@opengeni/db 0.2.0

package/drizzle/0028_codex_multi_account.sql

@@ -0,0 +1,85 @@
+-- 0028_codex_multi_account.sql
+-- Multi-account P1: N Codex subscriptions per workspace + a per-workspace active
+-- pointer + per-session pin/actual. Additive; relaxes (does not drop) uniqueness.
+--
+-- Runs under the runner's pg_advisory_lock(727458), so no app traffic observes
+-- the relaxed window or the NO FORCE backfill window below.
+
+-- 1. Per-account label/email metadata (plaintext, non-secret).
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "label" text;
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "account_email" text;
+
+-- 2. Relax one-per-workspace -> one-per-(workspace, chatgpt account).
+DROP INDEX IF EXISTS "codex_subscription_credentials_workspace_idx";
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_subscription_credentials_ws_account_idx"
+  ON "codex_subscription_credentials" ("workspace_id", "chatgpt_account_id")
+  WHERE "chatgpt_account_id" IS NOT NULL;
+CREATE INDEX IF NOT EXISTS "codex_subscription_credentials_workspace_lookup_idx"
+  ON "codex_subscription_credentials" ("workspace_id");
+
+-- 3. Per-session pin + actual. FK ON DELETE SET NULL (degrade, never dangle/cascade).
+ALTER TABLE "sessions" ADD COLUMN IF NOT EXISTS "codex_pinned_credential_id" uuid;
+ALTER TABLE "sessions" ADD COLUMN IF NOT EXISTS "codex_last_credential_id" uuid;
+DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'sessions_codex_pinned_credential_fk') THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_codex_pinned_credential_fk"
+      FOREIGN KEY ("codex_pinned_credential_id")
+      REFERENCES "codex_subscription_credentials"("id") ON DELETE SET NULL;
+  END IF;
+  IF NOT EXISTS (SELECT 1 FROM pg_constraint WHERE conname = 'sessions_codex_last_credential_fk') THEN
+    ALTER TABLE "sessions"
+      ADD CONSTRAINT "sessions_codex_last_credential_fk"
+      FOREIGN KEY ("codex_last_credential_id")
+      REFERENCES "codex_subscription_credentials"("id") ON DELETE SET NULL;
+  END IF;
+END $$;
+
+-- 4. The per-workspace active-pointer table (created WITHOUT force-rls yet).
+CREATE TABLE IF NOT EXISTS "codex_rotation_settings" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "active_credential_id" uuid
+     REFERENCES "codex_subscription_credentials"("id") ON DELETE SET NULL,
+  "rotation_enabled" boolean NOT NULL DEFAULT false,
+  "rotation_strategy" text NOT NULL DEFAULT 'most_remaining',
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now()
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "codex_rotation_settings_workspace_idx"
+  ON "codex_rotation_settings" ("workspace_id");
+
+-- 5. Backfill: every existing single credential becomes its workspace's ACTIVE
+--    account. Reads a FORCE-RLS table as owner -> drop FORCE around it (precedent 0009).
+ALTER TABLE "codex_subscription_credentials" NO FORCE ROW LEVEL SECURITY;
+INSERT INTO "codex_rotation_settings" ("account_id", "workspace_id", "active_credential_id", "rotation_enabled")
+SELECT c."account_id", c."workspace_id", c."id", false
+FROM "codex_subscription_credentials" c
+ON CONFLICT ("workspace_id") DO NOTHING;
+UPDATE "codex_subscription_credentials" SET "label" = "plan_type"
+  WHERE "label" IS NULL AND "plan_type" IS NOT NULL;  -- cosmetic seed; route backfills email on next connect
+ALTER TABLE "codex_subscription_credentials" FORCE ROW LEVEL SECURITY;
+
+-- 6. RLS on the new table — verbatim from 0024_codex_subscription_credentials.sql:31-44.
+ALTER TABLE "codex_rotation_settings" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "codex_rotation_settings" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema() AND tablename = 'codex_rotation_settings' AND policyname = 'workspace_isolation') THEN
+    DROP POLICY workspace_isolation ON "codex_rotation_settings";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "codex_rotation_settings"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+-- 7. Re-grant (verbatim from 0024:46-51).
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0029_session_history_item_producer.sql

@@ -0,0 +1,31 @@
+-- 0029_session_history_item_producer.sql
+-- Cross-account encrypted-reasoning strip (multi-account codex, on top of P1).
+--
+-- Codex-subscription turns round-trip `reasoning.encrypted_content` — an opaque
+-- blob minted by the ChatGPT/Codex backend that is account/org-bound. After a
+-- manual switch from codex account A to B, the next turn on B replays history
+-- items whose encrypted reasoning was minted by A, which B rejects (400). We tag
+-- every conversation-truth row with the codex account that produced it so the
+-- read path can drop the encrypted reasoning of any item NOT produced by the
+-- turn's CURRENT codex account (message content is fully preserved).
+--
+-- Nullable, no FK: provenance must OUTLIVE the account's hard-disconnect (an
+-- ON DELETE SET NULL would erase the tag). NULL = produced on the non-codex /
+-- Azure path, or before this column existed (a legacy row replayed onto a codex
+-- turn then has NULL != the live codex id, so it is stripped — defensive and
+-- harmless: at most one turn of lost chain-of-thought continuity, never content).
+--
+-- Additive; every existing + new row defaults NULL, so non-codex and
+-- single-account flows are byte-identical no-ops. Runs under the runner's
+-- pg_advisory_lock(727458).
+ALTER TABLE "session_history_items"
+  ADD COLUMN IF NOT EXISTS "producer_codex_credential_id" uuid;
+
+-- Re-grant on the new column (idempotent; mirrors the boilerplate in earlier
+-- migrations so a fresh opengeni_app role can read/write the added column).
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0030_agent_run_state_frozen_codex.sql

@@ -0,0 +1,35 @@
+-- 0030_agent_run_state_frozen_codex.sql
+-- Cross-account encrypted-reasoning strip on the run-state REPLAY paths
+-- (HOLE C of the multi-account verify): record which codex account froze a run
+-- state so a resume on a DIFFERENT account can neutralize the frozen, account/
+-- org-bound reasoning before replaying it.
+--
+-- The serialized RunState blob (used by the approval-decision resume and the
+-- items-mode run-state fallback) round-trips `reasoning.encrypted_content` —
+-- minted by the ChatGPT/Codex backend and bound to the producing account/org —
+-- and the foreign reasoning ids the Responses backend validates. Unlike
+-- session_history_items, the blob carries NO per-item producer tag, so we cannot
+-- decide foreign-ness per item. Instead we stamp the freezing account on the
+-- run-state row: when a turn resumes a state whose codex account differs from
+-- the resuming turn's codex account, the replay path strips every reasoning
+-- item's account-bound identity (encrypted_content + provider id) from the blob.
+--
+-- Nullable, no FK: provenance must OUTLIVE the account's hard-disconnect (an
+-- ON DELETE SET NULL would erase the tag). NULL = frozen on the non-codex /
+-- Azure path, or before this column existed. NULL frozen + NULL resume (the
+-- non-codex / single-account case) compares equal, so those replays are
+-- byte-identical no-ops.
+--
+-- Additive; every existing + new row defaults NULL. Runs under the runner's
+-- pg_advisory_lock(727458).
+ALTER TABLE "agent_run_states"
+  ADD COLUMN IF NOT EXISTS "frozen_codex_credential_id" uuid;
+
+-- Re-grant on the new column (idempotent; mirrors the boilerplate in earlier
+-- migrations so a fresh opengeni_app role can read/write the added column).
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0031_codex_usage_cache.sql

@@ -0,0 +1,21 @@
+-- 0031_codex_usage_cache.sql
+-- Multi-account P2: per-account usage cache columns on codex_subscription_credentials.
+-- All five are PLAINTEXT metadata (used_percent + reset timing) snapshotted from
+-- GET /wham/usage; they NEVER hold a token or any secret. RLS is row-level, so the
+-- existing workspace_isolation policy already covers them — NO policy change.
+-- Additive only (mirrors 0028's style). Runs under the runner's advisory lock.
+
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "primary_used_percent" integer;
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "primary_reset_at" timestamptz;
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "secondary_used_percent" integer;
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "secondary_reset_at" timestamptz;
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "usage_checked_at" timestamptz;
+
+-- Re-grant (verbatim from 0024:46-51 / 0028:79-85) so opengeni_app keeps DML on
+-- the altered table after the column additions.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0032_codex_account_cooldown.sql

@@ -0,0 +1,18 @@
+-- 0032_codex_account_cooldown.sql
+-- Multi-account P3 (auto-rotation): one cooldown column on codex_subscription_credentials.
+-- `exhausted_until` is PLAINTEXT metadata (a timestamp), NEVER a token or secret. It marks
+-- an account as cooling-down until its usage cap resets, so the rotation engine deterministically
+-- skips a just-rotated-off account until then (no immediate re-pick, no thrash). The column
+-- self-clears via the now() comparison at read time — no sweeper. RLS is row-level, so the
+-- existing workspace_isolation policy already covers it — NO policy change. Additive only
+-- (mirrors 0031's style). Runs under the runner's advisory lock.
+
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "exhausted_until" timestamptz;
+
+-- Re-grant (verbatim from 0031:17-22) so opengeni_app keeps DML on the altered table.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0033_codex_connector_cache.sql

@@ -0,0 +1,20 @@
+-- 0033_codex_connector_cache.sql
+-- Multi-account P4 (Part B): per-account connector-set cache on codex_subscription_credentials.
+-- Both columns are PLAINTEXT metadata (the ORIGINAL-dotted connector namespaces the account
+-- exposes via codex_apps, e.g. {github,gmail,linear}, plus a freshness clock); they NEVER hold a
+-- token or any secret. The rotation ranker PREFERS (never requires) a target whose connector set
+-- covers the leaving account's set, so a switch doesn't strand a session mid-connector. RLS is
+-- row-level, so the existing workspace_isolation policy already covers them — NO policy change.
+-- Both nullable (null ⇒ never probed = unknown to the ranker). Additive only (mirrors 0031/0032's
+-- style). Runs under the runner's advisory lock.
+
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "connector_namespaces" text[];
+ALTER TABLE "codex_subscription_credentials" ADD COLUMN IF NOT EXISTS "connectors_checked_at" timestamptz;
+
+-- Re-grant (verbatim from 0031/0032) so opengeni_app keeps DML on the altered table.
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/0034_sandbox_lease_image.sql

@@ -0,0 +1,21 @@
+-- 0034_sandbox_lease_image.sql
+-- IMAGE IS SHARED STATE (B3): stamp the container image the group box runs on the lease.
+-- A shared box (sandbox:{groupId} / the default SHARE placement) is ONE filesystem across
+-- N sessions, so every session that attaches must run the SAME image. This column records
+-- the image the live box was created with; a resume whose resolved image DIFFERS is a
+-- conflict — a SOLO holder recreates the box on the new image (force cold + re-stamp),
+-- N-holders are rejected at the lease layer (SandboxImageConflictError). Nullable (a
+-- legacy/cold row reads NULL = "image unknown", which never conflicts) — additive only,
+-- forward-only, no backfill. Mirrors 0022's re-grant boilerplate. Runs under the runner's
+-- advisory lock.
+
+ALTER TABLE "sandbox_leases" ADD COLUMN IF NOT EXISTS "image" text;
+
+-- Re-grant on the new column (idempotent; mirrors the boilerplate in 0018/0022 so a
+-- fresh opengeni_app role can read/write the added column).
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/drizzle/meta/_journal.json

@@ -0,0 +1,167 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1765000000000,
+      "tag": "0000_initial",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1781136000000,
+      "tag": "0001_workspace_auth_billing",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "7",
+      "when": 1781200000000,
+      "tag": "0002_packs_and_social",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "7",
+      "when": 1781200600000,
+      "tag": "0003_capability_catalog",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "7",
+      "when": 1781201200000,
+      "tag": "0004_workspace_environments",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "7",
+      "when": 1781201800000,
+      "tag": "0005_session_goals",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "7",
+      "when": 1781481600000,
+      "tag": "0006_workspace_packs",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "7",
+      "when": 1781568000000,
+      "tag": "0007_session_history_items",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "7",
+      "when": 1781654400000,
+      "tag": "0008_session_first_party_mcp_permissions",
+      "breakpoints": true
+    },
+    {
+      "idx": 9,
+      "version": "7",
+      "when": 1781740800000,
+      "tag": "0009_goal_sessions_first_party_goals_manage",
+      "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "7",
+      "when": 1781827200000,
+      "tag": "0010_session_parent_linkage",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "7",
+      "when": 1781913600000,
+      "tag": "0011_context_compaction",
+      "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "7",
+      "when": 1782000000000,
+      "tag": "0012_compaction_summary_fractional_position",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "7",
+      "when": 1782086400000,
+      "tag": "0013_session_compact_requested",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "7",
+      "when": 1782172800000,
+      "tag": "0014_repair_orphaned_function_call_results",
+      "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "7",
+      "when": 1782259200000,
+      "tag": "0015_workspace_agent_instructions",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "7",
+      "when": 1782345600000,
+      "tag": "0016_session_create_idempotency",
+      "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1782432000000,
+      "tag": "0017_sandbox_leases",
+      "breakpoints": true
+    },
+    {
+      "idx": 18,
+      "version": "7",
+      "when": 1782518400000,
+      "tag": "0018_sandbox_os",
+      "breakpoints": true
+    },
+    {
+      "idx": 19,
+      "version": "7",
+      "when": 1782604800000,
+      "tag": "0019_session_stream_acknowledgments",
+      "breakpoints": true
+    },
+    {
+      "idx": 20,
+      "version": "7",
+      "when": 1782691200000,
+      "tag": "0020_session_recordings",
+      "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1782777600000,
+      "tag": "0021_sandbox_pty_sessions",
+      "breakpoints": true
+    },
+    {
+      "idx": 22,
+      "version": "7",
+      "when": 1782864000000,
+      "tag": "0022_sandbox_lease_terminal_url",
+      "breakpoints": true
+    }
+  ]
+}

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@opengeni/db",
+  "version": "0.2.0",
+  "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cloudgeni-ai/opengeni.git",
+    "directory": "packages/db"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./schema": {
+      "types": "./dist/schema.d.ts",
+      "import": "./dist/schema.js"
+    },
+    "./migrate": {
+      "types": "./dist/migrate.d.ts",
+      "import": "./dist/migrate.js"
+    },
+    "./provision-roles": {
+      "types": "./dist/provision-roles.d.ts",
+      "import": "./dist/provision-roles.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "drizzle"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "generate": "drizzle-kit generate",
+    "migrate": "bun src/migrate.ts",
+    "provision-roles": "bun src/provision-roles.ts",
+    "typecheck": "tsc --noEmit",
+    "build": "tsup"
+  },
+  "dependencies": {
+    "@opengeni/codex": "^0.2.0",
+    "@opengeni/config": "^0.2.0",
+    "@opengeni/contracts": "^0.3.0",
+    "drizzle-orm": "^0.45.2",
+    "postgres": "^3.4.7"
+  },
+  "devDependencies": {
+    "@opengeni/testing": "workspace:*",
+    "drizzle-kit": "^0.31.8",
+    "tsup": "^8.5.0",
+    "typescript": "^6.0.3"
+  }
+}