agor-live 0.22.0 → 0.23.2

package/dist/daemon/register-hooks.js

@@ -133,6 +133,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -243,6 +250,12 @@ function spawnExecutorLocal(payload, options) {
     options.onExit?.(127);
     return;
   }
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn(cmd, args, {
     cwd,
     env: asUser ? void 0 : { ...envWithDaemonUrl },
@@ -256,6 +269,7 @@ function spawnExecutorLocal(payload, options) {
   onSpawn?.(executorProcess);
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -263,7 +277,7 @@ function spawnExecutorLocal(payload, options) {
     } else {
       console.error(`${logPrefix} Executor exited with code ${code}`);
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -276,6 +290,12 @@ function spawnExecutorWithTemplate(payload, options) {
   console.log(`${logPrefix} Task ID: ${templateVariables.task_id}`);
   console.log(`${logPrefix} Command: ${payload.command}`);
   console.log(`${logPrefix} Template command (first 200 chars): ${command.slice(0, 200)}...`);
+  let reportedExit = false;
+  const reportExit = (code) => {
+    if (reportedExit) return;
+    reportedExit = true;
+    options.onExit?.(code);
+  };
   const executorProcess = spawn("sh", ["-c", command], {
     env: { ...process.env, LOG_LEVEL: logLevel },
     stdio: ["pipe", "pipe", "pipe"]
@@ -289,6 +309,7 @@ function spawnExecutorWithTemplate(payload, options) {
   });
   executorProcess.on("error", (error) => {
     console.error(`${logPrefix} Spawn error:`, error.message);
+    reportExit(127);
   });
   executorProcess.on("exit", (code) => {
     if (code === 0) {
@@ -300,7 +321,7 @@ function spawnExecutorWithTemplate(payload, options) {
         `${logPrefix} Executor exited with code ${code} (task: ${templateVariables.task_id})`
       );
     }
-    options.onExit?.(code);
+    reportExit(code);
   });
   executorProcess.stdin?.write(JSON.stringify(payload));
   executorProcess.stdin?.end();
@@ -579,12 +600,19 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
+}
+function generateScopedServiceToken(app, params) {
+  return generateSessionToken(app, serviceTokenScopeForParams(params));
 }
 var configuredDaemonUrl, configuredExecutorDefaults, EXECUTOR_RESULT_PREFIX, spawnExecutorFireAndForget;
 var init_spawn_executor = __esm({
@@ -600,12 +628,21 @@ var init_spawn_executor = __esm({
 });
 
 // src/utils/mcp-token-authorization.ts
-import { hasMinimumRole as hasMinimumRole5, ROLES as ROLES6 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole6, ROLES as ROLES7 } from "@agor/core/types";
+function hasExplicitMinimumRole(userRole, minimumRole) {
+  return !!userRole && hasMinimumRole6(userRole, minimumRole);
+}
 function canReceiveMcpTokenForSession(params) {
+  const { callerUserId, callerRole } = params;
+  const isServiceExecutor = callerRole === "service";
+  const isAuthenticatedMember = !!callerUserId && hasExplicitMinimumRole(callerRole, ROLES7.MEMBER);
+  return isAuthenticatedMember || isServiceExecutor;
+}
+function canControlCliSession(params) {
   const { callerUserId, callerRole, sessionCreatedBy } = params;
-  const isSuperadmin = hasMinimumRole5(callerRole, ROLES6.SUPERADMIN);
+  const isSuperadmin = hasExplicitMinimumRole(callerRole, ROLES7.SUPERADMIN);
   const isServiceExecutor = callerRole === "service";
-  const isCreatorMember = !!callerUserId && callerUserId === sessionCreatedBy && hasMinimumRole5(callerRole, ROLES6.MEMBER);
+  const isCreatorMember = !!callerUserId && callerUserId === sessionCreatedBy && hasExplicitMinimumRole(callerRole, ROLES7.MEMBER);
   return isCreatorMember || isSuperadmin || isServiceExecutor;
 }
 var init_mcp_token_authorization = __esm({
@@ -626,12 +663,16 @@ __export(tokens_exports, {
   validateSessionToken: () => validateSessionToken
 });
 import { MCP_TOKEN } from "@agor/core/config";
-import { generateId as generateId2, SessionRepository as SessionRepository2, shortId as shortId3 } from "@agor/core/db";
+import {
+  generateId as generateId2,
+  SessionRepository as SessionRepository2,
+  shortId as shortId3
+} from "@agor/core/db";
 import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
 } from "@agor/core/types";
-import jwt2 from "jsonwebtoken";
+import jwt4 from "jsonwebtoken";
 import { MCP_TOKEN_AUDIENCE as MCP_TOKEN_AUDIENCE2, MCP_TOKEN_ISSUER as MCP_TOKEN_ISSUER2 } from "@agor/core/types";
 function mcpTokenDebug(...args) {
   if (DEBUG_MCP_TOKENS) {
@@ -703,7 +744,7 @@ async function generateSessionToken2(app, sessionId, userId) {
     exp: expSec,
     jti
   };
-  const token = jwt2.sign(payload, jwtSecret, { algorithm: "HS256" });
+  const token = jwt4.sign(payload, jwtSecret, { algorithm: "HS256" });
   s.tokenCache.set(cacheKey, { token, expiresAtMs });
   mcpTokenDebug(
     `\u{1F3AB} MCP token issued: session=${shortId3(sessionId)} jti=${jti.substring(0, 8)} exp=+${Math.floor(s.expirationMs / 1e3)}s`
@@ -719,15 +760,15 @@ async function validateSessionToken(app, token) {
   }
   let payload;
   try {
-    payload = jwt2.verify(token, jwtSecret, {
+    payload = jwt4.verify(token, jwtSecret, {
       audience: MCP_TOKEN_AUDIENCE,
       issuer: MCP_TOKEN_ISSUER,
       algorithms: ["HS256"]
     });
   } catch (err) {
-    if (err instanceof jwt2.TokenExpiredError) {
+    if (err instanceof jwt4.TokenExpiredError) {
       console.warn("[mcp-tokens] token rejected: expired");
-    } else if (err instanceof jwt2.JsonWebTokenError) {
+    } else if (err instanceof jwt4.JsonWebTokenError) {
       console.warn(`[mcp-tokens] token rejected: ${err.message}`);
     } else {
       console.error("[mcp-tokens] token verify error:", err);
@@ -1179,6 +1220,7 @@ __export(claude_cli_integration_exports, {
   rehydrateCliWatchers: () => rehydrateCliWatchers,
   resolveClaudeCliMcpConfigTargetUnixUser: () => resolveClaudeCliMcpConfigTargetUnixUser,
   resolveHomeDirForCliSession: () => resolveHomeDirForCliSession,
+  scanCliWatcherRehydrateSessions: () => scanCliWatcherRehydrateSessions,
   setPendingCliTask: () => setPendingCliTask,
   writeClaudeCliMcpConfigFile: () => writeClaudeCliMcpConfigFile,
   writeClaudeCliMcpConfigForSession: () => writeClaudeCliMcpConfigForSession
@@ -1195,8 +1237,12 @@ import {
   permissionModeForCli,
   slugForCwd
 } from "@agor/core/claude-cli";
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig3 } from "@agor/core/config";
 import {
   generateId as generateId4,
+  getCurrentTenantId as getCurrentTenantId3,
+  runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope2,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
   SessionRepository as SessionRepository3,
   shortId as shortId4,
   TaskRepository
@@ -1214,6 +1260,22 @@ function getDb(app) {
   const db = app.get("database") ?? app.get("db");
   return db ?? null;
 }
+function getCliFallbackTenantId(app) {
+  const config = app.get("config");
+  return resolveMultiTenancyConfig3(config ?? {}).static_tenant_id;
+}
+function captureCliWatcherTenantId(app) {
+  return getCurrentTenantId3() ?? getCliFallbackTenantId(app);
+}
+function rememberCliWatcherTenant(sessionId, tenantId) {
+  cliWatcherTenantBySession.set(sessionId, tenantId);
+}
+async function runCliCallbackDatabaseScope(app, sessionId, work) {
+  const db = getDb(app);
+  if (!db) return work();
+  const tenantId = cliWatcherTenantBySession.get(sessionId) ?? captureCliWatcherTenantId(app);
+  return runWithTenantDatabaseScope4(db, tenantId, work);
+}
 async function persistActiveTurnSnapshot(app, sessionId, turn) {
   const db = getDb(app);
   if (!db) return;
@@ -1287,52 +1349,60 @@ function stopTaskWatchdog(sessionId) {
 }
 function startTaskWatchdog(app, sessionId) {
   stopTaskWatchdog(sessionId);
-  const timer = setInterval(async () => {
-    const active = activeCliTurn.get(sessionId);
-    if (!active) {
-      stopTaskWatchdog(sessionId);
-      return;
-    }
-    const idleMs = Date.now() - (Date.parse(active.lastTimestamp) || active.startedAtMs);
-    if (idleMs < WATCHDOG_IDLE_THRESHOLD_MS) return;
-    const alive = await isClaudeRunningFor(sessionId);
-    if (alive) return;
-    console.log(
-      JSON.stringify({
-        layer: "claude-cli-watcher.watchdog",
-        sessionId,
-        idleMs,
-        note: "claude process not running \u2014 closing stale turn"
-      })
-    );
-    try {
-      await closeActiveTurnDispatch?.(sessionId, "claude_exited", (/* @__PURE__ */ new Date()).toISOString());
-    } catch (err) {
-      console.warn("[claude-cli-watcher.watchdog] close dispatch failed", err);
-    }
-    stopTaskWatchdog(sessionId);
-  }, WATCHDOG_TICK_MS);
-  timer.unref?.();
-  watchdogTimers.set(sessionId, timer);
+  runWithoutTenantDatabaseScope2(() => {
+    const timer = setInterval(() => {
+      void runCliCallbackDatabaseScope(app, sessionId, async () => {
+        const active = activeCliTurn.get(sessionId);
+        if (!active) {
+          stopTaskWatchdog(sessionId);
+          return;
+        }
+        const idleMs = Date.now() - (Date.parse(active.lastTimestamp) || active.startedAtMs);
+        if (idleMs < WATCHDOG_IDLE_THRESHOLD_MS) return;
+        const alive = await isClaudeRunningFor(sessionId);
+        if (alive) return;
+        console.log(
+          JSON.stringify({
+            layer: "claude-cli-watcher.watchdog",
+            sessionId,
+            idleMs,
+            note: "claude process not running \u2014 closing stale turn"
+          })
+        );
+        try {
+          await closeActiveTurnDispatch?.(sessionId, "claude_exited", (/* @__PURE__ */ new Date()).toISOString());
+        } catch (err) {
+          console.warn("[claude-cli-watcher.watchdog] close dispatch failed", err);
+        }
+        stopTaskWatchdog(sessionId);
+      }).catch((err) => {
+        console.warn("[claude-cli-watcher.watchdog] scoped tick failed", err);
+      });
+    }, WATCHDOG_TICK_MS);
+    timer.unref?.();
+    watchdogTimers.set(sessionId, timer);
+  });
 }
 function buildCliPersister(app) {
   return {
     async saveOffset(sessionId, update2) {
-      const db = getDb(app);
-      if (!db) return;
-      const repo = new SessionRepository3(db);
-      const row = await repo.findById(sessionId).catch(() => null);
-      if (!row) return;
-      const existing = row.cli_state ?? {};
-      const patch = {
-        cli_state: {
-          ...existing,
-          watcher_offset: update2.watcher_offset,
-          last_event_ts: update2.last_event_ts ?? existing.last_event_ts,
-          last_event_uuid: update2.last_event_uuid ?? existing.last_event_uuid
-        }
-      };
-      await repo.update(sessionId, patch);
+      await runCliCallbackDatabaseScope(app, sessionId, async () => {
+        const db = getDb(app);
+        if (!db) return;
+        const repo = new SessionRepository3(db);
+        const row = await repo.findById(sessionId).catch(() => null);
+        if (!row) return;
+        const existing = row.cli_state ?? {};
+        const patch = {
+          cli_state: {
+            ...existing,
+            watcher_offset: update2.watcher_offset,
+            last_event_ts: update2.last_event_ts ?? existing.last_event_ts,
+            last_event_uuid: update2.last_event_uuid ?? existing.last_event_uuid
+          }
+        };
+        await repo.update(sessionId, patch);
+      });
     }
   };
 }
@@ -1710,14 +1780,17 @@ function buildCliEventSink(app) {
       throw err;
     }
   };
+  const scopedSink = (sessionId, event) => runCliCallbackDatabaseScope(app, sessionId, async () => {
+    await sink(sessionId, event);
+  });
   closeActiveTurnDispatch = async (sessionId, _reason, ts) => {
-    await sink(sessionId, {
+    await scopedSink(sessionId, {
       type: "turn_end",
       messageId: "watchdog-synthetic",
       timestamp: ts
     });
   };
-  return sink;
+  return scopedSink;
 }
 function resolveHomeDirForCliSession(session) {
   if (session.unix_username) {
@@ -1853,13 +1926,13 @@ function writeClaudeCliMcpConfigFile(params) {
 async function writeClaudeCliMcpConfigForSession(app, session, opts = {}) {
   const config = app.get("config");
   if (config?.daemon?.mcpEnabled === false) return void 0;
-  if (opts.actor && !canReceiveMcpTokenForSession({
+  if (opts.actor && !canControlCliSession({
     callerUserId: opts.actor.user_id,
     callerRole: opts.actor.role,
     sessionCreatedBy: session.created_by
   })) {
     console.warn(
-      `[claude-cli-integration] not writing owner-scoped MCP config for session ${shortId4(session.session_id)}: caller ${opts.actor.user_id ?? "anonymous"} cannot receive session creator token`
+      `[claude-cli-integration] not writing owner-scoped MCP config for session ${shortId4(session.session_id)}: caller ${opts.actor.user_id ?? "anonymous"} is not allowed to control the owner-scoped CLI MCP config`
     );
     return void 0;
   }
@@ -1938,13 +2011,18 @@ async function onCliSessionCreated(app, session, branchCwd) {
   }
   try {
     const reg = getCliWatcherRegistry(app);
-    await reg.register({
-      sessionId: session.session_id,
-      cwd: branchCwd,
-      homeDir,
-      startOffset: session.cli_state?.watcher_offset ?? 0
+    const watcherTenantId = captureCliWatcherTenantId(app);
+    await runWithoutTenantDatabaseScope2(async () => {
+      rememberCliWatcherTenant(session.session_id, watcherTenantId);
+      await reg.register({
+        sessionId: session.session_id,
+        cwd: branchCwd,
+        homeDir,
+        startOffset: session.cli_state?.watcher_offset ?? 0
+      });
     });
   } catch (err) {
+    cliWatcherTenantBySession.delete(session.session_id);
     console.warn(
       `[claude-cli-integration] watcher register failed for session ${session.session_id}:`,
       err
@@ -1974,30 +2052,37 @@ async function onCliSessionEnded(app, sessionId) {
   await reg.unregister(sessionId);
   stopTaskWatchdog(sessionId);
   activeCliTurn.delete(sessionId);
+  cliWatcherTenantBySession.delete(sessionId);
 }
-async function rehydrateCliWatchers(app, branchCwdLookup) {
+async function scanCliWatcherRehydrateSessions(app) {
   const db = getDb(app);
-  if (!db) return;
+  if (!db) return [];
   const repo = new SessionRepository3(db);
-  const all = await repo.findAll().catch(() => []);
+  return repo.findAll();
+}
+async function rehydrateCliWatchers(app, branchCwdLookup, sessions, options) {
   const reg = getCliWatcherRegistry(app);
   let rehydrated = 0;
-  for (const session of all) {
+  for (const session of sessions) {
     if (session.agentic_tool !== "claude-code-cli") continue;
     if (session.status === "completed" || session.status === "failed") continue;
     if (session.archived) continue;
     const cwd = await branchCwdLookup(session.branch_id);
     if (!cwd) continue;
-    primeActiveCliTurnFromSession(app, session);
     try {
-      await reg.register({
-        sessionId: session.session_id,
-        cwd,
-        homeDir: resolveHomeDirForCliSession(session),
-        startOffset: session.cli_state?.watcher_offset ?? 0
+      await runWithoutTenantDatabaseScope2(async () => {
+        rememberCliWatcherTenant(session.session_id, options.tenantId);
+        primeActiveCliTurnFromSession(app, session);
+        await reg.register({
+          sessionId: session.session_id,
+          cwd,
+          homeDir: resolveHomeDirForCliSession(session),
+          startOffset: session.cli_state?.watcher_offset ?? 0
+        });
       });
       rehydrated++;
     } catch (err) {
+      cliWatcherTenantBySession.delete(session.session_id);
       console.warn(
         `[claude-cli-integration] failed to rehydrate watcher for ${session.session_id}:`,
         err
@@ -2008,7 +2093,7 @@ async function rehydrateCliWatchers(app, branchCwdLookup) {
     console.log(`[claude-cli-integration] rehydrated ${rehydrated} CLI watcher(s)`);
   }
 }
-var activeCliTurn, WATCHDOG_TICK_MS, WATCHDOG_IDLE_THRESHOLD_MS, watchdogTimers, closeActiveTurnDispatch, pendingCliTask, registrySingleton;
+var cliWatcherTenantBySession, activeCliTurn, WATCHDOG_TICK_MS, WATCHDOG_IDLE_THRESHOLD_MS, watchdogTimers, closeActiveTurnDispatch, pendingCliTask, registrySingleton;
 var init_claude_cli_integration = __esm({
   "src/services/claude-cli-integration.ts"() {
     "use strict";
@@ -2018,6 +2103,7 @@ var init_claude_cli_integration = __esm({
     init_spawn_executor();
     init_claude_cli_watcher();
     init_claude_cli_watcher();
+    cliWatcherTenantBySession = /* @__PURE__ */ new Map();
     activeCliTurn = /* @__PURE__ */ new Map();
     WATCHDOG_TICK_MS = 6e4;
     WATCHDOG_IDLE_THRESHOLD_MS = 9e4;
@@ -2033,12 +2119,16 @@ import { analyticsLogger } from "@agor/core/analytics";
 import {
   isUnixImpersonationEnabled,
   loadConfig,
+  resolveExecutionSecurityMode,
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig4,
+  resolveMultiTenancyDatabaseDialect,
+  resolveTenantContext as resolveTenantContext3,
+  TenantResolutionError as TenantResolutionError3,
   validateRepoEnvironment,
   wrapV1AsV2
 } from "@agor/core/config";
 import {
   ArtifactRepository,
-  BoardObjectRepository as BoardObjectRepository2,
   BoardRepository as BoardRepository2,
   ScheduleRepository,
   shortId as shortId5,
@@ -2050,7 +2140,7 @@ import {
   validateRenderedManagedEnvUrlFields,
   validateRepoEnvironmentLifecyclePolicy
 } from "@agor/core/environment/webhook";
-import { BadRequest as BadRequest3, Forbidden as Forbidden8, NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
+import { BadRequest as BadRequest5, Forbidden as Forbidden9, NotAuthenticated as NotAuthenticated8 } from "@agor/core/feathers";
 import {
   boardCommentQueryValidator,
   boardObjectQueryValidator,
@@ -2063,17 +2153,50 @@ import {
   typedValidateQuery,
   userQueryValidator
 } from "@agor/core/lib/feathers-validation";
-import { hasMinimumRole as hasMinimumRole8, ROLES as ROLES9 } from "@agor/core/types";
+import {
+  GATEWAY_REDACTED_SENTINEL,
+  GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  hasMinimumRole as hasMinimumRole9,
+  ROLES as ROLES10
+} from "@agor/core/types";
 
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
+
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record = payload;
+  return record.type === EXECUTOR_SESSION_TOKEN_TYPE && record.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+
+// src/auth/executor-runtime-scope.ts
 function scopedPayload(context) {
-  const payload = context.params.authentication?.payload;
-  if (payload?.type !== "executor-session") return null;
-  if (payload.purpose !== "executor-task") {
-    throw new Forbidden("Executor token is not valid for this request");
+  const params = context.params;
+  const payload = params.authentication?.payload;
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
+      throw new Forbidden("Executor token is not valid for this request");
+    }
+    return payload;
   }
-  return payload;
+  if (params.authentication?.strategy === "jwt" && params.task_id) {
+    return {
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
+      task_id: params.task_id,
+      session_id: params.session_id,
+      sessionId: params.sessionId,
+      branch_id: params.branch_id
+    };
+  }
+  if (payload?.type !== void 0) return null;
+  return null;
 }
 function expectClaim(claim, label) {
   if (!claim) {
@@ -2175,7 +2298,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };
@@ -2352,13 +2475,16 @@ var gatewayRouteHook = async (context) => {
   const latestToolUse = extractLatestToolUseFromMessage(message);
   if (latestToolUse) {
     try {
-      void gatewayService.updateProgress({
-        session_id: message.session_id,
-        state: "working",
-        task_id: message.task_id,
-        tool_name: latestToolUse.name,
-        tool_input: latestToolUse.input
-      });
+      gatewayService.updateProgressAfterCommit(
+        {
+          session_id: message.session_id,
+          state: "working",
+          task_id: message.task_id,
+          tool_name: latestToolUse.name,
+          tool_input: latestToolUse.input
+        },
+        context.params
+      );
     } catch (error) {
       console.warn("[gateway-route] Failed to route tool progress:", error);
     }
@@ -2377,6 +2503,11 @@ var gatewayRouteHook = async (context) => {
       return context;
     }
     shouldRoute = true;
+  } else if (message.role === "system") {
+    const systemMeta = message.metadata?.system;
+    if (systemMeta?.render_hint === "context" || /^\[system\]/i.test(messageText.trim())) {
+      shouldRoute = true;
+    }
   } else if (message.role === "user") {
     const source = message.metadata?.source;
     if (source === "agor") {
@@ -2403,37 +2534,25 @@ var gatewayRouteHook = async (context) => {
     return context;
   }
   try {
-    gatewayService.routeMessage({
-      session_id: message.session_id,
-      message: messageText
-    }).catch((error) => {
-      console.warn("[gateway-route] Failed to route message:", error);
-    });
+    gatewayService.routeMessageAfterCommit(
+      {
+        session_id: message.session_id,
+        message: messageText,
+        metadata: message.metadata
+      },
+      context.params
+    );
   } catch (error) {
     console.warn("[gateway-route] Failed to invoke gateway service:", error);
   }
   return context;
 };
 
-// src/services/board-objects.ts
-import {
-  BoardObjectRepository
-} from "@agor/core/db";
-function normalizeBoardObjectFindQuery(query = {}) {
-  const { board_id, branch_id, card_id, zone_id, entity_type } = query;
-  const requestedSkip = Number(query.$skip ?? 0);
-  const requestedLimit = typeof query.$limit === "number" ? query.$limit : void 0;
-  const filters = Object.fromEntries(
-    Object.entries({ board_id, branch_id, card_id, zone_id, entity_type }).filter(
-      ([, value]) => value !== void 0
-    )
-  );
-  return {
-    filters,
-    pagination: requestedLimit !== void 0 || requestedSkip > 0 ? { limit: requestedLimit, offset: requestedSkip } : {},
-    limit: requestedLimit ?? 100,
-    skip: requestedSkip
-  };
+// src/oauth-auth-helpers.ts
+import { runWithTenantDatabaseScope } from "@agor/core/db";
+function resolveForUserIdWithGate(opts) {
+  const canUseExplicitUser = opts.isServiceAccount === true || opts.authPayloadType === "executor-session" && opts.queryForUserId === opts.callerUserId;
+  return opts.queryForUserId && canUseExplicitUser ? opts.queryForUserId : opts.callerUserId;
 }
 
 // src/services/groups.ts
@@ -2670,37 +2789,6 @@ function paginateClientSide(rows, query, skipFilterKeys = /* @__PURE__ */ new Se
     data: filtered.slice(skip, skip + limit)
   };
 }
-function scopeSessionQuery(sessionRepo, options) {
-  return async (context) => {
-    if (!context.params.provider) {
-      return context;
-    }
-    if (context.params.user?._isServiceAccount) {
-      return context;
-    }
-    if (context.method !== "find") {
-      return context;
-    }
-    const userId = context.params.user?.user_id;
-    if (!userId) {
-      context.result = {
-        total: 0,
-        limit: 0,
-        skip: 0,
-        data: []
-      };
-      return context;
-    }
-    const userRole = context.params.user?.role;
-    const allowSuperadmin = options?.allowSuperadmin ?? true;
-    const accessibleSessions = isSuperAdmin(userRole, allowSuperadmin) ? await sessionRepo.findAll() : await sessionRepo.findAccessibleSessions(userId);
-    context.result = paginateClientSide(
-      accessibleSessions,
-      context.params.query
-    );
-    return context;
-  };
-}
 function loadSessionBranch(sessionService, branchRepo) {
   return async (context) => {
     if (!context.params.provider) {
@@ -2997,7 +3085,7 @@ function emptyFindResult(context) {
   };
   return context;
 }
-async function resolveFindScopeAccess(context, options, loadAccessibleIds) {
+async function resolveFindSqlScopeAccess(context, options) {
   if (context.method !== "find") return { kind: "passThrough" };
   if (!context.params.provider) return { kind: "passThrough" };
   if (context.params.user?._isServiceAccount) return { kind: "passThrough" };
@@ -3009,57 +3097,30 @@ async function resolveFindScopeAccess(context, options, loadAccessibleIds) {
   const userRole = context.params.user?.role;
   const allowSuperadmin = options?.allowSuperadmin ?? true;
   if (isSuperAdmin(userRole, allowSuperadmin)) return { kind: "passThrough" };
-  const ids = await loadAccessibleIds(userId);
-  return { kind: "filter", accessibleIds: new Set(ids) };
+  return { kind: "filter", userId };
 }
-function intersectFindQuery(context, field, accessibleIds) {
-  const query = context.params.query ?? {};
-  const existing = query[field];
-  if (typeof existing === "string") {
-    if (!accessibleIds.has(existing)) return emptyFindResult(context);
-    return context;
-  }
-  if (existing && typeof existing === "object" && Array.isArray(existing.$in)) {
-    const intersect = existing.$in.filter((id) => accessibleIds.has(id));
-    if (intersect.length === 0) return emptyFindResult(context);
-    query[field] = { $in: intersect };
-    context.params.query = query;
-    return context;
-  }
-  if (accessibleIds.size === 0) return emptyFindResult(context);
-  query[field] = { $in: Array.from(accessibleIds) };
-  context.params.query = query;
-  return context;
-}
-function scopeFindToAccessibleBranches(branchRepo, options) {
+function scopeFindToAccessibleBranchesSql(options) {
   return async (context) => {
-    const decision = await resolveFindScopeAccess(context, options, async (uid) => {
-      const accessible = await branchRepo.findAccessibleBranches(uid);
-      return accessible.map((w) => w.branch_id);
-    });
+    const decision = await resolveFindSqlScopeAccess(context, options);
     if (decision.kind !== "filter") return context;
-    return intersectFindQuery(context, "branch_id", decision.accessibleIds);
+    context.params._agorSqlBranchAccessUserId = decision.userId;
+    return context;
   };
 }
-function scopeFindToAccessibleSessions(sessionRepo, options) {
+function scopeFindToAccessibleSessionsSql(options) {
   return async (context) => {
-    const decision = await resolveFindScopeAccess(context, options, async (uid) => {
-      const accessible = await sessionRepo.findAccessibleSessions(uid);
-      return accessible.map((s) => s.session_id);
-    });
+    const decision = await resolveFindSqlScopeAccess(context, options);
     if (decision.kind !== "filter") return context;
-    return intersectFindQuery(context, "session_id", decision.accessibleIds);
+    context.params._agorSqlSessionAccessUserId = decision.userId;
+    return context;
   };
 }
-function scopeFindToAccessibleBoards(boardRepo, options) {
+function scopeFindToAccessibleBoardsSql(options) {
   return async (context) => {
-    const decision = await resolveFindScopeAccess(
-      context,
-      options,
-      (uid) => boardRepo.findVisibleBoardIds(uid)
-    );
+    const decision = await resolveFindSqlScopeAccess(context, options);
     if (decision.kind !== "filter") return context;
-    return intersectFindQuery(context, "board_id", decision.accessibleIds);
+    context.params._agorSqlBoardAccessUserId = decision.userId;
+    return context;
   };
 }
 function scopeScheduleQuery(scheduleRepo, options) {
@@ -3182,8 +3243,13 @@ import {
   SessionRepository,
   UsersRepository
 } from "@agor/core/db";
-import { Forbidden as Forbidden4 } from "@agor/core/feathers";
-import { formatModelToolMismatchWarning, lintModelToolMatch } from "@agor/core/models";
+import { BadRequest as BadRequest2, Forbidden as Forbidden4 } from "@agor/core/feathers";
+import {
+  formatModelToolMismatchWarning,
+  formatUnsupportedAgorCodexModelMessage,
+  isUnsupportedAgorCodexModel,
+  lintModelToolMatch
+} from "@agor/core/models";
 import { resolveChildSessionConfig } from "@agor/core/sessions";
 import { ROLES as ROLES3, SessionStatus } from "@agor/core/types";
 var remoteRelationshipsEnrichedResults = /* @__PURE__ */ new WeakSet();
@@ -3206,6 +3272,7 @@ import {
   validateEnvVar
 } from "@agor/core/config";
 import {
+  and,
   compare,
   decryptApiKey,
   deleteFrom,
@@ -3217,16 +3284,29 @@ import {
   update,
   users
 } from "@agor/core/db";
-import { Forbidden as Forbidden5, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
-import { isLikelyGitToken } from "@agor/core/git";
+import { Forbidden as Forbidden6, NotAuthenticated as NotAuthenticated3 } from "@agor/core/feathers";
+import { isLikelyGitToken } from "@agor/core/git/pure";
 import {
   extractAgenticToolsPublicValues,
-  hasMinimumRole as hasMinimumRole3,
+  hasMinimumRole as hasMinimumRole4,
   normalizeRole,
-  ROLES as ROLES4,
+  ROLES as ROLES5,
   toAgenticToolsStatus
 } from "@agor/core/types";
+
+// src/services/user-avatar-sync.ts
+import {
+  AppVariableRepository,
+  GatewayChannelRepository,
+  UsersRepository as UsersRepository2
+} from "@agor/core/db";
+import { Forbidden as Forbidden5 } from "@agor/core/feathers";
+import { SlackConnector } from "@agor/core/gateway";
+import { hasMinimumRole as hasMinimumRole3, ROLES as ROLES4 } from "@agor/core/types";
+
+// src/services/users.ts
 var LOCAL_AUTH_LOOKUP_PARAM = Symbol("agor.users.local-auth-lookup");
+var AUTH_INTERNAL_USER_LOOKUP_PARAM = Symbol("agor.users.auth-internal-lookup");
 function isLocalAuthenticationLookup(params) {
   return params?.[LOCAL_AUTH_LOOKUP_PARAM] === true;
 }
@@ -3250,6 +3330,11 @@ function buildSessionCreatedAnalyticsProperties(session) {
 }
 
 // src/utils/apply-session-config-defaults.ts
+import { BadRequest as BadRequest3 } from "@agor/core/feathers";
+import {
+  formatUnsupportedAgorCodexModelMessage as formatUnsupportedAgorCodexModelMessage2,
+  isUnsupportedAgorCodexModel as isUnsupportedAgorCodexModel2
+} from "@agor/core/models";
 import { resolveSessionDefaults } from "@agor/core/sessions";
 function applySessionConfigDefaults(opts = {}) {
   const { warnOnExternalDefaultFill = true } = opts;
@@ -3261,9 +3346,12 @@ function applySessionConfigDefaults(opts = {}) {
     if (!data) return context;
     const hasPermission = data.permission_config != null;
     const hasModel = !!data.model_config?.model;
-    if (hasPermission && hasModel) return context;
     const agenticTool = data.agentic_tool;
     if (!agenticTool) return context;
+    if (agenticTool === "codex" && data.model_config?.model && isUnsupportedAgorCodexModel2(data.model_config.model)) {
+      throw new BadRequest3(formatUnsupportedAgorCodexModelMessage2(data.model_config.model));
+    }
+    if (hasPermission && hasModel) return context;
     const userId = data.created_by;
     if (!userId) return context;
     let user;
@@ -3282,6 +3370,9 @@ function applySessionConfigDefaults(opts = {}) {
       user,
       overrides: { modelConfig: data.model_config ?? void 0 }
     });
+    if (resolved.model_config?.model && agenticTool === "codex" && isUnsupportedAgorCodexModel2(resolved.model_config.model)) {
+      throw new BadRequest3(formatUnsupportedAgorCodexModelMessage2(resolved.model_config.model));
+    }
     if (!hasPermission) {
       data.permission_config = resolved.permission_config;
       if (warnOnExternalDefaultFill && context.params.provider) {
@@ -3298,8 +3389,8 @@ function applySessionConfigDefaults(opts = {}) {
 }
 
 // src/utils/authorization.ts
-import { Forbidden as Forbidden6, NotAuthenticated as NotAuthenticated4 } from "@agor/core/feathers";
-import { hasMinimumRole as hasMinimumRole4, ROLES as ROLES5 } from "@agor/core/types";
+import { Forbidden as Forbidden7, NotAuthenticated as NotAuthenticated4 } from "@agor/core/feathers";
+import { hasMinimumRole as hasMinimumRole5, ROLES as ROLES6 } from "@agor/core/types";
 function ensureMinimumRole(params, minimumRole, action = "perform this action") {
   if (!params?.provider) {
     return;
@@ -3310,8 +3401,8 @@ function ensureMinimumRole(params, minimumRole, action = "perform this action")
   if (params.user._isServiceAccount === true) {
     return;
   }
-  if (!hasMinimumRole4(params.user.role, minimumRole)) {
-    throw new Forbidden6(`You need ${minimumRole} access to ${action}`);
+  if (!hasMinimumRole5(params.user.role, minimumRole)) {
+    throw new Forbidden7(`You need ${minimumRole} access to ${action}`);
   }
 }
 function requireMinimumRole(minimumRole, action) {
@@ -3320,7 +3411,7 @@ function requireMinimumRole(minimumRole, action) {
     return context;
   };
 }
-var DEFAULT_MANAGED_ENVS_MINIMUM_ROLE = ROLES5.MEMBER;
+var DEFAULT_MANAGED_ENVS_MINIMUM_ROLE = ROLES6.MEMBER;
 var ENV_COMMAND_FIELDS = [
   "environment",
   // Repo-level: v2 named variants (source of truth)
@@ -3348,13 +3439,13 @@ function requireAdminForEnvConfig() {
     }
     ensureMinimumRole(
       context.params,
-      ROLES5.ADMIN,
+      ROLES6.ADMIN,
       "modify environment commands (up_command, down_command, etc.)"
     );
     return context;
   };
 }
-function registerAuthenticatedRoute(app, path4, service, authConfig, requireAuth) {
+function registerAuthenticatedRoute(app, path4, service, authConfig, requireAuth, options = {}) {
   app.use(path4, service);
   const hooks = {};
   for (const [method, config] of Object.entries(authConfig)) {
@@ -3365,6 +3456,7 @@ function registerAuthenticatedRoute(app, path4, service, authConfig, requireAuth
     ];
   }
   app.service(path4).hooks({
+    ...options.around ? { around: { all: options.around } } : {},
     before: hooks
   });
 }
@@ -3376,7 +3468,8 @@ function isBranchInspectResult(value) {
 }
 async function inspectBranchViaExecutor(app, branchId, options = {}) {
   const sessionToken = generateSessionToken(
-    app
+    app,
+    options.serviceTokenScope
   );
   const result = await runExecutorCommand(
     {
@@ -3401,7 +3494,7 @@ async function inspectBranchViaExecutor(app, branchId, options = {}) {
 
 // src/utils/executor-read-impersonation.ts
 import { loadConfigSync as loadConfigSync2 } from "@agor/core/config";
-import { UsersRepository as UsersRepository2 } from "@agor/core/db";
+import { UsersRepository as UsersRepository3 } from "@agor/core/db";
 async function resolveExecutorReadAsUser(db, userOrId) {
   const config = loadConfigSync2();
   const unixMode = config.execution?.unix_user_mode ?? "simple";
@@ -3410,7 +3503,7 @@ async function resolveExecutorReadAsUser(db, userOrId) {
   }
   let user;
   if (typeof userOrId === "string") {
-    user = await new UsersRepository2(db).findById(userOrId);
+    user = await new UsersRepository3(db).findById(userOrId);
   } else {
     user = userOrId;
   }
@@ -3456,11 +3549,26 @@ function injectCreatedBy() {
 // src/utils/mcp-header-secrets.ts
 import { redactMCPAuthSecrets } from "@agor/core/tools/mcp/auth-secrets";
 import { redactMCPCustomHeaders } from "@agor/core/tools/mcp/http-headers";
+import jwt2 from "jsonwebtoken";
 function shouldExposeMCPServerSecretsForSessionToken(params, options = {}) {
-  const payload = params?.authentication?.payload;
-  const sessionId = params?.session_id ?? payload?.session_id ?? payload?.sessionId;
+  const payload = params?.authentication?.payload ?? decodeExecutorSessionPayload(params);
+  const sessionId = params?.session_id ?? getPayloadSessionId(payload);
   return !!params?.provider && (params.authentication?.strategy === "session-token" || payload?.type === "executor-session") && !!sessionId && (!options.sessionId || sessionId === options.sessionId);
 }
+function decodeExecutorSessionPayload(params) {
+  if (params?.authentication?.strategy !== "jwt" || !params.authentication.accessToken) {
+    return void 0;
+  }
+  const decoded = jwt2.decode(params.authentication.accessToken);
+  if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+    return void 0;
+  }
+  if (!isExecutorSessionTokenPayload(decoded)) return void 0;
+  return decoded;
+}
+function getPayloadSessionId(payload) {
+  return payload ? getExecutorSessionTokenSessionId(payload) : void 0;
+}
 function shouldExposeMCPServerSecrets(params, options = {}) {
   if (!params?.provider) return true;
   if (params.user?._isServiceAccount || params.user?.role === "service") return true;
@@ -3482,12 +3590,13 @@ init_mcp_token_authorization();
 
 // src/utils/realign-repo-origin.ts
 init_spawn_executor();
-async function ensureRepoOriginAlignedForRepo(app, repo) {
+async function ensureRepoOriginAlignedForRepo(app, repo, params) {
   if (repo.repo_type !== "remote") return;
   if (!repo.remote_url) return;
   if (!repo.local_path) return;
-  const sessionToken = generateSessionToken(
-    app
+  const sessionToken = generateScopedServiceToken(
+    app,
+    params
   );
   spawnExecutorFireAndForget(
     {
@@ -3516,12 +3625,14 @@ function realignRepoOriginAfterPatchHook() {
     const repos = Array.isArray(result) ? result : [result];
     for (const repo of repos) {
       if (!repo?.repo_id) continue;
-      ensureRepoOriginAlignedForRepo(context.app, repo).catch((err) => {
-        const message = err instanceof Error ? err.message : String(err);
-        console.warn(
-          `\u26A0\uFE0F  [repos.after.patch] ensureRepoOriginAlignedForRepo failed for repo ${repo.repo_id}: ${message}`
-        );
-      });
+      ensureRepoOriginAlignedForRepo(context.app, repo, context.params).catch(
+        (err) => {
+          const message = err instanceof Error ? err.message : String(err);
+          console.warn(
+            `\u26A0\uFE0F  [repos.after.patch] ensureRepoOriginAlignedForRepo failed for repo ${repo.repo_id}: ${message}`
+          );
+        }
+      );
     }
     return context;
   };
@@ -3543,6 +3654,7 @@ var RealtimeAccessCache = class {
   }
   branchVisibility = /* @__PURE__ */ new Map();
   sessionBranches = /* @__PURE__ */ new Map();
+  sessionOwners = /* @__PURE__ */ new Map();
   branchVisibilityTtlMs;
   sessionBranchTtlMs;
   now;
@@ -3559,6 +3671,27 @@ var RealtimeAccessCache = class {
     });
     return branchId;
   }
+  /**
+   * Owning user id for a session, cached on the same cadence as the
+   * session→branch map. Used only to offer streaming events to the session
+   * creator's own connections as a fallback when they haven't subscribed to
+   * the per-session stream channel yet.
+   */
+  async getSessionOwnerId(sessionId) {
+    const cached = this.sessionOwners.get(sessionId);
+    const now = this.now();
+    if (cached && cached.expiresAt > now) {
+      return cached.ownerId;
+    }
+    const ownerId = await this.options.sessionsRepository.findCreatedByBySessionId(
+      sessionId
+    ) ?? null;
+    this.sessionOwners.set(sessionId, {
+      ownerId,
+      expiresAt: now + this.sessionBranchTtlMs
+    });
+    return ownerId;
+  }
   async getBranchVisibility(branchId) {
     const cached = this.branchVisibility.get(branchId);
     const now = this.now();
@@ -3594,6 +3727,7 @@ var RealtimeAccessCache = class {
   }
   invalidateSession(sessionId) {
     this.sessionBranches.delete(sessionId);
+    this.sessionOwners.delete(sessionId);
   }
   clearVisibility() {
     this.branchVisibility.clear();
@@ -3601,6 +3735,7 @@ var RealtimeAccessCache = class {
   clearAll() {
     this.branchVisibility.clear();
     this.sessionBranches.clear();
+    this.sessionOwners.clear();
   }
   visibilityFromEntry(entry) {
     return entry.mode === "allAuthenticated" ? { mode: "allAuthenticated" } : { mode: "explicitUsers", userIds: entry.userIds };
@@ -3608,8 +3743,22 @@ var RealtimeAccessCache = class {
 };
 
 // src/utils/realtime-publish.ts
-import { shortId as shortId2 } from "@agor/core/db";
-import { hasMinimumRole as hasMinimumRole6, ROLES as ROLES7 } from "@agor/core/types";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@agor/core/config";
+import { getCurrentTenantId, shortId as shortId2 } from "@agor/core/db";
+import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES8 } from "@agor/core/types";
+function tenantChannelName(tenantId) {
+  return `tenant:${tenantId}`;
+}
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -3625,8 +3774,27 @@ var SESSION_ID_SCOPED_PATHS = /* @__PURE__ */ new Set([
   "session-env-selections"
 ]);
 var OPTIONAL_BRANCH_OR_SESSION_SCOPED_PATHS = /* @__PURE__ */ new Set(["board-objects", "board-comments"]);
+var MESSAGE_STREAMING_EVENTS = /* @__PURE__ */ new Set([
+  "streaming:start",
+  "streaming:chunk",
+  "streaming:end",
+  "streaming:error",
+  "thinking:start",
+  "thinking:chunk",
+  "thinking:end"
+]);
+var TASK_STREAMING_EVENTS = /* @__PURE__ */ new Set(["thinking:chunk", "tool:start", "tool:complete"]);
 function isStreamingEvent(context) {
-  return context.path === "messages/streaming" || context.path === "messages" && context.event?.startsWith("streaming:") === true;
+  if (context.path === "messages/streaming") return true;
+  const event = context.event;
+  if (!event) return false;
+  if (context.path === "messages") {
+    return event.startsWith("streaming:") || MESSAGE_STREAMING_EVENTS.has(event);
+  }
+  if (context.path === "tasks") {
+    return TASK_STREAMING_EVENTS.has(event);
+  }
+  return false;
 }
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -3676,7 +3844,7 @@ function isServiceConnection(connection) {
 }
 function isAdminConnection(connection, allowSuperadmin) {
   const user = userFromConnection(connection);
-  if (!user?._isServiceAccount && user?.role && hasMinimumRole6(user.role, ROLES7.ADMIN)) {
+  if (!user?._isServiceAccount && user?.role && hasMinimumRole7(user.role, ROLES8.ADMIN)) {
     return true;
   }
   return isSuperAdmin(user?.role, allowSuperadmin);
@@ -3762,6 +3930,47 @@ async function resolvePublishScope(data, context, accessCache) {
 function filterToServiceConnections(authenticated) {
   return authenticated.filter((connection) => isServiceConnection(connection));
 }
+async function resolveStreamingDelivery(app, data, tenantScoped, accessCache, branchRbacEnabled, allowSuperadmin) {
+  const serviceConnections = filterToServiceConnections(tenantScoped);
+  const sessionId = extractSessionId(data);
+  if (!sessionId) return serviceConnections;
+  const tenantConnections = new Set(
+    tenantScoped.connections
+  );
+  const existingRoom = existingChannel(app, sessionStreamChannelName(sessionId));
+  const room = existingRoom ? existingRoom.filter((connection) => tenantConnections.has(connection)) : null;
+  let ownerId = null;
+  try {
+    ownerId = await accessCache.getSessionOwnerId(sessionId);
+  } catch {
+  }
+  const ownerChannel = () => tenantScoped.filter(
+    (connection) => userFromConnection(connection)?.user_id === ownerId
+  );
+  if (!branchRbacEnabled) {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const branchId = await accessCache.getBranchIdForSession(sessionId);
+  const visibility = branchId ? await accessCache.getBranchVisibility(branchId) : null;
+  if (!visibility) return serviceConnections;
+  if (visibility.mode === "allAuthenticated") {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const channels = [serviceConnections];
+  if (room) {
+    channels.push(filterToUserIdsOrSuperadmins(room, visibility.userIds, allowSuperadmin));
+  }
+  if (ownerId && visibility.userIds.has(ownerId)) {
+    channels.push(ownerChannel());
+  }
+  return channels;
+}
 function filterToUserIdsOrAdmins(authenticated, userIds, allowSuperadmin) {
   return authenticated.filter((connection) => {
     if (isServiceConnection(connection) || isAdminConnection(connection, allowSuperadmin)) {
@@ -3780,6 +3989,22 @@ function filterToUserIdsOrSuperadmins(authenticated, userIds, allowSuperadmin) {
     return typeof userId === "string" && userIds.has(userId);
   });
 }
+function extractConnectionTenantId(context) {
+  const params = context.params;
+  const tenant = params?.connection?.tenant ?? params?.connection?.data?.tenant;
+  return tenant && typeof tenant === "object" && "tenant_id" in tenant ? typeof tenant.tenant_id === "string" ? tenant.tenant_id : void 0 : void 0;
+}
+function resolveRealtimeTenantId(multiTenancy, context) {
+  try {
+    return resolveTenantContext(multiTenancy, { params: context.params }).tenant_id;
+  } catch (error) {
+    const connectionTenantId = extractConnectionTenantId(context);
+    if (error instanceof TenantResolutionError && connectionTenantId) return connectionTenantId;
+    const ambientTenantId = getCurrentTenantId();
+    if (error instanceof TenantResolutionError && ambientTenantId) return ambientTenantId;
+    throw error;
+  }
+}
 function configureRealtimePublish(options) {
   const {
     app,
@@ -3790,7 +4015,8 @@ function configureRealtimePublish(options) {
       branchRepository,
       sessionsRepository
     }),
-    allowSuperadmin = true
+    allowSuperadmin = true,
+    multiTenancy
   } = options;
   app.publish(async (data, context) => {
     if (context.path && context.method && !isStreamingEvent(context)) {
@@ -3801,12 +4027,39 @@ function configureRealtimePublish(options) {
       );
     }
     const authenticated = app.channel("authenticated");
-    if (!branchRbacEnabled) return authenticated;
+    let tenantScoped = authenticated;
+    if (multiTenancy) {
+      try {
+        const tenantId = resolveRealtimeTenantId(multiTenancy, context);
+        tenantScoped = app.channel(tenantChannelName(tenantId));
+      } catch (error) {
+        if (error instanceof TenantResolutionError) {
+          console.warn("[realtime] Suppressing event without tenant context", {
+            path: context.path,
+            event: context.event,
+            method: context.method
+          });
+          return filterToServiceConnections(authenticated);
+        }
+        throw error;
+      }
+    }
+    if (isStreamingEvent(context)) {
+      return resolveStreamingDelivery(
+        app,
+        data,
+        tenantScoped,
+        accessCache,
+        branchRbacEnabled,
+        allowSuperadmin
+      );
+    }
+    if (!branchRbacEnabled) return tenantScoped;
     const scope = await resolvePublishScope(data, context, accessCache);
-    if (scope.kind === "global") return authenticated;
-    if (scope.kind === "serviceOnly") return filterToServiceConnections(authenticated);
+    if (scope.kind === "global") return tenantScoped;
+    if (scope.kind === "serviceOnly") return filterToServiceConnections(tenantScoped);
     if (scope.kind === "users") {
-      return filterToUserIdsOrAdmins(authenticated, scope.userIds, allowSuperadmin);
+      return filterToUserIdsOrAdmins(tenantScoped, scope.userIds, allowSuperadmin);
     }
     if (!scope.branchId) {
       console.warn("[realtime] Suppressing scoped event without resolvable branch context", {
@@ -3814,7 +4067,7 @@ function configureRealtimePublish(options) {
         event: context.event,
         method: context.method
       });
-      return filterToServiceConnections(authenticated);
+      return filterToServiceConnections(tenantScoped);
     }
     const visibility = await accessCache.getBranchVisibility(scope.branchId);
     if (!visibility) {
@@ -3823,18 +4076,18 @@ function configureRealtimePublish(options) {
         event: context.event,
         method: context.method
       });
-      return filterToServiceConnections(authenticated);
+      return filterToServiceConnections(tenantScoped);
     }
     if (visibility.mode === "allAuthenticated") {
-      return authenticated;
+      return tenantScoped;
     }
-    return filterToUserIdsOrSuperadmins(authenticated, visibility.userIds, allowSuperadmin);
+    return filterToUserIdsOrSuperadmins(tenantScoped, visibility.userIds, allowSuperadmin);
   });
 }
 
 // src/utils/schedule-hooks.ts
-import { BadRequest as BadRequest2, Forbidden as Forbidden7, NotAuthenticated as NotAuthenticated6 } from "@agor/core/feathers";
-import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES8 } from "@agor/core/types";
+import { BadRequest as BadRequest4, Forbidden as Forbidden8, NotAuthenticated as NotAuthenticated6 } from "@agor/core/feathers";
+import { hasMinimumRole as hasMinimumRole8, ROLES as ROLES9 } from "@agor/core/types";
 function ensureCurrentScheduleLoaded(scheduleRepo) {
   return async (context) => {
     if (context.method !== "patch") return context;
@@ -3856,21 +4109,21 @@ function validateScheduleConfig() {
       const { isValidCron } = await import("@agor/core/utils/cron");
       const tz = merged.timezone_mode === "local" && merged.timezone ? merged.timezone : "UTC";
       if (!isValidCron(data.cron_expression, tz)) {
-        throw new BadRequest2(`Invalid cron expression: '${data.cron_expression}'`);
+        throw new BadRequest4(`Invalid cron expression: '${data.cron_expression}'`);
       }
     }
     if (merged.timezone_mode === "local" && !merged.timezone) {
-      throw new BadRequest2("timezone_mode='local' requires a non-empty IANA timezone.");
+      throw new BadRequest4("timezone_mode='local' requires a non-empty IANA timezone.");
     }
     if (data.timezone) {
       try {
         new Intl.DateTimeFormat("en-US", { timeZone: data.timezone });
       } catch {
-        throw new BadRequest2(`Unknown IANA timezone: '${data.timezone}'`);
+        throw new BadRequest4(`Unknown IANA timezone: '${data.timezone}'`);
       }
     }
     if (data.prompt !== void 0 && data.prompt.trim() === "") {
-      throw new BadRequest2("Schedule prompt cannot be empty.");
+      throw new BadRequest4("Schedule prompt cannot be empty.");
     }
     return context;
   };
@@ -3889,14 +4142,14 @@ function ensureScheduleRunsAsCaller(options) {
     }
     const data = context.data;
     if (data?.created_by !== void 0 && data.created_by !== schedule.created_by) {
-      throw new Forbidden7("Cannot change the user a schedule runs as.");
+      throw new Forbidden8("Cannot change the user a schedule runs as.");
     }
     const allowSuperadmin = options?.allowSuperadmin ?? true;
-    if (allowSuperadmin && hasMinimumRole7(user.role, ROLES8.SUPERADMIN)) {
+    if (allowSuperadmin && hasMinimumRole8(user.role, ROLES9.SUPERADMIN)) {
       return context;
     }
     if (schedule.created_by !== user.user_id) {
-      throw new Forbidden7(
+      throw new Forbidden8(
         "Schedules run as the user who created them. You can only modify or run schedules you created."
       );
     }
@@ -3933,6 +4186,165 @@ function recomputeNextRunAt() {
   };
 }
 
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope3 } from "@agor/core/db";
+
+// src/utils/tenant-db-scope.ts
+init_runtime_tokens();
+import {
+  resolveMultiTenancyConfig,
+  resolveTenantContext as resolveTenantContext2,
+  TenantResolutionError as TenantResolutionError2
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId as getCurrentTenantId2,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope2
+} from "@agor/core/db";
+import { NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
+import jwt3 from "jsonwebtoken";
+function readHeaderValue(headers, name) {
+  if (!headers) return null;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== wanted) continue;
+    const raw = Array.isArray(value) ? value[0] : value;
+    return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+  }
+  return null;
+}
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId2();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope2(db, tenantId, work).catch((error) => {
+          if (onError) {
+            onError(error);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
+}
+function createTenantDatabaseScopeAroundHook(options) {
+  const multiTenancy = resolveMultiTenancyConfig(options.config);
+  const bearerPayloadFromHeaders = (headers) => {
+    const authorization = readHeaderValue(headers, "authorization");
+    const match = authorization?.match(/^Bearer\s+(.+)$/i);
+    if (!match || !options.jwtSecret) return void 0;
+    try {
+      return jwt3.verify(match[1], options.jwtSecret, {
+        issuer: RUNTIME_JWT_ISSUER,
+        audience: RUNTIME_JWT_AUDIENCE
+      });
+    } catch {
+      return void 0;
+    }
+  };
+  const resolveTenantForDatabaseScope = (context) => {
+    const params = context.params;
+    const connectionTenant = params.connection?.tenant ?? params.connection?.data?.tenant;
+    const paramsWithConnectionTenant = connectionTenant && typeof connectionTenant === "object" && "tenant_id" in connectionTenant ? { ...params, tenant: params.tenant ?? connectionTenant } : params;
+    try {
+      return resolveTenantContext2(multiTenancy, {
+        params: paramsWithConnectionTenant,
+        authPayload: paramsWithConnectionTenant.authentication?.payload ?? bearerPayloadFromHeaders(paramsWithConnectionTenant.headers),
+        headers: paramsWithConnectionTenant.headers
+      });
+    } catch (error) {
+      const inheritedTenantId = getCurrentTenantId2();
+      if (error instanceof TenantResolutionError2 && inheritedTenantId) {
+        return { tenant_id: inheritedTenantId, source: "explicit" };
+      }
+      throw error;
+    }
+  };
+  return async (context, next) => {
+    try {
+      context.params.tenant = resolveTenantForDatabaseScope(context);
+    } catch (error) {
+      if (error instanceof TenantResolutionError2) {
+        throw new NotAuthenticated7(error.message);
+      }
+      throw error;
+    }
+    await runWithTenantDatabaseScope2(options.db, context.params.tenant?.tenant_id, next);
+  };
+}
+
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config) {
+  const multiTenancy = resolveMultiTenancyConfig2(config);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error) => {
+    if (onError) {
+      onError(error);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+
 // src/utils/session-task-state.ts
 import {
   isTerminalTaskStatus,
@@ -3980,7 +4392,7 @@ function validateRepoEnvPolicyHook() {
           const env = validateRepoEnvironment(item.environment);
           validateRepoEnvironmentLifecyclePolicy(env, mode);
         } catch (error) {
-          throw new BadRequest3(error instanceof Error ? error.message : "Invalid repo environment");
+          throw new BadRequest5(error instanceof Error ? error.message : "Invalid repo environment");
         }
       }
       if (Object.hasOwn(item, "environment_config") && shouldValidateRepoEnvironmentPayload(item.environment_config)) {
@@ -3988,7 +4400,7 @@ function validateRepoEnvPolicyHook() {
           const env = wrapV1AsV2(item.environment_config);
           if (env) validateRepoEnvironmentLifecyclePolicy(env, mode, "legacy repo environment");
         } catch (error) {
-          throw new BadRequest3(
+          throw new BadRequest5(
             error instanceof Error ? error.message : "Invalid legacy repo environment"
           );
         }
@@ -4030,7 +4442,7 @@ function validateBranchEnvPolicyHook() {
           app: item.app_url
         });
       } catch (error) {
-        throw new BadRequest3(error instanceof Error ? error.message : "Invalid branch environment");
+        throw new BadRequest5(error instanceof Error ? error.message : "Invalid branch environment");
       }
     }
     return context;
@@ -4057,6 +4469,10 @@ function shouldRunSessionPostTurnHooks(session) {
 function shouldDrainQueueAfterSessionPostTurnPatch(session, params) {
   return shouldRunSessionPostTurnHooks(session) && session.ready_for_prompt === true && !isTerminalQueueProcessingSuppressed(params);
 }
+function getTrustedSessionTenantId(session) {
+  const tenantId = session?.tenant_id;
+  return typeof tenantId === "string" && tenantId.length > 0 ? tenantId : void 0;
+}
 async function enrichSessionFindResultWithRemoteRelationships(result, sessionsService) {
   if (isRemoteRelationshipsEnrichedResult(result)) return result;
   if (Array.isArray(result)) {
@@ -4069,6 +4485,56 @@ async function enrichSessionFindResultWithRemoteRelationships(result, sessionsSe
     data: await sessionsService.enrichRemoteRelationships(result.data)
   });
 }
+var TENANT_OWNED_SERVICE_PATHS = [
+  "sessions",
+  "sessions/:id/mcp-servers",
+  "session-relationships",
+  "tasks",
+  "messages",
+  "boards",
+  "repos",
+  "branches",
+  "branches/:id/owners",
+  "boards/:id/owners",
+  "schedules",
+  "users",
+  "groups",
+  "group-memberships",
+  "branches/:id/group-grants",
+  "boards/:id/group-grants",
+  "app-variables",
+  "mcp-servers",
+  "mcp-servers/discover",
+  "mcp-servers/oauth-auth-headers",
+  "mcp-servers/oauth-complete",
+  "mcp-servers/oauth-disconnect",
+  "mcp-servers/oauth-refresh",
+  "mcp-servers/oauth-start",
+  "mcp-servers/oauth-status",
+  "mcp-servers/test-oauth",
+  "card-types",
+  "cards",
+  "artifacts",
+  "artifact-trust-grants",
+  "board-objects",
+  "session-mcp-servers",
+  "user-mcp-oauth-tokens",
+  "board-comments",
+  "gateway-channels",
+  "gateway",
+  "thread-session-map",
+  "gateway-outbound-messages",
+  "session-env-selections",
+  "kb/namespaces",
+  "kb/documents",
+  "kb/document-edits",
+  "kb/versions",
+  "kb/search",
+  "kb/settings",
+  "kb/indexing/status",
+  "kb/indexing/reindex",
+  "leaderboard"
+];
 function registerHooks(ctx) {
   const {
     db,
@@ -4092,6 +4558,76 @@ function registerHooks(ctx) {
       return void 0;
     }
   };
+  const multiTenancy = resolveMultiTenancyConfig4(config);
+  const tenantColumnsEnabled = resolveMultiTenancyDatabaseDialect(config) === "postgresql";
+  const executionMode = resolveExecutionSecurityMode(config);
+  const tenantOwnedServicePaths = TENANT_OWNED_SERVICE_PATHS;
+  const stampTenantData = (data, tenantId) => {
+    if (Array.isArray(data)) return data.map((item) => stampTenantData(item, tenantId));
+    if (!data || typeof data !== "object") return data;
+    return { ...data, tenant_id: tenantId };
+  };
+  const stripTenantData = (data) => {
+    if (Array.isArray(data)) return data.map(stripTenantData);
+    if (!data || typeof data !== "object") return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  };
+  const resultBelongsToTenant = (result, tenantId) => {
+    if (Array.isArray(result)) return result.every((item) => resultBelongsToTenant(item, tenantId));
+    if (!result || typeof result !== "object") return true;
+    const record = result;
+    if (Array.isArray(record.data))
+      return record.data.every((item) => resultBelongsToTenant(item, tenantId));
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenantId;
+  };
+  const tenantDatabaseScopeAround = createTenantDatabaseScopeAroundHook({
+    db,
+    config,
+    jwtSecret
+  });
+  const ensureTenantContext = async (context) => {
+    try {
+      context.params.tenant = resolveTenantContext3(multiTenancy, { params: context.params });
+      return context;
+    } catch (error) {
+      if (error instanceof TenantResolutionError3) {
+        throw new NotAuthenticated8(error.message);
+      }
+      throw error;
+    }
+  };
+  const scopeTenantBefore = async (context) => {
+    await ensureTenantContext(context);
+    const tenantId = context.params.tenant?.tenant_id;
+    if (!tenantId) return context;
+    if (context.method === "create") {
+      context.data = stampTenantData(context.data, tenantId);
+    } else if (context.method === "update" || context.method === "patch") {
+      context.data = stripTenantData(context.data);
+    }
+    return context;
+  };
+  const assertTenantAfter = async (context) => {
+    const tenantId = context.params.tenant?.tenant_id;
+    if (tenantId && !resultBelongsToTenant(context.result, tenantId)) {
+      throw new NotAuthenticated8("Tenant isolation check failed");
+    }
+    return context;
+  };
+  const registerTenantHooks = () => {
+    for (const path4 of tenantOwnedServicePaths) {
+      const service = safeService(path4);
+      if (!service) continue;
+      service.hooks({
+        around: { all: [tenantDatabaseScopeAround] },
+        before: { all: [scopeTenantBefore] },
+        after: { all: [assertTenantAfter] }
+      });
+    }
+  };
   const realtimeAccessCache = new RealtimeAccessCache({
     branchRepository,
     sessionsRepository
@@ -4114,12 +4650,21 @@ function registerHooks(ctx) {
     await invalidateRealtimeBranchAccess(context.params.route?.id);
     return context;
   };
-  const syncBranchUnixAccess = (branchId, logPrefix) => {
-    if (!jwtSecret) return;
-    const serviceToken = createServiceToken(jwtSecret, void 0, {
+  const createExecutorServiceToken = (params, scope) => {
+    if (!jwtSecret) return void 0;
+    return createServiceToken(jwtSecret, void 0, {
+      ...serviceTokenScopeForParams(params),
+      ...scope
+    });
+  };
+  const syncBranchUnixAccess = (branchId, logPrefix, params, options) => {
+    if (!executionMode.unixFsIsolationEnabled) return;
+    const serviceToken = createExecutorServiceToken(params, {
+      ...options?.scope,
       branch_id: branchId,
       command: "unix.sync-branch"
     });
+    if (!serviceToken) return;
     spawnExecutorFireAndForget(
       {
         command: "unix.sync-branch",
@@ -4127,14 +4672,16 @@ function registerHooks(ctx) {
         daemonUrl: getDaemonUrl(),
         params: {
           branchId,
-          daemonUser: config.daemon?.unix_user
+          daemonUser: config.daemon?.unix_user,
+          ...options?.delete ? { delete: true } : {}
         }
       },
       { logPrefix }
     );
   };
-  const syncUnixAccessForBoardAlignedBranches = async (boardId, logPrefix) => {
-    if (!jwtSecret || typeof boardId !== "string" || boardId.length === 0) return;
+  const syncUnixAccessForBoardAlignedBranches = async (boardId, logPrefix, params) => {
+    if (!executionMode.unixFsIsolationEnabled) return;
+    if (typeof boardId !== "string" || boardId.length === 0) return;
     const alignedBranches = await branchRepository.findBoardAlignedBranches(boardId);
     if (alignedBranches.length === 0) return;
     console.log(
@@ -4143,10 +4690,11 @@ function registerHooks(ctx) {
     for (const branch of alignedBranches) {
       await invalidateRealtimeBranchAccess(branch.branch_id);
     }
-    const serviceToken = createServiceToken(jwtSecret, void 0, {
+    const serviceToken = createExecutorServiceToken(params, {
       board_id: boardId,
       command: "unix.sync-board"
     });
+    if (!serviceToken) return;
     spawnExecutorFireAndForget(
       {
         command: "unix.sync-board",
@@ -4161,15 +4709,43 @@ function registerHooks(ctx) {
     );
   };
   const syncUnixAccessForBoardFromRoute = async (context, logPrefix) => {
-    await syncUnixAccessForBoardAlignedBranches(context.params.route?.id, logPrefix);
+    await syncUnixAccessForBoardAlignedBranches(
+      context.params.route?.id,
+      logPrefix,
+      context.params
+    );
     return context;
   };
-  const syncUnixAccessForAllBranches = async (context, logPrefix) => {
-    if (!jwtSecret) return context;
-    const branches = await branchRepository.findAll({ includeArchived: false });
-    for (const branch of branches) {
-      syncBranchUnixAccess(branch.branch_id, logPrefix);
-      await invalidateRealtimeBranchAccess(branch.branch_id);
+  const membershipGroupIdFromContext = (context) => {
+    const resultGroupId = context.result?.group_id;
+    if (typeof resultGroupId === "string" && resultGroupId.length > 0) {
+      return resultGroupId;
+    }
+    const dataGroupId = context.data?.group_id;
+    if (typeof dataGroupId === "string" && dataGroupId.length > 0) return dataGroupId;
+    const queryGroupId = context.params.query?.group_id;
+    if (typeof queryGroupId === "string" && queryGroupId.length > 0) return queryGroupId;
+    const routeGroupId = context.params.route?.groupId;
+    if (typeof routeGroupId === "string" && routeGroupId.length > 0) return routeGroupId;
+    return void 0;
+  };
+  const syncUnixAccessForGroupGrantedBranches = async (context, logPrefix) => {
+    if (!executionMode.unixFsIsolationEnabled) return context;
+    const groupId = membershipGroupIdFromContext(context);
+    if (!groupId) {
+      console.warn(
+        `[Unix Integration] Could not resolve group_id for ${context.path}.${context.method}; skipping group membership permission sync`
+      );
+      return context;
+    }
+    const branchIds = await branchRepository.findExplicitFsAccessBranchIdsForGroup(groupId);
+    if (branchIds.length === 0) return context;
+    console.log(
+      `[Unix Integration] Queueing group membership permission sync for ${branchIds.length} branch(es) granted to group ${shortId5(groupId)}`
+    );
+    for (const branchId of branchIds) {
+      syncBranchUnixAccess(branchId, logPrefix, context.params);
+      await invalidateRealtimeBranchAccess(branchId);
     }
     return context;
   };
@@ -4185,7 +4761,7 @@ function registerHooks(ctx) {
         // RBAC: Scope messages.find() to sessions the caller can access.
         // Without this backstop, any authenticated member could list messages
         // across every session/branch by omitting the session_id filter.
-        ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
+        ...branchRbacEnabled ? [scopeFindToAccessibleSessionsSql(superadminOpts)] : []
       ],
       get: [
         ...branchRbacEnabled ? [
@@ -4197,7 +4773,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create messages"),
+        requireMinimumRole(ROLES10.MEMBER, "create messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4209,7 +4785,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       patch: [
-        requireMinimumRole(ROLES9.MEMBER, "update messages"),
+        requireMinimumRole(ROLES10.MEMBER, "update messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4219,7 +4795,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       remove: [
-        requireMinimumRole(ROLES9.MEMBER, "delete messages"),
+        requireMinimumRole(ROLES10.MEMBER, "delete messages"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -4253,141 +4829,51 @@ function registerHooks(ctx) {
       ]
     }
   });
-  const boardObjectRepository = new BoardObjectRepository2(db);
   safeService("board-objects")?.hooks({
     before: {
       all: [
         typedValidateQuery(boardObjectQueryValidator),
         requireAuth,
-        requireMinimumRole(ROLES9.MEMBER, "manage board objects")
+        requireMinimumRole(ROLES10.MEMBER, "manage board objects")
       ],
-      // NOTE: We deliberately do NOT add the generic scopeFindToAccessibleBranches here.
-      // Board-objects may reference `branch_id` (branch cards) OR `card_id`
-      // (kanban cards with no branch) OR neither (zones, layout objects).
-      // That generic hook would filter out rows with null branch_id, breaking
-      // card-only boards. The RBAC find hook below uses a board-object-specific
-      // SQL query that preserves card/zone rows while scoping branch-bound ones.
-      find: [
-        ...branchRbacEnabled ? [
-          async (context) => {
-            if (!context.params.provider) return context;
-            const userId = context.params.user?.user_id;
-            const normalized = normalizeBoardObjectFindQuery(context.params.query);
-            if (!userId) {
-              context.result = {
-                total: 0,
-                limit: normalized.limit,
-                skip: normalized.skip,
-                data: []
-              };
-              return context;
-            }
-            const [total, data] = await Promise.all([
-              boardObjectRepository.countVisibleToUser(userId, normalized.filters),
-              boardObjectRepository.findVisibleToUser(
-                userId,
-                normalized.filters,
-                normalized.pagination
-              )
-            ]);
-            context.result = {
-              total,
-              limit: normalized.limit,
-              skip: normalized.skip,
-              data
-            };
-            context.params._boardObjectsRbacScoped = true;
-            return context;
-          }
-        ] : []
-      ]
-    },
-    after: {
-      find: [
-        ...branchRbacEnabled ? [
-          // Filter board-objects based on branch access permissions
-          async (context) => {
-            if (context.params._boardObjectsRbacScoped) {
-              return context;
-            }
-            if (!context.params.provider) {
-              return context;
-            }
-            const userId = context.params.user?.user_id;
-            if (!userId) {
-              context.result = {
-                total: 0,
-                limit: context.result?.limit ?? 0,
-                skip: context.result?.skip ?? 0,
-                data: []
-              };
-              return context;
-            }
-            const boardObjects = context.result?.data ?? context.result ?? [];
-            const authorizedBoardObjects = [];
-            for (const boardObject of boardObjects) {
-              if (boardObject.branch_id) {
-                const branch = await branchRepository.findById(boardObject.branch_id);
-                if (!branch) {
-                  continue;
-                }
-                const effectivePermission = await branchRepository.resolveUserPermission(
-                  branch,
-                  userId
-                );
-                const hasAccess = PERMISSION_RANK[effectivePermission] >= PERMISSION_RANK.view;
-                if (hasAccess) {
-                  authorizedBoardObjects.push(boardObject);
-                }
-              } else if (boardObject.card_id) {
-                authorizedBoardObjects.push(boardObject);
-              } else {
-                authorizedBoardObjects.push(boardObject);
-              }
-            }
-            if (context.result?.data) {
-              context.result.data = authorizedBoardObjects;
-              context.result.total = authorizedBoardObjects.length;
-            } else {
-              context.result = authorizedBoardObjects;
-            }
-            return context;
-          }
-        ] : []
-      ]
+      // Board-objects may reference a branch or may be loose board/card/layout
+      // rows. The service composes this marker into an object-specific SQL
+      // predicate: branch-bound rows require branch access; loose rows require
+      // board visibility.
+      find: [...branchRbacEnabled ? [scopeFindToAccessibleBoardsSql(superadminOpts)] : []]
     }
   });
   safeService("card-types")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create card types")],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update card types")],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete card types")]
+      create: [requireMinimumRole(ROLES10.MEMBER, "create card types")],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update card types")],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete card types")]
     }
   });
   safeService("cards")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create cards"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update cards")],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete cards")]
+      create: [requireMinimumRole(ROLES10.MEMBER, "create cards"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update cards")],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete cards")]
     }
   });
   const ensureArtifactOwnerOrAdmin = () => async (context) => {
     if (!context.params.provider) return context;
     const user = context.params?.user;
-    if (!user) throw new NotAuthenticated7("Authentication required");
+    if (!user) throw new NotAuthenticated8("Authentication required");
     if (user._isServiceAccount) return context;
-    if (hasMinimumRole8(user.role, ROLES9.ADMIN)) return context;
+    if (hasMinimumRole9(user.role, ROLES10.ADMIN)) return context;
     const artifactId = context.id;
     if (artifactId === void 0 || artifactId === null) return context;
     const artifactRepo = new ArtifactRepository(db);
     const artifact = await artifactRepo.findById(String(artifactId));
     if (!artifact) {
-      throw new Forbidden8(`Artifact ${artifactId} not found or not accessible`);
+      throw new Forbidden9(`Artifact ${artifactId} not found or not accessible`);
     }
     if (artifact.created_by && artifact.created_by === user.user_id) return context;
-    throw new Forbidden8(
+    throw new Forbidden9(
       "Only the artifact's creator or an admin may modify it. Use agor_artifacts_publish to create your own copy."
     );
   };
@@ -4396,15 +4882,14 @@ function registerHooks(ctx) {
       all: [requireAuth],
       find: [
         // RBAC: Artifacts carry a `branch_id` (nullable — survives branch deletion).
-        // Scope find() to the branches the caller can access. Rows with null
-        // branch_id (orphaned artifacts) will be excluded by the $in filter,
-        // which is the safe default — orphans can only be surfaced via explicit
-        // board-scoped queries.
-        ...branchRbacEnabled ? [scopeFindToAccessibleBranches(branchRepository, superadminOpts)] : []
+        // Scope find() to the branches the caller can access. The service pushes
+        // this into SQL as a correlated visibility predicate rather than
+        // preloading ids and injecting `branch_id IN (...)`.
+        ...branchRbacEnabled ? [scopeFindToAccessibleBranchesSql(superadminOpts)] : []
       ],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create artifacts"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update artifacts"), ensureArtifactOwnerOrAdmin()],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete artifacts"), ensureArtifactOwnerOrAdmin()]
+      create: [requireMinimumRole(ROLES10.MEMBER, "create artifacts"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update artifacts"), ensureArtifactOwnerOrAdmin()],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete artifacts"), ensureArtifactOwnerOrAdmin()]
     }
   });
   if (svcEnabled("artifacts")) {
@@ -4419,7 +4904,7 @@ function registerHooks(ctx) {
           return artifactsService.getPayload(artifactId, _params.user?.user_id);
         }
       },
-      { find: { role: ROLES9.VIEWER, action: "get artifact payload" } },
+      { find: { role: ROLES10.VIEWER, action: "get artifact payload" } },
       requireAuth
     );
     registerAuthenticatedRoute(
@@ -4446,7 +4931,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES9.MEMBER, action: "post artifact console logs" }
+        create: { role: ROLES10.MEMBER, action: "post artifact console logs" }
       },
       requireAuth
     );
@@ -4475,7 +4960,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES9.MEMBER, action: "post artifact sandpack error" }
+        create: { role: ROLES10.MEMBER, action: "post artifact sandpack error" }
       },
       requireAuth
     );
@@ -4516,7 +5001,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES9.MEMBER, action: "post artifact runtime response" }
+        create: { role: ROLES10.MEMBER, action: "post artifact runtime response" }
       },
       requireAuth
     );
@@ -4538,7 +5023,7 @@ function registerHooks(ctx) {
         }
       },
       {
-        create: { role: ROLES9.MEMBER, action: "create artifact trust grant" }
+        create: { role: ROLES10.MEMBER, action: "create artifact trust grant" }
       },
       requireAuth
     );
@@ -4562,8 +5047,8 @@ function registerHooks(ctx) {
         }
       },
       {
-        find: { role: ROLES9.VIEWER, action: "list artifact trust grants" },
-        remove: { role: ROLES9.MEMBER, action: "revoke artifact trust grant" }
+        find: { role: ROLES10.VIEWER, action: "list artifact trust grants" },
+        remove: { role: ROLES10.MEMBER, action: "revoke artifact trust grant" }
       },
       requireAuth
     );
@@ -4571,9 +5056,15 @@ function registerHooks(ctx) {
   safeService("board-comments")?.hooks({
     before: {
       all: [typedValidateQuery(boardCommentQueryValidator), requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create board comments"), injectCreatedBy()],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update board comments")],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete board comments")]
+      find: [
+        // Board comments inherit board visibility for pure board/spatial
+        // comments and branch/session/task/message visibility for attached
+        // comments. The service pushes the marker into SQL.
+        ...branchRbacEnabled ? [scopeFindToAccessibleBoardsSql(superadminOpts)] : []
+      ],
+      create: [requireMinimumRole(ROLES10.MEMBER, "create board comments"), injectCreatedBy()],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update board comments")],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete board comments")]
     }
   });
   app.service("repos").hooks({
@@ -4581,24 +5072,24 @@ function registerHooks(ctx) {
       all: [
         typedValidateQuery(repoQueryValidator),
         requireAuth,
-        requireMinimumRole(ROLES9.MEMBER, "access repositories")
+        requireMinimumRole(ROLES10.MEMBER, "access repositories")
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create repositories"),
+        requireMinimumRole(ROLES10.MEMBER, "create repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
       update: [
-        requireMinimumRole(ROLES9.MEMBER, "update repositories"),
+        requireMinimumRole(ROLES10.MEMBER, "update repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
       patch: [
-        requireMinimumRole(ROLES9.MEMBER, "update repositories"),
+        requireMinimumRole(ROLES10.MEMBER, "update repositories"),
         requireAdminForEnvConfig(),
         validateRepoEnvPolicyHook()
       ],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete repositories")]
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete repositories")]
     },
     after: {
       patch: [realignRepoOriginAfterPatchHook()]
@@ -4610,12 +5101,12 @@ function registerHooks(ctx) {
         typedValidateQuery(branchQueryValidator),
         requireAuth,
         executorRuntimeScopeGuard(),
-        requireMinimumRole(ROLES9.MEMBER, "access branches")
+        requireMinimumRole(ROLES10.MEMBER, "access branches")
       ],
       find: [
-        // RBAC: compose an accessible branch_id filter and let BranchesService.find()
-        // handle service-level filters/enrichment (including virtual zone_id).
-        ...branchRbacEnabled ? [scopeFindToAccessibleBranches(branchRepository, superadminOpts)] : []
+        // RBAC: mark external regular-user finds for BranchesService to compose
+        // the shared branch visibility predicate directly into its SQL read.
+        ...branchRbacEnabled ? [scopeFindToAccessibleBranchesSql(superadminOpts)] : []
       ],
       get: [
         ...branchRbacEnabled ? [
@@ -4625,13 +5116,13 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create branches"),
+        requireMinimumRole(ROLES10.MEMBER, "create branches"),
         requireAdminForEnvConfig(),
         validateBranchEnvPolicyHook(),
         injectCreatedBy()
       ],
       update: [
-        requireMinimumRole(ROLES9.MEMBER, "update branches"),
+        requireMinimumRole(ROLES10.MEMBER, "update branches"),
         requireAdminForEnvConfig(),
         validateBranchEnvPolicyHook()
       ],
@@ -4643,13 +5134,13 @@ function registerHooks(ctx) {
           ensureBranchPermission("all", "update branches", superadminOpts)
           // Require 'all' permission to update
         ] : [],
-        // Capture previous others_fs_access for comparison in after hook
-        ...branchRbacEnabled ? [
+        // Capture previous others_fs_access for comparison in after Unix sync hook.
+        ...executionMode.unixFsIsolationEnabled ? [
           async (context) => {
             const patchData = context.data;
             const params = context.params;
             if (Object.hasOwn(patchData, "others_fs_access") && !params._skipUnixSync) {
-              const branch = await context.service.get(context.id);
+              const branch = await context.service.get(context.id, context.params);
               params._previousOthersFsAccess = branch.others_fs_access;
             }
             return context;
@@ -4684,7 +5175,7 @@ function registerHooks(ctx) {
       ],
       patch: [
         invalidateRealtimeBranchFromResult,
-        ...branchRbacEnabled ? [
+        ...executionMode.unixFsIsolationEnabled ? [
           async (context) => {
             const params = context.params;
             if (params._skipUnixSync) {
@@ -4708,56 +5199,29 @@ function registerHooks(ctx) {
               );
               return context;
             }
-            if (jwtSecret) {
-              console.log(
-                `[Unix Integration] Syncing permissions for branch ${shortId5(branch.branch_id)} (others_fs_access: ${previousValue} -> ${branch.others_fs_access})`
-              );
-              const serviceToken = createServiceToken(jwtSecret, void 0, {
-                branch_id: branch.branch_id,
-                command: "unix.sync-branch"
-              });
-              spawnExecutorFireAndForget(
-                {
-                  command: "unix.sync-branch",
-                  sessionToken: serviceToken,
-                  daemonUrl: getDaemonUrl(),
-                  params: {
-                    branchId: branch.branch_id,
-                    daemonUser: config.daemon?.unix_user
-                  }
-                },
-                { logPrefix: "[Executor/branch.patch]" }
-              );
-            }
+            console.log(
+              `[Unix Integration] Syncing permissions for branch ${shortId5(branch.branch_id)} (others_fs_access: ${previousValue} -> ${branch.others_fs_access})`
+            );
+            syncBranchUnixAccess(
+              branch.branch_id,
+              "[Executor/branch.patch]",
+              context.params
+            );
             return context;
           }
         ] : []
       ],
       remove: [
         invalidateRealtimeBranchFromResult,
-        ...branchRbacEnabled ? [
+        ...executionMode.unixFsIsolationEnabled ? [
           async (context) => {
             const branchId = context.id;
-            if (jwtSecret) {
-              const serviceToken = createServiceToken(jwtSecret, void 0, {
-                branch_id: branchId,
-                command: "unix.sync-branch"
-              });
-              spawnExecutorFireAndForget(
-                {
-                  command: "unix.sync-branch",
-                  sessionToken: serviceToken,
-                  daemonUrl: getDaemonUrl(),
-                  params: {
-                    branchId,
-                    daemonUser: config.daemon?.unix_user,
-                    delete: true
-                    // Signal to delete the group instead of syncing
-                  }
-                },
-                { logPrefix: "[Executor/branch.remove]" }
-              );
-            }
+            syncBranchUnixAccess(
+              branchId,
+              "[Executor/branch.remove]",
+              context.params,
+              { delete: true }
+            );
             return context;
           }
         ] : []
@@ -4767,28 +5231,28 @@ function registerHooks(ctx) {
   safeService("kb/namespaces")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create knowledge namespaces")],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update knowledge namespaces")],
-      update: [requireMinimumRole(ROLES9.MEMBER, "update knowledge namespaces")],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete knowledge namespaces")],
-      saveWithAcl: [requireMinimumRole(ROLES9.MEMBER, "save knowledge namespace permissions")],
-      listAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")],
-      setAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")],
-      removeAcl: [requireMinimumRole(ROLES9.MEMBER, "manage knowledge namespace permissions")]
+      create: [requireMinimumRole(ROLES10.MEMBER, "create knowledge namespaces")],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update knowledge namespaces")],
+      update: [requireMinimumRole(ROLES10.MEMBER, "update knowledge namespaces")],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete knowledge namespaces")],
+      saveWithAcl: [requireMinimumRole(ROLES10.MEMBER, "save knowledge namespace permissions")],
+      listAcl: [requireMinimumRole(ROLES10.MEMBER, "manage knowledge namespace permissions")],
+      setAcl: [requireMinimumRole(ROLES10.MEMBER, "manage knowledge namespace permissions")],
+      removeAcl: [requireMinimumRole(ROLES10.MEMBER, "manage knowledge namespace permissions")]
     }
   });
   safeService("kb/documents")?.hooks({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create knowledge documents")],
-      patch: [requireMinimumRole(ROLES9.MEMBER, "update knowledge documents")],
-      update: [requireMinimumRole(ROLES9.MEMBER, "update knowledge documents")],
-      remove: [requireMinimumRole(ROLES9.MEMBER, "delete knowledge documents")]
+      create: [requireMinimumRole(ROLES10.MEMBER, "create knowledge documents")],
+      patch: [requireMinimumRole(ROLES10.MEMBER, "update knowledge documents")],
+      update: [requireMinimumRole(ROLES10.MEMBER, "update knowledge documents")],
+      remove: [requireMinimumRole(ROLES10.MEMBER, "delete knowledge documents")]
     }
   });
   safeService("kb/document-edits")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES9.MEMBER, "edit knowledge documents")]
+      all: [requireAuth, requireMinimumRole(ROLES10.MEMBER, "edit knowledge documents")]
     }
   });
   safeService("kb/versions")?.hooks({
@@ -4803,29 +5267,35 @@ function registerHooks(ctx) {
   });
   safeService("kb/settings")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "configure Knowledge semantic search")]
+      all: [requireAuth, requireMinimumRole(ROLES10.ADMIN, "configure Knowledge semantic search")]
     }
   });
   safeService("kb/indexing/status")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "view Knowledge indexing status")]
+      all: [requireAuth, requireMinimumRole(ROLES10.ADMIN, "view Knowledge indexing status")]
     }
   });
   safeService("kb/indexing/reindex")?.hooks({
     before: {
-      all: [requireAuth, requireMinimumRole(ROLES9.ADMIN, "reindex Knowledge embeddings")]
+      all: [requireAuth, requireMinimumRole(ROLES10.ADMIN, "reindex Knowledge embeddings")]
     }
   });
   safeService("kb/graph")?.hooks?.({
     before: {
       all: [requireAuth],
-      create: [requireMinimumRole(ROLES9.MEMBER, "link knowledge graph nodes")],
-      link: [requireMinimumRole(ROLES9.MEMBER, "link knowledge graph nodes")]
+      create: [requireMinimumRole(ROLES10.MEMBER, "link knowledge graph nodes")],
+      link: [requireMinimumRole(ROLES10.MEMBER, "link knowledge graph nodes")]
     }
   });
   const injectPerUserOAuthTokens = async (context) => {
     const queryForUserId = context.params?.query?.forUserId;
-    const userId = context.params?.user?.user_id || queryForUserId;
+    const authPayloadType = context.params?.authentication?.payload?.type;
+    const userId = resolveForUserIdWithGate({
+      queryForUserId,
+      isServiceAccount: context.params?.user?._isServiceAccount,
+      authPayloadType,
+      callerUserId: context.params?.user?.user_id
+    });
     if (!userId) {
       return context;
     }
@@ -4908,9 +5378,9 @@ function registerHooks(ctx) {
   safeService("mcp-servers")?.hooks({
     before: {
       all: [typedValidateQuery(mcpServerQueryValidator), requireAuth],
-      create: [requireMinimumRole(ROLES9.ADMIN, "create MCP servers")],
-      patch: [requireMinimumRole(ROLES9.ADMIN, "update MCP servers")],
-      remove: [requireMinimumRole(ROLES9.ADMIN, "delete MCP servers")]
+      create: [requireMinimumRole(ROLES10.ADMIN, "create MCP servers")],
+      patch: [requireMinimumRole(ROLES10.ADMIN, "update MCP servers")],
+      remove: [requireMinimumRole(ROLES10.ADMIN, "delete MCP servers")]
     },
     after: {
       find: [injectPerUserOAuthTokens, redactMCPServerSecretFields],
@@ -4924,9 +5394,9 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       find: [
-        requireMinimumRole(ROLES9.MEMBER, "list session MCP servers"),
+        requireMinimumRole(ROLES10.MEMBER, "list session MCP servers"),
         // RBAC: Scope to sessions the caller can access.
-        ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
+        ...branchRbacEnabled ? [scopeFindToAccessibleSessionsSql(superadminOpts)] : []
       ]
     },
     after: {
@@ -4937,9 +5407,9 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       find: [
-        requireMinimumRole(ROLES9.MEMBER, "list session env selections"),
-        // RBAC: Scope to sessions the caller can access.
-        ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
+        requireMinimumRole(ROLES10.MEMBER, "list session env selections")
+        // This top-level service is event-only and always returns []; do not
+        // run RBAC preloads for an intentionally empty result set.
       ]
     }
   });
@@ -4970,7 +5440,7 @@ function registerHooks(ctx) {
     before: {
       all: [requireAuth],
       create: [
-        requireMinimumRole(ROLES9.ADMIN, "create gateway channels"),
+        requireMinimumRole(ROLES10.ADMIN, "create gateway channels"),
         injectCreatedBy(),
         // Encrypt env var values at rest (same pattern as user env vars / API keys)
         async (context) => {
@@ -4988,7 +5458,7 @@ function registerHooks(ctx) {
         }
       ],
       patch: [
-        requireMinimumRole(ROLES9.ADMIN, "update gateway channels"),
+        requireMinimumRole(ROLES10.ADMIN, "update gateway channels"),
         // Resolve redacted env var sentinel values ('••••••••') back to real
         // values from the database. Uses the repository directly to bypass
         // the after-hook redaction that the service layer applies.
@@ -5000,6 +5470,7 @@ function registerHooks(ctx) {
         async (context) => {
           const data = context.data;
           if (!data || !context.id) return context;
+          if (data.agentic_config === null) return context;
           let ac = data.agentic_config;
           const hadAgenticConfigInPatch = ac !== void 0;
           const ensureAc = () => {
@@ -5009,12 +5480,12 @@ function registerHooks(ctx) {
             }
             return ac;
           };
-          const SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+          const SENTINEL = GATEWAY_REDACTED_SENTINEL;
           const incomingVars = ac?.envVars;
           if (incomingVars === void 0) {
             try {
-              const { GatewayChannelRepository } = await import("@agor/core/db");
-              const channelRepo = new GatewayChannelRepository(db);
+              const { GatewayChannelRepository: GatewayChannelRepository2 } = await import("@agor/core/db");
+              const channelRepo = new GatewayChannelRepository2(db);
               const existing = await channelRepo.findById(String(context.id));
               if (!hadAgenticConfigInPatch && existing?.agentic_config) {
                 ac = { ...existing.agentic_config };
@@ -5034,8 +5505,8 @@ function registerHooks(ctx) {
             return context;
           }
           try {
-            const { GatewayChannelRepository } = await import("@agor/core/db");
-            const channelRepo = new GatewayChannelRepository(db);
+            const { GatewayChannelRepository: GatewayChannelRepository2 } = await import("@agor/core/db");
+            const channelRepo = new GatewayChannelRepository2(db);
             const existing = await channelRepo.findById(String(context.id));
             const existingVars = existing?.agentic_config?.envVars ?? [];
             const existingByKey = new Map(existingVars.map((v) => [v.key, v.value]));
@@ -5046,14 +5517,14 @@ function registerHooks(ctx) {
               return v;
             });
           } catch (error) {
-            throw new BadRequest3(
+            throw new BadRequest5(
               `Failed to resolve redacted gateway env vars: ${error instanceof Error ? error.message : String(error)}`
             );
           }
           return context;
         }
       ],
-      remove: [requireMinimumRole(ROLES9.ADMIN, "delete gateway channels")]
+      remove: [requireMinimumRole(ROLES10.ADMIN, "delete gateway channels")]
     },
     after: {
       all: [
@@ -5062,15 +5533,9 @@ function registerHooks(ctx) {
           const redact = (channel) => {
             if (channel?.config && typeof channel.config === "object") {
               const config2 = { ...channel.config };
-              for (const field of [
-                "bot_token",
-                "app_token",
-                "signing_secret",
-                "private_key",
-                "webhook_secret"
-              ]) {
+              for (const field of GATEWAY_SENSITIVE_CONFIG_FIELDS) {
                 if (config2[field]) {
-                  config2[field] = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+                  config2[field] = GATEWAY_REDACTED_SENTINEL;
                 }
               }
               channel.config = config2;
@@ -5078,7 +5543,11 @@ function registerHooks(ctx) {
             if (channel?.agentic_config && typeof channel.agentic_config === "object") {
               const ac = channel.agentic_config;
               if (Array.isArray(ac.envVars)) {
-                ac.envVars = ac.envVars.map((v) => ({ key: v.key, value: "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022", forceOverride: v.forceOverride }));
+                ac.envVars = ac.envVars.map((v) => ({
+                  key: v.key,
+                  value: GATEWAY_REDACTED_SENTINEL,
+                  forceOverride: v.forceOverride
+                }));
               }
             }
           };
@@ -5100,12 +5569,17 @@ function registerHooks(ctx) {
       all: [requireAuth]
     }
   });
+  safeService("admin/local-actions")?.hooks({
+    before: {
+      create: [requireAuth, requireMinimumRole(ROLES10.ADMIN, "run local admin actions")]
+    }
+  });
   app.service("config").hooks({
     before: {
       all: [requireAuth],
-      find: [requireMinimumRole(ROLES9.ADMIN, "view configuration")],
-      get: [requireMinimumRole(ROLES9.ADMIN, "view configuration")],
-      patch: [requireMinimumRole(ROLES9.ADMIN, "update configuration")]
+      find: [requireMinimumRole(ROLES10.ADMIN, "view configuration")],
+      get: [requireMinimumRole(ROLES10.ADMIN, "view configuration")],
+      patch: [requireMinimumRole(ROLES10.ADMIN, "update configuration")]
     }
   });
   safeService("context")?.hooks({
@@ -5117,7 +5591,7 @@ function registerHooks(ctx) {
     before: {
       all: [
         requireAuth,
-        requireMinimumRole(ROLES9.MEMBER, "search files"),
+        requireMinimumRole(ROLES10.MEMBER, "search files"),
         // RBAC: files service takes a sessionId query param and returns files
         // from that session's branch. Verify the caller can at least 'view'
         // that branch before running git ls-files. If sessionId is missing
@@ -5144,7 +5618,7 @@ function registerHooks(ctx) {
     before: {
       all: [
         requireAuth,
-        requireMinimumRole(ROLES9.MEMBER, "read files"),
+        requireMinimumRole(ROLES10.MEMBER, "read files"),
         ...branchRbacEnabled ? [loadBranch(branchRepository, "branch_id"), ensureCanView(superadminOpts)] : []
       ]
     }
@@ -5156,13 +5630,13 @@ function registerHooks(ctx) {
         requireAuth,
         (context) => {
           if (!webTerminalEnabled) {
-            throw new Forbidden8(
+            throw new Forbidden9(
               "Web terminal is disabled on this instance. Ask an administrator to unset or enable execution.allow_web_terminal in the daemon config."
             );
           }
           return context;
         },
-        requireMinimumRole(ROLES9.MEMBER, "access terminals")
+        requireMinimumRole(ROLES10.MEMBER, "access terminals")
       ]
     }
   });
@@ -5178,11 +5652,11 @@ function registerHooks(ctx) {
     after: {
       create: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.create]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.create]")
       ],
       remove: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.remove]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.remove]")
       ]
     }
   });
@@ -5199,7 +5673,11 @@ function registerHooks(ctx) {
         (context) => {
           const branchId = context.params.route?.id;
           if (typeof branchId === "string") {
-            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.create]");
+            syncBranchUnixAccess(
+              branchId,
+              "[Executor/branch-group-grants.create]",
+              context.params
+            );
           }
           return context;
         }
@@ -5209,7 +5687,11 @@ function registerHooks(ctx) {
         (context) => {
           const branchId = context.params.route?.id;
           if (typeof branchId === "string") {
-            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.patch]");
+            syncBranchUnixAccess(
+              branchId,
+              "[Executor/branch-group-grants.patch]",
+              context.params
+            );
           }
           return context;
         }
@@ -5219,7 +5701,11 @@ function registerHooks(ctx) {
         (context) => {
           const branchId = context.params.route?.id;
           if (typeof branchId === "string") {
-            syncBranchUnixAccess(branchId, "[Executor/branch-group-grants.remove]");
+            syncBranchUnixAccess(
+              branchId,
+              "[Executor/branch-group-grants.remove]",
+              context.params
+            );
           }
           return context;
         }
@@ -5264,7 +5750,7 @@ function registerHooks(ctx) {
             return context;
           }
           if (params.user) {
-            ensureMinimumRole(params, ROLES9.MEMBER, "list users");
+            ensureMinimumRole(params, ROLES10.MEMBER, "list users");
             return context;
           }
           const query = params.query || {};
@@ -5272,12 +5758,12 @@ function registerHooks(ctx) {
             params.query = { ...query, $limit: 1 };
             return context;
           }
-          throw new NotAuthenticated7("Authentication required");
+          throw new NotAuthenticated8("Authentication required");
         }
       ],
       get: [
         (context) => {
-          ensureMinimumRole(context.params, ROLES9.MEMBER, "view users");
+          ensureMinimumRole(context.params, ROLES10.MEMBER, "view users");
           return context;
         }
       ],
@@ -5289,13 +5775,13 @@ function registerHooks(ctx) {
           }
           const existing = await usersService.find({ query: { $limit: 1 } });
           if (existing.total > 0) {
-            ensureMinimumRole(params, ROLES9.ADMIN, "create users");
+            ensureMinimumRole(params, ROLES10.ADMIN, "create users");
           }
           const data = context.data;
-          if (hasMinimumRole8(data?.role, ROLES9.SUPERADMIN)) {
+          if (hasMinimumRole9(data?.role, ROLES10.SUPERADMIN)) {
             const callerRole = params.user?.role;
-            if (!hasMinimumRole8(callerRole, ROLES9.SUPERADMIN)) {
-              throw new Forbidden8("Only superadmins can create superadmin users");
+            if (!hasMinimumRole9(callerRole, ROLES10.SUPERADMIN)) {
+              throw new Forbidden9("Only superadmins can create superadmin users");
             }
           }
           return context;
@@ -5306,28 +5792,28 @@ function registerHooks(ctx) {
           const params = context.params;
           const userId = context.id;
           const callerRole = params.user?.role;
-          const callerIsAdmin = hasMinimumRole8(callerRole, ROLES9.ADMIN);
+          const callerIsAdmin = hasMinimumRole9(callerRole, ROLES10.ADMIN);
           if (!Array.isArray(context.data)) {
             if (context.data?.unix_username !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden8("Only admins can modify unix_username");
+                throw new Forbidden9("Only admins can modify unix_username");
               }
             }
             if (context.data?.role !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden8("Only admins can modify user roles");
+                throw new Forbidden9("Only admins can modify user roles");
               }
-              if (hasMinimumRole8(context.data.role, ROLES9.SUPERADMIN) && !hasMinimumRole8(callerRole, ROLES9.SUPERADMIN)) {
+              if (hasMinimumRole9(context.data.role, ROLES10.SUPERADMIN) && !hasMinimumRole9(callerRole, ROLES10.SUPERADMIN)) {
                 const allUsers = await usersService.find({});
-                const hasSuperadmin = allUsers.data.some((u) => u.role === ROLES9.SUPERADMIN);
+                const hasSuperadmin = allUsers.data.some((u) => u.role === ROLES10.SUPERADMIN);
                 if (hasSuperadmin) {
-                  throw new Forbidden8("Only superadmins can assign the superadmin role");
+                  throw new Forbidden9("Only superadmins can assign the superadmin role");
                 }
               }
             }
             if (context.data?.must_change_password !== void 0) {
               if (!callerIsAdmin) {
-                throw new Forbidden8("Only admins can force password changes");
+                throw new Forbidden9("Only admins can force password changes");
               }
             }
           }
@@ -5340,22 +5826,22 @@ function registerHooks(ctx) {
           if (!context.params.provider && params.trustedEnvVarWrite === true) {
             const keys = Object.keys(context.data ?? {});
             if (!keys.every((k) => k === "env_vars" || k === "env_var_scopes")) {
-              throw new Forbidden8(
+              throw new Forbidden9(
                 "trustedEnvVarWrite only permits env_vars and env_var_scopes updates"
               );
             }
             return context;
           }
-          throw new Forbidden8("You can only update your own profile");
+          throw new Forbidden9("You can only update your own profile");
         }
       ],
-      remove: [requireMinimumRole(ROLES9.ADMIN, "delete users")]
+      remove: [requireMinimumRole(ROLES10.ADMIN, "delete users")]
     },
     after: {
       // After user create/patch: optionally ensure Unix user exists and sync password
       create: [
         async (context) => {
-          if (!jwtSecret) {
+          if (!executionMode.unixImpersonationEnabled || !jwtSecret) {
             return context;
           }
           const user = context.result;
@@ -5368,10 +5854,14 @@ function registerHooks(ctx) {
             return context;
           }
           console.log(`[Unix Integration] Syncing Unix user for: ${user.unix_username}`);
-          const serviceToken = createServiceToken(jwtSecret, void 0, {
-            user_id: user.user_id,
-            command: "unix.sync-user"
-          });
+          const serviceToken = createExecutorServiceToken(
+            context.params,
+            {
+              user_id: user.user_id,
+              command: "unix.sync-user"
+            }
+          );
+          if (!serviceToken) return context;
           spawnExecutorFireAndForget(
             {
               command: "unix.sync-user",
@@ -5388,11 +5878,27 @@ function registerHooks(ctx) {
             { logPrefix: "[Executor/user.create]" }
           );
           return context;
+        },
+        async (context) => {
+          if (context.params.skipAvatarRefresh) {
+            return context;
+          }
+          const user = context.result;
+          const avatarService = safeService("users");
+          if (avatarService?.refreshAvatarFromSettings) {
+            avatarService.refreshAvatarFromSettings(user.user_id).catch((error) => {
+              console.warn(
+                `[users/avatar-sync] Failed to refresh avatar for new user ${shortId5(user.user_id)}:`,
+                error instanceof Error ? error.message : String(error)
+              );
+            });
+          }
+          return context;
         }
       ],
       patch: [
         async (context) => {
-          if (!jwtSecret) {
+          if (!executionMode.unixImpersonationEnabled || !jwtSecret) {
             return context;
           }
           const data = context.data;
@@ -5408,10 +5914,14 @@ function registerHooks(ctx) {
             return context;
           }
           console.log(`[Unix Integration] Syncing Unix user for: ${user.unix_username}`);
-          const serviceToken = createServiceToken(jwtSecret, void 0, {
-            user_id: user.user_id,
-            command: "unix.sync-user"
-          });
+          const serviceToken = createExecutorServiceToken(
+            context.params,
+            {
+              user_id: user.user_id,
+              command: "unix.sync-user"
+            }
+          );
+          if (!serviceToken) return context;
           spawnExecutorFireAndForget(
             {
               command: "unix.sync-user",
@@ -5428,6 +5938,26 @@ function registerHooks(ctx) {
             { logPrefix: "[Executor/user.patch]" }
           );
           return context;
+        },
+        async (context) => {
+          if (context.params.skipAvatarRefresh) {
+            return context;
+          }
+          const data = context.data;
+          if (data?.email === void 0 && data?.preferences === void 0) {
+            return context;
+          }
+          const user = context.result;
+          const avatarService = safeService("users");
+          if (avatarService?.refreshAvatarFromSettings) {
+            avatarService.refreshAvatarFromSettings(user.user_id).catch((error) => {
+              console.warn(
+                `[users/avatar-sync] Failed to refresh avatar for updated user ${shortId5(user.user_id)}:`,
+                error instanceof Error ? error.message : String(error)
+              );
+            });
+          }
+          return context;
         }
       ]
     }
@@ -5438,14 +5968,16 @@ function registerHooks(ctx) {
     branchRepository,
     sessionsRepository,
     accessCache: realtimeAccessCache,
-    allowSuperadmin: superadminOpts.allowSuperadmin
+    allowSuperadmin: superadminOpts.allowSuperadmin,
+    multiTenancy
   });
   app.service("sessions").hooks({
     before: {
       all: [typedValidateQuery(sessionQueryValidator), requireAuth, executorRuntimeScopeGuard()],
       find: [
-        // RBAC: Optimized SQL-based filtering (single query with JOIN on branches, no N+1)
-        ...branchRbacEnabled ? [scopeSessionQuery(sessionsRepository, superadminOpts)] : []
+        // RBAC: mark external regular-user finds for SessionsService to compose
+        // the shared branch visibility predicate directly into its SQL read.
+        ...branchRbacEnabled ? [scopeFindToAccessibleSessionsSql(superadminOpts)] : []
       ],
       get: [
         ...branchRbacEnabled ? [
@@ -5456,7 +5988,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create sessions"),
+        requireMinimumRole(ROLES10.MEMBER, "create sessions"),
         ...branchRbacEnabled ? [
           setSessionUnixUsername(usersRepository),
           // Stamp session with creator's unix_username (MUST run first)
@@ -5467,7 +5999,7 @@ function registerHooks(ctx) {
               try {
                 const branch = await branchRepository.findById(data.branch_id);
                 if (!branch) {
-                  throw new Forbidden8(`Branch not found: ${data.branch_id}`);
+                  throw new Forbidden9(`Branch not found: ${data.branch_id}`);
                 }
                 await cacheBranchAccess(context.params, branchRepository, branch);
               } catch (error) {
@@ -5513,7 +6045,10 @@ function registerHooks(ctx) {
                           db,
                           context.params.user?.user_id
                         ),
-                        logPrefix: `[sessions.create ${branch.name}]`
+                        logPrefix: `[sessions.create ${branch.name}]`,
+                        serviceTokenScope: serviceTokenScopeForParams(
+                          context.params
+                        )
                       }
                     );
                     context.data.git_state = {
@@ -5535,7 +6070,7 @@ function registerHooks(ctx) {
             }
           }
           const cbConfig = context.data?.callback_config;
-          if (cbConfig?.callback_session_id) {
+          if (cbConfig?.callback_session_id && context.params.provider) {
             const authenticatedUserId = context.params.user?.user_id || "unknown";
             await ensureCanPromptTargetSession(
               cbConfig.callback_session_id,
@@ -5574,10 +6109,13 @@ function registerHooks(ctx) {
             )(context);
           }
         ] : [],
-        // Validate user has prompt permission on callback target session's branch
+        // Validate user has prompt permission on callback target session's branch.
+        // Skip for internal calls (no provider) — patches from dispatchCompletionCallbacks
+        // spread the existing callback_config (which includes callback_session_id) and must
+        // not be blocked by this check.
         async (context) => {
           const patchCbConfig = context.data?.callback_config;
-          if (patchCbConfig?.callback_session_id) {
+          if (patchCbConfig?.callback_session_id && context.params.provider) {
             const userId = context.params.user?.user_id || "unknown";
             await ensureCanPromptTargetSession(
               patchCbConfig.callback_session_id,
@@ -5618,13 +6156,15 @@ function registerHooks(ctx) {
           const callerUser = context.params.user;
           if (!canReceiveMcpTokenForSession({
             callerUserId: callerUser?.user_id,
-            callerRole: callerUser?.role,
-            sessionCreatedBy: session.created_by
+            callerRole: callerUser?.role
           })) {
             return context;
           }
           const { generateSessionToken: generateSessionToken3 } = await Promise.resolve().then(() => (init_tokens(), tokens_exports));
-          const userId = session.created_by || "unknown";
+          const userId = callerUser?.user_id;
+          if (!userId) {
+            return context;
+          }
           const jwtSecret2 = app.settings.authentication?.secret;
           if (!jwtSecret2) {
             console.error("\u274C JWT secret not configured - cannot generate MCP token");
@@ -5675,13 +6215,19 @@ function registerHooks(ctx) {
           if (config.daemon?.mcpEnabled === false) {
             return context;
           }
-          const callerRole = context.params.user?.role;
-          if (!hasMinimumRole8(callerRole, ROLES9.MEMBER)) {
+          const callerUser = context.params.user;
+          if (!canReceiveMcpTokenForSession({
+            callerUserId: callerUser?.user_id,
+            callerRole: callerUser?.role
+          })) {
             return context;
           }
           const { generateSessionToken: generateSessionToken3 } = await Promise.resolve().then(() => (init_tokens(), tokens_exports));
           const session = context.result;
-          const userId = session.created_by || "unknown";
+          const userId = callerUser?.user_id;
+          if (!userId) {
+            return context;
+          }
           const jwtSecret2 = app.settings.authentication?.secret;
           if (!jwtSecret2) {
             console.error("\u274C JWT secret not configured - cannot generate MCP token");
@@ -5702,7 +6248,7 @@ function registerHooks(ctx) {
         // unix groups. Without this, non-owners can't access the .git/ directory
         // (which uses 2770 = no others access) even if the branch directory itself
         // allows "others" access via ACLs.
-        ...branchRbacEnabled ? [
+        ...executionMode.unixFsIsolationEnabled ? [
           async (context) => {
             const session = context.result;
             if (!session.branch_id || !session.unix_username) {
@@ -5717,28 +6263,15 @@ function registerHooks(ctx) {
               if (!branch?.others_fs_access || branch.others_fs_access === "none") {
                 return context;
               }
-              if (jwtSecret) {
-                console.log(
-                  `[Unix Integration] Non-owner session created in branch ${shortId5(session.branch_id)} by ${session.unix_username} (others_fs_access: ${branch.others_fs_access}), syncing group membership`
-                );
-                const serviceToken = createServiceToken(jwtSecret, void 0, {
-                  branch_id: branch.branch_id,
-                  session_id: session.session_id,
-                  command: "unix.sync-branch"
-                });
-                spawnExecutorFireAndForget(
-                  {
-                    command: "unix.sync-branch",
-                    sessionToken: serviceToken,
-                    daemonUrl: getDaemonUrl(),
-                    params: {
-                      branchId: session.branch_id,
-                      daemonUser: config.daemon?.unix_user
-                    }
-                  },
-                  { logPrefix: "[Executor/session.create.unix-group]" }
-                );
-              }
+              console.log(
+                `[Unix Integration] Non-owner session created in branch ${shortId5(session.branch_id)} by ${session.unix_username} (others_fs_access: ${branch.others_fs_access}), syncing group membership`
+              );
+              syncBranchUnixAccess(
+                branch.branch_id,
+                "[Executor/session.create.unix-group]",
+                context.params,
+                { scope: { session_id: session.session_id } }
+              );
             } catch (error) {
               console.error(
                 `[Unix Integration] Failed to trigger group sync for session ${shortId5(session.session_id)}:`,
@@ -5753,7 +6286,7 @@ function registerHooks(ctx) {
         async (context) => {
           const session = Array.isArray(context.result) ? context.result[0] : context.result;
           if (session && shouldRunSessionPostTurnHooks(session)) {
-            setImmediate(async () => {
+            deferWithTenantDatabaseScope(db, context.params, async () => {
               try {
                 const gatewayService = context.app.service("gateway");
                 await gatewayService.flushGitHubBuffer(session.session_id);
@@ -5769,19 +6302,33 @@ function registerHooks(ctx) {
               }
             });
             if (shouldDrainQueueAfterSessionPostTurnPatch(session, context.params)) {
-              setImmediate(async () => {
-                try {
+              const sessionTenantId = getTrustedSessionTenantId(session);
+              deferWithSessionQueueTenantScope(
+                {
+                  db,
+                  config,
+                  sessionId: session.session_id,
+                  params: context.params,
+                  tenantIdHint: sessionTenantId,
+                  label: "SessionsService.after.patch queue drain"
+                },
+                async (queueParams) => {
                   console.log(
                     `\u{1F504} [SessionsService.after.patch] Session ${shortId5(session.session_id)} became promptable (${session.status}), checking for queued tasks...`
                   );
-                  await sessionsService.triggerQueueProcessing(session.session_id, context.params);
-                } catch (error) {
+                  await sessionsService.triggerQueueProcessing(session.session_id, queueParams);
+                },
+                (error) => {
                   console.error(
                     `\u274C [SessionsService.after.patch] Failed to process queue for session ${shortId5(session.session_id)}:`,
                     error
                   );
                 }
-              });
+              );
+            } else {
+              console.log(
+                `\u23ED\uFE0F  [SessionsService.after.patch] Queue drain suppressed for session ${shortId5(session.session_id)} (suppressTerminalQueueProcessing or not ready)`
+              );
             }
           }
           return context;
@@ -5810,14 +6357,14 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create schedules"),
+        requireMinimumRole(ROLES10.MEMBER, "create schedules"),
         ...branchRbacEnabled ? [loadBranch(branchRepository, "branch_id"), ensureCanCreateSession(superadminOpts)] : [],
         injectCreatedBy(),
         validateScheduleConfig(),
         recomputeNextRunAt()
       ],
       patch: [
-        requireMinimumRole(ROLES9.MEMBER, "update schedules"),
+        requireMinimumRole(ROLES10.MEMBER, "update schedules"),
         ...branchRbacEnabled ? [
           loadScheduleAndBranch(scheduleRepository, branchRepository),
           ensureCanModifySchedule(superadminOpts)
@@ -5832,7 +6379,7 @@ function registerHooks(ctx) {
         recomputeNextRunAt()
       ],
       remove: [
-        requireMinimumRole(ROLES9.MEMBER, "delete schedules"),
+        requireMinimumRole(ROLES10.MEMBER, "delete schedules"),
         ...branchRbacEnabled ? [
           loadScheduleAndBranch(scheduleRepository, branchRepository),
           ensureBranchPermission("all", "delete schedule", superadminOpts)
@@ -5845,7 +6392,7 @@ function registerHooks(ctx) {
       all: [typedValidateQuery(taskQueryValidator), requireAuth, executorRuntimeScopeGuard()],
       find: [
         // RBAC: Scope tasks.find() to sessions the caller can access.
-        ...branchRbacEnabled ? [scopeFindToAccessibleSessions(sessionsRepository, superadminOpts)] : []
+        ...branchRbacEnabled ? [scopeFindToAccessibleSessionsSql(superadminOpts)] : []
       ],
       get: [
         ...branchRbacEnabled ? [
@@ -5857,7 +6404,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       create: [
-        requireMinimumRole(ROLES9.MEMBER, "create tasks"),
+        requireMinimumRole(ROLES10.MEMBER, "create tasks"),
         ...branchRbacEnabled ? [
           resolveSessionContext(),
           loadSession(sessionsService),
@@ -5879,7 +6426,7 @@ function registerHooks(ctx) {
         ] : []
       ],
       remove: [
-        requireMinimumRole(ROLES9.MEMBER, "delete tasks"),
+        requireMinimumRole(ROLES10.MEMBER, "delete tasks"),
         // RBAC: deleting a task requires 'all' permission on the branch
         // (mirrors sessions.remove). Without this, any member with 'session'
         // access could delete tasks owned by other users on shared branches.
@@ -5897,21 +6444,21 @@ function registerHooks(ctx) {
     return async (context) => {
       if (!branchRbacEnabled || !context.params.provider) return context;
       const user = context.params.user;
-      if (!user) throw new NotAuthenticated7("Authentication required");
+      if (!user) throw new NotAuthenticated8("Authentication required");
       if (user._isServiceAccount) return context;
       const allowSuperadmin = superadminOpts?.allowSuperadmin ?? true;
-      if (user.role === ROLES9.ADMIN || allowSuperadmin && user.role === ROLES9.SUPERADMIN) {
+      if (user.role === ROLES10.ADMIN || allowSuperadmin && user.role === ROLES10.SUPERADMIN) {
         return context;
       }
       const args = context.arguments;
       const firstArg = args?.[0];
       const id = typeof context.id === "string" ? context.id : typeof context.params.route?.id === "string" ? context.params.route.id : typeof firstArg === "string" ? firstArg : firstArg && typeof firstArg === "object" ? firstArg.boardId ?? firstArg.id ?? firstArg.slug : void 0;
-      if (!id) throw new BadRequest3("Board ID is required");
+      if (!id) throw new BadRequest5("Board ID is required");
       const board = await boardRepository.findBySlugOrId(id);
-      if (!board) throw new Forbidden8(`Board not found: ${id}`);
+      if (!board) throw new Forbidden9(`Board not found: ${id}`);
       const allowed = mode === "view" ? await boardRepository.canView(board.board_id, user.user_id) : await boardRepository.canMutate(board.board_id, user.user_id);
       if (!allowed) {
-        throw new Forbidden8(
+        throw new Forbidden9(
           mode === "view" ? `You need board access to ${action}` : `You need board owner or board group 'all' access to ${action}`
         );
       }
@@ -5925,16 +6472,16 @@ function registerHooks(ctx) {
       all: [typedValidateQuery(boardQueryValidator), requireAuth],
       find: [
         // RBAC: restrict boards.find to boards the caller created or has a
-        // branch on. Runs at the SQL layer via BoardRepository.findVisibleBoardIds
-        // to avoid hydrating every accessible branch in-memory.
-        ...branchRbacEnabled ? [scopeFindToAccessibleBoards(boardRepository, superadminOpts)] : []
+        // branch on. The service pushes this into the repository query as one
+        // SQL predicate, avoiding a preloaded `board_id IN (...)` list.
+        ...branchRbacEnabled ? [scopeFindToAccessibleBoardsSql(superadminOpts)] : []
       ],
       get: [ensureCanViewBoard("view this board")],
       findBySlug: [ensureCanViewBoard("view this board")],
       findBySlugOrId: [ensureCanViewBoard("view this board")],
-      create: [requireMinimumRole(ROLES9.MEMBER, "create boards"), injectCreatedBy()],
+      create: [requireMinimumRole(ROLES10.MEMBER, "create boards"), injectCreatedBy()],
       patch: [
-        requireMinimumRole(ROLES9.MEMBER, "update boards"),
+        requireMinimumRole(ROLES10.MEMBER, "update boards"),
         ensureCanMutateBoard("update this board"),
         async (context) => {
           const contextData = context.data || {};
@@ -5986,6 +6533,17 @@ function registerHooks(ctx) {
             context.dispatch = result;
             return context;
           }
+          if (_action === "mergeObjectFields" && objects) {
+            if (!context.id) throw new Error("Board ID required");
+            const result = await boardsService.mergeBoardObjectFields(
+              context.id,
+              objects
+            );
+            context.result = result;
+            app.service("boards").emit("patched", result);
+            context.dispatch = result;
+            return context;
+          }
           if (_action === "deleteZone" && objectId) {
             if (!context.id) throw new Error("Board ID required");
             const result = await boardsService.deleteZone(
@@ -6001,30 +6559,30 @@ function registerHooks(ctx) {
         }
       ],
       remove: [
-        requireMinimumRole(ROLES9.MEMBER, "delete boards"),
+        requireMinimumRole(ROLES10.MEMBER, "delete boards"),
         ensureCanMutateBoard("delete this board")
       ],
       toBlob: [
-        requireMinimumRole(ROLES9.MEMBER, "export boards"),
+        requireMinimumRole(ROLES10.MEMBER, "export boards"),
         ensureCanViewBoard("export boards")
       ],
       toYaml: [
-        requireMinimumRole(ROLES9.MEMBER, "export boards"),
+        requireMinimumRole(ROLES10.MEMBER, "export boards"),
         ensureCanViewBoard("export boards")
       ],
-      fromBlob: [requireMinimumRole(ROLES9.MEMBER, "import boards")],
-      fromYaml: [requireMinimumRole(ROLES9.MEMBER, "import boards")],
-      clone: [requireMinimumRole(ROLES9.MEMBER, "clone boards"), ensureCanViewBoard("clone boards")],
+      fromBlob: [requireMinimumRole(ROLES10.MEMBER, "import boards")],
+      fromYaml: [requireMinimumRole(ROLES10.MEMBER, "import boards")],
+      clone: [requireMinimumRole(ROLES10.MEMBER, "clone boards"), ensureCanViewBoard("clone boards")],
       setPrimaryAssistant: [
-        requireMinimumRole(ROLES9.MEMBER, "set primary assistant"),
+        requireMinimumRole(ROLES10.MEMBER, "set primary assistant"),
         ensureCanMutateBoard("set primary assistant")
       ],
       clearPrimaryAssistant: [
-        requireMinimumRole(ROLES9.MEMBER, "clear primary assistant"),
+        requireMinimumRole(ROLES10.MEMBER, "clear primary assistant"),
         ensureCanMutateBoard("clear primary assistant")
       ],
       ensureAssistantWelcomeNote: [
-        requireMinimumRole(ROLES9.MEMBER, "create assistant welcome note"),
+        requireMinimumRole(ROLES10.MEMBER, "create assistant welcome note"),
         ensureCanMutateBoard("create assistant welcome note")
       ]
     },
@@ -6165,7 +6723,7 @@ function registerHooks(ctx) {
       before: {
         create: [
           requireAuth,
-          requireMinimumRole(ROLES9.MEMBER, "archive boards"),
+          requireMinimumRole(ROLES10.MEMBER, "archive boards"),
           ensureCanMutateBoard("archive this board")
         ]
       },
@@ -6182,17 +6740,22 @@ function registerHooks(ctx) {
       before: {
         create: [
           requireAuth,
-          requireMinimumRole(ROLES9.MEMBER, "unarchive boards"),
+          requireMinimumRole(ROLES10.MEMBER, "unarchive boards"),
           ensureCanMutateBoard("unarchive this board")
         ]
       },
       after: { create: [clearRealtimeBranchVisibility] }
     });
   }
+  if (tenantColumnsEnabled) {
+    registerTenantHooks();
+  }
 }
 export {
   PROMPT_FLOW_PATCH_FIELDS,
+  TENANT_OWNED_SERVICE_PATHS,
   enrichSessionFindResultWithRemoteRelationships,
+  getTrustedSessionTenantId,
   isPromptFlowPatchOnly,
   registerHooks,
   shouldDrainQueueAfterSessionPostTurnPatch,