@promptowl/contextnest-community 1.22.0 → 1.23.0

package/dist/index.js

@@ -18,6 +18,7 @@ import {
   getPendingReview,
   getReviewHistory,
   getReviewQueue,
+  hasAnyConnector,
   isNestTarget,
   isSafeConnectorUrl,
   listDeletionRequests,
@@ -37,7 +38,7 @@ import {
   submitForReview,
   withNodeWriteLock,
   withdrawDeletionRequest
-} from "./chunk-OQXZ43HG.js";
+} from "./chunk-MLQU4I5J.js";
 import {
   canCreateInNest,
   canManageStewards,
@@ -57,7 +58,7 @@ import {
   resolveUserRoles,
   syncFromConfig,
   updateSteward
-} from "./chunk-PX3P4FTU.js";
+} from "./chunk-2YPY2HGZ.js";
 import {
   createGrant,
   deleteGrant,
@@ -66,7 +67,7 @@ import {
   listGrants,
   listUserGrants,
   resolveNodeGrant
-} from "./chunk-MY4JIWQD.js";
+} from "./chunk-UOMW7TT6.js";
 import {
   generateApiKey,
   getKeyPrefix,
@@ -92,7 +93,7 @@ import {
   listMyDrafts,
   setApprovedVersion,
   upsertVersion
-} from "./chunk-6WESEA75.js";
+} from "./chunk-5CVZMHHB.js";
 import {
   approveExternalEdit,
   getExternalEditDetail,
@@ -104,12 +105,13 @@ import {
   scanDocumentForDrift,
   scanNestForDrift,
   startDriftScanner
-} from "./chunk-ZAV4QUZA.js";
+} from "./chunk-XYD6V2LH.js";
 import {
   addMember,
   addWatcher,
   archiveNest,
   assertSafeNodeId,
+  buildDocContext,
   buildTitleMap,
   canApproveWith,
   canEditWith,
@@ -119,7 +121,6 @@ import {
   createTeam,
   deleteNest,
   deleteTeam,
-  describeNode,
   disableStewardshipAndWipeGovernance,
   docLink,
   engineApi,
@@ -169,6 +170,7 @@ import {
   normalizeTag,
   notifyNestInvite,
   nowExpr,
+  nowMsExpr,
   opContext,
   parseSharedTeams,
   permissionLevel,
@@ -200,6 +202,7 @@ import {
   shareTeamWithNest,
   startLicenseSafetyPoll,
   startTelemetryLoop,
+  suffixOf,
   syncNodeTags,
   trackEvent,
   uniqueNestName,
@@ -208,7 +211,7 @@ import {
   updateMemberRole,
   validateLicense,
   verifySmtp
-} from "./chunk-W5ILNGPD.js";
+} from "./chunk-QLXC6542.js";
 import {
   AppError,
   ConflictError,
@@ -226,7 +229,7 @@ import {
   initDb,
   isEmailListish,
   isEmailish
-} from "./chunk-J2OQ3MEB.js";
+} from "./chunk-QWNXWRWO.js";
 import {
   ANON_EMAIL,
   ANON_USER_ID,
@@ -240,7 +243,7 @@ import {
 import { serve } from "@hono/node-server";
 
 // src/app.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono25 } from "hono";
 import { LinearRouter } from "hono/router/linear-router";
 import { createMiddleware as createMiddleware2 } from "hono/factory";
 import { cors } from "hono/cors";
@@ -270,7 +273,7 @@ function applyArtifactSandboxHeaders(c) {
 
 // src/auth/routes.ts
 import { Hono as Hono2 } from "hono";
-import { v4 as uuid3 } from "uuid";
+import { v4 as uuid4 } from "uuid";
 
 // src/auth/middleware.ts
 import { createMiddleware } from "hono/factory";
@@ -565,10 +568,89 @@ function verifySsoTicket(token, secret, nowSec = Math.floor(Date.now() / 1e3)) {
   return claims;
 }
 
+// src/auth/community-sites.ts
+import { v4 as uuid } from "uuid";
+function rowToSite(row) {
+  return { ...row, is_active: !!row.is_active };
+}
+var SELECT_COLUMNS = "id, name, url, secret, is_active, created_at, updated_at";
+var activeSitesCache = [];
+async function loadActiveCommunitySites() {
+  const rows = await getDb().all(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites WHERE is_active = 1 ORDER BY name`
+  );
+  activeSitesCache = rows.map(rowToSite);
+}
+function getActiveCommunitySites() {
+  return activeSitesCache;
+}
+async function listCommunitySites() {
+  const rows = await getDb().all(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites ORDER BY name`
+  );
+  return rows.map(rowToSite);
+}
+async function getCommunitySite(id) {
+  const row = await getDb().get(
+    `SELECT ${SELECT_COLUMNS} FROM community_sites WHERE id = ?`,
+    [id]
+  );
+  return row ? rowToSite(row) : null;
+}
+async function createCommunitySite(input) {
+  const id = uuid();
+  await getDb().run(
+    `INSERT INTO community_sites (id, name, url, secret, is_active) VALUES (?, ?, ?, ?, ?)`,
+    [id, input.name, input.url, input.secret, input.is_active ? 1 : 0]
+  );
+  const site = await getCommunitySite(id);
+  if (!site) throw new Error("Failed to create community site");
+  return site;
+}
+async function updateCommunitySite(id, patch) {
+  const existing = await getCommunitySite(id);
+  if (!existing) return null;
+  const next = {
+    name: patch.name ?? existing.name,
+    url: patch.url ?? existing.url,
+    secret: patch.secret ?? existing.secret,
+    is_active: patch.is_active ?? existing.is_active
+  };
+  const db = getDb();
+  await db.run(
+    `UPDATE community_sites
+        SET name = ?, url = ?, secret = ?, is_active = ?, updated_at = ${nowExpr(db)}
+      WHERE id = ?`,
+    [next.name, next.url, next.secret, next.is_active ? 1 : 0, id]
+  );
+  return getCommunitySite(id);
+}
+async function deleteCommunitySite(id) {
+  const result = await getDb().run("DELETE FROM community_sites WHERE id = ?", [
+    id
+  ]);
+  return result.changes > 0;
+}
+function legacyCandidate() {
+  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
+  if (!secret) return null;
+  return { id: "legacy", label: "legacy", secret, url: config.PUBLIC_BASE_URL };
+}
+function ssoCandidates() {
+  const fromDb = getActiveCommunitySites().map((s) => ({
+    id: s.id,
+    label: s.name,
+    secret: s.secret,
+    url: s.url.replace(/\/$/, "")
+  }));
+  const legacy = legacyCandidate();
+  return legacy ? [...fromDb, legacy] : fromDb;
+}
+
 // src/auth/oidc.ts
 import { Hono } from "hono";
 import { createHash, randomBytes as randomBytes2 } from "crypto";
-import { v4 as uuid } from "uuid";
+import { v4 as uuid2 } from "uuid";
 import { createRemoteJWKSet, jwtVerify } from "jose";
 
 // src/shared/base-url.ts
@@ -824,8 +906,8 @@ oidcRoutes.get("/callback", async (c) => {
     );
     if (!user) {
       if (!config.OIDC_AUTO_PROVISION) return bounce("not_invited");
-      const userId = uuid();
-      const placeholderHash = await hashPassword(uuid());
+      const userId = uuid2();
+      const placeholderHash = await hashPassword(uuid2());
       try {
         await db.run(
           "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -897,7 +979,7 @@ oidcRoutes.get("/logout", async (c) => {
 });
 
 // src/auth/token-exchange.ts
-import { v4 as uuid2 } from "uuid";
+import { v4 as uuid3 } from "uuid";
 import { jwtVerify as jwtVerify2 } from "jose";
 var TX_LIMIT = { max: 60, windowMs: 15 * 6e4 };
 var ExchangeError = class extends Error {
@@ -984,8 +1066,8 @@ async function resolveUser(email, name, department) {
   if (!config.OIDC_AUTO_PROVISION || config.OIDC_ALLOWED_DOMAINS.length === 0) {
     throw new ExchangeError("no_account", 403);
   }
-  const userId = uuid2();
-  const placeholderHash = await hashPassword(uuid2());
+  const userId = uuid3();
+  const placeholderHash = await hashPassword(uuid3());
   try {
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -1161,8 +1243,8 @@ async function provisionPromptowlUser(c, rawEmail, rawName) {
     [meEmail]
   );
   if (!user) {
-    const userId = uuid3();
-    const placeholderHash = await hashPassword(uuid3());
+    const userId = uuid4();
+    const placeholderHash = await hashPassword(uuid4());
     await db.run(
       "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
       [userId, meEmail, rawName || null, placeholderHash]
@@ -1235,7 +1317,7 @@ authRoutes.post("/register", async (c) => {
     }
     throw new ValidationError("Email already registered");
   }
-  const userId = uuid3();
+  const userId = uuid4();
   const passwordHash = await hashPassword(body.password);
   await db.run(
     "INSERT INTO users (id, email, name, password_hash) VALUES (?, ?, ?, ?)",
@@ -1337,7 +1419,7 @@ authRoutes.post("/keys", authMiddleware, async (c) => {
   });
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const apiKey = generateApiKey();
-  const keyId = uuid3();
+  const keyId = uuid4();
   await db.run(
     "INSERT INTO api_keys (id, user_id, key_hash, key_prefix, nest_id, label) VALUES (?, ?, ?, ?, ?, ?)",
     [
@@ -1366,7 +1448,7 @@ authRoutes.post("/keys/rotate", authMiddleware, async (c) => {
   if (!check.ok) return c.json({ error: check.error }, check.status);
   const prior = check.key;
   const apiKey = generateApiKey();
-  const keyId = uuid3();
+  const keyId = uuid4();
   const nestScope = "nest_id" in body ? body.nest_id || null : prior.nest_id;
   const replaced = await db.transaction(async (tx) => {
     const removed = await tx.run(
@@ -1520,25 +1602,30 @@ authRoutes.post("/promptowl", async (c) => {
 });
 authRoutes.get("/sso", async (c) => {
   const ssoError = (code) => c.redirect(`/?sso_error=${code}`, 302);
-  const secret = config.OFFICIAL_COMMUNITY_SSO_SECRET;
-  if (!secret) return ssoError("not_supported");
+  const candidates = ssoCandidates();
+  if (candidates.length === 0) return ssoError("not_supported");
   if (!tryConsume(`sso:ip:${clientIp(c)}`, DEVICE_LIMIT)) {
     return ssoError("rate_limited");
   }
   const ticket = c.req.query("ticket");
   if (!ticket) return ssoError("missing_ticket");
   let claims;
-  try {
-    claims = verifySsoTicket(ticket, secret);
-  } catch {
-    return ssoError("invalid_ticket");
+  let matched;
+  for (const candidate of candidates) {
+    try {
+      claims = verifySsoTicket(ticket, candidate.secret);
+      matched = candidate;
+      break;
+    } catch {
+    }
   }
+  if (!claims || !matched) return ssoError("invalid_ticket");
   if ((claims.scope || "") === "mcp") return ssoError("invalid_ticket");
   const expectedAud = config.PUBLIC_BASE_URL;
   if (!expectedAud && !warnedMissingSsoAudience) {
     warnedMissingSsoAudience = true;
     console.warn(
-      "[sso] OFFICIAL_COMMUNITY_SSO_SECRET is set but PUBLIC_BASE_URL is empty \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL so a ticket minted for another server cannot be replayed against this one."
+      `[sso] site "${matched.label}" has a secret but PUBLIC_BASE_URL is unset \u2014 ticket audience binding is DISABLED. Set PUBLIC_BASE_URL to this deployment's own URL so a ticket minted for another deployment cannot be replayed against this one.`
     );
   }
   if (expectedAud) {
@@ -1674,7 +1761,7 @@ authRoutes.post("/admin/reset-password/:userId", async (c) => {
   if (supplied !== void 0) {
     assertValidPassword(supplied);
   }
-  const generated = supplied ? null : uuid3().replace(/-/g, "").slice(0, 16);
+  const generated = supplied ? null : uuid4().replace(/-/g, "").slice(0, 16);
   const newPassword = supplied ?? generated;
   const newHash = await hashPassword(newPassword);
   await db.transaction(async (tx) => {
@@ -1789,7 +1876,7 @@ authRoutes.post("/invite", async (c) => {
       409
     );
   }
-  const tempPassword = uuid3().replace(/-/g, "").slice(0, 16);
+  const tempPassword = uuid4().replace(/-/g, "").slice(0, 16);
   const passwordHash = await hashPassword(tempPassword);
   let userId;
   if (existing) {
@@ -1799,7 +1886,7 @@ authRoutes.post("/invite", async (c) => {
       userId
     ]);
   } else {
-    userId = uuid3();
+    userId = uuid4();
     await db.run(
       "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
       [userId, email, null, passwordHash]
@@ -1939,7 +2026,43 @@ function documentPrimeFlag(metadata) {
 }
 
 // src/governance/mention-notify.ts
-import { v4 as uuid4 } from "uuid";
+import { v4 as uuid5 } from "uuid";
+
+// src/shared/mentions.ts
+var MENTION = /(?:^|\s)@(?:\(([^)]+)\)|([a-zA-Z0-9._@-]+))/g;
+function stripCode(markdown2) {
+  return markdown2.replace(/```[\s\S]*?```/g, " ").replace(/`[^`\n]*`/g, " ");
+}
+function extractMentions(markdown2) {
+  const names = [];
+  const seen = /* @__PURE__ */ new Set();
+  const text = stripCode(markdown2 || "");
+  let match;
+  MENTION.lastIndex = 0;
+  while ((match = MENTION.exec(text)) !== null) {
+    const name = (match[1] || match[2] || "").trim();
+    const key = name.toLowerCase();
+    if (!name || seen.has(key)) continue;
+    seen.add(key);
+    names.push(name);
+  }
+  return names;
+}
+function newMentions(previous, next) {
+  const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
+  return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
+}
+var MAX_MENTION_RECIPIENTS = 25;
+function resolveMention(people, name) {
+  const n = name.trim().toLowerCase();
+  if (!n) return void 0;
+  const exact = people.find((p) => p.email.toLowerCase() === n);
+  if (exact) return exact;
+  const matches = people.filter(
+    (p) => p.email.toLowerCase().split("@")[0] === n || (p.name || "").toLowerCase() === n
+  );
+  return matches.length === 1 ? matches[0] : void 0;
+}
 
 // src/nests/people-service.ts
 var PERSON_SOURCES = [
@@ -2003,40 +2126,129 @@ async function listNestPeople(nestId) {
   }
   return people;
 }
-
-// src/shared/mentions.ts
-var MENTION = /(?:^|\s)@(?:\(([^)]+)\)|([a-zA-Z0-9._@-]+))/g;
-function stripCode(markdown2) {
-  return markdown2.replace(/```[\s\S]*?```/g, " ").replace(/`[^`\n]*`/g, " ");
-}
-function extractMentions(markdown2) {
-  const names = [];
-  const seen = /* @__PURE__ */ new Set();
-  const text = stripCode(markdown2 || "");
-  let match;
-  MENTION.lastIndex = 0;
-  while ((match = MENTION.exec(text)) !== null) {
-    const name = (match[1] || match[2] || "").trim();
-    const key = name.toLowerCase();
-    if (!name || seen.has(key)) continue;
-    seen.add(key);
-    names.push(name);
+async function withDirectory(roster) {
+  if (!config.PEOPLE_SUGGEST_ALL_USERS) return roster;
+  const seen = new Set(roster.map((p) => p.email.toLowerCase()));
+  const rows = await getDb().all(
+    "SELECT id, email, name FROM users WHERE id != ? ORDER BY email LIMIT ?",
+    [ANON_USER_ID, SUGGEST_FETCH]
+  );
+  const extra = [];
+  for (const r of rows) {
+    const email = (r.email || "").trim();
+    if (!email || seen.has(email.toLowerCase())) continue;
+    extra.push({ email, name: r.name ?? null, userId: r.id, source: "directory" });
   }
-  return names;
+  return [...roster, ...extra];
 }
-function newMentions(previous, next) {
-  const before = new Set(extractMentions(previous).map((n) => n.toLowerCase()));
-  return extractMentions(next).filter((n) => !before.has(n.toLowerCase()));
-}
-function resolveMention(people, name) {
+async function findDirectoryPerson(name) {
+  if (!config.PEOPLE_SUGGEST_ALL_USERS) return void 0;
   const n = name.trim().toLowerCase();
   if (!n) return void 0;
-  const exact = people.find((p) => p.email.toLowerCase() === n);
-  if (exact) return exact;
-  const matches = people.filter(
-    (p) => p.email.toLowerCase().split("@")[0] === n || (p.name || "").toLowerCase() === n
-  );
-  return matches.length === 1 ? matches[0] : void 0;
+  const rows = await getDb().all(
+    `SELECT id, email, name FROM users
+      WHERE id != ?
+        AND (LOWER(email) = ? OR LOWER(email) LIKE ? ESCAPE '\\' OR LOWER(COALESCE(name, '')) = ?)`,
+    [ANON_USER_ID, n, `${escapeLike(n)}@%`, n]
+  );
+  return resolveMention(
+    rows.map((r) => ({ email: r.email, name: r.name ?? null, userId: r.id, source: "directory" })),
+    name
+  );
+}
+var SUGGEST_LIMIT = 20;
+var SUGGEST_FETCH = 200;
+function matchesQuery(person, q) {
+  if (!q) return true;
+  return person.email.toLowerCase().includes(q) || (person.name || "").toLowerCase().includes(q);
+}
+var escapeLike = (s) => s.replace(/([\\%_])/g, "\\$1");
+function queryFilter(q) {
+  if (!q) return { sql: "", args: [] };
+  const pattern = `%${escapeLike(q)}%`;
+  return {
+    sql: " AND (LOWER(u.email) LIKE ? ESCAPE '\\' OR LOWER(COALESCE(u.name, '')) LIKE ? ESCAPE '\\')",
+    args: [pattern, pattern]
+  };
+}
+async function suggestPeopleForUser(callerUserId, query = "", limit = SUGGEST_LIMIT) {
+  const db = getDb();
+  const q = query.trim().toLowerCase();
+  const cap = Math.min(Math.max(limit, 1), SUGGEST_LIMIT);
+  const caller = await db.get("SELECT email FROM users WHERE id = ?", [
+    callerUserId
+  ]);
+  const callerEmail = (caller?.email || "").toLowerCase();
+  const filter = queryFilter(q);
+  const wholeDirectory = config.PEOPLE_SUGGEST_ALL_USERS || await isServerAdminUserId(callerUserId);
+  const rows = await (async () => {
+    if (wholeDirectory) {
+      return await db.all(
+        `SELECT u.id AS user_id, u.email AS email, u.name AS name, 'directory' AS source
+           FROM users u
+          WHERE u.id != ? AND u.id != ?${filter.sql}
+          ORDER BY u.email
+          LIMIT ?`,
+        [callerUserId, ANON_USER_ID, ...filter.args, SUGGEST_FETCH]
+      );
+    }
+    const args = [callerUserId, ANON_USER_ID];
+    const myNests = () => {
+      args.push(callerUserId, callerUserId);
+      return `SELECT id FROM nests WHERE user_id = ?
+              UNION SELECT nest_id FROM nest_collaborators WHERE user_id = ?`;
+    };
+    const ownedNests = myNests();
+    const collabNests = myNests();
+    const stewardNests = myNests();
+    const sql = `SELECT u.id AS user_id, u.email AS email, u.name AS name, 'nest' AS source
+         FROM users u
+        WHERE u.id != ? AND u.id != ?
+          AND (u.id IN (SELECT user_id FROM nests WHERE id IN (${ownedNests}))
+               OR u.id IN (SELECT user_id FROM nest_collaborators
+                            WHERE nest_id IN (${collabNests}))
+               OR LOWER(u.email) IN (SELECT LOWER(user_email) FROM stewards
+                                      WHERE is_active = 1
+                                        AND nest_id IN (${stewardNests})))${filter.sql}
+        ORDER BY u.email
+        LIMIT ?`;
+    args.push(...filter.args, SUGGEST_FETCH);
+    return await db.all(sql, args);
+  })();
+  const byEmail = /* @__PURE__ */ new Map();
+  const add = (email, name, source) => {
+    const addr = (email || "").trim();
+    const key = addr.toLowerCase();
+    if (!addr || !key || key === callerEmail || byEmail.has(key)) return;
+    const person = { email: addr, name: name ?? null, source };
+    if (!matchesQuery(person, q)) return;
+    byEmail.set(key, person);
+  };
+  for (const r of rows) add(r.email, r.name, r.source);
+  const teamEmails = /* @__PURE__ */ new Set();
+  for (const team of wholeDirectory ? [] : await listTeamsForUser(callerUserId)) {
+    for (const member of team.members ?? []) {
+      const key = (member.email || "").trim().toLowerCase();
+      if (key && key !== callerEmail && !byEmail.has(key)) teamEmails.add(key);
+    }
+  }
+  if (teamEmails.size > 0) {
+    const list = [...teamEmails].slice(0, SUGGEST_FETCH);
+    const named = await db.all(
+      `SELECT email, name FROM users
+        WHERE LOWER(email) IN (${list.map(() => "?").join(",")})`,
+      list
+    );
+    const nameOf = new Map(
+      named.map((u) => [u.email.toLowerCase(), u.name ?? null])
+    );
+    for (const email of list) add(email, nameOf.get(email) ?? null, "team");
+  }
+  return [...byEmail.values()].sort(
+    (a, b) => (a.name || a.email).localeCompare(b.name || b.email, void 0, {
+      sensitivity: "base"
+    })
+  ).slice(0, cap);
 }
 
 // src/governance/mention-notify.ts
@@ -2047,48 +2259,172 @@ async function canOpenNode(nestId, nodeId, userId, email) {
   }
   return canReadNode(nestId, nodeId, userId, email);
 }
+async function resolveRecipients(params) {
+  const { nestId, nodeId, names, actorEmail } = params;
+  if (names.length === 0) return [];
+  const roster = await listNestPeople(nestId);
+  const actor = actorEmail.toLowerCase();
+  const candidates = /* @__PURE__ */ new Map();
+  const outsiders = [];
+  for (const name of names) {
+    const member = resolveMention(roster, name);
+    const person = member ?? await findDirectoryPerson(name);
+    if (!person?.userId) continue;
+    const key = person.email.toLowerCase();
+    if (key === actor || candidates.has(key)) continue;
+    const r = { email: person.email, userId: person.userId };
+    candidates.set(key, r);
+    if (!member) outsiders.push(r);
+    if (candidates.size >= MAX_MENTION_RECIPIENTS) break;
+  }
+  if (outsiders.length) await inviteMentioned(nestId, actorEmail, outsiders);
+  const checked = await Promise.all(
+    [...candidates.values()].map(async (r) => ({
+      r,
+      allowed: await canOpenNode(nestId, nodeId, r.userId, r.email)
+    }))
+  );
+  return checked.filter((c) => c.allowed).map((c) => c.r);
+}
+async function inviteMentioned(nestId, actorEmail, outsiders) {
+  const db = getDb();
+  const actor = await db.get("SELECT id FROM users WHERE LOWER(email) = LOWER(?)", [
+    actorEmail
+  ]);
+  if (!actor) return;
+  const access = await resolveNestAccess(nestId, actor.id);
+  if (permissionLevel(access.permission) < permissionLevel("write")) return;
+  for (const r of outsiders) {
+    await db.run(
+      `INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by)
+       SELECT ?, ?, ?, 'read', ?
+        WHERE NOT EXISTS (SELECT 1 FROM nest_collaborators WHERE nest_id = ? AND user_id = ?)`,
+      [uuid5(), nestId, r.userId, actor.id, nestId, r.userId]
+    );
+  }
+}
+async function insertInboxRows(params) {
+  const db = getDb();
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  let created = 0;
+  for (const r of params.recipients) {
+    await db.run(
+      `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
+       VALUES (?, ?, ?, 'mention', ?, ?, ?)`,
+      [uuid5(), params.nestId, r.email.toLowerCase(), params.nodeId, params.message, now]
+    );
+    created++;
+  }
+  return created;
+}
+async function deliverMentionMessages(params) {
+  const { nestId, nodeId, recipients, channelMessage, actorEmail, excerpt: excerpt2, ctx } = params;
+  let throttled = 0;
+  const channelReachable = await hasAnyConnector(nestId, "mention");
+  if (channelReachable && canDeliver("channel", nestId, actorEmail)) {
+    void dispatchEvent({
+      kind: "mention",
+      nestId,
+      subjectId: nodeId,
+      actor: actorEmail,
+      message: channelMessage
+    });
+  } else if (channelReachable) {
+    throttled++;
+  }
+  for (const r of isEmailConfigured() ? recipients : []) {
+    if (!canDeliver("email", nestId, actorEmail)) {
+      throttled++;
+      continue;
+    }
+    void sendEmailToRecipient(r.email, {
+      status: "mention",
+      docTitle: ctx.docTitle,
+      path: ctx.path,
+      link: ctx.link,
+      actor: actorEmail,
+      note: excerpt2 || null
+    });
+  }
+  if (throttled > 0) {
+    console.warn(
+      `[notify] mention delivery budget exhausted for ${actorEmail} in ${nestId} \u2014 ${throttled} outbound message(s) skipped; inbox rows unaffected`
+    );
+  }
+}
+var MENTION_DELIVERY_BUDGET = { max: 50, windowMs: 5 * 6e4 };
+var MENTION_CHANNEL_BUDGET = { max: 25, windowMs: 5 * 6e4 };
+function canDeliver(kind, nestId, actorEmail) {
+  return tryConsume(
+    `mention-${kind}:${nestId}:${actorEmail.toLowerCase()}`,
+    kind === "email" ? MENTION_DELIVERY_BUDGET : MENTION_CHANNEL_BUDGET
+  );
+}
+function channelSentence(actorEmail, recipients, where) {
+  const names = recipients.map((r) => r.email).join(", ");
+  return `${actorEmail} mentioned ${names} ${where}`;
+}
+function excerptOf(body, max = 140) {
+  const s = (body || "").replace(/\s+/g, " ").trim();
+  return s.length > max ? s.slice(0, max - 1) + "\u2026" : s;
+}
 async function notifyMentions(params) {
-  const { nestId, nodeId, previousBody, nextBody, actorEmail } = params;
+  const { nestId, nodeId, previousBody, nextBody, actorEmail, baseUrl } = params;
   try {
     const names = newMentions(previousBody, nextBody);
-    if (names.length === 0) return 0;
-    const people = await listNestPeople(nestId);
-    const actor = actorEmail.toLowerCase();
-    const recipients = /* @__PURE__ */ new Map();
-    for (const name of names) {
-      const person = resolveMention(people, name);
-      if (!person?.userId) continue;
-      const key = person.email.toLowerCase();
-      if (key === actor || recipients.has(key)) continue;
-      recipients.set(key, { email: person.email, userId: person.userId });
-    }
-    if (recipients.size === 0) return 0;
-    const label = await describeNode(nestId, nodeId);
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const db = getDb();
-    let created = 0;
-    for (const { email, userId } of recipients.values()) {
-      if (!await canOpenNode(nestId, nodeId, userId, email)) continue;
-      await db.run(
-        `INSERT INTO notifications (id, nest_id, user_email, kind, subject_id, message, created_at)
-         VALUES (?, ?, ?, 'mention', ?, ?, ?)`,
-        [
-          uuid4(),
-          nestId,
-          email.toLowerCase(),
-          nodeId,
-          `${actorEmail} mentioned you in "${label}"`,
-          now
-        ]
-      );
-      created++;
-    }
+    const recipients = await resolveRecipients({ nestId, nodeId, names, actorEmail });
+    if (recipients.length === 0) return 0;
+    const ctx = await buildDocContext(nestId, nodeId, baseUrl);
+    const message = `${actorEmail} mentioned you in "${ctx.label}"`;
+    const created = await insertInboxRows({ nestId, nodeId, recipients, message });
+    await deliverMentionMessages({
+      nestId,
+      nodeId,
+      recipients,
+      channelMessage: channelSentence(
+        actorEmail,
+        recipients,
+        `in *${ctx.label}*`
+      ),
+      actorEmail,
+      excerpt: "",
+      ctx
+    });
     return created;
   } catch (err) {
     console.error("[notify] mention fan-out failed", nestId, nodeId, err);
     return 0;
   }
 }
+async function notifyCommentMentions(params) {
+  const { nestId, nodeId, body, actorEmail, baseUrl } = params;
+  try {
+    const names = extractMentions(body || "");
+    const recipients = await resolveRecipients({ nestId, nodeId, names, actorEmail });
+    if (recipients.length === 0) return 0;
+    const ctx = await buildDocContext(nestId, nodeId, baseUrl);
+    const excerpt2 = excerptOf(body);
+    const message = `${actorEmail} mentioned you in a comment on "${ctx.label}"`;
+    const created = await insertInboxRows({ nestId, nodeId, recipients, message });
+    await deliverMentionMessages({
+      nestId,
+      nodeId,
+      recipients,
+      channelMessage: channelSentence(
+        actorEmail,
+        recipients,
+        `in a comment on *${ctx.label}*`
+      ),
+      actorEmail,
+      excerpt: excerpt2,
+      ctx
+    });
+    return created;
+  } catch (err) {
+    console.error("[notify] comment mention fan-out failed", nestId, nodeId, err);
+    return 0;
+  }
+}
 
 // src/nodes/service.ts
 async function userIdFromEmail(email) {
@@ -2312,8 +2648,9 @@ function engineScopesFolders() {
   }
   return folderScopeSupported;
 }
+var DERIVED_ANNOTATIONS_SUFFIX = "--annotations";
 function isDerivedAnnotationsNode(id) {
-  return id.endsWith("--annotations");
+  return id.endsWith(DERIVED_ANNOTATIONS_SUFFIX);
 }
 async function getNodeForCaller(nestId, selector, userId, userEmail, opts = {}) {
   if (selector.id && !await canReadNode(nestId, selector.id, userId, userEmail)) {
@@ -2647,11 +2984,11 @@ async function autoPublishReason(nestId, userEmail, doc) {
   }
   return await actorAutoPublishes(nestId, userEmail) ? "owner/admin self-approve" : null;
 }
-async function createNode(nestId, input, userEmail) {
+async function createNode(nestId, input, userEmail, opts = {}) {
   const generatedId = !input.id && !slugify(input.title);
   for (let attempt = 0; ; attempt++) {
     try {
-      return await createNodeOnce(nestId, input, userEmail);
+      return await createNodeOnce(nestId, input, userEmail, opts);
     } catch (err) {
       if (!generatedId || attempt >= 3 || !(err instanceof ConflictError)) {
         throw err;
@@ -2659,7 +2996,7 @@ async function createNode(nestId, input, userEmail) {
     }
   }
 }
-async function createNodeOnce(nestId, input, userEmail) {
+async function createNodeOnce(nestId, input, userEmail, opts = {}) {
   const { storage } = await engineCache.get(nestId);
   assertTitleLength(input.title);
   assertTitleReadable(input.title);
@@ -2792,13 +3129,15 @@ async function createNodeOnce(nestId, input, userEmail) {
       });
     }
     await trackEvent("node.create", { nestId, nodeId: id });
-    await notifyMentions({
-      nestId,
-      nodeId: id,
-      previousBody: "",
-      nextBody: node.body || "",
-      actorEmail: userEmail
-    });
+    if (opts.notifyMentions !== false) {
+      await notifyMentions({
+        nestId,
+        nodeId: id,
+        previousBody: "",
+        nextBody: node.body || "",
+        actorEmail: userEmail
+      });
+    }
     return { node, version: savedVersion };
   });
 }
@@ -2892,7 +3231,7 @@ async function registerImportedDocuments(nestId, userEmail) {
   await trackEvent("nest.import.documents", { nestId, registered: docs.length });
   return docs.length;
 }
-async function updateNode(nestId, nodeId, patch, userEmail) {
+async function updateNode(nestId, nodeId, patch, userEmail, opts = {}) {
   return withNodeWriteLock(nodeWriteKey(nestId, nodeId), async () => {
     try {
       const { storage, versions: versionManager } = await engineCache.get(
@@ -3044,13 +3383,15 @@ async function updateNode(nestId, nodeId, patch, userEmail) {
         );
         responseVersion = publishedVersion;
       }
-      await notifyMentions({
-        nestId,
-        nodeId,
-        previousBody,
-        nextBody: node.body || "",
-        actorEmail: userEmail
-      });
+      if (opts.notifyMentions !== false) {
+        await notifyMentions({
+          nestId,
+          nodeId,
+          previousBody,
+          nextBody: node.body || "",
+          actorEmail: userEmail
+        });
+      }
       return { node, version: responseVersion };
     } catch (err) {
       throw toSafeError(
@@ -3632,8 +3973,13 @@ nestRoutes.get("/", async (c) => {
   }
   const out = await Promise.all(deduped.map(annotate));
   const docRows = await db.all(
-    `SELECT nest_id, COUNT(DISTINCT node_id) AS c, MAX(created_at) AS last_activity
-       FROM node_versions GROUP BY nest_id`
+    `SELECT nest_id,
+            COUNT(DISTINCT CASE
+              WHEN ${suffixOf(db, "node_id", DERIVED_ANNOTATIONS_SUFFIX.length)} <> ?
+              THEN node_id END) AS c,
+            MAX(created_at) AS last_activity
+       FROM node_versions GROUP BY nest_id`,
+    [DERIVED_ANNOTATIONS_SUFFIX]
   );
   const docByNest = new Map(docRows.map((r) => [r.nest_id, Number(r.c)]));
   const activityByNest = new Map(docRows.map((r) => [r.nest_id, r.last_activity]));
@@ -3675,6 +4021,7 @@ nestRoutes.get("/", async (c) => {
     );
     for (const r of rows) {
       const targets = grantTargetsByNest.get(r.nest_id) ?? [];
+      if (isDerivedAnnotationsNode(r.node_id)) continue;
       if (grantCoversNode(targets, r.node_id)) {
         grantedDocsByNest.set(r.nest_id, (grantedDocsByNest.get(r.nest_id) ?? 0) + 1);
       }
@@ -3960,7 +4307,7 @@ nestRoutes.patch("/:nestId/settings", async (c) => {
 import { Hono as Hono4 } from "hono";
 
 // src/nests/sharing-service.ts
-import { v4 as uuid5 } from "uuid";
+import { v4 as uuid6 } from "uuid";
 var VALID_PERMISSIONS = ["read", "write", "admin"];
 async function addCollaborator(params) {
   const { nestId } = params;
@@ -3987,10 +4334,10 @@ async function addCollaborator(params) {
       userId = existing.id;
     } else {
       const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-      userId = uuid5();
+      userId = uuid6();
       await db.run(
         "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-        [userId, email, null, await hashPassword2(uuid5())]
+        [userId, email, null, await hashPassword2(uuid6())]
       );
     }
   }
@@ -4028,7 +4375,7 @@ async function addCollaborator(params) {
     [params.grantedByEmail]
   ))?.id : void 0;
   const granterId = params.grantedByUserId || granterByEmail || ownerRow.user_id;
-  const collabId = uuid5();
+  const collabId = uuid6();
   await db.run(
     "INSERT INTO nest_collaborators (id, nest_id, user_id, permission, granted_by) VALUES (?, ?, ?, ?, ?)",
     [collabId, nestId, userId, params.permission, granterId]
@@ -4101,7 +4448,7 @@ sharingRoutes.get("/collaborators", async (c) => {
   }
   return c.json({
     collaborators: enriched,
-    people: await listNestPeople(nestId)
+    people: await withDirectory(await listNestPeople(nestId))
   });
 });
 sharingRoutes.post("/collaborators", async (c) => {
@@ -4145,6 +4492,22 @@ sharingRoutes.delete("/collaborators/:collabId", async (c) => {
   }
   return c.json({ removed: true });
 });
+sharingRoutes.get("/mentionable", async (c) => {
+  const nestId = c.req.param("nestId");
+  const userId = c.get("userId");
+  const people = await listNestPeople(nestId);
+  const callerEmail = (await resolveCallerEmail(userId)).toLowerCase();
+  const onRoster = people.some((p) => p.email.toLowerCase() === callerEmail);
+  if (!onRoster) {
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("write")) {
+      throw new ForbiddenError("Only people on this nest can see its roster");
+    }
+  }
+  return c.json({
+    people: (await withDirectory(people)).map((p) => ({ email: p.email, name: p.name }))
+  });
+});
 sharingRoutes.patch("/visibility", async (c) => {
   const body = await c.req.json();
   if (!body.visibility || !["private", "org", "public"].includes(body.visibility)) {
@@ -4176,10 +4539,14 @@ sharingRoutes.patch("/visibility", async (c) => {
 });
 sharingRoutes.patch("/reader-mode", async (c) => {
   const userId = c.get("userId");
+  const nestId = c.req.param("nestId");
   if (config.AUTH_MODE !== "open" && !await isServerAdminUserId(userId)) {
-    throw new ForbiddenError(
-      "Only the server admin can configure reader mode"
-    );
+    const access = await resolveNestAccess(nestId, userId);
+    if (permissionLevel(access.permission) < permissionLevel("admin")) {
+      throw new ForbiddenError(
+        "Only the nest owner, a nest admin, or the server admin can configure reader mode"
+      );
+    }
   }
   const body = await c.req.json();
   if (body.enabled !== void 0 && typeof body.enabled !== "boolean") {
@@ -4202,7 +4569,6 @@ sharingRoutes.patch("/reader-mode", async (c) => {
     );
   }
   const db = getDb();
-  const nestId = c.req.param("nestId");
   const exists = await db.get("SELECT id FROM nests WHERE id = ?", [
     nestId
   ]);
@@ -4222,7 +4588,7 @@ sharingRoutes.patch("/reader-mode", async (c) => {
 
 // src/nests/grant-routes.ts
 import { Hono as Hono5 } from "hono";
-import { v4 as uuid6 } from "uuid";
+import { v4 as uuid7 } from "uuid";
 var grantRoutes = new Hono5();
 async function requireManage(c, nestId) {
   if (!await canManageStewards(nestId, c.get("userId"))) {
@@ -4237,10 +4603,10 @@ async function resolveGrantee(email) {
   const existing = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
   if (existing) return existing.id;
   const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-  const id = uuid6();
+  const id = uuid7();
   await db.run(
     "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-    [id, e, null, await hashPassword2(uuid6())]
+    [id, e, null, await hashPassword2(uuid7())]
   );
   return id;
 }
@@ -4342,7 +4708,7 @@ grantRoutes.delete("/:id", async (c) => {
 import { Hono as Hono6 } from "hono";
 
 // src/nests/publish-service.ts
-import { v4 as uuid7 } from "uuid";
+import { v4 as uuid8 } from "uuid";
 import { createHash as createHash2, randomBytes as randomBytes3 } from "crypto";
 var MODES = ["public", "email", "code", "invite"];
 var LINK_TTL_SECONDS = 60 * 60;
@@ -4411,7 +4777,7 @@ async function createPublish(params) {
     );
   }
   const db = getDb();
-  const id = uuid7();
+  const id = uuid8();
   const slug = newSlug();
   const created = nowIso();
   const codeHash = mode === "code" && params.code ? await hashPassword(params.code.trim()) : null;
@@ -4442,7 +4808,7 @@ async function createPublish(params) {
       await db.run(
         `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
          VALUES (?, ?, 'invite', ?, NULL, NULL, NULL, ?)`,
-        [uuid7(), id, email, created]
+        [uuid8(), id, email, created]
       );
     }
   }
@@ -4497,7 +4863,7 @@ async function mintMagicLink(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'link', ?, ?, ?, NULL, ?)`,
-    [uuid7(), publishId, e, sha256Hex(token), expires, nowIso()]
+    [uuid8(), publishId, e, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4527,7 +4893,7 @@ async function createSession2(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'session', ?, ?, ?, NULL, ?)`,
-    [uuid7(), publishId, email, sha256Hex(token), expires, nowIso()]
+    [uuid8(), publishId, email, sha256Hex(token), expires, nowIso()]
   );
   return token;
 }
@@ -4544,7 +4910,7 @@ async function logView(publishId, email) {
   await getDb().run(
     `INSERT INTO access_grant (id, publish_id, kind, email, token_hash, expires_at, used_at, created_at)
      VALUES (?, ?, 'view', ?, NULL, NULL, NULL, ?)`,
-    [uuid7(), publishId, email, nowIso()]
+    [uuid8(), publishId, email, nowIso()]
   );
 }
 async function listAllowlist(publishId) {
@@ -4637,7 +5003,7 @@ import { Hono as Hono7 } from "hono";
 import MarkdownIt from "markdown-it";
 
 // src/annotations/service.ts
-import { v4 as uuid8 } from "uuid";
+import { v4 as uuid9 } from "uuid";
 
 // src/annotations/projection.ts
 var MAX_CONTEXT_CHARS = 250;
@@ -4762,6 +5128,10 @@ async function rowToThread(row) {
 async function getThreadRow(threadId) {
   return await getDb().get("SELECT * FROM annotation_threads WHERE id = ?", [threadId]);
 }
+async function getThread(threadId) {
+  const row = await getThreadRow(threadId);
+  return row ? await rowToThread(row) : null;
+}
 async function countThreadsByNode(nestId) {
   const rows = await getDb().all(
     `SELECT node_id, CAST(COUNT(*) AS INTEGER) AS count, MAX(created_at) AS last_at
@@ -4787,14 +5157,14 @@ async function createThread(nestId, nodeId, input, authorEmail) {
     throw new Error("comment body is required");
   }
   const db = getDb();
-  const id = uuid8();
+  const id = uuid9();
   const anchor = clampAnchor(input.anchor);
   const snapshot = input.snapshotVersion ?? await getApprovedVersion(nestId, nodeId) ?? null;
   await db.transaction(async (tx) => {
     await tx.run(
       `INSERT INTO annotation_threads
-         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by)
-       VALUES (?, ?, ?, ?, ?, 'open', ?)`,
+         (id, nest_id, node_id, snapshot_version, anchor_json, status, created_by, created_at)
+       VALUES (?, ?, ?, ?, ?, 'open', ?, ${nowMsExpr(db)})`,
       [
         id,
         nestId,
@@ -4805,8 +5175,9 @@ async function createThread(nestId, nodeId, input, authorEmail) {
       ]
     );
     await tx.run(
-      "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-      [uuid8(), id, authorEmail, body]
+      `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
+       VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
+      [uuid9(), id, authorEmail, body]
     );
   });
   return rowToThread(await getThreadRow(id));
@@ -4824,9 +5195,11 @@ async function addComment(nestId, nodeId, threadId, authorEmail, body) {
     throw new Error("comment body is required");
   }
   await getScopedThreadRow(threadId, nestId, nodeId);
-  await getDb().run(
-    "INSERT INTO annotation_comments (id, thread_id, author, body) VALUES (?, ?, ?, ?)",
-    [uuid8(), threadId, authorEmail, trimmed]
+  const db = getDb();
+  await db.run(
+    `INSERT INTO annotation_comments (id, thread_id, author, body, created_at)
+     VALUES (?, ?, ?, ?, ${nowMsExpr(db)})`,
+    [uuid9(), threadId, authorEmail, trimmed]
   );
   return rowToThread(await getThreadRow(threadId));
 }
@@ -4913,7 +5286,13 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
     const markdown2 = projectThreadsToMarkdown(title, threads);
     const derivedId = derivedAnnotationsId(nodeId);
     try {
-      await updateNode(nestId, derivedId, { content: markdown2 }, userEmail);
+      await updateNode(
+        nestId,
+        derivedId,
+        { content: markdown2 },
+        userEmail,
+        { notifyMentions: false }
+      );
     } catch (err) {
       if (err instanceof NotFoundError) {
         await createNode(
@@ -4925,7 +5304,8 @@ async function syncAnnotationsNode(nestId, nodeId, userEmail) {
             type: "document",
             tags: ["annotations"]
           },
-          userEmail
+          userEmail,
+          { notifyMentions: false }
         );
       } else {
         throw err;
@@ -5350,8 +5730,19 @@ nestTeamRoutes.delete("/:teamId", async (c) => {
   return c.json({ teams });
 });
 
-// src/governance/team-routes.ts
+// src/nests/people-routes.ts
 import { Hono as Hono9 } from "hono";
+var peopleRoutes = new Hono9();
+peopleRoutes.get("/suggest", async (c) => {
+  const userId = c.get("userId");
+  const q = c.req.query("q") ?? "";
+  const rawLimit = Number(c.req.query("limit"));
+  const limit = Number.isFinite(rawLimit) && rawLimit > 0 ? rawLimit : void 0;
+  return c.json({ people: await suggestPeopleForUser(userId, q, limit) });
+});
+
+// src/governance/team-routes.ts
+import { Hono as Hono10 } from "hono";
 
 // src/governance/promptowl-teams.ts
 var PROMPTOWL_SOURCE = "promptowl";
@@ -5498,7 +5889,7 @@ async function desiredRoster(poTeam, callerEmail) {
 }
 
 // src/governance/team-routes.ts
-var teamRoutes = new Hono9();
+var teamRoutes = new Hono10();
 var PROMPTOWL_LIMIT = { max: 10, windowMs: 15 * 6e4 };
 var CONNECT_REQUIRED = "promptowl_connect_required";
 var CONNECT_REQUIRED_STATUS = 428;
@@ -5683,7 +6074,7 @@ function toSearchHit(node, query) {
 }
 
 // src/nodes/routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 
 // src/nodes/markdown-export.ts
 import { parseDocument as parseDocument2 } from "@promptowl/contextnest-engine";
@@ -5735,7 +6126,7 @@ ${m[1]}
 }
 
 // src/nodes/routes.ts
-var nodeRoutes = new Hono10();
+var nodeRoutes = new Hono11();
 function nodeAsMarkdown(response, nodeId) {
   return nodeToMarkdown({
     id: nodeId,
@@ -5817,7 +6208,7 @@ nodeRoutes.post("/", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-5HBQGDMK.js");
+  const { resolveStewardsWithFallback: resolveStewardsWithFallback2 } = await import("./stewardship-service-32UHIRQ5.js");
   const { stewards, fallbackToOwner, ownerEmail } = await resolveStewardsWithFallback2(
     nestId,
     nodeId
@@ -5838,7 +6229,7 @@ nodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
 nodeRoutes.get("/:nodeId{.+}/reviews", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
-  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-XFWTENTN.js");
+  const { getReviewHistory: getReviewHistory2 } = await import("./review-service-A7PNLWG5.js");
   const history = await getReviewHistory2(nestId, nodeId);
   return c.json({ reviews: history });
 });
@@ -6082,13 +6473,13 @@ async function getUserEmail(c) {
 }
 
 // src/annotations/routes.ts
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 
 // src/annotations/types.ts
 var ARTIFACT_NODE_TYPE = "artifact";
 
 // src/annotations/routes.ts
-var annotationRoutes = new Hono11();
+var annotationRoutes = new Hono12();
 function getNodeId(c) {
   const raw = c.req.param("nodeId");
   try {
@@ -6129,6 +6520,13 @@ annotationRoutes.post("/:nodeId{.+}/annotations", async (c) => {
     },
     userEmail
   );
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: input.body,
+    actorEmail: userEmail,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread }, 201);
 });
@@ -6144,6 +6542,13 @@ async function handleAnnotationReply(c, nodeId, threadId) {
     throw new ValidationError("body is required");
   }
   const thread = await addComment(nestId, nodeId, threadId, userEmail, input.body);
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: input.body,
+    actorEmail: userEmail,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
   await syncAnnotationsNode(nestId, nodeId, userEmail);
   return c.json({ thread });
 }
@@ -6202,7 +6607,7 @@ annotationRoutes.get("/:nodeId{.+}/hosted", async (c) => {
 });
 
 // src/nodes/query-routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 
 // src/tables/service.ts
 function splitCsvLine(line) {
@@ -6836,7 +7241,7 @@ async function buildNestGraph(nestId, userId, userEmail, canSeeIdentities) {
 }
 
 // src/nodes/query-routes.ts
-var queryRoutes = new Hono12();
+var queryRoutes = new Hono13();
 queryRoutes.get("/changes", async (c) => {
   const nestId = c.req.param("nestId");
   const userId = c.get("userId");
@@ -7398,7 +7803,7 @@ queryRoutes.post("/publish", async (c) => {
 });
 
 // src/mcp/routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 
@@ -7478,10 +7883,10 @@ async function listTraceEvents(filters = {}) {
 }
 
 // src/mcp/workflow-tools.ts
-import { v4 as uuid11 } from "uuid";
+import { v4 as uuid12 } from "uuid";
 
 // src/workflow/run-service.ts
-import { v4 as uuid9 } from "uuid";
+import { v4 as uuid10 } from "uuid";
 var RUNNABLE_TYPES = ["agent", "skill"];
 async function flowSubgraph(nestId, agentNode) {
   const db = getDb();
@@ -7611,7 +8016,7 @@ async function triggerRun(opts) {
   }
   const edges = await flowSubgraph(nestId, agentNode);
   const definitions = await referencedDefinitions(nestId, edges);
-  const id = `run_${uuid9()}`;
+  const id = `run_${uuid10()}`;
   const db = getDb();
   await db.transaction(async (tx) => {
     if (parentRunId) {
@@ -7797,8 +8202,8 @@ async function listRuns(nestId, opts) {
 }
 
 // src/workflow/edge-routes.ts
-import { Hono as Hono13 } from "hono";
-import { v4 as uuid10 } from "uuid";
+import { Hono as Hono14 } from "hono";
+import { v4 as uuid11 } from "uuid";
 function toResponse(e, t) {
   return {
     id: e.id,
@@ -7859,7 +8264,9 @@ async function validateCondition(nestId, mode, condition) {
 async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
   if (fromNode === toNode) {
     throw new ConflictError(
-      `This step loops back on itself: ${await nodeTrail(db, nestId, [fromNode])}. A flow can't return to a step it already ran.`
+      `This step loops back on itself: ${await nodeTrail(db, nestId, [fromNode])}.
+
+A flow can't return to a step it already ran.`
     );
   }
   const rows = await db.all(
@@ -7888,7 +8295,9 @@ async function assertNoFlowCycle(db, nestId, fromNode, toNode) {
       }
       path.reverse().push(toNode);
       throw new ConflictError(
-        `These steps loop back on each other: ${await nodeTrail(db, nestId, path)}. A flow can't return to a step it already ran.`
+        `These steps loop back on each other: ${await nodeTrail(db, nestId, path)}.
+
+A flow can't return to a step it already ran.`
       );
     }
     for (const nb of adj.get(cur) ?? []) {
@@ -7912,7 +8321,7 @@ async function assertNoDuplicateEdge(db, nestId, fromNode, toNode, type, exclude
     );
   }
 }
-var edgeRoutes = new Hono13();
+var edgeRoutes = new Hono14();
 edgeRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -7980,7 +8389,7 @@ edgeRoutes.post("/", requireWorkflowPlane, async (c) => {
   );
   const metadata = body.metadata === void 0 || body.metadata === null ? null : JSON.stringify(body.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid10();
+  const id = uuid11();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8381,7 +8790,7 @@ async function createEdge(ctx, args) {
   );
   const metadata = args.metadata === void 0 || args.metadata === null ? null : JSON.stringify(args.metadata);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = uuid11();
+  const id = uuid12();
   await db.transaction(async (tx) => {
     await assertNoDuplicateEdge(tx, ctx.nestId, fromNode, toNode, type);
     if (type.is_flow) {
@@ -8445,7 +8854,7 @@ async function upsertEdgeType(ctx, args) {
         `INSERT INTO edge_types
            (id, nest_id, name, description, direction, is_flow, condition_schema, color, created_by, created_at, updated_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-        [uuid11(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
+        [uuid12(), ctx.nestId, name, args.description.trim(), direction, isFlow, conditionSchema, color, definedBy, now, now]
       );
     }
   });
@@ -8654,6 +9063,43 @@ var TOOL_DEFINITIONS = [
       }
     }
   },
+  {
+    name: "context_comment",
+    description: "Leave a comment on a document \u2014 the same threads the web UI's comments panel shows. Omit `thread` to open a new one; pass a thread id (from context_comments) to reply to it. Use this to answer feedback you were given, or to raise something you noticed while working. Anyone who can read the document may comment; `@name` in the body notifies that person.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" },
+        body: { type: "string", description: "The comment text" },
+        thread: {
+          type: "string",
+          description: "Thread id to reply to (from context_comments). Omit to open a new thread on the document."
+        }
+      },
+      required: ["body"]
+    }
+  },
+  {
+    name: "context_resolve_comment",
+    description: "Mark a comment thread resolved once you have addressed it, or reopen one that was closed too early. Records you as the resolver, exactly as the web UI does. Resolve only threads you actually acted on.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" },
+        thread: {
+          type: "string",
+          description: "Thread id, from context_comments"
+        },
+        reopen: {
+          type: "boolean",
+          description: "Reopen the thread instead of resolving it"
+        }
+      },
+      required: ["thread"]
+    }
+  },
   {
     name: "context_create",
     description: "Create a new knowledge node in the vault. The title must not already be in use \u2014 these tools resolve documents by title, so a duplicate is refused rather than filed as an unreachable twin. To change an existing document use context_update; to refile it use context_move.",
@@ -9359,8 +9805,8 @@ ${parts.join(
         node = docs.find((n) => n.id === args.id);
       }
       if (!node) return `Node not found: ${args.title || args.id}`;
-      if (await resolveLlmBody(ctx, node) === null) {
-        return `Node "${node.frontmatter.title}" has no approved version yet \u2014 not available to AI.`;
+      if (!await canReadNode(nestId, node.id, ctx.userId, userEmail)) {
+        return `Node not found: ${args.title || args.id}`;
       }
       const threads = await listThreads(nestId, node.id);
       if (!threads.length)
@@ -9379,6 +9825,89 @@ ${quote}${comments}`;
 
 ${sections}`;
     }
+    // ── Comments: write half of context_comments ──────────────────────────
+    //
+    // Both cases target the annotation store the UI's comments panel uses, so
+    // an agent's comment and a human's are the same object, and both carry the
+    // side effects the REST routes carry: the @mention fan-out and the derived
+    // `— Annotations` projection an artifact's agents read back.
+    //
+    // PRIMARY permission gate, like context_create's: the /mcp middleware
+    // admits read-tier callers (the transport is always POST), so the check
+    // here is the real one. Commenting is READ-tier — the same rule REST
+    // applies in app.ts (isAnnotationAction) — so canReadNode is the bar, not
+    // write access. Deliberately NOT gated on an approved version: a reviewer
+    // comments on a draft, and unlike reading a thread, writing one discloses
+    // nothing (the caller supplies the text).
+    case "context_comment":
+    case "context_resolve_comment": {
+      const body = String(args.body ?? "");
+      const isResolve = toolName === "context_resolve_comment";
+      if (!isResolve && !body.trim()) {
+        return "body is required \u2014 the comment text.";
+      }
+      const threadId = args.thread ? String(args.thread) : "";
+      if (isResolve && !threadId) {
+        return "thread is required \u2014 the id from context_comments.";
+      }
+      const docs = await storage.discoverDocuments();
+      let node;
+      if (args.title) {
+        node = docs.find(
+          (n) => n.frontmatter.title.toLowerCase() === String(args.title).toLowerCase()
+        );
+      } else if (args.id) {
+        node = docs.find((n) => n.id === String(args.id));
+      }
+      if (!node) {
+        return toolError(
+          `Node not found: ${args.title || args.id || "(no title or id given)"}`,
+          "DOCUMENT_NOT_FOUND"
+        );
+      }
+      if (!await canReadNode(nestId, node.id, ctx.userId, userEmail)) {
+        return toolError(
+          `Node not found: ${args.title || args.id}`,
+          "DOCUMENT_NOT_FOUND"
+        );
+      }
+      const label = node.frontmatter.title || node.id;
+      if (threadId) {
+        const existing = await getThread(threadId);
+        if (!existing || existing.nodeId !== node.id || existing.nestId !== nestId) {
+          return toolError(
+            `Thread ${threadId} is not a thread on "${label}". Call context_comments to list its threads.`,
+            "DOCUMENT_NOT_FOUND"
+          );
+        }
+      }
+      if (isResolve) {
+        const reopen = args.reopen === true;
+        const thread2 = await setThreadStatus(
+          nestId,
+          node.id,
+          threadId,
+          reopen ? "open" : "resolved",
+          userEmail
+        );
+        await syncAnnotationsNode(nestId, node.id, userEmail);
+        return reopen ? `Reopened the thread on "${label}". It is back in the open list for whoever picks it up.` : `Resolved the thread on "${label}", recorded against ${thread2.resolvedBy}.`;
+      }
+      const thread = threadId ? await addComment(nestId, node.id, threadId, userEmail, body) : await createThread(nestId, node.id, { body, anchor: null }, userEmail);
+      await notifyCommentMentions({
+        nestId,
+        nodeId: node.id,
+        body,
+        actorEmail: userEmail,
+        // Without this the notification still reaches the person, but its
+        // "Open document" link falls back to PUBLIC_BASE_URL and comes out
+        // empty when that isn't configured — every other notifying tool in
+        // this file passes it, and the REST route passes requestBaseUrl.
+        baseUrl: ctx.baseUrl
+      });
+      await syncAnnotationsNode(nestId, node.id, userEmail);
+      return threadId ? `Replied on "${label}", in thread ${thread.id}.` : `Commented on "${label}" \u2014 opened thread ${thread.id}. Reply to it by passing that id as \`thread\`.`;
+    }
     case "context_create": {
       if (!await canCreateInNest(nestId, userEmail)) {
         return toolError(
@@ -9927,19 +10456,19 @@ ${list}`,
       if (!target) return "target is required (a node id or folder prefix).";
       if (!["read", "write"].includes(role)) return "role must be read or write.";
       try {
-        const { createGrant: createGrant2 } = await import("./grants-service-UZ2MGDO5.js");
-        const db = (await import("./client-CSCHXUNX.js")).getDb();
+        const { createGrant: createGrant2 } = await import("./grants-service-TBGTCO5K.js");
+        const db = (await import("./client-LWDMNKX3.js")).getDb();
         const { normalizeEmail: normalizeEmail2 } = await import("./email-R7DFS6E5.js");
         const e = normalizeEmail2(String(args.email || ""));
         if (!e) return "email is required.";
         let row = await db.get("SELECT id FROM users WHERE LOWER(email) = ?", [e]);
         if (!row) {
           const { hashPassword: hashPassword2 } = await import("./keys-CTOGAG3W.js");
-          const { v4: uuid19 } = await import("uuid");
-          const id = uuid19();
+          const { v4: uuid20 } = await import("uuid");
+          const id = uuid20();
           await db.run(
             "INSERT INTO users (id, email, name, password_hash, is_invited) VALUES (?, ?, ?, ?, 1)",
-            [id, e, null, await hashPassword2(uuid19())]
+            [id, e, null, await hashPassword2(uuid20())]
           );
           row = { id };
         }
@@ -9994,7 +10523,7 @@ ${list}`;
 
 // src/mcp/routes.ts
 import { z } from "zod";
-var mcpRoutes = new Hono14();
+var mcpRoutes = new Hono15();
 async function getUserEmail2(userId) {
   const db = getDb();
   const user = await db.get("SELECT email FROM users WHERE id = ?", [userId]);
@@ -10060,8 +10589,8 @@ mcpRoutes.all("/", async (c) => {
 });
 
 // src/workflow/run-routes.ts
-import { Hono as Hono15 } from "hono";
-import { v4 as uuid12 } from "uuid";
+import { Hono as Hono16 } from "hono";
+import { v4 as uuid13 } from "uuid";
 var RUNNABLE_TYPES2 = ["agent", "skill"];
 var safeJson2 = (s) => {
   if (!s) return null;
@@ -10179,7 +10708,7 @@ async function buildRunBundle(nestId, agentNode) {
     definitions
   };
 }
-var runTriggerRoutes = new Hono15();
+var runTriggerRoutes = new Hono16();
 async function resolveParentRun2(nestId, parentRunId, childAgent) {
   if (!config.FEATURE_SUBAGENT_RUNS) {
     throw new ValidationError(
@@ -10258,7 +10787,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
   }
   const bundle = await buildRunBundle(nestId, agentNode);
   const triggeredBy = await resolveCallerEmail(c.get("userId"));
-  const id = `run_${uuid12()}`;
+  const id = `run_${uuid13()}`;
   await getDb().run(
     `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
      VALUES (?, ?, ?, ?, 'running', ?, ?, ?, ?)`,
@@ -10287,7 +10816,7 @@ runTriggerRoutes.post("/:agentNode{.+}", requireWorkflowPlane, async (c) => {
     201
   );
 });
-var runListRoutes = new Hono15();
+var runListRoutes = new Hono16();
 runListRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10319,7 +10848,7 @@ runListRoutes.get("/", requireWorkflowPlane, async (c) => {
     }))
   });
 });
-var runDetailRoutes = new Hono15();
+var runDetailRoutes = new Hono16();
 async function loadRunWithPermission(c, runId, required) {
   const run = await getDb().get("SELECT * FROM runs WHERE id = ?", [
     runId
@@ -10470,8 +10999,8 @@ runDetailRoutes.get("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/workflow/schedule-routes.ts
-import { Hono as Hono16 } from "hono";
-import { v4 as uuid13 } from "uuid";
+import { Hono as Hono17 } from "hono";
+import { v4 as uuid14 } from "uuid";
 var RUNNABLE_TYPES3 = ["agent", "skill"];
 var MIN_EVERY = 5;
 var MAX_EVERY = 7 * 24 * 60;
@@ -10508,7 +11037,7 @@ function parseEvery(v) {
   }
   return n;
 }
-var scheduleRoutes = new Hono16();
+var scheduleRoutes = new Hono17();
 scheduleRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -10549,7 +11078,7 @@ scheduleRoutes.post("/", requireWorkflowPlane, async (c) => {
     );
   }
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `sch_${uuid13()}`;
+  const id = `sch_${uuid14()}`;
   await db.run(
     `INSERT INTO schedules (id, nest_id, agent_node, every_minutes, enabled, last_run_at, max_runs, runs_created, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, NULL, ?, 0, ?, ?, ?)`,
@@ -10604,13 +11133,14 @@ scheduleRoutes.delete("/:id", requireWorkflowPlane, async (c) => {
 });
 
 // src/notify/connector-routes.ts
-import { Hono as Hono17 } from "hono";
-import { v4 as uuid14 } from "uuid";
+import { Hono as Hono18 } from "hono";
+import { v4 as uuid15 } from "uuid";
 var KNOWN_EVENTS = [
   "review_requested",
   "review_approved",
   "review_rejected",
-  "run_failed"
+  "run_failed",
+  "mention"
 ];
 var CHANNELS = ["slack", "teams", "webhook"];
 function toResponse3(r) {
@@ -10651,7 +11181,7 @@ function parseUrl(v) {
     'url must be a public https:// URL (loopback/private/metadata hosts are refused) or an env reference like "env:SLACK_WEBHOOK"'
   );
 }
-var connectorRoutes = new Hono17();
+var connectorRoutes = new Hono18();
 connectorRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const rows = await getDb().all(
@@ -10670,7 +11200,7 @@ connectorRoutes.post("/", async (c) => {
   const url = parseUrl(body.url);
   const events = parseEvents(body.events);
   const now = (/* @__PURE__ */ new Date()).toISOString();
-  const id = `con_${uuid14()}`;
+  const id = `con_${uuid15()}`;
   await getDb().run(
     `INSERT INTO connectors (id, nest_id, channel, url, events, enabled, created_by, created_at, updated_at)
      VALUES (?, ?, ?, ?, ?, 1, ?, ?, ?)`,
@@ -10713,7 +11243,7 @@ connectorRoutes.delete("/:id", async (c) => {
 });
 
 // src/workflow/hook-routes.ts
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 import { createHmac as createHmac2, timingSafeEqual as timingSafeEqual2, randomUUID } from "crypto";
 var PRESETS = ["slack", "teams", "webhook"];
 var RUNNABLE_TYPES4 = ["agent", "skill"];
@@ -10736,7 +11266,7 @@ function toResponse4(c, r, opts = {}) {
     created_at: r.created_at
   };
 }
-var hookNestRoutes = new Hono18();
+var hookNestRoutes = new Hono19();
 hookNestRoutes.get("/", requireWorkflowPlane, async (c) => {
   const nestId = c.req.param("nestId");
   const agent = c.req.query("agent");
@@ -10810,7 +11340,7 @@ function teamsSignatureValid(secret, authHeader, rawBody) {
 function stripMentions(text) {
   return text.replace(/<@[^>]+>/g, "").replace(/<at>[^<]*<\/at>/gi, "").trim();
 }
-var hookFireRoutes = new Hono18();
+var hookFireRoutes = new Hono19();
 hookFireRoutes.post("/:token", async (c) => {
   const token = c.req.param("token");
   if (!tryConsume("hook:*", { max: 120, windowMs: 6e4 })) {
@@ -10912,9 +11442,9 @@ hookFireRoutes.post("/:token", async (c) => {
 });
 
 // src/definitions/routes.ts
-import { Hono as Hono19 } from "hono";
-import { v4 as uuid15 } from "uuid";
-var definitionRoutes = new Hono19();
+import { Hono as Hono20 } from "hono";
+import { v4 as uuid16 } from "uuid";
+var definitionRoutes = new Hono20();
 definitionRoutes.get("/", async (c) => {
   const nestId = c.req.param("nestId");
   const db = getDb();
@@ -10993,7 +11523,7 @@ definitionRoutes.post("/", async (c) => {
       await applyUpdate(tx, existing.id);
       targetId = existing.id;
     } else {
-      targetId = uuid15();
+      targetId = uuid16();
       wasCreated = true;
       await tx.run(
         `INSERT INTO definitions (id, nest_id, term, definition, linked_tag, defined_by, created_at, updated_at)
@@ -11022,11 +11552,11 @@ definitionRoutes.delete("/:id", async (c) => {
 });
 
 // src/nests/asset-routes.ts
-import { Hono as Hono20 } from "hono";
-import { v4 as uuid16 } from "uuid";
+import { Hono as Hono21 } from "hono";
+import { v4 as uuid17 } from "uuid";
 import { mkdir as mkdir2, readFile, writeFile } from "fs/promises";
 import { join as join4 } from "path";
-var assetRoutes = new Hono20();
+var assetRoutes = new Hono21();
 var CONTENT_TYPES = {
   png: "image/png",
   jpg: "image/jpeg",
@@ -11072,7 +11602,7 @@ assetRoutes.post("/", async (c) => {
       `${isVideo ? "video" : "image"} too large (${(file.size / (1024 * 1024)).toFixed(1)} MB, max ${maxBytes / (1024 * 1024)} MB for ${isVideo ? "video" : "images"})`
     );
   }
-  const name = `${uuid16()}.${ext === "jpeg" ? "jpg" : ext}`;
+  const name = `${uuid17()}.${ext === "jpeg" ? "jpg" : ext}`;
   const dir = join4(resolveNestPath(nestId), "assets");
   await mkdir2(dir, { recursive: true });
   await writeFile(join4(dir, name), Buffer.from(await file.arrayBuffer()));
@@ -11112,8 +11642,108 @@ assetRoutes.get("/:file", async (c) => {
   });
 });
 
+// src/auth/community-sites-routes.ts
+import { Hono as Hono22 } from "hono";
+var serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
+var isHttpUrl = (v) => /^https?:\/\/\S+$/i.test(v);
+var serializeSite = (site) => ({
+  id: site.id,
+  name: site.name,
+  url: site.url,
+  secret_set: !!site.secret,
+  is_active: site.is_active,
+  created_at: site.created_at,
+  updated_at: site.updated_at
+});
+var communitySiteRoutes = new Hono22();
+communitySiteRoutes.get("/", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can view this." }, 403);
+  const sites = await listCommunitySites();
+  return c.json({ community_sites: sites.map(serializeSite) });
+});
+communitySiteRoutes.post("/", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can add a community site." }, 403);
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const name = typeof body.name === "string" ? body.name.trim() : "";
+  const url = typeof body.url === "string" ? body.url.trim().replace(/\/$/, "") : "";
+  const secret = typeof body.secret === "string" ? body.secret.trim() : "";
+  const is_active = body.is_active === void 0 ? true : !!body.is_active;
+  if (!name) return c.json({ error: "A name is required." }, 400);
+  if (!url || !isHttpUrl(url))
+    return c.json({ error: "A valid http(s) site URL is required." }, 400);
+  if (!secret || secret.length < 16)
+    return c.json({ error: "A secret of at least 16 characters is required." }, 400);
+  try {
+    const site = await createCommunitySite({ name, url, secret, is_active });
+    await loadActiveCommunitySites();
+    return c.json(serializeSite(site), 201);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/unique|duplicate/i.test(msg))
+      return c.json({ error: "A community site with this URL already exists." }, 409);
+    throw err;
+  }
+});
+communitySiteRoutes.patch("/:id", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can edit a community site." }, 403);
+  const id = c.req.param("id");
+  let body;
+  try {
+    body = await c.req.json();
+  } catch {
+    return c.json({ error: "Invalid JSON body" }, 400);
+  }
+  const patch = {};
+  if ("name" in body) {
+    const v = typeof body.name === "string" ? body.name.trim() : "";
+    if (!v) return c.json({ error: "A name is required." }, 400);
+    patch.name = v;
+  }
+  if ("url" in body) {
+    const v = typeof body.url === "string" ? body.url.trim().replace(/\/$/, "") : "";
+    if (!v || !isHttpUrl(v))
+      return c.json({ error: "A valid http(s) site URL is required." }, 400);
+    patch.url = v;
+  }
+  if ("secret" in body) {
+    const v = typeof body.secret === "string" ? body.secret.trim() : "";
+    if (!v || v.length < 16)
+      return c.json({ error: "A secret of at least 16 characters is required." }, 400);
+    patch.secret = v;
+  }
+  if ("is_active" in body) patch.is_active = !!body.is_active;
+  try {
+    const site = await updateCommunitySite(id, patch);
+    if (!site) return c.json({ error: "Community site not found." }, 404);
+    await loadActiveCommunitySites();
+    return c.json(serializeSite(site));
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/unique|duplicate/i.test(msg))
+      return c.json({ error: "A community site with this URL already exists." }, 409);
+    throw err;
+  }
+});
+communitySiteRoutes.delete("/:id", async (c) => {
+  if (!await serverAdminAllowed(c))
+    return c.json({ error: "Only the server admin can remove a community site." }, 403);
+  const id = c.req.param("id");
+  const removed = await deleteCommunitySite(id);
+  if (!removed) return c.json({ error: "Community site not found." }, 404);
+  await loadActiveCommunitySites();
+  return c.json({ ok: true, id });
+});
+
 // src/mcp/server-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono23 } from "hono";
 import { McpServer as McpServer2 } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPServerTransport2 } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { z as z2 } from "zod";
@@ -11173,7 +11803,9 @@ async function buildNestIndex(userId, nestScope) {
       let document_count = null;
       try {
         const { storage } = await engineCache.get(n.id);
-        document_count = (await storage.discoverDocuments()).length;
+        document_count = (await storage.discoverDocuments()).filter(
+          (d) => !isDerivedAnnotationsNode(d.id)
+        ).length;
       } catch {
       }
       return {
@@ -11309,6 +11941,22 @@ var SERVER_TOOL_DEFINITIONS = [
       required: ["nest", "selector"]
     }
   },
+  {
+    // Read-only, so it belongs on this endpoint: an agent reading a nest's
+    // documents across nests also needs the feedback left on them. Writing a
+    // comment stays on the per-nest endpoint with the other write tools.
+    name: "context_comments",
+    description: "Get the review comments/annotations on a document in a nest \u2014 anchored quotes, threaded replies, and open/resolved status. Use to pull human feedback into context before acting on a document.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        nest: { type: "string", description: "Nest name or id (see nest_index)" },
+        title: { type: "string", description: "Title of the node" },
+        id: { type: "string", description: "ID of the node" }
+      },
+      required: ["nest"]
+    }
+  },
   {
     name: "nest_create",
     description: "Create a new nest owned by the caller. Returns the new nest's id \u2014 target it with the other tools afterwards.",
@@ -11421,7 +12069,7 @@ function createServerMcp(userId, userEmail, nestScope, baseUrl) {
   }
   return server;
 }
-var serverMcpRoutes = new Hono21();
+var serverMcpRoutes = new Hono23();
 serverMcpRoutes.all("/", async (c) => {
   const userId = c.get("userId");
   const userEmail = await getUserEmail3(userId);
@@ -11443,7 +12091,7 @@ serverMcpRoutes.all("/", async (c) => {
     await server.server.close();
   }
 });
-var nestIndexRoutes = new Hono21();
+var nestIndexRoutes = new Hono23();
 nestIndexRoutes.get("/", async (c) => {
   const userId = c.get("userId");
   const nests = await buildNestIndex(userId, c.get("nestScope"));
@@ -11582,14 +12230,14 @@ is \`ctx push --server ${B} --nest <nest-id>\` with the same env var set.
   through steward review before they become AI-visible.
 `;
 }
-var llmsTxtRoutes = new Hono21();
+var llmsTxtRoutes = new Hono23();
 llmsTxtRoutes.get("/", (c) => {
   const md = renderLlmsTxt(requestBaseUrl(c.req.url));
   return c.text(md, 200, { "Content-Type": "text/markdown; charset=utf-8" });
 });
 
 // src/governance/routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono24 } from "hono";
 
 // src/governance/feed-service.ts
 var SNIPPET_CHARS = 200;
@@ -11720,7 +12368,7 @@ async function getNestFeed(params) {
 }
 
 // src/governance/comment-service.ts
-import { v4 as uuid17 } from "uuid";
+import { v4 as uuid18 } from "uuid";
 async function createComment(params) {
   const db = getDb();
   const body = (params.body ?? "").trim();
@@ -11736,7 +12384,7 @@ async function createComment(params) {
       throw new Error("Parent comment not found on this node");
     }
   }
-  const id = uuid17();
+  const id = uuid18();
   await db.run(
     `INSERT INTO comments
        (id, nest_id, node_id, version, anchor_start, anchor_end, anchor_text,
@@ -12021,7 +12669,7 @@ function parseLimit(raw, def = 100, max = 1e3) {
   if (Number.isNaN(n) || n < 1) return def;
   return Math.min(n, max);
 }
-var governanceRoutes = new Hono22();
+var governanceRoutes = new Hono24();
 governanceRoutes.get("/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const scope = c.req.query("scope");
@@ -12388,7 +13036,7 @@ governanceRoutes.get("/activity", async (c) => {
   const activity = await getActivity({ nestId, limit });
   return c.json({ activity });
 });
-var governanceNodeRoutes = new Hono22();
+var governanceNodeRoutes = new Hono24();
 governanceNodeRoutes.get("/:nodeId{.+}/stewards", async (c) => {
   const nestId = c.req.param("nestId");
   const nodeId = c.req.param("nodeId");
@@ -12520,8 +13168,9 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
   }
   const body = await c.req.json();
   const author = await getUserEmail4(c);
+  let comment;
   try {
-    const comment = await createComment({
+    comment = await createComment({
       nestId,
       nodeId,
       author,
@@ -12530,12 +13179,19 @@ governanceNodeRoutes.post("/:nodeId{.+}/comments", async (c) => {
       anchor: body.anchor,
       parentId: body.parentId
     });
-    return c.json({ comment }, 201);
   } catch (err) {
     throw new ValidationError(
       err instanceof Error ? err.message : String(err)
     );
   }
+  await notifyCommentMentions({
+    nestId,
+    nodeId,
+    body: comment.body,
+    actorEmail: author,
+    baseUrl: requestBaseUrl(c.req.url)
+  });
+  return c.json({ comment }, 201);
 });
 governanceNodeRoutes.post(
   "/:nodeId{.+}/comments/:commentId/resolve",
@@ -12953,7 +13609,7 @@ async function canApproveInNest(nestId, email) {
   return ok;
 }
 function createApp() {
-  const app = new Hono23({ router: new LinearRouter() });
+  const app = new Hono25({ router: new LinearRouter() });
   const corsOrigins = config.CORS_ORIGINS;
   app.use(
     "*",
@@ -13134,7 +13790,7 @@ function createApp() {
       return c.json({ error: msg }, 500);
     }
   });
-  const serverAdminAllowed = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
+  const serverAdminAllowed2 = async (c) => config.AUTH_MODE === "open" || await isServerAdminUserId(c.get("userId"));
   app.use("/admin/settings", flexAuthMiddleware);
   app.use("/admin/settings/*", flexAuthMiddleware);
   const currentServerSettings = () => ({
@@ -13163,6 +13819,7 @@ function createApp() {
     oidc_allowed_domains: config.OIDC_ALLOWED_DOMAINS.join(", "),
     oidc_auto_provision: config.OIDC_AUTO_PROVISION,
     oidc_department_tagging: config.OIDC_DEPARTMENT_TAGGING,
+    people_suggest_all_users: config.PEOPLE_SUGGEST_ALL_USERS,
     // Agent SSO / token-exchange. MCP_SIGNING_SECRET is WRITE-ONLY — only its
     // presence is reported, never the value (same discipline as the OIDC secret).
     sso_token_exchange_enabled: config.SSO_TOKEN_EXCHANGE_ENABLED,
@@ -13187,12 +13844,12 @@ function createApp() {
     notify_email_to: config.NOTIFY_EMAIL_TO ?? ""
   });
   app.get("/admin/settings", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     return c.json(currentServerSettings());
   });
   app.post("/admin/settings/test-notification", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can do this." }, 403);
     let body;
     try {
@@ -13206,7 +13863,7 @@ function createApp() {
     return result.ok ? c.json({ ok: true }) : c.json({ error: result.error }, 502);
   });
   app.patch("/admin/settings", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can change this." }, 403);
     let body;
     try {
@@ -13383,6 +14040,12 @@ function createApp() {
         value: body.oidc_department_tagging ? "true" : null
       });
     }
+    if ("people_suggest_all_users" in body) {
+      pending.push({
+        name: "PEOPLE_SUGGEST_ALL_USERS",
+        value: body.people_suggest_all_users ? "true" : null
+      });
+    }
     if ("sso_token_exchange_enabled" in body) {
       pending.push({
         name: "SSO_TOKEN_EXCHANGE_ENABLED",
@@ -13551,7 +14214,7 @@ function createApp() {
   });
   app.use("/admin/trace", flexAuthMiddleware);
   app.get("/admin/trace", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     const limitRaw = Number(c.req.query("limit"));
     const offsetRaw = Number(c.req.query("offset"));
@@ -13569,7 +14232,7 @@ function createApp() {
   app.use("/admin/super-admins", flexAuthMiddleware);
   app.use("/admin/super-admins/*", flexAuthMiddleware);
   app.get("/admin/super-admins", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can view this." }, 403);
     const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
     const byEmail = /* @__PURE__ */ new Map();
@@ -13595,7 +14258,7 @@ function createApp() {
     return c.json({ super_admins: [...byEmail.values()] });
   });
   app.post("/admin/super-admins", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can grant superadmin." }, 403);
     let body;
     try {
@@ -13640,7 +14303,7 @@ function createApp() {
     return c.json({ email, source: "granted", granted_by: grantedBy }, 201);
   });
   app.delete("/admin/super-admins/:email", async (c) => {
-    if (!await serverAdminAllowed(c))
+    if (!await serverAdminAllowed2(c))
       return c.json({ error: "Only the server admin can revoke superadmin." }, 403);
     const email = c.req.param("email").trim().toLowerCase();
     const callerEmail = (await resolveCallerEmail(c.get("userId"))).toLowerCase();
@@ -13681,9 +14344,14 @@ function createApp() {
     await loadGrantedSuperAdmins();
     return c.json({ ok: true, email });
   });
+  app.use("/admin/community-sites", flexAuthMiddleware);
+  app.use("/admin/community-sites/*", flexAuthMiddleware);
+  app.route("/admin/community-sites", communitySiteRoutes);
   app.use("/teams/*", flexAuthMiddleware);
   app.use("/teams", flexAuthMiddleware);
   app.route("/teams", teamRoutes);
+  app.use("/people/*", flexAuthMiddleware);
+  app.route("/people", peopleRoutes);
   app.use("/me/*", flexAuthMiddleware);
   app.get("/me/work", async (c) => {
     const userId = c.get("userId");
@@ -13827,7 +14495,9 @@ function createApp() {
     for (const nest of visibleNests) {
       try {
         const { storage } = await engineCache.get(nest.id);
-        const docs = await storage.discoverDocuments();
+        const docs = (await storage.discoverDocuments()).filter(
+          (d) => !isDerivedAnnotationsNode(d.id)
+        );
         documents += (await filterAccessible(nest.id, userId, userEmail, docs)).length;
       } catch {
       }
@@ -13882,7 +14552,7 @@ function createApp() {
   app.route("/index", nestIndexRoutes);
   app.use("/mcp", flexAuthWithPromptowlTicket);
   app.route("/mcp", serverMcpRoutes);
-  const nestsApp = new Hono23();
+  const nestsApp = new Hono25();
   nestsApp.use("*", async (c, next) => {
     const parts = nestPathParts(c.req.path);
     const ticketEligible = parts.length === 2 && (c.req.method === "POST" && parts[1] === "context" || c.req.method === "GET" && parts[1] === "nodes" || parts[1] === "mcp");
@@ -14414,7 +15084,7 @@ async function repairGraftedVersionChains(db) {
 }
 
 // src/workflow/scheduler.ts
-import { v4 as uuid18 } from "uuid";
+import { v4 as uuid19 } from "uuid";
 function isDue(s, now) {
   if (!s.last_run_at) return true;
   const last = Date.parse(s.last_run_at);
@@ -14442,7 +15112,7 @@ async function schedulerTick(now = Date.now()) {
         );
         continue;
       }
-      const id = `run_${uuid18()}`;
+      const id = `run_${uuid19()}`;
       const nowIso2 = new Date(now).toISOString();
       await db.run(
         `INSERT INTO runs (id, nest_id, agent_node, triggered_by, status, inputs, started_at, parent_run_id, depth)
@@ -14512,6 +15182,11 @@ async function main() {
   } catch (err) {
     console.error("[access] failed to load DB-granted superadmins:", err);
   }
+  try {
+    await loadActiveCommunitySites();
+  } catch (err) {
+    console.error("[sso] failed to load community sites:", err);
+  }
   const license = await validateLicense();
   if (!license.valid) {
     console.warn(`