@agent-team-foundation/first-tree-hub 0.14.6 → 0.14.7-alpha.281.1

package/dist/cli/index.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { $ as SdkError, A as printResults, B as ClientRuntime, C as migrateLocalAgentDirs, D as checkNodeVersion, E as checkClientConfig, G as removeLocalAgent, I as restartClientService, J as fail, K as resolveReplyToFromEnv, L as startClientService, M as getClientServiceStatus, N as installClientService, O as checkServerReachable, P as isServiceSupported, Q as FirstTreeHubSDK, R as stopClientService, S as createApiNameResolver, T as checkBackgroundService, U as findStaleAliases, V as handleClientOrgMismatch, W as formatStaleReason, X as ClientOrgMismatchError, Y as success, Z as ClientUserMismatchError, _ as loadOnboardState, a as declineUpdate, b as saveOnboardState, c as detectInstallMode, d as reconcileLocalRuntimeProviders, et as SessionRegistry, f as uploadClientCapabilities, g as formatCheckReport, h as promptMissingFields, i as createExecuteUpdate, it as configureClientLoggerForService, j as reconcileAgentConfigs, k as checkWebSocket, l as fetchLatestVersion, m as promptAddAgent, nt as probeCapabilities, o as promptUpdate, p as isInteractive, q as resolveSenderName, r as registerSaaSConnectCommand, rt as applyClientLoggerConfig, s as PACKAGE_NAME, tt as cleanWorkspaces, u as installGlobalLatest, v as onboardCheck, w as checkAgentConfigs, x as runHomeMigration, y as onboardCreate } from "../saas-connect-CNY9Ve5V.mjs";
+import { $ as SdkError, A as printResults, B as ClientRuntime, C as migrateLocalAgentDirs, D as checkNodeVersion, E as checkClientConfig, G as removeLocalAgent, I as restartClientService, J as fail, K as resolveReplyToFromEnv, L as startClientService, M as getClientServiceStatus, N as installClientService, O as checkServerReachable, P as isServiceSupported, Q as FirstTreeHubSDK, R as stopClientService, S as createApiNameResolver, T as checkBackgroundService, U as findStaleAliases, V as handleClientOrgMismatch, W as formatStaleReason, X as ClientOrgMismatchError, Y as success, Z as ClientUserMismatchError, _ as loadOnboardState, a as declineUpdate, b as saveOnboardState, c as detectInstallMode, d as reconcileLocalRuntimeProviders, et as SessionRegistry, f as uploadClientCapabilities, g as formatCheckReport, h as promptMissingFields, i as createExecuteUpdate, it as configureClientLoggerForService, j as reconcileAgentConfigs, k as checkWebSocket, l as fetchLatestVersion, m as promptAddAgent, nt as probeCapabilities, o as promptUpdate, p as isInteractive, q as resolveSenderName, r as registerSaaSConnectCommand, rt as applyClientLoggerConfig, s as PACKAGE_NAME, tt as cleanWorkspaces, u as installGlobalLatest, v as onboardCheck, w as checkAgentConfigs, x as runHomeMigration, y as onboardCreate } from "../saas-connect-gXv14p6J.mjs";
 import { C as resolveConfigReadonly, S as resetConfigMeta, _ as initConfig, a as loadCredentials, b as readConfigFile, c as saveAgentConfig, d as DEFAULT_DATA_DIR, f as DEFAULT_HOME_DIR, g as getConfigValue, i as ensureFreshAdminToken, m as clientConfigSchema, p as agentConfigSchema, r as ensureFreshAccessToken, s as resolveServerUrl, u as DEFAULT_CONFIG_DIR, v as loadAgents, w as setConfigValue, x as resetConfig } from "../bootstrap-CmkHQsnS.mjs";
 import { a as print, n as CLI_USER_AGENT, o as setJsonMode, r as COMMAND_VERSION, t as cliFetch } from "../cli-fetch-BGVItZxo.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-BE7QRxnE.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "../feishu-BBUEVTnb.mjs";
 import { join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, readdirSync } from "node:fs";
 import * as semver from "semver";

package/dist/{feishu-BE7QRxnE.mjs → feishu-BBUEVTnb.mjs}

@@ -545,10 +545,7 @@ const chatMetadataSchema = z.discriminatedUnion("source", [githubChatMetadataSch
 const optionalChatMetadataSchema = z.union([z.object({}).strict(), chatMetadataSchema]);
 const chatSourceSchema = z.enum([
 	"manual",
-	"github_issue",
-	"github_pull_request",
-	"github_discussion",
-	"github_commit",
+	"github",
 	"feishu"
 ]);
 const chatTypeSchema = z.enum(["direct", "group"]);
@@ -577,7 +574,9 @@ const chatParticipantDetailSchema = z.object({
 }).extend({
 	name: z.string().nullable(),
 	displayName: z.string(),
-	type: z.string()
+	type: z.string(),
+	avatarColorToken: z.string().nullable(),
+	avatarImageUrl: z.string().nullable()
 });
 z.object({
 	id: z.string(),
@@ -598,6 +597,47 @@ z.object({
 z.object({ topic: z.string().trim().max(500).nullable() });
 z.object({ agentId: z.string().min(1) });
 z.object({ agentId: z.string().min(1) });
+/**
+* Schema for `GET /api/v1/chats/:chatId/github-entities`.
+*
+* Each item describes one entity bound to the chat via
+* `github_entity_chat_mappings`. Live state (`title`, `state`) is fetched
+* per-request from the GitHub REST API at request time and NEVER
+* persisted to the database — the user explicitly opted for the
+* fresh-on-every-open model rather than a webhook-synced column.
+*
+* Live fields may be `null` when the GitHub call failed (token unavailable,
+* rate-limited, 404 on a deleted entity, etc.). The client falls back to
+* rendering `entityKey + htmlUrl` so the row is still a working link.
+*/
+const githubEntityBoundViaSchema = z.enum([
+	"direct",
+	"fixes_link",
+	"agent_created"
+]);
+/**
+* Coarse live state. PR-specific values (`merged`, `draft`) are folded
+* into the same enum as the issue's `open` / `closed` so the UI can
+* switch on a single field. `null` means we couldn't reach GitHub for
+* this entity in this request — the row still renders, just without
+* the state badge.
+*/
+const githubEntityLiveStateSchema = z.enum([
+	"open",
+	"closed",
+	"merged",
+	"draft"
+]);
+const chatGithubEntitySchema = z.object({
+	entityType: githubEntityTypeSchema,
+	entityKey: z.string().min(1),
+	boundVia: githubEntityBoundViaSchema,
+	htmlUrl: z.string().url(),
+	title: z.string().nullable(),
+	state: githubEntityLiveStateSchema.nullable(),
+	number: z.number().int().nullable()
+});
+z.object({ items: z.array(chatGithubEntitySchema) });
 const clientStatusSchema = z.enum(["connected", "disconnected"]);
 /**
 * Auth health channel surfaced to the Web admin dashboard. Computed
@@ -771,10 +811,20 @@ const contextTreeSummarySchema = z.object({
 	removedCount: z.number().int().nonnegative(),
 	changedNodeCount: z.number().int().nonnegative()
 });
+const contextTreeUsageEventSchema = z.object({
+	id: z.string(),
+	agentId: z.string(),
+	agentName: z.string(),
+	agentAvatarColorToken: z.string().nullable(),
+	chatId: z.string().nullable(),
+	chatTitle: z.string().nullable(),
+	createdAt: z.string()
+});
 const contextTreeUsageSummarySchema = z.object({
 	windowDays: z.number().int().positive(),
 	agentCount: z.number().int().nonnegative(),
-	usageCount: z.number().int().nonnegative()
+	usageCount: z.number().int().nonnegative(),
+	recentEvents: z.array(contextTreeUsageEventSchema)
 });
 z.object({
 	repo: z.string().nullable(),
@@ -1031,23 +1081,41 @@ z.object({
 });
 z.object({ token: z.string().min(1) });
 z.object({}).optional();
-const meChatFilterSchema = z.enum([
-	"all",
-	"unread",
-	"watching"
-]);
+const meChatFilterSchema = z.enum(["all", "unread"]);
 const meChatMembershipKindSchema = z.enum(["participant", "watching"]);
 const chatEngagementViewSchema = z.enum([
 	"active",
 	"archived",
 	"all"
 ]);
+/**
+* Coerce a CSV string like `"manual,pr,issue"` to an array of trimmed
+* non-empty tokens. Lets the wire accept both repeated query params
+* (`?origin=manual&origin=pr`) and the comma-joined form the workspace
+* URL uses (`?origin=manual,pr`). Returns `undefined` when the input is
+* missing or empty so the caller can treat "no filter" and "filter to
+* empty array" identically.
+*/
+function csvArrayPreprocess(input) {
+	if (typeof input !== "string") return input;
+	const trimmed = input.trim();
+	if (trimmed === "") return void 0;
+	return trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
 	filter: meChatFilterSchema.default("all"),
 	engagement: chatEngagementViewSchema.default("active"),
-	source: chatSourceSchema.optional()
+	origin: z.preprocess(csvArrayPreprocess, z.array(chatSourceSchema).optional()),
+	with: z.preprocess(csvArrayPreprocess, z.array(z.string().min(1)).optional()),
+	watching: z.preprocess((v) => {
+		if (typeof v === "string") {
+			if (v === "1" || v.toLowerCase() === "true") return true;
+			if (v === "0" || v.toLowerCase() === "false" || v === "") return false;
+		}
+		return v;
+	}, z.boolean().optional())
 });
 const meChatParticipantSchema = z.object({
 	agentId: z.string(),
@@ -1080,6 +1148,8 @@ const meChatRowSchema = z.object({
 	chatId: z.string(),
 	type: z.string(),
 	membershipKind: meChatMembershipKindSchema,
+	source: chatSourceSchema.default("manual"),
+	entityType: githubEntityTypeSchema.nullable().default(null),
 	title: z.string(),
 	topic: z.string().nullable(),
 	participants: z.array(meChatParticipantSchema),
@@ -1347,34 +1417,16 @@ z.object({
 	}),
 	mentionedUser: z.string().optional()
 });
-const notificationTypeSchema = z.enum([
+z.enum([
 	"agent_error",
 	"agent_blocked",
 	"agent_stale"
 ]);
-const notificationSeveritySchema = z.enum([
+z.enum([
 	"high",
 	"medium",
 	"low"
 ]);
-z.object({
-	id: z.string(),
-	organizationId: z.string(),
-	type: notificationTypeSchema,
-	severity: notificationSeveritySchema,
-	agentId: z.string().nullable(),
-	chatId: z.string().nullable(),
-	message: z.string(),
-	read: z.boolean(),
-	createdAt: z.string()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).default(20),
-	cursor: z.string().optional(),
-	severity: notificationSeveritySchema.optional(),
-	read: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
-	agentId: z.string().optional()
-});
 z.object({ next: z.string().max(256).optional() });
 z.object({
 	code: z.string().min(1),
@@ -1403,8 +1455,8 @@ z.object({
 *
 * Each namespace has three schemas:
 *   - `storage` — what is persisted in `organization_settings.value`. For
-*     namespaces with secrets, the storage schema names the *cipher* field
-*     (e.g. `webhookSecretCipher`); plaintext never touches the row.
+*     namespaces with secrets, the storage schema names the *cipher* field;
+*     plaintext never touches the row.
 *   - `input`   — what the admin API accepts in PUT bodies. For namespaces
 *     with secrets, `webhookSecret` is plaintext; the service layer
 *     encrypts it before merging into storage.

package/dist/{feishu-De9_bA91.mjs → feishu-DLt219hJ.mjs}

@@ -1,3 +1,3 @@
 import "./cli-fetch-BGVItZxo.mjs";
-import { t as bindFeishuBot } from "./feishu-BE7QRxnE.mjs";
+import { t as bindFeishuBot } from "./feishu-BBUEVTnb.mjs";
 export { bindFeishuBot };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { $ as SdkError, A as printResults, B as ClientRuntime, D as checkNodeVersion, E as checkClientConfig, F as resolveCliInvocation, H as rotateClientIdWithBackup, I as restartClientService, L as startClientService, M as getClientServiceStatus, N as installClientService, O as checkServerReachable, P as isServiceSupported, Q as FirstTreeHubSDK, R as stopClientService, V as handleClientOrgMismatch, g as formatCheckReport, h as promptMissingFields, k as checkWebSocket, m as promptAddAgent, n as deriveHubUrlFromToken, p as isInteractive, t as HubUrlDerivationError, v as onboardCheck, w as checkAgentConfigs, x as runHomeMigration, y as onboardCreate, z as uninstallClientService } from "./saas-connect-CNY9Ve5V.mjs";
+import { $ as SdkError, A as printResults, B as ClientRuntime, D as checkNodeVersion, E as checkClientConfig, F as resolveCliInvocation, H as rotateClientIdWithBackup, I as restartClientService, L as startClientService, M as getClientServiceStatus, N as installClientService, O as checkServerReachable, P as isServiceSupported, Q as FirstTreeHubSDK, R as stopClientService, V as handleClientOrgMismatch, g as formatCheckReport, h as promptMissingFields, k as checkWebSocket, m as promptAddAgent, n as deriveHubUrlFromToken, p as isInteractive, t as HubUrlDerivationError, v as onboardCheck, w as checkAgentConfigs, x as runHomeMigration, y as onboardCreate, z as uninstallClientService } from "./saas-connect-gXv14p6J.mjs";
 import { i as ensureFreshAdminToken, n as AuthRefreshRateLimitedError, o as resolveAccessToken, r as ensureFreshAccessToken, s as resolveServerUrl, t as AuthRefreshFailedError } from "./bootstrap-CmkHQsnS.mjs";
 import { i as blank, s as status } from "./cli-fetch-BGVItZxo.mjs";
-import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-BE7QRxnE.mjs";
+import { n as bindFeishuUser, t as bindFeishuBot } from "./feishu-BBUEVTnb.mjs";
 export { AuthRefreshFailedError, AuthRefreshRateLimitedError, ClientRuntime, FirstTreeHubSDK, HubUrlDerivationError, SdkError, bindFeishuBot, bindFeishuUser, blank, checkAgentConfigs, checkClientConfig, checkNodeVersion, checkServerReachable, checkWebSocket, deriveHubUrlFromToken, ensureFreshAccessToken, ensureFreshAdminToken, formatCheckReport, getClientServiceStatus, handleClientOrgMismatch, installClientService, isInteractive, isServiceSupported, onboardCheck, onboardCreate, printResults, promptAddAgent, promptMissingFields, resolveAccessToken, resolveCliInvocation, resolveServerUrl, restartClientService, rotateClientIdWithBackup, runHomeMigration, startClientService, status, stopClientService, uninstallClientService };

package/dist/{saas-connect-CNY9Ve5V.mjs → saas-connect-gXv14p6J.mjs}

@@ -3677,6 +3677,152 @@ function configureClientLoggerForService(logDir) {
 //#endregion
 //#region ../client/dist/index.mjs
 /**
+* Shared scanner for plain markdown document-path tokens inside chat text.
+*
+* Runtime (client) calls this to know which `.md` paths to read off disk and
+* embed as snapshots in `metadata.documentContext`. Web calls the same scanner
+* to know which tokens to wrap in `[path](path)` so react-markdown renders
+* them as clickable links. Sharing one scanner is what guarantees that every
+* link the user sees in the UI has a matching snapshot in metadata — the
+* cache-key on both sides is the canonical path the scanner reports here.
+*
+* Skipped constructs (must stay aligned with markdown rules so we don't
+* rewrite something the renderer already treats specially):
+*   - inline markdown links `[text](path.md)` (the runtime scans those
+*     separately via `scanInlineMarkdownLinks`; this scanner intentionally
+*     does not double-handle them)
+*   - inline code spans `` `...` ``
+*   - fenced code blocks (``` ``` ``` ``` / `~~~`)
+*   - indented code blocks (4+ spaces or leading tab)
+*   - HTML tag bodies `<...>` (so href / src attribute values aren't
+*     re-linkified)
+*   - reference-link definitions `[ref]: target`
+*   - domain-shaped tokens like `example.com/readme.md` — these are URLs the
+*     user almost certainly meant as external links, not workspace paths.
+*
+* The function returns matches WITH offsets so callers that need to rewrite
+* the source string (web's `linkifyMarkdownDocPaths`) can do so without
+* re-running the same regex.
+*/
+/**
+* v1 limitation — the path-segment character class is intentionally ASCII
+* only. Unicode filenames and Windows backslash-separated paths are NOT
+* linkified. Workspaces in practice use POSIX-style ASCII paths, and the
+* runtime's `normalizeDocLinkPath` also rejects absolute paths, so this
+* matches the rest of the pipeline. Loosening the character class later
+* is straightforward but requires re-validating that we don't accidentally
+* absorb adjacent punctuation as part of a "filename".
+*/
+const BARE_PATH_RE = /(^|[\s([{"'])(?<path>(?:\.{1,2}\/|\/)?(?:[A-Za-z0-9_.~+@%-]+\/)*[A-Za-z0-9_.~+@%-]+\.md(?::\d+(?::\d+)?)?)(?=$|[\s)\]}"',.;!?])/g;
+const INLINE_MARKDOWN_LINK_RE = /\[(?:[^\]\\\n]|\\.)*\]\([^)\n]*\)/g;
+const REFERENCE_LINK_DEFINITION_RE = /^\s*\[[^\]\n]+\]:\s*\S+/;
+const HTML_TAG_RE = /<\/?[A-Za-z][^>\n]*>/g;
+const FENCE_OPEN_RE = /^\s*(```|~~~)/;
+const INDENT_CODE_RE = /^(?: {4}|\t)/;
+const DOMAIN_LIKE_PREFIX_RE = /^[a-z][a-z0-9.-]*\.[a-z]{2,}\//i;
+/**
+* Scan `text` for plain `.md` path tokens that are NOT already wrapped in a
+* markdown link, code span, HTML tag, or fenced/indented code block.
+*
+* The returned tokens still need to be passed through
+* `normalizeDocLinkPath(stripLineSuffix(raw))` before they are treated as
+* canonical workspace paths.
+*/
+function scanBareDocPathTokens(text) {
+	const out = [];
+	const lines = text.split(/(\r?\n)/);
+	let inFence = false;
+	let absoluteOffset = 0;
+	for (const line of lines) {
+		if (line === "\n" || line === "\r\n") {
+			absoluteOffset += line.length;
+			continue;
+		}
+		if (FENCE_OPEN_RE.test(line)) {
+			inFence = !inFence;
+			absoluteOffset += line.length;
+			continue;
+		}
+		if (inFence) {
+			absoluteOffset += line.length;
+			continue;
+		}
+		if (INDENT_CODE_RE.test(line) || REFERENCE_LINK_DEFINITION_RE.test(line)) {
+			absoluteOffset += line.length;
+			continue;
+		}
+		const skipRanges = findInlineSkipRanges(line);
+		BARE_PATH_RE.lastIndex = 0;
+		let match = BARE_PATH_RE.exec(line);
+		while (match !== null) {
+			const boundary = match[1] ?? "";
+			const path = match.groups?.path ?? "";
+			const pathStart = match.index + boundary.length;
+			const pathEnd = pathStart + path.length;
+			if (path && !isInsideAnyRange(pathStart, skipRanges) && !isDomainLike(path)) out.push({
+				raw: path,
+				start: absoluteOffset + pathStart,
+				end: absoluteOffset + pathEnd
+			});
+			match = BARE_PATH_RE.exec(line);
+		}
+		absoluteOffset += line.length;
+	}
+	return out;
+}
+/**
+* Strip the `:line[:col]` suffix that agents often append to file references.
+* Returns the path portion (without the trailing line/column digits) so
+* callers can hand it to `normalizeDocLinkPath`. We accept and discard the
+* line/column information — preview-time line scrolling is out of scope
+* for the snapshot link path.
+*/
+function stripDocPathLineSuffix(raw) {
+	return /^(?<path>.*?\.md)(?::\d+(?::\d+)?)?$/i.exec(raw)?.groups?.path ?? raw;
+}
+function findInlineSkipRanges(line) {
+	const ranges = [];
+	for (const match of line.matchAll(INLINE_MARKDOWN_LINK_RE)) if (match.index !== void 0) ranges.push({
+		start: match.index,
+		end: match.index + match[0].length
+	});
+	for (const match of line.matchAll(HTML_TAG_RE)) if (match.index !== void 0) ranges.push({
+		start: match.index,
+		end: match.index + match[0].length
+	});
+	for (let idx = 0; idx < line.length;) {
+		if (line[idx] !== "`") {
+			idx += 1;
+			continue;
+		}
+		const start = idx;
+		while (line[idx] === "`") idx += 1;
+		const ticks = line.slice(start, idx);
+		const end = line.indexOf(ticks, idx);
+		if (end === -1) continue;
+		ranges.push({
+			start,
+			end: end + ticks.length
+		});
+		idx = end + ticks.length;
+	}
+	return ranges;
+}
+function isInsideAnyRange(index, ranges) {
+	return ranges.some((range) => index >= range.start && index < range.end);
+}
+/**
+* Decide whether the first path segment looks like a bare domain name
+* (`example.com/...`) rather than a real `.md` filename. The check is
+* suppressed when the first segment already ends in `.md`, since a directory
+* named `notes.md/` is a legitimate workspace path even though it matches
+* the domain-shape regex.
+*/
+function isDomainLike(path) {
+	if ((path.split("/", 1).at(0) ?? "").toLowerCase().endsWith(".md")) return false;
+	return DOMAIN_LIKE_PREFIX_RE.test(path);
+}
+/**
 * Workspace-relative markdown doc path normalisation.
 *
 * Shared by:
@@ -4226,10 +4372,7 @@ const chatMetadataSchema = z.discriminatedUnion("source", [githubChatMetadataSch
 const optionalChatMetadataSchema = z.union([z.object({}).strict(), chatMetadataSchema]);
 const chatSourceSchema = z.enum([
 	"manual",
-	"github_issue",
-	"github_pull_request",
-	"github_discussion",
-	"github_commit",
+	"github",
 	"feishu"
 ]);
 const chatTypeSchema = z.enum(["direct", "group"]);
@@ -4258,7 +4401,9 @@ const chatParticipantDetailSchema = z.object({
 }).extend({
 	name: z.string().nullable(),
 	displayName: z.string(),
-	type: z.string()
+	type: z.string(),
+	avatarColorToken: z.string().nullable(),
+	avatarImageUrl: z.string().nullable()
 });
 z.object({
 	id: z.string(),
@@ -4279,6 +4424,47 @@ z.object({
 z.object({ topic: z.string().trim().max(500).nullable() });
 z.object({ agentId: z.string().min(1) });
 z.object({ agentId: z.string().min(1) });
+/**
+* Schema for `GET /api/v1/chats/:chatId/github-entities`.
+*
+* Each item describes one entity bound to the chat via
+* `github_entity_chat_mappings`. Live state (`title`, `state`) is fetched
+* per-request from the GitHub REST API at request time and NEVER
+* persisted to the database — the user explicitly opted for the
+* fresh-on-every-open model rather than a webhook-synced column.
+*
+* Live fields may be `null` when the GitHub call failed (token unavailable,
+* rate-limited, 404 on a deleted entity, etc.). The client falls back to
+* rendering `entityKey + htmlUrl` so the row is still a working link.
+*/
+const githubEntityBoundViaSchema = z.enum([
+	"direct",
+	"fixes_link",
+	"agent_created"
+]);
+/**
+* Coarse live state. PR-specific values (`merged`, `draft`) are folded
+* into the same enum as the issue's `open` / `closed` so the UI can
+* switch on a single field. `null` means we couldn't reach GitHub for
+* this entity in this request — the row still renders, just without
+* the state badge.
+*/
+const githubEntityLiveStateSchema = z.enum([
+	"open",
+	"closed",
+	"merged",
+	"draft"
+]);
+const chatGithubEntitySchema = z.object({
+	entityType: githubEntityTypeSchema,
+	entityKey: z.string().min(1),
+	boundVia: githubEntityBoundViaSchema,
+	htmlUrl: z.string().url(),
+	title: z.string().nullable(),
+	state: githubEntityLiveStateSchema.nullable(),
+	number: z.number().int().nullable()
+});
+z.object({ items: z.array(chatGithubEntitySchema) });
 const clientStatusSchema = z.enum(["connected", "disconnected"]);
 /**
 * Auth health channel surfaced to the Web admin dashboard. Computed
@@ -4452,10 +4638,20 @@ const contextTreeSummarySchema = z.object({
 	removedCount: z.number().int().nonnegative(),
 	changedNodeCount: z.number().int().nonnegative()
 });
+const contextTreeUsageEventSchema = z.object({
+	id: z.string(),
+	agentId: z.string(),
+	agentName: z.string(),
+	agentAvatarColorToken: z.string().nullable(),
+	chatId: z.string().nullable(),
+	chatTitle: z.string().nullable(),
+	createdAt: z.string()
+});
 const contextTreeUsageSummarySchema = z.object({
 	windowDays: z.number().int().positive(),
 	agentCount: z.number().int().nonnegative(),
-	usageCount: z.number().int().nonnegative()
+	usageCount: z.number().int().nonnegative(),
+	recentEvents: z.array(contextTreeUsageEventSchema)
 });
 z.object({
 	repo: z.string().nullable(),
@@ -4743,23 +4939,41 @@ z.object({
 });
 z.object({ token: z.string().min(1) });
 z.object({}).optional();
-const meChatFilterSchema = z.enum([
-	"all",
-	"unread",
-	"watching"
-]);
+const meChatFilterSchema = z.enum(["all", "unread"]);
 const meChatMembershipKindSchema = z.enum(["participant", "watching"]);
 const chatEngagementViewSchema = z.enum([
 	"active",
 	"archived",
 	"all"
 ]);
+/**
+* Coerce a CSV string like `"manual,pr,issue"` to an array of trimmed
+* non-empty tokens. Lets the wire accept both repeated query params
+* (`?origin=manual&origin=pr`) and the comma-joined form the workspace
+* URL uses (`?origin=manual,pr`). Returns `undefined` when the input is
+* missing or empty so the caller can treat "no filter" and "filter to
+* empty array" identically.
+*/
+function csvArrayPreprocess(input) {
+	if (typeof input !== "string") return input;
+	const trimmed = input.trim();
+	if (trimmed === "") return void 0;
+	return trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+}
 z.object({
 	cursor: z.string().optional(),
 	limit: z.coerce.number().int().min(1).max(200).default(50),
 	filter: meChatFilterSchema.default("all"),
 	engagement: chatEngagementViewSchema.default("active"),
-	source: chatSourceSchema.optional()
+	origin: z.preprocess(csvArrayPreprocess, z.array(chatSourceSchema).optional()),
+	with: z.preprocess(csvArrayPreprocess, z.array(z.string().min(1)).optional()),
+	watching: z.preprocess((v) => {
+		if (typeof v === "string") {
+			if (v === "1" || v.toLowerCase() === "true") return true;
+			if (v === "0" || v.toLowerCase() === "false" || v === "") return false;
+		}
+		return v;
+	}, z.boolean().optional())
 });
 const meChatParticipantSchema = z.object({
 	agentId: z.string(),
@@ -4792,6 +5006,8 @@ const meChatRowSchema = z.object({
 	chatId: z.string(),
 	type: z.string(),
 	membershipKind: meChatMembershipKindSchema,
+	source: chatSourceSchema.default("manual"),
+	entityType: githubEntityTypeSchema.nullable().default(null),
 	title: z.string(),
 	topic: z.string().nullable(),
 	participants: z.array(meChatParticipantSchema),
@@ -5074,34 +5290,16 @@ z.object({
 	}),
 	mentionedUser: z.string().optional()
 });
-const notificationTypeSchema = z.enum([
+z.enum([
 	"agent_error",
 	"agent_blocked",
 	"agent_stale"
 ]);
-const notificationSeveritySchema = z.enum([
+z.enum([
 	"high",
 	"medium",
 	"low"
 ]);
-z.object({
-	id: z.string(),
-	organizationId: z.string(),
-	type: notificationTypeSchema,
-	severity: notificationSeveritySchema,
-	agentId: z.string().nullable(),
-	chatId: z.string().nullable(),
-	message: z.string(),
-	read: z.boolean(),
-	createdAt: z.string()
-});
-z.object({
-	limit: z.coerce.number().int().min(1).max(100).default(20),
-	cursor: z.string().optional(),
-	severity: notificationSeveritySchema.optional(),
-	read: z.enum(["true", "false"]).transform((v) => v === "true").optional(),
-	agentId: z.string().optional()
-});
 z.object({ next: z.string().max(256).optional() });
 z.object({
 	code: z.string().min(1),
@@ -5130,8 +5328,8 @@ z.object({
 *
 * Each namespace has three schemas:
 *   - `storage` — what is persisted in `organization_settings.value`. For
-*     namespaces with secrets, the storage schema names the *cipher* field
-*     (e.g. `webhookSecretCipher`); plaintext never touches the row.
+*     namespaces with secrets, the storage schema names the *cipher* field;
+*     plaintext never touches the row.
 *   - `input`   — what the admin API accepts in PUT bodies. For namespaces
 *     with secrets, `webhookSecret` is plaintext; the service layer
 *     encrypts it before merging into storage.
@@ -5900,6 +6098,10 @@ var FirstTreeHubSDK = class {
 	async listChatParticipants(chatId) {
 		return this.requestJson(`/api/v1/agent/chats/${chatId}/participants`);
 	}
+	/** Fetch Context Tree configuration for this SDK's authenticated agent. */
+	async getAgentContextTreeConfig() {
+		return this.requestJson("/api/v1/agent/context-tree/info");
+	}
 	queryString(options) {
 		const params = new URLSearchParams();
 		if (options?.limit !== void 0) params.set("limit", String(options.limit));
@@ -6646,14 +6848,19 @@ function getHandlerFactory(type) {
 	}
 	return factory;
 }
-const CONTEXT_TREE_DIR = join(DEFAULT_DATA_DIR, "context-tree");
-/**
-* Sync the shared Context Tree git clone.
-*
-* Clones on first run, pulls on subsequent runs.
-* Returns the binding on success, null on failure (graceful degradation).
-*/
-async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
+const CONTEXT_TREE_REPOS_DIR = join(DEFAULT_DATA_DIR, "context-tree-repos");
+const contextTreeSyncLocks = /* @__PURE__ */ new Map();
+function contextTreeCloneDir(repo, branch) {
+	return join(CONTEXT_TREE_REPOS_DIR, createHash("sha256").update(`${repo}\0${branch}`).digest("hex"));
+}
+function withContextTreeSyncLock(key, fn) {
+	const next = (contextTreeSyncLocks.get(key) ?? Promise.resolve(null)).catch(() => null).then(fn).finally(() => {
+		if (contextTreeSyncLocks.get(key) === next) contextTreeSyncLocks.delete(key);
+	});
+	contextTreeSyncLocks.set(key, next);
+	return next;
+}
+async function resolveContextTreeBinding(fetchConfig, log) {
 	try {
 		execFileSync("git", ["--version"], { stdio: "ignore" });
 	} catch {
@@ -6663,11 +6870,7 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 	let repo;
 	let branch;
 	try {
-		const config = await new FirstTreeHubSDK({
-			serverUrl,
-			getAccessToken,
-			userAgent
-		}).getContextTreeConfig();
+		const config = await fetchConfig();
 		if (!config.repo) {
 			log("Context Tree sync skipped: not configured on server");
 			return null;
@@ -6678,39 +6881,43 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 		log(`Context Tree sync skipped: failed to fetch config from server (${err instanceof Error ? err.message : String(err)})`);
 		return null;
 	}
+	const cloneDir = contextTreeCloneDir(repo, branch);
+	return withContextTreeSyncLock(cloneDir, () => syncContextTreeRepo(repo, branch, cloneDir, log));
+}
+async function syncContextTreeRepo(repo, branch, cloneDir, log) {
 	try {
-		if (existsSync(join(CONTEXT_TREE_DIR, ".git"))) {
+		if (existsSync(join(cloneDir, ".git"))) {
 			if (execFileSync("git", [
 				"rev-parse",
 				"--abbrev-ref",
 				"HEAD"
 			], {
-				cwd: CONTEXT_TREE_DIR,
+				cwd: cloneDir,
 				encoding: "utf-8",
 				timeout: 5e3
 			}).trim() !== branch) {
 				execFileSync("git", ["checkout", branch], {
-					cwd: CONTEXT_TREE_DIR,
+					cwd: cloneDir,
 					stdio: "pipe",
 					timeout: 1e4
 				});
 				log(`Context Tree switched to branch ${branch}`);
 			}
 			execFileSync("git", ["pull", "--ff-only"], {
-				cwd: CONTEXT_TREE_DIR,
+				cwd: cloneDir,
 				stdio: "pipe",
 				timeout: 3e4
 			});
 			log(`Context Tree updated (pull)`);
 		} else {
-			mkdirSync(CONTEXT_TREE_DIR, { recursive: true });
+			mkdirSync(cloneDir, { recursive: true });
 			execFileSync("git", [
 				"clone",
 				"--branch",
 				branch,
 				"--single-branch",
 				repo,
-				CONTEXT_TREE_DIR
+				cloneDir
 			], {
 				stdio: "pipe",
 				timeout: 6e4
@@ -6718,7 +6925,7 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 			log(`Context Tree cloned from ${repo} (branch: ${branch})`);
 		}
 		return {
-			path: CONTEXT_TREE_DIR,
+			path: cloneDir,
 			repoUrl: repo,
 			branch
 		};
@@ -6726,28 +6933,28 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 		const msg = err instanceof Error ? err.message : String(err);
 		log(`Context Tree sync failed: ${msg}`);
 		log("Check that git credentials (SSH key or credential helper) are configured for this repo");
-		if ((msg.includes("cannot fast-forward") || msg.includes("not possible to fast-forward") || msg.includes("CONFLICT")) && existsSync(join(CONTEXT_TREE_DIR, ".git"))) {
+		if ((msg.includes("cannot fast-forward") || msg.includes("not possible to fast-forward") || msg.includes("CONFLICT")) && existsSync(join(cloneDir, ".git"))) {
 			log("Diverged history detected, attempting fresh clone...");
 			try {
-				rmSync(CONTEXT_TREE_DIR, {
+				rmSync(cloneDir, {
 					recursive: true,
 					force: true
 				});
-				mkdirSync(CONTEXT_TREE_DIR, { recursive: true });
+				mkdirSync(cloneDir, { recursive: true });
 				execFileSync("git", [
 					"clone",
 					"--branch",
 					branch,
 					"--single-branch",
 					repo,
-					CONTEXT_TREE_DIR
+					cloneDir
 				], {
 					stdio: "pipe",
 					timeout: 6e4
 				});
 				log("Context Tree re-cloned successfully");
 				return {
-					path: CONTEXT_TREE_DIR,
+					path: cloneDir,
 					repoUrl: repo,
 					branch
 				};
@@ -6755,10 +6962,10 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 				log("Context Tree re-clone also failed, continuing without context");
 			}
 		}
-		if (existsSync(join(CONTEXT_TREE_DIR, ".git"))) {
+		if (existsSync(join(cloneDir, ".git"))) {
 			log("Using existing Context Tree clone despite sync failure");
 			return {
-				path: CONTEXT_TREE_DIR,
+				path: cloneDir,
 				repoUrl: repo,
 				branch
 			};
@@ -6767,6 +6974,16 @@ async function syncContextTree(serverUrl, getAccessToken, log, userAgent) {
 	}
 }
 /**
+* Sync the Context Tree checkout for the authenticated runtime agent.
+*
+* Uses the SDK's agent-scoped `/api/v1/agent/context-tree/info` route, so the
+* binding follows the agent's own organization rather than the caller's
+* default organization. Local checkouts are still isolated per `(repo, branch)`.
+*/
+async function syncAgentContextTree(sdk, log) {
+	return resolveContextTreeBinding(() => sdk.getAgentContextTreeConfig(), log);
+}
+/**
 * Marker file written into every workspace so the Codex CLI's project-root
 * detection (configured via `project_root_markers: ["first-tree-workspace"]`)
 * stops at the workspace boundary instead of walking up the filesystem and
@@ -9813,21 +10030,23 @@ var Deduplicator = class {
 * offending link simply downgrades to a plain link in the UI.
 */
 async function buildMessageDocumentSnapshots(text, root) {
-	const links = scanInlineMarkdownLinks(text);
-	if (links.length === 0) return {
+	const inline = scanInlineMarkdownLinks(text);
+	const bare = scanBareDocPathTokens(text).map((m) => stripDocPathLineSuffix(m.raw));
+	const candidates = [...inline, ...bare];
+	if (candidates.length === 0) return {
 		docs: [],
 		skipped: 0
 	};
 	const rootReal = await safeRealpath(root);
 	if (!rootReal) return {
 		docs: [],
-		skipped: links.length
+		skipped: candidates.length
 	};
 	const docs = [];
 	let totalBytes = 0;
 	let skipped = 0;
 	const seenCanonical = /* @__PURE__ */ new Set();
-	for (const rawPath of links) {
+	for (const rawPath of candidates) {
 		if (docs.length >= 5) {
 			skipped += 1;
 			continue;
@@ -10722,7 +10941,7 @@ var AgentSlot = class {
 			lastActivityMs: 0
 		};
 	}
-	async start(contextTreeBinding) {
+	async start() {
 		const sdk = (await this.clientConnection.bindAgent(this.config.agentId, this.config.runtimeType ?? this.config.type, this.config.runtimeVersion)).sdk;
 		const agent = await sdk.register();
 		this.logger.info({ displayName: agent.displayName }, "agent bound");
@@ -10743,6 +10962,8 @@ var AgentSlot = class {
 			throw new Error(`Hub unreachable while loading agent config: ${msg}`);
 		}
 		this.inboxId = agent.inboxId;
+		const contextTreeBinding = await syncAgentContextTree(sdk, (msg) => this.logger.info(msg));
+		if (!contextTreeBinding) this.logger.info("context tree not configured or sync skipped — agent will start without organizational context");
 		const onInboxDeliver = (inboxId, frame) => {
 			if (inboxId !== this.inboxId) return;
 			this.dispatchPushedFrame(frame).catch((err) => {
@@ -11593,14 +11814,6 @@ var ClientRuntime = class {
 	watcher = null;
 	debounceTimer = null;
 	/**
-	* Per-org Context Tree binding resolved at `start()`. Threaded through every
-	* `slot.start()` so handlers can copy `AGENT.md` / root `NODE.md` into the
-	* agent workspace's `.agent/context/` and install the first-tree skill.
-	* `null` when the user has no primary org, the org has no tree configured,
-	* or git sync failed — handlers degrade gracefully (empty context dir).
-	*/
-	contextTreeBinding = null;
-	/**
 	* Directory we write auto-registered agent configs into (same path that
 	* `first-tree-hub agent add` uses). Set by `watchAgentsDir` so the
 	* `agent:pinned` handler knows where to materialise new configs.
@@ -11671,7 +11884,6 @@ var ClientRuntime = class {
 		} catch (err) {
 			print.status("⚠️", `git-mirror orphan sweep failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
-		this.contextTreeBinding = await syncContextTree(this.serverUrl, (opts) => ensureFreshAccessToken(opts), (msg) => print.status("[context-tree]", msg), CLI_USER_AGENT);
 		if (this.options.currentVersion && this.options.update) this.updateManager = UpdateManager.attach(this.connection, {
 			currentVersion: this.options.currentVersion,
 			...this.options.update,
@@ -11690,7 +11902,7 @@ var ClientRuntime = class {
 		}
 		await Promise.allSettled(this.agents.map(async (agent) => {
 			try {
-				const identity = await agent.slot.start(this.contextTreeBinding);
+				const identity = await agent.slot.start();
 				print.check(true, `${agent.name}: connected`, `agent: ${identity.displayName ?? identity.agentId}`);
 			} catch (error) {
 				const msg = error instanceof Error ? error.message : String(error);
@@ -11817,7 +12029,7 @@ var ClientRuntime = class {
 	startAgent(name) {
 		const entry = this.agents.find((a) => a.name === name);
 		if (!entry) return;
-		entry.slot.start(this.contextTreeBinding).then((identity) => {
+		entry.slot.start().then((identity) => {
 			print.check(true, `${name}: connected`, `agent: ${identity.displayName ?? identity.agentId}`);
 		}).catch((err) => {
 			const msg = err instanceof Error ? err.message : String(err);
@@ -13112,7 +13324,7 @@ async function onboardCreate(args) {
 	}
 	const runtimeAgent = args.type === "human" ? args.assistant : args.id;
 	if (args.feishuBotAppId && args.feishuBotAppSecret) {
-		const { bindFeishuBot } = await import("./feishu-De9_bA91.mjs");
+		const { bindFeishuBot } = await import("./feishu-DLt219hJ.mjs");
 		const targetAgentUuid = args.type === "human" ? assistantUuid : primary.uuid;
 		if (!targetAgentUuid) print.line(`Warning: Cannot bind Feishu bot — no runtime agent available for "${args.id}".\n`);
 		else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-team-foundation/first-tree-hub",
-  "version": "0.14.6",
+  "version": "0.14.7-alpha.281.1",
   "type": "module",
   "description": "First Tree Hub — unified CLI for client and agent management",
   "exports": {