fix(backends,storage,core): setuid in exec wrapper, missing-column migration, runner config dir for mirror, tagged prompt sources

tests/test_claude_sdk_backend.py

@@ -25,7 +25,12 @@ from claude_agent_sdk import (
 
 from beaver_gateway.agents.base import ExposedMcp
 from beaver_gateway.agents.claude import ClaudeAgent, ClaudeOptions
-from beaver_gateway.backends.claude_sdk import ClaudeSdkBackend, UsageEvent, fingerprint
+from beaver_gateway.backends.claude_sdk import (
+    ClaudeSdkBackend,
+    RunnerConfig,
+    UsageEvent,
+    fingerprint,
+)
 from beaver_gateway.core.transcript import messages_from_entries
 from beaver_gateway.core.turn_capture import TurnCapture
 
@@ -359,7 +364,9 @@ async def test_prompt_sources_are_assembled(cwd: Path) -> None:
     (cwd / "a.md").write_text("alpha\n")
     (cwd / "b.md").write_text("\nbeta\n\n")
     backend = _backend(
-        cwd, InMemorySessionStore(), prompt_sources=(cwd / "a.md", cwd / "b.md")
+        cwd,
+        InMemorySessionStore(),
+        prompt_sources=(("role", cwd / "a.md"), cwd / "b.md"),
     )
     await _drain(
         backend.complete(
@@ -368,7 +375,33 @@ async def test_prompt_sources_are_assembled(cwd: Path) -> None:
             conversation_id="c",
         )
     )
-    assert FakeClient.instances[0].options.system_prompt == "alpha\n\nbeta\n"
+    assert (
+        FakeClient.instances[0].options.system_prompt
+        == "<role>\nalpha\n</role>\n\nbeta\n"
+    )
+
+
+async def test_runner_user_lands_in_wrapper(cwd: Path) -> None:
+    import os
+    import pwd
+
+    me = pwd.getpwuid(os.getuid())
+    backend = _backend(cwd, InMemorySessionStore())
+    backend._runner = RunnerConfig(user=me.pw_name, home=cwd)
+    backend._uid, backend._gid = me.pw_uid, me.pw_gid
+    await _drain(
+        backend.complete(
+            agent=backend.agent,
+            messages=[{"role": "user", "content": "x"}],
+            conversation_id="c",
+        )
+    )
+    opts = FakeClient.instances[0].options
+    assert opts.env["HOME"] == str(cwd)
+    assert opts.env["CLAUDE_CONFIG_DIR"] == str(cwd / ".claude")
+    wrapper = Path(opts.cli_path).read_text()
+    assert f"UID = {me.pw_uid}" in wrapper
+    assert "os.setuid(UID)" in wrapper
 
 
 async def test_close_disconnects(cwd: Path) -> None: