agor-live 0.21.2 → 0.22.0

package/dist/core/db/index.js

@@ -525,6 +525,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -834,7 +837,7 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
-var SessionStatus;
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
@@ -852,11 +855,17 @@ var init_session = __esm({
       COMPLETED: "completed",
       FAILED: "failed"
     };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -884,6 +893,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1047,6 +1062,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -1070,7 +1087,7 @@ import {
   uniqueIndex,
   varchar
 } from "drizzle-orm/pg-core";
-var bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -1163,6 +1180,36 @@ var init_schema_postgres = __esm({
         scheduleRunUnique: uniqueIndex("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships = pgTable(
+      "session_relationships",
+      {
+        relationship_id: varchar("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: varchar("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: varchar("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: text("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: varchar("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: varchar("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        sourceIdx: index("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks = pgTable(
       "tasks",
       {
@@ -1699,6 +1746,12 @@ var init_schema_postgres = __esm({
         branch_id: varchar("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: varchar("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: varchar("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: text("name").notNull(),
         description: text("description"),
@@ -1725,6 +1778,7 @@ var init_schema_postgres = __esm({
       },
       (table) => ({
         branchIdx: index("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index("artifacts_board_idx").on(table.board_id),
         archivedIdx: index("artifacts_archived_idx").on(table.archived),
         publicIdx: index("artifacts_public_idx").on(table.public)
@@ -1881,7 +1935,7 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: text("name").notNull(),
         channel_type: text("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: varchar("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: varchar("agor_user_id", { length: 36 }).notNull(),
@@ -2265,7 +2319,7 @@ var init_schema_postgres = __esm({
         archivedIdx: index("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = relations(sessions, ({ one }) => ({
+    sessionsRelations = relations(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -2273,6 +2327,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = relations(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = relations(branches, ({ many }) => ({
@@ -2325,6 +2397,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -2343,7 +2417,7 @@ import {
   text as text2,
   uniqueIndex as uniqueIndex2
 } from "drizzle-orm/sqlite-core";
-var t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2433,6 +2507,36 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: uniqueIndex2("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(sql2`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = sqliteTable(
+      "session_relationships",
+      {
+        relationship_id: text2("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: text2("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: text2("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: text2("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: text2("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: text2("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: index2("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: index2("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: index2("session_relationships_callback_idx").on(table.callback_session_id),
+        sourceTargetTypeUnique: uniqueIndex2("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = sqliteTable(
       "tasks",
       {
@@ -2977,6 +3081,12 @@ var init_schema_sqlite = __esm({
         branch_id: text2("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: text2("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: text2("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: text2("name").notNull(),
         description: text2("description"),
@@ -3003,6 +3113,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: index2("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: index2("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: index2("artifacts_board_idx").on(table.board_id),
         archivedIdx: index2("artifacts_archived_idx").on(table.archived),
         publicIdx: index2("artifacts_public_idx").on(table.public)
@@ -3161,7 +3272,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: text2("name").notNull(),
         channel_type: text2("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: text2("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: text2("agor_user_id", { length: 36 }).notNull(),
@@ -3544,7 +3655,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: index2("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = relations2(sessions2, ({ one }) => ({
+    sessionsRelations2 = relations2(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3552,6 +3663,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = relations2(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = relations2(branches2, ({ many }) => ({
@@ -3901,6 +4030,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -3908,7 +4038,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3940,6 +4070,7 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
@@ -4163,17 +4294,17 @@ var init_first_run_bootstrap = __esm({
 init_esm_shims();
 init_ids();
 import {
-  and as and22,
+  and as and23,
   asc as asc3,
   desc as desc6,
-  eq as eq30,
+  eq as eq31,
   gt,
   gte,
-  inArray as inArray7,
+  inArray as inArray8,
   like as like16,
   lte as lte2,
-  or as or8,
-  sql as sql14
+  or as or9,
+  sql as sql15
 } from "drizzle-orm";
 import bcryptjs from "bcryptjs";
 
@@ -4301,8 +4432,8 @@ function createPostgresDatabase(config) {
     if (config.ssl !== void 0) {
       options.ssl = config.ssl;
     }
-    const sql15 = postgres(config.url, options);
-    return drizzlePostgres(sql15, { schema: schema_postgres_exports });
+    const sql16 = postgres(config.url, options);
+    return drizzlePostgres(sql16, { schema: schema_postgres_exports });
   } catch (error) {
     throw new DatabaseConnectionError(
       `Failed to create PostgreSQL client: ${error instanceof Error ? error.message : String(error)}`,
@@ -4993,6 +5124,7 @@ var ArtifactRepository = class {
     return {
       artifact_id: artifactId,
       branch_id: row.branch_id ?? null,
+      source_session_id: row.source_session_id ?? null,
       board_id: row.board_id,
       name: row.name,
       description: row.description ?? void 0,
@@ -5031,6 +5163,7 @@ var ArtifactRepository = class {
       const insertData = {
         artifact_id: artifactId,
         branch_id: data.branch_id ?? null,
+        source_session_id: data.source_session_id ?? null,
         board_id: data.board_id ?? "",
         name: data.name ?? "Untitled Artifact",
         description: data.description ?? null,
@@ -5183,6 +5316,9 @@ var ArtifactRepository = class {
         setData.agor_grants = updates.agor_grants ?? null;
       }
       if (updates.public !== void 0) setData.public = updates.public;
+      if (updates.source_session_id !== void 0) {
+        setData.source_session_id = updates.source_session_id ?? null;
+      }
       if (updates.archived !== void 0) setData.archived = updates.archived;
       if (updates.archived_at !== void 0) {
         setData.archived_at = updates.archived_at ? new Date(updates.archived_at) : null;
@@ -6408,6 +6544,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -6901,6 +7038,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where(eq11(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where(eq11(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, eq11(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and8(eq11(groups3.group_id, branchGroupGrants3.group_id), eq11(groups3.archived, false))
+    ).where(
+      and8(
+        eq11(branchGroupGrants3.branch_id, branchId),
+        inArray3(
+          sql7`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where(eq11(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, eq11(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      and8(eq11(groups3.group_id, boardGroupGrants3.group_id), eq11(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      and8(
+        eq11(boards3.board_id, boardGroupGrants3.board_id),
+        eq11(
+          sql7`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      and8(
+        eq11(boardGroupGrants3.board_id, branchRow.board_id),
+        inArray3(
+          sql7`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      and8(
+        eq11(branches3.board_id, boardId),
+        eq11(branches3.permission_source, "board"),
+        eq11(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -8476,8 +8690,10 @@ var SENSITIVE_CONFIG_FIELDS = [
   "signing_secret",
   // Slack
   "private_key",
-  "webhook_secret"
+  "webhook_secret",
   // GitHub
+  "app_password"
+  // Teams (Azure Bot App Secret)
 ];
 var REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
 function encryptConfig(config) {
@@ -12325,13 +12541,173 @@ var SessionMCPServerRepository = class {
   }
 };
 
+// src/db/repositories/session-relationships.ts
+init_esm_shims();
+init_ids();
+init_database_wrapper();
+init_schema();
+import { and as and19, eq as eq25, inArray as inArray6, or as or8 } from "drizzle-orm";
+var SessionRelationshipRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  rowToRelationship(row) {
+    return {
+      relationship_id: row.relationship_id,
+      source_session_id: row.source_session_id,
+      target_session_id: row.target_session_id,
+      relationship_type: row.relationship_type,
+      created_by: row.created_by,
+      created_at: new Date(row.created_at).toISOString(),
+      updated_at: row.updated_at ? new Date(row.updated_at).toISOString() : null,
+      callback_enabled: Boolean(row.callback_enabled),
+      callback_session_id: row.callback_session_id ?? null,
+      data: row.data ?? null
+    };
+  }
+  async create(input) {
+    try {
+      const now = /* @__PURE__ */ new Date();
+      const row = {
+        relationship_id: generateId(),
+        source_session_id: input.source_session_id,
+        target_session_id: input.target_session_id,
+        relationship_type: input.relationship_type,
+        created_by: input.created_by,
+        created_at: now,
+        updated_at: now,
+        callback_enabled: input.callback_enabled ?? false,
+        callback_session_id: input.callback_session_id ?? null,
+        data: input.data ?? null
+      };
+      await insert(this.db, sessionRelationships3).values(row).run();
+      return this.rowToRelationship(row);
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to create session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async get(relationshipId) {
+    try {
+      const row = await select(this.db).from(sessionRelationships3).where(eq25(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to get session relationship: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSession(sessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        or8(
+          eq25(sessionRelationships3.source_session_id, sessionId),
+          eq25(sessionRelationships3.target_session_id, sessionId)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findForSessions(sessionIds) {
+    if (sessionIds.length === 0) return [];
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        or8(
+          inArray6(sessionRelationships3.source_session_id, sessionIds),
+          inArray6(sessionRelationships3.target_session_id, sessionIds)
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteChildren(sourceSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        and19(
+          eq25(sessionRelationships3.source_session_id, sourceSessionId),
+          eq25(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote child relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async findRemoteParents(targetSessionId) {
+    try {
+      const rows = await select(this.db).from(sessionRelationships3).where(
+        and19(
+          eq25(sessionRelationships3.target_session_id, targetSessionId),
+          eq25(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).all();
+      return rows.map((row) => this.rowToRelationship(row));
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list remote parent relationships: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabled(relationshipId, callbackEnabled) {
+    try {
+      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(eq25(sessionRelationships3.relationship_id, relationshipId)).run();
+      if (result.rowsAffected === 0) {
+        throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      }
+      const row = await select(this.db).from(sessionRelationships3).where(eq25(sessionRelationships3.relationship_id, relationshipId)).one();
+      if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
+      return this.rowToRelationship(row);
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to update session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  async setCallbackEnabledForTargetSession(targetSessionId, callbackEnabled) {
+    try {
+      await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(
+        and19(
+          eq25(sessionRelationships3.target_session_id, targetSessionId),
+          eq25(sessionRelationships3.relationship_type, "remote_create")
+        )
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to update target session relationship callback state: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+};
+
 // src/db/repositories/tasks.ts
 init_esm_shims();
 init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { eq as eq25, inArray as inArray6, like as like13, sql as sql13 } from "drizzle-orm";
+import { eq as eq26, inArray as inArray7, like as like13, sql as sql13 } from "drizzle-orm";
 var TaskRepository = class {
   constructor(db) {
     this.db = db;
@@ -12427,7 +12803,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where(eq25(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -12451,7 +12827,7 @@ var TaskRepository = class {
       const inserts = taskList.map((task) => this.taskToInsert(task));
       await insert(this.db, tasks3).values(inserts).run();
       const taskIds = inserts.map((t3) => t3.task_id);
-      const rows = await select(this.db).from(tasks3).where(inArray6(tasks3.task_id, taskIds)).all();
+      const rows = await select(this.db).from(tasks3).where(inArray7(tasks3.task_id, taskIds)).all();
       const rowsById = new Map(rows.map((r) => [r.task_id, r]));
       return taskIds.map((id) => this.rowToTask(rowsById.get(id)));
     } catch (error) {
@@ -12467,7 +12843,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where(eq25(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -12497,7 +12873,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq25(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12511,7 +12887,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq25(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12567,7 +12943,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq25(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where(eq26(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12589,8 +12965,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq25(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq25(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq26(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -12604,7 +12980,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where(eq25(tasks3.task_id, fullId)).run();
+        }).where(eq26(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -12623,7 +12999,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where(eq25(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where(eq26(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -12685,7 +13061,7 @@ var TaskRepository = class {
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where(eq25(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where(eq26(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -12726,7 +13102,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq25(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: sql13`count(*)` }).from(tasks3).where(eq26(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -12743,7 +13119,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, eq as eq26, like as like14, lt as lt2 } from "drizzle-orm";
+import { and as and20, eq as eq27, like as like14, lt as lt2 } from "drizzle-orm";
 var ThreadSessionMapRepository = class {
   constructor(db) {
     this.db = db;
@@ -12813,7 +13189,7 @@ var ThreadSessionMapRepository = class {
         id: data.id ?? generateId()
       });
       await insert(this.db, threadSessionMap3).values(insertData).run();
-      const row = await select(this.db).from(threadSessionMap3).where(eq26(threadSessionMap3.id, insertData.id)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.id, insertData.id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created thread-session mapping");
       }
@@ -12832,7 +13208,7 @@ var ThreadSessionMapRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(threadSessionMap3).where(eq26(threadSessionMap3.id, fullId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.id, fullId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -12873,7 +13249,7 @@ var ThreadSessionMapRepository = class {
         status: insertData.status,
         last_message_at: insertData.last_message_at,
         metadata: insertData.metadata
-      }).where(eq26(threadSessionMap3.id, fullId)).run();
+      }).where(eq27(threadSessionMap3.id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated thread-session mapping");
@@ -12894,7 +13270,7 @@ var ThreadSessionMapRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, threadSessionMap3).where(eq26(threadSessionMap3.id, fullId)).run();
+      const result = await deleteFrom(this.db, threadSessionMap3).where(eq27(threadSessionMap3.id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("ThreadSessionMap", id);
       }
@@ -12912,7 +13288,7 @@ var ThreadSessionMapRepository = class {
   async findByChannelAndThread(channelId, threadId) {
     try {
       const row = await select(this.db).from(threadSessionMap3).where(
-        and19(eq26(threadSessionMap3.channel_id, channelId), eq26(threadSessionMap3.thread_id, threadId))
+        and20(eq27(threadSessionMap3.channel_id, channelId), eq27(threadSessionMap3.thread_id, threadId))
       ).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
@@ -12929,7 +13305,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByThread(threadId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq26(threadSessionMap3.thread_id, threadId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.thread_id, threadId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12943,7 +13319,7 @@ var ThreadSessionMapRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq26(threadSessionMap3.session_id, sessionId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.session_id, sessionId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12957,11 +13333,11 @@ var ThreadSessionMapRepository = class {
    */
   async findByChannel(channelId, status) {
     try {
-      const conditions = [eq26(threadSessionMap3.channel_id, channelId)];
+      const conditions = [eq27(threadSessionMap3.channel_id, channelId)];
       if (status) {
-        conditions.push(eq26(threadSessionMap3.status, status));
+        conditions.push(eq27(threadSessionMap3.status, status));
       }
-      const rows = await select(this.db).from(threadSessionMap3).where(and19(...conditions)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where(and20(...conditions)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -12977,7 +13353,7 @@ var ThreadSessionMapRepository = class {
     try {
       await update(this.db, threadSessionMap3).set({
         last_message_at: /* @__PURE__ */ new Date()
-      }).where(eq26(threadSessionMap3.id, id)).run();
+      }).where(eq27(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update last message timestamp: ${error instanceof Error ? error.message : String(error)}`,
@@ -12990,7 +13366,7 @@ var ThreadSessionMapRepository = class {
    */
   async updateMetadata(id, metadata) {
     try {
-      await update(this.db, threadSessionMap3).set({ metadata }).where(eq26(threadSessionMap3.id, id)).run();
+      await update(this.db, threadSessionMap3).set({ metadata }).where(eq27(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update metadata: ${error instanceof Error ? error.message : String(error)}`,
@@ -13005,7 +13381,7 @@ var ThreadSessionMapRepository = class {
     try {
       const cutoff = new Date(Date.now() - daysInactive * 24 * 60 * 60 * 1e3);
       const rows = await select(this.db).from(threadSessionMap3).where(
-        and19(eq26(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
+        and20(eq27(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
       ).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
@@ -13020,7 +13396,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByBranch(branchId) {
     try {
-      const rows = await select(this.db).from(threadSessionMap3).where(eq26(threadSessionMap3.branch_id, branchId)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where(eq27(threadSessionMap3.branch_id, branchId)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -13038,7 +13414,7 @@ init_database_wrapper();
 init_schema();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and20, eq as eq27 } from "drizzle-orm";
+import { and as and21, eq as eq28 } from "drizzle-orm";
 var KEY_PREFIX = "agor_sk_";
 var KEY_PREFIX_LENGTH = 12;
 var KEY_RANDOM_BYTES = 32;
@@ -13075,7 +13451,7 @@ var UserApiKeysRepository = class {
   }
   /** List all API keys for a user (never returns hashes) */
   async listByUser(userId) {
-    const rows = await select(this.db).from(userApiKeys3).where(eq27(userApiKeys3.user_id, userId)).all();
+    const rows = await select(this.db).from(userApiKeys3).where(eq28(userApiKeys3.user_id, userId)).all();
     return rows.map((r) => ({
       id: r.id,
       name: r.name,
@@ -13086,7 +13462,7 @@ var UserApiKeysRepository = class {
   }
   /** Find a key by prefix (for auth lookup). Returns rows with hash for verification. */
   async findByPrefix(prefix) {
-    return select(this.db).from(userApiKeys3).where(eq27(userApiKeys3.prefix, prefix)).all();
+    return select(this.db).from(userApiKeys3).where(eq28(userApiKeys3.prefix, prefix)).all();
   }
   /** Verify a raw API key against stored hashes. Returns the matching row or null. */
   async verifyKey(rawKey) {
@@ -13101,19 +13477,19 @@ var UserApiKeysRepository = class {
   }
   /** Update last_used_at timestamp */
   async updateLastUsed(id) {
-    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq27(userApiKeys3.id, id)).run();
+    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq28(userApiKeys3.id, id)).run();
   }
   /** Update key name */
   async updateName(id, userId, name) {
-    await update(this.db, userApiKeys3).set({ name }).where(and20(eq27(userApiKeys3.id, id), eq27(userApiKeys3.user_id, userId))).run();
+    await update(this.db, userApiKeys3).set({ name }).where(and21(eq28(userApiKeys3.id, id), eq28(userApiKeys3.user_id, userId))).run();
   }
   /** Delete a key */
   async delete(id, userId) {
-    await deleteFrom(this.db, userApiKeys3).where(and20(eq27(userApiKeys3.id, id), eq27(userApiKeys3.user_id, userId))).run();
+    await deleteFrom(this.db, userApiKeys3).where(and21(eq28(userApiKeys3.id, id), eq28(userApiKeys3.user_id, userId))).run();
   }
   /** Delete all keys for a user */
   async deleteAllForUser(userId) {
-    await deleteFrom(this.db, userApiKeys3).where(eq27(userApiKeys3.user_id, userId)).run();
+    await deleteFrom(this.db, userApiKeys3).where(eq28(userApiKeys3.user_id, userId)).run();
   }
 };
 
@@ -13121,7 +13497,7 @@ var UserApiKeysRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and21, eq as eq28, isNull as isNull6 } from "drizzle-orm";
+import { and as and22, eq as eq29, isNull as isNull6 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -13136,9 +13512,9 @@ function rowToToken(row) {
   };
 }
 function matchKey(userId, serverId) {
-  return and21(
-    userId === null ? isNull6(userMcpOauthTokens3.user_id) : eq28(userMcpOauthTokens3.user_id, userId),
-    eq28(userMcpOauthTokens3.mcp_server_id, serverId)
+  return and22(
+    userId === null ? isNull6(userMcpOauthTokens3.user_id) : eq29(userMcpOauthTokens3.user_id, userId),
+    eq29(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -13255,7 +13631,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -13266,7 +13642,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -13277,7 +13653,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq28(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq29(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -13295,7 +13671,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types2();
-import { eq as eq29, like as like15 } from "drizzle-orm";
+import { eq as eq30, like as like15, sql as sql14 } from "drizzle-orm";
 
 // src/config/env-vars.ts
 init_esm_shims();
@@ -13425,7 +13801,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where(eq29(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where(eq30(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -13448,7 +13824,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where(eq29(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where(eq30(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -13460,7 +13836,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq29(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -13476,12 +13852,41 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where(eq29(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where(eq30(users3.email, email)).one();
     if (!result) {
       return null;
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(sql14`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -13518,8 +13923,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq29(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where(eq29(users3.user_id, fullId)).one();
+    }).where(eq30(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -13530,7 +13935,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where(eq29(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where(eq30(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -13538,7 +13943,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq29(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq30(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -13620,7 +14025,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq29(users3.user_id, fullId)).run();
+    }).where(eq30(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -13646,7 +14051,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq29(users3.user_id, fullId)).run();
+    }).where(eq30(users3.user_id, fullId)).run();
   }
 };
 
@@ -13708,6 +14113,7 @@ export {
   SerializedSessionRepository,
   SessionEnvSelectionRepository,
   SessionMCPServerRepository,
+  SessionRelationshipRepository,
   SessionRepository,
   TaskRepository,
   ThreadSessionMapRepository,
@@ -13715,7 +14121,7 @@ export {
   UserMCPOAuthTokenRepository,
   UsersRepository,
   advisoryLockKeyForUuid,
-  and22 as and,
+  and23 as and,
   appVariables3 as appVariables,
   artifactTrustGrants3 as artifactTrustGrants,
   artifacts3 as artifacts,
@@ -13744,7 +14150,7 @@ export {
   deleteFrom,
   desc6 as desc,
   encryptApiKey,
-  eq30 as eq,
+  eq31 as eq,
   executeAll,
   executeGet,
   executeRaw,
@@ -13764,7 +14170,7 @@ export {
   gte,
   hash,
   identifyUrlParam,
-  inArray7 as inArray,
+  inArray8 as inArray,
   initializeDatabase,
   insert,
   insertOne,
@@ -13788,7 +14194,7 @@ export {
   lte2 as lte,
   mcpServers3 as mcpServers,
   messages3 as messages,
-  or8 as or,
+  or9 as or,
   reattributeLegacyAnonymousRows,
   repos3 as repos,
   resolveByShortIdPrefix,
@@ -13800,9 +14206,10 @@ export {
   serializedSessions3 as serializedSessions,
   sessionEnvSelections3 as sessionEnvSelections,
   sessionMcpServers3 as sessionMcpServers,
+  sessionRelationships3 as sessionRelationships,
   sessions3 as sessions,
   shortId,
-  sql14 as sql,
+  sql15 as sql,
   tasks3 as tasks,
   threadSessionMap3 as threadSessionMap,
   tryAdvisoryXactLock,