agor-live 0.12.2 → 0.12.3

package/dist/core/db/index.cjs

@@ -216,13 +216,15 @@ __export(schema_postgres_exports, {
   repos: () => repos,
   sessionMcpServers: () => sessionMcpServers,
   sessions: () => sessions,
+  sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
   threadSessionMap: () => threadSessionMap,
   users: () => users,
   worktreeOwners: () => worktreeOwners,
-  worktrees: () => worktrees
+  worktrees: () => worktrees,
+  worktreesRelations: () => worktreesRelations
 });
-var import_drizzle_orm, import_pg_core, t, sessions, tasks, messages, boards, repos, worktrees, worktreeOwners, users, mcpServers, boardObjects, sessionMcpServers, boardComments, gatewayChannels, threadSessionMap;
+var import_drizzle_orm, import_pg_core, t, sessions, tasks, messages, boards, repos, worktrees, worktreeOwners, users, mcpServers, boardObjects, sessionMcpServers, boardComments, gatewayChannels, threadSessionMap, sessionsRelations, worktreesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -711,6 +713,15 @@ var init_schema_postgres = __esm({
         channelStatusIdx: (0, import_pg_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    sessionsRelations = (0, import_drizzle_orm.relations)(sessions, ({ one }) => ({
+      worktree: one(worktrees, {
+        fields: [sessions.worktree_id],
+        references: [worktrees.worktree_id]
+      })
+    }));
+    worktreesRelations = (0, import_drizzle_orm.relations)(worktrees, ({ many }) => ({
+      sessions: many(sessions)
+    }));
   }
 });
 
@@ -726,13 +737,15 @@ __export(schema_sqlite_exports, {
   repos: () => repos2,
   sessionMcpServers: () => sessionMcpServers2,
   sessions: () => sessions2,
+  sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
   threadSessionMap: () => threadSessionMap2,
   users: () => users2,
   worktreeOwners: () => worktreeOwners2,
-  worktrees: () => worktrees2
+  worktrees: () => worktrees2,
+  worktreesRelations: () => worktreesRelations2
 });
-var import_drizzle_orm2, import_sqlite_core, t2, sessions2, tasks2, messages2, boards2, repos2, worktrees2, worktreeOwners2, users2, mcpServers2, boardObjects2, sessionMcpServers2, boardComments2, gatewayChannels2, threadSessionMap2;
+var import_drizzle_orm2, import_sqlite_core, t2, sessions2, tasks2, messages2, boards2, repos2, worktrees2, worktreeOwners2, users2, mcpServers2, boardObjects2, sessionMcpServers2, boardComments2, gatewayChannels2, threadSessionMap2, sessionsRelations2, worktreesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -1222,6 +1235,15 @@ var init_schema_sqlite = __esm({
         channelStatusIdx: (0, import_sqlite_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    sessionsRelations2 = (0, import_drizzle_orm2.relations)(sessions2, ({ one }) => ({
+      worktree: one(worktrees2, {
+        fields: [sessions2.worktree_id],
+        references: [worktrees2.worktree_id]
+      })
+    }));
+    worktreesRelations2 = (0, import_drizzle_orm2.relations)(worktrees2, ({ many }) => ({
+      sessions: many(sessions2)
+    }));
   }
 });
 
@@ -1281,10 +1303,10 @@ function isSQLiteDatabase(db) {
 function isPostgresDatabase(db) {
   return !("run" in db);
 }
-function jsonExtract(db, column, path) {
-  const parts = path.split(".");
+function jsonExtract(db, column, path2) {
+  const parts = path2.split(".");
   if (isSQLiteDatabase(db)) {
-    return import_drizzle_orm3.sql`json_extract(${column}, ${`$.${path}`})`;
+    return import_drizzle_orm3.sql`json_extract(${column}, ${`$.${path2}`})`;
   } else {
     if (parts.length === 1) {
       return import_drizzle_orm3.sql`${column}${import_drizzle_orm3.sql.raw(`->>'${parts[0]}'`)}`;
@@ -1634,14 +1656,14 @@ init_schema_factory();
 init_cjs_shims();
 var import_node_os = require("os");
 var import_node_path = require("path");
-function expandPath(path) {
-  if (path.startsWith("file:~/")) {
-    return `file:${(0, import_node_path.join)((0, import_node_os.homedir)(), path.slice(7))}`;
+function expandPath(path2) {
+  if (path2.startsWith("file:~/")) {
+    return `file:${(0, import_node_path.join)((0, import_node_os.homedir)(), path2.slice(7))}`;
   }
-  if (path.startsWith("~/")) {
-    return (0, import_node_path.join)((0, import_node_os.homedir)(), path.slice(2));
+  if (path2.startsWith("~/")) {
+    return (0, import_node_path.join)((0, import_node_os.homedir)(), path2.slice(2));
   }
-  return path;
+  return path2;
 }
 
 // src/db/client.ts
@@ -1903,18 +1925,8 @@ async function checkMigrationStatus(db) {
       );
       appliedHashes = result.map((row) => String(row.hash));
     }
-    const normalizedAppliedHashes = appliedHashes;
-    const numExpected = expectedMigrations.length;
-    const numApplied = normalizedAppliedHashes.length;
-    if (numApplied >= numExpected) {
-      return {
-        hasPending: false,
-        pending: [],
-        applied: expectedMigrations.map((m) => m.tag)
-      };
-    }
-    const pending = expectedMigrations.filter((m) => !normalizedAppliedHashes.includes(m.hash)).map((m) => m.tag);
-    const appliedTags = expectedMigrations.filter((m) => normalizedAppliedHashes.includes(m.hash)).map((m) => m.tag);
+    const pending = expectedMigrations.filter((m) => !appliedHashes.includes(m.hash)).map((m) => m.tag);
+    const appliedTags = expectedMigrations.filter((m) => appliedHashes.includes(m.hash)).map((m) => m.tag);
     return {
       hasPending: pending.length > 0,
       pending,
@@ -2619,8 +2631,148 @@ var BoardObjectRepository = class {
 // src/db/repositories/boards.ts
 init_cjs_shims();
 var import_drizzle_orm7 = require("drizzle-orm");
-var yaml = __toESM(require("js-yaml"), 1);
+var yaml2 = __toESM(require("js-yaml"), 1);
+
+// src/config/config-manager.ts
+init_cjs_shims();
+var import_node_fs = require("fs");
+var import_promises = __toESM(require("fs/promises"), 1);
+var import_node_os2 = __toESM(require("os"), 1);
+var import_node_path3 = __toESM(require("path"), 1);
+var import_js_yaml = __toESM(require("js-yaml"), 1);
+
+// src/config/constants.ts
+init_cjs_shims();
+var DAEMON = {
+  /**
+   * Default daemon port
+   */
+  DEFAULT_PORT: 3030,
+  /**
+   * Default daemon host
+   */
+  DEFAULT_HOST: "localhost"
+};
+
+// src/config/config-manager.ts
+function getAgorHome() {
+  return import_node_path3.default.join(import_node_os2.default.homedir(), ".agor");
+}
+function getConfigPath() {
+  return import_node_path3.default.join(getAgorHome(), "config.yaml");
+}
+function validateConfig(config) {
+  const mode = config.execution?.unix_user_mode;
+  if (mode === "opportunistic") {
+    throw new Error(
+      `Config error: 'opportunistic' unix_user_mode has been deprecated.
+Please update your config to use one of:
+  - 'insulated': Filesystem isolation via Unix groups (recommended)
+  - 'strict': Full process impersonation required
+
+To update: agor config set execution.unix_user_mode insulated`
+    );
+  }
+}
+async function loadConfig() {
+  const configPath = getConfigPath();
+  try {
+    const content = await import_promises.default.readFile(configPath, "utf-8");
+    const config = import_js_yaml.default.load(content);
+    const finalConfig = config || {};
+    validateConfig(finalConfig);
+    return finalConfig;
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return getDefaultConfig();
+    }
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function getDefaultConfig() {
+  return {
+    defaults: {
+      board: "main",
+      agent: "claude-code"
+    },
+    display: {
+      tableStyle: "unicode",
+      colorOutput: true,
+      shortIdLength: 8
+    },
+    daemon: {
+      port: DAEMON.DEFAULT_PORT,
+      host: DAEMON.DEFAULT_HOST,
+      allowAnonymous: true,
+      // Default: Allow anonymous access (local mode)
+      requireAuth: false,
+      // Default: Do not require authentication
+      mcpEnabled: true
+      // Default: Enable built-in MCP server
+    },
+    ui: {
+      port: 5173,
+      host: "localhost"
+    },
+    codex: {
+      home: "~/.agor/codex"
+    },
+    execution: {
+      session_token_expiration_ms: 864e5,
+      // 24 hours
+      session_token_max_uses: 1,
+      // Single-use tokens
+      sync_unix_passwords: true
+      // Default: sync passwords to Unix
+    }
+  };
+}
+function validateBaseUrl(url) {
+  const trimmed = url.trim().replace(/\/$/, "");
+  if (!trimmed.startsWith("http://") && !trimmed.startsWith("https://")) {
+    throw new Error(`Invalid base URL: "${url}". Must start with http:// or https://`);
+  }
+  try {
+    new URL(trimmed);
+  } catch {
+    throw new Error(`Invalid base URL format: "${url}". Must be a valid HTTP(S) URL.`);
+  }
+  return trimmed;
+}
+async function getBaseUrl() {
+  if (process.env.AGOR_BASE_URL) {
+    return validateBaseUrl(process.env.AGOR_BASE_URL);
+  }
+  const config = await loadConfig();
+  if (config.daemon?.base_url) {
+    return validateBaseUrl(config.daemon.base_url);
+  }
+  const defaults = getDefaultConfig();
+  const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
+  const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
+  const host = config.daemon?.host || defaults.daemon?.host || DAEMON.DEFAULT_HOST;
+  return `http://${host}:${port}`;
+}
+
+// src/db/repositories/boards.ts
+init_ids();
+
+// src/utils/url.ts
+init_cjs_shims();
 init_ids();
+function getSessionUrl(sessionId, boardId, boardSlug, baseUrl) {
+  if (!boardId) return null;
+  const boardParam = boardSlug || shortId(boardId);
+  return `${baseUrl}/b/${boardParam}/${shortId(sessionId)}`;
+}
+function getBoardUrl(boardId, boardSlug, baseUrl) {
+  const boardParam = boardSlug || shortId(boardId);
+  return `${baseUrl}/b/${boardParam}`;
+}
+
+// src/db/repositories/boards.ts
 init_database_wrapper();
 init_schema();
 var BoardRepository = class {
@@ -2629,16 +2781,23 @@ var BoardRepository = class {
   }
   /**
    * Convert database row to Board type
+   *
+   * @param row - Database row
+   * @param baseUrl - Base URL for generating board URLs
    */
-  rowToBoard(row) {
+  rowToBoard(row, baseUrl) {
     const data = row.data;
+    const boardId = row.board_id;
+    const slug = row.slug !== null ? row.slug : void 0;
+    const url = baseUrl ? getBoardUrl(boardId, slug, baseUrl) : "";
     return {
-      board_id: row.board_id,
+      board_id: boardId,
       name: row.name,
-      slug: row.slug !== null ? row.slug : void 0,
+      slug,
       created_at: new Date(row.created_at).toISOString(),
       last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
       created_by: row.created_by,
+      url,
       ...data
     };
   }
@@ -2718,6 +2877,7 @@ var BoardRepository = class {
   async create(data) {
     try {
       const boardId = data.board_id ?? generateId();
+      const baseUrl = await getBaseUrl();
       let finalSlug;
       if (data.slug === null) {
         finalSlug = void 0;
@@ -2740,7 +2900,7 @@ var BoardRepository = class {
       if (!row) {
         throw new RepositoryError("Failed to retrieve created board");
       }
-      return this.rowToBoard(row);
+      return this.rowToBoard(row, baseUrl);
     } catch (error) {
       if (error instanceof RepositoryError) throw error;
       throw new RepositoryError(
@@ -2755,8 +2915,9 @@ var BoardRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
+      const baseUrl = await getBaseUrl();
       const row = await select(this.db).from(boards3).where((0, import_drizzle_orm7.eq)(boards3.board_id, fullId)).one();
-      return row ? this.rowToBoard(row) : null;
+      return row ? this.rowToBoard(row, baseUrl) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
       if (error instanceof AmbiguousIdError) throw error;
@@ -2771,8 +2932,9 @@ var BoardRepository = class {
    */
   async findBySlug(slug) {
     try {
+      const baseUrl = await getBaseUrl();
       const row = await select(this.db).from(boards3).where((0, import_drizzle_orm7.eq)(boards3.slug, slug)).one();
-      return row ? this.rowToBoard(row) : null;
+      return row ? this.rowToBoard(row, baseUrl) : null;
     } catch (error) {
       throw new RepositoryError(
         `Failed to find board by slug: ${error instanceof Error ? error.message : String(error)}`,
@@ -2797,8 +2959,9 @@ var BoardRepository = class {
    */
   async findAll() {
     try {
+      const baseUrl = await getBaseUrl();
       const rows = await select(this.db).from(boards3).all();
-      return rows.map((row) => this.rowToBoard(row));
+      return rows.map((row) => this.rowToBoard(row, baseUrl));
     } catch (error) {
       throw new RepositoryError(
         `Failed to find all boards: ${error instanceof Error ? error.message : String(error)}`,
@@ -3044,7 +3207,7 @@ var BoardRepository = class {
       "# Version: 1.0",
       ""
     ].join("\n");
-    return header + yaml.dump(blob, { indent: 2, lineWidth: -1 });
+    return header + yaml2.dump(blob, { indent: 2, lineWidth: -1 });
   }
   /**
    * Import board from YAML string
@@ -3060,7 +3223,7 @@ var BoardRepository = class {
    */
   parseYamlToBlob(yamlContent) {
     try {
-      const blob = yaml.load(yamlContent, { schema: yaml.JSON_SCHEMA });
+      const blob = yaml2.load(yamlContent, { schema: yaml2.JSON_SCHEMA });
       this.validateBoardBlob(blob);
       return blob;
     } catch (error) {
@@ -3148,7 +3311,14 @@ function decryptConfig(config) {
     if (typeof decrypted[field] === "string" && decrypted[field]) {
       try {
         decrypted[field] = decryptApiKey(decrypted[field]);
-      } catch {
+      } catch (error) {
+        console.error(
+          `[gateway-channels] Failed to decrypt ${field}:`,
+          error instanceof Error ? error.message : String(error)
+        );
+        console.error(
+          "[gateway-channels] Channel credentials may be corrupted or master secret changed"
+        );
       }
     }
   }
@@ -3289,6 +3459,15 @@ var GatewayChannelRepository = class {
         throw new EntityNotFoundError("GatewayChannel", id);
       }
       const merged = { ...current, ...updates };
+      if (updates.config) {
+        const mergedConfig = { ...current.config, ...updates.config };
+        for (const field of SENSITIVE_CONFIG_FIELDS) {
+          if (!updates.config[field] && current.config[field]) {
+            mergedConfig[field] = current.config[field];
+          }
+        }
+        merged.config = mergedConfig;
+      }
       const insertData = this.channelToInsert(merged);
       await update(this.db, gatewayChannels3).set({
         name: insertData.name,
@@ -4205,11 +4384,19 @@ var SessionRepository = class {
   }
   /**
    * Convert database row to Session type
+   *
+   * @param row - Database row
+   * @param worktreeBoardId - Board ID from worktree (if JOINed)
+   * @param boardSlug - Board slug from boards table (if JOINed)
+   * @param baseUrl - Base URL for generating session URLs
    */
-  rowToSession(row) {
+  rowToSession(row, worktreeBoardId, boardSlug, baseUrl) {
     const genealogyData = row.data.genealogy || { children: [] };
+    const sessionId = row.session_id;
+    const boardId = worktreeBoardId ?? null;
+    const url = baseUrl ? getSessionUrl(sessionId, boardId, boardSlug, baseUrl) : null;
     return {
-      session_id: row.session_id,
+      session_id: sessionId,
       status: row.status,
       agentic_tool: row.agentic_tool,
       created_at: new Date(row.created_at).toISOString(),
@@ -4217,6 +4404,8 @@ var SessionRepository = class {
       created_by: row.created_by,
       unix_username: row.unix_username || null,
       worktree_id: row.worktree_id,
+      worktree_board_id: boardId,
+      url,
       ...row.data,
       tasks: row.data.tasks.map((id) => id),
       genealogy: {
@@ -4329,11 +4518,15 @@ var SessionRepository = class {
     try {
       const insertData = this.sessionToInsert(data);
       await insert(this.db, sessions3).values(insertData).run();
-      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm12.eq)(sessions3.session_id, insertData.session_id)).one();
-      if (!row) {
+      const baseUrl = await getBaseUrl();
+      const result = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where((0, import_drizzle_orm12.eq)(sessions3.session_id, insertData.session_id)).one();
+      if (!result) {
         throw new RepositoryError("Failed to retrieve created session");
       }
-      return this.rowToSession(row);
+      const sessionRow = result.sessions;
+      const boardId = result.worktrees?.board_id ?? null;
+      const boardSlug = result.boards?.slug ?? null;
+      return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
     } catch (error) {
       if (error instanceof RepositoryError) throw error;
       throw new RepositoryError(
@@ -4344,12 +4537,22 @@ var SessionRepository = class {
   }
   /**
    * Find session by ID (supports short ID)
+   *
+   * Automatically LEFT JOINs with worktrees table to populate worktree_board_id and url.
+   * This avoids N+1 queries when URL generation is needed.
    */
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm12.eq)(sessions3.session_id, fullId)).one();
-      return row ? this.rowToSession(row) : null;
+      const baseUrl = await getBaseUrl();
+      const result = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where((0, import_drizzle_orm12.eq)(sessions3.session_id, fullId)).one();
+      if (!result) {
+        return null;
+      }
+      const sessionRow = result.sessions;
+      const boardId = result.worktrees?.board_id ?? null;
+      const boardSlug = result.boards?.slug ?? null;
+      return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
       if (error instanceof AmbiguousIdError) throw error;
@@ -4361,11 +4564,21 @@ var SessionRepository = class {
   }
   /**
    * Find all sessions
+   *
+   * LEFT JOINs with worktrees to populate board_id and url in a single query.
    */
   async findAll() {
     try {
-      const rows = await select(this.db).from(sessions3).all();
-      return rows.map((row) => this.rowToSession(row));
+      const baseUrl = await getBaseUrl();
+      const results = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).all();
+      return results.map(
+        (result) => {
+          const sessionRow = result.sessions;
+          const boardId = result.worktrees?.board_id ?? null;
+          const boardSlug = result.boards?.slug ?? null;
+          return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
+        }
+      );
     } catch (error) {
       throw new RepositoryError(
         `Failed to find all sessions: ${error instanceof Error ? error.message : String(error)}`,
@@ -4375,11 +4588,21 @@ var SessionRepository = class {
   }
   /**
    * Find sessions by status
+   *
+   * LEFT JOINs with worktrees to populate board_id and url.
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm12.eq)(sessions3.status, status)).all();
-      return rows.map((row) => this.rowToSession(row));
+      const baseUrl = await getBaseUrl();
+      const results = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where((0, import_drizzle_orm12.eq)(sessions3.status, status)).all();
+      return results.map(
+        (result) => {
+          const sessionRow = result.sessions;
+          const boardId = result.worktrees?.board_id ?? null;
+          const boardSlug = result.boards?.slug ?? null;
+          return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
+        }
+      );
     } catch (error) {
       throw new RepositoryError(
         `Failed to find sessions by status: ${error instanceof Error ? error.message : String(error)}`,
@@ -4389,11 +4612,22 @@ var SessionRepository = class {
   }
   /**
    * Find sessions by board ID
+   *
+   * Uses materialized board_id column for O(1) indexed lookup.
+   * LEFT JOINs with worktrees to populate url (board_id already known from filter).
    */
   async findByBoard(boardId) {
     try {
-      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm12.eq)(sessions3.board_id, boardId)).all();
-      return rows.map((row) => this.rowToSession(row));
+      const baseUrl = await getBaseUrl();
+      const results = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where((0, import_drizzle_orm12.eq)(sessions3.board_id, boardId)).all();
+      return results.map(
+        (result) => {
+          const sessionRow = result.sessions;
+          const board_id = result.worktrees?.board_id ?? null;
+          const boardSlug = result.boards?.slug ?? null;
+          return this.rowToSession(sessionRow, board_id, boardSlug, baseUrl);
+        }
+      );
     } catch (error) {
       throw new RepositoryError(
         `Failed to find sessions by board: ${error instanceof Error ? error.message : String(error)}`,
@@ -4403,18 +4637,28 @@ var SessionRepository = class {
   }
   /**
    * Find child sessions (forked or spawned from this session)
+   *
+   * LEFT JOINs with worktrees to populate board_id and url.
    */
   async findChildren(sessionId) {
     try {
       const fullId = await this.resolveId(sessionId);
+      const baseUrl = await getBaseUrl();
       const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
-      const rows = await select(this.db).from(sessions3).where(
+      const results = await select(this.db).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where(
         (0, import_drizzle_orm12.or)(
           import_drizzle_orm12.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
           import_drizzle_orm12.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
         )
       ).all();
-      return rows.map((row) => this.rowToSession(row));
+      return results.map(
+        (result) => {
+          const sessionRow = result.sessions;
+          const boardId = result.worktrees?.board_id ?? null;
+          const boardSlug = result.boards?.slug ?? null;
+          return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
+        }
+      );
     } catch (error) {
       throw new RepositoryError(
         `Failed to find child sessions: ${error instanceof Error ? error.message : String(error)}`,
@@ -4467,14 +4711,18 @@ var SessionRepository = class {
   async update(id, updates) {
     try {
       const fullId = await this.resolveId(id);
+      const baseUrl = await getBaseUrl();
       const statusInfo = updates.status ? ` (status: ${updates.status}, ready_for_prompt: ${updates.ready_for_prompt})` : "";
       console.debug(`\u{1F504} [SessionRepo] Updating session ${fullId.substring(0, 8)}${statusInfo}`);
       const result = await this.db.transaction(async (tx) => {
-        const currentRow = await select(tx).from(sessions3).where((0, import_drizzle_orm12.eq)(sessions3.session_id, fullId)).one();
-        if (!currentRow) {
+        const currentResult = await select(tx).from(sessions3).leftJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).where((0, import_drizzle_orm12.eq)(sessions3.session_id, fullId)).one();
+        if (!currentResult) {
           throw new EntityNotFoundError("Session", id);
         }
-        const current = this.rowToSession(currentRow);
+        const currentRow = currentResult.sessions;
+        const boardId = currentResult.worktrees?.board_id ?? null;
+        const boardSlug = currentResult.boards?.slug ?? null;
+        const current = this.rowToSession(currentRow, boardId, boardSlug, baseUrl);
         const merged = deepMerge(current, updates);
         const insertData = this.sessionToInsert(merged);
         await update(tx, sessions3).set({
@@ -4541,15 +4789,18 @@ var SessionRepository = class {
    * instead of N+1. Returns sessions where user is a worktree owner OR worktree.others_can
    * allows at least 'view' access.
    *
+   * Also populates board_id and url via the worktrees JOIN.
+   *
    * NOTE: This method should only be called when RBAC is enabled. When RBAC is disabled,
    * the scopeSessionQuery hook is not registered, so default Feathers query is used
    * (which returns all sessions without filtering).
    *
    * @param userId - User ID to check access for
-   * @returns Array of accessible sessions
+   * @returns Array of accessible sessions with urls populated
    */
   async findAccessibleSessions(userId) {
-    const rows = await select(this.db, (0, import_drizzle_orm12.getTableColumns)(sessions3)).from(sessions3).innerJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(
+    const baseUrl = await getBaseUrl();
+    const results = await select(this.db).from(sessions3).innerJoin(worktrees3, (0, import_drizzle_orm12.eq)(sessions3.worktree_id, worktrees3.worktree_id)).leftJoin(boards3, (0, import_drizzle_orm12.eq)(worktrees3.board_id, boards3.board_id)).leftJoin(
       worktreeOwners3,
       (0, import_drizzle_orm12.and)(
         (0, import_drizzle_orm12.eq)(worktreeOwners3.worktree_id, worktrees3.worktree_id),
@@ -4561,7 +4812,14 @@ var SessionRepository = class {
         (0, import_drizzle_orm12.inArray)(worktrees3.others_can, ["view", "prompt", "all"])
       )
     ).all();
-    return rows.map((row) => this.rowToSession(row));
+    return results.map(
+      (result) => {
+        const sessionRow = result.sessions;
+        const boardId = result.worktrees?.board_id ?? null;
+        const boardSlug = result.boards?.slug ?? null;
+        return this.rowToSession(sessionRow, boardId, boardSlug, baseUrl);
+      }
+    );
   }
   /**
    * Enrich a single session with last assistant message
@@ -4610,7 +4868,7 @@ var SessionRepository = class {
             fullText = messageData.content.filter((block) => block.type === "text" && block.text).map((block) => block.text).join("\n");
           }
           if (fullText.length > truncationLength) {
-            fullText = fullText.substring(0, truncationLength) + "...";
+            fullText = `${fullText.substring(0, truncationLength)}...`;
           }
           lastMessageBySession.set(sessionId, fullText);
         }
@@ -5397,6 +5655,20 @@ var ThreadSessionMapRepository = class {
       );
     }
   }
+  /**
+   * Find all mappings for a worktree (for UI filtering gateway sessions)
+   */
+  async findByWorktree(worktreeId) {
+    try {
+      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm15.eq)(threadSessionMap3.worktree_id, worktreeId)).all();
+      return rows.map((row) => this.rowToMapping(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to find mappings by worktree: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
 };
 
 // src/db/repositories/users.ts
@@ -6173,7 +6445,7 @@ var WorktreeRepository = class {
             fullText = messageData.content.filter((block) => block.type === "text" && block.text).map((block) => block.text).join("\n");
           }
           if (fullText.length > truncationLength) {
-            fullText = fullText.substring(0, truncationLength) + "...";
+            fullText = `${fullText.substring(0, truncationLength)}...`;
           }
           lastMessageBySession.set(sessionId, fullText);
         }
@@ -6184,7 +6456,7 @@ var WorktreeRepository = class {
         const sessionId = row.session_id;
         let lastMessage = lastMessageBySession.get(sessionId) || "";
         if (lastMessage.length > truncationLength) {
-          lastMessage = lastMessage.substring(0, truncationLength) + "...truncated";
+          lastMessage = `${lastMessage.substring(0, truncationLength)}...truncated`;
         }
         const sessionData = row.data;
         const messageCount = sessionData?.message_count ?? 0;