test(sag): cover database access audit gate

[gregkonush]

Summary

• Adds a SAG gateway regression test for AgentRun database inspection requests.
• Verifies database table inspection stays approval-gated and emits a database:list_tables SQL audit event.
• Confirms duplicate database inspection requests reuse the existing pending approval for the same AgentRun target.

Related Issues

None

Testing

• PASS: bun run --filter @proompteng/sag test -- src/server/gateway.test.ts
• PASS: bun run --filter @proompteng/sag tsc
• PASS: bun run --filter @proompteng/sag lint
• PASS: bun run --filter @proompteng/sag lint:oxlint
• PASS: bun run --filter @proompteng/sag build
• PASS: git diff --check
• PASS: curl -fsS --max-time 10 https://sag.proompteng.ai/api/health returned persistence=postgres, totalTasks=5, totalEvents=44, awaitingApproval=1, and blockedAgentRuns=2.
• PASS: curl -fsS --max-time 10 https://sag.proompteng.ai/api/agent-runs/sag-mp582cjf/database-access returned a pending database.list_tables approval for agents/sag-mp582cjf:sag.database.tables with tableCount=0 while approval is pending.

Screenshots (if applicable)

N/A

Breaking Changes

None

Checklist

• Testing section documents the exact validation performed (or N/A with justification).
• Screenshots and Breaking Changes sections are handled appropriately (removed or filled in).
• Documentation, release notes, and follow-ups are updated or tracked.

[gregkonush]

Progress

• Implemented and pushed test(sag): cover database access audit gate.
• Queried live SAG database-backed endpoints:
  • /api/health: persistence=postgres, totalTasks=5, totalEvents=44, awaitingApproval=1, blockedAgentRuns=2.
  • /api/agent-runs/sag-mp582cjf/database-access: pending database.list_tables approval for agents/sag-mp582cjf:sag.database.tables, tableCount=0 while approval is pending.
• Local validation passed: SAG test, typecheck, formatter, Oxlint, production build, and git diff --check.
• PR test(sag): cover database access audit gate #6587 is open, non-draft, mergeable, and all reported checks are complete. Required-check query reports no required checks on this branch.

PR

#6587