fix(db): bind every raw-sql Date through its column encoder (#6337)

* fix(db): bind every raw-sql Date through its column encoder

`drizzle()` overwrites postgres-js's temporal serializers (OIDs 1082/1083/
1114/1184/1182/1185/1115/1231) with an identity function because drizzle maps
timestamps itself through the column's `mapToDriverValue`. A raw `sql` template
carries no column context, so an interpolated `Date` skips that mapping, reaches
the identity serializer unchanged, and the wire encoder throws
`ERR_INVALID_ARG_TYPE`. The pools' `prepare` / `fetch_types` options are
irrelevant: the serializer swap happens for all four combinations.

Five live sites still interpolated a bare `Date`, the stale schedule-job filter
among them — it has no try/catch, so a database async backend would surface a
500 from the schedule tick. Bind each cutoff with `sql.param(date, column)`.

The testing `sql` mock's guard cannot see untested code or the tests that
override the drizzle-orm mock, so add `check:sql-date-binding`: a Babel-AST
audit over apps/** and packages/** that resolves Date-valued bindings per file
and rejects any that reach a raw template unbound. Correct the mock's comment,
which attributed the failure to postgres-js under `fetch_types: false`.

* fix(scripts): require the documented sql-date-bound annotation form and a reason

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -159,6 +159,9 @@ jobs:
       - name: Tool request transport boundary audit
         run: bun run check:tool-request-boundary
 
+      - name: SQL Date binding audit
+        run: bun run check:sql-date-binding
+
       - name: Verify generated tool metadata is in sync
         run: bun run tool-metadata:check
 

apps/sim/app/api/schedules/execute/route.test.ts

@@ -4,6 +4,7 @@
  * @vitest-environment node
  */
 import {
+  createMockSql,
   dbChainMock,
   dbChainMockFns,
   requestUtilsMockFns,
@@ -102,7 +103,7 @@ vi.mock('drizzle-orm', () => ({
   isNull: vi.fn((field: unknown) => ({ type: 'isNull', field })),
   or: vi.fn((...conditions: unknown[]) => ({ type: 'or', conditions })),
   asc: vi.fn((field: unknown) => ({ type: 'asc', field })),
-  sql: vi.fn((strings: unknown, ...values: unknown[]) => ({ type: 'sql', strings, values })),
+  sql: createMockSql(),
 }))
 
 vi.mock('@sim/db', () => ({

apps/sim/app/api/schedules/execute/route.ts

@@ -401,7 +401,7 @@ function staleScheduleExecutionJobsFilter(now: Date) {
             THEN (${asyncJobs.payload} ->> 'executionTimeoutMs')::double precision / 1000 + ${cleanupGraceSeconds}
           ELSE ${legacyMaxDurationSeconds}
         END
-      ) * interval '1 second' <= ${now}`
+      ) * interval '1 second' <= ${sql.param(now, asyncJobs.startedAt)}`
     )
   )
 }

apps/sim/lib/data-drains/sources/cursor.test.ts

@@ -1,8 +1,13 @@
 /**
  * @vitest-environment node
  */
+import type { PgColumn } from 'drizzle-orm/pg-core'
 import { describe, expect, it } from 'vitest'
-import { decodeTimeCursor, encodeTimeCursor } from '@/lib/data-drains/sources/cursor'
+import {
+  decodeTimeCursor,
+  encodeTimeCursor,
+  timeCursorPredicate,
+} from '@/lib/data-drains/sources/cursor'
 
 describe('time cursor encoding', () => {
   it('round-trips a valid cursor', () => {
@@ -24,3 +29,24 @@ describe('time cursor encoding', () => {
     expect(decodeTimeCursor(JSON.stringify({}))).toBeNull()
   })
 })
+
+describe('timeCursorPredicate', () => {
+  const timestampCol = { name: 'created_at' } as unknown as PgColumn
+  const idCol = { name: 'id' } as unknown as PgColumn
+
+  it('returns undefined without a cursor', () => {
+    expect(timeCursorPredicate(timestampCol, idCol, null)).toBeUndefined()
+  })
+
+  it('binds the cursor timestamp through the column encoder', () => {
+    const predicate = timeCursorPredicate(timestampCol, idCol, {
+      ts: '2026-01-01T00:00:00.000Z',
+      id: 'row-1',
+    }) as unknown as { values: unknown[] }
+
+    expect(predicate.values).not.toContainEqual(new Date('2026-01-01T00:00:00.000Z'))
+    expect(predicate.values).toContainEqual(
+      expect.objectContaining({ value: new Date('2026-01-01T00:00:00.000Z') })
+    )
+  })
+})

apps/sim/lib/data-drains/sources/cursor.ts

@@ -44,7 +44,7 @@ export function timeCursorPredicate(
   cursor: TimeCursor | null
 ): SQL | undefined {
   if (!cursor) return undefined
-  return sql`(date_trunc('milliseconds', ${timestampCol}), ${idCol}) > (${new Date(cursor.ts)}, ${cursor.id})`
+  return sql`(date_trunc('milliseconds', ${timestampCol}), ${idCol}) > (${sql.param(new Date(cursor.ts), timestampCol)}, ${cursor.id})`
 }
 
 /**

apps/sim/lib/execution/remote-sandbox/image-registry.test.ts

@@ -6,6 +6,7 @@
  * guard down, plus the failure modes that must leave the retention sweep a job to
  * finish rather than losing the image silently.
  */
+import { createMockSql } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -88,7 +89,7 @@ vi.mock('drizzle-orm', () => ({
   lt: (...args: unknown[]) => args,
   notInArray: (...args: unknown[]) => args,
   or: (...args: unknown[]) => args,
-  sql: (...args: unknown[]) => args,
+  sql: createMockSql(),
 }))
 
 vi.mock('@/lib/execution/remote-sandbox/provider', () => ({
@@ -977,10 +978,16 @@ describe('cleanupSandboxImages', () => {
   })
 })
 
-/** True when any leaf of the mocked predicate tree is a `Date`, i.e. a time bound. */
+/**
+ * True when any leaf of the mocked predicate tree is a `Date`, i.e. a time bound.
+ * Cutoffs are bound through `sql.param(date, column)`, so the walk descends into
+ * the mock's fragment and param objects as well as condition arrays.
+ */
 function hasTimeBound(predicate: unknown): boolean {
   if (predicate instanceof Date) return true
-  return Array.isArray(predicate) && predicate.some(hasTimeBound)
+  if (Array.isArray(predicate)) return predicate.some(hasTimeBound)
+  if (predicate && typeof predicate === 'object') return Object.values(predicate).some(hasTimeBound)
+  return false
 }
 
 /**

apps/sim/lib/execution/remote-sandbox/image-registry.ts

@@ -1003,6 +1003,7 @@ export async function cleanupSandboxImages(retentionDays: number): Promise<{
   const images = provider.images
 
   const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000)
+  const beyondRetention = sql`coalesce(${sandboxImage.lastUsedAt}, ${sandboxImage.createdAt}) < ${sql.param(cutoff, sandboxImage.lastUsedAt)}`
   const stale = await db
     .select({
       id: sandboxImage.id,
@@ -1015,7 +1016,7 @@ export async function cleanupSandboxImages(retentionDays: number): Promise<{
     .where(
       and(
         eq(sandboxImage.provider, provider.id),
-        sql`coalesce(${sandboxImage.lastUsedAt}, ${sandboxImage.createdAt}) < ${cutoff}`,
+        beyondRetention,
         sql`not exists (select 1 from workspace_sandbox ws where ws.spec_hash = ${sandboxImage.specHash})`
       )
     )
@@ -1033,11 +1034,7 @@ export async function cleanupSandboxImages(retentionDays: number): Promise<{
   for (let offset = 0; offset < stale.length; offset += CLEANUP_CONCURRENCY) {
     const chunk = stale.slice(offset, offset + CLEANUP_CONCURRENCY)
     const outcomes = await Promise.all(
-      chunk.map((row) =>
-        claimAndDeleteImage(provider.id, images, row.specHash, [
-          sql`coalesce(${sandboxImage.lastUsedAt}, ${sandboxImage.createdAt}) < ${cutoff}`,
-        ])
-      )
+      chunk.map((row) => claimAndDeleteImage(provider.id, images, row.specHash, [beyondRetention]))
     )
 
     deleted += outcomes.filter((outcome) => outcome === 'released').length

apps/sim/lib/workspace-events/state.test.ts

@@ -0,0 +1,48 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockOnConflictDoUpdate, mockReturning } = vi.hoisted(() => ({
+  mockOnConflictDoUpdate: vi.fn(),
+  mockReturning: vi.fn(),
+}))
+
+vi.mock('@sim/db', () => ({
+  db: {
+    insert: () => ({
+      values: () => ({ onConflictDoUpdate: mockOnConflictDoUpdate }),
+    }),
+  },
+}))
+
+import { claimCooldown } from '@/lib/workspace-events/state'
+
+describe('claimCooldown', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mockOnConflictDoUpdate.mockReturnValue({ returning: mockReturning })
+    mockReturning.mockResolvedValue([{ workflowId: 'workflow-1' }])
+  })
+
+  it('claims the slot when the upsert returns a row', async () => {
+    await expect(claimCooldown('workflow-1', 'block-1', 'scope-1', 60_000)).resolves.toBe(true)
+  })
+
+  it('declines the slot when the cooldown predicate matched nothing', async () => {
+    mockReturning.mockResolvedValue([])
+    await expect(claimCooldown('workflow-1', 'block-1', 'scope-1', 60_000)).resolves.toBe(false)
+  })
+
+  it('binds the cooldown threshold through the column encoder', async () => {
+    await claimCooldown('workflow-1', 'block-1', 'scope-1', 60_000)
+
+    const { setWhere } = mockOnConflictDoUpdate.mock.calls[0][0]
+    expect(setWhere.values.some((value: unknown) => value instanceof Date)).toBe(false)
+    expect(
+      setWhere.values.some(
+        (value: unknown) => (value as { value?: unknown } | null)?.value instanceof Date
+      )
+    ).toBe(true)
+  })
+})

apps/sim/lib/workspace-events/state.ts

@@ -59,7 +59,7 @@ export async function claimCooldown(
     .onConflictDoUpdate({
       target: [simTriggerState.workflowId, simTriggerState.blockId, simTriggerState.scopeKey],
       set: { lastFiredAt: now, updatedAt: now },
-      setWhere: sql`${simTriggerState.lastFiredAt} IS NULL OR ${simTriggerState.lastFiredAt} < ${threshold}`,
+      setWhere: sql`${simTriggerState.lastFiredAt} IS NULL OR ${simTriggerState.lastFiredAt} < ${sql.param(threshold, simTriggerState.lastFiredAt)}`,
     })
     .returning({ workflowId: simTriggerState.workflowId })
 

package.json

@@ -33,6 +33,7 @@
     "check:realtime-prune": "bun run scripts/check-realtime-prune-graph.ts",
     "check:tool-request-boundary": "bun test scripts/check-tool-request-boundary.test.ts && bun run scripts/check-tool-request-boundary.ts",
     "check:tool-registry-boundary": "bun run scripts/check-tool-registry-boundary.ts",
+    "check:sql-date-binding": "bun test scripts/check-sql-date-binding.test.ts && bun run scripts/check-sql-date-binding.ts",
     "check:zustand-v5": "bun run scripts/check-zustand-v5-selectors.ts",
     "check:react-query": "bun run scripts/check-react-query-patterns.ts --check",
     "check:client-boundary": "bun run scripts/check-client-boundary-imports.ts --check",