agor-live 0.18.0 → 0.19.1

package/dist/daemon/register-routes.js

@@ -8,7 +8,121 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/utils/append-system-message.ts
+import { generateId, SessionRepository as SessionRepository2 } from "@agor/core/db";
+import { MessageRole } from "@agor/core/types";
+async function appendSystemMessage(opts) {
+  const {
+    app,
+    db,
+    sessionId,
+    taskId,
+    content,
+    contentPreview,
+    type = "system",
+    role = MessageRole.SYSTEM,
+    metadata,
+    params
+  } = opts;
+  const index = await new SessionRepository2(db).countMessages(sessionId);
+  const preview = contentPreview ?? (typeof content === "string" ? content.substring(0, 200) : "");
+  const message = {
+    message_id: generateId(),
+    session_id: sessionId,
+    task_id: taskId,
+    type,
+    role,
+    index,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    content_preview: preview,
+    content,
+    ...metadata ? { metadata } : {}
+  };
+  const created = await app.service("messages").create(message, params ?? {});
+  return created;
+}
+var init_append_system_message = __esm({
+  "src/utils/append-system-message.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/build-initial-user-message.ts
+import { generateId as generateId2 } from "@agor/core/db";
+import { MessageRole as MessageRole2 } from "@agor/core/types";
+function buildInitialUserMessage(input) {
+  const preview = typeof input.content === "string" ? input.content.slice(0, CONTENT_PREVIEW_MAX_CHARS) : safeStringify(input.content).slice(0, CONTENT_PREVIEW_MAX_CHARS);
+  return {
+    message_id: generateId2(),
+    session_id: input.sessionId,
+    task_id: input.taskId,
+    type: input.type ?? "user",
+    role: MessageRole2.USER,
+    index: input.index,
+    timestamp: input.timestamp,
+    content_preview: preview,
+    content: input.content,
+    metadata: input.metadata
+  };
+}
+function safeStringify(value) {
+  if (value == null) return "";
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return String(value);
+  }
+}
+var CONTENT_PREVIEW_MAX_CHARS;
+var init_build_initial_user_message = __esm({
+  "src/utils/build-initial-user-message.ts"() {
+    "use strict";
+    CONTENT_PREVIEW_MAX_CHARS = 200;
+  }
+});
+
+// src/utils/session-tasks.ts
+import { TaskStatus } from "@agor/core/types";
+function recencyKey(t) {
+  return new Date(t.started_at || t.created_at).getTime();
+}
+async function findTasksForSession(app, sessionId, params) {
+  const result = await app.service("tasks").find({
+    ...params ?? {},
+    // Merge defensively: spread params first, then force session_id so a
+    // caller-supplied params.query can never silently overwrite the filter.
+    query: {
+      ...params?.query,
+      session_id: sessionId,
+      $limit: params?.query?.$limit ?? 1e3
+    }
+  });
+  const tasks = Array.isArray(result) ? result : result.data;
+  return [...tasks].sort((a, b) => recencyKey(b) - recencyKey(a));
+}
+async function findActiveTasksForSession(app, sessionId, params) {
+  const all = await findTasksForSession(app, sessionId, params);
+  return all.filter((t) => ACTIVE_TASK_STATUSES.has(t.status));
+}
+async function findHostTaskForSession(app, sessionId, params) {
+  const all = await findTasksForSession(app, sessionId, params);
+  if (all.length === 0) return void 0;
+  return all.find((t) => ACTIVE_TASK_STATUSES.has(t.status)) ?? all[0];
+}
+var ACTIVE_TASK_STATUSES;
+var init_session_tasks = __esm({
+  "src/utils/session-tasks.ts"() {
+    "use strict";
+    ACTIVE_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.STOPPING
+    ]);
+  }
+});
+
 // src/utils/worktree-authorization.ts
+import { shortId as shortId5 } from "@agor/core/db";
 import { Forbidden as Forbidden3, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
 import { ROLES as ROLES2, WORKTREE_PERMISSION_LEVELS } from "@agor/core/types";
 function isSuperAdmin(role, allowSuperadmin = true) {
@@ -75,7 +189,7 @@ async function ensureCanPromptTargetSession(sessionId, userId, app, worktreeRepo
   try {
     targetSession = await app.service("sessions").get(sessionId, { provider: void 0 });
   } catch {
-    throw new Forbidden3(`Invalid callback target: session ${sessionId.substring(0, 8)} not found`);
+    throw new Forbidden3(`Invalid callback target: session ${shortId5(sessionId)} not found`);
   }
   const worktree = await worktreeRepo.findById(targetSession.worktree_id);
   if (!worktree) {
@@ -100,7 +214,7 @@ async function ensureCanPromptTargetSession(sessionId, userId, app, worktreeRepo
     );
   }
   throw new Forbidden3(
-    `Cannot set callback target: you need at least 'session' permission on worktree ${worktree.name || worktree.worktree_id.substring(0, 8)}. You have '${effectiveLevel}' permission.`
+    `Cannot set callback target: you need at least 'session' permission on worktree ${worktree.name || shortId5(worktree.worktree_id)}. You have '${effectiveLevel}' permission.`
   );
 }
 function checkSessionOwnerOrAdmin(user, session, options) {
@@ -127,6 +241,18 @@ var init_worktree_authorization = __esm({
   }
 });
 
+// src/widgets/registry.ts
+function getWidget(type) {
+  return widgetRegistry.get(type);
+}
+var widgetRegistry;
+var init_registry = __esm({
+  "src/widgets/registry.ts"() {
+    "use strict";
+    widgetRegistry = /* @__PURE__ */ new Map();
+  }
+});
+
 // src/auth/service-jwt-strategy.ts
 var service_jwt_strategy_exports = {};
 __export(service_jwt_strategy_exports, {
@@ -189,7 +315,7 @@ var api_key_strategy_exports = {};
 __export(api_key_strategy_exports, {
   ApiKeyStrategy: () => ApiKeyStrategy
 });
-import { AuthenticationBaseStrategy, NotAuthenticated as NotAuthenticated4 } from "@agor/core/feathers";
+import { AuthenticationBaseStrategy, NotAuthenticated as NotAuthenticated5 } from "@agor/core/feathers";
 var ApiKeyStrategy;
 var init_api_key_strategy = __esm({
   "src/auth/api-key-strategy.ts"() {
@@ -206,22 +332,22 @@ var init_api_key_strategy = __esm({
       // biome-ignore lint/suspicious/noExplicitAny: Feathers type compatibility
       async authenticate(authentication, params) {
         if (!this.apiKeysRepo || !this.usersService) {
-          throw new NotAuthenticated4("ApiKeyStrategy not initialized");
+          throw new NotAuthenticated5("ApiKeyStrategy not initialized");
         }
         const apiKey = authentication.apiKey;
         if (!apiKey || !apiKey.startsWith("agor_sk_")) {
-          throw new NotAuthenticated4("Invalid API key format");
+          throw new NotAuthenticated5("Invalid API key format");
         }
         const keyRow = await this.apiKeysRepo.verifyKey(apiKey);
         if (!keyRow) {
-          throw new NotAuthenticated4("Invalid API key");
+          throw new NotAuthenticated5("Invalid API key");
         }
         this.apiKeysRepo.updateLastUsed(keyRow.id).catch((err) => {
           console.warn("Failed to update API key last_used_at:", err);
         });
         const user = await this.usersService.get(keyRow.user_id);
         if (!user) {
-          throw new NotAuthenticated4("User not found for API key");
+          throw new NotAuthenticated5("User not found for API key");
         }
         return {
           authentication: { strategy: "api-key" },
@@ -253,25 +379,1120 @@ var init_api_key_strategy = __esm({
   }
 });
 
-// src/utils/git-shell-capture.ts
-var git_shell_capture_exports = {};
-__export(git_shell_capture_exports, {
-  captureGitStateViaShell: () => captureGitStateViaShell
+// src/adapters/drizzle.ts
+import { NotFoundError } from "@agor/core/utils/errors";
+var init_drizzle = __esm({
+  "src/adapters/drizzle.ts"() {
+    "use strict";
+  }
+});
+
+// src/services/claude-cli-watcher.ts
+import { promises as fsp, watch } from "fs";
+import path2 from "path";
+import {
+  claudeSessionJsonlPath,
+  claudeSubagentsDir,
+  JsonlEventTranslator
+} from "@agor/core/claude-cli";
+function sleep(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, ms);
+    t.unref?.();
+  });
+}
+var DEFAULT_PERSIST_EVERY_N_LINES, DEFAULT_PERSIST_EVERY_MS, FILE_NOT_FOUND_FAST_BACKOFF_MS, FILE_NOT_FOUND_FAST_RETRIES, PARENT_DIR_CHECK_INTERVAL_MS, ClaudeCliWatcher, ClaudeCliWatcherRegistry;
+var init_claude_cli_watcher = __esm({
+  "src/services/claude-cli-watcher.ts"() {
+    "use strict";
+    DEFAULT_PERSIST_EVERY_N_LINES = 25;
+    DEFAULT_PERSIST_EVERY_MS = 5e3;
+    FILE_NOT_FOUND_FAST_BACKOFF_MS = 100;
+    FILE_NOT_FOUND_FAST_RETRIES = 50;
+    PARENT_DIR_CHECK_INTERVAL_MS = 3e4;
+    ClaudeCliWatcher = class {
+      translator = new JsonlEventTranslator();
+      opts;
+      jsonlPath;
+      subagentsDir;
+      watcher = null;
+      /** Long-lived watch on the parent slug dir while waiting for the JSONL
+       *  to appear. Closed once we successfully open the file. */
+      parentDirWatcher = null;
+      /** Backstop polling timer for the slow-path "waiting on JSONL" state. */
+      parentDirPollTimer = null;
+      offset;
+      /** Trailing fragment held over between `change` events when the last
+       *  write didn't end in `\n`. */
+      lineBuffer = "";
+      /** Lines processed since the last `persistOffset()` flush. */
+      linesSinceFlush = 0;
+      flushTimer = null;
+      /** Last seen `assistant.timestamp` / `uuid` for telemetry / resume-sanity. */
+      lastEventTs = null;
+      lastEventUuid = null;
+      /** Serialize the read-and-dispatch loop so overlapping `change`
+       *  notifications don't interleave. */
+      busy = Promise.resolve();
+      stopped = false;
+      constructor(options) {
+        this.opts = {
+          sessionId: options.sessionId,
+          cwd: options.cwd,
+          homeDir: options.homeDir,
+          startOffset: options.startOffset ?? 0,
+          persister: options.persister,
+          sink: options.sink,
+          persistEveryNLines: options.persistEveryNLines ?? DEFAULT_PERSIST_EVERY_N_LINES,
+          persistEveryMs: options.persistEveryMs ?? DEFAULT_PERSIST_EVERY_MS,
+          log: options.log ?? console
+        };
+        this.offset = this.opts.startOffset;
+        this.jsonlPath = claudeSessionJsonlPath(this.opts.homeDir, this.opts.cwd, this.opts.sessionId);
+        this.subagentsDir = claudeSubagentsDir(this.opts.homeDir, this.opts.cwd, this.opts.sessionId);
+      }
+      /** Absolute path to the JSONL we're watching. */
+      get path() {
+        return this.jsonlPath;
+      }
+      /** Where the subagent JSONLs would live (we don't watch this yet). */
+      get subagentsPath() {
+        return this.subagentsDir;
+      }
+      /** Current byte offset into the JSONL. */
+      get currentOffset() {
+        return this.offset;
+      }
+      /**
+       * Begin watching. Resolves once the file is either found (and an initial
+       * pass over `[startOffset, EOF)` has run) OR we've fallen through to the
+       * patient `watching-parent-dir` slow path.
+       *
+       * Two-tier wait:
+       *   1. **Fast path** — poll the JSONL every 100ms for up to ~5s. This
+       *      latches on quickly in the common case where `claude` is spawning
+       *      right alongside us (sub-100ms is typical per the analysis doc).
+       *   2. **Slow path** — once the fast retries exhaust, `start()` returns
+       *      and we install an `fs.watch` on the parent slug directory plus
+       *      a 30s backstop poll. As soon as the JSONL appears (e.g. the user
+       *      finally opens the terminal modal and the `claude` REPL starts
+       *      writing), we transition to the live-tail watcher. No timeout —
+       *      it sits idle indefinitely, at zero cost.
+       *
+       * The patient slow path matters because Agor's lifecycle is:
+       *   create CLI session → daemon emits `terminal:tab` → user opens
+       *   terminal modal → executor spawns the tab → `claude` writes JSONL.
+       *
+       * The gap between session create and terminal open can be arbitrary
+       * (user might create-then-leave). Failing the watcher at 5s was a v0
+       * shortcut that this method replaces.
+       */
+      async start() {
+        if (this.stopped) throw new Error("ClaudeCliWatcher: cannot start a stopped watcher");
+        for (let attempt = 0; attempt < FILE_NOT_FOUND_FAST_RETRIES; attempt++) {
+          try {
+            await fsp.stat(this.jsonlPath);
+            return await this.beginTailing();
+          } catch (err) {
+            if (err.code !== "ENOENT") throw err;
+          }
+          await sleep(FILE_NOT_FOUND_FAST_BACKOFF_MS);
+        }
+        this.opts.log.info("[claude-cli-watcher] JSONL not yet present, entering patient-wait mode", {
+          sessionId: this.opts.sessionId,
+          path: this.jsonlPath
+        });
+        this.installParentDirWaiter();
+      }
+      /**
+       * Open the JSONL and start the live-tail watcher. Idempotent: safe to
+       * call from either the fast-path success branch or the parent-dir
+       * waiter when the file finally shows up.
+       */
+      async beginTailing() {
+        if (this.stopped) return;
+        if (this.watcher) return;
+        this.closeParentDirWaiter();
+        await this.readAndDispatch();
+        this.watcher = watch(this.jsonlPath, { persistent: false }, () => {
+          this.busy = this.busy.then(() => this.readAndDispatch()).catch((err) => {
+            this.opts.log.error("[claude-cli-watcher] read error", {
+              sessionId: this.opts.sessionId,
+              err
+            });
+          });
+        });
+        this.scheduleFlush();
+      }
+      /**
+       * Stop watching and flush the current offset to the persister.
+       * Idempotent.
+       */
+      async stop() {
+        if (this.stopped) return;
+        this.stopped = true;
+        if (this.watcher) {
+          this.watcher.close();
+          this.watcher = null;
+        }
+        this.closeParentDirWaiter();
+        if (this.flushTimer) {
+          clearTimeout(this.flushTimer);
+          this.flushTimer = null;
+        }
+        await this.busy;
+        await this.persistOffset();
+      }
+      /**
+       * Install the patient-wait mode: an `fs.watch` on the parent slug
+       * directory (so we wake up the instant the CLI writes the file's first
+       * byte and triggers a `rename` event), backed by a slow poll as a
+       * defensive belt-and-suspenders.
+       *
+       * Idempotent and stoppable via {@link stop} / {@link closeParentDirWaiter}.
+       */
+      installParentDirWaiter() {
+        if (this.stopped) return;
+        if (this.parentDirWatcher || this.parentDirPollTimer) return;
+        const parentDir = path2.dirname(this.jsonlPath);
+        const targetBasename = path2.basename(this.jsonlPath);
+        const tryLatch = () => {
+          if (this.stopped || this.watcher) return;
+          fsp.stat(this.jsonlPath).then(
+            () => {
+              if (this.stopped || this.watcher) return;
+              this.busy = this.busy.then(() => this.beginTailing()).catch((err) => {
+                this.opts.log.error("[claude-cli-watcher] beginTailing failed", {
+                  sessionId: this.opts.sessionId,
+                  err
+                });
+              });
+            },
+            () => {
+            }
+          );
+        };
+        try {
+          this.parentDirWatcher = watch(parentDir, { persistent: false }, (_event, filename) => {
+            if (filename === targetBasename) tryLatch();
+          });
+        } catch (err) {
+          this.opts.log.debug?.("[claude-cli-watcher] parent dir watch failed (will poll)", {
+            sessionId: this.opts.sessionId,
+            parentDir,
+            err
+          });
+        }
+        this.parentDirPollTimer = setInterval(tryLatch, PARENT_DIR_CHECK_INTERVAL_MS);
+        this.parentDirPollTimer.unref?.();
+        tryLatch();
+      }
+      closeParentDirWaiter() {
+        if (this.parentDirWatcher) {
+          this.parentDirWatcher.close();
+          this.parentDirWatcher = null;
+        }
+        if (this.parentDirPollTimer) {
+          clearInterval(this.parentDirPollTimer);
+          this.parentDirPollTimer = null;
+        }
+      }
+      async readAndDispatch() {
+        if (this.stopped) return;
+        let stat;
+        try {
+          stat = await fsp.stat(this.jsonlPath);
+        } catch (err) {
+          this.opts.log.warn("[claude-cli-watcher] stat failed", {
+            sessionId: this.opts.sessionId,
+            err
+          });
+          return;
+        }
+        if (stat.size === this.offset) return;
+        if (stat.size < this.offset) {
+          this.opts.log.warn("[claude-cli-watcher] file shrank \u2014 re-reading from start", {
+            sessionId: this.opts.sessionId,
+            path: this.jsonlPath,
+            old: this.offset,
+            new: stat.size
+          });
+          this.offset = 0;
+          this.lineBuffer = "";
+        }
+        const fh = await fsp.open(this.jsonlPath, "r");
+        try {
+          const readFrom = this.offset;
+          const chunkSize = stat.size - readFrom;
+          const buf = Buffer.alloc(chunkSize);
+          const { bytesRead } = await fh.read(buf, 0, chunkSize, readFrom);
+          const fragmentBytes = Buffer.byteLength(this.lineBuffer, "utf-8");
+          const combined = this.lineBuffer + buf.subarray(0, bytesRead).toString("utf-8");
+          const lines = combined.split("\n");
+          const trailing = lines.pop() ?? "";
+          let lineStart = readFrom - fragmentBytes;
+          let sinkFailed = false;
+          for (const line of lines) {
+            const lineBytes = Buffer.byteLength(line, "utf-8");
+            const lineEnd = lineStart + lineBytes + 1;
+            if (!line.trim()) {
+              this.offset = lineEnd;
+              this.lineBuffer = "";
+              lineStart = lineEnd;
+              continue;
+            }
+            const events = this.translator.translateLine(line);
+            let allSucceeded = true;
+            for (const event of events) {
+              try {
+                if ("uuid" in event && event.uuid) this.lastEventUuid = event.uuid;
+                if ("timestamp" in event && event.timestamp) this.lastEventTs = event.timestamp;
+                await this.opts.sink(this.opts.sessionId, event);
+              } catch (err) {
+                this.opts.log.error("[claude-cli-watcher] sink error \u2014 stopping at line", {
+                  sessionId: this.opts.sessionId,
+                  eventType: event.type,
+                  byteOffset: lineStart,
+                  err
+                });
+                allSucceeded = false;
+                sinkFailed = true;
+                break;
+              }
+            }
+            if (!allSucceeded) break;
+            this.offset = lineEnd;
+            this.lineBuffer = "";
+            lineStart = lineEnd;
+            this.linesSinceFlush++;
+            if (this.linesSinceFlush >= this.opts.persistEveryNLines) {
+              void this.persistOffset();
+            }
+          }
+          if (!sinkFailed) {
+            this.lineBuffer = trailing;
+          }
+        } finally {
+          await fh.close();
+        }
+      }
+      scheduleFlush() {
+        if (this.stopped) return;
+        this.flushTimer = setTimeout(() => {
+          void this.persistOffset().finally(() => this.scheduleFlush());
+        }, this.opts.persistEveryMs);
+        this.flushTimer?.unref?.();
+      }
+      async persistOffset() {
+        this.linesSinceFlush = 0;
+        try {
+          await this.opts.persister.saveOffset(this.opts.sessionId, {
+            watcher_offset: this.offset,
+            last_event_ts: this.lastEventTs,
+            last_event_uuid: this.lastEventUuid
+          });
+        } catch (err) {
+          this.opts.log.warn("[claude-cli-watcher] persist failed", {
+            sessionId: this.opts.sessionId,
+            err
+          });
+        }
+      }
+    };
+    ClaudeCliWatcherRegistry = class {
+      constructor(persister, sink, log = console) {
+        this.persister = persister;
+        this.sink = sink;
+        this.log = log;
+      }
+      watchers = /* @__PURE__ */ new Map();
+      /** Start a watcher for a session. No-op if one already exists. */
+      async register(args) {
+        const existing = this.watchers.get(args.sessionId);
+        if (existing) return existing;
+        const w = new ClaudeCliWatcher({
+          ...args,
+          persister: this.persister,
+          sink: this.sink,
+          log: this.log
+        });
+        this.watchers.set(args.sessionId, w);
+        try {
+          await w.start();
+          this.log.info("[claude-cli-watcher] started", {
+            sessionId: args.sessionId,
+            path: w.path,
+            startOffset: args.startOffset ?? 0
+          });
+        } catch (err) {
+          this.watchers.delete(args.sessionId);
+          throw err;
+        }
+        return w;
+      }
+      /** Stop + flush a watcher. No-op if none. */
+      async unregister(sessionId) {
+        const w = this.watchers.get(sessionId);
+        if (!w) return;
+        this.watchers.delete(sessionId);
+        await w.stop();
+        this.log.info("[claude-cli-watcher] stopped", { sessionId });
+      }
+      /** Stop every watcher. Called on daemon shutdown. */
+      async stopAll() {
+        const sessions = Array.from(this.watchers.keys());
+        await Promise.all(sessions.map((id) => this.unregister(id)));
+      }
+      /** Peek the live watcher for a session — diagnostic / test-only. */
+      get(sessionId) {
+        return this.watchers.get(sessionId);
+      }
+      /** Count of active watchers — diagnostic. */
+      get size() {
+        return this.watchers.size;
+      }
+    };
+  }
+});
+
+// src/services/claude-cli-integration.ts
+var claude_cli_integration_exports = {};
+__export(claude_cli_integration_exports, {
+  ClaudeCliWatcherRegistry: () => ClaudeCliWatcherRegistry,
+  buildCliEventSink: () => buildCliEventSink,
+  buildCliPersister: () => buildCliPersister,
+  buildSpawnConfigForSession: () => buildSpawnConfigForSession,
+  getCliWatcherRegistry: () => getCliWatcherRegistry,
+  isClaudeRunningFor: () => isClaudeRunningFor,
+  onCliSessionCreated: () => onCliSessionCreated,
+  onCliSessionEnded: () => onCliSessionEnded,
+  primeActiveCliTurnFromSession: () => primeActiveCliTurnFromSession,
+  rehydrateCliWatchers: () => rehydrateCliWatchers,
+  resolveHomeDirForCliSession: () => resolveHomeDirForCliSession,
+  setPendingCliTask: () => setPendingCliTask
+});
+import { spawn as spawnProcess } from "child_process";
+import * as fs2 from "fs";
+import os2 from "os";
+import {
+  buildClaudeCliSpawn,
+  claudeSessionJsonlPath as claudeSessionJsonlPath2,
+  computeCost,
+  getContextWindowLimit,
+  permissionModeForCli,
+  slugForCwd
+} from "@agor/core/claude-cli";
+import {
+  generateId as generateId3,
+  SessionRepository as SessionRepository3,
+  shortId as shortId6,
+  TaskRepository
+} from "@agor/core/db";
+import {
+  SessionStatus as SessionStatus2,
+  TaskStatus as TaskStatus3
+} from "@agor/core/types";
+function getDb(app) {
+  const db = app.get("database") ?? app.get("db");
+  return db ?? null;
+}
+async function persistActiveTurnSnapshot(app, sessionId, turn) {
+  const db = getDb(app);
+  if (!db) return;
+  const repo = new SessionRepository3(db);
+  const row = await repo.findById(sessionId);
+  if (!row) {
+    throw new Error(`persistActiveTurnSnapshot: session not found: ${shortId6(sessionId)}`);
+  }
+  const patch = {
+    cli_state: {
+      ...row.cli_state ?? {},
+      active_turn: {
+        task_id: turn.taskId,
+        user_message_index: turn.userMessageIndex,
+        started_at_ms: turn.startedAtMs
+      }
+    }
+  };
+  await repo.update(sessionId, patch);
+}
+async function clearActiveTurnSnapshot(app, sessionId) {
+  const db = getDb(app);
+  if (!db) return;
+  try {
+    const repo = new SessionRepository3(db);
+    const patch = {
+      cli_state: { active_turn: null }
+    };
+    await repo.update(sessionId, patch);
+  } catch (err) {
+    console.warn("[claude-cli-integration] clearActiveTurnSnapshot failed", err);
+  }
+}
+function primeActiveCliTurnFromSession(app, session) {
+  const persisted = session.cli_state?.active_turn;
+  if (!persisted) return;
+  if (activeCliTurn.has(session.session_id)) return;
+  activeCliTurn.set(session.session_id, {
+    taskId: persisted.task_id,
+    userMessageIndex: persisted.user_message_index,
+    lastIndex: persisted.user_message_index,
+    lastTimestamp: new Date(persisted.started_at_ms).toISOString(),
+    startedAtMs: persisted.started_at_ms,
+    assistantTurns: [],
+    lastAssistantRaw: null,
+    toolUseCount: 0
+  });
+  startTaskWatchdog(app, session.session_id);
+}
+function isClaudeRunningFor(sessionId) {
+  return new Promise((resolve) => {
+    const pattern = `claude .*(--session-id|--resume) ${sessionId}`;
+    const proc = spawnProcess("pgrep", ["-f", pattern], { stdio: "ignore" });
+    proc.on("exit", (code) => resolve(code === 0));
+    proc.on("error", () => resolve(true));
+    setTimeout(() => {
+      try {
+        proc.kill();
+      } catch {
+      }
+      resolve(true);
+    }, 3e3);
+  });
+}
+function stopTaskWatchdog(sessionId) {
+  const t = watchdogTimers.get(sessionId);
+  if (t) {
+    clearInterval(t);
+    watchdogTimers.delete(sessionId);
+  }
+}
+function startTaskWatchdog(app, sessionId) {
+  stopTaskWatchdog(sessionId);
+  const timer = setInterval(async () => {
+    const active = activeCliTurn.get(sessionId);
+    if (!active) {
+      stopTaskWatchdog(sessionId);
+      return;
+    }
+    const idleMs = Date.now() - (Date.parse(active.lastTimestamp) || active.startedAtMs);
+    if (idleMs < WATCHDOG_IDLE_THRESHOLD_MS) return;
+    const alive = await isClaudeRunningFor(sessionId);
+    if (alive) return;
+    console.log(
+      JSON.stringify({
+        layer: "claude-cli-watcher.watchdog",
+        sessionId,
+        idleMs,
+        note: "claude process not running \u2014 closing stale turn"
+      })
+    );
+    try {
+      await closeActiveTurnDispatch?.(sessionId, "claude_exited", (/* @__PURE__ */ new Date()).toISOString());
+    } catch (err) {
+      console.warn("[claude-cli-watcher.watchdog] close dispatch failed", err);
+    }
+    stopTaskWatchdog(sessionId);
+  }, WATCHDOG_TICK_MS);
+  timer.unref?.();
+  watchdogTimers.set(sessionId, timer);
+}
+function buildCliPersister(app) {
+  return {
+    async saveOffset(sessionId, update) {
+      const db = getDb(app);
+      if (!db) return;
+      const repo = new SessionRepository3(db);
+      const row = await repo.findById(sessionId).catch(() => null);
+      if (!row) return;
+      const existing = row.cli_state ?? {};
+      const patch = {
+        cli_state: {
+          ...existing,
+          watcher_offset: update.watcher_offset,
+          last_event_ts: update.last_event_ts ?? existing.last_event_ts,
+          last_event_uuid: update.last_event_uuid ?? existing.last_event_uuid
+        }
+      };
+      await repo.update(sessionId, patch);
+    }
+  };
+}
+function setPendingCliTask(sessionId, taskId, userMessageIndex) {
+  pendingCliTask.set(sessionId, { taskId, userMessageIndex });
+}
+function buildCliEventSink(app) {
+  const indexBySession = /* @__PURE__ */ new Map();
+  const nextIndex = async (sessionId) => {
+    const cached2 = indexBySession.get(sessionId);
+    if (cached2 !== void 0) {
+      indexBySession.set(sessionId, cached2 + 1);
+      return cached2;
+    }
+    try {
+      const db = getDb(app);
+      if (!db) {
+        indexBySession.set(sessionId, 1);
+        return 0;
+      }
+      const repo = new SessionRepository3(db);
+      const count = await repo.countMessages(sessionId).catch(() => 0) ?? 0;
+      indexBySession.set(sessionId, count + 1);
+      return count;
+    } catch {
+      indexBySession.set(sessionId, 1);
+      return 0;
+    }
+  };
+  const previewFor = (content) => {
+    if (typeof content === "string") return content.slice(0, 200);
+    if (!content) return "";
+    try {
+      return JSON.stringify(content).slice(0, 200);
+    } catch {
+      return String(content).slice(0, 200);
+    }
+  };
+  const mintTaskForOrphanTurn = async (sessionId, prompt, userMessageIndex, timestamp) => {
+    const db = getDb(app);
+    if (!db) return null;
+    try {
+      const sessionRepo = new SessionRepository3(db);
+      const session = await sessionRepo.findById(sessionId).catch(() => null);
+      if (!session) return null;
+      const taskRepo = new TaskRepository(db);
+      const task = await taskRepo.create({
+        session_id: sessionId,
+        created_by: session.created_by,
+        full_prompt: prompt,
+        status: TaskStatus3.RUNNING,
+        started_at: timestamp,
+        message_range: {
+          start_index: userMessageIndex,
+          end_index: userMessageIndex,
+          start_timestamp: timestamp,
+          end_timestamp: timestamp
+        },
+        git_state: {
+          ref_at_start: session.git_state?.ref ?? "",
+          sha_at_start: session.git_state?.current_sha ?? ""
+        },
+        tool_use_count: 0,
+        metadata: { source: "cli-repl" }
+      });
+      app.service("tasks").emit("created", task);
+      await app.service("sessions").patch(sessionId, {
+        status: SessionStatus2.RUNNING,
+        ready_for_prompt: false,
+        tasks: [...session.tasks, task.task_id]
+      }).catch((err) => {
+        console.warn("[claude-cli-watcher.sink] session patch (RUNNING) failed", err);
+      });
+      return task.task_id;
+    } catch (err) {
+      console.warn("[claude-cli-watcher.sink] mintTaskForOrphanTurn failed", err);
+      return null;
+    }
+  };
+  const sink = async (sessionId, event) => {
+    try {
+      const baseTs = (/* @__PURE__ */ new Date()).toISOString();
+      if (event.type === "user_message") {
+        if (event.isSidechain) return;
+        const promptText = typeof event.content === "string" ? event.content : (() => {
+          try {
+            return JSON.stringify(event.content);
+          } catch {
+            return String(event.content ?? "");
+          }
+        })();
+        const ts = event.timestamp ?? baseTs;
+        const pending = pendingCliTask.get(sessionId);
+        if (pending) {
+          pendingCliTask.delete(sessionId);
+          indexBySession.set(sessionId, pending.userMessageIndex + 1);
+          const turn2 = {
+            taskId: pending.taskId,
+            userMessageIndex: pending.userMessageIndex,
+            lastIndex: pending.userMessageIndex,
+            lastTimestamp: ts,
+            startedAtMs: Date.parse(ts) || Date.now(),
+            assistantTurns: [],
+            lastAssistantRaw: null,
+            toolUseCount: 0
+          };
+          activeCliTurn.set(sessionId, turn2);
+          await persistActiveTurnSnapshot(app, sessionId, turn2);
+          startTaskWatchdog(app, sessionId);
+          return;
+        }
+        const userIdx = await nextIndex(sessionId);
+        const taskId = await mintTaskForOrphanTurn(sessionId, promptText, userIdx, ts);
+        const userMessage = buildInitialUserMessage({
+          sessionId,
+          taskId: taskId ?? void 0,
+          index: userIdx,
+          timestamp: ts,
+          content: typeof event.content === "string" ? event.content : event.content ?? "",
+          metadata: { source: "cli-repl", original_id: event.uuid ?? void 0 }
+        });
+        await app.service("messages").create(userMessage);
+        if (!taskId) return;
+        const turn = {
+          taskId,
+          userMessageIndex: userIdx,
+          lastIndex: userIdx,
+          lastTimestamp: ts,
+          startedAtMs: Date.parse(ts) || Date.now(),
+          assistantTurns: [],
+          lastAssistantRaw: null,
+          toolUseCount: 0
+        };
+        activeCliTurn.set(sessionId, turn);
+        await persistActiveTurnSnapshot(app, sessionId, turn);
+        startTaskWatchdog(app, sessionId);
+        return;
+      }
+      if (event.type === "assistant_message") {
+        if (event.turn.isSidechain) return;
+        const idx = await nextIndex(sessionId);
+        const content = event.turn.content;
+        const ts = event.turn.timestamp ?? baseTs;
+        const active = activeCliTurn.get(sessionId);
+        await app.service("messages").create({
+          message_id: generateId3(),
+          session_id: sessionId,
+          task_id: active?.taskId,
+          type: "assistant",
+          role: "assistant",
+          index: idx,
+          timestamp: ts,
+          content_preview: previewFor(content),
+          content,
+          metadata: {
+            model: event.turn.model ?? void 0,
+            original_id: event.turn.messageId,
+            stop_reason: event.turn.stopReason ?? void 0,
+            tokens: event.turn.usage ? {
+              input: event.turn.usage.input_tokens ?? 0,
+              output: event.turn.usage.output_tokens ?? 0,
+              cache_creation: event.turn.usage.cache_creation_input_tokens ?? 0,
+              cache_read: event.turn.usage.cache_read_input_tokens ?? 0
+            } : void 0
+          }
+        });
+        if (active) {
+          active.lastIndex = idx;
+          active.lastTimestamp = ts;
+          active.assistantTurns.push({
+            model: event.turn.model ?? null,
+            usage: event.turn.usage ?? null,
+            messageId: event.turn.messageId,
+            timestamp: event.turn.timestamp ?? null,
+            stopReason: event.turn.stopReason ?? null
+          });
+          active.lastAssistantRaw = {
+            message: {
+              id: event.turn.messageId,
+              type: "message",
+              role: "assistant",
+              model: event.turn.model,
+              content,
+              stop_reason: event.turn.stopReason,
+              usage: event.turn.usage
+            },
+            timestamp: event.turn.timestamp
+          };
+          if (Array.isArray(content)) {
+            for (const block of content) {
+              if (block && typeof block === "object" && block.type === "tool_use") {
+                active.toolUseCount += 1;
+              }
+            }
+          }
+        }
+        return;
+      }
+      if (event.type === "tool_result") {
+        if (event.isSidechain) return;
+        const idx = await nextIndex(sessionId);
+        const ts = event.timestamp ?? baseTs;
+        const active = activeCliTurn.get(sessionId);
+        await app.service("messages").create({
+          message_id: generateId3(),
+          session_id: sessionId,
+          task_id: active?.taskId,
+          type: "user",
+          role: "user",
+          index: idx,
+          timestamp: ts,
+          content_preview: previewFor(event.result),
+          content: [
+            {
+              type: "tool_result",
+              tool_use_id: event.sourceToolAssistantUUID ?? void 0,
+              content: event.result
+            }
+          ],
+          metadata: { original_id: event.uuid ?? void 0 }
+        });
+        if (active) {
+          active.lastIndex = idx;
+          active.lastTimestamp = ts;
+        }
+        return;
+      }
+      if (event.type === "turn_end") {
+        const active = activeCliTurn.get(sessionId);
+        if (!active) {
+          console.log(
+            JSON.stringify({
+              layer: "claude-cli-watcher.sink",
+              sessionId,
+              eventType: "turn_end",
+              note: "no active turn \u2014 skipping close"
+            })
+          );
+          return;
+        }
+        activeCliTurn.delete(sessionId);
+        void clearActiveTurnSnapshot(app, sessionId);
+        stopTaskWatchdog(sessionId);
+        const ts = event.timestamp ?? active.lastTimestamp ?? baseTs;
+        const endedAtMs = Date.parse(ts) || Date.now();
+        const durationMs = Math.max(0, endedAtMs - active.startedAtMs);
+        const modelUsageMap = {};
+        let totalInput = 0;
+        let totalOutput = 0;
+        let totalCacheCreation = 0;
+        let totalCacheRead = 0;
+        let totalCostUsd;
+        let primaryModel;
+        for (const turn of active.assistantTurns) {
+          const modelId = turn.model ?? "unknown";
+          if (!primaryModel && turn.model) primaryModel = turn.model;
+          const u = turn.usage ?? {};
+          const tIn = u.input_tokens ?? 0;
+          const tOut = u.output_tokens ?? 0;
+          const tCacheC = u.cache_creation_input_tokens ?? 0;
+          const tCacheR = u.cache_read_input_tokens ?? 0;
+          totalInput += tIn;
+          totalOutput += tOut;
+          totalCacheCreation += tCacheC;
+          totalCacheRead += tCacheR;
+          const entry = modelUsageMap[modelId] ?? {
+            inputTokens: 0,
+            outputTokens: 0,
+            cacheCreationInputTokens: 0,
+            cacheReadInputTokens: 0,
+            contextWindow: getContextWindowLimit(turn.model)
+          };
+          entry.inputTokens += tIn;
+          entry.outputTokens += tOut;
+          entry.cacheCreationInputTokens += tCacheC;
+          entry.cacheReadInputTokens += tCacheR;
+          modelUsageMap[modelId] = entry;
+          const turnCost = computeCost(turn.model, u);
+          if (turnCost !== void 0) {
+            totalCostUsd = (totalCostUsd ?? 0) + turnCost;
+          }
+        }
+        const rawSdkResponse = {
+          type: "result",
+          subtype: "success",
+          session_id: sessionId,
+          duration_ms: durationMs,
+          total_cost_usd: totalCostUsd,
+          modelUsage: modelUsageMap,
+          usage: {
+            input_tokens: totalInput,
+            output_tokens: totalOutput,
+            cache_read_input_tokens: totalCacheRead,
+            cache_creation_input_tokens: totalCacheCreation
+          },
+          // Provenance: keeping the last assistant payload around helps
+          // debug "did we miss the end_turn?" cases without re-parsing
+          // the JSONL.
+          _cli_provenance: {
+            adapter: "claude-code-cli",
+            assistantTurns: active.assistantTurns.length,
+            lastAssistantSnapshot: active.lastAssistantRaw
+          }
+        };
+        const normalizedSdkResponse = {
+          tokenUsage: {
+            inputTokens: totalInput,
+            outputTokens: totalOutput,
+            totalTokens: totalInput + totalOutput,
+            cacheReadTokens: totalCacheRead,
+            cacheCreationTokens: totalCacheCreation
+          },
+          contextWindowLimit: Math.max(0, ...Object.values(modelUsageMap).map((m) => m.contextWindow)) || 2e5,
+          costUsd: totalCostUsd,
+          primaryModel,
+          durationMs
+        };
+        const lastTurn = active.assistantTurns[active.assistantTurns.length - 1];
+        const computedContextWindow = lastTurn?.usage ? (lastTurn.usage.input_tokens ?? 0) + (lastTurn.usage.cache_creation_input_tokens ?? 0) + (lastTurn.usage.cache_read_input_tokens ?? 0) : void 0;
+        try {
+          await app.service("tasks").patch(active.taskId, {
+            status: TaskStatus3.COMPLETED,
+            completed_at: ts,
+            message_range: {
+              start_index: active.userMessageIndex,
+              end_index: active.lastIndex,
+              end_timestamp: ts
+            },
+            model: primaryModel,
+            duration_ms: durationMs,
+            tool_use_count: active.toolUseCount,
+            raw_sdk_response: rawSdkResponse,
+            normalized_sdk_response: normalizedSdkResponse,
+            computed_context_window: computedContextWindow
+          });
+        } catch (err) {
+          console.warn("[claude-cli-watcher.sink] task close failed", {
+            sessionId,
+            taskId: active.taskId,
+            err: err instanceof Error ? err.message : String(err)
+          });
+        }
+        try {
+          const patch = {
+            status: SessionStatus2.IDLE,
+            ready_for_prompt: true
+          };
+          if (computedContextWindow !== void 0) {
+            patch.current_context_usage = computedContextWindow;
+            patch.context_window_limit = normalizedSdkResponse.contextWindowLimit;
+            patch.last_context_update_at = ts;
+          }
+          await app.service("sessions").patch(sessionId, patch);
+        } catch (err) {
+          console.warn("[claude-cli-watcher.sink] session IDLE patch failed", {
+            sessionId,
+            err: err instanceof Error ? err.message : String(err)
+          });
+        }
+        return;
+      }
+      console.log(
+        JSON.stringify({
+          layer: "claude-cli-watcher.sink",
+          sessionId,
+          eventType: event.type
+        })
+      );
+    } catch (err) {
+      console.warn("[claude-cli-watcher.sink] write failed (re-throwing)", {
+        sessionId,
+        eventType: event.type,
+        err: err instanceof Error ? err.message : String(err)
+      });
+      throw err;
+    }
+  };
+  closeActiveTurnDispatch = async (sessionId, _reason, ts) => {
+    await sink(sessionId, {
+      type: "turn_end",
+      messageId: "watchdog-synthetic",
+      timestamp: ts
+    });
+  };
+  return sink;
+}
+function resolveHomeDirForCliSession(session) {
+  if (session.unix_username) {
+    return `/home/${session.unix_username}`;
+  }
+  return os2.homedir();
+}
+function getCliWatcherRegistry(app) {
+  if (!registrySingleton) {
+    registrySingleton = new ClaudeCliWatcherRegistry(
+      buildCliPersister(app),
+      buildCliEventSink(app),
+      console
+    );
+  }
+  return registrySingleton;
+}
+function buildSpawnConfigForSession(session, worktreeCwd) {
+  const homeDir = resolveHomeDirForCliSession(session);
+  const jsonlPath = claudeSessionJsonlPath2(homeDir, worktreeCwd, session.session_id);
+  const transcriptExists = fs2.existsSync(jsonlPath);
+  return {
+    sessionId: transcriptExists ? void 0 : session.session_id,
+    resumeSessionId: transcriptExists ? session.session_id : void 0,
+    displayName: `cli-${shortId6(session.session_id)}`,
+    model: session.model_config?.model,
+    effort: session.model_config?.effort,
+    permissionMode: permissionModeForCli(session.permission_config?.mode),
+    addDirs: [worktreeCwd]
+    // mcpConfigPath: lands once MCP scoping is plumbed for the CLI adapter.
+    // appendSystemPromptFile: lands once session-context rendering is wired.
+  };
+}
+function dispatchZellijClaudeTab(app, userId, tabName, cwd, command, commandArgs) {
+  if (!userId) return false;
+  if (!app.io) return false;
+  app.io.to(`user/${userId}/terminal`).emit("terminal:tab", {
+    userId,
+    action: "create",
+    tabName,
+    cwd,
+    command,
+    commandArgs
+  });
+  return true;
+}
+async function onCliSessionCreated(app, session, worktreeCwd) {
+  if (session.agentic_tool !== "claude-code-cli") return;
+  const homeDir = resolveHomeDirForCliSession(session);
+  const slug = slugForCwd(worktreeCwd);
+  const jsonlPath = claudeSessionJsonlPath2(homeDir, worktreeCwd, session.session_id);
+  const spawnCfg = buildSpawnConfigForSession(session, worktreeCwd);
+  const built = buildClaudeCliSpawn(spawnCfg);
+  const tabName = spawnCfg.displayName ?? `cli-${shortId6(session.session_id)}`;
+  const persister = buildCliPersister(app);
+  await persister.saveOffset(session.session_id, {
+    watcher_offset: 0,
+    last_event_ts: null,
+    last_event_uuid: null
+  });
+  try {
+    const db = getDb(app);
+    if (db) {
+      const repo = new SessionRepository3(db);
+      const row = await repo.findById(session.session_id).catch(() => null);
+      if (row) {
+        const patch = {
+          sdk_session_id: session.session_id,
+          cli_state: {
+            ...row.cli_state ?? {},
+            slug,
+            jsonl_path: jsonlPath,
+            zellij_tab_name: tabName
+          }
+        };
+        await repo.update(session.session_id, patch);
+      }
+    }
+  } catch (err) {
+    console.warn("[claude-cli-integration] failed to persist initial cli_state", err);
+  }
+  try {
+    const reg = getCliWatcherRegistry(app);
+    await reg.register({
+      sessionId: session.session_id,
+      cwd: worktreeCwd,
+      homeDir,
+      startOffset: session.cli_state?.watcher_offset ?? 0
+    });
+  } catch (err) {
+    console.warn(
+      `[claude-cli-integration] watcher register failed for session ${session.session_id}:`,
+      err
+    );
+  }
+  const dispatched = dispatchZellijClaudeTab(
+    app,
+    session.created_by,
+    tabName,
+    worktreeCwd,
+    built.bin,
+    built.args
+  );
+  console.log(
+    JSON.stringify({
+      layer: "claude-cli-integration.onCliSessionCreated",
+      sessionId: session.session_id,
+      slug,
+      jsonl_path: jsonlPath,
+      tab_dispatched: dispatched,
+      spawn: { bin: built.bin, args: built.args }
+    })
+  );
+}
+async function onCliSessionEnded(app, sessionId) {
+  const reg = getCliWatcherRegistry(app);
+  await reg.unregister(sessionId);
+  stopTaskWatchdog(sessionId);
+  activeCliTurn.delete(sessionId);
+}
+async function rehydrateCliWatchers(app, worktreeCwdLookup) {
+  const db = getDb(app);
+  if (!db) return;
+  const repo = new SessionRepository3(db);
+  const all = await repo.findAll().catch(() => []);
+  const reg = getCliWatcherRegistry(app);
+  let rehydrated = 0;
+  for (const session of all) {
+    if (session.agentic_tool !== "claude-code-cli") continue;
+    if (session.status === "completed" || session.status === "failed") continue;
+    if (session.archived) continue;
+    const cwd = await worktreeCwdLookup(session.worktree_id);
+    if (!cwd) continue;
+    primeActiveCliTurnFromSession(app, session);
+    try {
+      await reg.register({
+        sessionId: session.session_id,
+        cwd,
+        homeDir: resolveHomeDirForCliSession(session),
+        startOffset: session.cli_state?.watcher_offset ?? 0
+      });
+      rehydrated++;
+    } catch (err) {
+      console.warn(
+        `[claude-cli-integration] failed to rehydrate watcher for ${session.session_id}:`,
+        err
+      );
+    }
+  }
+  if (rehydrated > 0) {
+    console.log(`[claude-cli-integration] rehydrated ${rehydrated} CLI watcher(s)`);
+  }
+}
+var activeCliTurn, WATCHDOG_TICK_MS, WATCHDOG_IDLE_THRESHOLD_MS, watchdogTimers, closeActiveTurnDispatch, pendingCliTask, registrySingleton;
+var init_claude_cli_integration = __esm({
+  "src/services/claude-cli-integration.ts"() {
+    "use strict";
+    init_drizzle();
+    init_build_initial_user_message();
+    init_claude_cli_watcher();
+    init_claude_cli_watcher();
+    activeCliTurn = /* @__PURE__ */ new Map();
+    WATCHDOG_TICK_MS = 6e4;
+    WATCHDOG_IDLE_THRESHOLD_MS = 9e4;
+    watchdogTimers = /* @__PURE__ */ new Map();
+    closeActiveTurnDispatch = null;
+    pendingCliTask = /* @__PURE__ */ new Map();
+    registrySingleton = null;
+  }
 });
-import { runAsUser, validateResolvedUnixUser } from "@agor/core/unix";
-async function resolveValidatedDaemonUser() {
+
+// src/utils/git-impersonation.ts
+async function resolveDaemonUserForGroupRefresh() {
   const { getDaemonUser, isUnixGroupRefreshNeeded } = await import("@agor/core/config");
   if (!isUnixGroupRefreshNeeded()) {
     return void 0;
   }
-  const daemonUser = getDaemonUser();
-  if (daemonUser) {
-    validateResolvedUnixUser("simple", daemonUser);
-  }
-  return daemonUser;
+  return getDaemonUser();
 }
+var init_git_impersonation = __esm({
+  "src/utils/git-impersonation.ts"() {
+    "use strict";
+  }
+});
+
+// src/utils/git-shell-capture.ts
+var git_shell_capture_exports = {};
+__export(git_shell_capture_exports, {
+  captureGitStateViaShell: () => captureGitStateViaShell
+});
+import { runAsUser } from "@agor/core/unix";
 async function captureGitStateViaShell(worktreePath) {
-  const daemonUser = await resolveValidatedDaemonUser();
+  const daemonUser = await resolveDaemonUserForGroupRefresh();
   const runOpts = { asUser: daemonUser, timeout: 1e4 };
   let sha = "unknown";
   let ref = "unknown";
@@ -301,12 +1522,13 @@ async function captureGitStateViaShell(worktreePath) {
   }
   return { sha, ref };
 }
-function escapeForShell(path2) {
-  return `'${path2.replace(/'/g, "'\\''")}'`;
+function escapeForShell(path3) {
+  return `'${path3.replace(/'/g, "'\\''")}'`;
 }
 var init_git_shell_capture = __esm({
   "src/utils/git-shell-capture.ts"() {
     "use strict";
+    init_git_impersonation();
   }
 });
 
@@ -640,10 +1862,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path2) {
-  if (!path2)
+function getElementAtPath(obj, path3) {
+  if (!path3)
     return obj;
-  return path2.reduce((acc, key) => acc?.[key], obj);
+  return path3.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -971,11 +2193,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path2, issues) {
+function prefixIssues(path3, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path2);
+    iss.path.unshift(path3);
     return iss;
   });
 }
@@ -1193,16 +2415,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path2 = []) => {
+  const processError = (error52, path3 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1229,17 +2451,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path2 = []) => {
+  const processError = (error52, path3 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path2, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path3, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path2, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path3, ...issue2.path]);
       } else {
-        const fullpath = [...path2, ...issue2.path];
+        const fullpath = [...path3, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1271,8 +2493,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path2 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path2) {
+  const path3 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path3) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -13153,7 +14375,7 @@ var init_v4_mini = __esm({
 
 // src/mcp/tokens.ts
 import { MCP_TOKEN } from "@agor/core/config";
-import { generateId, SessionRepository as SessionRepository2 } from "@agor/core/db";
+import { generateId as generateId4, SessionRepository as SessionRepository4, shortId as shortId7 } from "@agor/core/db";
 import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
@@ -13204,7 +14426,7 @@ async function validateSessionToken(app, token) {
   }
   const sessionExists = await s.sessionRepo.exists(sessionId);
   if (!sessionExists) {
-    console.warn(`[mcp-tokens] token rejected: session ${sessionId.substring(0, 8)} not found`);
+    console.warn(`[mcp-tokens] token rejected: session ${shortId7(sessionId)} not found`);
     return null;
   }
   return { sessionId, userId, jti: payload.jti };
@@ -13232,7 +14454,8 @@ var init_tool_registry = __esm({
       users: "User accounts, profiles, preferences, and administration",
       analytics: "Usage and cost tracking leaderboard",
       "mcp-servers": "External MCP server configuration and OAuth management",
-      proxies: "Configured HTTP proxies for third-party APIs (Shortcut, Linear, Jira, etc.)"
+      proxies: "Configured HTTP proxies for third-party APIs (Shortcut, Linear, Jira, etc.)",
+      widgets: "In-conversation interactive widgets \u2014 agents render small forms/buttons inline in the transcript to capture user input that never enters the LLM context"
     };
     ALWAYS_VISIBLE = /* @__PURE__ */ new Set(["agor_search_tools", "agor_execute_tool"]);
     ToolRegistry = class {
@@ -15001,13 +16224,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path2 = ref.slice(1).split("/").filter(Boolean);
-  if (path2.length === 0) {
+  const path3 = ref.slice(1).split("/").filter(Boolean);
+  if (path3.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path2[0] === defsKey) {
-    const key = path2[1];
+  if (path3[0] === defsKey) {
+    const key = path3[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -15875,7 +17098,7 @@ var init_analytics = __esm({
 
 // src/mcp/tools/artifacts.ts
 import { WorktreeRepository as WorktreeRepository2 } from "@agor/core/db";
-import { NotFoundError } from "@agor/core/utils/errors";
+import { NotFoundError as NotFoundError2 } from "@agor/core/utils/errors";
 function registerArtifactTools(server, ctx) {
   server.registerTool(
     "agor_artifacts_publish",
@@ -16048,7 +17271,7 @@ NOTE: sandpack_error and console_logs require a browser to be viewing the artifa
       try {
         artifact = await service.get(artifactId, ctx.baseServiceParams);
       } catch (err) {
-        if (err instanceof NotFoundError) {
+        if (err instanceof NotFoundError2) {
           return textResult({ error: `Artifact ${artifactId} not found` });
         }
         throw err;
@@ -16159,7 +17382,7 @@ Visibility: public artifacts are readable by anyone; private artifacts are only
       try {
         artifact = await service.get(artifactId, ctx.baseServiceParams);
       } catch (err) {
-        if (err instanceof NotFoundError) {
+        if (err instanceof NotFoundError2) {
           return textResult({ error: `Artifact ${artifactId} not found` });
         }
         throw err;
@@ -17493,7 +18716,7 @@ import {
   inArray,
   messages as messagesTable,
   or,
-  SessionRepository as SessionRepository3,
+  SessionRepository as SessionRepository5,
   select,
   sql
 } from "@agor/core/db";
@@ -17562,7 +18785,7 @@ function registerMessageTools(server, ctx) {
       if (isWorktreeRbacEnabled()) {
         const userRole = ctx.authenticatedUser?.role;
         if (!isSuperAdmin(userRole)) {
-          const sessionRepo = new SessionRepository3(ctx.db);
+          const sessionRepo = new SessionRepository5(ctx.db);
           const accessibleSessions = await sessionRepo.findAccessibleSessions(ctx.userId);
           const accessibleIds = accessibleSessions.map((s) => s.session_id);
           if (accessibleIds.length === 0) {
@@ -17868,11 +19091,11 @@ function registerRepoTools(server, ctx) {
       })
     },
     async (args) => {
-      const path2 = coerceString(args.path);
-      if (!path2) throw new Error("path is required");
+      const path3 = coerceString(args.path);
+      if (!path3) throw new Error("path is required");
       const slug = coerceString(args.slug);
       const reposService = ctx.app.service("repos");
-      const repo = await reposService.addLocalRepository({ path: path2, slug }, ctx.baseServiceParams);
+      const repo = await reposService.addLocalRepository({ path: path3, slug }, ctx.baseServiceParams);
       return textResult(repo);
     }
   );
@@ -18053,7 +19276,7 @@ var init_search = __esm({
 });
 
 // src/mcp/tools/sessions.ts
-import { WorktreeRepository as WorktreeRepository3 } from "@agor/core/db";
+import { shortId as shortId8, WorktreeRepository as WorktreeRepository3 } from "@agor/core/db";
 import {
   AVAILABLE_CLAUDE_MODEL_ALIASES,
   CODEX_MODEL_METADATA,
@@ -18336,7 +19559,7 @@ function registerSessionTools(server, ctx) {
       inputSchema: external_exports.object({
         prompt: external_exports.string().describe("The prompt/task for the subsession agent to execute"),
         title: external_exports.string().optional().describe("Optional title for the session (defaults to first 100 chars of prompt)"),
-        agenticTool: external_exports.enum(["claude-code", "codex", "gemini", "opencode"]).optional().describe("Which agent to use for the subsession (defaults to same as parent)"),
+        agenticTool: external_exports.enum(["claude-code", "claude-code-cli", "codex", "gemini", "opencode"]).optional().describe("Which agent to use for the subsession (defaults to same as parent)"),
         enableCallback: external_exports.boolean().optional().describe("Enable callback to parent on completion (default: true)"),
         includeLastMessage: external_exports.boolean().optional().describe("Include child's final result in callback (default: true)"),
         includeOriginalPrompt: external_exports.boolean().optional().describe("Include original spawn prompt in callback (default: false)"),
@@ -18391,7 +19614,7 @@ function registerSessionTools(server, ctx) {
         mode: external_exports.enum(["continue", "fork", "subsession", "btw"]).describe(
           "How to route the work: continue (add to existing session), fork (create sibling session), subsession (create child session), btw (ephemeral fork \u2014 works even on running sessions, auto-callbacks result to caller, auto-archives when done)"
         ),
-        agenticTool: external_exports.enum(["claude-code", "codex", "gemini"]).optional().describe(
+        agenticTool: external_exports.enum(["claude-code", "claude-code-cli", "codex", "gemini"]).optional().describe(
           "Agent for subsession (subsession mode only, defaults to parent agent). Fork mode always uses parent agent."
         ),
         title: external_exports.string().optional().describe("Session title (for fork/subsession only)"),
@@ -18500,7 +19723,7 @@ function registerSessionTools(server, ctx) {
       description: 'Create a new session in an existing worktree. Use for starting fresh work on a new task in the same codebase (e.g., new feature branch, separate investigation). Unlike spawn, this creates an independent session with no parent-child relationship. MCP servers are inherited from the worktree (if configured) or user defaults, or can be overridden via `mcpServerIds`. Model selection falls back to user defaults and can be overridden via `modelConfig` (accepts either a model ID string like "claude-opus-4-6" or a full {mode, model, effort, provider} object \u2014 call `agor_models_list` to discover valid model IDs per agenticTool). Supports optional callbacks to notify the creating session when the new session completes.',
       inputSchema: external_exports.object({
         worktreeId: external_exports.string().describe("Worktree ID where the session will run (required)"),
-        agenticTool: external_exports.enum(["claude-code", "codex", "gemini"]).describe("Which agent to use for this session (required)"),
+        agenticTool: external_exports.enum(["claude-code", "claude-code-cli", "codex", "gemini"]).describe("Which agent to use for this session (required)"),
         title: external_exports.string().optional().describe("Session title (optional)"),
         description: external_exports.string().optional().describe("Session description (optional)"),
         contextFiles: external_exports.array(external_exports.string()).optional().describe("Context file paths to load (optional)"),
@@ -18623,7 +19846,7 @@ function registerSessionTools(server, ctx) {
           { ...ctx.baseServiceParams, route: { id: session.session_id } }
         );
       }
-      const callbackNote = callbackConfig.callback_session_id ? ` Callback will be sent to session ${callbackConfig.callback_session_id.substring(0, 8)} on completion.` : "";
+      const callbackNote = callbackConfig.callback_session_id ? ` Callback will be sent to session ${shortId8(callbackConfig.callback_session_id)} on completion.` : "";
       const mcpFailureNote = mcpAttachFailures.length > 0 ? ` Warning: ${mcpAttachFailures.length} requested MCP server(s) failed to attach \u2014 see mcpAttachFailures.` : "";
       return textResult({
         session,
@@ -18894,7 +20117,7 @@ function registerSessionTools(server, ctx) {
       description: "List valid model IDs grouped by agenticTool. Use this to discover what to pass for `modelConfig` (or its string shorthand) in agor_sessions_create / spawn / prompt. Sourced live from the daemon model registry \u2014 when new models ship and the registry is updated, this tool returns them on the next call.",
       annotations: { readOnlyHint: true },
       inputSchema: external_exports.object({
-        agenticTool: external_exports.enum(["claude-code", "codex", "copilot", "gemini"]).optional().describe("Filter to a single agentic tool. Omit to return all tools.")
+        agenticTool: external_exports.enum(["claude-code", "claude-code-cli", "codex", "copilot", "gemini"]).optional().describe("Filter to a single agentic tool. Omit to return all tools.")
       })
     },
     async (args) => {
@@ -18926,6 +20149,13 @@ function registerSessionTools(server, ctx) {
           default: DEFAULT_CLAUDE_MODEL,
           models: claudeModels
         },
+        // Claude Code CLI shares the same Anthropic model lineup as the
+        // SDK path; surface the same list so MCP clients can pass any
+        // valid claude id to either adapter.
+        "claude-code-cli": {
+          default: DEFAULT_CLAUDE_MODEL,
+          models: claudeModels
+        },
         codex: {
           default: DEFAULT_CODEX_MODEL,
           models: codexModels
@@ -19146,33 +20376,194 @@ function registerUserTools(server, ctx) {
       })
     },
     async (args) => {
-      const createData = {
-        email: args.email,
-        password: args.password
-      };
-      if (args.name !== void 0) createData.name = args.name;
-      if (args.emoji !== void 0) createData.emoji = args.emoji;
-      if (args.avatar !== void 0) createData.avatar = args.avatar;
-      if (args.unix_username !== void 0) createData.unix_username = args.unix_username;
-      if (args.must_change_password !== void 0)
-        createData.must_change_password = args.must_change_password;
-      if (args.role !== void 0) createData.role = args.role;
-      const newUser = await ctx.app.service("users").create(createData, ctx.baseServiceParams);
-      return textResult(newUser);
+      const createData = {
+        email: args.email,
+        password: args.password
+      };
+      if (args.name !== void 0) createData.name = args.name;
+      if (args.emoji !== void 0) createData.emoji = args.emoji;
+      if (args.avatar !== void 0) createData.avatar = args.avatar;
+      if (args.unix_username !== void 0) createData.unix_username = args.unix_username;
+      if (args.must_change_password !== void 0)
+        createData.must_change_password = args.must_change_password;
+      if (args.role !== void 0) createData.role = args.role;
+      const newUser = await ctx.app.service("users").create(createData, ctx.baseServiceParams);
+      return textResult(newUser);
+    }
+  );
+}
+var init_users = __esm({
+  "src/mcp/tools/users.ts"() {
+    "use strict";
+    init_zod();
+    init_server();
+  }
+});
+
+// src/widgets/env-vars/index.ts
+import { ENV_VAR_CONSTRAINTS, isEnvVarAllowed, validateEnvVar } from "@agor/core/config";
+import { BadRequest as BadRequest2 } from "@agor/core/feathers";
+var ENV_VAR_NAME_REGEX, envVarsParamsSchema, envVarsSubmitSchema;
+var init_env_vars = __esm({
+  "src/widgets/env-vars/index.ts"() {
+    "use strict";
+    init_zod();
+    init_registry();
+    ENV_VAR_NAME_REGEX = ENV_VAR_CONSTRAINTS.NAME_PATTERN;
+    envVarsParamsSchema = external_exports.object({
+      names: external_exports.array(external_exports.string().regex(ENV_VAR_NAME_REGEX)).min(1).max(10).refine((names) => new Set(names).size === names.length, {
+        message: "Env var names must be unique"
+      }).describe("UPPER_SNAKE env var names (same validation as User Settings)."),
+      reason: external_exports.string().min(1).max(200).describe(
+        "One sentence explaining why you need the value(s). Keep it tight \u2014 this renders in a small muted line under the input. NOT a place to restate what the widget does."
+      ),
+      auto_resume: external_exports.boolean().default(true).describe(
+        "When true (default), a system-authored prompt is auto-queued back into the agent on submit/dismiss."
+      )
+    });
+    envVarsSubmitSchema = external_exports.object({
+      values: external_exports.record(
+        external_exports.string().regex(ENV_VAR_NAME_REGEX),
+        external_exports.string().min(1).max(ENV_VAR_CONSTRAINTS.MAX_VALUE_LENGTH)
+      ).refine((v) => Object.keys(v).length >= 1 && Object.keys(v).length <= 10, {
+        message: "Must submit between 1 and 10 env vars"
+      }),
+      scope: external_exports.enum(["global", "session"])
+    });
+  }
+});
+
+// src/mcp/tools/widgets.ts
+import { MessageRole as MessageRole3 } from "@agor/core/types";
+function widgetContentPreview(params) {
+  const list = params.names.join(", ");
+  return params.names.length === 1 ? `Please provide ${list}: ${params.reason}` : `Please provide ${list}: ${params.reason}`;
+}
+function allNamesPresentInScope(envVarsMeta, names, scope) {
+  if (!envVarsMeta) return false;
+  for (const name of names) {
+    const meta3 = envVarsMeta[name];
+    if (!meta3 || meta3.scope !== scope) return false;
+  }
+  return true;
+}
+function registerWidgetTools(server, ctx) {
+  server.registerTool(
+    "agor_widgets_request_env_vars",
+    {
+      description: 'Ask the user to provide one or more environment variables via a compact in-conversation form. FIRE-AND-FORGET: the widget renders inline; end your turn after calling. You will receive a user-role message ("[Agor] User submitted ...") when the user responds. Values never enter your context \u2014 only the variable NAMES do. Do NOT ask the user to paste values into chat. Keep `reason` to ONE short sentence (\u2264200 chars) \u2014 it shows as a small muted line; do not restate what the widget does or describe the security contract (the UI handles that).',
+      annotations: { destructiveHint: false, openWorldHint: false },
+      inputSchema: envVarsParamsSchema
+    },
+    async (args) => {
+      const params = args;
+      const session = await ctx.app.service("sessions").get(ctx.sessionId, ctx.baseServiceParams);
+      const sessionCreatorId = session.created_by;
+      const creator = await ctx.app.service("users").get(sessionCreatorId, ctx.baseServiceParams);
+      const presentEverywhere = allNamesPresentInScope(
+        creator.env_vars,
+        params.names,
+        "global"
+      );
+      const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const baseWidgetMeta = {
+        widget_type: "env_vars",
+        schema_version: 1,
+        params,
+        status: presentEverywhere ? "already_present" : "pending",
+        requested_at: requestedAt,
+        ...presentEverywhere ? { resolved_at: requestedAt } : {},
+        auto_resume: params.auto_resume
+      };
+      const hostTask = await findHostTaskForSession(
+        ctx.app,
+        ctx.sessionId,
+        ctx.baseServiceParams
+      );
+      const hostTaskId = hostTask?.task_id;
+      const created = await appendSystemMessage({
+        app: ctx.app,
+        db: ctx.db,
+        sessionId: ctx.sessionId,
+        taskId: hostTaskId,
+        content: widgetContentPreview(params),
+        contentPreview: `Widget: env_vars (${params.names.join(", ")})`,
+        type: "widget_request",
+        role: MessageRole3.SYSTEM,
+        // widget_id is filled in once we know the new message_id (id == widget_id).
+        metadata: {
+          widget: {
+            ...baseWidgetMeta,
+            widget_id: "pending"
+          }
+        }
+      });
+      const widgetId = created.message_id;
+      if (hostTask?.message_range) {
+        try {
+          await ctx.app.service("tasks").patch(
+            hostTask.task_id,
+            {
+              message_range: {
+                start_index: hostTask.message_range.start_index,
+                end_index: created.index
+              }
+            },
+            ctx.baseServiceParams
+          );
+        } catch (err) {
+          console.warn(
+            `[widgets] failed to extend task.message_range for widget ${widgetId}:`,
+            err
+          );
+        }
+      }
+      await ctx.app.service("messages").patch(
+        widgetId,
+        {
+          metadata: {
+            ...created.metadata ?? {},
+            widget: { ...baseWidgetMeta, widget_id: widgetId }
+          }
+        },
+        ctx.baseServiceParams
+      );
+      if (presentEverywhere) {
+        if (params.auto_resume) {
+          const namesList = params.names.join(", ");
+          const verb = params.names.length === 1 ? "was" : "were";
+          const prompt = `[Agor] ${namesList} ${verb} already configured. You can proceed.`;
+          await ctx.app.service("/sessions/:id/prompt").create(
+            {
+              prompt,
+              messageSource: "agor",
+              metadata: {
+                system_authored: true,
+                widget_id: widgetId
+              }
+            },
+            { ...ctx.baseServiceParams, route: { id: ctx.sessionId } }
+          );
+        }
+        return textResult({ widget_id: widgetId, status: "already_present" });
+      }
+      return textResult({ widget_id: widgetId, status: "requested" });
     }
   );
 }
-var init_users = __esm({
-  "src/mcp/tools/users.ts"() {
+var init_widgets = __esm({
+  "src/mcp/tools/widgets.ts"() {
     "use strict";
-    init_zod();
+    init_append_system_message();
+    init_session_tasks();
+    init_env_vars();
     init_server();
   }
 });
 
 // src/mcp/tools/worktrees.ts
 import { isWorktreeRbacEnabled as isWorktreeRbacEnabled2 } from "@agor/core/config";
-import { WorktreeRepository as WorktreeRepository4 } from "@agor/core/db";
+import { shortId as shortId9, WorktreeRepository as WorktreeRepository4 } from "@agor/core/db";
 import { getAssistantConfig, isAssistant, WORKTREE_PERMISSION_LEVELS as WORKTREE_PERMISSION_LEVELS2 } from "@agor/core/types";
 import { computeZoneRelativePosition } from "@agor/core/utils/board-placement";
 import { normalizeOptionalHttpUrl } from "@agor/core/utils/url";
@@ -19552,7 +20943,7 @@ function registerWorktreeTools(server, ctx) {
       const zoneId = coerceString(args.zoneId);
       const targetSessionId = coerceString(args.targetSessionId) ? await resolveSessionId(ctx, coerceString(args.targetSessionId)) : void 0;
       const triggerTemplate = args.triggerTemplate === true;
-      console.log(`\u{1F4CD} MCP pinning worktree ${worktreeId.substring(0, 8)} to zone ${zoneId}`);
+      console.log(`\u{1F4CD} MCP pinning worktree ${shortId9(worktreeId)} to zone ${zoneId}`);
       const worktree = await ctx.app.service("worktrees").get(worktreeId, ctx.baseServiceParams);
       if (!worktree.board_id) {
         throw new Error("Worktree must be on a board before it can be pinned to a zone");
@@ -19590,9 +20981,7 @@ function registerWorktreeTools(server, ctx) {
       const hasZoneTrigger = zone.trigger?.template && zone.trigger.template.trim().length > 0;
       const isAlwaysNew = hasZoneTrigger && zone.trigger.behavior === "always_new";
       if (triggerTemplate && targetSessionId && hasZoneTrigger) {
-        console.log(
-          `\u{1F3AF} Triggering zone prompt template for session ${targetSessionId.substring(0, 8)}`
-        );
+        console.log(`\u{1F3AF} Triggering zone prompt template for session ${shortId9(targetSessionId)}`);
         const { renderTemplate: renderTemplate2 } = await import("@agor/core/templates/handlebars-helpers");
         const { buildZoneTriggerContext: buildZoneTriggerContext2 } = await import("@agor/core/templates/zone-trigger-context");
         let targetSession;
@@ -19625,7 +21014,7 @@ function registerWorktreeTools(server, ctx) {
               note: "Session is busy. Zone trigger prompt has been queued."
             };
             console.log(
-              `\u{1F4EC} Zone trigger queued for session ${targetSessionId.substring(0, 8)} at position ${task.queue_position}`
+              `\u{1F4EC} Zone trigger queued for session ${shortId9(targetSessionId)} at position ${task.queue_position}`
             );
           } else {
             promptResult = {
@@ -19633,7 +21022,7 @@ function registerWorktreeTools(server, ctx) {
               sessionId: targetSessionId,
               note: "Zone trigger prompt sent to target session"
             };
-            console.log(`\u2705 Zone trigger executed: task ${task.task_id.substring(0, 8)}`);
+            console.log(`\u2705 Zone trigger executed: task ${shortId9(task.task_id)}`);
           }
         } else {
           promptResult = {
@@ -19643,7 +21032,7 @@ function registerWorktreeTools(server, ctx) {
         }
       } else if (isAlwaysNew) {
         console.log(
-          `\u{1F3AF} Zone has always_new trigger, auto-creating session for worktree ${worktreeId.substring(0, 8)}`
+          `\u{1F3AF} Zone has always_new trigger, auto-creating session for worktree ${shortId9(worktreeId)}`
         );
         try {
           const user = await ctx.app.service("users").get(ctx.userId, ctx.baseServiceParams);
@@ -19658,15 +21047,13 @@ function registerWorktreeTools(server, ctx) {
             userId: ctx.userId
           });
           const agenticTool = newSession.agentic_tool;
-          console.log(
-            `\u2705 Auto-created session ${newSession.session_id.substring(0, 8)} (${agenticTool})`
-          );
+          console.log(`\u2705 Auto-created session ${shortId9(newSession.session_id)} (${agenticTool})`);
           promptResult = {
             taskId: task.task_id,
             sessionId: newSession.session_id,
-            note: `always_new trigger: created session ${newSession.session_id.substring(0, 8)} (${agenticTool}) and sent prompt`
+            note: `always_new trigger: created session ${shortId9(newSession.session_id)} (${agenticTool}) and sent prompt`
           };
-          console.log(`\u2705 Zone trigger executed: task ${task.task_id.substring(0, 8)}`);
+          console.log(`\u2705 Zone trigger executed: task ${shortId9(task.task_id)}`);
         } catch (error51) {
           const message = error51 instanceof Error ? error51.message : String(error51);
           if (message.includes("rendered to an empty prompt")) {
@@ -19847,8 +21234,9 @@ __export(server_exports, {
   setupMCPRoutes: () => setupMCPRoutes,
   textResult: () => textResult
 });
+import { shortId as shortId10 } from "@agor/core/db";
 import { getServiceTier as getServiceTier2, SERVICE_GROUP_TO_MCP_DOMAINS, SERVICE_TIER_RANK } from "@agor/core/types";
-import { NotFoundError as NotFoundError2 } from "@agor/core/utils/errors";
+import { NotFoundError as NotFoundError3 } from "@agor/core/utils/errors";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
@@ -19912,6 +21300,10 @@ function buildRegistry(servicesConfig) {
     registerTaskTools(tempServer, dummyCtx);
     registerMessageTools(tempServer, dummyCtx);
   }
+  if (isDomainEnabled("widgets", servicesConfig)) {
+    registry2.setCurrentDomain("widgets");
+    registerWidgetTools(tempServer, dummyCtx);
+  }
   if (isDomainEnabled("repos", servicesConfig)) {
     registry2.setCurrentDomain("repos");
     registerRepoTools(tempServer, dummyCtx);
@@ -20018,6 +21410,7 @@ function createMcpServer(ctx, toolSearchEnabled, servicesConfig) {
     registerTaskTools(s, c);
     registerMessageTools(s, c);
   });
+  domainRegister("widgets", registerWidgetTools);
   domainRegister("repos", registerRepoTools);
   domainRegister("worktrees", (s, c) => {
     registerWorktreeTools(s, c);
@@ -20090,13 +21483,13 @@ function setupMCPRoutes(app, db, toolSearchEnabled = true, servicesConfig) {
         });
       }
       console.log(
-        `\u{1F50C} MCP request authenticated (user: ${context.userId.substring(0, 8)}, session: ${context.sessionId.substring(0, 8)})`
+        `\u{1F50C} MCP request authenticated (user: ${shortId10(context.userId)}, session: ${shortId10(context.sessionId)})`
       );
       let authenticatedUser;
       try {
         authenticatedUser = await app.service("users").get(context.userId);
       } catch (error51) {
-        if (error51 instanceof NotFoundError2) {
+        if (error51 instanceof NotFoundError3) {
           return res.status(401).json({
             jsonrpc: "2.0",
             id: req.body?.id,
@@ -20174,6 +21567,7 @@ var init_server = __esm({
     init_sessions();
     init_tasks();
     init_users();
+    init_widgets();
     init_worktrees();
     SERVER_INSTRUCTIONS = `Agor is a multiplayer canvas for orchestrating AI coding agents. It manages git worktrees, tracks AI conversations, visualizes work on spatial boards, and enables real-time collaboration.
 
@@ -20192,6 +21586,7 @@ Domains:
 - users: User accounts, profiles, preferences, and administration
 - analytics: Usage and cost tracking leaderboard
 - mcp-servers: External MCP server configuration and OAuth management
+- widgets: In-conversation interactive widgets (forms/buttons rendered inline; values never enter your context)
 
 Common workflows:
 
@@ -20217,40 +21612,43 @@ Discover tools: search (list detail) \u2192 search (full detail for schemas) \u2
 // src/register-routes.ts
 import { loadConfig as loadConfig2 } from "@agor/core/config";
 import {
-  generateId as generateId2,
+  generateId as generateId5,
   MCPServerRepository,
   MessagesRepository,
   RepoRepository,
   SessionMCPServerRepository as SessionMCPServerRepository2,
-  SessionRepository as SessionRepository4,
-  TaskRepository,
+  SessionRepository as SessionRepository6,
+  shortId as shortId11,
+  TaskRepository as TaskRepository2,
   UsersRepository as UsersRepository2,
   WorktreeRepository as WorktreeRepository5
 } from "@agor/core/db";
 import {
   AuthenticationService,
-  BadRequest as BadRequest2,
+  BadRequest as BadRequest3,
   Conflict as Conflict2,
   errorHandler,
-  Forbidden as Forbidden4,
+  Forbidden as Forbidden5,
   LocalStrategy,
-  NotAuthenticated as NotAuthenticated5,
-  NotFound as NotFound2
+  NotAuthenticated as NotAuthenticated6,
+  NotFound as NotFound3
 } from "@agor/core/feathers";
 import { PermissionService } from "@agor/core/permissions";
 import {
   AGENTIC_TOOL_CAPABILITIES as AGENTIC_TOOL_CAPABILITIES2,
   hasMinimumRole as hasMinimumRole2,
+  MessageRole as MessageRole4,
   ROLES as ROLES4,
   SERVICE_GROUP_NAMES as SERVICE_GROUP_NAMES2,
-  SessionStatus as SessionStatus2,
-  TaskStatus as TaskStatus2
+  SessionStatus as SessionStatus3,
+  TaskStatus as TaskStatus4
 } from "@agor/core/types";
-import { NotFoundError as NotFoundError3 } from "@agor/core/utils/errors";
+import { NotFoundError as NotFoundError4 } from "@agor/core/utils/errors";
 import { rateLimit as rateLimit2 } from "express-rate-limit";
 import jwt4 from "jsonwebtoken";
 
 // src/executor-tracking.ts
+import { shortId } from "@agor/core/db";
 var executorProcesses = /* @__PURE__ */ new Map();
 function killExecutorProcess(sessionId) {
   const proc = executorProcesses.get(sessionId);
@@ -20262,7 +21660,7 @@ function killExecutorProcess(sessionId) {
     return false;
   }
   console.log(
-    `\u{1F6D1} [Stop] Sending SIGTERM to executor PID ${proc.pid} (session ${sessionId.substring(0, 8)})`
+    `\u{1F6D1} [Stop] Sending SIGTERM to executor PID ${proc.pid} (session ${shortId(sessionId)})`
   );
   try {
     process.kill(proc.pid, "SIGTERM");
@@ -20315,6 +21713,7 @@ var ScheduleNotReadyError = class extends Error {
 };
 
 // src/services/user-api-keys.ts
+import { shortId as shortId2 } from "@agor/core/db";
 import { BadRequest, NotAuthenticated } from "@agor/core/feathers";
 function createUserApiKeysService(apiKeysRepo) {
   return {
@@ -20336,9 +21735,7 @@ function createUserApiKeysService(apiKeysRepo) {
         throw new BadRequest("Maximum of 25 API keys per user");
       }
       const result = await apiKeysRepo.create(user.user_id, name);
-      console.log(
-        `[API Keys] Created: ${result.key.prefix}... for user ${user.user_id.substring(0, 8)}`
-      );
+      console.log(`[API Keys] Created: ${result.key.prefix}... for user ${shortId2(user.user_id)}`);
       return result;
     },
     /** Update key name */
@@ -20358,9 +21755,7 @@ function createUserApiKeysService(apiKeysRepo) {
       const user = params.user;
       if (!user) throw new NotAuthenticated("Authentication required");
       await apiKeysRepo.delete(id, user.user_id);
-      console.log(
-        `[API Keys] Deleted: ${id.substring(0, 8)} for user ${user.user_id.substring(0, 8)}`
-      );
+      console.log(`[API Keys] Deleted: ${shortId2(id)} for user ${shortId2(user.user_id)}`);
       return { id };
     }
   };
@@ -20611,6 +22006,9 @@ function applyTierHooks(app, servicePath, tier) {
   }
 }
 
+// src/register-routes.ts
+init_append_system_message();
+
 // src/utils/auth-rate-limit-key.ts
 function buildAuthRateLimitKey(req) {
   const ip = (req.ip || "unknown").toLowerCase();
@@ -20645,17 +22043,21 @@ function requireMinimumRole(minimumRole, action) {
   };
 }
 var DEFAULT_MANAGED_ENVS_MINIMUM_ROLE = ROLES.MEMBER;
-function registerAuthenticatedRoute(app, path2, service, authConfig, requireAuth) {
-  app.use(path2, service);
+function registerAuthenticatedRoute(app, path3, service, authConfig, requireAuth) {
+  app.use(path3, service);
   const hooks = {};
   for (const [method, config2] of Object.entries(authConfig)) {
     hooks[method] = [requireAuth, requireMinimumRole(config2.role, config2.action)];
   }
-  app.service(path2).hooks({
+  app.service(path3).hooks({
     before: hooks
   });
 }
 
+// src/register-routes.ts
+init_build_initial_user_message();
+init_session_tasks();
+
 // src/utils/session-turn-lock.ts
 async function withSessionTurnLock(locks, sessionId, fn) {
   while (locks.has(sessionId)) {
@@ -20675,16 +22077,17 @@ async function withSessionTurnLock(locks, sessionId, fn) {
 }
 
 // src/utils/task-runner.ts
+import { shortId as shortId3 } from "@agor/core/db";
 import { Conflict, NotFound } from "@agor/core/feathers";
-import { TaskStatus } from "@agor/core/types";
+import { TaskStatus as TaskStatus2 } from "@agor/core/types";
 async function runExistingTask(task, options, params, deps) {
   const fresh = await deps.findTaskById(task.task_id);
   if (!fresh) {
     throw new NotFound(`Task ${task.task_id} no longer exists`);
   }
-  if (fresh.status !== TaskStatus.CREATED) {
+  if (fresh.status !== TaskStatus2.CREATED) {
     throw new Conflict(
-      `Task ${task.task_id.substring(0, 8)} cannot be run: status is '${fresh.status}' (only 'created' tasks may be triggered; the task may have been started by another caller or drained from the queue).`
+      `Task ${shortId3(task.task_id)} cannot be run: status is '${fresh.status}' (only 'created' tasks may be triggered; the task may have been started by another caller or drained from the queue).`
     );
   }
   return await deps.spawnFn(fresh, options, params);
@@ -20700,6 +22103,7 @@ function normalizeMessageSource(input, params) {
 import fs from "fs/promises";
 import os from "os";
 import path from "path";
+import { shortId as shortId4 } from "@agor/core/db";
 import multer from "multer";
 var ALLOWED_UPLOAD_MIME_TYPES = /* @__PURE__ */ new Set([
   // Images
@@ -20738,7 +22142,7 @@ function createUploadStorage(sessionRepo, worktreeRepo) {
         }
         if (DEBUG_UPLOAD) {
           console.log(
-            `\u{1F4C2} [Upload Storage] Processing upload for session ${sessionId?.substring(0, 8)}`
+            `\u{1F4C2} [Upload Storage] Processing upload for session ${sessionId ? shortId4(sessionId) : "unknown"}`
           );
           console.log(`   Destination type: ${destination}`);
         }
@@ -20748,18 +22152,16 @@ function createUploadStorage(sessionRepo, worktreeRepo) {
         }
         const session = await sessionRepo.findById(sessionId);
         if (!session) {
-          console.error(`\u274C [Upload Storage] Session not found: ${sessionId.substring(0, 8)}`);
+          console.error(`\u274C [Upload Storage] Session not found: ${shortId4(sessionId)}`);
           return cb(new Error(`Session not found: ${sessionId}`), "");
         }
         if (!session.worktree_id) {
-          console.error(`\u274C [Upload Storage] Session ${sessionId.substring(0, 8)} has no worktree`);
+          console.error(`\u274C [Upload Storage] Session ${shortId4(sessionId)} has no worktree`);
           return cb(new Error(`Session ${sessionId} has no associated worktree`), "");
         }
         const worktree = await worktreeRepo.findById(session.worktree_id);
         if (!worktree) {
-          console.error(
-            `\u274C [Upload Storage] Worktree not found: ${session.worktree_id.substring(0, 8)}`
-          );
+          console.error(`\u274C [Upload Storage] Worktree not found: ${shortId4(session.worktree_id)}`);
           return cb(new Error(`Worktree not found: ${session.worktree_id}`), "");
         }
         const paths = {
@@ -20863,6 +22265,144 @@ function enforceParsedTotalUploadSize() {
 
 // src/register-routes.ts
 init_worktree_authorization();
+
+// src/widgets/submissions.ts
+init_worktree_authorization();
+init_registry();
+import { Forbidden as Forbidden4, NotAuthenticated as NotAuthenticated4, NotFound as NotFound2 } from "@agor/core/feathers";
+function canResolveWidget(caller, session, worktree, isOwner) {
+  if (session.created_by === caller.user_id) return true;
+  const effective = resolveWorktreePermission(worktree, caller.user_id, isOwner, caller.role);
+  return PERMISSION_RANK[effective] >= PERMISSION_RANK.prompt;
+}
+var inFlightResolutions = /* @__PURE__ */ new Map();
+async function resolveWidget(widgetId, action, caller, deps) {
+  if (!caller) {
+    throw new NotAuthenticated4("Authentication required to resolve a widget");
+  }
+  const existing = inFlightResolutions.get(widgetId);
+  if (existing) {
+    await existing.catch(() => {
+    });
+  }
+  const promise2 = (async () => doResolveWidget(widgetId, action, caller, deps))();
+  inFlightResolutions.set(widgetId, promise2);
+  try {
+    return await promise2;
+  } finally {
+    if (inFlightResolutions.get(widgetId) === promise2) {
+      inFlightResolutions.delete(widgetId);
+    }
+  }
+}
+async function doResolveWidget(widgetId, action, caller, deps) {
+  let message;
+  try {
+    message = await deps.app.service("messages").get(widgetId);
+  } catch {
+    throw new NotFound2(`Widget ${widgetId} not found`);
+  }
+  if (message.type !== "widget_request") {
+    throw new NotFound2(`Message ${widgetId} is not a widget request`);
+  }
+  const widget = message.metadata?.widget;
+  if (!widget) {
+    throw new NotFound2(`Widget ${widgetId} has no widget metadata`);
+  }
+  const session = await deps.app.service("sessions").get(message.session_id);
+  const worktree = await deps.app.service("worktrees").get(session.worktree_id);
+  const isOwner = await deps.isWorktreeOwner(worktree.worktree_id, caller.user_id);
+  if (!canResolveWidget(caller, session, worktree, isOwner)) {
+    throw new Forbidden4(
+      `You need to be the session creator, a worktree owner, or have 'prompt' permission on the worktree to resolve this widget.`
+    );
+  }
+  if (widget.status !== "pending") {
+    throw new Forbidden4(
+      `Widget ${widgetId} is already ${widget.status}; cannot ${action.kind} again.`
+    );
+  }
+  const entry = getWidget(widget.widget_type);
+  let resultMeta;
+  let autoResumePrompt;
+  if (action.kind === "submit") {
+    if (!entry) {
+      throw new NotFound2(
+        `Widget type '${widget.widget_type}' is not registered on this daemon. Update the daemon or use a known widget type.`
+      );
+    }
+    const parsed = entry.submitSchema.safeParse(action.body);
+    if (!parsed.success) {
+      throw new Forbidden4(`Invalid submit payload: ${parsed.error.message}`);
+    }
+    const submit = parsed.data;
+    const submitCtx = {
+      // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
+      app: deps.app,
+      sessionId: message.session_id,
+      submitterUserId: caller.user_id,
+      submitterRole: caller.role,
+      sessionCreatorUserId: session.created_by
+    };
+    await entry.applySubmit(submitCtx, submit, widget.params);
+    resultMeta = entry.buildResultMeta(submit);
+    autoResumePrompt = entry.buildAutoResumePrompt(resultMeta, widget.params);
+  } else {
+    autoResumePrompt = entry ? entry.buildDismissedPrompt(widget.params) : `[Agor] User dismissed a widget request. Do not re-request immediately \u2014 ask whether to proceed without, or move on to other work.`;
+  }
+  const newStatus = action.kind === "submit" ? "submitted" : "dismissed";
+  const updatedWidget = {
+    ...widget,
+    status: newStatus,
+    resolved_at: (/* @__PURE__ */ new Date()).toISOString(),
+    submitted_by: caller.user_id,
+    ...resultMeta !== void 0 ? { result_meta: resultMeta } : {}
+  };
+  await deps.app.service("messages").patch(widgetId, {
+    metadata: {
+      ...message.metadata ?? {},
+      widget: updatedWidget
+    }
+  });
+  let autoResumeQueued = false;
+  if (widget.auto_resume !== false && autoResumePrompt) {
+    await deps.app.service("/sessions/:id/prompt").create(
+      {
+        prompt: autoResumePrompt,
+        messageSource: "agor",
+        // Stamp traceability fields onto the queued task so the UI can
+        // distinguish system-authored auto-resume prompts from user-typed
+        // ones, and so the resulting task links back to its widget.
+        metadata: {
+          system_authored: true,
+          widget_id: widget.widget_id
+        }
+      },
+      {
+        // Internal call — no `provider` so RBAC hooks bypass. Submitter is
+        // attributed (`created_by`) for audit; see §5.3 of the design.
+        user: { user_id: caller.user_id },
+        route: { id: message.session_id }
+      }
+    );
+    autoResumeQueued = true;
+  }
+  deps.app.service("messages").emit?.("widget:resolved", {
+    widget_id: widget.widget_id,
+    session_id: message.session_id,
+    status: newStatus,
+    result_meta: resultMeta,
+    resolved_at: updatedWidget.resolved_at,
+    submitted_by: caller.user_id
+  });
+  return {
+    widget_id: widget.widget_id,
+    status: newStatus,
+    auto_resume_queued: autoResumeQueued
+  };
+}
+
+// src/register-routes.ts
 function isPaginated(result) {
   return !Array.isArray(result) && "data" in result && "total" in result;
 }
@@ -20900,9 +22440,9 @@ async function registerRoutes(ctx) {
   const usersService = app.service("users");
   const tasksService = app.service("tasks");
   const reposService = app.service("repos");
-  const safeService = (path2) => {
+  const safeService = (path3) => {
     try {
-      return app.service(path2);
+      return app.service(path3);
     } catch {
       return void 0;
     }
@@ -20971,20 +22511,6 @@ async function registerRoutes(ctx) {
     security: []
   };
   authService.hooks({
-    before: {
-      create: [
-        // biome-ignore lint/suspicious/noExplicitAny: FeathersJS context type not fully typed
-        async (context) => {
-          const data = Array.isArray(context.data) ? context.data[0] : context.data;
-          console.log("\u{1F510} Authentication attempt:", {
-            strategy: data?.strategy,
-            email: data?.email,
-            hasPassword: !!data?.password
-          });
-          return context;
-        }
-      ]
-    },
     after: {
       create: [
         // biome-ignore lint/suspicious/noExplicitAny: FeathersJS context type not fully typed
@@ -21042,7 +22568,7 @@ async function registerRoutes(ctx) {
           user
         };
       } catch (_error) {
-        throw new NotAuthenticated5("Invalid or expired refresh token");
+        throw new NotAuthenticated6("Invalid or expired refresh token");
       }
     }
   });
@@ -21056,38 +22582,38 @@ async function registerRoutes(ctx) {
     async create(data, params) {
       const authParams = params;
       if (!authParams?.user || !authParams.user.user_id) {
-        throw new NotAuthenticated5("Authentication required");
+        throw new NotAuthenticated6("Authentication required");
       }
       const caller = authParams.user;
       if (!hasMinimumRole2(caller.role, ROLES4.SUPERADMIN)) {
-        throw new Forbidden4("Superadmin role required for impersonation");
+        throw new Forbidden5("Superadmin role required for impersonation");
       }
       const authPayload = authParams.authentication?.payload;
       if (authPayload?.is_impersonated === true) {
-        throw new Forbidden4("Cannot impersonate from an already-impersonated token");
+        throw new Forbidden5("Cannot impersonate from an already-impersonated token");
       }
       if (!data?.user_id) {
-        throw new BadRequest2("user_id is required");
+        throw new BadRequest3("user_id is required");
       }
       if (data.expiry_ms != null) {
         if (typeof data.expiry_ms !== "number" || !Number.isFinite(data.expiry_ms)) {
-          throw new BadRequest2("expiry_ms must be a finite number");
+          throw new BadRequest3("expiry_ms must be a finite number");
         }
         if (data.expiry_ms <= 0) {
-          throw new BadRequest2("expiry_ms must be a positive number");
+          throw new BadRequest3("expiry_ms must be a positive number");
         }
       }
       let targetUser;
       try {
         targetUser = await usersService.get(data.user_id);
       } catch {
-        throw new NotFound2(`User not found: ${data.user_id}`);
+        throw new NotFound3(`User not found: ${data.user_id}`);
       }
       const configuredMax = config2.daemon?.impersonation_token_expiry_ms ?? MAX_IMPERSONATION_EXPIRY_MS;
       const maxExpiry = Math.min(configuredMax, MAX_IMPERSONATION_EXPIRY_MS);
       const requestedExpiry = data.expiry_ms ?? maxExpiry;
       const expiryMs = Math.min(requestedExpiry, maxExpiry);
-      const jti = generateId2();
+      const jti = generateId5();
       const expiresAt = new Date(Date.now() + expiryMs);
       const accessToken = jwt4.sign(
         {
@@ -21129,12 +22655,12 @@ async function registerRoutes(ctx) {
     }
   });
   const _messagesRepo = new MessagesRepository(db);
-  const _sessionsRepo = new SessionRepository4(db);
+  const _sessionsRepo = new SessionRepository6(db);
   const _sessionMCPRepo = new SessionMCPServerRepository2(db);
   const _mcpServerRepo = new MCPServerRepository(db);
   const _worktreesRepo = new WorktreeRepository5(db);
   const _reposRepo = new RepoRepository(db);
-  const _tasksRepo = new TaskRepository(db);
+  const _tasksRepo = new TaskRepository2(db);
   const permissionService = new PermissionService((event, data) => {
     app.service("sessions").emit(event, data);
   });
@@ -21188,9 +22714,9 @@ async function registerRoutes(ctx) {
       async create(data, params) {
         const id = params.route?.id;
         if (!id) throw new Error("Session ID required");
-        console.log(`\u{1F500} Forking session: ${id.substring(0, 8)}`);
+        console.log(`\u{1F500} Forking session: ${shortId11(id)}`);
         const forkedSession = await sessionsService.fork(id, data, params);
-        console.log(`\u2705 Fork created: ${forkedSession.session_id.substring(0, 8)}`);
+        console.log(`\u2705 Fork created: ${shortId11(forkedSession.session_id)}`);
         console.log("\u{1F4E1} [FORK] Manually broadcasting created event to all clients");
         if (app.io) {
           app.io.emit("sessions created", forkedSession);
@@ -21210,9 +22736,9 @@ async function registerRoutes(ctx) {
       async create(data, params) {
         const id = params.route?.id;
         if (!id) throw new Error("Session ID required");
-        console.log(`\u{1F331} Spawning session from: ${id.substring(0, 8)}`);
+        console.log(`\u{1F331} Spawning session from: ${shortId11(id)}`);
         const spawnedSession = await sessionsService.spawn(id, data, params);
-        console.log(`\u2705 Spawn created: ${spawnedSession.session_id.substring(0, 8)}`);
+        console.log(`\u2705 Spawn created: ${shortId11(spawnedSession.session_id)}`);
         console.log("\u{1F4E1} [SPAWN] Manually broadcasting created event to all clients");
         if (app.io) {
           app.io.emit("sessions created", spawnedSession);
@@ -21241,16 +22767,79 @@ async function registerRoutes(ctx) {
     },
     requireAuth
   );
+  registerAuthenticatedRoute(
+    app,
+    "/sessions/:id/restart-cli",
+    {
+      async create(_data, params) {
+        const id = params.route?.id;
+        if (!id) throw new Error("Session ID required");
+        const session = await sessionsService.get(id, params);
+        if (session.agentic_tool !== "claude-code-cli") {
+          throw new Error(
+            `Restart is only supported for claude-code-cli sessions; this session is ${session.agentic_tool}`
+          );
+        }
+        const targetUserId = session.created_by;
+        if (!targetUserId) throw new Error("Session has no created_by \u2014 cannot route restart");
+        const tabName = `cli-${shortId11(session.session_id)}`;
+        const channel = `user/${targetUserId}/terminal`;
+        try {
+          const { spawn: spawnProc } = await import("child_process");
+          const killProc = spawnProc(
+            "pkill",
+            ["-f", `claude .*(--session-id|--resume) ${session.session_id}`],
+            { stdio: "ignore" }
+          );
+          await new Promise((resolve) => {
+            killProc.on("exit", () => resolve());
+            killProc.on("error", () => resolve());
+            setTimeout(() => {
+              try {
+                killProc.kill();
+              } catch {
+              }
+              resolve();
+            }, 2e3);
+          });
+        } catch (err) {
+          console.warn("[claude-cli-integration] pkill failed, proceeding anyway", err);
+        }
+        const worktree = await app.service("worktrees").get(session.worktree_id, params);
+        const cwd = worktree?.path;
+        if (!cwd) throw new Error("Worktree has no path; cannot restart");
+        const { buildSpawnConfigForSession: buildSpawnConfigForSession2 } = await Promise.resolve().then(() => (init_claude_cli_integration(), claude_cli_integration_exports));
+        const { buildClaudeCliSpawn: buildClaudeCliSpawn2 } = await import("@agor/core/claude-cli");
+        const spawnCfg = buildSpawnConfigForSession2(session, cwd);
+        const built = buildClaudeCliSpawn2(spawnCfg);
+        if (app.io) {
+          app.io.to(channel).emit("terminal:tab", {
+            userId: targetUserId,
+            action: "create",
+            tabName,
+            cwd,
+            command: built.bin,
+            commandArgs: built.args,
+            forceRecreate: true
+          });
+        }
+        return { ok: true, tabName };
+      }
+      // biome-ignore lint/suspicious/noExplicitAny: FeathersJS route handler type mismatch
+    },
+    {
+      create: { role: ROLES4.MEMBER, action: "restart claude CLI session" }
+    },
+    requireAuth
+  );
   const sessionTurnLocks = /* @__PURE__ */ new Map();
   async function safePatch(serviceName, id, data, entityType, params) {
     try {
       await app.service(serviceName).patch(id, data, params || {});
       return true;
     } catch (error51) {
-      if (error51 instanceof NotFoundError3 || error51 instanceof Error && error51.message.includes("No record found")) {
-        console.log(
-          `\u26A0\uFE0F  ${entityType} ${id.substring(0, 8)} was deleted mid-execution - skipping update`
-        );
+      if (error51 instanceof NotFoundError4 || error51 instanceof Error && error51.message.includes("No record found")) {
+        console.log(`\u26A0\uFE0F  ${entityType} ${shortId11(id)} was deleted mid-execution - skipping update`);
         return false;
       }
       throw error51;
@@ -21284,7 +22873,7 @@ async function registerRoutes(ctx) {
     const updatedTask = await app.service("tasks").patch(
       task.task_id,
       {
-        status: TaskStatus2.RUNNING,
+        status: TaskStatus4.RUNNING,
         started_at: startTimestamp,
         queue_position: void 0,
         message_range: {
@@ -21311,24 +22900,21 @@ async function registerRoutes(ctx) {
         if (source) {
           messageMetadata.source = source;
         }
-        const userMessage = {
-          message_id: generateId2(),
-          session_id: task.session_id,
-          // Callback messages are typed `system` so the UI shows the special
-          // Agor-callback styling. Normal prompts stay `user`.
-          type: isCallback ? "system" : "user",
-          role: "user",
+        const userMessage = buildInitialUserMessage({
+          sessionId: task.session_id,
+          taskId: task.task_id,
           index: messageStartIndex,
           timestamp: startTimestamp,
-          content_preview: task.full_prompt.substring(0, 200),
           content: task.full_prompt,
-          task_id: task.task_id,
+          // Callback messages are typed `system` so the UI shows the special
+          // Agor-callback styling. Normal prompts stay `user`.
+          type: isCallback ? "system" : "user",
           metadata: Object.keys(messageMetadata).length > 0 ? messageMetadata : void 0
-        };
+        });
         await app.service("messages").create(userMessage, params);
       } catch (msgErr) {
         console.warn(
-          `\u26A0\uFE0F  [Daemon] Failed to write initial user-message row for task ${task.task_id.substring(0, 8)} (executor will retry):`,
+          `\u26A0\uFE0F  [Daemon] Failed to write initial user-message row for task ${shortId11(task.task_id)} (executor will retry):`,
           msgErr
         );
       }
@@ -21336,7 +22922,7 @@ async function registerRoutes(ctx) {
     await app.service("sessions").patch(
       task.session_id,
       {
-        status: SessionStatus2.RUNNING,
+        status: SessionStatus3.RUNNING,
         ready_for_prompt: false,
         tasks: [...session.tasks, task.task_id]
       },
@@ -21356,19 +22942,59 @@ async function registerRoutes(ctx) {
 ${task.full_prompt}`;
         }
       } catch (err) {
-        console.warn(
-          `[Prompt] Failed to look up prompter user ${prompterUserId.substring(0, 8)}:`,
-          err
-        );
+        console.warn(`[Prompt] Failed to look up prompter user ${shortId11(prompterUserId)}:`, err);
       }
     }
     const useStreaming = options.stream !== false;
     const sessionId = task.session_id;
     const taskId = task.task_id;
+    if (session.agentic_tool === "claude-code-cli") {
+      const { setPendingCliTask: setPendingCliTask2 } = await Promise.resolve().then(() => (init_claude_cli_integration(), claude_cli_integration_exports));
+      setPendingCliTask2(sessionId, taskId, messageStartIndex);
+      setImmediate(async () => {
+        try {
+          const targetUserId = session.created_by;
+          if (!targetUserId) {
+            throw new Error("CLI session has no created_by \u2014 cannot route PTY injection");
+          }
+          const channel = `user/${targetUserId}/terminal`;
+          const tabName = `cli-${shortId11(session.session_id)}`;
+          const io = app.io;
+          io?.to(channel).emit("terminal:tab", {
+            userId: targetUserId,
+            action: "focus",
+            tabName
+          });
+          await new Promise((r) => setTimeout(r, 150));
+          const payload = `${promptForExecutor}\r`;
+          io?.to(channel).emit("terminal:input", { userId: targetUserId, input: payload });
+          console.log(
+            `[claude-cli] PTY-injected prompt into ${channel} \u2192 tab ${tabName} (task ${shortId11(taskId)}, ${promptForExecutor.length} chars)`
+          );
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          console.error(`[claude-cli] PTY injection failed for task ${shortId11(taskId)}: ${msg}`);
+          await safePatch(
+            "tasks",
+            taskId,
+            {
+              status: TaskStatus4.FAILED,
+              completed_at: (/* @__PURE__ */ new Date()).toISOString(),
+              error_message: `PTY injection failed: ${msg}`
+            },
+            "Task",
+            params
+          );
+          await app.service("sessions").patch(sessionId, { status: SessionStatus3.IDLE, ready_for_prompt: true }, params).catch(() => {
+          });
+        }
+      });
+      return updatedTask;
+    }
     setImmediate(async () => {
       try {
         console.log(
-          `\u{1F680} [Daemon] Routing ${session.agentic_tool} to Feathers/WebSocket executor (task ${taskId.substring(0, 8)})`
+          `\u{1F680} [Daemon] Routing ${session.agentic_tool} to Feathers/WebSocket executor (task ${shortId11(taskId)})`
         );
         await sessionsService.executeTask(
           sessionId,
@@ -21382,19 +23008,19 @@ ${task.full_prompt}`;
           params
         );
         console.log(
-          `\u2705 [Daemon] Executor spawned for session ${sessionId.substring(0, 8)}, waiting for task completion`
+          `\u2705 [Daemon] Executor spawned for session ${shortId11(sessionId)}, waiting for task completion`
         );
       } catch (error51) {
         const errorMessage = error51 instanceof Error ? error51.message : String(error51);
         console.error(
-          `\u274C [Daemon] Executor spawn failed for session=${sessionId.substring(0, 8)} task=${taskId.substring(0, 8)} agent=${session.agentic_tool} unix_username=${session.unix_username ?? "null"}: ${errorMessage}`,
+          `\u274C [Daemon] Executor spawn failed for session=${shortId11(sessionId)} task=${shortId11(taskId)} agent=${session.agentic_tool} unix_username=${session.unix_username ?? "null"}: ${errorMessage}`,
           error51
         );
         await safePatch(
           "tasks",
           taskId,
           {
-            status: TaskStatus2.FAILED,
+            status: TaskStatus4.FAILED,
             completed_at: (/* @__PURE__ */ new Date()).toISOString(),
             error_message: errorMessage
           },
@@ -21402,23 +23028,19 @@ ${task.full_prompt}`;
           params
         );
         try {
-          const sysIndex = await sessionsRepository.countMessages(sessionId);
           const errorContent = `\u26A0\uFE0F The agent failed to start.
 
 ${errorMessage}`;
-          const sysMessage = {
-            message_id: generateId2(),
-            session_id: sessionId,
-            type: "system",
-            role: "assistant",
-            index: sysIndex,
-            timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-            content_preview: errorContent.substring(0, 200),
+          await appendSystemMessage({
+            app,
+            db,
+            sessionId,
+            taskId,
             content: errorContent,
-            task_id: taskId,
-            metadata: { is_meta: true }
-          };
-          await app.service("messages").create(sysMessage, params);
+            role: MessageRole4.ASSISTANT,
+            metadata: { is_meta: true },
+            params
+          });
         } catch (sysErr) {
           console.warn(
             "[Daemon] Failed to write system error message after spawn failure:",
@@ -21443,7 +23065,9 @@ ${errorMessage}`;
     "/sessions/:id/prompt",
     {
       async create(data, params) {
-        console.log(`\u{1F4E8} [Daemon] Prompt request for session ${params.route?.id?.substring(0, 8)}`);
+        console.log(
+          `\u{1F4E8} [Daemon] Prompt request for session ${params.route?.id ? shortId11(params.route.id) : "unknown"}`
+        );
         console.log(`   Permission mode: ${data.permissionMode || "not specified"}`);
         console.log(`   Streaming: ${data.stream !== false}`);
         console.log(`   Message source: ${data.messageSource || "not specified"}`);
@@ -21470,7 +23094,7 @@ ${errorMessage}`;
         }
         if (session.archived) {
           console.log(
-            `\u{1F4E6} [Prompt] Auto-unarchiving session ${id.substring(0, 8)} (was archived: ${session.archived_reason || "unknown reason"})`
+            `\u{1F4E6} [Prompt] Auto-unarchiving session ${shortId11(id)} (was archived: ${session.archived_reason || "unknown reason"})`
           );
           session = await sessionsService.patch(
             id,
@@ -21478,37 +23102,38 @@ ${errorMessage}`;
             params
           );
         }
-        if (session.status === SessionStatus2.STOPPING) {
+        if (session.status === SessionStatus3.STOPPING) {
           throw new Error("Cannot send prompt: session is currently stopping");
         }
-        const taskRepo = new TaskRepository(db);
+        const taskRepo = new TaskRepository2(db);
         if (!params.user?.user_id) {
-          throw new NotAuthenticated5("Authentication required to prompt a session");
+          throw new NotAuthenticated6("Authentication required to prompt a session");
         }
         const createdBy = params.user.user_id;
         return await withSessionTurnLock(sessionTurnLocks, id, async () => {
           const lockedSession = await sessionsService.get(id, params);
-          if (lockedSession.status === SessionStatus2.STOPPING) {
+          if (lockedSession.status === SessionStatus3.STOPPING) {
             throw new Error("Cannot send prompt: session is currently stopping");
           }
           const queuedTasks = await taskRepo.findQueued(id);
-          const shouldQueue = lockedSession.status !== SessionStatus2.IDLE || queuedTasks.length > 0;
+          const shouldQueue = lockedSession.status !== SessionStatus3.IDLE || queuedTasks.length > 0;
           if (shouldQueue) {
             const queuedTask = await taskRepo.createPending({
               session_id: id,
               full_prompt: data.prompt,
               created_by: createdBy,
-              status: TaskStatus2.QUEUED,
+              status: TaskStatus4.QUEUED,
               metadata: {
                 ...params.user?.user_id ? { queued_by_user_id: params.user.user_id } : {},
-                ...messageSource ? { source: messageSource } : {}
+                ...messageSource ? { source: messageSource } : {},
+                ...data.metadata ?? {}
               }
             });
             console.log(
-              `\u{1F4EC} [Prompt] Auto-queued task for session ${id.substring(0, 8)} at position ${queuedTask.queue_position} (session status: ${lockedSession.status}, existing queue items: ${queuedTasks.length})`
+              `\u{1F4EC} [Prompt] Auto-queued task for session ${shortId11(id)} at position ${queuedTask.queue_position} (session status: ${lockedSession.status}, existing queue items: ${queuedTasks.length})`
             );
             app.service("tasks").emit("queued", queuedTask);
-            if (lockedSession.status === SessionStatus2.IDLE) {
+            if (lockedSession.status === SessionStatus3.IDLE) {
               setImmediate(async () => {
                 try {
                   await sessionsService.triggerQueueProcessing(id, params);
@@ -21526,12 +23151,16 @@ ${errorMessage}`;
           console.log(
             `   Session permission_config.mode: ${lockedSession.permission_config?.mode || "not set"}`
           );
+          const idleTaskMetadata = {
+            ...messageSource ? { source: messageSource } : {},
+            ...data.metadata ?? {}
+          };
           const task = await taskRepo.createPending({
             session_id: id,
             full_prompt: data.prompt,
             created_by: createdBy,
-            status: TaskStatus2.CREATED,
-            metadata: messageSource ? { source: messageSource } : void 0
+            status: TaskStatus4.CREATED,
+            metadata: Object.keys(idleTaskMetadata).length > 0 ? idleTaskMetadata : void 0
           });
           app.service("tasks").emit("created", task);
           return await spawnTaskExecutor(
@@ -21557,16 +23186,16 @@ ${errorMessage}`;
     {
       async create(data, params) {
         const taskId = params.route?.id;
-        if (!taskId) throw new BadRequest2("Task ID required");
-        const taskRepo = new TaskRepository(db);
+        if (!taskId) throw new BadRequest3("Task ID required");
+        const taskRepo = new TaskRepository2(db);
         const task = await taskRepo.findById(taskId);
         if (!task) {
-          throw new NotFound2(`Task ${taskId} not found`);
+          throw new NotFound3(`Task ${taskId} not found`);
         }
-        if (task.status !== TaskStatus2.CREATED) {
-          const hint = task.status === TaskStatus2.QUEUED ? `Queued tasks drain automatically in queue-position order when the session becomes idle \u2014 wait for it, or stop the currently running task to free the queue.` : `Only 'created' tasks may be triggered.`;
+        if (task.status !== TaskStatus4.CREATED) {
+          const hint = task.status === TaskStatus4.QUEUED ? `Queued tasks drain automatically in queue-position order when the session becomes idle \u2014 wait for it, or stop the currently running task to free the queue.` : `Only 'created' tasks may be triggered.`;
           throw new Conflict2(
-            `Task ${taskId.substring(0, 8)} cannot be run: status is '${task.status}'. ${hint}`
+            `Task ${shortId11(taskId)} cannot be run: status is '${task.status}'. ${hint}`
           );
         }
         const isInternalCall = !params.provider;
@@ -21577,11 +23206,11 @@ ${errorMessage}`;
           } else {
             const userId = params.user?.user_id;
             if (!userId) {
-              throw new Forbidden4("Authentication required to run tasks");
+              throw new Forbidden5("Authentication required to run tasks");
             }
             const wt = await worktreeRepository.findById(session.worktree_id);
             if (!wt) {
-              throw new NotFound2(`Worktree ${session.worktree_id} not found`);
+              throw new NotFound3(`Worktree ${session.worktree_id} not found`);
             }
             const isOwner = await worktreeRepository.isOwner(wt.worktree_id, userId);
             const effectiveLevel = resolveWorktreePermission(
@@ -21593,7 +23222,7 @@ ${errorMessage}`;
             );
             const canRun = PERMISSION_RANK[effectiveLevel] >= PERMISSION_RANK.prompt || effectiveLevel === "session" && session.created_by === userId;
             if (!canRun) {
-              throw new Forbidden4(
+              throw new Forbidden5(
                 `You have '${effectiveLevel}' permission on this worktree, which does not allow running tasks. Need 'prompt' or 'all' (or 'session' for own sessions).`
               );
             }
@@ -21601,12 +23230,12 @@ ${errorMessage}`;
         }
         return await withSessionTurnLock(sessionTurnLocks, task.session_id, async () => {
           const session = await sessionsService.get(task.session_id, params);
-          if (session.status === SessionStatus2.STOPPING) {
-            throw new BadRequest2("Cannot run task: session is currently stopping");
+          if (session.status === SessionStatus3.STOPPING) {
+            throw new BadRequest3("Cannot run task: session is currently stopping");
           }
-          if (session.status !== SessionStatus2.IDLE) {
+          if (session.status !== SessionStatus3.IDLE) {
             throw new Conflict2(
-              `Cannot run task ${taskId.substring(0, 8)}: session is '${session.status}'. To enqueue a prompt on a busy session, POST to /sessions/:id/prompt instead \u2014 it creates and queues a task atomically.`
+              `Cannot run task ${shortId11(taskId)}: session is '${session.status}'. To enqueue a prompt on a busy session, POST to /sessions/:id/prompt instead \u2014 it creates and queues a task atomically.`
             );
           }
           return await runExistingTask(
@@ -21636,9 +23265,9 @@ ${errorMessage}`;
     {
       async create(data, params) {
         const id = params.route?.id;
-        if (!id) throw new BadRequest2("Session ID required");
+        if (!id) throw new BadRequest3("Session ID required");
         if (typeof data?.userPrompt !== "string") {
-          throw new BadRequest2("userPrompt (string) is required");
+          throw new BadRequest3("userPrompt (string) is required");
         }
         const { renderSpawnSubsessionPrompt } = await import("@agor/core/templates/spawn-subsession-template");
         const { parentPermissionMode, ...spawnContext } = data;
@@ -21663,26 +23292,26 @@ ${errorMessage}`;
     {
       async create(data, params) {
         const worktreeId = params.route?.id;
-        if (!worktreeId) throw new BadRequest2("Worktree ID required");
+        if (!worktreeId) throw new BadRequest3("Worktree ID required");
         if (typeof data?.zoneId !== "string" || !data.zoneId.trim()) {
-          throw new BadRequest2("zoneId (string) is required");
+          throw new BadRequest3("zoneId (string) is required");
         }
         const worktree = await app.service("worktrees").get(worktreeId, params);
         if (!worktree.board_id) {
-          throw new BadRequest2("Worktree is not on a board; cannot resolve zone");
+          throw new BadRequest3("Worktree is not on a board; cannot resolve zone");
         }
         const board = await app.service("boards").get(worktree.board_id, params);
         const zoneObj = board.objects?.[data.zoneId];
         if (!zoneObj || zoneObj.type !== "zone") {
-          throw new BadRequest2(`Zone ${data.zoneId} not found on board ${worktree.board_id}`);
+          throw new BadRequest3(`Zone ${data.zoneId} not found on board ${worktree.board_id}`);
         }
         if (zoneObj.trigger?.behavior !== "always_new") {
-          throw new BadRequest2(
+          throw new BadRequest3(
             `Zone "${zoneObj.label}" trigger behaviour is "${zoneObj.trigger?.behavior}", expected "always_new"`
           );
         }
         const userId = params.user?.user_id;
-        if (!userId) throw new BadRequest2("Authenticated user required");
+        if (!userId) throw new BadRequest3("Authenticated user required");
         const user = await app.service("users").get(userId, params);
         const { fireAlwaysNewZoneTrigger: fireAlwaysNewZoneTrigger2 } = await Promise.resolve().then(() => (init_zone_trigger(), zone_trigger_exports));
         try {
@@ -21697,7 +23326,7 @@ ${errorMessage}`;
           });
         } catch (err) {
           const message = err instanceof Error ? err.message : String(err);
-          throw new BadRequest2(message);
+          throw new BadRequest3(message);
         }
       }
     },
@@ -21706,7 +23335,7 @@ ${errorMessage}`;
     },
     requireAuth
   );
-  const sessionRepo = new SessionRepository4(db);
+  const sessionRepo = new SessionRepository6(db);
   const worktreeRepo = new WorktreeRepository5(db);
   const uploadMiddleware = createUploadMiddleware(sessionRepo, worktreeRepo);
   const DEBUG_UPLOAD2 = process.env.NODE_ENV !== "production";
@@ -21724,7 +23353,9 @@ ${errorMessage}`;
       const { destination, notifyAgent, message } = req.body;
       const files = req.files;
       if (DEBUG_UPLOAD2) {
-        console.log(`\u{1F4CE} [Upload Handler] Processing for session ${sessionId?.substring(0, 8)}`);
+        console.log(
+          `\u{1F4CE} [Upload Handler] Processing for session ${sessionId ? shortId11(sessionId) : "unknown"}`
+        );
         console.log(`   Destination: ${destination || "worktree"}`);
         console.log(`   Notify agent: ${notifyAgent === "true" || notifyAgent === true}`);
         console.log(`   Files received: ${files?.length || 0}`);
@@ -21733,14 +23364,14 @@ ${errorMessage}`;
       if (DEBUG_UPLOAD2) {
         console.log(`   Auth params:`, {
           hasUser: !!params?.user,
-          userId: params?.user?.user_id?.substring(0, 8),
+          userId: params?.user?.user_id ? shortId11(params.user.user_id) : void 0,
           provider: params?.provider
         });
       }
       ensureMinimumRole(params, ROLES4.MEMBER, "upload files");
       const session = await sessionsService.get(sessionId, params);
       if (!session) {
-        console.error(`\u274C [Upload Handler] Session not found: ${sessionId.substring(0, 8)}`);
+        console.error(`\u274C [Upload Handler] Session not found: ${shortId11(sessionId)}`);
         return res.status(404).json({ error: "Session not found" });
       }
       if (worktreeRbacEnabled) {
@@ -21763,7 +23394,7 @@ ${errorMessage}`;
         const canUpload = PERMISSION_RANK[effectiveLevel] >= PERMISSION_RANK.prompt || effectiveLevel === "session" && session.created_by === userId;
         if (!canUpload) {
           console.error(
-            `\u274C [Upload Handler] User ${userId.substring(0, 8)} has '${effectiveLevel}' permission, cannot upload to worktree ${wt.worktree_id.substring(0, 8)}`
+            `\u274C [Upload Handler] User ${shortId11(userId)} has '${effectiveLevel}' permission, cannot upload to worktree ${shortId11(wt.worktree_id)}`
           );
           return res.status(403).json({ error: "Not authorized to upload to this session" });
         }
@@ -21829,7 +23460,10 @@ ${errorMessage}`;
       console.log("   URL:", req.url);
       console.log("   Content-Type:", req.headers["content-type"]);
       console.log("   Has auth header:", !!req.headers.authorization);
-      console.log("   Session ID param:", req.params.sessionId?.substring(0, 8));
+      console.log(
+        "   Session ID param:",
+        req.params.sessionId ? shortId11(req.params.sessionId) : "unknown"
+      );
     }
     next();
   };
@@ -21854,7 +23488,7 @@ ${errorMessage}`;
       });
       if (DEBUG_UPLOAD2) {
         console.log("\u2705 [Upload Auth] Authentication successful");
-        console.log("   User:", result.user?.user_id?.substring(0, 8));
+        console.log("   User:", result.user?.user_id ? shortId11(result.user.user_id) : "unknown");
       }
       req.feathers = {
         user: result.user,
@@ -21875,7 +23509,10 @@ ${errorMessage}`;
     ((req, res, next) => {
       if (DEBUG_UPLOAD2) {
         console.log("\u2705 [Upload Route] Authentication passed");
-        console.log("   User:", req.feathers?.user?.user_id?.substring(0, 8) ?? "unknown");
+        console.log(
+          "   User:",
+          req.feathers?.user?.user_id ? shortId11(req.feathers.user.user_id) : "unknown"
+        );
       }
       next();
     }),
@@ -21918,9 +23555,9 @@ ${errorMessage}`;
         const stopReason = data && typeof data === "object" && "reason" in data && typeof data.reason === "string" ? data.reason : void 0;
         const session = await sessionsService.get(id, params);
         const activeStates = [
-          SessionStatus2.RUNNING,
-          SessionStatus2.AWAITING_PERMISSION,
-          SessionStatus2.STOPPING
+          SessionStatus3.RUNNING,
+          SessionStatus3.AWAITING_PERMISSION,
+          SessionStatus3.STOPPING
         ];
         if (!activeStates.includes(session.status)) {
           return {
@@ -21928,55 +23565,38 @@ ${errorMessage}`;
             reason: `Session cannot be stopped (status: ${session.status})`
           };
         }
-        const targetTasksArray = [];
-        for (const status of [
-          TaskStatus2.RUNNING,
-          TaskStatus2.AWAITING_PERMISSION,
-          TaskStatus2.STOPPING
-        ]) {
-          const result = await tasksService.find({
-            query: { session_id: id, status, $limit: 10 }
-          });
-          const findResult = result;
-          const tasks = isPaginated(findResult) ? findResult.data : findResult;
-          targetTasksArray.push(...tasks);
-        }
+        const targetTasksArray = await findActiveTasksForSession(app, id);
         if (targetTasksArray.length === 0) {
           console.warn(
-            `\u26A0\uFE0F  [Stop] No active tasks for session ${id.substring(0, 8)}, resetting to IDLE${stopReason ? ` (reason: ${stopReason})` : ""}`
+            `\u26A0\uFE0F  [Stop] No active tasks for session ${shortId11(id)}, resetting to IDLE${stopReason ? ` (reason: ${stopReason})` : ""}`
           );
           await app.service("sessions").patch(
             id,
             {
-              status: SessionStatus2.IDLE,
+              status: SessionStatus3.IDLE,
               ready_for_prompt: true
             },
             params
           );
           return {
             success: true,
-            status: SessionStatus2.IDLE,
+            status: SessionStatus3.IDLE,
             reason: "No active tasks found, session reset to idle"
           };
         }
-        targetTasksArray.sort((a, b) => {
-          const timeA = new Date(a.started_at || a.created_at).getTime();
-          const timeB = new Date(b.started_at || b.created_at).getTime();
-          return timeB - timeA;
-        });
         const latestTask = targetTasksArray[0];
         console.log(
-          `\u{1F6D1} [Stop] Stopping task ${latestTask.task_id.substring(0, 8)} for session ${id.substring(0, 8)}${stopReason ? ` (reason: ${stopReason})` : ""}`
+          `\u{1F6D1} [Stop] Stopping task ${shortId11(latestTask.task_id)} for session ${shortId11(id)}${stopReason ? ` (reason: ${stopReason})` : ""}`
         );
         const processKilled = killExecutorProcess(id);
         if (!processKilled) {
           console.warn(
-            `\u26A0\uFE0F  [Stop] No tracked process for session ${id.substring(0, 8)} \u2014 executor may have already exited`
+            `\u26A0\uFE0F  [Stop] No tracked process for session ${shortId11(id)} \u2014 executor may have already exited`
           );
         }
         try {
           await tasksService.patch(latestTask.task_id, {
-            status: TaskStatus2.STOPPED,
+            status: TaskStatus4.STOPPED,
             completed_at: (/* @__PURE__ */ new Date()).toISOString()
           });
         } catch (error51) {
@@ -21986,7 +23606,7 @@ ${errorMessage}`;
           await app.service("sessions").patch(
             id,
             {
-              status: SessionStatus2.IDLE,
+              status: SessionStatus3.IDLE,
               ready_for_prompt: true
             },
             params
@@ -21994,7 +23614,7 @@ ${errorMessage}`;
         } catch (error51) {
           console.error(`\u274C [Stop] Failed to patch session to IDLE:`, error51);
         }
-        return { success: true, status: SessionStatus2.IDLE };
+        return { success: true, status: SessionStatus3.IDLE };
       }
     },
     {
@@ -22009,7 +23629,7 @@ ${errorMessage}`;
       async find(params) {
         const sessionId = params.route?.id;
         if (!sessionId) throw new Error("Session ID required");
-        const taskQueueRepo = new TaskRepository(db);
+        const taskQueueRepo = new TaskRepository2(db);
         const queued = await taskQueueRepo.findQueued(sessionId);
         return {
           total: queued.length,
@@ -22027,9 +23647,7 @@ ${errorMessage}`;
   async function processNextQueuedTask(sessionId, params) {
     const existingLock = sessionTurnLocks.get(sessionId);
     if (existingLock) {
-      console.log(
-        `\u23F3 [Queue] Session turn in progress for ${sessionId.substring(0, 8)}, waiting...`
-      );
+      console.log(`\u23F3 [Queue] Session turn in progress for ${shortId11(sessionId)}, waiting...`);
       await existingLock.catch(() => void 0);
       if (!queueRetryScheduled.has(sessionId)) {
         queueRetryScheduled.add(sessionId);
@@ -22038,10 +23656,7 @@ ${errorMessage}`;
           try {
             await processNextQueuedTask(sessionId, params);
           } catch (error51) {
-            console.error(
-              `\u274C [Queue] Retry failed for session ${sessionId.substring(0, 8)}:`,
-              error51
-            );
+            console.error(`\u274C [Queue] Retry failed for session ${shortId11(sessionId)}:`, error51);
           }
         });
       }
@@ -22060,10 +23675,10 @@ ${errorMessage}`;
     }
   }
   async function processNextQueuedTaskInternal(sessionId, params) {
-    const taskRepo = new TaskRepository(db);
+    const taskRepo = new TaskRepository2(db);
     const nextTask = await taskRepo.getNextQueued(sessionId);
     if (!nextTask) {
-      console.log(`\u{1F4ED} No queued tasks for session ${sessionId.substring(0, 8)}`);
+      console.log(`\u{1F4ED} No queued tasks for session ${shortId11(sessionId)}`);
       return;
     }
     const userId = nextTask.metadata?.queued_by_user_id;
@@ -22074,18 +23689,18 @@ ${errorMessage}`;
       user: queuedByUser
     } : params;
     console.log(
-      `\u{1F4EC} Processing queued task ${nextTask.task_id.substring(0, 8)} (position ${nextTask.queue_position}) with user context: ${queuedByUser ? queuedByUser.user_id.substring(0, 8) : "none"}`
+      `\u{1F4EC} Processing queued task ${shortId11(nextTask.task_id)} (position ${nextTask.queue_position}) with user context: ${queuedByUser ? shortId11(queuedByUser.user_id) : "none"}`
     );
     const session = await sessionsService.get(sessionId, taskParams);
-    if (session.status !== SessionStatus2.IDLE) {
+    if (session.status !== SessionStatus3.IDLE) {
       console.log(
-        `\u23F8\uFE0F  [Queue] Session ${sessionId.substring(0, 8)} is ${session.status}, task ${nextTask.task_id.substring(0, 8)} waiting in queue (will be processed when session becomes IDLE via patch hook)`
+        `\u23F8\uFE0F  [Queue] Session ${shortId11(sessionId)} is ${session.status}, task ${shortId11(nextTask.task_id)} waiting in queue (will be processed when session becomes IDLE via patch hook)`
       );
       return;
     }
     const stillQueued = await taskRepo.findById(nextTask.task_id);
-    if (!stillQueued || stillQueued.status !== TaskStatus2.QUEUED) {
-      console.log(`\u26A0\uFE0F  Queued task ${nextTask.task_id.substring(0, 8)} no longer queued, skipping`);
+    if (!stillQueued || stillQueued.status !== TaskStatus4.QUEUED) {
+      console.log(`\u26A0\uFE0F  Queued task ${shortId11(nextTask.task_id)} no longer queued, skipping`);
       return;
     }
     const source = nextTask.metadata?.source;
@@ -22097,7 +23712,7 @@ ${errorMessage}`;
       },
       taskParams
     );
-    console.log(`\u2705 Queued task drained for session ${sessionId.substring(0, 8)}`);
+    console.log(`\u2705 Queued task drained for session ${shortId11(sessionId)}`);
   }
   sessionsService.setQueueProcessor(async (sessionId, params) => {
     try {
@@ -22176,66 +23791,54 @@ ${errorMessage}`;
     },
     requireAuth
   );
+  const widgetResolverDeps = {
+    // biome-ignore lint/suspicious/noExplicitAny: Feathers Application shape
+    app,
+    isWorktreeOwner: async (worktreeId, userId) => worktreeRepository.isOwner(worktreeId, userId)
+  };
   registerAuthenticatedRoute(
     app,
-    "/sessions/:id/input-response",
+    "/widgets/:id/submit",
     {
       async create(data, params) {
-        const id = params.route?.id;
-        if (!id) throw new Error("Session ID required");
-        if (!data.requestId) throw new Error("requestId required");
-        if (!data.answers) throw new Error("answers required");
-        const messagesServiceInst = app.service("messages");
-        const messages = await messagesServiceInst.find({
-          query: {
-            session_id: id,
-            type: "input_request"
-          }
-        });
-        const messageList = isPaginated(messages) ? messages.data : messages;
-        const inputMessage = messageList.find((msg) => {
-          const content = msg.content;
-          return content?.request_id === data.requestId;
-        });
-        if (!inputMessage) {
-          throw new Error(`Input request ${data.requestId} not found`);
-        }
-        const inputContent = inputMessage.content;
-        if (inputContent?.status && inputContent.status !== "pending") {
-          return {
-            success: false,
-            alreadyResolved: true,
-            status: inputContent.status,
-            message: `Input request already ${inputContent.status}`
-          };
+        const widgetId = params.route?.id;
+        if (!widgetId) throw new Error("Widget ID required");
+        if (!params.user?.user_id) {
+          throw new NotAuthenticated6("Authentication required to submit a widget");
         }
-        const resolvedTaskId = inputContent.task_id || inputMessage.task_id;
-        if (!resolvedTaskId) {
-          throw new Error("Cannot process input response: task_id is missing.");
+        return resolveWidget(
+          widgetId,
+          { kind: "submit", body: data ?? {} },
+          { user_id: params.user.user_id, role: params.user.role },
+          widgetResolverDeps
+        );
+      }
+    },
+    {
+      create: { role: ROLES4.MEMBER, action: "submit widgets" }
+    },
+    requireAuth
+  );
+  registerAuthenticatedRoute(
+    app,
+    "/widgets/:id/dismiss",
+    {
+      async create(_data, params) {
+        const widgetId = params.route?.id;
+        if (!widgetId) throw new Error("Widget ID required");
+        if (!params.user?.user_id) {
+          throw new NotAuthenticated6("Authentication required to dismiss a widget");
         }
-        await messagesServiceInst.patch(inputMessage.message_id, {
-          content: {
-            ...inputContent,
-            status: "answered",
-            answers: data.answers,
-            annotations: data.annotations,
-            answered_by: data.respondedBy,
-            answered_at: (/* @__PURE__ */ new Date()).toISOString()
-          }
-        });
-        app.service("messages").emit("input_resolved", {
-          requestId: data.requestId,
-          taskId: resolvedTaskId,
-          sessionId: id,
-          answers: data.answers,
-          annotations: data.annotations,
-          respondedBy: data.respondedBy
-        });
-        return { success: true };
+        return resolveWidget(
+          widgetId,
+          { kind: "dismiss" },
+          { user_id: params.user.user_id, role: params.user.role },
+          widgetResolverDeps
+        );
       }
     },
     {
-      create: { role: ROLES4.MEMBER, action: "respond to input requests" }
+      create: { role: ROLES4.MEMBER, action: "dismiss widgets" }
     },
     requireAuth
   );
@@ -22389,32 +23992,19 @@ ${errorMessage}`;
       },
       async create(data, params) {
         return userApiKeysService.create(data, params);
-      }
-    },
-    {
-      find: { role: ROLES4.MEMBER, action: "list API keys" },
-      create: { role: ROLES4.MEMBER, action: "create API keys" }
-    },
-    requireAuth
-  );
-  registerAuthenticatedRoute(
-    app,
-    "/api/v1/user/api-keys/:id",
-    {
-      // biome-ignore lint/suspicious/noExplicitAny: Feathers service type
-      async patch(data, params) {
-        const id = params.route?.id;
-        if (!id) throw new BadRequest2("API key ID required");
+      },
+      async patch(id, data, params) {
+        if (!id) throw new BadRequest3("API key ID required");
         return userApiKeysService.patch(id, data, params);
       },
-      // biome-ignore lint/suspicious/noExplicitAny: Feathers service type
-      async remove(_id, params) {
-        const keyId = params.route?.id;
-        if (!keyId) throw new BadRequest2("API key ID required");
-        return userApiKeysService.remove(keyId, params);
+      async remove(id, params) {
+        if (!id) throw new BadRequest3("API key ID required");
+        return userApiKeysService.remove(id, params);
       }
     },
     {
+      find: { role: ROLES4.MEMBER, action: "list API keys" },
+      create: { role: ROLES4.MEMBER, action: "create API keys" },
       patch: { role: ROLES4.MEMBER, action: "update API keys" },
       remove: { role: ROLES4.MEMBER, action: "delete API keys" }
     },
@@ -22603,7 +24193,7 @@ ${errorMessage}`;
           if (!id) throw new Error("Worktree ID required");
           const worktree = await worktreeRepository.findById(id);
           if (!worktree) {
-            throw new Forbidden4(`Worktree not found: ${id}`);
+            throw new Forbidden5(`Worktree not found: ${id}`);
           }
           const userId = context.params.user?.user_id;
           const isOwner = userId ? await worktreeRepository.isOwner(worktree.worktree_id, userId) : false;
@@ -22615,7 +24205,7 @@ ${errorMessage}`;
           const isOwner = context.params.isWorktreeOwner;
           const userRole = context.params.user?.role;
           if (!isOwner && !hasMinimumRole2(userRole, ROLES4.ADMIN)) {
-            throw new Forbidden4(
+            throw new Forbidden5(
               "You must be the worktree owner or a global admin to archive/delete worktrees"
             );
           }
@@ -22646,7 +24236,7 @@ ${errorMessage}`;
           if (!id) throw new Error("Worktree ID required");
           const worktree = await worktreeRepository.findById(id);
           if (!worktree) {
-            throw new Forbidden4(`Worktree not found: ${id}`);
+            throw new Forbidden5(`Worktree not found: ${id}`);
           }
           const userId = context.params.user?.user_id;
           const isOwner = userId ? await worktreeRepository.isOwner(worktree.worktree_id, userId) : false;
@@ -22658,7 +24248,7 @@ ${errorMessage}`;
           const isOwner = context.params.isWorktreeOwner;
           const userRole = context.params.user?.role;
           if (!isOwner && !hasMinimumRole2(userRole, ROLES4.ADMIN)) {
-            throw new Forbidden4(
+            throw new Forbidden5(
               "You must be the worktree owner or a global admin to unarchive worktrees"
             );
           }
@@ -22670,14 +24260,14 @@ ${errorMessage}`;
   app.use("/worktrees/:id/execute-schedule-now", {
     async create(_data, params) {
       const id = params.route?.id;
-      if (!id) throw new BadRequest2("Worktree ID required");
+      if (!id) throw new BadRequest3("Worktree ID required");
       const scheduler = app.get("scheduler");
       if (!scheduler) {
-        throw new NotFound2("Scheduler service is not enabled on this instance.");
+        throw new NotFound3("Scheduler service is not enabled on this instance.");
       }
       const triggeredBy = params.user?.user_id;
       if (!triggeredBy) {
-        throw new NotAuthenticated5("Authentication required to trigger schedule.");
+        throw new NotAuthenticated6("Authentication required to trigger schedule.");
       }
       try {
         const session = await scheduler.executeScheduleNow({
@@ -22695,7 +24285,7 @@ ${errorMessage}`;
           throw new Conflict2(err.message, { code: err.code });
         }
         if (err instanceof ScheduleNotReadyError) {
-          throw new BadRequest2(err.message, { code: err.code });
+          throw new BadRequest3(err.message, { code: err.code });
         }
         throw err;
       }
@@ -22708,10 +24298,10 @@ ${errorMessage}`;
         requireMinimumRole(ROLES4.MEMBER, "execute scheduled runs"),
         async (context) => {
           const id = context.params.route?.id;
-          if (!id) throw new BadRequest2("Worktree ID required");
+          if (!id) throw new BadRequest3("Worktree ID required");
           const worktree = await worktreeRepository.findById(id);
           if (!worktree) {
-            throw new NotFound2(`Worktree not found: ${id}`);
+            throw new NotFound3(`Worktree not found: ${id}`);
           }
           const userId = context.params.user?.user_id;
           const isOwner = userId ? await worktreeRepository.isOwner(worktree.worktree_id, userId) : false;
@@ -22723,7 +24313,7 @@ ${errorMessage}`;
           const isOwner = context.params.isWorktreeOwner;
           const userRole = context.params.user?.role;
           if (!isOwner && !hasMinimumRole2(userRole, ROLES4.ADMIN)) {
-            throw new Forbidden4(
+            throw new Forbidden5(
               "You must be the worktree owner or a global admin to execute scheduled runs"
             );
           }
@@ -22843,28 +24433,28 @@ ${errorMessage}`;
   const requireSessionOwnerOrAdmin = async (sessionId, params) => {
     const user = params?.user;
     if (!user) {
-      throw new NotAuthenticated5("Authentication required");
+      throw new NotAuthenticated6("Authentication required");
     }
     if (user._isServiceAccount) return;
     const session = await sessionsService.get(sessionId, { provider: void 0 });
     if (!session) {
-      throw new NotFound2(`Session not found: ${sessionId}`);
+      throw new NotFound3(`Session not found: ${sessionId}`);
     }
     checkSessionOwnerOrAdmin(user, session, superadminOpts);
   };
   const normalizeEnvVarNames = (value) => {
     if (!Array.isArray(value)) {
-      throw new BadRequest2("envVarNames (array of strings) required");
+      throw new BadRequest3("envVarNames (array of strings) required");
     }
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     for (const entry of value) {
       if (typeof entry !== "string") {
-        throw new BadRequest2("envVarNames entries must be strings");
+        throw new BadRequest3("envVarNames entries must be strings");
       }
       const trimmed = entry.trim();
       if (!trimmed) {
-        throw new BadRequest2("envVarNames entries must be non-empty");
+        throw new BadRequest3("envVarNames entries must be non-empty");
       }
       if (!seen.has(trimmed)) {
         seen.add(trimmed);
@@ -22881,19 +24471,19 @@ ${errorMessage}`;
       // the comment above and the UI consumer expect names, not full rows.
       async find(_data, params) {
         const id = params.route?.id;
-        if (!id) throw new BadRequest2("Session ID required");
+        if (!id) throw new BadRequest3("Session ID required");
         await requireSessionOwnerOrAdmin(id, params);
         const rows = await sessionEnvSelectionsService.list(id, params);
         return rows.map((r) => r.env_var_name);
       },
       async create(data, params) {
         const id = params.route?.id;
-        if (!id) throw new BadRequest2("Session ID required");
+        if (!id) throw new BadRequest3("Session ID required");
         if (!data?.envVarName || typeof data.envVarName !== "string") {
-          throw new BadRequest2("envVarName required");
+          throw new BadRequest3("envVarName required");
         }
         const name = data.envVarName.trim();
-        if (!name) throw new BadRequest2("envVarName must be non-empty");
+        if (!name) throw new BadRequest3("envVarName must be non-empty");
         await requireSessionOwnerOrAdmin(id, params);
         await sessionEnvSelectionsService.add(id, name, params);
         const relationship = {
@@ -22908,8 +24498,8 @@ ${errorMessage}`;
       },
       async remove(name, params) {
         const id = params.route?.id;
-        if (!id) throw new BadRequest2("Session ID required");
-        if (!name) throw new BadRequest2("env var name required");
+        if (!id) throw new BadRequest3("Session ID required");
+        if (!name) throw new BadRequest3("env var name required");
         await requireSessionOwnerOrAdmin(id, params);
         await sessionEnvSelectionsService.remove(id, name, params);
         const relationship = {
@@ -22924,7 +24514,7 @@ ${errorMessage}`;
       },
       async patch(_nullId, data, params) {
         const id = params.route?.id;
-        if (!id) throw new BadRequest2("Session ID required");
+        if (!id) throw new BadRequest3("Session ID required");
         const envVarNames = normalizeEnvVarNames(data?.envVarNames);
         await requireSessionOwnerOrAdmin(id, params);
         await sessionEnvSelectionsService.setAll(id, envVarNames, params);
@@ -23159,9 +24749,9 @@ ${errorMessage}`;
   for (const [group, paths] of Object.entries(SERVICE_GROUP_PATHS)) {
     const tier = svcTier(group);
     if (tier === "on" || tier === "off") continue;
-    for (const path2 of paths) {
+    for (const path3 of paths) {
       try {
-        applyTierHooks(app, path2, tier);
+        applyTierHooks(app, path3, tier);
       } catch {
       }
     }