llm-cli-gateway 2.8.0 → 2.9.0

package/dist/session-manager-pg.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "crypto";
+import { getRequestContext, resolveOwnerPrincipal } from "./request-context.js";
 const DEFAULT_SESSION_DESCRIPTIONS = {
     claude: "Claude Session",
     codex: "Codex Session",
@@ -16,11 +17,12 @@ export class PostgreSQLSessionManager {
         const id = sessionId || randomUUID();
         const sessionDescription = description ?? DEFAULT_SESSION_DESCRIPTIONS[cli];
         const now = new Date().toISOString();
+        const ownerPrincipal = resolveOwnerPrincipal(getRequestContext());
         const client = await this.pool.connect();
         try {
             await client.query("BEGIN");
-            await client.query(`INSERT INTO sessions (id, cli, description, created_at, last_used_at)
-         VALUES ($1, $2, $3, $4, $5)`, [id, cli, sessionDescription, now, now]);
+            await client.query(`INSERT INTO sessions (id, cli, description, created_at, last_used_at, owner_principal)
+         VALUES ($1, $2, $3, $4, $5, $6)`, [id, cli, sessionDescription, now, now, ownerPrincipal]);
             await client.query(`INSERT INTO active_sessions (cli, session_id, updated_at)
          VALUES ($1, $2, $3)
          ON CONFLICT (cli) DO NOTHING`, [cli, id, now]);
@@ -31,6 +33,7 @@ export class PostgreSQLSessionManager {
                 createdAt: now,
                 lastUsedAt: now,
                 description: sessionDescription,
+                ownerPrincipal,
             };
         }
         catch (error) {
@@ -42,18 +45,18 @@ export class PostgreSQLSessionManager {
         }
     }
     async getSession(sessionId) {
-        const result = await this.pool.query(`SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt"
+        const result = await this.pool.query(`SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt", owner_principal AS "ownerPrincipal"
        FROM sessions
        WHERE id = $1`, [sessionId]);
         return result.rows[0] ?? null;
     }
     async listSessions(cli) {
         const query = cli
-            ? `SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt"
+            ? `SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt", owner_principal AS "ownerPrincipal"
          FROM sessions
          WHERE cli = $1
          ORDER BY last_used_at DESC`
-            : `SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt"
+            : `SELECT id, cli, description, metadata, created_at AS "createdAt", last_used_at AS "lastUsedAt", owner_principal AS "ownerPrincipal"
          FROM sessions
          ORDER BY last_used_at DESC`;
         const result = cli

package/dist/session-manager.d.ts

@@ -14,6 +14,7 @@ export interface Session {
     lastUsedAt: string;
     description?: string;
     metadata?: Record<string, any>;
+    ownerPrincipal?: string | null;
 }
 export interface SessionStorage {
     sessions: Record<string, Session>;

package/dist/session-manager.js

@@ -4,6 +4,7 @@ import { join, dirname } from "path";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync, openSync, fsyncSync, closeSync, chmodSync, } from "fs";
 import { DEFAULT_SESSION_TTL_SECONDS } from "./config.js";
 import { noopLogger } from "./logger.js";
+import { getRequestContext, resolveOwnerPrincipal } from "./request-context.js";
 export const CLI_TYPES = ["claude", "codex", "gemini", "grok", "mistral"];
 export const API_PROVIDER_TYPES = ["grok-api"];
 export const PROVIDER_TYPES = [...CLI_TYPES, ...API_PROVIDER_TYPES];
@@ -113,6 +114,7 @@ export class FileSessionManager {
             createdAt: new Date().toISOString(),
             lastUsedAt: new Date().toISOString(),
             description: sessionDescription,
+            ownerPrincipal: resolveOwnerPrincipal(getRequestContext()),
         };
         this.storage.sessions[id] = session;
         if (!this.storage.activeSession[cli]) {

package/migrations/004_session_owner_principal.sql

@@ -0,0 +1,10 @@
+-- F3: per-principal isolation. Add an ownership principal to PostgreSQL-backed
+-- sessions, mirroring the file backend's `ownerPrincipal` and the job store's
+-- `owner_principal`. Additive and nullable: rows created before this migration
+-- keep NULL and are treated as legacy-unowned by F3b enforcement.
+
+ALTER TABLE sessions ADD COLUMN IF NOT EXISTS owner_principal TEXT;
+
+INSERT INTO schema_migrations (version, name)
+VALUES (4, '004_session_owner_principal')
+ON CONFLICT (version) DO NOTHING;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "llm-cli-gateway",
-      "version": "2.8.0",
+      "version": "2.9.0",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "llm-cli-gateway",
-  "version": "2.8.0",
+  "version": "2.9.0",
   "mcpName": "io.github.verivus-oss/llm-cli-gateway",
   "description": "MCP server providing unified access to Claude Code, Codex, Gemini, Grok, and Mistral Vibe CLIs with session management, retry logic, async job orchestration, durable job results, and cross-LLM validation.",
   "license": "MIT",