agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/config.d.ts

@@ -5,8 +5,8 @@
  * Wraps @agor/core/config functions for UI access.
  */
 import { type AgorConfig } from '@agor/core/config';
-import type { Database } from '@agor/core/db';
-import type { Application } from '@agor/core/feathers';
+import type { TenantScopeAwareDatabase } from '@agor/core/db';
+import { type Application } from '@agor/core/feathers';
 import { type AgenticToolName, type Params, type TaskID } from '@agor/core/types';
 /**
  * Config service class
@@ -15,7 +15,7 @@ export declare class ConfigService {
     private db;
     /** App reference injected after registration for cross-service calls */
     app?: Application;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Get full config (masked)
      */
@@ -41,6 +41,14 @@ export declare class ConfigService {
          * sweep (legacy behavior preserved for non-SDK callers).
          */
         tool?: AgenticToolName;
+        /**
+         * Explicit task-scoped executor JWT proof. The Socket.io connection can
+         * authenticate as the session creator user while dropping custom JWT
+         * claims from later service params, so executors include the minted token
+         * on this secret-resolution call and the daemon validates it against the
+         * in-memory session-token registry.
+         */
+        executorSessionToken?: string;
     }, params?: Params): Promise<{
         apiKey: string | null;
         source: 'user' | 'config' | 'env' | 'native';
@@ -57,5 +65,5 @@ export declare class ConfigService {
 /**
  * Service factory function
  */
-export declare function createConfigService(db: Database): ConfigService;
+export declare function createConfigService(db: TenantScopeAwareDatabase): ConfigService;
 //# sourceMappingURL=config.d.ts.map

package/dist/daemon/services/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/services/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,UAAU,EAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,MAAM,EACX,KAAK,MAAM,EAGZ,MAAM,kBAAkB,CAAC;AA0D1B;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAAW;IACrB,wEAAwE;IACxE,GAAG,CAAC,EAAE,WAAW,CAAC;gBAEN,EAAE,EAAE,QAAQ;IAIxB;;OAEG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKjD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBzD;;;;;;;OAOG;IACG,aAAa,CACjB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB;;;;WAIG;QACH,IAAI,CAAC,EAAE,eAAe,CAAC;KACxB,EACD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC7C,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IAyFF;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAiFzF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,QAAQ,GAAG,aAAa,CAE/D"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/services/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EACL,KAAK,UAAU,EAKhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,KAAK,WAAW,EAA2C,MAAM,qBAAqB,CAAC;AAChG,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,MAAM,EACX,KAAK,MAAM,EAGZ,MAAM,kBAAkB,CAAC;AAiG1B;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAA2B;IACrC,wEAAwE;IACxE,GAAG,CAAC,EAAE,WAAW,CAAC;gBAEN,EAAE,EAAE,wBAAwB;IAIxC;;OAEG;IACG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAKjD;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmBzD;;;;;;;OAOG;IACG,aAAa,CACjB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB;;;;WAIG;QACH,IAAI,CAAC,EAAE,eAAe,CAAC;QACvB;;;;;;WAMG;QACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;KAC/B,EACD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QACT,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,MAAM,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;QAC7C,aAAa,EAAE,OAAO,CAAC;QACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;KAC5B,CAAC;IA0GF;;;;OAIG;IACG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAiFzF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,wBAAwB,GAAG,aAAa,CAE/E"}

package/dist/daemon/services/config.js

@@ -8,6 +8,7 @@ import { BadRequest, Forbidden, NotAuthenticated } from "@agor/core/feathers";
 import {
   TOOL_API_KEY_NAMES
 } from "@agor/core/types";
+import jwt from "jsonwebtoken";
 var RESOLVABLE_API_KEY_NAMES = {
   ANTHROPIC_API_KEY: true,
   ANTHROPIC_AUTH_TOKEN: true,
@@ -21,8 +22,30 @@ function isResolvableApiKeyName(value) {
   return Object.hasOwn(RESOLVABLE_API_KEY_NAMES, value);
 }
 function getExecutorTokenPayload(params) {
-  const payload = params?.authentication?.payload;
-  return payload?.type === "executor-session" && payload.purpose === "executor-task" ? payload : void 0;
+  const authParams = params;
+  const payload = authParams?.authentication?.payload;
+  if (payload?.type === "executor-session" && payload.purpose === "executor-task") {
+    return payload;
+  }
+  const accessToken = params?.authentication?.accessToken;
+  if (typeof accessToken === "string") {
+    const decoded = jwt.decode(accessToken);
+    if (decoded?.type === "executor-session" && decoded.purpose === "executor-task") {
+      return decoded;
+    }
+  }
+  if (authParams?.authentication?.strategy === "jwt" && authParams.task_id) {
+    const scopedParams = params;
+    return {
+      type: "executor-session",
+      purpose: "executor-task",
+      task_id: authParams.task_id,
+      session_id: scopedParams?.session_id,
+      sessionId: scopedParams?.sessionId,
+      branch_id: scopedParams?.branch_id
+    };
+  }
+  return void 0;
 }
 function maskApiKey(key) {
   if (!key || typeof key !== "string") return void 0;
@@ -86,7 +109,20 @@ var ConfigService = class {
     if (!isResolvableApiKeyName(keyName)) {
       throw new BadRequest("Unsupported API key name");
     }
-    const executorPayload = getExecutorTokenPayload(params);
+    let executorPayload = getExecutorTokenPayload(params);
+    if (!executorPayload && params?.provider && data.executorSessionToken) {
+      const sessionTokenService = this.app?.sessionTokenService;
+      const sessionInfo = await sessionTokenService?.validateToken(data.executorSessionToken, {
+        taskId
+      });
+      if (sessionInfo?.task_id === taskId) {
+        executorPayload = {
+          type: "executor-session",
+          purpose: "executor-task",
+          task_id: sessionInfo.task_id
+        };
+      }
+    }
     if (params?.provider) {
       const caller = params?.user;
       const isServiceAccount = caller?._isServiceAccount === true;

package/dist/daemon/services/copilot-models.d.ts

@@ -23,7 +23,7 @@
  *     throws, CLI binary missing — all degrade silently to the static list
  *     the UI already has bundled. The picker stays usable.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Params, UserID } from '@agor/core/types';
 export interface CopilotModelOption {
     id: string;
@@ -49,9 +49,9 @@ interface AuthenticatedParams extends Params {
 }
 export declare class CopilotModelsService {
     private db;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     find(params?: AuthenticatedParams): Promise<CopilotModelsResult>;
 }
-export declare function createCopilotModelsService(db: Database): CopilotModelsService;
+export declare function createCopilotModelsService(db: TenantScopeAwareDatabase): CopilotModelsService;
 export {};
 //# sourceMappingURL=copilot-models.d.ts.map

package/dist/daemon/services/copilot-models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"copilot-models.d.ts","sourceRoot":"","sources":["../../src/services/copilot-models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAkBD,UAAU,mBAAoB,SAAQ,MAAM;IAC1C,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED,qBAAa,oBAAoB;IACnB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE1B,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA4DvE;AAED,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,QAAQ,GAAG,oBAAoB,CAE7E"}
+{"version":3,"file":"copilot-models.d.ts","sourceRoot":"","sources":["../../src/services/copilot-models.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAW,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAkBD,UAAU,mBAAoB,SAAQ,MAAM;IAC1C,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED,qBAAa,oBAAoB;IACnB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,wBAAwB;IAE1C,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CA4DvE;AAED,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,wBAAwB,GAAG,oBAAoB,CAE7F"}

package/dist/daemon/services/cursor-models.d.ts

@@ -6,7 +6,7 @@
  * Falls back to Cursor's documented default alias when no key is configured or
  * the SDK call fails.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Params, UserID } from '@agor/core/types';
 export interface CursorModelOption {
     id: string;
@@ -26,9 +26,9 @@ interface AuthenticatedParams extends Params {
 }
 export declare class CursorModelsService {
     private db;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     find(params?: AuthenticatedParams): Promise<CursorModelsResult>;
 }
-export declare function createCursorModelsService(db: Database): CursorModelsService;
+export declare function createCursorModelsService(db: TenantScopeAwareDatabase): CursorModelsService;
 export {};
 //# sourceMappingURL=cursor-models.d.ts.map

package/dist/daemon/services/cursor-models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cursor-models.d.ts","sourceRoot":"","sources":["../../src/services/cursor-models.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAW,MAAM,eAAe,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAiBD,UAAU,mBAAoB,SAAQ,MAAM;IAC1C,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAyBD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,QAAQ;IAE1B,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAqCtE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,QAAQ,GAAG,mBAAmB,CAE3E"}
+{"version":3,"file":"cursor-models.d.ts","sourceRoot":"","sources":["../../src/services/cursor-models.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAW,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAiBD,UAAU,mBAAoB,SAAQ,MAAM;IAC1C,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAyBD,qBAAa,mBAAmB;IAClB,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,wBAAwB;IAE1C,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAqCtE;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,wBAAwB,GAAG,mBAAmB,CAE3F"}

package/dist/daemon/services/files.d.ts

@@ -5,7 +5,7 @@
  * Delegates git ls-files to the executor so the daemon does not run git in a
  * managed branch checkout.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { Application } from '@agor/core/feathers';
 import type { AuthenticatedParams, SessionID } from '@agor/core/types';
 interface FileSearchQuery {
@@ -25,7 +25,7 @@ export declare class FilesService {
     private sessionRepo;
     private branchRepo;
     private usersRepo;
-    constructor(db: Database, app: Application);
+    constructor(db: TenantScopeAwareDatabase, app: Application);
     /**
      * Search files and folders in a session's branch
      *
@@ -42,6 +42,6 @@ export declare class FilesService {
 /**
  * Service factory function
  */
-export declare function createFilesService(db: Database, app: Application): FilesService;
+export declare function createFilesService(db: TenantScopeAwareDatabase, app: Application): FilesService;
 export {};
 //# sourceMappingURL=files.d.ts.map

package/dist/daemon/services/files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/services/files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAoB,KAAK,QAAQ,EAAsC,MAAM,eAAe,CAAC;AACpG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAU,MAAM,kBAAkB,CAAC;AAQ/E,UAAU,eAAe;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;CACzB;AAqBD;;GAEG;AACH,qBAAa,YAAY;IAMrB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG;IANb,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;gBAGzB,EAAE,EAAE,QAAQ,EACZ,GAAG,EAAE,WAAW;IAO1B;;;;;;;;OAQG;IACG,IAAI,CACR,MAAM,EAAE;QAAE,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAChE,OAAO,CAAC,UAAU,EAAE,CAAC;CA8DzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CAE/E"}
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/services/files.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAGL,KAAK,wBAAwB,EAE9B,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,SAAS,EAAU,MAAM,kBAAkB,CAAC;AAY/E,UAAU,eAAe;IACvB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,GAAG,QAAQ,CAAC;CACzB;AAqBD;;GAEG;AACH,qBAAa,YAAY;IAMrB,OAAO,CAAC,EAAE;IACV,OAAO,CAAC,GAAG;IANb,OAAO,CAAC,WAAW,CAAoB;IACvC,OAAO,CAAC,UAAU,CAAmB;IACrC,OAAO,CAAC,SAAS,CAAkB;gBAGzB,EAAE,EAAE,wBAAwB,EAC5B,GAAG,EAAE,WAAW;IAO1B;;;;;;;;OAQG;IACG,IAAI,CACR,MAAM,EAAE;QAAE,KAAK,EAAE,eAAe,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,GAChE,OAAO,CAAC,UAAU,EAAE,CAAC;CA+DzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CAE/F"}

package/dist/daemon/services/files.js

@@ -1,5 +1,9 @@
 // src/services/files.ts
-import { BranchRepository, SessionRepository, UsersRepository as UsersRepository2 } from "@agor/core/db";
+import {
+  BranchRepository,
+  SessionRepository,
+  UsersRepository as UsersRepository2
+} from "@agor/core/db";
 
 // src/utils/executor-read-impersonation.ts
 import { loadConfigSync } from "@agor/core/config";
@@ -134,6 +138,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path.join(dirname, "../executor/cli.js"),
@@ -433,12 +444,19 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
+}
+function generateScopedServiceToken(app, params) {
+  return generateSessionToken(app, serviceTokenScopeForParams(params));
 }
 
 // src/services/files.ts
@@ -487,8 +505,9 @@ var FilesService = class {
       if (!branch?.path) {
         return [];
       }
-      const sessionToken = generateSessionToken(
-        this.app
+      const sessionToken = generateScopedServiceToken(
+        this.app,
+        params
       );
       const currentUserId = params.user?.user_id;
       const currentUser = currentUserId ? await this.usersRepo.findById(currentUserId) : null;

package/dist/daemon/services/gateway-channels-test.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Gateway Channels Test Service (`gateway-channels/test`)
+ *
+ * Admin-only sub-path service that runs a best-effort connection probe against
+ * a gateway channel's effective config and returns a {@link SlackTestResult}.
+ *
+ * Token resolution reads DECRYPTED credentials from the repository directly
+ * (never through the gateway-channels Feathers service, whose after-hook
+ * redacts secrets to the `••••••••` sentinel). The response contains no token
+ * values.
+ */
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { AuthenticatedParams, SlackTestResult } from '@agor/core/types';
+export interface GatewayChannelTestInput {
+    gatewayChannelId?: string;
+    config?: Record<string, unknown>;
+}
+/**
+ * Factory for the `gateway-channels/test` service.
+ */
+export declare function createGatewayChannelsTestService(db: TenantScopeAwareDatabase): {
+    create(data: GatewayChannelTestInput, _params?: AuthenticatedParams): Promise<SlackTestResult>;
+};
+//# sourceMappingURL=gateway-channels-test.d.ts.map

package/dist/daemon/services/gateway-channels-test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-channels-test.d.ts","sourceRoot":"","sources":["../../src/services/gateway-channels-test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAGxF,OAAO,KAAK,EAAE,mBAAmB,EAAe,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG1F,MAAM,WAAW,uBAAuB;IACtC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA0BD;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,EAAE,EAAE,wBAAwB;iBAKjE,uBAAuB,YACnB,mBAAmB,GAC5B,OAAO,CAAC,eAAe,CAAC;EA+C9B"}

package/dist/daemon/services/gateway-channels-test.js

@@ -0,0 +1,66 @@
+// src/services/gateway-channels-test.ts
+import { GatewayChannelRepository } from "@agor/core/db";
+import { NotFound } from "@agor/core/feathers";
+import { getConnector } from "@agor/core/gateway";
+import { GATEWAY_REDACTED_SENTINEL, GATEWAY_SENSITIVE_CONFIG_FIELDS } from "@agor/core/types";
+function resolveEffectiveConfig(stored, overrides) {
+  const resolved = { ...stored };
+  if (!overrides) return resolved;
+  const sensitive = new Set(GATEWAY_SENSITIVE_CONFIG_FIELDS);
+  for (const [key, value] of Object.entries(overrides)) {
+    if (value === void 0 || value === null) continue;
+    if (value === GATEWAY_REDACTED_SENTINEL) continue;
+    if (sensitive.has(key) && value === "") continue;
+    resolved[key] = value;
+  }
+  return resolved;
+}
+function createGatewayChannelsTestService(db) {
+  const channelRepo = new GatewayChannelRepository(db);
+  return {
+    async create(data, _params) {
+      let channelType = "slack";
+      let storedConfig = {};
+      if (data.gatewayChannelId) {
+        const channel = await channelRepo.findById(data.gatewayChannelId);
+        if (!channel) {
+          throw new NotFound(`Gateway channel not found: ${data.gatewayChannelId}`);
+        }
+        channelType = channel.channel_type;
+        storedConfig = channel.config;
+      }
+      const config = resolveEffectiveConfig(storedConfig, data.config);
+      let connector;
+      try {
+        connector = getConnector(channelType, config);
+      } catch (error) {
+        return {
+          ok: false,
+          failures: [
+            {
+              capability: "config",
+              reason: error instanceof Error ? error.message : String(error)
+            }
+          ],
+          notVerifiable: []
+        };
+      }
+      if (!connector.testConnection) {
+        return {
+          ok: false,
+          failures: [
+            {
+              capability: "connector",
+              reason: `Connection testing is not supported for channel type "${channelType}".`
+            }
+          ],
+          notVerifiable: []
+        };
+      }
+      return connector.testConnection();
+    }
+  };
+}
+export {
+  createGatewayChannelsTestService
+};

package/dist/daemon/services/gateway-channels.d.ts

@@ -4,14 +4,14 @@
  * Provides REST + WebSocket API for gateway channel management.
  * Uses DrizzleService adapter with GatewayChannelRepository.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { GatewayChannel } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 export declare class GatewayChannelsService extends DrizzleService<GatewayChannel, Partial<GatewayChannel>> {
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
 }
 /**
  * Service factory function
  */
-export declare function createGatewayChannelsService(db: Database): GatewayChannelsService;
+export declare function createGatewayChannelsService(db: TenantScopeAwareDatabase): GatewayChannelsService;
 //# sourceMappingURL=gateway-channels.d.ts.map

package/dist/daemon/services/gateway-channels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-channels.d.ts","sourceRoot":"","sources":["../../src/services/gateway-channels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAA4B,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,sBAAuB,SAAQ,cAAc,CACxD,cAAc,EACd,OAAO,CAAC,cAAc,CAAC,CACxB;gBACa,EAAE,EAAE,QAAQ;CAWzB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,QAAQ,GAAG,sBAAsB,CAEjF"}
+{"version":3,"file":"gateway-channels.d.ts","sourceRoot":"","sources":["../../src/services/gateway-channels.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAA4B,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACxF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,qBAAa,sBAAuB,SAAQ,cAAc,CACxD,cAAc,EACd,OAAO,CAAC,cAAc,CAAC,CACxB;gBACa,EAAE,EAAE,wBAAwB;CAWzC;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,wBAAwB,GAAG,sBAAsB,CAEjG"}

package/dist/daemon/services/gateway-channels.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {