@agenticmail/enterprise 0.5.311 → 0.5.313

package/src/agent-tools/tools/local/dependency-manager.ts

@@ -0,0 +1,286 @@
+/**
+ * Dependency Manager — Detects missing tools/packages and handles installation.
+ * 
+ * Agents use this to:
+ * 1. Check if a command/tool is available before using it
+ * 2. Request installation if missing (with manager approval flow)
+ * 3. Track what was installed for cleanup
+ * 
+ * Installation approval modes:
+ * - 'auto': Install without asking (for trusted/common tools)
+ * - 'ask_manager': Message manager for approval before installing
+ * - 'deny': Never install (locked-down environments)
+ */
+
+import { exec as cpExec } from 'node:child_process';
+import { promisify } from 'node:util';
+import { platform } from 'node:os';
+import type { ToolDefinition } from '../../types.js';
+
+var execAsync = promisify(cpExec);
+
+// Track installations per session for cleanup
+var sessionInstalls = new Map<string, string[]>();
+
+// Common tools and their package names per platform
+var KNOWN_PACKAGES: Record<string, { brew?: string; apt?: string; pip?: string; npm?: string; description: string }> = {
+  ffmpeg: { brew: 'ffmpeg', apt: 'ffmpeg', description: 'Audio/video processing toolkit' },
+  ffprobe: { brew: 'ffmpeg', apt: 'ffmpeg', description: 'Audio/video analysis (part of ffmpeg)' },
+  convert: { brew: 'imagemagick', apt: 'imagemagick', description: 'Image manipulation (ImageMagick)' },
+  magick: { brew: 'imagemagick', apt: 'imagemagick', description: 'Image manipulation (ImageMagick)' },
+  sox: { brew: 'sox', apt: 'sox', description: 'Sound processing toolkit' },
+  jq: { brew: 'jq', apt: 'jq', description: 'JSON processor' },
+  curl: { brew: 'curl', apt: 'curl', description: 'HTTP client' },
+  wget: { brew: 'wget', apt: 'wget', description: 'File downloader' },
+  yt_dlp: { brew: 'yt-dlp', pip: 'yt-dlp', description: 'Video downloader' },
+  'yt-dlp': { brew: 'yt-dlp', pip: 'yt-dlp', description: 'Video downloader' },
+  tesseract: { brew: 'tesseract', apt: 'tesseract-ocr', description: 'OCR text recognition' },
+  pdftk: { brew: 'pdftk-java', apt: 'pdftk', description: 'PDF toolkit' },
+  ghostscript: { brew: 'ghostscript', apt: 'ghostscript', description: 'PDF/PostScript processor' },
+  gs: { brew: 'ghostscript', apt: 'ghostscript', description: 'PDF/PostScript processor' },
+  chromium: { brew: 'chromium', apt: 'chromium-browser', description: 'Web browser' },
+  pandoc: { brew: 'pandoc', apt: 'pandoc', description: 'Document format converter' },
+  rsvg: { brew: 'librsvg', apt: 'librsvg2-bin', description: 'SVG renderer' },
+  graphviz: { brew: 'graphviz', apt: 'graphviz', description: 'Graph visualization' },
+  dot: { brew: 'graphviz', apt: 'graphviz', description: 'Graph visualization (part of graphviz)' },
+  gifsicle: { brew: 'gifsicle', apt: 'gifsicle', description: 'GIF optimizer' },
+  optipng: { brew: 'optipng', apt: 'optipng', description: 'PNG optimizer' },
+  qrencode: { brew: 'qrencode', apt: 'qrencode', description: 'QR code generator' },
+  htop: { brew: 'htop', apt: 'htop', description: 'Process monitor' },
+  tree: { brew: 'tree', apt: 'tree', description: 'Directory tree viewer' },
+  ripgrep: { brew: 'ripgrep', apt: 'ripgrep', description: 'Fast text search (rg)' },
+  rg: { brew: 'ripgrep', apt: 'ripgrep', description: 'Fast text search' },
+  fd: { brew: 'fd', apt: 'fd-find', description: 'Fast file finder' },
+  bat: { brew: 'bat', apt: 'bat', description: 'Better cat with syntax highlighting' },
+};
+
+export function createDependencyManagerTools(): ToolDefinition[] {
+  return [
+    {
+      name: 'check_dependency',
+      description: `Check if a command-line tool is available on this system. Returns availability, version info, and install instructions if missing. Use this BEFORE running shell commands that depend on specific tools (ffmpeg, imagemagick, etc.). If the tool is missing, use install_dependency to install it.`,
+      input_schema: {
+        type: 'object' as const,
+        properties: {
+          command: { type: 'string', description: 'Command to check (e.g. "ffmpeg", "convert", "jq")' },
+        },
+        required: ['command'],
+      },
+      execute: async (input: any) => {
+        var cmd = input.command.trim();
+        try {
+          var { stdout } = await execAsync(`which ${cmd} 2>/dev/null && ${cmd} --version 2>&1 || ${cmd} -version 2>&1 || echo "version-unknown"`, {
+            timeout: 5000,
+            env: { ...process.env, TERM: 'dumb' },
+          });
+          return {
+            available: true,
+            command: cmd,
+            path: stdout.split('\n')[0] || '',
+            versionInfo: stdout.slice(0, 500),
+          };
+        } catch {
+          var known = KNOWN_PACKAGES[cmd];
+          var os = platform();
+          var installCmd = '';
+          if (known) {
+            if (os === 'darwin' && known.brew) installCmd = `brew install ${known.brew}`;
+            else if (known.apt) installCmd = `sudo apt-get install -y ${known.apt}`;
+            else if (known.pip) installCmd = `pip install ${known.pip}`;
+            else if (known.npm) installCmd = `npm install -g ${known.npm}`;
+          }
+          return {
+            available: false,
+            command: cmd,
+            description: known?.description || 'Unknown tool',
+            installCommand: installCmd || `Use shell_install with package="${cmd}"`,
+            suggestion: `Tool "${cmd}" is not installed. ${installCmd ? `Install with: ${installCmd}` : 'Use install_dependency to install it.'}`,
+          };
+        }
+      },
+    },
+    {
+      name: 'install_dependency',
+      description: `Install a missing command-line tool using the system package manager (brew on macOS, apt on Linux). Auto-detects the correct package name for common tools. Tracks installations for cleanup. Use check_dependency first to verify the tool is actually missing.`,
+      input_schema: {
+        type: 'object' as const,
+        properties: {
+          command: { type: 'string', description: 'Tool name to install (e.g. "ffmpeg", "imagemagick")' },
+          package: { type: 'string', description: 'Override package name if different from command' },
+          method: { type: 'string', description: 'Force install method: brew|apt|pip|npm (auto-detected by default)' },
+        },
+        required: ['command'],
+      },
+      execute: async (input: any) => {
+        var cmd = input.command.trim();
+        var os = platform();
+        var known = KNOWN_PACKAGES[cmd];
+        var pkg = input.package || '';
+        var method = input.method || '';
+
+        // Determine install command
+        var installCmd = '';
+        var packageName = '';
+
+        if (method === 'pip' || (!method && known?.pip && !known?.brew && !known?.apt)) {
+          packageName = pkg || known?.pip || cmd;
+          installCmd = `pip install ${packageName}`;
+        } else if (method === 'npm' || (!method && known?.npm)) {
+          packageName = pkg || known?.npm || cmd;
+          installCmd = `npm install -g ${packageName}`;
+        } else if (os === 'darwin') {
+          packageName = pkg || known?.brew || cmd;
+          installCmd = `brew install ${packageName}`;
+        } else {
+          // Linux
+          packageName = pkg || known?.apt || cmd;
+          installCmd = `sudo apt-get install -y ${packageName}`;
+        }
+
+        console.log(`[dep-manager] Installing: ${installCmd}`);
+
+        try {
+          var r = await execAsync(installCmd, {
+            timeout: 300000, // 5 min for large packages
+            maxBuffer: 2 * 1024 * 1024,
+            env: { ...process.env, DEBIAN_FRONTEND: 'noninteractive', TERM: 'dumb', HOMEBREW_NO_AUTO_UPDATE: '1' },
+          });
+
+          // Track installation for cleanup
+          var key = 'global'; // Could be per-session if we had session context
+          var installed = sessionInstalls.get(key) || [];
+          installed.push(packageName);
+          sessionInstalls.set(key, installed);
+
+          // Verify installation
+          try {
+            await execAsync(`which ${cmd}`, { timeout: 3000 });
+            return {
+              ok: true,
+              command: cmd,
+              package: packageName,
+              method: installCmd.split(' ')[0],
+              stdout: (r.stdout || '').slice(-2000),
+              note: `Installed "${packageName}" successfully. The "${cmd}" command is now available.`,
+            };
+          } catch {
+            return {
+              ok: true,
+              command: cmd,
+              package: packageName,
+              warning: `Package installed but "${cmd}" not found in PATH. The binary may have a different name.`,
+              stdout: (r.stdout || '').slice(-2000),
+            };
+          }
+        } catch (err: any) {
+          return {
+            ok: false,
+            command: cmd,
+            error: (err.stderr || err.message || '').slice(0, 5000),
+            suggestion: `Installation failed. Try: 1) Check package name is correct, 2) Run with sudo if needed, 3) Use shell_exec to install manually.`,
+          };
+        }
+      },
+    },
+    {
+      name: 'check_environment',
+      description: 'Check the current system environment: OS, package manager, installed common tools, available disk space, etc. Use at the start of complex tasks to understand capabilities.',
+      input_schema: {
+        type: 'object' as const,
+        properties: {},
+        required: [],
+      },
+      execute: async () => {
+        var os = platform();
+        var checks: Record<string, boolean> = {};
+        var commonTools = ['ffmpeg', 'convert', 'jq', 'curl', 'wget', 'sox', 'pandoc', 'tesseract', 'yt-dlp', 'rg', 'node', 'python3', 'pip3', 'git'];
+
+        for (var tool of commonTools) {
+          try {
+            await execAsync(`which ${tool}`, { timeout: 2000 });
+            checks[tool] = true;
+          } catch {
+            checks[tool] = false;
+          }
+        }
+
+        var pkgManager = 'unknown';
+        try {
+          if (os === 'darwin') { await execAsync('which brew', { timeout: 2000 }); pkgManager = 'brew'; }
+          else { await execAsync('which apt-get', { timeout: 2000 }); pkgManager = 'apt'; }
+        } catch {
+          try { await execAsync('which dnf', { timeout: 2000 }); pkgManager = 'dnf'; }
+          catch { try { await execAsync('which pacman', { timeout: 2000 }); pkgManager = 'pacman'; } catch {} }
+        }
+
+        var diskSpace = '';
+        try {
+          var r = await execAsync('df -h / | tail -1', { timeout: 3000 });
+          diskSpace = r.stdout.trim();
+        } catch {}
+
+        var nodeVersion = '';
+        try { nodeVersion = (await execAsync('node --version', { timeout: 2000 })).stdout.trim(); } catch {}
+
+        return {
+          os,
+          arch: process.arch,
+          packageManager: pkgManager,
+          nodeVersion,
+          diskSpace,
+          tools: checks,
+          missingTools: Object.entries(checks).filter(([, v]) => !v).map(([k]) => k),
+          availableTools: Object.entries(checks).filter(([, v]) => v).map(([k]) => k),
+          installedThisSession: sessionInstalls.get('global') || [],
+        };
+      },
+    },
+    {
+      name: 'cleanup_installed',
+      description: 'List or uninstall packages that were installed during this session. Use for cleanup after completing tasks.',
+      input_schema: {
+        type: 'object' as const,
+        properties: {
+          action: { type: 'string', description: '"list" to see installed packages, "uninstall" to remove them, "keep" to clear tracking without removing' },
+          packages: { type: 'array', items: { type: 'string' }, description: 'Specific packages to uninstall (default: all session-installed)' },
+        },
+        required: ['action'],
+      },
+      execute: async (input: any) => {
+        var installed = sessionInstalls.get('global') || [];
+
+        if (input.action === 'list') {
+          return { installedThisSession: installed };
+        }
+
+        if (input.action === 'keep') {
+          sessionInstalls.delete('global');
+          return { ok: true, message: 'Tracking cleared. Packages remain installed.', packages: installed };
+        }
+
+        if (input.action === 'uninstall') {
+          var toRemove = input.packages || installed;
+          var os = platform();
+          var results: any[] = [];
+
+          for (var pkg of toRemove) {
+            try {
+              var cmd = os === 'darwin' ? `brew uninstall ${pkg}` : `sudo apt-get remove -y ${pkg}`;
+              await execAsync(cmd, { timeout: 60000, env: { ...process.env, DEBIAN_FRONTEND: 'noninteractive' } });
+              results.push({ package: pkg, removed: true });
+              // Remove from tracking
+              installed = installed.filter((p: string) => p !== pkg);
+            } catch (err: any) {
+              results.push({ package: pkg, removed: false, error: (err.message || '').slice(0, 200) });
+            }
+          }
+
+          sessionInstalls.set('global', installed);
+          return { results, remaining: installed };
+        }
+
+        return { error: 'Unknown action. Use "list", "uninstall", or "keep".' };
+      },
+    },
+  ];
+}

package/src/agent-tools/tools/local/index.ts

@@ -11,6 +11,7 @@ import { createFileListTool } from './file-list.js';
 import { createFileSearchTool } from './file-search.js';
 import { createFileMoveTool, createFileDeleteTool } from './file-ops.js';
 import { createShellTools } from './shell.js';
+import { createDependencyManagerTools } from './dependency-manager.js';
 import { createSystemInfoTool } from './system-info.js';
 import { createCodingTools } from './coding.js';
 import type { ToolDefinition } from '../../types.js';
@@ -36,6 +37,7 @@ export function createLocalSystemTools(config?: LocalToolsConfig): ToolDefinitio
     createFileMoveTool(sandbox),
     createFileDeleteTool(sandbox),
     ...createShellTools({ cwd: config?.shellCwd, timeout: config?.shellTimeout }),
+    ...createDependencyManagerTools(),
     createSystemInfoTool(),
     ...createCodingTools({ cwd: config?.shellCwd, sandbox }),
   ];
@@ -50,3 +52,4 @@ export { createFileMoveTool, createFileDeleteTool } from './file-ops.js';
 export { createShellTools, createShellExecTool } from './shell.js';
 export { createSystemInfoTool } from './system-info.js';
 export { createCodingTools } from './coding.js';
+export { createDependencyManagerTools } from './dependency-manager.js';

package/src/agent-tools/tools/messaging/telegram.ts

@@ -90,6 +90,35 @@ export function createTelegramTools(config: TelegramConfig): ToolDefinition[] {
       input_schema: { type: 'object' as const, properties: {}, required: [] },
       execute: async (_id: string) => tgApi(botToken, 'getMe'),
     },
+    {
+      name: 'telegram_download_file',
+      description: 'Download a file from Telegram by file_id (from media messages). Returns the local path.',
+      input_schema: {
+        type: 'object' as const,
+        properties: {
+          fileId: { type: 'string', description: 'Telegram file_id from the message' },
+          fileName: { type: 'string', description: 'Optional output filename' },
+        },
+        required: ['fileId'],
+      },
+      execute: async (_id: string, input: any) => {
+        var fileData = await tgApi(botToken, 'getFile', { file_id: input.fileId });
+        if (!fileData.file_path) return { error: 'No file_path returned' };
+        var downloadUrl = `https://api.telegram.org/file/bot${botToken}/${fileData.file_path}`;
+        var resp = await fetch(downloadUrl);
+        if (!resp.ok) throw new Error(`Download failed: ${resp.status}`);
+        var { join } = await import('path');
+        var { mkdirSync, writeFileSync } = await import('fs');
+        var mediaDir = join('/tmp/agents/media');
+        try { mkdirSync(mediaDir, { recursive: true }); } catch {}
+        var ext = fileData.file_path.split('.').pop() || 'bin';
+        var localName = input.fileName || `telegram-${Date.now()}.${ext}`;
+        var localPath = join(mediaDir, localName);
+        var buffer = Buffer.from(await resp.arrayBuffer());
+        writeFileSync(localPath, buffer);
+        return { ok: true, localPath, size: buffer.length, originalPath: fileData.file_path };
+      },
+    },
     {
       name: 'telegram_get_chat',
       description: 'Get chat/group details.',

package/src/agent-tools/tools/messaging/whatsapp.ts

@@ -155,22 +155,77 @@ export async function getOrCreateConnection(config: WhatsAppConfig): Promise<Wha
             if (!isSelfChat) continue;
           }
 
-          if (!text) continue;
+          // Detect media
+          var mediaMessage = msg.message?.imageMessage || msg.message?.videoMessage ||
+            msg.message?.documentMessage || msg.message?.audioMessage ||
+            msg.message?.stickerMessage || null;
+          var hasMedia = !!mediaMessage;
+
+          // For media messages, caption may be the text
+          if (!text && mediaMessage) {
+            text = mediaMessage.caption || '';
+          }
+
+          // Skip if no text AND no media
+          if (!text && !hasMedia) continue;
 
           var senderJid = isGroup ? msg.key.participant : remoteJid;
-          console.log(`[wa:${config.agentId.slice(0,8)}] Incoming from=${senderJid} group=${isGroup} selfChat=${!!isSelfChat} text="${text.slice(0,50)}"`);
+          console.log(`[wa:${config.agentId.slice(0,8)}] Incoming from=${senderJid} group=${isGroup} selfChat=${!!isSelfChat} hasMedia=${hasMedia} text="${(text||'').slice(0,50)}"`);
 
           // Show typing indicator while agent processes
           try { await sock.sendPresenceUpdate('composing', remoteJid); } catch {}
 
+          // Download media if present
+          var mediaPath: string | undefined;
+          var mediaType: string | undefined;
+          if (hasMedia && mediaMessage) {
+            try {
+              var { downloadMediaMessage } = await import('@whiskeysockets/baileys');
+              var buffer = await downloadMediaMessage(msg, 'buffer', {});
+              if (buffer && buffer.length > 0) {
+                var { join } = await import('path');
+                var { mkdirSync, writeFileSync } = await import('fs');
+                var mediaDir = join(config.dataDir || `/tmp/agents/${config.agentId}`, 'media');
+                try { mkdirSync(mediaDir, { recursive: true }); } catch {}
+
+                mediaType = msg.message?.imageMessage ? 'photo'
+                  : msg.message?.videoMessage ? 'video'
+                  : msg.message?.audioMessage ? 'audio'
+                  : msg.message?.documentMessage ? 'document'
+                  : msg.message?.stickerMessage ? 'sticker' : 'file';
+
+                var ext = mediaType === 'photo' ? 'jpg' : mediaType === 'video' ? 'mp4'
+                  : mediaType === 'audio' ? 'ogg' : mediaType === 'sticker' ? 'webp'
+                  : (mediaMessage.fileName?.split('.').pop() || 'bin');
+                var localName = mediaMessage.fileName || `${mediaType}-${Date.now()}.${ext}`;
+                mediaPath = join(mediaDir, localName);
+                writeFileSync(mediaPath, buffer);
+                console.log(`[wa:${config.agentId.slice(0,8)}] Media downloaded: ${mediaPath} (${buffer.length} bytes)`);
+              }
+            } catch (dlErr: any) {
+              console.error(`[wa:${config.agentId.slice(0,8)}] Media download failed: ${dlErr.message}`);
+            }
+          }
+
+          // Build text with media info
+          var finalText = text || '';
+          if (mediaPath) {
+            var desc = `[${mediaType}${mediaMessage?.fileName ? ': ' + mediaMessage.fileName : ''}] saved to: ${mediaPath}`;
+            finalText = text ? `${text}\n\n${desc}` : desc;
+          } else if (hasMedia && !text) {
+            finalText = `[${mediaType || 'media'} received but download failed]`;
+          }
+
           conn.lastMessageAt = Date.now();
           conn.events.emit('message', {
             from: remoteJid,
             senderJid,
             pushName: msg.pushName,
-            text,
+            text: finalText,
             timestamp: msg.messageTimestamp,
-            hasMedia: !!(msg.message?.imageMessage || msg.message?.videoMessage || msg.message?.documentMessage || msg.message?.audioMessage),
+            hasMedia,
+            mediaPath,
+            mediaType,
             messageId: msg.key.id,
             isGroup,
             isSelfChat: !!isSelfChat,

package/src/auth/routes.ts

@@ -73,11 +73,14 @@ export function createAuthRoutes(
     return process.env.NODE_ENV === 'production' || process.env.SECURE_COOKIES === '1';
   };
 
-  async function issueTokens(userId: string, email: string, role: string) {
+  async function issueTokens(userId: string, email: string, role: string, clientOrgId?: string | null) {
     const { SignJWT } = await import('jose');
     const secret = new TextEncoder().encode(jwtSecret);
 
-    const token = await new SignJWT({ sub: userId, email, role })
+    const payload: Record<string, any> = { sub: userId, email, role };
+    if (clientOrgId) payload.clientOrgId = clientOrgId;
+
+    const token = await new SignJWT(payload)
       .setProtectedHeader({ alg: 'HS256' })
       .setIssuedAt()
       .setExpirationTime(TOKEN_TTL)
@@ -93,8 +96,8 @@ export function createAuthRoutes(
   }
 
   /** Set session cookies and return token info */
-  async function setSessionCookies(c: any, userId: string, email: string, role: string, method: string) {
-    const { token, refreshToken } = await issueTokens(userId, email, role);
+  async function setSessionCookies(c: any, userId: string, email: string, role: string, method: string, clientOrgId?: string | null) {
+    const { token, refreshToken } = await issueTokens(userId, email, role, clientOrgId);
     const csrf = generateCsrf();
     const secure = isSecure();
 
@@ -301,7 +304,7 @@ export function createAuthRoutes(
       });
     }
 
-    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'password');
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'password', user.clientOrgId);
 
     return c.json({
       token,
@@ -360,7 +363,7 @@ export function createAuthRoutes(
 
     pending2fa.delete(challengeToken);
 
-    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'password+2fa');
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'password+2fa', user.clientOrgId);
 
     return c.json({
       token,
@@ -614,7 +617,7 @@ export function createAuthRoutes(
     const user = await db.getUser(key.createdBy);
     if (!user) return c.json({ error: 'API key owner not found' }, 401);
 
-    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'api-key');
+    const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'api-key', user.clientOrgId);
 
     return c.json({
       token,
@@ -643,7 +646,7 @@ export function createAuthRoutes(
       const user = await db.getUser(payload.sub as string);
       if (!user) return c.json({ error: 'User not found' }, 401);
 
-      const { token, refreshToken } = await issueTokens(user.id, user.email, user.role);
+      const { token, refreshToken } = await issueTokens(user.id, user.email, user.role, user.clientOrgId);
       const csrf = generateCsrf();
       const secure = isSecure();
 
@@ -694,7 +697,7 @@ export function createAuthRoutes(
       if (!target) return c.json({ error: 'User not found' }, 404);
 
       // Generate a short-lived token (1 hour) for the target user with impersonation flag
-      const impersonateToken = await new SignJWT({ sub: target.id, role: target.role, impersonatedBy: caller.id })
+      const impersonateToken = await new SignJWT({ sub: target.id, role: target.role, impersonatedBy: caller.id, clientOrgId: target.clientOrgId || undefined, orgId: target.clientOrgId || (target as any).org_id || undefined })
         .setProtectedHeader({ alg: 'HS256' })
         .setIssuedAt()
         .setExpirationTime('1h')
@@ -890,7 +893,7 @@ export function createAuthRoutes(
         ip: c.req.header('x-forwarded-for') || c.req.header('x-real-ip'),
       });
 
-      const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'bootstrap');
+      const { token, refreshToken, csrf } = await setSessionCookies(c, user.id, user.email, user.role, 'bootstrap', user.clientOrgId);
 
       // Notify server that setup is complete (flips the dashboard latch)
       opts?.onBootstrap?.();
@@ -1214,7 +1217,7 @@ export function createAuthRoutes(
     }
 
     // Issue session
-    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, 'oidc');
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, 'oidc', result.user.clientOrgId);
 
     // Redirect to dashboard
     return c.redirect('/dashboard');
@@ -1363,7 +1366,7 @@ export function createAuthRoutes(
     }
 
     // Issue session
-    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, 'saml');
+    await setSessionCookies(c, result.user.id, result.user.email, result.user.role, 'saml', result.user.clientOrgId);
 
     // Redirect to dashboard (or RelayState)
     return c.redirect('/dashboard');

package/src/cli-agent.ts

@@ -393,11 +393,8 @@ export async function runAgent(_args: string[]) {
   console.log('   Connecting to database...');
 
   // 1. Connect to shared enterprise DB
-  const { createAdapter } = await import('./db/factory.js');
-  const db = await createAdapter({
-    type: DATABASE_URL.startsWith('postgres') ? 'postgres' : 'sqlite',
-    connectionString: DATABASE_URL,
-  });
+  const { createAdapter, smartDbConfig } = await import('./db/factory.js');
+  const db = await createAdapter(smartDbConfig(DATABASE_URL));
   await db.migrate();
 
   // 2. Initialize engine DB
@@ -902,6 +899,7 @@ export async function runAgent(_args: string[]) {
         isDM: boolean;
         messageText: string;
         isManager?: boolean;
+        mediaFiles?: Array<{ path: string; type: string; mimeType?: string }>;
       }>();
 
       const isMessagingSource = ['whatsapp', 'telegram'].includes(ctx.source);
@@ -1063,6 +1061,23 @@ export async function runAgent(_args: string[]) {
           `- No markdown formatting — plain text only.`,
           `- For simple greetings/questions, reply in ONE tool call. Do not overthink.`,
           '',
+          `DEPENDENCY & TOOL MANAGEMENT:`,
+          `- Before running commands that need specific tools (ffmpeg, imagemagick, etc.), use check_dependency to verify they're installed.`,
+          `- If a tool is missing: use install_dependency to install it automatically (brew on macOS, apt on Linux).`,
+          `- Tell your manager what you're installing and why — don't just silently install things. Example: "I need to install ffmpeg to process your video. Installing now..."`,
+          `- After completing a task that required installing new tools, use cleanup_installed to review what was installed.`,
+          `- For common tools (ffmpeg, imagemagick, jq, etc.) you can install without explicit permission — just inform.`,
+          `- For unusual packages or large installs, ask your manager first.`,
+          `- If installation fails, explain what happened and suggest alternatives.`,
+          `- Use check_environment at the start of complex tasks to understand what's available.`,
+          '',
+          `FILE & MEDIA HANDLING:`,
+          `- When you receive media files (images, videos, documents), they are saved locally and you can access them.`,
+          `- For images: you can see them directly in the message. Describe what you see.`,
+          `- For videos/audio: use ffmpeg (check_dependency first) to analyze, convert, or edit.`,
+          `- For documents: use the appropriate tool to read/process them.`,
+          `- You can send media back using ${ctx.source === 'telegram' ? 'telegram_send_media' : 'whatsapp_send_media'} with a local file path.`,
+          '',
           buildScheduleInfo(agentSchedule, agentTimezone),
           ambientContext ? `\nCONTEXT FROM MEMORY:\n${ambientContext}` : '',
         ].filter(Boolean).join('\n');
@@ -1118,11 +1133,37 @@ export async function runAgent(_args: string[]) {
         });
       } catch (e: any) { /* non-fatal */ }
 
+      // Build multimodal message content if media files are present
+      let chatMessageContent: string = ctx.messageText;
+      let mediaContentBlocks: any[] | undefined;
+      if ((ctx as any).mediaFiles && (ctx as any).mediaFiles.length > 0) {
+        const { readFileSync } = await import('fs');
+        const blocks: any[] = [];
+        if (ctx.messageText) blocks.push({ type: 'text', text: ctx.messageText });
+        for (const media of (ctx as any).mediaFiles) {
+          try {
+            const buf = readFileSync(media.path);
+            const b64 = buf.toString('base64');
+            const mime = media.mimeType || (media.type === 'photo' ? 'image/jpeg' : 'application/octet-stream');
+            if (mime.startsWith('image/')) {
+              blocks.push({ type: 'image', source: { type: 'base64', media_type: mime, data: b64 } });
+              blocks.push({ type: 'text', text: `[Image saved at: ${media.path}]` });
+            } else {
+              blocks.push({ type: 'text', text: `[File received: ${media.path} (${mime}). Use tools to read/process this file.]` });
+            }
+          } catch (fileErr: any) {
+            blocks.push({ type: 'text', text: `[Media file: ${media.path} — could not read: ${fileErr.message}]` });
+          }
+        }
+        if (blocks.length > 0) mediaContentBlocks = blocks;
+      }
+
       const session = await runtime.spawnSession({
         agentId: agentId,
-        message: ctx.messageText,
+        message: chatMessageContent,
         systemPrompt,
         ...(sessionContext ? { sessionContext } : {}),
+        ...(mediaContentBlocks ? { messageContent: mediaContentBlocks } : {}),
       });
 
       // Mark task as in progress

package/src/cli-serve.ts

@@ -121,13 +121,10 @@ export async function runServe(_args: string[]) {
     process.exit(1);
   }
 
-  const { createAdapter } = await import('./db/factory.js');
+  const { createAdapter, smartDbConfig } = await import('./db/factory.js');
   const { createServer } = await import('./server.js');
 
-  const db = await createAdapter({
-    type: DATABASE_URL.startsWith('postgres') ? 'postgres' : 'sqlite',
-    connectionString: DATABASE_URL,
-  });
+  const db = await createAdapter(smartDbConfig(DATABASE_URL));
 
   await db.migrate();