agor-live 0.21.0 → 0.21.1

package/dist/cli/base-command.d.ts

@@ -1,16 +1,14 @@
-import { AgorClient } from '@agor-live/client';
-import { Command } from '@oclif/core';
-
 /**
  * Base Command - Shared logic for all Agor CLI commands
  *
  * Reduces boilerplate by providing common functionality like daemon connection checking.
  */
-
+import type { AgorClient } from '@agor-live/client';
+import { Command } from '@oclif/core';
 /**
  * Base command with daemon connection utilities
  */
-declare abstract class BaseCommand extends Command {
+export declare abstract class BaseCommand extends Command {
     protected daemonUrl: string | null;
     /**
      * Connect to daemon (checks if running first)
@@ -25,5 +23,4 @@ declare abstract class BaseCommand extends Command {
      */
     protected cleanupClient(client: AgorClient): Promise<void>;
 }
-
-export { BaseCommand };
+//# sourceMappingURL=base-command.d.ts.map

package/dist/cli/base-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-command.d.ts","sourceRoot":"","sources":["../src/base-command.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC;;GAEG;AACH,8BAAsB,WAAY,SAAQ,OAAO;IAC/C,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAQ;IAE1C;;;;OAIG;cACa,eAAe,IAAI,OAAO,CAAC,UAAU,CAAC;IAsEtD;;;;OAIG;cACa,aAAa,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CAajE"}

package/dist/cli/commands/admin/add-to-branch-group.d.ts

@@ -1,16 +1,23 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Add User to Branch Unix Group
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Adds a Unix user to a branch's group, granting filesystem access.
+ * This command is designed to be called by the daemon via `sudo agor admin add-to-branch-group`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class AddToBranchGroup extends Command {
+export default class AddToBranchGroup extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        group: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { AddToBranchGroup as default };
+//# sourceMappingURL=add-to-branch-group.d.ts.map

package/dist/cli/commands/admin/add-to-branch-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-to-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/add-to-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,OAAgB,WAAW,SAAoD;IAE/E,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;MAqBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}

package/dist/cli/commands/admin/create-branch-group.d.ts

@@ -1,15 +1,22 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Create Branch Unix Group
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Creates a Unix group for branch isolation (agor_wt_<short-id>).
+ * This command is designed to be called by the daemon via `sudo agor admin create-branch-group`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class CreateBranchGroup extends Command {
+export default class CreateBranchGroup extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        'branch-id': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        'branch-id': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { CreateBranchGroup as default };
+//# sourceMappingURL=create-branch-group.d.ts.map

package/dist/cli/commands/admin/create-branch-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,OAAgB,WAAW,SAAmD;IAE9E,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;MAgBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAsClC"}

package/dist/cli/commands/admin/create-symlink.d.ts

@@ -1,18 +1,25 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Create Branch Symlink
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Creates a symlink in a user's ~/agor/worktrees directory pointing to a branch.
+ * This command is designed to be called by the daemon via `sudo agor admin create-symlink`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class CreateSymlink extends Command {
+export default class CreateSymlink extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'branch-name': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'branch-path': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'home-base': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'branch-name': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'branch-path': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { CreateSymlink as default };
+//# sourceMappingURL=create-symlink.d.ts.map

package/dist/cli/commands/admin/create-symlink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/create-symlink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,OAAgB,WAAW,SAAiE;IAE5F,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;;;MA8BnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoDlC"}

package/dist/cli/commands/admin/delete-branch-group.d.ts

@@ -1,15 +1,22 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Delete Branch Unix Group
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Deletes a Unix group for branch isolation.
+ * This command is designed to be called by the daemon via `sudo agor admin delete-branch-group`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class DeleteBranchGroup extends Command {
+export default class DeleteBranchGroup extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        group: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { DeleteBranchGroup as default };
+//# sourceMappingURL=delete-branch-group.d.ts.map

package/dist/cli/commands/admin/delete-branch-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,iBAAkB,SAAQ,OAAO;IACpD,OAAgB,WAAW,SAA6C;IAExE,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;MAgBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}

package/dist/cli/commands/admin/delete-user.d.ts

@@ -1,16 +1,23 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Delete Unix User
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Deletes a Unix user. Optionally removes their home directory.
+ * This command is designed to be called by the daemon via `sudo agor admin delete-user`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class DeleteUser extends Command {
+export default class DeleteUser extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'delete-home': _oclif_core_interfaces.BooleanFlag<boolean>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'delete-home': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { DeleteUser as default };
+//# sourceMappingURL=delete-user.d.ts.map

package/dist/cli/commands/admin/delete-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/delete-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAAqC;IAEhE,OAAgB,QAAQ,WAItB;IAEF,OAAgB,KAAK;;;;;MAoBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAuClC"}

package/dist/cli/commands/admin/ensure-user.d.ts

@@ -1,16 +1,23 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Ensure Unix User Exists
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Creates a Unix user if it doesn't exist, with home directory and ~/agor/worktrees setup.
+ * This command is designed to be called by the daemon via `sudo agor admin ensure-user`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class EnsureUser extends Command {
+export default class EnsureUser extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'home-base': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { EnsureUser as default };
+//# sourceMappingURL=ensure-user.d.ts.map

package/dist/cli/commands/admin/ensure-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure-user.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/ensure-user.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAO;IAC7C,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAItB;IAEF,OAAgB,KAAK;;;;;MAoBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAgDlC"}

package/dist/cli/commands/admin/remove-from-branch-group.d.ts

@@ -1,16 +1,23 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Remove User from Branch Unix Group
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Removes a Unix user from a branch's group, revoking filesystem access.
+ * This command is designed to be called by the daemon via `sudo agor admin remove-from-branch-group`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class RemoveFromBranchGroup extends Command {
+export default class RemoveFromBranchGroup extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        group: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        group: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { RemoveFromBranchGroup as default };
+//# sourceMappingURL=remove-from-branch-group.d.ts.map

package/dist/cli/commands/admin/remove-from-branch-group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-from-branch-group.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-from-branch-group.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,qBAAsB,SAAQ,OAAO;IACxD,OAAgB,WAAW,SAAyD;IAEpF,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;MAqBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlC"}

package/dist/cli/commands/admin/remove-symlink.d.ts

@@ -1,17 +1,24 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Remove Branch Symlink
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Removes a symlink from a user's ~/agor/worktrees directory.
+ * This command is designed to be called by the daemon via `sudo agor admin remove-symlink`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class RemoveSymlink extends Command {
+export default class RemoveSymlink extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'branch-name': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'home-base': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'branch-name': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { RemoveSymlink as default };
+//# sourceMappingURL=remove-symlink.d.ts.map

package/dist/cli/commands/admin/remove-symlink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-symlink.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/remove-symlink.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,aAAc,SAAQ,OAAO;IAChD,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;;MAyBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAqClC"}

package/dist/cli/commands/admin/scrub-git-remotes.d.ts

@@ -0,0 +1,9 @@
+import { Command } from '@oclif/core';
+export default class ScrubGitRemotes extends Command {
+    static description: string;
+    static flags: {
+        write: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=scrub-git-remotes.d.ts.map

package/dist/cli/commands/admin/scrub-git-remotes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub-git-remotes.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/scrub-git-remotes.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAG7C,MAAM,CAAC,OAAO,OAAO,eAAgB,SAAQ,OAAO;IAClD,OAAgB,WAAW,SAC0E;IAErG,OAAgB,KAAK;;MAOnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA4F3B"}

package/dist/cli/commands/admin/scrub-git-remotes.js

@@ -0,0 +1,104 @@
+// src/commands/admin/scrub-git-remotes.ts
+import {
+  BranchRepository,
+  createDatabase,
+  getDatabaseUrl,
+  RepoRepository,
+  shortId
+} from "@agor/core/db";
+import { scanGitConfigRemoteCredentials, scrubGitConfigRemoteCredentials } from "@agor/core/git";
+import { Command, Flags } from "@oclif/core";
+import chalk from "chalk";
+var ScrubGitRemotes = class _ScrubGitRemotes extends Command {
+  static description = "Scan registered repos/branches for credential-bearing git remote URLs and optionally scrub them.";
+  static flags = {
+    write: Flags.boolean({
+      char: "w",
+      default: false,
+      description: "Rewrite unsafe remote URLs in .git/config and persisted repo rows by removing URL userinfo"
+    })
+  };
+  async run() {
+    const { flags } = await this.parse(_ScrubGitRemotes);
+    const db = createDatabase({ url: getDatabaseUrl() });
+    const repoRepo = new RepoRepository(db);
+    const branchRepo = new BranchRepository(db);
+    const repos = await repoRepo.findAll();
+    const branches = await branchRepo.findAll({ includeArchived: true });
+    const seen = /* @__PURE__ */ new Set();
+    let unsafeConfigUrls = 0;
+    let changedConfigs = 0;
+    let changedDbRows = 0;
+    const dbScan = await repoRepo.scanRemoteUrls();
+    const unsafeDbRows = dbScan.findings.length;
+    if (unsafeDbRows > 0) {
+      this.log(chalk.yellow(`persisted repo rows: ${unsafeDbRows} unsafe remote URL(s)`));
+      for (const finding of dbScan.findings) {
+        this.log(`  repo ${finding.slug} (${shortId(finding.repo_id)}): remote_url = <redacted>`);
+      }
+    }
+    if (flags.write) {
+      const dbScrub = await repoRepo.scrubRemoteUrls();
+      changedDbRows = dbScrub.changed;
+      if (dbScrub.changed > 0) {
+        this.log(
+          chalk.green(
+            `Scrubbed ${dbScrub.changed} persisted repo remote URL entr${dbScrub.changed === 1 ? "y" : "ies"}.`
+          )
+        );
+      }
+    }
+    for (const item of [
+      ...repos.map((repo) => ({
+        kind: "repo",
+        label: `${repo.slug} (${shortId(repo.repo_id)})`,
+        path: repo.local_path
+      })),
+      ...branches.map((branch) => ({
+        kind: "branch",
+        label: `${branch.name} (${shortId(branch.branch_id)})`,
+        path: branch.path
+      }))
+    ]) {
+      if (!item.path) continue;
+      const result = flags.write ? await scrubGitConfigRemoteCredentials(item.path) : await scanGitConfigRemoteCredentials(item.path);
+      const findings = result.findings.filter((finding) => {
+        const key = `${finding.configPath}\0${finding.remote}\0${finding.key}\0${finding.sanitizedUrl}`;
+        if (seen.has(key)) return false;
+        seen.add(key);
+        return true;
+      });
+      if (findings.length === 0) continue;
+      unsafeConfigUrls += findings.length;
+      if ("changed" in result && result.changed) {
+        changedConfigs += new Set(findings.map((finding) => finding.configPath)).size;
+      }
+      this.log(chalk.yellow(`${item.kind} ${item.label}: ${findings.length} unsafe remote URL(s)`));
+      for (const finding of findings) {
+        this.log(
+          `  ${finding.configPath}: remote "${finding.remote}" ${finding.key} = ${finding.redactedUrl}`
+        );
+      }
+    }
+    if (unsafeDbRows === 0 && unsafeConfigUrls === 0) {
+      this.log(chalk.green("No credential-bearing git remote URLs found."));
+      return;
+    }
+    if (flags.write) {
+      this.log(
+        chalk.green(
+          `Scrubbed ${changedDbRows} persisted repo row(s) and ${unsafeConfigUrls} credential-bearing remote URL(s) across ${changedConfigs} config file(s).`
+        )
+      );
+    } else {
+      this.log(
+        chalk.yellow(
+          `Found ${unsafeDbRows} persisted repo row(s) and ${unsafeConfigUrls} git config remote URL(s) with credential-bearing HTTP(S) userinfo. Re-run with --write to remove URL userinfo. Rotate any exposed token(s).`
+        )
+      );
+    }
+  }
+};
+export {
+  ScrubGitRemotes as default
+};

package/dist/cli/commands/admin/sync-unix.d.ts

@@ -1,18 +1,38 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Sync Unix Users and Groups
+ *
+ * Full sync of Unix users and groups with the Agor database. This command
+ * ensures all users, groups, and permissions are correctly configured.
+ *
+ * Default behavior (no flags needed):
+ * - Creates missing Unix users for users with unix_username set
+ * - Creates missing branch groups (agor_wt_*) and repo groups (agor_rp_*)
+ * - Backfills unix_group on branches that don't have one
+ * - Sets filesystem permissions on branches and repo directories (incl. .git)
+ * - Creates missing branch directories for non-archived branches
+ * - Adds users to their branch and repo groups
+ * - Prunes stale group memberships (users no longer owning a branch)
+ * - Ensures agor_users group exists and contains all managed users
+ * - Applies daemon user ACLs on branch directories
+ * - Syncs user symlinks (creates missing, removes broken)
+ *
+ * Cleanup (opt-in, destructive):
+ * - --cleanup: Deletes stale users and groups not in database
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class SyncUnix extends Command {
+export default class SyncUnix extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
-        cleanup: _oclif_core_interfaces.BooleanFlag<boolean>;
-        'cleanup-groups': _oclif_core_interfaces.BooleanFlag<boolean>;
-        'cleanup-users': _oclif_core_interfaces.BooleanFlag<boolean>;
-        'branch-id': _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        cleanup: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'cleanup-groups': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'cleanup-users': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'branch-id': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }
-
-export { SyncUnix as default };
+//# sourceMappingURL=sync-unix.d.ts.map

package/dist/cli/commands/admin/sync-unix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-unix.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/sync-unix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA4CH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AA8B7C,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,OAAO;IAC3C,OAAgB,WAAW,SACwS;IAEnU,OAAgB,QAAQ,WAMtB;IAEF,OAAgB,KAAK;;;;;;;MA6BnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA2iD3B"}

package/dist/cli/commands/admin/sync-user-symlinks.d.ts

@@ -1,16 +1,23 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * Admin Command: Sync User Symlinks
+ *
+ * PRIVILEGED OPERATION - Must be called via sudo
+ *
+ * Cleans up broken symlinks in a user's ~/agor/worktrees directory.
+ * This command is designed to be called by the daemon via `sudo agor admin sync-user-symlinks`.
+ *
+ * @see context/guides/rbac-and-unix-isolation.md
+ */
 import { Command } from '@oclif/core';
-
-declare class SyncUserSymlinks extends Command {
+export default class SyncUserSymlinks extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        username: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'home-base': _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
-        'dry-run': _oclif_core_interfaces.BooleanFlag<boolean>;
-        verbose: _oclif_core_interfaces.BooleanFlag<boolean>;
+        username: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'home-base': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }
-
-export { SyncUserSymlinks as default };
+//# sourceMappingURL=sync-user-symlinks.d.ts.map

package/dist/cli/commands/admin/sync-user-symlinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-user-symlinks.d.ts","sourceRoot":"","sources":["../../../src/commands/admin/sync-user-symlinks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AASH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,OAAO,OAAO,gBAAiB,SAAQ,OAAO;IACnD,OAAgB,WAAW,SAAsE;IAEjG,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;;MAoBnB;IAEW,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAoClC"}

package/dist/cli/commands/auth/login.d.ts

@@ -1,14 +1,16 @@
-import * as _oclif_core_interfaces from '@oclif/core/interfaces';
+/**
+ * `agor login` - Authenticate with daemon
+ *
+ * Prompts for email/password and stores JWT token for future CLI commands
+ */
 import { Command } from '@oclif/core';
-
-declare class Login extends Command {
+export default class Login extends Command {
     static description: string;
     static examples: string[];
     static flags: {
-        email: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
-        password: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
+        email: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        password: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }
-
-export { Login as default };
+//# sourceMappingURL=login.d.ts.map

package/dist/cli/commands/auth/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,OAAO,EAAS,MAAM,aAAa,CAAC;AAK7C,MAAM,CAAC,OAAO,OAAO,KAAM,SAAQ,OAAO;IACxC,MAAM,CAAC,WAAW,SAAmC;IAErD,MAAM,CAAC,QAAQ,WAGb;IAEF,MAAM,CAAC,KAAK;;;MASV;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA0H3B"}

package/dist/cli/commands/auth/login.js

@@ -55,7 +55,7 @@ var Login = class _Login extends Command {
           message: "Email",
           default: email,
           validate: (input) => {
-            if (!input || !input.includes("@")) {
+            if (!input?.includes("@")) {
               return "Please enter a valid email address";
             }
             return true;

package/dist/cli/commands/auth/logout.d.ts

@@ -1,15 +1,12 @@
-import { Command } from '@oclif/core';
-
 /**
  * `agor logout` - Clear stored authentication token
  *
  * Removes JWT token from disk
  */
-
-declare class Logout extends Command {
+import { Command } from '@oclif/core';
+export default class Logout extends Command {
     static description: string;
     static examples: string[];
     run(): Promise<void>;
 }
-
-export { Logout as default };
+//# sourceMappingURL=logout.d.ts.map

package/dist/cli/commands/auth/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/logout.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAC,WAAW,SAAkD;IAEpE,MAAM,CAAC,QAAQ,WAA2C;IAEpD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB3B"}

package/dist/cli/commands/auth/whoami.d.ts

@@ -1,15 +1,12 @@
-import { Command } from '@oclif/core';
-
 /**
  * `agor whoami` - Show current authenticated user
  *
  * Displays information about the currently authenticated user
  */
-
-declare class Whoami extends Command {
+import { Command } from '@oclif/core';
+export default class Whoami extends Command {
     static description: string;
     static examples: string[];
     run(): Promise<void>;
 }
-
-export { Whoami as default };
+//# sourceMappingURL=whoami.d.ts.map

package/dist/cli/commands/auth/whoami.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"whoami.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/whoami.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAItC,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,OAAO;IACzC,MAAM,CAAC,WAAW,SAAqC;IAEvD,MAAM,CAAC,QAAQ,WAA2C;IAEpD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkC3B"}