agor-live 0.22.0 → 0.23.1

package/dist/daemon/services/schedules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/services/schedules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,QAAQ;CAWzB;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,QAAQ,GAAG,gBAAgB,CAErE"}
+{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/services/schedules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,MAAM,cAAc,GAAG,WAAW,CAAC;IACvC,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB,CAAC,GACA,mBAAmB,CAAC;AAEtB,qBAAa,gBAAiB,SAAQ,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC;gBACnF,EAAE,EAAE,wBAAwB;CAWzC;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,wBAAwB,GAAG,gBAAgB,CAErF"}

package/dist/daemon/services/schedules.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/services/session-env-selections.d.ts

@@ -14,7 +14,7 @@
  * granted access — session env selections expose the creator's private
  * credentials.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { QueryParams, SessionEnvSelection, SessionID } from '@agor/core/types';
 /**
  * Session-env-selection params
@@ -28,7 +28,7 @@ export type SessionEnvSelectionParams = QueryParams<{
  */
 export declare class SessionEnvSelectionsService {
     private repo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * List all selections for a session.
      */
@@ -49,5 +49,5 @@ export declare class SessionEnvSelectionsService {
 /**
  * Service factory
  */
-export declare function createSessionEnvSelectionsService(db: Database): SessionEnvSelectionsService;
+export declare function createSessionEnvSelectionsService(db: TenantScopeAwareDatabase): SessionEnvSelectionsService;
 //# sourceMappingURL=session-env-selections.d.ts.map

package/dist/daemon/services/session-env-selections.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-env-selections.d.ts","sourceRoot":"","sources":["../../src/services/session-env-selections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAAiC,MAAM,eAAe,CAAC;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,IAAI,CAAgC;gBAEhC,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIjC;;OAEG;IACG,GAAG,CACP,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;CAGjB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAAC,EAAE,EAAE,QAAQ,GAAG,2BAA2B,CAE3F"}
+{"version":3,"file":"session-env-selections.d.ts","sourceRoot":"","sources":["../../src/services/session-env-selections.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAiC,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEpF;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,WAAW,CAAC;IAClD,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,IAAI,CAAgC;gBAEhC,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,IAAI,CACR,SAAS,EAAE,SAAS,EACpB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAIjC;;OAEG;IACG,GAAG,CACP,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,MAAM,CACV,SAAS,EAAE,SAAS,EACpB,WAAW,EAAE,MAAM,EAAE,EACrB,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC;CAGjB;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,EAAE,EAAE,wBAAwB,GAC3B,2BAA2B,CAE7B"}

package/dist/daemon/services/session-mcp-servers.d.ts

@@ -4,7 +4,7 @@
  * Manages the many-to-many relationship between sessions and MCP servers.
  * Provides API for adding/removing/toggling MCP servers for sessions.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { MCPServer, MCPServerID, QueryParams, SessionID } from '@agor/core/types';
 /**
  * Session-MCP service params
@@ -20,7 +20,7 @@ export type SessionMCPParams = QueryParams<{
  */
 export declare class SessionMCPServersService {
     private sessionMCPRepo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Add MCP server to session
      */
@@ -49,5 +49,5 @@ export declare class SessionMCPServersService {
 /**
  * Service factory function
  */
-export declare function createSessionMCPServersService(db: Database): SessionMCPServersService;
+export declare function createSessionMCPServersService(db: TenantScopeAwareDatabase): SessionMCPServersService;
 //# sourceMappingURL=session-mcp-servers.d.ts.map

package/dist/daemon/services/session-mcp-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/session-mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,KAAK,QAAQ,EAA8B,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,cAAc,CAA6B;gBAEvC,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAIvB;;OAEG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,WAAW,EAAE,EACxB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;CAGnB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,EAAE,QAAQ,GAAG,wBAAwB,CAErF"}
+{"version":3,"file":"session-mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/session-mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAA8B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;IACzC,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,wBAAwB;IACnC,OAAO,CAAC,cAAc,CAA6B;gBAEvC,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,YAAY,CAChB,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,EAAE,CAAC;IAIvB;;OAEG;IACG,UAAU,CACd,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,WAAW,EAAE,EACxB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,IAAI,CAAC;IAIhB;;OAEG;IACG,KAAK,CACT,SAAS,EAAE,SAAS,EACpB,WAAW,UAAQ,EACnB,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,MAAM,CAAC;CAGnB;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,wBAAwB,GAC3B,wBAAwB,CAE1B"}

package/dist/daemon/services/session-token-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-service.d.ts","sourceRoot":"","sources":["../../src/services/session-token-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAwBH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAuB;gBAG9B,MAAM,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;KAClB;IAMH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlC;;;OAGG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,MAAM,CAAC;IAkDlB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqD9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMhC;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAe5C;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAU1B"}
+{"version":3,"file":"session-token-service.d.ts","sourceRoot":"","sources":["../../src/services/session-token-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAyBH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,mBAAmB;IAK5B,OAAO,CAAC,MAAM;IAJhB,OAAO,CAAC,MAAM,CAAuC;IACrD,OAAO,CAAC,SAAS,CAAuB;gBAG9B,MAAM,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,EAAE,MAAM,CAAC;KAClB;IAMH;;;OAGG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAIlC;;;OAGG;IACG,aAAa,CACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,KAAK,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACnE,OAAO,CAAC,MAAM,CAAC;IAoDlB;;;;;;OAMG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GACpE,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAqD9B;;OAEG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAMhC;;OAEG;IACH,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAe5C;;OAEG;IACH,mBAAmB,IAAI,MAAM;IAI7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgB5B;;OAEG;IACH,OAAO,CAAC,iBAAiB;CAU1B"}

package/dist/daemon/services/session-token-service.js

@@ -1,4 +1,5 @@
 // src/services/session-token-service.ts
+import { getCurrentTenantId } from "@agor/core/db";
 import jwt from "jsonwebtoken";
 var DEBUG_SESSION_TOKENS = process.env.AGOR_DEBUG_SESSION_TOKENS === "1" || process.env.DEBUG?.includes("session-token");
 function sessionTokenDebug(...args) {
@@ -30,6 +31,7 @@ var SessionTokenService = class {
     }
     const now = /* @__PURE__ */ new Date();
     const expiresAt = new Date(now.getTime() + this.config.expiration_ms);
+    const tenantId = getCurrentTenantId();
     const payload = {
       sub: userId,
       // Standard JWT subject claim (used by Feathers for user lookup)
@@ -40,6 +42,7 @@ var SessionTokenService = class {
       session_id: sessionId,
       task_id: scope.taskId,
       branch_id: scope.branchId,
+      ...tenantId ? { tenant_id: tenantId } : {},
       iat: Math.floor(now.getTime() / 1e3),
       // Issued at
       exp: Math.floor(expiresAt.getTime() / 1e3),

package/dist/daemon/services/sessions.d.ts

@@ -4,10 +4,10 @@
  * Provides REST + WebSocket API for session management.
  * Uses DrizzleService adapter with SessionRepository.
  */
-import { type Database, type SessionWithLastMessage } from '@agor/core/db';
+import { type SessionWithLastMessage, type TenantScopeAwareDatabase } from '@agor/core/db';
 import { type Application } from '@agor/core/feathers';
-import type { AuthenticatedParams, Paginated, QueryParams, Session, SessionID } from '@agor/core/types';
-import { DrizzleService } from '../adapters/drizzle';
+import type { AuthenticatedParams, Paginated, QueryParams, Session, SessionID, UUID } from '@agor/core/types';
+import { DrizzleService, type Query } from '../adapters/drizzle';
 /**
  * Internal service params shared between services that support last-message enrichment.
  * Bypasses Feathers query filtering for internal service-to-service calls.
@@ -28,6 +28,8 @@ export type SessionParams = QueryParams<{
 }> & AuthenticatedParams & InternalEnrichmentParams & {
     /** Root-level include_last_message flag (bypasses Feathers query filtering, used by internal service calls) */
     _include_last_message?: boolean | 'true' | 'false';
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlSessionAccessUserId?: UUID;
 };
 export declare function markRemoteRelationshipsEnrichedResult<T extends object>(result: T): T;
 export declare function isRemoteRelationshipsEnrichedResult(result: unknown): boolean;
@@ -53,7 +55,9 @@ export declare class SessionsService extends DrizzleService<Session, Partial<Ses
     private sessionEnvSelectionRepo;
     private usersRepo;
     private branchRepo;
-    constructor(db: Database, app: Application);
+    private assertSupportedModelConfig;
+    constructor(db: TenantScopeAwareDatabase, app: Application);
+    protected fetchData(_query: Query, params?: SessionParams): Promise<Session[]>;
     enrichRemoteRelationships(sessionList: Session[]): Promise<Session[]>;
     /**
      * Attach explicit MCP server IDs to a session.
@@ -200,5 +204,5 @@ export declare class SessionsService extends DrizzleService<Session, Partial<Ses
 /**
  * Service factory function
  */
-export declare function createSessionsService(db: Database, app: Application): SessionsService;
+export declare function createSessionsService(db: TenantScopeAwareDatabase, app: Application): SessionsService;
 //# sourceMappingURL=sessions.d.ts.map

package/dist/daemon/services/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/services/sessions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEL,KAAK,QAAQ,EAKb,KAAK,sBAAsB,EAE5B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAa,MAAM,qBAAqB,CAAC;AAGlE,OAAO,KAAK,EACV,mBAAmB,EAGnB,SAAS,EACT,WAAW,EACX,OAAO,EACP,SAAS,EAGV,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgCrD;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC,CAAC,GACA,mBAAmB,GACnB,wBAAwB,GAAG;IACzB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;CACpD,CAAC;AAIJ,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,kBAAkB,EAAE,cAAc,CAAC;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,aAAa,CAAC;CAC1D,CAAC;AAEF;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,UAAU,CAAmB;gBAEzB,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW;IAwBpC,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA8B3E;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5F;;;OAGG;YACW,cAAc;IA0B5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oBAAoB;IAoElC;;;;OAIG;IACG,IAAI,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA2EnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,WAAW,CAAC,EACrD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA4JnB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CASpB;IAEH,iBAAiB,CACf,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,KACnB,OAAO,CAAC;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,GACD,IAAI;IAID,WAAW,CACf,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IAOF;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CAA+D;IAEtF,iBAAiB,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI1F,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/E;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;KACrB,CAAC;IAgBF;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAsC/B;;;OAGG;IACG,KAAK,CACT,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAqB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2B9E;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;CAc5E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,eAAe,CAErF"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/services/sessions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAML,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,KAAK,WAAW,EAAyB,MAAM,qBAAqB,CAAC;AAQ9E,OAAO,KAAK,EACV,mBAAmB,EAGnB,SAAS,EACT,WAAW,EACX,OAAO,EACP,SAAS,EAET,IAAI,EACL,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAgCjE;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,uGAAuG;IACvG,+BAA+B,CAAC,EAAE,MAAM,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC3B,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IAClD,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACzC,CAAC,GACA,mBAAmB,GACnB,wBAAwB,GAAG;IACzB,+GAA+G;IAC/G,qBAAqB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;IACnD,0FAA0F;IAC1F,2BAA2B,CAAC,EAAE,IAAI,CAAC;CACpC,CAAC;AAmCJ,wBAAgB,qCAAqC,CAAC,CAAC,SAAS,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAGpF;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,OAAO,kBAAkB,EAAE,cAAc,CAAC;IAC3D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,OAAO,kBAAkB,EAAE,aAAa,CAAC;CAC1D,CAAC;AAEF;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,uBAAuB,CAAgC;IAC/D,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,UAAU,CAAmB;IAErC,OAAO,CAAC,0BAA0B;gBAatB,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW;cAwB1C,SAAS,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAM9E,yBAAyB,CAAC,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IA8B3E;;;OAGG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5F;;;OAGG;YACW,cAAc;IA0B5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;YACW,oBAAoB;IAoElC;;;;OAIG;IACG,IAAI,CACR,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1C,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA6EnB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACG,KAAK,CACT,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,CAAC,OAAO,kBAAkB,EAAE,WAAW,CAAC,EACrD,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IA8JnB;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CASpB;IAEH,iBAAiB,CACf,OAAO,EAAE,CACP,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,KACnB,OAAO,CAAC;QACX,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC,GACD,IAAI;IAID,WAAW,CACf,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,eAAe,EACrB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;KACpB,CAAC;IAOF;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAC,CAA+D;IAEtF,iBAAiB,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAI1F,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ/E;;;;OAIG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,SAAS,EAAE,OAAO,EAAE,CAAC;QACrB,QAAQ,EAAE,OAAO,EAAE,CAAC;KACrB,CAAC;IAgBF;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAsC/B;;;OAGG;IACG,KAAK,CACT,EAAE,EAAE,OAAO,kBAAkB,EAAE,UAAU,EACzC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,EACtB,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,GAAG,OAAO,EAAE,CAAC;IAqB/B;;;;OAIG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA2B9E;;;OAGG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC;CAwE5E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW,GACf,eAAe,CAEjB"}

package/dist/daemon/services/sessions.js

@@ -8,8 +8,13 @@ import {
   SessionRepository,
   UsersRepository
 } from "@agor/core/db";
-import { Forbidden as Forbidden2 } from "@agor/core/feathers";
-import { formatModelToolMismatchWarning, lintModelToolMatch } from "@agor/core/models";
+import { BadRequest, Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  formatModelToolMismatchWarning,
+  formatUnsupportedAgorCodexModelMessage,
+  isUnsupportedAgorCodexModel,
+  lintModelToolMatch
+} from "@agor/core/models";
 import { resolveChildSessionConfig } from "@agor/core/sessions";
 import { ROLES as ROLES2, SessionStatus } from "@agor/core/types";
 
@@ -30,6 +35,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -121,12 +154,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -138,10 +187,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -153,14 +205,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -176,7 +232,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -190,12 +249,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -205,7 +266,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -219,6 +283,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -310,6 +376,25 @@ function getInheritableConfig(parent) {
     model_config: parent.model_config
   };
 }
+function shouldSqlPageSessionQuery(query, forcePage = false) {
+  if (!query) return forcePage;
+  const sort = query.$sort;
+  const wantsRecency = !!sort && sort.updated_at !== void 0;
+  const wantsBoard = query.board_id !== void 0;
+  if (!wantsRecency && !wantsBoard && !forcePage) return false;
+  const allowedKeys = /* @__PURE__ */ new Set(["archived", "board_id", "$sort", "$limit", "$skip"]);
+  for (const key of Object.keys(query)) {
+    if (!allowedKeys.has(key)) return false;
+  }
+  if (query.archived !== void 0 && typeof query.archived !== "boolean") return false;
+  if (wantsBoard && typeof query.board_id !== "string") return false;
+  if (sort) {
+    const sortKeys = Object.keys(sort);
+    if (sortKeys.length !== 1 || sortKeys[0] !== "updated_at") return false;
+    if (sort.updated_at !== 1 && sort.updated_at !== -1) return false;
+  }
+  return true;
+}
 var remoteRelationshipsEnrichedResults = /* @__PURE__ */ new WeakSet();
 function markRemoteRelationshipsEnrichedResult(result) {
   remoteRelationshipsEnrichedResults.add(result);
@@ -326,6 +411,11 @@ var SessionsService = class extends DrizzleService {
   sessionEnvSelectionRepo;
   usersRepo;
   branchRepo;
+  assertSupportedModelConfig(agenticTool, modelConfig) {
+    if (agenticTool === "codex" && modelConfig?.model && isUnsupportedAgorCodexModel(modelConfig.model)) {
+      throw new BadRequest(formatUnsupportedAgorCodexModelMessage(modelConfig.model));
+    }
+  }
   constructor(db, app) {
     const sessionRepo = new SessionRepository(db);
     super(sessionRepo, {
@@ -346,6 +436,11 @@ var SessionsService = class extends DrizzleService {
     this.branchRepo = new BranchRepository(db);
     this.usersRepo = new UsersRepository(db);
   }
+  async fetchData(_query, params) {
+    return this.sessionRepo.findAll({
+      visibleToUserId: params?._agorSqlSessionAccessUserId
+    });
+  }
   async enrichRemoteRelationships(sessionList) {
     const sessionIds = sessionList.map((session) => session.session_id);
     if (sessionIds.length === 0) return sessionList;
@@ -493,6 +588,8 @@ var SessionsService = class extends DrizzleService {
   async fork(id, data, params) {
     const parent = await this.get(id, params);
     const { created_by, unix_username } = await this.resolveChildIdentity(parent, params);
+    const inheritableConfig = getInheritableConfig(parent);
+    this.assertSupportedModelConfig(parent.agentic_tool, inheritableConfig.model_config);
     const forkedSession = await this.create(
       {
         agentic_tool: parent.agentic_tool,
@@ -515,7 +612,7 @@ var SessionsService = class extends DrizzleService {
           children: []
         },
         contextFiles: [...parent.contextFiles || []],
-        ...getInheritableConfig(parent),
+        ...inheritableConfig,
         tasks: []
         // Don't copy sdk_session_id - fork will get its own via forkSession:true
       },
@@ -611,6 +708,7 @@ var SessionsService = class extends DrizzleService {
     if (lintWarning) {
       console.warn(`[SessionsService.spawn] ${lintWarning}`);
     }
+    this.assertSupportedModelConfig(targetTool, modelConfig);
     const isCallbackEnabled = data.enableCallback !== false;
     const callbackConfig = {
       ...data.enableCallback !== void 0 ? { enabled: data.enableCallback } : {},
@@ -817,6 +915,41 @@ ${data.extraInstructions}`;
    * Note: Last message is NOT included in list operations - only on single GET.
    */
   async find(params) {
+    const query = params?.query;
+    if (shouldSqlPageSessionQuery(query, !!params?._agorSqlSessionAccessUserId)) {
+      const sortSpec = query?.$sort;
+      const limit = query?.$limit ?? PAGINATION.DEFAULT_LIMIT;
+      const skip = query?.$skip ?? 0;
+      const { data, total } = await this.sessionRepo.findPage({
+        boardId: query?.board_id,
+        archived: query?.archived,
+        sortUpdatedAt: sortSpec?.updated_at,
+        limit,
+        skip,
+        visibleToUserId: params?._agorSqlSessionAccessUserId
+      });
+      const enriched = await this.enrichRemoteRelationships(data);
+      return markRemoteRelationshipsEnrichedResult({ total, limit, skip, data: enriched });
+    }
+    const boardId = params?.query?.board_id;
+    if (boardId) {
+      const { board_id: _scopedBoardId, ...residualQuery } = params?.query ?? {};
+      const residual = residualQuery;
+      const rows = await this.sessionRepo.findByBoard(boardId, {
+        visibleToUserId: params?._agorSqlSessionAccessUserId
+      });
+      const filtered = this.filterData(rows, residual);
+      const total = filtered.length;
+      const sorted = this.sortData(filtered, residual.$sort);
+      const selected = this.selectFields(sorted, residual.$select);
+      const paged = this.paginateData(selected, residual, total);
+      if (Array.isArray(paged)) {
+        const enriched = await this.enrichRemoteRelationships(paged);
+        return markRemoteRelationshipsEnrichedResult(enriched);
+      }
+      const enrichedData2 = await this.enrichRemoteRelationships(paged.data);
+      return markRemoteRelationshipsEnrichedResult({ ...paged, data: enrichedData2 });
+    }
     const result = await super.find(params);
     if (Array.isArray(result)) {
       const enriched = await this.enrichRemoteRelationships(result);

package/dist/daemon/services/tasks.d.ts

@@ -4,10 +4,10 @@
  * Provides REST + WebSocket API for task management.
  * Uses DrizzleService adapter with TaskRepository.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
-import type { Paginated, QueryParams, Task } from '@agor/core/types';
-import { DrizzleService } from '../adapters/drizzle';
+import type { Paginated, QueryParams, Task, UUID } from '@agor/core/types';
+import { DrizzleService, type Query } from '../adapters/drizzle';
 export type TaskParams = QueryParams<{
     session_id?: string;
     status?: Task['status'];
@@ -33,6 +33,8 @@ export type TaskParams = QueryParams<{
      * terminal transition. Most callers should leave this unset.
      */
     suppressBtwCleanup?: boolean;
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlSessionAccessUserId?: UUID;
 };
 /**
  * Extended tasks service with custom methods
@@ -43,11 +45,12 @@ export declare class TasksService extends DrizzleService<Task, Partial<Task>, Ta
     private db;
     private heartbeatCallbackRunner;
     private completionCallbackDispatches;
-    constructor(db: Database, app: Application);
+    constructor(db: TenantScopeAwareDatabase, app: Application);
     /**
      * Override find to support session-based filtering
      */
     find(params?: TaskParams): Promise<Task[] | Paginated<Task>>;
+    protected fetchData(query: Query, params?: TaskParams): Promise<Task[]>;
     /**
      * Override create to atomically update session status when task is created with RUNNING status
      */
@@ -62,6 +65,9 @@ export declare class TasksService extends DrizzleService<Task, Partial<Task>, Ta
         error_message: string;
     }, params?: TaskParams): Promise<Task>;
     private handleExecutorHeartbeat;
+    private runAfterTenantDatabaseCommit;
+    private triggerQueueProcessingAfterCommit;
+    private dispatchCompletionCallbacksAfterCommit;
     /**
      * Override patch to detect task completion and:
      * 1. Atomically update session status to IDLE when task reaches terminal state
@@ -127,5 +133,5 @@ export declare class TasksService extends DrizzleService<Task, Partial<Task>, Ta
 /**
  * Service factory function
  */
-export declare function createTasksService(db: Database, app: Application): TasksService;
+export declare function createTasksService(db: TenantScopeAwareDatabase, app: Application): TasksService;
 //# sourceMappingURL=tasks.d.ts.map