agor-live 0.22.0 → 0.23.1

package/dist/daemon/services/users.js

@@ -9,6 +9,7 @@ import {
   validateEnvVar
 } from "@agor/core/config";
 import {
+  and,
   compare,
   decryptApiKey,
   deleteFrom,
@@ -20,15 +21,282 @@ import {
   update,
   users
 } from "@agor/core/db";
-import { Forbidden, NotAuthenticated } from "@agor/core/feathers";
-import { isLikelyGitToken } from "@agor/core/git";
+import { Forbidden as Forbidden2, NotAuthenticated } from "@agor/core/feathers";
+import { isLikelyGitToken } from "@agor/core/git/pure";
 import {
   extractAgenticToolsPublicValues,
-  hasMinimumRole,
+  hasMinimumRole as hasMinimumRole2,
   normalizeRole,
-  ROLES,
+  ROLES as ROLES2,
   toAgenticToolsStatus
 } from "@agor/core/types";
+
+// src/services/user-avatar-sync.ts
+import {
+  AppVariableRepository,
+  GatewayChannelRepository,
+  UsersRepository
+} from "@agor/core/db";
+import { Forbidden } from "@agor/core/feathers";
+import { SlackConnector } from "@agor/core/gateway";
+import { hasMinimumRole, ROLES } from "@agor/core/types";
+var NAMESPACE = "user_avatars";
+var SETTINGS_KEY = "settings";
+var DEFAULT_SETTINGS = {
+  enabled: false,
+  provider: null,
+  gateway_channel_id: null
+};
+function isAdmin(params) {
+  return hasMinimumRole(params?.user?.role, ROLES.ADMIN);
+}
+function requireAdmin(params) {
+  if (params?.provider && !isAdmin(params)) {
+    throw new Forbidden("Only admins can manage user avatars");
+  }
+}
+function parseSettings(raw) {
+  if (!raw) return DEFAULT_SETTINGS;
+  try {
+    return { ...DEFAULT_SETTINGS, ...JSON.parse(raw) };
+  } catch {
+    return DEFAULT_SETTINGS;
+  }
+}
+function isUsableAvatarUrl(url) {
+  if (!url) return false;
+  try {
+    const parsed = new URL(url);
+    return parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+var UserAvatarSyncManager = class {
+  constructor(db, app) {
+    this.app = app;
+    this.variables = new AppVariableRepository(db);
+    this.gatewayChannels = new GatewayChannelRepository(db);
+    this.users = new UsersRepository(db);
+  }
+  variables;
+  gatewayChannels;
+  users;
+  async getSettings(params) {
+    requireAdmin(params);
+    const raw = await this.variables.getPlain(NAMESPACE, SETTINGS_KEY);
+    return parseSettings(raw);
+  }
+  async updateSettings(data, params) {
+    requireAdmin(params);
+    const current = await this.getSettings();
+    const next = {
+      ...current,
+      ...data,
+      provider: data.enabled === false ? null : data.provider ?? current.provider ?? "slack",
+      gateway_channel_id: data.enabled === false ? null : data.gateway_channel_id ?? current.gateway_channel_id
+    };
+    if (next.enabled && !next.gateway_channel_id) {
+      throw new Error("Select a Slack gateway channel before enabling Slack avatars");
+    }
+    await this.saveSettings(
+      next,
+      params?.user?.user_id
+    );
+    if (data.enabled === false) {
+      await this.clearSlackAvatars();
+    }
+    return next;
+  }
+  async syncAvatars(data = {}, params) {
+    requireAdmin(params);
+    const settings = await this.getSettings();
+    const gatewayChannelId = data.gateway_channel_id ?? settings.gateway_channel_id;
+    const result = data.user_id ? await this.refreshSingleUser(data.user_id, gatewayChannelId, {
+      mode: "single"
+    }) : await this.refreshAllUsers(gatewayChannelId);
+    const nextSettings = {
+      ...settings,
+      enabled: true,
+      provider: "slack",
+      gateway_channel_id: gatewayChannelId ?? settings.gateway_channel_id,
+      last_sync_at: result.finished_at,
+      last_sync_result: result
+    };
+    await this.saveSettings(
+      nextSettings,
+      params?.user?.user_id
+    );
+    return result;
+  }
+  async refreshUserFromSettings(userId) {
+    const settings = await this.getSettings();
+    if (!settings.enabled || settings.provider !== "slack" || !settings.gateway_channel_id) {
+      return null;
+    }
+    return this.refreshSingleUser(userId, settings.gateway_channel_id, {
+      mode: "single"
+    });
+  }
+  async saveSettings(settings, updatedBy) {
+    await this.variables.set({
+      namespace: NAMESPACE,
+      key: SETTINGS_KEY,
+      value: JSON.stringify(settings),
+      content_type: "application/json",
+      updated_by: updatedBy ?? null
+    });
+  }
+  async clearSlackAvatars() {
+    const allUsers = await this.users.findAll();
+    const slackUsers = allUsers.filter((user) => user.avatar_source === "slack");
+    await Promise.all(
+      slackUsers.map(
+        (user) => this.app.service("users").patch(
+          user.user_id,
+          {
+            avatar_url: null,
+            avatar: null,
+            avatar_source: null,
+            avatar_source_id: null,
+            avatar_synced_at: null
+          },
+          {
+            skipAvatarRefresh: true,
+            user: {
+              user_id: "user-avatars-service",
+              email: "user-avatars@agor.internal",
+              role: ROLES.ADMIN,
+              _isServiceAccount: true
+            }
+          }
+        )
+      )
+    );
+  }
+  async getSlackGateway(gatewayChannelId) {
+    if (!gatewayChannelId) throw new Error("Select a Slack gateway channel first");
+    const channel = await this.gatewayChannels.findById(gatewayChannelId);
+    if (!channel) throw new Error(`Gateway channel not found: ${gatewayChannelId}`);
+    if (channel.channel_type !== "slack") throw new Error("Selected gateway channel is not Slack");
+    if (!channel.config?.bot_token || typeof channel.config.bot_token !== "string") {
+      throw new Error("Selected Slack gateway is missing a bot token");
+    }
+    return channel;
+  }
+  async refreshAllUsers(gatewayChannelId) {
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const channel = await this.getSlackGateway(gatewayChannelId);
+    const connector = new SlackConnector(channel.config);
+    const allUsers = await this.users.findAll();
+    let matched = 0;
+    let updated = 0;
+    let skipped = 0;
+    let failed = 0;
+    const failures = [];
+    for (const user of allUsers) {
+      try {
+        const one = await this.refreshUserWithConnector(user, connector);
+        matched += one.matched;
+        updated += one.updated;
+        skipped += one.skipped;
+        failed += one.failed;
+        failures.push(...one.failures);
+      } catch (error) {
+        failed += 1;
+        failures.push({
+          user_id: user.user_id,
+          email: user.email,
+          reason: error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+    return {
+      ok: failed === 0,
+      mode: "bulk",
+      gateway_channel_id: channel.id,
+      started_at: startedAt,
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      matched,
+      updated,
+      skipped,
+      failed,
+      failures
+    };
+  }
+  async refreshSingleUser(userId, gatewayChannelId, options) {
+    const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+    const channel = await this.getSlackGateway(gatewayChannelId);
+    const connector = new SlackConnector(channel.config);
+    const user = await this.users.findById(userId);
+    if (!user) throw new Error(`User not found: ${userId}`);
+    const one = await this.refreshUserWithConnector(user, connector);
+    return {
+      ok: one.failed === 0,
+      mode: options.mode,
+      gateway_channel_id: channel.id,
+      started_at: startedAt,
+      finished_at: (/* @__PURE__ */ new Date()).toISOString(),
+      ...one
+    };
+  }
+  async refreshUserWithConnector(user, connector) {
+    if (!user.email) {
+      return { matched: 0, updated: 0, skipped: 1, failed: 0, failures: [] };
+    }
+    if (user.preferences?.use_slack_avatar === false) {
+      return { matched: 0, updated: 0, skipped: 1, failed: 0, failures: [] };
+    }
+    try {
+      const profile = await connector.lookupUserAvatarByEmail(user.email);
+      if (!profile) {
+        return { matched: 0, updated: 0, skipped: 1, failed: 0, failures: [] };
+      }
+      if (!isUsableAvatarUrl(profile.avatarUrl)) {
+        return { matched: 1, updated: 0, skipped: 1, failed: 0, failures: [] };
+      }
+      await this.app.service("users").patch(
+        user.user_id,
+        {
+          avatar_url: profile.avatarUrl,
+          avatar_source: "slack",
+          avatar_source_id: profile.slackUserId,
+          avatar_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+        },
+        {
+          skipAvatarRefresh: true,
+          // users.patch has field-level/profile ownership hooks even for
+          // internal calls. Avatar sync is an admin-only service action, so
+          // carry an internal service user through the hook chain rather than
+          // bypassing the users service and losing Feathers events.
+          user: {
+            user_id: "user-avatars-service",
+            email: "user-avatars@agor.internal",
+            role: ROLES.ADMIN,
+            _isServiceAccount: true
+          }
+        }
+      );
+      return { matched: 1, updated: 1, skipped: 0, failed: 0, failures: [] };
+    } catch (error) {
+      return {
+        matched: 0,
+        updated: 0,
+        skipped: 0,
+        failed: 1,
+        failures: [
+          {
+            user_id: user.user_id,
+            email: user.email,
+            reason: error instanceof Error ? error.message : String(error)
+          }
+        ]
+      };
+    }
+  }
+};
+
+// src/services/users.ts
 function optionalNonNegativeInteger(value) {
   if (value === void 0 || value === null || value === "") return void 0;
   const numeric = typeof value === "number" ? value : Number(value);
@@ -40,18 +308,44 @@ function queryString(value) {
   const trimmed = value.trim();
   return trimmed.length > 0 ? trimmed : void 0;
 }
+function usersTableHasTenantColumn() {
+  return "tenant_id" in users;
+}
+function tenantPredicate(params) {
+  const tenantId = params?.tenant?.tenant_id;
+  if (!tenantId || !usersTableHasTenantColumn()) return void 0;
+  return eq(users.tenant_id, tenantId);
+}
+function withTenantPredicate(params, predicate) {
+  const tenant = tenantPredicate(params);
+  return tenant ? and(predicate, tenant) : predicate;
+}
+function tenantInsertValues(params) {
+  const tenantId = params?.tenant?.tenant_id;
+  return tenantId && usersTableHasTenantColumn() ? { tenant_id: tenantId } : {};
+}
 var LOCAL_AUTH_LOOKUP_PARAM = Symbol("agor.users.local-auth-lookup");
+var AUTH_INTERNAL_USER_LOOKUP_PARAM = Symbol("agor.users.auth-internal-lookup");
 function markLocalAuthenticationLookup(params) {
   params[LOCAL_AUTH_LOOKUP_PARAM] = true;
 }
+function markAuthenticationUserLookup(params) {
+  params[AUTH_INTERNAL_USER_LOOKUP_PARAM] = true;
+}
 function isLocalAuthenticationLookup(params) {
   return params?.[LOCAL_AUTH_LOOKUP_PARAM] === true;
 }
+function isAuthenticationUserLookup(params) {
+  return params?.[AUTH_INTERNAL_USER_LOOKUP_PARAM] === true;
+}
+function shouldIncludeAuthMetadata(params, includePassword = false) {
+  return includePassword || !params?.provider || isAuthenticationUserLookup(params);
+}
 function isServiceAccount(params) {
   return !!params?.user?._isServiceAccount;
 }
-function isAdmin(params) {
-  return hasMinimumRole(params?.user?.role, ROLES.ADMIN);
+function isAdmin2(params) {
+  return hasMinimumRole2(params?.user?.role, ROLES2.ADMIN);
 }
 function isSelfEmailLookup(params, email) {
   const requesterEmail = params?.user?.email;
@@ -62,10 +356,10 @@ function ensureCanExactEmailLookup(params, email) {
   if (!params?.user) {
     throw new NotAuthenticated("Authentication required");
   }
-  if (isServiceAccount(params) || isAdmin(params) || isSelfEmailLookup(params, email)) {
+  if (isServiceAccount(params) || isAdmin2(params) || isSelfEmailLookup(params, email)) {
     return;
   }
-  throw new Forbidden("Exact email user lookup is restricted");
+  throw new Forbidden2("Exact email user lookup is restricted");
 }
 function applyAgenticToolsPatch(current, patch) {
   const next = { ...current };
@@ -94,8 +388,18 @@ function applyAgenticToolsPatch(current, patch) {
   return next;
 }
 var UsersService = class {
-  constructor(db) {
+  constructor(db, app) {
     this.db = db;
+    if (app) {
+      this.avatarSync = new UserAvatarSyncManager(db, app);
+    }
+  }
+  avatarSync;
+  requireAvatarSync() {
+    if (!this.avatarSync) {
+      throw new Error("User avatar sync is not available in this service context");
+    }
+    return this.avatarSync;
   }
   /**
    * Find all users.
@@ -116,10 +420,10 @@ var UsersService = class {
     let rows;
     if (email) {
       ensureCanExactEmailLookup(params, email);
-      const row = await select(this.db).from(users).where(eq(users.email, email)).one();
+      const row = await select(this.db).from(users).where(withTenantPredicate(params, eq(users.email, email))).one();
       rows = row ? [row] : [];
     } else {
-      rows = await select(this.db).from(users).all();
+      rows = tenantPredicate(params) ? await select(this.db).from(users).where(tenantPredicate(params)).all() : await select(this.db).from(users).all();
     }
     rows = rows.sort(
       (a, b) => a.email.localeCompare(b.email) || a.user_id.localeCompare(b.user_id)
@@ -137,7 +441,10 @@ var UsersService = class {
     const skip = optionalNonNegativeInteger(rawQuery.$skip) ?? optionalNonNegativeInteger(rawQuery.skip) ?? optionalNonNegativeInteger(rawQuery.offset) ?? 0;
     const limit = optionalNonNegativeInteger(rawQuery.$limit) ?? optionalNonNegativeInteger(rawQuery.limit);
     const pageRows = limit === void 0 ? rows.slice(skip) : rows.slice(skip, skip + Math.max(limit, 0));
-    const results = pageRows.map((row) => this.rowToUser(row, includePassword, requesterId));
+    const includeAuthMetadata = shouldIncludeAuthMetadata(params, includePassword);
+    const results = pageRows.map(
+      (row) => this.rowToUser(row, includePassword, requesterId, includeAuthMetadata)
+    );
     return {
       total,
       limit: limit ?? results.length,
@@ -149,26 +456,26 @@ var UsersService = class {
    * Get user by ID
    */
   async get(id, params) {
-    const row = await select(this.db).from(users).where(eq(users.user_id, id)).one();
+    const row = await select(this.db).from(users).where(withTenantPredicate(params, eq(users.user_id, id))).one();
     if (!row) {
       throw new Error(`User not found: ${id}`);
     }
     const requesterId = params?.user?.user_id;
-    return this.rowToUser(row, false, requesterId);
+    return this.rowToUser(row, false, requesterId, shouldIncludeAuthMetadata(params));
   }
   /**
    * Create new user
    */
-  async create(data, _params) {
-    const existing = await select(this.db).from(users).where(eq(users.email, data.email)).one();
+  async create(data, params) {
+    const existing = await select(this.db).from(users).where(withTenantPredicate(params, eq(users.email, data.email))).one();
     if (existing) {
       throw new Error(`User with email ${data.email} already exists`);
     }
     const hashedPassword = await hash(data.password, 10);
     const now = /* @__PURE__ */ new Date();
     const user_id = generateId();
-    const role = data.role || ROLES.MEMBER;
-    const defaultEmoji = role === ROLES.ADMIN ? "\u2B50" : "\u{1F464}";
+    const role = data.role || ROLES2.MEMBER;
+    const defaultEmoji = role === ROLES2.ADMIN ? "\u2B50" : "\u{1F464}";
     const row = await insert(this.db, users).values({
       user_id,
       email: data.email,
@@ -180,11 +487,16 @@ var UsersService = class {
       must_change_password: data.must_change_password ?? false,
       created_at: now,
       updated_at: now,
+      ...tenantInsertValues(params),
       data: {
+        avatar_url: data.avatar_url ?? data.avatar ?? void 0,
+        avatar_source: data.avatar_source ?? (data.avatar_url ?? data.avatar ? "manual" : void 0),
+        avatar_source_id: data.avatar_source_id ?? void 0,
+        avatar_synced_at: data.avatar_synced_at ?? void 0,
         preferences: {}
       }
     }).returning().one();
-    return this.rowToUser(row);
+    return this.rowToUser(row, false, void 0, shouldIncludeAuthMetadata(params));
   }
   /**
    * Update user
@@ -194,6 +506,7 @@ var UsersService = class {
     const updates = { updated_at: now };
     if (data.password) {
       updates.password = await hash(data.password, 10);
+      updates.tokens_valid_after = now;
       updates.must_change_password = data.must_change_password ?? false;
     } else if (data.must_change_password !== void 0) {
       updates.must_change_password = data.must_change_password;
@@ -205,9 +518,9 @@ var UsersService = class {
     if (data.unix_username !== void 0) updates.unix_username = data.unix_username;
     if (data.onboarding_completed !== void 0)
       updates.onboarding_completed = data.onboarding_completed;
-    if (data.avatar || data.preferences || data.agentic_tools || data.env_vars || data.env_var_scopes || data.default_agentic_config) {
-      const current = await this.get(id);
-      const currentRow = await select(this.db).from(users).where(eq(users.user_id, id)).one();
+    if (data.avatar_url !== void 0 || data.avatar !== void 0 || data.avatar_source !== void 0 || data.avatar_source_id !== void 0 || data.avatar_synced_at !== void 0 || data.preferences || data.agentic_tools || data.env_vars || data.env_var_scopes || data.default_agentic_config) {
+      const current = await this.get(id, params);
+      const currentRow = await select(this.db).from(users).where(withTenantPredicate(params, eq(users.user_id, id))).one();
       const currentData = currentRow?.data;
       const nextAgenticTools = data.agentic_tools ? applyAgenticToolsPatch(currentData?.agentic_tools ?? {}, data.agentic_tools) : currentData?.agentic_tools ?? {};
       const normalizedExisting = normalizeStoredEnvMap(currentData?.env_vars);
@@ -264,8 +577,18 @@ var UsersService = class {
           console.log(`\u{1F527} Updated scope for env var ${key}: ${scope}`);
         }
       }
+      const avatarUrlTouched = data.avatar_url !== void 0 || data.avatar !== void 0;
+      const avatarCleared = data.avatar_url === null || data.avatar === null;
+      const inferredManualAvatarSource = avatarUrlTouched && !avatarCleared && data.avatar_source === void 0;
+      const avatarSourceChangedAwayFromSlack = data.avatar_source !== void 0 && data.avatar_source !== null && data.avatar_source !== "slack";
       updates.data = {
-        avatar: data.avatar ?? current.avatar,
+        ...currentData,
+        avatar_url: avatarCleared ? void 0 : data.avatar_url ?? data.avatar ?? current.avatar_url,
+        // Deprecated legacy alias: read for back-compat, stop writing it on avatar updates.
+        avatar: void 0,
+        avatar_source: data.avatar_source === null || avatarCleared ? void 0 : data.avatar_source !== void 0 ? data.avatar_source : inferredManualAvatarSource ? "manual" : current.avatar_source,
+        avatar_source_id: data.avatar_source_id === null || avatarCleared || inferredManualAvatarSource || avatarSourceChangedAwayFromSlack && data.avatar_source_id === void 0 ? void 0 : data.avatar_source_id ?? current.avatar_source_id,
+        avatar_synced_at: data.avatar_synced_at === null || avatarCleared || inferredManualAvatarSource || avatarSourceChangedAwayFromSlack && data.avatar_synced_at === void 0 ? void 0 : data.avatar_synced_at ?? current.avatar_synced_at,
         preferences: data.preferences ?? current.preferences,
         agentic_tools: Object.keys(nextAgenticTools).length > 0 ? nextAgenticTools : void 0,
         env_vars: Object.keys(nextEnvVars).length > 0 ? nextEnvVars : void 0,
@@ -277,13 +600,13 @@ var UsersService = class {
       throw new Error(`User not found: ${id}`);
     }
     const requesterId = params?.user?.user_id;
-    return this.rowToUser(row, false, requesterId);
+    return this.rowToUser(row, false, requesterId, shouldIncludeAuthMetadata(params));
   }
   /**
    * Delete user
    */
-  async remove(id, _params) {
-    const user = await this.get(id);
+  async remove(id, params) {
+    const user = await this.get(id, params);
     await deleteFrom(this.db, users).where(eq(users.user_id, id)).run();
     return user;
   }
@@ -386,11 +709,23 @@ var UsersService = class {
       }
       const isService = !!caller._isServiceAccount;
       if (!isService && caller.user_id !== userId) {
-        throw new Forbidden("Cannot access another user's git environment");
+        throw new Forbidden2("Cannot access another user's git environment");
       }
     }
     return resolveUserEnvironment(userId, this.db);
   }
+  async getAvatarSettings(_data, params) {
+    return this.requireAvatarSync().getSettings(params);
+  }
+  async updateAvatarSettings(data, params) {
+    return this.requireAvatarSync().updateSettings(data, params);
+  }
+  async syncAvatars(data = {}, params) {
+    return this.requireAvatarSync().syncAvatars(data, params);
+  }
+  async refreshAvatarFromSettings(userId) {
+    return this.requireAvatarSync().refreshUserFromSettings(userId);
+  }
   /**
    * Convert database row to User type
    *
@@ -403,7 +738,7 @@ var UsersService = class {
    *   including admins viewing someone else's profile — public values are
    *   omitted, since base URLs can leak internal hostnames.
    */
-  rowToUser(row, includePassword = false, requesterId) {
+  rowToUser(row, includePassword = false, requesterId, includeAuthMetadata = true) {
     const data = row.data;
     const normalizedEnvVars = normalizeStoredEnvMap(data.env_vars);
     const envVarMetadata = Object.keys(normalizedEnvVars).length > 0 ? Object.fromEntries(
@@ -419,7 +754,11 @@ var UsersService = class {
       emoji: row.emoji ?? void 0,
       role: normalizeRole(row.role ?? void 0),
       unix_username: row.unix_username ?? void 0,
+      avatar_url: data.avatar_url ?? data.avatar,
       avatar: data.avatar,
+      avatar_source: data.avatar_source,
+      avatar_source_id: data.avatar_source_id,
+      avatar_synced_at: data.avatar_synced_at,
       preferences: data.preferences,
       onboarding_completed: !!row.onboarding_completed,
       must_change_password: !!row.must_change_password,
@@ -436,6 +775,12 @@ var UsersService = class {
       // Return default agentic config
       default_agentic_config: data.default_agentic_config
     };
+    if (includeAuthMetadata && row.tokens_valid_after) {
+      user.tokens_valid_after = new Date(row.tokens_valid_after);
+    }
+    if (includeAuthMetadata && "tenant_id" in row) {
+      user.tenant_id = row.tenant_id;
+    }
     if (includePassword) {
       user.password = row.password;
     }
@@ -468,10 +813,15 @@ var UsersServiceWithAuth = class extends UsersService {
       name: row.name ?? void 0,
       emoji: row.emoji ?? void 0,
       role: normalizeRole(row.role ?? void 0),
+      avatar_url: data.avatar_url ?? data.avatar,
       avatar: data.avatar,
+      avatar_source: data.avatar_source,
+      avatar_source_id: data.avatar_source_id,
+      avatar_synced_at: data.avatar_synced_at,
       preferences: data.preferences,
       onboarding_completed: !!row.onboarding_completed,
       must_change_password: !!row.must_change_password,
+      tokens_valid_after: row.tokens_valid_after ? new Date(row.tokens_valid_after) : void 0,
       created_at: row.created_at,
       updated_at: row.updated_at ?? void 0,
       agentic_tools: toAgenticToolsStatus(data.agentic_tools),
@@ -479,13 +829,16 @@ var UsersServiceWithAuth = class extends UsersService {
     };
   }
 };
-function createUsersService(db) {
-  return new UsersServiceWithAuth(db);
+function createUsersService(db, app) {
+  return new UsersServiceWithAuth(db, app);
 }
 export {
+  AUTH_INTERNAL_USER_LOOKUP_PARAM,
   LOCAL_AUTH_LOOKUP_PARAM,
   UsersService,
   createUsersService,
+  isAuthenticationUserLookup,
   isLocalAuthenticationLookup,
+  markAuthenticationUserLookup,
   markLocalAuthenticationLookup
 };

package/dist/daemon/services/zone-trigger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"zone-trigger.d.ts","sourceRoot":"","sources":["../../src/services/zone-trigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAIrF,MAAM,WAAW,6BAA6B;IAE5C,GAAG,EAAE,GAAG,CAAC;IAET,MAAM,EAAE,GAAG,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACzF,IAAI,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7E,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;IACX,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAID;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,8BAA8B,CAAC,CAqFzC"}
+{"version":3,"file":"zone-trigger.d.ts","sourceRoot":"","sources":["../../src/services/zone-trigger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAKrF,MAAM,WAAW,6BAA6B;IAE5C,GAAG,EAAE,GAAG,CAAC;IAET,MAAM,EAAE,GAAG,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IACzF,IAAI,EAAE;QACJ,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,KAAK,CAAC,EAAE,eAAe,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC7E,CAAC;IACF,IAAI,EAAE,IAAI,CAAC;IACX,kEAAkE;IAClE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,IAAI,CAAC;CACZ;AAID;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,8BAA8B,CAAC,CAsFzC"}

package/dist/daemon/services/zone-trigger.js

@@ -113,6 +113,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -412,12 +419,16 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
 }
 
 // src/utils/branch-inspect.ts
@@ -426,7 +437,8 @@ function isBranchInspectResult(value) {
 }
 async function inspectBranchViaExecutor(app, branchId, options = {}) {
   const sessionToken = generateSessionToken(
-    app
+    app,
+    options.serviceTokenScope
   );
   const result = await runExecutorCommand(
     {
@@ -506,7 +518,8 @@ async function fireAlwaysNewZoneTrigger(input) {
   const asUser = db ? await resolveExecutorReadAsUser(db, user) : void 0;
   const { currentSha, currentRef } = await inspectBranchViaExecutor(app, branch.branch_id, {
     asUser,
-    logPrefix: `[zone-trigger ${branch.name}]`
+    logPrefix: `[zone-trigger ${branch.name}]`,
+    serviceTokenScope: serviceTokenScopeForParams(params)
   });
   const newSession = await app.service("sessions").create(
     {

package/dist/daemon/setup/build-info.d.ts

@@ -8,7 +8,7 @@
  *
  * Precedence (first match wins):
  *   1. process.env.AGOR_BUILD_SHA           — Docker --build-arg, CI
- *   2. <daemon-dist>/.build-info            — written by packages/agor-live/build.sh
+ *   2. <daemon-dist>/.build-info            — written by daemon build script
  *   3. git rev-parse --short HEAD           — local source installs
  *   4. 'dev'                                — disables the version check entirely
  */

package/dist/daemon/setup/build-info.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-info.d.ts","sourceRoot":"","sources":["../../src/setup/build-info.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0EAA0E;IAC1E,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;CAC7C;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAmD9D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEhE"}
+{"version":3,"file":"build-info.d.ts","sourceRoot":"","sources":["../../src/setup/build-info.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0EAA0E;IAC1E,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;CAC7C;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAyD9D;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEhE"}

package/dist/daemon/setup/build-info.js

@@ -14,7 +14,11 @@ function loadBuildInfo(importMetaUrl) {
     };
   }
   const currentDir = dirname(fileURLToPath(importMetaUrl));
-  const candidates = [join(currentDir, "../.build-info"), join(currentDir, "../../.build-info")];
+  const candidates = [
+    join(currentDir, ".build-info"),
+    join(currentDir, "../.build-info"),
+    join(currentDir, "../../.build-info")
+  ];
   for (const path of candidates) {
     try {
       const raw = readFileSync(path, "utf-8");