agor-live 0.17.2 → 0.17.3

package/dist/core/tools/mcp/oauth-refresh.js

@@ -28,25 +28,6 @@ var init_id = __esm({
   }
 });
 
-// src/lib/ids.ts
-import { v7 as uuidv7 } from "uuid";
-function generateId() {
-  return uuidv7();
-}
-function shortId(uuid, length = 8) {
-  return toShortId(uuid, length);
-}
-function formatShortId(uuid, length = 8) {
-  return shortId(uuid, length);
-}
-var init_ids = __esm({
-  "src/lib/ids.ts"() {
-    "use strict";
-    init_esm_shims();
-    init_id();
-  }
-});
-
 // src/db/database-wrapper.ts
 import { sql } from "drizzle-orm";
 function isSQLiteDatabase(db) {
@@ -511,6 +492,7 @@ var init_schema_postgres = __esm({
         completed_at: t.timestamp("completed_at"),
         status: text("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -522,6 +504,8 @@ var init_schema_postgres = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer("queue_position"),
         // User attribution
         created_by: varchar("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -531,7 +515,12 @@ var init_schema_postgres = __esm({
       (table) => ({
         sessionIdx: index("tasks_session_idx").on(table.session_id),
         statusIdx: index("tasks_status_idx").on(table.status),
-        createdIdx: index("tasks_created_idx").on(table.created_at)
+        createdIdx: index("tasks_created_idx").on(table.created_at),
+        queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
       })
     );
     serializedSessions = pgTable(
@@ -591,11 +580,9 @@ var init_schema_postgres = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text("parent_tool_use_id"),
-        // Message queueing fields
-        status: text("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t.json("data").$type().notNull()
       },
@@ -603,8 +590,7 @@ var init_schema_postgres = __esm({
         // Indexes for efficient lookups
         sessionIdx: index("messages_session_id_idx").on(table.session_id),
         taskIdx: index("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards = pgTable(
@@ -1249,6 +1235,7 @@ var init_schema_sqlite = __esm({
         completed_at: t2.timestamp("completed_at"),
         status: text2("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -1260,6 +1247,8 @@ var init_schema_sqlite = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer2("queue_position"),
         // User attribution
         created_by: text2("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -1269,7 +1258,12 @@ var init_schema_sqlite = __esm({
       (table) => ({
         sessionIdx: index2("tasks_session_idx").on(table.session_id),
         statusIdx: index2("tasks_status_idx").on(table.status),
-        createdIdx: index2("tasks_created_idx").on(table.created_at)
+        createdIdx: index2("tasks_created_idx").on(table.created_at),
+        queueIdx: index2("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex2("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql3`${table.status} = 'queued'`)
       })
     );
     serializedSessions2 = sqliteTable(
@@ -1329,11 +1323,9 @@ var init_schema_sqlite = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text2("parent_tool_use_id"),
-        // Message queueing fields
-        status: text2("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer2("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t2.json("data").$type().notNull()
       },
@@ -1341,8 +1333,7 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: index2("messages_session_id_idx").on(table.session_id),
         taskIdx: index2("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index2("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards2 = sqliteTable(
@@ -2052,10 +2043,25 @@ init_esm_shims();
 
 // src/db/repositories/artifacts.ts
 init_esm_shims();
-init_ids();
+import { and, eq, like, or } from "drizzle-orm";
+
+// src/lib/ids.ts
+init_esm_shims();
+init_id();
+import { v7 as uuidv7 } from "uuid";
+function generateId() {
+  return uuidv7();
+}
+function shortId(uuid, length = 8) {
+  return toShortId(uuid, length);
+}
+function formatShortId(uuid, length = 8) {
+  return shortId(uuid, length);
+}
+
+// src/db/repositories/artifacts.ts
 init_database_wrapper();
 init_schema();
-import { and, eq, like, or } from "drizzle-orm";
 
 // src/db/repositories/base.ts
 init_esm_shims();
@@ -2088,14 +2094,12 @@ var AmbiguousIdError = class extends RepositoryError {
 
 // src/db/repositories/board-comments.ts
 init_esm_shims();
-init_ids();
+import { and as and2, eq as eq2, isNull, like as like2 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { and as and2, eq as eq2, isNull, like as like2 } from "drizzle-orm";
 
 // src/db/repositories/board-objects.ts
 init_esm_shims();
-init_ids();
 import { eq as eq3 } from "drizzle-orm";
 
 // src/utils/board-placement.ts
@@ -2109,7 +2113,6 @@ init_schema();
 init_esm_shims();
 init_types();
 init_config_manager();
-init_ids();
 import { and as and3, eq as eq4, exists, inArray, isNotNull, like as like3, ne, or as or2, sql as sql4 } from "drizzle-orm";
 import * as yaml2 from "js-yaml";
 
@@ -2118,7 +2121,6 @@ init_esm_shims();
 
 // src/utils/url.ts
 init_esm_shims();
-init_ids();
 
 // src/db/repositories/boards.ts
 init_database_wrapper();
@@ -2126,23 +2128,20 @@ init_schema();
 
 // src/db/repositories/card-types.ts
 init_esm_shims();
-init_ids();
+import { eq as eq5, like as like4 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { eq as eq5, like as like4 } from "drizzle-orm";
 
 // src/db/repositories/cards.ts
 init_esm_shims();
-init_ids();
+import { and as and4, eq as eq6, like as like5 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { and as and4, eq as eq6, like as like5 } from "drizzle-orm";
 
 // src/db/repositories/gateway-channels.ts
 init_esm_shims();
-init_ids();
-init_database_wrapper();
 import { eq as eq7, like as like6 } from "drizzle-orm";
+init_database_wrapper();
 
 // src/db/encryption.ts
 init_esm_shims();
@@ -2153,10 +2152,9 @@ init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
-init_ids();
+import { and as and5, eq as eq8, like as like7 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { and as and5, eq as eq8, like as like7 } from "drizzle-orm";
 var MCPServerRepository = class {
   constructor(db) {
     this.db = db;
@@ -2418,7 +2416,6 @@ var dump2 = yaml3.dump;
 var YAMLException = yaml3.YAMLException;
 
 // src/db/repositories/repos.ts
-init_ids();
 init_database_wrapper();
 init_schema();
 
@@ -2427,10 +2424,9 @@ init_esm_shims();
 
 // src/db/repositories/serialized-sessions.ts
 init_esm_shims();
-init_ids();
+import { and as and7, desc, eq as eq11, lt } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { and as and7, desc, eq as eq11, lt } from "drizzle-orm";
 
 // src/db/repositories/session-env-selections.ts
 init_esm_shims();
@@ -2448,40 +2444,36 @@ import { and as and10, eq as eq14 } from "drizzle-orm";
 init_esm_shims();
 init_types();
 init_config_manager();
-init_ids();
-import { and as and9, desc as desc2, eq as eq13, inArray as inArray2, isNotNull as isNotNull2, isNull as isNull2, like as like9, or as or3, sql as sql6 } from "drizzle-orm";
+import { and as and9, desc as desc2, eq as eq13, inArray as inArray2, isNotNull as isNotNull2, like as like9, or as or3, sql as sql6 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/tasks.ts
 init_esm_shims();
 init_types();
-init_ids();
+import { eq as eq15, like as like10, sql as sql7 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { eq as eq15, like as like10, sql as sql7 } from "drizzle-orm";
 
 // src/db/repositories/thread-session-map.ts
 init_esm_shims();
-init_ids();
+import { and as and11, eq as eq16, like as like11, lt as lt2 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import { and as and11, eq as eq16, like as like11, lt as lt2 } from "drizzle-orm";
 
 // src/db/repositories/user-api-keys.ts
 init_esm_shims();
-init_ids();
-init_database_wrapper();
-init_schema();
 import { randomBytes as randomBytes2 } from "crypto";
 import bcrypt from "bcryptjs";
 import { and as and12, eq as eq17 } from "drizzle-orm";
+init_database_wrapper();
+init_schema();
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and13, eq as eq18, isNull as isNull3 } from "drizzle-orm";
+import { and as and13, eq as eq18, isNull as isNull2 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -2497,7 +2489,7 @@ function rowToToken(row) {
 }
 function matchKey(userId, serverId) {
   return and13(
-    userId === null ? isNull3(userMcpOauthTokens3.user_id) : eq18(userMcpOauthTokens3.user_id, userId),
+    userId === null ? isNull2(userMcpOauthTokens3.user_id) : eq18(userMcpOauthTokens3.user_id, userId),
     eq18(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
@@ -2649,6 +2641,7 @@ var UserMCPOAuthTokenRepository = class {
 
 // src/db/repositories/users.ts
 init_esm_shims();
+init_types();
 import { eq as eq19, like as like12 } from "drizzle-orm";
 
 // src/config/env-vars.ts
@@ -2657,28 +2650,15 @@ var V05_SCOPES = ["global", "session"];
 var V05_SCOPE_SET = new Set(V05_SCOPES);
 
 // src/db/repositories/users.ts
-init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/worktrees.ts
 init_esm_shims();
 init_types();
-init_ids();
+import { and as and14, desc as desc3, eq as eq20, getTableColumns, inArray as inArray3, isNotNull as isNotNull3, like as like13, or as or4, sql as sql8 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
-import {
-  and as and14,
-  desc as desc3,
-  eq as eq20,
-  getTableColumns,
-  inArray as inArray3,
-  isNotNull as isNotNull3,
-  isNull as isNull4,
-  like as like13,
-  or as or4,
-  sql as sql8
-} from "drizzle-orm";
 
 // src/tools/mcp/oauth-auth.ts
 init_esm_shims();

package/dist/core/types/index.cjs

@@ -20,6 +20,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/types/index.ts
 var types_exports = {};
 __export(types_exports, {
+  AGENTIC_TOOLS_PUBLIC_FIELDS: () => AGENTIC_TOOLS_PUBLIC_FIELDS,
   AGENTIC_TOOL_CAPABILITIES: () => AGENTIC_TOOL_CAPABILITIES,
   ALLOWED_SERVICE_TIERS: () => ALLOWED_SERVICE_TIERS,
   CommentAttachmentType: () => CommentAttachmentType,
@@ -42,6 +43,7 @@ __export(types_exports, {
   URL_SHORT_ID_LENGTH: () => URL_SHORT_ID_LENGTH,
   WORKTREE_PERMISSION_LEVELS: () => WORKTREE_PERMISSION_LEVELS,
   autoPromoteDependencies: () => autoPromoteDependencies,
+  extractAgenticToolsPublicValues: () => extractAgenticToolsPublicValues,
   findByShortIdPrefix: () => findByShortIdPrefix,
   getAssistantConfig: () => getAssistantConfig,
   getCommentAttachmentType: () => getCommentAttachmentType,
@@ -65,6 +67,7 @@ __export(types_exports, {
   isServiceFullAccess: () => isServiceFullAccess,
   isThreadRoot: () => isThreadRoot,
   normalizeRole: () => normalizeRole,
+  toAgenticToolsStatus: () => toAgenticToolsStatus,
   toShortId: () => toShortId,
   validateAllowedTiers: () => validateAllowedTiers,
   validateServiceDependencies: () => validateServiceDependencies
@@ -379,6 +382,8 @@ function getSessionType(session) {
 
 // src/types/task.ts
 var TaskStatus = {
+  QUEUED: "queued",
+  // Task created but not yet running (waiting for executor to drain queue)
   CREATED: "created",
   RUNNING: "running",
   STOPPING: "stopping",
@@ -419,6 +424,47 @@ function hasMinimumRole(userRole, minimumRole) {
   const normalized = normalizeRole(userRole);
   return (ROLE_RANK[normalized] ?? 0) >= ROLE_RANK[minimumRole];
 }
+function toAgenticToolsStatus(stored) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const flags = {};
+    for (const [field, value] of Object.entries(fields)) {
+      if (value) flags[field] = true;
+    }
+    if (Object.keys(flags).length > 0) {
+      out[tool] = flags;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+var AGENTIC_TOOLS_PUBLIC_FIELDS = {
+  "claude-code": ["ANTHROPIC_BASE_URL"],
+  codex: ["OPENAI_BASE_URL"]
+};
+function extractAgenticToolsPublicValues(stored, decrypt) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const whitelist = AGENTIC_TOOLS_PUBLIC_FIELDS[tool];
+    if (!whitelist || whitelist.length === 0) continue;
+    const plaintext = {};
+    for (const field of whitelist) {
+      const ciphertext = fields[field];
+      if (!ciphertext) continue;
+      try {
+        plaintext[field] = decrypt(ciphertext);
+      } catch {
+      }
+    }
+    if (Object.keys(plaintext).length > 0) {
+      out[tool] = plaintext;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
 var ENV_VAR_SCOPES_V05 = ["global", "session"];
 
 // src/types/utils.ts
@@ -444,6 +490,7 @@ function getAssistantConfig(worktree) {
 var getPersistedAgentConfig = getAssistantConfig;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  AGENTIC_TOOLS_PUBLIC_FIELDS,
   AGENTIC_TOOL_CAPABILITIES,
   ALLOWED_SERVICE_TIERS,
   CommentAttachmentType,
@@ -466,6 +513,7 @@ var getPersistedAgentConfig = getAssistantConfig;
   URL_SHORT_ID_LENGTH,
   WORKTREE_PERMISSION_LEVELS,
   autoPromoteDependencies,
+  extractAgenticToolsPublicValues,
   findByShortIdPrefix,
   getAssistantConfig,
   getCommentAttachmentType,
@@ -489,6 +537,7 @@ var getPersistedAgentConfig = getAssistantConfig;
   isServiceFullAccess,
   isThreadRoot,
   normalizeRole,
+  toAgenticToolsStatus,
   toShortId,
   validateAllowedTiers,
   validateServiceDependencies

package/dist/core/types/index.d.cts

@@ -2,19 +2,19 @@ export { PermissionDecision, PermissionRequest } from '../permissions/index.cjs'
 export { A as AGENTIC_TOOL_CAPABILITIES, a as AgenticTool, b as AgenticToolCapabilities, c as AgenticToolName, C as ClaudeCodePermissionMode, d as CodexApprovalPolicy, e as CodexNetworkAccess, f as CodexPermissionMode, g as CodexSandboxMode, h as CopilotPermissionMode, G as GeminiPermissionMode, O as OpenCodePermissionMode } from '../agentic-tool-BulhIUGb.cjs';
 export { A as Artifact, a as ArtifactBuildStatus, b as ArtifactConsoleEntry, c as ArtifactPayload, d as ArtifactStatus, S as SandpackError, e as SandpackManifest } from '../artifact-B2AqjUMb.cjs';
 export { A as AppBoardObject, a as ArtifactBoardObject, B as Board, b as BoardEntityObject, c as BoardEntityType, d as BoardExportBlob, e as BoardObject, f as BoardObjectType, g as BoardPosition, C as Card, h as CardID, i as CardType, j as CardTypeID, k as CardWithType, M as MarkdownBoardObject, S as SandpackTemplate, T as TextBoardObject, Z as ZoneBoardObject, l as ZoneTrigger, m as ZoneTriggerBehavior } from '../board-D7SnPqp-.cjs';
-export { B as BoardComment, a as BoardCommentCreate, b as BoardCommentPatch, C as CommentAttachmentType, c as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, d as groupReactions, i as isReply, e as isResolvable, f as isThreadRoot } from '../board-comment-DIdOJrSF.cjs';
-export { A as ALLOWED_SERVICE_TIERS, D as DEFAULT_SERVICE_TIER, a as DaemonResourcesConfig, b as DaemonServicesConfig, E as EnforcedAgentConfig, R as ResourceRepoConfig, c as ResourceUserConfig, d as ResourceWorktreeConfig, S as SERVICE_DEPENDENCIES, e as SERVICE_GROUP_NAMES, f as SERVICE_GROUP_TO_MCP_DOMAINS, g as SERVICE_TIERS, h as SERVICE_TIER_RANK, i as ServiceDependencyViolation, j as ServiceGroupName, k as ServiceTier, l as ServiceTierViolation, m as autoPromoteDependencies, n as getServiceTier, o as isServiceEnabled, p as isServiceExternallyAccessible, q as isServiceFullAccess, v as validateAllowedTiers, r as validateServiceDependencies } from '../config-services-YEZ4DwCD.cjs';
+export { B as BoardComment, a as BoardCommentCreate, b as BoardCommentPatch, C as CommentAttachmentType, c as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, d as groupReactions, i as isReply, e as isResolvable, f as isThreadRoot } from '../board-comment-CCFVVN7K.cjs';
+export { A as ALLOWED_SERVICE_TIERS, D as DEFAULT_SERVICE_TIER, a as DaemonResourcesConfig, b as DaemonServicesConfig, E as EnforcedAgentConfig, R as ResourceRepoConfig, c as ResourceUserConfig, d as ResourceWorktreeConfig, S as SERVICE_DEPENDENCIES, e as SERVICE_GROUP_NAMES, f as SERVICE_GROUP_TO_MCP_DOMAINS, g as SERVICE_TIERS, h as SERVICE_TIER_RANK, i as ServiceDependencyViolation, j as ServiceGroupName, k as ServiceTier, l as ServiceTierViolation, m as autoPromoteDependencies, n as getServiceTier, o as isServiceEnabled, p as isServiceExternallyAccessible, q as isServiceFullAccess, v as validateAllowedTiers, r as validateServiceDependencies } from '../config-services-CXyQKEK5.cjs';
 export { C as ContextFileDetail, a as ContextFileListItem, b as ContextFilePath } from '../context-BpkCELpO.cjs';
 export { A as AuthenticatedParams, a as AuthenticatedUser, b as AuthenticationResult, B as BaseService, C as CreateHookContext, H as HookContext, Q as QueryParams, R as RBACParams, S as ServiceWithEvents } from '../feathers-ChZyv3Kj.cjs';
-export { C as ChannelType, G as GatewayAgenticConfig, a as GatewayChannel, b as GatewayChannelID, c as GatewayEnvVar, T as ThreadSessionMap, d as ThreadSessionMapID, e as ThreadStatus } from '../gateway-BnOlAelY.cjs';
+export { C as ChannelType, G as GatewayAgenticConfig, a as GatewayChannel, b as GatewayChannelID, c as GatewayEnvVar, T as ThreadSessionMap, d as ThreadSessionMapID, e as ThreadStatus } from '../gateway-BWq4j_Ll.cjs';
 import { B as BoardID } from '../id-CoIbY_uc.cjs';
 export { A as AgenticToolID, a as AnyShortId, b as ArtifactID, C as CommentID, I as IDPrefix, c as IdInput, M as MessageID, R as RepoID, S as SessionID, d as ShortID, T as TaskID, U as URL_SHORT_ID_LENGTH, e as UUID, f as UserID, W as WorktreeID, g as findByShortIdPrefix, t as toShortId } from '../id-CoIbY_uc.cjs';
 export { C as CreateMCPServerInput, J as JSONSchema, M as MCPAuth, a as MCPCapabilities, b as MCPConfigFile, c as MCPPrompt, d as MCPResource, e as MCPScope, f as MCPServer, g as MCPServerFilters, h as MCPServerID, i as MCPServersConfig, j as MCPSource, k as MCPTestResult, l as MCPTool, m as MCPTransport, n as MCP_TOKEN_AUDIENCE, o as MCP_TOKEN_ISSUER, P as PromptArgument, S as SessionMCPServer, T as ToolPermission, U as UpdateMCPServerInput } from '../mcp-DC7GLAg2.cjs';
-export { C as ContentBlock, D as DiffEnrichment, F as FileDiff, I as InputRequestContent, a as InputRequestOption, b as InputRequestQuestion, c as InputRequestStatus, M as Message, d as MessageCreate, e as MessageRole, f as MessageSource, g as MessageStatus, h as MessageType, P as PermissionRequestContent, i as PermissionScope, j as PermissionStatus, S as StreamingEventType, k as StructuredPatchHunk, T as ToolUse } from '../message-DinITA7a.cjs';
-import { g as User } from '../user-DkNdeFoz.cjs';
-export { A as AudioPreferences, B as BaseUserFields, C as ChimeSound, a as CreateUserInput, D as DefaultAgenticConfig, b as DefaultAgenticToolConfig, c as DefaultModelConfig, E as ENV_VAR_SCOPES_V05, d as EnvVarMetadata, e as EnvVarScope, f as EventStreamPreferences, O as OnboardingState, R as ROLES, S as SessionEnvSelection, U as UpdateUserInput, h as UserApiKey, i as UserPreferences, j as UserRole, k as hasMinimumRole, n as normalizeRole } from '../user-DkNdeFoz.cjs';
+export { C as ContentBlock, D as DiffEnrichment, F as FileDiff, I as InputRequestContent, a as InputRequestOption, b as InputRequestQuestion, c as InputRequestStatus, M as Message, d as MessageCreate, e as MessageRole, f as MessageSource, g as MessageType, P as PermissionRequestContent, h as PermissionScope, i as PermissionStatus, S as StreamingEventType, j as StructuredPatchHunk, T as ToolUse } from '../message-CSWOsdcZ.cjs';
+import { q as User } from '../user-CpfkcV2C.cjs';
+export { A as AGENTIC_TOOLS_PUBLIC_FIELDS, a as AgenticToolConfigField, b as AgenticToolsConfig, c as AgenticToolsPublicValues, d as AgenticToolsStatus, e as AgenticToolsUpdate, f as AudioPreferences, B as BaseUserFields, C as ChimeSound, g as ClaudeCodeConfig, h as CodexConfig, i as CopilotConfig, j as CreateUserInput, D as DefaultAgenticConfig, k as DefaultAgenticToolConfig, l as DefaultModelConfig, E as ENV_VAR_SCOPES_V05, m as EnvVarMetadata, n as EnvVarScope, o as EventStreamPreferences, G as GeminiConfig, O as OnboardingState, R as ROLES, S as SessionEnvSelection, p as StoredAgenticTools, U as UpdateUserInput, r as UserApiKey, s as UserPreferences, t as UserRole, u as extractAgenticToolsPublicValues, v as hasMinimumRole, w as normalizeRole, x as toAgenticToolsStatus } from '../user-CpfkcV2C.cjs';
 export { A as AssistantConfig, C as CreateLocalRepoRequest, a as CreateRepoRequest, P as PersistedAgentConfig, R as Repo, b as RepoEnvironment, c as RepoEnvironmentConfig, d as RepoEnvironmentConfigV1, e as RepoEnvironmentVariant, f as RepoSlug, g as RepoType, W as WORKTREE_PERMISSION_LEVELS, h as Worktree, i as WorktreeConfig, j as WorktreeEnvironmentInstance, k as WorktreeName, l as WorktreePermissionLevel, m as WorktreeScheduleConfig, n as getAssistantConfig, o as getPersistedAgentConfig, p as isAssistant, q as isPersistedAgent } from '../repo-Ckl-vaAk.cjs';
-export { R as Report, a as ReportPath, b as ReportTemplate, T as Task, c as TaskStatus, i as isNaturalCompletion } from '../task-wht1RJEL.cjs';
+export { R as Report, a as ReportPath, b as ReportTemplate, T as Task, c as TaskMetadata, d as TaskStatus, i as isNaturalCompletion } from '../task-C2Hy7H6u.cjs';
 export { E as EffortLevel, G as GatewaySource, P as PermissionMode, S as ScheduledRunMetadata, a as Session, b as SessionStatus, c as SessionType, d as SpawnConfig, g as getDefaultPermissionMode, e as getGatewaySource, f as getSessionType, i as isGatewaySession } from '../session-MNU4BQv4.cjs';
 export { Id, NullableId, Paginated, Params, Service, ServiceMethods } from '@feathersjs/feathers';
 

package/dist/core/types/index.d.ts

@@ -2,19 +2,19 @@ export { PermissionDecision, PermissionRequest } from '../permissions/index.js';
 export { A as AGENTIC_TOOL_CAPABILITIES, a as AgenticTool, b as AgenticToolCapabilities, c as AgenticToolName, C as ClaudeCodePermissionMode, d as CodexApprovalPolicy, e as CodexNetworkAccess, f as CodexPermissionMode, g as CodexSandboxMode, h as CopilotPermissionMode, G as GeminiPermissionMode, O as OpenCodePermissionMode } from '../agentic-tool-cYqsU5i5.js';
 export { A as Artifact, a as ArtifactBuildStatus, b as ArtifactConsoleEntry, c as ArtifactPayload, d as ArtifactStatus, S as SandpackError, e as SandpackManifest } from '../artifact-bMxYKV3b.js';
 export { A as AppBoardObject, a as ArtifactBoardObject, B as Board, b as BoardEntityObject, c as BoardEntityType, d as BoardExportBlob, e as BoardObject, f as BoardObjectType, g as BoardPosition, C as Card, h as CardID, i as CardType, j as CardTypeID, k as CardWithType, M as MarkdownBoardObject, S as SandpackTemplate, T as TextBoardObject, Z as ZoneBoardObject, l as ZoneTrigger, m as ZoneTriggerBehavior } from '../board-D3YJ0_ih.js';
-export { B as BoardComment, a as BoardCommentCreate, b as BoardCommentPatch, C as CommentAttachmentType, c as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, d as groupReactions, i as isReply, e as isResolvable, f as isThreadRoot } from '../board-comment-3N-jSgsk.js';
-export { A as ALLOWED_SERVICE_TIERS, D as DEFAULT_SERVICE_TIER, a as DaemonResourcesConfig, b as DaemonServicesConfig, E as EnforcedAgentConfig, R as ResourceRepoConfig, c as ResourceUserConfig, d as ResourceWorktreeConfig, S as SERVICE_DEPENDENCIES, e as SERVICE_GROUP_NAMES, f as SERVICE_GROUP_TO_MCP_DOMAINS, g as SERVICE_TIERS, h as SERVICE_TIER_RANK, i as ServiceDependencyViolation, j as ServiceGroupName, k as ServiceTier, l as ServiceTierViolation, m as autoPromoteDependencies, n as getServiceTier, o as isServiceEnabled, p as isServiceExternallyAccessible, q as isServiceFullAccess, v as validateAllowedTiers, r as validateServiceDependencies } from '../config-services-DcO2GRgh.js';
+export { B as BoardComment, a as BoardCommentCreate, b as BoardCommentPatch, C as CommentAttachmentType, c as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, d as groupReactions, i as isReply, e as isResolvable, f as isThreadRoot } from '../board-comment-iT3DgZb4.js';
+export { A as ALLOWED_SERVICE_TIERS, D as DEFAULT_SERVICE_TIER, a as DaemonResourcesConfig, b as DaemonServicesConfig, E as EnforcedAgentConfig, R as ResourceRepoConfig, c as ResourceUserConfig, d as ResourceWorktreeConfig, S as SERVICE_DEPENDENCIES, e as SERVICE_GROUP_NAMES, f as SERVICE_GROUP_TO_MCP_DOMAINS, g as SERVICE_TIERS, h as SERVICE_TIER_RANK, i as ServiceDependencyViolation, j as ServiceGroupName, k as ServiceTier, l as ServiceTierViolation, m as autoPromoteDependencies, n as getServiceTier, o as isServiceEnabled, p as isServiceExternallyAccessible, q as isServiceFullAccess, v as validateAllowedTiers, r as validateServiceDependencies } from '../config-services-DhM7_yWn.js';
 export { C as ContextFileDetail, a as ContextFileListItem, b as ContextFilePath } from '../context-BpkCELpO.js';
 export { A as AuthenticatedParams, a as AuthenticatedUser, b as AuthenticationResult, B as BaseService, C as CreateHookContext, H as HookContext, Q as QueryParams, R as RBACParams, S as ServiceWithEvents } from '../feathers-C5QP3fwJ.js';
-export { C as ChannelType, G as GatewayAgenticConfig, a as GatewayChannel, b as GatewayChannelID, c as GatewayEnvVar, T as ThreadSessionMap, d as ThreadSessionMapID, e as ThreadStatus } from '../gateway-B_4X-v07.js';
+export { C as ChannelType, G as GatewayAgenticConfig, a as GatewayChannel, b as GatewayChannelID, c as GatewayEnvVar, T as ThreadSessionMap, d as ThreadSessionMapID, e as ThreadStatus } from '../gateway-C3Jm_akw.js';
 import { B as BoardID } from '../id-CoIbY_uc.js';
 export { A as AgenticToolID, a as AnyShortId, b as ArtifactID, C as CommentID, I as IDPrefix, c as IdInput, M as MessageID, R as RepoID, S as SessionID, d as ShortID, T as TaskID, U as URL_SHORT_ID_LENGTH, e as UUID, f as UserID, W as WorktreeID, g as findByShortIdPrefix, t as toShortId } from '../id-CoIbY_uc.js';
 export { C as CreateMCPServerInput, J as JSONSchema, M as MCPAuth, a as MCPCapabilities, b as MCPConfigFile, c as MCPPrompt, d as MCPResource, e as MCPScope, f as MCPServer, g as MCPServerFilters, h as MCPServerID, i as MCPServersConfig, j as MCPSource, k as MCPTestResult, l as MCPTool, m as MCPTransport, n as MCP_TOKEN_AUDIENCE, o as MCP_TOKEN_ISSUER, P as PromptArgument, S as SessionMCPServer, T as ToolPermission, U as UpdateMCPServerInput } from '../mcp-z5v19H-r.js';
-export { C as ContentBlock, D as DiffEnrichment, F as FileDiff, I as InputRequestContent, a as InputRequestOption, b as InputRequestQuestion, c as InputRequestStatus, M as Message, d as MessageCreate, e as MessageRole, f as MessageSource, g as MessageStatus, h as MessageType, P as PermissionRequestContent, i as PermissionScope, j as PermissionStatus, S as StreamingEventType, k as StructuredPatchHunk, T as ToolUse } from '../message-CHUUP6OS.js';
-import { g as User } from '../user-BfVWBmXA.js';
-export { A as AudioPreferences, B as BaseUserFields, C as ChimeSound, a as CreateUserInput, D as DefaultAgenticConfig, b as DefaultAgenticToolConfig, c as DefaultModelConfig, E as ENV_VAR_SCOPES_V05, d as EnvVarMetadata, e as EnvVarScope, f as EventStreamPreferences, O as OnboardingState, R as ROLES, S as SessionEnvSelection, U as UpdateUserInput, h as UserApiKey, i as UserPreferences, j as UserRole, k as hasMinimumRole, n as normalizeRole } from '../user-BfVWBmXA.js';
+export { C as ContentBlock, D as DiffEnrichment, F as FileDiff, I as InputRequestContent, a as InputRequestOption, b as InputRequestQuestion, c as InputRequestStatus, M as Message, d as MessageCreate, e as MessageRole, f as MessageSource, g as MessageType, P as PermissionRequestContent, h as PermissionScope, i as PermissionStatus, S as StreamingEventType, j as StructuredPatchHunk, T as ToolUse } from '../message-DZa8g0s0.js';
+import { q as User } from '../user-DP-XZMIM.js';
+export { A as AGENTIC_TOOLS_PUBLIC_FIELDS, a as AgenticToolConfigField, b as AgenticToolsConfig, c as AgenticToolsPublicValues, d as AgenticToolsStatus, e as AgenticToolsUpdate, f as AudioPreferences, B as BaseUserFields, C as ChimeSound, g as ClaudeCodeConfig, h as CodexConfig, i as CopilotConfig, j as CreateUserInput, D as DefaultAgenticConfig, k as DefaultAgenticToolConfig, l as DefaultModelConfig, E as ENV_VAR_SCOPES_V05, m as EnvVarMetadata, n as EnvVarScope, o as EventStreamPreferences, G as GeminiConfig, O as OnboardingState, R as ROLES, S as SessionEnvSelection, p as StoredAgenticTools, U as UpdateUserInput, r as UserApiKey, s as UserPreferences, t as UserRole, u as extractAgenticToolsPublicValues, v as hasMinimumRole, w as normalizeRole, x as toAgenticToolsStatus } from '../user-DP-XZMIM.js';
 export { A as AssistantConfig, C as CreateLocalRepoRequest, a as CreateRepoRequest, P as PersistedAgentConfig, R as Repo, b as RepoEnvironment, c as RepoEnvironmentConfig, d as RepoEnvironmentConfigV1, e as RepoEnvironmentVariant, f as RepoSlug, g as RepoType, W as WORKTREE_PERMISSION_LEVELS, h as Worktree, i as WorktreeConfig, j as WorktreeEnvironmentInstance, k as WorktreeName, l as WorktreePermissionLevel, m as WorktreeScheduleConfig, n as getAssistantConfig, o as getPersistedAgentConfig, p as isAssistant, q as isPersistedAgent } from '../repo-84E0A2gV.js';
-export { R as Report, a as ReportPath, b as ReportTemplate, T as Task, c as TaskStatus, i as isNaturalCompletion } from '../task-BLPFCORT.js';
+export { R as Report, a as ReportPath, b as ReportTemplate, T as Task, c as TaskMetadata, d as TaskStatus, i as isNaturalCompletion } from '../task-BHV-YHg1.js';
 export { E as EffortLevel, G as GatewaySource, P as PermissionMode, S as ScheduledRunMetadata, a as Session, b as SessionStatus, c as SessionType, d as SpawnConfig, g as getDefaultPermissionMode, e as getGatewaySource, f as getSessionType, i as isGatewaySession } from '../session-CAfhv1qL.js';
 export { Id, NullableId, Paginated, Params, Service, ServiceMethods } from '@feathersjs/feathers';
 

package/dist/core/types/index.js

@@ -306,6 +306,8 @@ function getSessionType(session) {
 
 // src/types/task.ts
 var TaskStatus = {
+  QUEUED: "queued",
+  // Task created but not yet running (waiting for executor to drain queue)
   CREATED: "created",
   RUNNING: "running",
   STOPPING: "stopping",
@@ -346,6 +348,47 @@ function hasMinimumRole(userRole, minimumRole) {
   const normalized = normalizeRole(userRole);
   return (ROLE_RANK[normalized] ?? 0) >= ROLE_RANK[minimumRole];
 }
+function toAgenticToolsStatus(stored) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const flags = {};
+    for (const [field, value] of Object.entries(fields)) {
+      if (value) flags[field] = true;
+    }
+    if (Object.keys(flags).length > 0) {
+      out[tool] = flags;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+var AGENTIC_TOOLS_PUBLIC_FIELDS = {
+  "claude-code": ["ANTHROPIC_BASE_URL"],
+  codex: ["OPENAI_BASE_URL"]
+};
+function extractAgenticToolsPublicValues(stored, decrypt) {
+  if (!stored) return void 0;
+  const out = {};
+  for (const [tool, fields] of Object.entries(stored)) {
+    if (!fields) continue;
+    const whitelist = AGENTIC_TOOLS_PUBLIC_FIELDS[tool];
+    if (!whitelist || whitelist.length === 0) continue;
+    const plaintext = {};
+    for (const field of whitelist) {
+      const ciphertext = fields[field];
+      if (!ciphertext) continue;
+      try {
+        plaintext[field] = decrypt(ciphertext);
+      } catch {
+      }
+    }
+    if (Object.keys(plaintext).length > 0) {
+      out[tool] = plaintext;
+    }
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
 var ENV_VAR_SCOPES_V05 = ["global", "session"];
 
 // src/types/utils.ts
@@ -370,6 +413,7 @@ function getAssistantConfig(worktree) {
 }
 var getPersistedAgentConfig = getAssistantConfig;
 export {
+  AGENTIC_TOOLS_PUBLIC_FIELDS,
   AGENTIC_TOOL_CAPABILITIES,
   ALLOWED_SERVICE_TIERS,
   CommentAttachmentType,
@@ -392,6 +436,7 @@ export {
   URL_SHORT_ID_LENGTH,
   WORKTREE_PERMISSION_LEVELS,
   autoPromoteDependencies,
+  extractAgenticToolsPublicValues,
   findByShortIdPrefix,
   getAssistantConfig,
   getCommentAttachmentType,
@@ -415,6 +460,7 @@ export {
   isServiceFullAccess,
   isThreadRoot,
   normalizeRole,
+  toAgenticToolsStatus,
   toShortId,
   validateAllowedTiers,
   validateServiceDependencies

package/dist/core/{types-DNqfdt1z.d.cts → types-D4Rl6ZKN.d.cts}

@@ -1,5 +1,5 @@
-import { a as DaemonResourcesConfig, b as DaemonServicesConfig } from './config-services-YEZ4DwCD.cjs';
-import { j as UserRole } from './user-DkNdeFoz.cjs';
+import { a as DaemonResourcesConfig, b as DaemonServicesConfig } from './config-services-CXyQKEK5.cjs';
+import { t as UserRole } from './user-CpfkcV2C.cjs';
 import { l as WorktreePermissionLevel } from './repo-Ckl-vaAk.cjs';
 
 /**
@@ -268,6 +268,22 @@ interface AgorExecutionSettings {
     mcp_token_expiration_ms?: number;
     /** Sync web passwords to Unix user passwords (default: true). When enabled, passwords are synced on user creation/update. */
     sync_unix_passwords?: boolean;
+    /**
+     * When true (default), the daemon writes the initial user-message row inside
+     * `POST /sessions/:id/prompt`, immediately after the task is created. This
+     * guarantees the chat transcript reflects what the user typed even if the
+     * executor crashes during startup ("never lose a prompt").
+     *
+     * Set to false to revert to the legacy behavior where the executor is the
+     * sole writer of the user-message row. The legacy behavior is racy: any
+     * crash before the executor connects back via Feathers leaves the prompt
+     * visible only on `tasks.full_prompt`, not in the chat transcript.
+     *
+     * Kill switch only — intended for emergency rollback. The executor's
+     * `createUserMessage` path always honors a "skip if user-message row already
+     * exists for this task" guard, so toggling this flag is safe at runtime.
+     */
+    daemon_writes_user_message?: boolean;
     /** Permission request timeout in ms (default: 600000 = 10 minutes). When a permission request is not resolved within this time, the agent is notified and can continue. */
     permission_timeout_ms?: number;
     /**