Skip to content

fix(db): scope artifact upload row lock - #146

Merged
iamjr15 merged 1 commit into
mainfrom
fix/artifact-upload-lock-scope
Aug 4, 2026
Merged

fix(db): scope artifact upload row lock#146
iamjr15 merged 1 commit into
mainfrom
fix/artifact-upload-lock-scope

Conversation

@iamjr15

@iamjr15 iamjr15 commented Aug 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • lock only the active v2_agent_runs row while validating artifact-upload ownership
  • keep project, thread, and user joins read-only under their least-privilege grants
  • preserve the transaction fence against a concurrent run completion

Why

PostgreSQL applies an unqualified FOR UPDATE to every relation in a joined query. The agent role intentionally cannot update projects, so generated media reached persistence and then failed before its upload intent could be committed. FOR UPDATE OF v2_agent_runs matches the intended concurrency boundary and the clean baseline ACLs.

Verification

  • pnpm exec biome check packages/db/src/artifact-upload-intents.ts
  • pnpm turbo lint
  • pnpm turbo typecheck --filter=@cheatcode/db --filter=@cheatcode/agent-worker
  • pnpm turbo build --filter=@cheatcode/agent-worker
  • pnpm db:migrate -- --dry-run

@vercel

vercel Bot commented Aug 4, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment
Project Deployment Actions Updated (UTC)
cheatcode Skipped Skipped Aug 4, 2026 8:36am

@iamjr15
iamjr15 merged commit 49b57c6 into main Aug 4, 2026
6 checks passed
@iamjr15
iamjr15 deleted the fix/artifact-upload-lock-scope branch August 4, 2026 08:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant