fix: harden runtime stream and approval handling

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/adapter-utils/src/server-utils.ts

@@ -1151,7 +1151,8 @@ export async function runChildProcess(
 
         child.stdout?.on("data", (chunk: unknown) => {
           const readable = child.stdout;
-          readable?.pause();
+          if (!readable) return;
+          readable.pause();
           const text = String(chunk);
           stdout = appendWithCap(stdout, text);
           logChain = logChain
@@ -1162,7 +1163,8 @@ export async function runChildProcess(
 
         child.stderr?.on("data", (chunk: unknown) => {
           const readable = child.stderr;
-          readable?.pause();
+          if (!readable) return;
+          readable.pause();
           const text = String(chunk);
           stderr = appendWithCap(stderr, text);
           logChain = logChain

server/src/__tests__/agent-permissions-routes.test.ts

@@ -538,7 +538,10 @@ describe("agent permission routes", () => {
       status: "idle",
     };
     mockAgentService.getById.mockResolvedValue(pendingAgent);
-    mockAgentService.activatePendingApproval.mockResolvedValue(approvedAgent);
+    mockAgentService.activatePendingApproval.mockResolvedValue({
+      agent: approvedAgent,
+      activated: true,
+    });
 
     const app = await createApp({
       type: "board",

server/src/routes/agents.ts

@@ -2130,11 +2130,16 @@ export function agentRoutes(db: Db) {
       return;
     }
 
-    const agent = await svc.activatePendingApproval(id);
-    if (!agent) {
+    const approval = await svc.activatePendingApproval(id);
+    if (!approval) {
       res.status(404).json({ error: "Agent not found" });
       return;
     }
+    if (!approval.activated) {
+      res.status(409).json({ error: "Only pending approval agents can be approved" });
+      return;
+    }
+    const { agent } = approval;
 
     await logActivity(db, {
       companyId: agent.companyId,

server/src/services/agents.ts

@@ -526,18 +526,19 @@ export function agentService(db: Db) {
     },
 
     activatePendingApproval: async (id: string) => {
-      const existing = await getById(id);
-      if (!existing) return null;
-      if (existing.status !== "pending_approval") return existing;
-
       const updated = await db
         .update(agents)
         .set({ status: "idle", updatedAt: new Date() })
-        .where(eq(agents.id, id))
+        .where(and(eq(agents.id, id), eq(agents.status, "pending_approval")))
         .returning()
         .then((rows) => rows[0] ?? null);
 
-      return updated ? normalizeAgentRow(updated) : null;
+      if (updated) {
+        return { agent: normalizeAgentRow(updated), activated: true };
+      }
+
+      const existing = await getById(id);
+      return existing ? { agent: existing, activated: false } : null;
     },
 
     updatePermissions: async (id: string, permissions: { canCreateAgents: boolean }) => {