agor-live 0.17.2 → 0.17.3

package/dist/core/index.js

@@ -168,6 +168,7 @@ __export(config_manager_exports, {
   getWorktreesDir: () => getWorktreesDir,
   getWorktreesDirAsync: () => getWorktreesDirAsync,
   initConfig: () => initConfig,
+  isConfigCredentialKey: () => isConfigCredentialKey,
   isUnixImpersonationEnabled: () => isUnixImpersonationEnabled,
   isWorktreeRbacEnabled: () => isWorktreeRbacEnabled,
   loadConfig: () => loadConfig,
@@ -439,6 +440,9 @@ function loadConfigSync() {
     );
   }
 }
+function isConfigCredentialKey(key) {
+  return CONFIG_CREDENTIAL_KEYS.has(key);
+}
 function getCredential(key) {
   try {
     const config = loadConfigSync();
@@ -534,7 +538,7 @@ async function getReposDirAsync() {
 async function getWorktreesDirAsync() {
   return path2.join(await getDataHomeAsync(), "worktrees");
 }
-var PublicBaseUrlNotConfiguredError;
+var PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
     "use strict";
@@ -547,6 +551,13 @@ var init_config_manager = __esm({
         this.name = "PublicBaseUrlNotConfiguredError";
       }
     };
+    CONFIG_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "ANTHROPIC_BASE_URL",
+      "OPENAI_API_KEY",
+      "GEMINI_API_KEY"
+    ]);
   }
 });
 
@@ -1234,6 +1245,8 @@ var init_task = __esm({
     "use strict";
     init_esm_shims();
     TaskStatus = {
+      QUEUED: "queued",
+      // Task created but not yet running (waiting for executor to drain queue)
       CREATED: "created",
       RUNNING: "running",
       STOPPING: "stopping",
@@ -1268,7 +1281,44 @@ function hasMinimumRole(userRole, minimumRole) {
   const normalized = normalizeRole(userRole);
   return (ROLE_RANK[normalized] ?? 0) >= ROLE_RANK[minimumRole];
 }
-var ROLES, ROLE_RANK, ENV_VAR_SCOPES_V05;
+function toAgenticToolsStatus(stored) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const flags = {};
+    for (const [field, value] of Object.entries(fields)) {
+      if (value) flags[field] = true;
+    }
+    if (Object.keys(flags).length > 0) {
+      out[tool] = flags;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function extractAgenticToolsPublicValues(stored, decrypt) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const whitelist = AGENTIC_TOOLS_PUBLIC_FIELDS[tool];
+    if (!whitelist || whitelist.length === 0) continue;
+    const plaintext = {};
+    for (const field of whitelist) {
+      const ciphertext = fields[field];
+      if (!ciphertext) continue;
+      try {
+        plaintext[field] = decrypt(ciphertext);
+      } catch {
+      }
+    }
+    if (Object.keys(plaintext).length > 0) {
+      out[tool] = plaintext;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+var ROLES, ROLE_RANK, AGENTIC_TOOLS_PUBLIC_FIELDS, ENV_VAR_SCOPES_V05;
 var init_user = __esm({
   "src/types/user.ts"() {
     "use strict";
@@ -1286,6 +1336,10 @@ var init_user = __esm({
       [ROLES.SUPERADMIN]: 3,
       owner: 3
     };
+    AGENTIC_TOOLS_PUBLIC_FIELDS = {
+      "claude-code": ["ANTHROPIC_BASE_URL"],
+      codex: ["OPENAI_BASE_URL"]
+    };
     ENV_VAR_SCOPES_V05 = ["global", "session"];
   }
 });
@@ -1492,6 +1546,7 @@ var init_schema_postgres = __esm({
         completed_at: t.timestamp("completed_at"),
         status: text("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -1503,6 +1558,8 @@ var init_schema_postgres = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer("queue_position"),
         // User attribution
         created_by: varchar("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -1512,7 +1569,12 @@ var init_schema_postgres = __esm({
       (table) => ({
         sessionIdx: index("tasks_session_idx").on(table.session_id),
         statusIdx: index("tasks_status_idx").on(table.status),
-        createdIdx: index("tasks_created_idx").on(table.created_at)
+        createdIdx: index("tasks_created_idx").on(table.created_at),
+        queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
       })
     );
     serializedSessions = pgTable(
@@ -1572,11 +1634,9 @@ var init_schema_postgres = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text("parent_tool_use_id"),
-        // Message queueing fields
-        status: text("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t.json("data").$type().notNull()
       },
@@ -1584,8 +1644,7 @@ var init_schema_postgres = __esm({
         // Indexes for efficient lookups
         sessionIdx: index("messages_session_id_idx").on(table.session_id),
         taskIdx: index("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards = pgTable(
@@ -2230,6 +2289,7 @@ var init_schema_sqlite = __esm({
         completed_at: t2.timestamp("completed_at"),
         status: text2("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -2241,6 +2301,8 @@ var init_schema_sqlite = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer2("queue_position"),
         // User attribution
         created_by: text2("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -2250,7 +2312,12 @@ var init_schema_sqlite = __esm({
       (table) => ({
         sessionIdx: index2("tasks_session_idx").on(table.session_id),
         statusIdx: index2("tasks_status_idx").on(table.status),
-        createdIdx: index2("tasks_created_idx").on(table.created_at)
+        createdIdx: index2("tasks_created_idx").on(table.created_at),
+        queueIdx: index2("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex2("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql3`${table.status} = 'queued'`)
       })
     );
     serializedSessions2 = sqliteTable(
@@ -2310,11 +2377,9 @@ var init_schema_sqlite = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text2("parent_tool_use_id"),
-        // Message queueing fields
-        status: text2("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer2("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t2.json("data").$type().notNull()
       },
@@ -2322,8 +2387,7 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: index2("messages_session_id_idx").on(table.session_id),
         taskIdx: index2("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index2("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards2 = sqliteTable(
@@ -4027,6 +4091,7 @@ var ALLOWED_ENV_VARS = /* @__PURE__ */ new Set([
   "ANTHROPIC_BASE_URL",
   "ANTHROPIC_AUTH_TOKEN",
   "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
   "GEMINI_API_KEY",
   "GOOGLE_API_KEY",
   // Vertex AI (Claude Code on GCP)
@@ -4067,7 +4132,7 @@ var AGOR_INTERNAL_ENV_VARS = /* @__PURE__ */ new Set([
 ]);
 async function resolveUserEnvironment(userId, db, options = {}) {
   const env = {};
-  const { sessionId } = options;
+  const { sessionId, tool } = options;
   try {
     const row = await select(db).from(users3).where(eq2(users3.user_id, userId)).one();
     if (row) {
@@ -4101,16 +4166,22 @@ async function resolveUserEnvironment(userId, db, options = {}) {
           console.error(`Failed to decrypt env var ${key} for user ${userId}:`, err);
         }
       }
-      const encryptedApiKeys = data.api_keys;
-      if (encryptedApiKeys) {
-        for (const [key, encryptedValue] of Object.entries(encryptedApiKeys)) {
-          try {
-            const decryptedValue = decryptApiKey(encryptedValue);
-            if (decryptedValue && decryptedValue.trim() !== "") {
-              env[key] = decryptedValue;
+      if (tool) {
+        const toolFields = data.agentic_tools?.[tool];
+        if (toolFields) {
+          for (const [key, encryptedValue] of Object.entries(toolFields)) {
+            if (!encryptedValue) continue;
+            try {
+              const decryptedValue = decryptApiKey(encryptedValue);
+              if (decryptedValue && decryptedValue.trim() !== "") {
+                env[key] = decryptedValue;
+              }
+            } catch (err) {
+              console.error(
+                `Failed to decrypt agentic_tools.${tool}.${key} for user ${userId}:`,
+                err
+              );
             }
-          } catch (err) {
-            console.error(`Failed to decrypt API key ${key} for user ${userId}:`, err);
           }
         }
       }
@@ -4148,7 +4219,7 @@ function buildAllowlistedEnv() {
   }
   return env;
 }
-async function createUserProcessEnvironment(userId, db, additionalEnv, forImpersonation = false, gatewayEnv, sessionId) {
+async function createUserProcessEnvironment(userId, db, additionalEnv, forImpersonation = false, gatewayEnv, sessionId, tool) {
   const env = buildAllowlistedEnv();
   const USER_IDENTITY_VARS = ["HOME", "USER", "LOGNAME", "SHELL"];
   if (forImpersonation) {
@@ -4166,7 +4237,7 @@ async function createUserProcessEnvironment(userId, db, additionalEnv, forImpers
     }
   }
   if (userId && db) {
-    const userEnv = await resolveUserEnvironment(userId, db, { sessionId });
+    const userEnv = await resolveUserEnvironment(userId, db, { sessionId, tool });
     for (const [key, value] of Object.entries(userEnv)) {
       if (value && value.trim() !== "") {
         env[key] = value;
@@ -7237,8 +7308,6 @@ var MessagesRepository = class {
       content: row.data.content,
       tool_uses: row.data.tool_uses,
       parent_tool_use_id: row.parent_tool_use_id || void 0,
-      status: row.status,
-      queue_position: row.queue_position ?? void 0,
       metadata: row.data.metadata
     };
   }
@@ -7257,8 +7326,6 @@ var MessagesRepository = class {
       timestamp: new Date(message.timestamp),
       content_preview: message.content_preview,
       parent_tool_use_id: message.parent_tool_use_id || null,
-      status: message.status || null,
-      queue_position: message.queue_position ?? null,
       data: {
         content: message.content,
         tool_uses: message.tool_uses,
@@ -7357,68 +7424,6 @@ var MessagesRepository = class {
   async delete(messageId) {
     await deleteFrom(this.db, messages3).where(eq12(messages3.message_id, messageId)).run();
   }
-  /**
-   * Create a queued message
-   * NOTE: Queued messages always store prompt as string content
-   * This ensures compatibility with prompt execution endpoint
-   *
-   * @param sessionId - Session to queue message for
-   * @param prompt - Message content (string)
-   * @param metadata - Optional metadata (e.g., is_agor_callback, source, child_session_id)
-   */
-  async createQueued(sessionId, prompt, metadata) {
-    if (!prompt || typeof prompt !== "string") {
-      throw new Error("Prompt must be a non-empty string");
-    }
-    const { generateId: generateId2 } = await Promise.resolve().then(() => (init_ids(), ids_exports));
-    const result = await select(this.db).from(messages3).where(and7(eq12(messages3.session_id, sessionId), eq12(messages3.status, "queued"))).all();
-    const maxPosition = result.reduce(
-      (max, row) => Math.max(max, row.queue_position || 0),
-      0
-    );
-    const nextPosition = maxPosition + 1;
-    const messageType = metadata?.is_agor_callback ? "system" : "user";
-    const message = {
-      message_id: generateId2(),
-      session_id: sessionId,
-      type: messageType,
-      role: "user",
-      // Always 'user' for right-side positioning
-      index: -1,
-      // Not in conversation yet
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      content_preview: prompt.substring(0, 200),
-      content: prompt,
-      // Always string for queued messages
-      status: "queued",
-      queue_position: nextPosition,
-      task_id: void 0,
-      metadata
-      // Include metadata (is_agor_callback, source, child_session_id, etc.)
-    };
-    return this.create(message);
-  }
-  /**
-   * Find queued messages for a session
-   */
-  async findQueued(sessionId) {
-    const { asc: asc2 } = await import("drizzle-orm");
-    const rows = await select(this.db).from(messages3).where(and7(eq12(messages3.session_id, sessionId), eq12(messages3.status, "queued"))).orderBy(asc2(messages3.queue_position)).all();
-    return rows.map((r) => this.rowToMessage(r));
-  }
-  /**
-   * Get next queued message
-   */
-  async getNextQueued(sessionId) {
-    const queued = await this.findQueued(sessionId);
-    return queued[0] || null;
-  }
-  /**
-   * Delete queued message (when processing or user cancels)
-   */
-  async deleteQueued(messageId) {
-    await this.delete(messageId);
-  }
 };
 
 // src/db/repositories/repos.ts
@@ -7945,7 +7950,7 @@ init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and9, desc as desc2, eq as eq15, inArray as inArray2, isNotNull as isNotNull2, isNull as isNull2, like as like9, or as or3, sql as sql7 } from "drizzle-orm";
+import { and as and9, desc as desc2, eq as eq15, inArray as inArray2, isNotNull as isNotNull2, like as like9, or as or3, sql as sql7 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 var SessionRepository = class {
@@ -8431,14 +8436,7 @@ var SessionRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where(
-          and9(
-            eq15(messagesTable.session_id, sessionId),
-            eq15(messagesTable.role, "assistant"),
-            isNull2(messagesTable.status)
-            // Exclude queued messages
-          )
-        );
+        }).from(messagesTable).where(and9(eq15(messagesTable.session_id, sessionId), eq15(messagesTable.role, "assistant")));
         const lastMessage = await query.orderBy(desc2(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
@@ -8726,6 +8724,7 @@ var TaskRepository = class {
       task_id: row.task_id,
       session_id: row.session_id,
       status: row.status,
+      queue_position: row.queue_position ?? void 0,
       created_at: new Date(row.created_at).toISOString(),
       completed_at: row.completed_at ? new Date(row.completed_at).toISOString() : void 0,
       created_by: row.created_by,
@@ -8753,11 +8752,11 @@ var TaskRepository = class {
       // Always use server timestamp, ignore client-provided value
       completed_at: task.completed_at ? new Date(task.completed_at) : void 0,
       status: task.status ?? TaskStatus.CREATED,
+      queue_position: task.queue_position ?? null,
       created_by: task.created_by ?? "anonymous",
       session_md5: task.session_md5 ?? null,
       data: {
-        description: task.description ?? "",
-        full_prompt: task.full_prompt ?? task.description ?? "",
+        full_prompt: task.full_prompt ?? "",
         message_range: task.message_range ?? {
           start_index: 0,
           end_index: 0,
@@ -8779,8 +8778,10 @@ var TaskRepository = class {
         computed_context_window: task.computed_context_window,
         // Cumulative context window (computed by tool.computeContextWindow())
         report: task.report,
-        permission_request: task.permission_request
+        permission_request: task.permission_request,
         // Permission state for UI approval flow
+        metadata: task.metadata
+        // Generic metadata bag (e.g., is_agor_callback, source)
       }
     };
   }
@@ -8907,7 +8908,12 @@ var TaskRepository = class {
   }
   /**
    * Find orphaned tasks (running, stopping, awaiting permission, or awaiting input)
-   * These are tasks that were interrupted when daemon stopped
+   * These are tasks that were interrupted when daemon stopped.
+   *
+   * NOTE: QUEUED tasks are intentionally NOT considered orphans — they were
+   * never spawned, so they have no executor to recover. The startup queue
+   * drainer (see register-routes.ts processNextQueuedTask) picks them up
+   * once any session goes idle. See never-lose-prompt §C.
    */
   async findOrphaned() {
     try {
@@ -8959,6 +8965,7 @@ var TaskRepository = class {
         const insertData = this.taskToInsert(merged);
         await update(txAsDb(tx), tasks3).set({
           status: insertData.status,
+          queue_position: insertData.queue_position,
           completed_at: insertData.completed_at,
           session_md5: insertData.session_md5,
           data: insertData.data
@@ -8993,6 +9000,92 @@ var TaskRepository = class {
       );
     }
   }
+  /**
+   * Create a pending task — either CREATED (will spawn immediately) or
+   * QUEUED (will drain later) — owning the sentinel defaults that the
+   * caller would otherwise have to assemble by hand.
+   *
+   * For QUEUED tasks, `queue_position = max(queue_position) + 1` is computed
+   * inside a transaction so concurrent writers don't both observe the same
+   * max and collide. (The schema also carries a partial unique index on
+   * `(session_id, queue_position) WHERE status='queued'` as a belt-and-
+   * suspenders against transaction-isolation surprises.)
+   *
+   * Sentinel contract: while a task carries `message_range.start_index = -1`
+   * and `git_state.sha_at_start = ''`, it has not yet been pinned to real
+   * conversation/git state. spawnTaskExecutor is the sole place that
+   * overwrites these on the way to RUNNING.
+   */
+  async createPending(input) {
+    const taskBase = {
+      session_id: input.session_id,
+      full_prompt: input.full_prompt,
+      created_by: input.created_by,
+      status: input.status,
+      metadata: input.metadata,
+      // Sentinels — overwritten by spawnTaskExecutor at the status → RUNNING
+      // transition. While `start_index === -1` / `sha_at_start === ''`, the
+      // task is intentionally unpinned.
+      message_range: {
+        start_index: -1,
+        end_index: -1,
+        start_timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      },
+      git_state: {
+        ref_at_start: "",
+        sha_at_start: ""
+      },
+      tool_use_count: 0
+    };
+    if (input.status === TaskStatus.CREATED) {
+      return this.create(taskBase);
+    }
+    return this.db.transaction(async (tx) => {
+      const positionRow = await select(txAsDb(tx), {
+        maxPos: sql8`max(${tasks3.queue_position})`
+      }).from(tasks3).where(sql8`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
+      const nextPosition = (positionRow?.maxPos ?? 0) + 1;
+      const insertData = this.taskToInsert({
+        ...taskBase,
+        queue_position: nextPosition
+      });
+      await insert(txAsDb(tx), tasks3).values(insertData).run();
+      const row = await select(txAsDb(tx)).from(tasks3).where(eq17(tasks3.task_id, insertData.task_id)).one();
+      if (!row) {
+        throw new RepositoryError("Failed to retrieve created queued task");
+      }
+      return this.rowToTask(row);
+    });
+  }
+  /**
+   * Find all QUEUED tasks for a session, ordered by queue_position ascending.
+   */
+  async findQueued(sessionId) {
+    try {
+      const rows = await select(this.db).from(tasks3).where(sql8`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
+      return rows.map((row) => this.rowToTask(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to find queued tasks: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /**
+   * Return the next QUEUED task to drain (lowest queue_position) for a session,
+   * or null if none.
+   */
+  async getNextQueued(sessionId) {
+    try {
+      const row = await select(this.db).from(tasks3).where(sql8`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
+      return row ? this.rowToTask(row) : null;
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to get next queued task: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Count tasks for a session
    */
@@ -9393,7 +9486,7 @@ var UserApiKeysRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and13, eq as eq20, isNull as isNull3 } from "drizzle-orm";
+import { and as and13, eq as eq20, isNull as isNull2 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -9409,7 +9502,7 @@ function rowToToken(row) {
 }
 function matchKey(userId, serverId) {
   return and13(
-    userId === null ? isNull3(userMcpOauthTokens3.user_id) : eq20(userMcpOauthTokens3.user_id, userId),
+    userId === null ? isNull2(userMcpOauthTokens3.user_id) : eq20(userMcpOauthTokens3.user_id, userId),
     eq20(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
@@ -9561,6 +9654,7 @@ var UserMCPOAuthTokenRepository = class {
 
 // src/db/repositories/users.ts
 init_esm_shims();
+init_types();
 import { eq as eq21, like as like12 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
@@ -9570,8 +9664,9 @@ var UsersRepository = class {
     this.db = db;
   }
   /**
-   * Convert database row to User type
-   * Note: Converts encrypted API keys (strings) to boolean flags for API exposure
+   * Convert database row to User type.
+   * Converts the encrypted `agentic_tools` blob to a boolean presence DTO so
+   * decrypted credentials never leave this repository.
    */
   rowToUser(row) {
     return {
@@ -9587,13 +9682,8 @@ var UsersRepository = class {
       must_change_password: row.must_change_password,
       avatar: row.data.avatar,
       preferences: row.data.preferences,
-      // Convert encrypted keys to boolean flags (true = key exists, false/undefined = no key)
-      api_keys: row.data.api_keys ? {
-        ANTHROPIC_API_KEY: !!row.data.api_keys.ANTHROPIC_API_KEY,
-        OPENAI_API_KEY: !!row.data.api_keys.OPENAI_API_KEY,
-        GEMINI_API_KEY: !!row.data.api_keys.GEMINI_API_KEY,
-        COPILOT_GITHUB_TOKEN: !!row.data.api_keys.COPILOT_GITHUB_TOKEN
-      } : void 0,
+      // Convert encrypted per-tool credential blobs into boolean presence flags.
+      agentic_tools: toAgenticToolsStatus(row.data.agentic_tools),
       // Convert stored env vars to presence + scope metadata (never exposes secrets).
       // Handles both legacy string form and v0.5 object form via normalizeStoredEnvMap.
       // The schema stores `scope` as a generic string (no SQL CHECK constraint); the
@@ -9637,10 +9727,17 @@ var UsersRepository = class {
       data: {
         avatar: user.avatar,
         preferences: user.preferences,
-        // Use raw API keys if provided (for internal operations like setApiKey)
-        api_keys: user.api_keys_raw,
-        env_vars: void 0,
-        // Not implemented yet
+        // Encrypted per-tool credentials. Only forwarded when caller passes the
+        // raw shape (internal credential mutators); regular updates leave it undefined,
+        // letting the merge in `update()` reuse the existing on-disk blob.
+        // Cast: schema declares `opencode: Record<string, never>` (no fields by
+        // contract); StoredAgenticTools widens that to string values for shape
+        // uniformity. Runtime never writes opencode, so the cast is safe.
+        agentic_tools: user.agentic_tools_raw,
+        // Same pass-through as agentic_tools: env_vars are encrypted blobs
+        // not represented on the public DTO. `update()` threads the raw value
+        // from the existing row so a generic field update doesn't wipe them.
+        env_vars: user.env_vars_raw,
         default_agentic_config: user.default_agentic_config
       }
     };
@@ -9752,7 +9849,14 @@ var UsersRepository = class {
         );
       }
     }
+    const rawRow = await this.getRawRow(fullId);
     const merged = { ...current, ...updates };
+    if (rawRow?.data.agentic_tools) {
+      merged.agentic_tools_raw = rawRow.data.agentic_tools;
+    }
+    if (rawRow?.data.env_vars) {
+      merged.env_vars_raw = rawRow.data.env_vars;
+    }
     const insertData = this.userToInsert(merged);
     await update(this.db, users3).set({
       ...insertData,
@@ -9787,96 +9891,103 @@ var UsersRepository = class {
     }
   }
   /**
-   * Get decrypted API key for a user and service
+   * Get the full decrypted credential bag for a single agentic tool.
    *
-   * @param userId - User ID
-   * @param service - Service name ('anthropic', 'openai', 'gemini')
-   * @returns Decrypted API key or null if not found
+   * Returns `null` when the user has no stored config for that tool.
+   * Fields that fail to decrypt are dropped from the returned object and
+   * logged — callers see "missing field" rather than a thrown error so a
+   * single corrupt value doesn't poison an entire SDK spawn.
    */
-  async getApiKey(userId, service) {
+  async getToolConfig(userId, tool) {
     const row = await this.getRawRow(userId);
-    if (!row || !row.data.api_keys) {
-      return null;
-    }
-    const keyMap = {
-      anthropic: "ANTHROPIC_API_KEY",
-      openai: "OPENAI_API_KEY",
-      gemini: "GEMINI_API_KEY",
-      copilot: "COPILOT_GITHUB_TOKEN"
-    };
-    const encryptedKey = row.data.api_keys[keyMap[service]];
-    if (!encryptedKey) {
-      return null;
+    if (!row) return null;
+    const stored = row.data.agentic_tools;
+    const fields = stored?.[tool];
+    if (!fields || Object.keys(fields).length === 0) return null;
+    const out = {};
+    for (const [field, encrypted] of Object.entries(fields)) {
+      if (!encrypted) continue;
+      try {
+        out[field] = decryptApiKey(encrypted);
+      } catch (error) {
+        console.error(
+          `[users] Failed to decrypt ${tool}.${field} for user ${userId.substring(0, 8)}: ${error.message}`
+        );
+      }
     }
+    return Object.keys(out).length > 0 ? out : null;
+  }
+  /**
+   * Get a single decrypted credential field for a tool.
+   *
+   * Returns `null` when the field is unset OR when decryption fails (logged).
+   * Throws only on storage-layer errors, not on missing/corrupt values.
+   */
+  async getToolConfigField(userId, tool, field) {
+    const row = await this.getRawRow(userId);
+    if (!row) return null;
+    const stored = row.data.agentic_tools;
+    const encrypted = stored?.[tool]?.[field];
+    if (!encrypted) return null;
     try {
-      return decryptApiKey(encryptedKey);
+      return decryptApiKey(encrypted);
     } catch (error) {
-      throw new RepositoryError(`Failed to decrypt API key for service ${service}`, error);
+      console.error(
+        `[users] Failed to decrypt ${tool}.${field} for user ${userId.substring(0, 8)}: ${error.message}`
+      );
+      return null;
     }
   }
   /**
-   * Set encrypted API key for a user and service
+   * Set (encrypt + persist) a single credential field for a tool.
    *
-   * @param userId - User ID
-   * @param service - Service name ('anthropic', 'openai', 'gemini')
-   * @param apiKey - Plaintext API key to encrypt and store
+   * Field names are env-var-shaped (e.g. ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL)
+   * and are stored encrypted regardless of whether the value is a secret —
+   * keeping the on-disk shape uniform avoids decrypt-vs-plain branching at
+   * read time. UI controls own the text-vs-password rendering distinction.
    */
-  async setApiKey(userId, service, apiKey) {
+  async setToolConfigField(userId, tool, field, value) {
     const fullId = await this.resolveId(userId);
     const row = await this.getRawRow(fullId);
     if (!row) {
       throw new EntityNotFoundError("User", userId);
     }
-    const keyMap = {
-      anthropic: "ANTHROPIC_API_KEY",
-      openai: "OPENAI_API_KEY",
-      gemini: "GEMINI_API_KEY",
-      copilot: "COPILOT_GITHUB_TOKEN"
-    };
-    const encryptedKey = encryptApiKey(apiKey);
-    const updatedApiKeys = {
-      ...row.data.api_keys || {},
-      [keyMap[service]]: encryptedKey
-    };
-    const user = this.rowToUser(row);
-    const updateData = {
-      ...user,
-      api_keys_raw: updatedApiKeys
+    const stored = row.data.agentic_tools ?? {};
+    const next = {
+      ...stored,
+      [tool]: {
+        ...stored[tool] ?? {},
+        [field]: encryptApiKey(value)
+      }
     };
-    const insertData = this.userToInsert(updateData);
     await update(this.db, users3).set({
-      ...insertData,
+      data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
     }).where(eq21(users3.user_id, fullId)).run();
   }
   /**
-   * Delete API key for a user and service
+   * Delete a single credential field for a tool.
    *
-   * @param userId - User ID
-   * @param service - Service name ('anthropic', 'openai', 'gemini')
+   * If the tool's bucket becomes empty after the delete, the bucket itself is
+   * removed so `data.agentic_tools` doesn't accumulate empty objects.
    */
-  async deleteApiKey(userId, service) {
+  async deleteToolConfigField(userId, tool, field) {
     const fullId = await this.resolveId(userId);
     const row = await this.getRawRow(fullId);
     if (!row) {
       throw new EntityNotFoundError("User", userId);
     }
-    const keyMap = {
-      anthropic: "ANTHROPIC_API_KEY",
-      openai: "OPENAI_API_KEY",
-      gemini: "GEMINI_API_KEY",
-      copilot: "COPILOT_GITHUB_TOKEN"
-    };
-    const updatedApiKeys = { ...row.data.api_keys || {} };
-    delete updatedApiKeys[keyMap[service]];
-    const user = this.rowToUser(row);
-    const updateData = {
-      ...user,
-      api_keys_raw: updatedApiKeys
-    };
-    const insertData = this.userToInsert(updateData);
+    const stored = row.data.agentic_tools ?? {};
+    const toolFields = { ...stored[tool] ?? {} };
+    delete toolFields[field];
+    const next = { ...stored };
+    if (Object.keys(toolFields).length > 0) {
+      next[tool] = toolFields;
+    } else {
+      delete next[tool];
+    }
     await update(this.db, users3).set({
-      ...insertData,
+      data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
     }).where(eq21(users3.user_id, fullId)).run();
   }
@@ -9888,18 +9999,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import {
-  and as and14,
-  desc as desc3,
-  eq as eq22,
-  getTableColumns,
-  inArray as inArray3,
-  isNotNull as isNotNull3,
-  isNull as isNull4,
-  like as like13,
-  or as or4,
-  sql as sql9
-} from "drizzle-orm";
+import { and as and14, desc as desc3, eq as eq22, getTableColumns, inArray as inArray3, isNotNull as isNotNull3, like as like13, or as or4, sql as sql9 } from "drizzle-orm";
 var WorktreeRepository = class {
   constructor(db) {
     this.db = db;
@@ -10427,14 +10527,7 @@ var WorktreeRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where(
-          and14(
-            eq22(messagesTable.session_id, sessionId),
-            eq22(messagesTable.role, "assistant"),
-            isNull4(messagesTable.status)
-            // Exclude queued messages
-          )
-        );
+        }).from(messagesTable).where(and14(eq22(messagesTable.session_id, sessionId), eq22(messagesTable.role, "assistant")));
         const lastMessage = await query.orderBy(desc3(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
@@ -10626,7 +10719,18 @@ async function resolveApiKey(keyName, context = {}) {
     const row = await select(context.db).from(users3).where(eq24(users3.user_id, context.userId)).one();
     if (row) {
       const data = row.data;
-      const encryptedKey = data.api_keys?.[keyName];
+      let encryptedKey;
+      const tools = data.agentic_tools ?? {};
+      if (context.tool) {
+        encryptedKey = tools[context.tool]?.[keyName];
+      } else {
+        for (const fields of Object.values(tools)) {
+          if (fields?.[keyName]) {
+            encryptedKey = fields[keyName];
+            break;
+          }
+        }
+      }
       if (encryptedKey) {
         try {
           const decryptedKey = decryptApiKey(encryptedKey);
@@ -10651,12 +10755,13 @@ async function resolveApiKey(keyName, context = {}) {
   } else if (!context.db) {
     console.log(`   \u2192 Skipping user-level check (no database connection)`);
   }
-  console.log(`   \u2192 Checking app-level configuration (config.yaml)...`);
-  const globalKey = getCredential(keyName);
-  if (globalKey && globalKey.length > 0) {
-    console.log(`   \u2713 Found app-level API key for ${keyName} (from config.yaml)`);
-    return { apiKey: globalKey, source: "config", useNativeAuth: false };
-  } else {
+  if (isConfigCredentialKey(keyName)) {
+    console.log(`   \u2192 Checking app-level configuration (config.yaml)...`);
+    const globalKey = getCredential(keyName);
+    if (globalKey && globalKey.length > 0) {
+      console.log(`   \u2713 Found app-level API key for ${keyName} (from config.yaml)`);
+      return { apiKey: globalKey, source: "config", useNativeAuth: false };
+    }
     console.log(`   \u2717 No app-level API key for ${keyName}`);
   }
   console.log(`   \u2192 Checking OS-level environment variables...`);
@@ -10664,16 +10769,17 @@ async function resolveApiKey(keyName, context = {}) {
   if (envKey && envKey.length > 0) {
     console.log(`   \u2713 Found OS-level environment variable ${keyName}`);
     return { apiKey: envKey, source: "env", useNativeAuth: false };
-  } else {
-    console.log(`   \u2717 No OS-level environment variable ${keyName}`);
   }
+  console.log(`   \u2717 No OS-level environment variable ${keyName}`);
   console.log(`   \u2139\uFE0F  No API key found for ${keyName} - SDK will use native authentication`);
   return { apiKey: void 0, source: "none", useNativeAuth: true };
 }
 function resolveApiKeySync(keyName) {
-  const globalKey = getCredential(keyName);
-  if (globalKey && globalKey.length > 0) {
-    return { apiKey: globalKey, source: "config", useNativeAuth: false };
+  if (isConfigCredentialKey(keyName)) {
+    const globalKey = getCredential(keyName);
+    if (globalKey && globalKey.length > 0) {
+      return { apiKey: globalKey, source: "config", useNativeAuth: false };
+    }
   }
   const envKey = process.env[keyName];
   if (envKey && envKey.length > 0) {
@@ -12109,6 +12215,152 @@ function resolveMcpServersTemplates(servers, context) {
   return servers.map((server) => resolveMcpServerTemplates(server, context));
 }
 
+// src/sessions/index.ts
+init_esm_shims();
+
+// src/sessions/resolve-session-defaults.ts
+init_esm_shims();
+
+// src/models/resolve-config.ts
+init_esm_shims();
+function resolveModelConfig(input, opts) {
+  if (!input?.model) return void 0;
+  return {
+    mode: input.mode ?? "alias",
+    model: input.model,
+    updated_at: (opts?.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    ...input.effort !== void 0 && { effort: input.effort },
+    ...input.provider !== void 0 && { provider: input.provider }
+  };
+}
+
+// src/sessions/resolve-session-defaults.ts
+init_session();
+
+// src/utils/permission-mode-mapper.ts
+init_esm_shims();
+function mapPermissionMode(mode, agenticTool) {
+  switch (agenticTool) {
+    case "claude-code":
+    case "copilot":
+      switch (mode) {
+        // Native Claude modes - pass through
+        case "default":
+        case "acceptEdits":
+        case "bypassPermissions":
+        case "plan":
+        case "dontAsk":
+          return mode;
+        // Gemini modes → Claude equivalents
+        case "autoEdit":
+          return "acceptEdits";
+        case "yolo":
+          return "bypassPermissions";
+        // Codex modes → Claude equivalents
+        case "ask":
+          return "default";
+        case "auto":
+          return "acceptEdits";
+        case "on-failure":
+          return "acceptEdits";
+        case "allow-all":
+          return "bypassPermissions";
+        default:
+          return "acceptEdits";
+      }
+    case "gemini":
+    case "opencode":
+      switch (mode) {
+        // Native Gemini modes - pass through
+        case "default":
+        case "autoEdit":
+        case "yolo":
+          return mode;
+        // Claude modes → Gemini equivalents
+        case "acceptEdits":
+          return "autoEdit";
+        case "bypassPermissions":
+        case "dontAsk":
+          return "yolo";
+        case "plan":
+          return "default";
+        // Plan mode → restrictive
+        // Codex modes → Gemini equivalents
+        case "ask":
+          return "default";
+        case "auto":
+          return "autoEdit";
+        case "on-failure":
+          return "autoEdit";
+        case "allow-all":
+          return "yolo";
+        default:
+          return "autoEdit";
+      }
+    case "codex":
+      switch (mode) {
+        // Native Codex modes - pass through
+        case "ask":
+        case "auto":
+        case "on-failure":
+        case "allow-all":
+          return mode;
+        // Claude modes → Codex equivalents
+        case "default":
+          return "ask";
+        case "acceptEdits":
+          return "auto";
+        case "bypassPermissions":
+        case "dontAsk":
+          return "allow-all";
+        case "plan":
+          return "ask";
+        // Gemini modes → Codex equivalents
+        case "autoEdit":
+          return "auto";
+        case "yolo":
+          return "allow-all";
+        default:
+          return "auto";
+      }
+    default:
+      return mode;
+  }
+}
+
+// src/sessions/resolve-session-defaults.ts
+function resolveSessionDefaults(args) {
+  const { agenticTool, user, worktree, overrides, now } = args;
+  const userToolDefaults = user?.default_agentic_config?.[agenticTool];
+  const requestedMode = overrides?.permissionMode ?? userToolDefaults?.permissionMode ?? getDefaultPermissionMode(agenticTool);
+  const permissionMode = mapPermissionMode(requestedMode, agenticTool);
+  const permission_config = {
+    mode: permissionMode
+  };
+  if (agenticTool === "codex") {
+    const sandboxMode = overrides?.codexSandboxMode ?? userToolDefaults?.codexSandboxMode;
+    const approvalPolicy = overrides?.codexApprovalPolicy ?? userToolDefaults?.codexApprovalPolicy;
+    const networkAccess = overrides?.codexNetworkAccess ?? userToolDefaults?.codexNetworkAccess;
+    if (sandboxMode && approvalPolicy) {
+      permission_config.codex = {
+        sandboxMode,
+        approvalPolicy,
+        ...networkAccess !== void 0 && { networkAccess }
+      };
+    }
+  }
+  const model_config = resolveModelConfig(overrides?.modelConfig, { now }) ?? resolveModelConfig(userToolDefaults?.modelConfig, { now });
+  let mcp_server_ids;
+  if (overrides?.mcpServerIds !== void 0) {
+    mcp_server_ids = overrides.mcpServerIds;
+  } else if (worktree?.mcp_server_ids && worktree.mcp_server_ids.length > 0) {
+    mcp_server_ids = worktree.mcp_server_ids;
+  } else {
+    mcp_server_ids = userToolDefaults?.mcpServerIds ?? [];
+  }
+  return { permission_config, model_config, mcp_server_ids };
+}
+
 // src/index.ts
 init_types();
 
@@ -14707,6 +14959,7 @@ function unpatchConsole() {
   }
 }
 export {
+  AGENTIC_TOOLS_PUBLIC_FIELDS,
   AGENTIC_TOOL_CAPABILITIES,
   AGOR_DEFAULT_SHELL,
   AGOR_HOME_BASE,
@@ -14857,6 +15110,7 @@ export {
   executeRaw,
   executeRun,
   expandHomePath,
+  extractAgenticToolsPublicValues,
   extractRepoName,
   extractSlugFromUrl,
   filterEnv,
@@ -14935,6 +15189,7 @@ export {
   isAssistant,
   isAutoGeneratedUsername,
   isClean,
+  isConfigCredentialKey,
   isDaemonRunning,
   isDefined,
   isEncrypted,
@@ -15012,6 +15267,7 @@ export {
   resolvePassword,
   resolveRepoReference,
   resolveSecurity,
+  resolveSessionDefaults,
   resolveShortId,
   resolveSystemEnvironment,
   resolveUnixUserForImpersonation,
@@ -15038,6 +15294,7 @@ export {
   sql10 as sql,
   tasks3 as tasks,
   threadSessionMap3 as threadSessionMap,
+  toAgenticToolsStatus,
   toShortId,
   tryUnlinkEnvFile,
   tryUnlinkEnvFileAsUser,