agor-live 0.18.0 → 0.19.1

package/dist/daemon/services/worktree-owners.js

@@ -1,4 +1,5 @@
 // src/services/worktree-owners.ts
+import { shortId as shortId2 } from "@agor/core/db";
 import { Forbidden as Forbidden2, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
 
 // src/utils/spawn-executor.ts
@@ -13,7 +14,44 @@ import {
   prepareImpersonationEnv
 } from "@agor/core/unix";
 import jwt from "jsonwebtoken";
+
+// src/utils/build-resolved-config-slice.ts
+import { loadConfigSync } from "@agor/core/config";
+function withResolvedConfig(payload) {
+  if (payload.resolvedConfig !== void 0) {
+    return payload;
+  }
+  return { ...payload, resolvedConfig: buildResolvedConfigSlice() };
+}
+function buildResolvedConfigSlice() {
+  try {
+    const config = loadConfigSync();
+    const slice = {};
+    const permissionTimeoutMs = config.execution?.permission_timeout_ms;
+    if (permissionTimeoutMs !== void 0) {
+      slice.execution = { permission_timeout_ms: permissionTimeoutMs };
+    }
+    const opencodeServerUrl = config.opencode?.serverUrl;
+    if (opencodeServerUrl !== void 0) {
+      slice.opencode = { serverUrl: opencodeServerUrl };
+    }
+    const hostIpAddress = config.daemon?.host_ip_address;
+    if (hostIpAddress !== void 0) {
+      slice.daemon = { host_ip_address: hostIpAddress };
+    }
+    return slice;
+  } catch (error) {
+    console.warn(
+      "[Executor] Failed to resolve config slice; handlers will fall back to defaults:",
+      error instanceof Error ? error.message : String(error)
+    );
+    return {};
+  }
+}
+
+// src/utils/spawn-executor.ts
 var configuredDaemonUrl = null;
+var configuredExecutorDefaults = {};
 function substituteTemplateVariables(template, variables) {
   let result = template;
   const substitutions = {
@@ -64,20 +102,25 @@ ${possiblePaths.map((p) => `  - ${p}`).join("\n")}`
   return executorPath;
 }
 function spawnExecutor(payload, options = {}) {
-  const { executorCommandTemplate, templateVariables, logPrefix = "[Executor]" } = options;
+  const { templateVariables, logPrefix = "[Executor]" } = options;
+  const executorCommandTemplate = options.executorCommandTemplate !== void 0 ? options.executorCommandTemplate || void 0 : configuredExecutorDefaults.executorCommandTemplate;
+  const asUser = options.asUser !== void 0 ? options.asUser || void 0 : configuredExecutorDefaults.asUser;
+  const payloadWithConfig = withResolvedConfig(payload);
   if (executorCommandTemplate) {
-    spawnExecutorWithTemplate(payload, {
+    spawnExecutorWithTemplate(payloadWithConfig, {
       ...options,
+      asUser,
       executorCommandTemplate,
       templateVariables: {
-        command: payload.command,
+        command: payloadWithConfig.command,
         task_id: generateTaskId(),
+        unix_user: asUser,
         ...templateVariables
       },
       logPrefix
     });
   } else {
-    spawnExecutorLocal(payload, options);
+    spawnExecutorLocal(payloadWithConfig, { ...options, asUser });
   }
 }
 function spawnExecutorLocal(payload, options) {
@@ -87,10 +130,14 @@ function spawnExecutorLocal(payload, options) {
     cwd = executorDir,
     env = process.env,
     logPrefix = "[Executor]",
-    asUser
+    asUser: rawAsUser,
+    onSpawn,
+    preparedEnv,
+    preparedEnvFilePath
   } = options;
+  const asUser = rawAsUser || void 0;
   const daemonUrl = getDaemonUrl();
-  const essentialEnv = asUser ? Object.fromEntries(
+  const envWithDaemonUrl = preparedEnv ? { DAEMON_URL: daemonUrl, ...preparedEnv } : asUser ? Object.fromEntries(
     Object.entries({
       DAEMON_URL: daemonUrl,
       PATH: env.PATH || "/usr/local/bin:/usr/bin:/bin",
@@ -109,8 +156,12 @@ function spawnExecutorLocal(payload, options) {
       GIT_CONFIG_PARAMETERS: env.GIT_CONFIG_PARAMETERS
     }).filter(([_, v]) => v !== void 0)
   ) : { ...env, DAEMON_URL: daemonUrl };
-  const envWithDaemonUrl = essentialEnv;
-  const prepared = asUser ? prepareImpersonationEnv({ asUser, env: envWithDaemonUrl }) : { inlineEnv: void 0, envFilePath: void 0 };
+  const prepared = asUser ? preparedEnvFilePath ? {
+    inlineEnv: Object.fromEntries(
+      Object.entries(envWithDaemonUrl).filter(([k]) => !isSecretEnvKey(k))
+    ),
+    envFilePath: preparedEnvFilePath
+  } : prepareImpersonationEnv({ asUser, env: envWithDaemonUrl }) : { inlineEnv: void 0, envFilePath: void 0 };
   const { cmd, args } = buildSpawnArgs("node", [executorPath, "--stdin"], {
     asUser,
     env: asUser ? prepared.inlineEnv : void 0,
@@ -125,6 +176,13 @@ function spawnExecutorLocal(payload, options) {
   }
   console.log(`${logPrefix} Spawning executor at: ${executorPath}`);
   console.log(`${logPrefix} Command: ${payload.command}`);
+  if (cwd && !existsSync(cwd)) {
+    console.error(
+      `${logPrefix} Refusing to spawn: cwd does not exist on disk: ${cwd}. This usually means the worktree or repo directory was deleted out-of-band \u2014 for example a Kubernetes pod redeploy with an ephemeral $HOME but a persistent database. Verify that the volume backing $HOME persists across restarts. See issue #1109.`
+    );
+    options.onExit?.(127);
+    return;
+  }
   const executorProcess = spawn(cmd, args, {
     cwd,
     env: asUser ? void 0 : { ...envWithDaemonUrl },
@@ -135,6 +193,7 @@ function spawnExecutorLocal(payload, options) {
     // Don't detach - let daemon manage lifecycle
   });
   attachEnvFileCleanup(executorProcess, { envFilePath: prepared.envFilePath, asUser });
+  onSpawn?.(executorProcess);
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
   });
@@ -159,6 +218,7 @@ function spawnExecutorWithTemplate(payload, options) {
   const executorProcess = spawn("sh", ["-c", command], {
     stdio: ["pipe", "pipe", "pipe"]
   });
+  options.onSpawn?.(executorProcess);
   executorProcess.stdout?.on("data", (data) => {
     console.log(`${logPrefix} ${data.toString().trim()}`);
   });
@@ -178,16 +238,14 @@ function spawnExecutorWithTemplate(payload, options) {
         `${logPrefix} Executor exited with code ${code} (task: ${templateVariables.task_id})`
       );
     }
+    options.onExit?.(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
 }
 function getDaemonUrl() {
-  if (configuredDaemonUrl) {
-    return configuredDaemonUrl;
-  }
-  const effectivePort = process.env.PORT || "3030";
-  return `http://localhost:${effectivePort}`;
+  if (configuredDaemonUrl) return configuredDaemonUrl;
+  return `http://localhost:${process.env.PORT || "3030"}`;
 }
 function createServiceToken(jwtSecret, expiresIn) {
   const options = {
@@ -209,6 +267,7 @@ function createServiceToken(jwtSecret, expiresIn) {
 var spawnExecutorFireAndForget = spawnExecutor;
 
 // src/utils/worktree-authorization.ts
+import { shortId } from "@agor/core/db";
 import { Forbidden, NotAuthenticated } from "@agor/core/feathers";
 import { ROLES, WORKTREE_PERMISSION_LEVELS } from "@agor/core/types";
 function isSuperAdmin(role, allowSuperadmin = true) {
@@ -352,7 +411,7 @@ function setupWorktreeOwnersService(app, worktreeRepo, config = {}) {
           }
           const worktreeId = context.params.route?.id;
           console.log(
-            `[Unix Integration] Syncing worktree ${worktreeId.substring(0, 8)} after owner added`
+            `[Unix Integration] Syncing worktree ${shortId2(worktreeId)} after owner added`
           );
           const serviceToken = createServiceToken(config.jwtSecret);
           spawnExecutorFireAndForget(
@@ -379,7 +438,7 @@ function setupWorktreeOwnersService(app, worktreeRepo, config = {}) {
           }
           const worktreeId = context.params.route?.id;
           console.log(
-            `[Unix Integration] Syncing worktree ${worktreeId.substring(0, 8)} after owner removed`
+            `[Unix Integration] Syncing worktree ${shortId2(worktreeId)} after owner removed`
           );
           const serviceToken = createServiceToken(config.jwtSecret);
           spawnExecutorFireAndForget(

package/dist/daemon/services/worktrees.js

@@ -17,7 +17,7 @@ __export(unix_group_init_exports, {
 import { exec } from "child_process";
 import { promisify } from "util";
 import { getDaemonUser } from "@agor/core/config";
-import { UsersRepository } from "@agor/core/db";
+import { shortId, UsersRepository } from "@agor/core/db";
 import {
   generateRepoGroupName,
   generateWorktreeGroupName,
@@ -45,9 +45,7 @@ async function runCommands(commands) {
 async function initializeRepoUnixGroup(db, app, repoId, userId) {
   const groupName = generateRepoGroupName(repoId);
   const daemonUser = getDaemonUser();
-  console.log(
-    `[unix-group-init] Creating repo group ${groupName} for repo ${repoId.substring(0, 8)}`
-  );
+  console.log(`[unix-group-init] Creating repo group ${groupName} for repo ${shortId(repoId)}`);
   const exists = await checkCommand(UnixGroupCommands.groupExists(groupName));
   if (!exists) {
     await runCommand(UnixGroupCommands.createGroup(groupName));
@@ -96,16 +94,14 @@ async function initializeRepoUnixGroup(db, app, repoId, userId) {
     }
   }
   await app.service("repos").patch(repoId, { unix_group: groupName });
-  console.log(
-    `[unix-group-init] Updated repo ${repoId.substring(0, 8)} with unix_group=${groupName}`
-  );
+  console.log(`[unix-group-init] Updated repo ${shortId(repoId)} with unix_group=${groupName}`);
   return groupName;
 }
 async function initializeWorktreeUnixGroup(db, app, worktreeId, othersAccess) {
   const groupName = generateWorktreeGroupName(worktreeId);
   const daemonUser = getDaemonUser();
   console.log(
-    `[unix-group-init] Creating worktree group ${groupName} for worktree ${worktreeId.substring(0, 8)}`
+    `[unix-group-init] Creating worktree group ${groupName} for worktree ${shortId(worktreeId)}`
   );
   const worktree = await app.service("worktrees").get(worktreeId);
   const worktreePath = worktree.path;
@@ -181,7 +177,7 @@ async function initializeWorktreeUnixGroup(db, app, worktreeId, othersAccess) {
   }
   await app.service("worktrees").patch(worktreeId, { unix_group: groupName });
   console.log(
-    `[unix-group-init] Updated worktree ${worktreeId.substring(0, 8)} with unix_group=${groupName}`
+    `[unix-group-init] Updated worktree ${shortId(worktreeId)} with unix_group=${groupName}`
   );
   return groupName;
 }
@@ -448,22 +444,35 @@ function ensureCanTriggerManagedEnv(minimumRole, params, action) {
 }
 
 // src/utils/git-impersonation.ts
-import { validateResolvedUnixUser } from "@agor/core/unix";
-async function resolveGitImpersonationForUser(_db, _userId) {
+async function resolveDaemonUserForGroupRefresh() {
   const { getDaemonUser: getDaemonUser2, isUnixGroupRefreshNeeded } = await import("@agor/core/config");
   if (!isUnixGroupRefreshNeeded()) {
     return void 0;
   }
-  const daemonUser = getDaemonUser2();
-  if (daemonUser) {
-    validateResolvedUnixUser("simple", daemonUser);
-  }
-  return daemonUser;
+  return getDaemonUser2();
+}
+async function resolveGitImpersonationForUser(_db, _userId) {
+  return resolveDaemonUserForGroupRefresh();
 }
 async function resolveGitImpersonationForWorktree(db, worktree) {
   return resolveGitImpersonationForUser(db, worktree.created_by);
 }
 
+// src/utils/query-params.ts
+function parseLastMessageTruncationLength(value) {
+  const DEFAULT = 500;
+  const MIN = 50;
+  const MAX = 1e4;
+  if (value === void 0 || value === null) {
+    return DEFAULT;
+  }
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed) || parsed < MIN || parsed > MAX) {
+    return DEFAULT;
+  }
+  return Math.floor(parsed);
+}
+
 // src/utils/spawn-executor.ts
 import { spawn } from "child_process";
 import { existsSync } from "fs";
@@ -476,7 +485,44 @@ import {
   prepareImpersonationEnv
 } from "@agor/core/unix";
 import jwt from "jsonwebtoken";
+
+// src/utils/build-resolved-config-slice.ts
+import { loadConfigSync } from "@agor/core/config";
+function withResolvedConfig(payload) {
+  if (payload.resolvedConfig !== void 0) {
+    return payload;
+  }
+  return { ...payload, resolvedConfig: buildResolvedConfigSlice() };
+}
+function buildResolvedConfigSlice() {
+  try {
+    const config = loadConfigSync();
+    const slice = {};
+    const permissionTimeoutMs = config.execution?.permission_timeout_ms;
+    if (permissionTimeoutMs !== void 0) {
+      slice.execution = { permission_timeout_ms: permissionTimeoutMs };
+    }
+    const opencodeServerUrl = config.opencode?.serverUrl;
+    if (opencodeServerUrl !== void 0) {
+      slice.opencode = { serverUrl: opencodeServerUrl };
+    }
+    const hostIpAddress = config.daemon?.host_ip_address;
+    if (hostIpAddress !== void 0) {
+      slice.daemon = { host_ip_address: hostIpAddress };
+    }
+    return slice;
+  } catch (error) {
+    console.warn(
+      "[Executor] Failed to resolve config slice; handlers will fall back to defaults:",
+      error instanceof Error ? error.message : String(error)
+    );
+    return {};
+  }
+}
+
+// src/utils/spawn-executor.ts
 var configuredDaemonUrl = null;
+var configuredExecutorDefaults = {};
 function substituteTemplateVariables(template, variables) {
   let result = template;
   const substitutions = {
@@ -527,20 +573,25 @@ ${possiblePaths.map((p) => `  - ${p}`).join("\n")}`
   return executorPath;
 }
 function spawnExecutor(payload, options = {}) {
-  const { executorCommandTemplate, templateVariables, logPrefix = "[Executor]" } = options;
+  const { templateVariables, logPrefix = "[Executor]" } = options;
+  const executorCommandTemplate = options.executorCommandTemplate !== void 0 ? options.executorCommandTemplate || void 0 : configuredExecutorDefaults.executorCommandTemplate;
+  const asUser = options.asUser !== void 0 ? options.asUser || void 0 : configuredExecutorDefaults.asUser;
+  const payloadWithConfig = withResolvedConfig(payload);
   if (executorCommandTemplate) {
-    spawnExecutorWithTemplate(payload, {
+    spawnExecutorWithTemplate(payloadWithConfig, {
       ...options,
+      asUser,
       executorCommandTemplate,
       templateVariables: {
-        command: payload.command,
+        command: payloadWithConfig.command,
         task_id: generateTaskId(),
+        unix_user: asUser,
         ...templateVariables
       },
       logPrefix
     });
   } else {
-    spawnExecutorLocal(payload, options);
+    spawnExecutorLocal(payloadWithConfig, { ...options, asUser });
   }
 }
 function spawnExecutorLocal(payload, options) {
@@ -550,10 +601,14 @@ function spawnExecutorLocal(payload, options) {
     cwd = executorDir,
     env = process.env,
     logPrefix = "[Executor]",
-    asUser
+    asUser: rawAsUser,
+    onSpawn,
+    preparedEnv,
+    preparedEnvFilePath
   } = options;
+  const asUser = rawAsUser || void 0;
   const daemonUrl = getDaemonUrl();
-  const essentialEnv = asUser ? Object.fromEntries(
+  const envWithDaemonUrl = preparedEnv ? { DAEMON_URL: daemonUrl, ...preparedEnv } : asUser ? Object.fromEntries(
     Object.entries({
       DAEMON_URL: daemonUrl,
       PATH: env.PATH || "/usr/local/bin:/usr/bin:/bin",
@@ -572,8 +627,12 @@ function spawnExecutorLocal(payload, options) {
       GIT_CONFIG_PARAMETERS: env.GIT_CONFIG_PARAMETERS
     }).filter(([_, v]) => v !== void 0)
   ) : { ...env, DAEMON_URL: daemonUrl };
-  const envWithDaemonUrl = essentialEnv;
-  const prepared = asUser ? prepareImpersonationEnv({ asUser, env: envWithDaemonUrl }) : { inlineEnv: void 0, envFilePath: void 0 };
+  const prepared = asUser ? preparedEnvFilePath ? {
+    inlineEnv: Object.fromEntries(
+      Object.entries(envWithDaemonUrl).filter(([k]) => !isSecretEnvKey(k))
+    ),
+    envFilePath: preparedEnvFilePath
+  } : prepareImpersonationEnv({ asUser, env: envWithDaemonUrl }) : { inlineEnv: void 0, envFilePath: void 0 };
   const { cmd, args } = buildSpawnArgs("node", [executorPath, "--stdin"], {
     asUser,
     env: asUser ? prepared.inlineEnv : void 0,
@@ -588,6 +647,13 @@ function spawnExecutorLocal(payload, options) {
   }
   console.log(`${logPrefix} Spawning executor at: ${executorPath}`);
   console.log(`${logPrefix} Command: ${payload.command}`);
+  if (cwd && !existsSync(cwd)) {
+    console.error(
+      `${logPrefix} Refusing to spawn: cwd does not exist on disk: ${cwd}. This usually means the worktree or repo directory was deleted out-of-band \u2014 for example a Kubernetes pod redeploy with an ephemeral $HOME but a persistent database. Verify that the volume backing $HOME persists across restarts. See issue #1109.`
+    );
+    options.onExit?.(127);
+    return;
+  }
   const executorProcess = spawn(cmd, args, {
     cwd,
     env: asUser ? void 0 : { ...envWithDaemonUrl },
@@ -598,6 +664,7 @@ function spawnExecutorLocal(payload, options) {
     // Don't detach - let daemon manage lifecycle
   });
   attachEnvFileCleanup(executorProcess, { envFilePath: prepared.envFilePath, asUser });
+  onSpawn?.(executorProcess);
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
   });
@@ -622,6 +689,7 @@ function spawnExecutorWithTemplate(payload, options) {
   const executorProcess = spawn("sh", ["-c", command], {
     stdio: ["pipe", "pipe", "pipe"]
   });
+  options.onSpawn?.(executorProcess);
   executorProcess.stdout?.on("data", (data) => {
     console.log(`${logPrefix} ${data.toString().trim()}`);
   });
@@ -641,16 +709,14 @@ function spawnExecutorWithTemplate(payload, options) {
         `${logPrefix} Executor exited with code ${code} (task: ${templateVariables.task_id})`
       );
     }
+    options.onExit?.(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
 }
 function getDaemonUrl() {
-  if (configuredDaemonUrl) {
-    return configuredDaemonUrl;
-  }
-  const effectivePort = process.env.PORT || "3030";
-  return `http://localhost:${effectivePort}`;
+  if (configuredDaemonUrl) return configuredDaemonUrl;
+  return `http://localhost:${process.env.PORT || "3030"}`;
 }
 function createServiceToken(jwtSecret, expiresIn) {
   const options = {
@@ -678,19 +744,6 @@ function generateSessionToken(app) {
 }
 
 // src/services/worktrees.ts
-function parseTruncationLength(value) {
-  const DEFAULT = 500;
-  const MIN = 50;
-  const MAX = 1e4;
-  if (value === void 0 || value === null) {
-    return DEFAULT;
-  }
-  const parsed = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(parsed) || parsed < MIN || parsed > MAX) {
-    return DEFAULT;
-  }
-  return Math.floor(parsed);
-}
 var WorktreesService = class extends DrizzleService {
   worktreeRepo;
   db;
@@ -877,7 +930,7 @@ var WorktreesService = class extends DrizzleService {
     if (!boardIdProvided) {
       const withZone2 = await this.worktreeRepo.enrichWithZoneInfo(updatedWorktree);
       if (params?.query?.include_sessions === true || params?.query?.include_sessions === "true") {
-        const truncationLength = parseTruncationLength(
+        const truncationLength = parseLastMessageTruncationLength(
           params?.query?.last_message_truncation_length
         );
         return this.worktreeRepo.enrichWithSessionActivity(withZone2, truncationLength);
@@ -912,7 +965,9 @@ var WorktreesService = class extends DrizzleService {
     }
     const withZone = await this.worktreeRepo.enrichWithZoneInfo(updatedWorktree);
     if (params?.query?.include_sessions === true || params?.query?.include_sessions === "true") {
-      const truncationLength = parseTruncationLength(params?.query?.last_message_truncation_length);
+      const truncationLength = parseLastMessageTruncationLength(
+        params?.query?.last_message_truncation_length
+      );
       return this.worktreeRepo.enrichWithSessionActivity(withZone, truncationLength);
     }
     return withZone;
@@ -931,7 +986,9 @@ var WorktreesService = class extends DrizzleService {
     if (includeSessions === true || includeSessions === "true") {
       const truncationLengthQuery = params?.query?.last_message_truncation_length;
       const truncationLengthRoot = params?._last_message_truncation_length;
-      const truncationLength = parseTruncationLength(truncationLengthRoot ?? truncationLengthQuery);
+      const truncationLength = parseLastMessageTruncationLength(
+        truncationLengthRoot ?? truncationLengthQuery
+      );
       const result = await this.worktreeRepo.enrichWithSessionActivity(withZone, truncationLength);
       return result;
     }
@@ -965,8 +1022,7 @@ var WorktreesService = class extends DrizzleService {
     const result = await super.remove(id, params);
     if (deleteFromFilesystem) {
       console.log(`\u{1F5D1}\uFE0F  Spawning executor to remove worktree from filesystem: ${worktree.path}`);
-      const rbacEnabled = isWorktreeRbacEnabled();
-      const asUser = rbacEnabled ? await resolveGitImpersonationForWorktree(this.db, worktree) : void 0;
+      const asUser = await resolveGitImpersonationForWorktree(this.db, worktree);
       const userId = params.user.user_id;
       const appWithToken = this.app;
       appWithToken.sessionTokenService?.generateToken("worktree-remove", userId).then((sessionToken) => {

package/dist/daemon/setup/database.js

@@ -78,17 +78,46 @@ async function safeUnlink(path) {
 }
 async function runFirstRunAdminBootstrap(db, options = {}) {
   const credentialsPath = getAdminCredentialsPath(options.credentialsBaseDir);
+  const envPassword = process.env.AGOR_ADMIN_PASSWORD;
   let credentialsWritten = false;
   const result = await bootstrapFirstRunAdmin(db, async () => {
+    if (envPassword && envPassword.length > 0) {
+      return await createUser(db, {
+        email: BOOTSTRAP_ADMIN_EMAIL,
+        password: envPassword,
+        name: "Admin",
+        role: "superadmin",
+        unix_username: "admin",
+        must_change_password: true
+      });
+    }
     const password = generateAdminPassword();
-    await writeCredentialsExclusive(credentialsPath, BOOTSTRAP_ADMIN_EMAIL, password);
+    try {
+      await writeCredentialsExclusive(credentialsPath, BOOTSTRAP_ADMIN_EMAIL, password);
+    } catch (err) {
+      const code = err.code;
+      if (code === "EEXIST") throw err;
+      throw new Error(
+        [
+          `Failed to write admin credentials file at ${credentialsPath}.`,
+          "",
+          "Set the AGOR_ADMIN_PASSWORD environment variable to skip the",
+          "credentials file entirely (the password you provide is used to",
+          "create the bootstrap admin), or make the parent directory",
+          "writable so the daemon can persist a generated password.",
+          "",
+          `Underlying error: ${err instanceof Error ? err.message : String(err)}`
+        ].join("\n")
+      );
+    }
     credentialsWritten = true;
     try {
       return await createUser(db, {
         email: BOOTSTRAP_ADMIN_EMAIL,
         password,
         name: "Admin",
-        role: "admin",
+        role: "superadmin",
+        unix_username: "admin",
         // Forces the operator to set their own password after first login.
         // Without this the printed/persisted cleartext stays valid forever.
         must_change_password: true
@@ -105,15 +134,19 @@ async function runFirstRunAdminBootstrap(db, options = {}) {
   };
 }
 function logFirstRunAdminBootstrap(result) {
-  if (result.createdAdmin && result.credentialsPath && result.admin) {
+  if (result.createdAdmin && result.admin) {
     process.stderr.write("\n");
     process.stderr.write("================================================================\n");
     process.stderr.write("\u{1F510}  First-run admin user created\n");
     process.stderr.write("----------------------------------------------------------------\n");
     process.stderr.write(`    Email:     ${result.admin.email}
 `);
-    process.stderr.write(`    Password:  see ${result.credentialsPath} (mode 0600)
+    if (result.credentialsPath) {
+      process.stderr.write(`    Password:  see ${result.credentialsPath} (mode 0600)
 `);
+    } else {
+      process.stderr.write("    Password:  set via the AGOR_ADMIN_PASSWORD env var\n");
+    }
     process.stderr.write("\n");
     process.stderr.write("    You will be prompted to change the password on first login.\n");
     process.stderr.write("================================================================\n");

package/dist/daemon/setup/first-run-admin.d.ts

@@ -31,7 +31,16 @@ interface DaemonBootstrapResult extends AdminBootstrapResult {
  * Run the first-run admin bootstrap with filesystem-aware credential
  * persistence and rollback. Idempotent — safe on every daemon start.
  *
- * Atomicity:
+ * Password resolution — capability-driven, no deployment-mode flag:
+ *   1. AGOR_ADMIN_PASSWORD env var      → use it; no file is written
+ *      (caller is presumed to know the value out-of-band, e.g. a k8s
+ *      Secret mounted into the daemon's env)
+ *   2. Credentials file is writable     → generate + write a 0600 file
+ *      with O_EXCL, then create the user (today's flow)
+ *   3. Neither                          → fail-fast with a clear error
+ *      naming the env var to set or the directory to make writable
+ *
+ * Atomicity (file path only):
  *   1. Generate the password.
  *   2. Open the credentials file with O_CREAT|O_EXCL|O_WRONLY mode 0600.
  *      Fails fast if the file already exists.

package/dist/daemon/setup/first-run-admin.js

@@ -67,17 +67,46 @@ async function safeUnlink(path) {
 }
 async function runFirstRunAdminBootstrap(db, options = {}) {
   const credentialsPath = getAdminCredentialsPath(options.credentialsBaseDir);
+  const envPassword = process.env.AGOR_ADMIN_PASSWORD;
   let credentialsWritten = false;
   const result = await bootstrapFirstRunAdmin(db, async () => {
+    if (envPassword && envPassword.length > 0) {
+      return await createUser(db, {
+        email: BOOTSTRAP_ADMIN_EMAIL,
+        password: envPassword,
+        name: "Admin",
+        role: "superadmin",
+        unix_username: "admin",
+        must_change_password: true
+      });
+    }
     const password = generateAdminPassword();
-    await writeCredentialsExclusive(credentialsPath, BOOTSTRAP_ADMIN_EMAIL, password);
+    try {
+      await writeCredentialsExclusive(credentialsPath, BOOTSTRAP_ADMIN_EMAIL, password);
+    } catch (err) {
+      const code = err.code;
+      if (code === "EEXIST") throw err;
+      throw new Error(
+        [
+          `Failed to write admin credentials file at ${credentialsPath}.`,
+          "",
+          "Set the AGOR_ADMIN_PASSWORD environment variable to skip the",
+          "credentials file entirely (the password you provide is used to",
+          "create the bootstrap admin), or make the parent directory",
+          "writable so the daemon can persist a generated password.",
+          "",
+          `Underlying error: ${err instanceof Error ? err.message : String(err)}`
+        ].join("\n")
+      );
+    }
     credentialsWritten = true;
     try {
       return await createUser(db, {
         email: BOOTSTRAP_ADMIN_EMAIL,
         password,
         name: "Admin",
-        role: "admin",
+        role: "superadmin",
+        unix_username: "admin",
         // Forces the operator to set their own password after first login.
         // Without this the printed/persisted cleartext stays valid forever.
         must_change_password: true
@@ -94,15 +123,19 @@ async function runFirstRunAdminBootstrap(db, options = {}) {
   };
 }
 function logFirstRunAdminBootstrap(result) {
-  if (result.createdAdmin && result.credentialsPath && result.admin) {
+  if (result.createdAdmin && result.admin) {
     process.stderr.write("\n");
     process.stderr.write("================================================================\n");
     process.stderr.write("\u{1F510}  First-run admin user created\n");
     process.stderr.write("----------------------------------------------------------------\n");
     process.stderr.write(`    Email:     ${result.admin.email}
 `);
-    process.stderr.write(`    Password:  see ${result.credentialsPath} (mode 0600)
+    if (result.credentialsPath) {
+      process.stderr.write(`    Password:  see ${result.credentialsPath} (mode 0600)
 `);
+    } else {
+      process.stderr.write("    Password:  set via the AGOR_ADMIN_PASSWORD env var\n");
+    }
     process.stderr.write("\n");
     process.stderr.write("    You will be prompted to change the password on first login.\n");
     process.stderr.write("================================================================\n");