agor-live 0.21.2 → 0.22.0

package/dist/core/unix/index.cjs

@@ -495,6 +495,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -509,8 +512,11 @@ async function requirePublicBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   throw new PublicBaseUrlNotConfiguredError(
-    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
+    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` (preferred) / `ui.base_url` (legacy) in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
   );
 }
 function loadConfigSync() {
@@ -1166,15 +1172,35 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
     init_cjs_shims();
+    SessionStatus = {
+      IDLE: "idle",
+      RUNNING: "running",
+      STOPPING: "stopping",
+      // Stop requested, waiting for task to stop
+      AWAITING_PERMISSION: "awaiting_permission",
+      AWAITING_INPUT: "awaiting_input",
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+      TIMED_OUT: "timed_out",
+      // Permission/input request timed out, executor exited — user must re-prompt
+      COMPLETED: "completed",
+      FAILED: "failed"
+    };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -1202,6 +1228,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1361,6 +1393,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -1369,7 +1403,7 @@ __export(schema_postgres_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens,
   users: () => users
 });
-var import_drizzle_orm2, import_pg_core, bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var import_drizzle_orm2, import_pg_core, bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -1464,6 +1498,36 @@ var init_schema_postgres = __esm({
         scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships = (0, import_pg_core.pgTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_pg_core.varchar)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_pg_core.varchar)("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_pg_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_pg_core.varchar)("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_pg_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_pg_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_pg_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: (0, import_pg_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks = (0, import_pg_core.pgTable)(
       "tasks",
       {
@@ -2000,6 +2064,12 @@ var init_schema_postgres = __esm({
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
         description: (0, import_pg_core.text)("description"),
@@ -2026,6 +2096,7 @@ var init_schema_postgres = __esm({
       },
       (table) => ({
         branchIdx: (0, import_pg_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_pg_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_pg_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_pg_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_pg_core.index)("artifacts_public_idx").on(table.public)
@@ -2182,7 +2253,7 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: (0, import_pg_core.text)("name").notNull(),
         channel_type: (0, import_pg_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_pg_core.varchar)("agor_user_id", { length: 36 }).notNull(),
@@ -2566,7 +2637,7 @@ var init_schema_postgres = __esm({
         archivedIdx: (0, import_pg_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = (0, import_drizzle_orm2.relations)(sessions, ({ one }) => ({
+    sessionsRelations = (0, import_drizzle_orm2.relations)(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -2574,6 +2645,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = (0, import_drizzle_orm2.relations)(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = (0, import_drizzle_orm2.relations)(branches, ({ many }) => ({
@@ -2626,6 +2715,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -2634,7 +2725,7 @@ __export(schema_sqlite_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens2,
   users: () => users2
 });
-var import_drizzle_orm3, import_sqlite_core, t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var import_drizzle_orm3, import_sqlite_core, t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2726,6 +2817,36 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: (0, import_sqlite_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm3.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = (0, import_sqlite_core.sqliteTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_sqlite_core.text)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_sqlite_core.text)("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_sqlite_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_sqlite_core.text)("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_sqlite_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_sqlite_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_sqlite_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: (0, import_sqlite_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = (0, import_sqlite_core.sqliteTable)(
       "tasks",
       {
@@ -3270,6 +3391,12 @@ var init_schema_sqlite = __esm({
         branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: (0, import_sqlite_core.text)("name").notNull(),
         description: (0, import_sqlite_core.text)("description"),
@@ -3296,6 +3423,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: (0, import_sqlite_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_sqlite_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_sqlite_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_sqlite_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_sqlite_core.index)("artifacts_public_idx").on(table.public)
@@ -3454,7 +3582,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: (0, import_sqlite_core.text)("name").notNull(),
         channel_type: (0, import_sqlite_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_sqlite_core.text)("agor_user_id", { length: 36 }).notNull(),
@@ -3837,7 +3965,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: (0, import_sqlite_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = (0, import_drizzle_orm3.relations)(sessions2, ({ one }) => ({
+    sessionsRelations2 = (0, import_drizzle_orm3.relations)(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3845,6 +3973,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = (0, import_drizzle_orm3.relations)(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = (0, import_drizzle_orm3.relations)(branches2, ({ many }) => ({
@@ -3940,6 +4086,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -3947,7 +4094,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3979,6 +4126,7 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
@@ -5253,7 +5401,7 @@ init_cjs_shims();
 
 // src/db/index.ts
 init_cjs_shims();
-var import_drizzle_orm34 = require("drizzle-orm");
+var import_drizzle_orm35 = require("drizzle-orm");
 var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
 init_ids();
 
@@ -5814,6 +5962,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -6307,6 +6456,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm16.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm16.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm16.and)(
+        (0, import_drizzle_orm16.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm16.inArray)(
+          import_drizzle_orm16.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where((0, import_drizzle_orm16.eq)(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm16.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm16.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm16.and)(
+        (0, import_drizzle_orm16.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm16.eq)(
+          import_drizzle_orm16.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      (0, import_drizzle_orm16.and)(
+        (0, import_drizzle_orm16.eq)(boardGroupGrants3.board_id, branchRow.board_id),
+        (0, import_drizzle_orm16.inArray)(
+          import_drizzle_orm16.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      (0, import_drizzle_orm16.and)(
+        (0, import_drizzle_orm16.eq)(branches3.board_id, boardId),
+        (0, import_drizzle_orm16.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm16.eq)(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -7119,10 +7345,17 @@ init_ids();
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/session-relationships.ts
+init_cjs_shims();
+var import_drizzle_orm29 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm30 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -7130,7 +7363,7 @@ init_schema();
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -7139,21 +7372,21 @@ init_schema();
 init_cjs_shims();
 var import_node_crypto5 = require("crypto");
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/users.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -7245,7 +7478,7 @@ var UsersRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "User", async (pattern) => {
-      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm33.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm34.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.user_id);
     });
   }
@@ -7253,7 +7486,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -7276,7 +7509,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -7288,7 +7521,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -7304,12 +7537,41 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.email, email)).one();
     if (!result) {
       return null;
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(import_drizzle_orm34.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -7346,8 +7608,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
+    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -7358,7 +7620,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -7366,7 +7628,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -7448,7 +7710,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -7474,7 +7736,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
   }
 };
 
@@ -8842,6 +9104,30 @@ var UnixIntegrationService = class {
     this.usersRepo = new UsersRepository(db);
     this.repoRepo = new RepoRepository(db);
   }
+  async getUnixUsernamesForUsers(userIds) {
+    const unixUsernames = /* @__PURE__ */ new Set();
+    for (const userId of userIds) {
+      const user = await this.usersRepo.findById(userId);
+      if (user?.unix_username) {
+        unixUsernames.add(user.unix_username);
+      }
+    }
+    return unixUsernames;
+  }
+  async reconcileUnixGroupMembers(groupName, allowedUnixUsernames, options) {
+    if (this.config.daemonUser) {
+      allowedUnixUsernames.add(this.config.daemonUser);
+    }
+    const result = await this.executor.exec(UnixGroupCommands.listGroupMembers(groupName));
+    const currentMembers = result.stdout.trim().split(",").filter(Boolean);
+    for (const unixUsername of currentMembers) {
+      if (allowedUnixUsernames.has(unixUsername)) continue;
+      console.log(
+        `[UnixIntegration] Removing stale ${options.label} group member ${unixUsername} from ${groupName}`
+      );
+      await this.executor.exec(UnixGroupCommands.removeUserFromGroup(unixUsername, groupName));
+    }
+  }
   /**
    * Get the configured daemon user
    *
@@ -9085,19 +9371,26 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing branch
    *
-   * Creates group and adds all current owners.
+   * Creates group and adds all users with explicit filesystem access.
    *
    * @param branchId - Branch ID
    */
   async initializeBranchGroup(branchId) {
     const groupName = await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "branch"
+    });
     console.log(
-      `[UnixIntegration] Initialized group ${groupName} with ${ownerIds.length} owner(s)`
+      `[UnixIntegration] Initialized group ${groupName} with ${userIds.length} explicit filesystem user(s)`
     );
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
+    }
   }
   // ============================================================
   // REPO GROUP MANAGEMENT
@@ -9329,8 +9622,8 @@ var UnixIntegrationService = class {
   /**
    * Check if a user should be in a repo's Unix group
    *
-   * A user should be in the repo group if they have ownership
-   * of ANY branch in that repo.
+   * A user should be in the repo group if they have explicit filesystem access
+   * to ANY branch in that repo.
    *
    * @param repoId - Repo ID
    * @param userId - User ID to check
@@ -9339,8 +9632,8 @@ var UnixIntegrationService = class {
   async shouldUserBeInRepoGroup(repoId, userId) {
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
     for (const wt of branches4) {
-      const isOwner = await this.branchRepo.isOwner(wt.branch_id, userId);
-      if (isOwner) {
+      const userIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      if (userIds.includes(userId)) {
         return true;
       }
     }
@@ -9349,33 +9642,36 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing repo
    *
-   * Creates group, sets .git permissions, and adds all users who
-   * own any branch in the repo.
+   * Creates group, sets .git permissions, and adds all users who have explicit
+   * filesystem access to any branch in the repo.
    *
    * @param repoId - Repo ID
    */
   async initializeRepoGroup(repoId) {
     const groupName = await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "repo"
+    });
     console.log(
-      `[UnixIntegration] Initialized repo group ${groupName} with ${ownerIds.size} unique owner(s)`
+      `[UnixIntegration] Initialized repo group ${groupName} with ${userIds.size} unique filesystem user(s)`
     );
   }
   /**
    * Full sync for a repo
    *
    * Ensures repo group exists, .git permissions are set, and all
-   * branch owners are in the repo group.
+   * branch filesystem-access users are in the repo group.
    *
    * @param repoId - Repo ID
    */
@@ -9383,15 +9679,23 @@ var UnixIntegrationService = class {
     console.log(`[UnixIntegration] Full sync for repo ${shortId(repoId)}`);
     await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
+    }
+    const repo = await this.repoRepo.findById(repoId);
+    if (repo?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        repo.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "repo" }
+      );
     }
   }
   // ============================================================
@@ -9668,16 +9972,28 @@ var UnixIntegrationService = class {
   /**
    * Full sync for a branch
    *
-   * Ensures group exists, all owners are in group, and symlinks are created.
+   * Ensures group exists, all explicit filesystem-access users are in group,
+   * and symlinks are created.
    *
    * @param branchId - Branch ID
    */
   async syncBranch(branchId) {
     console.log(`[UnixIntegration] Full sync for branch ${shortId(branchId)}`);
     await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
+    }
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        branch.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "branch" }
+      );
+    }
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
     }
   }
   /**