@agenticmail/enterprise 0.5.304 → 0.5.306

package/dist/cli-serve-KZT4WNKR.js

@@ -0,0 +1,143 @@
+import "./chunk-KFQGP6VL.js";
+
+// src/cli-serve.ts
+import { existsSync, readFileSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+function loadEnvFile() {
+  const candidates = [
+    join(process.cwd(), ".env"),
+    join(homedir(), ".agenticmail", ".env")
+  ];
+  for (const envPath of candidates) {
+    if (!existsSync(envPath)) continue;
+    try {
+      const content = readFileSync(envPath, "utf8");
+      for (const line of content.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("#")) continue;
+        const eq = trimmed.indexOf("=");
+        if (eq < 0) continue;
+        const key = trimmed.slice(0, eq).trim();
+        let val = trimmed.slice(eq + 1).trim();
+        if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+          val = val.slice(1, -1);
+        }
+        if (!process.env[key]) process.env[key] = val;
+      }
+      console.log(`Loaded config from ${envPath}`);
+      return;
+    } catch {
+    }
+  }
+}
+async function ensureSecrets() {
+  const { randomUUID } = await import("crypto");
+  const envDir = join(homedir(), ".agenticmail");
+  const envPath = join(envDir, ".env");
+  let dirty = false;
+  if (!process.env.JWT_SECRET) {
+    process.env.JWT_SECRET = randomUUID() + randomUUID();
+    dirty = true;
+    console.log("[startup] Generated new JWT_SECRET (existing sessions will need to re-login)");
+  }
+  if (!process.env.AGENTICMAIL_VAULT_KEY) {
+    process.env.AGENTICMAIL_VAULT_KEY = randomUUID() + randomUUID();
+    dirty = true;
+    console.log("[startup] Generated new AGENTICMAIL_VAULT_KEY");
+    console.log("[startup] \u26A0\uFE0F  Previously encrypted credentials will need to be re-entered in the dashboard");
+  }
+  if (dirty) {
+    try {
+      if (!existsSync(envDir)) {
+        const { mkdirSync } = await import("fs");
+        mkdirSync(envDir, { recursive: true });
+      }
+      const { appendFileSync } = await import("fs");
+      const lines = [];
+      let existing = "";
+      if (existsSync(envPath)) {
+        existing = readFileSync(envPath, "utf8");
+      }
+      if (!existing.includes("JWT_SECRET=")) {
+        lines.push(`JWT_SECRET=${process.env.JWT_SECRET}`);
+      }
+      if (!existing.includes("AGENTICMAIL_VAULT_KEY=")) {
+        lines.push(`AGENTICMAIL_VAULT_KEY=${process.env.AGENTICMAIL_VAULT_KEY}`);
+      }
+      if (lines.length) {
+        appendFileSync(envPath, "\n" + lines.join("\n") + "\n", { mode: 384 });
+        console.log(`[startup] Saved secrets to ${envPath}`);
+      }
+    } catch (e) {
+      console.warn(`[startup] Could not save secrets to ${envPath}: ${e.message}`);
+    }
+  }
+}
+async function runServe(_args) {
+  loadEnvFile();
+  const DATABASE_URL = process.env.DATABASE_URL;
+  const PORT = parseInt(process.env.PORT || "8080", 10);
+  await ensureSecrets();
+  const JWT_SECRET = process.env.JWT_SECRET;
+  const VAULT_KEY = process.env.AGENTICMAIL_VAULT_KEY;
+  if (!DATABASE_URL) {
+    console.error("ERROR: DATABASE_URL is required.");
+    console.error("");
+    console.error("Set it via environment variable or .env file:");
+    console.error("  DATABASE_URL=postgresql://user:pass@host:5432/db npx @agenticmail/enterprise start");
+    console.error("");
+    console.error("Or create a .env file (in cwd or ~/.agenticmail/.env):");
+    console.error("  DATABASE_URL=postgresql://user:pass@host:5432/db");
+    console.error("  JWT_SECRET=your-secret-here");
+    console.error("  PORT=3200");
+    process.exit(1);
+  }
+  const { createAdapter } = await import("./factory-QYGGXVYW.js");
+  const { createServer } = await import("./server-43HP7BAB.js");
+  const db = await createAdapter({
+    type: DATABASE_URL.startsWith("postgres") ? "postgres" : "sqlite",
+    connectionString: DATABASE_URL
+  });
+  await db.migrate();
+  const server = createServer({
+    port: PORT,
+    db,
+    jwtSecret: JWT_SECRET,
+    corsOrigins: ["*"]
+  });
+  await server.start();
+  console.log(`AgenticMail Enterprise server running on :${PORT}`);
+  const tunnelToken = process.env.CLOUDFLARED_TOKEN;
+  if (tunnelToken) {
+    try {
+      const { execSync, spawn } = await import("child_process");
+      try {
+        execSync("which cloudflared", { timeout: 3e3 });
+      } catch {
+        console.log("[startup] cloudflared not found \u2014 skipping tunnel auto-start");
+        console.log("[startup] Install cloudflared to enable tunnel: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/downloads/");
+        return;
+      }
+      try {
+        execSync('pgrep -f "cloudflared.*tunnel.*run"', { timeout: 3e3 });
+        console.log("[startup] cloudflared tunnel already running");
+        return;
+      } catch {
+      }
+      const subdomain = process.env.AGENTICMAIL_SUBDOMAIN || process.env.AGENTICMAIL_DOMAIN || "";
+      console.log(`[startup] Starting cloudflared tunnel${subdomain ? ` for ${subdomain}.agenticmail.io` : ""}...`);
+      const child = spawn("cloudflared", ["tunnel", "--no-autoupdate", "run", "--token", tunnelToken], {
+        detached: true,
+        stdio: "ignore"
+      });
+      child.unref();
+      console.log("[startup] cloudflared tunnel started (pid " + child.pid + ")");
+    } catch (e) {
+      console.warn("[startup] Could not auto-start cloudflared: " + e.message);
+    }
+  }
+}
+export {
+  runServe
+};

package/dist/cli.js

@@ -57,14 +57,14 @@ Skill Development:
     break;
   case "serve":
   case "start":
-    import("./cli-serve-JZEXPYXY.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
+    import("./cli-serve-KZT4WNKR.js").then((m) => m.runServe(args.slice(1))).catch(fatal);
     break;
   case "agent":
     import("./cli-agent-YSQVDBOZ.js").then((m) => m.runAgent(args.slice(1))).catch(fatal);
     break;
   case "setup":
   default:
-    import("./setup-ZZAOBEY4.js").then((m) => m.runSetupWizard()).catch(fatal);
+    import("./setup-2NQBX5FF.js").then((m) => m.runSetupWizard()).catch(fatal);
     break;
 }
 function fatal(err) {

package/dist/dashboard/pages/approvals.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, Fragment, useApp, engineCall, showConfirm, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, Fragment, useApp, engineCall, showConfirm, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -16,7 +16,7 @@ export function ApprovalsPage() {
   const load = () => {
     engineCall('/approvals/pending').then(d => setPending(d.requests || [])).catch(() => {});
     engineCall('/approvals/history?limit=50').then(d => setHistory(d.requests || [])).catch(() => {});
-    engineCall('/agents?orgId=' + effectiveOrgId).then(d => setAgents(d.agents || [])).catch(() => {});
+    apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(d => setAgents(d.agents || [])).catch(() => {});
   };
   useEffect(() => { load(); }, []);
 

package/dist/dashboard/pages/dashboard.js

@@ -48,7 +48,7 @@ export function SetupChecklist({ onNavigate }) {
 
 export function DashboardPage() {
   var orgCtx = useOrgContext();
-  var effectiveOrgId = orgCtx.selectedOrgId || effectiveOrgId;
+  var clientOrgFilter = orgCtx.selectedOrgId || '';
   const [stats, setStats] = useState(null);
   const [agents, setAgents] = useState([]);
   const [events, setEvents] = useState([]);
@@ -59,11 +59,12 @@ export function DashboardPage() {
   var selectedEvent = _selectedEvent[0]; var setSelectedEvent = _selectedEvent[1];
 
   useEffect(() => {
+    var agentUrl = clientOrgFilter ? '/agents?clientOrgId=' + clientOrgFilter : '/agents';
     apiCall('/stats').then(setStats).catch(() => {});
-    apiCall('/agents').then(d => setAgents(d.agents || d || [])).catch(() => {});
-    engineCall('/agents?orgId=' + effectiveOrgId).then(d => setEngineAgents(d.agents || [])).catch(() => {});
+    apiCall(agentUrl).then(d => setAgents(d.agents || d || [])).catch(() => {});
+    engineCall('/agents?orgId=' + getOrgId()).then(d => setEngineAgents(d.agents || [])).catch(() => {});
     engineCall('/activity/events?limit=10').then(d => setEvents(d.events || [])).catch(() => {});
-  }, [effectiveOrgId]);
+  }, [clientOrgFilter]);
 
   // Merge admin + engine agents; engine agents (appended last) win in the data map
   var mergedForMap = [].concat(agents, engineAgents);
@@ -81,7 +82,7 @@ export function DashboardPage() {
     h('div', { className: 'stat-grid' },
       h('div', { className: 'stat-card' }, h('div', { className: 'stat-label', style: { display: 'flex', alignItems: 'center' } }, 'Total Agents', h(HelpButton, { label: 'Total Agents' },
         h('p', null, 'The total number of agents created in your organization, including active, paused, and archived agents.')
-      )), h('div', { className: 'stat-value' }, stats?.totalAgents ?? agents.length ?? '-')),
+      )), h('div', { className: 'stat-value' }, clientOrgFilter ? agents.length : (stats?.totalAgents ?? agents.length ?? '-'))),
       h('div', { className: 'stat-card' }, h('div', { className: 'stat-label', style: { display: 'flex', alignItems: 'center' } }, 'Active Agents', h(HelpButton, { label: 'Active Agents' },
         h('p', null, 'Agents currently running and available to process tasks. If this is lower than Total Agents, some agents may be paused or archived.')
       )), h('div', { className: 'stat-value', style: { color: 'var(--success)' } }, (stats?.activeAgents ?? agents.filter(function(a) { return a.status === 'active'; }).length) || '-')),

package/dist/dashboard/pages/guardrails.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -104,7 +104,7 @@ export function GuardrailsPage() {
   var _ag = useState([]);
   var agents = _ag[0]; var setAgents = _ag[1];
   useEffect(function() {
-    engineCall('/agents?orgId=' + effectiveOrgId).then(function(d) { setAgents(d.agents || []); }).catch(function() {});
+    apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(function(d) { setAgents(d.agents || []); }).catch(function() {});
   }, []);
 
   var TABS = [

package/dist/dashboard/pages/journal.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, Fragment, useApp, engineCall, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, Fragment, useApp, engineCall, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -16,7 +16,7 @@ export function JournalPage() {
   const load = () => {
     engineCall('/journal?orgId=' + effectiveOrgId + '&limit=50').then(d => { setEntries(d.entries || []); setTotal(d.total || 0); }).catch(() => {});
     engineCall('/journal/stats/default').then(d => setStats(d)).catch(() => {});
-    engineCall('/agents?orgId=' + effectiveOrgId).then(d => setAgents(d.agents || [])).catch(() => {});
+    apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(d => setAgents(d.agents || [])).catch(() => {});
   };
   useEffect(load, []);
 

package/dist/dashboard/pages/knowledge-contributions.js

@@ -42,7 +42,7 @@ export function KnowledgeContributionsPage() {
   var [searchAgentFilter, setSearchAgentFilter] = useState('');
 
   // Effective org ID: uses client org if selected, else default
-  var effectiveOrgId = orgCtx.selectedOrgId || effectiveOrgId;
+  var effectiveOrgId = orgCtx.selectedOrgId || getOrgId();
 
   var loadBases = useCallback(function() {
     Promise.all([

package/dist/dashboard/pages/knowledge.js

@@ -17,7 +17,7 @@ export function KnowledgeBasePage() {
   const [chunks, setChunks] = useState([]);
   const [selectedDoc, setSelectedDoc] = useState(null);
   const [editing, setEditing] = useState(false);
-  const [editForm, setEditForm] = useState({ name: '', description: '' });
+  const [editForm, setEditForm] = useState({ name: '', description: '', clientOrgId: '' });
   const [loading, setLoading] = useState(false);
   const [showImport, setShowImport] = useState(false);
   const [importKb, setImportKb] = useState(null);
@@ -54,7 +54,7 @@ export function KnowledgeBasePage() {
       setDocs(kbData.documents || []);
       setChunks([]);
       setSelectedDoc(null);
-      setEditForm({ name: kbData.name || '', description: kbData.description || '' });
+      setEditForm({ name: kbData.name || '', description: kbData.description || '', clientOrgId: kbData.clientOrgId || '' });
     } catch (e) {
       toast('Failed to load knowledge base: ' + e.message, 'error');
     }
@@ -122,9 +122,9 @@ export function KnowledgeBasePage() {
   const saveEdit = async () => {
     if (!selected) return;
     try {
-      await engineCall('/knowledge-bases/' + selected.id, { method: 'PUT', body: JSON.stringify({ name: editForm.name, description: editForm.description }) });
+      await engineCall('/knowledge-bases/' + selected.id, { method: 'PUT', body: JSON.stringify({ name: editForm.name, description: editForm.description, clientOrgId: editForm.clientOrgId || null }) });
       toast('Knowledge base updated', 'success');
-      setSelected(s => ({ ...s, name: editForm.name, description: editForm.description }));
+      setSelected(s => ({ ...s, name: editForm.name, description: editForm.description, clientOrgId: editForm.clientOrgId }));
       setEditing(false);
       load();
     } catch (e) { toast(e.message, 'error'); }
@@ -171,7 +171,16 @@ export function KnowledgeBasePage() {
       h('div', { className: 'card', style: { marginBottom: 16 } },
         h('div', { className: 'card-body' },
           editing
-            ? h('textarea', { className: 'input', rows: 3, value: editForm.description, onChange: e => setEditForm(f => ({ ...f, description: e.target.value })), placeholder: 'Knowledge base description...' })
+            ? h(Fragment, null,
+                h('textarea', { className: 'input', rows: 3, value: editForm.description, onChange: e => setEditForm(f => ({ ...f, description: e.target.value })), placeholder: 'Knowledge base description...', style: { marginBottom: 8 } }),
+                clientOrgs.length > 0 && h('div', { style: { display: 'flex', alignItems: 'center', gap: 8 } },
+                  h('label', { style: { fontSize: 12, fontWeight: 600, whiteSpace: 'nowrap' } }, 'Organization:'),
+                  h('select', { className: 'input', value: editForm.clientOrgId, onChange: e => setEditForm(f => ({ ...f, clientOrgId: e.target.value })), style: { fontSize: 12, maxWidth: 250 } },
+                    h('option', { value: '' }, 'My Organization (internal)'),
+                    clientOrgs.filter(o => o.is_active !== false).map(o => h('option', { key: o.id, value: o.id }, o.name))
+                  )
+                )
+              )
             : h('p', { style: { color: 'var(--text-secondary)', fontSize: 13, margin: 0 } }, selected.description || 'No description'),
           h('div', { style: { display: 'flex', gap: 12, marginTop: 12, fontSize: 12, color: 'var(--text-muted)' } },
             h('span', null, 'ID: ', h('code', null, selected.id)),

package/dist/dashboard/pages/messages.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useRef, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, useRef, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -22,7 +22,7 @@ export function MessagesPage() {
     engineCall('/messages?orgId=' + effectiveOrgId + '&limit=100').then(d => setMessages(d.messages || [])).catch(() => {});
   };
   const loadAgents = () => {
-    engineCall('/agents?orgId=' + effectiveOrgId).then(d => setAgents(d.agents || [])).catch(() => {});
+    apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(d => setAgents(d.agents || [])).catch(() => {});
   };
   const loadTopology = () => {
     engineCall('/messages/topology?orgId=' + effectiveOrgId).then(d => setTopology(d.topology || null)).catch(() => {});

package/dist/dashboard/pages/org-chart.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, useRef, Fragment, useApp, engineCall, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, useRef, Fragment, useApp, engineCall, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -154,7 +154,7 @@ export function OrgChartPage() {
     setLoading(true); setError(null);
     Promise.all([
       engineCall('/hierarchy/org-chart').catch(function() { return null; }),
-      engineCall('/agents?orgId=' + effectiveOrgId).catch(function() { return { agents: [] }; }),
+      apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).catch(function() { return { agents: [] }; }),
     ]).then(function(res) {
       var hierRes = res[0]; var agentRes = res[1];
       var avatarMap = {};

package/dist/dashboard/pages/task-pipeline.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, useRef, Fragment, useApp, engineCall, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, useRef, Fragment, useApp, engineCall, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -440,7 +440,7 @@ export function TaskPipelinePage() {
   var app = useApp();
   var toast = app.toast;
   var orgCtx = useOrgContext();
-  var effectiveOrgId = orgCtx.selectedOrgId || effectiveOrgId;
+  var effectiveOrgId = orgCtx.selectedOrgId || getOrgId();
   var _tasks = useState([]);
   var tasks = _tasks[0]; var setTasks = _tasks[1];
   var _stats = useState({ created: 0, assigned: 0, inProgress: 0, completed: 0, failed: 0, cancelled: 0, total: 0, todayCompleted: 0, todayFailed: 0, todayCreated: 0, avgDurationMs: 0, totalCost: 0, totalTokens: 0, topAgents: [] });
@@ -477,16 +477,26 @@ export function TaskPipelinePage() {
     Promise.all([
       engineCall('/task-pipeline?limit=200'),
       engineCall('/task-pipeline/stats'),
-      engineCall('/agents?orgId=' + effectiveOrgId).catch(function() { return { agents: [] }; }),
+      apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).catch(function() { return { agents: [] }; }),
     ]).then(function(res) {
-      setTasks(res[0]?.tasks || []);
-      setStats(res[1] || stats);
+      var allTasks = res[0]?.tasks || [];
+      var orgAgents = res[2]?.agents || [];
       // Build agent avatar/name map
       var map = {};
-      (res[2]?.agents || []).forEach(function(a) {
-        map[a.id] = { name: a.config?.name || a.id, avatar: a.config?.identity?.avatar || a.config?.avatar || a.config?.persona?.avatar || null };
+      orgAgents.forEach(function(a) {
+        map[a.id] = { name: a.config?.name || a.name || a.id, avatar: a.config?.identity?.avatar || a.config?.avatar || a.config?.persona?.avatar || null };
       });
       setAgentMap(map);
+      // Filter tasks by org's agents when org is selected
+      if (orgCtx.selectedOrgId && orgAgents.length > 0) {
+        var agentIds = {};
+        orgAgents.forEach(function(a) { agentIds[a.id] = true; });
+        allTasks = allTasks.filter(function(t) { return agentIds[t.assignedAgent] || agentIds[t.createdBy]; });
+      } else if (orgCtx.selectedOrgId && orgAgents.length === 0) {
+        allTasks = []; // No agents in this org = no tasks
+      }
+      setTasks(allTasks);
+      setStats(res[1] || stats);
     }).catch(function(err) { console.error('[TaskPipeline]', err); })
       .finally(function() { setLoading(false); });
   }, [effectiveOrgId]);

package/dist/dashboard/pages/users.js

@@ -235,6 +235,30 @@ function PermissionEditor({ userId, userName, currentPerms, pageRegistry, onSave
       })
     ),
 
+    // ─── Organization Assignment ──────────────────────
+    permOrgs.length > 0 && h('div', { style: { marginTop: 16, padding: '12px 14px', background: 'var(--bg-tertiary)', borderRadius: 8 } },
+      h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 8 } },
+        h('div', null,
+          h('strong', { style: { fontSize: 13 } }, 'Client Organization'),
+          h('div', { style: { fontSize: 11, color: 'var(--text-muted)', marginTop: 1 } }, 'Bind this user to a client org — they will only see that org\'s agents and data')
+        )
+      ),
+      h('select', {
+        className: 'input',
+        value: userOrgId,
+        onChange: function(e) { setUserOrgId(e.target.value); },
+        style: { fontSize: 13 }
+      },
+        h('option', { value: '' }, 'None (Internal User)'),
+        permOrgs.filter(function(o) { return o.is_active !== false; }).map(function(o) {
+          return h('option', { key: o.id, value: o.id }, o.name);
+        })
+      ),
+      userOrgId && h('div', { style: { fontSize: 11, color: 'var(--warning, #f59e0b)', marginTop: 6 } },
+        'This user will only see agents and data belonging to this organization. The org switcher will be locked for them.'
+      )
+    ),
+
     // ─── Agent Access ──────────────────────────
     !fullAccess && h('div', { style: { marginTop: 16 } },
       h('div', { style: { display: 'flex', alignItems: 'center', justifyContent: 'space-between', marginBottom: 8 } },
@@ -470,6 +494,21 @@ export function UsersPage() {
     setResetting(false);
   };
 
+  var openEditUser = function(u) {
+    setEditUser(u);
+    setEditForm({ name: u.name || '', role: u.role || 'viewer', clientOrgId: u.clientOrgId || '' });
+  };
+
+  var doEditUser = async function() {
+    if (!editUser) return;
+    try {
+      await apiCall('/users/' + editUser.id, { method: 'PATCH', body: JSON.stringify({ name: editForm.name, role: editForm.role, clientOrgId: editForm.clientOrgId || null }) });
+      toast('User updated', 'success');
+      setEditUser(null);
+      load();
+    } catch (e) { toast(e.message || 'Update failed', 'error'); }
+  };
+
   var toggleActive = async function(user) {
     var action = user.isActive === false ? 'reactivate' : 'deactivate';
     var ok = await showConfirm({
@@ -491,6 +530,8 @@ export function UsersPage() {
   var [deleteStep, setDeleteStep] = useState(0);
   var [deleteTarget, setDeleteTarget] = useState(null);
   var [deleteTyped, setDeleteTyped] = useState('');
+  var [editUser, setEditUser] = useState(null);
+  var [editForm, setEditForm] = useState({ name: '', role: '', clientOrgId: '' });
 
   var startDelete = function(user) { setDeleteTarget(user); setDeleteStep(1); setDeleteTyped(''); };
   var cancelDelete = function() { setDeleteTarget(null); setDeleteStep(0); setDeleteTyped(''); };
@@ -631,13 +672,60 @@ export function UsersPage() {
     ),
 
     // Permission editor modal
+    // Edit User modal
+    editUser && h(Modal, {
+      title: 'Edit User — ' + (editUser.name || editUser.email),
+      onClose: function() { setEditUser(null); },
+      width: 420,
+      footer: h(Fragment, null,
+        h('button', { className: 'btn btn-secondary', onClick: function() { setEditUser(null); } }, 'Cancel'),
+        h('button', { className: 'btn btn-primary', onClick: doEditUser }, 'Save Changes')
+      )
+    },
+      h('div', { className: 'form-group' },
+        h('label', { className: 'form-label' }, 'Name'),
+        h('input', { className: 'input', value: editForm.name, onChange: function(e) { setEditForm(function(f) { return Object.assign({}, f, { name: e.target.value }); }); } })
+      ),
+      h('div', { className: 'form-group' },
+        h('label', { className: 'form-label' }, 'Role'),
+        h('select', { className: 'input', value: editForm.role, onChange: function(e) { setEditForm(function(f) { return Object.assign({}, f, { role: e.target.value }); }); } },
+          h('option', { value: 'viewer' }, 'Viewer'),
+          h('option', { value: 'member' }, 'Member'),
+          h('option', { value: 'admin' }, 'Admin'),
+          h('option', { value: 'owner' }, 'Owner')
+        ),
+        h('div', { style: { fontSize: 11, color: 'var(--text-muted)', marginTop: 4 } },
+          editForm.role === 'owner' ? 'Full access to everything. Cannot be restricted.' :
+          editForm.role === 'admin' ? 'Full access by default. Can be restricted via permissions.' :
+          editForm.role === 'member' ? 'Access controlled by permissions. Can view and act on assigned pages.' :
+          'Read-only access. Can view but not modify.'
+        )
+      ),
+      clientOrgs.length > 0 && h('div', { className: 'form-group' },
+        h('label', { className: 'form-label' }, 'Client Organization'),
+        h('select', { className: 'input', value: editForm.clientOrgId, onChange: function(e) { setEditForm(function(f) { return Object.assign({}, f, { clientOrgId: e.target.value }); }); } },
+          h('option', { value: '' }, 'None (Internal User)'),
+          clientOrgs.filter(function(o) { return o.is_active !== false; }).map(function(o) {
+            return h('option', { key: o.id, value: o.id }, o.name);
+          })
+        ),
+        editForm.clientOrgId && h('div', { style: { fontSize: 11, color: 'var(--warning, #f59e0b)', marginTop: 4 } },
+          'This user will only see agents and data from this organization.'
+        )
+      ),
+      h('div', { style: { fontSize: 12, color: 'var(--text-muted)', padding: '8px 0', borderTop: '1px solid var(--border)', marginTop: 8 } },
+        'Email: ', h('code', null, editUser.email), ' (cannot be changed)'
+      )
+    ),
+
     permTarget && pageRegistry && h(PermissionEditor, {
       userId: permTarget.id,
       userName: permTarget.name || permTarget.email,
       currentPerms: permGrants,
       pageRegistry: pageRegistry,
       onSave: savePermissions,
-      onClose: function() { setPermTarget(null); }
+      onClose: function() { setPermTarget(null); },
+      userObj: permTarget
     }),
 
     // 5-step delete confirmation modal
@@ -743,6 +831,7 @@ export function UsersPage() {
                 h('td', { style: { fontSize: 12, color: 'var(--text-muted)' } }, u.createdAt ? new Date(u.createdAt).toLocaleDateString() : '-'),
                 h('td', null,
                   h('div', { style: { display: 'flex', gap: 4 } },
+                    h('button', { className: 'btn btn-ghost btn-sm', title: 'Edit User', onClick: function() { openEditUser(u); } }, I.edit()),
                     h('button', {
                       className: 'btn btn-ghost btn-sm',
                       title: isRestricted ? 'Edit Permissions' : 'Permissions (Owner/Admin have full access)',

package/dist/dashboard/pages/workforce.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, useCallback, Fragment, useApp, engineCall, buildAgentEmailMap, resolveAgentEmail, buildAgentDataMap, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { TimezoneSelect } from '../components/timezones.js';
 import { HelpButton } from '../components/help-button.js';
@@ -47,7 +47,7 @@ export function WorkforcePage() {
       setSchedules(schedulesRes.schedules || []);
       setBudgetData(budgetRes);
       setClockRecords(recordsRes.records || []);
-      engineCall('/agents?orgId=' + effectiveOrgId).then(d => setAgents(d.agents || [])).catch(() => {});
+      apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(d => setAgents(d.agents || [])).catch(() => {});
     } catch (err) { toast('Failed to load workforce data', 'error'); }
     setLoading(false);
   };

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   provision,
   runSetupWizard
-} from "./chunk-4VGAZULN.js";
+} from "./chunk-N5JFOIJN.js";
 import {
   AgenticMailManager,
   GoogleEmailProvider,
@@ -42,7 +42,7 @@ import {
   requireRole,
   securityHeaders,
   validate
-} from "./chunk-CRXYUYVJ.js";
+} from "./chunk-4QGERCWK.js";
 import "./chunk-OF4MUWWS.js";
 import {
   PROVIDER_REGISTRY,

package/dist/server-43HP7BAB.js

@@ -0,0 +1,15 @@
+import {
+  createServer
+} from "./chunk-4QGERCWK.js";
+import "./chunk-OF4MUWWS.js";
+import "./chunk-UF3ZJMJO.js";
+import "./chunk-3OC6RH7W.js";
+import "./chunk-2DDKGTD6.js";
+import "./chunk-YVK6F5OD.js";
+import "./chunk-MKRNEM5A.js";
+import "./chunk-DRXMYYKN.js";
+import "./chunk-6WSX7QXF.js";
+import "./chunk-KFQGP6VL.js";
+export {
+  createServer
+};

package/dist/setup-2NQBX5FF.js

@@ -0,0 +1,20 @@
+import {
+  promptCompanyInfo,
+  promptDatabase,
+  promptDeployment,
+  promptDomain,
+  promptRegistration,
+  provision,
+  runSetupWizard
+} from "./chunk-N5JFOIJN.js";
+import "./chunk-QCGSFWKU.js";
+import "./chunk-KFQGP6VL.js";
+export {
+  promptCompanyInfo,
+  promptDatabase,
+  promptDeployment,
+  promptDomain,
+  promptRegistration,
+  provision,
+  runSetupWizard
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticmail/enterprise",
-  "version": "0.5.304",
+  "version": "0.5.306",
   "description": "AgenticMail Enterprise — cloud-hosted AI agent identity, email, auth & compliance for organizations",
   "type": "module",
   "bin": {

package/src/admin/routes.ts

@@ -216,10 +216,16 @@ export function createAdminRoutes(db: DatabaseAdapter) {
 
   api.get('/agents', async (c) => {
     const status = c.req.query('status') as any;
+    const clientOrgId = c.req.query('clientOrgId') || '';
     const limit = Math.min(parseInt(c.req.query('limit') || '50'), 200);
     const offset = Math.max(parseInt(c.req.query('offset') || '0'), 0);
-    const agents = await db.listAgents({ status, limit, offset });
-    const total = await db.countAgents(status);
+    let agents = await db.listAgents({ status, limit, offset });
+    let total = await db.countAgents(status);
+    // Filter by client org if requested
+    if (clientOrgId) {
+      agents = agents.filter((a: any) => a.client_org_id === clientOrgId);
+      total = agents.length;
+    }
     return c.json({ agents, total, limit, offset });
   });
 

package/src/dashboard/pages/approvals.js

@@ -1,4 +1,4 @@
-import { h, useState, useEffect, Fragment, useApp, engineCall, showConfirm, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } from '../components/utils.js';
+import { h, useState, useEffect, Fragment, useApp, engineCall, showConfirm, buildAgentEmailMap, buildAgentDataMap, resolveAgentEmail, renderAgentBadge, getOrgId } , apiCall } from '../components/utils.js';
 import { I } from '../components/icons.js';
 import { HelpButton } from '../components/help-button.js';
 import { useOrgContext } from '../components/org-switcher.js';
@@ -16,7 +16,7 @@ export function ApprovalsPage() {
   const load = () => {
     engineCall('/approvals/pending').then(d => setPending(d.requests || [])).catch(() => {});
     engineCall('/approvals/history?limit=50').then(d => setHistory(d.requests || [])).catch(() => {});
-    engineCall('/agents?orgId=' + effectiveOrgId).then(d => setAgents(d.agents || [])).catch(() => {});
+    apiCall('/agents' + (orgCtx.selectedOrgId ? '?clientOrgId=' + orgCtx.selectedOrgId : '')).then(d => setAgents(d.agents || [])).catch(() => {});
   };
   useEffect(() => { load(); }, []);