoryID {
+		t.Fatalf("cancel endpoint returned run_history_id=%v want %s: %s", cancelResult["run_history_id"], asyncRunHistoryID, cancelResultBody)
+	}
+	assertNoGatewayMCPLeak(t, cancelResultBody)
 	report := apiGet[map[string]any](t, httpServer.URL+"/api/gateway/v1/projects/codencer/runs/run-gateway-test/report?relay_profile_id=default&machine_id=mach-1", token.AccessToken)
 	reportBody := mustJSON(t, report)
 	if !strings.Contains(reportBody, `"status":"completed"`) || !strings.Contains(reportBody, `"run_id":"run-gateway-test"`) {
@@ -957,6 +982,24 @@ func newFakeRelay(t *testing.T, opts fakeRelayOptions) *fakeRelay {
 			"report_path": "/tmp/codencer/run-plans/run-async-gateway-test.json",
 		})
 	})
+	mux.HandleFunc("/api/v2/projects/codencer/runs/run-async-gateway-test/cancel", func(w http.ResponseWriter, r *http.Request) {
+		requireRelayAuth(t, r)
+		if r.Method != http.MethodPost {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		writeTestJSON(t, w, map[string]any{
+			"ok":     true,
+			"run_id": "run-async-gateway-test",
+			"status": "cancelled",
+			"run": map[string]any{
+				"id":    "run-async-gateway-test",
+				"state": "cancelled",
+			},
+			"repo_root":   "/Users/example/codencer",
+			"report_path": "/tmp/codencer/run-plans/run-async-gateway-test.json",
+		})
+	})
 	mux.HandleFunc("/api/v2/projects/codencer/run-plan", func(w http.ResponseWriter, r *http.Request) {
 		requireRelayAuth(t, r)
 		relay.lastMachineID = r.URL.Query().Get("machine_id")
@@ -1066,6 +1109,23 @@ func newFakeRelay(t *testing.T, opts fakeRelayOptions) *fakeRelay {
 			}},
 		})
 	})
+	mux.HandleFunc("/api/v2/projects/codencer/runs/run-async-console/cancel", func(w http.ResponseWriter, r *http.Request) {
+		requireRelayAuth(t, r)
+		if r.Method != http.MethodPost {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		writeTestJSON(t, w, map[string]any{
+			"ok":     true,
+			"run_id": "run-async-console",
+			"status": "cancelled",
+			"run": map[string]any{
+				"id":    "run-async-console",
+				"state": "cancelled",
+			},
+			"report_path": "/Users/example/.codencer-live-test/artifacts/run-plans/run-async-console.json",
+		})
+	})
 	mux.HandleFunc("/api/v2/projects/codencer/reports/run-plans/run-gateway-test", func(w http.ResponseWriter, r *http.Request) {
 		requireRelayAuth(t, r)
 		writeTestJSON(t, w, map[string]any{

internal/gateway/run_history.go

@@ -71,6 +71,10 @@ func (s *Server) finishRunRecord(ctx context.Context, record RunRecord, payload
 }
 
 func (s *Server) refreshRunRecordFromReport(ctx context.Context, principal *authPrincipal, match relayProjectMatch, args map[string]any, payload any) (RunRecord, map[string]any) {
+	return s.refreshRunRecordFromLifecyclePayload(ctx, principal, match, args, payload, reportStatusForPayload(payload, "completed"))
+}
+
+func (s *Server) refreshRunRecordFromLifecyclePayload(ctx context.Context, principal *authPrincipal, match relayProjectMatch, args map[string]any, payload any, reportStatus string) (RunRecord, map[string]any) {
 	if s.store == nil || principal == nil || principal.WorkspaceID == "" {
 		return RunRecord{}, map[string]any{"project_id": match.Project.ProjectID, "run_id": stringArg(args, "run_id")}
 	}
@@ -95,7 +99,7 @@ func (s *Server) refreshRunRecordFromReport(ctx context.Context, principal *auth
 	}
 	record, _ = s.applyRouteToRunRecord(ctx, record, principal, match, args)
 	record.RunID = firstNonEmpty(record.RunID, runID)
-	return s.finishRunRecord(ctx, record, payload, reportStatusForPayload(payload, "completed"))
+	return s.finishRunRecord(ctx, record, payload, reportStatus)
 }
 
 func applyPayloadToRunRecord(record *RunRecord, payload any, reportStatus string) {
@@ -117,7 +121,8 @@ func applyPayloadToRunRecord(record *RunRecord, payload any, reportStatus string
 	}
 	record.ResultSummary = firstNonEmpty(resultSummaryFromPayload(obj), record.ResultSummary)
 	record.ResultDetails = firstNonEmpty(resultDetailsFromPayload(obj), record.ResultDetails, record.ResultSummary)
-	if terminalAuditType(obj) == "run_completed" || terminalAuditType(obj) == "run_failed" || terminalAuditType(obj) == "blocker" {
+	eventType := terminalAuditType(obj)
+	if eventType == "run_completed" || eventType == "run_failed" || eventType == "blocker" || eventType == "run_cancelled" {
 		record.CompletedAt = time.Now().UTC()
 	}
 }

internal/gateway/tools.go

@@ -155,7 +155,7 @@ func buildTools(server *Server) map[string]Tool {
 			return "/api/v2/projects/" + projectID + "/reports/run-plans/" + runID, nil, nil
 		}),
 		"codencer.get_gateway_run_events": server.gatewayRunEventsTool(),
-		"codencer.cancel_project_run":     server.unsupportedProjectLifecycleTool("codencer.cancel_project_run", "Return an explicit capability blocker for project-run cancellation when the selected route cannot cancel safely.", "cancel_project_run"),
+		"codencer.cancel_project_run":     server.projectForwardTool("codencer.cancel_project_run", "Cancel a shared project run through the selected Gateway relay.", []string{"project_id", "run_id"}, cancelProjectRunRoute),
 		"codencer.resume_project_run":     server.unsupportedProjectLifecycleTool("codencer.resume_project_run", "Return an explicit capability blocker for project-run resume when the selected route cannot resume safely.", "resume_project_run"),
 		"codencer.get_blocker": {
 			Name:        "codencer.get_blocker",
@@ -262,6 +262,10 @@ func (s *Server) projectForwardTool(name, description string, required []string,
 				return ToolResult{}, apiErr
 			}
 			path = appendSelector(path, args)
+			if name == "codencer.cancel_project_run" {
+				auditMetadata = projectLifecycleAuditMetadata(match, args)
+				s.recordGatewayAuditWithMetadata(ctx, principal, "cancel_project_run_requested", "Requested cancel_project_run for run "+requiredStringValue(args, "run_id")+" in project "+projectID, auditMetadata)
+			}
 			method := http.MethodGet
 			if body != nil {
 				method = http.MethodPost
@@ -275,6 +279,8 @@ func (s *Server) projectForwardTool(name, description string, required []string,
 				eventType := "run_failed"
 				if name == "codencer.get_run_report" {
 					eventType = "report_read"
+				} else if name == "codencer.cancel_project_run" {
+					auditMetadata = projectLifecycleAuditMetadata(match, args)
 				} else {
 					runRecord.Status = "failed"
 					runRecord.ResultSummary = "Gateway relay call failed: " + apiErr.Code
@@ -288,6 +294,10 @@ func (s *Server) projectForwardTool(name, description string, required []string,
 				_ = record
 				s.recordTerminalRunAuditOnce(ctx, principal, projectID, payload, metadata)
 				s.recordGatewayAuditWithMetadata(ctx, principal, "report_read", "Read run report "+requiredStringValue(args, "run_id")+" for project "+projectID, metadata)
+			} else if name == "codencer.cancel_project_run" {
+				record, metadata := s.refreshRunRecordFromLifecyclePayload(ctx, principal, match, args, payload, reportStatusForPayload(payload, "available"))
+				_ = record
+				s.recordGatewayAuditWithMetadata(ctx, principal, terminalAuditType(payload), terminalAuditSummary(projectID, payload), metadata)
 			} else if recordRun {
 				runRecord, auditMetadata = s.finishRunRecord(ctx, runRecord, payload, reportStatusForPayload(payload, "available"))
 				if obj, ok := payload.(map[string]any); ok && runRecord.ID != "" {
@@ -460,6 +470,28 @@ func selectedProjectLocation(project relayProject, args map[string]any) projectL
 	return projectLocation{}
 }
 
+func projectLifecycleAuditMetadata(match relayProjectMatch, args map[string]any) map[string]any {
+	metadata := map[string]any{
+		"project_id":       match.Project.ProjectID,
+		"run_id":           requiredStringValue(args, "run_id"),
+		"relay_profile_id": match.Profile.ID,
+	}
+	if runHistoryID := strings.TrimSpace(stringArg(args, "run_history_id")); runHistoryID != "" {
+		metadata["run_history_id"] = runHistoryID
+	}
+	location := selectedProjectLocation(match.Project, args)
+	for key, value := range map[string]string{
+		"connector_id": location.ConnectorID,
+		"machine_id":   location.MachineID,
+		"host_label":   location.HostLabel,
+	} {
+		if strings.TrimSpace(value) != "" {
+			metadata[key] = strings.TrimSpace(value)
+		}
+	}
+	return metadata
+}
+
 func resolvedExecutorLabel(project relayProject, args map[string]any) string {
 	return firstNonEmpty(
 		strings.TrimSpace(stringArg(args, "profile")),
@@ -491,6 +523,10 @@ func terminalAuditType(payload any) string {
 	switch status {
 	case "submitted", "started", "starting", "queued", "pending", "running", "in_progress", "validating":
 		return "run_started"
+	case "cancel_requested", "cancelling", "canceling":
+		return "run_cancel_requested"
+	case "cancelled", "canceled":
+		return "run_cancelled"
 	case "failed", "failed_adapter", "failed_bridge", "failed_validation", "timeout", "adapter_error", "bridge_error":
 		return "run_failed"
 	case "blocked", "question", "manual_approval_required", "needs_approval", "needs_manual_attention", "permission_request_required", "unsafe_action", "validation_failed":
@@ -510,6 +546,10 @@ func terminalAuditSummary(projectID string, payload any) string {
 		outcome = "failed"
 	case "blocker":
 		outcome = "reached blocker"
+	case "run_cancel_requested":
+		outcome = "cancel requested"
+	case "run_cancelled":
+		outcome = "cancelled"
 	}
 	if runID == "" {
 		return "Run " + outcome + " for project " + projectID
@@ -686,6 +726,24 @@ func getProjectRunRoute(args map[string]any) (string, []byte, *apiError) {
 	return "/api/v2/projects/" + projectID + "/runs/" + runID, nil, nil
 }
 
+func cancelProjectRunRoute(args map[string]any) (string, []byte, *apiError) {
+	projectID, apiErr := requiredString(args, "project_id")
+	if apiErr != nil {
+		return "", nil, apiErr
+	}
+	runID, apiErr := requiredString(args, "run_id")
+	if apiErr != nil {
+		return "", nil, apiErr
+	}
+	payload := map[string]any{}
+	copyOptional(payload, args, "reason")
+	body, apiErr := jsonBody(payload)
+	if apiErr != nil {
+		return "", nil, apiErr
+	}
+	return "/api/v2/projects/" + projectID + "/runs/" + runID + "/cancel", body, nil
+}
+
 func submitProjectTaskRoute(wait bool) func(map[string]any) (string, []byte, *apiError) {
 	return func(args map[string]any) (string, []byte, *apiError) {
 		projectID, apiErr := requiredString(args, "project_id")