agor-live 0.17.2 → 0.17.3

package/dist/core/config/index.js

@@ -406,6 +406,9 @@ function loadConfigSync() {
     );
   }
 }
+function isConfigCredentialKey(key) {
+  return CONFIG_CREDENTIAL_KEYS.has(key);
+}
 function getCredential(key) {
   try {
     const config = loadConfigSync();
@@ -501,7 +504,7 @@ async function getReposDirAsync() {
 async function getWorktreesDirAsync() {
   return path2.join(await getDataHomeAsync(), "worktrees");
 }
-var PublicBaseUrlNotConfiguredError;
+var PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
     "use strict";
@@ -514,6 +517,13 @@ var init_config_manager = __esm({
         this.name = "PublicBaseUrlNotConfiguredError";
       }
     };
+    CONFIG_CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+      "ANTHROPIC_API_KEY",
+      "ANTHROPIC_AUTH_TOKEN",
+      "ANTHROPIC_BASE_URL",
+      "OPENAI_API_KEY",
+      "GEMINI_API_KEY"
+    ]);
   }
 });
 
@@ -985,6 +995,7 @@ var init_schema_postgres = __esm({
         completed_at: t.timestamp("completed_at"),
         status: text("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -996,6 +1007,8 @@ var init_schema_postgres = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer("queue_position"),
         // User attribution
         created_by: varchar("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -1005,7 +1018,12 @@ var init_schema_postgres = __esm({
       (table) => ({
         sessionIdx: index("tasks_session_idx").on(table.session_id),
         statusIdx: index("tasks_status_idx").on(table.status),
-        createdIdx: index("tasks_created_idx").on(table.created_at)
+        createdIdx: index("tasks_created_idx").on(table.created_at),
+        queueIdx: index("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql2`${table.status} = 'queued'`)
       })
     );
     serializedSessions = pgTable(
@@ -1065,11 +1083,9 @@ var init_schema_postgres = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text("parent_tool_use_id"),
-        // Message queueing fields
-        status: text("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t.json("data").$type().notNull()
       },
@@ -1077,8 +1093,7 @@ var init_schema_postgres = __esm({
         // Indexes for efficient lookups
         sessionIdx: index("messages_session_id_idx").on(table.session_id),
         taskIdx: index("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards = pgTable(
@@ -1723,6 +1738,7 @@ var init_schema_sqlite = __esm({
         completed_at: t2.timestamp("completed_at"),
         status: text2("status", {
           enum: [
+            "queued",
             "created",
             "running",
             "stopping",
@@ -1734,6 +1750,8 @@ var init_schema_sqlite = __esm({
             "stopped"
           ]
         }).notNull(),
+        // Queue position (lower drains first); only populated for status='queued'
+        queue_position: integer2("queue_position"),
         // User attribution
         created_by: text2("created_by", { length: 36 }).notNull().default("anonymous"),
         // MD5 of SDK session file at task completion (only populated when stateless_fs_mode is enabled)
@@ -1743,7 +1761,12 @@ var init_schema_sqlite = __esm({
       (table) => ({
         sessionIdx: index2("tasks_session_idx").on(table.session_id),
         statusIdx: index2("tasks_status_idx").on(table.status),
-        createdIdx: index2("tasks_created_idx").on(table.created_at)
+        createdIdx: index2("tasks_created_idx").on(table.created_at),
+        queueIdx: index2("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
+        // Partial unique index — defense-in-depth for `tasks.createPending` race
+        // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
+        // rows have NULL queue_position and are unaffected.
+        queuedPositionUnique: uniqueIndex2("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(sql3`${table.status} = 'queued'`)
       })
     );
     serializedSessions2 = sqliteTable(
@@ -1803,11 +1826,9 @@ var init_schema_sqlite = __esm({
         // First 200 chars for list views
         // Parent tool use ID (for nested tool calls - e.g., Task tool spawning Read/Grep)
         parent_tool_use_id: text2("parent_tool_use_id"),
-        // Message queueing fields
-        status: text2("status", { enum: ["queued"] }),
-        // 'queued' or null (normal message)
-        queue_position: integer2("queue_position"),
-        // Position in queue (1, 2, 3, ...)
+        // NOTE: queueing moved off `messages` and onto `tasks.status='queued'` as
+        // of migration sqlite/0040 (postgres/0030). The legacy `status` and
+        // `queue_position` columns are gone — see `tasks.queue_position` instead.
         // Full data (JSON blob)
         data: t2.json("data").$type().notNull()
       },
@@ -1815,8 +1836,7 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: index2("messages_session_id_idx").on(table.session_id),
         taskIdx: index2("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index),
-        queueIdx: index2("messages_queue_idx").on(table.session_id, table.status, table.queue_position)
+        sessionIndexIdx: index2("messages_session_index_idx").on(table.session_id, table.index)
       })
     );
     boards2 = sqliteTable(
@@ -3044,6 +3064,7 @@ var ALLOWED_ENV_VARS = /* @__PURE__ */ new Set([
   "ANTHROPIC_BASE_URL",
   "ANTHROPIC_AUTH_TOKEN",
   "OPENAI_API_KEY",
+  "OPENAI_BASE_URL",
   "GEMINI_API_KEY",
   "GOOGLE_API_KEY",
   // Vertex AI (Claude Code on GCP)
@@ -3084,7 +3105,7 @@ var AGOR_INTERNAL_ENV_VARS = /* @__PURE__ */ new Set([
 ]);
 async function resolveUserEnvironment(userId, db, options = {}) {
   const env = {};
-  const { sessionId } = options;
+  const { sessionId, tool } = options;
   try {
     const row = await select(db).from(users3).where(eq2(users3.user_id, userId)).one();
     if (row) {
@@ -3118,16 +3139,22 @@ async function resolveUserEnvironment(userId, db, options = {}) {
           console.error(`Failed to decrypt env var ${key} for user ${userId}:`, err);
         }
       }
-      const encryptedApiKeys = data.api_keys;
-      if (encryptedApiKeys) {
-        for (const [key, encryptedValue] of Object.entries(encryptedApiKeys)) {
-          try {
-            const decryptedValue = decryptApiKey(encryptedValue);
-            if (decryptedValue && decryptedValue.trim() !== "") {
-              env[key] = decryptedValue;
+      if (tool) {
+        const toolFields = data.agentic_tools?.[tool];
+        if (toolFields) {
+          for (const [key, encryptedValue] of Object.entries(toolFields)) {
+            if (!encryptedValue) continue;
+            try {
+              const decryptedValue = decryptApiKey(encryptedValue);
+              if (decryptedValue && decryptedValue.trim() !== "") {
+                env[key] = decryptedValue;
+              }
+            } catch (err) {
+              console.error(
+                `Failed to decrypt agentic_tools.${tool}.${key} for user ${userId}:`,
+                err
+              );
             }
-          } catch (err) {
-            console.error(`Failed to decrypt API key ${key} for user ${userId}:`, err);
           }
         }
       }
@@ -3165,7 +3192,7 @@ function buildAllowlistedEnv() {
   }
   return env;
 }
-async function createUserProcessEnvironment(userId, db, additionalEnv, forImpersonation = false, gatewayEnv, sessionId) {
+async function createUserProcessEnvironment(userId, db, additionalEnv, forImpersonation = false, gatewayEnv, sessionId, tool) {
   const env = buildAllowlistedEnv();
   const USER_IDENTITY_VARS = ["HOME", "USER", "LOGNAME", "SHELL"];
   if (forImpersonation) {
@@ -3183,7 +3210,7 @@ async function createUserProcessEnvironment(userId, db, additionalEnv, forImpers
     }
   }
   if (userId && db) {
-    const userEnv = await resolveUserEnvironment(userId, db, { sessionId });
+    const userEnv = await resolveUserEnvironment(userId, db, { sessionId, tool });
     for (const [key, value] of Object.entries(userEnv)) {
       if (value && value.trim() !== "") {
         env[key] = value;
@@ -3480,7 +3507,7 @@ init_esm_shims();
 init_types();
 init_config_manager();
 init_ids();
-import { and as and9, desc as desc2, eq as eq15, inArray as inArray2, isNotNull as isNotNull2, isNull as isNull2, like as like9, or as or3, sql as sql7 } from "drizzle-orm";
+import { and as and9, desc as desc2, eq as eq15, inArray as inArray2, isNotNull as isNotNull2, like as like9, or as or3, sql as sql7 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 
@@ -3512,10 +3539,11 @@ import { and as and12, eq as eq19 } from "drizzle-orm";
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and13, eq as eq20, isNull as isNull3 } from "drizzle-orm";
+import { and as and13, eq as eq20, isNull as isNull2 } from "drizzle-orm";
 
 // src/db/repositories/users.ts
 init_esm_shims();
+init_types();
 import { eq as eq21, like as like12 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
@@ -3527,18 +3555,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import {
-  and as and14,
-  desc as desc3,
-  eq as eq22,
-  getTableColumns,
-  inArray as inArray3,
-  isNotNull as isNotNull3,
-  isNull as isNull4,
-  like as like13,
-  or as or4,
-  sql as sql9
-} from "drizzle-orm";
+import { and as and14, desc as desc3, eq as eq22, getTableColumns, inArray as inArray3, isNotNull as isNotNull3, like as like13, or as or4, sql as sql9 } from "drizzle-orm";
 
 // src/db/index.ts
 init_schema();
@@ -3572,7 +3589,18 @@ async function resolveApiKey(keyName, context = {}) {
     const row = await select(context.db).from(users3).where(eq24(users3.user_id, context.userId)).one();
     if (row) {
       const data = row.data;
-      const encryptedKey = data.api_keys?.[keyName];
+      let encryptedKey;
+      const tools = data.agentic_tools ?? {};
+      if (context.tool) {
+        encryptedKey = tools[context.tool]?.[keyName];
+      } else {
+        for (const fields of Object.values(tools)) {
+          if (fields?.[keyName]) {
+            encryptedKey = fields[keyName];
+            break;
+          }
+        }
+      }
       if (encryptedKey) {
         try {
           const decryptedKey = decryptApiKey(encryptedKey);
@@ -3597,12 +3625,13 @@ async function resolveApiKey(keyName, context = {}) {
   } else if (!context.db) {
     console.log(`   \u2192 Skipping user-level check (no database connection)`);
   }
-  console.log(`   \u2192 Checking app-level configuration (config.yaml)...`);
-  const globalKey = getCredential(keyName);
-  if (globalKey && globalKey.length > 0) {
-    console.log(`   \u2713 Found app-level API key for ${keyName} (from config.yaml)`);
-    return { apiKey: globalKey, source: "config", useNativeAuth: false };
-  } else {
+  if (isConfigCredentialKey(keyName)) {
+    console.log(`   \u2192 Checking app-level configuration (config.yaml)...`);
+    const globalKey = getCredential(keyName);
+    if (globalKey && globalKey.length > 0) {
+      console.log(`   \u2713 Found app-level API key for ${keyName} (from config.yaml)`);
+      return { apiKey: globalKey, source: "config", useNativeAuth: false };
+    }
     console.log(`   \u2717 No app-level API key for ${keyName}`);
   }
   console.log(`   \u2192 Checking OS-level environment variables...`);
@@ -3610,16 +3639,17 @@ async function resolveApiKey(keyName, context = {}) {
   if (envKey && envKey.length > 0) {
     console.log(`   \u2713 Found OS-level environment variable ${keyName}`);
     return { apiKey: envKey, source: "env", useNativeAuth: false };
-  } else {
-    console.log(`   \u2717 No OS-level environment variable ${keyName}`);
   }
+  console.log(`   \u2717 No OS-level environment variable ${keyName}`);
   console.log(`   \u2139\uFE0F  No API key found for ${keyName} - SDK will use native authentication`);
   return { apiKey: void 0, source: "none", useNativeAuth: true };
 }
 function resolveApiKeySync(keyName) {
-  const globalKey = getCredential(keyName);
-  if (globalKey && globalKey.length > 0) {
-    return { apiKey: globalKey, source: "config", useNativeAuth: false };
+  if (isConfigCredentialKey(keyName)) {
+    const globalKey = getCredential(keyName);
+    if (globalKey && globalKey.length > 0) {
+      return { apiKey: globalKey, source: "config", useNativeAuth: false };
+    }
   }
   const envKey = process.env[keyName];
   if (envKey && envKey.length > 0) {
@@ -4218,6 +4248,7 @@ export {
   getWorktreesDir,
   getWorktreesDirAsync,
   initConfig,
+  isConfigCredentialKey,
   isEnvVarAllowed,
   isUnixImpersonationEnabled,
   isValid,

package/dist/core/{config-manager-TxxjFMRd.d.cts → config-manager-B8TP9Kz0.d.cts}

@@ -1,4 +1,4 @@
-import { a as AgorConfig } from './types-DNqfdt1z.cjs';
+import { a as AgorConfig } from './types-D4Rl6ZKN.cjs';
 
 /**
  * Agor Config Manager
@@ -139,6 +139,15 @@ declare function requirePublicBaseUrl(): Promise<string>;
  * Use for hot paths where async is not possible.
  */
 declare function loadConfigSync(): AgorConfig;
+/**
+ * Credential keys that are valid in `config.yaml`'s `credentials` section
+ * (i.e., keys that have a meaningful global / app-level value). User-only
+ * tokens like `CLAUDE_CODE_OAUTH_TOKEN` (Pro/Max subscription) and
+ * `COPILOT_GITHUB_TOKEN` are intentionally excluded — they don't make sense
+ * as a global default.
+ */
+type ConfigCredentialKey = 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'ANTHROPIC_BASE_URL' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY';
+declare function isConfigCredentialKey(key: string): key is ConfigCredentialKey;
 /**
  * Get credential with precedence: config.yaml > process.env
  *
@@ -148,7 +157,7 @@ declare function loadConfigSync(): AgorConfig;
  * @param key - Credential key from CredentialKey enum
  * @returns API key or undefined
  */
-declare function getCredential(key: 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'ANTHROPIC_BASE_URL' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY'): string | undefined;
+declare function getCredential(key: ConfigCredentialKey): string | undefined;
 /**
  * Get the Unix user that the Agor daemon runs as
  *
@@ -268,4 +277,4 @@ declare function getReposDirAsync(): Promise<string>;
  */
 declare function getWorktreesDirAsync(): Promise<string>;
 
-export { saveConfig as A, setConfigValue as B, unsetConfigValue as C, PublicBaseUrlNotConfiguredError as P, expandHomePath as a, getBaseUrl as b, getConfigPath as c, getConfigValue as d, ensureCodexHome as e, getCredential as f, getAgorHome as g, getDaemonUrl as h, getDaemonUser as i, getDataHome as j, getDataHomeAsync as k, getDefaultConfig as l, getReposDir as m, getReposDirAsync as n, getWorktreePath as o, getWorktreesDir as p, getWorktreesDirAsync as q, initConfig as r, isUnixImpersonationEnabled as s, isWorktreeRbacEnabled as t, loadConfig as u, loadConfigFromFile as v, loadConfigSync as w, requireDaemonUser as x, requirePublicBaseUrl as y, resolveCodexHome as z };
+export { resolveCodexHome as A, saveConfig as B, type ConfigCredentialKey as C, setConfigValue as D, unsetConfigValue as E, PublicBaseUrlNotConfiguredError as P, expandHomePath as a, getBaseUrl as b, getConfigPath as c, getConfigValue as d, ensureCodexHome as e, getCredential as f, getAgorHome as g, getDaemonUrl as h, getDaemonUser as i, getDataHome as j, getDataHomeAsync as k, getDefaultConfig as l, getReposDir as m, getReposDirAsync as n, getWorktreePath as o, getWorktreesDir as p, getWorktreesDirAsync as q, initConfig as r, isConfigCredentialKey as s, isUnixImpersonationEnabled as t, isWorktreeRbacEnabled as u, loadConfig as v, loadConfigFromFile as w, loadConfigSync as x, requireDaemonUser as y, requirePublicBaseUrl as z };

package/dist/core/{config-manager-DTrsj6G3.d.ts → config-manager-CDEB0FY4.d.ts}

@@ -1,4 +1,4 @@
-import { a as AgorConfig } from './types-DqPMmTad.js';
+import { a as AgorConfig } from './types-n61iaXub.js';
 
 /**
  * Agor Config Manager
@@ -139,6 +139,15 @@ declare function requirePublicBaseUrl(): Promise<string>;
  * Use for hot paths where async is not possible.
  */
 declare function loadConfigSync(): AgorConfig;
+/**
+ * Credential keys that are valid in `config.yaml`'s `credentials` section
+ * (i.e., keys that have a meaningful global / app-level value). User-only
+ * tokens like `CLAUDE_CODE_OAUTH_TOKEN` (Pro/Max subscription) and
+ * `COPILOT_GITHUB_TOKEN` are intentionally excluded — they don't make sense
+ * as a global default.
+ */
+type ConfigCredentialKey = 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'ANTHROPIC_BASE_URL' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY';
+declare function isConfigCredentialKey(key: string): key is ConfigCredentialKey;
 /**
  * Get credential with precedence: config.yaml > process.env
  *
@@ -148,7 +157,7 @@ declare function loadConfigSync(): AgorConfig;
  * @param key - Credential key from CredentialKey enum
  * @returns API key or undefined
  */
-declare function getCredential(key: 'ANTHROPIC_API_KEY' | 'ANTHROPIC_AUTH_TOKEN' | 'ANTHROPIC_BASE_URL' | 'OPENAI_API_KEY' | 'GEMINI_API_KEY'): string | undefined;
+declare function getCredential(key: ConfigCredentialKey): string | undefined;
 /**
  * Get the Unix user that the Agor daemon runs as
  *
@@ -268,4 +277,4 @@ declare function getReposDirAsync(): Promise<string>;
  */
 declare function getWorktreesDirAsync(): Promise<string>;
 
-export { saveConfig as A, setConfigValue as B, unsetConfigValue as C, PublicBaseUrlNotConfiguredError as P, expandHomePath as a, getBaseUrl as b, getConfigPath as c, getConfigValue as d, ensureCodexHome as e, getCredential as f, getAgorHome as g, getDaemonUrl as h, getDaemonUser as i, getDataHome as j, getDataHomeAsync as k, getDefaultConfig as l, getReposDir as m, getReposDirAsync as n, getWorktreePath as o, getWorktreesDir as p, getWorktreesDirAsync as q, initConfig as r, isUnixImpersonationEnabled as s, isWorktreeRbacEnabled as t, loadConfig as u, loadConfigFromFile as v, loadConfigSync as w, requireDaemonUser as x, requirePublicBaseUrl as y, resolveCodexHome as z };
+export { resolveCodexHome as A, saveConfig as B, type ConfigCredentialKey as C, setConfigValue as D, unsetConfigValue as E, PublicBaseUrlNotConfiguredError as P, expandHomePath as a, getBaseUrl as b, getConfigPath as c, getConfigValue as d, ensureCodexHome as e, getCredential as f, getAgorHome as g, getDaemonUrl as h, getDaemonUser as i, getDataHome as j, getDataHomeAsync as k, getDefaultConfig as l, getReposDir as m, getReposDirAsync as n, getWorktreePath as o, getWorktreesDir as p, getWorktreesDirAsync as q, initConfig as r, isConfigCredentialKey as s, isUnixImpersonationEnabled as t, isWorktreeRbacEnabled as u, loadConfig as v, loadConfigFromFile as w, loadConfigSync as x, requireDaemonUser as y, requirePublicBaseUrl as z };

package/dist/core/{config-services-YEZ4DwCD.d.cts → config-services-CXyQKEK5.d.cts}

@@ -1,7 +1,7 @@
 import { c as AgenticToolName } from './agentic-tool-BulhIUGb.cjs';
 import { R as Repo, h as Worktree } from './repo-Ckl-vaAk.cjs';
 import { P as PermissionMode } from './session-MNU4BQv4.cjs';
-import { g as User } from './user-DkNdeFoz.cjs';
+import { q as User } from './user-CpfkcV2C.cjs';
 
 type ResourceRepoConfig = Pick<Repo, 'repo_id' | 'slug' | 'remote_url' | 'repo_type' | 'default_branch'> & {
     /**

package/dist/core/{config-services-DcO2GRgh.d.ts → config-services-DhM7_yWn.d.ts}

@@ -1,7 +1,7 @@
 import { c as AgenticToolName } from './agentic-tool-cYqsU5i5.js';
 import { R as Repo, h as Worktree } from './repo-84E0A2gV.js';
 import { P as PermissionMode } from './session-CAfhv1qL.js';
-import { g as User } from './user-BfVWBmXA.js';
+import { q as User } from './user-DP-XZMIM.js';
 
 type ResourceRepoConfig = Pick<Repo, 'repo_id' | 'slug' | 'remote_url' | 'repo_type' | 'default_branch'> & {
     /**