agor-live 0.22.0 → 0.23.2

package/dist/daemon/startup.js

@@ -49,9 +49,18 @@ var init_persisted_secret = __esm({
 // src/startup.ts
 import { promises as fs } from "fs";
 import path from "path";
-import { getAgorHome, resolveExecutorHeartbeatConfig } from "@agor/core/config";
-import { MessagesRepository, SessionRepository as SessionRepository3, shortId as shortId6 } from "@agor/core/db";
-import { SessionStatus as SessionStatus2, TaskStatus } from "@agor/core/types";
+import {
+  getAgorHome,
+  resolveExecutorHeartbeatConfig,
+  resolveMultiTenancyConfig
+} from "@agor/core/config";
+import {
+  MessagesRepository,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
+  SessionRepository as SessionRepository3,
+  shortId as shortId6
+} from "@agor/core/db";
+import { isTerminalTaskStatus, SessionStatus as SessionStatus2, TaskStatus } from "@agor/core/types";
 
 // src/services/executor-heartbeat-supervisor.ts
 import { shortId } from "@agor/core/db";
@@ -122,7 +131,14 @@ var ExecutorHeartbeatSupervisor = class {
 
 // src/services/health-monitor.ts
 import { ENVIRONMENT } from "@agor/core/config";
-import { shortId as shortId2 } from "@agor/core/db";
+import {
+  BranchRepository,
+  getHiddenTenantId,
+  runWithoutTenantDatabaseScope,
+  runWithSystemDatabaseScope,
+  runWithTenantDatabaseScope,
+  shortId as shortId2
+} from "@agor/core/db";
 import { NotFoundError } from "@agor/core/utils/errors";
 var DEBUG_HEALTH_MONITOR = process.env.AGOR_DEBUG_HEALTH_MONITOR === "1" || process.env.DEBUG?.includes("health-monitor");
 function healthMonitorDebug(...args) {
@@ -130,14 +146,35 @@ function healthMonitorDebug(...args) {
     console.debug(...args);
   }
 }
+function tenantParamsFromBranch(branch) {
+  const tenantId = getHiddenTenantId(branch);
+  if (!tenantId) return void 0;
+  return { tenant: { tenant_id: tenantId, source: "auth_claim" } };
+}
 var HealthMonitor = class {
   app;
   intervals = /* @__PURE__ */ new Map();
+  branchParams = /* @__PURE__ */ new Map();
   isShuttingDown = false;
-  constructor(app) {
+  defaultParams;
+  db;
+  branchRepo;
+  tenantId;
+  requireTenantParams;
+  discoverActiveEnvironmentRefs;
+  constructor(app, options = {}) {
     this.app = app;
+    this.defaultParams = options.defaultParams;
+    this.db = options.db;
+    this.branchRepo = options.db ? new BranchRepository(options.db) : void 0;
+    this.tenantId = typeof options.tenantId === "string" && options.tenantId.trim() ? options.tenantId.trim() : void 0;
+    this.requireTenantParams = options.requireTenantParams ?? false;
+    this.discoverActiveEnvironmentRefs = options.discoverActiveEnvironmentRefs;
     this.setupBranchListeners();
   }
+  paramsForBranch(branch) {
+    return tenantParamsFromBranch(branch) ?? (this.requireTenantParams ? void 0 : this.defaultParams);
+  }
   /**
    * Set up WebSocket listeners for branch changes
    */
@@ -151,6 +188,7 @@ var HealthMonitor = class {
     });
     branchesService.on("removed", (branch) => {
       this.stopMonitoring(branch.branch_id);
+      this.branchParams.delete(branch.branch_id);
     });
   }
   /**
@@ -160,31 +198,43 @@ var HealthMonitor = class {
     if (this.isShuttingDown) return;
     const status = branch.environment_instance?.status;
     if (status === "running" || status === "starting") {
+      const params = this.paramsForBranch(branch);
+      if (!params && this.requireTenantParams) {
+        console.error(
+          `\u274C Health monitoring skipped for branch ${shortId2(branch.branch_id)}: missing tenant metadata`
+        );
+        return;
+      }
+      if (params) this.branchParams.set(branch.branch_id, params);
       if (!this.intervals.has(branch.branch_id)) {
         healthMonitorDebug(`\u{1F3E5} Starting health monitoring for branch: ${branch.name}`);
-        this.startMonitoring(branch.branch_id);
+        this.startMonitoring(branch.branch_id, params);
       }
     } else {
       if (this.intervals.has(branch.branch_id)) {
         healthMonitorDebug(`\u{1F3E5} Stopping health monitoring for branch: ${branch.name}`);
         this.stopMonitoring(branch.branch_id);
       }
+      this.branchParams.delete(branch.branch_id);
     }
   }
   /**
    * Start monitoring a branch's health
    */
-  startMonitoring(branchId) {
+  startMonitoring(branchId, params = this.branchParams.get(branchId)) {
     this.stopMonitoring(branchId);
-    setTimeout(() => {
-      if (this.isShuttingDown) return;
-      this.checkHealth(branchId);
-      const interval = setInterval(() => {
+    if (params) this.branchParams.set(branchId, params);
+    runWithoutTenantDatabaseScope(() => {
+      setTimeout(() => {
         if (this.isShuttingDown) return;
         this.checkHealth(branchId);
-      }, ENVIRONMENT.HEALTH_CHECK_INTERVAL_MS);
-      this.intervals.set(branchId, interval);
-    }, ENVIRONMENT.STARTUP_GRACE_PERIOD_MS);
+        const interval = setInterval(() => {
+          if (this.isShuttingDown) return;
+          this.checkHealth(branchId);
+        }, ENVIRONMENT.HEALTH_CHECK_INTERVAL_MS);
+        this.intervals.set(branchId, interval);
+      }, ENVIRONMENT.STARTUP_GRACE_PERIOD_MS);
+    });
   }
   /**
    * Stop monitoring a branch's health
@@ -202,13 +252,21 @@ var HealthMonitor = class {
   async checkHealth(branchId) {
     try {
       const branchesService = this.app.service("branches");
-      const branch = await branchesService.get(branchId);
+      const params = this.branchParams.get(branchId) ?? (this.requireTenantParams ? void 0 : this.defaultParams);
+      if (!params && this.requireTenantParams) {
+        console.error(
+          `\u274C Health check skipped for branch ${shortId2(branchId)}: missing tenant metadata`
+        );
+        this.stopMonitoring(branchId);
+        return;
+      }
+      const branch = await branchesService.get(branchId, params);
       const status = branch.environment_instance?.status;
       if (status !== "running" && status !== "starting") {
         this.stopMonitoring(branchId);
         return;
       }
-      await branchesService.checkHealth(branchId);
+      await branchesService.checkHealth(branchId, params);
     } catch (error) {
       if (error instanceof NotFoundError) {
         this.stopMonitoring(branchId);
@@ -230,25 +288,100 @@ var HealthMonitor = class {
    */
   async initialize() {
     try {
-      const branchesService = this.app.service("branches");
-      const result = await branchesService.find({
-        query: {
-          $limit: 1e3
-        },
-        paginate: false
-      });
-      const branches = Array.isArray(result) ? result : result.data;
-      const activeBranches = branches.filter(
-        (w) => w.environment_instance?.status === "running" || w.environment_instance?.status === "starting"
-      );
-      for (const branch of activeBranches) {
-        this.startMonitoring(branch.branch_id);
-      }
-      console.log(`\u{1F3E5} Health Monitor initialized (${activeBranches.length} active environment(s))`);
+      const activeBranches = this.branchRepo || this.discoverActiveEnvironmentRefs ? await this.initializeFromTenantAwareDiscovery() : await this.initializeFromDefaultParamsScan();
+      console.log(`\u{1F3E5} Health Monitor initialized (${activeBranches} active environment(s))`);
     } catch (error) {
       console.error("\u274C Failed to initialize Health Monitor:", error);
     }
   }
+  async initializeFromDefaultParamsScan() {
+    const branchesService = this.app.service("branches");
+    const result = await branchesService.find({
+      ...this.defaultParams,
+      query: {
+        $limit: 1e3
+      },
+      paginate: false
+    });
+    const branches = Array.isArray(result) ? result : result.data;
+    const activeBranches = branches.filter(
+      (w) => w.environment_instance?.status === "running" || w.environment_instance?.status === "starting"
+    );
+    for (const branch of activeBranches) {
+      const params = this.paramsForBranch(branch);
+      if (!params && this.requireTenantParams) {
+        console.error(
+          `\u274C Health monitoring skipped for branch ${shortId2(branch.branch_id)}: missing tenant metadata`
+        );
+        continue;
+      }
+      if (params) this.branchParams.set(branch.branch_id, params);
+      this.startMonitoring(branch.branch_id, params);
+    }
+    return activeBranches.length;
+  }
+  async initializeFromTenantAwareDiscovery() {
+    const refs = await this.findActiveEnvironmentRefs();
+    const branchesService = this.app.service("branches");
+    let activeCount = 0;
+    for (const ref of refs) {
+      if (!ref.tenantId) {
+        console.error(
+          `\u274C Health monitoring skipped for branch ${shortId2(ref.branchId)}: missing tenant metadata`
+        );
+        continue;
+      }
+      const params = {
+        tenant: {
+          tenant_id: ref.tenantId,
+          source: this.tenantId ? "static" : "explicit"
+        }
+      };
+      try {
+        const loadAndStart = async () => {
+          const branch = await branchesService.get(ref.branchId, params);
+          const status = branch.environment_instance?.status;
+          if (status !== "running" && status !== "starting") return;
+          this.branchParams.set(branch.branch_id, tenantParamsFromBranch(branch) ?? params);
+          this.startMonitoring(branch.branch_id, this.branchParams.get(branch.branch_id));
+          activeCount += 1;
+        };
+        if (this.db) {
+          await runWithTenantDatabaseScope(this.db, ref.tenantId, loadAndStart);
+        } else {
+          await loadAndStart();
+        }
+      } catch (error) {
+        console.error(
+          `\u274C Failed to initialize health monitoring for branch ${shortId2(ref.branchId)}:`,
+          error
+        );
+      }
+    }
+    return activeCount;
+  }
+  async findActiveEnvironmentRefs() {
+    const normalizeRef = (ref, tenantId) => {
+      if ("branchId" in ref) {
+        return { branchId: ref.branchId, tenantId: tenantId ?? ref.tenantId };
+      }
+      return { branchId: ref.branch_id, tenantId: tenantId ?? ref.tenant_id };
+    };
+    const findRefs = async (tenantId) => {
+      const refs = this.discoverActiveEnvironmentRefs ? await this.discoverActiveEnvironmentRefs() : await this.branchRepo.findActiveEnvironmentRefs();
+      return refs.map((ref) => normalizeRef(ref, tenantId));
+    };
+    if (this.tenantId) {
+      if (!this.db) return findRefs(this.tenantId);
+      return runWithTenantDatabaseScope(this.db, this.tenantId, () => findRefs(this.tenantId));
+    }
+    if (!this.db) return findRefs();
+    return runWithSystemDatabaseScope(
+      this.db,
+      "health monitor active environment discovery",
+      () => findRefs()
+    );
+  }
   /**
    * Cleanup all monitoring intervals
    *
@@ -261,6 +394,7 @@ var HealthMonitor = class {
       clearInterval(interval);
     }
     this.intervals.clear();
+    this.branchParams.clear();
     console.log(`\u{1F3E5} Health Monitor cleaned up (${stoppedCount} monitor(s) stopped)`);
   }
   /**
@@ -287,6 +421,7 @@ import {
   kbDocumentUnits,
   kbDocumentVersions,
   kbEmbeddingSpaces,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope2,
   select,
   shortId as shortId3,
   sql as sql2,
@@ -359,6 +494,28 @@ function rowsOf(result) {
 function boolValue(value) {
   return value === true || value === "t" || value === "true" || value === 1 || value === "1";
 }
+async function ensureEmbeddingTenantIsolation(db) {
+  await executeRaw(
+    db,
+    sql`ALTER TABLE kb_unit_embeddings ADD COLUMN IF NOT EXISTS tenant_id text DEFAULT 'default' NOT NULL`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE INDEX IF NOT EXISTS kb_unit_embeddings_tenant_id_idx ON kb_unit_embeddings USING btree (tenant_id)`
+  );
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings ENABLE ROW LEVEL SECURITY`);
+  await executeRaw(db, sql`ALTER TABLE kb_unit_embeddings FORCE ROW LEVEL SECURITY`);
+  await executeRaw(
+    db,
+    sql`DROP POLICY IF EXISTS tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings`
+  );
+  await executeRaw(
+    db,
+    sql`CREATE POLICY tenant_isolation_kb_unit_embeddings ON kb_unit_embeddings
+      USING (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))
+      WITH CHECK (tenant_id = COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'))`
+  );
+}
 async function readCapability(db) {
   if (!isPostgresDatabase(db)) {
     return {
@@ -441,6 +598,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       await executeRaw(
         db,
         sql`CREATE TABLE IF NOT EXISTS kb_unit_embeddings (
+          tenant_id text DEFAULT 'default' NOT NULL,
           unit_id varchar(36) NOT NULL REFERENCES public.kb_document_units(unit_id) ON DELETE cascade,
           embedding_space_id varchar(36) NOT NULL REFERENCES public.kb_embedding_spaces(embedding_space_id) ON DELETE cascade,
           content_sha256 text NOT NULL,
@@ -453,6 +611,7 @@ async function ensureKnowledgePgvectorStorage(db) {
       );
       capability.tableReady = true;
     }
+    await ensureEmbeddingTenantIsolation(db);
     if (!capability.spaceIndexReady) {
       await executeRaw(
         db,
@@ -551,6 +710,7 @@ function buildKnowledgeEmbeddingReuseSql(params) {
             ORDER BY p.unit_id, old_u.updated_at DESC NULLS LAST, old_u.created_at DESC
           ), upserted AS (
             INSERT INTO kb_unit_embeddings (
+              tenant_id,
               unit_id,
               embedding_space_id,
               content_sha256,
@@ -560,6 +720,7 @@ function buildKnowledgeEmbeddingReuseSql(params) {
               updated_at
             )
             SELECT
+              COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'),
               new_unit_id,
               ${params.embeddingSpaceId},
               content_sha256,
@@ -591,8 +752,9 @@ function buildKnowledgeEmbeddingReuseSql(params) {
             candidates.previous_version_id`;
 }
 var KnowledgeEmbeddingIndexer = class {
-  constructor(db) {
+  constructor(db, options = {}) {
     this.db = db;
+    this.options = options;
     this.variables = new AppVariableRepository(db);
   }
   intervalHandle;
@@ -731,6 +893,12 @@ var KnowledgeEmbeddingIndexer = class {
     }
   }
   async tick() {
+    if (this.options.tenantId) {
+      return runWithTenantDatabaseScope2(this.db, this.options.tenantId, () => this.tickInScope());
+    }
+    return this.tickInScope();
+  }
+  async tickInScope() {
     if (this.running) return;
     this.running = true;
     try {
@@ -843,8 +1011,8 @@ var KnowledgeEmbeddingIndexer = class {
       const vector = embeddingToPgvector(result.embedding);
       await executeRaw2(
         this.db,
-        sql2`INSERT INTO kb_unit_embeddings (unit_id, embedding_space_id, content_sha256, embedding, token_count, created_at, updated_at)
-            VALUES (${result.id}, ${embeddingSpaceId}, ${sha256Text(content)}, ${vector}::vector, ${result.tokenCount ?? null}, now(), now())
+        sql2`INSERT INTO kb_unit_embeddings (tenant_id, unit_id, embedding_space_id, content_sha256, embedding, token_count, created_at, updated_at)
+            VALUES (COALESCE(NULLIF(current_setting('agor.tenant_id', true), ''), 'default'), ${result.id}, ${embeddingSpaceId}, ${sha256Text(content)}, ${vector}::vector, ${result.tokenCount ?? null}, now(), now())
             ON CONFLICT (unit_id, embedding_space_id) DO UPDATE SET
               content_sha256 = EXCLUDED.content_sha256,
               embedding = EXCLUDED.embedding,
@@ -873,8 +1041,11 @@ var KnowledgeEmbeddingIndexer = class {
 // src/services/scheduler.ts
 import {
   advisoryLockKeyForUuid,
-  BranchRepository,
+  BranchRepository as BranchRepository2,
+  getCurrentTenantId,
   isPostgresDatabase as isPostgresDatabase3,
+  runWithSystemDatabaseScope as runWithSystemDatabaseScope2,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope3,
   ScheduleRepository,
   SessionMCPServerRepository,
   SessionRepository,
@@ -941,9 +1112,9 @@ function renderSchedulePrompt(template, branch, schedule, scheduledRunAt) {
 }
 var ScheduleBusyError = class extends Error {
   code = "schedule_busy";
-  constructor(branchName) {
+  constructor(scheduleName) {
     super(
-      `A session is already running in branch "${branchName}" and allow_concurrent_runs is disabled.`
+      `An active run from schedule "${scheduleName}" is already in progress and allow_concurrent_runs is disabled.`
     );
     this.name = "ScheduleBusyError";
   }
@@ -976,9 +1147,10 @@ var SchedulerService = class {
       gracePeriod: config.gracePeriod ?? 12e4,
       // 2 minutes
       debug: config.debug ?? false,
-      unixUserMode: config.unixUserMode ?? "simple"
+      unixUserMode: config.unixUserMode ?? "simple",
+      tenantId: typeof config.tenantId === "string" && config.tenantId.trim() ? config.tenantId.trim() : void 0
     };
-    this.branchRepo = new BranchRepository(db);
+    this.branchRepo = new BranchRepository2(db);
     this.scheduleRepo = new ScheduleRepository(db);
     this.sessionRepo = new SessionRepository(db);
     this.userRepo = new UsersRepository(db);
@@ -1033,18 +1205,25 @@ var SchedulerService = class {
   async tick() {
     const now = Date.now();
     try {
-      const dueSchedules = await this.scheduleRepo.findDue(now + this.config.gracePeriod);
+      const dueScheduleRefs = await this.findDueScheduleRefs(now);
       if (this.config.debug) {
-        console.log(`\u{1F504} Scheduler tick: Found ${dueSchedules.length} due schedules`);
+        console.log(`\u{1F504} Scheduler tick: Found ${dueScheduleRefs.length} due schedules`);
       }
-      for (const schedule of dueSchedules) {
-        try {
-          await this.processSchedule(schedule, now);
-        } catch (error) {
+      for (const ref of dueScheduleRefs) {
+        if (!ref.tenantId) {
           console.error(
-            `\u274C Failed to process schedule ${schedule.schedule_id} (${schedule.name}):`,
-            error
+            `\u274C Skipping due schedule ${shortId4(ref.scheduleId)}: missing tenant metadata`
           );
+          continue;
+        }
+        try {
+          await runWithTenantDatabaseScope3(this.db, ref.tenantId, async () => {
+            const schedule = await this.scheduleRepo.findById(ref.scheduleId);
+            if (!schedule) return;
+            await this.processSchedule(schedule, now);
+          });
+        } catch (error) {
+          console.error(`\u274C Failed to process schedule ${shortId4(ref.scheduleId)}:`, error);
         }
       }
     } catch (error) {
@@ -1052,6 +1231,23 @@ var SchedulerService = class {
       throw error;
     }
   }
+  async findDueScheduleRefs(now) {
+    const findDue = async (tenantId) => {
+      const dueSchedules = await this.scheduleRepo.findDueRefs(now + this.config.gracePeriod);
+      return dueSchedules.map((schedule) => ({
+        scheduleId: schedule.schedule_id,
+        tenantId: tenantId ?? schedule.tenant_id
+      }));
+    };
+    if (this.config.tenantId) {
+      return runWithTenantDatabaseScope3(
+        this.db,
+        this.config.tenantId,
+        () => findDue(this.config.tenantId)
+      );
+    }
+    return runWithSystemDatabaseScope2(this.db, "scheduler due schedule discovery", () => findDue());
+  }
   /**
    * Process a single schedule.
    *
@@ -1127,7 +1323,7 @@ var SchedulerService = class {
    * @throws ScheduleNotReadyError when the schedule is disabled or its
    *   branch can't be loaded.
    * @throws ScheduleBusyError when allow_concurrent_runs is false and
-   *   the branch already has an active session.
+   *   this schedule already has an active run.
    */
   async executeScheduleNow(opts) {
     const { scheduleId, triggeredBy } = opts;
@@ -1222,9 +1418,9 @@ var SchedulerService = class {
    * 1. Look up the schedule's branch (cascaded delete means it should
    *    always exist; we still handle null defensively).
    * 2. Dedup against `sessions(schedule_id, scheduled_run_at)`.
-   * 3. Enforce `allow_concurrent_runs` against any active session in the
-   *    SAME BRANCH (sibling schedules on the same branch are sequential
-   *    by default; opt out per-schedule via allow_concurrent_runs).
+   * 3. Enforce `allow_concurrent_runs` against any active session spawned
+   *    by the SAME SCHEDULE. Different schedules on the same branch do not
+   *    block one another.
    * 4. Render prompt template (Handlebars).
    * 5. Look up creator's unix_username for execution context.
    * 6. Create session with schedule metadata + `schedule_id` FK.
@@ -1237,13 +1433,10 @@ var SchedulerService = class {
    * 9. Enforce retention policy (oldest sessions on this schedule_id
    *    are deleted).
    *
-   * NOTE (multi-daemon, deferred): with the current per-schedule
-   * advisory lock, two daemons can each lock different schedules on
-   * the same branch and both pass the branch-wide concurrency guard
-   * before either creates a session, then both spawn. Branch-scoped
-   * coordination (lock on branch when allow_concurrent_runs=false)
-   * will be needed once we support multi-daemon. Out of scope for V1
-   * since multi-daemon isn't supported yet.
+   * NOTE (multi-daemon, deferred): the per-schedule advisory lock and
+   * partial unique index guard same-schedule races. They deliberately do
+   * not serialize sibling schedules on the same branch, matching the
+   * schedule-scoped meaning of `allow_concurrent_runs=false`.
    */
   async spawnScheduledSession(schedule, scheduledRunAt, now, options = { source: "cron" }) {
     const { source, triggeredBy } = options;
@@ -1267,19 +1460,19 @@ var SchedulerService = class {
       return existingSession;
     }
     if (!schedule.allow_concurrent_runs) {
-      const active = await this.sessionRepo.existsInBranchWithStatuses(
-        branch.branch_id,
+      const active = await this.sessionRepo.existsInScheduleWithStatuses(
+        schedule.schedule_id,
         ACTIVE_SESSION_STATUSES
       );
       if (active) {
         if (manual) {
           console.log(
-            `   \u26D4 ${schedule.name}: manual run blocked \u2014 active session present (allow_concurrent_runs=false)`
+            `   \u26D4 ${schedule.name}: manual run blocked \u2014 active run from this schedule present (allow_concurrent_runs=false)`
           );
-          throw new ScheduleBusyError(branch.name);
+          throw new ScheduleBusyError(schedule.name);
         }
         console.log(
-          `   \u23ED\uFE0F  ${schedule.name}: scheduled run skipped \u2014 active session present (allow_concurrent_runs=false)`
+          `   \u23ED\uFE0F  ${schedule.name}: scheduled run skipped \u2014 active run from this schedule present (allow_concurrent_runs=false)`
         );
         await this.updateScheduleMetadata(schedule, scheduledRunAt, null, now);
         return null;
@@ -1382,6 +1575,7 @@ var SchedulerService = class {
         }
       }
       const promptService = this.app.service("/sessions/:id/prompt");
+      const tenantId = getCurrentTenantId();
       await promptService.create(
         {
           prompt: renderedPrompt,
@@ -1392,8 +1586,9 @@ var SchedulerService = class {
           route: { id: createdSession.session_id },
           provider: void 0,
           // Bypass auth for internal scheduler call
-          user: creator
+          user: creator,
           // Pass creator user for session token generation
+          ...tenantId ? { tenant: { tenant_id: tenantId, source: "explicit" } } : {}
         }
       );
       await this.updateScheduleMetadata(
@@ -1494,11 +1689,15 @@ async function appendSystemMessage(opts) {
 }
 
 // src/utils/git-remote-credential-scan.ts
-import { BranchRepository as BranchRepository2, RepoRepository, shortId as shortId5 } from "@agor/core/db";
-import { scrubGitConfigRemoteCredentials } from "@agor/core/git";
+import {
+  BranchRepository as BranchRepository3,
+  RepoRepository,
+  shortId as shortId5
+} from "@agor/core/db";
+import { scrubGitConfigRemoteCredentials } from "@agor/core/git/exec";
 async function scrubManagedGitRemoteCredentials(db) {
   const repoRepo = new RepoRepository(db);
-  const branchRepo = new BranchRepository2(db);
+  const branchRepo = new BranchRepository3(db);
   const repos = await repoRepo.findAll();
   const repoById = new Map(repos.map((repo) => [repo.repo_id, repo]));
   const remoteRepos = repos.filter((repo) => repo.repo_type === "remote");
@@ -1596,21 +1795,57 @@ async function readAndClearSentinel() {
     return false;
   }
 }
+function startupTenantParams(config) {
+  const multiTenancy = resolveMultiTenancyConfig(config);
+  return {
+    tenant: {
+      tenant_id: multiTenancy.static_tenant_id,
+      source: "static"
+    }
+  };
+}
+async function runStartupTenantDatabaseScope(ctx, work) {
+  return runWithTenantDatabaseScope4(ctx.db, startupTenantParams(ctx.config).tenant.tenant_id, work);
+}
 async function cleanupOrphanStatuses(ctx) {
+  return runStartupTenantDatabaseScope(ctx, () => cleanupOrphanStatusesInTenantScope(ctx));
+}
+async function cleanupOrphanStatusesInTenantScope(ctx) {
   const { app, sessionsService } = ctx;
   const tasksService = app.service("tasks");
+  const startupParams = startupTenantParams(ctx.config);
   const wasGraceful = await readAndClearSentinel();
-  const orphanedTasks = await tasksService.getOrphaned();
+  const orphanedTasks = await tasksService.getOrphaned(startupParams);
   if (orphanedTasks.length > 0) {
     for (const task of orphanedTasks) {
-      await tasksService.patch(task.task_id, {
-        status: TaskStatus.STOPPED
-      });
+      await tasksService.patch(
+        task.task_id,
+        {
+          status: TaskStatus.STOPPED
+        },
+        startupParams
+      );
       startupDebug(
         `[startup] stopped orphaned task ${shortId6(task.task_id)} (was: ${task.status})`
       );
     }
   }
+  const queuedResult = await tasksService.find({
+    query: { status: TaskStatus.QUEUED, $limit: 1e3 },
+    ...startupParams
+  });
+  const queuedTasks = queuedResult.data;
+  if (queuedTasks.length > 0) {
+    for (const task of queuedTasks) {
+      await tasksService.patch(
+        task.task_id,
+        {
+          status: TaskStatus.STOPPED
+        },
+        startupParams
+      );
+    }
+  }
   const orphanedSessions = [];
   for (const status of [
     SessionStatus2.RUNNING,
@@ -1620,7 +1855,8 @@ async function cleanupOrphanStatuses(ctx) {
     SessionStatus2.TIMED_OUT
   ]) {
     const result = await sessionsService.find({
-      query: { status, $limit: 1e3 }
+      query: { status, $limit: 1e3 },
+      ...startupParams
     });
     orphanedSessions.push(...result.data);
   }
@@ -1632,7 +1868,7 @@ async function cleanupOrphanStatuses(ctx) {
           status: SessionStatus2.IDLE,
           ready_for_prompt: true
         },
-        {}
+        startupParams
       );
       startupDebug(
         `   \u2713 Marked session ${shortId6(session.session_id)} as idle (was: ${session.status})`
@@ -1645,7 +1881,7 @@ async function cleanupOrphanStatuses(ctx) {
   let sessionsResetFromOrphanedTasks = 0;
   if (sessionIdsWithOrphanedTasks.size > 0) {
     for (const sessionId of sessionIdsWithOrphanedTasks) {
-      const session = await sessionsService.get(sessionId);
+      const session = await sessionsService.get(sessionId, startupParams);
       if (session.status === SessionStatus2.RUNNING || session.status === SessionStatus2.STOPPING || session.status === SessionStatus2.AWAITING_PERMISSION || session.status === SessionStatus2.TIMED_OUT) {
         await app.service("sessions").patch(
           sessionId,
@@ -1653,7 +1889,7 @@ async function cleanupOrphanStatuses(ctx) {
             status: SessionStatus2.IDLE,
             ready_for_prompt: true
           },
-          {}
+          startupParams
         );
         sessionsResetFromOrphanedTasks++;
         startupDebug(
@@ -1662,16 +1898,36 @@ async function cleanupOrphanStatuses(ctx) {
       }
     }
   }
-  const queuedResult = await tasksService.find({
-    query: { status: TaskStatus.QUEUED, $limit: 1e3 }
+  const bootInterruptedTaskIds = /* @__PURE__ */ new Set([
+    ...orphanedTasks.map((t) => t.task_id),
+    ...queuedTasks.map((t) => t.task_id)
+  ]);
+  const idleNotReadyResult = await sessionsService.find({
+    query: { status: SessionStatus2.IDLE, ready_for_prompt: false, $limit: 1e3 },
+    ...startupParams
   });
-  const queuedTasks = queuedResult.data;
-  if (queuedTasks.length > 0) {
-    for (const task of queuedTasks) {
-      await tasksService.patch(task.task_id, {
-        status: TaskStatus.STOPPED
-      });
+  const stuckIdleSessions = [];
+  for (const session of idleNotReadyResult.data) {
+    const latestTaskId = session.tasks?.at(-1);
+    if (!latestTaskId) {
+      continue;
     }
+    let wasInterrupted = bootInterruptedTaskIds.has(latestTaskId);
+    if (!wasInterrupted) {
+      try {
+        const latestTask = await tasksService.get(latestTaskId, startupParams);
+        wasInterrupted = !isTerminalTaskStatus(latestTask.status);
+      } catch {
+      }
+    }
+    if (!wasInterrupted) {
+      continue;
+    }
+    stuckIdleSessions.push(session);
+    await app.service("sessions").patch(session.session_id, { ready_for_prompt: true }, startupParams);
+    startupDebug(
+      `   \u2713 Unblocked stuck-idle session ${shortId6(session.session_id)} (ready_for_prompt was false, latest task interrupted)`
+    );
   }
   const cleanupParts = [
     `${orphanedTasks.length} orphaned task(s) stopped`,
@@ -1681,6 +1937,9 @@ async function cleanupOrphanStatuses(ctx) {
   if (sessionsResetFromOrphanedTasks > 0) {
     cleanupParts.push(`${sessionsResetFromOrphanedTasks} task-owned session(s) reset`);
   }
+  if (stuckIdleSessions.length > 0) {
+    cleanupParts.push(`${stuckIdleSessions.length} stuck-idle session(s) unblocked`);
+  }
   console.log(`[startup] orphan cleanup: ${cleanupParts.join(", ")}`);
   return {
     wasGraceful,
@@ -1692,9 +1951,16 @@ async function cleanupOrphanStatuses(ctx) {
   };
 }
 async function injectRestartNotices(ctx, cleanupResult) {
+  return runStartupTenantDatabaseScope(
+    ctx,
+    () => injectRestartNoticesInTenantScope(ctx, cleanupResult)
+  );
+}
+async function injectRestartNoticesInTenantScope(ctx, cleanupResult) {
   const { app, db, sessionsService } = ctx;
   const { wasGraceful, orphanedTasks, orphanedSessions, sessionIdsWithOrphanedTasks } = cleanupResult;
   const tasksService = app.service("tasks");
+  const startupParams = startupTenantParams(ctx.config);
   const affectedSessionIds = /* @__PURE__ */ new Set([
     ...orphanedSessions.map((s) => s.session_id),
     ...Array.from(sessionIdsWithOrphanedTasks)
@@ -1704,7 +1970,7 @@ async function injectRestartNotices(ctx, cleanupResult) {
   }
   console.log(`\u{1F9F9} Injecting daemon restart notices for ${affectedSessionIds.size} session(s)...`);
   const restartType = wasGraceful ? "daemon_restart" : "daemon_crash";
-  const messageText = wasGraceful ? "The Agor daemon was restarted while this session was running. Ask the agent to resume where it left off." : "The Agor daemon restarted unexpectedly while this session was running. Ask the agent to resume where it left off.";
+  const messageText = wasGraceful ? "The Agor daemon was restarted while this session was running." : "The Agor daemon restarted unexpectedly while this session was running.";
   const lastOrphanedTaskBySession = /* @__PURE__ */ new Map();
   for (const task of orphanedTasks) {
     const sid = task.session_id;
@@ -1719,10 +1985,10 @@ async function injectRestartNotices(ctx, cleanupResult) {
     try {
       let attachTask = lastOrphanedTaskBySession.get(sessionId);
       if (!attachTask) {
-        const session = await sessionsService.get(sessionId);
+        const session = await sessionsService.get(sessionId, startupParams);
         const latestTaskId = session.tasks?.at(-1);
         if (latestTaskId) {
-          attachTask = await tasksService.get(latestTaskId);
+          attachTask = await tasksService.get(latestTaskId, startupParams);
         }
       }
       if (!attachTask) {
@@ -1811,7 +2077,13 @@ async function startup(ctx) {
     terminalsService
   } = ctx;
   const orphanCleanupResult = await cleanupOrphanStatuses(ctx);
-  const healthMonitor = new HealthMonitor(app);
+  const startupMultiTenancy = resolveMultiTenancyConfig(config);
+  const healthMonitor = new HealthMonitor(app, {
+    defaultParams: startupTenantParams(config),
+    db,
+    tenantId: startupMultiTenancy.mode === "static" ? startupMultiTenancy.static_tenant_id : void 0,
+    requireTenantParams: startupMultiTenancy.mode !== "static"
+  });
   await ensureMasterSecret(config);
   const server = await app.listen(DAEMON_PORT, DAEMON_HOST);
   const displayHost = DAEMON_HOST === "0.0.0.0" ? "localhost" : DAEMON_HOST;
@@ -1823,7 +2095,10 @@ async function startup(ctx) {
   );
   runPostStartJob("health-monitor-initialize", () => healthMonitor.initialize());
   runPostStartJob("daemon-restart-notices", () => injectRestartNotices(ctx, orphanCleanupResult));
-  runPostStartJob("git-remote-credential-scrub", () => scrubManagedGitRemoteCredentials(db));
+  runPostStartJob(
+    "git-remote-credential-scrub",
+    () => runStartupTenantDatabaseScope(ctx, () => scrubManagedGitRemoteCredentials(db))
+  );
   runPostStartJob("host-ip-log", async () => {
     const { resolveHostIpAddress } = await import("@agor/core/utils/host-ip");
     const hostIp = resolveHostIpAddress(config.daemon?.host_ip_address);
@@ -1852,29 +2127,36 @@ async function startup(ctx) {
   }
   let schedulerService = null;
   if (svcEnabled("scheduler")) {
+    const multiTenancy = resolveMultiTenancyConfig(config);
     schedulerService = new SchedulerService(db, app, {
       tickInterval: 3e4,
       // 30 seconds
       gracePeriod: 12e4,
       // 2 minutes
       debug: process.env.NODE_ENV !== "production",
-      unixUserMode: config.execution?.unix_user_mode ?? "simple"
+      unixUserMode: config.execution?.unix_user_mode ?? "simple",
+      // Static mode keeps the historical single-tenant scope. Auth-resolved
+      // multi-tenant mode leaves this undefined so the scheduler discovers due
+      // schedule tenant metadata at the DB boundary on each tick.
+      tenantId: multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0
     });
-    schedulerService.start();
     app.set("scheduler", schedulerService);
-    console.log(`\u{1F504} Scheduler started (tick interval: 30s)`);
+    schedulerService.start();
+    console.log("\u{1F504} Scheduler started (tick interval: 30s)");
   }
   let knowledgeEmbeddingIndexer = null;
   if (svcEnabled("knowledge")) {
-    knowledgeEmbeddingIndexer = new KnowledgeEmbeddingIndexer(db);
+    knowledgeEmbeddingIndexer = new KnowledgeEmbeddingIndexer(db, {
+      tenantId: startupTenantParams(config).tenant.tenant_id
+    });
     knowledgeEmbeddingIndexer.start();
     app.set("knowledgeEmbeddingIndexer", knowledgeEmbeddingIndexer);
     console.log("\u{1F9E0} Knowledge embedding indexer started");
   }
   const gatewayService = safeService("gateway");
   if (gatewayService) {
-    gatewayService.refreshChannelState().then(() => {
-      return gatewayService.startListeners();
+    runStartupTenantDatabaseScope(ctx, () => gatewayService.refreshChannelState()).then(() => {
+      return runStartupTenantDatabaseScope(ctx, () => gatewayService.startListeners());
     }).catch((error) => {
       console.error("[gateway] Failed to start listeners:", error);
     });
@@ -1941,6 +2223,7 @@ async function startup(ctx) {
   process.on("SIGINT", () => shutdown("SIGINT"));
 }
 export {
+  cleanupOrphanStatuses,
   runPostStartJob,
   startup
 };