agor-live 0.21.2 → 0.23.1

package/dist/core/unix/index.cjs

@@ -12,14 +12,15 @@ var __export = (target, all) => {
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __copyProps = (to, from, except, desc7) => {
+var __copyProps = (to, from, except, desc6) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
       if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc7 = __getOwnPropDesc(from, key)) || desc7.enumerable });
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc6 = __getOwnPropDesc(from, key)) || desc6.enumerable });
   }
   return to;
 };
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
 var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
   // If the importer is in node compatibility mode or this is not an ESM
   // file that has been converted to a CommonJS file using a Babel-
@@ -31,9 +32,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // ../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.15_tsx@4.22.4_typescript@6.0.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl, importMetaUrl;
 var init_cjs_shims = __esm({
   "../../node_modules/.pnpm/tsup@8.5.1_jiti@2.6.1_postcss@8.5.15_tsx@4.22.4_typescript@6.0.3_yaml@2.9.0/node_modules/tsup/assets/cjs_shims.js"() {
     "use strict";
+    getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+    importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
   }
 });
 
@@ -156,6 +160,71 @@ var init_executor_heartbeat = __esm({
   }
 });
 
+// src/config/multitenancy.ts
+function detectPostgresUrl(url) {
+  if (!url) return false;
+  const lower = url.toLowerCase();
+  return lower.startsWith("postgresql://") || lower.startsWith("postgres://") || lower.startsWith("pg://");
+}
+function resolveMultiTenancyDatabaseDialect(config = {}) {
+  if (process.env.AGOR_DB_DIALECT === "postgresql" || process.env.AGOR_DB_DIALECT === "sqlite") {
+    return process.env.AGOR_DB_DIALECT;
+  }
+  if (detectPostgresUrl(process.env.DATABASE_URL)) return "postgresql";
+  if (config.database?.dialect === "postgresql" || config.database?.dialect === "sqlite") {
+    return config.database.dialect;
+  }
+  if (detectPostgresUrl(config.database?.postgresql?.url) || config.database?.postgresql?.host) {
+    return "postgresql";
+  }
+  return "sqlite";
+}
+function resolveMultiTenancyConfig(config) {
+  const raw = config.multi_tenancy ?? {};
+  const mode = raw.mode ?? "static";
+  return {
+    mode,
+    static_tenant_id: raw.static_tenant_id?.trim() || DEFAULT_STATIC_TENANT_ID,
+    ...raw.auth_claim ? { auth_claim: raw.auth_claim } : {},
+    ...raw.trusted_header ? { trusted_header: raw.trusted_header } : {}
+  };
+}
+function assertValidMultiTenancyConfig(config) {
+  const resolved = resolveMultiTenancyConfig(config);
+  if (resolved.mode !== "static" && resolved.mode !== "required_from_auth") {
+    throw new Error("Config error: multi_tenancy.mode must be one of: static, required_from_auth");
+  }
+  if (!resolved.static_tenant_id) {
+    throw new Error("Config error: multi_tenancy.static_tenant_id must not be empty");
+  }
+  if (resolved.auth_claim && RESERVED_AUTH_CLAIMS.has(resolved.auth_claim)) {
+    throw new Error(
+      `Config error: multi_tenancy.auth_claim cannot be reserved JWT claim '${resolved.auth_claim}'`
+    );
+  }
+  if (resolved.mode === "required_from_auth") {
+    if (resolveMultiTenancyDatabaseDialect(config) !== "postgresql") {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires database.dialect: postgresql"
+      );
+    }
+    if (!resolved.auth_claim && !resolved.trusted_header) {
+      throw new Error(
+        "Config error: multi_tenancy.required_from_auth requires multi_tenancy.auth_claim or multi_tenancy.trusted_header"
+      );
+    }
+  }
+}
+var DEFAULT_STATIC_TENANT_ID, RESERVED_AUTH_CLAIMS;
+var init_multitenancy = __esm({
+  "src/config/multitenancy.ts"() {
+    "use strict";
+    init_cjs_shims();
+    DEFAULT_STATIC_TENANT_ID = "default";
+    RESERVED_AUTH_CLAIMS = /* @__PURE__ */ new Set(["aud", "exp", "iat", "iss", "jti", "nbf", "sub", "type"]);
+  }
+});
+
 // src/config/types.ts
 var BRANCH_STORAGE_MODES, DEFAULT_BRANCH_STORAGE_MODE;
 var init_types = __esm({
@@ -200,6 +269,7 @@ __export(config_manager_exports, {
   requireDaemonUser: () => requireDaemonUser,
   requirePublicBaseUrl: () => requirePublicBaseUrl,
   resolveBranchStorageConfig: () => resolveBranchStorageConfig,
+  resolveExecutionSecurityMode: () => resolveExecutionSecurityMode,
   saveConfig: () => saveConfig,
   setConfigValue: () => setConfigValue,
   unsetConfigValue: () => unsetConfigValue
@@ -209,8 +279,8 @@ function cacheKeyMatches(a, b) {
 }
 function statCacheKey(configPath) {
   try {
-    const stat2 = (0, import_node_fs2.statSync)(configPath);
-    return { mtimeMs: stat2.mtimeMs, size: stat2.size };
+    const stat = (0, import_node_fs2.statSync)(configPath);
+    return { mtimeMs: stat.mtimeMs, size: stat.size };
   } catch (error) {
     if (error.code === "ENOENT") {
       return NO_FILE_KEY;
@@ -238,7 +308,10 @@ function __resetConfigCacheForTests() {
   invalidateConfigCache();
 }
 function parseAndValidateConfig(content) {
-  const parsed = import_js_yaml2.default.load(content);
+  if (content.trim() === "") {
+    return {};
+  }
+  const parsed = yaml2.load(content);
   const finalConfig = parsed || {};
   validateConfig(finalConfig);
   return finalConfig;
@@ -275,6 +348,7 @@ To update: agor config set execution.unix_user_mode insulated`
       `Config error: execution.managed_envs_execution_mode must be one of: hybrid, webhook-only`
     );
   }
+  assertValidMultiTenancyConfig(config);
   validateOptionalHttpUrl(
     config.external_launch,
     "login_redirect_url",
@@ -354,7 +428,7 @@ async function saveConfig(config) {
   validateConfig(config);
   await ensureAgorHome();
   const configPath = getConfigPath();
-  const content = import_js_yaml2.default.dump(config, {
+  const content = yaml2.dump(config, {
     indent: 2,
     lineWidth: 120,
     noRefs: true
@@ -392,7 +466,12 @@ function getDefaultConfig() {
       // Default: sync passwords to Unix
       executor_heartbeat: resolveExecutorHeartbeatConfig()
     },
-    analytics: getDefaultAnalyticsConfig()
+    analytics: getDefaultAnalyticsConfig(),
+    telemetry: {},
+    multi_tenancy: {
+      mode: "static",
+      static_tenant_id: "default"
+    }
   };
 }
 function expandHomePath(input) {
@@ -424,7 +503,8 @@ async function getConfigValue(key) {
     ui: { ...defaults.ui, ...config.ui },
     execution: { ...defaults.execution, ...config.execution },
     paths: { ...defaults.paths, ...config.paths },
-    analytics: { ...defaults.analytics, ...config.analytics }
+    analytics: { ...defaults.analytics, ...config.analytics },
+    telemetry: { ...defaults.telemetry, ...config.telemetry }
   };
   const parts = key.split(".");
   let value = merged;
@@ -495,6 +575,9 @@ async function getBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   const defaults = getDefaultConfig();
   const envPort = process.env.PORT ? Number.parseInt(process.env.PORT, 10) : void 0;
   const port = envPort || config.daemon?.port || defaults.daemon?.port || DAEMON.DEFAULT_PORT;
@@ -509,8 +592,11 @@ async function requirePublicBaseUrl() {
   if (config.daemon?.base_url) {
     return validateBaseUrl(config.daemon.base_url);
   }
+  if (config.ui?.base_url) {
+    return validateBaseUrl(config.ui.base_url);
+  }
   throw new PublicBaseUrlNotConfiguredError(
-    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
+    "No public base URL configured. Set the AGOR_BASE_URL environment variable or `daemon.base_url` (preferred) / `ui.base_url` (legacy) in ~/.agor/config.yaml to the daemon's browser-reachable URL (e.g. https://agor.example.com). This is required so OAuth providers can redirect users back to a URL their browser can reach \u2014 the localhost fallback only works for browsers on the daemon machine."
   );
 }
 function loadConfigSync() {
@@ -580,10 +666,10 @@ function requireDaemonUser(config) {
   if (config.daemon?.unix_user) {
     return config.daemon.unix_user;
   }
-  const unixIsolationEnabled = config.execution?.branch_rbac === true || config.execution?.unix_user_mode && config.execution.unix_user_mode !== "simple";
+  const unixIsolationEnabled = resolveExecutionSecurityMode(config).requiresDaemonUnixUser;
   if (unixIsolationEnabled) {
     throw new Error(
-      "Unix isolation is enabled (branch_rbac or unix_user_mode) but daemon.unix_user is not configured.\nPlease set daemon.unix_user in ~/.agor/config.yaml to the user running the daemon.\nExample:\n  daemon:\n    unix_user: agor"
+      "Unix isolation is enabled (execution.unix_user_mode is insulated or strict) but daemon.unix_user is not configured.\nPlease set daemon.unix_user in ~/.agor/config.yaml to the user running the daemon.\nExample:\n  daemon:\n    unix_user: agor"
     );
   }
   const user = process.env.USER || import_node_os.default.userInfo().username;
@@ -594,19 +680,29 @@ function requireDaemonUser(config) {
   }
   return user;
 }
+function resolveExecutionSecurityMode(config = loadConfigSync()) {
+  const unixUserMode = config.execution?.unix_user_mode ?? "simple";
+  const unixIsolationEnabled = unixUserMode !== "simple";
+  return {
+    appRbacEnabled: config.execution?.branch_rbac === true,
+    unixUserMode,
+    unixImpersonationEnabled: unixIsolationEnabled,
+    unixFsIsolationEnabled: unixIsolationEnabled,
+    unixGroupRefreshNeeded: unixIsolationEnabled,
+    requiresDaemonUnixUser: unixIsolationEnabled,
+    shouldInitUnixGroups: unixIsolationEnabled
+  };
+}
 function isBranchRbacEnabled() {
   try {
-    const config = loadConfigSync();
-    return config.execution?.branch_rbac === true;
+    return resolveExecutionSecurityMode().appRbacEnabled;
   } catch {
     return false;
   }
 }
 function isUnixImpersonationEnabled() {
   try {
-    const config = loadConfigSync();
-    const mode = config.execution?.unix_user_mode;
-    return mode !== void 0 && mode !== "simple";
+    return resolveExecutionSecurityMode().unixImpersonationEnabled;
   } catch {
     return false;
   }
@@ -632,7 +728,7 @@ function ensureBranchStorageModeAllowed(mode) {
   }
 }
 function isUnixGroupRefreshNeeded() {
-  return isBranchRbacEnabled() || isUnixImpersonationEnabled();
+  return resolveExecutionSecurityMode().unixGroupRefreshNeeded;
 }
 function getDataHome() {
   if (process.env.AGOR_DATA_HOME) {
@@ -675,7 +771,7 @@ async function getReposDirAsync() {
 async function getBranchesDirAsync() {
   return import_node_path.default.join(await getDataHomeAsync(), "worktrees");
 }
-var import_node_fs2, import_promises, import_node_os, import_node_path, import_js_yaml2, NO_FILE, NO_FILE_KEY, cachedEntry, PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
+var import_node_fs2, import_promises, import_node_os, import_node_path, yaml2, NO_FILE, NO_FILE_KEY, cachedEntry, PublicBaseUrlNotConfiguredError, CONFIG_CREDENTIAL_KEYS;
 var init_config_manager = __esm({
   "src/config/config-manager.ts"() {
     "use strict";
@@ -684,10 +780,11 @@ var init_config_manager = __esm({
     import_promises = __toESM(require("fs/promises"), 1);
     import_node_os = __toESM(require("os"), 1);
     import_node_path = __toESM(require("path"), 1);
-    import_js_yaml2 = __toESM(require("js-yaml"), 1);
+    yaml2 = __toESM(require("js-yaml"), 1);
     init_analytics_defaults();
     init_constants();
     init_executor_heartbeat();
+    init_multitenancy();
     init_types();
     NO_FILE = -1;
     NO_FILE_KEY = { mtimeMs: NO_FILE, size: 0 };
@@ -710,6 +807,21 @@ var init_config_manager = __esm({
   }
 });
 
+// src/db/tenant-context.ts
+function getCurrentTenantId() {
+  const store = tenantDatabaseScope.getStore();
+  return store?.kind === "tenant" ? store.tenantId : void 0;
+}
+var import_node_async_hooks, tenantDatabaseScope;
+var init_tenant_context = __esm({
+  "src/db/tenant-context.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_async_hooks = require("async_hooks");
+    tenantDatabaseScope = new import_node_async_hooks.AsyncLocalStorage();
+  }
+});
+
 // src/db/database-wrapper.ts
 var database_wrapper_exports = {};
 __export(database_wrapper_exports, {
@@ -775,7 +887,7 @@ function dateTruncUtc(db, column, bucket) {
     }
   } else {
     return import_drizzle_orm.sql`to_char(
-      date_trunc(${bucket}, ${column} AT TIME ZONE 'UTC'),
+      date_trunc(${import_drizzle_orm.sql.raw(`'${bucket}'`)}, ${column} AT TIME ZONE 'UTC'),
       'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'
     )`;
   }
@@ -797,12 +909,12 @@ function advisoryLockKeyForUuid(uuid) {
   const FNV_OFFSET = 0xcbf29ce484222325n;
   const FNV_PRIME = 0x100000001b3n;
   const MASK_64 = 0xffffffffffffffffn;
-  let hash2 = FNV_OFFSET;
+  let hash = FNV_OFFSET;
   for (let i = 0; i < uuid.length; i++) {
-    hash2 ^= BigInt(uuid.charCodeAt(i));
-    hash2 = hash2 * FNV_PRIME & MASK_64;
+    hash ^= BigInt(uuid.charCodeAt(i));
+    hash = hash * FNV_PRIME & MASK_64;
   }
-  return hash2 > 0x7fffffffffffffffn ? hash2 - 0x10000000000000000n : hash2;
+  return hash > 0x7fffffffffffffffn ? hash - 0x10000000000000000n : hash;
 }
 async function executeRaw(db, query) {
   if (isSQLiteDatabase(db)) {
@@ -830,21 +942,36 @@ async function getOne(db, table, where) {
 }
 async function insertOne(db, table, values) {
   if (isSQLiteDatabase(db)) {
-    const result = await db.insert(table).values(values).returning();
+    const result = await db.insert(table).values(withTenantInsertValues(values, table)).returning();
     return result;
   } else {
-    const result = await db.insert(table).values(values).returning();
+    const result = await db.insert(table).values(withTenantInsertValues(values, table)).returning();
     return result[0];
   }
 }
-function wrapQuery(query, db) {
+function tableHasTenantColumn(table) {
+  return Boolean(table && "tenant_id" in table);
+}
+function withTenantInsertValues(values, table) {
+  const tenantId = getCurrentTenantId();
+  if (!tenantId || !tableHasTenantColumn(table)) return values;
+  const stamp = (row) => {
+    if (!row || typeof row !== "object" || Array.isArray(row)) return row;
+    if ("tenant_id" in row) return row;
+    return { tenant_id: tenantId, ...row };
+  };
+  return Array.isArray(values) ? values.map(stamp) : stamp(values);
+}
+function wrapQuery(query, db, table) {
   return {
     ...query,
     one: async () => {
       if (isSQLiteDatabase(db)) {
         return await query.get();
       } else {
-        const results = await query.limit(1);
+        const results = await query.limit(
+          1
+        );
         return results[0] || null;
       }
     },
@@ -866,30 +993,55 @@ function wrapQuery(query, db) {
         return { rowsAffected: result.length || 0 };
       }
     },
-    // biome-ignore lint/suspicious/noExplicitAny: Drizzle query builder types vary by dialect
     returning: () => wrapReturning(query.returning(), db),
     // Preserve chainable methods
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    where: (...args) => wrapQuery(query.where(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    limit: (...args) => wrapQuery(query.limit(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    offset: (...args) => wrapQuery(query.offset(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    orderBy: (...args) => wrapQuery(query.orderBy(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    groupBy: (...args) => wrapQuery(query.groupBy(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    set: (...args) => wrapQuery(query.set(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    values: (...args) => wrapQuery(query.values(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    innerJoin: (...args) => wrapQuery(query.innerJoin(...args), db),
-    // biome-ignore lint/suspicious/noExplicitAny: These methods accept varying argument types from Drizzle
-    leftJoin: (...args) => wrapQuery(query.leftJoin(...args), db),
-    onConflictDoNothing: (...args) => (
-      // biome-ignore lint/suspicious/noExplicitAny: Drizzle exposes onConflictDoNothing on both dialects after .values()
-      wrapQuery(query.onConflictDoNothing(...args), db)
+    where: (...args) => wrapQuery(
+      query.where(...args),
+      db,
+      table
+    ),
+    limit: (...args) => wrapQuery(
+      query.limit(...args),
+      db,
+      table
+    ),
+    offset: (...args) => wrapQuery(
+      query.offset(...args),
+      db,
+      table
+    ),
+    orderBy: (...args) => wrapQuery(
+      query.orderBy(...args),
+      db,
+      table
+    ),
+    groupBy: (...args) => wrapQuery(
+      query.groupBy(...args),
+      db,
+      table
+    ),
+    set: (...args) => wrapQuery(query.set(...args), db, table),
+    values: (...args) => wrapQuery(
+      query.values(
+        ...args.map((arg) => withTenantInsertValues(arg, table))
+      ),
+      db,
+      table
+    ),
+    innerJoin: (...args) => wrapQuery(
+      query.innerJoin(...args),
+      db,
+      table
+    ),
+    leftJoin: (...args) => wrapQuery(
+      query.leftJoin(...args),
+      db,
+      table
+    ),
+    onConflictDoNothing: (...args) => wrapQuery(
+      query.onConflictDoNothing(...args),
+      db,
+      table
     )
   };
 }
@@ -922,7 +1074,7 @@ function select(db, columns) {
 }
 function insert(db, table) {
   const query = db.insert(table);
-  return wrapQuery(query, db);
+  return wrapQuery(query, db, table);
 }
 function update(db, table) {
   const query = db.update(table);
@@ -962,6 +1114,7 @@ var init_database_wrapper = __esm({
     "use strict";
     init_cjs_shims();
     import_drizzle_orm = require("drizzle-orm");
+    init_tenant_context();
   }
 });
 
@@ -1166,15 +1319,35 @@ var init_schedule = __esm({
 });
 
 // src/types/session.ts
+var SessionStatus, EXECUTING_SESSION_STATUSES;
 var init_session = __esm({
   "src/types/session.ts"() {
     "use strict";
     init_cjs_shims();
+    SessionStatus = {
+      IDLE: "idle",
+      RUNNING: "running",
+      STOPPING: "stopping",
+      // Stop requested, waiting for task to stop
+      AWAITING_PERMISSION: "awaiting_permission",
+      AWAITING_INPUT: "awaiting_input",
+      // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+      TIMED_OUT: "timed_out",
+      // Permission/input request timed out, executor exited — user must re-prompt
+      COMPLETED: "completed",
+      FAILED: "failed"
+    };
+    EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+      SessionStatus.RUNNING,
+      SessionStatus.STOPPING,
+      SessionStatus.AWAITING_PERMISSION,
+      SessionStatus.AWAITING_INPUT
+    ]);
   }
 });
 
 // src/types/task.ts
-var TaskStatus, TERMINAL_TASK_STATUSES;
+var TaskStatus, TERMINAL_TASK_STATUSES, EXECUTING_TASK_STATUSES;
 var init_task = __esm({
   "src/types/task.ts"() {
     "use strict";
@@ -1202,6 +1375,12 @@ var init_task = __esm({
       TaskStatus.STOPPED,
       TaskStatus.TIMED_OUT
     ]);
+    EXECUTING_TASK_STATUSES = /* @__PURE__ */ new Set([
+      TaskStatus.RUNNING,
+      TaskStatus.STOPPING,
+      TaskStatus.AWAITING_PERMISSION,
+      TaskStatus.AWAITING_INPUT
+    ]);
   }
 });
 
@@ -1213,6 +1392,14 @@ var init_template = __esm({
   }
 });
 
+// src/types/tenant.ts
+var init_tenant = __esm({
+  "src/types/tenant.ts"() {
+    "use strict";
+    init_cjs_shims();
+  }
+});
+
 // src/types/ui.ts
 var init_ui = __esm({
   "src/types/ui.ts"() {
@@ -1318,6 +1505,7 @@ var init_types2 = __esm({
     init_session();
     init_task();
     init_template();
+    init_tenant();
     init_ui();
     init_user();
     init_utils();
@@ -1343,6 +1531,7 @@ __export(schema_postgres_exports, {
   cardTypes: () => cardTypes,
   cards: () => cards,
   gatewayChannels: () => gatewayChannels,
+  gatewayOutboundMessages: () => gatewayOutboundMessages,
   groupMemberships: () => groupMemberships,
   groups: () => groups,
   kbDocumentUnits: () => kbDocumentUnits,
@@ -1361,6 +1550,8 @@ __export(schema_postgres_exports, {
   serializedSessions: () => serializedSessions,
   sessionEnvSelections: () => sessionEnvSelections,
   sessionMcpServers: () => sessionMcpServers,
+  sessionRelationships: () => sessionRelationships,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations,
   sessions: () => sessions,
   sessionsRelations: () => sessionsRelations,
   tasks: () => tasks,
@@ -1369,7 +1560,7 @@ __export(schema_postgres_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens,
   users: () => users
 });
-var import_drizzle_orm2, import_pg_core, bytea, t, sessions, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, branchesRelations, schedulesRelations;
+var import_drizzle_orm2, import_pg_core, bytea, t, sessions, sessionRelationships, tasks, serializedSessions, messages, boards, repos, branches, branchOwners, boardOwners, schedules, users, groups, groupMemberships, branchGroupGrants, boardGroupGrants, appVariables, userApiKeys, mcpServers, cardTypes, cards, artifacts, artifactTrustGrants, boardObjects, sessionMcpServers, userMcpOauthTokens, boardComments, gatewayChannels, threadSessionMap, gatewayOutboundMessages, sessionEnvSelections, kbNamespaces, kbNamespaceAcl, kbDocuments, kbDocumentVersions, kbDocumentUnits, kbEmbeddingSpaces, kbGraphNodes, kbGraphEdges, sessionsRelations, sessionRelationshipsRelations, branchesRelations, schedulesRelations;
 var init_schema_postgres = __esm({
   "src/db/schema.postgres.ts"() {
     "use strict";
@@ -1390,6 +1581,7 @@ var init_schema_postgres = __esm({
     sessions = (0, import_pg_core.pgTable)(
       "sessions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1449,7 +1641,9 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("sessions_tenant_id_idx").on(table.tenant_id),
         statusIdx: (0, import_pg_core.index)("sessions_status_idx").on(table.status),
+        statusReadyIdx: (0, import_pg_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: (0, import_pg_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: (0, import_pg_core.index)("sessions_board_idx").on(table.board_id),
         branchIdx: (0, import_pg_core.index)("sessions_branch_idx").on(table.branch_id),
@@ -1461,12 +1655,57 @@ var init_schema_postgres = __esm({
         // Partial unique index — covering for the scheduler's dedup lookup
         // AND serves as the DB-level guard against check-then-create races
         // in spawnScheduledSession.
-        scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+        scheduleRunUnique: (0, import_pg_core.uniqueIndex)("sessions_schedule_run_unique").on(table.tenant_id, table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm2.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
+      })
+    );
+    sessionRelationships = (0, import_pg_core.pgTable)(
+      "session_relationships",
+      {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+        relationship_id: (0, import_pg_core.varchar)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_pg_core.varchar)("target_session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_pg_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at"),
+        callback_enabled: t.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_pg_core.varchar)("callback_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t.json("data")
+      },
+      (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_relationships_tenant_id_idx").on(table.tenant_id),
+        sourceIdx: (0, import_pg_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_pg_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_pg_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        // Composite indexes so the OR predicate in dispatchCompletionCallbacks
+        // (WHERE source_session_id = $1 OR target_session_id = $2) uses BitmapOr
+        // over these instead of a full tenant table scan via tenant_id_idx.
+        tenantSourceIdx: (0, import_pg_core.index)("session_relationships_tenant_source_idx").on(
+          table.tenant_id,
+          table.source_session_id
+        ),
+        tenantTargetIdx: (0, import_pg_core.index)("session_relationships_tenant_target_idx").on(
+          table.tenant_id,
+          table.target_session_id
+        ),
+        sourceTargetTypeUnique: (0, import_pg_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.tenant_id,
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
       })
     );
     tasks = (0, import_pg_core.pgTable)(
       "tasks",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         task_id: (0, import_pg_core.varchar)("task_id", { length: 36 }).primaryKey(),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").notNull(),
@@ -1496,19 +1735,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("tasks_tenant_id_idx").on(table.tenant_id),
         sessionIdx: (0, import_pg_core.index)("tasks_session_idx").on(table.session_id),
         statusIdx: (0, import_pg_core.index)("tasks_status_idx").on(table.status),
         createdIdx: (0, import_pg_core.index)("tasks_created_idx").on(table.created_at),
+        // Composite for "latest task for session" queries (ORDER BY created_at DESC LIMIT 1).
+        sessionCreatedIdx: (0, import_pg_core.index)("tasks_session_created_idx").on(table.session_id, table.created_at),
         queueIdx: (0, import_pg_core.index)("tasks_queue_idx").on(table.session_id, table.status, table.queue_position),
         // Partial unique index — defense-in-depth for `tasks.createPending` race
         // serialization. Only QUEUED rows are constrained; CREATED/RUNNING/done
         // rows have NULL queue_position and are unaffected.
-        queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.session_id, table.queue_position).where(import_drizzle_orm2.sql`${table.status} = 'queued'`)
+        queuedPositionUnique: (0, import_pg_core.uniqueIndex)("tasks_queued_position_unique").on(table.tenant_id, table.session_id, table.queue_position).where(import_drizzle_orm2.sql`${table.status} = 'queued'`)
       })
     );
     serializedSessions = (0, import_pg_core.pgTable)(
       "serialized_sessions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
@@ -1524,6 +1767,7 @@ var init_schema_postgres = __esm({
         // gzipped; NULL while status='processing'
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("serialized_sessions_tenant_id_idx").on(table.tenant_id),
         sessionTurnIdx: (0, import_pg_core.index)("serialized_sessions_session_turn_idx").on(
           table.session_id,
           table.turn_index
@@ -1534,6 +1778,7 @@ var init_schema_postgres = __esm({
     messages = (0, import_pg_core.pgTable)(
       "messages",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         message_id: (0, import_pg_core.varchar)("message_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1573,15 +1818,23 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("messages_tenant_id_idx").on(table.tenant_id),
+        tenantTimestampIdx: (0, import_pg_core.index)("messages_tenant_timestamp_idx").on(table.tenant_id, table.timestamp),
         // Indexes for efficient lookups
         sessionIdx: (0, import_pg_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_pg_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: (0, import_pg_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: (0, import_pg_core.index)("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: (0, import_pg_core.index)("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards = (0, import_pg_core.pgTable)(
       "boards",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
@@ -1589,7 +1842,7 @@ var init_schema_postgres = __esm({
         created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull(),
         // Materialized for lookups
         name: (0, import_pg_core.text)("name").notNull(),
-        slug: (0, import_pg_core.text)("slug").unique(),
+        slug: (0, import_pg_core.text)("slug"),
         primary_assistant_id: (0, import_pg_core.varchar)("primary_assistant_id", { length: 36 }).references(
           () => branches.branch_id,
           {
@@ -1604,18 +1857,21 @@ var init_schema_postgres = __esm({
         archived_by: (0, import_pg_core.varchar)("archived_by", { length: 36 })
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("boards_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("boards_name_idx").on(table.name),
-        slugIdx: (0, import_pg_core.index)("boards_slug_idx").on(table.slug)
+        slugIdx: (0, import_pg_core.index)("boards_slug_idx").on(table.slug),
+        slugTenantUnique: (0, import_pg_core.uniqueIndex)("boards_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     repos = (0, import_pg_core.pgTable)(
       "repos",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for querying
-        slug: (0, import_pg_core.text)("slug").notNull().unique(),
+        slug: (0, import_pg_core.text)("slug").notNull(),
         repo_type: (0, import_pg_core.text)("repo_type", { enum: ["remote", "local"] }).notNull().default("remote"),
         // Unix group for repo-level git access (agor_rp_<short-id>)
         // Users who have access to ANY branch in this repo get added to this group.
@@ -1626,12 +1882,15 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.index)("repos_slug_idx").on(table.slug)
+        tenantIdx: (0, import_pg_core.index)("repos_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.index)("repos_slug_idx").on(table.slug),
+        slugTenantUnique: (0, import_pg_core.uniqueIndex)("repos_tenant_slug_unique").on(table.tenant_id, table.slug)
       })
     );
     branches = (0, import_pg_core.pgTable)(
       "branches",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).primaryKey(),
         repo_id: (0, import_pg_core.varchar)("repo_id", { length: 36 }).notNull().references(() => repos.repo_id, { onDelete: "cascade" }),
@@ -1706,6 +1965,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branches_tenant_id_idx").on(table.tenant_id),
         repoIdx: (0, import_pg_core.index)("branches_repo_idx").on(table.repo_id),
         nameIdx: (0, import_pg_core.index)("branches_name_idx").on(table.name),
         refIdx: (0, import_pg_core.index)("branches_ref_idx").on(table.ref),
@@ -1719,22 +1979,26 @@ var init_schema_postgres = __esm({
     branchOwners = (0, import_pg_core.pgTable)(
       "branch_owners",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at").defaultNow()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branch_owners_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.user_id] })
       })
     );
     boardOwners = (0, import_pg_core.pgTable)(
       "board_owners",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         created_at: t.timestamp("created_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_owners_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.user_id] }),
         userIdx: (0, import_pg_core.index)("board_owners_user_idx").on(table.user_id)
       })
@@ -1742,6 +2006,7 @@ var init_schema_postgres = __esm({
     schedules = (0, import_pg_core.pgTable)(
       "schedules",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         schedule_id: (0, import_pg_core.varchar)("schedule_id", { length: 36 }).primaryKey(),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
@@ -1765,6 +2030,7 @@ var init_schema_postgres = __esm({
         created_by: (0, import_pg_core.varchar)("created_by", { length: 36 }).notNull().references(() => users.user_id)
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("schedules_tenant_id_idx").on(table.tenant_id),
         enabledNextRunIdx: (0, import_pg_core.index)("schedules_enabled_next_run_idx").on(table.enabled, table.next_run_at),
         branchIdx: (0, import_pg_core.index)("schedules_branch_idx").on(table.branch_id),
         createdByIdx: (0, import_pg_core.index)("schedules_created_by_idx").on(table.created_by)
@@ -1773,12 +2039,13 @@ var init_schema_postgres = __esm({
     users = (0, import_pg_core.pgTable)(
       "users",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
         updated_at: t.timestamp("updated_at"),
         // Materialized for auth lookups
-        email: (0, import_pg_core.text)("email").unique().notNull(),
+        email: (0, import_pg_core.text)("email").notNull(),
         password: (0, import_pg_core.text)("password").notNull(),
         // bcrypt hashed
         // Basic profile (materialized for display)
@@ -1794,16 +2061,22 @@ var init_schema_postgres = __esm({
         onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t.json("data").$type().notNull()
       },
       (table) => ({
-        emailIdx: (0, import_pg_core.index)("users_email_idx").on(table.email)
+        tenantIdx: (0, import_pg_core.index)("users_tenant_id_idx").on(table.tenant_id),
+        emailIdx: (0, import_pg_core.index)("users_email_idx").on(table.email),
+        emailTenantUnique: (0, import_pg_core.uniqueIndex)("users_tenant_email_unique").on(table.tenant_id, table.email)
       })
     );
     groups = (0, import_pg_core.pgTable)(
       "groups",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).primaryKey(),
         name: (0, import_pg_core.text)("name").notNull(),
         slug: (0, import_pg_core.text)("slug").notNull(),
@@ -1816,13 +2089,15 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.uniqueIndex)("groups_slug_idx").on(table.slug),
+        tenantIdx: (0, import_pg_core.index)("groups_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.uniqueIndex)("groups_tenant_slug_unique").on(table.tenant_id, table.slug),
         archivedIdx: (0, import_pg_core.index)("groups_archived_idx").on(table.archived)
       })
     );
     groupMemberships = (0, import_pg_core.pgTable)(
       "group_memberships",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         added_by: (0, import_pg_core.varchar)("added_by", { length: 36 }).references(() => users.user_id, {
@@ -1831,6 +2106,7 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("group_memberships_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.group_id, table.user_id] }),
         userIdx: (0, import_pg_core.index)("group_memberships_user_idx").on(table.user_id)
       })
@@ -1838,6 +2114,7 @@ var init_schema_postgres = __esm({
     branchGroupGrants = (0, import_pg_core.pgTable)(
       "branch_group_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1849,6 +2126,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("branch_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.branch_id, table.group_id] }),
         groupIdx: (0, import_pg_core.index)("branch_group_grants_group_idx").on(table.group_id)
       })
@@ -1856,6 +2134,7 @@ var init_schema_postgres = __esm({
     boardGroupGrants = (0, import_pg_core.pgTable)(
       "board_group_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         group_id: (0, import_pg_core.varchar)("group_id", { length: 36 }).notNull().references(() => groups.group_id, { onDelete: "cascade" }),
         can: (0, import_pg_core.text)("can", { enum: [...BRANCH_PERMISSION_LEVELS] }).notNull().default("view"),
@@ -1867,6 +2146,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_group_grants_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.board_id, table.group_id] }),
         groupIdx: (0, import_pg_core.index)("board_group_grants_group_idx").on(table.group_id)
       })
@@ -1874,6 +2154,7 @@ var init_schema_postgres = __esm({
     appVariables = (0, import_pg_core.pgTable)(
       "app_variables",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         variable_id: (0, import_pg_core.varchar)("variable_id", { length: 36 }).primaryKey(),
         namespace: (0, import_pg_core.text)("namespace").notNull(),
         key: (0, import_pg_core.text)("key").notNull(),
@@ -1889,13 +2170,19 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
-        namespaceKeyIdx: (0, import_pg_core.uniqueIndex)("app_variables_namespace_key_idx").on(table.namespace, table.key),
+        tenantIdx: (0, import_pg_core.index)("app_variables_tenant_id_idx").on(table.tenant_id),
+        namespaceKeyIdx: (0, import_pg_core.uniqueIndex)("app_variables_tenant_namespace_key_unique").on(
+          table.tenant_id,
+          table.namespace,
+          table.key
+        ),
         namespaceIdx: (0, import_pg_core.index)("app_variables_namespace_idx").on(table.namespace)
       })
     );
     userApiKeys = (0, import_pg_core.pgTable)(
       "user_api_keys",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull().references(() => users.user_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
@@ -1907,6 +2194,7 @@ var init_schema_postgres = __esm({
         last_used_at: t.timestamp("last_used_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("user_api_keys_tenant_id_idx").on(table.tenant_id),
         userIdx: (0, import_pg_core.index)("user_api_keys_user_idx").on(table.user_id),
         prefixIdx: (0, import_pg_core.index)("user_api_keys_prefix_idx").on(table.prefix)
       })
@@ -1914,6 +2202,7 @@ var init_schema_postgres = __esm({
     mcpServers = (0, import_pg_core.pgTable)(
       "mcp_servers",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -1940,6 +2229,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("mcp_servers_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("mcp_servers_name_idx").on(table.name),
         scopeIdx: (0, import_pg_core.index)("mcp_servers_scope_idx").on(table.scope),
         ownerIdx: (0, import_pg_core.index)("mcp_servers_owner_idx").on(table.owner_user_id),
@@ -1949,6 +2239,7 @@ var init_schema_postgres = __esm({
     cardTypes = (0, import_pg_core.pgTable)(
       "card_types",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).primaryKey(),
         name: (0, import_pg_core.text)("name").notNull(),
         emoji: (0, import_pg_core.text)("emoji"),
@@ -1960,12 +2251,14 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("card_types_tenant_id_idx").on(table.tenant_id),
         nameIdx: (0, import_pg_core.index)("card_types_name_idx").on(table.name)
       })
     );
     cards = (0, import_pg_core.pgTable)(
       "cards",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         card_id: (0, import_pg_core.varchar)("card_id", { length: 36 }).primaryKey(),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         card_type_id: (0, import_pg_core.varchar)("card_type_id", { length: 36 }).references(() => cardTypes.card_type_id, {
@@ -1986,6 +2279,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("cards_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("cards_board_idx").on(table.board_id),
         cardTypeIdx: (0, import_pg_core.index)("cards_card_type_idx").on(table.card_type_id),
         titleIdx: (0, import_pg_core.index)("cards_title_idx").on(table.title),
@@ -1996,10 +2290,17 @@ var init_schema_postgres = __esm({
     artifacts = (0, import_pg_core.pgTable)(
       "artifacts",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         artifact_id: (0, import_pg_core.varchar)("artifact_id", { length: 36 }).primaryKey(),
         branch_id: (0, import_pg_core.varchar)("branch_id", { length: 36 }).references(() => branches.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_pg_core.varchar)("source_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
         name: (0, import_pg_core.text)("name").notNull(),
         description: (0, import_pg_core.text)("description"),
@@ -2025,7 +2326,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("artifacts_tenant_id_idx").on(table.tenant_id),
         branchIdx: (0, import_pg_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_pg_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_pg_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_pg_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_pg_core.index)("artifacts_public_idx").on(table.public)
@@ -2034,6 +2337,7 @@ var init_schema_postgres = __esm({
     artifactTrustGrants = (0, import_pg_core.pgTable)(
       "artifact_trust_grants",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         grant_id: (0, import_pg_core.varchar)("grant_id", { length: 36 }).primaryKey(),
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).notNull(),
         scope_type: (0, import_pg_core.text)("scope_type").notNull(),
@@ -2044,6 +2348,7 @@ var init_schema_postgres = __esm({
         revoked_at: t.timestamp("revoked_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("artifact_trust_grants_tenant_id_idx").on(table.tenant_id),
         userIdx: (0, import_pg_core.index)("artifact_trust_grants_user_idx").on(table.user_id),
         scopeIdx: (0, import_pg_core.index)("artifact_trust_grants_scope_idx").on(table.scope_type, table.scope_value)
       })
@@ -2051,6 +2356,7 @@ var init_schema_postgres = __esm({
     boardObjects = (0, import_pg_core.pgTable)(
       "board_objects",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         object_id: (0, import_pg_core.varchar)("object_id", { length: 36 }).primaryKey(),
         board_id: (0, import_pg_core.varchar)("board_id", { length: 36 }).notNull().references(() => boards.board_id, { onDelete: "cascade" }),
@@ -2066,6 +2372,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_objects_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("board_objects_board_idx").on(table.board_id),
         branchIdx: (0, import_pg_core.index)("board_objects_branch_idx").on(table.branch_id),
         cardIdx: (0, import_pg_core.index)("board_objects_card_idx").on(table.card_id)
@@ -2074,12 +2381,14 @@ var init_schema_postgres = __esm({
     sessionMcpServers = (0, import_pg_core.pgTable)(
       "session_mcp_servers",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         mcp_server_id: (0, import_pg_core.varchar)("mcp_server_id", { length: 36 }).notNull().references(() => mcpServers.mcp_server_id, { onDelete: "cascade" }),
         enabled: t.bool("enabled").notNull().default(true),
         added_at: t.timestamp("added_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_mcp_servers_tenant_id_idx").on(table.tenant_id),
         // Composite primary key
         pk: (0, import_pg_core.index)("session_mcp_servers_pk").on(table.session_id, table.mcp_server_id),
         // Indexes for queries
@@ -2091,6 +2400,7 @@ var init_schema_postgres = __esm({
     userMcpOauthTokens = (0, import_pg_core.pgTable)(
       "user_mcp_oauth_tokens",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // NULL = shared-mode token (one per mcp_server_id)
         user_id: (0, import_pg_core.varchar)("user_id", { length: 36 }).references(() => users.user_id, {
           onDelete: "cascade"
@@ -2108,6 +2418,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("user_mcp_oauth_tokens_tenant_id_idx").on(table.tenant_id),
         // Composite lookup indexes. Uniqueness enforced via partial unique indexes
         // created in the migration (one for per-user rows, one for the shared row).
         pk: (0, import_pg_core.index)("user_mcp_oauth_tokens_pk").on(table.user_id, table.mcp_server_id),
@@ -2118,6 +2429,7 @@ var init_schema_postgres = __esm({
     boardComments = (0, import_pg_core.pgTable)(
       "board_comments",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         comment_id: (0, import_pg_core.varchar)("comment_id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -2159,6 +2471,7 @@ var init_schema_postgres = __esm({
         data: t.json("data").$type().notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("board_comments_tenant_id_idx").on(table.tenant_id),
         boardIdx: (0, import_pg_core.index)("board_comments_board_idx").on(table.board_id),
         sessionIdx: (0, import_pg_core.index)("board_comments_session_idx").on(table.session_id),
         taskIdx: (0, import_pg_core.index)("board_comments_task_idx").on(table.task_id),
@@ -2173,6 +2486,7 @@ var init_schema_postgres = __esm({
     gatewayChannels = (0, import_pg_core.pgTable)(
       "gateway_channels",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -2182,11 +2496,11 @@ var init_schema_postgres = __esm({
         // Materialized for queries
         name: (0, import_pg_core.text)("name").notNull(),
         channel_type: (0, import_pg_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_pg_core.varchar)("agor_user_id", { length: 36 }).notNull(),
-        channel_key: (0, import_pg_core.text)("channel_key").notNull().unique(),
+        channel_key: (0, import_pg_core.text)("channel_key").notNull(),
         enabled: t.bool("enabled").notNull().default(true),
         last_message_at: t.timestamp("last_message_at"),
         // JSON blob for platform credentials (encrypted at rest)
@@ -2195,13 +2509,19 @@ var init_schema_postgres = __esm({
         agentic_config: t.json("agentic_config")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("gateway_channels_tenant_id_idx").on(table.tenant_id),
         channelKeyIdx: (0, import_pg_core.index)("idx_gateway_channel_key").on(table.channel_key),
+        channelKeyTenantUnique: (0, import_pg_core.uniqueIndex)("gateway_channels_tenant_channel_key_unique").on(
+          table.tenant_id,
+          table.channel_key
+        ),
         enabledTypeIdx: (0, import_pg_core.index)("idx_gateway_enabled_type").on(table.enabled, table.channel_type)
       })
     );
     threadSessionMap = (0, import_pg_core.pgTable)(
       "thread_session_map",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         // Primary identity
         id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
         created_at: t.timestamp("created_at").notNull(),
@@ -2219,7 +2539,9 @@ var init_schema_postgres = __esm({
         metadata: t.json("metadata")
       },
       (table) => ({
-        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_thread_map_channel_thread").on(
+        tenantIdx: (0, import_pg_core.index)("thread_session_map_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_thread_map_tenant_channel_thread").on(
+          table.tenant_id,
           table.channel_id,
           table.thread_id
         ),
@@ -2228,14 +2550,82 @@ var init_schema_postgres = __esm({
         channelStatusIdx: (0, import_pg_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages = (0, import_pg_core.pgTable)(
+      "gateway_outbound_messages",
+      {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
+        id: (0, import_pg_core.varchar)("id", { length: 36 }).primaryKey(),
+        created_at: t.timestamp("created_at").notNull(),
+        updated_at: t.timestamp("updated_at").notNull(),
+        gateway_channel_id: (0, import_pg_core.varchar)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels.id, { onDelete: "cascade" }),
+        channel_type: (0, import_pg_core.text)("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: (0, import_pg_core.text)("platform_channel_id").notNull(),
+        platform_message_id: (0, import_pg_core.text)("platform_message_id").notNull(),
+        platform_thread_id: (0, import_pg_core.text)("platform_thread_id").notNull(),
+        platform_permalink: (0, import_pg_core.text)("platform_permalink"),
+        target_branch_id: (0, import_pg_core.varchar)("target_branch_id", { length: 36 }).notNull().references(() => branches.branch_id),
+        emitted_by_user_id: (0, import_pg_core.varchar)("emitted_by_user_id", { length: 36 }).notNull().references(() => users.user_id),
+        emitted_by_session_id: (0, import_pg_core.varchar)("emitted_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: (0, import_pg_core.varchar)("emitted_by_task_id", { length: 36 }).references(
+          () => tasks.task_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_schedule_id: (0, import_pg_core.varchar)("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: (0, import_pg_core.text)("message_text").notNull(),
+        message_preview: (0, import_pg_core.text)("message_preview").notNull(),
+        metadata: t.json("metadata"),
+        consumed_by_session_id: (0, import_pg_core.varchar)("consumed_by_session_id", { length: 36 }).references(
+          () => sessions.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t.timestamp("consumed_at")
+      },
+      (table) => ({
+        tenantIdx: (0, import_pg_core.index)("gateway_outbound_messages_tenant_id_idx").on(table.tenant_id),
+        uniqueChannelThread: (0, import_pg_core.uniqueIndex)("uniq_gateway_outbound_tenant_channel_thread").on(
+          table.tenant_id,
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: (0, import_pg_core.index)("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: (0, import_pg_core.index)("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: (0, import_pg_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections = (0, import_pg_core.pgTable)(
       "session_env_selections",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         session_id: (0, import_pg_core.varchar)("session_id", { length: 36 }).notNull().references(() => sessions.session_id, { onDelete: "cascade" }),
         env_var_name: (0, import_pg_core.text)("env_var_name").notNull(),
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("session_env_selections_tenant_id_idx").on(table.tenant_id),
         pk: (0, import_pg_core.primaryKey)({ columns: [table.session_id, table.env_var_name] }),
         sessionIdx: (0, import_pg_core.index)("session_env_selections_session_idx").on(table.session_id)
       })
@@ -2243,6 +2633,7 @@ var init_schema_postgres = __esm({
     kbNamespaces = (0, import_pg_core.pgTable)(
       "kb_namespaces",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).primaryKey(),
         slug: (0, import_pg_core.text)("slug").notNull(),
         display_name: (0, import_pg_core.text)("display_name").notNull(),
@@ -2269,7 +2660,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        slugIdx: (0, import_pg_core.uniqueIndex)("kb_namespaces_slug_idx").on(table.slug).where(import_drizzle_orm2.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_namespaces_tenant_id_idx").on(table.tenant_id),
+        slugIdx: (0, import_pg_core.uniqueIndex)("kb_namespaces_tenant_slug_unique").on(table.tenant_id, table.slug).where(import_drizzle_orm2.sql`${table.archived} = false`),
         kindIdx: (0, import_pg_core.index)("kb_namespaces_kind_idx").on(table.kind),
         ownerIdx: (0, import_pg_core.index)("kb_namespaces_owner_idx").on(table.owner_user_id),
         repoIdx: (0, import_pg_core.index)("kb_namespaces_repo_idx").on(table.repo_id),
@@ -2280,6 +2672,7 @@ var init_schema_postgres = __esm({
     kbNamespaceAcl = (0, import_pg_core.pgTable)(
       "kb_namespace_acl",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         namespace_acl_id: (0, import_pg_core.varchar)("namespace_acl_id", { length: 36 }).primaryKey(),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         subject_type: (0, import_pg_core.text)("subject_type", { enum: ["user", "group"] }).notNull(),
@@ -2292,9 +2685,11 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_namespace_acl_tenant_id_idx").on(table.tenant_id),
         namespaceIdx: (0, import_pg_core.index)("kb_namespace_acl_namespace_idx").on(table.namespace_id),
         subjectIdx: (0, import_pg_core.index)("kb_namespace_acl_subject_idx").on(table.subject_type, table.subject_id),
-        namespaceSubjectIdx: (0, import_pg_core.uniqueIndex)("kb_namespace_acl_namespace_subject_idx").on(
+        namespaceSubjectIdx: (0, import_pg_core.uniqueIndex)("kb_namespace_acl_tenant_namespace_subject_unique").on(
+          table.tenant_id,
           table.namespace_id,
           table.subject_type,
           table.subject_id
@@ -2304,6 +2699,7 @@ var init_schema_postgres = __esm({
     kbDocuments = (0, import_pg_core.pgTable)(
       "kb_documents",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).primaryKey(),
         namespace_id: (0, import_pg_core.varchar)("namespace_id", { length: 36 }).notNull().references(() => kbNamespaces.namespace_id, { onDelete: "cascade" }),
         path: (0, import_pg_core.text)("path").notNull(),
@@ -2331,8 +2727,9 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        namespacePathIdx: (0, import_pg_core.uniqueIndex)("kb_documents_namespace_path_idx").on(table.namespace_id, table.path).where(import_drizzle_orm2.sql`${table.archived} = false`),
-        uriIdx: (0, import_pg_core.uniqueIndex)("kb_documents_uri_idx").on(table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_documents_tenant_id_idx").on(table.tenant_id),
+        namespacePathIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_namespace_path_unique").on(table.tenant_id, table.namespace_id, table.path).where(import_drizzle_orm2.sql`${table.archived} = false`),
+        uriIdx: (0, import_pg_core.uniqueIndex)("kb_documents_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
         namespaceIdx: (0, import_pg_core.index)("kb_documents_namespace_idx").on(table.namespace_id),
         kindIdx: (0, import_pg_core.index)("kb_documents_kind_idx").on(table.kind),
         visibilityIdx: (0, import_pg_core.index)("kb_documents_visibility_idx").on(table.visibility),
@@ -2345,6 +2742,7 @@ var init_schema_postgres = __esm({
     kbDocumentVersions = (0, import_pg_core.pgTable)(
       "kb_document_versions",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).primaryKey(),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_number: (0, import_pg_core.integer)("version_number").notNull(),
@@ -2364,7 +2762,9 @@ var init_schema_postgres = __esm({
         created_at: t.timestamp("created_at").notNull()
       },
       (table) => ({
-        documentVersionIdx: (0, import_pg_core.uniqueIndex)("kb_document_versions_document_version_idx").on(
+        tenantIdx: (0, import_pg_core.index)("kb_document_versions_tenant_id_idx").on(table.tenant_id),
+        documentVersionIdx: (0, import_pg_core.uniqueIndex)("kb_document_versions_tenant_document_version_unique").on(
+          table.tenant_id,
           table.document_id,
           table.version_number
         ),
@@ -2376,6 +2776,7 @@ var init_schema_postgres = __esm({
     kbDocumentUnits = (0, import_pg_core.pgTable)(
       "kb_document_units",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         unit_id: (0, import_pg_core.varchar)("unit_id", { length: 36 }).primaryKey(),
         document_id: (0, import_pg_core.varchar)("document_id", { length: 36 }).notNull().references(() => kbDocuments.document_id, { onDelete: "cascade" }),
         version_id: (0, import_pg_core.varchar)("version_id", { length: 36 }).notNull().references(() => kbDocumentVersions.version_id, { onDelete: "cascade" }),
@@ -2400,6 +2801,7 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_document_units_tenant_id_idx").on(table.tenant_id),
         documentIdx: (0, import_pg_core.index)("kb_document_units_document_idx").on(table.document_id),
         versionIdx: (0, import_pg_core.index)("kb_document_units_version_idx").on(table.version_id),
         versionOrdinalIdx: (0, import_pg_core.index)("kb_document_units_version_ordinal_idx").on(
@@ -2413,6 +2815,7 @@ var init_schema_postgres = __esm({
     kbEmbeddingSpaces = (0, import_pg_core.pgTable)(
       "kb_embedding_spaces",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         embedding_space_id: (0, import_pg_core.varchar)("embedding_space_id", { length: 36 }).primaryKey(),
         provider: (0, import_pg_core.text)("provider").notNull(),
         model: (0, import_pg_core.text)("model").notNull(),
@@ -2425,7 +2828,9 @@ var init_schema_postgres = __esm({
         updated_at: t.timestamp("updated_at")
       },
       (table) => ({
-        providerModelIdx: (0, import_pg_core.uniqueIndex)("kb_embedding_spaces_provider_model_idx").on(
+        tenantIdx: (0, import_pg_core.index)("kb_embedding_spaces_tenant_id_idx").on(table.tenant_id),
+        providerModelIdx: (0, import_pg_core.uniqueIndex)("kb_embedding_spaces_tenant_provider_model_unique").on(
+          table.tenant_id,
           table.provider,
           table.model,
           table.dimensions,
@@ -2438,6 +2843,7 @@ var init_schema_postgres = __esm({
     kbGraphNodes = (0, import_pg_core.pgTable)(
       "kb_graph_nodes",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         node_id: (0, import_pg_core.varchar)("node_id", { length: 36 }).primaryKey(),
         node_type: (0, import_pg_core.text)("node_type", {
           enum: [
@@ -2503,7 +2909,8 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
-        uriIdx: (0, import_pg_core.uniqueIndex)("kb_graph_nodes_uri_idx").on(table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
+        tenantIdx: (0, import_pg_core.index)("kb_graph_nodes_tenant_id_idx").on(table.tenant_id),
+        uriIdx: (0, import_pg_core.uniqueIndex)("kb_graph_nodes_tenant_uri_unique").on(table.tenant_id, table.uri).where(import_drizzle_orm2.sql`${table.archived} = false`),
         typeIdx: (0, import_pg_core.index)("kb_graph_nodes_type_idx").on(table.node_type),
         namespaceIdx: (0, import_pg_core.index)("kb_graph_nodes_namespace_idx").on(table.namespace_id),
         documentIdx: (0, import_pg_core.index)("kb_graph_nodes_document_idx").on(table.document_id),
@@ -2523,6 +2930,7 @@ var init_schema_postgres = __esm({
     kbGraphEdges = (0, import_pg_core.pgTable)(
       "kb_graph_edges",
       {
+        tenant_id: (0, import_pg_core.text)("tenant_id").notNull().default("default"),
         edge_id: (0, import_pg_core.varchar)("edge_id", { length: 36 }).primaryKey(),
         source_node_id: (0, import_pg_core.varchar)("source_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
         target_node_id: (0, import_pg_core.varchar)("target_node_id", { length: 36 }).notNull().references(() => kbGraphNodes.node_id, { onDelete: "cascade" }),
@@ -2551,6 +2959,7 @@ var init_schema_postgres = __esm({
         archived_at: t.timestamp("archived_at")
       },
       (table) => ({
+        tenantIdx: (0, import_pg_core.index)("kb_graph_edges_tenant_id_idx").on(table.tenant_id),
         sourceIdx: (0, import_pg_core.index)("kb_graph_edges_source_idx").on(table.source_node_id),
         targetIdx: (0, import_pg_core.index)("kb_graph_edges_target_idx").on(table.target_node_id),
         typeIdx: (0, import_pg_core.index)("kb_graph_edges_type_idx").on(table.edge_type),
@@ -2562,11 +2971,11 @@ var init_schema_postgres = __esm({
           table.target_node_id,
           table.edge_type
         ),
-        sourceTargetTypeIdx: (0, import_pg_core.uniqueIndex)("kb_graph_edges_source_target_type_idx").on(table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm2.sql`${table.archived} = false`),
+        sourceTargetTypeIdx: (0, import_pg_core.uniqueIndex)("kb_graph_edges_tenant_source_target_type_unique").on(table.tenant_id, table.source_node_id, table.target_node_id, table.edge_type).where(import_drizzle_orm2.sql`${table.archived} = false`),
         archivedIdx: (0, import_pg_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations = (0, import_drizzle_orm2.relations)(sessions, ({ one }) => ({
+    sessionsRelations = (0, import_drizzle_orm2.relations)(sessions, ({ one, many }) => ({
       branch: one(branches, {
         fields: [sessions.branch_id],
         references: [branches.branch_id]
@@ -2574,6 +2983,24 @@ var init_schema_postgres = __esm({
       schedule: one(schedules, {
         fields: [sessions.schedule_id],
         references: [schedules.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations = (0, import_drizzle_orm2.relations)(sessionRelationships, ({ one }) => ({
+      sourceSession: one(sessions, {
+        fields: [sessionRelationships.source_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions, {
+        fields: [sessionRelationships.target_session_id],
+        references: [sessions.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions, {
+        fields: [sessionRelationships.callback_session_id],
+        references: [sessions.session_id]
       })
     }));
     branchesRelations = (0, import_drizzle_orm2.relations)(branches, ({ many }) => ({
@@ -2608,6 +3035,7 @@ __export(schema_sqlite_exports, {
   cardTypes: () => cardTypes2,
   cards: () => cards2,
   gatewayChannels: () => gatewayChannels2,
+  gatewayOutboundMessages: () => gatewayOutboundMessages2,
   groupMemberships: () => groupMemberships2,
   groups: () => groups2,
   kbDocumentUnits: () => kbDocumentUnits2,
@@ -2626,6 +3054,8 @@ __export(schema_sqlite_exports, {
   serializedSessions: () => serializedSessions2,
   sessionEnvSelections: () => sessionEnvSelections2,
   sessionMcpServers: () => sessionMcpServers2,
+  sessionRelationships: () => sessionRelationships2,
+  sessionRelationshipsRelations: () => sessionRelationshipsRelations2,
   sessions: () => sessions2,
   sessionsRelations: () => sessionsRelations2,
   tasks: () => tasks2,
@@ -2634,7 +3064,7 @@ __export(schema_sqlite_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens2,
   users: () => users2
 });
-var import_drizzle_orm3, import_sqlite_core, t2, sessions2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, branchesRelations2, schedulesRelations2;
+var import_drizzle_orm3, import_sqlite_core, t2, sessions2, sessionRelationships2, tasks2, serializedSessions2, messages2, boards2, repos2, branches2, branchOwners2, boardOwners2, schedules2, users2, groups2, groupMemberships2, branchGroupGrants2, boardGroupGrants2, appVariables2, userApiKeys2, mcpServers2, cardTypes2, cards2, artifacts2, artifactTrustGrants2, boardObjects2, sessionMcpServers2, userMcpOauthTokens2, boardComments2, gatewayChannels2, threadSessionMap2, gatewayOutboundMessages2, sessionEnvSelections2, kbNamespaces2, kbNamespaceAcl2, kbDocuments2, kbDocumentVersions2, kbDocumentUnits2, kbEmbeddingSpaces2, kbGraphNodes2, kbGraphEdges2, sessionsRelations2, sessionRelationshipsRelations2, branchesRelations2, schedulesRelations2;
 var init_schema_sqlite = __esm({
   "src/db/schema.sqlite.ts"() {
     "use strict";
@@ -2710,6 +3140,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         statusIdx: (0, import_sqlite_core.index)("sessions_status_idx").on(table.status),
+        statusReadyIdx: (0, import_sqlite_core.index)("sessions_status_ready_idx").on(table.status, table.ready_for_prompt),
         agenticToolIdx: (0, import_sqlite_core.index)("sessions_agentic_tool_idx").on(table.agentic_tool),
         boardIdx: (0, import_sqlite_core.index)("sessions_board_idx").on(table.board_id),
         branchIdx: (0, import_sqlite_core.index)("sessions_branch_idx").on(table.branch_id),
@@ -2726,6 +3157,39 @@ var init_schema_sqlite = __esm({
         scheduleRunUnique: (0, import_sqlite_core.uniqueIndex)("sessions_schedule_run_unique").on(table.schedule_id, table.scheduled_run_at).where(import_drizzle_orm3.sql`${table.schedule_id} IS NOT NULL AND ${table.scheduled_run_at} IS NOT NULL`)
       })
     );
+    sessionRelationships2 = (0, import_sqlite_core.sqliteTable)(
+      "session_relationships",
+      {
+        relationship_id: (0, import_sqlite_core.text)("relationship_id", { length: 36 }).primaryKey(),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        target_session_id: (0, import_sqlite_core.text)("target_session_id", { length: 36 }).notNull().references(() => sessions2.session_id, { onDelete: "cascade" }),
+        relationship_type: (0, import_sqlite_core.text)("relationship_type", { enum: ["remote_create"] }).notNull(),
+        created_by: (0, import_sqlite_core.text)("created_by", { length: 36 }).notNull(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at"),
+        callback_enabled: t2.bool("callback_enabled").notNull().default(false),
+        callback_session_id: (0, import_sqlite_core.text)("callback_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        data: t2.json("data")
+      },
+      (table) => ({
+        sourceIdx: (0, import_sqlite_core.index)("session_relationships_source_idx").on(table.source_session_id),
+        targetIdx: (0, import_sqlite_core.index)("session_relationships_target_idx").on(table.target_session_id),
+        callbackIdx: (0, import_sqlite_core.index)("session_relationships_callback_idx").on(table.callback_session_id),
+        // Note: no tenant_source/tenant_target composite indexes here — SQLite schema
+        // has no tenant column on this table (RLS is Postgres-only). The standalone
+        // source/target indexes above are sufficient for SQLite.
+        sourceTargetTypeUnique: (0, import_sqlite_core.uniqueIndex)("session_relationships_source_target_type_unique").on(
+          table.source_session_id,
+          table.target_session_id,
+          table.relationship_type
+        )
+      })
+    );
     tasks2 = (0, import_sqlite_core.sqliteTable)(
       "tasks",
       {
@@ -2838,7 +3302,12 @@ var init_schema_sqlite = __esm({
         // Indexes for efficient lookups
         sessionIdx: (0, import_sqlite_core.index)("messages_session_id_idx").on(table.session_id),
         taskIdx: (0, import_sqlite_core.index)("messages_task_id_idx").on(table.task_id),
-        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index)
+        sessionIndexIdx: (0, import_sqlite_core.index)("messages_session_index_idx").on(table.session_id, table.index),
+        timestampIdx: (0, import_sqlite_core.index)("messages_timestamp_idx").on(table.timestamp),
+        sessionTimestampIdx: (0, import_sqlite_core.index)("messages_session_timestamp_idx").on(
+          table.session_id,
+          table.timestamp
+        )
       })
     );
     boards2 = (0, import_sqlite_core.sqliteTable)(
@@ -3064,6 +3533,9 @@ var init_schema_sqlite = __esm({
         onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
         // Force password change flag (admin-settable, auto-cleared on password change)
         must_change_password: t2.bool("must_change_password").notNull().default(false),
+        // Auth invalidation marker. Password changes set this timestamp so any
+        // previously issued browser access or refresh token is rejected.
+        tokens_valid_after: t2.timestamp("tokens_valid_after"),
         // JSON blob for profile/preferences
         data: t2.json("data").$type().notNull()
       },
@@ -3270,6 +3742,12 @@ var init_schema_sqlite = __esm({
         branch_id: (0, import_sqlite_core.text)("branch_id", { length: 36 }).references(() => branches2.branch_id, {
           onDelete: "set null"
         }),
+        source_session_id: (0, import_sqlite_core.text)("source_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
         board_id: (0, import_sqlite_core.text)("board_id", { length: 36 }).notNull().references(() => boards2.board_id, { onDelete: "cascade" }),
         name: (0, import_sqlite_core.text)("name").notNull(),
         description: (0, import_sqlite_core.text)("description"),
@@ -3296,6 +3774,7 @@ var init_schema_sqlite = __esm({
       },
       (table) => ({
         branchIdx: (0, import_sqlite_core.index)("artifacts_branch_idx").on(table.branch_id),
+        sourceSessionIdx: (0, import_sqlite_core.index)("artifacts_source_session_idx").on(table.source_session_id),
         boardIdx: (0, import_sqlite_core.index)("artifacts_board_idx").on(table.board_id),
         archivedIdx: (0, import_sqlite_core.index)("artifacts_archived_idx").on(table.archived),
         publicIdx: (0, import_sqlite_core.index)("artifacts_public_idx").on(table.public)
@@ -3454,7 +3933,7 @@ var init_schema_sqlite = __esm({
         // Materialized for queries
         name: (0, import_sqlite_core.text)("name").notNull(),
         channel_type: (0, import_sqlite_core.text)("channel_type", {
-          enum: ["slack", "discord", "whatsapp", "telegram", "github"]
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
         }).notNull(),
         target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id, { onDelete: "cascade" }),
         agor_user_id: (0, import_sqlite_core.text)("agor_user_id", { length: 36 }).notNull(),
@@ -3500,6 +3979,66 @@ var init_schema_sqlite = __esm({
         channelStatusIdx: (0, import_sqlite_core.index)("idx_thread_map_channel_status").on(table.channel_id, table.status)
       })
     );
+    gatewayOutboundMessages2 = (0, import_sqlite_core.sqliteTable)(
+      "gateway_outbound_messages",
+      {
+        id: (0, import_sqlite_core.text)("id", { length: 36 }).primaryKey(),
+        created_at: t2.timestamp("created_at").notNull(),
+        updated_at: t2.timestamp("updated_at").notNull(),
+        gateway_channel_id: (0, import_sqlite_core.text)("gateway_channel_id", { length: 36 }).notNull().references(() => gatewayChannels2.id, { onDelete: "cascade" }),
+        channel_type: (0, import_sqlite_core.text)("channel_type", {
+          enum: ["slack", "discord", "whatsapp", "telegram", "github", "teams"]
+        }).notNull(),
+        platform_channel_id: (0, import_sqlite_core.text)("platform_channel_id").notNull(),
+        platform_message_id: (0, import_sqlite_core.text)("platform_message_id").notNull(),
+        platform_thread_id: (0, import_sqlite_core.text)("platform_thread_id").notNull(),
+        platform_permalink: (0, import_sqlite_core.text)("platform_permalink"),
+        target_branch_id: (0, import_sqlite_core.text)("target_branch_id", { length: 36 }).notNull().references(() => branches2.branch_id),
+        emitted_by_user_id: (0, import_sqlite_core.text)("emitted_by_user_id", { length: 36 }).notNull().references(() => users2.user_id),
+        emitted_by_session_id: (0, import_sqlite_core.text)("emitted_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        emitted_by_task_id: (0, import_sqlite_core.text)("emitted_by_task_id", { length: 36 }).references(() => tasks2.task_id, {
+          onDelete: "set null"
+        }),
+        emitted_by_schedule_id: (0, import_sqlite_core.text)("emitted_by_schedule_id", { length: 36 }).references(
+          () => schedules2.schedule_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        message_text: (0, import_sqlite_core.text)("message_text").notNull(),
+        message_preview: (0, import_sqlite_core.text)("message_preview").notNull(),
+        metadata: t2.json("metadata"),
+        consumed_by_session_id: (0, import_sqlite_core.text)("consumed_by_session_id", { length: 36 }).references(
+          () => sessions2.session_id,
+          {
+            onDelete: "set null"
+          }
+        ),
+        consumed_at: t2.timestamp("consumed_at")
+      },
+      (table) => ({
+        uniqueChannelThread: (0, import_sqlite_core.uniqueIndex)("uniq_gateway_outbound_channel_thread").on(
+          table.gateway_channel_id,
+          table.platform_thread_id
+        ),
+        emittedSessionIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_session").on(
+          table.emitted_by_session_id
+        ),
+        emittedScheduleIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_emitted_schedule").on(
+          table.emitted_by_schedule_id
+        ),
+        targetBranchCreatedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_branch_created").on(
+          table.target_branch_id,
+          table.created_at
+        ),
+        consumedIdx: (0, import_sqlite_core.index)("idx_gateway_outbound_consumed").on(table.consumed_at)
+      })
+    );
     sessionEnvSelections2 = (0, import_sqlite_core.sqliteTable)(
       "session_env_selections",
       {
@@ -3837,7 +4376,7 @@ var init_schema_sqlite = __esm({
         archivedIdx: (0, import_sqlite_core.index)("kb_graph_edges_archived_idx").on(table.archived)
       })
     );
-    sessionsRelations2 = (0, import_drizzle_orm3.relations)(sessions2, ({ one }) => ({
+    sessionsRelations2 = (0, import_drizzle_orm3.relations)(sessions2, ({ one, many }) => ({
       branch: one(branches2, {
         fields: [sessions2.branch_id],
         references: [branches2.branch_id]
@@ -3845,6 +4384,24 @@ var init_schema_sqlite = __esm({
       schedule: one(schedules2, {
         fields: [sessions2.schedule_id],
         references: [schedules2.schedule_id]
+      }),
+      outboundRelationships: many(sessionRelationships2, { relationName: "relationshipSource" }),
+      inboundRelationships: many(sessionRelationships2, { relationName: "relationshipTarget" })
+    }));
+    sessionRelationshipsRelations2 = (0, import_drizzle_orm3.relations)(sessionRelationships2, ({ one }) => ({
+      sourceSession: one(sessions2, {
+        fields: [sessionRelationships2.source_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipSource"
+      }),
+      targetSession: one(sessions2, {
+        fields: [sessionRelationships2.target_session_id],
+        references: [sessions2.session_id],
+        relationName: "relationshipTarget"
+      }),
+      callbackSession: one(sessions2, {
+        fields: [sessionRelationships2.callback_session_id],
+        references: [sessions2.session_id]
       })
     }));
     branchesRelations2 = (0, import_drizzle_orm3.relations)(branches2, ({ many }) => ({
@@ -3923,6 +4480,7 @@ __export(schema_exports, {
   cardTypes: () => cardTypes3,
   cards: () => cards3,
   gatewayChannels: () => gatewayChannels3,
+  gatewayOutboundMessages: () => gatewayOutboundMessages3,
   groupMemberships: () => groupMemberships3,
   groups: () => groups3,
   kbDocumentUnits: () => kbDocumentUnits3,
@@ -3940,6 +4498,7 @@ __export(schema_exports, {
   serializedSessions: () => serializedSessions3,
   sessionEnvSelections: () => sessionEnvSelections3,
   sessionMcpServers: () => sessionMcpServers3,
+  sessionRelationships: () => sessionRelationships3,
   sessions: () => sessions3,
   tasks: () => tasks3,
   threadSessionMap: () => threadSessionMap3,
@@ -3947,7 +4506,7 @@ __export(schema_exports, {
   userMcpOauthTokens: () => userMcpOauthTokens3,
   users: () => users3
 });
-var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
+var dialect, schema, sessions3, tasks3, messages3, boards3, repos3, branches3, branchOwners3, boardOwners3, groups3, groupMemberships3, branchGroupGrants3, boardGroupGrants3, schedules3, users3, appVariables3, mcpServers3, cardTypes3, cards3, artifacts3, artifactTrustGrants3, boardObjects3, sessionMcpServers3, sessionRelationships3, sessionEnvSelections3, userMcpOauthTokens3, boardComments3, gatewayChannels3, threadSessionMap3, gatewayOutboundMessages3, userApiKeys3, serializedSessions3, kbNamespaces3, kbNamespaceAcl3, kbDocuments3, kbDocumentVersions3, kbDocumentUnits3, kbEmbeddingSpaces3, kbGraphNodes3, kbGraphEdges3;
 var init_schema = __esm({
   "src/db/schema.ts"() {
     "use strict";
@@ -3979,11 +4538,13 @@ var init_schema = __esm({
     artifactTrustGrants3 = schema.artifactTrustGrants;
     boardObjects3 = schema.boardObjects;
     sessionMcpServers3 = schema.sessionMcpServers;
+    sessionRelationships3 = schema.sessionRelationships;
     sessionEnvSelections3 = schema.sessionEnvSelections;
     userMcpOauthTokens3 = schema.userMcpOauthTokens;
     boardComments3 = schema.boardComments;
     gatewayChannels3 = schema.gatewayChannels;
     threadSessionMap3 = schema.threadSessionMap;
+    gatewayOutboundMessages3 = schema.gatewayOutboundMessages;
     userApiKeys3 = schema.userApiKeys;
     serializedSessions3 = schema.serializedSessions;
     kbNamespaces3 = schema.kbNamespaces;
@@ -4016,35 +4577,6 @@ var init_ids = __esm({
   }
 });
 
-// src/db/user-utils.ts
-var import_bcryptjs, import_drizzle_orm6;
-var init_user_utils = __esm({
-  "src/db/user-utils.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_bcryptjs = __toESM(require("bcryptjs"), 1);
-    import_drizzle_orm6 = require("drizzle-orm");
-    init_ids();
-    init_user();
-    init_database_wrapper();
-    init_schema();
-  }
-});
-
-// src/db/first-run-bootstrap.ts
-var import_node_crypto3, import_drizzle_orm7;
-var init_first_run_bootstrap = __esm({
-  "src/db/first-run-bootstrap.ts"() {
-    "use strict";
-    init_cjs_shims();
-    import_node_crypto3 = require("crypto");
-    import_drizzle_orm7 = require("drizzle-orm");
-    init_database_wrapper();
-    init_schema();
-    init_user_utils();
-  }
-});
-
 // src/unix/index.ts
 var unix_exports = {};
 __export(unix_exports, {
@@ -4129,7 +4661,7 @@ var import_node_child_process = require("child_process");
 var import_node_util = require("util");
 var execAsync = (0, import_node_util.promisify)(import_node_child_process.exec);
 function spawnWithInput(cmd, args, input) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const child = (0, import_node_child_process.spawn)(cmd, args, {
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -4143,7 +4675,7 @@ function spawnWithInput(cmd, args, input) {
     });
     child.on("error", reject);
     child.on("close", (code) => {
-      resolve2({
+      resolve({
         stdout,
         stderr,
         exitCode: code ?? 1
@@ -4627,10 +5159,7 @@ var import_node_fs = __toESM(require("fs"), 1);
 
 // src/yaml/index.ts
 init_cjs_shims();
-var import_js_yaml = __toESM(require("js-yaml"), 1);
-var load = import_js_yaml.default.load;
-var dump = import_js_yaml.default.dump;
-var YAMLException = import_js_yaml.default.YAMLException;
+var yaml = __toESM(require("js-yaml"), 1);
 
 // src/config/variant-resolver.ts
 init_cjs_shims();
@@ -4822,6 +5351,7 @@ init_schema();
 init_cjs_shims();
 init_ids();
 init_id();
+init_tenant_context();
 var RepositoryError = class extends Error {
   constructor(message, cause) {
     super(message);
@@ -4863,6 +5393,21 @@ async function resolveByShortIdPrefix(id, entityType, fetchMatches) {
   return matches[0];
 }
 var RESOLVE_SHORT_ID_FETCH_LIMIT = 11;
+function getHiddenTenantId(row) {
+  const tenantId = row?.tenant_id;
+  return typeof tenantId === "string" && tenantId.length > 0 ? tenantId : void 0;
+}
+function attachHiddenTenant(dto, row) {
+  const tenantId = getHiddenTenantId(row);
+  if (tenantId) {
+    Object.defineProperty(dto, "tenant_id", {
+      value: tenantId,
+      enumerable: false,
+      configurable: true
+    });
+  }
+  return dto;
+}
 
 // src/db/repositories/session-env-selections.ts
 var SessionEnvSelectionRepository = class {
@@ -5250,71 +5795,103 @@ init_executor_heartbeat();
 
 // src/config/key-resolver.ts
 init_cjs_shims();
-
-// src/db/index.ts
-init_cjs_shims();
-var import_drizzle_orm34 = require("drizzle-orm");
-var import_bcryptjs3 = __toESM(require("bcryptjs"), 1);
+var import_drizzle_orm6 = require("drizzle-orm");
+init_database_wrapper();
+init_schema();
 init_ids();
-
-// src/lib/slugs.ts
-init_cjs_shims();
-
-// src/db/client.ts
-init_cjs_shims();
-var import_client = require("@libsql/client");
-var import_libsql = require("drizzle-orm/libsql");
-var import_postgres_js = require("drizzle-orm/postgres-js");
-var import_postgres = __toESM(require("postgres"), 1);
 init_config_manager();
-init_schema_postgres();
-init_schema_sqlite();
-init_schema_factory();
-
-// src/utils/path.ts
-init_cjs_shims();
-var import_node_os2 = require("os");
-var import_node_path2 = require("path");
+var DEBUG_KEY_RESOLUTION = process.env.AGOR_DEBUG_KEY_RESOLUTION === "1" || process.env.DEBUG?.includes("key-resolution");
 
-// src/db/index.ts
-init_database_wrapper();
-init_first_run_bootstrap();
+// src/config/index.ts
+init_multitenancy();
 
-// src/db/migrate.ts
+// src/config/proxies-resolver.ts
 init_cjs_shims();
-var import_node_path3 = require("path");
-var import_node_url = require("url");
-var import_drizzle_orm8 = require("drizzle-orm");
-var import_migrator = require("drizzle-orm/libsql/migrator");
-var import_migrator2 = require("drizzle-orm/postgres-js/migrator");
-init_database_wrapper();
-init_schema();
 
-// src/db/pending-migrations.ts
+// src/config/repo-list.ts
 init_cjs_shims();
 
-// src/db/repositories/index.ts
+// src/config/repo-reference.ts
 init_cjs_shims();
+var REPO_SLUG_PATTERN = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
 
-// src/db/repositories/app-variables.ts
+// src/config/resolved-config-slice.ts
 init_cjs_shims();
-var import_drizzle_orm9 = require("drizzle-orm");
-init_ids();
-init_database_wrapper();
-init_schema();
+var import_zod = require("zod");
+var ResolvedConfigSliceSchema = import_zod.z.object({
+  /** From `config.execution.*` */
+  execution: import_zod.z.object({
+    permission_timeout_ms: import_zod.z.number().int().nonnegative().optional(),
+    executor_heartbeat: import_zod.z.object({
+      enabled: import_zod.z.boolean(),
+      interval_ms: import_zod.z.number().int().positive()
+    }).optional()
+  }).optional(),
+  /** From `config.opencode.*` */
+  opencode: import_zod.z.object({
+    serverUrl: import_zod.z.string().optional()
+  }).optional(),
+  /** From `config.daemon.*` (selected fields only) */
+  daemon: import_zod.z.object({
+    host_ip_address: import_zod.z.string().optional()
+  }).optional()
+});
 
-// src/db/repositories/artifact-trust.ts
+// src/config/resource-schemas.ts
 init_cjs_shims();
-var import_drizzle_orm10 = require("drizzle-orm");
-init_ids();
-init_database_wrapper();
-init_schema();
-
-// src/db/repositories/artifacts.ts
+var import_zod2 = require("zod");
+var uuidSchema = import_zod2.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID");
+var repoSlugSchema = import_zod2.z.string().regex(
+  REPO_SLUG_PATTERN,
+  'Must be org/name format with alphanumeric, hyphens, underscores, or dots (e.g., "my-org/my-repo")'
+);
+var enforcedAgentConfigSchema = import_zod2.z.object({
+  agentic_tool: import_zod2.z.enum(["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]).optional(),
+  permission_mode: import_zod2.z.string().optional(),
+  model: import_zod2.z.string().optional(),
+  mcp_server_ids: import_zod2.z.array(import_zod2.z.string()).optional()
+});
+var resourceRepoConfigSchema = import_zod2.z.object({
+  repo_id: uuidSchema,
+  slug: repoSlugSchema,
+  remote_url: import_zod2.z.string().optional(),
+  repo_type: import_zod2.z.enum(["remote", "local"]).default("remote"),
+  default_branch: import_zod2.z.string().optional(),
+  shallow: import_zod2.z.boolean().optional()
+}).refine((data) => data.repo_type !== "remote" || data.remote_url, {
+  message: 'remote_url is required when repo_type is "remote"',
+  path: ["remote_url"]
+});
+var resourceBranchConfigSchema = import_zod2.z.object({
+  branch_id: uuidSchema,
+  name: import_zod2.z.string().min(1, "Branch name is required"),
+  ref: import_zod2.z.string().min(1, "Git ref is required"),
+  ref_type: import_zod2.z.enum(["branch", "tag"]).optional(),
+  others_can: import_zod2.z.enum(["none", "view", "session", "prompt", "all"]).optional(),
+  mcp_server_ids: import_zod2.z.array(import_zod2.z.string()).optional(),
+  repo: repoSlugSchema,
+  readonly: import_zod2.z.boolean().optional(),
+  agent: enforcedAgentConfigSchema.optional()
+});
+var resourceUserConfigSchema = import_zod2.z.object({
+  user_id: uuidSchema,
+  email: import_zod2.z.string().email("Must be a valid email address"),
+  name: import_zod2.z.string().optional(),
+  role: import_zod2.z.enum(["superadmin", "admin", "member", "viewer"]).default("member"),
+  unix_username: import_zod2.z.string().optional(),
+  password: import_zod2.z.string().optional()
+});
+var daemonResourcesConfigSchema = import_zod2.z.object({
+  repos: import_zod2.z.array(resourceRepoConfigSchema).optional(),
+  branches: import_zod2.z.array(resourceBranchConfigSchema).optional(),
+  users: import_zod2.z.array(resourceUserConfigSchema).optional()
+});
+
+// src/config/resource-sync.ts
+init_cjs_shims();
+
+// src/config/security-resolver.ts
 init_cjs_shims();
-var import_drizzle_orm11 = require("drizzle-orm");
-init_config_manager();
-init_ids();
 
 // src/utils/url.ts
 init_cjs_shims();
@@ -5366,99 +5943,113 @@ function stripHttpUrlUserinfo(rawUrl) {
   }
 }
 
-// src/db/repositories/artifacts.ts
-init_database_wrapper();
-init_schema();
+// src/config/security-resolver.ts
+var DEFAULT_GIT_CONFIG_PARAMETERS = Object.freeze([
+  "transfer.credentialsInUrl=die",
+  "protocol.file.allow=user",
+  "protocol.ext.allow=never",
+  "core.protectHFS=true",
+  "core.protectNTFS=true"
+]);
 
-// src/db/repositories/board-comments.ts
+// src/config/index.ts
+init_types();
+
+// src/db/repositories/index.ts
 init_cjs_shims();
-var import_drizzle_orm12 = require("drizzle-orm");
+
+// src/db/repositories/app-variables.ts
+init_cjs_shims();
+var import_drizzle_orm7 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/board-objects.ts
+// src/db/repositories/artifact-trust.ts
 init_cjs_shims();
-var import_drizzle_orm14 = require("drizzle-orm");
+var import_drizzle_orm8 = require("drizzle-orm");
 init_ids();
+init_database_wrapper();
+init_schema();
 
-// src/utils/board-placement.ts
+// src/db/repositories/artifacts.ts
 init_cjs_shims();
-
-// src/db/repositories/board-objects.ts
+var import_drizzle_orm10 = require("drizzle-orm");
+init_config_manager();
+init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/branch-access.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm13 = require("drizzle-orm");
+var import_drizzle_orm9 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 var VISIBLE_BRANCH_PERMISSION_LEVELS = BRANCH_PERMISSION_LEVELS.filter(
   (level) => level !== "none"
 );
 function activeGroupGrantAccessExists(db, userId) {
-  return (0, import_drizzle_orm13.exists)(
+  return (0, import_drizzle_orm9.exists)(
     // biome-ignore lint/suspicious/noExplicitAny: Drizzle select has complex cross-dialect overloads
-    db.select({ _: import_drizzle_orm13.sql`1` }).from(branchGroupGrants3).innerJoin(
+    db.select({ _: import_drizzle_orm9.sql`1` }).from(branchGroupGrants3).innerJoin(
       groupMemberships3,
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id),
-        (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId)
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id),
+        (0, import_drizzle_orm9.eq)(groupMemberships3.user_id, userId)
       )
     ).innerJoin(
       groups3,
-      (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm13.eq)(groups3.archived, false))
+      (0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm9.eq)(groups3.archived, false))
     ).where(
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, branches3.branch_id),
-        (0, import_drizzle_orm13.inArray)(branchGroupGrants3.can, VISIBLE_BRANCH_PERMISSION_LEVELS)
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(branchGroupGrants3.branch_id, branches3.branch_id),
+        (0, import_drizzle_orm9.inArray)(branchGroupGrants3.can, VISIBLE_BRANCH_PERMISSION_LEVELS)
       )
     )
   );
 }
 function activeBoardGroupGrantAccessExists(db, userId) {
-  return (0, import_drizzle_orm13.exists)(
+  return (0, import_drizzle_orm9.exists)(
     // biome-ignore lint/suspicious/noExplicitAny: Drizzle select has complex cross-dialect overloads
-    db.select({ _: import_drizzle_orm13.sql`1` }).from(boardGroupGrants3).innerJoin(
+    db.select({ _: import_drizzle_orm9.sql`1` }).from(boardGroupGrants3).innerJoin(
       groupMemberships3,
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id),
-        (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId)
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id),
+        (0, import_drizzle_orm9.eq)(groupMemberships3.user_id, userId)
       )
     ).innerJoin(
       groups3,
-      (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm13.eq)(groups3.archived, false))
+      (0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm9.eq)(groups3.archived, false))
     ).innerJoin(
       boards3,
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(boards3.board_id, boardGroupGrants3.board_id),
-        (0, import_drizzle_orm13.eq)(import_drizzle_orm13.sql`coalesce(${jsonExtract(db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm9.eq)(import_drizzle_orm9.sql`coalesce(${jsonExtract(db, boards3.data, "access_mode")}, 'shared')`, "shared")
       )
     ).where(
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, branches3.board_id),
-        (0, import_drizzle_orm13.inArray)(boardGroupGrants3.can, VISIBLE_BRANCH_PERMISSION_LEVELS)
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(boardGroupGrants3.board_id, branches3.board_id),
+        (0, import_drizzle_orm9.inArray)(boardGroupGrants3.can, VISIBLE_BRANCH_PERMISSION_LEVELS)
       )
     )
   );
 }
 function activeBoardOwnerAccessExists(db, userId) {
-  return (0, import_drizzle_orm13.exists)(
+  return (0, import_drizzle_orm9.exists)(
     // biome-ignore lint/suspicious/noExplicitAny: Drizzle select has complex cross-dialect overloads
-    db.select({ _: import_drizzle_orm13.sql`1` }).from(boardOwners3).where((0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(boardOwners3.board_id, branches3.board_id), (0, import_drizzle_orm13.eq)(boardOwners3.user_id, userId)))
+    db.select({ _: import_drizzle_orm9.sql`1` }).from(boardOwners3).where((0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(boardOwners3.board_id, branches3.board_id), (0, import_drizzle_orm9.eq)(boardOwners3.user_id, userId)))
   );
 }
 function alignedBoardDefaultVisible(db) {
-  return (0, import_drizzle_orm13.exists)(
+  return (0, import_drizzle_orm9.exists)(
     // biome-ignore lint/suspicious/noExplicitAny: Drizzle select has complex cross-dialect overloads
-    db.select({ _: import_drizzle_orm13.sql`1` }).from(boards3).where(
-      (0, import_drizzle_orm13.and)(
-        (0, import_drizzle_orm13.eq)(boards3.board_id, branches3.board_id),
-        (0, import_drizzle_orm13.eq)(import_drizzle_orm13.sql`coalesce(${jsonExtract(db, boards3.data, "access_mode")}, 'shared')`, "shared"),
-        (0, import_drizzle_orm13.inArray)(
-          import_drizzle_orm13.sql`coalesce(${jsonExtract(db, boards3.data, "default_others_can")}, 'session')`,
+    db.select({ _: import_drizzle_orm9.sql`1` }).from(boards3).where(
+      (0, import_drizzle_orm9.and)(
+        (0, import_drizzle_orm9.eq)(boards3.board_id, branches3.board_id),
+        (0, import_drizzle_orm9.eq)(import_drizzle_orm9.sql`coalesce(${jsonExtract(db, boards3.data, "access_mode")}, 'shared')`, "shared"),
+        (0, import_drizzle_orm9.inArray)(
+          import_drizzle_orm9.sql`coalesce(${jsonExtract(db, boards3.data, "default_others_can")}, 'session')`,
           VISIBLE_BRANCH_PERMISSION_LEVELS
         )
       )
@@ -5466,33 +6057,81 @@ function alignedBoardDefaultVisible(db) {
   );
 }
 function visibleBranchAccessCondition(db, userId) {
-  return (0, import_drizzle_orm13.or)(
-    (0, import_drizzle_orm13.isNotNull)(branchOwners3.user_id),
+  return (0, import_drizzle_orm9.or)(
+    (0, import_drizzle_orm9.isNotNull)(branchOwners3.user_id),
     activeGroupGrantAccessExists(db, userId),
-    (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(branches3.permission_source, "board"), activeBoardOwnerAccessExists(db, userId)),
-    (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(branches3.permission_source, "board"), activeBoardGroupGrantAccessExists(db, userId)),
-    (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(branches3.permission_source, "board"), alignedBoardDefaultVisible(db)),
-    (0, import_drizzle_orm13.and)(
-      (0, import_drizzle_orm13.eq)(branches3.permission_source, "override"),
-      (0, import_drizzle_orm13.inArray)(branches3.others_can, VISIBLE_BRANCH_PERMISSION_LEVELS)
+    (0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(branches3.permission_source, "board"), activeBoardOwnerAccessExists(db, userId)),
+    (0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(branches3.permission_source, "board"), activeBoardGroupGrantAccessExists(db, userId)),
+    (0, import_drizzle_orm9.and)((0, import_drizzle_orm9.eq)(branches3.permission_source, "board"), alignedBoardDefaultVisible(db)),
+    (0, import_drizzle_orm9.and)(
+      (0, import_drizzle_orm9.eq)(branches3.permission_source, "override"),
+      (0, import_drizzle_orm9.inArray)(branches3.others_can, VISIBLE_BRANCH_PERMISSION_LEVELS)
     )
-  ) ?? import_drizzle_orm13.sql`false`;
+  ) ?? import_drizzle_orm9.sql`false`;
 }
 
+// src/db/repositories/board-comments.ts
+init_cjs_shims();
+var import_drizzle_orm11 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
+// src/db/repositories/board-objects.ts
+init_cjs_shims();
+var import_drizzle_orm12 = require("drizzle-orm");
+init_ids();
+
+// src/utils/board-placement.ts
+init_cjs_shims();
+
+// src/db/repositories/board-objects.ts
+init_database_wrapper();
+init_schema();
+
 // src/db/repositories/boards.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm17 = require("drizzle-orm");
+var import_drizzle_orm15 = require("drizzle-orm");
 var yaml3 = __toESM(require("js-yaml"), 1);
 init_config_manager();
 init_ids();
+
+// src/lib/slugs.ts
+init_cjs_shims();
+
+// src/utils/emoji-shortcodes.ts
+init_cjs_shims();
+var import_node_module = require("module");
+var requireJson = (0, import_node_module.createRequire)(importMetaUrl);
+var emojiData = requireJson("emojibase-data/en/compact.json");
+var shortcodes = requireJson(
+  "emojibase-data/en/shortcodes/emojibase.json"
+);
+var emojiByHexcode = /* @__PURE__ */ new Map();
+for (const emoji of emojiData) {
+  if (emoji.unicode) {
+    emojiByHexcode.set(emoji.hexcode, emoji.unicode);
+  }
+}
+var emojiByShortcode = /* @__PURE__ */ new Map();
+for (const [hexcode, codes] of Object.entries(shortcodes)) {
+  const emoji = emojiByHexcode.get(hexcode);
+  if (!emoji) continue;
+  const codeList = Array.isArray(codes) ? codes : [codes];
+  for (const code of codeList) {
+    emojiByShortcode.set(code.toLowerCase(), emoji);
+  }
+}
+
+// src/db/repositories/boards.ts
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/branches.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm16 = require("drizzle-orm");
+var import_drizzle_orm14 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -5500,7 +6139,7 @@ init_schema();
 
 // src/db/repositories/groups.ts
 init_cjs_shims();
-var import_drizzle_orm15 = require("drizzle-orm");
+var import_drizzle_orm13 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -5564,17 +6203,17 @@ var GroupRepository = class {
   }
   async findAll(filter) {
     const conditions = [];
-    if (filter?.archived !== void 0) conditions.push((0, import_drizzle_orm15.eq)(groups3.archived, filter.archived));
+    if (filter?.archived !== void 0) conditions.push((0, import_drizzle_orm13.eq)(groups3.archived, filter.archived));
     const query = select(this.db).from(groups3);
-    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm15.and)(...conditions)).all() : await query.all();
+    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm13.and)(...conditions)).all() : await query.all();
     return rows.map((row) => this.rowToGroup(row));
   }
   async findById(id) {
-    const row = await select(this.db).from(groups3).where((0, import_drizzle_orm15.eq)(groups3.group_id, id)).one();
+    const row = await select(this.db).from(groups3).where((0, import_drizzle_orm13.eq)(groups3.group_id, id)).one();
     return row ? this.rowToGroup(row) : null;
   }
   async findBySlug(slug) {
-    const row = await select(this.db).from(groups3).where((0, import_drizzle_orm15.eq)(groups3.slug, slug)).one();
+    const row = await select(this.db).from(groups3).where((0, import_drizzle_orm13.eq)(groups3.slug, slug)).one();
     return row ? this.rowToGroup(row) : null;
   }
   async create(data) {
@@ -5608,7 +6247,7 @@ var GroupRepository = class {
     if (updates.slug !== void 0) patch.slug = normalizeSlug(updates.slug);
     if (updates.description !== void 0) patch.description = updates.description;
     if (updates.archived !== void 0) patch.archived = updates.archived;
-    await update(this.db, groups3).set(patch).where((0, import_drizzle_orm15.eq)(groups3.group_id, existing.group_id)).run();
+    await update(this.db, groups3).set(patch).where((0, import_drizzle_orm13.eq)(groups3.group_id, existing.group_id)).run();
     const updatedGroup = await this.findById(existing.group_id);
     if (!updatedGroup) throw new RepositoryError("Failed to retrieve updated group");
     return updatedGroup;
@@ -5616,19 +6255,19 @@ var GroupRepository = class {
   async delete(id) {
     const existing = await this.findById(id);
     if (!existing) throw new EntityNotFoundError("Group", id);
-    await deleteFrom(this.db, groups3).where((0, import_drizzle_orm15.eq)(groups3.group_id, existing.group_id)).run();
+    await deleteFrom(this.db, groups3).where((0, import_drizzle_orm13.eq)(groups3.group_id, existing.group_id)).run();
     return existing;
   }
   async listMemberships(filter) {
     const conditions = [];
-    if (filter?.group_id) conditions.push((0, import_drizzle_orm15.eq)(groupMemberships3.group_id, filter.group_id));
-    if (filter?.user_id) conditions.push((0, import_drizzle_orm15.eq)(groupMemberships3.user_id, filter.user_id));
+    if (filter?.group_id) conditions.push((0, import_drizzle_orm13.eq)(groupMemberships3.group_id, filter.group_id));
+    if (filter?.user_id) conditions.push((0, import_drizzle_orm13.eq)(groupMemberships3.user_id, filter.user_id));
     const query = select(this.db).from(groupMemberships3);
-    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm15.and)(...conditions)).all() : await query.all();
+    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm13.and)(...conditions)).all() : await query.all();
     return rows.map((row) => this.rowToMembership(row));
   }
   async addMember(groupId, userId, addedBy) {
-    const existing = await select(this.db).from(groupMemberships3).where((0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId))).one();
+    const existing = await select(this.db).from(groupMemberships3).where((0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId))).one();
     if (existing) return this.rowToMembership(existing);
     const row = {
       group_id: groupId,
@@ -5640,17 +6279,17 @@ var GroupRepository = class {
     return this.rowToMembership(row);
   }
   async removeMember(groupId, userId) {
-    const existing = await select(this.db).from(groupMemberships3).where((0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId))).one();
+    const existing = await select(this.db).from(groupMemberships3).where((0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId))).one();
     if (!existing) return null;
-    await deleteFrom(this.db, groupMemberships3).where((0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId))).run();
+    await deleteFrom(this.db, groupMemberships3).where((0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(groupMemberships3.group_id, groupId), (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId))).run();
     return this.rowToMembership(existing);
   }
   async getGroupIdsForUser(userId) {
-    const rows = await select(this.db, { group_id: groupMemberships3.group_id }).from(groupMemberships3).where((0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId)).all();
+    const rows = await select(this.db, { group_id: groupMemberships3.group_id }).from(groupMemberships3).where((0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId)).all();
     return rows.map((r) => r.group_id);
   }
   async listBranchGrants(branchId) {
-    const rows = await select(this.db).from(branchGroupGrants3).leftJoin(groups3, (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, groups3.group_id)).where((0, import_drizzle_orm15.eq)(branchGroupGrants3.branch_id, branchId)).all();
+    const rows = await select(this.db).from(branchGroupGrants3).leftJoin(groups3, (0, import_drizzle_orm13.eq)(branchGroupGrants3.group_id, groups3.group_id)).where((0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, branchId)).all();
     return rows.map(
       (r) => this.rowToGrant(r.branch_group_grants, r.groups ? this.rowToGroup(r.groups) : void 0)
     );
@@ -5658,16 +6297,16 @@ var GroupRepository = class {
   async upsertBranchGrant(data) {
     const now = /* @__PURE__ */ new Date();
     const existing = await select(this.db).from(branchGroupGrants3).where(
-      (0, import_drizzle_orm15.and)(
-        (0, import_drizzle_orm15.eq)(branchGroupGrants3.branch_id, data.branch_id),
-        (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, data.group_id)
+      (0, import_drizzle_orm13.and)(
+        (0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, data.branch_id),
+        (0, import_drizzle_orm13.eq)(branchGroupGrants3.group_id, data.group_id)
       )
     ).one();
     if (existing) {
       await update(this.db, branchGroupGrants3).set({ can: data.can, fs_access: data.fs_access ?? null, updated_at: now }).where(
-        (0, import_drizzle_orm15.and)(
-          (0, import_drizzle_orm15.eq)(branchGroupGrants3.branch_id, data.branch_id),
-          (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, data.group_id)
+        (0, import_drizzle_orm13.and)(
+          (0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, data.branch_id),
+          (0, import_drizzle_orm13.eq)(branchGroupGrants3.group_id, data.group_id)
         )
       ).run();
     } else {
@@ -5690,16 +6329,16 @@ var GroupRepository = class {
     const existing = (await this.listBranchGrants(branchId)).find((g) => g.group_id === groupId) ?? null;
     if (!existing) return null;
     await deleteFrom(this.db, branchGroupGrants3).where(
-      (0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(branchGroupGrants3.branch_id, branchId), (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, groupId))
+      (0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, branchId), (0, import_drizzle_orm13.eq)(branchGroupGrants3.group_id, groupId))
     ).run();
     return existing;
   }
   async getBranchGrantsForUser(branchId, userId) {
-    const rows = await select(this.db).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm15.eq)(branchGroupGrants3.group_id, groupMemberships3.group_id)).innerJoin(groups3, (0, import_drizzle_orm15.eq)(groupMemberships3.group_id, groups3.group_id)).where(
-      (0, import_drizzle_orm15.and)(
-        (0, import_drizzle_orm15.eq)(branchGroupGrants3.branch_id, branchId),
-        (0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId),
-        (0, import_drizzle_orm15.eq)(groups3.archived, false)
+    const rows = await select(this.db).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm13.eq)(branchGroupGrants3.group_id, groupMemberships3.group_id)).innerJoin(groups3, (0, import_drizzle_orm13.eq)(groupMemberships3.group_id, groups3.group_id)).where(
+      (0, import_drizzle_orm13.and)(
+        (0, import_drizzle_orm13.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId),
+        (0, import_drizzle_orm13.eq)(groups3.archived, false)
       )
     ).all();
     return rows.map(
@@ -5707,7 +6346,7 @@ var GroupRepository = class {
     );
   }
   async listBoardGrants(boardId) {
-    const rows = await select(this.db).from(boardGroupGrants3).leftJoin(groups3, (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, groups3.group_id)).where((0, import_drizzle_orm15.eq)(boardGroupGrants3.board_id, boardId)).all();
+    const rows = await select(this.db).from(boardGroupGrants3).leftJoin(groups3, (0, import_drizzle_orm13.eq)(boardGroupGrants3.group_id, groups3.group_id)).where((0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, boardId)).all();
     return rows.map(
       (r) => this.rowToBoardGrant(r.board_group_grants, r.groups ? this.rowToGroup(r.groups) : void 0)
     );
@@ -5715,16 +6354,16 @@ var GroupRepository = class {
   async upsertBoardGrant(data) {
     const now = /* @__PURE__ */ new Date();
     const existing = await select(this.db).from(boardGroupGrants3).where(
-      (0, import_drizzle_orm15.and)(
-        (0, import_drizzle_orm15.eq)(boardGroupGrants3.board_id, data.board_id),
-        (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, data.group_id)
+      (0, import_drizzle_orm13.and)(
+        (0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, data.board_id),
+        (0, import_drizzle_orm13.eq)(boardGroupGrants3.group_id, data.group_id)
       )
     ).one();
     if (existing) {
       await update(this.db, boardGroupGrants3).set({ can: data.can, fs_access: data.fs_access ?? null, updated_at: now }).where(
-        (0, import_drizzle_orm15.and)(
-          (0, import_drizzle_orm15.eq)(boardGroupGrants3.board_id, data.board_id),
-          (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, data.group_id)
+        (0, import_drizzle_orm13.and)(
+          (0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, data.board_id),
+          (0, import_drizzle_orm13.eq)(boardGroupGrants3.group_id, data.group_id)
         )
       ).run();
     } else {
@@ -5746,15 +6385,15 @@ var GroupRepository = class {
   async removeBoardGrant(boardId, groupId) {
     const existing = (await this.listBoardGrants(boardId)).find((g) => g.group_id === groupId) ?? null;
     if (!existing) return null;
-    await deleteFrom(this.db, boardGroupGrants3).where((0, import_drizzle_orm15.and)((0, import_drizzle_orm15.eq)(boardGroupGrants3.board_id, boardId), (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, groupId))).run();
+    await deleteFrom(this.db, boardGroupGrants3).where((0, import_drizzle_orm13.and)((0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, boardId), (0, import_drizzle_orm13.eq)(boardGroupGrants3.group_id, groupId))).run();
     return existing;
   }
   async getBoardGrantsForUser(boardId, userId) {
-    const rows = await select(this.db).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm15.eq)(boardGroupGrants3.group_id, groupMemberships3.group_id)).innerJoin(groups3, (0, import_drizzle_orm15.eq)(groupMemberships3.group_id, groups3.group_id)).where(
-      (0, import_drizzle_orm15.and)(
-        (0, import_drizzle_orm15.eq)(boardGroupGrants3.board_id, boardId),
-        (0, import_drizzle_orm15.eq)(groupMemberships3.user_id, userId),
-        (0, import_drizzle_orm15.eq)(groups3.archived, false)
+    const rows = await select(this.db).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm13.eq)(boardGroupGrants3.group_id, groupMemberships3.group_id)).innerJoin(groups3, (0, import_drizzle_orm13.eq)(groupMemberships3.group_id, groups3.group_id)).where(
+      (0, import_drizzle_orm13.and)(
+        (0, import_drizzle_orm13.eq)(boardGroupGrants3.board_id, boardId),
+        (0, import_drizzle_orm13.eq)(groupMemberships3.user_id, userId),
+        (0, import_drizzle_orm13.eq)(groups3.archived, false)
       )
     ).all();
     return rows.map(
@@ -5814,6 +6453,7 @@ var FS_ACCESS_RANK = {
 };
 var VIEW_OR_BETTER_BRANCH_PERMISSIONS = ["view", "session", "prompt", "all"];
 var BRANCH_PERMISSION_SOURCES = ["board", "override"];
+var FS_ACCESS_BRANCH_PERMISSIONS = ["read", "write"];
 var BranchRepository = class {
   constructor(db) {
     this.db = db;
@@ -5830,44 +6470,47 @@ var BranchRepository = class {
   rowToBranch(row, baseUrl) {
     const branchId = row.branch_id;
     const url = baseUrl && row.board_id ? getBranchUrl(branchId, baseUrl) : null;
-    return {
-      branch_id: branchId,
-      repo_id: row.repo_id,
-      created_at: new Date(row.created_at).toISOString(),
-      updated_at: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      name: row.name,
-      ref: row.ref,
-      ref_type: row.ref_type ?? "branch",
-      branch_unique_id: row.branch_unique_id,
-      start_command: row.start_command ?? void 0,
-      // Static environment fields
-      stop_command: row.stop_command ?? void 0,
-      nuke_command: row.nuke_command ?? void 0,
-      health_check_url: row.health_check_url ?? void 0,
-      app_url: row.app_url ?? void 0,
-      logs_command: row.logs_command ?? void 0,
-      environment_variant: row.environment_variant ?? void 0,
-      board_id: row.board_id ?? void 0,
-      // Top-level column
-      needs_attention: Boolean(row.needs_attention),
-      // Convert SQLite integer (0/1) to boolean
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_at: row.archived_at ? new Date(row.archived_at).toISOString() : void 0,
-      archived_by: row.archived_by ?? void 0,
-      filesystem_status: row.filesystem_status ?? void 0,
-      // RBAC fields
-      permission_source: row.permission_source ?? "override",
-      others_can: row.others_can ?? void 0,
-      others_fs_access: row.others_fs_access ?? void 0,
-      unix_group: row.unix_group ?? void 0,
-      // Branch storage mode
-      storage_mode: row.storage_mode ?? "worktree",
-      clone_depth: row.clone_depth ?? void 0,
-      ...row.data,
-      url
-    };
+    return attachHiddenTenant(
+      {
+        branch_id: branchId,
+        repo_id: row.repo_id,
+        created_at: new Date(row.created_at).toISOString(),
+        updated_at: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        name: row.name,
+        ref: row.ref,
+        ref_type: row.ref_type ?? "branch",
+        branch_unique_id: row.branch_unique_id,
+        start_command: row.start_command ?? void 0,
+        // Static environment fields
+        stop_command: row.stop_command ?? void 0,
+        nuke_command: row.nuke_command ?? void 0,
+        health_check_url: row.health_check_url ?? void 0,
+        app_url: row.app_url ?? void 0,
+        logs_command: row.logs_command ?? void 0,
+        environment_variant: row.environment_variant ?? void 0,
+        board_id: row.board_id ?? void 0,
+        // Top-level column
+        needs_attention: Boolean(row.needs_attention),
+        // Convert SQLite integer (0/1) to boolean
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_at: row.archived_at ? new Date(row.archived_at).toISOString() : void 0,
+        archived_by: row.archived_by ?? void 0,
+        filesystem_status: row.filesystem_status ?? void 0,
+        // RBAC fields
+        permission_source: row.permission_source ?? "override",
+        others_can: row.others_can ?? void 0,
+        others_fs_access: row.others_fs_access ?? void 0,
+        unix_group: row.unix_group ?? void 0,
+        // Branch storage mode
+        storage_mode: row.storage_mode ?? "worktree",
+        clone_depth: row.clone_depth ?? void 0,
+        ...row.data,
+        url
+      },
+      row
+    );
   }
   /**
    * Convert Branch to database insert format
@@ -5974,10 +6617,10 @@ var BranchRepository = class {
   async findById(id) {
     try {
       const fullId = await resolveByShortIdPrefix(id, "Branch", async (pattern) => {
-        const rows = await select(this.db).from(branches3).where((0, import_drizzle_orm16.like)(branches3.branch_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+        const rows = await select(this.db).from(branches3).where((0, import_drizzle_orm14.like)(branches3.branch_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
         return rows.map((r) => r.branch_id);
       });
-      const row = await select(this.db).from(branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, fullId)).one();
+      const row = await select(this.db).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, fullId)).one();
       if (!row) return null;
       const baseUrl = await getBaseUrl();
       return this.rowToBranch(row, baseUrl);
@@ -5992,7 +6635,7 @@ var BranchRepository = class {
   async findRealtimeVisibilityBranch(id) {
     try {
       const fullId = await resolveByShortIdPrefix(id, "Branch", async (pattern) => {
-        const rows = await select(this.db, { branch_id: branches3.branch_id }).from(branches3).where((0, import_drizzle_orm16.like)(branches3.branch_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+        const rows = await select(this.db, { branch_id: branches3.branch_id }).from(branches3).where((0, import_drizzle_orm14.like)(branches3.branch_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
         return rows.map((r) => r.branch_id);
       });
       const row = await select(this.db, {
@@ -6000,11 +6643,11 @@ var BranchRepository = class {
         others_can: branches3.others_can,
         board_id: branches3.board_id,
         permission_source: branches3.permission_source
-      }).from(branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, fullId)).one();
+      }).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, fullId)).one();
       if (!row) return null;
       let othersCan = row.others_can;
       if (row.permission_source === "board" && row.board_id) {
-        const board = await select(this.db, { data: boards3.data }).from(boards3).where((0, import_drizzle_orm16.eq)(boards3.board_id, row.board_id)).one();
+        const board = await select(this.db, { data: boards3.data }).from(boards3).where((0, import_drizzle_orm14.eq)(boards3.board_id, row.board_id)).one();
         const boardData = board?.data;
         othersCan = (boardData?.access_mode ?? "shared") === "private" ? "none" : boardData?.default_others_can ?? row.others_can;
       }
@@ -6024,21 +6667,109 @@ var BranchRepository = class {
    * Callers that explicitly want to exclude archived branches should pass
    * `{ includeArchived: false }`.
    *
-   * @param filter - Optional filters (repo_id, includeArchived)
+   * The `board_id`, `archived`, and `branchIds` filters let the list read path
+   * (`BranchesService.find`) push its high-selectivity predicates into SQL so it
+   * no longer materializes the whole table before filtering in memory.
+   *
+   * @param filter - Optional filters
    * @param filter.repo_id - Filter by repository ID
    * @param filter.includeArchived - Include archived branches (default: true)
+   * @param filter.board_id - Filter to a single board
+   * @param filter.archived - Filter to an exact archived state (takes precedence
+   *   over `includeArchived`)
+   * @param filter.branchIds - Restrict to a set of branch IDs (empty set yields
+   *   no rows, matching an `{ $in: [] }` filter)
+   * @param filter.visibleToUserId - Restrict to branches visible to this user
+   *   under branch RBAC, pushed down as a SQL predicate instead of a preloaded
+   *   `branch_id IN (...)` list.
    */
   async findAll(filter) {
+    if (filter?.branchIds !== void 0 && filter.branchIds.length === 0) {
+      return [];
+    }
     const includeArchived = filter?.includeArchived ?? true;
     const conditions = [];
     if (filter?.repo_id) {
-      conditions.push((0, import_drizzle_orm16.eq)(branches3.repo_id, filter.repo_id));
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.repo_id, filter.repo_id));
+    }
+    if (filter?.board_id) {
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.board_id, filter.board_id));
+    }
+    if (filter?.archived !== void 0) {
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.archived, filter.archived));
+    } else if (!includeArchived) {
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.archived, false));
     }
-    if (!includeArchived) {
-      conditions.push((0, import_drizzle_orm16.eq)(branches3.archived, false));
+    if (filter?.branchIds !== void 0) {
+      conditions.push((0, import_drizzle_orm14.inArray)(branches3.branch_id, filter.branchIds));
     }
-    const query = select(this.db).from(branches3);
-    const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm16.and)(...conditions)).all() : await query.all();
+    if (filter?.visibleToUserId) {
+      conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
+    }
+    const baseQuery = filter?.visibleToUserId ? select(this.db, (0, import_drizzle_orm14.getTableColumns)(branches3)).from(branches3).leftJoin(
+      branchOwners3,
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branches3.branch_id),
+        (0, import_drizzle_orm14.eq)(branchOwners3.user_id, filter.visibleToUserId)
+      )
+    ) : select(this.db).from(branches3);
+    const rows = conditions.length > 0 ? await baseQuery.where((0, import_drizzle_orm14.and)(...conditions)).all() : await baseQuery.all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
+  /**
+   * Health-monitor discovery query. Returns only routing metadata so the
+   * background monitor can enter the correct tenant DB scope before loading
+   * branch contents or patching health state.
+   */
+  async findActiveEnvironmentRefs() {
+    const tenantColumn = branches3.tenant_id;
+    const columns = isPostgresDatabase(this.db) && tenantColumn ? { branch_id: branches3.branch_id, tenant_id: tenantColumn } : { branch_id: branches3.branch_id };
+    const statusExpr = import_drizzle_orm14.sql`${jsonExtract(this.db, branches3.data, "environment_instance.status")}`;
+    const rows = await select(this.db, columns).from(branches3).where((0, import_drizzle_orm14.or)((0, import_drizzle_orm14.eq)(statusExpr, "running"), (0, import_drizzle_orm14.eq)(statusExpr, "starting"))).all();
+    return rows.map((row) => ({
+      branch_id: row.branch_id,
+      ...typeof row.tenant_id === "string" && row.tenant_id.length > 0 ? { tenant_id: row.tenant_id } : {}
+    }));
+  }
+  /**
+   * Find active assistant branches without paginating the whole branch list first.
+   *
+   * A branch is discoverable as an assistant when it has the canonical assistant
+   * marker in custom_context (new or legacy key), or as a read-time backfill for
+   * older hand-bootstrapped assistants, when it has at least one enabled
+   * first-class schedule.
+   */
+  async findAssistantBranches(filter) {
+    const assistantKindConditions = [
+      (0, import_drizzle_orm14.eq)(import_drizzle_orm14.sql`${jsonExtract(this.db, branches3.data, "custom_context.assistant.kind")}`, "assistant"),
+      (0, import_drizzle_orm14.eq)(
+        import_drizzle_orm14.sql`${jsonExtract(this.db, branches3.data, "custom_context.assistant.kind")}`,
+        "persisted-agent"
+      ),
+      (0, import_drizzle_orm14.eq)(import_drizzle_orm14.sql`${jsonExtract(this.db, branches3.data, "custom_context.agent.kind")}`, "assistant"),
+      (0, import_drizzle_orm14.eq)(
+        import_drizzle_orm14.sql`${jsonExtract(this.db, branches3.data, "custom_context.agent.kind")}`,
+        "persisted-agent"
+      )
+    ];
+    const hasEnabledSchedule = (0, import_drizzle_orm14.exists)(
+      // biome-ignore lint/suspicious/noExplicitAny: Drizzle select has complex cross-dialect overloads
+      this.db.select({ _: import_drizzle_orm14.sql`1` }).from(schedules3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(schedules3.branch_id, branches3.branch_id), (0, import_drizzle_orm14.eq)(schedules3.enabled, true)))
+    );
+    const conditions = [(0, import_drizzle_orm14.or)(...assistantKindConditions, hasEnabledSchedule) ?? import_drizzle_orm14.sql`false`];
+    if (filter?.repo_id) conditions.push((0, import_drizzle_orm14.eq)(branches3.repo_id, filter.repo_id));
+    if (filter?.archived !== void 0) conditions.push((0, import_drizzle_orm14.eq)(branches3.archived, filter.archived));
+    if (filter?.userId) conditions.push(visibleBranchAccessCondition(this.db, filter.userId));
+    const baseQuery = select(this.db, (0, import_drizzle_orm14.getTableColumns)(branches3)).from(branches3);
+    const query = filter?.userId ? baseQuery.leftJoin(
+      branchOwners3,
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branches3.branch_id),
+        (0, import_drizzle_orm14.eq)(branchOwners3.user_id, filter.userId)
+      )
+    ) : baseQuery;
+    const rows = await query.where((0, import_drizzle_orm14.and)(...conditions)).limit(filter?.limit ?? 200).all();
     const baseUrl = await getBaseUrl();
     return rows.map((row) => this.rowToBranch(row, baseUrl));
   }
@@ -6059,9 +6790,9 @@ var BranchRepository = class {
         txAsDb(tx),
         this.db,
         branches3,
-        (0, import_drizzle_orm16.eq)(branches3.branch_id, existing.branch_id)
+        (0, import_drizzle_orm14.eq)(branches3.branch_id, existing.branch_id)
       );
-      const currentRow = await select(txAsDb(tx)).from(branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, existing.branch_id)).one();
+      const currentRow = await select(txAsDb(tx)).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, existing.branch_id)).one();
       if (!currentRow) {
         throw new EntityNotFoundError("Branch", id);
       }
@@ -6078,7 +6809,7 @@ var BranchRepository = class {
         // Always update timestamp
       });
       const insertData = this.branchToInsert(merged);
-      const row = await update(txAsDb(tx), branches3).set(insertData).where((0, import_drizzle_orm16.eq)(branches3.branch_id, current.branch_id)).returning().one();
+      const row = await update(txAsDb(tx), branches3).set(insertData).where((0, import_drizzle_orm14.eq)(branches3.branch_id, current.branch_id)).returning().one();
       return this.rowToBranch(row, baseUrl);
     });
   }
@@ -6090,13 +6821,13 @@ var BranchRepository = class {
     if (!existing) {
       throw new EntityNotFoundError("Branch", id);
     }
-    await deleteFrom(this.db, branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, existing.branch_id)).run();
+    await deleteFrom(this.db, branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, existing.branch_id)).run();
   }
   /**
    * Find branch by repo_id and name
    */
   async findByRepoAndName(repoId, name) {
-    const row = await select(this.db).from(branches3).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm16.eq)(branches3.name, name))).one();
+    const row = await select(this.db).from(branches3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm14.eq)(branches3.name, name))).one();
     if (!row) return null;
     const baseUrl = await getBaseUrl();
     return this.rowToBranch(row, baseUrl);
@@ -6106,7 +6837,7 @@ var BranchRepository = class {
    */
   async findActiveByRepoAndName(repoId, name) {
     const row = await select(this.db).from(branches3).where(
-      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm16.eq)(branches3.name, name), (0, import_drizzle_orm16.eq)(branches3.archived, false))
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm14.eq)(branches3.name, name), (0, import_drizzle_orm14.eq)(branches3.archived, false))
     ).one();
     if (!row) return null;
     const baseUrl = await getBaseUrl();
@@ -6125,7 +6856,7 @@ var BranchRepository = class {
    * Used for auto-suffix name conflict resolution — bypasses Feathers pagination.
    */
   async getActiveNamesByRepo(repoId) {
-    const rows = await select(this.db, { name: branches3.name }).from(branches3).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm16.eq)(branches3.archived, false))).all();
+    const rows = await select(this.db, { name: branches3.name }).from(branches3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branches3.repo_id, repoId), (0, import_drizzle_orm14.eq)(branches3.archived, false))).all();
     return rows.map((row) => row.name);
   }
   // ===== RBAC: Ownership Management =====
@@ -6137,7 +6868,7 @@ var BranchRepository = class {
    * @returns true if user is an owner
    */
   async isOwner(branchId, userId) {
-    const row = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branchId), (0, import_drizzle_orm16.eq)(branchOwners3.user_id, userId))).one();
+    const row = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branchId), (0, import_drizzle_orm14.eq)(branchOwners3.user_id, userId))).one();
     return row != null;
   }
   /**
@@ -6149,17 +6880,17 @@ var BranchRepository = class {
   async getBestGroupGrantForUser(branchId, userId) {
     const rows = await select(this.db).from(branchGroupGrants3).innerJoin(
       groupMemberships3,
-      (0, import_drizzle_orm16.and)(
-        (0, import_drizzle_orm16.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id),
-        (0, import_drizzle_orm16.eq)(groupMemberships3.user_id, userId)
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id),
+        (0, import_drizzle_orm14.eq)(groupMemberships3.user_id, userId)
       )
     ).innerJoin(
       groups3,
-      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm16.eq)(groups3.archived, false))
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
     ).where(
-      (0, import_drizzle_orm16.and)(
-        (0, import_drizzle_orm16.eq)(branchGroupGrants3.branch_id, branchId),
-        (0, import_drizzle_orm16.inArray)(branchGroupGrants3.can, BRANCH_PERMISSION_LEVELS)
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm14.inArray)(branchGroupGrants3.can, BRANCH_PERMISSION_LEVELS)
       )
     ).all();
     let best = null;
@@ -6189,7 +6920,7 @@ var BranchRepository = class {
    * this method.
    */
   async resolveUserAccess(branch, userId) {
-    const board = branch.permission_source === "board" && branch.board_id ? await select(this.db, { data: boards3.data, board_id: boards3.board_id }).from(boards3).where((0, import_drizzle_orm16.eq)(boards3.board_id, branch.board_id)).one() : null;
+    const board = branch.permission_source === "board" && branch.board_id ? await select(this.db, { data: boards3.data, board_id: boards3.board_id }).from(boards3).where((0, import_drizzle_orm14.eq)(boards3.board_id, branch.board_id)).one() : null;
     const boardData = board?.data;
     const boardIsShared = (boardData?.access_mode ?? "shared") === "shared";
     const sharing = branch.permission_source === "board" && boardIsShared ? boardData?.default_dangerously_allow_session_sharing ?? false : branch.dangerously_allow_session_sharing ?? false;
@@ -6205,7 +6936,7 @@ var BranchRepository = class {
     const groupRepo = new GroupRepository(this.db);
     const branchGroupGrants4 = await groupRepo.getBranchGrantsForUser(branch.branch_id, userId);
     if (branch.permission_source === "board" && branch.board_id) {
-      const boardOwner = await select(this.db).from(boardOwners3).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(boardOwners3.board_id, branch.board_id), (0, import_drizzle_orm16.eq)(boardOwners3.user_id, userId))).one();
+      const boardOwner = await select(this.db).from(boardOwners3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(boardOwners3.board_id, branch.board_id), (0, import_drizzle_orm14.eq)(boardOwners3.user_id, userId))).one();
       if (boardOwner) {
         return {
           can: "all",
@@ -6262,34 +6993,34 @@ var BranchRepository = class {
     const branchRow = await select(this.db, {
       board_id: branches3.board_id,
       permission_source: branches3.permission_source
-    }).from(branches3).where((0, import_drizzle_orm16.eq)(branches3.branch_id, branchId)).one();
-    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branchId)).all();
-    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm16.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+    }).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
       groups3,
-      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm16.eq)(groups3.archived, false))
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
     ).where(
-      (0, import_drizzle_orm16.and)(
-        (0, import_drizzle_orm16.eq)(branchGroupGrants3.branch_id, branchId),
-        (0, import_drizzle_orm16.inArray)(branchGroupGrants3.can, VIEW_OR_BETTER_BRANCH_PERMISSIONS)
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm14.inArray)(branchGroupGrants3.can, VIEW_OR_BETTER_BRANCH_PERMISSIONS)
       )
     ).all();
-    const boardOwnerRows = branchRow?.permission_source === "board" && branchRow.board_id ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where((0, import_drizzle_orm16.eq)(boardOwners3.board_id, branchRow.board_id)).all() : [];
-    const boardGroupRows = branchRow?.permission_source === "board" && branchRow.board_id ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm16.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+    const boardOwnerRows = branchRow?.permission_source === "board" && branchRow.board_id ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where((0, import_drizzle_orm14.eq)(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = branchRow?.permission_source === "board" && branchRow.board_id ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
       groups3,
-      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm16.eq)(groups3.archived, false))
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
     ).innerJoin(
       boards3,
-      (0, import_drizzle_orm16.and)(
-        (0, import_drizzle_orm16.eq)(boards3.board_id, boardGroupGrants3.board_id),
-        (0, import_drizzle_orm16.eq)(
-          import_drizzle_orm16.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm14.eq)(
+          import_drizzle_orm14.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
           "shared"
         )
       )
     ).where(
-      (0, import_drizzle_orm16.and)(
-        (0, import_drizzle_orm16.eq)(boardGroupGrants3.board_id, branchRow.board_id),
-        (0, import_drizzle_orm16.inArray)(boardGroupGrants3.can, VIEW_OR_BETTER_BRANCH_PERMISSIONS)
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boardGroupGrants3.board_id, branchRow.board_id),
+        (0, import_drizzle_orm14.inArray)(boardGroupGrants3.can, VIEW_OR_BETTER_BRANCH_PERMISSIONS)
       )
     ).all() : [];
     const userIds = /* @__PURE__ */ new Set();
@@ -6307,6 +7038,83 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find users whose explicit branch or aligned-board grants should materialize
+   * into filesystem access for the branch.
+   *
+   * This intentionally excludes ambient "others" access because there is no
+   * bounded user set to expand. Board owners apply whenever the branch is
+   * explicitly aligned to board permissions (`permission_source = 'board'`);
+   * board group grants additionally require a shared board. Override branches
+   * must not inherit board grants.
+   */
+  async findExplicitFsAccessUserIds(branchId) {
+    const branchRow = await select(this.db, {
+      board_id: branches3.board_id,
+      permission_source: branches3.permission_source
+    }).from(branches3).where((0, import_drizzle_orm14.eq)(branches3.branch_id, branchId)).one();
+    const ownerRows = await select(this.db, { user_id: branchOwners3.user_id }).from(branchOwners3).where((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branchId)).all();
+    const groupRows = await select(this.db, { user_id: groupMemberships3.user_id }).from(branchGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, branchGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branchGroupGrants3.branch_id, branchId),
+        (0, import_drizzle_orm14.inArray)(
+          import_drizzle_orm14.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const isBoardAligned = branchRow?.permission_source === "board" && branchRow.board_id;
+    const boardOwnerRows = isBoardAligned ? await select(this.db, { user_id: boardOwners3.user_id }).from(boardOwners3).where((0, import_drizzle_orm14.eq)(boardOwners3.board_id, branchRow.board_id)).all() : [];
+    const boardGroupRows = isBoardAligned ? await select(this.db, { user_id: groupMemberships3.user_id }).from(boardGroupGrants3).innerJoin(groupMemberships3, (0, import_drizzle_orm14.eq)(groupMemberships3.group_id, boardGroupGrants3.group_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm14.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm14.eq)(
+          import_drizzle_orm14.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`,
+          "shared"
+        )
+      )
+    ).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(boardGroupGrants3.board_id, branchRow.board_id),
+        (0, import_drizzle_orm14.inArray)(
+          import_drizzle_orm14.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all() : [];
+    const userIds = /* @__PURE__ */ new Set();
+    for (const row of ownerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of groupRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardOwnerRows) {
+      userIds.add(row.user_id);
+    }
+    for (const row of boardGroupRows) {
+      userIds.add(row.user_id);
+    }
+    return Array.from(userIds);
+  }
+  async findBoardAlignedBranches(boardId) {
+    const rows = await select(this.db).from(branches3).where(
+      (0, import_drizzle_orm14.and)(
+        (0, import_drizzle_orm14.eq)(branches3.board_id, boardId),
+        (0, import_drizzle_orm14.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm14.eq)(branches3.archived, false)
+      )
+    ).all();
+    const baseUrl = await getBaseUrl();
+    return rows.map((row) => this.rowToBranch(row, baseUrl));
+  }
   /**
    * Get all owners of a branch
    *
@@ -6318,7 +7126,7 @@ var BranchRepository = class {
     if (!branch) {
       throw new EntityNotFoundError("Branch", branchId);
     }
-    const rows = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branch.branch_id)).all();
+    const rows = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branch.branch_id)).all();
     return rows.map((row) => row.user_id);
   }
   /**
@@ -6358,7 +7166,7 @@ var BranchRepository = class {
     if (!branch) {
       throw new EntityNotFoundError("Branch", branchId);
     }
-    await deleteFrom(this.db, branchOwners3).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branch.branch_id), (0, import_drizzle_orm16.eq)(branchOwners3.user_id, userId))).run();
+    await deleteFrom(this.db, branchOwners3).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branch.branch_id), (0, import_drizzle_orm14.eq)(branchOwners3.user_id, userId))).run();
   }
   /**
    * Bulk-load ownership for multiple branches
@@ -6373,7 +7181,7 @@ var BranchRepository = class {
     if (branchIds.length === 0) {
       return /* @__PURE__ */ new Map();
     }
-    const rows = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm16.inArray)(branchOwners3.branch_id, branchIds)).all();
+    const rows = await select(this.db).from(branchOwners3).where((0, import_drizzle_orm14.inArray)(branchOwners3.branch_id, branchIds)).all();
     const ownersByBranch = /* @__PURE__ */ new Map();
     for (const row of rows) {
       const wtId = row.branch_id;
@@ -6404,14 +7212,14 @@ var BranchRepository = class {
   async findAccessibleBranches(userId, filter) {
     const conditions = [visibleBranchAccessCondition(this.db, userId)];
     if (filter?.archived === true) {
-      conditions.push((0, import_drizzle_orm16.eq)(branches3.archived, true));
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.archived, true));
     } else if (filter?.archived === false) {
-      conditions.push((0, import_drizzle_orm16.eq)(branches3.archived, false));
+      conditions.push((0, import_drizzle_orm14.eq)(branches3.archived, false));
     }
-    const rows = await select(this.db, (0, import_drizzle_orm16.getTableColumns)(branches3)).from(branches3).leftJoin(
+    const rows = await select(this.db, (0, import_drizzle_orm14.getTableColumns)(branches3)).from(branches3).leftJoin(
       branchOwners3,
-      (0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm16.eq)(branchOwners3.user_id, userId))
-    ).where((0, import_drizzle_orm16.and)(...conditions)).all();
+      (0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm14.eq)(branchOwners3.user_id, userId))
+    ).where((0, import_drizzle_orm14.and)(...conditions)).all();
     const baseUrl = await getBaseUrl();
     const seen = /* @__PURE__ */ new Set();
     const result = [];
@@ -6434,7 +7242,7 @@ var BranchRepository = class {
     const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
     const rows = await select(this.db, {
       branch_id: boardObjectsTable.branch_id
-    }).from(boardObjectsTable).where(import_drizzle_orm16.sql`${jsonExtract2(this.db, boardObjectsTable.data, "zone_id")} = ${zoneId}`).all();
+    }).from(boardObjectsTable).where(import_drizzle_orm14.sql`${jsonExtract2(this.db, boardObjectsTable.data, "zone_id")} = ${zoneId}`).all();
     const uniqueIds = /* @__PURE__ */ new Set();
     for (const row of rows) {
       if (row.branch_id) {
@@ -6486,7 +7294,7 @@ var BranchRepository = class {
         zone_id: jsonExtract2(this.db, boardObjectsTable.data, "zone_id"),
         position: jsonExtract2(this.db, boardObjectsTable.data, "position"),
         board_data: boardsTable.data
-      }).from(boardObjectsTable).leftJoin(boardsTable, (0, import_drizzle_orm16.eq)(boardObjectsTable.board_id, boardsTable.board_id)).where((0, import_drizzle_orm16.inArray)(boardObjectsTable.branch_id, branchIds)).all();
+      }).from(boardObjectsTable).leftJoin(boardsTable, (0, import_drizzle_orm14.eq)(boardObjectsTable.board_id, boardsTable.board_id)).where((0, import_drizzle_orm14.inArray)(boardObjectsTable.branch_id, branchIds)).all();
       const boardObjectInfoByBranch = /* @__PURE__ */ new Map();
       for (const row of rows) {
         const info = {
@@ -6565,7 +7373,7 @@ var BranchRepository = class {
         agentic_tool: sessionsTable.agentic_tool,
         updated_at: sessionsTable.updated_at,
         unix_username: sessionsTable.unix_username
-      }).from(sessionsTable).where((0, import_drizzle_orm16.inArray)(sessionsTable.branch_id, branchIds)).orderBy(sessionsTable.updated_at).all();
+      }).from(sessionsTable).where((0, import_drizzle_orm14.inArray)(sessionsTable.branch_id, branchIds)).orderBy(sessionsTable.updated_at).all();
       const sessionIds = sessionRows.map((s) => s.session_id);
       if (sessionIds.length === 0) {
         return branches4.map((wt) => ({ ...wt, sessions: [] }));
@@ -6574,8 +7382,8 @@ var BranchRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where((0, import_drizzle_orm16.and)((0, import_drizzle_orm16.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm16.eq)(messagesTable.role, "assistant")));
-        const lastMessage = await query.orderBy((0, import_drizzle_orm16.desc)(messagesTable.index)).limit(1).one();
+        }).from(messagesTable).where((0, import_drizzle_orm14.and)((0, import_drizzle_orm14.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm14.eq)(messagesTable.role, "assistant")));
+        const lastMessage = await query.orderBy((0, import_drizzle_orm14.desc)(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
           let fullText = "";
@@ -6590,8 +7398,8 @@ var BranchRepository = class {
       }
       const countRows = await select(this.db, {
         session_id: messagesTable.session_id,
-        count: import_drizzle_orm16.sql`count(*)`
-      }).from(messagesTable).where((0, import_drizzle_orm16.inArray)(messagesTable.session_id, sessionIds)).groupBy(messagesTable.session_id).all();
+        count: import_drizzle_orm14.sql`count(*)`
+      }).from(messagesTable).where((0, import_drizzle_orm14.inArray)(messagesTable.session_id, sessionIds)).groupBy(messagesTable.session_id).all();
       const messageCountBySession = /* @__PURE__ */ new Map();
       for (const r of countRows) {
         messageCountBySession.set(r.session_id, Number(r.count));
@@ -6643,14 +7451,14 @@ var BranchRepository = class {
 
 // src/db/repositories/card-types.ts
 init_cjs_shims();
-var import_drizzle_orm18 = require("drizzle-orm");
+var import_drizzle_orm16 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/cards.ts
 init_cjs_shims();
-var import_drizzle_orm19 = require("drizzle-orm");
+var import_drizzle_orm17 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -6658,16 +7466,24 @@ init_schema();
 // src/db/repositories/gateway-channels.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm20 = require("drizzle-orm");
+var import_drizzle_orm18 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
+// src/db/repositories/gateway-outbound-messages.ts
+init_cjs_shims();
+init_types2();
+var import_drizzle_orm19 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/knowledge.ts
 init_cjs_shims();
-var import_node_crypto4 = require("crypto");
+var import_node_crypto3 = require("crypto");
 init_types2();
-var import_drizzle_orm21 = require("drizzle-orm");
+var import_drizzle_orm20 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -6675,7 +7491,7 @@ init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm22 = require("drizzle-orm");
+var import_drizzle_orm21 = require("drizzle-orm");
 init_ids();
 
 // src/tools/mcp/auth-secrets.ts
@@ -6690,13 +7506,13 @@ init_schema();
 
 // src/db/repositories/messages.ts
 init_cjs_shims();
-var import_drizzle_orm23 = require("drizzle-orm");
+var import_drizzle_orm22 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/repos.ts
 init_cjs_shims();
-var import_drizzle_orm24 = require("drizzle-orm");
+var import_drizzle_orm23 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -6732,20 +7548,23 @@ var RepoRepository = class {
     const environment = data.environment ?? wrapV1AsV2(data.environment_config);
     const environment_config = data.environment_config ?? deriveV1FromV2(environment);
     const remote_url = typeof data.remote_url === "string" ? stripHttpUrlUserinfo(data.remote_url) : data.remote_url;
-    return {
-      repo_id: row.repo_id,
-      slug: row.slug,
-      repo_type: row.repo_type ?? "remote",
-      unix_group: row.unix_group ?? void 0,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      ...data,
-      remote_url,
-      environment,
-      environment_config,
-      clone_status: data.clone_status,
-      clone_error: data.clone_error
-    };
+    return attachHiddenTenant(
+      {
+        repo_id: row.repo_id,
+        slug: row.slug,
+        repo_type: row.repo_type ?? "remote",
+        unix_group: row.unix_group ?? void 0,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        ...data,
+        remote_url,
+        environment,
+        environment_config,
+        clone_status: data.clone_status,
+        clone_error: data.clone_error
+      },
+      row
+    );
   }
   /**
    * Convert Repo to database insert format
@@ -6795,7 +7614,7 @@ var RepoRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Repo", async (pattern) => {
-      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm24.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm23.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.repo_id);
     });
   }
@@ -6806,7 +7625,7 @@ var RepoRepository = class {
     try {
       const insertData = this.repoToInsert(data);
       await insert(this.db, repos3).values(insertData).run();
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, insertData.repo_id)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, insertData.repo_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created repo");
       }
@@ -6825,7 +7644,7 @@ var RepoRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -6841,7 +7660,7 @@ var RepoRepository = class {
    */
   async findBySlug(slug) {
     try {
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.slug, slug)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.slug, slug)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -6909,8 +7728,8 @@ var RepoRepository = class {
       let changed = 0;
       for (const finding of scan.findings) {
         await this.db.transaction(async (tx) => {
-          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id));
-          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id)).one();
+          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id));
+          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id)).one();
           if (!currentRow) return;
           const data = currentRow.data;
           if (typeof data.remote_url !== "string" || !httpUrlHasUserinfo(data.remote_url)) {
@@ -6922,7 +7741,7 @@ var RepoRepository = class {
               ...data,
               remote_url: stripHttpUrlUserinfo(data.remote_url)
             }
-          }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, finding.repo_id)).run();
+          }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id)).run();
           changed += 1;
         });
       }
@@ -6944,8 +7763,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -6959,7 +7778,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: merged.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
         merged.clone_error = insertData.data.clone_error;
         merged.remote_url = insertData.data.remote_url;
         merged.last_updated = newUpdatedAt.toISOString();
@@ -6993,8 +7812,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm24.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -7008,7 +7827,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: next.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
         next.environment = insertData.data.environment;
         next.environment_config = insertData.data.environment_config;
         next.remote_url = insertData.data.remote_url;
@@ -7048,7 +7867,7 @@ var RepoRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm24.eq)(repos3.repo_id, fullId)).run();
+      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Repo", id);
       }
@@ -7079,7 +7898,7 @@ var RepoRepository = class {
    */
   async count() {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm24.sql`count(*)` }).from(repos3).one();
+      const result = await select(this.db, { count: import_drizzle_orm23.sql`count(*)` }).from(repos3).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -7092,33 +7911,40 @@ var RepoRepository = class {
 
 // src/db/repositories/schedules.ts
 init_cjs_shims();
-var import_drizzle_orm25 = require("drizzle-orm");
+var import_drizzle_orm24 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/serialized-sessions.ts
 init_cjs_shims();
-var import_drizzle_orm26 = require("drizzle-orm");
+var import_drizzle_orm25 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/session-mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm27 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/sessions.ts
 init_cjs_shims();
 init_types2();
-var import_drizzle_orm27 = require("drizzle-orm");
+var import_drizzle_orm26 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
 init_schema();
 
+// src/db/repositories/session-relationships.ts
+init_cjs_shims();
+var import_drizzle_orm28 = require("drizzle-orm");
+init_ids();
+init_database_wrapper();
+init_schema();
+
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types2();
@@ -7137,12 +7963,13 @@ init_schema();
 
 // src/db/repositories/user-api-keys.ts
 init_cjs_shims();
-var import_node_crypto5 = require("crypto");
-var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
+var import_node_crypto4 = require("crypto");
+var import_bcryptjs = __toESM(require("bcryptjs"), 1);
 var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
+init_tenant_context();
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
@@ -7178,7 +8005,12 @@ var UsersRepository = class {
       unix_username: row.unix_username ?? void 0,
       onboarding_completed: row.onboarding_completed,
       must_change_password: row.must_change_password,
+      tokens_valid_after: row.tokens_valid_after ? new Date(row.tokens_valid_after) : void 0,
+      avatar_url: row.data.avatar_url ?? row.data.avatar,
       avatar: row.data.avatar,
+      avatar_source: row.data.avatar_source,
+      avatar_source_id: row.data.avatar_source_id,
+      avatar_synced_at: row.data.avatar_synced_at,
       preferences: row.data.preferences,
       // Convert encrypted per-tool credential blobs into boolean presence flags.
       agentic_tools: toAgenticToolsStatus(row.data.agentic_tools),
@@ -7222,8 +8054,14 @@ var UsersRepository = class {
       role: user.role ?? "member",
       unix_username: user.unix_username ?? null,
       onboarding_completed: user.onboarding_completed ?? false,
+      must_change_password: user.must_change_password ?? false,
+      tokens_valid_after: user.tokens_valid_after ? new Date(user.tokens_valid_after) : null,
       data: {
+        avatar_url: user.avatar_url,
         avatar: user.avatar,
+        avatar_source: user.avatar_source,
+        avatar_source_id: user.avatar_source_id,
+        avatar_synced_at: user.avatar_synced_at,
         preferences: user.preferences,
         // Encrypted per-tool credentials. Only forwarded when caller passes the
         // raw shape (internal credential mutators); regular updates leave it undefined,
@@ -7310,6 +8148,35 @@ var UsersRepository = class {
     }
     return this.rowToUser(result);
   }
+  /**
+   * Find user by email for external identity providers.
+   *
+   * Agor intentionally keeps exact/case-sensitive email lookup semantics for
+   * auth paths because the schema historically allowed case-distinct emails.
+   * External providers such as Slack and GitHub treat email addresses as a
+   * canonical identity hint, so their alignment path needs a case-insensitive
+   * match. Prefer an exact match when present; otherwise return a
+   * case-insensitive match only when it is unambiguous.
+   */
+  async findByEmailForAlignment(email) {
+    const normalizedEmail = email.trim().toLowerCase();
+    if (!normalizedEmail) return null;
+    const exact = await this.findByEmail(normalizedEmail);
+    if (exact) return exact;
+    const results = await select(this.db).from(users3).where(import_drizzle_orm33.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    if (results.length !== 1) {
+      if (results.length > 1) {
+        console.warn(
+          `[users] Ambiguous case-insensitive email alignment for ${normalizedEmail}: ${results.map((row) => {
+            const userRow = row;
+            return `${shortId(userRow.user_id)}:${userRow.email}`;
+          }).join(", ")}`
+        );
+      }
+      return null;
+    }
+    return this.rowToUser(results[0]);
+  }
   /**
    * Find all users
    */
@@ -7478,130 +8345,10 @@ var UsersRepository = class {
   }
 };
 
-// src/db/index.ts
-init_schema();
-
-// src/db/session-guard.ts
-init_cjs_shims();
-init_ids();
-
-// src/db/index.ts
-init_user_utils();
-var compare = import_bcryptjs3.default.compare;
-var hash = import_bcryptjs3.default.hash;
-
-// src/config/key-resolver.ts
-init_database_wrapper();
-init_schema();
-init_ids();
-init_config_manager();
-var DEBUG_KEY_RESOLUTION = process.env.AGOR_DEBUG_KEY_RESOLUTION === "1" || process.env.DEBUG?.includes("key-resolution");
-
-// src/config/proxies-resolver.ts
-init_cjs_shims();
-
-// src/config/repo-list.ts
-init_cjs_shims();
-
-// src/config/repo-reference.ts
-init_cjs_shims();
-var REPO_SLUG_PATTERN = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
-
-// src/config/resolved-config-slice.ts
-init_cjs_shims();
-var import_zod = require("zod");
-var ResolvedConfigSliceSchema = import_zod.z.object({
-  /** From `config.execution.*` */
-  execution: import_zod.z.object({
-    permission_timeout_ms: import_zod.z.number().int().nonnegative().optional(),
-    executor_heartbeat: import_zod.z.object({
-      enabled: import_zod.z.boolean(),
-      interval_ms: import_zod.z.number().int().positive()
-    }).optional()
-  }).optional(),
-  /** From `config.opencode.*` */
-  opencode: import_zod.z.object({
-    serverUrl: import_zod.z.string().optional()
-  }).optional(),
-  /** From `config.daemon.*` (selected fields only) */
-  daemon: import_zod.z.object({
-    host_ip_address: import_zod.z.string().optional()
-  }).optional()
-});
-
-// src/config/resource-schemas.ts
-init_cjs_shims();
-var import_zod2 = require("zod");
-var uuidSchema = import_zod2.z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i, "Must be a valid UUID");
-var repoSlugSchema = import_zod2.z.string().regex(
-  REPO_SLUG_PATTERN,
-  'Must be org/name format with alphanumeric, hyphens, underscores, or dots (e.g., "my-org/my-repo")'
-);
-var enforcedAgentConfigSchema = import_zod2.z.object({
-  agentic_tool: import_zod2.z.enum(["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]).optional(),
-  permission_mode: import_zod2.z.string().optional(),
-  model: import_zod2.z.string().optional(),
-  mcp_server_ids: import_zod2.z.array(import_zod2.z.string()).optional()
-});
-var resourceRepoConfigSchema = import_zod2.z.object({
-  repo_id: uuidSchema,
-  slug: repoSlugSchema,
-  remote_url: import_zod2.z.string().optional(),
-  repo_type: import_zod2.z.enum(["remote", "local"]).default("remote"),
-  default_branch: import_zod2.z.string().optional(),
-  shallow: import_zod2.z.boolean().optional()
-}).refine((data) => data.repo_type !== "remote" || data.remote_url, {
-  message: 'remote_url is required when repo_type is "remote"',
-  path: ["remote_url"]
-});
-var resourceBranchConfigSchema = import_zod2.z.object({
-  branch_id: uuidSchema,
-  name: import_zod2.z.string().min(1, "Branch name is required"),
-  ref: import_zod2.z.string().min(1, "Git ref is required"),
-  ref_type: import_zod2.z.enum(["branch", "tag"]).optional(),
-  others_can: import_zod2.z.enum(["none", "view", "session", "prompt", "all"]).optional(),
-  mcp_server_ids: import_zod2.z.array(import_zod2.z.string()).optional(),
-  repo: repoSlugSchema,
-  readonly: import_zod2.z.boolean().optional(),
-  agent: enforcedAgentConfigSchema.optional()
-});
-var resourceUserConfigSchema = import_zod2.z.object({
-  user_id: uuidSchema,
-  email: import_zod2.z.string().email("Must be a valid email address"),
-  name: import_zod2.z.string().optional(),
-  role: import_zod2.z.enum(["superadmin", "admin", "member", "viewer"]).default("member"),
-  unix_username: import_zod2.z.string().optional(),
-  password: import_zod2.z.string().optional()
-});
-var daemonResourcesConfigSchema = import_zod2.z.object({
-  repos: import_zod2.z.array(resourceRepoConfigSchema).optional(),
-  branches: import_zod2.z.array(resourceBranchConfigSchema).optional(),
-  users: import_zod2.z.array(resourceUserConfigSchema).optional()
-});
-
-// src/config/resource-sync.ts
-init_cjs_shims();
-
-// src/config/security-resolver.ts
-init_cjs_shims();
-var DEFAULT_GIT_CONFIG_PARAMETERS = Object.freeze([
-  "transfer.credentialsInUrl=die",
-  "protocol.file.allow=user",
-  "protocol.ext.allow=never",
-  "core.protectHFS=true",
-  "core.protectNTFS=true"
-]);
-
-// src/config/index.ts
-init_types();
-
 // src/git/index.ts
+var git_exports = {};
 init_cjs_shims();
-var import_node_fs3 = require("fs");
-var import_promises2 = require("fs/promises");
-var import_node_path4 = require("path");
-var import_simple_git = require("simple-git");
-init_config_manager();
+__reExport(git_exports, require("@agor/git"));
 
 // src/unix/run-as-user.ts
 init_cjs_shims();
@@ -7957,116 +8704,13 @@ function buildSpawnArgs(command, args = [], options) {
   };
 }
 
-// src/git/index.ts
-init_config_manager();
-var cachedGitBinary;
-function getGitBinary() {
-  if (cachedGitBinary !== void 0) return cachedGitBinary;
-  const commonPaths = [
-    "/opt/homebrew/bin/git",
-    // Homebrew on Apple Silicon
-    "/usr/local/bin/git",
-    // Homebrew on Intel
-    "/usr/bin/git"
-    // System git (Docker and Linux)
-  ];
-  for (const path2 of commonPaths) {
-    if ((0, import_node_fs3.existsSync)(path2)) {
-      cachedGitBinary = path2;
-      return path2;
-    }
-  }
-  cachedGitBinary = "git";
-  return cachedGitBinary;
-}
-function isLikelyGitToken(token) {
-  return /^[A-Za-z0-9_-]{20,255}$/.test(token);
-}
-var DEFAULT_AUTH_HEADER_HOST = "github.com";
-function buildGitConfigEnv(entries) {
-  if (entries.length === 0) return {};
-  const out = {
-    GIT_CONFIG_COUNT: String(entries.length)
-  };
-  for (let i = 0; i < entries.length; i++) {
-    const [key, value] = entries[i];
-    out[`GIT_CONFIG_KEY_${i}`] = key;
-    out[`GIT_CONFIG_VALUE_${i}`] = value;
-  }
-  return out;
-}
-function buildAuthHeaderEnv(token, host = DEFAULT_AUTH_HEADER_HOST) {
-  if (!token) return [];
-  if (!isLikelyGitToken(token)) {
-    console.warn(
-      "\u{1F511} Skipping http.extraheader: token does not match expected shape. Tokens must match /^[A-Za-z0-9_-]{20,255}$/. Re-save the token to enable the auth header."
-    );
-    return [];
-  }
-  const credential = Buffer.from(`x-access-token:${token}`, "utf8").toString("base64");
-  const key = `http.https://${host}/.extraheader`;
-  return [[key, `Authorization: Basic ${credential}`]];
-}
-function createGit(baseDir, env, authHost) {
-  const gitBinary = getGitBinary();
-  const config = [];
-  const rawToken = env?.GITHUB_TOKEN ?? env?.GH_TOKEN;
-  const authConfigEntries = buildAuthHeaderEnv(rawToken, authHost ?? DEFAULT_AUTH_HEADER_HOST);
-  let spawnEnv;
-  if (env || authConfigEntries.length > 0) {
-    spawnEnv = {
-      ...process.env,
-      ...env ?? {},
-      // Inheritance kill (GLOBAL only): ignore the daemon user's
-      // ~/.gitconfig. /etc/gitconfig is intentionally NOT killed — it is
-      // admin-policy territory (CA bundles, proxies). See block comment.
-      GIT_CONFIG_GLOBAL: "/dev/null",
-      // Fail fast instead of blocking on an interactive credential prompt
-      // (which would hang the daemon).
-      GIT_TERMINAL_PROMPT: "0",
-      // Inject http.extraheader (and any future server-constructed config)
-      // via the env-var protocol so it never lands on argv.
-      ...buildGitConfigEnv(authConfigEntries)
-    };
-  }
-  const git = (0, import_simple_git.simpleGit)({
-    baseDir,
-    binary: gitBinary,
-    config,
-    unsafe: {
-      // simple-git's scanner blocks spawning when these env vars / config keys
-      // are present. We own the daemon env (in strict mode it's the user's own
-      // env) and inject GIT_CONFIG_* ourselves — opting in here mirrors what a
-      // direct `git` invocation on the same machine does.
-      allowUnsafeSshCommand: true,
-      allowUnsafeConfigPaths: true,
-      allowUnsafeConfigEnvCount: true,
-      allowUnsafeEditor: true,
-      allowUnsafeAskPass: true,
-      allowUnsafePager: true,
-      allowUnsafeGitProxy: true,
-      allowUnsafeTemplateDir: true,
-      allowUnsafeDiffExternal: true
-    }
-  });
-  if (spawnEnv) {
-    git.env(spawnEnv);
-  }
-  return { git };
-}
-async function getCurrentSha(repoPath) {
-  const { git } = createGit(repoPath);
-  const log = await git.log({ maxCount: 1 });
-  return log.latest?.hash || "";
-}
-
 // src/unix/user-env-file.ts
 init_cjs_shims();
 var import_node_child_process4 = require("child_process");
-var import_node_crypto6 = require("crypto");
-var import_node_fs4 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path5 = require("path");
+var import_node_crypto5 = require("crypto");
+var import_node_fs3 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path2 = require("path");
 
 // src/unix/secret-env.ts
 init_cjs_shims();
@@ -8108,8 +8752,8 @@ function writeUserEnvFile(asUser, env) {
   if (!isValidUnixUsername(asUser)) {
     throw new Error(`writeUserEnvFile: invalid Unix username: ${JSON.stringify(asUser)}`);
   }
-  const nonce = (0, import_node_crypto6.randomBytes)(16).toString("hex");
-  const envFilePath = (0, import_node_path5.join)((0, import_node_os3.tmpdir)(), `${ENV_FILE_PREFIX}${nonce}`);
+  const nonce = (0, import_node_crypto5.randomBytes)(16).toString("hex");
+  const envFilePath = (0, import_node_path2.join)((0, import_node_os2.tmpdir)(), `${ENV_FILE_PREFIX}${nonce}`);
   const lines = [];
   for (const [key, value] of Object.entries(env)) {
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
@@ -8129,7 +8773,7 @@ function writeUserEnvFile(asUser, env) {
 }
 function tryUnlinkEnvFile(path2) {
   try {
-    (0, import_node_fs4.unlinkSync)(path2);
+    (0, import_node_fs3.unlinkSync)(path2);
   } catch {
   }
 }
@@ -8175,7 +8819,7 @@ function prepareImpersonationEnv(options) {
 // src/unix/environment-command-spawn.ts
 async function captureBranchBuildSha(branchPath2) {
   try {
-    const sha = await getCurrentSha(branchPath2);
+    const sha = await (0, git_exports.getCurrentSha)(branchPath2);
     return sha ? sha.slice(0, 7) : void 0;
   } catch {
     return void 0;
@@ -8474,7 +9118,7 @@ var REPO_GIT_PERMISSION_MODE = "2770";
 // src/unix/id-lookups.ts
 init_cjs_shims();
 var import_node_child_process6 = require("child_process");
-var import_node_fs5 = __toESM(require("fs"), 1);
+var import_node_fs4 = __toESM(require("fs"), 1);
 function getGidFromGroupName(groupName) {
   if (!groupName) {
     return void 0;
@@ -8495,8 +9139,8 @@ function getGidFromGroupName(groupName) {
       }
     } catch {
     }
-    if (import_node_fs5.default.existsSync("/etc/group")) {
-      const groupFile = import_node_fs5.default.readFileSync("/etc/group", "utf-8");
+    if (import_node_fs4.default.existsSync("/etc/group")) {
+      const groupFile = import_node_fs4.default.readFileSync("/etc/group", "utf-8");
       const line = groupFile.split("\n").find((l) => l.startsWith(`${groupName}:`));
       if (line) {
         const parts = line.split(":");
@@ -8550,8 +9194,8 @@ function getUidFromUsername(username) {
       }
     } catch {
     }
-    if (import_node_fs5.default.existsSync("/etc/passwd")) {
-      const passwdFile = import_node_fs5.default.readFileSync("/etc/passwd", "utf-8");
+    if (import_node_fs4.default.existsSync("/etc/passwd")) {
+      const passwdFile = import_node_fs4.default.readFileSync("/etc/passwd", "utf-8");
       const line = passwdFile.split("\n").find((l) => l.startsWith(`${username}:`));
       if (line) {
         const parts = line.split(":");
@@ -8590,8 +9234,8 @@ function getHomedirFromUsername(username) {
       }
     } catch {
     }
-    if (import_node_fs5.default.existsSync("/etc/passwd")) {
-      const passwdFile = import_node_fs5.default.readFileSync("/etc/passwd", "utf-8");
+    if (import_node_fs4.default.existsSync("/etc/passwd")) {
+      const passwdFile = import_node_fs4.default.readFileSync("/etc/passwd", "utf-8");
       const line = passwdFile.split("\n").find((l) => l.startsWith(`${username}:`));
       if (line) {
         const parts = line.split(":");
@@ -8842,6 +9486,30 @@ var UnixIntegrationService = class {
     this.usersRepo = new UsersRepository(db);
     this.repoRepo = new RepoRepository(db);
   }
+  async getUnixUsernamesForUsers(userIds) {
+    const unixUsernames = /* @__PURE__ */ new Set();
+    for (const userId of userIds) {
+      const user = await this.usersRepo.findById(userId);
+      if (user?.unix_username) {
+        unixUsernames.add(user.unix_username);
+      }
+    }
+    return unixUsernames;
+  }
+  async reconcileUnixGroupMembers(groupName, allowedUnixUsernames, options) {
+    if (this.config.daemonUser) {
+      allowedUnixUsernames.add(this.config.daemonUser);
+    }
+    const result = await this.executor.exec(UnixGroupCommands.listGroupMembers(groupName));
+    const currentMembers = result.stdout.trim().split(",").filter(Boolean);
+    for (const unixUsername of currentMembers) {
+      if (allowedUnixUsernames.has(unixUsername)) continue;
+      console.log(
+        `[UnixIntegration] Removing stale ${options.label} group member ${unixUsername} from ${groupName}`
+      );
+      await this.executor.exec(UnixGroupCommands.removeUserFromGroup(unixUsername, groupName));
+    }
+  }
   /**
    * Get the configured daemon user
    *
@@ -9085,19 +9753,26 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing branch
    *
-   * Creates group and adds all current owners.
+   * Creates group and adds all users with explicit filesystem access.
    *
    * @param branchId - Branch ID
    */
   async initializeBranchGroup(branchId) {
     const groupName = await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "branch"
+    });
     console.log(
-      `[UnixIntegration] Initialized group ${groupName} with ${ownerIds.length} owner(s)`
+      `[UnixIntegration] Initialized group ${groupName} with ${userIds.length} explicit filesystem user(s)`
     );
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
+    }
   }
   // ============================================================
   // REPO GROUP MANAGEMENT
@@ -9329,8 +10004,8 @@ var UnixIntegrationService = class {
   /**
    * Check if a user should be in a repo's Unix group
    *
-   * A user should be in the repo group if they have ownership
-   * of ANY branch in that repo.
+   * A user should be in the repo group if they have explicit filesystem access
+   * to ANY branch in that repo.
    *
    * @param repoId - Repo ID
    * @param userId - User ID to check
@@ -9339,8 +10014,8 @@ var UnixIntegrationService = class {
   async shouldUserBeInRepoGroup(repoId, userId) {
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
     for (const wt of branches4) {
-      const isOwner = await this.branchRepo.isOwner(wt.branch_id, userId);
-      if (isOwner) {
+      const userIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      if (userIds.includes(userId)) {
         return true;
       }
     }
@@ -9349,33 +10024,36 @@ var UnixIntegrationService = class {
   /**
    * Initialize Unix group for an existing repo
    *
-   * Creates group, sets .git permissions, and adds all users who
-   * own any branch in the repo.
+   * Creates group, sets .git permissions, and adds all users who have explicit
+   * filesystem access to any branch in the repo.
    *
    * @param repoId - Repo ID
    */
   async initializeRepoGroup(repoId) {
     const groupName = await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
     }
+    await this.reconcileUnixGroupMembers(groupName, await this.getUnixUsernamesForUsers(userIds), {
+      label: "repo"
+    });
     console.log(
-      `[UnixIntegration] Initialized repo group ${groupName} with ${ownerIds.size} unique owner(s)`
+      `[UnixIntegration] Initialized repo group ${groupName} with ${userIds.size} unique filesystem user(s)`
     );
   }
   /**
    * Full sync for a repo
    *
    * Ensures repo group exists, .git permissions are set, and all
-   * branch owners are in the repo group.
+   * branch filesystem-access users are in the repo group.
    *
    * @param repoId - Repo ID
    */
@@ -9383,15 +10061,23 @@ var UnixIntegrationService = class {
     console.log(`[UnixIntegration] Full sync for repo ${shortId(repoId)}`);
     await this.createRepoGroup(repoId);
     const branches4 = await this.branchRepo.findAll({ repo_id: repoId });
-    const ownerIds = /* @__PURE__ */ new Set();
+    const userIds = /* @__PURE__ */ new Set();
     for (const wt of branches4) {
-      const wtOwners = await this.branchRepo.getOwners(wt.branch_id);
-      for (const ownerId of wtOwners) {
-        ownerIds.add(ownerId);
+      const branchUserIds = await this.branchRepo.findExplicitFsAccessUserIds(wt.branch_id);
+      for (const userId of branchUserIds) {
+        userIds.add(userId);
       }
     }
-    for (const ownerId of ownerIds) {
-      await this.addUserToRepoGroup(repoId, ownerId);
+    for (const userId of userIds) {
+      await this.addUserToRepoGroup(repoId, userId);
+    }
+    const repo = await this.repoRepo.findById(repoId);
+    if (repo?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        repo.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "repo" }
+      );
     }
   }
   // ============================================================
@@ -9668,16 +10354,28 @@ var UnixIntegrationService = class {
   /**
    * Full sync for a branch
    *
-   * Ensures group exists, all owners are in group, and symlinks are created.
+   * Ensures group exists, all explicit filesystem-access users are in group,
+   * and symlinks are created.
    *
    * @param branchId - Branch ID
    */
   async syncBranch(branchId) {
     console.log(`[UnixIntegration] Full sync for branch ${shortId(branchId)}`);
     await this.createBranchGroup(branchId);
-    const ownerIds = await this.branchRepo.getOwners(branchId);
-    for (const ownerId of ownerIds) {
-      await this.addUserToBranchGroup(branchId, ownerId);
+    const userIds = await this.branchRepo.findExplicitFsAccessUserIds(branchId);
+    for (const userId of userIds) {
+      await this.addUserToBranchGroup(branchId, userId);
+    }
+    const branch = await this.branchRepo.findById(branchId);
+    if (branch?.unix_group) {
+      await this.reconcileUnixGroupMembers(
+        branch.unix_group,
+        await this.getUnixUsernamesForUsers(userIds),
+        { label: "branch" }
+      );
+    }
+    if (branch?.repo_id) {
+      await this.syncRepo(branch.repo_id);
     }
   }
   /**