agor-live 0.22.0 → 0.23.2

package/dist/daemon/mcp/tools/branches.js

@@ -125,6 +125,13 @@ function generateTaskId() {
   return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
 }
 function findExecutorPath() {
+  const configuredPath = process.env.AGOR_EXECUTOR_PATH;
+  if (configuredPath) {
+    if (!existsSync(configuredPath)) {
+      throw new Error(`Configured AGOR_EXECUTOR_PATH does not exist: ${configuredPath}`);
+    }
+    return configuredPath;
+  }
   const dirname = typeof __dirname !== "undefined" ? __dirname : path4.dirname(fileURLToPath(import.meta.url));
   const possiblePaths = [
     path4.join(dirname, "../executor/cli.js"),
@@ -423,12 +430,16 @@ function createServiceToken(jwtSecret, expiresIn, scope = {}) {
     expiresIn || "5m"
   );
 }
-function generateSessionToken(app) {
+function serviceTokenScopeForParams(params) {
+  const tenantId = params?.tenant?.tenant_id ?? params?.tenant_id ?? params?.user?.tenant_id;
+  return tenantId ? { tenant_id: tenantId } : {};
+}
+function generateSessionToken(app, scope = {}) {
   const jwtSecret = app.settings.authentication?.secret;
   if (!jwtSecret) {
     throw new Error("JWT secret not configured in app settings");
   }
-  return createServiceToken(jwtSecret);
+  return createServiceToken(jwtSecret, void 0, scope);
 }
 var configuredDaemonUrl, configuredExecutorDefaults, EXECUTOR_RESULT_PREFIX;
 var init_spawn_executor = __esm({
@@ -448,7 +459,8 @@ function isBranchInspectResult(value) {
 }
 async function inspectBranchViaExecutor(app, branchId, options = {}) {
   const sessionToken = generateSessionToken(
-    app
+    app,
+    options.serviceTokenScope
   );
   const result = await runExecutorCommand(
     {
@@ -545,7 +557,8 @@ async function fireAlwaysNewZoneTrigger(input) {
   const asUser = db ? await resolveExecutorReadAsUser(db, user) : void 0;
   const { currentSha, currentRef } = await inspectBranchViaExecutor(app, branch.branch_id, {
     asUser,
-    logPrefix: `[zone-trigger ${branch.name}]`
+    logPrefix: `[zone-trigger ${branch.name}]`,
+    serviceTokenScope: serviceTokenScopeForParams(params)
   });
   const newSession = await app.service("sessions").create(
     {
@@ -588,14 +601,15 @@ var init_zone_trigger = __esm({
     "use strict";
     init_branch_inspect();
     init_executor_read_impersonation();
+    init_spawn_executor();
     VALID_AGENTS = ["claude-code", "codex", "gemini", "opencode"];
   }
 });
 
 // src/mcp/tools/branches.ts
 import { existsSync as existsSync2 } from "fs";
-import { isBranchRbacEnabled as isBranchRbacEnabled2 } from "@agor/core/config";
-import { BranchRepository as BranchRepository5, shortId as shortId6 } from "@agor/core/db";
+import { isBranchRbacEnabled as isBranchRbacEnabled2, loadConfig as loadConfig2 } from "@agor/core/config";
+import { BranchRepository as BranchRepository6, shortId as shortId6 } from "@agor/core/db";
 import { BRANCH_PERMISSION_LEVELS as BRANCH_PERMISSION_LEVELS2, getAssistantConfig as getAssistantConfig3, isAssistant as isAssistant3 } from "@agor/core/types";
 import { computeZoneRelativePosition } from "@agor/core/utils/board-placement";
 import { normalizeOptionalHttpUrl } from "@agor/core/utils/url";
@@ -15114,11 +15128,19 @@ function date4(params) {
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 config(en_default());
 
-// src/mcp/resolve-ids.ts
-async function resolveSessionId(ctx, id) {
-  const entity = await ctx.app.service("sessions").get(id, ctx.baseServiceParams);
-  return entity.session_id;
+// src/utils/branch-authorization.ts
+import { shortId } from "@agor/core/db";
+import { Forbidden, NotAuthenticated, NotFound } from "@agor/core/feathers";
+import { BRANCH_PERMISSION_LEVELS, hasMinimumRole, ROLES } from "@agor/core/types";
+function isSuperAdmin(role, allowSuperadmin = true) {
+  if (!allowSuperadmin) return false;
+  return role === ROLES.SUPERADMIN || role === "owner";
 }
+var PERMISSION_RANK = Object.fromEntries(
+  BRANCH_PERMISSION_LEVELS.map((level, i) => [level, i - 1])
+);
+
+// src/mcp/resolve-ids.ts
 async function resolveBranchId(ctx, id) {
   const entity = await ctx.app.service("branches").get(id, ctx.baseServiceParams);
   return entity.branch_id;
@@ -15150,6 +15172,11 @@ function mcpOptionalString(fieldName, description) {
     error: `${fieldName} must be a string when provided.`
   }).optional().describe(description);
 }
+function mcpOptionalNonEmptyString(fieldName, description) {
+  return external_exports.string({
+    error: `${fieldName} must be a string when provided.`
+  }).min(1, `${fieldName} cannot be empty when provided.`).optional().describe(description);
+}
 function mcpOptionalNonBlankString(fieldName, description) {
   return external_exports.string({
     error: `${fieldName} must be a string when provided.`
@@ -15195,7 +15222,11 @@ import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 
 // src/mcp/tokens.ts
 import { MCP_TOKEN } from "@agor/core/config";
-import { generateId, SessionRepository, shortId } from "@agor/core/db";
+import {
+  generateId,
+  SessionRepository,
+  shortId as shortId2
+} from "@agor/core/db";
 import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
@@ -15216,6 +15247,7 @@ var DOMAIN_DESCRIPTIONS = {
   users: "User accounts, profiles, preferences, and administration",
   analytics: "Usage and cost tracking leaderboard",
   "mcp-servers": "External MCP server configuration and OAuth management",
+  gateway: "Gateway channels for Slack, GitHub, Teams, and other message integrations",
   proxies: "Configured HTTP proxies for third-party APIs (Shortcut, Linear, Jira, etc.)",
   widgets: "In-conversation interactive widgets \u2014 agents render small forms/buttons inline in the transcript to capture user input that never enters the LLM context",
   knowledge: "DB-backed markdown knowledge documents, version history, search, and graph links",
@@ -15229,16 +15261,6 @@ function formatDomainDescriptionsForInstructions() {
 import path from "path";
 import { BranchRepository } from "@agor/core/db";
 import { NotFoundError } from "@agor/core/utils/errors";
-
-// src/utils/branch-authorization.ts
-import { shortId as shortId2 } from "@agor/core/db";
-import { Forbidden, NotAuthenticated, NotFound } from "@agor/core/feathers";
-import { BRANCH_PERMISSION_LEVELS, hasMinimumRole, ROLES } from "@agor/core/types";
-var PERMISSION_RANK = Object.fromEntries(
-  BRANCH_PERMISSION_LEVELS.map((level, i) => [level, i - 1])
-);
-
-// src/mcp/tools/artifacts.ts
 var SANDPACK_TEMPLATES = [
   "react",
   "react-ts",
@@ -15295,12 +15317,211 @@ function assertValidVariant(repo, variant) {
   }
 }
 
+// src/mcp/tools/gateway-channels.ts
+import {
+  BranchRepository as BranchRepository2,
+  GatewayChannelRepository,
+  SessionRepository as SessionRepository2,
+  ThreadSessionMapRepository
+} from "@agor/core/db";
+import {
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
+} from "@agor/core/gateway";
+import {
+  GATEWAY_REDACTED_SENTINEL,
+  GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
+  hasMinimumRole as hasMinimumRole2,
+  ROLES as ROLES2
+} from "@agor/core/types";
+var configSchema = external_exports.record(external_exports.string(), external_exports.unknown()).describe(
+  "Platform-specific gateway configuration. Secrets are stored encrypted and returned redacted. Prefer env/template references for shared credentials where the connector supports them."
+);
+var outboundTargetSchema = external_exports.string().trim().regex(
+  /^(channel:[^:\s]+|channel_name:[^\s]+|#[^\s]+|(?:email:|user_email:)?[^@\s]+@[^@\s]+\.[^@\s]+)$/
+).describe(
+  "Slack outbound target for v0: channel:C123, #project-updates, channel_name:project-updates, or user@example.com. Thread targets are intentionally not supported."
+);
+var envVarSchema = external_exports.strictObject({
+  key: mcpRequiredString("agenticConfig.envVars[].key", "Environment variable name"),
+  value: mcpRequiredString(
+    "agenticConfig.envVars[].value",
+    `Environment variable value. Prefer references/templates over raw secrets. Existing redacted values may be passed as '${GATEWAY_REDACTED_SENTINEL}' on update to preserve them.`
+  ),
+  forceOverride: external_exports.boolean().optional().describe("When true, channel value wins over user env vars. Defaults to false.")
+});
+var agenticConfigSchema = external_exports.strictObject({
+  agent: external_exports.enum(["claude-code", "claude-code-cli", "codex", "gemini", "opencode", "copilot", "cursor"]).describe("Agent used for sessions created from this gateway channel."),
+  permissionMode: external_exports.enum([
+    "default",
+    "acceptEdits",
+    "bypassPermissions",
+    "plan",
+    "dontAsk",
+    "autoEdit",
+    "yolo",
+    "ask",
+    "auto",
+    "on-failure",
+    "allow-all"
+  ]).optional().describe("Permission mode for spawned sessions."),
+  modelConfig: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Agent model configuration."),
+  mcpServerIds: external_exports.array(external_exports.string().min(1)).optional().describe("MCP server IDs to attach to gateway-created sessions."),
+  codexSandboxMode: external_exports.enum(["read-only", "workspace-write", "danger-full-access"]).optional().describe("Codex sandbox mode for Codex gateway sessions."),
+  codexApprovalPolicy: external_exports.enum(["untrusted", "on-failure", "on-request", "never"]).optional().describe("Codex approval policy for Codex gateway sessions."),
+  codexNetworkAccess: external_exports.boolean().optional().describe("Allow Codex network access."),
+  envVars: external_exports.array(envVarSchema).optional().describe("Gateway-level env vars. Values are redacted in responses.")
+}).describe("Agent/session defaults for conversations created through this gateway channel.");
+var gatewayChannelCreateSchema = external_exports.strictObject({
+  name: mcpRequiredString("name", 'Human-readable channel name, e.g. "Engineering Slack".'),
+  channelType: external_exports.enum(["slack", "github", "teams", "discord", "whatsapp", "telegram"]).default("slack").describe("Gateway platform type. Current active connectors are slack, github, and teams."),
+  targetBranchId: mcpRequiredId(
+    "targetBranchId",
+    "Branch",
+    "Branch/worktree ID that this gateway channel prompts."
+  ),
+  agorUserId: mcpOptionalId(
+    "agorUserId",
+    "User",
+    "Agor user ID whose identity is used when platform-user alignment is disabled."
+  ),
+  enabled: external_exports.boolean().optional().describe("Whether the channel is active. Defaults to true."),
+  config: configSchema,
+  agenticConfig: agenticConfigSchema.optional()
+}).superRefine((value, issue2) => {
+  const config2 = value.config ?? {};
+  if (value.enabled !== false) {
+    const requiredSecretMessages = {
+      bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+      app_token: "config.app_token is required for Slack Socket Mode.",
+      private_key: "config.private_key is required for GitHub gateway channels.",
+      app_password: "config.app_password is required for Teams gateway channels."
+    };
+    for (const field of getRequiredSecretFields(value.channelType, config2)) {
+      if (!config2[field]) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["config", field],
+          message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
+        });
+      }
+    }
+  }
+  if (value.channelType === "github") {
+    for (const field of ["app_id", "installation_id", "watch_repos"]) {
+      if (!config2[field]) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["config", field],
+          message: `config.${field} is required for GitHub gateway channels.`
+        });
+      }
+    }
+  }
+  if (value.channelType === "teams" && !config2.app_id) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["config", "app_id"],
+      message: "config.app_id is required for Teams gateway channels."
+    });
+  }
+  if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["agorUserId"],
+      message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+    });
+  }
+});
+var slackThreadHistorySchema = external_exports.strictObject({
+  sessionId: mcpOptionalId(
+    "sessionId",
+    "Session",
+    "Preferred: resolve the Slack thread mapping from an accessible Agor session ID (UUIDv7 or short ID). If provided, gatewayChannelId/threadId are ignored."
+  ),
+  gatewayChannelId: mcpOptionalId(
+    "gatewayChannelId",
+    "Gateway channel",
+    "Explicit Slack gateway channel ID (UUIDv7 or short ID). Required when sessionId is omitted."
+  ),
+  threadId: mcpOptionalNonEmptyString(
+    "threadId",
+    "Explicit Slack thread ID in Agor gateway format, e.g. C123-171234.000100. Required when sessionId is omitted."
+  ),
+  oldestTs: mcpOptionalNonEmptyString(
+    "oldestTs",
+    "Optional Slack oldest timestamp bound, e.g. 171234.000100."
+  ),
+  latestTs: mcpOptionalNonEmptyString(
+    "latestTs",
+    "Optional Slack latest timestamp bound, e.g. 171235.000200."
+  ),
+  inclusive: external_exports.boolean().optional().describe("Whether Slack should include messages exactly at oldest/latest bounds."),
+  limit: mcpLimit(50).describe("Maximum Slack messages to request (default: 50, max: 200)."),
+  includeBotMessages: external_exports.boolean().optional().describe("Include Slack bot messages in the returned history. Defaults to false."),
+  format: external_exports.enum(["messages", "markdown"]).optional().describe(
+    'Response body format. "messages" returns normalized JSON; "markdown" returns a transcript string.'
+  )
+}).superRefine((value, issue2) => {
+  if (value.sessionId) return;
+  if (!value.gatewayChannelId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["gatewayChannelId"],
+      message: "gatewayChannelId is required when sessionId is omitted."
+    });
+  }
+  if (!value.threadId) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["threadId"],
+      message: "threadId is required when sessionId is omitted."
+    });
+  }
+});
+var gatewayChannelUpdateSchema = external_exports.strictObject({
+  gatewayChannelId: mcpRequiredId(
+    "gatewayChannelId",
+    "Gateway channel",
+    "Gateway channel ID (UUIDv7 or short ID)"
+  ),
+  name: mcpOptionalNonEmptyString("name", "New human-readable channel name."),
+  channelType: external_exports.enum(["slack", "github", "teams", "discord", "whatsapp", "telegram"]).optional().describe("Gateway platform type. Changing this should include compatible config."),
+  targetBranchId: mcpOptionalId("targetBranchId", "Branch", "New target branch/worktree ID."),
+  agorUserId: mcpOptionalId("agorUserId", "User", "New run-as Agor user ID."),
+  enabled: external_exports.boolean().optional().describe("Enable/disable the channel."),
+  config: configSchema.optional().describe(
+    `Partial platform config to merge. Send '${GATEWAY_REDACTED_SENTINEL}' or omit sensitive fields to preserve existing secrets; send a new value to rotate.`
+  ),
+  agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
+});
+var slackManifestGenerateSchema = external_exports.strictObject({
+  appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+  botDisplayName: mcpOptionalNonEmptyString(
+    "botDisplayName",
+    "Bot user display name. Defaults to appName."
+  ),
+  publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+  privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+  groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+  alignUsers: external_exports.boolean().default(true).describe(
+    "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+  ),
+  outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+  restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+    "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+  )
+});
+
 // src/mcp/tools/knowledge.ts
 import { createHash, randomUUID } from "crypto";
 import fs2 from "fs";
 import { mkdir, readFile, writeFile } from "fs/promises";
 import path3 from "path";
-import { BranchRepository as BranchRepository3, KnowledgeNamespaceRepository as KnowledgeNamespaceRepository2 } from "@agor/core/db";
+import { BranchRepository as BranchRepository4, KnowledgeNamespaceRepository as KnowledgeNamespaceRepository2 } from "@agor/core/db";
 import { NotFound as NotFound2 } from "@agor/core/feathers";
 import {
   buildKnowledgeDocumentUri,
@@ -15326,14 +15547,14 @@ import { unified } from "unified";
 
 // src/services/assistant-knowledge.ts
 import {
-  BranchRepository as BranchRepository2,
+  BranchRepository as BranchRepository3,
   KnowledgeNamespaceRepository,
   shortId as shortId3
 } from "@agor/core/db";
 import { getAssistantConfig, isAssistant } from "@agor/core/types";
 
 // src/services/knowledge-access.ts
-import { hasMinimumRole as hasMinimumRole2, ROLES as ROLES2 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole3, ROLES as ROLES3 } from "@agor/core/types";
 
 // src/utils/branch-workspace-path.ts
 import fs from "fs";
@@ -15475,6 +15696,261 @@ var KnowledgeNodeRefSchema = external_exports.object(
   "Reference to an existing or creatable knowledge graph node. Prefer nodeId or uri; use typed IDs for links to Agor core objects."
 );
 
+// src/mcp/tools/mcp-servers.ts
+import {
+  isReservedMCPCustomHeaderName,
+  isValidMCPHeaderName
+} from "@agor/core/tools/mcp/http-headers";
+var mcpNameSchema = external_exports.string({
+  error: 'name is required and must be a string. Example: { "name": "context7" }'
+}).regex(
+  /^[a-z][a-z0-9_-]{0,63}$/,
+  'name must start with a lowercase letter and contain only lowercase letters, digits, "_" or "-" (max 64 chars).'
+).describe('Stable internal ID, e.g. "context7", "github", "datadog". Cannot be changed later.');
+var stringMapSchema = external_exports.record(external_exports.string(), external_exports.string()).describe(
+  "JSON object of string keys/values. Values may use templates like {{ user.env.API_TOKEN }}."
+);
+var mcpAuthInputSchema = external_exports.strictObject({
+  type: external_exports.enum(["none", "bearer", "jwt", "oauth"]).describe(
+    "Authentication mode. OAuth tip: start with { type: 'oauth' } plus the MCP server URL; only add endpoint/client fields if discovery/DCR fails."
+  ),
+  token: mcpOptionalString(
+    "auth.token",
+    "Bearer token. Prefer {{ user.env.MCP_TOKEN }} templates; raw secrets will be stored redacted but are still visible in this MCP call transcript."
+  ),
+  api_url: mcpOptionalString("auth.api_url", "JWT auth API URL."),
+  api_token: mcpOptionalString(
+    "auth.api_token",
+    "JWT API token. Prefer {{ user.env.JWT_TOKEN }} templates."
+  ),
+  api_secret: mcpOptionalString(
+    "auth.api_secret",
+    "JWT API secret. Prefer {{ user.env.JWT_SECRET }} templates."
+  ),
+  oauth_authorization_url: mcpOptionalString(
+    "auth.oauth_authorization_url",
+    "Optional OAuth authorization endpoint override. Leave blank for discovery."
+  ),
+  oauth_token_url: mcpOptionalString(
+    "auth.oauth_token_url",
+    "Optional OAuth token endpoint override. Leave blank for discovery."
+  ),
+  oauth_client_id: mcpOptionalString(
+    "auth.oauth_client_id",
+    "Optional OAuth client ID for providers that require a pre-registered app. Leave blank for Dynamic Client Registration where supported."
+  ),
+  oauth_client_secret: mcpOptionalString(
+    "auth.oauth_client_secret",
+    "Optional OAuth client secret. Prefer {{ user.env.OAUTH_CLIENT_SECRET }} templates; raw secrets are not returned by this tool."
+  ),
+  oauth_scope: mcpOptionalString("auth.oauth_scope", "Optional OAuth scopes, space-separated."),
+  oauth_grant_type: external_exports.enum(["client_credentials", "authorization_code"]).optional().describe(
+    "OAuth grant type hint. Defaults to 'client_credentials' for legacy token testing; browser OAuth uses authorization code with PKCE."
+  ),
+  oauth_mode: external_exports.enum(["per_user", "shared"]).optional().describe("OAuth token ownership. Defaults to 'per_user' (recommended)."),
+  insecure: external_exports.boolean().optional().describe("Allow insecure auth behavior if supported.")
+}).superRefine((auth, issue2) => {
+  if (auth.type === "bearer" && !auth.token) {
+    issue2.addIssue({
+      code: "custom",
+      path: ["token"],
+      message: "auth.token is required when auth.type is 'bearer'."
+    });
+  }
+  const fieldsByType = {
+    none: [],
+    bearer: ["token"],
+    jwt: ["api_url", "api_token", "api_secret"],
+    oauth: [
+      "oauth_authorization_url",
+      "oauth_token_url",
+      "oauth_client_id",
+      "oauth_client_secret",
+      "oauth_scope",
+      "oauth_grant_type",
+      "oauth_mode",
+      "insecure"
+    ]
+  };
+  const allowed = /* @__PURE__ */ new Set(["type", ...fieldsByType[auth.type]]);
+  for (const key of Object.keys(auth)) {
+    if (!allowed.has(key)) {
+      issue2.addIssue({
+        code: "custom",
+        path: [key],
+        message: `auth.${key} does not apply when auth.type is '${auth.type}'.`
+      });
+    }
+  }
+  if (auth.type === "jwt") {
+    for (const field of ["api_url", "api_token", "api_secret"]) {
+      if (!auth[field]) {
+        issue2.addIssue({
+          code: "custom",
+          path: [field],
+          message: `auth.${field} is required when auth.type is 'jwt'.`
+        });
+      }
+    }
+  }
+}).describe(
+  "Auth config. Common OAuth path: { type: 'oauth' } plus url; leave OAuth URLs/client fields blank first so metadata discovery/DCR can do the work."
+);
+var toolPermissionsSchema = external_exports.record(external_exports.string(), external_exports.enum(["ask", "allow", "deny"])).describe("Optional per-tool permissions, e.g. { 'list_files': 'allow', 'write_file': 'ask' }.");
+var mcpServerCreateSchema = external_exports.strictObject({
+  name: mcpNameSchema,
+  displayName: mcpOptionalNonEmptyString(
+    "displayName",
+    'Human-friendly display name, e.g. "Context7 MCP".'
+  ),
+  description: mcpOptionalString("description", "Optional description."),
+  transport: external_exports.enum(["stdio", "http", "sse"]).optional().describe(
+    "Transport. Defaults to 'http' when url is provided, otherwise 'stdio'. Most remote OAuth MCP servers use 'http'."
+  ),
+  url: mcpOptionalString(
+    "url",
+    "Remote MCP server URL for http/sse transports. Supports templates like {{ user.env.MCP_URL }}."
+  ),
+  command: mcpOptionalString("command", 'Local command for stdio transport, e.g. "npx".'),
+  args: external_exports.array(external_exports.string()).optional().describe(
+    'Arguments for stdio command, e.g. ["-y", "@modelcontextprotocol/server-filesystem"].'
+  ),
+  headers: stringMapSchema.optional().describe(
+    "Custom HTTP headers for http/sse transports. Do not include Authorization; use auth instead. Prefer templates for secret values."
+  ),
+  env: stringMapSchema.optional().describe(
+    "Environment variables for the MCP process/config. Prefer {{ user.env.VAR }} templates for secrets."
+  ),
+  auth: mcpAuthInputSchema.optional(),
+  scope: external_exports.enum(["global", "session"]).optional().describe(
+    "Scope. Defaults to 'global' so it appears in agor_mcp_servers_list. 'session' is only for explicit session attachment workflows."
+  ),
+  enabled: external_exports.boolean().optional().describe("Whether the server is enabled. Defaults to true."),
+  attachToCurrentSession: external_exports.boolean().optional().describe(
+    `If true, also add a session-specific link after creating. Mostly useful for scope:"session" servers; global enabled servers are already in each session's effective MCP set.`
+  ),
+  attachToSessionId: mcpOptionalId(
+    "attachToSessionId",
+    "Session",
+    "Optional session ID (UUIDv7 or short ID) to attach after creating. Overrides attachToCurrentSession."
+  )
+}).superRefine((value, issue2) => validateMcpServerConfig(value, issue2, false));
+var mcpServerUpdateSchema = external_exports.strictObject({
+  mcpServerId: mcpRequiredId(
+    "mcpServerId",
+    "MCP server",
+    "MCP server ID to update (UUIDv7 or short ID)"
+  ),
+  displayName: mcpOptionalNonEmptyString("displayName", "New human-friendly display name."),
+  description: mcpOptionalString(
+    "description",
+    "New description. Pass an empty string to clear."
+  ),
+  transport: external_exports.enum(["stdio", "http", "sse"]).optional().describe("Transport to set."),
+  url: mcpOptionalString("url", "Remote MCP URL for http/sse transports."),
+  command: mcpOptionalString("command", "Local command for stdio transport."),
+  args: external_exports.array(external_exports.string()).optional().describe("Arguments for stdio command."),
+  headers: stringMapSchema.optional().describe(
+    "Replace custom HTTP headers. Redacted existing header values may be passed back unchanged by the UI; this tool should normally pass real template values or omit headers."
+  ),
+  env: stringMapSchema.optional().describe("Replace environment variables."),
+  auth: mcpAuthInputSchema.optional().describe(
+    "Replace auth config. Existing redacted secrets are preserved if their redacted placeholders are passed back; prefer omitting auth unless changing it. Use { type: 'none' } to clear auth."
+  ),
+  scope: external_exports.enum(["global", "session"]).optional().describe("Scope to set."),
+  enabled: external_exports.boolean().optional().describe("Enabled flag."),
+  toolPermissions: toolPermissionsSchema.optional()
+}).superRefine((value, issue2) => validateMcpServerConfig(value, issue2, true));
+function validateHeaders(headers, issue2) {
+  if (!headers) return;
+  for (const [key, value] of Object.entries(headers)) {
+    const name = key.trim();
+    if (!name) {
+      issue2.addIssue({
+        code: "custom",
+        path: ["headers", key],
+        message: "Header names cannot be empty."
+      });
+    } else if (!isValidMCPHeaderName(name)) {
+      issue2.addIssue({
+        code: "custom",
+        path: ["headers", key],
+        message: `Invalid HTTP header name: ${key}`
+      });
+    } else if (isReservedMCPCustomHeaderName(name)) {
+      issue2.addIssue({
+        code: "custom",
+        path: ["headers", key],
+        message: `Header ${name} is reserved; configure Authorization through auth instead.`
+      });
+    }
+    if (typeof value !== "string") {
+      issue2.addIssue({
+        code: "custom",
+        path: ["headers", key],
+        message: "Header values must be strings."
+      });
+    }
+  }
+}
+function validateMcpServerConfig(value, issue2, partial2) {
+  const transport = value.transport ?? (value.url ? "http" : "stdio");
+  validateHeaders(value.headers, issue2);
+  if (!partial2 || value.transport !== void 0 || value.url !== void 0 || value.command !== void 0) {
+    if (transport === "stdio") {
+      if (!partial2 && !value.command) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["command"],
+          message: "command is required for stdio transport."
+        });
+      }
+      if (value.url) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["url"],
+          message: "url only applies to http/sse transports, not stdio."
+        });
+      }
+      if (value.headers) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["headers"],
+          message: "headers only apply to http/sse transports, not stdio."
+        });
+      }
+      if (value.auth && value.auth.type !== "none") {
+        issue2.addIssue({
+          code: "custom",
+          path: ["auth", "type"],
+          message: "Authentication config only applies to http/sse transports."
+        });
+      }
+    } else if (!partial2 && !value.url) {
+      issue2.addIssue({
+        code: "custom",
+        path: ["url"],
+        message: `url is required for ${transport} transport.`
+      });
+    } else {
+      if (value.command) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["command"],
+          message: "command only applies to stdio transport, not http/sse."
+        });
+      }
+      if (value.args && value.args.length > 0) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["args"],
+          message: "args only apply to stdio transport, not http/sse."
+        });
+      }
+    }
+  }
+}
+
 // src/mcp/tools/messages.ts
 import { isBranchRbacEnabled } from "@agor/core/config";
 import {
@@ -15482,13 +15958,15 @@ import {
   asc,
   desc,
   eq,
-  inArray,
+  gte,
+  lte,
   messages as messagesTable,
   or,
-  SessionRepository as SessionRepository2,
   select,
-  sql
+  sql,
+  visibleSessionReferenceAccessExists
 } from "@agor/core/db";
+var MAX_CROSS_SESSION_SEARCH_WINDOW_MS = 31 * 24 * 60 * 60 * 1e3;
 
 // src/mcp/tools/proxies.ts
 import { getBaseUrl, loadConfig, resolveProxies } from "@agor/core/config";
@@ -15503,7 +15981,7 @@ var agenticToolConfigSchema = external_exports.object({
   model_config: external_exports.object({
     mode: external_exports.enum(["alias", "exact"]).optional(),
     model: mcpOptionalString("model_config.model", "Model name override."),
-    effort: external_exports.enum(["low", "medium", "high", "max"]).optional(),
+    effort: external_exports.enum(["low", "medium", "high", "xhigh", "max"]).optional(),
     advisorModel: mcpOptionalString(
       "model_config.advisorModel",
       "Claude Code advisor model override (e.g. 'opus', 'sonnet', 'fable')."
@@ -15519,7 +15997,7 @@ var agenticToolConfigSchema = external_exports.object({
 
 // src/mcp/tools/sessions.ts
 import {
-  BranchRepository as BranchRepository4,
+  BranchRepository as BranchRepository5,
   SessionRelationshipRepository,
   shortId as shortId4
 } from "@agor/core/db";
@@ -15542,6 +16020,7 @@ import {
 } from "@agor/core/types";
 init_branch_inspect();
 init_executor_read_impersonation();
+init_spawn_executor();
 var modelConfigObjectSchema = external_exports.object({
   mode: external_exports.enum(["alias", "exact"]).optional().describe("Model selection mode (default: 'alias')"),
   // .min(1): reject empty-string model explicitly so callers don't silently
@@ -15550,7 +16029,7 @@ var modelConfigObjectSchema = external_exports.object({
     "modelConfig.model",
     "Model identifier (e.g. 'claude-opus-4-6', 'claude-sonnet-4-6')"
   ),
-  effort: external_exports.enum(["low", "medium", "high", "max"]).optional().describe("Reasoning effort level (default: high)"),
+  effort: external_exports.enum(["low", "medium", "high", "xhigh", "max"]).optional().describe("Reasoning effort level (default: high)"),
   advisorModel: mcpOptionalString(
     "modelConfig.advisorModel",
     "Claude Code advisor model override (e.g. 'opus', 'sonnet', 'fable', or a full model ID)."
@@ -15571,10 +16050,10 @@ var modelConfigInputSchema = external_exports.union([
 );
 
 // src/mcp/tools/users.ts
-import { ROLES as ROLES3 } from "@agor/core/types";
+import { ROLES as ROLES4 } from "@agor/core/types";
 
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole2 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole5, MessageRole as MessageRole2, ROLES as ROLES6 } from "@agor/core/types";
 
 // src/utils/append-system-message.ts
 import { generateId as generateId2, SessionRepository as SessionRepository3 } from "@agor/core/db";
@@ -15584,9 +16063,20 @@ import { MessageRole } from "@agor/core/types";
 import { EXECUTING_TASK_STATUSES, isTaskExecuting } from "@agor/core/types";
 
 // src/widgets/env-vars/index.ts
-import { ENV_VAR_CONSTRAINTS, isEnvVarAllowed, validateEnvVar } from "@agor/core/config";
+import {
+  ENV_VAR_CONSTRAINTS,
+  isEnvVarAllowed,
+  validateEnvVar
+} from "@agor/core/config";
+import { SessionEnvSelectionRepository } from "@agor/core/db";
 import { BadRequest } from "@agor/core/feathers";
 var ENV_VAR_NAME_REGEX = ENV_VAR_CONSTRAINTS.NAME_PATTERN;
+var envVarFieldMetadataSchema = external_exports.object({
+  description: external_exports.string().max(200).optional(),
+  placeholder: external_exports.string().max(120).optional(),
+  format_hint: external_exports.string().max(80).optional(),
+  input_type: external_exports.enum(["password", "text", "textarea"]).default("password").optional()
+}).strict();
 var envVarsParamsSchema = external_exports.object({
   names: external_exports.array(external_exports.string().regex(ENV_VAR_NAME_REGEX)).min(1).max(10).refine((names) => new Set(names).size === names.length, {
     message: "Env var names must be unique"
@@ -15594,20 +16084,82 @@ var envVarsParamsSchema = external_exports.object({
   reason: external_exports.string().min(1).max(200).describe(
     "One sentence explaining why you need the value(s). Keep it tight \u2014 this renders in a small muted line under the input. NOT a place to restate what the widget does."
   ),
+  variable_metadata: external_exports.record(external_exports.string().regex(ENV_VAR_NAME_REGEX), envVarFieldMetadataSchema).optional().describe(
+    "Optional per-variable display metadata keyed by requested name. Allowed keys per variable: description, placeholder, format_hint, input_type (password|text|textarea). Do not include values, defaults, examples containing secrets, or anything secret-like."
+  ),
   auto_resume: external_exports.boolean().default(true).describe(
     "When true (default), a system-authored prompt is auto-queued back into the agent on submit/dismiss."
   )
+}).superRefine((params, ctx) => {
+  const requested = new Set(params.names);
+  for (const key of Object.keys(params.variable_metadata ?? {})) {
+    if (!requested.has(key)) {
+      ctx.addIssue({
+        code: external_exports.ZodIssueCode.custom,
+        path: ["variable_metadata", key],
+        message: `Metadata key ${key} must match a requested env var name`
+      });
+    }
+  }
 });
 var envVarsSubmitSchema = external_exports.object({
   values: external_exports.record(
     external_exports.string().regex(ENV_VAR_NAME_REGEX),
     external_exports.string().min(1).max(ENV_VAR_CONSTRAINTS.MAX_VALUE_LENGTH)
-  ).refine((v) => Object.keys(v).length >= 1 && Object.keys(v).length <= 10, {
-    message: "Must submit between 1 and 10 env vars"
-  }),
+  ).default({}),
+  use_existing: external_exports.array(external_exports.string().regex(ENV_VAR_NAME_REGEX)).max(10).default([]).describe("Requested names whose already-saved global values should be used."),
   scope: external_exports.enum(["global", "session"])
+}).superRefine((submit, ctx) => {
+  const valueNames = Object.keys(submit.values);
+  const existingNames = submit.use_existing;
+  const total = valueNames.length + existingNames.length;
+  if (total < 1 || total > 10) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      message: "Must submit between 1 and 10 env vars"
+    });
+  }
+  const duplicates = existingNames.filter((name) => valueNames.includes(name));
+  for (const name of duplicates) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["use_existing"],
+      message: `Cannot both submit and use existing value for ${name}`
+    });
+  }
+  if (new Set(existingNames).size !== existingNames.length) {
+    ctx.addIssue({
+      code: external_exports.ZodIssueCode.custom,
+      path: ["use_existing"],
+      message: "use_existing names must be unique"
+    });
+  }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden2 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole4,
+  ROLES as ROLES5
+} from "@agor/core/types";
+var MAX_TOKEN_LENGTH = 8192;
+var gatewayTokenParamsSchema = external_exports.object({
+  gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+  channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+  channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+  fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+    message: "Token field names must be unique"
+  }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+  reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+}).strict();
+var gatewayTokenSubmitSchema = external_exports.object({
+  tokens: external_exports.partialRecord(
+    external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+    external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+  ).describe("Map of sensitive field name \u2192 credential value.")
+}).strict();
+
 // src/mcp/server.ts
 var DEBUG_MCP_REQUESTS = process.env.AGOR_DEBUG_MCP_REQUESTS === "1" || process.env.DEBUG?.includes("mcp-requests");
 function coerceString(value) {
@@ -15720,6 +16272,13 @@ function notesPreview(notes, maxLength = 200) {
   if (singleLine.length <= maxLength) return singleLine;
   return `${singleLine.slice(0, maxLength - 1)}\u2026`;
 }
+async function shouldScopeAssistantDiscoveryToUser(ctx) {
+  if (!isBranchRbacEnabled2()) return false;
+  if (ctx.authenticatedUser?._isServiceAccount) return false;
+  const config2 = await loadConfig2();
+  const allowSuperadmin = config2.execution?.allow_superadmin === true;
+  return !isSuperAdmin(ctx.authenticatedUser?.role, allowSuperadmin);
+}
 async function findAllArchivedBranchesForCleanup(ctx, baseQuery) {
   const branches = [];
   let skip = 0;
@@ -16020,7 +16579,7 @@ function registerBranchTools(server, ctx) {
       const variant = coerceString(args.variant);
       if (variant) assertValidVariant(repo, variant);
       if (autoSuffix) {
-        const branchRepo = new BranchRepository5(ctx.db);
+        const branchRepo = new BranchRepository6(ctx.db);
         const activeNames = await branchRepo.getActiveNamesByRepo(repoId);
         const existingNames = new Set(activeNames);
         if (existingNames.has(branchName)) {
@@ -16092,7 +16651,7 @@ function registerBranchTools(server, ctx) {
   server.registerTool(
     "agor_branches_update",
     {
-      description: "Update metadata for an existing branch (issue/PR URLs, notes, board placement, custom context, RBAC permissions, owners)",
+      description: "Update metadata for an existing branch (issue/PR URLs, notes, board placement, attention state, custom context, RBAC permissions, owners)",
       annotations: { idempotentHint: true },
       inputSchema: external_exports.object({
         branchId: mcpOptionalId(
@@ -16114,6 +16673,9 @@ function registerBranchTools(server, ctx) {
         mcpServerIds: external_exports.array(mcpRequiredId("mcpServerIds[]", "MCP server", "MCP server ID")).nullable().optional().describe(
           "Default MCP server IDs for new sessions in this branch. Sessions inherit these unless they explicitly specify their own. Pass null to clear."
         ),
+        needsAttention: external_exports.boolean({ error: "needsAttention must be a boolean when provided." }).optional().describe(
+          "Branch/card attention highlight state. Pass true to mark the branch as needing attention, or false to clear it."
+        ),
         // RBAC fields (optional, safe to ignore for single-user setups)
         othersCan: external_exports.enum(BRANCH_PERMISSION_LEVELS2).optional().describe(
           `App-layer permission for non-owner users. "none" = no access, "view" = read-only, "session" = can create & prompt own sessions, "prompt" = can prompt ANY session (including other users'), "all" = full access. Always effective regardless of Unix isolation mode. Single-user setups can ignore this.`
@@ -16178,6 +16740,10 @@ function registerBranchTools(server, ctx) {
         fieldsProvided++;
         updates.mcp_server_ids = args.mcpServerIds === null ? [] : await Promise.all(args.mcpServerIds.map((id) => resolveMcpServerId(ctx, id)));
       }
+      if (args.needsAttention !== void 0) {
+        fieldsProvided++;
+        updates.needs_attention = args.needsAttention;
+      }
       if (args.othersCan !== void 0) {
         fieldsProvided++;
         updates.others_can = args.othersCan;
@@ -16279,11 +16845,21 @@ function registerBranchTools(server, ctx) {
           "triggerTemplate and targetSessionId cannot be used when zoneId is null; clearing a zone pin does not run zone triggers."
         );
       }
-      const targetSessionId = rawTargetSessionId ? await resolveSessionId(ctx, rawTargetSessionId) : void 0;
+      const targetSession = rawTargetSessionId ? await ctx.app.service("sessions").get(rawTargetSessionId, ctx.baseServiceParams) : void 0;
+      const targetSessionId = targetSession?.session_id;
       console.log(
         zoneId === null ? `\u{1F4CD} MCP clearing zone pin for branch ${shortId6(branchId)}` : `\u{1F4CD} MCP pinning branch ${shortId6(branchId)} to zone ${zoneId}`
       );
       const branch = await ctx.app.service("branches").get(branchId, ctx.baseServiceParams);
+      if (triggerTemplate && targetSession && targetSession.branch_id !== branch.branch_id) {
+        throw new Error(
+          `targetSessionId ${shortId6(targetSession.session_id)} belongs to branch ${shortId6(
+            targetSession.branch_id
+          )}, but agor_branches_set_zone is moving branch ${shortId6(
+            branch.branch_id
+          )}. Use a session in the moved branch or create a branch-local session first.`
+        );
+      }
       const boardObjectsService = ctx.app.service("board-objects");
       if (zoneId === null) {
         const boardObject2 = await boardObjectsService.findByBranchId(
@@ -16347,12 +16923,6 @@ function registerBranchTools(server, ctx) {
         console.log(`\u{1F3AF} Triggering zone prompt template for session ${shortId6(targetSessionId)}`);
         const { renderTemplate: renderTemplate2 } = await import("@agor/core/templates/handlebars-helpers");
         const { buildZoneTriggerContext: buildZoneTriggerContext2 } = await import("@agor/core/templates/zone-trigger-context");
-        let targetSession;
-        try {
-          targetSession = await ctx.app.service("sessions").get(targetSessionId, ctx.baseServiceParams);
-        } catch {
-          targetSession = void 0;
-        }
         const templateContext = buildZoneTriggerContext2({
           branch,
           board,
@@ -16552,11 +17122,15 @@ function registerBranchTools(server, ctx) {
       })
     },
     async (args) => {
-      const query = { archived: false, $limit: args.limit || 200 };
-      if (args.repoId) query.repo_id = await resolveRepoId(ctx, args.repoId);
-      const result = await ctx.app.service("branches").find({ query, ...ctx.baseServiceParams });
-      const branches = Array.isArray(result) ? result : result.data;
-      const assistants = branches.filter((w) => isAssistant3(w));
+      const limit = args.limit || 200;
+      const repoId = args.repoId ? await resolveRepoId(ctx, args.repoId) : void 0;
+      const branchRepo = new BranchRepository6(ctx.db);
+      const assistants = await branchRepo.findAssistantBranches({
+        archived: false,
+        ...repoId ? { repo_id: repoId } : {},
+        ...await shouldScopeAssistantDiscoveryToUser(ctx) ? { userId: ctx.userId } : {},
+        limit
+      });
       const shaped = assistants.map((w) => {
         const config2 = getAssistantConfig3(w);
         return {