agor-live 0.22.0 → 0.23.2

package/dist/daemon/services/local-actions.js

@@ -0,0 +1,120 @@
+// src/services/local-actions.ts
+import { BadRequest } from "@agor/core/feathers";
+import {
+  addToBranchGroupAction,
+  cleanupBrokenSymlinksAction,
+  createBranchGroupAction,
+  createBranchSymlinkAction,
+  createBufferedReporter,
+  deleteBranchGroupAction,
+  deleteUnixUserAction,
+  ensureUnixUserAction,
+  removeBranchSymlinkAction,
+  removeFromBranchGroupAction,
+  scrubGitRemotesAction
+} from "@agor/core/local-actions";
+import { AGOR_HOME_BASE } from "@agor/core/unix";
+function requireString(params, key) {
+  const value = params[key];
+  if (typeof value !== "string" || value.trim().length === 0) {
+    throw new BadRequest(`Missing required string param: ${key}`);
+  }
+  return value;
+}
+function getManagedHomeBase(params) {
+  const value = params.homeBase;
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value !== AGOR_HOME_BASE) {
+    throw new BadRequest(`homeBase must be the managed Agor home base: ${AGOR_HOME_BASE}`);
+  }
+  return value;
+}
+function createLocalActionsService() {
+  return {
+    async create(data, _params) {
+      const reporter = createBufferedReporter();
+      const actionParams = data.params ?? {};
+      const common = { dryRun: !!data.dryRun, verbose: !!data.verbose, reporter };
+      switch (data.action) {
+        case "unix.group.createBranch":
+          await createBranchGroupAction({
+            ...common,
+            branchId: requireString(actionParams, "branchId")
+          });
+          break;
+        case "unix.group.deleteBranch":
+          await deleteBranchGroupAction({
+            ...common,
+            group: requireString(actionParams, "group")
+          });
+          break;
+        case "unix.group.addUser":
+          await addToBranchGroupAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            group: requireString(actionParams, "group")
+          });
+          break;
+        case "unix.group.removeUser":
+          await removeFromBranchGroupAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            group: requireString(actionParams, "group")
+          });
+          break;
+        case "unix.user.ensure":
+          await ensureUnixUserAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            homeBase: getManagedHomeBase(actionParams)
+          });
+          break;
+        case "unix.user.delete":
+          await deleteUnixUserAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            deleteHome: actionParams.deleteHome === true
+          });
+          break;
+        case "unix.symlink.create":
+          await createBranchSymlinkAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            branchName: requireString(actionParams, "branchName"),
+            branchPath: requireString(actionParams, "branchPath"),
+            homeBase: getManagedHomeBase(actionParams)
+          });
+          break;
+        case "unix.symlink.remove":
+          await removeBranchSymlinkAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            branchName: requireString(actionParams, "branchName"),
+            homeBase: getManagedHomeBase(actionParams)
+          });
+          break;
+        case "unix.symlink.cleanupBroken":
+          await cleanupBrokenSymlinksAction({
+            ...common,
+            username: requireString(actionParams, "username"),
+            homeBase: getManagedHomeBase(actionParams)
+          });
+          break;
+        case "git.remoteCredentials.scrubManaged":
+          await scrubGitRemotesAction({
+            ...common,
+            write: actionParams.write === true
+          });
+          break;
+        default:
+          throw new BadRequest(
+            `Unsupported local action: ${data.action}`
+          );
+      }
+      return { logs: reporter.logs };
+    }
+  };
+}
+export {
+  createLocalActionsService
+};

package/dist/daemon/services/mcp-servers.d.ts

@@ -4,7 +4,7 @@
  * Provides REST + WebSocket API for MCP server management.
  * Uses DrizzleService adapter with MCPServerRepository.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import type { CreateMCPServerInput, MCPServer, Paginated, QueryParams, UpdateMCPServerInput } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
 /**
@@ -22,7 +22,7 @@ export type MCPServerParams = QueryParams<{
  */
 export declare class MCPServersService extends DrizzleService<MCPServer, CreateMCPServerInput | UpdateMCPServerInput, MCPServerParams> {
     private mcpServerRepo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
     /**
      * Override find to support filter params
      */
@@ -35,5 +35,5 @@ export declare class MCPServersService extends DrizzleService<MCPServer, CreateM
 /**
  * Service factory function
  */
-export declare function createMCPServersService(db: Database): MCPServersService;
+export declare function createMCPServersService(db: TenantScopeAwareDatabase): MCPServersService;
 //# sourceMappingURL=mcp-servers.d.ts.map

package/dist/daemon/services/mcp-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAuB,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EACV,oBAAoB,EAEpB,SAAS,EAIT,SAAS,EACT,WAAW,EACX,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CACnD,SAAS,EACT,oBAAoB,GAAG,oBAAoB,EAC3C,eAAe,CAChB;IACC,OAAO,CAAC,aAAa,CAAsB;gBAE/B,EAAE,EAAE,QAAQ;IAcxB;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe;IAgCnC;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,SAAS,EAAE,CAAC;CAGxB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,QAAQ,GAAG,iBAAiB,CAEvE"}
+{"version":3,"file":"mcp-servers.d.ts","sourceRoot":"","sources":["../../src/services/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAuB,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,KAAK,EACV,oBAAoB,EAEpB,SAAS,EAIT,SAAS,EACT,WAAW,EACX,oBAAoB,EACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,cAAc,CACnD,SAAS,EACT,oBAAoB,GAAG,oBAAoB,EAC3C,eAAe,CAChB;IACC,OAAO,CAAC,aAAa,CAAsB;gBAE/B,EAAE,EAAE,wBAAwB;IAcxC;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe;IAgCnC;;OAEG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GACxB,OAAO,CAAC,SAAS,EAAE,CAAC;CAGxB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,wBAAwB,GAAG,iBAAiB,CAEvF"}

package/dist/daemon/services/mcp-servers.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {

package/dist/daemon/services/messages.d.ts

@@ -4,9 +4,9 @@
  * Provides REST + WebSocket API for message management.
  * Uses DrizzleService adapter with MessagesRepository.
  */
-import { type Database } from '@agor/core/db';
-import type { Message, MessageID, Paginated, QueryParams, SessionID, TaskID } from '@agor/core/types';
-import { DrizzleService } from '../adapters/drizzle';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
+import type { Message, MessageID, Paginated, QueryParams, SessionID, TaskID, UUID } from '@agor/core/types';
+import { DrizzleService, type Query } from '../adapters/drizzle';
 /**
  * Message service params
  */
@@ -15,13 +15,17 @@ export type MessageParams = QueryParams<{
     task_id?: TaskID;
     type?: Message['type'];
     role?: Message['role'];
-}>;
+}> & {
+    /** Internal RBAC SQL pushdown marker set by register-hooks for external regular users. */
+    _agorSqlSessionAccessUserId?: UUID;
+};
 /**
  * Extended messages service with custom methods
  */
 export declare class MessagesService extends DrizzleService<Message, Partial<Message>, MessageParams> {
     private messagesRepo;
-    constructor(db: Database);
+    constructor(db: TenantScopeAwareDatabase);
+    protected fetchData(query: Query, params?: MessageParams): Promise<Message[]>;
     /**
      * Override find to support task-based and session-based filtering
      */
@@ -51,5 +55,5 @@ export declare class MessagesService extends DrizzleService<Message, Partial<Mes
 /**
  * Service factory function
  */
-export declare function createMessagesService(db: Database): MessagesService;
+export declare function createMessagesService(db: TenantScopeAwareDatabase): MessagesService;
 //# sourceMappingURL=messages.d.ts.map

package/dist/daemon/services/messages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/services/messages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,KAAK,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAClE,OAAO,KAAK,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,WAAW,EACX,SAAS,EACT,MAAM,EACP,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACxB,CAAC,CAAC;AAEH;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,YAAY,CAAqB;gBAE7B,EAAE,EAAE,QAAQ;IAexB;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IA8D3E;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI7D;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIpD;;;OAGG;IACG,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI1E;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,EAAE,CAAC;IAIrB;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG1D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,QAAQ,GAAG,eAAe,CAEnE"}
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../src/services/messages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAsB,KAAK,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAClF,OAAO,KAAK,EACV,OAAO,EACP,SAAS,EACT,SAAS,EACT,WAAW,EACX,SAAS,EACT,MAAM,EACN,IAAI,EACL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC;IACtC,UAAU,CAAC,EAAE,SAAS,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;CACxB,CAAC,GAAG;IACH,0FAA0F;IAC1F,2BAA2B,CAAC,EAAE,IAAI,CAAC;CACpC,CAAC;AAEF;;GAEG;AACH,qBAAa,eAAgB,SAAQ,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAC3F,OAAO,CAAC,YAAY,CAAqB;gBAE7B,EAAE,EAAE,wBAAwB;cAexB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAwBnF;;OAEG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAkE3E;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAI7D;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAIpD;;;OAGG;IACG,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAI1E;;OAEG;IACG,WAAW,CACf,SAAS,EAAE,SAAS,EACpB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,EAAE,CAAC;IAIrB;;OAEG;IACG,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAG1D;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,EAAE,wBAAwB,GAAG,eAAe,CAEnF"}

package/dist/daemon/services/messages.js

@@ -19,6 +19,34 @@ var DrizzleService = class {
   // Event emitter for FeathersJS (will be injected by framework)
   // biome-ignore lint/suspicious/noExplicitAny: FeathersJS event system
   emit;
+  /** Extract resolved tenant context from Feathers params. */
+  getTenant(params) {
+    return params?.tenant;
+  }
+  /**
+   * Whether a row belongs to the current tenant. Rows from pre-migration test
+   * fixtures that do not expose tenant_id are treated as visible so existing
+   * single-tenant unit tests keep working; migrated DB rows always carry it.
+   */
+  rowBelongsToTenant(row, tenant) {
+    if (!tenant) return true;
+    const record = row;
+    if (!("tenant_id" in record)) return true;
+    return record.tenant_id === tenant.tenant_id;
+  }
+  /** Stamp tenant_id onto created rows and prevent client-supplied drift. */
+  withTenant(data, params) {
+    const tenant = this.getTenant(params);
+    if (!tenant || !data || typeof data !== "object" || Array.isArray(data)) return data;
+    return { ...data, tenant_id: tenant.tenant_id };
+  }
+  /** Never allow a patch/update to move a row across tenants. */
+  stripTenantMutation(data) {
+    if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+    const clone = { ...data };
+    delete clone.tenant_id;
+    return clone;
+  }
   /**
    * Extract query parameters from params
    */
@@ -110,12 +138,28 @@ var DrizzleService = class {
       data: paginated
     };
   }
+  /**
+   * Resolve the candidate row set that `find` filters, sorts, and paginates.
+   *
+   * The base implementation reads the whole table and relies on `filterData` to
+   * narrow it in memory. Subclasses may override this to push high-selectivity
+   * predicates into SQL; because `find` always re-applies every query filter via
+   * `filterData`, an override only needs to return a superset of the matching
+   * rows for the result to stay identical.
+   */
+  async fetchData(_query, _params) {
+    return this.repository.findAll();
+  }
   /**
    * Find records
    */
   async find(params) {
     const query = this.getQuery(params);
-    let data = await this.repository.findAll();
+    let data = await this.fetchData(query, params);
+    const tenant = this.getTenant(params);
+    if (tenant) {
+      data = data.filter((row) => this.rowBelongsToTenant(row, tenant));
+    }
     data = this.filterData(data, query);
     const total = data.length;
     data = this.sortData(data, query.$sort);
@@ -127,10 +171,13 @@ var DrizzleService = class {
    */
   async get(id, _params) {
     const prefetched = _params?._agorPrefetchedRecord;
-    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id)) {
+    if (prefetched && prefetched.idField === this.id && prefetched.id === String(id) && String(prefetched.record[this.id]) === String(id) && this.rowBelongsToTenant(prefetched.record, this.getTenant(_params))) {
       return prefetched.record;
     }
     const result = await this.repository.findById(String(id));
+    if (result && !this.rowBelongsToTenant(result, this.getTenant(_params))) {
+      throw new NotFoundError(this.resourceType, String(id));
+    }
     if (!result) {
       throw new NotFoundError(this.resourceType, String(id));
     }
@@ -142,14 +189,18 @@ var DrizzleService = class {
   async create(data, params) {
     if (Array.isArray(data)) {
       const results = await Promise.all(
-        data.map((item) => this.repository.create(item))
+        data.map(
+          (item) => this.repository.create(this.withTenant(item, params))
+        )
       );
       for (const result2 of results) {
         this.emit?.("created", result2, params);
       }
       return results;
     }
-    const result = await this.repository.create(data);
+    const result = await this.repository.create(
+      this.withTenant(data, params)
+    );
     this.emit?.("created", result, params);
     return result;
   }
@@ -165,7 +216,10 @@ var DrizzleService = class {
    */
   async update(id, data, params) {
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("updated", result, params);
     return result;
   }
@@ -179,12 +233,14 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       const results = await Promise.all(
         records.map(
           (record) => this.repository.update(
             record[this.id],
-            data
+            this.stripTenantMutation(data)
           )
         )
       );
@@ -194,7 +250,10 @@ var DrizzleService = class {
       return results;
     }
     await this.get(id, params);
-    const result = await this.repository.update(String(id), data);
+    const result = await this.repository.update(
+      String(id),
+      this.stripTenantMutation(data)
+    );
     this.emit?.("patched", result, params);
     return result;
   }
@@ -208,6 +267,8 @@ var DrizzleService = class {
       }
       const query = this.getQuery(params);
       let records = await this.repository.findAll();
+      const tenant = this.getTenant(params);
+      if (tenant) records = records.filter((row) => this.rowBelongsToTenant(row, tenant));
       records = this.filterData(records, query);
       await Promise.all(records.map((record) => this.repository.delete(record[this.id])));
       for (const record of records) {
@@ -239,10 +300,29 @@ var MessagesService = class extends DrizzleService {
     });
     this.messagesRepo = messagesRepo;
   }
+  async fetchData(query, params) {
+    const sessionId = query.session_id;
+    const filter = {};
+    if (typeof sessionId === "string") {
+      filter.sessionId = sessionId;
+    } else if (sessionId && typeof sessionId === "object" && Array.isArray(sessionId.$in) && sessionId.$in.every((el) => typeof el === "string")) {
+      filter.sessionIds = sessionId.$in;
+    }
+    if (typeof query.task_id === "string") filter.taskId = query.task_id;
+    if (typeof query.type === "string") filter.type = query.type;
+    if (typeof query.role === "string") filter.role = query.role;
+    if (params?._agorSqlSessionAccessUserId) {
+      filter.visibleToUserId = params._agorSqlSessionAccessUserId;
+    }
+    return this.messagesRepo.findAll(filter);
+  }
   /**
    * Override find to support task-based and session-based filtering
    */
   async find(params) {
+    if (params?._agorSqlSessionAccessUserId) {
+      return super.find(params);
+    }
     if (typeof params?.query?.task_id === "string") {
       let messages = await this.messagesRepo.findByTaskId(params.query.task_id);
       const sid = params.query.session_id;

package/dist/daemon/services/repos.d.ts

@@ -4,11 +4,11 @@
  * Provides REST + WebSocket API for repository management.
  * Uses DrizzleService adapter with RepoRepository.
  *
- * Git operations (clone, branch add) are delegated to the executor process
- * for proper Unix isolation. The executor handles filesystem operations while
- * the daemon handles database records and business logic.
+ * Git clone/worktree mutations for queued branch/repo operations are delegated
+ * to the executor process for Unix isolation. The daemon still performs a small
+ * set of local preflight/repair checks for registered repo metadata.
  */
-import { type Database } from '@agor/core/db';
+import { type TenantScopeAwareDatabase } from '@agor/core/db';
 import { type Application } from '@agor/core/feathers';
 import type { Branch, CloneRepositoryResult, QueryParams, Repo } from '@agor/core/types';
 import { DrizzleService } from '../adapters/drizzle';
@@ -27,7 +27,7 @@ export declare class ReposService extends DrizzleService<Repo, Partial<Repo>, Re
     private repoRepo;
     private app;
     private db;
-    constructor(db: Database, app: Application);
+    constructor(db: TenantScopeAwareDatabase, app: Application);
     /**
      * Custom method: Find repo by slug
      */
@@ -189,5 +189,5 @@ export declare class ReposService extends DrizzleService<Repo, Partial<Repo>, Re
 /**
  * Service factory function
  */
-export declare function createReposService(db: Database, app: Application): ReposService;
+export declare function createReposService(db: TenantScopeAwareDatabase, app: Application): ReposService;
 //# sourceMappingURL=repos.d.ts.map

package/dist/daemon/services/repos.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repos.d.ts","sourceRoot":"","sources":["../../src/services/repos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAeH,OAAO,EAAoB,KAAK,QAAQ,EAA2B,MAAM,eAAe,CAAC;AAEzF,OAAO,EAAE,KAAK,WAAW,EAA2C,MAAM,qBAAqB,CAAC;AAahG,OAAO,KAAK,EAEV,MAAM,EACN,qBAAqB,EACrB,WAAW,EACX,IAAI,EAKL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC,CAAC;AAyCH;;GAEG;AACH,qBAAa,YAAa,SAAQ,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC/E,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,EAAE,CAAW;gBAET,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW;IAgB1C;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI1E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CACnB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5E,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,qBAAqB,CAAC;IAqMjC;;;;;;;;;OASG;IACG,mBAAmB,CACvB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EACzC,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;;;;;OAaG;IACG,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,EACD,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IA+DhB;;OAEG;IACG,kBAAkB,CACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrC,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;OAMG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB;;;;4DAIoD;QACpD,QAAQ,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;WAGG;QACH,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QACpC,yFAAyF;QACzF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC;IA4WlB;;;;;;OAMG;YACW,0BAA0B;YAa1B,yBAAyB;IAmCvC;;;;;;;OAOG;IACG,iBAAiB,CACrB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IAkDhB;;;;;;;;;OASG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsC5B;;;;;;;;OAQG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA2G7D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CAE/E"}
+{"version":3,"file":"repos.d.ts","sourceRoot":"","sources":["../../src/services/repos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAeH,OAAO,EAIL,KAAK,wBAAwB,EAC9B,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,KAAK,WAAW,EAA2C,MAAM,qBAAqB,CAAC;AAehG,OAAO,KAAK,EAEV,MAAM,EACN,qBAAqB,EACrB,WAAW,EACX,IAAI,EAKL,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAWrD;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC,CAAC;AAyCH;;GAEG;AACH,qBAAa,YAAa,SAAQ,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC/E,OAAO,CAAC,QAAQ,CAAiB;IACjC,OAAO,CAAC,GAAG,CAAc;IACzB,OAAO,CAAC,EAAE,CAA2B;gBAEzB,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW;IAgB1D;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAI1E;;;;;;;;;;;;;;;;;;;OAmBG;IACG,eAAe,CACnB,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE,EAC5E,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,qBAAqB,CAAC;IAuMjC;;;;;;;;;OASG;IACG,mBAAmB,CACvB,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EACzC,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IAiBjC;;;;;;;;;;;;;OAaG;IACG,cAAc,CAClB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,SAAS,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;QAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,EACD,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IA+DhB;;OAEG;IACG,kBAAkB,CACtB,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrC,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IAsFhB;;;;;;OAMG;IACG,YAAY,CAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QACJ,IAAI,EAAE,MAAM,CAAC;QACb,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;QAC3B,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB;;;;4DAIoD;QACpD,QAAQ,CAAC,EAAE;YAAE,CAAC,EAAE,MAAM,CAAC;YAAC,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QACpC,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B;;;WAGG;QACH,YAAY,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC;QACpC,yFAAyF;QACzF,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EACD,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,MAAM,CAAC;IA8WlB;;;;;;OAMG;YACW,0BAA0B;YAa1B,yBAAyB;IAoCvC;;;;;;;OAOG;IACG,iBAAiB,CACrB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC;IAkDhB;;;;;;;;;OASG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,EAC3B,MAAM,CAAC,EAAE,UAAU,GAClB,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAsC5B;;;;;;;;OAQG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;CA4G7D;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CAE/F"}