fix(runtime): accept integer ai_access (Turso) in the AI-seat synthesis (#2336)

sys_user.ai_access reads back as integer 1 on Turso/libSQL (sqlite booleans),
but the seat synthesis checked `=== true` (boolean) — so `1 !== true` and a
SEATED user got no `ai_seat` -> /ai/agents=[] under enforce. The memory driver
returns a JS boolean, which masked it in local testing. Caught on a real
Turso-backed staging env (the env creator was seated yet denied).

Accept `true | 1 | '1'` in both synthesis points: resolveExecutionContext (the
gate) and plugin-hono-server data-route resolveCtx.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: os-zhuang

packages/plugins/plugin-hono-server/src/hono-plugin.ts

@@ -509,7 +509,9 @@ export class HonoServerPlugin implements Plugin {
                             'sys_user',
                             { where: { id: userId }, limit: 1, ...sysCtx } as any,
                         ).catch(() => []);
-                        if ((uRows?.[0] as any)?.ai_access === true) permissions.push('ai_seat');
+                        // Turso returns sqlite booleans as 1/0; memory driver as boolean.
+                        const aiAccess = (uRows?.[0] as any)?.ai_access;
+                        if (aiAccess === true || aiAccess === 1 || aiAccess === '1') permissions.push('ai_seat');
                     } catch {
                         /* no ai_access column / query failed → no seat (safe) */
                     }

packages/runtime/src/security/resolve-execution-context.ts

@@ -414,7 +414,11 @@ export async function resolveExecutionContext(opts: ResolveOptions): Promise<Exe
   // Guarded (tryFind swallows errors) → can only ever ADD access, never break auth.
   if (userId && !ctx.permissions!.includes('ai_seat')) {
     const seatRows = await tryFind(ql, 'sys_user', { id: userId }, 1);
-    if ((seatRows?.[0] as { ai_access?: unknown } | undefined)?.ai_access === true) {
+    // Turso/libSQL returns sqlite booleans as integer 1/0; the memory driver
+    // returns a JS boolean. Accept both (+ the stringified form) so the seat
+    // resolves regardless of the env's data driver.
+    const aiAccess = (seatRows?.[0] as { ai_access?: unknown } | undefined)?.ai_access;
+    if (aiAccess === true || aiAccess === 1 || aiAccess === '1') {
       ctx.permissions!.push('ai_seat');
     }
   }