agor-live 0.21.2 → 0.22.0

package/dist/daemon/register-hooks.js

@@ -8,6 +8,14 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// src/adapters/drizzle.ts
+import { NotFoundError } from "@agor/core/utils/errors";
+var init_drizzle = __esm({
+  "src/adapters/drizzle.ts"() {
+    "use strict";
+  }
+});
+
 // src/auth/runtime-tokens.ts
 import jwt from "jsonwebtoken";
 function issueRuntimeToken(payload, jwtSecret, expiresIn, options = {}) {
@@ -592,12 +600,12 @@ var init_spawn_executor = __esm({
 });
 
 // src/utils/mcp-token-authorization.ts
-import { hasMinimumRole as hasMinimumRole5, ROLES as ROLES5 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole5, ROLES as ROLES6 } from "@agor/core/types";
 function canReceiveMcpTokenForSession(params) {
   const { callerUserId, callerRole, sessionCreatedBy } = params;
-  const isSuperadmin = hasMinimumRole5(callerRole, ROLES5.SUPERADMIN);
+  const isSuperadmin = hasMinimumRole5(callerRole, ROLES6.SUPERADMIN);
   const isServiceExecutor = callerRole === "service";
-  const isCreatorMember = !!callerUserId && callerUserId === sessionCreatedBy && hasMinimumRole5(callerRole, ROLES5.MEMBER);
+  const isCreatorMember = !!callerUserId && callerUserId === sessionCreatedBy && hasMinimumRole5(callerRole, ROLES6.MEMBER);
   return isCreatorMember || isSuperadmin || isServiceExecutor;
 }
 var init_mcp_token_authorization = __esm({
@@ -618,7 +626,7 @@ __export(tokens_exports, {
   validateSessionToken: () => validateSessionToken
 });
 import { MCP_TOKEN } from "@agor/core/config";
-import { generateId as generateId2, SessionRepository, shortId as shortId3 } from "@agor/core/db";
+import { generateId as generateId2, SessionRepository as SessionRepository2, shortId as shortId3 } from "@agor/core/db";
 import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
@@ -642,7 +650,7 @@ function initMcpTokens(options) {
   const expirationMs = options.expirationMs ?? MCP_TOKEN.DEFAULT_EXPIRATION_MS;
   const now = options.now ?? (() => Date.now());
   _state = {
-    sessionRepo: new SessionRepository(options.db),
+    sessionRepo: new SessionRepository2(options.db),
     expirationMs,
     now,
     tokenCache: /* @__PURE__ */ new Map(),
@@ -753,14 +761,6 @@ var init_tokens = __esm({
   }
 });
 
-// src/adapters/drizzle.ts
-import { NotFoundError } from "@agor/core/utils/errors";
-var init_drizzle = __esm({
-  "src/adapters/drizzle.ts"() {
-    "use strict";
-  }
-});
-
 // src/utils/build-initial-user-message.ts
 import { generateId as generateId3 } from "@agor/core/db";
 import { MessageRole } from "@agor/core/types";
@@ -1197,13 +1197,13 @@ import {
 } from "@agor/core/claude-cli";
 import {
   generateId as generateId4,
-  SessionRepository as SessionRepository2,
+  SessionRepository as SessionRepository3,
   shortId as shortId4,
   TaskRepository
 } from "@agor/core/db";
 import {
-  SessionStatus,
-  TaskStatus
+  SessionStatus as SessionStatus3,
+  TaskStatus as TaskStatus2
 } from "@agor/core/types";
 import {
   getHomedirFromUsername,
@@ -1217,7 +1217,7 @@ function getDb(app) {
 async function persistActiveTurnSnapshot(app, sessionId, turn) {
   const db = getDb(app);
   if (!db) return;
-  const repo = new SessionRepository2(db);
+  const repo = new SessionRepository3(db);
   const row = await repo.findById(sessionId);
   if (!row) {
     throw new Error(`persistActiveTurnSnapshot: session not found: ${shortId4(sessionId)}`);
@@ -1238,7 +1238,7 @@ async function clearActiveTurnSnapshot(app, sessionId) {
   const db = getDb(app);
   if (!db) return;
   try {
-    const repo = new SessionRepository2(db);
+    const repo = new SessionRepository3(db);
     const patch = {
       cli_state: { active_turn: null }
     };
@@ -1320,7 +1320,7 @@ function buildCliPersister(app) {
     async saveOffset(sessionId, update2) {
       const db = getDb(app);
       if (!db) return;
-      const repo = new SessionRepository2(db);
+      const repo = new SessionRepository3(db);
       const row = await repo.findById(sessionId).catch(() => null);
       if (!row) return;
       const existing = row.cli_state ?? {};
@@ -1353,7 +1353,7 @@ function buildCliEventSink(app) {
         indexBySession.set(sessionId, 1);
         return 0;
       }
-      const repo = new SessionRepository2(db);
+      const repo = new SessionRepository3(db);
       const count = await repo.countMessages(sessionId).catch(() => 0) ?? 0;
       indexBySession.set(sessionId, count + 1);
       return count;
@@ -1375,7 +1375,7 @@ function buildCliEventSink(app) {
     const db = getDb(app);
     if (!db) return null;
     try {
-      const sessionRepo = new SessionRepository2(db);
+      const sessionRepo = new SessionRepository3(db);
       const session = await sessionRepo.findById(sessionId).catch(() => null);
       if (!session) return null;
       const taskRepo = new TaskRepository(db);
@@ -1383,7 +1383,7 @@ function buildCliEventSink(app) {
         session_id: sessionId,
         created_by: session.created_by,
         full_prompt: prompt,
-        status: TaskStatus.RUNNING,
+        status: TaskStatus2.RUNNING,
         started_at: timestamp,
         message_range: {
           start_index: userMessageIndex,
@@ -1400,7 +1400,7 @@ function buildCliEventSink(app) {
       });
       app.service("tasks").emit("created", task);
       await app.service("sessions").patch(sessionId, {
-        status: SessionStatus.RUNNING,
+        status: SessionStatus3.RUNNING,
         ready_for_prompt: false,
         tasks: [...session.tasks, task.task_id]
       }).catch((err) => {
@@ -1654,7 +1654,7 @@ function buildCliEventSink(app) {
         const computedContextWindow = lastTurn?.usage ? (lastTurn.usage.input_tokens ?? 0) + (lastTurn.usage.cache_creation_input_tokens ?? 0) + (lastTurn.usage.cache_read_input_tokens ?? 0) : void 0;
         try {
           await app.service("tasks").patch(active.taskId, {
-            status: TaskStatus.COMPLETED,
+            status: TaskStatus2.COMPLETED,
             completed_at: ts,
             message_range: {
               start_index: active.userMessageIndex,
@@ -1677,7 +1677,7 @@ function buildCliEventSink(app) {
         }
         try {
           const patch = {
-            status: SessionStatus.IDLE,
+            status: SessionStatus3.IDLE,
             ready_for_prompt: true
           };
           if (computedContextWindow !== void 0) {
@@ -1918,7 +1918,7 @@ async function onCliSessionCreated(app, session, branchCwd) {
   try {
     const db = getDb(app);
     if (db) {
-      const repo = new SessionRepository2(db);
+      const repo = new SessionRepository3(db);
       const row = await repo.findById(session.session_id).catch(() => null);
       if (row) {
         const patch = {
@@ -1978,7 +1978,7 @@ async function onCliSessionEnded(app, sessionId) {
 async function rehydrateCliWatchers(app, branchCwdLookup) {
   const db = getDb(app);
   if (!db) return;
-  const repo = new SessionRepository2(db);
+  const repo = new SessionRepository3(db);
   const all = await repo.findAll().catch(() => []);
   const reg = getCliWatcherRegistry(app);
   let rehydrated = 0;
@@ -2050,7 +2050,7 @@ import {
   validateRenderedManagedEnvUrlFields,
   validateRepoEnvironmentLifecyclePolicy
 } from "@agor/core/environment/webhook";
-import { BadRequest as BadRequest3, Forbidden as Forbidden7, NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
+import { BadRequest as BadRequest3, Forbidden as Forbidden8, NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
 import {
   boardCommentQueryValidator,
   boardObjectQueryValidator,
@@ -2063,7 +2063,7 @@ import {
   typedValidateQuery,
   userQueryValidator
 } from "@agor/core/lib/feathers-validation";
-import { hasMinimumRole as hasMinimumRole8, ROLES as ROLES8 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole8, ROLES as ROLES9 } from "@agor/core/types";
 
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
@@ -2318,11 +2318,64 @@ function extractText(content) {
   }
   return "";
 }
+function isGatewayThinkingPlaceholder(text) {
+  return /^thinking\s*\.{3}$/i.test(text.trim());
+}
+function extractLatestToolUse(content) {
+  if (!Array.isArray(content)) return null;
+  for (let i = content.length - 1; i >= 0; i--) {
+    const block = content[i];
+    if (block.type !== "tool_use") continue;
+    if (typeof block.name !== "string") continue;
+    const input = block.input && typeof block.input === "object" && !Array.isArray(block.input) ? block.input : {};
+    return { name: block.name, input };
+  }
+  return null;
+}
+function extractLatestToolUseFromMessage(message) {
+  const fromContent = extractLatestToolUse(message.content);
+  if (fromContent) return fromContent;
+  const toolUses = message.tool_uses;
+  if (!Array.isArray(toolUses) || toolUses.length === 0) return null;
+  const latest = toolUses[toolUses.length - 1];
+  if (!latest || typeof latest.name !== "string") return null;
+  return {
+    name: latest.name,
+    input: latest.input && typeof latest.input === "object" && !Array.isArray(latest.input) ? latest.input : {}
+  };
+}
 var gatewayRouteHook = async (context) => {
   const message = context.result;
+  const gatewayService = context.app.service("gateway");
   let shouldRoute = false;
   let messageText = extractText(message.content);
+  const latestToolUse = extractLatestToolUseFromMessage(message);
+  if (latestToolUse) {
+    try {
+      void gatewayService.updateProgress({
+        session_id: message.session_id,
+        state: "working",
+        task_id: message.task_id,
+        tool_name: latestToolUse.name,
+        tool_input: latestToolUse.input
+      });
+    } catch (error) {
+      console.warn("[gateway-route] Failed to route tool progress:", error);
+    }
+    if (!messageText) {
+      return context;
+    }
+  }
+  if (!messageText && message.role === "assistant" && typeof message.content_preview === "string") {
+    messageText = message.content_preview;
+  }
+  if (message.role === "assistant" && messageText && isGatewayThinkingPlaceholder(messageText)) {
+    return context;
+  }
   if (message.role === "assistant") {
+    if (gatewayService.wasMessageStreamedToSlack?.(message.message_id) || gatewayService.wasTaskStreamedToSlack?.(message.task_id)) {
+      return context;
+    }
     shouldRoute = true;
   } else if (message.role === "user") {
     const source = message.metadata?.source;
@@ -2350,7 +2403,6 @@ var gatewayRouteHook = async (context) => {
     return context;
   }
   try {
-    const gatewayService = context.app.service("gateway");
     gatewayService.routeMessage({
       session_id: message.session_id,
       message: messageText
@@ -3119,6 +3171,30 @@ var groupMembershipsHooks = {
   }
 };
 
+// src/services/sessions.ts
+init_drizzle();
+import { PAGINATION } from "@agor/core/config";
+import {
+  BranchRepository,
+  SessionEnvSelectionRepository,
+  SessionMCPServerRepository,
+  SessionRelationshipRepository,
+  SessionRepository,
+  UsersRepository
+} from "@agor/core/db";
+import { Forbidden as Forbidden4 } from "@agor/core/feathers";
+import { formatModelToolMismatchWarning, lintModelToolMatch } from "@agor/core/models";
+import { resolveChildSessionConfig } from "@agor/core/sessions";
+import { ROLES as ROLES3, SessionStatus } from "@agor/core/types";
+var remoteRelationshipsEnrichedResults = /* @__PURE__ */ new WeakSet();
+function markRemoteRelationshipsEnrichedResult(result) {
+  remoteRelationshipsEnrichedResults.add(result);
+  return result;
+}
+function isRemoteRelationshipsEnrichedResult(result) {
+  return typeof result === "object" && result !== null && remoteRelationshipsEnrichedResults.has(result);
+}
+
 // src/services/users.ts
 import { generateId } from "@agor/core";
 import {
@@ -3141,13 +3217,13 @@ import {
   update,
   users
 } from "@agor/core/db";
-import { Forbidden as Forbidden4, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
+import { Forbidden as Forbidden5, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
 import { isLikelyGitToken } from "@agor/core/git";
 import {
   extractAgenticToolsPublicValues,
   hasMinimumRole as hasMinimumRole3,
   normalizeRole,
-  ROLES as ROLES3,
+  ROLES as ROLES4,
   toAgenticToolsStatus
 } from "@agor/core/types";
 var LOCAL_AUTH_LOOKUP_PARAM = Symbol("agor.users.local-auth-lookup");
@@ -3222,8 +3298,8 @@ function applySessionConfigDefaults(opts = {}) {
 }
 
 // src/utils/authorization.ts
-import { Forbidden as Forbidden5, NotAuthenticated as NotAuthenticated4 } from "@agor/core/feathers";
-import { hasMinimumRole as hasMinimumRole4, ROLES as ROLES4 } from "@agor/core/types";
+import { Forbidden as Forbidden6, NotAuthenticated as NotAuthenticated4 } from "@agor/core/feathers";
+import { hasMinimumRole as hasMinimumRole4, ROLES as ROLES5 } from "@agor/core/types";
 function ensureMinimumRole(params, minimumRole, action = "perform this action") {
   if (!params?.provider) {
     return;
@@ -3235,7 +3311,7 @@ function ensureMinimumRole(params, minimumRole, action = "perform this action")
     return;
   }
   if (!hasMinimumRole4(params.user.role, minimumRole)) {
-    throw new Forbidden5(`You need ${minimumRole} access to ${action}`);
+    throw new Forbidden6(`You need ${minimumRole} access to ${action}`);
   }
 }
 function requireMinimumRole(minimumRole, action) {
@@ -3244,7 +3320,7 @@ function requireMinimumRole(minimumRole, action) {
     return context;
   };
 }
-var DEFAULT_MANAGED_ENVS_MINIMUM_ROLE = ROLES4.MEMBER;
+var DEFAULT_MANAGED_ENVS_MINIMUM_ROLE = ROLES5.MEMBER;
 var ENV_COMMAND_FIELDS = [
   "environment",
   // Repo-level: v2 named variants (source of truth)
@@ -3272,7 +3348,7 @@ function requireAdminForEnvConfig() {
     }
     ensureMinimumRole(
       context.params,
-      ROLES4.ADMIN,
+      ROLES5.ADMIN,
       "modify environment commands (up_command, down_command, etc.)"
     );
     return context;
@@ -3325,7 +3401,7 @@ async function inspectBranchViaExecutor(app, branchId, options = {}) {
 
 // src/utils/executor-read-impersonation.ts
 import { loadConfigSync as loadConfigSync2 } from "@agor/core/config";
-import { UsersRepository } from "@agor/core/db";
+import { UsersRepository as UsersRepository2 } from "@agor/core/db";
 async function resolveExecutorReadAsUser(db, userOrId) {
   const config = loadConfigSync2();
   const unixMode = config.execution?.unix_user_mode ?? "simple";
@@ -3334,7 +3410,7 @@ async function resolveExecutorReadAsUser(db, userOrId) {
   }
   let user;
   if (typeof userOrId === "string") {
-    user = await new UsersRepository(db).findById(userOrId);
+    user = await new UsersRepository2(db).findById(userOrId);
   } else {
     user = userOrId;
   }
@@ -3533,7 +3609,7 @@ var RealtimeAccessCache = class {
 
 // src/utils/realtime-publish.ts
 import { shortId as shortId2 } from "@agor/core/db";
-import { hasMinimumRole as hasMinimumRole6, ROLES as ROLES6 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole6, ROLES as ROLES7 } from "@agor/core/types";
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -3600,7 +3676,7 @@ function isServiceConnection(connection) {
 }
 function isAdminConnection(connection, allowSuperadmin) {
   const user = userFromConnection(connection);
-  if (!user?._isServiceAccount && user?.role && hasMinimumRole6(user.role, ROLES6.ADMIN)) {
+  if (!user?._isServiceAccount && user?.role && hasMinimumRole6(user.role, ROLES7.ADMIN)) {
     return true;
   }
   return isSuperAdmin(user?.role, allowSuperadmin);
@@ -3757,8 +3833,8 @@ function configureRealtimePublish(options) {
 }
 
 // src/utils/schedule-hooks.ts
-import { BadRequest as BadRequest2, Forbidden as Forbidden6, NotAuthenticated as NotAuthenticated6 } from "@agor/core/feathers";
-import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES7 } from "@agor/core/types";
+import { BadRequest as BadRequest2, Forbidden as Forbidden7, NotAuthenticated as NotAuthenticated6 } from "@agor/core/feathers";
+import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES8 } from "@agor/core/types";
 function ensureCurrentScheduleLoaded(scheduleRepo) {
   return async (context) => {
     if (context.method !== "patch") return context;
@@ -3813,14 +3889,14 @@ function ensureScheduleRunsAsCaller(options) {
     }
     const data = context.data;
     if (data?.created_by !== void 0 && data.created_by !== schedule.created_by) {
-      throw new Forbidden6("Cannot change the user a schedule runs as.");
+      throw new Forbidden7("Cannot change the user a schedule runs as.");
     }
     const allowSuperadmin = options?.allowSuperadmin ?? true;
-    if (allowSuperadmin && hasMinimumRole7(user.role, ROLES7.SUPERADMIN)) {
+    if (allowSuperadmin && hasMinimumRole7(user.role, ROLES8.SUPERADMIN)) {
       return context;
     }
     if (schedule.created_by !== user.user_id) {
-      throw new Forbidden6(
+      throw new Forbidden7(
         "Schedules run as the user who created them. You can only modify or run schedules you created."
       );
     }
@@ -3857,6 +3933,17 @@ function recomputeNextRunAt() {
   };
 }
 
+// src/utils/session-task-state.ts
+import {
+  isTerminalTaskStatus,
+  SessionStatus as SessionStatus2,
+  sessionCanStartTask,
+  TaskStatus
+} from "@agor/core/types";
+function isTerminalQueueProcessingSuppressed(params) {
+  return params?.suppressTerminalQueueProcessing === true;
+}
+
 // src/register-hooks.ts
 init_spawn_executor();
 var DEBUG_MCP_TOKENS2 = process.env.AGOR_DEBUG_MCP_TOKENS === "1" || process.env.DEBUG?.includes("mcp-tokens");
@@ -3876,6 +3963,9 @@ var BRANCH_ENV_FIELDS = [
 function itemHasAnyField(item, fields) {
   return fields.some((field) => Object.hasOwn(item, field));
 }
+function shouldValidateRepoEnvironmentPayload(value) {
+  return value !== void 0 && value !== null;
+}
 async function getManagedEnvExecutionMode() {
   const config = await loadConfig();
   return config.execution?.managed_envs_execution_mode ?? MANAGED_ENV_EXECUTION_MODE_DEFAULT;
@@ -3885,7 +3975,7 @@ function validateRepoEnvPolicyHook() {
     const mode = await getManagedEnvExecutionMode();
     const items = Array.isArray(context.data) ? context.data : [context.data];
     for (const item of items) {
-      if (Object.hasOwn(item, "environment") && item.environment !== null) {
+      if (Object.hasOwn(item, "environment") && shouldValidateRepoEnvironmentPayload(item.environment)) {
         try {
           const env = validateRepoEnvironment(item.environment);
           validateRepoEnvironmentLifecyclePolicy(env, mode);
@@ -3893,7 +3983,7 @@ function validateRepoEnvPolicyHook() {
           throw new BadRequest3(error instanceof Error ? error.message : "Invalid repo environment");
         }
       }
-      if (Object.hasOwn(item, "environment_config") && item.environment_config !== null) {
+      if (Object.hasOwn(item, "environment_config") && shouldValidateRepoEnvironmentPayload(item.environment_config)) {
         try {
           const env = wrapV1AsV2(item.environment_config);
           if (env) validateRepoEnvironmentLifecyclePolicy(env, mode, "legacy repo environment");
@@ -3961,6 +4051,24 @@ function isPromptFlowPatchOnly(data) {
   if (keys.length === 0) return false;
   return keys.every((key) => PROMPT_FLOW_PATCH_FIELDS.includes(key));
 }
+function shouldRunSessionPostTurnHooks(session) {
+  return sessionCanStartTask(session.status, session.ready_for_prompt);
+}
+function shouldDrainQueueAfterSessionPostTurnPatch(session, params) {
+  return shouldRunSessionPostTurnHooks(session) && session.ready_for_prompt === true && !isTerminalQueueProcessingSuppressed(params);
+}
+async function enrichSessionFindResultWithRemoteRelationships(result, sessionsService) {
+  if (isRemoteRelationshipsEnrichedResult(result)) return result;
+  if (Array.isArray(result)) {
+    return markRemoteRelationshipsEnrichedResult(
+      await sessionsService.enrichRemoteRelationships(result)
+    );
+  }
+  return markRemoteRelationshipsEnrichedResult({
+    ...result,
+    data: await sessionsService.enrichRemoteRelationships(result.data)
+  });
+}
 function registerHooks(ctx) {
   const {
     db,
@@ -4006,6 +4114,65 @@ function registerHooks(ctx) {
     await invalidateRealtimeBranchAccess(context.params.route?.id);
     return context;
   };
+  const syncBranchUnixAccess = (branchId, logPrefix) => {
+    if (!jwtSecret) return;
+    const serviceToken = createServiceToken(jwtSecret, void 0, {
+      branch_id: branchId,
+      command: "unix.sync-branch"
+    });
+    spawnExecutorFireAndForget(
+      {
+        command: "unix.sync-branch",
+        sessionToken: serviceToken,
+        daemonUrl: getDaemonUrl(),
+        params: {
+          branchId,
+          daemonUser: config.daemon?.unix_user
+        }
+      },
+      { logPrefix }
+    );
+  };
+  const syncUnixAccessForBoardAlignedBranches = async (boardId, logPrefix) => {
+    if (!jwtSecret || typeof boardId !== "string" || boardId.length === 0) return;
+    const alignedBranches = await branchRepository.findBoardAlignedBranches(boardId);
+    if (alignedBranches.length === 0) return;
+    console.log(
+      `[Unix Integration] Queueing board permission sync for ${alignedBranches.length} board-aligned branch(es) on board ${shortId5(boardId)}`
+    );
+    for (const branch of alignedBranches) {
+      await invalidateRealtimeBranchAccess(branch.branch_id);
+    }
+    const serviceToken = createServiceToken(jwtSecret, void 0, {
+      board_id: boardId,
+      command: "unix.sync-board"
+    });
+    spawnExecutorFireAndForget(
+      {
+        command: "unix.sync-board",
+        sessionToken: serviceToken,
+        daemonUrl: getDaemonUrl(),
+        params: {
+          boardId,
+          daemonUser: config.daemon?.unix_user
+        }
+      },
+      { logPrefix }
+    );
+  };
+  const syncUnixAccessForBoardFromRoute = async (context, logPrefix) => {
+    await syncUnixAccessForBoardAlignedBranches(context.params.route?.id, logPrefix);
+    return context;
+  };
+  const syncUnixAccessForAllBranches = async (context, logPrefix) => {
+    if (!jwtSecret) return context;
+    const branches = await branchRepository.findAll({ includeArchived: false });
+    for (const branch of branches) {
+      syncBranchUnixAccess(branch.branch_id, logPrefix);
+      await invalidateRealtimeBranchAccess(branch.branch_id);
+    }
+    return context;
+  };
   const clearRealtimeBranchVisibility = (context) => {
     realtimeAccessCache.clearVisibility();
     return context;
@@ -4030,7 +4197,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create messages"),
+        requireMinimumRole(ROLES9.MEMBER, "create messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4042,7 +4209,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       patch: [
-        requireMinimumRole(ROLES8.MEMBER, "update messages"),
+        requireMinimumRole(ROLES9.MEMBER, "update messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4052,7 +4219,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       remove: [
-        requireMinimumRole(ROLES8.MEMBER, "delete messages"),
+        requireMinimumRole(ROLES9.MEMBER, "delete messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4092,7 +4259,7 @@ function registerHooks(ctx) {
       all: [
         typedValidateQuery(boardObjectQueryValidator),
         requireAuth,
-        requireMinimumRole(ROLES8.MEMBER, "manage board objects")
+        requireMinimumRole(ROLES9.MEMBER, "manage board objects")
       ],
       // NOTE: We deliberately do NOT add the generic scopeFindToAccessibleBranches here.
       // Board-objects may reference `branch_id` (branch cards) OR `card_id`
@@ -4193,17 +4360,17 @@ function registerHooks(ctx) {
   safeService("card-types")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create card types")],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update card types")],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete card types")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create card types")],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update card types")],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete card types")]
     }
   });
   safeService("cards")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create cards"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update cards")],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete cards")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create cards"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update cards")],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete cards")]
     }
   });
   const ensureArtifactOwnerOrAdmin = () => async (context) => {
@@ -4211,16 +4378,16 @@ function registerHooks(ctx) {
     const user = context.params?.user;
     if (!user) throw new NotAuthenticated7("Authentication required");
     if (user._isServiceAccount) return context;
-    if (hasMinimumRole8(user.role, ROLES8.ADMIN)) return context;
+    if (hasMinimumRole8(user.role, ROLES9.ADMIN)) return context;
     const artifactId = context.id;
     if (artifactId === void 0 || artifactId === null) return context;
     const artifactRepo = new ArtifactRepository(db);
     const artifact = await artifactRepo.findById(String(artifactId));
     if (!artifact) {
-      throw new Forbidden7(`Artifact ${artifactId} not found or not accessible`);
+      throw new Forbidden8(`Artifact ${artifactId} not found or not accessible`);
     }
     if (artifact.created_by && artifact.created_by === user.user_id) return context;
-    throw new Forbidden7(
+    throw new Forbidden8(
       "Only the artifact's creator or an admin may modify it. Use agor_artifacts_publish to create your own copy."
     );
   };
@@ -4235,9 +4402,9 @@ function registerHooks(ctx) {
         // board-scoped queries.
         ...branchRbacEnabled ? [scopeFindToAccessibleBranches(branchRepository, superadminOpts)] : []
       ],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create artifacts"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update artifacts"), ensureArtifactOwnerOrAdmin()],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete artifacts"), ensureArtifactOwnerOrAdmin()]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create artifacts"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update artifacts"), ensureArtifactOwnerOrAdmin()],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete artifacts"), ensureArtifactOwnerOrAdmin()]
     }
   });
   if (svcEnabled("artifacts")) {
@@ -4252,7 +4419,7 @@ function registerHooks(ctx) {
           return artifactsService.getPayload(artifactId, _params.user?.user_id);
         }
       },
-      { find: { role: ROLES8.VIEWER, action: "get artifact payload" } },
+      { find: { role: ROLES9.VIEWER, action: "get artifact payload" } },
       requireAuth
     );
     registerAuthenticatedRoute(
@@ -4279,7 +4446,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES8.MEMBER, action: "post artifact console logs" }
+        create: { role: ROLES9.MEMBER, action: "post artifact console logs" }
       },
       requireAuth
     );
@@ -4308,7 +4475,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES8.MEMBER, action: "post artifact sandpack error" }
+        create: { role: ROLES9.MEMBER, action: "post artifact sandpack error" }
       },
       requireAuth
     );
@@ -4349,7 +4516,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES8.MEMBER, action: "post artifact runtime response" }
+        create: { role: ROLES9.MEMBER, action: "post artifact runtime response" }
       },
       requireAuth
     );
@@ -4371,7 +4538,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES8.MEMBER, action: "create artifact trust grant" }
+        create: { role: ROLES9.MEMBER, action: "create artifact trust grant" }
       },
       requireAuth
     );
@@ -4395,8 +4562,8 @@ function registerHooks(ctx) {
         }
       },
       {
-        find: { role: ROLES8.VIEWER, action: "list artifact trust grants" },
-        remove: { role: ROLES8.MEMBER, action: "revoke artifact trust grant" }
+        find: { role: ROLES9.VIEWER, action: "list artifact trust grants" },
+        remove: { role: ROLES9.MEMBER, action: "revoke artifact trust grant" }
       },
       requireAuth
     );
@@ -4404,9 +4571,9 @@ function registerHooks(ctx) {
   safeService("board-comments")?.hooks({
     before: {
       all: [typedValidateQuery(boardCommentQueryValidator), requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create board comments"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update board comments")],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete board comments")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create board comments"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update board comments")],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete board comments")]
     }
   });
   app.service("repos").hooks({
@@ -4414,24 +4581,24 @@ function registerHooks(ctx) {
       all: [
         typedValidateQuery(repoQueryValidator),
         requireAuth,
-        requireMinimumRole(ROLES8.MEMBER, "access repositories")
+        requireMinimumRole(ROLES9.MEMBER, "access repositories")
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create repositories"),
+        requireMinimumRole(ROLES9.MEMBER, "create repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
       update: [
-        requireMinimumRole(ROLES8.MEMBER, "update repositories"),
+        requireMinimumRole(ROLES9.MEMBER, "update repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
       patch: [
-        requireMinimumRole(ROLES8.MEMBER, "update repositories"),
+        requireMinimumRole(ROLES9.MEMBER, "update repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete repositories")]
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete repositories")]
     },
     after: {
       patch: [realignRepoOriginAfterPatchHook()]
@@ -4443,7 +4610,7 @@ function registerHooks(ctx) {
         typedValidateQuery(branchQueryValidator),
         requireAuth,
         executorRuntimeScopeGuard(),
-        requireMinimumRole(ROLES8.MEMBER, "access branches")
+        requireMinimumRole(ROLES9.MEMBER, "access branches")
       ],
       find: [
         // RBAC: compose an accessible branch_id filter and let BranchesService.find()
@@ -4458,13 +4625,13 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create branches"),
+        requireMinimumRole(ROLES9.MEMBER, "create branches"),
         requireAdminForEnvConfig(),
         validateBranchEnvPolicyHook(),
         injectCreatedBy()
       ],
       update: [
-        requireMinimumRole(ROLES8.MEMBER, "update branches"),
+        requireMinimumRole(ROLES9.MEMBER, "update branches"),
         requireAdminForEnvConfig(),
         validateBranchEnvPolicyHook()
       ],
@@ -4600,28 +4767,28 @@ function registerHooks(ctx) {
   safeService("kb/namespaces")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create knowledge namespaces")],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update knowledge namespaces")],
-      update: [requireMinimumRole(ROLES8.MEMBER, "update knowledge namespaces")],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete knowledge namespaces")],
-      saveWithAcl: [requireMinimumRole(ROLES8.MEMBER, "save knowledge namespace permissions")],
-      listAcl: [requireMinimumRole(ROLES8.MEMBER, "manage knowledge namespace permissions")],
-      setAcl: [requireMinimumRole(ROLES8.MEMBER, "manage knowledge namespace permissions")],
-      removeAcl: [requireMinimumRole(ROLES8.MEMBER, "manage knowledge namespace permissions")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create knowledge namespaces")],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update knowledge namespaces")],
+      update: [requireMinimumRole(ROLES9.MEMBER, "update knowledge namespaces")],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete knowledge namespaces")],
+      saveWithAcl: [requireMinimumRole(ROLES9.MEMBER, "save knowledge namespace permissions")],
+      listAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")],
+      setAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")],
+      removeAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")]
     }
   });
   safeService("kb/documents")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create knowledge documents")],
-      patch: [requireMinimumRole(ROLES8.MEMBER, "update knowledge documents")],
-      update: [requireMinimumRole(ROLES8.MEMBER, "update knowledge documents")],
-      remove: [requireMinimumRole(ROLES8.MEMBER, "delete knowledge documents")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "create knowledge documents")],
+      patch: [requireMinimumRole(ROLES9.MEMBER, "update knowledge documents")],
+      update: [requireMinimumRole(ROLES9.MEMBER, "update knowledge documents")],
+      remove: [requireMinimumRole(ROLES9.MEMBER, "delete knowledge documents")]
     }
   });
   safeService("kb/document-edits")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES8.MEMBER, "edit knowledge documents")]
+      all: [requireAuth, requireMinimumRole(ROLES9.MEMBER, "edit knowledge documents")]
     }
   });
   safeService("kb/versions")?.hooks({
@@ -4636,35 +4803,30 @@ function registerHooks(ctx) {
   });
   safeService("kb/settings")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES8.ADMIN, "configure Knowledge semantic search")]
+      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "configure Knowledge semantic search")]
     }
   });
   safeService("kb/indexing/status")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES8.ADMIN, "view Knowledge indexing status")]
+      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "view Knowledge indexing status")]
     }
   });
   safeService("kb/indexing/reindex")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES8.ADMIN, "reindex Knowledge embeddings")]
+      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "reindex Knowledge embeddings")]
     }
   });
   safeService("kb/graph")?.hooks?.({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES8.MEMBER, "link knowledge graph nodes")],
-      link: [requireMinimumRole(ROLES8.MEMBER, "link knowledge graph nodes")]
+      create: [requireMinimumRole(ROLES9.MEMBER, "link knowledge graph nodes")],
+      link: [requireMinimumRole(ROLES9.MEMBER, "link knowledge graph nodes")]
     }
   });
   const injectPerUserOAuthTokens = async (context) => {
     const queryForUserId = context.params?.query?.forUserId;
     const userId = context.params?.user?.user_id || queryForUserId;
-    const source = context.params?.user?.user_id ? "socket-auth" : queryForUserId ? "query-param" : "none";
-    console.log(
-      `[MCP OAuth] injectPerUserOAuthTokens called - userId: ${userId || "NONE"}, source: ${source}, provider: ${context.params?.provider || "internal"}, method: ${context.method}, resultCount: ${Array.isArray(context.result) ? context.result.length : 1}`
-    );
     if (!userId) {
-      console.log("[MCP OAuth] No user ID - skipping token injection");
       return context;
     }
     const injectToken = async (server) => {
@@ -4677,9 +4839,6 @@ function registerHooks(ctx) {
         const userTokenRepo = new UserMCPOAuthTokenRepository(db);
         const row = await userTokenRepo.getToken(tokenUserId, server.mcp_server_id);
         if (!row) {
-          console.log(
-            `[MCP OAuth] No token row for user=${tokenUserId ?? "<shared>"} server=${server.name}`
-          );
           return server;
         }
         let accessToken = row.oauth_access_token;
@@ -4749,9 +4908,9 @@ function registerHooks(ctx) {
   safeService("mcp-servers")?.hooks({
     before: {
       all: [typedValidateQuery(mcpServerQueryValidator), requireAuth],
-      create: [requireMinimumRole(ROLES8.ADMIN, "create MCP servers")],
-      patch: [requireMinimumRole(ROLES8.ADMIN, "update MCP servers")],
-      remove: [requireMinimumRole(ROLES8.ADMIN, "delete MCP servers")]
+      create: [requireMinimumRole(ROLES9.ADMIN, "create MCP servers")],
+      patch: [requireMinimumRole(ROLES9.ADMIN, "update MCP servers")],
+      remove: [requireMinimumRole(ROLES9.ADMIN, "delete MCP servers")]
     },
     after: {
       find: [injectPerUserOAuthTokens, redactMCPServerSecretFields],
@@ -4765,7 +4924,7 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       find: [
-        requireMinimumRole(ROLES8.MEMBER, "list session MCP servers"),
+        requireMinimumRole(ROLES9.MEMBER, "list session MCP servers"),
         // RBAC: Scope to sessions the caller can access.
         ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
       ]
@@ -4778,7 +4937,7 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       find: [
-        requireMinimumRole(ROLES8.MEMBER, "list session env selections"),
+        requireMinimumRole(ROLES9.MEMBER, "list session env selections"),
         // RBAC: Scope to sessions the caller can access.
         ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
       ]
@@ -4811,7 +4970,7 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       create: [
-        requireMinimumRole(ROLES8.ADMIN, "create gateway channels"),
+        requireMinimumRole(ROLES9.ADMIN, "create gateway channels"),
         injectCreatedBy(),
         // Encrypt env var values at rest (same pattern as user env vars / API keys)
         async (context) => {
@@ -4829,7 +4988,7 @@ function registerHooks(ctx) {
         }
       ],
       patch: [
-        requireMinimumRole(ROLES8.ADMIN, "update gateway channels"),
+        requireMinimumRole(ROLES9.ADMIN, "update gateway channels"),
         // Resolve redacted env var sentinel values ('••••••••') back to real
         // values from the database. Uses the repository directly to bypass
         // the after-hook redaction that the service layer applies.
@@ -4894,7 +5053,7 @@ function registerHooks(ctx) {
           return context;
         }
       ],
-      remove: [requireMinimumRole(ROLES8.ADMIN, "delete gateway channels")]
+      remove: [requireMinimumRole(ROLES9.ADMIN, "delete gateway channels")]
     },
     after: {
       all: [
@@ -4944,9 +5103,9 @@ function registerHooks(ctx) {
   app.service("config").hooks({
     before: {
       all: [requireAuth],
-      find: [requireMinimumRole(ROLES8.ADMIN, "view configuration")],
-      get: [requireMinimumRole(ROLES8.ADMIN, "view configuration")],
-      patch: [requireMinimumRole(ROLES8.ADMIN, "update configuration")]
+      find: [requireMinimumRole(ROLES9.ADMIN, "view configuration")],
+      get: [requireMinimumRole(ROLES9.ADMIN, "view configuration")],
+      patch: [requireMinimumRole(ROLES9.ADMIN, "update configuration")]
     }
   });
   safeService("context")?.hooks({
@@ -4958,7 +5117,7 @@ function registerHooks(ctx) {
     before: {
       all: [
         requireAuth,
-        requireMinimumRole(ROLES8.MEMBER, "search files"),
+        requireMinimumRole(ROLES9.MEMBER, "search files"),
         // RBAC: files service takes a sessionId query param and returns files
         // from that session's branch. Verify the caller can at least 'view'
         // that branch before running git ls-files. If sessionId is missing
@@ -4985,7 +5144,7 @@ function registerHooks(ctx) {
     before: {
       all: [
         requireAuth,
-        requireMinimumRole(ROLES8.MEMBER, "read files"),
+        requireMinimumRole(ROLES9.MEMBER, "read files"),
         ...branchRbacEnabled ? [loadBranch(branchRepository, "branch_id"), ensureCanView(superadminOpts)] : []
       ]
     }
@@ -4997,13 +5156,13 @@ function registerHooks(ctx) {
         requireAuth,
         (context) => {
           if (!webTerminalEnabled) {
-            throw new Forbidden7(
+            throw new Forbidden8(
               "Web terminal is disabled on this instance. Ask an administrator to unset or enable execution.allow_web_terminal in the daemon config."
             );
           }
           return context;
         },
-        requireMinimumRole(ROLES8.MEMBER, "access terminals")
+        requireMinimumRole(ROLES9.MEMBER, "access terminals")
       ]
     }
   });
@@ -5017,8 +5176,14 @@ function registerHooks(ctx) {
   safeService("group-memberships")?.hooks(groupMembershipsHooks);
   safeService("group-memberships")?.hooks({
     after: {
-      create: [clearRealtimeBranchVisibility],
-      remove: [clearRealtimeBranchVisibility]
+      create: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.create]")
+      ],
+      remove: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.remove]")
+      ]
     }
   });
   safeService("branches/:id/owners")?.hooks({
@@ -5029,22 +5194,64 @@ function registerHooks(ctx) {
   });
   safeService("branches/:id/group-grants")?.hooks({
     after: {
-      create: [invalidateRealtimeBranchFromRoute],
-      patch: [invalidateRealtimeBranchFromRoute],
-      remove: [invalidateRealtimeBranchFromRoute]
+      create: [
+        invalidateRealtimeBranchFromRoute,
+        (context) => {
+          const branchId = context.params.route?.id;
+          if (typeof branchId === "string") {
+            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.create]");
+          }
+          return context;
+        }
+      ],
+      patch: [
+        invalidateRealtimeBranchFromRoute,
+        (context) => {
+          const branchId = context.params.route?.id;
+          if (typeof branchId === "string") {
+            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.patch]");
+          }
+          return context;
+        }
+      ],
+      remove: [
+        invalidateRealtimeBranchFromRoute,
+        (context) => {
+          const branchId = context.params.route?.id;
+          if (typeof branchId === "string") {
+            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.remove]");
+          }
+          return context;
+        }
+      ]
     }
   });
   safeService("boards/:id/owners")?.hooks({
     after: {
-      create: [clearRealtimeBranchVisibility],
-      remove: [clearRealtimeBranchVisibility]
+      create: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForBoardFromRoute(context, "[Executor/board-owners.create]")
+      ],
+      remove: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForBoardFromRoute(context, "[Executor/board-owners.remove]")
+      ]
     }
   });
   safeService("boards/:id/group-grants")?.hooks({
     after: {
-      create: [clearRealtimeBranchVisibility],
-      patch: [clearRealtimeBranchVisibility],
-      remove: [clearRealtimeBranchVisibility]
+      create: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForBoardFromRoute(context, "[Executor/board-group-grants.create]")
+      ],
+      patch: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForBoardFromRoute(context, "[Executor/board-group-grants.patch]")
+      ],
+      remove: [
+        clearRealtimeBranchVisibility,
+        (context) => syncUnixAccessForBoardFromRoute(context, "[Executor/board-group-grants.remove]")
+      ]
     }
   });
   app.service("users").hooks({
@@ -5057,7 +5264,7 @@ function registerHooks(ctx) {
             return context;
           }
           if (params.user) {
-            ensureMinimumRole(params, ROLES8.MEMBER, "list users");
+            ensureMinimumRole(params, ROLES9.MEMBER, "list users");
             return context;
           }
           const query = params.query || {};
@@ -5070,7 +5277,7 @@ function registerHooks(ctx) {
       ],
       get: [
         (context) => {
-          ensureMinimumRole(context.params, ROLES8.MEMBER, "view users");
+          ensureMinimumRole(context.params, ROLES9.MEMBER, "view users");
           return context;
         }
       ],
@@ -5082,13 +5289,13 @@ function registerHooks(ctx) {
           }
           const existing = await usersService.find({ query: { $limit: 1 } });
           if (existing.total > 0) {
-            ensureMinimumRole(params, ROLES8.ADMIN, "create users");
+            ensureMinimumRole(params, ROLES9.ADMIN, "create users");
           }
           const data = context.data;
-          if (hasMinimumRole8(data?.role, ROLES8.SUPERADMIN)) {
+          if (hasMinimumRole8(data?.role, ROLES9.SUPERADMIN)) {
             const callerRole = params.user?.role;
-            if (!hasMinimumRole8(callerRole, ROLES8.SUPERADMIN)) {
-              throw new Forbidden7("Only superadmins can create superadmin users");
+            if (!hasMinimumRole8(callerRole, ROLES9.SUPERADMIN)) {
+              throw new Forbidden8("Only superadmins can create superadmin users");
             }
           }
           return context;
@@ -5099,28 +5306,28 @@ function registerHooks(ctx) {
           const params = context.params;
           const userId = context.id;
           const callerRole = params.user?.role;
-          const callerIsAdmin = hasMinimumRole8(callerRole, ROLES8.ADMIN);
+          const callerIsAdmin = hasMinimumRole8(callerRole, ROLES9.ADMIN);
           if (!Array.isArray(context.data)) {
             if (context.data?.unix_username !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden7("Only admins can modify unix_username");
+                throw new Forbidden8("Only admins can modify unix_username");
               }
             }
             if (context.data?.role !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden7("Only admins can modify user roles");
+                throw new Forbidden8("Only admins can modify user roles");
               }
-              if (hasMinimumRole8(context.data.role, ROLES8.SUPERADMIN) && !hasMinimumRole8(callerRole, ROLES8.SUPERADMIN)) {
+              if (hasMinimumRole8(context.data.role, ROLES9.SUPERADMIN) && !hasMinimumRole8(callerRole, ROLES9.SUPERADMIN)) {
                 const allUsers = await usersService.find({});
-                const hasSuperadmin = allUsers.data.some((u) => u.role === ROLES8.SUPERADMIN);
+                const hasSuperadmin = allUsers.data.some((u) => u.role === ROLES9.SUPERADMIN);
                 if (hasSuperadmin) {
-                  throw new Forbidden7("Only superadmins can assign the superadmin role");
+                  throw new Forbidden8("Only superadmins can assign the superadmin role");
                 }
               }
             }
             if (context.data?.must_change_password !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden7("Only admins can force password changes");
+                throw new Forbidden8("Only admins can force password changes");
               }
             }
           }
@@ -5133,16 +5340,16 @@ function registerHooks(ctx) {
           if (!context.params.provider && params.trustedEnvVarWrite === true) {
             const keys = Object.keys(context.data ?? {});
             if (!keys.every((k) => k === "env_vars" || k === "env_var_scopes")) {
-              throw new Forbidden7(
+              throw new Forbidden8(
                 "trustedEnvVarWrite only permits env_vars and env_var_scopes updates"
               );
             }
             return context;
           }
-          throw new Forbidden7("You can only update your own profile");
+          throw new Forbidden8("You can only update your own profile");
         }
       ],
-      remove: [requireMinimumRole(ROLES8.ADMIN, "delete users")]
+      remove: [requireMinimumRole(ROLES9.ADMIN, "delete users")]
     },
     after: {
       // After user create/patch: optionally ensure Unix user exists and sync password
@@ -5249,7 +5456,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create sessions"),
+        requireMinimumRole(ROLES9.MEMBER, "create sessions"),
         ...branchRbacEnabled ? [
           setSessionUnixUsername(usersRepository),
           // Stamp session with creator's unix_username (MUST run first)
@@ -5260,7 +5467,7 @@ function registerHooks(ctx) {
               try {
                 const branch = await branchRepository.findById(data.branch_id);
                 if (!branch) {
-                  throw new Forbidden7(`Branch not found: ${data.branch_id}`);
+                  throw new Forbidden8(`Branch not found: ${data.branch_id}`);
                 }
                 await cacheBranchAccess(context.params, branchRepository, branch);
               } catch (error) {
@@ -5318,7 +5525,8 @@ function registerHooks(ctx) {
                       `\u2705 Auto-populated git_state from branch: ref=${currentRef}, sha=${currentSha.substring(0, 8)}`
                     );
                   } catch (gitError) {
-                    console.warn("Failed to auto-populate git_state from branch:", gitError);
+                    const message = gitError instanceof Error ? gitError.message : String(gitError);
+                    console.warn(`Failed to auto-populate git_state from branch: ${message}`);
                   }
                 }
               }
@@ -5392,6 +5600,15 @@ function registerHooks(ctx) {
       ]
     },
     after: {
+      find: [
+        async (context) => {
+          context.result = await enrichSessionFindResultWithRemoteRelationships(
+            context.result,
+            sessionsService
+          );
+          return context;
+        }
+      ],
       get: [
         async (context) => {
           if (config.daemon?.mcpEnabled === false) {
@@ -5459,7 +5676,7 @@ function registerHooks(ctx) {
             return context;
           }
           const callerRole = context.params.user?.role;
-          if (!hasMinimumRole8(callerRole, ROLES8.MEMBER)) {
+          if (!hasMinimumRole8(callerRole, ROLES9.MEMBER)) {
             return context;
           }
           const { generateSessionToken: generateSessionToken3 } = await Promise.resolve().then(() => (init_tokens(), tokens_exports));
@@ -5535,23 +5752,27 @@ function registerHooks(ctx) {
       patch: [
         async (context) => {
           const session = Array.isArray(context.result) ? context.result[0] : context.result;
-          if (session && session.status === "idle") {
+          if (session && shouldRunSessionPostTurnHooks(session)) {
             setImmediate(async () => {
               try {
                 const gatewayService = context.app.service("gateway");
                 await gatewayService.flushGitHubBuffer(session.session_id);
+                await gatewayService.updateProgress({
+                  session_id: session.session_id,
+                  state: "done"
+                });
               } catch (error) {
                 console.warn(
-                  `[gateway] Failed to flush GitHub buffer for session ${shortId5(session.session_id)}:`,
+                  `[gateway] Failed to flush gateway buffers/status for session ${shortId5(session.session_id)}:`,
                   error
                 );
               }
             });
-            if (session.ready_for_prompt) {
+            if (shouldDrainQueueAfterSessionPostTurnPatch(session, context.params)) {
               setImmediate(async () => {
                 try {
                   console.log(
-                    `\u{1F504} [SessionsService.after.patch] Session ${shortId5(session.session_id)} became IDLE, checking for queued tasks...`
+                    `\u{1F504} [SessionsService.after.patch] Session ${shortId5(session.session_id)} became promptable (${session.status}), checking for queued tasks...`
                   );
                   await sessionsService.triggerQueueProcessing(session.session_id, context.params);
                 } catch (error) {
@@ -5589,14 +5810,14 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create schedules"),
+        requireMinimumRole(ROLES9.MEMBER, "create schedules"),
         ...branchRbacEnabled ? [loadBranch(branchRepository, "branch_id"), ensureCanCreateSession(superadminOpts)] : [],
         injectCreatedBy(),
         validateScheduleConfig(),
         recomputeNextRunAt()
       ],
       patch: [
-        requireMinimumRole(ROLES8.MEMBER, "update schedules"),
+        requireMinimumRole(ROLES9.MEMBER, "update schedules"),
         ...branchRbacEnabled ? [
           loadScheduleAndBranch(scheduleRepository, branchRepository),
           ensureCanModifySchedule(superadminOpts)
@@ -5611,7 +5832,7 @@ function registerHooks(ctx) {
         recomputeNextRunAt()
       ],
       remove: [
-        requireMinimumRole(ROLES8.MEMBER, "delete schedules"),
+        requireMinimumRole(ROLES9.MEMBER, "delete schedules"),
         ...branchRbacEnabled ? [
           loadScheduleAndBranch(scheduleRepository, branchRepository),
           ensureBranchPermission("all", "delete schedule", superadminOpts)
@@ -5636,7 +5857,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES8.MEMBER, "create tasks"),
+        requireMinimumRole(ROLES9.MEMBER, "create tasks"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -5658,7 +5879,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       remove: [
-        requireMinimumRole(ROLES8.MEMBER, "delete tasks"),
+        requireMinimumRole(ROLES9.MEMBER, "delete tasks"),
         // RBAC: deleting a task requires 'all' permission on the branch
         // (mirrors sessions.remove). Without this, any member with 'session'
         // access could delete tasks owned by other users on shared branches.
@@ -5679,7 +5900,7 @@ function registerHooks(ctx) {
       if (!user) throw new NotAuthenticated7("Authentication required");
       if (user._isServiceAccount) return context;
       const allowSuperadmin = superadminOpts?.allowSuperadmin ?? true;
-      if (user.role === ROLES8.ADMIN || allowSuperadmin && user.role === ROLES8.SUPERADMIN) {
+      if (user.role === ROLES9.ADMIN || allowSuperadmin && user.role === ROLES9.SUPERADMIN) {
         return context;
       }
       const args = context.arguments;
@@ -5687,10 +5908,10 @@ function registerHooks(ctx) {
       const id = typeof context.id === "string" ? context.id : typeof context.params.route?.id === "string" ? context.params.route.id : typeof firstArg === "string" ? firstArg : firstArg && typeof firstArg === "object" ? firstArg.boardId ?? firstArg.id ?? firstArg.slug : void 0;
       if (!id) throw new BadRequest3("Board ID is required");
       const board = await boardRepository.findBySlugOrId(id);
-      if (!board) throw new Forbidden7(`Board not found: ${id}`);
+      if (!board) throw new Forbidden8(`Board not found: ${id}`);
       const allowed = mode === "view" ? await boardRepository.canView(board.board_id, user.user_id) : await boardRepository.canMutate(board.board_id, user.user_id);
       if (!allowed) {
-        throw new Forbidden7(
+        throw new Forbidden8(
           mode === "view" ? `You need board access to ${action}` : `You need board owner or board group 'all' access to ${action}`
         );
       }
@@ -5711,9 +5932,9 @@ function registerHooks(ctx) {
       get: [ensureCanViewBoard("view this board")],
       findBySlug: [ensureCanViewBoard("view this board")],
       findBySlugOrId: [ensureCanViewBoard("view this board")],
-      create: [requireMinimumRole(ROLES8.MEMBER, "create boards"), injectCreatedBy()],
+      create: [requireMinimumRole(ROLES9.MEMBER, "create boards"), injectCreatedBy()],
       patch: [
-        requireMinimumRole(ROLES8.MEMBER, "update boards"),
+        requireMinimumRole(ROLES9.MEMBER, "update boards"),
         ensureCanMutateBoard("update this board"),
         async (context) => {
           const contextData = context.data || {};
@@ -5780,30 +6001,30 @@ function registerHooks(ctx) {
         }
       ],
       remove: [
-        requireMinimumRole(ROLES8.MEMBER, "delete boards"),
+        requireMinimumRole(ROLES9.MEMBER, "delete boards"),
         ensureCanMutateBoard("delete this board")
       ],
       toBlob: [
-        requireMinimumRole(ROLES8.MEMBER, "export boards"),
+        requireMinimumRole(ROLES9.MEMBER, "export boards"),
         ensureCanViewBoard("export boards")
       ],
       toYaml: [
-        requireMinimumRole(ROLES8.MEMBER, "export boards"),
+        requireMinimumRole(ROLES9.MEMBER, "export boards"),
         ensureCanViewBoard("export boards")
       ],
-      fromBlob: [requireMinimumRole(ROLES8.MEMBER, "import boards")],
-      fromYaml: [requireMinimumRole(ROLES8.MEMBER, "import boards")],
-      clone: [requireMinimumRole(ROLES8.MEMBER, "clone boards"), ensureCanViewBoard("clone boards")],
+      fromBlob: [requireMinimumRole(ROLES9.MEMBER, "import boards")],
+      fromYaml: [requireMinimumRole(ROLES9.MEMBER, "import boards")],
+      clone: [requireMinimumRole(ROLES9.MEMBER, "clone boards"), ensureCanViewBoard("clone boards")],
       setPrimaryAssistant: [
-        requireMinimumRole(ROLES8.MEMBER, "set primary assistant"),
+        requireMinimumRole(ROLES9.MEMBER, "set primary assistant"),
         ensureCanMutateBoard("set primary assistant")
       ],
       clearPrimaryAssistant: [
-        requireMinimumRole(ROLES8.MEMBER, "clear primary assistant"),
+        requireMinimumRole(ROLES9.MEMBER, "clear primary assistant"),
         ensureCanMutateBoard("clear primary assistant")
       ],
       ensureAssistantWelcomeNote: [
-        requireMinimumRole(ROLES8.MEMBER, "create assistant welcome note"),
+        requireMinimumRole(ROLES9.MEMBER, "create assistant welcome note"),
         ensureCanMutateBoard("create assistant welcome note")
       ]
     },
@@ -5944,7 +6165,7 @@ function registerHooks(ctx) {
       before: {
         create: [
           requireAuth,
-          requireMinimumRole(ROLES8.MEMBER, "archive boards"),
+          requireMinimumRole(ROLES9.MEMBER, "archive boards"),
           ensureCanMutateBoard("archive this board")
         ]
       },
@@ -5961,7 +6182,7 @@ function registerHooks(ctx) {
       before: {
         create: [
           requireAuth,
-          requireMinimumRole(ROLES8.MEMBER, "unarchive boards"),
+          requireMinimumRole(ROLES9.MEMBER, "unarchive boards"),
           ensureCanMutateBoard("unarchive this board")
         ]
       },
@@ -5971,6 +6192,10 @@ function registerHooks(ctx) {
 }
 export {
   PROMPT_FLOW_PATCH_FIELDS,
+  enrichSessionFindResultWithRemoteRelationships,
   isPromptFlowPatchOnly,
-  registerHooks
+  registerHooks,
+  shouldDrainQueueAfterSessionPostTurnPatch,
+  shouldRunSessionPostTurnHooks,
+  shouldValidateRepoEnvironmentPayload
 };