agor-live 0.18.0 → 0.19.1

package/dist/core/seed/index.js

@@ -49,6 +49,7 @@ var init_constants = __esm({
 var config_manager_exports = {};
 __export(config_manager_exports, {
   PublicBaseUrlNotConfiguredError: () => PublicBaseUrlNotConfiguredError,
+  __resetConfigCacheForTests: () => __resetConfigCacheForTests,
   expandHomePath: () => expandHomePath,
   getAgorHome: () => getAgorHome,
   getBaseUrl: () => getBaseUrl,
@@ -79,11 +80,50 @@ __export(config_manager_exports, {
   setConfigValue: () => setConfigValue,
   unsetConfigValue: () => unsetConfigValue
 });
-import { readFileSync } from "fs";
+import { readFileSync, statSync } from "fs";
 import fs from "fs/promises";
 import os from "os";
 import path2 from "path";
 import yaml from "js-yaml";
+function cacheKeyMatches(a, b) {
+  return a.mtimeMs === b.mtimeMs && a.size === b.size;
+}
+function statCacheKey(configPath) {
+  try {
+    const stat2 = statSync(configPath);
+    return { mtimeMs: stat2.mtimeMs, size: stat2.size };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return NO_FILE_KEY;
+    }
+    return null;
+  }
+}
+function readCachedConfig(configPath) {
+  if (cachedEntry === null || cachedEntry.path !== configPath) {
+    return null;
+  }
+  const currentKey = statCacheKey(configPath);
+  if (currentKey === null || !cacheKeyMatches(currentKey, cachedEntry.key)) {
+    return null;
+  }
+  return structuredClone(cachedEntry.config);
+}
+function writeCachedConfig(configPath, config, key) {
+  cachedEntry = { path: configPath, config: structuredClone(config), key };
+}
+function invalidateConfigCache() {
+  cachedEntry = null;
+}
+function __resetConfigCacheForTests() {
+  invalidateConfigCache();
+}
+function parseAndValidateConfig(content) {
+  const parsed = yaml.load(content);
+  const finalConfig = parsed || {};
+  validateConfig(finalConfig);
+  return finalConfig;
+}
 function getAgorHome() {
   return path2.join(os.homedir(), ".agor");
 }
@@ -113,27 +153,48 @@ To update: agor config set execution.unix_user_mode insulated`
 }
 async function loadConfig() {
   const configPath = getConfigPath();
+  const cached = readCachedConfig(configPath);
+  if (cached !== null) {
+    return cached;
+  }
+  let beforeKey;
+  let content;
+  let afterKey;
   try {
-    const content = await fs.readFile(configPath, "utf-8");
-    const config = yaml.load(content);
-    const finalConfig = config || {};
-    validateConfig(finalConfig);
-    return finalConfig;
+    beforeKey = statCacheKey(configPath);
+    if (beforeKey?.mtimeMs === NO_FILE) {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    content = await fs.readFile(configPath, "utf-8");
+    afterKey = statCacheKey(configPath);
   } catch (error) {
     if (error.code === "ENOENT") {
-      return getDefaultConfig();
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
     }
     throw new Error(
       `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
     );
   }
+  let finalConfig;
+  try {
+    finalConfig = parseAndValidateConfig(content);
+  } catch (error) {
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (beforeKey !== null && afterKey !== null && cacheKeyMatches(beforeKey, afterKey)) {
+    writeCachedConfig(configPath, finalConfig, beforeKey);
+  }
+  return finalConfig;
 }
 async function loadConfigFromFile(filePath) {
   const content = await fs.readFile(filePath, "utf-8");
-  const config = yaml.load(content);
-  const finalConfig = config || {};
-  validateConfig(finalConfig);
-  return finalConfig;
+  return parseAndValidateConfig(content);
 }
 async function saveConfig(config) {
   await ensureAgorHome();
@@ -144,6 +205,7 @@ async function saveConfig(config) {
     noRefs: true
   });
   await fs.writeFile(configPath, content, "utf-8");
+  invalidateConfigCache();
 }
 function getDefaultConfig() {
   return {
@@ -153,8 +215,7 @@ function getDefaultConfig() {
     },
     display: {
       tableStyle: "unicode",
-      colorOutput: true,
-      shortIdLength: 8
+      colorOutput: true
     },
     daemon: {
       port: DAEMON.DEFAULT_PORT,
@@ -305,18 +366,44 @@ async function requirePublicBaseUrl() {
 }
 function loadConfigSync() {
   const configPath = getConfigPath();
+  const cached = readCachedConfig(configPath);
+  if (cached !== null) {
+    return cached;
+  }
+  let beforeKey;
+  let content;
+  let afterKey;
   try {
-    const content = readFileSync(configPath, "utf-8");
-    const config = yaml.load(content);
-    return config || {};
+    beforeKey = statCacheKey(configPath);
+    if (beforeKey?.mtimeMs === NO_FILE) {
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
+    }
+    content = readFileSync(configPath, "utf-8");
+    afterKey = statCacheKey(configPath);
   } catch (error) {
     if (error.code === "ENOENT") {
-      return getDefaultConfig();
+      const defaults = getDefaultConfig();
+      writeCachedConfig(configPath, defaults, NO_FILE_KEY);
+      return defaults;
     }
     throw new Error(
       `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
     );
   }
+  let finalConfig;
+  try {
+    finalConfig = parseAndValidateConfig(content);
+  } catch (error) {
+    throw new Error(
+      `Failed to load config: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  if (beforeKey !== null && afterKey !== null && cacheKeyMatches(beforeKey, afterKey)) {
+    writeCachedConfig(configPath, finalConfig, beforeKey);
+  }
+  return finalConfig;
 }
 function isConfigCredentialKey(key) {
   return CONFIG_CREDENTIAL_KEYS.has(key);
@@ -419,12 +506,15 @@ async function getReposDirAsync() {
 async function getWorktreesDirAsync() {
   return path2.join(await getDataHomeAsync(), "worktrees");
 }
-var PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
+var NO_FILE, NO_FILE_KEY, cachedEntry, PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
     "use strict";
     init_esm_shims();
     init_constants();
+    NO_FILE = -1;
+    NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
+    cachedEntry = null;
     PublicBaseUrlNotConfiguredError = class extends Error {
       code = "PUBLIC_BASE_URL_NOT_CONFIGURED";
       constructor(message) {
@@ -443,9 +533,12 @@ var init_config_manager = __esm({
 });
 
 // src/types/id.ts
-function toShortId(id, length = 8) {
+function toShortId(id, length = SHORT_ID_LENGTH) {
   return id.replace(/-/g, "").slice(0, Math.min(length, 32));
 }
+function shortId(id) {
+  return toShortId(id, SHORT_ID_LENGTH);
+}
 function prefixToLikePattern(prefix) {
   const clean = prefix.replace(/-/g, "").toLowerCase();
   const breaks = [8, 12, 16, 20];
@@ -460,25 +553,24 @@ function prefixToLikePattern(prefix) {
   }
   return `${out}${clean.slice(cursor)}%`;
 }
-var URL_SHORT_ID_LENGTH;
+var SHORT_ID_LENGTH;
 var init_id = __esm({
   "src/types/id.ts"() {
     "use strict";
     init_esm_shims();
-    URL_SHORT_ID_LENGTH = 16;
+    SHORT_ID_LENGTH = 24;
   }
 });
 
 // src/lib/ids.ts
+import { randomBytes } from "crypto";
 import { v7 as uuidv7 } from "uuid";
 function generateId() {
-  return uuidv7();
-}
-function shortId(uuid, length = 8) {
-  return toShortId(uuid, length);
+  return uuidv7({ random: randomBytes(16) });
 }
-function formatShortId(uuid, length = 8) {
-  return shortId(uuid, length);
+function isValidUUID(value) {
+  const uuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  return uuidPattern.test(value);
 }
 var init_ids = __esm({
   "src/lib/ids.ts"() {
@@ -936,6 +1028,14 @@ var init_utils = __esm({
   }
 });
 
+// src/types/widget.ts
+var init_widget = __esm({
+  "src/types/widget.ts"() {
+    "use strict";
+    init_esm_shims();
+  }
+});
+
 // src/types/worktree.ts
 var WORKTREE_PERMISSION_LEVELS;
 var init_worktree = __esm({
@@ -975,6 +1075,7 @@ var init_types = __esm({
     init_ui();
     init_user();
     init_utils();
+    init_widget();
     init_worktree();
   }
 });
@@ -1066,7 +1167,7 @@ var init_schema_postgres = __esm({
           ]
         }).notNull(),
         agentic_tool: text("agentic_tool", {
-          enum: ["claude-code", "codex", "gemini", "opencode", "copilot"]
+          enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot"]
         }).notNull(),
         board_id: varchar("board_id", { length: 36 }),
         // NULL = no board
@@ -1191,7 +1292,10 @@ var init_schema_postgres = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash",
+            "widget_request"
           ]
         }).notNull(),
         role: text("role", {
@@ -1827,7 +1931,7 @@ var init_schema_sqlite = __esm({
           ]
         }).notNull(),
         agentic_tool: text2("agentic_tool", {
-          enum: ["claude-code", "codex", "gemini", "opencode", "copilot"]
+          enum: ["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot"]
         }).notNull(),
         board_id: text2("board_id", { length: 36 }),
         // NULL = no board
@@ -1952,7 +2056,10 @@ var init_schema_sqlite = __esm({
             "system",
             "file-history-snapshot",
             "permission_request",
-            "input_request"
+            "input_request",
+            "daemon_restart",
+            "daemon_crash",
+            "widget_request"
           ]
         }).notNull(),
         role: text2("role", {
@@ -2949,6 +3056,8 @@ import { and as and2, eq as eq2, like, or } from "drizzle-orm";
 
 // src/db/repositories/base.ts
 init_esm_shims();
+init_ids();
+init_id();
 var RepositoryError = class extends Error {
   constructor(message, cause) {
     super(message);
@@ -2975,10 +3084,24 @@ var AmbiguousIdError = class extends RepositoryError {
     this.name = "AmbiguousIdError";
   }
 };
+async function resolveByShortIdPrefix(id, entityType, fetchMatches) {
+  if (isValidUUID(id)) {
+    return id;
+  }
+  const pattern = prefixToLikePattern(id);
+  const matches = await fetchMatches(pattern);
+  if (matches.length === 0) {
+    throw new EntityNotFoundError(entityType, id);
+  }
+  if (matches.length > 1) {
+    throw new AmbiguousIdError(entityType, id, matches);
+  }
+  return matches[0];
+}
+var RESOLVE_SHORT_ID_FETCH_LIMIT = 11;
 
 // src/db/repositories/board-comments.ts
 init_esm_shims();
-init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3288,7 +3411,7 @@ function generateSlug(name) {
 init_esm_shims();
 init_ids();
 function getBoardUrl(boardId, boardSlug, baseUrl) {
-  const boardParam = boardSlug || shortId(boardId, URL_SHORT_ID_LENGTH);
+  const boardParam = boardSlug || shortId(boardId);
   return `${baseUrl}/b/${boardParam}`;
 }
 
@@ -3352,25 +3475,13 @@ var BoardRepository = class {
     };
   }
   /**
-   * Resolve short ID to full ID
+   * Resolve short ID to full ID via the centralized helper.
    */
   async resolveId(id) {
-    if (id.length === 36 && id.includes("-")) {
-      return id;
-    }
-    const pattern = prefixToLikePattern(id);
-    const results = await select(this.db).from(boards3).where(like3(boards3.board_id, pattern)).all();
-    if (results.length === 0) {
-      throw new EntityNotFoundError("Board", id);
-    }
-    if (results.length > 1) {
-      throw new AmbiguousIdError(
-        "Board",
-        id,
-        results.map((r) => r.board_id)
-      );
-    }
-    return results[0].board_id;
+    return resolveByShortIdPrefix(id, "Board", async (pattern) => {
+      const rows = await select(this.db).from(boards3).where(like3(boards3.board_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      return rows.map((r) => r.board_id);
+    });
   }
   /**
    * Generate a unique slug for a board.
@@ -3868,7 +3979,6 @@ var BoardRepository = class {
 
 // src/db/repositories/card-types.ts
 init_esm_shims();
-init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3876,7 +3986,6 @@ import { eq as eq8, like as like4 } from "drizzle-orm";
 
 // src/db/repositories/cards.ts
 init_esm_shims();
-init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3891,7 +4000,7 @@ import { eq as eq10, like as like6 } from "drizzle-orm";
 
 // src/db/encryption.ts
 init_esm_shims();
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from "crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes2, scryptSync } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 var KEY_LENGTH = 32;
 var IV_LENGTH = 16;
@@ -3914,8 +4023,8 @@ function encryptApiKey(plaintext, secret) {
   if (!masterSecret) {
     return plaintext;
   }
-  const salt = randomBytes(SALT_LENGTH);
-  const iv = randomBytes(IV_LENGTH);
+  const salt = randomBytes2(SALT_LENGTH);
+  const iv = randomBytes2(IV_LENGTH);
   const key = deriveKey(masterSecret, salt);
   const cipher = createCipheriv(ALGORITHM, key, iv);
   const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -3953,7 +4062,6 @@ init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
-init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -3967,7 +4075,6 @@ import { and as and7, eq as eq12 } from "drizzle-orm";
 
 // src/db/repositories/repos.ts
 init_esm_shims();
-init_types();
 import { eq as eq13, like as like8, sql as sql5 } from "drizzle-orm";
 
 // src/config/variant-resolver.ts
@@ -4154,25 +4261,13 @@ var RepoRepository = class {
     };
   }
   /**
-   * Resolve short ID to full ID
+   * Resolve short ID to full ID via the centralized helper.
    */
   async resolveId(id) {
-    if (id.length === 36 && id.includes("-")) {
-      return id;
-    }
-    const pattern = prefixToLikePattern(id);
-    const results = await select(this.db).from(repos3).where(like8(repos3.repo_id, pattern)).all();
-    if (results.length === 0) {
-      throw new EntityNotFoundError("Repo", id);
-    }
-    if (results.length > 1) {
-      throw new AmbiguousIdError(
-        "Repo",
-        id,
-        results.map((r) => r.repo_id)
-      );
-    }
-    return results[0].repo_id;
+    return resolveByShortIdPrefix(id, "Repo", async (pattern) => {
+      const rows = await select(this.db).from(repos3).where(like8(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      return rows.map((r) => r.repo_id);
+    });
   }
   /**
    * Create a new repo
@@ -4435,7 +4530,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq18, like as like10, sql as sql7 } from "drizzle-orm";
+import { eq as eq18, inArray as inArray3, like as like10, sql as sql7 } from "drizzle-orm";
 
 // src/db/repositories/thread-session-map.ts
 init_esm_shims();
@@ -4450,7 +4545,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
 import { and as and13, eq as eq20 } from "drizzle-orm";
 
@@ -4581,25 +4676,13 @@ var UsersRepository = class {
     };
   }
   /**
-   * Resolve short ID to full ID
+   * Resolve short ID to full ID via the centralized helper.
    */
   async resolveId(id) {
-    if (id.length === 36 && id.includes("-")) {
-      return id;
-    }
-    const pattern = prefixToLikePattern(id);
-    const results = await select(this.db).from(users3).where(like12(users3.user_id, pattern)).all();
-    if (results.length === 0) {
-      throw new EntityNotFoundError("User", id);
-    }
-    if (results.length > 1) {
-      throw new AmbiguousIdError(
-        "User",
-        id,
-        results.map((r) => r.user_id)
-      );
-    }
-    return results[0].user_id;
+    return resolveByShortIdPrefix(id, "User", async (pattern) => {
+      const rows = await select(this.db).from(users3).where(like12(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      return rows.map((r) => r.user_id);
+    });
   }
   /**
    * Check if unix_username is already taken by another user
@@ -4748,7 +4831,7 @@ var UsersRepository = class {
         out[field] = decryptApiKey(encrypted);
       } catch (error) {
         console.error(
-          `[users] Failed to decrypt ${tool}.${field} for user ${userId.substring(0, 8)}: ${error.message}`
+          `[users] Failed to decrypt ${tool}.${field} for user ${shortId(userId)}: ${error.message}`
         );
       }
     }
@@ -4770,7 +4853,7 @@ var UsersRepository = class {
       return decryptApiKey(encrypted);
     } catch (error) {
       console.error(
-        `[users] Failed to decrypt ${tool}.${field} for user ${userId.substring(0, 8)}: ${error.message}`
+        `[users] Failed to decrypt ${tool}.${field} for user ${shortId(userId)}: ${error.message}`
       );
       return null;
     }
@@ -4836,7 +4919,7 @@ init_types();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and15, desc as desc3, eq as eq23, getTableColumns, inArray as inArray3, isNotNull as isNotNull3, like as like13, or as or4, sql as sql8 } from "drizzle-orm";
+import { and as and15, desc as desc3, eq as eq23, getTableColumns, inArray as inArray4, isNotNull as isNotNull3, like as like13, or as or4, sql as sql8 } from "drizzle-orm";
 var WorktreeRepository = class {
   constructor(db) {
     this.db = db;
@@ -4975,24 +5058,26 @@ var WorktreeRepository = class {
     }
   }
   /**
-   * Find worktree by exact ID or short ID prefix
+   * Find worktree by exact ID or short ID prefix.
+   *
+   * Goes through the centralized `resolveByShortIdPrefix` so the LIKE pattern
+   * is built via `prefixToLikePattern` — which re-inserts hyphens at the
+   * canonical UUID positions. Without this normalization, a prefix that
+   * spans a hyphen boundary (anything ≥9 chars) silently matches nothing
+   * because stored IDs are hyphenated.
    */
   async findById(id) {
-    if (id.length === 36 && id.includes("-")) {
-      const row = await select(this.db).from(worktrees3).where(eq23(worktrees3.worktree_id, id)).one();
+    try {
+      const fullId = await resolveByShortIdPrefix(id, "Worktree", async (pattern) => {
+        const rows = await select(this.db).from(worktrees3).where(like13(worktrees3.worktree_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+        return rows.map((r) => r.worktree_id);
+      });
+      const row = await select(this.db).from(worktrees3).where(eq23(worktrees3.worktree_id, fullId)).one();
       return row ? this.rowToWorktree(row) : null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      throw error;
     }
-    const prefix = id.replace(/-/g, "").toLowerCase();
-    const matches = await select(this.db).from(worktrees3).where(like13(worktrees3.worktree_id, `${prefix}%`)).limit(2).all();
-    if (matches.length === 0) return null;
-    if (matches.length > 1) {
-      throw new AmbiguousIdError(
-        "Worktree",
-        prefix,
-        matches.map((m) => m.worktree_id)
-      );
-    }
-    return this.rowToWorktree(matches[0]);
   }
   /**
    * Find all worktrees (with optional filters)
@@ -5185,7 +5270,7 @@ var WorktreeRepository = class {
     if (worktreeIds.length === 0) {
       return /* @__PURE__ */ new Map();
     }
-    const rows = await select(this.db).from(worktreeOwners3).where(inArray3(worktreeOwners3.worktree_id, worktreeIds)).all();
+    const rows = await select(this.db).from(worktreeOwners3).where(inArray4(worktreeOwners3.worktree_id, worktreeIds)).all();
     const ownersByWorktree = /* @__PURE__ */ new Map();
     for (const row of rows) {
       const wtId = row.worktree_id;
@@ -5216,7 +5301,7 @@ var WorktreeRepository = class {
     const conditions = [
       or4(
         isNotNull3(worktreeOwners3.user_id),
-        inArray3(
+        inArray4(
           worktrees3.others_can,
           WORKTREE_PERMISSION_LEVELS.filter((l) => l !== "none")
         )
@@ -5279,7 +5364,7 @@ var WorktreeRepository = class {
         zone_id: jsonExtract2(this.db, boardObjectsTable.data, "zone_id"),
         position: jsonExtract2(this.db, boardObjectsTable.data, "position"),
         board_data: boardsTable.data
-      }).from(boardObjectsTable).leftJoin(boardsTable, eq23(boardObjectsTable.board_id, boardsTable.board_id)).where(inArray3(boardObjectsTable.worktree_id, worktreeIds)).all();
+      }).from(boardObjectsTable).leftJoin(boardsTable, eq23(boardObjectsTable.board_id, boardsTable.board_id)).where(inArray4(boardObjectsTable.worktree_id, worktreeIds)).all();
       const boardObjectInfoByWorktree = /* @__PURE__ */ new Map();
       for (const row of rows) {
         const info = {
@@ -5358,7 +5443,7 @@ var WorktreeRepository = class {
         agentic_tool: sessionsTable.agentic_tool,
         updated_at: sessionsTable.updated_at,
         unix_username: sessionsTable.unix_username
-      }).from(sessionsTable).where(inArray3(sessionsTable.worktree_id, worktreeIds)).orderBy(sessionsTable.updated_at).all();
+      }).from(sessionsTable).where(inArray4(sessionsTable.worktree_id, worktreeIds)).orderBy(sessionsTable.updated_at).all();
       const sessionIds = sessionRows.map((s) => s.session_id);
       if (sessionIds.length === 0) {
         return worktrees4.map((wt) => ({ ...wt, sessions: [] }));
@@ -5384,7 +5469,7 @@ var WorktreeRepository = class {
       const countRows = await select(this.db, {
         session_id: messagesTable.session_id,
         count: sql8`count(*)`
-      }).from(messagesTable).where(inArray3(messagesTable.session_id, sessionIds)).groupBy(messagesTable.session_id).all();
+      }).from(messagesTable).where(inArray4(messagesTable.session_id, sessionIds)).groupBy(messagesTable.session_id).all();
       const messageCountBySession = /* @__PURE__ */ new Map();
       for (const r of countRows) {
         messageCountBySession.set(r.session_id, Number(r.count));
@@ -5450,12 +5535,17 @@ import { execSync as execSync2 } from "child_process";
 init_esm_shims();
 init_ids();
 import { execSync } from "child_process";
+
+// src/unix/short-id-naming.ts
+init_esm_shims();
+var UNIX_NAME_SHORT_ID_LENGTH = 8;
+
+// src/unix/user-manager.ts
 var AGOR_HOME_BASE = "/home";
 var AGOR_DEFAULT_SHELL = "/bin/bash";
 var AGOR_WORKTREES_DIR = "agor/worktrees";
 function generateUnixUsername(userId) {
-  const shortId2 = formatShortId(userId);
-  return `agor_${shortId2}`;
+  return `agor_${toShortId(userId, UNIX_NAME_SHORT_ID_LENGTH)}`;
 }
 function isValidUnixUsername(username) {
   return /^[a-z_][a-z0-9_-]{0,31}$/.test(username);
@@ -6224,7 +6314,7 @@ import {
   eq as eq26,
   gt,
   gte,
-  inArray as inArray4,
+  inArray as inArray5,
   like as like14,
   lte,
   or as or5,
@@ -6250,6 +6340,7 @@ init_schema();
 
 // src/db/session-guard.ts
 init_esm_shims();
+init_ids();
 
 // src/db/index.ts
 init_user_utils();
@@ -6259,6 +6350,7 @@ var hash = bcryptjs.hash;
 // src/config/key-resolver.ts
 init_database_wrapper();
 init_schema();
+init_ids();
 init_config_manager();
 
 // src/config/proxies-resolver.ts
@@ -6271,54 +6363,72 @@ init_esm_shims();
 init_esm_shims();
 var REPO_SLUG_PATTERN = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
 
-// src/config/resource-schemas.ts
+// src/config/resolved-config-slice.ts
 init_esm_shims();
 import { z } from "zod";
-var uuidSchema = z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID");
-var repoSlugSchema = z.string().regex(
+var ResolvedConfigSliceSchema = z.object({
+  /** From `config.execution.*` */
+  execution: z.object({
+    permission_timeout_ms: z.number().int().nonnegative().optional()
+  }).optional(),
+  /** From `config.opencode.*` */
+  opencode: z.object({
+    serverUrl: z.string().optional()
+  }).optional(),
+  /** From `config.daemon.*` (selected fields only) */
+  daemon: z.object({
+    host_ip_address: z.string().optional()
+  }).optional()
+});
+
+// src/config/resource-schemas.ts
+init_esm_shims();
+import { z as z2 } from "zod";
+var uuidSchema = z2.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID");
+var repoSlugSchema = z2.string().regex(
   REPO_SLUG_PATTERN,
   'Must be org/name format with alphanumeric, hyphens, underscores, or dots (e.g., "my-org/my-repo")'
 );
-var enforcedAgentConfigSchema = z.object({
-  agentic_tool: z.enum(["claude-code", "codex", "gemini", "opencode", "copilot"]).optional(),
-  permission_mode: z.string().optional(),
-  model: z.string().optional(),
-  mcp_server_ids: z.array(z.string()).optional()
+var enforcedAgentConfigSchema = z2.object({
+  agentic_tool: z2.enum(["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot"]).optional(),
+  permission_mode: z2.string().optional(),
+  model: z2.string().optional(),
+  mcp_server_ids: z2.array(z2.string()).optional()
 });
-var resourceRepoConfigSchema = z.object({
+var resourceRepoConfigSchema = z2.object({
   repo_id: uuidSchema,
   slug: repoSlugSchema,
-  remote_url: z.string().optional(),
-  repo_type: z.enum(["remote", "local"]).default("remote"),
-  default_branch: z.string().optional(),
-  shallow: z.boolean().optional()
+  remote_url: z2.string().optional(),
+  repo_type: z2.enum(["remote", "local"]).default("remote"),
+  default_branch: z2.string().optional(),
+  shallow: z2.boolean().optional()
 }).refine((data) => data.repo_type !== "remote" || data.remote_url, {
   message: 'remote_url is required when repo_type is "remote"',
   path: ["remote_url"]
 });
-var resourceWorktreeConfigSchema = z.object({
+var resourceWorktreeConfigSchema = z2.object({
   worktree_id: uuidSchema,
-  name: z.string().min(1, "Worktree name is required"),
-  ref: z.string().min(1, "Git ref is required"),
-  ref_type: z.enum(["branch", "tag"]).optional(),
-  others_can: z.enum(["none", "view", "session", "prompt", "all"]).optional(),
-  mcp_server_ids: z.array(z.string()).optional(),
+  name: z2.string().min(1, "Worktree name is required"),
+  ref: z2.string().min(1, "Git ref is required"),
+  ref_type: z2.enum(["branch", "tag"]).optional(),
+  others_can: z2.enum(["none", "view", "session", "prompt", "all"]).optional(),
+  mcp_server_ids: z2.array(z2.string()).optional(),
   repo: repoSlugSchema,
-  readonly: z.boolean().optional(),
+  readonly: z2.boolean().optional(),
   agent: enforcedAgentConfigSchema.optional()
 });
-var resourceUserConfigSchema = z.object({
+var resourceUserConfigSchema = z2.object({
   user_id: uuidSchema,
-  email: z.string().email("Must be a valid email address"),
-  name: z.string().optional(),
-  role: z.enum(["superadmin", "admin", "member", "viewer"]).default("member"),
-  unix_username: z.string().optional(),
-  password: z.string().optional()
+  email: z2.string().email("Must be a valid email address"),
+  name: z2.string().optional(),
+  role: z2.enum(["superadmin", "admin", "member", "viewer"]).default("member"),
+  unix_username: z2.string().optional(),
+  password: z2.string().optional()
 });
-var daemonResourcesConfigSchema = z.object({
-  repos: z.array(resourceRepoConfigSchema).optional(),
-  worktrees: z.array(resourceWorktreeConfigSchema).optional(),
-  users: z.array(resourceUserConfigSchema).optional()
+var daemonResourcesConfigSchema = z2.object({
+  repos: z2.array(resourceRepoConfigSchema).optional(),
+  worktrees: z2.array(resourceWorktreeConfigSchema).optional(),
+  users: z2.array(resourceUserConfigSchema).optional()
 });
 
 // src/config/resource-sync.ts
@@ -6340,7 +6450,7 @@ init_esm_shims();
 // src/unix/user-env-file.ts
 init_esm_shims();
 import { execFileSync } from "child_process";
-import { randomBytes as randomBytes3 } from "crypto";
+import { randomBytes as randomBytes4 } from "crypto";
 import { unlinkSync } from "fs";
 import { tmpdir } from "os";
 import { join as join4 } from "path";
@@ -6352,12 +6462,10 @@ init_esm_shims();
 init_esm_shims();
 init_ids();
 function generateWorktreeGroupName(worktreeId) {
-  const shortId2 = formatShortId(worktreeId);
-  return `agor_wt_${shortId2}`;
+  return `agor_wt_${toShortId(worktreeId, UNIX_NAME_SHORT_ID_LENGTH)}`;
 }
 function generateRepoGroupName(repoId) {
-  const shortId2 = formatShortId(repoId);
-  return `agor_rp_${shortId2}`;
+  return `agor_rp_${toShortId(repoId, UNIX_NAME_SHORT_ID_LENGTH)}`;
 }
 var AGOR_USERS_GROUP = "agor_users";
 var UnixGroupCommands = {
@@ -6660,6 +6768,7 @@ import { execSync as execSync5 } from "child_process";
 
 // src/unix/unix-integration-service.ts
 init_esm_shims();
+init_ids();
 var AGOR_ZELLIJ_CONFIG = `// Agor Zellij Config
 // Customize as needed
 
@@ -6776,7 +6885,7 @@ var UnixIntegrationService = class {
   async createWorktreeGroup(worktreeId) {
     const groupName = generateWorktreeGroupName(worktreeId);
     console.log(
-      `[UnixIntegration] Creating group ${groupName} for worktree ${worktreeId.substring(0, 8)}`
+      `[UnixIntegration] Creating group ${groupName} for worktree ${shortId(worktreeId)}`
     );
     const exists2 = await this.executor.check(UnixGroupCommands.groupExists(groupName));
     if (exists2) {
@@ -6825,11 +6934,11 @@ var UnixIntegrationService = class {
   async deleteWorktreeGroup(worktreeId) {
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.unix_group) {
-      console.log(`[UnixIntegration] No Unix group for worktree ${worktreeId.substring(0, 8)}`);
+      console.log(`[UnixIntegration] No Unix group for worktree ${shortId(worktreeId)}`);
       return;
     }
     console.log(
-      `[UnixIntegration] Deleting group ${worktree.unix_group} for worktree ${worktreeId.substring(0, 8)}`
+      `[UnixIntegration] Deleting group ${worktree.unix_group} for worktree ${shortId(worktreeId)}`
     );
     const exists2 = await this.executor.check(UnixGroupCommands.groupExists(worktree.unix_group));
     if (exists2) {
@@ -6846,14 +6955,14 @@ var UnixIntegrationService = class {
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.unix_group) {
       console.log(
-        `[UnixIntegration] No Unix group for worktree ${worktreeId.substring(0, 8)}, skipping user add`
+        `[UnixIntegration] No Unix group for worktree ${shortId(worktreeId)}, skipping user add`
       );
       return;
     }
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
       console.log(
-        `[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username, skipping group add`
+        `[UnixIntegration] User ${shortId(userId)} has no Unix username, skipping group add`
       );
       return;
     }
@@ -6884,14 +6993,14 @@ var UnixIntegrationService = class {
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.unix_group) {
       console.log(
-        `[UnixIntegration] No Unix group for worktree ${worktreeId.substring(0, 8)}, skipping user remove`
+        `[UnixIntegration] No Unix group for worktree ${shortId(worktreeId)}, skipping user remove`
       );
       return;
     }
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
       console.log(
-        `[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username, skipping group remove`
+        `[UnixIntegration] User ${shortId(userId)} has no Unix username, skipping group remove`
       );
       return;
     }
@@ -6920,7 +7029,7 @@ var UnixIntegrationService = class {
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.unix_group) {
       console.log(
-        `[UnixIntegration] No Unix group for worktree ${worktreeId.substring(0, 8)}, skipping permissions`
+        `[UnixIntegration] No Unix group for worktree ${shortId(worktreeId)}, skipping permissions`
       );
       return;
     }
@@ -6969,9 +7078,7 @@ var UnixIntegrationService = class {
    */
   async createRepoGroup(repoId) {
     const groupName = generateRepoGroupName(repoId);
-    console.log(
-      `[UnixIntegration] Creating repo group ${groupName} for repo ${repoId.substring(0, 8)}`
-    );
+    console.log(`[UnixIntegration] Creating repo group ${groupName} for repo ${shortId(repoId)}`);
     const exists2 = await this.executor.check(UnixGroupCommands.groupExists(groupName));
     if (exists2) {
       console.log(`[UnixIntegration] Repo group ${groupName} already exists`);
@@ -7017,11 +7124,11 @@ var UnixIntegrationService = class {
   async deleteRepoGroup(repoId) {
     const repo = await this.repoRepo.findById(repoId);
     if (!repo?.unix_group) {
-      console.log(`[UnixIntegration] No Unix group for repo ${repoId.substring(0, 8)}`);
+      console.log(`[UnixIntegration] No Unix group for repo ${shortId(repoId)}`);
       return;
     }
     console.log(
-      `[UnixIntegration] Deleting repo group ${repo.unix_group} for repo ${repoId.substring(0, 8)}`
+      `[UnixIntegration] Deleting repo group ${repo.unix_group} for repo ${shortId(repoId)}`
     );
     const exists2 = await this.executor.check(UnixGroupCommands.groupExists(repo.unix_group));
     if (exists2) {
@@ -7042,7 +7149,7 @@ var UnixIntegrationService = class {
     const repo = await this.repoRepo.findById(repoId);
     if (!repo?.unix_group) {
       console.log(
-        `[UnixIntegration] No Unix group for repo ${repoId.substring(0, 8)}, skipping repo permissions`
+        `[UnixIntegration] No Unix group for repo ${shortId(repoId)}, skipping repo permissions`
       );
       return;
     }
@@ -7085,7 +7192,7 @@ var UnixIntegrationService = class {
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.repo_id) {
       console.log(
-        `[UnixIntegration] Worktree ${worktreeId.substring(0, 8)} has no repo, skipping .git/worktrees fix`
+        `[UnixIntegration] Worktree ${shortId(worktreeId)} has no repo, skipping .git/worktrees fix`
       );
       return;
     }
@@ -7125,15 +7232,13 @@ var UnixIntegrationService = class {
   async addUserToRepoGroup(repoId, userId) {
     const repo = await this.repoRepo.findById(repoId);
     if (!repo?.unix_group) {
-      console.log(
-        `[UnixIntegration] No Unix group for repo ${repoId.substring(0, 8)}, skipping user add`
-      );
+      console.log(`[UnixIntegration] No Unix group for repo ${shortId(repoId)}, skipping user add`);
       return;
     }
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
       console.log(
-        `[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username, skipping repo group add`
+        `[UnixIntegration] User ${shortId(userId)} has no Unix username, skipping repo group add`
       );
       return;
     }
@@ -7164,14 +7269,14 @@ var UnixIntegrationService = class {
     const repo = await this.repoRepo.findById(repoId);
     if (!repo?.unix_group) {
       console.log(
-        `[UnixIntegration] No Unix group for repo ${repoId.substring(0, 8)}, skipping user remove`
+        `[UnixIntegration] No Unix group for repo ${shortId(repoId)}, skipping user remove`
       );
       return;
     }
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
       console.log(
-        `[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username, skipping repo group remove`
+        `[UnixIntegration] User ${shortId(userId)} has no Unix username, skipping repo group remove`
       );
       return;
     }
@@ -7241,7 +7346,7 @@ var UnixIntegrationService = class {
    * @param repoId - Repo ID
    */
   async syncRepo(repoId) {
-    console.log(`[UnixIntegration] Full sync for repo ${repoId.substring(0, 8)}`);
+    console.log(`[UnixIntegration] Full sync for repo ${shortId(repoId)}`);
     await this.createRepoGroup(repoId);
     const worktrees4 = await this.worktreeRepo.findAll({ repo_id: repoId });
     const ownerIds = /* @__PURE__ */ new Set();
@@ -7276,7 +7381,7 @@ var UnixIntegrationService = class {
     if (!unixUsername) {
       unixUsername = generateUnixUsername(userId);
       console.log(
-        `[UnixIntegration] Generated Unix username: ${unixUsername} for user ${userId.substring(0, 8)}`
+        `[UnixIntegration] Generated Unix username: ${unixUsername} for user ${shortId(userId)}`
       );
     }
     if (!isValidUnixUsername(unixUsername)) {
@@ -7385,7 +7490,7 @@ var UnixIntegrationService = class {
   async deleteUnixUser(userId, deleteHome = false) {
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
-      console.log(`[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username`);
+      console.log(`[UnixIntegration] User ${shortId(userId)} has no Unix username`);
       return;
     }
     const exists2 = await this.executor.check(UnixUserCommands.userExists(user.unix_username));
@@ -7442,14 +7547,14 @@ var UnixIntegrationService = class {
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
       console.log(
-        `[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username, skipping symlink`
+        `[UnixIntegration] User ${shortId(userId)} has no Unix username, skipping symlink`
       );
       return;
     }
     const worktree = await this.worktreeRepo.findById(worktreeId);
     if (!worktree?.path || !worktree.name) {
       console.log(
-        `[UnixIntegration] Worktree ${worktreeId.substring(0, 8)} has no path/name, skipping symlink`
+        `[UnixIntegration] Worktree ${shortId(worktreeId)} has no path/name, skipping symlink`
       );
       return;
     }
@@ -7496,7 +7601,7 @@ var UnixIntegrationService = class {
   async syncUserSymlinks(userId) {
     const user = await this.usersRepo.findById(userId);
     if (!user?.unix_username) {
-      console.log(`[UnixIntegration] User ${userId.substring(0, 8)} has no Unix username`);
+      console.log(`[UnixIntegration] User ${shortId(userId)} has no Unix username`);
       return;
     }
     console.log(`[UnixIntegration] Syncing symlinks for user: ${user.unix_username}`);
@@ -7525,7 +7630,7 @@ var UnixIntegrationService = class {
   async syncWorktreeSymlinks(worktreeId) {
     const ownerIds = await this.worktreeRepo.getOwners(worktreeId);
     console.log(
-      `[UnixIntegration] Syncing symlinks for worktree ${worktreeId.substring(0, 8)} (${ownerIds.length} owners)`
+      `[UnixIntegration] Syncing symlinks for worktree ${shortId(worktreeId)} (${ownerIds.length} owners)`
     );
     for (const ownerId of ownerIds) {
       await this.createWorktreeSymlink(ownerId, worktreeId);
@@ -7542,7 +7647,7 @@ var UnixIntegrationService = class {
    * @param worktreeId - Worktree ID
    */
   async syncWorktree(worktreeId) {
-    console.log(`[UnixIntegration] Full sync for worktree ${worktreeId.substring(0, 8)}`);
+    console.log(`[UnixIntegration] Full sync for worktree ${shortId(worktreeId)}`);
     await this.createWorktreeGroup(worktreeId);
     const ownerIds = await this.worktreeRepo.getOwners(worktreeId);
     for (const ownerId of ownerIds) {
@@ -7557,7 +7662,7 @@ var UnixIntegrationService = class {
    * @param userId - User ID
    */
   async syncUser(userId) {
-    console.log(`[UnixIntegration] Full sync for user ${userId.substring(0, 8)}`);
+    console.log(`[UnixIntegration] Full sync for user ${shortId(userId)}`);
     await this.ensureUnixUser(userId);
     await this.syncUserSymlinks(userId);
   }