agor-live 0.21.2 → 0.23.1

package/dist/daemon/utils/session-task-state.js

@@ -1,10 +1,15 @@
 // src/utils/session-task-state.ts
-import { isTerminalTaskStatus, SessionStatus, TaskStatus } from "@agor/core/types";
+import {
+  isTerminalTaskStatus,
+  SessionStatus,
+  sessionCanStartTask,
+  TaskStatus
+} from "@agor/core/types";
 function isTaskBlockingPrompt(task) {
   return task.status !== TaskStatus.QUEUED && !isTerminalTaskStatus(task.status);
 }
-function sessionCanStartTask(status, readyForPrompt) {
-  return status === SessionStatus.IDLE || status === SessionStatus.FAILED && readyForPrompt === true;
+function isTerminalQueueProcessingSuppressed(params) {
+  return params?.suppressTerminalQueueProcessing === true;
 }
 function shouldReconcileSessionPromptState(session, tasks, options = {}) {
   if (session.status !== SessionStatus.FAILED) return false;
@@ -14,6 +19,7 @@ function shouldReconcileSessionPromptState(session, tasks, options = {}) {
 }
 export {
   isTaskBlockingPrompt,
+  isTerminalQueueProcessingSuppressed,
   sessionCanStartTask,
   shouldReconcileSessionPromptState
 };

package/dist/daemon/utils/session-tasks.d.ts

@@ -1,6 +1,6 @@
 /**
- * Helpers for finding "active" tasks for a session — RUNNING /
- * AWAITING_PERMISSION / STOPPING — sorted by recency.
+ * Helpers for finding "active" tasks for a session — RUNNING / STOPPING / AWAITING_PERMISSION /
+ * AWAITING_INPUT — sorted by recency.
  *
  * Background: `TasksService.find()` short-circuits on `session_id: string`
  * (see `services/tasks.ts:65-110`) and returns ALL session tasks in
@@ -16,14 +16,14 @@
 import type { Application } from '@agor/core/feathers';
 import type { Params, SessionID, Task } from '@agor/core/types';
 /** Statuses considered "active" — an executor may still be doing work. */
-export declare const ACTIVE_TASK_STATUSES: ReadonlySet<string>;
+export declare const ACTIVE_TASK_STATUSES: ReadonlySet<import("@agor/core").TaskStatus>;
 /**
  * All tasks for the session, returned in recency-DESC order (most recently
  * started/created first). Useful when callers want a fallback path.
  */
 export declare function findTasksForSession(app: Application, sessionId: SessionID, params?: Params): Promise<Task[]>;
 /**
- * The session's active tasks (RUNNING / AWAITING_PERMISSION / STOPPING),
+ * The session's active/executor-owned tasks,
  * recency-DESC. Empty when nothing is active.
  */
 export declare function findActiveTasksForSession(app: Application, sessionId: SessionID, params?: Params): Promise<Task[]>;

package/dist/daemon/utils/session-tasks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-tasks.d.ts","sourceRoot":"","sources":["../../src/utils/session-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAa,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG3E,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,CAInD,CAAC;AAMH;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAajB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAI3B"}
+{"version":3,"file":"session-tasks.d.ts","sourceRoot":"","sources":["../../src/utils/session-tasks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAa,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAG3E,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,8CAA0B,CAAC;AAM5D;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAajB;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,EAAE,CAAC,CAGjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,WAAW,EAChB,SAAS,EAAE,SAAS,EACpB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAI3B"}

package/dist/daemon/utils/session-tasks.js

@@ -1,10 +1,6 @@
 // src/utils/session-tasks.ts
-import { TaskStatus } from "@agor/core/types";
-var ACTIVE_TASK_STATUSES = /* @__PURE__ */ new Set([
-  TaskStatus.RUNNING,
-  TaskStatus.AWAITING_PERMISSION,
-  TaskStatus.STOPPING
-]);
+import { EXECUTING_TASK_STATUSES, isTaskExecuting } from "@agor/core/types";
+var ACTIVE_TASK_STATUSES = EXECUTING_TASK_STATUSES;
 function recencyKey(t) {
   return new Date(t.started_at || t.created_at).getTime();
 }
@@ -24,12 +20,12 @@ async function findTasksForSession(app, sessionId, params) {
 }
 async function findActiveTasksForSession(app, sessionId, params) {
   const all = await findTasksForSession(app, sessionId, params);
-  return all.filter((t) => ACTIVE_TASK_STATUSES.has(t.status));
+  return all.filter((t) => isTaskExecuting(t));
 }
 async function findHostTaskForSession(app, sessionId, params) {
   const all = await findTasksForSession(app, sessionId, params);
   if (all.length === 0) return void 0;
-  return all.find((t) => ACTIVE_TASK_STATUSES.has(t.status)) ?? all[0];
+  return all.find((t) => isTaskExecuting(t)) ?? all[0];
 }
 export {
   ACTIVE_TASK_STATUSES,

package/dist/daemon/utils/session-turn-lock.d.ts

@@ -27,6 +27,13 @@ export type SessionTurnLocks = Map<SessionID, Promise<void>>;
  * callers contending for the same session wait their turn (FIFO-ish — set
  * order through the Map). Errors thrown by `fn` propagate to the caller and
  * the lock is released either way.
+ *
+ * Pass `options.waiterTimeoutMs` to limit how long this call waits for the
+ * lock. If the timeout fires before the lock is available, throws an Error.
+ * Use this on HTTP request handlers so a stuck lock holder (broken DB
+ * connection, etc.) does not hang the request indefinitely.
  */
-export declare function withSessionTurnLock<T>(locks: SessionTurnLocks, sessionId: SessionID, fn: () => Promise<T>): Promise<T>;
+export declare function withSessionTurnLock<T>(locks: SessionTurnLocks, sessionId: SessionID, fn: () => Promise<T>, options?: {
+    waiterTimeoutMs?: number;
+}): Promise<T>;
 //# sourceMappingURL=session-turn-lock.d.ts.map

package/dist/daemon/utils/session-turn-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-turn-lock.d.ts","sourceRoot":"","sources":["../../src/utils/session-turn-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC,CAAC,CAAC,CAwBZ"}
+{"version":3,"file":"session-turn-lock.d.ts","sourceRoot":"","sources":["../../src/utils/session-turn-lock.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAE7D;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EACzC,KAAK,EAAE,gBAAgB,EACvB,SAAS,EAAE,SAAS,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,MAAM,CAAA;CAAE,GACrC,OAAO,CAAC,CAAC,CAAC,CAiDZ"}

package/dist/daemon/utils/session-turn-lock.js

@@ -1,7 +1,30 @@
 // src/utils/session-turn-lock.ts
-async function withSessionTurnLock(locks, sessionId, fn) {
+async function withSessionTurnLock(locks, sessionId, fn, options) {
+  const waiterTimeoutMs = options?.waiterTimeoutMs;
+  const waitStart = waiterTimeoutMs !== void 0 ? Date.now() : 0;
   while (locks.has(sessionId)) {
-    await locks.get(sessionId)?.catch(() => void 0);
+    const existingLock = locks.get(sessionId);
+    if (waiterTimeoutMs !== void 0) {
+      const remaining = waiterTimeoutMs - (Date.now() - waitStart);
+      if (remaining <= 0) {
+        throw new Error(
+          `Session turn lock acquisition timed out after ${waiterTimeoutMs}ms (session ${sessionId})`
+        );
+      }
+      const outcome = await Promise.race([
+        // Swallow the awaited promise's rejection — the original caller already
+        // received the error; waiters only care about lock ordering.
+        existingLock?.catch(() => void 0).then(() => "released"),
+        new Promise((resolve) => setTimeout(() => resolve("timeout"), remaining))
+      ]);
+      if (outcome === "timeout") {
+        throw new Error(
+          `Session turn lock acquisition timed out after ${waiterTimeoutMs}ms (session ${sessionId})`
+        );
+      }
+    } else {
+      await existingLock?.catch(() => void 0);
+    }
   }
   let resolveLock;
   const lockPromise = new Promise((resolve) => {

package/dist/daemon/utils/spawn-executor.d.ts

@@ -22,6 +22,7 @@
  */
 import { type ChildProcess } from 'node:child_process';
 import type { AgorExecutionSettings } from '@agor/core/config';
+import type { AuthenticatedParams } from '@agor/core/types';
 import type { SignOptions } from 'jsonwebtoken';
 /** Set the daemon URL for executor payloads. Call once at daemon startup. */
 export declare function configureDaemonUrl(url: string): void;
@@ -119,6 +120,13 @@ export declare function getDaemonUrl(): string;
  * @returns JWT access token
  */
 export declare function createServiceToken(jwtSecret: string, expiresIn?: SignOptions['expiresIn'], scope?: Record<string, unknown>): string;
+/**
+ * Build extra JWT claims for executor/service tokens from authenticated service
+ * params. In Cloud required-from-auth mode, executor RPCs must carry the same
+ * tenant claim as the request that spawned them; otherwise the daemon handles
+ * them as the static/default tenant.
+ */
+export declare function serviceTokenScopeForParams(params?: Partial<AuthenticatedParams>): Record<string, unknown>;
 /**
  * Generate a session token from the Feathers app
  *
@@ -134,7 +142,21 @@ export declare function generateSessionToken(app: {
             secret?: string;
         };
     };
-}): string;
+}, scope?: Record<string, unknown>): string;
+/**
+ * Generate a tenant-scoped executor service token from Feathers params.
+ *
+ * Prefer this over manually composing `generateSessionToken(app,
+ * serviceTokenScopeForParams(params))` so required-from-auth deployments do not
+ * accidentally drop tenant context on new executor call paths.
+ */
+export declare function generateScopedServiceToken(app: {
+    settings: {
+        authentication?: {
+            secret?: string;
+        };
+    };
+}, params?: Partial<AuthenticatedParams>): string;
 /**
  * Configuration for executor spawning.
  * Loaded from ~/.agor/config.yaml execution section.

package/dist/daemon/utils/spawn-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spawn-executor.d.ts","sourceRoot":"","sources":["../../src/utils/spawn-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAQ/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAqBhD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAID,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAgBtE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,yBACf,SAAQ,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,yBAAyB,GACnC,MAAM,CAsBR;AAED,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAqBzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,oBAAyB,GACjC,IAAI,CA6BN;AA4OD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AA4PD,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,EACpC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAaR;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE;IACxC,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,GAAG,MAAM,CAMT;AAMD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,2BAA2B,GAAG,oBAAoB,CACnD,CAAC;AASF,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,cAAc,IAEpE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAS,IAAI,CAAC,oBAAoB,EAAE,yBAAyB,CAAM,KAClE,IAAI,CAaR;AAMD,eAAO,MAAM,0BAA0B,sBAAgB,CAAC"}
+{"version":3,"file":"spawn-executor.d.ts","sourceRoot":"","sources":["../../src/utils/spawn-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAI9D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAQ5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAqBhD,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAGpD;AAID,mGAAmG;AACnG,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,GAAG,IAAI,CAgBtE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wEAAwE;IACxE,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,yBACf,SAAQ,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,yBAAyB,GACnC,MAAM,CAsBR;AAED,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CA6BzC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,oBAAyB,GACjC,IAAI,CA6BN;AAgQD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,CA8BhC;AA4PD,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,WAAW,CAAC,WAAW,CAAC,EACpC,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAaR;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE;IACH,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,EACD,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,MAAM,CAMR;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,GAAG,EAAE;IACH,QAAQ,EAAE;QAAE,cAAc,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACpD,EACD,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GACpC,MAAM,CAER;AAMD;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,qBAAqB,EACrB,2BAA2B,GAAG,oBAAoB,CACnD,CAAC;AASF,yGAAyG;AACzG,wBAAgB,uBAAuB,CAAC,eAAe,CAAC,EAAE,cAAc,IAEpE,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,UAAS,IAAI,CAAC,oBAAoB,EAAE,yBAAyB,CAAM,KAClE,IAAI,CAaR;AAMD,eAAO,MAAM,0BAA0B,sBAAgB,CAAC"}

package/dist/daemon/utils/spawn-executor.js

@@ -127,6 +127,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -237,6 +244,12 @@ function spawnExecutorLocal(payload, options) {
     options.onExit?.(127);
     return;
   }
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn(cmd, args, {
     cwd,
     env: asUser ? void 0 : { ...envWithDaemonUrl },
@@ -250,6 +263,7 @@ function spawnExecutorLocal(payload, options) {
   onSpawn?.(executorProcess);
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -257,7 +271,7 @@ function spawnExecutorLocal(payload, options) {
     } else {
       console.error(`${logPrefix} Executor exited with code ${code}`);
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -270,6 +284,12 @@ function spawnExecutorWithTemplate(payload, options) {
   console.log(`${logPrefix} Task ID: ${templateVariables.task_id}`);
   console.log(`${logPrefix} Command: ${payload.command}`);
   console.log(`${logPrefix} Template command (first 200 chars): ${command.slice(0, 200)}...`);
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn("sh", ["-c", command], {
     env: { ...process.env, LOG_LEVEL: logLevel },
     stdio: ["pipe", "pipe", "pipe"]
@@ -283,6 +303,7 @@ function spawnExecutorWithTemplate(payload, options) {
   });
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -294,7 +315,7 @@ function spawnExecutorWithTemplate(payload, options) {
         `${logPrefix} Executor exited with code ${code} (task: ${templateVariables.task_id})`
       );
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -574,12 +595,19 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
+}
+function generateScopedServiceToken(app, params) {
+  return generateSessionToken(app, serviceTokenScopeForParams(params));
 }
 function createConfiguredSpawner(executionConfig) {
   return function configuredSpawnExecutor(payload, options = {}) {
@@ -600,10 +628,12 @@ export {
   createConfiguredSpawner,
   createServiceToken,
   findExecutorPath,
+  generateScopedServiceToken,
   generateSessionToken,
   generateTaskId,
   getDaemonUrl,
   runExecutorCommand,
+  serviceTokenScopeForParams,
   spawnExecutor,
   spawnExecutorFireAndForget,
   substituteTemplateVariables

package/dist/daemon/utils/tenant-db-scope.d.ts

@@ -0,0 +1,20 @@
+import { type AgorConfig } from '@agor/core/config';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { HookContext } from '@agor/core/types';
+interface TenantDatabaseScopeOptions {
+    db: TenantScopeAwareDatabase;
+    config: AgorConfig;
+    jwtSecret: string;
+}
+export declare function resolveTenantIdForDeferredScope(params?: unknown): string | undefined;
+/**
+ * Schedule asynchronous work outside the current ALS store, then re-enter a
+ * fresh tenant database scope for the captured tenant. Use this for delayed
+ * executor/queue/gateway work: bare setImmediate inherits possibly-committed
+ * transaction objects, but a bare runWithoutTenantDatabaseScope loses Postgres
+ * RLS context entirely.
+ */
+export declare function deferWithTenantDatabaseScope(db: TenantScopeAwareDatabase, params: unknown, work: () => Promise<void>, onError?: (error: unknown) => void): void;
+export declare function createTenantDatabaseScopeAroundHook(options: TenantDatabaseScopeOptions): (context: HookContext, next: () => Promise<void>) => Promise<void>;
+export {};
+//# sourceMappingURL=tenant-db-scope.d.ts.map

package/dist/daemon/utils/tenant-db-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-db-scope.d.ts","sourceRoot":"","sources":["../../src/utils/tenant-db-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,WAAW,EAA2B,MAAM,kBAAkB,CAAC;AAI7E,UAAU,0BAA0B;IAClC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAkBD,wBAAgB,+BAA+B,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGpF;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,EAAE,EAAE,wBAAwB,EAC5B,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,GACjC,IAAI,CAmCN;AAED,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,0BAA0B,IAkDvE,SAAS,WAAW,EAAE,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KAAG,OAAO,CAAC,IAAI,CAAC,CAY9E"}

package/dist/daemon/utils/tenant-db-scope.js

@@ -0,0 +1,114 @@
+// src/utils/tenant-db-scope.ts
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope
+} from "@agor/core/db";
+import { NotAuthenticated } from "@agor/core/feathers";
+import jwt2 from "jsonwebtoken";
+
+// src/auth/runtime-tokens.ts
+import jwt from "jsonwebtoken";
+var RUNTIME_JWT_ISSUER = "agor";
+var RUNTIME_JWT_AUDIENCE = "https://agor.dev";
+
+// src/utils/tenant-db-scope.ts
+function readHeaderValue(headers, name) {
+  if (!headers) return null;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== wanted) continue;
+    const raw = Array.isArray(value) ? value[0] : value;
+    return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+  }
+  return null;
+}
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope(db, tenantId, work).catch((error) => {
+          if (onError) {
+            onError(error);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
+}
+function createTenantDatabaseScopeAroundHook(options) {
+  const multiTenancy = resolveMultiTenancyConfig(options.config);
+  const bearerPayloadFromHeaders = (headers) => {
+    const authorization = readHeaderValue(headers, "authorization");
+    const match = authorization?.match(/^Bearer\s+(.+)$/i);
+    if (!match || !options.jwtSecret) return void 0;
+    try {
+      return jwt2.verify(match[1], options.jwtSecret, {
+        issuer: RUNTIME_JWT_ISSUER,
+        audience: RUNTIME_JWT_AUDIENCE
+      });
+    } catch {
+      return void 0;
+    }
+  };
+  const resolveTenantForDatabaseScope = (context) => {
+    const params = context.params;
+    const connectionTenant = params.connection?.tenant ?? params.connection?.data?.tenant;
+    const paramsWithConnectionTenant = connectionTenant && typeof connectionTenant === "object" && "tenant_id" in connectionTenant ? { ...params, tenant: params.tenant ?? connectionTenant } : params;
+    try {
+      return resolveTenantContext(multiTenancy, {
+        params: paramsWithConnectionTenant,
+        authPayload: paramsWithConnectionTenant.authentication?.payload ?? bearerPayloadFromHeaders(paramsWithConnectionTenant.headers),
+        headers: paramsWithConnectionTenant.headers
+      });
+    } catch (error) {
+      const inheritedTenantId = getCurrentTenantId();
+      if (error instanceof TenantResolutionError && inheritedTenantId) {
+        return { tenant_id: inheritedTenantId, source: "explicit" };
+      }
+      throw error;
+    }
+  };
+  return async (context, next) => {
+    try {
+      context.params.tenant = resolveTenantForDatabaseScope(context);
+    } catch (error) {
+      if (error instanceof TenantResolutionError) {
+        throw new NotAuthenticated(error.message);
+      }
+      throw error;
+    }
+    await runWithTenantDatabaseScope(options.db, context.params.tenant?.tenant_id, next);
+  };
+}
+export {
+  createTenantDatabaseScopeAroundHook,
+  deferWithTenantDatabaseScope,
+  resolveTenantIdForDeferredScope
+};

package/dist/daemon/utils/unix-group-init.d.ts

@@ -10,8 +10,8 @@
  *   client.service('repos').initializeUnixGroup(...)
  *   client.service('branches').initializeUnixGroup(...)
  */
-import type { Database } from '@agor/core/db';
+import type { TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
-export declare function initializeRepoUnixGroup(db: Database, app: Application, repoId: string, userId?: string): Promise<string>;
-export declare function initializeBranchUnixGroup(db: Database, app: Application, branchId: string, othersAccess: 'none' | 'read' | 'write'): Promise<string>;
+export declare function initializeRepoUnixGroup(db: TenantScopeAwareDatabase, app: Application, repoId: string, userId?: string): Promise<string>;
+export declare function initializeBranchUnixGroup(db: TenantScopeAwareDatabase, app: Application, branchId: string, othersAccess: 'none' | 'read' | 'write'): Promise<string>;
 //# sourceMappingURL=unix-group-init.d.ts.map

package/dist/daemon/utils/unix-group-init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unix-group-init.d.ts","sourceRoot":"","sources":["../../src/utils/unix-group-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAoCvD,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAID,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CAmGjB"}
+{"version":3,"file":"unix-group-init.d.ts","sourceRoot":"","sources":["../../src/utils/unix-group-init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAoCvD,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW,EAChB,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,CAsEjB;AAID,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW,EAChB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GACtC,OAAO,CAAC,MAAM,CAAC,CAmGjB"}

package/dist/daemon/utils/upload.d.ts

@@ -1,12 +1,8 @@
 /**
  * Upload middleware using multer for file upload handling
  *
- * Supports uploading files to:
- * - Branch (.agor/uploads/) - Default, agent-accessible
- * - Temp folder - Ephemeral uploads
- * - Global (~/.agor/uploads/) - Shared across sessions
+ * Stores daemon-side uploads under ~/.agor/uploads/.
  */
-import type { BranchRepository, SessionRepository } from '@agor/core/db';
 import type { NextFunction, Request, Response } from 'express';
 import multer from 'multer';
 /**
@@ -26,17 +22,18 @@ export declare const MAX_UPLOAD_FILES_PER_REQUEST = 10;
 /** Max combined size of all files in a single request (bytes). */
 export declare const MAX_UPLOAD_TOTAL_SIZE: number;
 /**
- * Destination types for file uploads
+ * Resolve the only supported daemon-side upload directory.
  */
-export type UploadDestination = 'branch' | 'temp' | 'global';
+export declare function getUploadDirectory(): string;
+export declare function validateUploadDestinationQuery(destination: unknown): void;
 /**
  * Create multer storage configuration
  */
-export declare function createUploadStorage(sessionRepo: SessionRepository, branchRepo: BranchRepository): multer.StorageEngine;
+export declare function createUploadStorage(): multer.StorageEngine;
 /**
  * Create configured multer instance
  */
-export declare function createUploadMiddleware(sessionRepo: SessionRepository, branchRepo: BranchRepository): multer.Multer;
+export declare function createUploadMiddleware(): multer.Multer;
 /**
  * Pre-multer middleware: reject any request whose declared `Content-Length`
  * exceeds {@link MAX_UPLOAD_TOTAL_SIZE} before we spend time streaming bytes

package/dist/daemon/utils/upload.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/utils/upload.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAoBxD,CAAC;AAEH,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,yDAAyD;AACzD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,QAAoB,CAAC;AAKvD;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7D;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB,wBAgG/F;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,iBAAiB,EAC9B,UAAU,EAAE,gBAAgB,iBAuC7B;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAY/D;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAoB9E"}
+{"version":3,"file":"upload.d.ts","sourceRoot":"","sources":["../../src/utils/upload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CAoBxD,CAAC;AAEH,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AACrD,yDAAyD;AACzD,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,QAAoB,CAAC;AAOvD;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAiBzE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,yBA6DlC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,kBAsCrC;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,IAAI,CAY/D;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,KAC5B,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAoB9E"}

package/dist/daemon/utils/upload.js

@@ -1,8 +1,7 @@
 // src/utils/upload.ts
 import fs from "fs/promises";
-import os from "os";
 import path from "path";
-import { shortId } from "@agor/core/db";
+import { getAgorHome } from "@agor/core/config";
 import multer from "multer";
 var ALLOWED_UPLOAD_MIME_TYPES = /* @__PURE__ */ new Set([
   // Images
@@ -29,46 +28,38 @@ var MAX_UPLOAD_FILE_SIZE = 50 * 1024 * 1024;
 var MAX_UPLOAD_FILES_PER_REQUEST = 10;
 var MAX_UPLOAD_TOTAL_SIZE = 100 * 1024 * 1024;
 var DEBUG_UPLOAD = process.env.NODE_ENV !== "production";
-function createUploadStorage(sessionRepo, branchRepo) {
+var LEGACY_IGNORED_UPLOAD_DESTINATIONS = /* @__PURE__ */ new Set(["branch", "global"]);
+function getUploadDirectory() {
+  return path.join(getAgorHome(), "uploads");
+}
+function validateUploadDestinationQuery(destination) {
+  if (destination == null || destination === "") return;
+  if (Array.isArray(destination)) {
+    throw Object.assign(new Error("Upload destination options are no longer supported"), {
+      status: 400
+    });
+  }
+  const value = String(destination);
+  if (LEGACY_IGNORED_UPLOAD_DESTINATIONS.has(value)) return;
+  throw Object.assign(
+    new Error(
+      `Upload destination '${value}' is no longer supported; uploads are stored in ~/.agor/uploads/`
+    ),
+    { status: 400 }
+  );
+}
+function createUploadStorage() {
   const storage = multer.diskStorage({
     destination: async (req, _file, cb) => {
       try {
         const { sessionId } = req.params;
-        const destination = req.query.destination || "branch";
-        if (!["branch", "temp", "global"].includes(destination)) {
-          console.error(`\u274C [Upload Storage] Invalid destination: ${destination}`);
-          return cb(new Error(`Invalid destination: ${destination}`), "");
-        }
+        validateUploadDestinationQuery(req.query.destination);
         if (DEBUG_UPLOAD) {
           console.log(
-            `\u{1F4C2} [Upload Storage] Processing upload for session ${sessionId ? shortId(sessionId) : "unknown"}`
+            `\u{1F4C2} [Upload Storage] Processing upload for session ${sessionId || "unknown"}`
           );
-          console.log(`   Destination type: ${destination}`);
-        }
-        if (!sessionId) {
-          console.error("\u274C [Upload Storage] No session ID provided");
-          return cb(new Error("Session ID required"), "");
-        }
-        const session = await sessionRepo.findById(sessionId);
-        if (!session) {
-          console.error(`\u274C [Upload Storage] Session not found: ${shortId(sessionId)}`);
-          return cb(new Error(`Session not found: ${sessionId}`), "");
-        }
-        if (!session.branch_id) {
-          console.error(`\u274C [Upload Storage] Session ${shortId(sessionId)} has no branch`);
-          return cb(new Error(`Session ${sessionId} has no associated branch`), "");
-        }
-        const branch = await branchRepo.findById(session.branch_id);
-        if (!branch) {
-          console.error(`\u274C [Upload Storage] Branch not found: ${shortId(session.branch_id)}`);
-          return cb(new Error(`Branch not found: ${session.branch_id}`), "");
         }
-        const paths = {
-          branch: path.join(branch.path, ".agor", "uploads"),
-          temp: path.join(os.tmpdir(), "agor-uploads"),
-          global: path.join(os.homedir(), ".agor", "uploads")
-        };
-        const dest = paths[destination] || paths.branch;
+        const dest = getUploadDirectory();
         if (DEBUG_UPLOAD) console.log(`\u{1F4C1} [Upload Storage] Target directory: ${dest}`);
         await fs.mkdir(dest, { recursive: true });
         if (DEBUG_UPLOAD) console.log(`\u2705 [Upload Storage] Directory created/verified: ${dest}`);
@@ -95,8 +86,8 @@ function createUploadStorage(sessionRepo, branchRepo) {
   });
   return storage;
 }
-function createUploadMiddleware(sessionRepo, branchRepo) {
-  const storage = createUploadStorage(sessionRepo, branchRepo);
+function createUploadMiddleware() {
+  const storage = createUploadStorage();
   return multer({
     storage,
     limits: {
@@ -169,5 +160,7 @@ export {
   createUploadMiddleware,
   createUploadStorage,
   enforceParsedTotalUploadSize,
-  enforceTotalUploadSize
+  enforceTotalUploadSize,
+  getUploadDirectory,
+  validateUploadDestinationQuery
 };