fix(web): the planning Stop reaches eve under the deployment's secret

Merged
DA
11d ago
+239-29

The bug

The planning Stop never cancelled Luke's turn in eve. The voice function's stopAsk and the hook's carried Stop both reach eve's cancel route under the deployment's CRON_SECRET with the account in x-luke-account, but deploymentActor (apps/web/server/hosted/brain-host/auth.ts) admitted only POST /eve/v1/session and POST /eve/v1/session/:id, and required a turn kind the cancel request never sends. Every cancel under the secret was refused with NOT_DEPLOYMENT_ACT before eve's route ran. eve's own cancel route (0.74.0) runs route auth and nothing else, so Luke's door was the whole refusal.

The fix

The actor admits a POST to a session's cancel route for the named account. A cancel opens no turn, so the turn table says nothing about it and it names no kind. What bounds it is the door's ownership check (ownedAuth), unchanged: a cancel on another account's session, or on a session no record attributes to anybody, is still refused as NOT_OWNER. Every other route and kind under the secret stays refused. The refusal's wording now names the stop.

Tests (each fails without the fix)

  • hosted-brain-host-access.test.ts: the actor mints the deployment principal for the cancel route and still refuses a GET on it, compact, reset, stream, and info; the door admits the cancel on the account's recorded session and refuses it on another account's and on an unrecorded one; the host's own eveSessions client's cancel walks the real door over a fake HttpClient and comes back accepted for the account's session and 403 for another's, while the same client still opens only the turns the table admits.
  • voice-live-brain.test.ts: the hosted live brain's cancelRun (what the stop key calls through stopAsk) is the request the real door admits, and the run is told cancelled with the row stamped. The stop key to cancelRun link is already held by live-session-service.test.ts.

apps/web/server/README.md and the door's comments describe the new rule.

Verification

./scripts/check.sh exits 0. No UI or Mac change; verify.sh was waived for this work and CI could not verify it.

šŸ¤– Generated with Claude Code

Open workspace in Conductor

Devin Review