chore: retire openhub and pi ts runtime

rust/crates/control-plane/src/turso.rs

@@ -2684,18 +2684,31 @@ impl ControlPlaneStore for TursoControlPlaneStore {
 
         let conn = self.lock_conn()?;
         let now = now_text();
-        let existing = conn
-            .query_row(
+        let existing = if let Some(workspace_id) = input.workspace_id.as_deref() {
+            conn.query_row(
                 "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
                  FROM ai_policies
-                 WHERE (?1 IS NULL OR user_id = ?1)
-                   AND (?2 IS NULL OR workspace_id = ?2)
+                 WHERE workspace_id = ?1
                  ORDER BY created_at DESC
                  LIMIT 1",
-                params![input.user_id, input.workspace_id],
+                params![workspace_id],
                 row_to_ai_policy,
             )
-            .optional()?;
+            .optional()?
+        } else if let Some(user_id) = input.user_id.as_deref() {
+            conn.query_row(
+                "SELECT id, user_id, workspace_id, allowed_roots_json, model_policy_json, quota_json, created_at, updated_at, revision
+                 FROM ai_policies
+                 WHERE user_id = ?1 AND workspace_id IS NULL
+                 ORDER BY created_at DESC
+                 LIMIT 1",
+                params![user_id],
+                row_to_ai_policy,
+            )
+            .optional()?
+        } else {
+            None
+        };
 
         if let Some(existing) = existing {
             let revision = existing.revision + 1;
@@ -4593,6 +4606,52 @@ mod tests {
         assert_eq!(user_only.id, user_policy.id);
     }
 
+    #[test]
+    fn ai_policy_user_upsert_does_not_overwrite_workspace_policy() {
+        let store = store();
+        create_user(&store, "ai_user");
+        let workspace = store
+            .ensure_default_workspace("ai_user")
+            .expect("default workspace");
+
+        let workspace_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: Some(workspace.id.clone()),
+                allowed_roots_json: "[\"file:///workspace-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"workspace\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("workspace policy");
+
+        let user_policy = store
+            .upsert_ai_policy(UpsertAiPolicyInput {
+                id: None,
+                user_id: Some("ai_user".to_string()),
+                workspace_id: None,
+                allowed_roots_json: "[\"file:///user-root\"]".to_string(),
+                model_policy_json: "{\"default\":\"user\"}".to_string(),
+                quota_json: "{}".to_string(),
+            })
+            .expect("user policy");
+        assert_ne!(user_policy.id, workspace_policy.id);
+
+        let user_only = store
+            .get_ai_policy("ai_user", None)
+            .expect("get user policy")
+            .expect("user policy exists");
+        assert_eq!(user_only.id, user_policy.id);
+        assert!(user_only.allowed_roots_json.contains("user-root"));
+
+        let workspace_only = store
+            .get_ai_policy("ai_user", Some(&workspace.id))
+            .expect("get workspace policy")
+            .expect("workspace policy exists");
+        assert_eq!(workspace_only.id, workspace_policy.id);
+        assert!(workspace_only.allowed_roots_json.contains("workspace-root"));
+    }
+
     #[test]
     fn sync_state_upsert_tracks_cursor_status_and_revision() {
         let store = store();