@agent-team-foundation/first-tree-hub 0.12.10 → 0.13.0

package/dist/{saas-connect-Fgnnnola.mjs → saas-connect-Bb5LR4y6.mjs}

@@ -1,12 +1,12 @@
 import { a as __toCommonJS, o as __toESM, t as __commonJSMin } from "./chunk-BSw8zbkd.mjs";
 import { A as FIRST_TREE_HUB_ATTR, C as stampOrgScope, D as untrustedAttrs, E as startWsConnectionSpan, M as require_pino, O as withSpan, S as stampChatResource, _ as rootLogger$1, a as buildRateLimitError, c as currentTraceId, g as reportErrorToRoot, i as bodyCaptureOnSendHook, j as redactUrl, k as withWsMessageSpan, l as decodeJwtForTrace, m as observabilityPlugin, n as applyLoggerConfig, o as classifyJoseError, r as attachRequestContext, s as createLogger$1, t as adapterAttrs, u as endWsConnectionSpan, x as stampAgentResource, y as setWsConnectionAttrs } from "./observability-BAScT_5S-BcW9HgkG.mjs";
-import { C as resetConfigMeta, E as setConfigValue, S as resetConfig, T as serverConfigSchema, b as migrateLegacyHome, c as resolveServerUrl, d as DEFAULT_CONFIG_DIR, f as DEFAULT_DATA_DIR$1, g as collectMissingPrompts, h as clientConfigSchema, i as ensureFreshAccessToken, l as saveAgentConfig, m as agentConfigSchema, o as loadCredentials, p as DEFAULT_HOME_DIR$1, u as saveCredentials, v as initConfig, w as resolveConfigReadonly, y as loadAgents } from "./bootstrap-CW73oEYn.mjs";
+import { C as resetConfigMeta, E as setConfigValue, S as resetConfig, T as serverConfigSchema, b as migrateLegacyHome, c as resolveServerUrl, d as DEFAULT_CONFIG_DIR, f as DEFAULT_DATA_DIR$1, g as collectMissingPrompts, h as clientConfigSchema, i as ensureFreshAccessToken, l as saveAgentConfig, m as agentConfigSchema, o as loadCredentials, p as DEFAULT_HOME_DIR$1, u as saveCredentials, v as initConfig, w as resolveConfigReadonly, y as loadAgents } from "./bootstrap-Cya2OoHz.mjs";
 import { a as print, i as blank, n as CLI_USER_AGENT, r as COMMAND_VERSION, s as status, t as cliFetch } from "./cli-fetch--tiwKm5S.mjs";
-import { $ as onboardingEventSchema, A as createOrgFromMeSchema, B as githubStartQuerySchema, C as contextTreeSnapshotSchema, Ct as updateClientCapabilitiesSchema, D as createChatSchema, E as createAgentSchema, Et as wsAuthFrameSchema, G as isOrgSettingNamespace, H as inboxAckFrameSchema, I as githubAppInstallationClaimBodySchema, J as joinByInvitationSchema, K as isRedactedEnvValue, L as githubAppInstallationPermissionsSchema$1, M as defaultRuntimeConfigPayload, N as delegateFeishuUserSchema, O as createMeChatSchema, P as dryRunAgentRuntimeConfigSchema, Q as notificationQuerySchema, R as githubCallbackQuerySchema, S as connectTokenExchangeSchema, St as updateChatSchema, T as createAdapterMappingSchema, Tt as updateOrganizationSchema, U as inboxDeliverFrameSchema$1, V as imageInlineContentSchema, W as inboxPollQuerySchema, X as loginSchema, Y as listMeChatsQuerySchema, Z as messageSourceSchema$1, _ as agentRuntimeConfigPayloadSchema$1, _t as stripCode, a as AGENT_TYPES, at as rebindAgentSchema, bt as updateAgentRuntimeConfigSchema, ct as safeRedirectPath, d as ORG_SETTINGS_NAMESPACES$1, dt as sendMessageSchema, et as paginationQuerySchema, f as WS_AUTH_FRAME_TIMEOUT_MS, ft as sendToAgentSchema, g as agentPinnedMessageSchema$1, gt as sessionStateMessageSchema, h as agentBindRequestSchema, ht as sessionReconcileRequestSchema, i as AGENT_STATUSES, k as createMemberSchema, l as MENTION_REGEX, m as addParticipantSchema, mt as sessionEventSchema$1, n as AGENT_NAME_REGEX$1, nt as patchOnboardingSchema, o as AGENT_VISIBILITY, ot as refreshTokenSchema, p as addMeChatParticipantsSchema, pt as sessionEventMessageSchema, q as isReservedAgentName$1, r as AGENT_SELECTOR_HEADER$1, s as CHAT_ENGAGEMENT_STATUSES, st as runtimeStateMessageSchema, t as AGENT_BIND_REJECT_REASONS, tt as patchChatEngagementSchema, u as NOTIFICATION_TYPES, ut as selfServiceFeishuBotSchema, v as agentTypeSchema$1, vt as submitQuestionAnswerSchema, w as createAdapterConfigSchema, wt as updateMemberSchema, x as clientRegisterSchema, xt as updateAgentSchema, y as chatMetadataSchema$1, yt as updateAdapterConfigSchema, z as githubDevCallbackQuerySchema } from "./dist-B1GHzMLc.mjs";
-import { a as ConflictError, c as UnauthorizedError, i as ClientUserMismatchError$1, l as organizations, n as BadRequestError, o as ForbiddenError, r as ClientOrgMismatchError$1, s as NotFoundError, t as AppError, u as users } from "./errors-CF5evtJt-B0NTIVPt.mjs";
+import { $ as notificationQuerySchema, A as createMemberSchema, B as githubDevCallbackQuerySchema, C as connectTokenExchangeSchema, Ct as updateChatSchema, D as createAgentSchema, Dt as wsAuthFrameSchema, E as createAdapterMappingSchema, Et as updateOrganizationSchema, F as dryRunAgentRuntimeConfigSchema, G as inboxPollQuerySchema, H as imageInlineContentSchema, J as isReservedAgentName$1, K as isOrgSettingNamespace, L as githubAppInstallationClaimBodySchema, N as defaultRuntimeConfigPayload, O as createChatSchema, P as delegateFeishuUserSchema, Q as messageSourceSchema$1, R as githubAppInstallationPermissionsSchema$1, S as clientRegisterSchema, St as updateAgentSchema, T as createAdapterConfigSchema, Tt as updateMemberSchema, U as inboxAckFrameSchema, V as githubStartQuerySchema, W as inboxDeliverFrameSchema$1, X as listMeChatsQuerySchema, Y as joinByInvitationSchema, Z as loginSchema, _ as agentPinnedMessageSchema$1, _t as sessionStateMessageSchema, a as AGENT_TYPES, b as chatMetadataSchema$1, bt as updateAdapterConfigSchema, ct as runtimeStateMessageSchema, d as NOTIFICATION_TYPES, dt as selfServiceFeishuBotSchema, et as onboardingEventSchema, f as ORG_SETTINGS_NAMESPACES$1, ft as sendMessageSchema, g as agentBindRequestSchema, gt as sessionReconcileRequestSchema, h as addParticipantSchema, ht as sessionEventSchema$1, i as AGENT_STATUSES, j as createOrgFromMeSchema, k as createMeChatSchema, lt as safeRedirectPath, m as addMeChatParticipantsSchema, mt as sessionEventMessageSchema, n as AGENT_NAME_REGEX$1, nt as patchChatEngagementSchema, o as AGENT_VISIBILITY, ot as rebindAgentSchema, p as WS_AUTH_FRAME_TIMEOUT_MS, pt as sendToAgentSchema, q as isRedactedEnvValue, r as AGENT_SELECTOR_HEADER$1, rt as patchOnboardingSchema, s as CHAT_ENGAGEMENT_STATUSES, st as refreshTokenSchema, t as AGENT_BIND_REJECT_REASONS, tt as paginationQuerySchema, u as MENTION_REGEX, v as agentRuntimeConfigPayloadSchema$1, vt as stripCode, w as contextTreeSnapshotSchema, wt as updateClientCapabilitiesSchema, xt as updateAgentRuntimeConfigSchema, y as agentTypeSchema$1, yt as submitQuestionAnswerSchema, z as githubCallbackQuerySchema } from "./dist-C8yStx2L.mjs";
+import { a as ConflictError, c as UnauthorizedError, i as ClientUserMismatchError$1, l as organizations, n as BadRequestError, o as ForbiddenError, r as ClientOrgMismatchError$1, s as NotFoundError, t as AppError, u as users } from "./errors-LPcARA4K-Dbrptiyz.mjs";
 import { n as init_esm, r as trace, t as esm_exports } from "./esm-iadMkGbV.mjs";
-import { $ as notifyRecipients, A as getPresence, B as listAgentsManagedByUser, C as ensureParticipant, D as getChatDetail, E as getCachedAudience, F as joinAsParticipant, G as listClients, H as listChatParticipantsWithNames, I as joinChat, K as listClientsForOrgAdmin, L as leaveAsParticipant, M as heartbeatInstance, N as inboxEntries, O as getClient, P as invalidateChatAudience, Q as messages, R as leaveChat, S as ensureCanJoin, T as getActivityOverview, U as listChats, V as listAgentsWithRuntime, W as listChatsForMember, X as markSupersededByChat, Y as markStaleAgents, Z as members, _ as createChat, _t as unbindAgent, a as agentVisibilityCondition, at as registerClient, b as disconnectClient, c as assertParticipant, ct as resolveChatMembership, d as chatMembership, dt as sendToAgent$1, et as pendingQuestions, f as chats, ft as serverInstances, g as clients, gt as touchAgent, h as cleanupStalePresence, ht as submitAnswer, i as agentPresence, it as registerChatMessageDispatcher, j as heartbeatClient, k as getOnlineCount, l as bindAgent, lt as retireClient, m as cleanupStaleClients, mt as setRuntimeState, n as addParticipant, nt as recomputeWatchersForAgent, o as agents, ot as removeParticipant, p as claimClient, pt as setOffline, q as listMessages, r as agentChatSessions, rt as recomputeWatchersForMember, s as assertClientOwner, st as resetActivity, t as addChatParticipants, tt as recomputeChatWatchers, u as changeChatType, ut as sendMessage, v as createNotifier, vt as updateClientCapabilities, w as findOrCreateDirectChat, x as editMessage, y as deriveAuthState, yt as upsertSessionState, z as listActiveAgentsPinnedToClient } from "./client-BViGcaUC-CZb2Svgh.mjs";
-import { a as invitationRedemptions, c as recordRedemption, i as getActiveInvitation, l as rotateInvitation, n as ensureActiveInvitation, o as invitations, r as findActiveByToken, t as buildInviteUrl, u as uuidv7 } from "./invitation-Bg0TRiyx-BsZH4GCS.mjs";
+import { $ as notifyRecipients, A as getPresence, B as listAgentsManagedByUser, C as ensureParticipant, D as getChatDetail, E as getCachedAudience, F as joinAsParticipant, G as listClients, H as listChatParticipantsWithNames, I as joinChat, K as listClientsForOrgAdmin, L as leaveAsParticipant, M as heartbeatInstance, N as inboxEntries, O as getClient, P as invalidateChatAudience, Q as messages, R as leaveChat, S as ensureCanJoin, T as getActivityOverview, U as listChats, V as listAgentsWithRuntime, W as listChatsForMember, X as markSupersededByChat, Y as markStaleAgents, Z as members, _ as createChat, _t as unbindAgent, a as agentVisibilityCondition, at as registerClient, b as disconnectClient, c as assertParticipant, ct as resolveChatMembership, d as chatMembership, dt as sendToAgent$1, et as pendingQuestions, f as chats, ft as serverInstances, g as clients, gt as touchAgent, h as cleanupStalePresence, ht as submitAnswer, i as agentPresence, it as registerChatMessageDispatcher, j as heartbeatClient, k as getOnlineCount, l as bindAgent, lt as retireClient, m as cleanupStaleClients, mt as setRuntimeState, n as addParticipant, nt as recomputeWatchersForAgent, o as agents, ot as removeParticipant, p as claimClient, pt as setOffline, q as listMessages, r as agentChatSessions, rt as recomputeWatchersForMember, s as assertClientOwner, st as resetActivity, t as addChatParticipants, tt as recomputeChatWatchers, u as changeChatType, ut as sendMessage, v as createNotifier, vt as updateClientCapabilities, w as findOrCreateDirectChat, x as editMessage, y as deriveAuthState, yt as upsertSessionState, z as listActiveAgentsPinnedToClient } from "./client-BH4CmUL0-CybE3kuP.mjs";
+import { a as invitationRedemptions, c as recordRedemption, i as getActiveInvitation, l as rotateInvitation, n as ensureActiveInvitation, o as invitations, r as findActiveByToken, t as buildInviteUrl, u as uuidv7 } from "./invitation-DZO4NX3P-BPxTeHf-.mjs";
 import { createRequire } from "node:module";
 import { ZodError, z } from "zod";
 import { basename, delimiter, dirname, extname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
@@ -386,6 +386,7 @@ z.object({
 const PROMPT_APPEND_MAX_LENGTH = 32e3;
 const MCP_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/i;
 const ENV_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+const WINDOWS_DRIVE_PATH_PATTERN = /^[A-Za-z]:/;
 const promptConfigSchema = z.object({ append: z.string().max(PROMPT_APPEND_MAX_LENGTH).default("") });
 const mcpStdioServerSchema = z.object({
 	name: z.string().regex(MCP_NAME_PATTERN, "MCP name must match /^[a-z0-9][a-z0-9_-]{0,63}$/i"),
@@ -415,10 +416,38 @@ const envEntrySchema = z.object({
 	value: z.string(),
 	sensitive: z.boolean().default(false)
 });
+function hasControlCharacters(value) {
+	for (let idx = 0; idx < value.length; idx++) {
+		const code = value.charCodeAt(idx);
+		if (code <= 31 || code === 127) return true;
+	}
+	return false;
+}
+function getRepoLocalPathSafetyError(localPath) {
+	if (localPath.length === 0) return "Git repo local path must not be empty";
+	if (localPath.trim() !== localPath) return "Git repo local path must not have leading or trailing whitespace";
+	if (hasControlCharacters(localPath)) return "Git repo local path must not contain control characters";
+	if (localPath.includes("\\")) return "Git repo local path must use forward slashes";
+	if (localPath.startsWith("/") || WINDOWS_DRIVE_PATH_PATTERN.test(localPath)) return "Git repo local path must be relative";
+	const segments = localPath.split("/");
+	for (const segment of segments) {
+		if (!segment) return "Git repo local path must not contain empty path segments";
+		if (segment === "." || segment === "..") return "Git repo local path must not contain dot segments";
+		if (segment.trim() !== segment) return "Git repo local path segments must not have leading or trailing whitespace";
+	}
+	return null;
+}
 const gitRepoSchema = z.object({
 	url: z.string().min(1),
 	ref: z.string().min(1).optional(),
-	localPath: z.string().min(1).optional()
+	localPath: z.string().min(1).superRefine((localPath, ctx) => {
+		const safetyError = getRepoLocalPathSafetyError(localPath);
+		if (!safetyError) return;
+		ctx.addIssue({
+			code: z.ZodIssueCode.custom,
+			message: safetyError
+		});
+	}).optional()
 });
 /**
 * Untagged base shape — 5 user-tunable fields, no `kind` discriminator.
@@ -1261,6 +1290,26 @@ const meChatParticipantSchema = z.object({
 	displayName: z.string(),
 	type: z.string()
 });
+/**
+* Live activity hint surfaced in the conversation row's time slot. Derived
+* server-side from the latest `session_events` row for the chat. See
+* `MeChatRow.liveActivity` for the lifecycle rules.
+*
+* `kind` is intentionally narrower than the full `sessionEventKind` enum:
+* `turn_end` / `error` produce `liveActivity: null` rather than a live
+* indicator.
+*/
+const liveActivityKindSchema = z.enum([
+	"tool_call",
+	"thinking",
+	"assistant_text"
+]);
+const liveActivitySchema = z.object({
+	agentId: z.string(),
+	kind: liveActivityKindSchema,
+	label: z.string(),
+	startedAt: z.string()
+});
 const meChatRowSchema = z.object({
 	chatId: z.string(),
 	type: z.string(),
@@ -1274,7 +1323,8 @@ const meChatRowSchema = z.object({
 	unreadMentionCount: z.number().int(),
 	canReply: z.boolean(),
 	engagementStatus: chatEngagementStatusSchema,
-	workingAgentIds: z.array(z.string())
+	engagedAgentIds: z.array(z.string()),
+	liveActivity: liveActivitySchema.nullable()
 });
 z.object({
 	rows: z.array(meChatRowSchema),
@@ -3309,7 +3359,7 @@ You are running inside **Agent Hub**, a messaging platform for agent teams.
 
 - Messages from other team members arrive as your prompt input
 - Each message includes a \`[From: <agent-name>]\` header — that name is also
-  what you pass back to \`agent send\` to reply to or address that agent
+  what you pass back to \`chat send\` to reply to or address that agent
 - **Your final text response is automatically delivered** to the chat — just respond normally
 - For **proactive communication** (sending to other agents, other chats, or structured data),
   use the \`first-tree-hub\` CLI below
@@ -3333,7 +3383,7 @@ The \`first-tree-hub\` CLI reads these automatically — no extra setup needed.
 
 ## Sending Messages
 
-Use the \`first-tree-hub agent send\` CLI — it reads the env vars above and
+Use the \`first-tree-hub chat send\` CLI — it reads the env vars above and
 attaches the \`Authorization\` + \`X-Agent-Id\` headers automatically:
 
 \`\`\`bash
@@ -3345,28 +3395,38 @@ attaches the \`Authorization\` + \`X-Agent-Id\` headers automatically:
 # the case in a group chat where someone @-mentioned you to talk to them),
 # the message stays in that chat. Otherwise it falls back to a direct chat
 # between you and the recipient. You don't need to think about which.
-first-tree-hub agent send <agentName> "your message"
+first-tree-hub chat send <agentName> "your message"
 
 # Send into a specific chat by id — use this only when you explicitly want
 # to address a chat your current session is NOT bound to.
-first-tree-hub agent send --chat <chatId> "your message"
+first-tree-hub chat send --chat <chatId> "your message"
 
 # Send markdown (default format is text)
-first-tree-hub agent send <agentName> -f markdown "**bold** message"
+first-tree-hub chat send <agentName> -f markdown "**bold** message"
 
 # Reply to a specific message
-first-tree-hub agent send <agentName> --reply-to <messageId> "reply content"
+first-tree-hub chat send <agentName> --reply-to <messageId> "reply content"
 
 # Pipe long content via stdin (recommended for special characters)
-echo "long message body" | first-tree-hub agent send <agentName>
+echo "long message body" | first-tree-hub chat send <agentName>
 \`\`\`
 
-> Agent uuids appear in \`agent chats\`, chat history, and participant lists,
-> but they are NOT accepted by \`agent send\` — always use the name.
+> Agent uuids appear in \`chat list\`, chat history, and participant lists,
+> but they are NOT accepted by \`chat send\` — always use the name.
 
 For content with quotes, \`$\`, backticks, or newlines, prefer stdin to avoid shell escaping issues.
 `;
 }
+function resolveGitRepoTargetPath(workspace, localPath) {
+	const safetyError = getRepoLocalPathSafetyError(localPath);
+	if (safetyError) throw new Error(`Unsafe git repo localPath "${localPath}": ${safetyError}`);
+	const workspaceRoot = resolve(workspace);
+	const targetPath = resolve(workspaceRoot, localPath);
+	const relativeTarget = relative(workspaceRoot, targetPath);
+	const escapesWorkspace = relativeTarget === ".." || relativeTarget.startsWith(`..${sep}`);
+	if (!relativeTarget || escapesWorkspace || isAbsolute(relativeTarget)) throw new Error(`Unsafe git repo localPath "${localPath}": resolved path escapes the session workspace`);
+	return targetPath;
+}
 const DEFAULT_CLONE_TIMEOUT_MS = 300 * 1e3;
 const FETCH_REFSPEC = "+refs/heads/*:refs/remotes/origin/*";
 const SESSION_BRANCH_PREFIX = "hub-session";
@@ -4994,7 +5054,7 @@ const createClaudeCodeHandler = (config) => {
 		if (!gitMirrorManager || !payload?.gitRepos?.length) return;
 		for (const repo of payload.gitRepos) {
 			const localPath = repo.localPath ?? deriveRepoLocalPath(repo.url);
-			const targetPath = join(workspace, localPath);
+			const targetPath = resolveGitRepoTargetPath(workspace, localPath);
 			sessionCtx.log(`Git: preparing ${repo.url} → ${localPath}${repo.ref ? ` @ ${repo.ref}` : ""}`);
 			const mirror = await gitMirrorManager.ensureMirror(repo.url);
 			if (mirror.cloned) sessionCtx.log(`Git: cloned ${repo.url} in ${mirror.elapsedMs}ms`);
@@ -5205,7 +5265,7 @@ function buildCodexThreadOptions(payload, workspaceCwd) {
 	for (const repo of payload.gitRepos) {
 		const localPath = repo.localPath ?? deriveRepoLocalPath(repo.url);
 		if (!localPath) continue;
-		additionalDirectories.push(join(workspaceCwd, localPath));
+		additionalDirectories.push(resolveGitRepoTargetPath(workspaceCwd, localPath));
 	}
 	const opts = {
 		workingDirectory: workspaceCwd,
@@ -5302,7 +5362,7 @@ const createCodexHandler = (config) => {
 		for (const repo of payload.gitRepos) {
 			const localPath = repo.localPath ?? deriveRepoLocalPath(repo.url);
 			if (!localPath) continue;
-			const targetPath = join(workspaceCwd, localPath);
+			const targetPath = resolveGitRepoTargetPath(workspaceCwd, localPath);
 			if (existsSync(targetPath)) continue;
 			try {
 				await gitMirrorManager.ensureMirror(repo.url);
@@ -7276,7 +7336,7 @@ function fail(code, message, exitCode = 1) {
 //#endregion
 //#region src/core/agent-messaging.ts
 /**
-* Resolve `replyTo` envelope fields for `agent send`. When the CLI is invoked
+* Resolve `replyTo` envelope fields for `chat send`. When the CLI is invoked
 * from inside a claude-code session (the handler exports
 * `FIRST_TREE_HUB_CHAT_ID` + `FIRST_TREE_HUB_INBOX_ID`), default the reply
 * target to the calling session's own chat so the peer's reply routes back
@@ -7568,7 +7628,7 @@ function rotateClientIdWithBackup(configDir) {
 }
 /**
 * Shared handler for `CLIENT_ORG_MISMATCH` across CLI entry points
-* (`client start` and `client connect --no-service`). Prompts interactively,
+* (`client start` and `connect <token> --no-service`). Prompts interactively,
 * rotates the local clientId, and always exits the current process — the
 * runtime is already poisoned (wrong clientId in memory), so continuing
 * in-band is not safe. Service-supervised (managed) runs skip the prompt and
@@ -8331,7 +8391,7 @@ function installLaunchd() {
 		lastBootstrapErr = res;
 		if (attempt < 2) sleepSync(1e3);
 	}
-	if (lastBootstrapErr) throw new Error(`launchctl bootstrap failed: ${lastBootstrapErr.stderr || `exit ${lastBootstrapErr.code ?? "unknown"}`}\n    Command: launchctl bootstrap ${target} ${plistPath}\n    Recovery: \`launchctl bootout ${target}/${LAUNCHD_LABEL}\` then \`first-tree-hub client connect <server-url>\`.`);
+	if (lastBootstrapErr) throw new Error(`launchctl bootstrap failed: ${lastBootstrapErr.stderr || `exit ${lastBootstrapErr.code ?? "unknown"}`}\n    Command: launchctl bootstrap ${target} ${plistPath}\n    Recovery: \`launchctl bootout ${target}/${LAUNCHD_LABEL}\` then \`first-tree-hub connect <token>\`.`);
 	const enableRes = runCapture("launchctl", ["enable", `${target}/${LAUNCHD_LABEL}`], 5e3);
 	if (!enableRes.ok) print.line(`    warning: launchctl enable: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n`);
 	const { state, pid, detail } = launchdState();
@@ -8491,7 +8551,7 @@ function installSystemd() {
 		"--now",
 		SYSTEMD_UNIT
 	], 1e4);
-	if (!enableRes.ok) throw new Error(`systemctl --user enable --now ${SYSTEMD_UNIT} failed: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n    Recovery: \`systemctl --user stop ${SYSTEMD_UNIT}\` then \`first-tree-hub client connect <server-url>\`.`);
+	if (!enableRes.ok) throw new Error(`systemctl --user enable --now ${SYSTEMD_UNIT} failed: ${enableRes.stderr || `exit ${enableRes.code ?? "unknown"}`}\n    Recovery: \`systemctl --user stop ${SYSTEMD_UNIT}\` then \`first-tree-hub connect <token>\`.`);
 	const { state, pid, detail } = systemdState();
 	return {
 		platform: "systemd",
@@ -9003,7 +9063,7 @@ function checkBackgroundService() {
 	return {
 		label: "Background service",
 		ok: false,
-		detail: "not installed — re-run `first-tree-hub client connect <url>` to install"
+		detail: "not installed — re-run `first-tree-hub connect <token>` to install"
 	};
 }
 async function checkWebSocket() {
@@ -9297,7 +9357,7 @@ function runHomeMigration() {
 	}
 	print.line(`[first-tree-hub] Copied client home to new layout: ${result.from} → ${result.to}\n  (Legacy directory preserved as a backup — delete it manually once you've verified the new location works.)\n`);
 	if (process.argv.includes("--no-interactive")) {
-		print.line("[first-tree-hub] Note: running as background service — skipped auto re-register to avoid self-termination.\n  Service paths will refresh on the next `first-tree-hub client connect <url>`.\n");
+		print.line("[first-tree-hub] Note: running as background service — skipped auto re-register to avoid self-termination.\n  Service paths will refresh on the next `first-tree-hub connect <token>`.\n");
 		return;
 	}
 	const status = getClientServiceStatus();
@@ -9307,7 +9367,7 @@ function runHomeMigration() {
 		print.line(`[first-tree-hub] Re-registered background service with new home paths.\n`);
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		print.line(`[first-tree-hub] WARNING: home migration succeeded but re-registering the background service failed: ${msg}\n  Re-run \`first-tree-hub client connect <url>\` to refresh service paths.\n`);
+		print.line(`[first-tree-hub] WARNING: home migration succeeded but re-registering the background service failed: ${msg}\n  Re-run \`first-tree-hub connect <token>\` to refresh service paths.\n`);
 	}
 }
 //#endregion
@@ -9339,7 +9399,7 @@ async function onboardCheck(args) {
 		key: "connect",
 		label: "Signed in",
 		status: "missing_required",
-		hint: "Run `first-tree-hub client connect <server-url>` first"
+		hint: "Run `first-tree-hub connect <token>` first"
 	});
 	try {
 		const serverUrl = resolveServerUrl(args.server);
@@ -9493,7 +9553,7 @@ async function onboardCreate(args) {
 	}
 	const runtimeAgent = args.type === "human" ? args.assistant : args.id;
 	if (args.feishuBotAppId && args.feishuBotAppSecret) {
-		const { bindFeishuBot } = await import("./feishu-30vUx69l.mjs").then((n) => n.r);
+		const { bindFeishuBot } = await import("./feishu-D_vnqC6a.mjs").then((n) => n.r);
 		const targetAgentUuid = args.type === "human" ? assistantUuid : primary.uuid;
 		if (!targetAgentUuid) print.line(`Warning: Cannot bind Feishu bot — no runtime agent available for "${args.id}".\n`);
 		else {
@@ -9580,13 +9640,13 @@ async function promptMissingFields(options) {
 * add (there's nothing sensible to key the local dir on).
 */
 async function promptAddAgent(opts = {}) {
-	if (loadCredentials() === null) throw new Error("Not connected. Run `first-tree-hub client connect <server-url>` first.");
+	if (loadCredentials() === null) throw new Error("Not connected. Run `first-tree-hub connect <token>` first.");
 	let serverUrl;
 	try {
 		serverUrl = resolveServerUrl(process.env.FIRST_TREE_HUB_SERVER_URL);
 	} catch (err) {
 		const msg = err instanceof Error ? err.message : String(err);
-		throw new Error(`${msg} Run \`first-tree-hub client connect\` or set FIRST_TREE_HUB_SERVER_URL.`);
+		throw new Error(`${msg} Run \`first-tree-hub connect <token>\` or set FIRST_TREE_HUB_SERVER_URL.`);
 	}
 	const agentId = opts.agentId ?? await input({
 		message: "Agent UUID on the Hub:",
@@ -10706,7 +10766,7 @@ function createFeedbackHandler(config) {
 	return { handle };
 }
 //#endregion
-//#region ../server/dist/app-B1wsm8zG.mjs
+//#region ../server/dist/app-DQVUb4ZY.mjs
 var import_fastify_opentelemetry = /* @__PURE__ */ __toESM(require_fastify_opentelemetry(), 1);
 init_esm();
 var __defProp = Object.defineProperty;
@@ -11406,7 +11466,7 @@ async function resolveAgentClient(db, data) {
 		userId: clients.userId
 	}).from(clients).where(eq(clients.id, data.clientId)).limit(1);
 	if (!client) throw new BadRequestError(`Client "${data.clientId}" not found`);
-	if (!client.userId) throw new BadRequestError(`Client "${data.clientId}" has not been claimed by a user yet. Have the operator run \`first-tree-hub client connect\` on that machine before pinning an agent to it.`);
+	if (!client.userId) throw new BadRequestError(`Client "${data.clientId}" has not been claimed by a user yet. Have the operator run \`first-tree-hub connect <token>\` on that machine before pinning an agent to it.`);
 	if (client.userId !== manager.userId) throw new ForbiddenError(`Client "${data.clientId}" is not owned by the manager's user — pick a client belonging to that user.`);
 	return client.id;
 }
@@ -12964,8 +13024,9 @@ async function pushToWebhook(notification) {
 }
 /**
 * Session events — structured event stream per (agent, chat) session.
-* `kind` is 'tool_call' | 'error'; the payload shape is enforced by the
-* service layer via Zod (no FK / CHECK on this table per project rule).
+* `kind` is one of `'tool_call' | 'error' | 'assistant_text' | 'thinking'
+* | 'turn_end'`; payload shape per kind is enforced by the service layer
+* via Zod (no FK / CHECK on this table per project rule).
 *
 * `seq` is monotonic per (agent_id, chat_id). The single-writer invariant
 * in the client-side session-manager guarantees ordering; the service wraps
@@ -13623,9 +13684,11 @@ function clientWsRoutes(notifier, instanceId) {
 								return;
 							}
 							const payload = sessionEventMessageSchema.parse(msg);
+							const boundInfo = boundAgents.get(agentId);
 							chainSessionOp(agentId, payload.chatId, async () => {
 								try {
 									await appendEvent(app.db, agentId, payload.chatId, payload.event);
+									if (boundInfo) notifier.notifySessionEvent(agentId, payload.chatId, payload.event.kind, boundInfo.organizationId).catch(() => {});
 								} catch (err) {
 									socket.send(JSON.stringify({
 										type: "error",
@@ -13827,7 +13890,7 @@ async function agentRoutes(app) {
 		};
 		if (health === "disconnected") return reply.status(200).send({
 			status: "offline",
-			message: "Agent is not connected. Start the client with: first-tree-hub client connect <server-url>",
+			message: "Agent is not connected. Connect the client with: first-tree-hub connect <token>",
 			connection
 		});
 		if (health === "stale") return reply.status(200).send({
@@ -15857,10 +15920,10 @@ async function listMeChats(db, humanAgentId, organizationId, query) {
 		agentId: chatMembership.agentId,
 		displayName: agents.displayName,
 		type: agents.type,
-		runtimeState: agentPresence.runtimeState
-	}).from(chatMembership).innerJoin(agents, eq(chatMembership.agentId, agents.uuid)).leftJoin(agentPresence, eq(agentPresence.agentId, chatMembership.agentId)).where(and(inArray(chatMembership.chatId, chatIds), eq(chatMembership.accessMode, "speaker")));
+		sessionState: agentChatSessions.state
+	}).from(chatMembership).innerJoin(agents, eq(chatMembership.agentId, agents.uuid)).leftJoin(agentChatSessions, and(eq(agentChatSessions.agentId, chatMembership.agentId), eq(agentChatSessions.chatId, chatMembership.chatId))).where(and(inArray(chatMembership.chatId, chatIds), eq(chatMembership.accessMode, "speaker")));
 	const participantsByChat = /* @__PURE__ */ new Map();
-	const workingByChat = /* @__PURE__ */ new Map();
+	const engagedByChat = /* @__PURE__ */ new Map();
 	for (const p of participantRows) {
 		const list = participantsByChat.get(p.chatId) ?? [];
 		list.push({
@@ -15869,12 +15932,13 @@ async function listMeChats(db, humanAgentId, organizationId, query) {
 			type: p.type
 		});
 		participantsByChat.set(p.chatId, list);
-		if (p.runtimeState === "working") {
-			const working = workingByChat.get(p.chatId) ?? [];
-			working.push(p.agentId);
-			workingByChat.set(p.chatId, working);
+		if (p.sessionState === "active") {
+			const engaged = engagedByChat.get(p.chatId) ?? [];
+			engaged.push(p.agentId);
+			engagedByChat.set(p.chatId, engaged);
 		}
 	}
+	const liveActivityByChat = await deriveLiveActivity(db, chatIds);
 	const firstMessageRows = chatIds.length > 0 ? await db.selectDistinctOn([messages.chatId], {
 		chatId: messages.chatId,
 		content: messages.content
@@ -15902,13 +15966,98 @@ async function listMeChats(db, humanAgentId, organizationId, query) {
 				unreadMentionCount: r.unread_mention_count,
 				canReply: isSpeaker,
 				engagementStatus: r.engagement_status,
-				workingAgentIds: workingByChat.get(r.chat_id) ?? []
+				engagedAgentIds: engagedByChat.get(r.chat_id) ?? [],
+				liveActivity: liveActivityByChat.get(r.chat_id) ?? null
 			};
 		}),
 		nextCursor
 	};
 }
 /**
+* Per-chat live activity, derived from the most recent `session_events` row.
+*
+* Returns a chatId → LiveActivity map; chats with no activity (or where the
+* latest event is terminal / stale) are absent from the map (caller treats
+* absence as null).
+*/
+async function deriveLiveActivity(db, chatIds) {
+	if (chatIds.length === 0) return /* @__PURE__ */ new Map();
+	const chatIdInClause = sql.join(chatIds.map((id) => sql`${id}`), sql`, `);
+	const rows = (await db.execute(sql`
+    SELECT acs.agent_id        AS agent_id,
+           acs.chat_id         AS chat_id,
+           e.kind              AS kind,
+           e.payload           AS payload,
+           e.created_at        AS created_at
+      FROM agent_chat_sessions acs
+      CROSS JOIN LATERAL (
+        SELECT kind, payload, created_at, seq
+          FROM session_events se
+         WHERE se.agent_id = acs.agent_id
+           AND se.chat_id  = acs.chat_id
+         ORDER BY se.seq DESC
+         LIMIT 1
+      ) e
+     WHERE acs.chat_id IN (${chatIdInClause})
+       AND acs.state <> 'evicted'
+  `)).map((r) => ({
+		agent_id: r.agent_id,
+		chat_id: r.chat_id,
+		kind: r.kind,
+		payload: r.payload,
+		created_at: r.created_at
+	}));
+	const now = Date.now();
+	const byChat = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const activity = toLiveActivity(row);
+		if (!activity) continue;
+		const createdAtMs = new Date(row.created_at).getTime();
+		if (now - createdAtMs > 6e4) continue;
+		const existing = byChat.get(row.chat_id);
+		if (!existing || createdAtMs > existing.createdAtMs) byChat.set(row.chat_id, {
+			activity,
+			createdAtMs
+		});
+	}
+	const out = /* @__PURE__ */ new Map();
+	for (const [chatId, { activity }] of byChat) out.set(chatId, activity);
+	return out;
+}
+/**
+* Translate a `session_events` row into a `LiveActivity`, or null when the
+* kind is terminal (`turn_end` / `error`) or unrecognised. Pure & exported
+* for unit testing.
+*/
+function toLiveActivity(row) {
+	const startedAt = new Date(row.created_at).toISOString();
+	switch (row.kind) {
+		case "tool_call": {
+			const payload = row.payload ?? {};
+			const label = typeof payload.name === "string" && payload.name.length > 0 ? payload.name : "Tool";
+			return {
+				agentId: row.agent_id,
+				kind: "tool_call",
+				label,
+				startedAt
+			};
+		}
+		case "thinking": return {
+			agentId: row.agent_id,
+			kind: "thinking",
+			label: "Thinking",
+			startedAt
+		};
+		case "assistant_text": return {
+			agentId: row.agent_id,
+			kind: "assistant_text",
+			label: "Writing",
+			startedAt
+		};
+		default: return null;
+	}
+}
+/**
 * Title resolution priority:
 *
 *   1. `chat.topic` (manual, set via `PATCH /chats/:chatId`)
@@ -17570,7 +17719,7 @@ async function healthzRoutes(app) {
 * `api/orgs/invitations.ts` (Class B, admin-gated).
 */
 async function publicInvitationRoutes(app) {
-	const { previewInvitation } = await import("./invitation-C299fxkP-CZgGbsN_.mjs");
+	const { previewInvitation } = await import("./invitation-CNv7gfFF-D93KQte0.mjs");
 	app.get("/:token/preview", async (request, reply) => {
 		if (!request.params.token) throw new UnauthorizedError("Token required");
 		const preview = await previewInvitation(app.db, request.params.token);
@@ -17640,7 +17789,8 @@ async function meRoutes(app) {
 			username: users.username,
 			displayName: users.displayName,
 			avatarUrl: users.avatarUrl,
-			onboardingDismissedAt: users.onboardingDismissedAt
+			onboardingDismissedAt: users.onboardingDismissedAt,
+			onboardingCompletedAt: users.onboardingCompletedAt
 		}).from(users).where(eq(users.id, userId)).limit(1);
 		const memberships = await listActiveMemberships(app.db, userId);
 		const defaultMembership = pickDefaultMembership(memberships.map((m) => ({
@@ -17668,7 +17818,8 @@ async function meRoutes(app) {
 			})),
 			onboarding: {
 				step: onboardingStep,
-				dismissedAt: user?.onboardingDismissedAt ? user.onboardingDismissedAt.toISOString() : null
+				dismissedAt: user?.onboardingDismissedAt ? user.onboardingDismissedAt.toISOString() : null,
+				completedAt: user?.onboardingCompletedAt ? user.onboardingCompletedAt.toISOString() : null
 			},
 			inviteUrl
 		};
@@ -17694,6 +17845,25 @@ async function meRoutes(app) {
 		return reply.status(200).send({ dismissedAt: u?.onboardingDismissedAt ? u.onboardingDismissedAt.toISOString() : null });
 	});
 	/**
+	* POST /me/onboarding-completed — stamp the terminal-state column when
+	* the user walks Step 3 to success (admin Continue, invitee Confirm /
+	* Continue). Distinct from PATCH /me/onboarding { dismissed: true },
+	* which only hides the stepper UI. Once stamped, the web sidebar drops
+	* the Settings → Onboarding entry point and /settings/onboarding
+	* redirects, so the wizard cannot re-enter.
+	*
+	* Idempotent: only writes when the column is still NULL — re-calling on
+	* an already-completed user is a no-op rather than resetting the stamp.
+	*/
+	app.post("/me/onboarding-completed", async (request, reply) => {
+		const { userId } = requireUser(request);
+		if ((await app.db.update(users).set({ onboardingCompletedAt: /* @__PURE__ */ new Date() }).where(and(eq(users.id, userId), isNull(users.onboardingCompletedAt))).returning({ id: users.id })).length > 0) app.log.info({
+			event: "onboarding.completed",
+			userId
+		}, "onboarding funnel: setup completed");
+		return reply.status(200).send({ ok: true });
+	});
+	/**
 	* POST /me/onboarding/events — web-side onboarding funnel reporter.
 	* Server-side milestones (`team_created` at OAuth, `dismissed` on PATCH)
 	* are emitted directly; this endpoint surfaces the web-driven ones into
@@ -17836,7 +18006,7 @@ async function meRoutes(app) {
 	*/
 	app.get("/me/pinned-agents", async (request) => {
 		const { userId } = requireUser(request);
-		const { listMyPinnedAgents } = await import("./client-DNiLcPEq-db3YS57z.mjs");
+		const { listMyPinnedAgents } = await import("./client-h4KZ3b9o-CQyibXig.mjs");
 		return listMyPinnedAgents(app.db, { userId });
 	});
 	/**
@@ -18757,6 +18927,12 @@ function orgWsRoutes(notifier, jwtSecret) {
 			...payload
 		});
 	});
+	notifier.onSessionEvent((payload) => {
+		broadcastOrgScoped({
+			type: "session:event",
+			...payload
+		});
+	});
 	notifier.onChatMessage(({ chatId }) => {
 		dispatchChatMessage(chatId);
 	});
@@ -22147,7 +22323,7 @@ const declineUpdate = async () => false;
 * relaunch picks up the new binary.
 *
 * `managed=false` means the process is running standalone (e.g. manual
-* `client start`, `client connect --no-service`, CI without a supervisor).
+* `client start`, `connect <token> --no-service`, CI without a supervisor).
 * Exiting in that mode would leave the client offline until an operator
 * noticed — so the callback instead prints a restart hint, returns
 * `{ installed: true }`, and the UpdateManager stops retrying until the

package/dist/web/assets/{index-B7FIVwrn.js → index-CJcRUZ8l.js}

@@ -1,4 +1,4 @@
-import{c as r,j as e,U as o,L as s,A as i,F as a,r as l}from"./index-DiDfVdIH.js";/**
+import{c as r,j as e,U as o,L as s,A as i,F as a,r as l}from"./index-DL_9NFkt.js";/**
  * @license lucide-react v0.577.0 - ISC
  *
  * This source code is licensed under the ISC license.