fix(backends,storage,core): setuid in exec wrapper, missing-column migration, runner config dir for mirror, tagged prompt sources

tests/test_claude_sdk_backend.py

@@ -25,7 +25,12 @@ from claude_agent_sdk import (
 
 from beaver_gateway.agents.base import ExposedMcp
 from beaver_gateway.agents.claude import ClaudeAgent, ClaudeOptions
-from beaver_gateway.backends.claude_sdk import ClaudeSdkBackend, UsageEvent, fingerprint
+from beaver_gateway.backends.claude_sdk import (
+    ClaudeSdkBackend,
+    RunnerConfig,
+    UsageEvent,
+    fingerprint,
+)
 from beaver_gateway.core.transcript import messages_from_entries
 from beaver_gateway.core.turn_capture import TurnCapture
 
@@ -359,7 +364,9 @@ async def test_prompt_sources_are_assembled(cwd: Path) -> None:
     (cwd / "a.md").write_text("alpha\n")
     (cwd / "b.md").write_text("\nbeta\n\n")
     backend = _backend(
-        cwd, InMemorySessionStore(), prompt_sources=(cwd / "a.md", cwd / "b.md")
+        cwd,
+        InMemorySessionStore(),
+        prompt_sources=(("role", cwd / "a.md"), cwd / "b.md"),
     )
     await _drain(
         backend.complete(
@@ -368,7 +375,33 @@ async def test_prompt_sources_are_assembled(cwd: Path) -> None:
             conversation_id="c",
         )
     )
-    assert FakeClient.instances[0].options.system_prompt == "alpha\n\nbeta\n"
+    assert (
+        FakeClient.instances[0].options.system_prompt
+        == "<role>\nalpha\n</role>\n\nbeta\n"
+    )
+
+
+async def test_runner_user_lands_in_wrapper(cwd: Path) -> None:
+    import os
+    import pwd
+
+    me = pwd.getpwuid(os.getuid())
+    backend = _backend(cwd, InMemorySessionStore())
+    backend._runner = RunnerConfig(user=me.pw_name, home=cwd)
+    backend._uid, backend._gid = me.pw_uid, me.pw_gid
+    await _drain(
+        backend.complete(
+            agent=backend.agent,
+            messages=[{"role": "user", "content": "x"}],
+            conversation_id="c",
+        )
+    )
+    opts = FakeClient.instances[0].options
+    assert opts.env["HOME"] == str(cwd)
+    assert opts.env["CLAUDE_CONFIG_DIR"] == str(cwd / ".claude")
+    wrapper = Path(opts.cli_path).read_text()
+    assert f"UID = {me.pw_uid}" in wrapper
+    assert "os.setuid(UID)" in wrapper
 
 
 async def test_close_disconnects(cwd: Path) -> None:

tests/test_db_migrate.py

@@ -0,0 +1,33 @@
+import sqlite3
+import tempfile
+from pathlib import Path
+
+from sqlmodel import select
+
+from beaver_gateway.storage import Database
+from beaver_gateway.storage.models import Conversation
+
+
+async def test_create_all_adds_missing_columns() -> None:
+    path = Path(tempfile.mkdtemp(prefix="beaver-migrate-")) / "old.db"
+    raw = sqlite3.connect(path)
+    raw.execute(
+        "CREATE TABLE conversations (id INTEGER PRIMARY KEY, frontend VARCHAR NOT NULL, "
+        "external_id VARCHAR NOT NULL, agent_name VARCHAR NOT NULL, "
+        "created_at DATETIME NOT NULL, updated_at DATETIME NOT NULL)"
+    )
+    raw.execute(
+        "INSERT INTO conversations VALUES (1, 'markdown', 'x', 'a', '2026-01-01', '2026-01-01')"
+    )
+    raw.commit()
+    raw.close()
+
+    db = Database(f"sqlite:///{path}")
+    await db.create_all()
+    async with db.session() as session:
+        conv = (await session.exec(select(Conversation))).one()
+        assert conv.session_id is None
+        conv.session_id = "sid"
+        session.add(conv)
+        await session.commit()
+    await db.dispose()