Derive toolkit MCP executors over the daemon's open database (#1409)

The daemon's boot bundle holds the data dir's ownership lock (a BEGIN
EXCLUSIVE held open on `data.db.owner-lock`, per-connection, with
`busy_timeout = 0`) for its whole lifetime. The toolkit MCP resource built
its executor with `createExecutorHandle({ activeToolkitSlug })`, which opens
a second owned database and so deadlocks against the lock this very process
holds. Every `/mcp/toolkits/<slug>` request failed with SQLITE_BUSY,
surfaced as a 500 (-32603), while the default `/mcp` resource kept working.

`activeToolkitSlug` only varies the plugin set: it adds a tool policy
provider to the toolkits plugin, while tenant, subject, and data dir are
fixed for the process. The second open was never needed. Extract the
`makeExecutor(plugins)` seam over the bundle's already-open handle and
derive toolkit executors from it, mirroring how self-host pairs a
long-lived database with per-request plugins.

The executor is built over the inner FumaDB handle rather than the owning
`{ db, close }` wrapper, so a scoped executor's `close()` tears down its own
plugins and never the shared database.

Cover both invariants in `apps/local` unit tests, which run on every PR, and
add the toolkits scenario to the e2e job that previously ran only the stdio
one. That gap is why this shipped unnoticed.

Co-authored-by: Jack <72348727+Jack-GitHub12@users.noreply.github.com>
Co-authored-by: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>

Author: jackulau

apps/local/src/executor.test.ts

@@ -4,8 +4,15 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { describe, expect, it } from "@effect/vitest";
+import { Effect } from "effect";
 
-import { disposeExecutor, getExecutor, reloadExecutor } from "./executor";
+import {
+  createExecutorHandle,
+  disposeExecutor,
+  getExecutor,
+  getExecutorBundle,
+  reloadExecutor,
+} from "./executor";
 
 const withIsolatedExecutorDataDir = async (body: () => Promise<void>): Promise<void> => {
   const previousDataDir = process.env.EXECUTOR_DATA_DIR;
@@ -52,3 +59,47 @@ describe("reloadExecutor", () => {
     });
   });
 });
+
+describe("toolkit-scoped executors", () => {
+  it("derives a toolkit-scoped executor while the shared bundle holds the data dir", async () => {
+    await withIsolatedExecutorDataDir(async () => {
+      const bundle = await getExecutorBundle();
+
+      // The bundle holds the data dir's ownership lock (a `BEGIN EXCLUSIVE` on
+      // `data.db.owner-lock`, per-connection, `busy_timeout = 0`) for its whole
+      // lifetime. Building this executor without `borrowedDb` opens a second
+      // owned database, which hits SQLITE_BUSY against that lock and rejects —
+      // that is what made every `/mcp/toolkits/<slug>` request 500.
+      const scoped = await createExecutorHandle({
+        activeToolkitSlug: "scoped-slug",
+        borrowedDb: bundle.db,
+      });
+
+      expect(scoped.executor).toBeDefined();
+      await scoped.dispose();
+    });
+  });
+
+  it("leaves the shared database open when a scoped executor is disposed", async () => {
+    await withIsolatedExecutorDataDir(async () => {
+      const bundle = await getExecutorBundle();
+      const scoped = await createExecutorHandle({
+        activeToolkitSlug: "scoped-slug",
+        borrowedDb: bundle.db,
+      });
+
+      await scoped.dispose();
+
+      // A scoped executor borrows the bundle's open handle, so disposing one
+      // must close its own plugins and nothing else. `createExecutor` closes the
+      // database only when it was handed the owning `{ db, close }` wrapper, so
+      // the layer passes the inner handle (`sqlite.db`) instead. Hand it the
+      // wrapper and the daemon loses `/mcp` and `/api` the moment any toolkit
+      // session ends — the type system does not catch the swap, because
+      // `SqliteFumaDb` structurally satisfies `ExecutorDb`. This read is what
+      // catches it.
+      const integrations = await Effect.runPromise(bundle.executor.integrations.list());
+      expect(Array.isArray(integrations)).toBe(true);
+    });
+  });
+});