@agent-team-foundation/first-tree-hub 0.10.15 → 0.11.1

package/dist/drizzle/0030_chat_first_workspace.sql

@@ -0,0 +1,129 @@
+-- Chat-first workspace foundation. See docs/chat-first-workspace-product-design.md
+-- for the contract this migration implements.
+--
+-- Three structural changes + one data backfill:
+--   1. chats: add last_message_at + last_message_preview projection columns
+--      and (organization_id, last_message_at DESC) index. Powers GET /me/chats
+--      cursor pagination + sort.
+--   2. chat_participants: add last_read_at + unread_mention_count columns.
+--      The chat-first workspace per-user read cursor and red-dot counter
+--      live with the participation row that owns them; no separate read-state
+--      table.
+--   3. chat_subscriptions (NEW): non-speaking observers ("watchers"). Stays
+--      strictly disjoint from chat_participants — invariant 1 in the design.
+--      ON DELETE CASCADE so dropping a chat tears down its watchers too.
+--   4. Backfill (single statement each):
+--      - chats projection from messages, using DISTINCT ON to avoid the
+--        per-row correlated subquery that would lock messages for minutes
+--        on large tables.
+--      - chat_subscriptions for every active manager whose managed non-human
+--        agent already participates in a chat the manager themselves does
+--        not speak in. Exactly the rows recomputeChatWatchers would create
+--        on first run, but in one bulk INSERT.
+--
+-- chat_participants.last_read_at + unread_mention_count default to NULL/0,
+-- which is the desired "treat all existing chats as already read" behavior
+-- on the workspace upgrade.
+
+ALTER TABLE "chats"
+  ADD COLUMN IF NOT EXISTS "last_message_at" timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS "last_message_preview" text;
+
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_chats_org_last_message"
+  ON "chats" ("organization_id", "last_message_at" DESC);
+
+--> statement-breakpoint
+ALTER TABLE "chat_participants"
+  ADD COLUMN IF NOT EXISTS "last_read_at" timestamp with time zone,
+  ADD COLUMN IF NOT EXISTS "unread_mention_count" integer NOT NULL DEFAULT 0;
+
+--> statement-breakpoint
+CREATE TABLE IF NOT EXISTS "chat_subscriptions" (
+  "chat_id" text NOT NULL,
+  "agent_id" text NOT NULL,
+  "kind" text NOT NULL DEFAULT 'watching',
+  "last_read_at" timestamp with time zone,
+  "unread_mention_count" integer NOT NULL DEFAULT 0,
+  "created_at" timestamp with time zone NOT NULL DEFAULT now(),
+  CONSTRAINT "chat_subscriptions_chat_id_fkey"
+    FOREIGN KEY ("chat_id") REFERENCES "chats"("id") ON DELETE CASCADE,
+  -- Intentionally NO ON DELETE clause on the agent FK. `services/agent.ts:
+  -- deleteAgent` is soft-only (UPDATE status='deleted', name=NULL — never
+  -- DELETE), so the row stays. Adding CASCADE would be dead code today and
+  -- silently legitimise a future hard-delete path; default RESTRICT instead
+  -- pins the soft-delete convention at the schema layer — any future caller
+  -- that tries a hard DELETE FROM agents will be forced to clean up
+  -- subscriptions explicitly. (asymmetry with chat_id FK is intentional —
+  -- chats can be hard-deleted by admin, agents cannot.)
+  CONSTRAINT "chat_subscriptions_agent_id_fkey"
+    FOREIGN KEY ("agent_id") REFERENCES "agents"("uuid"),
+  CONSTRAINT "chat_subscriptions_pkey"
+    PRIMARY KEY ("chat_id", "agent_id")
+);
+
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "idx_chat_subscriptions_agent"
+  ON "chat_subscriptions" ("agent_id");
+
+--> statement-breakpoint
+-- Backfill projection: one INSERT-shaped UPDATE driven by a DISTINCT ON
+-- subquery so messages is touched once. Avoids the correlated subquery
+-- variant that runs two scans per chat row.
+--
+-- Preview must match `chat-projection.ts:applyAfterFanOut`'s live-write
+-- semantics: a clean unquoted string for text messages, NULL for
+-- structured content (file / image / etc.). `content::text` would
+-- serialize JSONB to wire form (with quotes for strings, `{...}` for
+-- objects), producing visible inconsistency between backfilled and
+-- live-written rows. `jsonb_typeof` + `#>> '{}'` extracts the bare
+-- string only when content is a JSON string; otherwise NULL (B3 in
+-- PR review). `trim()` mirrors `outboundContent.trim()` in
+-- `chat-projection.ts:applyAfterFanOut` so leading whitespace doesn't
+-- visually jump on the first live overwrite.
+WITH last_msg AS (
+  SELECT DISTINCT ON ("chat_id")
+    "chat_id",
+    "created_at",
+    CASE
+      WHEN jsonb_typeof("content") = 'string'
+        THEN LEFT(trim("content" #>> '{}'), 200)
+      ELSE NULL
+    END AS "preview"
+  FROM "messages"
+  ORDER BY "chat_id", "created_at" DESC
+)
+UPDATE "chats" c
+   SET "last_message_at" = lm."created_at",
+       "last_message_preview" = lm."preview"
+  FROM last_msg lm
+ WHERE c."id" = lm."chat_id";
+
+--> statement-breakpoint
+-- Watcher backfill: every active member whose managed (non-human) agent
+-- participates in a chat where the member's own human agent is NOT a
+-- speaking participant. Idempotent via ON CONFLICT.
+--
+-- The explicit NULL casts are required: PostgreSQL infers a bare NULL in a
+-- VALUES/SELECT list as `text`, which then fails to coerce to the target
+-- columns (timestamptz / integer respectively).
+INSERT INTO "chat_subscriptions"
+  ("chat_id", "agent_id", "kind", "last_read_at", "unread_mention_count", "created_at")
+SELECT DISTINCT
+       cp."chat_id",
+       m."agent_id",
+       'watching',
+       NULL::timestamp with time zone,
+       0,
+       now()
+  FROM "chat_participants" cp
+  JOIN "agents"  a ON a."uuid" = cp."agent_id"
+  JOIN "members" m ON m."id"   = a."manager_id"
+ WHERE m."status" = 'active'
+   AND a."type" <> 'human'
+   AND NOT EXISTS (
+     SELECT 1 FROM "chat_participants" cp2
+      WHERE cp2."chat_id" = cp."chat_id"
+        AND cp2."agent_id" = m."agent_id"
+   )
+ON CONFLICT ("chat_id", "agent_id") DO NOTHING;

package/dist/drizzle/0031_drop_system_configs.sql

@@ -0,0 +1,11 @@
+-- Drop the `system_configs` table — replaced by deployment-level env
+-- vars (FIRST_TREE_HUB_INBOX_TIMEOUT_SECONDS, FIRST_TREE_HUB_MAX_RETRY_COUNT,
+-- FIRST_TREE_HUB_POLLING_INTERVAL_SECONDS, FIRST_TREE_HUB_PRESENCE_CLEANUP_SECONDS,
+-- FIRST_TREE_HUB_NOTIFICATION_WEBHOOK_URL).
+--
+-- See proposals/hub-strip-jwt-ambient-scope.20260508.md §3.5 + §6.3.
+-- The table held tunables that were never customer-configurable; promoting
+-- them to env vars closes the multi-tenant security gap where any org admin
+-- could mutate cross-org runtime behavior.
+
+DROP TABLE IF EXISTS "system_configs";

package/dist/drizzle/meta/_journal.json

@@ -211,6 +211,20 @@
       "when": 1777766400000,
       "tag": "0029_direct_agent_only_mention_only",
       "breakpoints": true
+    },
+    {
+      "idx": 30,
+      "version": "7",
+      "when": 1777852800000,
+      "tag": "0030_chat_first_workspace",
+      "breakpoints": true
+    },
+    {
+      "idx": 31,
+      "version": "7",
+      "when": 1777939200000,
+      "tag": "0031_drop_system_configs",
+      "breakpoints": true
     }
   ]
 }

package/dist/errors-BmyRwN0Y-CIZZ_sDc.mjs

@@ -0,0 +1,92 @@
+import { integer, jsonb, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+//#region ../server/dist/errors-BmyRwN0Y.mjs
+/** Organization entity. Agents and chats belong to exactly one organization. */
+const organizations = pgTable("organizations", {
+	id: text("id").primaryKey(),
+	name: text("name").unique().notNull(),
+	displayName: text("display_name").notNull(),
+	maxAgents: integer("max_agents").notNull().default(0),
+	maxMessagesPerMinute: integer("max_messages_per_minute").notNull().default(0),
+	features: jsonb("features").$type().notNull().default({}),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+/** User accounts. Passwords are stored as bcrypt hashes. */
+const users = pgTable("users", {
+	id: text("id").primaryKey(),
+	username: text("username").unique().notNull(),
+	passwordHash: text("password_hash").notNull(),
+	displayName: text("display_name").notNull(),
+	avatarUrl: text("avatar_url"),
+	status: text("status").notNull().default("active"),
+	createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+});
+var AppError = class extends Error {
+	constructor(statusCode, message, attrs) {
+		super(message);
+		this.statusCode = statusCode;
+		this.attrs = attrs;
+		this.name = "AppError";
+	}
+};
+var NotFoundError = class extends AppError {
+	constructor(message = "Not found", attrs) {
+		super(404, message, attrs);
+		this.name = "NotFoundError";
+	}
+};
+var UnauthorizedError = class extends AppError {
+	constructor(message = "Unauthorized", attrs) {
+		super(401, message, attrs);
+		this.name = "UnauthorizedError";
+	}
+};
+var ForbiddenError = class extends AppError {
+	constructor(message = "Forbidden", attrs) {
+		super(403, message, attrs);
+		this.name = "ForbiddenError";
+	}
+};
+var ConflictError = class extends AppError {
+	constructor(message = "Conflict", attrs) {
+		super(409, message, attrs);
+		this.name = "ConflictError";
+	}
+};
+var BadRequestError = class extends AppError {
+	constructor(message = "Bad request", attrs) {
+		super(400, message, attrs);
+		this.name = "BadRequestError";
+	}
+};
+/**
+* Thrown when an operation targets a client whose organization does not match
+* the caller's authenticated organization. Retained for wire compatibility:
+* the read paths that produced this error were retired in
+* decouple-client-from-identity §4.1, so the server itself no longer raises
+* it. SDK consumers may still pattern-match the `code` field on legacy
+* payloads.
+*/
+var ClientOrgMismatchError = class extends AppError {
+	code = "CLIENT_ORG_MISMATCH";
+	constructor(message = "Client belongs to a different organization", attrs) {
+		super(403, message, attrs);
+		this.name = "ClientOrgMismatchError";
+	}
+};
+/**
+* Thrown when a client.yaml is presented with a JWT whose user_id does not
+* match the row's owner. The CLI responds by guiding the operator through
+* `first-tree-hub client claim --confirm` to take over ownership, which
+* unpins the previous owner's agents from this machine.
+*/
+var ClientUserMismatchError = class extends AppError {
+	code = "CLIENT_USER_MISMATCH";
+	constructor(message = "Client belongs to a different user", attrs) {
+		super(403, message, attrs);
+		this.name = "ClientUserMismatchError";
+	}
+};
+//#endregion
+export { ConflictError as a, UnauthorizedError as c, ClientUserMismatchError as i, organizations as l, BadRequestError as n, ForbiddenError as o, ClientOrgMismatchError as r, NotFoundError as s, AppError as t, users as u };

package/dist/{esm-CYu4tXXn.mjs → esm-iadMkGbV.mjs}

@@ -1,39 +1,4 @@
-import { createRequire } from "node:module";
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __esmMin = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
-var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __toCommonJS = (mod) => __hasOwnProp.call(mod, "module.exports") ? mod["module.exports"] : __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
-//#endregion
+import { n as __esmMin, r as __exportAll } from "./chunk-BSw8zbkd.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+api@1.9.1/node_modules/@opentelemetry/api/build/esm/version.js
 var VERSION;
 var init_version = __esmMin((() => {
@@ -1548,4 +1513,4 @@ var init_esm = __esmMin((() => {
 	};
 }));
 //#endregion
-export { diag as a, SpanKind as c, __exportAll as d, __require as f, propagation as i, __commonJSMin as l, __toESM as m, init_esm as n, context as o, __toCommonJS as p, trace as r, SpanStatusCode as s, esm_exports as t, __esmMin as u };
+export { metrics as a, SpanStatusCode as c, createContextKey as d, DiagLogLevel as f, propagation as i, SpanKind as l, init_esm as n, diag as o, trace as r, context as s, esm_exports as t, DiagConsoleLogger as u };

package/dist/execAsync-CCyouKZM.mjs

@@ -0,0 +1,10 @@
+import { i as __require, t as __commonJSMin } from "./chunk-BSw8zbkd.mjs";
+//#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.1_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js
+var require_execAsync = /* @__PURE__ */ __commonJSMin(((exports) => {
+	Object.defineProperty(exports, "__esModule", { value: true });
+	exports.execAsync = void 0;
+	const child_process = __require("child_process");
+	exports.execAsync = __require("util").promisify(child_process.exec);
+}));
+//#endregion
+export { require_execAsync as t };

package/dist/{execAsync-XMc-nFn-.mjs → execAsync-pImxPKN5.mjs}

@@ -1,4 +1,4 @@
-import { f as __require, l as __commonJSMin } from "./esm-CYu4tXXn.mjs";
+import { i as __require, t as __commonJSMin } from "./chunk-BSw8zbkd.mjs";
 //#region ../../node_modules/.pnpm/@opentelemetry+resources@2.7.0_@opentelemetry+api@1.9.1/node_modules/@opentelemetry/resources/build/src/detectors/platform/node/machine-id/execAsync.js
 var require_execAsync = /* @__PURE__ */ __commonJSMin(((exports) => {
 	Object.defineProperty(exports, "__esModule", { value: true });

package/dist/{feishu-DQ1l18Ah.mjs → feishu-AEMHwT6L.mjs}

@@ -1,5 +1,5 @@
-import { d as __exportAll } from "./esm-CYu4tXXn.mjs";
-import { r as AGENT_SELECTOR_HEADER } from "./dist-D6AOiyNg.mjs";
+import { r as __exportAll } from "./chunk-BSw8zbkd.mjs";
+import { r as AGENT_SELECTOR_HEADER } from "./dist-BkvrONSQ.mjs";
 //#region src/core/feishu.ts
 var feishu_exports = /* @__PURE__ */ __exportAll({
 	bindFeishuBot: () => bindFeishuBot,