agor-live 0.21.2 → 0.22.0

package/dist/core/db/index.cjs

@@ -543,6 +543,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -857,7 +860,7 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
-var SessionStatus;
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
@@ -875,11 +878,17 @@ var init_session = __esm({
       COMPLETED: "completed",
       FAILED: "failed"
     };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -907,6 +916,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1070,6 +1085,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -1078,7 +1095,7 @@ __export(schema_postgres_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens,
   users: () => users
 });
-var import_drizzle_orm, import_pg_core, bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var import_drizzle_orm, import_pg_core, bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -1173,6 +1190,36 @@ var init_schema_postgres = __esm({
         scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships = (0, import_pg_core.pgTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_pg_core.varchar)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_pg_core.varchar)("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_pg_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_pg_core.varchar)("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_pg_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_pg_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_pg_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: (0, import_pg_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks = (0, import_pg_core.pgTable)(
       "tasks",
       {
@@ -1709,6 +1756,12 @@ var init_schema_postgres = __esm({
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
         description: (0, import_pg_core.text)("description"),
@@ -1735,6 +1788,7 @@ var init_schema_postgres = __esm({
       },
       (table) => ({
         branchIdx: (0, import_pg_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_pg_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_pg_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_pg_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_pg_core.index)("artifacts_public_idx").on(table.public)
@@ -1891,7 +1945,7 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: (0, import_pg_core.text)("name").notNull(),
         channel_type: (0, import_pg_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_pg_core.varchar)("agor_user_id", { length: 36 }).notNull(),
@@ -2275,7 +2329,7 @@ var init_schema_postgres = __esm({
         archivedIdx: (0, import_pg_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = (0, import_drizzle_orm.relations)(sessions, ({ one }) => ({
+    sessionsRelations = (0, import_drizzle_orm.relations)(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -2283,6 +2337,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = (0, import_drizzle_orm.relations)(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = (0, import_drizzle_orm.relations)(branches, ({ many }) => ({
@@ -2335,6 +2407,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -2343,7 +2417,7 @@ __export(schema_sqlite_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens2,
   users: () => users2
 });
-var import_drizzle_orm2, import_sqlite_core, t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var import_drizzle_orm2, import_sqlite_core, t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2435,6 +2509,36 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: (0, import_sqlite_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = (0, import_sqlite_core.sqliteTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_sqlite_core.text)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_sqlite_core.text)("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_sqlite_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_sqlite_core.text)("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_sqlite_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_sqlite_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_sqlite_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: (0, import_sqlite_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = (0, import_sqlite_core.sqliteTable)(
       "tasks",
       {
@@ -2979,6 +3083,12 @@ var init_schema_sqlite = __esm({
         branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: (0, import_sqlite_core.text)("name").notNull(),
         description: (0, import_sqlite_core.text)("description"),
@@ -3005,6 +3115,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: (0, import_sqlite_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_sqlite_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_sqlite_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_sqlite_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_sqlite_core.index)("artifacts_public_idx").on(table.public)
@@ -3163,7 +3274,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: (0, import_sqlite_core.text)("name").notNull(),
         channel_type: (0, import_sqlite_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_sqlite_core.text)("agor_user_id", { length: 36 }).notNull(),
@@ -3546,7 +3657,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: (0, import_sqlite_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = (0, import_drizzle_orm2.relations)(sessions2, ({ one }) => ({
+    sessionsRelations2 = (0, import_drizzle_orm2.relations)(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3554,6 +3665,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = (0, import_drizzle_orm2.relations)(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = (0, import_drizzle_orm2.relations)(branches2, ({ many }) => ({
@@ -3904,6 +4033,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -3911,7 +4041,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3943,6 +4073,7 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
@@ -4200,6 +4331,7 @@ __export(db_exports, {
   SerializedSessionRepository: () => SerializedSessionRepository,
   SessionEnvSelectionRepository: () => SessionEnvSelectionRepository,
   SessionMCPServerRepository: () => SessionMCPServerRepository,
+  SessionRelationshipRepository: () => SessionRelationshipRepository,
   SessionRepository: () => SessionRepository,
   TaskRepository: () => TaskRepository,
   ThreadSessionMapRepository: () => ThreadSessionMapRepository,
@@ -4207,11 +4339,11 @@ __export(db_exports, {
   UserMCPOAuthTokenRepository: () => UserMCPOAuthTokenRepository,
   UsersRepository: () => UsersRepository,
   advisoryLockKeyForUuid: () => advisoryLockKeyForUuid,
-  and: () => import_drizzle_orm33.and,
+  and: () => import_drizzle_orm34.and,
   appVariables: () => appVariables3,
   artifactTrustGrants: () => artifactTrustGrants3,
   artifacts: () => artifacts3,
-  asc: () => import_drizzle_orm33.asc,
+  asc: () => import_drizzle_orm34.asc,
   assertUsableBootstrapAdminPassword: () => assertUsableBootstrapAdminPassword,
   boardComments: () => boardComments3,
   boardGroupGrants: () => boardGroupGrants3,
@@ -4234,9 +4366,9 @@ __export(db_exports, {
   dateTruncUtc: () => dateTruncUtc,
   decryptApiKey: () => decryptApiKey,
   deleteFrom: () => deleteFrom,
-  desc: () => import_drizzle_orm33.desc,
+  desc: () => import_drizzle_orm34.desc,
   encryptApiKey: () => encryptApiKey,
-  eq: () => import_drizzle_orm33.eq,
+  eq: () => import_drizzle_orm34.eq,
   executeAll: () => executeAll,
   executeGet: () => executeGet,
   executeRaw: () => executeRaw,
@@ -4252,11 +4384,11 @@ __export(db_exports, {
   getUserByEmail: () => getUserByEmail,
   groupMemberships: () => groupMemberships3,
   groups: () => groups3,
-  gt: () => import_drizzle_orm33.gt,
-  gte: () => import_drizzle_orm33.gte,
+  gt: () => import_drizzle_orm34.gt,
+  gte: () => import_drizzle_orm34.gte,
   hash: () => hash,
   identifyUrlParam: () => identifyUrlParam,
-  inArray: () => import_drizzle_orm33.inArray,
+  inArray: () => import_drizzle_orm34.inArray,
   initializeDatabase: () => initializeDatabase,
   insert: () => insert,
   insertOne: () => insertOne,
@@ -4275,12 +4407,12 @@ __export(db_exports, {
   kbGraphNodes: () => kbGraphNodes3,
   kbNamespaceAcl: () => kbNamespaceAcl3,
   kbNamespaces: () => kbNamespaces3,
-  like: () => import_drizzle_orm33.like,
+  like: () => import_drizzle_orm34.like,
   lockRowForUpdate: () => lockRowForUpdate,
-  lte: () => import_drizzle_orm33.lte,
+  lte: () => import_drizzle_orm34.lte,
   mcpServers: () => mcpServers3,
   messages: () => messages3,
-  or: () => import_drizzle_orm33.or,
+  or: () => import_drizzle_orm34.or,
   reattributeLegacyAnonymousRows: () => reattributeLegacyAnonymousRows,
   repos: () => repos3,
   resolveByShortIdPrefix: () => resolveByShortIdPrefix,
@@ -4292,9 +4424,10 @@ __export(db_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   shortId: () => shortId,
-  sql: () => import_drizzle_orm33.sql,
+  sql: () => import_drizzle_orm34.sql,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
   tryAdvisoryXactLock: () => tryAdvisoryXactLock,
@@ -4309,7 +4442,7 @@ __export(db_exports, {
 });
 module.exports = __toCommonJS(db_exports);
 init_cjs_shims();
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
 init_ids();
 
@@ -4437,8 +4570,8 @@ function createPostgresDatabase(config) {
     if (config.ssl !== void 0) {
       options.ssl = config.ssl;
     }
-    const sql15 = (0, import_postgres.default)(config.url, options);
-    return (0, import_postgres_js.drizzle)(sql15, { schema: schema_postgres_exports });
+    const sql16 = (0, import_postgres.default)(config.url, options);
+    return (0, import_postgres_js.drizzle)(sql16, { schema: schema_postgres_exports });
   } catch (error) {
     throw new DatabaseConnectionError(
       `Failed to create PostgreSQL client: ${error instanceof Error ? error.message : String(error)}`,
@@ -5129,6 +5262,7 @@ var ArtifactRepository = class {
     return {
       artifact_id: artifactId,
       branch_id: row.branch_id ?? null,
+      source_session_id: row.source_session_id ?? null,
       board_id: row.board_id,
       name: row.name,
       description: row.description ?? void 0,
@@ -5167,6 +5301,7 @@ var ArtifactRepository = class {
       const insertData = {
         artifact_id: artifactId,
         branch_id: data.branch_id ?? null,
+        source_session_id: data.source_session_id ?? null,
         board_id: data.board_id ?? "",
         name: data.name ?? "Untitled Artifact",
         description: data.description ?? null,
@@ -5319,6 +5454,9 @@ var ArtifactRepository = class {
         setData.agor_grants = updates.agor_grants ?? null;
       }
       if (updates.public !== void 0) setData.public = updates.public;
+      if (updates.source_session_id !== void 0) {
+        setData.source_session_id = updates.source_session_id ?? null;
+      }
       if (updates.archived !== void 0) setData.archived = updates.archived;
       if (updates.archived_at !== void 0) {
         setData.archived_at = updates.archived_at ? new Date(updates.archived_at) : null;
@@ -6544,6 +6682,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -7037,6 +7176,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm14.inArray)(
+          import_drizzle_orm14.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where((0, import_drizzle_orm14.eq)(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm14.eq)(
+          import_drizzle_orm14.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boardGroupGrants3.board_id, branchRow.board_id),
+        (0, import_drizzle_orm14.inArray)(
+          import_drizzle_orm14.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branches3.board_id, boardId),
+        (0, import_drizzle_orm14.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm14.eq)(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -8612,8 +8828,10 @@ var SENSITIVE_CONFIG_FIELDS = [
   "signing_secret",
   // Slack
   "private_key",
-  "webhook_secret"
+  "webhook_secret",
   // GitHub
+  "app_password"
+  // Teams (Azure Bot App Secret)
 ];
 var REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function encryptConfig(config) {
@@ -12461,10 +12679,170 @@ var SessionMCPServerRepository = class {
   }
 };
 
+// src/db/repositories/session-relationships.ts
+init_cjs_shims();
+var import_drizzle_orm28 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+var SessionRelationshipRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  rowToRelationship(row) {
+    return {
+      relationship_id: row.relationship_id,
+      source_session_id: row.source_session_id,
+      target_session_id: row.target_session_id,
+      relationship_type: row.relationship_type,
+      created_by: row.created_by,
+      created_at: new Date(row.created_at).toISOString(),
+      updated_at: row.updated_at ? new Date(row.updated_at).toISOString() : null,
+      callback_enabled: Boolean(row.callback_enabled),
+      callback_session_id: row.callback_session_id ?? null,
+      data: row.data ?? null
+    };
+  }
+  async create(input) {
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const row = {
+        relationship_id: generateId(),
+        source_session_id: input.source_session_id,
+        target_session_id: input.target_session_id,
+        relationship_type: input.relationship_type,
+        created_by: input.created_by,
+        created_at: now,
+        updated_at: now,
+        callback_enabled: input.callback_enabled ?? false,
+        callback_session_id: input.callback_session_id ?? null,
+        data: input.data ?? null
+      };
+      await insert(this.db, sessionRelationships3).values(row).run();
+      return this.rowToRelationship(row);
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to create session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async get(relationshipId) {
+    try {
+      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to get session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSession(sessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        (0, import_drizzle_orm28.or)(
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.source_session_id, sessionId),
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.target_session_id, sessionId)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSessions(sessionIds) {
+    if (sessionIds.length === 0) return [];
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        (0, import_drizzle_orm28.or)(
+          (0, import_drizzle_orm28.inArray)(sessionRelationships3.source_session_id, sessionIds),
+          (0, import_drizzle_orm28.inArray)(sessionRelationships3.target_session_id, sessionIds)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteChildren(sourceSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.source_session_id, sourceSessionId),
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote child relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteParents(targetSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.target_session_id, targetSessionId),
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote parent relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabled(relationshipId, callbackEnabled) {
+    try {
+      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_id, relationshipId)).run();
+      if (result.rowsAffected === 0) {
+        throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      }
+      const row = await select(this.db).from(sessionRelationships3).where((0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to update session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabledForTargetSession(targetSessionId, callbackEnabled) {
+    try {
+      await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.target_session_id, targetSessionId),
+          (0, import_drizzle_orm28.eq)(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to update target session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+};
+
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm29 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -12552,7 +12930,7 @@ var TaskRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Task", async (pattern) => {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.task_id);
     });
   }
@@ -12563,7 +12941,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -12587,7 +12965,7 @@ var TaskRepository = class {
       const inserts = taskList.map((task) => this.taskToInsert(task));
       await insert(this.db, tasks3).values(inserts).run();
       const taskIds = inserts.map((t3) => t3.task_id);
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.inArray)(tasks3.task_id, taskIds)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.inArray)(tasks3.task_id, taskIds)).all();
       const rowsById = new Map(rows.map((r) => [r.task_id, r]));
       return taskIds.map((id) => this.rowToTask(rowsById.get(id)));
     } catch (error) {
@@ -12603,7 +12981,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -12633,7 +13011,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12647,7 +13025,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12668,7 +13046,7 @@ var TaskRepository = class {
   async findOrphaned() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm28.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
+        import_drizzle_orm29.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -12688,7 +13066,7 @@ var TaskRepository = class {
   async findActiveWithExecutorHeartbeat() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm28.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
+        import_drizzle_orm29.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -12703,7 +13081,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12725,8 +13103,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm28.eq)(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm29.eq)(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -12740,7 +13118,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where((0, import_drizzle_orm28.eq)(tasks3.task_id, fullId)).run();
+        }).where((0, import_drizzle_orm29.eq)(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -12759,7 +13137,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm28.eq)(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm29.eq)(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -12813,15 +13191,15 @@ var TaskRepository = class {
     }
     return this.db.transaction(async (tx) => {
       const positionRow = await select(txAsDb(tx), {
-        maxPos: import_drizzle_orm28.sql`max(${tasks3.queue_position})`
-      }).from(tasks3).where(import_drizzle_orm28.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
+        maxPos: import_drizzle_orm29.sql`max(${tasks3.queue_position})`
+      }).from(tasks3).where(import_drizzle_orm29.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
       const nextPosition = (positionRow?.maxPos ?? 0) + 1;
       const insertData = this.taskToInsert({
         ...taskBase,
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -12833,7 +13211,7 @@ var TaskRepository = class {
    */
   async findQueued(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm28.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
+      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm29.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12848,7 +13226,7 @@ var TaskRepository = class {
    */
   async getNextQueued(sessionId) {
     try {
-      const row = await select(this.db).from(tasks3).where(import_drizzle_orm28.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
+      const row = await select(this.db).from(tasks3).where(import_drizzle_orm29.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12862,7 +13240,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm28.eq)(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: import_drizzle_orm29.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm29.eq)(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -12876,7 +13254,7 @@ var TaskRepository = class {
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm30 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -12926,7 +13304,7 @@ var ThreadSessionMapRepository = class {
       return id;
     }
     const pattern = prefixToLikePattern(id);
-    const results = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.like)(threadSessionMap3.id, pattern)).all();
+    const results = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.like)(threadSessionMap3.id, pattern)).all();
     if (results.length === 0) {
       throw new EntityNotFoundError("ThreadSessionMap", id);
     }
@@ -12949,7 +13327,7 @@ var ThreadSessionMapRepository = class {
         id: data.id ?? generateId()
       });
       await insert(this.db, threadSessionMap3).values(insertData).run();
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, insertData.id)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, insertData.id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created thread-session mapping");
       }
@@ -12968,7 +13346,7 @@ var ThreadSessionMapRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, fullId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, fullId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -13009,7 +13387,7 @@ var ThreadSessionMapRepository = class {
         status: insertData.status,
         last_message_at: insertData.last_message_at,
         metadata: insertData.metadata
-      }).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, fullId)).run();
+      }).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated thread-session mapping");
@@ -13030,7 +13408,7 @@ var ThreadSessionMapRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, fullId)).run();
+      const result = await deleteFrom(this.db, threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("ThreadSessionMap", id);
       }
@@ -13048,7 +13426,7 @@ var ThreadSessionMapRepository = class {
   async findByChannelAndThread(channelId, threadId) {
     try {
       const row = await select(this.db).from(threadSessionMap3).where(
-        (0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(threadSessionMap3.channel_id, channelId), (0, import_drizzle_orm29.eq)(threadSessionMap3.thread_id, threadId))
+        (0, import_drizzle_orm30.and)((0, import_drizzle_orm30.eq)(threadSessionMap3.channel_id, channelId), (0, import_drizzle_orm30.eq)(threadSessionMap3.thread_id, threadId))
       ).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
@@ -13065,7 +13443,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByThread(threadId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.thread_id, threadId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.thread_id, threadId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -13079,7 +13457,7 @@ var ThreadSessionMapRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.session_id, sessionId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.session_id, sessionId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -13093,11 +13471,11 @@ var ThreadSessionMapRepository = class {
    */
   async findByChannel(channelId, status) {
     try {
-      const conditions = [(0, import_drizzle_orm29.eq)(threadSessionMap3.channel_id, channelId)];
+      const conditions = [(0, import_drizzle_orm30.eq)(threadSessionMap3.channel_id, channelId)];
       if (status) {
-        conditions.push((0, import_drizzle_orm29.eq)(threadSessionMap3.status, status));
+        conditions.push((0, import_drizzle_orm30.eq)(threadSessionMap3.status, status));
       }
-      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.and)(...conditions)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.and)(...conditions)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -13113,7 +13491,7 @@ var ThreadSessionMapRepository = class {
     try {
       await update(this.db, threadSessionMap3).set({
         last_message_at: /* @__PURE__ */ new Date()
-      }).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, id)).run();
+      }).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update last message timestamp: ${error instanceof Error ? error.message : String(error)}`,
@@ -13126,7 +13504,7 @@ var ThreadSessionMapRepository = class {
    */
   async updateMetadata(id, metadata) {
     try {
-      await update(this.db, threadSessionMap3).set({ metadata }).where((0, import_drizzle_orm29.eq)(threadSessionMap3.id, id)).run();
+      await update(this.db, threadSessionMap3).set({ metadata }).where((0, import_drizzle_orm30.eq)(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update metadata: ${error instanceof Error ? error.message : String(error)}`,
@@ -13141,7 +13519,7 @@ var ThreadSessionMapRepository = class {
     try {
       const cutoff = new Date(Date.now() - daysInactive * 24 * 60 * 60 * 1e3);
       const rows = await select(this.db).from(threadSessionMap3).where(
-        (0, import_drizzle_orm29.and)((0, import_drizzle_orm29.eq)(threadSessionMap3.status, "active"), (0, import_drizzle_orm29.lt)(threadSessionMap3.last_message_at, cutoff))
+        (0, import_drizzle_orm30.and)((0, import_drizzle_orm30.eq)(threadSessionMap3.status, "active"), (0, import_drizzle_orm30.lt)(threadSessionMap3.last_message_at, cutoff))
       ).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
@@ -13156,7 +13534,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByBranch(branchId) {
     try {
-      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm29.eq)(threadSessionMap3.branch_id, branchId)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where((0, import_drizzle_orm30.eq)(threadSessionMap3.branch_id, branchId)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -13171,7 +13549,7 @@ var ThreadSessionMapRepository = class {
 init_cjs_shims();
 var import_node_crypto5 = require("crypto");
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -13211,7 +13589,7 @@ var UserApiKeysRepository = class {
   }
   /** List all API keys for a user (never returns hashes) */
   async listByUser(userId) {
-    const rows = await select(this.db).from(userApiKeys3).where((0, import_drizzle_orm30.eq)(userApiKeys3.user_id, userId)).all();
+    const rows = await select(this.db).from(userApiKeys3).where((0, import_drizzle_orm31.eq)(userApiKeys3.user_id, userId)).all();
     return rows.map((r) => ({
       id: r.id,
       name: r.name,
@@ -13222,7 +13600,7 @@ var UserApiKeysRepository = class {
   }
   /** Find a key by prefix (for auth lookup). Returns rows with hash for verification. */
   async findByPrefix(prefix) {
-    return select(this.db).from(userApiKeys3).where((0, import_drizzle_orm30.eq)(userApiKeys3.prefix, prefix)).all();
+    return select(this.db).from(userApiKeys3).where((0, import_drizzle_orm31.eq)(userApiKeys3.prefix, prefix)).all();
   }
   /** Verify a raw API key against stored hashes. Returns the matching row or null. */
   async verifyKey(rawKey) {
@@ -13237,25 +13615,25 @@ var UserApiKeysRepository = class {
   }
   /** Update last_used_at timestamp */
   async updateLastUsed(id) {
-    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm30.eq)(userApiKeys3.id, id)).run();
+    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where((0, import_drizzle_orm31.eq)(userApiKeys3.id, id)).run();
   }
   /** Update key name */
   async updateName(id, userId, name) {
-    await update(this.db, userApiKeys3).set({ name }).where((0, import_drizzle_orm30.and)((0, import_drizzle_orm30.eq)(userApiKeys3.id, id), (0, import_drizzle_orm30.eq)(userApiKeys3.user_id, userId))).run();
+    await update(this.db, userApiKeys3).set({ name }).where((0, import_drizzle_orm31.and)((0, import_drizzle_orm31.eq)(userApiKeys3.id, id), (0, import_drizzle_orm31.eq)(userApiKeys3.user_id, userId))).run();
   }
   /** Delete a key */
   async delete(id, userId) {
-    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm30.and)((0, import_drizzle_orm30.eq)(userApiKeys3.id, id), (0, import_drizzle_orm30.eq)(userApiKeys3.user_id, userId))).run();
+    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm31.and)((0, import_drizzle_orm31.eq)(userApiKeys3.id, id), (0, import_drizzle_orm31.eq)(userApiKeys3.user_id, userId))).run();
   }
   /** Delete all keys for a user */
   async deleteAllForUser(userId) {
-    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm30.eq)(userApiKeys3.user_id, userId)).run();
+    await deleteFrom(this.db, userApiKeys3).where((0, import_drizzle_orm31.eq)(userApiKeys3.user_id, userId)).run();
   }
 };
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 function rowToToken(row) {
@@ -13272,9 +13650,9 @@ function rowToToken(row) {
   };
 }
 function matchKey(userId, serverId) {
-  return (0, import_drizzle_orm31.and)(
-    userId === null ? (0, import_drizzle_orm31.isNull)(userMcpOauthTokens3.user_id) : (0, import_drizzle_orm31.eq)(userMcpOauthTokens3.user_id, userId),
-    (0, import_drizzle_orm31.eq)(userMcpOauthTokens3.mcp_server_id, serverId)
+  return (0, import_drizzle_orm32.and)(
+    userId === null ? (0, import_drizzle_orm32.isNull)(userMcpOauthTokens3.user_id) : (0, import_drizzle_orm32.eq)(userMcpOauthTokens3.user_id, userId),
+    (0, import_drizzle_orm32.eq)(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -13391,7 +13769,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm31.eq)(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm32.eq)(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -13402,7 +13780,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm31.eq)(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where((0, import_drizzle_orm32.eq)(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -13413,7 +13791,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where((0, import_drizzle_orm31.eq)(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where((0, import_drizzle_orm32.eq)(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -13431,7 +13809,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 
 // src/config/env-vars.ts
 init_cjs_shims();
@@ -13553,7 +13931,7 @@ var UsersRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "User", async (pattern) => {
-      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm32.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm33.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.user_id);
     });
   }
@@ -13561,7 +13939,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -13584,7 +13962,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -13596,7 +13974,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -13612,12 +13990,41 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.email, email)).one();
     if (!result) {
       return null;
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(import_drizzle_orm33.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -13654,8 +14061,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).one();
+    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -13666,7 +14073,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -13674,7 +14081,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -13756,7 +14163,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -13782,7 +14189,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm32.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm33.eq)(users3.user_id, fullId)).run();
   }
 };
 
@@ -13845,6 +14252,7 @@ var hash = import_bcryptjs3.default.hash;
   SerializedSessionRepository,
   SessionEnvSelectionRepository,
   SessionMCPServerRepository,
+  SessionRelationshipRepository,
   SessionRepository,
   TaskRepository,
   ThreadSessionMapRepository,
@@ -13937,6 +14345,7 @@ var hash = import_bcryptjs3.default.hash;
   serializedSessions,
   sessionEnvSelections,
   sessionMcpServers,
+  sessionRelationships,
   sessions,
   shortId,
   sql,