agor-live 0.21.2 → 0.22.0

package/dist/core/index.js

@@ -65,8 +65,8 @@ var init_constants = __esm({
        * Logs command timeout in milliseconds
        * How long to wait for logs command to complete
        */
-      LOGS_TIMEOUT_MS: 1e4,
-      // 10 seconds
+      LOGS_TIMEOUT_MS: 3e4,
+      // 30 seconds
       /**
        * Maximum number of log lines to return from logs command
        * Prevents daemon crashes from massive log outputs
@@ -591,6 +591,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -605,8 +608,11 @@ async function requirePublicBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   throw new PublicBaseUrlNotConfiguredError(
-    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
+    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` (preferred) / `ui.base_url` (legacy) in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
   );
 }
 function loadConfigSync() {
@@ -1766,6 +1772,15 @@ function getDefaultPermissionMode(agenticTool) {
       return "auto";
   }
 }
+function sessionCanStartTask(status, readyForPrompt) {
+  return status === SessionStatus.IDLE || status === SessionStatus.FAILED && readyForPrompt === true;
+}
+function isSessionPromptable(session) {
+  return sessionCanStartTask(session.status, session.ready_for_prompt);
+}
+function isSessionExecuting(session) {
+  return EXECUTING_SESSION_STATUSES.has(session.status);
+}
 function isGatewaySession(session) {
   const ctx = session.custom_context;
   return !!ctx?.gateway_source;
@@ -1783,7 +1798,7 @@ function getSessionType(session) {
   if (session.scheduled_from_branch) return "scheduled";
   return "agent";
 }
-var SessionStatus;
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
@@ -1801,6 +1816,12 @@ var init_session = __esm({
       COMPLETED: "completed",
       FAILED: "failed"
     };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1811,7 +1832,10 @@ function isNaturalCompletion(status) {
 function isTerminalTaskStatus(status) {
   return status !== void 0 && TERMINAL_TASK_STATUSES.has(status);
 }
-var TaskStatus, TERMINAL_TASK_STATUSES;
+function isTaskExecuting(task) {
+  return EXECUTING_TASK_STATUSES.has(task.status);
+}
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -1839,6 +1863,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -2040,6 +2070,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -2063,7 +2095,7 @@ import {
   uniqueIndex,
   varchar
 } from "drizzle-orm/pg-core";
-var bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -2156,6 +2188,36 @@ var init_schema_postgres = __esm({
         scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships = pgTable(
+      "session_relationships",
+      {
+        relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: text("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: varchar("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: varchar("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks = pgTable(
       "tasks",
       {
@@ -2692,6 +2754,12 @@ var init_schema_postgres = __esm({
         branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: varchar("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
         description: text("description"),
@@ -2718,6 +2786,7 @@ var init_schema_postgres = __esm({
       },
       (table) => ({
         branchIdx: index("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index("artifacts_board_idx").on(table.board_id),
         archivedIdx: index("artifacts_archived_idx").on(table.archived),
         publicIdx: index("artifacts_public_idx").on(table.public)
@@ -2874,7 +2943,7 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: text("name").notNull(),
         channel_type: text("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
@@ -3258,7 +3327,7 @@ var init_schema_postgres = __esm({
         archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = relations(sessions, ({ one }) => ({
+    sessionsRelations = relations(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -3266,6 +3335,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = relations(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = relations(branches, ({ many }) => ({
@@ -3318,6 +3405,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -3336,7 +3425,7 @@ import {
   text as text2,
   uniqueIndex as uniqueIndex2
 } from "drizzle-orm/sqlite-core";
-var t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -3426,6 +3515,36 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: uniqueIndex2("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql3`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = sqliteTable(
+      "session_relationships",
+      {
+        relationship_id: text2("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: text2("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: text2("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: text2("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: text2("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: text2("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = sqliteTable(
       "tasks",
       {
@@ -3970,6 +4089,12 @@ var init_schema_sqlite = __esm({
         branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: text2("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: text2("name").notNull(),
         description: text2("description"),
@@ -3996,6 +4121,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: index2("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index2("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index2("artifacts_board_idx").on(table.board_id),
         archivedIdx: index2("artifacts_archived_idx").on(table.archived),
         publicIdx: index2("artifacts_public_idx").on(table.public)
@@ -4154,7 +4280,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: text2("name").notNull(),
         channel_type: text2("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: text2("agor_user_id", { length: 36 }).notNull(),
@@ -4537,7 +4663,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: index2("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = relations2(sessions2, ({ one }) => ({
+    sessionsRelations2 = relations2(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -4545,6 +4671,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = relations2(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = relations2(branches2, ({ many }) => ({
@@ -4640,6 +4784,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -4647,7 +4792,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -4679,6 +4824,7 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
@@ -5213,7 +5359,11 @@ function extendBranchesService(client) {
   const branchesService = client.service("branches");
   if (branchesService[BRANCHES_SERVICE_EXTENDED]) return;
   if (typeof branchesService.methods === "function") {
-    branchesService.methods("initializeUnixGroup", "ensureAssistantKnowledgeNamespace");
+    branchesService.methods(
+      "updateEnvironment",
+      "initializeUnixGroup",
+      "ensureAssistantKnowledgeNamespace"
+    );
   }
   branchesService[BRANCHES_SERVICE_EXTENDED] = true;
 }
@@ -6364,17 +6514,17 @@ init_esm_shims();
 init_esm_shims();
 init_ids();
 import {
-  and as and22,
+  and as and23,
   asc as asc3,
   desc as desc6,
-  eq as eq31,
+  eq as eq32,
   gt,
   gte,
-  inArray as inArray7,
+  inArray as inArray8,
   like as like16,
   lte as lte2,
-  or as or8,
-  sql as sql14
+  or as or9,
+  sql as sql15
 } from "drizzle-orm";
 import bcryptjs from "bcryptjs";
 
@@ -6502,8 +6652,8 @@ function createPostgresDatabase(config) {
     if (config.ssl !== void 0) {
       options.ssl = config.ssl;
     }
-    const sql15 = postgres(config.url, options);
-    return drizzlePostgres(sql15, { schema: schema_postgres_exports });
+    const sql16 = postgres(config.url, options);
+    return drizzlePostgres(sql16, { schema: schema_postgres_exports });
   } catch (error) {
     throw new DatabaseConnectionError(
       `Failed to create PostgreSQL client: ${error instanceof Error ? error.message : String(error)}`,
@@ -7087,6 +7237,7 @@ var ArtifactRepository = class {
     return {
       artifact_id: artifactId,
       branch_id: row.branch_id ?? null,
+      source_session_id: row.source_session_id ?? null,
       board_id: row.board_id,
       name: row.name,
       description: row.description ?? void 0,
@@ -7125,6 +7276,7 @@ var ArtifactRepository = class {
       const insertData = {
         artifact_id: artifactId,
         branch_id: data.branch_id ?? null,
+        source_session_id: data.source_session_id ?? null,
         board_id: data.board_id ?? "",
         name: data.name ?? "Untitled Artifact",
         description: data.description ?? null,
@@ -7277,6 +7429,9 @@ var ArtifactRepository = class {
         setData.agor_grants = updates.agor_grants ?? null;
       }
       if (updates.public !== void 0) setData.public = updates.public;
+      if (updates.source_session_id !== void 0) {
+        setData.source_session_id = updates.source_session_id ?? null;
+      }
       if (updates.archived !== void 0) setData.archived = updates.archived;
       if (updates.archived_at !== void 0) {
         setData.archived_at = updates.archived_at ? new Date(updates.archived_at) : null;
@@ -8502,6 +8657,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -8995,6 +9151,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where(eq13(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where(eq13(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, eq13(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and9(eq13(groups3.group_id, branchGroupGrants3.group_id), eq13(groups3.archived, false))
+    ).where(
+      and9(
+        eq13(branchGroupGrants3.branch_id, branchId),
+        inArray3(
+          sql7`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where(eq13(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, eq13(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and9(eq13(groups3.group_id, boardGroupGrants3.group_id), eq13(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      and9(
+        eq13(boards3.board_id, boardGroupGrants3.board_id),
+        eq13(
+          sql7`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      and9(
+        eq13(boardGroupGrants3.board_id, branchRow.board_id),
+        inArray3(
+          sql7`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      and9(
+        eq13(branches3.board_id, boardId),
+        eq13(branches3.permission_source, "board"),
+        eq13(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -10570,8 +10803,10 @@ var SENSITIVE_CONFIG_FIELDS = [
   "signing_secret",
   // Slack
   "private_key",
-  "webhook_secret"
+  "webhook_secret",
   // GitHub
+  "app_password"
+  // Teams (Azure Bot App Secret)
 ];
 var REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function encryptConfig(config) {
@@ -14269,13 +14504,173 @@ var SessionMCPServerRepository = class {
   }
 };
 
+// src/db/repositories/session-relationships.ts
+init_esm_shims();
+init_ids();
+init_database_wrapper();
+init_schema();
+import { and as and19, eq as eq26, inArray as inArray6, or as or8 } from "drizzle-orm";
+var SessionRelationshipRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  rowToRelationship(row) {
+    return {
+      relationship_id: row.relationship_id,
+      source_session_id: row.source_session_id,
+      target_session_id: row.target_session_id,
+      relationship_type: row.relationship_type,
+      created_by: row.created_by,
+      created_at: new Date(row.created_at).toISOString(),
+      updated_at: row.updated_at ? new Date(row.updated_at).toISOString() : null,
+      callback_enabled: Boolean(row.callback_enabled),
+      callback_session_id: row.callback_session_id ?? null,
+      data: row.data ?? null
+    };
+  }
+  async create(input) {
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const row = {
+        relationship_id: generateId(),
+        source_session_id: input.source_session_id,
+        target_session_id: input.target_session_id,
+        relationship_type: input.relationship_type,
+        created_by: input.created_by,
+        created_at: now,
+        updated_at: now,
+        callback_enabled: input.callback_enabled ?? false,
+        callback_session_id: input.callback_session_id ?? null,
+        data: input.data ?? null
+      };
+      await insert(this.db, sessionRelationships3).values(row).run();
+      return this.rowToRelationship(row);
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to create session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async get(relationshipId) {
+    try {
+      const row = await select(this.db).from(sessionRelationships3).where(eq26(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to get session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSession(sessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        or8(
+          eq26(sessionRelationships3.source_session_id, sessionId),
+          eq26(sessionRelationships3.target_session_id, sessionId)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSessions(sessionIds) {
+    if (sessionIds.length === 0) return [];
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        or8(
+          inArray6(sessionRelationships3.source_session_id, sessionIds),
+          inArray6(sessionRelationships3.target_session_id, sessionIds)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteChildren(sourceSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        and19(
+          eq26(sessionRelationships3.source_session_id, sourceSessionId),
+          eq26(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote child relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteParents(targetSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        and19(
+          eq26(sessionRelationships3.target_session_id, targetSessionId),
+          eq26(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote parent relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabled(relationshipId, callbackEnabled) {
+    try {
+      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(eq26(sessionRelationships3.relationship_id, relationshipId)).run();
+      if (result.rowsAffected === 0) {
+        throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      }
+      const row = await select(this.db).from(sessionRelationships3).where(eq26(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to update session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabledForTargetSession(targetSessionId, callbackEnabled) {
+    try {
+      await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(
+        and19(
+          eq26(sessionRelationships3.target_session_id, targetSessionId),
+          eq26(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to update target session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+};
+
 // src/db/repositories/tasks.ts
 init_esm_shims();
 init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq26, inArray as inArray6, like as like13, sql as sql13 } from "drizzle-orm";
+import { eq as eq27, inArray as inArray7, like as like13, sql as sql13 } from "drizzle-orm";
 var TaskRepository = class {
   constructor(db) {
     this.db = db;
@@ -14371,7 +14766,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -14395,7 +14790,7 @@ var TaskRepository = class {
       const inserts = taskList.map((task) => this.taskToInsert(task));
       await insert(this.db, tasks3).values(inserts).run();
       const taskIds = inserts.map((t3) => t3.task_id);
-      const rows = await select(this.db).from(tasks3).where(inArray6(tasks3.task_id, taskIds)).all();
+      const rows = await select(this.db).from(tasks3).where(inArray7(tasks3.task_id, taskIds)).all();
       const rowsById = new Map(rows.map((r) => [r.task_id, r]));
       return taskIds.map((id) => this.rowToTask(rowsById.get(id)));
     } catch (error) {
@@ -14411,7 +14806,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14441,7 +14836,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14455,7 +14850,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14511,7 +14906,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14533,8 +14928,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq26(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq27(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -14548,7 +14943,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where(eq26(tasks3.task_id, fullId)).run();
+        }).where(eq27(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -14567,7 +14962,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where(eq26(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where(eq27(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -14629,7 +15024,7 @@ var TaskRepository = class {
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -14670,7 +15065,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq26(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq27(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -14687,7 +15082,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, eq as eq27, like as like14, lt as lt2 } from "drizzle-orm";
+import { and as and20, eq as eq28, like as like14, lt as lt2 } from "drizzle-orm";
 var ThreadSessionMapRepository = class {
   constructor(db) {
     this.db = db;
@@ -14757,7 +15152,7 @@ var ThreadSessionMapRepository = class {
         id: data.id ?? generateId()
       });
       await insert(this.db, threadSessionMap3).values(insertData).run();
-      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.id, insertData.id)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.id, insertData.id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created thread-session mapping");
       }
@@ -14776,7 +15171,7 @@ var ThreadSessionMapRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.id, fullId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.id, fullId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14817,7 +15212,7 @@ var ThreadSessionMapRepository = class {
         status: insertData.status,
         last_message_at: insertData.last_message_at,
         metadata: insertData.metadata
-      }).where(eq27(threadSessionMap3.id, fullId)).run();
+      }).where(eq28(threadSessionMap3.id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated thread-session mapping");
@@ -14838,7 +15233,7 @@ var ThreadSessionMapRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, threadSessionMap3).where(eq27(threadSessionMap3.id, fullId)).run();
+      const result = await deleteFrom(this.db, threadSessionMap3).where(eq28(threadSessionMap3.id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("ThreadSessionMap", id);
       }
@@ -14856,7 +15251,7 @@ var ThreadSessionMapRepository = class {
   async findByChannelAndThread(channelId, threadId) {
     try {
       const row = await select(this.db).from(threadSessionMap3).where(
-        and19(eq27(threadSessionMap3.channel_id, channelId), eq27(threadSessionMap3.thread_id, threadId))
+        and20(eq28(threadSessionMap3.channel_id, channelId), eq28(threadSessionMap3.thread_id, threadId))
       ).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
@@ -14873,7 +15268,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByThread(threadId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.thread_id, threadId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.thread_id, threadId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14887,7 +15282,7 @@ var ThreadSessionMapRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.session_id, sessionId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.session_id, sessionId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14901,11 +15296,11 @@ var ThreadSessionMapRepository = class {
    */
   async findByChannel(channelId, status) {
     try {
-      const conditions = [eq27(threadSessionMap3.channel_id, channelId)];
+      const conditions = [eq28(threadSessionMap3.channel_id, channelId)];
       if (status) {
-        conditions.push(eq27(threadSessionMap3.status, status));
+        conditions.push(eq28(threadSessionMap3.status, status));
       }
-      const rows = await select(this.db).from(threadSessionMap3).where(and19(...conditions)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where(and20(...conditions)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14921,7 +15316,7 @@ var ThreadSessionMapRepository = class {
     try {
       await update(this.db, threadSessionMap3).set({
         last_message_at: /* @__PURE__ */ new Date()
-      }).where(eq27(threadSessionMap3.id, id)).run();
+      }).where(eq28(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update last message timestamp: ${error instanceof Error ? error.message : String(error)}`,
@@ -14934,7 +15329,7 @@ var ThreadSessionMapRepository = class {
    */
   async updateMetadata(id, metadata) {
     try {
-      await update(this.db, threadSessionMap3).set({ metadata }).where(eq27(threadSessionMap3.id, id)).run();
+      await update(this.db, threadSessionMap3).set({ metadata }).where(eq28(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update metadata: ${error instanceof Error ? error.message : String(error)}`,
@@ -14949,7 +15344,7 @@ var ThreadSessionMapRepository = class {
     try {
       const cutoff = new Date(Date.now() - daysInactive * 24 * 60 * 60 * 1e3);
       const rows = await select(this.db).from(threadSessionMap3).where(
-        and19(eq27(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
+        and20(eq28(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
       ).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
@@ -14964,7 +15359,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByBranch(branchId) {
     try {
-      const rows = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.branch_id, branchId)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.branch_id, branchId)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14982,7 +15377,7 @@ init_database_wrapper();
 init_schema();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and20, eq as eq28 } from "drizzle-orm";
+import { and as and21, eq as eq29 } from "drizzle-orm";
 var KEY_PREFIX = "agor_sk_";
 var KEY_PREFIX_LENGTH = 12;
 var KEY_RANDOM_BYTES = 32;
@@ -15019,7 +15414,7 @@ var UserApiKeysRepository = class {
   }
   /** List all API keys for a user (never returns hashes) */
   async listByUser(userId) {
-    const rows = await select(this.db).from(userApiKeys3).where(eq28(userApiKeys3.user_id, userId)).all();
+    const rows = await select(this.db).from(userApiKeys3).where(eq29(userApiKeys3.user_id, userId)).all();
     return rows.map((r) => ({
       id: r.id,
       name: r.name,
@@ -15030,7 +15425,7 @@ var UserApiKeysRepository = class {
   }
   /** Find a key by prefix (for auth lookup). Returns rows with hash for verification. */
   async findByPrefix(prefix) {
-    return select(this.db).from(userApiKeys3).where(eq28(userApiKeys3.prefix, prefix)).all();
+    return select(this.db).from(userApiKeys3).where(eq29(userApiKeys3.prefix, prefix)).all();
   }
   /** Verify a raw API key against stored hashes. Returns the matching row or null. */
   async verifyKey(rawKey) {
@@ -15045,19 +15440,19 @@ var UserApiKeysRepository = class {
   }
   /** Update last_used_at timestamp */
   async updateLastUsed(id) {
-    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq28(userApiKeys3.id, id)).run();
+    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq29(userApiKeys3.id, id)).run();
   }
   /** Update key name */
   async updateName(id, userId, name) {
-    await update(this.db, userApiKeys3).set({ name }).where(and20(eq28(userApiKeys3.id, id), eq28(userApiKeys3.user_id, userId))).run();
+    await update(this.db, userApiKeys3).set({ name }).where(and21(eq29(userApiKeys3.id, id), eq29(userApiKeys3.user_id, userId))).run();
   }
   /** Delete a key */
   async delete(id, userId) {
-    await deleteFrom(this.db, userApiKeys3).where(and20(eq28(userApiKeys3.id, id), eq28(userApiKeys3.user_id, userId))).run();
+    await deleteFrom(this.db, userApiKeys3).where(and21(eq29(userApiKeys3.id, id), eq29(userApiKeys3.user_id, userId))).run();
   }
   /** Delete all keys for a user */
   async deleteAllForUser(userId) {
-    await deleteFrom(this.db, userApiKeys3).where(eq28(userApiKeys3.user_id, userId)).run();
+    await deleteFrom(this.db, userApiKeys3).where(eq29(userApiKeys3.user_id, userId)).run();
   }
 };
 
@@ -15065,7 +15460,7 @@ var UserApiKeysRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and21, eq as eq29, isNull as isNull6 } from "drizzle-orm";
+import { and as and22, eq as eq30, isNull as isNull6 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -15080,9 +15475,9 @@ function rowToToken(row) {
   };
 }
 function matchKey(userId, serverId) {
-  return and21(
-    userId === null ? isNull6(userMcpOauthTokens3.user_id) : eq29(userMcpOauthTokens3.user_id, userId),
-    eq29(userMcpOauthTokens3.mcp_server_id, serverId)
+  return and22(
+    userId === null ? isNull6(userMcpOauthTokens3.user_id) : eq30(userMcpOauthTokens3.user_id, userId),
+    eq30(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -15199,7 +15594,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -15210,7 +15605,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -15221,7 +15616,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -15239,7 +15634,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types2();
-import { eq as eq30, like as like15 } from "drizzle-orm";
+import { eq as eq31, like as like15, sql as sql14 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -15339,7 +15734,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where(eq30(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -15362,7 +15757,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -15374,7 +15769,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -15390,12 +15785,41 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where(eq30(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.email, email)).one();
     if (!result) {
       return null;
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(sql14`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -15432,8 +15856,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+    }).where(eq31(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -15444,7 +15868,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where(eq30(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -15452,7 +15876,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -15534,7 +15958,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -15560,7 +15984,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
 };
 
@@ -15604,7 +16028,7 @@ async function resolveApiKey(keyName, context = {}) {
   );
   if (context.userId && context.db) {
     debugKeyResolution(`   \u2192 Checking user-level configuration...`);
-    const row = await select(context.db).from(users3).where(eq31(users3.user_id, context.userId)).one();
+    const row = await select(context.db).from(users3).where(eq32(users3.user_id, context.userId)).one();
     if (row) {
       const data = row.data;
       let encryptedKey;
@@ -16309,8 +16733,8 @@ function getDefaultGitConfigParameters() {
 }
 function gitConfigParameterKey(pair) {
   const trimmed = pair.trim();
-  const eq32 = trimmed.indexOf("=");
-  return eq32 >= 0 ? trimmed.slice(0, eq32) : trimmed;
+  const eq33 = trimmed.indexOf("=");
+  return eq33 >= 0 ? trimmed.slice(0, eq33) : trimmed;
 }
 function validateGitConfigParameterList(value, path3) {
   if (value === void 0 || value === null) return void 0;
@@ -18036,11 +18460,6 @@ function buildMCPTemplateContextFromEnv(env) {
       userEnv[key] = value;
     }
   }
-  if (allowedKeys.size > 0) {
-    console.log(
-      `   \u{1F510} MCP template context: ${allowedKeys.size} user env var(s) available for templates`
-    );
-  }
   return {
     user: {
       env: userEnv
@@ -19964,6 +20383,30 @@ var UnixIntegrationService = class {
     this.usersRepo = new UsersRepository(db);
     this.repoRepo = new RepoRepository(db);
   }
+  async getUnixUsernamesForUsers(userIds) {
+    const unixUsernames = /* @__PURE__ */ new Set();
+    for (const userId of userIds) {
+      const user = await this.usersRepo.findById(userId);
+      if (user?.unix_username) {
+        unixUsernames.add(user.unix_username);
+      }
+    }
+    return unixUsernames;
+  }
+  async reconcileUnixGroupMembers(groupName, allowedUnixUsernames, options) {
+    if (this.config.daemonUser) {
+      allowedUnixUsernames.add(this.config.daemonUser);
+    }
+    const result = await this.executor.exec(UnixGroupCommands.listGroupMembers(groupName));
+    const currentMembers = result.stdout.trim().split(",").filter(Boolean);
+    for (const unixUsername of currentMembers) {
+      if (allowedUnixUsernames.has(unixUsername)) continue;
+      console.log(
+        `[UnixIntegration] Removing stale ${options.label} group member ${unixUsername} from ${groupName}`
+      );
+      await this.executor.exec(UnixGroupCommands.removeUserFromGroup(unixUsername, groupName));
+    }
+  }
   /**
    * Get the configured daemon user
    *
@@ -20207,19 +20650,26 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing branch
    *
-   * Creates group and adds all current owners.
+   * Creates group and adds all users with explicit filesystem access.
    *
    * @param branchId - Branch ID
    */
   async initializeBranchGroup(branchId) {
     const groupName = await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "branch"
+    });
     console.log(
-      `[UnixIntegration] Initialized group ${groupName} with ${ownerIds.length} owner(s)`
+      `[UnixIntegration] Initialized group ${groupName} with ${userIds.length} explicit filesystem user(s)`
     );
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
+    }
   }
   // ============================================================
   // REPO GROUP MANAGEMENT
@@ -20451,8 +20901,8 @@ var UnixIntegrationService = class {
   /**
    * Check if a user should be in a repo's Unix group
    *
-   * A user should be in the repo group if they have ownership
-   * of ANY branch in that repo.
+   * A user should be in the repo group if they have explicit filesystem access
+   * to ANY branch in that repo.
    *
    * @param repoId - Repo ID
    * @param userId - User ID to check
@@ -20461,8 +20911,8 @@ var UnixIntegrationService = class {
   async shouldUserBeInRepoGroup(repoId, userId) {
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
     for (const wt of branches4) {
-      const isOwner = await this.branchRepo.isOwner(wt.branch_id, userId);
-      if (isOwner) {
+      const userIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      if (userIds.includes(userId)) {
         return true;
       }
     }
@@ -20471,33 +20921,36 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing repo
    *
-   * Creates group, sets .git permissions, and adds all users who
-   * own any branch in the repo.
+   * Creates group, sets .git permissions, and adds all users who have explicit
+   * filesystem access to any branch in the repo.
    *
    * @param repoId - Repo ID
    */
   async initializeRepoGroup(repoId) {
     const groupName = await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "repo"
+    });
     console.log(
-      `[UnixIntegration] Initialized repo group ${groupName} with ${ownerIds.size} unique owner(s)`
+      `[UnixIntegration] Initialized repo group ${groupName} with ${userIds.size} unique filesystem user(s)`
     );
   }
   /**
    * Full sync for a repo
    *
    * Ensures repo group exists, .git permissions are set, and all
-   * branch owners are in the repo group.
+   * branch filesystem-access users are in the repo group.
    *
    * @param repoId - Repo ID
    */
@@ -20505,15 +20958,23 @@ var UnixIntegrationService = class {
     console.log(`[UnixIntegration] Full sync for repo ${shortId(repoId)}`);
     await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
+    }
+    const repo = await this.repoRepo.findById(repoId);
+    if (repo?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        repo.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "repo" }
+      );
     }
   }
   // ============================================================
@@ -20790,16 +21251,28 @@ var UnixIntegrationService = class {
   /**
    * Full sync for a branch
    *
-   * Ensures group exists, all owners are in group, and symlinks are created.
+   * Ensures group exists, all explicit filesystem-access users are in group,
+   * and symlinks are created.
    *
    * @param branchId - Branch ID
    */
   async syncBranch(branchId) {
     console.log(`[UnixIntegration] Full sync for branch ${shortId(branchId)}`);
     await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
+    }
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        branch.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "branch" }
+      );
+    }
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
     }
   }
   /**
@@ -20954,6 +21427,8 @@ export {
   ENV_COMMAND_DENY_PATTERNS,
   ENV_VAR_CONSTRAINTS,
   ENV_VAR_SCOPES_V05,
+  EXECUTING_SESSION_STATUSES,
+  EXECUTING_TASK_STATUSES,
   EXECUTOR_HEARTBEAT_DEFAULT_CALLBACK_TIMEOUT_MS,
   EXECUTOR_HEARTBEAT_DEFAULT_INTERVAL_MS,
   EXECUTOR_HEARTBEAT_MIN_STALE_AFTER_MS,
@@ -21031,6 +21506,7 @@ export {
   SerializedSessionRepository,
   SessionEnvSelectionRepository,
   SessionMCPServerRepository,
+  SessionRelationshipRepository,
   SessionRepository,
   SessionStatus,
   SudoCliExecutor,
@@ -21055,7 +21531,7 @@ export {
   __resetConfigCacheForTests,
   addSafeDirectoryBestEffort,
   advisoryLockKeyForUuid,
-  and22 as and,
+  and23 as and,
   appVariables3 as appVariables,
   applyKnowledgeEditOps,
   artifactTrustGrants3 as artifactTrustGrants,
@@ -21127,7 +21603,7 @@ export {
   enforcedAgentConfigSchema,
   ensureBranchStorageModeAllowed,
   ensureGitRemoteUrl,
-  eq31 as eq,
+  eq32 as eq,
   escapeShellArg,
   executeAll,
   executeGet,
@@ -21212,7 +21688,7 @@ export {
   hasRemoteBranch,
   hash,
   identifyUrlParam,
-  inArray7 as inArray,
+  inArray8 as inArray,
   initConfig,
   initializeDatabase,
   insert,
@@ -21242,7 +21718,10 @@ export {
   isServiceEnabled,
   isServiceExternallyAccessible,
   isServiceFullAccess,
+  isSessionExecuting,
+  isSessionPromptable,
   isShortId,
+  isTaskExecuting,
   isTerminalTaskStatus,
   isThreadRoot,
   isUnixGroupRefreshNeeded,
@@ -21286,7 +21765,7 @@ export {
   normalizeRole,
   normalizeStoredEnvMap,
   normalizeStoredEnvVar,
-  or8 as or,
+  or9 as or,
   parseAgorYml,
   parseAgorYmlString,
   parseBranchGroupName,
@@ -21347,15 +21826,17 @@ export {
   seedInitialData,
   select,
   serializedSessions3 as serializedSessions,
+  sessionCanStartTask,
   sessionEnvSelections3 as sessionEnvSelections,
   sessionMcpServers3 as sessionMcpServers,
+  sessionRelationships3 as sessionRelationships,
   sessions3 as sessions,
   setConfigValue,
   shortId,
   simpleGit,
   spawnEnvironmentCommand,
   splitSecretEnv,
-  sql14 as sql,
+  sql15 as sql,
   stripGitUrlCredentials,
   tasks3 as tasks,
   threadSessionMap3 as threadSessionMap,