Re-land #16397: initialize Cloud VM account pools (migration applied first)

[lawrencecchen]

Re-lands #16397 (austinywang), which #16405 reverted after a production outage: every Cloud VM create failed with model_plane_unavailable from 2026-10-01 08:44 to 15:47 UTC (30 of 30), because migration 20261001000000_coderouter_vm_pool_initialization was never applied.

The code and migration are unchanged from #16397. The difference is ordering:

1. Apply the migration to PlanetScale staging, then main (production), with bun run cloud-vm:migrate -- <target>. Verified read-only first: it is the only pending migration on both branches, and the runner selects pending migrations by name, so its earlier folder timestamp does not cause a skip.
2. Merge this PR only after coderouter_pool_initializations exists in production.

Verification: bun scripts/db-migrate.mjs twice on a fresh Postgres 16 (the CI path), then every coderouter-*db-behavior suite: 73 pass, 0 fail, including #16397's own regression test. bun test tests/coderouter-*: 553 pass, 0 fail. Typecheck clean.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Re-lands Cloud VM account pool initialization, which the previous revert removed after a production outage: Cloud VM creates failed with model_plane_unavailable because the migration had not been applied. This re-land is identical but merges only after the migration is applied to staging and production.

• Adds coderouter_pool_initializations to mark pools that already received their initial snapshot of the team's shared accounts.
• The first VM token request after deploy marks the default pool as initialized and inserts its grants.
• Subsequent token refreshes skip the snapshot, preserving operator removals instead of recreating them.

^{Written for commit 45c9eec. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Newly initialized default CodeRouter pools now include accounts visible to the team, so VMs can route requests through those accounts without requiring separate pool grants.
  • Team-visible legacy Codex accounts selected for a VM’s pool can now be routed through that VM. Private Codex accounts remain hidden, and removing a pool grant removes the shared account from the VM’s listing.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: manaflow-ai/cmux/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6cbecf06-ceae-49b0-b0c8-f1df907087b1

📥 Commits

Reviewing files that changed from the base of the PR and between 7d57a03 and 45c9eec.

📒 Files selected for processing (4)

• web/db/migrations/20261001000000_coderouter_vm_pool_initialization/migration.sql
• web/db/schema.ts
• web/services/coderouter/repository.ts
• web/tests/coderouter-vm-scope-db-behavior.test.ts

 _______________________________________________________
< Perhaps loot boxes can help us cover the OpenAI bill. >
 -------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

1 issue found across 4 files

_{You’re at about 91% of the monthly reviewed-line limit. You may want to disable incremental reviews to conserve quota. Reviews will continue until that limit is exceeded. If you need help avoiding interruptions, please contact contact@cubic.dev.}

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="web/services/coderouter/repository.ts">

<violation number="1" location="web/services/coderouter/repository.ts:475">
P1: These grant queries reread `vm.coderouter_pool_id` after the marker statement, so a concurrent same-team pool reassignment can mark the default pool initialized but grant every shared account to the VM’s new custom pool. Use the pool ID returned by the marker for both inserts, or lock and revalidate the VM’s pool.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: These grant queries reread vm.coderouter_pool_id after the marker statement, so a concurrent same-team pool reassignment can mark the default pool initialized but grant every shared account to the VM’s new custom pool. Use the pool ID returned by the marker for both inserts, or lock and revalidate the VM’s pool.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At web/services/coderouter/repository.ts, line 475:

<comment>These grant queries reread `vm.coderouter_pool_id` after the marker statement, so a concurrent same-team pool reassignment can mark the default pool initialized but grant every shared account to the VM’s new custom pool. Use the pool ID returned by the marker for both inserts, or lock and revalidate the VM’s pool.</comment>

<file context>
@@ -449,6 +450,47 @@ export async function issueVmAuthorizationToken(
+
+    await tx.execute(sql`
+      insert into coderouter_pool_accounts (team_id, pool_id, account_id, granted_by_user_id)
+      select vm.owner_team_id, vm.coderouter_pool_id, account.id, account.created_by
+      from cloud_vms vm
+      join coderouter_accounts account on account.team_id = vm.owner_team_id
</file context>

[github-actions]

Merge receipt for 45c9eec33f: every check was green at merge (18 verified; 19 skipped by policy). Full suite runs on main after merge.