agor-live 0.21.2 → 0.22.0

package/dist/core/unix/index.js

@@ -480,6 +480,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -494,8 +497,11 @@ async function requirePublicBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   throw new PublicBaseUrlNotConfiguredError(
-    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
+    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` (preferred) / `ui.base_url` (legacy) in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
   );
 }
 function loadConfigSync() {
@@ -1145,15 +1151,35 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
     init_esm_shims();
+    SessionStatus = {
+      IDLE: "idle",
+      RUNNING: "running",
+      STOPPING: "stopping",
+      // Stop requested, waiting for task to stop
+      AWAITING_PERMISSION: "awaiting_permission",
+      AWAITING_INPUT: "awaiting_input",
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+      TIMED_OUT: "timed_out",
+      // Permission/input request timed out, executor exited — user must re-prompt
+      COMPLETED: "completed",
+      FAILED: "failed"
+    };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -1181,6 +1207,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1340,6 +1372,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -1363,7 +1397,7 @@ import {
   uniqueIndex,
   varchar
 } from "drizzle-orm/pg-core";
-var bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -1456,6 +1490,36 @@ var init_schema_postgres = __esm({
         scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships = pgTable(
+      "session_relationships",
+      {
+        relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: text("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: varchar("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: varchar("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks = pgTable(
       "tasks",
       {
@@ -1992,6 +2056,12 @@ var init_schema_postgres = __esm({
         branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: varchar("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
         description: text("description"),
@@ -2018,6 +2088,7 @@ var init_schema_postgres = __esm({
       },
       (table) => ({
         branchIdx: index("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index("artifacts_board_idx").on(table.board_id),
         archivedIdx: index("artifacts_archived_idx").on(table.archived),
         publicIdx: index("artifacts_public_idx").on(table.public)
@@ -2174,7 +2245,7 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: text("name").notNull(),
         channel_type: text("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
@@ -2558,7 +2629,7 @@ var init_schema_postgres = __esm({
         archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = relations(sessions, ({ one }) => ({
+    sessionsRelations = relations(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -2566,6 +2637,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = relations(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = relations(branches, ({ many }) => ({
@@ -2618,6 +2707,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -2636,7 +2727,7 @@ import {
   text as text2,
   uniqueIndex as uniqueIndex2
 } from "drizzle-orm/sqlite-core";
-var t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2726,6 +2817,36 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: uniqueIndex2("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql3`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = sqliteTable(
+      "session_relationships",
+      {
+        relationship_id: text2("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: text2("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: text2("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: text2("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: text2("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: text2("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = sqliteTable(
       "tasks",
       {
@@ -3270,6 +3391,12 @@ var init_schema_sqlite = __esm({
         branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: text2("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: text2("name").notNull(),
         description: text2("description"),
@@ -3296,6 +3423,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: index2("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index2("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index2("artifacts_board_idx").on(table.board_id),
         archivedIdx: index2("artifacts_archived_idx").on(table.archived),
         publicIdx: index2("artifacts_public_idx").on(table.public)
@@ -3454,7 +3582,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: text2("name").notNull(),
         channel_type: text2("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: text2("agor_user_id", { length: 36 }).notNull(),
@@ -3837,7 +3965,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: index2("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = relations2(sessions2, ({ one }) => ({
+    sessionsRelations2 = relations2(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3845,6 +3973,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = relations2(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = relations2(branches2, ({ many }) => ({
@@ -3940,6 +4086,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -3947,7 +4094,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3979,6 +4126,7 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
@@ -5177,17 +5325,17 @@ init_esm_shims();
 init_esm_shims();
 init_ids();
 import {
-  and as and22,
+  and as and23,
   asc as asc3,
   desc as desc6,
-  eq as eq31,
+  eq as eq32,
   gt,
   gte,
-  inArray as inArray7,
+  inArray as inArray8,
   like as like16,
   lte as lte2,
-  or as or8,
-  sql as sql14
+  or as or9,
+  sql as sql15
 } from "drizzle-orm";
 import bcryptjs from "bcryptjs";
 
@@ -5748,6 +5896,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -6241,6 +6390,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where(eq13(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where(eq13(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, eq13(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and9(eq13(groups3.group_id, branchGroupGrants3.group_id), eq13(groups3.archived, false))
+    ).where(
+      and9(
+        eq13(branchGroupGrants3.branch_id, branchId),
+        inArray3(
+          sql7`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where(eq13(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, eq13(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and9(eq13(groups3.group_id, boardGroupGrants3.group_id), eq13(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      and9(
+        eq13(boards3.board_id, boardGroupGrants3.board_id),
+        eq13(
+          sql7`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      and9(
+        eq13(boardGroupGrants3.board_id, branchRow.board_id),
+        inArray3(
+          sql7`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      and9(
+        eq13(branches3.board_id, boardId),
+        eq13(branches3.permission_source, "board"),
+        eq13(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -7053,13 +7279,20 @@ import { and as and17, desc as desc5, eq as eq24, inArray as inArray5, like as l
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/session-relationships.ts
+init_esm_shims();
+init_ids();
+init_database_wrapper();
+init_schema();
+import { and as and19, eq as eq26, inArray as inArray6, or as or8 } from "drizzle-orm";
+
 // src/db/repositories/tasks.ts
 init_esm_shims();
 init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq26, inArray as inArray6, like as like13, sql as sql13 } from "drizzle-orm";
+import { eq as eq27, inArray as inArray7, like as like13, sql as sql13 } from "drizzle-orm";
 
 // src/db/repositories/thread-session-map.ts
 init_esm_shims();
@@ -7067,7 +7300,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, eq as eq27, like as like14, lt as lt2 } from "drizzle-orm";
+import { and as and20, eq as eq28, like as like14, lt as lt2 } from "drizzle-orm";
 
 // src/db/repositories/user-api-keys.ts
 init_esm_shims();
@@ -7076,18 +7309,18 @@ init_database_wrapper();
 init_schema();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and20, eq as eq28 } from "drizzle-orm";
+import { and as and21, eq as eq29 } from "drizzle-orm";
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and21, eq as eq29, isNull as isNull6 } from "drizzle-orm";
+import { and as and22, eq as eq30, isNull as isNull6 } from "drizzle-orm";
 
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types2();
-import { eq as eq30, like as like15 } from "drizzle-orm";
+import { eq as eq31, like as like15, sql as sql14 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -7187,7 +7420,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where(eq30(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -7210,7 +7443,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -7222,7 +7455,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -7238,12 +7471,41 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where(eq30(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where(eq31(users3.email, email)).one();
     if (!result) {
       return null;
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(sql14`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -7280,8 +7542,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+    }).where(eq31(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -7292,7 +7554,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where(eq30(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -7300,7 +7562,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -7382,7 +7644,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -7408,7 +7670,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq30(users3.user_id, fullId)).run();
+    }).where(eq31(users3.user_id, fullId)).run();
   }
 };
 
@@ -8776,6 +9038,30 @@ var UnixIntegrationService = class {
     this.usersRepo = new UsersRepository(db);
     this.repoRepo = new RepoRepository(db);
   }
+  async getUnixUsernamesForUsers(userIds) {
+    const unixUsernames = /* @__PURE__ */ new Set();
+    for (const userId of userIds) {
+      const user = await this.usersRepo.findById(userId);
+      if (user?.unix_username) {
+        unixUsernames.add(user.unix_username);
+      }
+    }
+    return unixUsernames;
+  }
+  async reconcileUnixGroupMembers(groupName, allowedUnixUsernames, options) {
+    if (this.config.daemonUser) {
+      allowedUnixUsernames.add(this.config.daemonUser);
+    }
+    const result = await this.executor.exec(UnixGroupCommands.listGroupMembers(groupName));
+    const currentMembers = result.stdout.trim().split(",").filter(Boolean);
+    for (const unixUsername of currentMembers) {
+      if (allowedUnixUsernames.has(unixUsername)) continue;
+      console.log(
+        `[UnixIntegration] Removing stale ${options.label} group member ${unixUsername} from ${groupName}`
+      );
+      await this.executor.exec(UnixGroupCommands.removeUserFromGroup(unixUsername, groupName));
+    }
+  }
   /**
    * Get the configured daemon user
    *
@@ -9019,19 +9305,26 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing branch
    *
-   * Creates group and adds all current owners.
+   * Creates group and adds all users with explicit filesystem access.
    *
    * @param branchId - Branch ID
    */
   async initializeBranchGroup(branchId) {
     const groupName = await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "branch"
+    });
     console.log(
-      `[UnixIntegration] Initialized group ${groupName} with ${ownerIds.length} owner(s)`
+      `[UnixIntegration] Initialized group ${groupName} with ${userIds.length} explicit filesystem user(s)`
     );
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
+    }
   }
   // ============================================================
   // REPO GROUP MANAGEMENT
@@ -9263,8 +9556,8 @@ var UnixIntegrationService = class {
   /**
    * Check if a user should be in a repo's Unix group
    *
-   * A user should be in the repo group if they have ownership
-   * of ANY branch in that repo.
+   * A user should be in the repo group if they have explicit filesystem access
+   * to ANY branch in that repo.
    *
    * @param repoId - Repo ID
    * @param userId - User ID to check
@@ -9273,8 +9566,8 @@ var UnixIntegrationService = class {
   async shouldUserBeInRepoGroup(repoId, userId) {
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
     for (const wt of branches4) {
-      const isOwner = await this.branchRepo.isOwner(wt.branch_id, userId);
-      if (isOwner) {
+      const userIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      if (userIds.includes(userId)) {
         return true;
       }
     }
@@ -9283,33 +9576,36 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing repo
    *
-   * Creates group, sets .git permissions, and adds all users who
-   * own any branch in the repo.
+   * Creates group, sets .git permissions, and adds all users who have explicit
+   * filesystem access to any branch in the repo.
    *
    * @param repoId - Repo ID
    */
   async initializeRepoGroup(repoId) {
     const groupName = await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "repo"
+    });
     console.log(
-      `[UnixIntegration] Initialized repo group ${groupName} with ${ownerIds.size} unique owner(s)`
+      `[UnixIntegration] Initialized repo group ${groupName} with ${userIds.size} unique filesystem user(s)`
     );
   }
   /**
    * Full sync for a repo
    *
    * Ensures repo group exists, .git permissions are set, and all
-   * branch owners are in the repo group.
+   * branch filesystem-access users are in the repo group.
    *
    * @param repoId - Repo ID
    */
@@ -9317,15 +9613,23 @@ var UnixIntegrationService = class {
     console.log(`[UnixIntegration] Full sync for repo ${shortId(repoId)}`);
     await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
+    }
+    const repo = await this.repoRepo.findById(repoId);
+    if (repo?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        repo.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "repo" }
+      );
     }
   }
   // ============================================================
@@ -9602,16 +9906,28 @@ var UnixIntegrationService = class {
   /**
    * Full sync for a branch
    *
-   * Ensures group exists, all owners are in group, and symlinks are created.
+   * Ensures group exists, all explicit filesystem-access users are in group,
+   * and symlinks are created.
    *
    * @param branchId - Branch ID
    */
   async syncBranch(branchId) {
     console.log(`[UnixIntegration] Full sync for branch ${shortId(branchId)}`);
     await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
+    }
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        branch.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "branch" }
+      );
+    }
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
     }
   }
   /**