agor-live 0.17.2 → 0.17.3

package/dist/daemon/register-services.js

@@ -13,7 +13,7 @@ var session_token_service_exports = {};
 __export(session_token_service_exports, {
   SessionTokenService: () => SessionTokenService
 });
-import jwt2 from "jsonwebtoken";
+import jwt3 from "jsonwebtoken";
 var SessionTokenService;
 var init_session_token_service = __esm({
   "src/services/session-token-service.ts"() {
@@ -56,7 +56,7 @@ var init_session_token_service = __esm({
           iss: "agor"
           // Must match Feathers jwtOptions.issuer
         };
-        const token = jwt2.sign(payload, this.jwtSecret, {
+        const token = jwt3.sign(payload, this.jwtSecret, {
           algorithm: "HS256"
           // Must match Feathers jwtOptions.algorithm
           // No expiresIn here - we set exp directly in payload
@@ -183,7 +183,7 @@ import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
 } from "@agor/core/types";
-import jwt3 from "jsonwebtoken";
+import jwt4 from "jsonwebtoken";
 import { MCP_TOKEN_AUDIENCE as MCP_TOKEN_AUDIENCE2, MCP_TOKEN_ISSUER as MCP_TOKEN_ISSUER2 } from "@agor/core/types";
 function requireState() {
   if (!_state) {
@@ -230,7 +230,7 @@ async function generateSessionToken2(app, sessionId, userId) {
     exp: expSec,
     jti
   };
-  const token = jwt3.sign(payload, jwtSecret, { algorithm: "HS256" });
+  const token = jwt4.sign(payload, jwtSecret, { algorithm: "HS256" });
   console.log(
     `\u{1F3AB} MCP token issued: session=${sessionId.substring(0, 8)} jti=${jti.substring(0, 8)} exp=+${Math.floor(s.expirationMs / 1e3)}s`
   );
@@ -245,15 +245,15 @@ async function validateSessionToken(app, token) {
   }
   let payload;
   try {
-    payload = jwt3.verify(token, jwtSecret, {
+    payload = jwt4.verify(token, jwtSecret, {
       audience: MCP_TOKEN_AUDIENCE,
       issuer: MCP_TOKEN_ISSUER,
       algorithms: ["HS256"]
     });
   } catch (err) {
-    if (err instanceof jwt3.TokenExpiredError) {
+    if (err instanceof jwt4.TokenExpiredError) {
       console.warn("[mcp-tokens] token rejected: expired");
-    } else if (err instanceof jwt3.JsonWebTokenError) {
+    } else if (err instanceof jwt4.JsonWebTokenError) {
       console.warn(`[mcp-tokens] token rejected: ${err.message}`);
     } else {
       console.error("[mcp-tokens] token verify error:", err);
@@ -1956,7 +1956,7 @@ var ConfigService = class {
    * Called via: client.service('config').resolveApiKey({ taskId, keyName })
    */
   async resolveApiKey(data) {
-    const { taskId, keyName } = data;
+    const { taskId, keyName, tool } = data;
     let userId;
     try {
       const tasksService = this.app?.service("tasks");
@@ -1969,7 +1969,8 @@ var ConfigService = class {
     }
     const result = await resolveApiKey(keyName, {
       userId,
-      db: this.db
+      db: this.db,
+      tool
     });
     return {
       apiKey: result.apiKey ?? null,
@@ -2600,8 +2601,8 @@ import {
   hasConnector,
   parseGitHubThreadId
 } from "@agor/core/gateway";
-import { resolveModelConfig } from "@agor/core/models";
-import { getDefaultPermissionMode, SessionStatus } from "@agor/core/types";
+import { resolveSessionDefaults } from "@agor/core/sessions";
+import { SessionStatus } from "@agor/core/types";
 function hasListeningConfig(channel) {
   const config = channel.config;
   switch (channel.channel_type) {
@@ -2921,9 +2922,23 @@ var GatewayService = class {
     let mcpAuthWarning;
     const agenticConfig = channel.agentic_config;
     const agenticTool = agenticConfig?.agent ?? "claude-code";
-    const userDefaults = user.default_agentic_config?.[agenticTool];
-    const permissionMode = agenticConfig?.permissionMode ?? userDefaults?.permissionMode ?? getDefaultPermissionMode(agenticTool);
-    const modelConfig = agenticConfig?.modelConfig ?? userDefaults?.modelConfig;
+    const {
+      permission_config: gatewayPermissionConfig,
+      model_config: gatewayModelConfig,
+      mcp_server_ids: gatewayMcpServerIds
+    } = resolveSessionDefaults({
+      agenticTool,
+      user,
+      overrides: {
+        permissionMode: agenticConfig?.permissionMode,
+        modelConfig: agenticConfig?.modelConfig,
+        codexSandboxMode: agenticConfig?.codexSandboxMode,
+        codexApprovalPolicy: agenticConfig?.codexApprovalPolicy,
+        codexNetworkAccess: agenticConfig?.codexNetworkAccess,
+        mcpServerIds: agenticConfig?.mcpServerIds
+      }
+    });
+    const permissionMode = gatewayPermissionConfig.mode;
     if (existingMapping) {
       sessionId = existingMapping.session_id;
       await this.threadMapRepo.updateLastMessage(existingMapping.id);
@@ -2975,8 +2990,8 @@ var GatewayService = class {
         unix_username: user.unix_username ?? null,
         status: SessionStatus.IDLE,
         agentic_tool: agenticTool,
-        permission_config: { mode: permissionMode },
-        model_config: resolveModelConfig(modelConfig),
+        permission_config: gatewayPermissionConfig,
+        model_config: gatewayModelConfig,
         tasks: [],
         // Denormalized gateway metadata (immutable snapshot at creation time)
         // Avoids N+1 lookups when rendering board cards
@@ -2986,15 +3001,14 @@ var GatewayService = class {
       });
       sessionId = session.session_id;
       created = true;
-      const mcpServerIds = agenticConfig?.mcpServerIds;
-      if (mcpServerIds && mcpServerIds.length > 0) {
+      if (gatewayMcpServerIds.length > 0) {
         await sessionsService.setMCPServers(
           session.session_id,
-          mcpServerIds,
+          gatewayMcpServerIds,
           "gateway"
         );
         const unauthedMcpNames = [];
-        for (const serverId of mcpServerIds) {
+        for (const serverId of gatewayMcpServerIds) {
           try {
             const server = await this.mcpServerRepo.findById(serverId);
             if (server?.auth?.type === "oauth") {
@@ -3068,18 +3082,18 @@ var GatewayService = class {
 
 ${promptText}`;
       }
-      const response = await promptService.create(
+      const task = await promptService.create(
         { prompt: promptText, permissionMode, messageSource: "gateway" },
         { route: { id: sessionId }, user }
       );
-      if (response.queued) {
+      if (task.status === "queued") {
         console.log(
-          `[gateway] Message queued for session ${sessionId.substring(0, 8)} at position ${response.queue_position}`
+          `[gateway] Message queued for session ${sessionId.substring(0, 8)} at position ${task.queue_position}`
         );
         this.sendDebugMessage(
           channel,
           data.thread_id,
-          `Session is busy, message queued at position ${response.queue_position}`
+          `Session is busy, message queued at position ${task.queue_position}`
         );
       } else {
         console.log(
@@ -4236,7 +4250,9 @@ function spawnExecutorLocal(payload, options) {
       ANTHROPIC_API_KEY: env.ANTHROPIC_API_KEY,
       ANTHROPIC_AUTH_TOKEN: env.ANTHROPIC_AUTH_TOKEN,
       ANTHROPIC_BASE_URL: env.ANTHROPIC_BASE_URL,
+      CLAUDE_CODE_OAUTH_TOKEN: env.CLAUDE_CODE_OAUTH_TOKEN,
       OPENAI_API_KEY: env.OPENAI_API_KEY,
+      OPENAI_BASE_URL: env.OPENAI_BASE_URL,
       GEMINI_API_KEY: env.GEMINI_API_KEY,
       GOOGLE_API_KEY: env.GOOGLE_API_KEY
     }).filter(([_, v]) => v !== void 0)
@@ -5072,7 +5088,8 @@ import {
   UsersRepository as UsersRepository2
 } from "@agor/core/db";
 import { Forbidden as Forbidden3 } from "@agor/core/feathers";
-import { resolveModelConfig as resolveModelConfig2 } from "@agor/core/models";
+import { resolveModelConfig } from "@agor/core/models";
+import { resolveSessionDefaults as resolveSessionDefaults2 } from "@agor/core/sessions";
 import { ROLES as ROLES6, SessionStatus as SessionStatus2 } from "@agor/core/types";
 
 // src/utils/worktree-authorization.ts
@@ -5384,25 +5401,16 @@ var SessionsService = class extends DrizzleService {
       if (userId && this.app) {
         try {
           const user = await this.app.service("users").get(userId, params);
-          const toolDefaults = user?.default_agentic_config?.[targetTool];
-          if (toolDefaults) {
-            permissionConfig = {
-              mode: toolDefaults.permissionMode,
-              ...targetTool === "codex" && toolDefaults.codexSandboxMode && toolDefaults.codexApprovalPolicy ? {
-                codex: {
-                  sandboxMode: toolDefaults.codexSandboxMode,
-                  approvalPolicy: toolDefaults.codexApprovalPolicy,
-                  networkAccess: toolDefaults.codexNetworkAccess
-                }
-              } : {}
-            };
-            modelConfig = resolveModelConfig2(toolDefaults.modelConfig) ?? modelConfig;
-          }
+          const userResolved = resolveSessionDefaults2({ agenticTool: targetTool, user });
+          permissionConfig = userResolved.permission_config;
+          modelConfig = userResolved.model_config ?? modelConfig;
         } catch (error) {
           console.warn(
-            "Could not fetch user preferences for spawned session, using parent settings:",
+            "Could not fetch user preferences for spawned session, using system defaults:",
             error
           );
+          const sysResolved = resolveSessionDefaults2({ agenticTool: targetTool });
+          permissionConfig = sysResolved.permission_config;
         }
       }
     }
@@ -5418,7 +5426,7 @@ var SessionsService = class extends DrizzleService {
         } : permissionConfig?.codex ? { codex: permissionConfig.codex } : {}
       };
     }
-    modelConfig = resolveModelConfig2(data.modelConfig) ?? modelConfig;
+    modelConfig = resolveModelConfig(data.modelConfig) ?? modelConfig;
     const isCallbackEnabled = data.enableCallback !== false;
     const callbackConfig = {
       ...data.enableCallback !== void 0 ? { enabled: data.enableCallback } : {},
@@ -5523,7 +5531,7 @@ ${data.extraInstructions}`;
   /**
    * Custom method: Trigger queue processing
    *
-   * Processes the next queued message for an idle session.
+   * Drains the next queued task for an idle session.
    * Used by callback system to trigger immediate queue processing.
    *
    * NOTE: The actual implementation is provided by index.ts via setQueueProcessor
@@ -5868,7 +5876,7 @@ var TasksService = class extends DrizzleService {
         promptText = typeof firstUser.content === "string" ? firstUser.content : Array.isArray(firstUser.content) ? firstUser.content.filter((b) => b.type === "text").map((b) => b.text || "").join("\n\n") : "";
       }
       if (!promptText) {
-        promptText = task.description || btwSession.title || "(no prompt)";
+        promptText = task.full_prompt?.substring(0, 120) || btwSession.title || "(no prompt)";
       }
       const assistantMessages = messageList.filter((msg) => msg.role === "assistant").sort((a, b) => (b.index || 0) - (a.index || 0));
       let responseText = "";
@@ -5950,7 +5958,7 @@ var TasksService = class extends DrizzleService {
         return;
       }
       const includeOriginalPrompt = childSession.callback_config?.include_original_prompt ?? targetSession.callback_config?.include_original_prompt ?? false;
-      const spawnPrompt = includeOriginalPrompt ? task.description || "(no prompt available)" : void 0;
+      const spawnPrompt = includeOriginalPrompt ? task.full_prompt?.substring(0, 120) || "(no prompt available)" : void 0;
       let lastAssistantMessage;
       const includeLastMessage = childSession.callback_config?.include_last_message ?? targetSession.callback_config?.include_last_message ?? true;
       if (includeLastMessage) {
@@ -5999,7 +6007,6 @@ var TasksService = class extends DrizzleService {
       };
       const customTemplate = targetSession.callback_config?.template;
       const callbackMessage = renderChildCompletionCallback(context, customTemplate);
-      const messageRepo = new MessagesRepository2(this.db);
       if (!targetSession.created_by) {
         console.warn(
           `\u26A0\uFE0F  [TasksService] Cannot queue callback: target session ${targetSessionId.substring(0, 8)} has no creator (anonymous session)`
@@ -6007,15 +6014,22 @@ var TasksService = class extends DrizzleService {
         return;
       }
       const callbackCreator = childSession.callback_config?.callback_created_by ?? targetSession.created_by;
-      await messageRepo.createQueued(targetSessionId, callbackMessage, {
-        is_agor_callback: true,
-        source: "agor",
-        child_session_id: childSession.session_id,
-        child_task_id: task.task_id,
-        queued_by_user_id: callbackCreator
+      const callbackTask = await this.taskRepo.createPending({
+        session_id: targetSessionId,
+        full_prompt: callbackMessage,
+        created_by: callbackCreator,
+        status: TaskStatus.QUEUED,
+        metadata: {
+          is_agor_callback: true,
+          source: "agor",
+          child_session_id: childSession.session_id,
+          child_task_id: task.task_id,
+          queued_by_user_id: callbackCreator
+        }
       });
+      this.emit?.("queued", callbackTask);
       console.log(
-        `\u{1F514} Queued callback to ${targetSessionId.substring(0, 8)} from child ${childSession.session_id.substring(0, 8)}`
+        `\u{1F514} Queued callback task ${callbackTask.task_id.substring(0, 8)} on session ${targetSessionId.substring(0, 8)} from child ${childSession.session_id.substring(0, 8)}`
       );
     } catch (error) {
       console.error(
@@ -6453,7 +6467,38 @@ import {
   users as users2
 } from "@agor/core/db";
 import { isLikelyGitToken } from "@agor/core/git";
-import { normalizeRole, ROLES as ROLES7 } from "@agor/core/types";
+import {
+  extractAgenticToolsPublicValues,
+  normalizeRole,
+  ROLES as ROLES7,
+  toAgenticToolsStatus
+} from "@agor/core/types";
+function applyAgenticToolsPatch(current, patch) {
+  const next = { ...current };
+  for (const [tool, fields] of Object.entries(patch)) {
+    if (!fields) continue;
+    const bucket = { ...next[tool] ?? {} };
+    for (const [field, value] of Object.entries(fields)) {
+      if (value === null || value === void 0) {
+        delete bucket[field];
+      } else {
+        try {
+          bucket[field] = encryptApiKey(value);
+          console.log(`\u{1F510} Encrypted user agentic_tools.${tool}.${field}`);
+        } catch (err) {
+          console.error(`Failed to encrypt agentic_tools.${tool}.${field}:`, err);
+          throw new Error(`Failed to encrypt agentic_tools.${tool}.${field}`);
+        }
+      }
+    }
+    if (Object.keys(bucket).length > 0) {
+      next[tool] = bucket;
+    } else {
+      delete next[tool];
+    }
+  }
+  return next;
+}
 var UsersService = class {
   constructor(db) {
     this.db = db;
@@ -6464,6 +6509,7 @@ var UsersService = class {
   async find(params) {
     const email = params?.query?.email;
     const includePassword = !!email;
+    const requesterId = params?.user?.user_id;
     let rows;
     if (email) {
       const row = await select(this.db).from(users2).where(eq2(users2.email, email)).one();
@@ -6471,7 +6517,7 @@ var UsersService = class {
     } else {
       rows = await select(this.db).from(users2).all();
     }
-    const results = rows.map((row) => this.rowToUser(row, includePassword));
+    const results = rows.map((row) => this.rowToUser(row, includePassword, requesterId));
     return {
       total: results.length,
       limit: results.length,
@@ -6482,12 +6528,13 @@ var UsersService = class {
   /**
    * Get user by ID
    */
-  async get(id, _params) {
+  async get(id, params) {
     const row = await select(this.db).from(users2).where(eq2(users2.user_id, id)).one();
     if (!row) {
       throw new Error(`User not found: ${id}`);
     }
-    return this.rowToUser(row);
+    const requesterId = params?.user?.user_id;
+    return this.rowToUser(row, false, requesterId);
   }
   /**
    * Create new user
@@ -6522,7 +6569,7 @@ var UsersService = class {
   /**
    * Update user
    */
-  async patch(id, data, _params) {
+  async patch(id, data, params) {
     const now = /* @__PURE__ */ new Date();
     const updates = { updated_at: now };
     if (data.password) {
@@ -6538,26 +6585,11 @@ var UsersService = class {
     if (data.unix_username !== void 0) updates.unix_username = data.unix_username;
     if (data.onboarding_completed !== void 0)
       updates.onboarding_completed = data.onboarding_completed;
-    if (data.avatar || data.preferences || data.api_keys || data.env_vars || data.env_var_scopes || data.default_agentic_config) {
+    if (data.avatar || data.preferences || data.agentic_tools || data.env_vars || data.env_var_scopes || data.default_agentic_config) {
       const current = await this.get(id);
       const currentRow = await select(this.db).from(users2).where(eq2(users2.user_id, id)).one();
       const currentData = currentRow?.data;
-      const encryptedKeys = currentData?.api_keys || {};
-      if (data.api_keys) {
-        for (const [key, value] of Object.entries(data.api_keys)) {
-          if (value === null || value === void 0) {
-            delete encryptedKeys[key];
-          } else {
-            try {
-              encryptedKeys[key] = encryptApiKey(value);
-              console.log(`\u{1F510} Encrypted user API key: ${key}`);
-            } catch (err) {
-              console.error(`Failed to encrypt ${key}:`, err);
-              throw new Error(`Failed to encrypt ${key}`);
-            }
-          }
-        }
-      }
+      const nextAgenticTools = data.agentic_tools ? applyAgenticToolsPatch(currentData?.agentic_tools ?? {}, data.agentic_tools) : currentData?.agentic_tools ?? {};
       const normalizedExisting = normalizeStoredEnvMap(currentData?.env_vars);
       const nextEnvVars = { ...normalizedExisting };
       if (data.env_vars) {
@@ -6615,7 +6647,7 @@ var UsersService = class {
       updates.data = {
         avatar: data.avatar ?? current.avatar,
         preferences: data.preferences ?? current.preferences,
-        api_keys: Object.keys(encryptedKeys).length > 0 ? encryptedKeys : void 0,
+        agentic_tools: Object.keys(nextAgenticTools).length > 0 ? nextAgenticTools : void 0,
         env_vars: Object.keys(nextEnvVars).length > 0 ? nextEnvVars : void 0,
         default_agentic_config: data.default_agentic_config ?? current.default_agentic_config
       };
@@ -6624,7 +6656,8 @@ var UsersService = class {
     if (!row) {
       throw new Error(`User not found: ${id}`);
     }
-    return this.rowToUser(row);
+    const requesterId = params?.user?.user_id;
+    return this.rowToUser(row, false, requesterId);
   }
   /**
    * Delete user
@@ -6650,22 +6683,47 @@ var UsersService = class {
     return compare(password, row.password);
   }
   /**
-   * Get decrypted API key for a user
-   * Used by key resolution service
+   * Get a single decrypted credential field scoped to a specific agentic tool.
+   *
+   * Replaces the legacy flat-namespace `getApiKey(userId, 'ANTHROPIC_API_KEY')`
+   * call site with `(userId, 'claude-code', 'ANTHROPIC_API_KEY')` so an
+   * Anthropic key stored on the user can no longer leak into a Codex spawn.
    */
-  async getApiKey(userId, keyName) {
+  async getToolConfigField(userId, tool, field) {
     const row = await select(this.db).from(users2).where(eq2(users2.user_id, userId)).one();
     if (!row) return void 0;
     const data = row.data;
-    const encryptedKey = data.api_keys?.[keyName];
-    if (!encryptedKey) return void 0;
+    const encrypted = data.agentic_tools?.[tool]?.[field];
+    if (!encrypted) return void 0;
     try {
-      return decryptApiKey(encryptedKey);
+      return decryptApiKey(encrypted);
     } catch (err) {
-      console.error(`Failed to decrypt ${keyName} for user ${userId}:`, err);
+      console.error(`Failed to decrypt agentic_tools.${tool}.${field} for user ${userId}:`, err);
       return void 0;
     }
   }
+  /**
+   * Get the full decrypted credential bag for one tool. Used when spawning an
+   * SDK so the executor environment receives only that tool's env vars.
+   * Returns `null` if the user has no stored config for the tool.
+   */
+  async getToolConfig(userId, tool) {
+    const row = await select(this.db).from(users2).where(eq2(users2.user_id, userId)).one();
+    if (!row) return null;
+    const data = row.data;
+    const fields = data.agentic_tools?.[tool];
+    if (!fields || Object.keys(fields).length === 0) return null;
+    const out = {};
+    for (const [field, encrypted] of Object.entries(fields)) {
+      if (!encrypted) continue;
+      try {
+        out[field] = decryptApiKey(encrypted);
+      } catch (err) {
+        console.error(`Failed to decrypt agentic_tools.${tool}.${field} for user ${userId}:`, err);
+      }
+    }
+    return Object.keys(out).length > 0 ? out : null;
+  }
   /**
    * Get decrypted environment variables for a user (ALL scopes).
    *
@@ -6693,8 +6751,14 @@ var UsersService = class {
    *
    * @param row - Database row
    * @param includePassword - Include password field (for authentication only)
-   */
-  rowToUser(row, includePassword = false) {
+   * @param requesterId - Authenticated user making the request. When equal to
+   *   the row's `user_id`, the returned DTO includes `agentic_tools_public_values`
+   *   (decrypted plaintext for the whitelisted non-secret fields like
+   *   `OPENAI_BASE_URL` / `ANTHROPIC_BASE_URL`). For any other requester —
+   *   including admins viewing someone else's profile — public values are
+   *   omitted, since base URLs can leak internal hostnames.
+   */
+  rowToUser(row, includePassword = false, requesterId) {
     const data = row.data;
     const normalizedEnvVars = normalizeStoredEnvMap(data.env_vars);
     const envVarMetadata = Object.keys(normalizedEnvVars).length > 0 ? Object.fromEntries(
@@ -6716,12 +6780,12 @@ var UsersService = class {
       must_change_password: !!row.must_change_password,
       created_at: row.created_at,
       updated_at: row.updated_at ?? void 0,
-      // Return key status (boolean), NOT actual keys
-      api_keys: data.api_keys ? {
-        ANTHROPIC_API_KEY: !!data.api_keys.ANTHROPIC_API_KEY,
-        OPENAI_API_KEY: !!data.api_keys.OPENAI_API_KEY,
-        GEMINI_API_KEY: !!data.api_keys.GEMINI_API_KEY
-      } : void 0,
+      // Per-tool credential presence (boolean only — never expose decrypted values).
+      agentic_tools: toAgenticToolsStatus(data.agentic_tools),
+      // Self-only: return plaintext for whitelisted non-secret fields
+      // (base URLs) so the UI can render the saved value back. Field-level
+      // secrets are NEVER on the whitelist; see `AGENTIC_TOOLS_PUBLIC_FIELDS`.
+      agentic_tools_public_values: requesterId === row.user_id ? extractAgenticToolsPublicValues(data.agentic_tools, decryptApiKey) : void 0,
       // Return env var metadata (presence + scope), NOT actual values
       env_vars: envVarMetadata,
       // Return default agentic config
@@ -6765,11 +6829,7 @@ var UsersServiceWithAuth = class extends UsersService {
       must_change_password: !!row.must_change_password,
       created_at: row.created_at,
       updated_at: row.updated_at ?? void 0,
-      api_keys: data.api_keys ? {
-        ANTHROPIC_API_KEY: !!data.api_keys.ANTHROPIC_API_KEY,
-        OPENAI_API_KEY: !!data.api_keys.OPENAI_API_KEY,
-        GEMINI_API_KEY: !!data.api_keys.GEMINI_API_KEY
-      } : void 0,
+      agentic_tools: toAgenticToolsStatus(data.agentic_tools),
       env_vars: envVarMetadata
     };
   }
@@ -8107,6 +8167,12 @@ function createWorktreesService(db, app) {
   return new WorktreesService(db, app);
 }
 
+// src/setup/socketio.ts
+import jwt2 from "jsonwebtoken";
+function userRoomName(userId) {
+  return `user:${userId}`;
+}
+
 // src/utils/session-state.ts
 import { createHash as createHash2 } from "crypto";
 import { createReadStream, createWriteStream } from "fs";
@@ -8330,10 +8396,18 @@ async function registerServices(ctx) {
     createExecuteHandler(ctx, sessionsService, sessionTokenService)
   );
   app.use("/tasks", createTasksService(db, app), {
-    // 'failed' is emitted by the prompt route when executor spawn throws so
-    // clients can surface the error instead of silently seeing an idle
-    // session with a ghost task.
-    events: ["tool:start", "tool:complete", "thinking:chunk", "failed"]
+    // Custom events not in this list are dropped at the FeathersJS transport
+    // boundary — they fire on the local EventEmitter but never reach socket
+    // clients. Keep this in sync with every `app.service('tasks').emit(...)`
+    // call site.
+    //   - 'queued': prompt route auto-queues a task (session not idle / queue
+    //      not empty) — UI's queue drawer subscribes to this.
+    //   - 'failed': prompt route reports executor-spawn failures so clients
+    //      surface the error instead of seeing an idle session with a ghost
+    //      task.
+    //   - 'tool:start' / 'tool:complete' / 'thinking:chunk': forwarded from
+    //      the executor for live tool/thinking visualization.
+    events: ["queued", "tool:start", "tool:complete", "thinking:chunk", "failed"]
   });
   if (svcEnabled("leaderboard")) {
     app.use("/leaderboard", createLeaderboardService(db));
@@ -8667,7 +8741,8 @@ ${possiblePaths.map((p) => `  - ${p}`).join("\n")}`
       void 0,
       !!executorUnixUser,
       gatewayEnv,
-      sessionId
+      sessionId,
+      session.agentic_tool
     );
     const { SessionRepository: SessRepo, MessagesRepository: _MsgRepo } = await import("@agor/core/db");
     const sessionsRepository = new SessRepo(db);
@@ -8897,6 +8972,7 @@ async function registerMCPServices(ctx, sessionsService) {
       }
     }
   }, 6e4);
+  const DISCOVERY_CASCADE_TRIED = "Tried: (1) WWW-Authenticate resource_metadata hint, (2) /.well-known/oauth-protected-resource (RFC 9728), (3) /.well-known/oauth-authorization-server at MCP origin (RFC 8414), (4) /.well-known/openid-configuration at MCP origin (OIDC).";
   async function startTwoPhaseMCPOAuthFlow(opts) {
     return startTwoPhaseMCPOAuthFlowInternal(opts, false);
   }
@@ -8910,12 +8986,23 @@ async function registerMCPServices(ctx, sessionsService) {
     const { startMCPOAuthFlow } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
     const baseUrl = await requirePublicBaseUrl();
     const redirectUri = new URL("/mcp-servers/oauth-callback", baseUrl).toString();
+    const hasRfc9728 = !!opts.resourceMetadataUrl;
+    const hasAsDirect = !!opts.prefetchedAuthServerMetadata;
+    if (hasRfc9728 === hasAsDirect) {
+      throw new Error(
+        `startTwoPhaseMCPOAuthFlow requires exactly one of resourceMetadataUrl (RFC 9728) or prefetchedAuthServerMetadata (AS-direct discovery), received resourceMetadataUrl=${hasRfc9728}, prefetchedAuthServerMetadata=${hasAsDirect}.`
+      );
+    }
     const context = await startMCPOAuthFlow(opts.wwwAuthenticate, opts.clientId, redirectUri, {
       authorizationUrlOverride: opts.authorizationUrlOverride,
       tokenUrlOverride: opts.tokenUrlOverride,
       clientSecret: opts.clientSecret,
       scope: opts.scope,
-      resourceMetadataUrl: opts.resourceMetadataUrl
+      resourceMetadataUrl: opts.resourceMetadataUrl,
+      prefetchedAuthServerMetadata: opts.prefetchedAuthServerMetadata,
+      // Cache key for AS-direct path: use the MCP URL itself (origin matches
+      // what `getCachedOAuth21Token` looks up later).
+      cacheKey: opts.prefetchedAuthServerMetadata ? opts.mcpUrl : void 0
     });
     let tokenPromise;
     let tokenResolve;
@@ -9033,10 +9120,16 @@ async function registerMCPServices(ctx, sessionsService) {
             mcp_server_id: pendingFlow.mcpServerId,
             oauth_mode: pendingFlow.oauthMode || "per_user"
           };
-          if (pendingFlow.socketId) {
+          if (oauthEvent.oauth_mode === "per_user" && pendingFlow.userId) {
+            app.io.to(userRoomName(pendingFlow.userId)).emit("oauth:completed", oauthEvent);
+          } else if (oauthEvent.oauth_mode === "shared") {
+            app.io.emit("oauth:completed", oauthEvent);
+          } else if (pendingFlow.socketId) {
             app.io.to(pendingFlow.socketId).emit("oauth:completed", oauthEvent);
           } else {
-            app.io.emit("oauth:completed", oauthEvent);
+            console.warn(
+              `[OAuth Callback] per_user flow ${state} has no userId or socketId \u2014 skipping oauth:completed emit (UI will catch up on next mcp-servers find)`
+            );
           }
         }
         pendingFlow.tokenResolve?.(tokenResponse);
@@ -9114,15 +9207,22 @@ async function registerMCPServices(ctx, sessionsService) {
           headers: allHeaders
         });
         let metadataUrl = null;
+        let prefetchedAuthServerMetadata = null;
+        let discoverySource = null;
         if (probeResponse.status === 401) {
-          const { resolveResourceMetadataUrl } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
-          const resolved = await resolveResourceMetadataUrl(wwwAuthenticate, data.mcp_url);
-          if (resolved) {
-            metadataUrl = resolved.metadataUrl;
-            console.log(`[OAuth Test] Resolved metadata URL (${resolved.source}):`, metadataUrl);
+          const { resolveMCPOAuthDiscovery } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
+          const discovery = await resolveMCPOAuthDiscovery(wwwAuthenticate, data.mcp_url);
+          if (discovery?.kind === "resource-metadata") {
+            metadataUrl = discovery.metadataUrl;
+            discoverySource = `RFC 9728 ${discovery.source}`;
+            console.log(`[OAuth Test] Resolved metadata URL (${discovery.source}):`, metadataUrl);
+          } else if (discovery?.kind === "authorization-server") {
+            prefetchedAuthServerMetadata = discovery.authServerMetadata;
+            discoverySource = `AS-direct (${discovery.discoveredAt})`;
+            console.log("[OAuth Test] Resolved AS metadata directly at:", discovery.discoveredAt);
           }
         }
-        if (probeResponse.status === 401 && metadataUrl) {
+        if (probeResponse.status === 401 && (metadataUrl || prefetchedAuthServerMetadata)) {
           console.log("[OAuth Test] OAuth 2.1 auto-discovery detected");
           if (data.start_browser_flow) {
             console.log("[OAuth Test] Starting browser-based OAuth 2.1 flow...");
@@ -9133,7 +9233,8 @@ async function registerMCPServices(ctx, sessionsService) {
                 started = await startTwoPhaseMCPOAuthFlowAndAwaitToken({
                   mcpUrl: data.mcp_url,
                   wwwAuthenticate: wwwAuthenticate || "",
-                  resourceMetadataUrl: metadataUrl,
+                  resourceMetadataUrl: metadataUrl ?? void 0,
+                  prefetchedAuthServerMetadata: prefetchedAuthServerMetadata ?? void 0,
                   mcpServerId: data.mcp_server_id,
                   userId: params?.user?.user_id,
                   // Test endpoint mirrors the previous saveOAuth21TokenToDB
@@ -9177,13 +9278,29 @@ async function registerMCPServices(ctx, sessionsService) {
             }
           }
           try {
-            const metadataResponse = await fetch(metadataUrl);
+            if (prefetchedAuthServerMetadata) {
+              return {
+                success: true,
+                oauthType: "oauth2.1",
+                message: prefetchedAuthServerMetadata.registration_endpoint ? `OAuth 2.1 auto-discovery successful via ${discoverySource} (DCR supported). Click "Start OAuth Flow" to authenticate.` : `OAuth 2.1 auto-discovery successful via ${discoverySource}. Click "Start OAuth Flow" to authenticate.`,
+                authServerMetadata: {
+                  authorizationEndpoint: prefetchedAuthServerMetadata.authorization_endpoint,
+                  tokenEndpoint: prefetchedAuthServerMetadata.token_endpoint,
+                  registrationEndpoint: prefetchedAuthServerMetadata.registration_endpoint
+                },
+                supportsDynamicClientRegistration: !!prefetchedAuthServerMetadata.registration_endpoint,
+                requiresBrowserFlow: true,
+                discoverySource
+              };
+            }
+            const rfc9728Url = metadataUrl;
+            const metadataResponse = await fetch(rfc9728Url);
             if (!metadataResponse.ok) {
               return {
                 success: false,
                 error: `OAuth resource metadata endpoint returned ${metadataResponse.status}`,
                 oauthType: "oauth2.1",
-                metadataUrl,
+                metadataUrl: rfc9728Url,
                 requiresBrowserFlow: true
               };
             }
@@ -9193,31 +9310,27 @@ async function registerMCPServices(ctx, sessionsService) {
                 success: false,
                 error: "OAuth resource metadata missing authorization_servers",
                 oauthType: "oauth2.1",
-                metadataUrl,
+                metadataUrl: rfc9728Url,
                 metadata
               };
             }
             const authServerUrl = metadata.authorization_servers[0];
+            const { fetchAuthorizationServerMetadata } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
             let authServerMetadata = null;
-            for (const wellKnownPath of [
-              "/.well-known/oauth-authorization-server",
-              "/.well-known/openid-configuration"
-            ]) {
-              try {
-                const authMetaResponse = await fetch(`${authServerUrl}${wellKnownPath}`);
-                if (authMetaResponse.ok) {
-                  authServerMetadata = await authMetaResponse.json();
-                  console.log("[OAuth Test] Auth server metadata:", authServerMetadata);
-                  break;
-                }
-              } catch {
-              }
+            try {
+              authServerMetadata = await fetchAuthorizationServerMetadata(authServerUrl);
+              console.log("[OAuth Test] Auth server metadata:", authServerMetadata);
+            } catch (asMetaError) {
+              console.log(
+                "[OAuth Test] Auth server metadata unavailable:",
+                asMetaError instanceof Error ? asMetaError.message : String(asMetaError)
+              );
             }
             return {
               success: true,
               oauthType: "oauth2.1",
               message: authServerMetadata?.registration_endpoint ? 'OAuth 2.1 auto-discovery successful (DCR supported). Click "Start OAuth Flow" to authenticate.' : 'OAuth 2.1 auto-discovery successful. Click "Start OAuth Flow" to authenticate.',
-              metadataUrl,
+              metadataUrl: rfc9728Url,
               authorizationServers: metadata.authorization_servers,
               scopesSupported: metadata.scopes_supported,
               authServerMetadata: authServerMetadata ? {
@@ -9233,7 +9346,7 @@ async function registerMCPServices(ctx, sessionsService) {
               success: false,
               error: `Failed to fetch OAuth metadata: ${metadataError instanceof Error ? metadataError.message : String(metadataError)}`,
               oauthType: "oauth2.1",
-              metadataUrl
+              metadataUrl: metadataUrl ?? void 0
             };
           }
         }
@@ -9305,13 +9418,13 @@ async function registerMCPServices(ctx, sessionsService) {
           }
           return {
             success: false,
-            error: `Server requires authentication (401) but no OAuth 2.1 auto-discovery headers found.`,
+            error: "Server requires authentication (401) but OAuth 2.1 auto-discovery failed at every step.",
             oauthType: "unknown",
             mcpStatus: probeResponse.status,
             wwwAuthenticate: wwwAuthenticate || "<not present>",
             responseHeaders: allHeaders,
             responseBody: responseBody.substring(0, 500),
-            hint: "The server may require: (1) OAuth 2.1 setup on server side, (2) Client Credentials with explicit token URL, or (3) Different auth method."
+            hint: `${DISCOVERY_CASCADE_TRIED} None returned valid metadata. Options: (a) provide Client Credentials with explicit token URL, (b) ask the MCP server operator to publish OAuth metadata, or (c) configure manual OAuth URLs in the server settings.`
           };
         }
         return {
@@ -9361,12 +9474,12 @@ async function registerMCPServices(ctx, sessionsService) {
           };
         }
         const wwwAuthenticate = probeResponse.headers.get("www-authenticate") || "";
-        const { resolveResourceMetadataUrl } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
-        const resolved = await resolveResourceMetadataUrl(wwwAuthenticate, data.mcp_url);
-        if (!resolved) {
+        const { resolveMCPOAuthDiscovery } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
+        const discovery = await resolveMCPOAuthDiscovery(wwwAuthenticate, data.mcp_url);
+        if (!discovery) {
           return {
             success: false,
-            error: "Server returned 401 but does not advertise OAuth metadata. No resource_metadata in WWW-Authenticate header and no .well-known/oauth-protected-resource endpoint found."
+            error: `Server returned 401 but does not advertise OAuth metadata. ${DISCOVERY_CASCADE_TRIED} None succeeded.`
           };
         }
         const connection = params?.connection;
@@ -9376,7 +9489,8 @@ async function registerMCPServices(ctx, sessionsService) {
           result = await startTwoPhaseMCPOAuthFlow({
             mcpUrl: data.mcp_url,
             wwwAuthenticate,
-            resourceMetadataUrl: resolved.metadataUrl,
+            resourceMetadataUrl: discovery.kind === "resource-metadata" ? discovery.metadataUrl : void 0,
+            prefetchedAuthServerMetadata: discovery.kind === "authorization-server" ? discovery.authServerMetadata : void 0,
             mcpServerId: data.mcp_server_id,
             userId,
             oauthMode,
@@ -9694,14 +9808,15 @@ async function registerMCPServices(ctx, sessionsService) {
             });
             const wwwAuthenticate = probeResponse.headers.get("www-authenticate");
             if (probeResponse.status !== 401) return void 0;
-            const { resolveResourceMetadataUrl } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
-            const resolved = await resolveResourceMetadataUrl(wwwAuthenticate, mcpUrl);
-            if (!resolved) return void 0;
+            const { resolveMCPOAuthDiscovery } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
+            const discovery = await resolveMCPOAuthDiscovery(wwwAuthenticate, mcpUrl);
+            if (!discovery) return void 0;
             const connection = params?.connection;
             const started = await startTwoPhaseMCPOAuthFlowAndAwaitToken({
               mcpUrl,
               wwwAuthenticate: wwwAuthenticate || "",
-              resourceMetadataUrl: resolved.metadataUrl,
+              resourceMetadataUrl: discovery.kind === "resource-metadata" ? discovery.metadataUrl : void 0,
+              prefetchedAuthServerMetadata: discovery.kind === "authorization-server" ? discovery.authServerMetadata : void 0,
               mcpServerId: serverId,
               userId: params?.user?.user_id,
               // Discover writes the token via the shared MCP server row when