agor-live 0.21.2 → 0.23.1

package/dist/core/unix/unix-integration-service.d.ts

@@ -58,6 +58,8 @@ export declare class UnixIntegrationService {
     private usersRepo;
     private repoRepo;
     constructor(db: Database, executor: CommandExecutor, config?: UnixIntegrationConfig);
+    private getUnixUsernamesForUsers;
+    private reconcileUnixGroupMembers;
     /**
      * Get the configured daemon user
      *
@@ -143,7 +145,7 @@ export declare class UnixIntegrationService {
     /**
      * Initialize Unix group for an existing branch
      *
-     * Creates group and adds all current owners.
+     * Creates group and adds all users with explicit filesystem access.
      *
      * @param branchId - Branch ID
      */
@@ -217,8 +219,8 @@ export declare class UnixIntegrationService {
     /**
      * Check if a user should be in a repo's Unix group
      *
-     * A user should be in the repo group if they have ownership
-     * of ANY branch in that repo.
+     * A user should be in the repo group if they have explicit filesystem access
+     * to ANY branch in that repo.
      *
      * @param repoId - Repo ID
      * @param userId - User ID to check
@@ -228,8 +230,8 @@ export declare class UnixIntegrationService {
     /**
      * Initialize Unix group for an existing repo
      *
-     * Creates group, sets .git permissions, and adds all users who
-     * own any branch in the repo.
+     * Creates group, sets .git permissions, and adds all users who have explicit
+     * filesystem access to any branch in the repo.
      *
      * @param repoId - Repo ID
      */
@@ -238,7 +240,7 @@ export declare class UnixIntegrationService {
      * Full sync for a repo
      *
      * Ensures repo group exists, .git permissions are set, and all
-     * branch owners are in the repo group.
+     * branch filesystem-access users are in the repo group.
      *
      * @param repoId - Repo ID
      */
@@ -327,7 +329,8 @@ export declare class UnixIntegrationService {
     /**
      * Full sync for a branch
      *
-     * Ensures group exists, all owners are in group, and symlinks are created.
+     * Ensures group exists, all explicit filesystem-access users are in group,
+     * and symlinks are created.
      *
      * @param branchId - Branch ID
      */

package/dist/core/unix/unix-integration-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"unix-integration-service.d.ts","sourceRoot":"","sources":["../../src/unix/unix-integration-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqB7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8UAW9B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IAEjB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;mFAC+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAgF;IAC9F,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,QAAQ,CAAiB;gBAG/B,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,eAAe,EACzB,MAAM,GAAE,qBAA0C;IAiBpD;;;;;OAKG;IACH,aAAa,IAAI,MAAM,GAAG,SAAS;IAInC;;OAEG;IACH,SAAS,IAAI,OAAO;IAQpB;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3C;;;;;;OAMG;IACG,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE;;;;OAIG;IACG,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvE;;;;;OAKG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D;;;;;OAKG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAkC5D;;;;;;;OAOG;IACG,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IActF;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1D;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC3E;;;;;OAKG;IACG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAqChF;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BjF;;;;;;OAMG;IACG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB9D;;;;;;;;;OASG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCtD;;;;;;;OAOG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcpF;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CzE;;;;;;;;OAQG;IACG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCnE;;;;;;;OAOG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCrE;;;;;;;;OAQG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC1E;;;;;;;;;OASG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAe7E;;;;;;;OAOG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBxD;;;;;;;OAOG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2B7C;;;;;;;;OAQG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+DrD;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B5E;;;;;;;OAOG;IACG,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1D;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,OAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BhF;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B1E;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E;;;;;;OAMG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCrD;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D;;;;;;OAMG;IACG,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD;;;;;;OAMG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B/B"}
+{"version":3,"file":"unix-integration-service.d.ts","sourceRoot":"","sources":["../../src/unix/unix-integration-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAqB7D;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,8UAW9B,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,OAAO,EAAE,OAAO,CAAC;IAEjB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,qFAAqF;IACrF,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B,0FAA0F;IAC1F,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;mFAC+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IACjC,OAAO,CAAC,MAAM,CAAgF;IAC9F,OAAO,CAAC,QAAQ,CAAkB;IAClC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,QAAQ,CAAiB;gBAG/B,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,eAAe,EACzB,MAAM,GAAE,qBAA0C;YAiBtC,wBAAwB;YAWxB,yBAAyB;IAoBvC;;;;;OAKG;IACH,aAAa,IAAI,MAAM,GAAG,SAAS;IAInC;;OAEG;IACH,SAAS,IAAI,OAAO;IAQpB;;;;;OAKG;IACG,oBAAoB,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ3C;;;;;;OAMG;IACG,uBAAuB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAalE;;;;OAIG;IACG,4BAA4B,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYvE;;;;;OAKG;IACG,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ/D;;;;;OAKG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAkC5D;;;;;;;OAOG;IACG,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IActF;;;;OAIG;IACG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1D;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuC3E;;;;;OAKG;IACG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAqChF;;;;;OAKG;IACG,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BjF;;;;;;OAMG;IACG,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAyB9D;;;;;;;;;OASG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmCtD;;;;;;;OAOG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcpF;;;;OAIG;IACG,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpD;;;;;;;;;OASG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2CzE;;;;;;;;OAQG;IACG,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAyCnE;;;;;;;OAOG;IACG,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCrE;;;;;;;;OAQG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAgC1E;;;;;;;;;OASG;IACG,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAc7E;;;;;;;OAOG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA0BxD;;;;;;;OAOG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC7C;;;;;;;;OAQG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA+DrD;;;;;;;;;;;;;OAaG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA+B5E;;;;;;;OAOG;IACG,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkC1D;;;;;OAKG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,GAAE,OAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BhF;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUjD;;;;OAIG;IACG,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnD;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IA0B1E;;;;;OAKG;IACG,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB1E;;;;;;OAMG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAmCrD;;;;OAIG;IACG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB3D;;;;;;;OAOG;IACG,UAAU,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBnD;;;;;;OAMG;IACG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAU7C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA2B/B"}

package/dist/core/utils/emoji-shortcodes.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Normalize exact emoji shortcodes to Unicode while preserving arbitrary text.
+ *
+ * This intentionally only rewrites whole-field shortcodes such as `:compass:`.
+ * It does not parse Markdown/content or replace shortcodes embedded in text.
+ */
+export declare function normalizeExactEmojiShortcode(value: undefined): undefined;
+export declare function normalizeExactEmojiShortcode(value: null): null;
+export declare function normalizeExactEmojiShortcode(value: string): string;
+export declare function normalizeExactEmojiShortcode(value: string | undefined): string | undefined;
+export declare function normalizeExactEmojiShortcode(value: string | null): string | null;
+export declare function normalizeExactEmojiShortcode(value: string | null | undefined): string | null | undefined;
+//# sourceMappingURL=emoji-shortcodes.d.ts.map

package/dist/core/utils/emoji-shortcodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emoji-shortcodes.d.ts","sourceRoot":"","sources":["../../src/utils/emoji-shortcodes.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,CAAC;AAC1E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;AAChE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;AACpE,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAC5F,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;AAClF,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC"}

package/dist/core/utils/permission-mode-mapper.cjs

@@ -27,6 +27,19 @@ __export(permission_mode_mapper_exports, {
 module.exports = __toCommonJS(permission_mode_mapper_exports);
 
 // src/types/session.ts
+var SessionStatus = {
+  IDLE: "idle",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for task to stop
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed"
+};
 function getDefaultPermissionMode(agenticTool) {
   switch (agenticTool) {
     case "gemini":
@@ -48,6 +61,12 @@ function getDefaultPermissionMode(agenticTool) {
       return "auto";
   }
 }
+var EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+  SessionStatus.RUNNING,
+  SessionStatus.STOPPING,
+  SessionStatus.AWAITING_PERMISSION,
+  SessionStatus.AWAITING_INPUT
+]);
 
 // src/utils/permission-mode-mapper.ts
 function mapPermissionMode(mode, agenticTool) {

package/dist/core/utils/permission-mode-mapper.js

@@ -1,4 +1,17 @@
 // src/types/session.ts
+var SessionStatus = {
+  IDLE: "idle",
+  RUNNING: "running",
+  STOPPING: "stopping",
+  // Stop requested, waiting for task to stop
+  AWAITING_PERMISSION: "awaiting_permission",
+  AWAITING_INPUT: "awaiting_input",
+  // Legacy / pre-#1177: AskUserQuestion was disallowed at the SDK; new sessions never enter this state, kept for historical rows
+  TIMED_OUT: "timed_out",
+  // Permission/input request timed out, executor exited — user must re-prompt
+  COMPLETED: "completed",
+  FAILED: "failed"
+};
 function getDefaultPermissionMode(agenticTool) {
   switch (agenticTool) {
     case "gemini":
@@ -20,6 +33,12 @@ function getDefaultPermissionMode(agenticTool) {
       return "auto";
   }
 }
+var EXECUTING_SESSION_STATUSES = /* @__PURE__ */ new Set([
+  SessionStatus.RUNNING,
+  SessionStatus.STOPPING,
+  SessionStatus.AWAITING_PERMISSION,
+  SessionStatus.AWAITING_INPUT
+]);
 
 // src/utils/permission-mode-mapper.ts
 function mapPermissionMode(mode, agenticTool) {

package/dist/core/yaml/index.cjs

@@ -30,17 +30,17 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/yaml/index.ts
 var yaml_exports = {};
 __export(yaml_exports, {
-  YAMLException: () => YAMLException,
+  YAMLException: () => YAMLException2,
   default: () => yaml_default,
-  dump: () => dump,
-  load: () => load
+  dump: () => dump2,
+  load: () => load2
 });
 module.exports = __toCommonJS(yaml_exports);
-var import_js_yaml = __toESM(require("js-yaml"), 1);
-var load = import_js_yaml.default.load;
-var dump = import_js_yaml.default.dump;
-var YAMLException = import_js_yaml.default.YAMLException;
-var yaml_default = import_js_yaml.default;
+var yaml = __toESM(require("js-yaml"), 1);
+var load2 = yaml.load;
+var dump2 = yaml.dump;
+var YAMLException2 = yaml.YAMLException;
+var yaml_default = yaml;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   YAMLException,

package/dist/core/yaml/index.d.ts

@@ -8,7 +8,7 @@
  * `js-yaml` itself has no Node-only imports, so this module is safe to use
  * from the browser.
  */
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 export declare const load: typeof yaml.load;
 export declare const dump: typeof yaml.dump;
 export declare const YAMLException: typeof yaml.YAMLException;

package/dist/core/yaml/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/yaml/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,IAAI,MAAM,SAAS,CAAC;AAE3B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,aAAa,2BAAqB,CAAC;AAEhD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,eAAe,IAAI,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/yaml/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,IAAI,MAAM,SAAS,CAAC;AAEhC,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,IAAI,kBAAY,CAAC;AAC9B,eAAO,MAAM,aAAa,2BAAqB,CAAC;AAEhD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAExD,eAAe,IAAI,CAAC"}

package/dist/core/yaml/index.js

@@ -1,12 +1,12 @@
 // src/yaml/index.ts
-import yaml from "js-yaml";
-var load = yaml.load;
-var dump = yaml.dump;
-var YAMLException = yaml.YAMLException;
+import * as yaml from "js-yaml";
+var load2 = yaml.load;
+var dump2 = yaml.dump;
+var YAMLException2 = yaml.YAMLException;
 var yaml_default = yaml;
 export {
-  YAMLException,
+  YAMLException2 as YAMLException,
   yaml_default as default,
-  dump,
-  load
+  dump2 as dump,
+  load2 as load
 };

package/dist/daemon/adapters/drizzle.d.ts

@@ -67,6 +67,18 @@ export declare class DrizzleService<T = any, D = Partial<T>, P extends Params =
     multi: boolean | string[];
     resourceType: string;
     emit?: (event: string, ...args: any[]) => boolean;
+    /** Extract resolved tenant context from Feathers params. */
+    private getTenant;
+    /**
+     * Whether a row belongs to the current tenant. Rows from pre-migration test
+     * fixtures that do not expose tenant_id are treated as visible so existing
+     * single-tenant unit tests keep working; migrated DB rows always carry it.
+     */
+    private rowBelongsToTenant;
+    /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+    private withTenant;
+    /** Never allow a patch/update to move a row across tenants. */
+    private stripTenantMutation;
     constructor(repository: Repository<T>, options?: DrizzleAdapterOptions);
     /**
      * Extract query parameters from params
@@ -75,19 +87,29 @@ export declare class DrizzleService<T = any, D = Partial<T>, P extends Params =
     /**
      * Apply filters to data array (client-side filtering)
      */
-    private filterData;
+    protected filterData(data: T[], query: Query): T[];
     /**
      * Sort data array
      */
-    private sortData;
+    protected sortData(data: T[], sortSpec?: Record<string, 1 | -1>): T[];
     /**
      * Select specific fields from data
      */
-    private selectFields;
+    protected selectFields(data: T[], fields?: string[]): Partial<T>[];
     /**
      * Apply pagination to data
      */
-    private paginateData;
+    protected paginateData(data: T[], query: Query, total: number): Paginated<T> | T[];
+    /**
+     * Resolve the candidate row set that `find` filters, sorts, and paginates.
+     *
+     * The base implementation reads the whole table and relies on `filterData` to
+     * narrow it in memory. Subclasses may override this to push high-selectivity
+     * predicates into SQL; because `find` always re-applies every query filter via
+     * `filterData`, an override only needs to return a superset of the matching
+     * rows for the result to stay identical.
+     */
+    protected fetchData(_query: Query, _params?: P): Promise<T[]>;
     /**
      * Find records
      */

package/dist/daemon/adapters/drizzle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG1E;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AAEH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM;IAW1E,OAAO,CAAC,UAAU;IAVpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IAIrB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;gBAGxC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EACjC,OAAO,GAAE,qBAA0B;IAQrC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,OAAO,CAAC,UAAU;IA0ClB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAqBhB;;OAEG;IACH,OAAO,CAAC,YAAY;IAgBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAwBpB;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsBnD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAmC1C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAkBzD;;;;;;;;;OASG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASrD;;OAEG;IACG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsClE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CA+B3D"}
+{"version":3,"file":"drizzle.d.ts","sourceRoot":"","sources":["../../src/adapters/drizzle.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAGzF;;GAEG;AACH,MAAM,WAAW,KAAK;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAEnB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;OAEG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAE7B;;OAEG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAE3B;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3B;AAED;;;;;GAKG;AAEH,qBAAa,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,MAAM,GAAG,MAAM;IA2C1E,OAAO,CAAC,UAAU;IA1CpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IAIrB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;IAElD,4DAA4D;IAC5D,OAAO,CAAC,SAAS;IAIjB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAO1B,2EAA2E;IAC3E,OAAO,CAAC,UAAU;IAMlB,+DAA+D;IAC/D,OAAO,CAAC,mBAAmB;gBAQjB,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EACjC,OAAO,GAAE,qBAA0B;IAQrC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE;IA0ClD;;OAEG;IACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAqBrE;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE;IAgBlE;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IAwBlF;;;;;;;;OAQG;cACa,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAInE;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IA4BnD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwC1C;;OAEG;IACG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAsBzD;;;;;;;;;OASG;IACG,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAYrD;;OAEG;IACG,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IA2ClE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAiC3D"}

package/dist/daemon/adapters/drizzle.js

@@ -15,6 +15,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -106,12 +134,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -123,10 +167,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -138,14 +185,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -161,7 +212,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -175,12 +229,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -190,7 +246,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -204,6 +263,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/auth/api-key-strategy.js

@@ -25,7 +25,7 @@ var ApiKeyStrategy = class extends AuthenticationBaseStrategy {
     this.apiKeysRepo.updateLastUsed(keyRow.id).catch((err) => {
       console.warn("Failed to update API key last_used_at:", err);
     });
-    const user = await this.usersService.get(keyRow.user_id);
+    const user = await this.usersService.get(keyRow.user_id, params);
     if (!user) {
       throw new NotAuthenticated("User not found for API key");
     }

package/dist/daemon/auth/executor-runtime-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"executor-runtime-scope.d.ts","sourceRoot":"","sources":["../../src/auth/executor-runtime-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,WAAW,EAAU,MAAM,kBAAkB,CAAC;AAqJjF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE/D,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,KACzB,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CAkJ1D"}
+{"version":3,"file":"executor-runtime-scope.d.ts","sourceRoot":"","sources":["../../src/auth/executor-runtime-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,WAAW,EAAU,MAAM,kBAAkB,CAAC;AAuKjF,KAAK,QAAQ,GAAG,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;AAE/D,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAKxE;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,KACzB,SAAS,WAAW,KAAG,OAAO,CAAC,WAAW,CAAC,CAkJ1D"}

package/dist/daemon/auth/executor-runtime-scope.js

@@ -1,12 +1,26 @@
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
 function scopedPayload(context) {
-  const payload = context.params.authentication?.payload;
-  if (payload?.type !== "executor-session") return null;
-  if (payload.purpose !== "executor-task") {
-    throw new Forbidden("Executor token is not valid for this request");
+  const params = context.params;
+  const payload = params.authentication?.payload;
+  if (payload?.type === "executor-session") {
+    if (payload.purpose !== "executor-task") {
+      throw new Forbidden("Executor token is not valid for this request");
+    }
+    return payload;
+  }
+  if (params.authentication?.strategy === "jwt" && params.task_id) {
+    return {
+      type: "executor-session",
+      purpose: "executor-task",
+      task_id: params.task_id,
+      session_id: params.session_id,
+      sessionId: params.sessionId,
+      branch_id: params.branch_id
+    };
   }
-  return payload;
+  if (payload?.type !== void 0) return null;
+  return null;
 }
 function expectClaim(claim, label) {
   if (!claim) {

package/dist/daemon/auth/launch-auth.d.ts

@@ -1,5 +1,5 @@
-import type { AgorConfig } from '@agor/core/config';
-import { type Database } from '@agor/core/db';
+import { type AgorConfig } from '@agor/core/config';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Params, User, UserID } from '@agor/core/types';
 import { type SignOptions } from 'jsonwebtoken';
 interface ResolvedLaunchSettings {
@@ -14,6 +14,7 @@ interface ResolvedLaunchSettings {
     devSharedSecret?: string;
     serviceCredential?: string;
     allowAdminRoles: boolean;
+    trustVerifiedEmailForLinking: boolean;
     requestTimeoutMs: number;
     algorithms?: string[];
 }
@@ -30,7 +31,7 @@ export interface LaunchAuthResult {
     user: User;
 }
 export interface LaunchAuthServiceOptions {
-    db: Database;
+    db: TenantScopeAwareDatabase;
     config: AgorConfig;
     jwtSecret: string;
     accessTokenTtl: SignOptions['expiresIn'];
@@ -45,7 +46,7 @@ export declare function createLaunchAuthService(options: LaunchAuthServiceOption
     create(data: {
         launchCode?: string;
         launch_code?: string;
-    }, _params?: Params): Promise<LaunchAuthResult>;
+    }, params?: Params): Promise<LaunchAuthResult>;
 };
 export {};
 //# sourceMappingURL=launch-auth.d.ts.map

package/dist/daemon/auth/launch-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"launch-auth.d.ts","sourceRoot":"","sources":["../../src/auth/launch-auth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,QAAQ,EAAuD,MAAM,eAAe,CAAC;AAEnG,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAwB,MAAM,EAAY,MAAM,kBAAkB,CAAC;AAE7F,OAAY,EAAmC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAWtF,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA+BD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,QAAQ,CAAC;IACb,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,YAAY,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACnE;AAOD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,sBAAsB,CAoBhF;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,wBAAwB,CAQ5F;AA6UD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB;iBAElD;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,YAAY,MAAM;EAsCrF"}
+{"version":3,"file":"launch-auth.d.ts","sourceRoot":"","sources":["../../src/auth/launch-auth.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAQL,KAAK,wBAAwB,EAG9B,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EACV,MAAM,EAEN,IAAI,EAEJ,MAAM,EAEP,MAAM,kBAAkB,CAAC;AAE1B,OAAY,EAAmC,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAatF,UAAU,sBAAsB;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,OAAO,CAAC;IACtC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAgCD,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE;QAAE,QAAQ,EAAE,QAAQ,CAAA;KAAE,CAAC;IACvC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,eAAe,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1C,YAAY,EAAE;QAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAAE,CAAC;CACnE;AAOD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,GAAG,sBAAsB,CAqBhF;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,UAAU,GAAG,wBAAwB,CAQ5F;AAuXD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,wBAAwB;iBAIlD;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,WAAW,MAAM;EAkDpF"}