@sema-agent/server 1.315.0 → 1.317.0

package/dist/plugins/run-store-sql.js

@@ -0,0 +1,397 @@
+import { projectUsageStats, USAGE_SCAN_LIMIT } from "../usage-analytics.js";
+import { escapeLike } from "./sql-escape.js";
+import { pgSafeJsonStringify, pgSanitizeText } from "./pg-safe-json.js";
+import { parseJsonLenient as parseJson, toIso as iso } from "./sql-row-helpers.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+export class SqlRunStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    isDupKey(err) {
+        const code = err?.code;
+        return Boolean(err) && (this.db.dialect === "tidb" ? code === "ER_DUP_ENTRY" : code === "23505");
+    }
+    json(value) {
+        return this.db.dialect === "tidb" ? JSON.stringify(value) : pgSafeJsonStringify(value);
+    }
+    async tx(fn) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            await fn(conn);
+            await conn.commit();
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async createRun(taskId, sessionId, owner, instanceId, meta = {}) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            const now = new Date();
+            try {
+                await conn.query(this.q("INSERT INTO task_active (session_id, task_id, since) VALUES (?,?,?)", "INSERT INTO task_active (session_id, task_id, since) VALUES ($1,$2,$3)"), [sessionId, taskId, now]);
+            }
+            catch (err) {
+                if (this.isDupKey(err)) {
+                    await conn.rollback();
+                    const { rows: active } = await conn.query(this.q("SELECT task_id FROM task_active WHERE session_id = ?", "SELECT task_id FROM task_active WHERE session_id = $1"), [sessionId]);
+                    return { ok: false, activeTaskId: String(active[0]?.task_id ?? "") };
+                }
+                throw err;
+            }
+            await conn.query(this.q("INSERT INTO task_run (task_id, session_id, owner, status, instance_id, job_id, source, objective_preview, created_at, updated_at) " +
+                "VALUES (?,?,?,'running',?,?,?,?,?,?)", "INSERT INTO task_run (task_id, session_id, owner, status, instance_id, job_id, source, objective_preview, created_at, updated_at) " +
+                "VALUES ($1,$2,$3,'running',$4,$5,$6,$7,$8,$9)"), [
+                taskId,
+                sessionId,
+                owner,
+                instanceId,
+                meta.jobId ?? null,
+                meta.source ?? null,
+                this.db.dialect === "tidb"
+                    ? meta.objectivePreview ?? null
+                    : meta.objectivePreview == null
+                        ? null
+                        : pgSanitizeText(meta.objectivePreview),
+                now,
+                now,
+            ]);
+            await conn.commit();
+            return { ok: true };
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+    async requestCancel(taskId, owner) {
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET cancel_requested = 1 WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET cancel_requested = 1 WHERE task_id = $1 AND owner IS NOT DISTINCT FROM $2 AND status = 'running'"), [taskId, owner]);
+        return affected > 0;
+    }
+    async isCancelRequested(taskId, owner) {
+        const { rows } = await this.db.query(this.q("SELECT cancel_requested FROM task_run WHERE task_id = ? AND owner <=> ?", "SELECT cancel_requested FROM task_run WHERE task_id = $1 AND owner IS NOT DISTINCT FROM $2"), [taskId, owner]);
+        return Boolean(rows[0]?.cancel_requested);
+    }
+    async requestPreempt(taskId, owner) {
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET preempt_requested = 1 WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET preempt_requested = 1 WHERE task_id = $1 AND owner IS NOT DISTINCT FROM $2 AND status = 'running'"), [taskId, owner]);
+        return affected > 0;
+    }
+    async isPreemptRequested(taskId, owner) {
+        const { rows } = await this.db.query(this.q("SELECT preempt_requested FROM task_run WHERE task_id = ? AND owner <=> ?", "SELECT preempt_requested FROM task_run WHERE task_id = $1 AND owner IS NOT DISTINCT FROM $2"), [taskId, owner]);
+        return Boolean(rows[0]?.preempt_requested);
+    }
+    async heartbeat(taskId, owner) {
+        await this.db.query(this.q("UPDATE task_run SET updated_at = ? WHERE task_id = ? AND owner <=> ? AND status = 'running'", "UPDATE task_run SET updated_at = $1 WHERE task_id = $2 AND owner IS NOT DISTINCT FROM $3 AND status = 'running'"), [new Date(), taskId, owner]);
+    }
+    async appendEvent(taskId, seq, type, data) {
+        await this.db.query(this.q("INSERT INTO task_event (task_id, seq, type, data, ts) VALUES (?,?,?,?,?)", "INSERT INTO task_event (task_id, seq, type, data, ts) VALUES ($1,$2,$3,$4::jsonb,$5)"), [taskId, seq, type, data == null ? null : this.json(data), new Date()]);
+    }
+    async maxSeq(taskId) {
+        const { rows } = await this.db.query(this.q("SELECT MAX(seq) AS m FROM task_event WHERE task_id = ?", "SELECT MAX(seq) AS m FROM task_event WHERE task_id = $1"), [taskId]);
+        const m = rows[0]?.m;
+        return m == null ? 0 : Number(m);
+    }
+    async setTerminal(taskId, status, result, error) {
+        const errorCode = result?.errorCode ?? null;
+        await this.tx(async (conn) => {
+            await conn.query(this.q("UPDATE task_run SET status = ?, result = ?, error = ?, error_code = ?, updated_at = ? WHERE task_id = ? AND status IN ('running','suspended','needs_review')", "UPDATE task_run SET status = $1, result = $2::jsonb, error = $3, error_code = $4, updated_at = $5 WHERE task_id = $6 AND status IN ('running','suspended','needs_review')"), [
+                status,
+                result == null ? null : this.json(result),
+                this.db.dialect === "tidb" ? error : error == null ? null : pgSanitizeText(error),
+                this.db.dialect === "tidb" ? errorCode : errorCode == null ? null : pgSanitizeText(errorCode),
+                new Date(),
+                taskId,
+            ]);
+            await conn.query(this.q("DELETE FROM task_active WHERE task_id = ?", "DELETE FROM task_active WHERE task_id = $1"), [taskId]);
+        });
+    }
+    async setSuspended(taskId) {
+        await this.db.query(this.q("UPDATE task_run SET status = 'suspended', updated_at = ? WHERE task_id = ? AND status IN ('running','suspended')", "UPDATE task_run SET status = 'suspended', updated_at = $1 WHERE task_id = $2 AND status IN ('running','suspended')"), [new Date(), taskId]);
+    }
+    async setNeedsReview(taskId) {
+        await this.db.query(this.q("UPDATE task_run SET status = 'needs_review', updated_at = ? WHERE task_id = ? AND status IN ('running','needs_review')", "UPDATE task_run SET status = 'needs_review', updated_at = $1 WHERE task_id = $2 AND status IN ('running','needs_review')"), [new Date(), taskId]);
+    }
+    async markResuming(taskId) {
+        const { affected } = await this.db.query(this.q("UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, updated_at = ? WHERE task_id = ? AND status IN ('suspended','needs_review')", "UPDATE task_run SET status = 'running', cancel_requested = 0, preempt_requested = 0, updated_at = $1 WHERE task_id = $2 AND status IN ('suspended','needs_review')"), [new Date(), taskId]);
+        return affected === 1;
+    }
+    async getActiveTaskId(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT task_id FROM task_active WHERE session_id = ?", "SELECT task_id FROM task_active WHERE session_id = $1"), [sessionId]);
+        return rows[0] ? String(rows[0].task_id) : undefined;
+    }
+    rowToRun(r) {
+        return {
+            taskId: String(r.task_id),
+            sessionId: String(r.session_id),
+            owner: r.owner ?? null,
+            status: r.status,
+            result: parseJson(r.result),
+            error: r.error ?? null,
+            errorCode: r.error_code ?? null,
+            jobId: r.job_id ?? null,
+            source: r.source ?? null,
+            instanceId: r.instance_id ?? null,
+            objectivePreview: r.objective_preview ?? null,
+            createdAt: iso(r.created_at),
+            updatedAt: iso(r.updated_at),
+        };
+    }
+    async getRun(taskId) {
+        const { rows } = await this.db.query(this.q("SELECT task_id, session_id, owner, status, result, error, error_code, job_id, source, instance_id, objective_preview, created_at, updated_at FROM task_run WHERE task_id = ?", "SELECT task_id, session_id, owner, status, result, error, error_code, job_id, source, instance_id, objective_preview, created_at, updated_at FROM task_run WHERE task_id = $1"), [taskId]);
+        return rows[0] ? this.rowToRun(rows[0]) : undefined;
+    }
+    async listRuns(opts) {
+        if (opts.cursor && Number.isNaN(Date.parse(opts.cursor.createdAt)))
+            return [];
+        if (this.db.dialect === "tidb") {
+            const where = [];
+            const params = [];
+            if (opts.status) {
+                where.push("status = ?");
+                params.push(opts.status);
+            }
+            if (opts.jobId) {
+                where.push("job_id = ?");
+                params.push(opts.jobId);
+            }
+            if (opts.source) {
+                where.push("source = ?");
+                params.push(opts.source);
+            }
+            if (opts.owner) {
+                where.push("owner = ?");
+                params.push(opts.owner);
+            }
+            if (opts.cursor) {
+                where.push("(created_at < ? OR (created_at = ? AND task_id < ?))");
+                params.push(new Date(opts.cursor.createdAt), new Date(opts.cursor.createdAt), opts.cursor.taskId);
+            }
+            const sql = "SELECT task_id, session_id, owner, status, result, error, error_code, job_id, source, objective_preview, created_at, updated_at FROM task_run" +
+                (where.length ? " WHERE " + where.join(" AND ") : "") +
+                " ORDER BY created_at DESC, task_id DESC LIMIT ?";
+            params.push(opts.limit);
+            const { rows } = await this.db.query(sql, params);
+            return rows.map((r) => this.rowToRun(r));
+        }
+        const params = [];
+        const p = (v) => {
+            params.push(v);
+            return `$${params.length}`;
+        };
+        const where = [];
+        if (opts.status)
+            where.push(`status = ${p(opts.status)}`);
+        if (opts.jobId)
+            where.push(`job_id = ${p(opts.jobId)}`);
+        if (opts.source)
+            where.push(`source = ${p(opts.source)}`);
+        if (opts.owner)
+            where.push(`owner = ${p(opts.owner)}`);
+        if (opts.cursor) {
+            const a = p(new Date(opts.cursor.createdAt));
+            const b = p(new Date(opts.cursor.createdAt));
+            const t = p(opts.cursor.taskId);
+            where.push(`(created_at < ${a} OR (created_at = ${b} AND task_id < ${t}))`);
+        }
+        const sql = "SELECT task_id, session_id, owner, status, result, error, error_code, job_id, source, objective_preview, created_at, updated_at FROM task_run" +
+            (where.length ? " WHERE " + where.join(" AND ") : "") +
+            ` ORDER BY created_at DESC, task_id DESC LIMIT ${p(opts.limit)}`;
+        const { rows } = await this.db.query(sql, params);
+        return rows.map((r) => this.rowToRun(r));
+    }
+    async listSessions(opts) {
+        if (this.db.dialect === "tidb") {
+            const params = [];
+            let innerWhere = "";
+            if (opts.owner) {
+                innerWhere = " WHERE owner = ?";
+                params.push(opts.owner);
+            }
+            const outer = ["rn = 1"];
+            if (opts.q) {
+                outer.push("EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = t.session_id AND LOWER(tr.objective_preview) LIKE LOWER(?) ESCAPE '\\\\')");
+                params.push(`%${escapeLike(opts.q)}%`);
+            }
+            if (opts.cursor) {
+                outer.push("(last_activity < ? OR (last_activity = ? AND session_id < ?))");
+                params.push(new Date(opts.cursor.lastActivityAt), new Date(opts.cursor.lastActivityAt), opts.cursor.sessionId);
+            }
+            const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status FROM (" +
+                "SELECT session_id, owner, task_id, objective_preview, status," +
+                " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
+                " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
+                " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
+                " COUNT(*) OVER (PARTITION BY session_id) AS run_count" +
+                " FROM task_run" + innerWhere + ") t WHERE " + outer.join(" AND ") +
+                " ORDER BY last_activity DESC, session_id DESC LIMIT ?";
+            params.push(opts.limit);
+            const { rows } = await this.db.query(sql, params);
+            return rows.map((r) => this.rowToSession(r));
+        }
+        const params = [];
+        const p = (v) => {
+            params.push(v);
+            return `$${params.length}`;
+        };
+        const innerWhere = opts.owner ? ` WHERE owner = ${p(opts.owner)}` : "";
+        const outer = ["rn = 1"];
+        if (opts.q)
+            outer.push(`EXISTS (SELECT 1 FROM task_run tr WHERE tr.session_id = t.session_id AND LOWER(tr.objective_preview) LIKE LOWER(${p(`%${escapeLike(opts.q)}%`)}) ESCAPE '\\')`);
+        if (opts.cursor) {
+            const a = p(new Date(opts.cursor.lastActivityAt));
+            const b = p(new Date(opts.cursor.lastActivityAt));
+            const sid = p(opts.cursor.sessionId);
+            outer.push(`(last_activity < ${a} OR (last_activity = ${b} AND session_id < ${sid}))`);
+        }
+        const sql = "SELECT session_id, owner, task_id, last_activity, first_activity, run_count, objective_preview, status FROM (" +
+            "SELECT session_id, owner, task_id, objective_preview, status," +
+            " ROW_NUMBER() OVER (PARTITION BY session_id ORDER BY created_at DESC, task_id DESC) AS rn," +
+            " MAX(created_at) OVER (PARTITION BY session_id) AS last_activity," +
+            " MIN(created_at) OVER (PARTITION BY session_id) AS first_activity," +
+            " COUNT(*) OVER (PARTITION BY session_id) AS run_count" +
+            " FROM task_run" + innerWhere + ") t WHERE " + outer.join(" AND ") +
+            ` ORDER BY last_activity DESC, session_id DESC LIMIT ${p(opts.limit)}`;
+        const { rows } = await this.db.query(sql, params);
+        return rows.map((r) => this.rowToSession(r));
+    }
+    rowToSession(r) {
+        return {
+            sessionId: String(r.session_id),
+            owner: r.owner ?? null,
+            lastActivityAt: iso(r.last_activity),
+            firstActivityAt: iso(r.first_activity),
+            runCount: Number(r.run_count),
+            objectivePreview: r.objective_preview ?? null,
+            lastStatus: String(r.status),
+            lastRunId: r.task_id ?? null,
+            title: null,
+        };
+    }
+    async deleteBySession(sessionId, owner) {
+        let result = { removed: 0 };
+        await this.tx(async (conn) => {
+            const { rows: active } = await conn.query(this.q("SELECT task_id FROM task_active WHERE session_id = ? FOR UPDATE", "SELECT task_id FROM task_active WHERE session_id = $1 FOR UPDATE"), [sessionId]);
+            if (active[0]) {
+                result = { active: String(active[0].task_id) };
+                return;
+            }
+            await conn.query(this.q("DELETE te FROM task_event te JOIN task_run tr ON te.task_id = tr.task_id WHERE tr.session_id = ? AND tr.owner <=> ?", "DELETE FROM task_event te USING task_run tr WHERE te.task_id = tr.task_id AND tr.session_id = $1 AND tr.owner IS NOT DISTINCT FROM $2"), [sessionId, owner]);
+            await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.session_id = ? AND tr.owner <=> ?", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.session_id = $1 AND tr.owner IS NOT DISTINCT FROM $2"), [sessionId, owner]);
+            const { affected } = await conn.query(this.q("DELETE FROM task_run WHERE session_id = ? AND owner <=> ?", "DELETE FROM task_run WHERE session_id = $1 AND owner IS NOT DISTINCT FROM $2"), [sessionId, owner]);
+            result = { removed: affected };
+        });
+        return result;
+    }
+    async sourceSummary(sinceMs) {
+        const { rows } = await this.db.query(this.q("SELECT source, status, COUNT(*) AS c FROM task_run WHERE created_at >= ? GROUP BY source, status", "SELECT source, status, COUNT(*) AS c FROM task_run WHERE created_at >= $1 GROUP BY source, status"), [new Date(sinceMs)]);
+        return rows.map((r) => ({ source: r.source ?? null, status: String(r.status), count: Number(r.c) }));
+    }
+    async usageScan(fromMs, toMs, opts) {
+        const limit = Math.min(opts?.limit ?? USAGE_SCAN_LIMIT, USAGE_SCAN_LIMIT);
+        const where = [this.q("created_at >= ?", "created_at >= $1"), this.q("created_at < ?", "created_at < $2")];
+        const params = [new Date(fromMs), new Date(toMs)];
+        if (opts?.owner !== undefined) {
+            where.push(this.q("owner = ?", "owner = $3"));
+            params.push(opts.owner);
+        }
+        const { rows } = await this.db.query(`SELECT owner, created_at, status, result FROM task_run WHERE ${where.join(" AND ")} ORDER BY created_at LIMIT ${limit + 1}`, params);
+        const truncated = rows.length > limit;
+        const page = truncated ? rows.slice(0, limit) : rows;
+        return {
+            truncated,
+            rows: page.map((r) => ({
+                owner: r.owner ?? null,
+                createdAtMs: new Date(r.created_at).getTime(),
+                status: String(r.status),
+                ...(r.result != null ? { stats: projectUsageStats(r.result) } : {}),
+            })),
+        };
+    }
+    async retainedFrom(taskId) {
+        const { rows } = await this.db.query(this.q("SELECT MIN(seq) AS m FROM task_event WHERE task_id = ?", "SELECT MIN(seq) AS m FROM task_event WHERE task_id = $1"), [taskId]);
+        const m = rows[0]?.m;
+        return m == null ? 0 : Number(m);
+    }
+    async getEvents(taskId, afterSeq) {
+        const { rows } = await this.db.query(this.q("SELECT seq, type, data, ts FROM task_event WHERE task_id = ? AND seq > ? ORDER BY seq ASC", "SELECT seq, type, data, ts FROM task_event WHERE task_id = $1 AND seq > $2 ORDER BY seq ASC"), [taskId, afterSeq]);
+        return rows.map((r) => ({
+            seq: Number(r.seq),
+            type: String(r.type),
+            data: parseJson(r.data),
+            ts: iso(r.ts),
+        }));
+    }
+    async reapStale(olderThanMs) {
+        const cutoff = new Date(Date.now() - olderThanMs);
+        let reaped = 0;
+        await this.tx(async (conn) => {
+            const { affected } = await conn.query(this.q("UPDATE task_run SET status = 'failed', error = 'run stalled (instance lost?)', updated_at = ? " +
+                "WHERE status = 'running' AND updated_at < ?", "UPDATE task_run SET status = 'failed', error = 'run stalled (instance lost?)', updated_at = $1 " +
+                "WHERE status = 'running' AND updated_at < $2"), [new Date(), cutoff]);
+            reaped = affected;
+            await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+        });
+        return reaped;
+    }
+    async reapSuspended(olderThanMs) {
+        const cutoff = new Date(Date.now() - olderThanMs);
+        let reaped = 0;
+        await this.tx(async (conn) => {
+            const { affected } = await conn.query(this.q("UPDATE task_run tr SET tr.status = 'failed', tr.error = 'approval expired before decision', tr.error_code = 'approval.expired', tr.updated_at = ? " +
+                "WHERE tr.status = 'suspended' AND tr.updated_at < ? " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.session_id = tr.session_id AND c.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
+                "WHERE tr.status = 'suspended' AND tr.updated_at < $2 " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint c WHERE c.session_id = tr.session_id AND c.status = 'pending')"), [new Date(), cutoff]);
+            reaped = affected;
+            await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+        });
+        return reaped;
+    }
+    async failSuspendedWithExpiredCheckpoint() {
+        let reaped = 0;
+        await this.tx(async (conn) => {
+            const { affected } = await conn.query(this.q("UPDATE task_run tr SET tr.status = 'failed', tr.error = 'approval expired before decision', tr.error_code = 'approval.expired', tr.updated_at = ? " +
+                "WHERE tr.status IN ('suspended','needs_review') " +
+                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.session_id = tr.session_id AND ce.status = 'expired') " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.session_id = tr.session_id AND cp.status = 'pending')", "UPDATE task_run AS tr SET status = 'failed', error = 'approval expired before decision', error_code = 'approval.expired', updated_at = $1 " +
+                "WHERE tr.status IN ('suspended','needs_review') " +
+                "AND EXISTS (SELECT 1 FROM checkpoint ce WHERE ce.session_id = tr.session_id AND ce.status = 'expired') " +
+                "AND NOT EXISTS (SELECT 1 FROM checkpoint cp WHERE cp.session_id = tr.session_id AND cp.status = 'pending')"), [new Date()]);
+            reaped = affected;
+            await conn.query(this.q("DELETE ta FROM task_active ta JOIN task_run tr ON ta.task_id = tr.task_id WHERE tr.status NOT IN ('running','suspended','needs_review')", "DELETE FROM task_active ta USING task_run tr WHERE ta.task_id = tr.task_id AND tr.status NOT IN ('running','suspended','needs_review')"));
+        });
+        return reaped;
+    }
+}
+export class TiDBRunStore extends SqlRunStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgRunStore extends SqlRunStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=run-store-sql.js.map

package/dist/plugins/session-policy-store-sql.d.ts

@@ -0,0 +1,22 @@
+import { type SessionPolicyStore, type SessionPermissionRules, type StoredSessionRules, type SessionRulesRecord, type PutRulesOptions } from "@sema-agent/core";
+import type { Pool as MySqlPool } from "mysql2/promise";
+import type { Pool as PgPool } from "pg";
+import { type SqlDriver } from "./sql-driver.js";
+export declare class SqlSessionPolicyStore implements SessionPolicyStore {
+    private readonly db;
+    constructor(db: SqlDriver);
+    private q;
+    private isDupKey;
+    getRules(sessionId: string, principal?: string): Promise<StoredSessionRules | null>;
+    listBySession(sessionId: string): Promise<SessionRulesRecord[]>;
+    putRules(sessionId: string, principal: string | undefined, rules: SessionPermissionRules, opts?: PutRulesOptions): Promise<StoredSessionRules>;
+    deleteBySession(sessionId: string): Promise<void>;
+    private tx;
+}
+export declare class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
+    constructor(pool: MySqlPool);
+}
+export declare class PgSessionPolicyStore extends SqlSessionPolicyStore {
+    constructor(pool: PgPool);
+}
+//# sourceMappingURL=session-policy-store-sql.d.ts.map

package/dist/plugins/session-policy-store-sql.js

@@ -0,0 +1,109 @@
+import { createHash } from "node:crypto";
+import { loosenReasons, SessionPolicyError, normalizeRules, stripRev } from "@sema-agent/core";
+import { pgHasUnstorable } from "./pg-safe-json.js";
+import { mysqlDriver, pgDriver } from "./sql-driver.js";
+const policyKey = (sessionId, principal) => createHash("sha256").update(JSON.stringify([sessionId, principal ?? null])).digest("hex");
+const parseRules = (v) => (typeof v === "string" ? JSON.parse(v) : v);
+export class SqlSessionPolicyStore {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    q(tidb, pg) {
+        return this.db.dialect === "tidb" ? tidb : pg;
+    }
+    isDupKey(e) {
+        return this.db.dialect === "tidb"
+            ? e?.code === "ER_DUP_ENTRY" || e?.errno === 1062
+            : e?.code === "23505";
+    }
+    async getRules(sessionId, principal) {
+        const { rows } = await this.db.query(this.q("SELECT rules, rev FROM session_policy WHERE policy_key = ?", "SELECT rules, rev FROM session_policy WHERE policy_key = $1"), [policyKey(sessionId, principal)]);
+        if (!rows[0])
+            return null;
+        return { ...parseRules(rows[0].rules), rev: Number(rows[0].rev) };
+    }
+    async listBySession(sessionId) {
+        const { rows } = await this.db.query(this.q("SELECT principal, rules, rev FROM session_policy WHERE session_id = ?", "SELECT principal, rules, rev FROM session_policy WHERE session_id = $1"), [sessionId]);
+        return rows.map((r) => ({
+            principal: r.principal == null ? undefined : String(r.principal),
+            rules: { ...parseRules(r.rules), rev: Number(r.rev) },
+        }));
+    }
+    async putRules(sessionId, principal, rules, opts) {
+        const key = policyKey(sessionId, principal);
+        for (let attempt = 0;; attempt++) {
+            try {
+                return await this.tx(async (conn) => {
+                    const { rows } = await conn.query(this.q("SELECT rules, rev FROM session_policy WHERE policy_key = ? FOR UPDATE", "SELECT rules, rev FROM session_policy WHERE policy_key = $1 FOR UPDATE"), [key]);
+                    const prior = rows[0] ? { rules: parseRules(rows[0].rules), rev: Number(rows[0].rev) } : undefined;
+                    const priorRev = prior?.rev ?? 0;
+                    if (opts?.expectedRev !== undefined && priorRev !== opts.expectedRev) {
+                        throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts.expectedRev}, have ${priorRev})`);
+                    }
+                    const clean = normalizeRules(stripRev(rules));
+                    if (prior && opts?.operator !== true) {
+                        const loosens = loosenReasons(prior.rules, clean);
+                        if (loosens.length > 0) {
+                            throw new SessionPolicyError("loosen_forbidden", `a non-operator session-rule write may only tighten; refused: ${loosens.join("; ")}`);
+                        }
+                    }
+                    if (this.db.dialect === "pg" && pgHasUnstorable(clean)) {
+                        throw new SessionPolicyError("loosen_forbidden", "rules contain unstorable bytes (NUL / lone surrogate) — refused; strip them at the source (authorization rules are never rewritten by the store)");
+                    }
+                    const nextRev = priorRev + 1;
+                    const json = JSON.stringify(clean);
+                    const now = new Date();
+                    if (prior) {
+                        const upd = await conn.query(this.q("UPDATE session_policy SET principal = ?, rules = ?, rev = ?, updated_at = ? WHERE policy_key = ? AND rev = ?", "UPDATE session_policy SET principal = $1, rules = $2::jsonb, rev = $3, updated_at = $4 WHERE policy_key = $5 AND rev = $6"), [principal ?? null, json, nextRev, now, key, priorRev]);
+                        if (upd.affected !== 1)
+                            throw new SessionPolicyError("conflict", `session rules rev mismatch (expected ${opts?.expectedRev ?? priorRev}, have ${priorRev})`);
+                    }
+                    else {
+                        await conn.query(this.q("INSERT INTO session_policy (policy_key, session_id, principal, rules, rev, created_at, updated_at) VALUES (?,?,?,?,?,?,?)", "INSERT INTO session_policy (policy_key, session_id, principal, rules, rev, created_at, updated_at) VALUES ($1,$2,$3,$4::jsonb,$5,$6,$7)"), [key, sessionId, principal ?? null, json, nextRev, now, now]);
+                    }
+                    return structuredClone({ ...clean, rev: nextRev });
+                });
+            }
+            catch (e) {
+                if (this.isDupKey(e) && attempt < 4)
+                    continue;
+                throw e;
+            }
+        }
+    }
+    async deleteBySession(sessionId) {
+        await this.db.query(this.q("DELETE FROM session_policy WHERE session_id = ?", "DELETE FROM session_policy WHERE session_id = $1"), [sessionId]);
+    }
+    async tx(fn) {
+        const conn = await this.db.connect();
+        try {
+            await conn.begin();
+            const out = await fn(conn);
+            await conn.commit();
+            return out;
+        }
+        catch (err) {
+            try {
+                await conn.rollback();
+            }
+            catch {
+            }
+            throw err;
+        }
+        finally {
+            conn.release();
+        }
+    }
+}
+export class TiDBSessionPolicyStore extends SqlSessionPolicyStore {
+    constructor(pool) {
+        super(mysqlDriver(pool));
+    }
+}
+export class PgSessionPolicyStore extends SqlSessionPolicyStore {
+    constructor(pool) {
+        super(pgDriver(pool));
+    }
+}
+//# sourceMappingURL=session-policy-store-sql.js.map

package/dist/plugins/tidb-approval-store.d.ts

@@ -1,40 +1,2 @@
-import type { Pool } from "mysql2/promise";
-export type ApprovalStatus = "pending" | "approved" | "denied" | "expired";
-export interface ApprovalRow {
-    id: string;
-    taskId: string | null;
-    sessionId: string | null;
-    owner: string | null;
-    scope: string | null;
-    toolName: string;
-    args: unknown;
-    status: ApprovalStatus;
-    reason: string | null;
-    decidedBy: string | null;
-    createdAt: string;
-    decidedAt: string | null;
-}
-export declare class TiDBApprovalStore {
-    private readonly pool;
-    constructor(pool: Pool);
-    createPending(id: string, scope: string | null, ctx: {
-        taskId?: string | null;
-        sessionId?: string | null;
-        owner?: string | null;
-        toolName: string;
-        args: unknown;
-    }): Promise<void>;
-    getStatus(id: string, scope: string | null): Promise<{
-        status: ApprovalStatus;
-        reason: string | null;
-        decidedBy: string | null;
-    } | undefined>;
-    decide(id: string, scope: string | null, decision: "approved" | "denied" | "expired", reason: string | null, decidedBy: string | null): Promise<boolean>;
-    listPending(scope: string | null, owner?: string): Promise<ApprovalRow[]>;
-    get(id: string, scope: string | null): Promise<ApprovalRow | undefined>;
-    getById(id: string): Promise<ApprovalRow | undefined>;
-    listPendingAll(): Promise<ApprovalRow[]>;
-    expireStale(olderThanMs: number): Promise<number>;
-}
-export declare function mapRow(r: Record<string, unknown>): ApprovalRow;
+export { TiDBApprovalStore, mapRow, type ApprovalRow, type ApprovalStatus, } from "./approval-store-sql.js";
 //# sourceMappingURL=tidb-approval-store.d.ts.map

package/dist/plugins/tidb-approval-store.js

@@ -1,72 +1,2 @@
-import { parseJsonStrict as parseJson, toIsoOrNull as iso } from "./sql-row-helpers.js";
-export class TiDBApprovalStore {
-    pool;
-    constructor(pool) {
-        this.pool = pool;
-    }
-    async createPending(id, scope, ctx) {
-        await this.pool.query("INSERT INTO approval (id, task_id, session_id, owner, scope, tool_name, args, status, created_at) " +
-            "VALUES (?,?,?,?,?,?,?,'pending',?)", [
-            id,
-            ctx.taskId ?? null,
-            ctx.sessionId ?? null,
-            ctx.owner ?? null,
-            scope,
-            ctx.toolName,
-            ctx.args == null ? null : JSON.stringify(ctx.args),
-            new Date(),
-        ]);
-    }
-    async getStatus(id, scope) {
-        const [rows] = await this.pool.query("SELECT status, reason, decided_by FROM approval WHERE id = ? AND scope <=> ?", [id, scope]);
-        const r = rows[0];
-        if (!r)
-            return undefined;
-        return { status: r.status, reason: r.reason ?? null, decidedBy: r.decided_by ?? null };
-    }
-    async decide(id, scope, decision, reason, decidedBy) {
-        const [res] = await this.pool.query("UPDATE approval SET status = ?, reason = ?, decided_by = ?, decided_at = ? WHERE id = ? AND scope <=> ? AND status = 'pending'", [decision, reason, decidedBy, new Date(), id, scope]);
-        return res.affectedRows === 1;
-    }
-    async listPending(scope, owner) {
-        const [rows] = owner
-            ? await this.pool.query("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? AND owner = ? ORDER BY created_at ASC", [scope, owner])
-            : await this.pool.query("SELECT * FROM approval WHERE status = 'pending' AND scope <=> ? ORDER BY created_at ASC", [scope]);
-        return rows.map(mapRow);
-    }
-    async get(id, scope) {
-        const [rows] = await this.pool.query("SELECT * FROM approval WHERE id = ? AND scope <=> ?", [id, scope]);
-        return rows[0] ? mapRow(rows[0]) : undefined;
-    }
-    async getById(id) {
-        const [rows] = await this.pool.query("SELECT * FROM approval WHERE id = ?", [id]);
-        return rows[0] ? mapRow(rows[0]) : undefined;
-    }
-    async listPendingAll() {
-        const [rows] = await this.pool.query("SELECT * FROM approval WHERE status = 'pending' ORDER BY created_at ASC");
-        return rows.map(mapRow);
-    }
-    async expireStale(olderThanMs) {
-        const cutoff = new Date(Date.now() - olderThanMs);
-        const [res] = await this.pool.query("UPDATE approval SET status = 'expired', reason = 'timed out before decision', decided_at = ? " +
-            "WHERE status = 'pending' AND created_at < ?", [new Date(), cutoff]);
-        return res.affectedRows;
-    }
-}
-export function mapRow(r) {
-    return {
-        id: String(r.id),
-        taskId: r.task_id ?? null,
-        sessionId: r.session_id ?? null,
-        owner: r.owner ?? null,
-        scope: r.scope ?? null,
-        toolName: String(r.tool_name),
-        args: parseJson(r.args),
-        status: r.status,
-        reason: r.reason ?? null,
-        decidedBy: r.decided_by ?? null,
-        createdAt: iso(r.created_at),
-        decidedAt: iso(r.decided_at),
-    };
-}
+export { TiDBApprovalStore, mapRow, } from "./approval-store-sql.js";
 //# sourceMappingURL=tidb-approval-store.js.map