agor-live 0.23.1 → 0.23.2

package/dist/daemon/index.js

@@ -31,6 +31,24 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
   mod
 ));
 
+// src/auth/executor-session-token.ts
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record2 = payload;
+  return record2.type === EXECUTOR_SESSION_TOKEN_TYPE && record2.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+var EXECUTOR_SESSION_TOKEN_TYPE, EXECUTOR_SESSION_TOKEN_PURPOSE;
+var init_executor_session_token = __esm({
+  "src/auth/executor-session-token.ts"() {
+    "use strict";
+    EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+    EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+  }
+});
+
 // src/utils/branch-authorization.ts
 import { shortId } from "@agor/core/db";
 import { Forbidden as Forbidden2, NotAuthenticated, NotFound } from "@agor/core/feathers";
@@ -2648,7 +2666,7 @@ import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
 } from "@agor/core/types";
-import jwt3 from "jsonwebtoken";
+import jwt4 from "jsonwebtoken";
 import { MCP_TOKEN_AUDIENCE as MCP_TOKEN_AUDIENCE2, MCP_TOKEN_ISSUER as MCP_TOKEN_ISSUER2 } from "@agor/core/types";
 function mcpTokenDebug(...args) {
   if (DEBUG_MCP_TOKENS) {
@@ -2720,7 +2738,7 @@ async function generateSessionToken2(app, sessionId, userId) {
     exp: expSec,
     jti
   };
-  const token = jwt3.sign(payload, jwtSecret, { algorithm: "HS256" });
+  const token = jwt4.sign(payload, jwtSecret, { algorithm: "HS256" });
   s.tokenCache.set(cacheKey, { token, expiresAtMs });
   mcpTokenDebug(
     `\u{1F3AB} MCP token issued: session=${shortId3(sessionId)} jti=${jti.substring(0, 8)} exp=+${Math.floor(s.expirationMs / 1e3)}s`
@@ -2736,15 +2754,15 @@ async function validateSessionToken(app, token) {
   }
   let payload;
   try {
-    payload = jwt3.verify(token, jwtSecret, {
+    payload = jwt4.verify(token, jwtSecret, {
       audience: MCP_TOKEN_AUDIENCE,
       issuer: MCP_TOKEN_ISSUER,
       algorithms: ["HS256"]
     });
   } catch (err) {
-    if (err instanceof jwt3.TokenExpiredError) {
+    if (err instanceof jwt4.TokenExpiredError) {
       console.warn("[mcp-tokens] token rejected: expired");
-    } else if (err instanceof jwt3.JsonWebTokenError) {
+    } else if (err instanceof jwt4.JsonWebTokenError) {
       console.warn(`[mcp-tokens] token rejected: ${err.message}`);
     } else {
       console.error("[mcp-tokens] token verify error:", err);
@@ -3213,12 +3231,12 @@ import {
   permissionModeForCli,
   slugForCwd
 } from "@agor/core/claude-cli";
-import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig3 } from "@agor/core/config";
 import {
   generateId as generateId4,
   getCurrentTenantId as getCurrentTenantId3,
   runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope2,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope2,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
   SessionRepository as SessionRepository3,
   shortId as shortId4,
   TaskRepository
@@ -3238,7 +3256,7 @@ function getDb(app) {
 }
 function getCliFallbackTenantId(app) {
   const config2 = app.get("config");
-  return resolveMultiTenancyConfig2(config2 ?? {}).static_tenant_id;
+  return resolveMultiTenancyConfig3(config2 ?? {}).static_tenant_id;
 }
 function captureCliWatcherTenantId(app) {
   return getCurrentTenantId3() ?? getCliFallbackTenantId(app);
@@ -3250,7 +3268,7 @@ async function runCliCallbackDatabaseScope(app, sessionId, work) {
   const db = getDb(app);
   if (!db) return work();
   const tenantId = cliWatcherTenantBySession.get(sessionId) ?? captureCliWatcherTenantId(app);
-  return runWithTenantDatabaseScope2(db, tenantId, work);
+  return runWithTenantDatabaseScope4(db, tenantId, work);
 }
 async function persistActiveTurnSnapshot(app, sessionId, turn) {
   const db = getDb(app);
@@ -4229,7 +4247,7 @@ __export(service_jwt_strategy_exports, {
   ServiceJWTStrategy: () => ServiceJWTStrategy
 });
 import { JWTStrategy } from "@agor/core/feathers";
-import jwt7 from "jsonwebtoken";
+import jwt8 from "jsonwebtoken";
 function persistExecutorJwtPayloadOnConnection(params, accessToken, payload) {
   const connection = params?.connection;
   if (!connection) return;
@@ -4258,6 +4276,7 @@ var init_service_jwt_strategy = __esm({
   "src/auth/service-jwt-strategy.ts"() {
     "use strict";
     init_users();
+    init_executor_session_token();
     init_runtime_tokens();
     init_token_invalidation();
     ServiceJWTStrategy = class extends JWTStrategy {
@@ -4299,7 +4318,7 @@ var init_service_jwt_strategy = __esm({
        */
       // biome-ignore lint/suspicious/noExplicitAny: Feathers type compatibility
       async authenticate(authentication, params) {
-        const decoded = jwt7.decode(authentication?.accessToken);
+        const decoded = jwt8.decode(authentication?.accessToken);
         propagateTenantFromJwtPayload(params, decoded, this.tenantClaim);
         const result = await super.authenticate(authentication, params);
         const payload = result.authentication?.payload;
@@ -4318,14 +4337,14 @@ var init_service_jwt_strategy = __esm({
           };
         }
         if (payload?.type === "executor-session") {
-          if (payload.purpose !== "executor-task") {
+          if (!isExecutorSessionTokenPayload(payload)) {
             throw new Error("Invalid executor token purpose");
           }
           const token = authentication?.accessToken;
           if (!token || !this.sessionTokenService) {
             throw new Error("Executor token validation unavailable");
           }
-          const sessionId = payload.session_id ?? payload.sessionId;
+          const sessionId = getExecutorSessionTokenSessionId(payload);
           const sessionInfo = await this.sessionTokenService.validateToken(token, {
             sessionId,
             taskId: payload.task_id,
@@ -17672,7 +17691,7 @@ __export(schemas_exports2, {
   ipv4: () => ipv42,
   ipv6: () => ipv62,
   json: () => json,
-  jwt: () => jwt8,
+  jwt: () => jwt9,
   keyof: () => keyof,
   ksuid: () => ksuid2,
   lazy: () => lazy,
@@ -17839,7 +17858,7 @@ function base64url2(params) {
 function e1642(params) {
   return _e164(ZodE164, params);
 }
-function jwt8(params) {
+function jwt9(params) {
   return _jwt(ZodJWT, params);
 }
 function stringFormat(format, fnOrRegex, _params = {}) {
@@ -19729,7 +19748,7 @@ __export(external_exports, {
   ipv6: () => ipv62,
   iso: () => iso_exports2,
   json: () => json,
-  jwt: () => jwt8,
+  jwt: () => jwt9,
   keyof: () => keyof,
   ksuid: () => ksuid2,
   lazy: () => lazy,
@@ -22863,11 +22882,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL as GATEWAY_REDACTED_SENTINEL2,
   GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole10,
   ROLES as ROLES12
 } from "@agor/core/types";
@@ -22876,6 +22899,19 @@ function requireAdmin3(ctx, action) {
     throw new Error(`Access denied: admin role required to ${action}`);
   }
 }
+async function resolveCallerSessionBranchId(ctx) {
+  if (!ctx.sessionId) return null;
+  const session = await new SessionRepository6(ctx.db).findById(ctx.sessionId);
+  if (!session) {
+    throw new Error("Gateway access denied: calling session not found");
+  }
+  return session.branch_id;
+}
+function sessionBranchReadDeniedError() {
+  return new Error(
+    "Gateway read denied: this Slack thread belongs to a gateway channel targeting a different branch than the calling session's. Sessions can read Slack thread history only through gateway channels whose target branch matches their own."
+  );
+}
 async function canUseGatewayOutbound(ctx, branchRepo, branch) {
   if (hasMinimumRole10(ctx.authenticatedUser?.role, ROLES12.ADMIN)) return true;
   const userId = ctx.userId;
@@ -22956,16 +22992,23 @@ async function resolveSlackThreadHistoryTarget(ctx, args) {
   const channelRepo = new GatewayChannelRepository2(ctx.db);
   const threadMapRepo = new ThreadSessionMapRepository(ctx.db);
   const branchRepo = new BranchRepository5(ctx.db);
+  const callerSessionBranchId = await resolveCallerSessionBranchId(ctx);
   if (args.sessionId) {
     const session = await ctx.app.service("sessions").get(args.sessionId, ctx.baseServiceParams);
     const mapping2 = await threadMapRepo.findBySession(session.session_id);
     if (!mapping2) {
       throw new Error(`No gateway thread mapping found for session ${session.session_id}.`);
     }
+    if (callerSessionBranchId && mapping2.branch_id !== callerSessionBranchId) {
+      throw sessionBranchReadDeniedError();
+    }
     const channel2 = await channelRepo.findById(mapping2.channel_id);
     if (!channel2) {
       throw new Error(`Gateway channel not found for session mapping ${mapping2.id}.`);
     }
+    if (callerSessionBranchId && channel2.target_branch_id !== callerSessionBranchId) {
+      throw sessionBranchReadDeniedError();
+    }
     const branch2 = await branchRepo.findById(mapping2.branch_id);
     return {
       channel: channel2,
@@ -22980,6 +23023,9 @@ async function resolveSlackThreadHistoryTarget(ctx, args) {
   if (!channel) {
     throw new Error(`Gateway channel not found: ${args.gatewayChannelId}`);
   }
+  if (callerSessionBranchId && channel.target_branch_id !== callerSessionBranchId) {
+    throw sessionBranchReadDeniedError();
+  }
   const mapping = await threadMapRepo.findByChannelAndThread(channel.id, args.threadId);
   if (mapping) {
     const branch2 = await branchRepo.findById(mapping.branch_id);
@@ -23073,6 +23119,34 @@ function toServiceUpdateData(args) {
   }
   return updates;
 }
+function toSlackWizardOptions(args) {
+  return {
+    appName: args.appName,
+    ...args.botDisplayName ? { botDisplayName: args.botDisplayName } : {},
+    publicChannels: args.publicChannels,
+    privateChannels: args.privateChannels,
+    groupDms: args.groupDms,
+    alignUsers: args.alignUsers,
+    outbound: args.outbound
+  };
+}
+function toCreateChannelConfigHint(args) {
+  const config2 = {
+    connection_mode: "socket",
+    enable_channels: args.publicChannels,
+    enable_groups: args.privateChannels,
+    enable_mpim: args.groupDms,
+    align_slack_users: args.alignUsers,
+    outbound_enabled: args.outbound
+  };
+  if (args.restrictToChannelIds && args.restrictToChannelIds.length > 0) {
+    config2.allowed_channel_ids = args.restrictToChannelIds;
+  }
+  return { channelType: "slack", config: config2 };
+}
+function identityModeSetupStep(alignUsers) {
+  return alignUsers ? "Identity: the channel is set to align Slack users \u2014 each Slack user runs as their matched Agor account and unmatched users are rejected, so no run-as user is needed. Tell me if you would rather every message run as one fixed Agor user (that requires picking a user and passing agorUserId)." : "Identity: the channel is set to run every message as one fixed Agor user, which requires passing agorUserId to agor_gateway_channels_create. Tell me if you would rather align Slack users so each runs as their own matched Agor account instead.";
+}
 function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_channels_list",
@@ -23118,7 +23192,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_channels_create",
     {
-      description: 'Create a gateway channel definition (admin-only) through the same gateway-channels service used by the UI. Current connectors: Slack, GitHub, Teams. Slack example config: { bot_token, app_token, connection_mode:"socket", enable_channels:true, require_mention:true, allowed_channel_ids:["C123"] }. Secrets are encrypted by the service and returned redacted; prefer environment/template references where possible because raw secrets in tool arguments may appear in the MCP transcript.',
+      description: 'Create a gateway channel definition (admin-only) through the same gateway-channels service used by the UI. Current connectors: Slack, GitHub, Teams. For interactive/agent-driven setup, create the channel disabled and without secrets (enabled:false, no tokens), then collect credentials with agor_widgets_request_gateway_token so the user enters them in a secure inline form \u2014 raw secrets passed in tool arguments leak into the MCP transcript. Passing secrets directly here is for programmatic/non-interactive use only. Non-interactive Slack example config: { bot_token, app_token, connection_mode:"socket", enable_channels:true, require_mention:true, allowed_channel_ids:["C123"] }. Secrets are encrypted by the service and returned redacted.',
       annotations: { destructiveHint: false, idempotentHint: false },
       inputSchema: gatewayChannelCreateSchema
     },
@@ -23128,12 +23202,50 @@ function registerGatewayChannelTools(server, ctx) {
       return textResult({
         gateway_channel: redactGatewayChannel(created),
         next_steps: [
+          "If this channel was created disabled without tokens (the recommended interactive path), collect its credentials by calling agor_widgets_request_gateway_token for this channel so the user enters the tokens in the secure form that appears at the end of this message. Do NOT ask the user to paste xoxb-/xapp- tokens into the chat, and do NOT pass tokens as agor_gateway_channels_create arguments during interactive setup.",
+          ...created.channel_type === "slack" ? [
+            identityModeSetupStep(
+              created.config?.align_slack_users === true
+            )
+          ] : [],
           "Verify the channel in Settings > Gateway Channels or with agor_gateway_channels_list.",
           "Channel credentials, env vars, and inbound channel keys are intentionally redacted from MCP responses."
         ]
       });
     }
   );
+  server.registerTool(
+    "agor_gateway_slack_manifest_generate",
+    {
+      description: "Generate a ready-to-install Slack app manifest from desired gateway capabilities (admin-only). The agent-driven equivalent of the Slack setup wizard, backed by the same core generator. Returns the manifest JSON, the derived bot scopes/events, ordered setup steps, and the channel config to pass to agor_gateway_channels_create. This is pure: it creates no Slack app, no Agor channel, and validates no tokens.",
+      annotations: { readOnlyHint: true },
+      inputSchema: slackManifestGenerateSchema
+    },
+    async (args) => {
+      requireAdmin3(ctx, "generate Slack app manifests");
+      const options = toSlackWizardOptions(args);
+      return textResult({
+        manifest: buildSlackManifest(options),
+        bot_scopes: requiredBotScopes(options),
+        bot_events: requiredBotEvents(options),
+        setup_steps: [
+          'Open https://api.slack.com/apps?new_app=1 and choose "Create New App".',
+          'Select "From a manifest", pick the target workspace, paste the manifest JSON below, and click "Create".',
+          'Install the app to the workspace, then open OAuth & Permissions and copy the Bot User OAuth Token (starts with "xoxb-").',
+          'Open Basic Information \u2192 App-Level Tokens \u2192 Generate Token and Scopes, add the connections:write scope, generate it, and copy the App-Level Token (starts with "xapp-").',
+          'Once the app is installed and you hold the xoxb-/xapp- tokens, call agor_gateway_channels_create with channelType "slack", enabled:false, no tokens, and create_channel_config_hint below to create the channel as a draft.',
+          "Then call agor_widgets_request_gateway_token for that channel so the user enters the xoxb-/xapp- tokens in the secure form that appears at the end of this message, which enables the channel. Do NOT ask the user to paste xoxb-/xapp- tokens into the chat, and do NOT pass tokens as agor_gateway_channels_create arguments.",
+          identityModeSetupStep(args.alignUsers)
+        ],
+        create_channel_config_hint: toCreateChannelConfigHint(args),
+        caveats: [
+          "GENERATED ONLY \u2014 no Slack app created, no Agor channel created, no tokens validated, no event delivery verified.",
+          "The app-level connections:write token is generated manually and is NOT part of the manifest bot scopes.",
+          "restrictToChannelIds maps to config.allowed_channel_ids when you call create \u2014 it does NOT change the manifest scopes or events."
+        ]
+      });
+    }
+  );
   server.registerTool(
     "agor_gateway_channels_update",
     {
@@ -23157,7 +23269,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_outbound_targets_list",
     {
-      description: "List Slack gateway outbound targets the caller can use. Returns only outbound-enabled channels where the caller has branch all permission or admin access. Secrets and inbound channel keys are never returned.",
+      description: "List Slack gateway outbound targets the caller can use. Returns only outbound-enabled channels where the caller has branch all permission or admin access; when called from a session, results are additionally scoped to channels targeting the session's branch. Secrets and inbound channel keys are never returned.",
       annotations: { readOnlyHint: true },
       inputSchema: external_exports.strictObject({
         branchId: mcpOptionalId("branchId", "Branch", "Filter by target branch ID."),
@@ -23172,15 +23284,24 @@ function registerGatewayChannelTools(server, ctx) {
     async (args) => {
       const channelRepo = new GatewayChannelRepository2(ctx.db);
       const branchRepo = new BranchRepository5(ctx.db);
+      const callerSessionBranchId = await resolveCallerSessionBranchId(ctx);
       const branchFilter = args.branchId ? await branchRepo.findById(args.branchId) : null;
-      const branchFilterId = branchFilter?.branch_id;
+      const requestedBranchId = branchFilter?.branch_id;
+      if (callerSessionBranchId && args.branchId && requestedBranchId !== callerSessionBranchId) {
+        return textResult({
+          channels: [],
+          binding: "Results are scoped to the calling session's branch; the requested branchId targets a different branch, so this session cannot use its channels."
+        });
+      }
+      const branchFilterId = callerSessionBranchId ?? requestedBranchId;
       const allChannels = args.gatewayChannelId ? [await channelRepo.findById(args.gatewayChannelId)] : await channelRepo.findAll();
       const channels = [];
       for (const channel of allChannels) {
         if (!channel) continue;
         if (args.channelType && channel.channel_type !== args.channelType) continue;
         if (channel.channel_type !== "slack") continue;
-        if (args.branchId && channel.target_branch_id !== branchFilterId) continue;
+        if ((callerSessionBranchId || args.branchId) && channel.target_branch_id !== branchFilterId)
+          continue;
         if (!channel.enabled) continue;
         const outbound = getOutboundConfig(channel);
         if (!outbound.outbound_enabled) continue;
@@ -23203,13 +23324,18 @@ function registerGatewayChannelTools(server, ctx) {
           ]
         });
       }
-      return textResult({ channels });
+      return textResult({
+        channels,
+        ...callerSessionBranchId && channels.length === 0 ? {
+          hint: "No outbound-enabled channel targets this session's branch \u2014 ask an operator to create/enable one."
+        } : {}
+      });
     }
   );
   server.registerTool(
     "agor_gateway_slack_thread_history_get",
     {
-      description: "Fetch Slack thread history for a gateway-mapped Slack thread without exposing Slack tokens. Prefer sessionId to resolve the gateway thread mapping from an accessible Agor session. Alternatively pass gatewayChannelId + threadId: mapped threads require admin or branch all permission on the mapped branch; unmapped arbitrary thread reads are admin-only. Slack message text is untrusted external content.",
+      description: "Fetch Slack thread history for a gateway-mapped Slack thread without exposing Slack tokens. Prefer sessionId to resolve the gateway thread mapping from an accessible Agor session. Alternatively pass gatewayChannelId + threadId: mapped threads require admin or branch all permission on the mapped branch; unmapped arbitrary thread reads are admin-only. When called from a session, reads are restricted to threads whose target branch matches the calling session's branch. Slack message text is untrusted external content.",
       annotations: { readOnlyHint: true },
       inputSchema: slackThreadHistorySchema
     },
@@ -23277,7 +23403,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_emit_message",
     {
-      description: "Send a proactive Slack message through an outbound-enabled gateway channel and persist a seed/audit record. Targets may be Slack channel IDs, channel names, or user emails; v0 intentionally starts a fresh Slack thread/DM message for each emit and does not create a thread-session mapping until a human replies.",
+      description: "Send a proactive Slack message through an outbound-enabled gateway channel and persist a seed/audit record. Targets may be Slack channel IDs, channel names, or user emails; v0 intentionally starts a fresh Slack thread/DM message for each emit and does not create a thread-session mapping until a human replies. When called from a session, outbound is restricted to channels whose target branch matches the calling session's branch.",
       annotations: { destructiveHint: false, idempotentHint: false },
       inputSchema: external_exports.strictObject({
         gatewayChannelId: mcpRequiredId(
@@ -23314,7 +23440,7 @@ function registerGatewayChannelTools(server, ctx) {
     }
   );
 }
-var configSchema, outboundTargetSchema, envVarSchema, agenticConfigSchema, gatewayChannelCreateSchema, slackThreadHistorySchema, gatewayChannelUpdateSchema;
+var configSchema, outboundTargetSchema, envVarSchema, agenticConfigSchema, gatewayChannelCreateSchema, slackThreadHistorySchema, gatewayChannelUpdateSchema, slackManifestGenerateSchema;
 var init_gateway_channels = __esm({
   "src/mcp/tools/gateway-channels.ts"() {
     "use strict";
@@ -23378,44 +23504,48 @@ var init_gateway_channels = __esm({
       agenticConfig: agenticConfigSchema.optional()
     }).superRefine((value, issue2) => {
       const config2 = value.config ?? {};
-      if (value.channelType === "slack") {
-        if (!config2.bot_token) {
-          issue2.addIssue({
-            code: "custom",
-            path: ["config", "bot_token"],
-            message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-          });
-        }
-        if (config2.connection_mode === "socket" && !config2.app_token) {
-          issue2.addIssue({
-            code: "custom",
-            path: ["config", "app_token"],
-            message: "config.app_token is required for Slack Socket Mode."
-          });
-        }
-      }
-      if (value.channelType === "github") {
-        for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+      if (value.enabled !== false) {
+        const requiredSecretMessages = {
+          bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+          app_token: "config.app_token is required for Slack Socket Mode.",
+          private_key: "config.private_key is required for GitHub gateway channels.",
+          app_password: "config.app_password is required for Teams gateway channels."
+        };
+        for (const field of getRequiredSecretFields(value.channelType, config2)) {
           if (!config2[field]) {
             issue2.addIssue({
               code: "custom",
               path: ["config", field],
-              message: `config.${field} is required for GitHub gateway channels.`
+              message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
             });
           }
         }
       }
-      if (value.channelType === "teams") {
-        for (const field of ["app_id", "app_password"]) {
+      if (value.channelType === "github") {
+        for (const field of ["app_id", "installation_id", "watch_repos"]) {
           if (!config2[field]) {
             issue2.addIssue({
               code: "custom",
               path: ["config", field],
-              message: `config.${field} is required for Teams gateway channels.`
+              message: `config.${field} is required for GitHub gateway channels.`
             });
           }
         }
       }
+      if (value.channelType === "teams" && !config2.app_id) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["config", "app_id"],
+          message: "config.app_id is required for Teams gateway channels."
+        });
+      }
+      if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["agorUserId"],
+          message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+        });
+      }
     });
     slackThreadHistorySchema = external_exports.strictObject({
       sessionId: mcpOptionalId(
@@ -23479,6 +23609,23 @@ var init_gateway_channels = __esm({
       ),
       agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
     });
+    slackManifestGenerateSchema = external_exports.strictObject({
+      appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+      botDisplayName: mcpOptionalNonEmptyString(
+        "botDisplayName",
+        "Bot user display name. Defaults to appName."
+      ),
+      publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+      privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+      groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+      alignUsers: external_exports.boolean().default(true).describe(
+        "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+      ),
+      outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+      restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+        "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+      )
+    });
   }
 });
 
@@ -28907,8 +29054,191 @@ var init_env_vars = __esm({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden13 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS3,
+  hasMinimumRole as hasMinimumRole12,
+  ROLES as ROLES15
+} from "@agor/core/types";
+function isSupportedGatewayTokenChannelType(channelType) {
+  return SUPPORTED_CHANNEL_TYPES.includes(channelType);
+}
+function orderedFields(fields) {
+  return [...fields].sort();
+}
+function classifyGatewayTokenTest(result, appTokenExpected) {
+  const unprobable = result.failures.some((failure) => failure.capability === "connector");
+  if (unprobable) {
+    return {
+      enable: false,
+      status: "unverifiable",
+      summary: "credentials cannot be auto-verified for this channel type yet"
+    };
+  }
+  const isAppTokenFailure = (failure) => failure.capability === "app_token";
+  const hardFailure = result.failures.find(
+    (failure) => failure.slackError && HARD_CREDENTIAL_SLACK_ERRORS.has(failure.slackError) || failure.capability === "config" || appTokenExpected && isAppTokenFailure(failure)
+  );
+  if (hardFailure) {
+    return { enable: false, status: "failed", summary: hardFailure.reason };
+  }
+  if (appTokenExpected && result.appTokenValid === false) {
+    return {
+      enable: false,
+      status: "failed",
+      summary: "The app-level token is missing or invalid; Socket Mode cannot connect."
+    };
+  }
+  if (result.ok) {
+    return { enable: true, status: "verified", summary: "passed" };
+  }
+  const followUps = result.failures.filter((failure) => appTokenExpected || !isAppTokenFailure(failure)).map((failure) => failure.reason).filter(Boolean);
+  return {
+    enable: true,
+    status: "verified",
+    summary: followUps.length > 0 ? `passed, with follow-ups: ${followUps.join("; ")}` : "passed"
+  };
+}
+function assertGatewayTokenAdmin(ctx) {
+  if (!hasMinimumRole12(ctx.submitterRole, ROLES15.ADMIN)) {
+    throw new Forbidden13("Only admins can set gateway channel tokens");
+  }
+}
+async function applyGatewayTokenSubmit(ctx, submit, params) {
+  assertGatewayTokenAdmin(ctx);
+  const channelsService = ctx.app.service("gateway-channels");
+  const channel = await channelsService.get(params.gatewayChannelId);
+  if (!channel) {
+    throw new Forbidden13(`Gateway channel ${params.gatewayChannelId} not found`);
+  }
+  if (!isSupportedGatewayTokenChannelType(channel.channel_type)) {
+    throw new Forbidden13(
+      `Gateway channel type "${channel.channel_type}" does not support token entry`
+    );
+  }
+  if (channel.channel_type !== params.channelType) {
+    throw new Forbidden13("Gateway channel type does not match the widget request");
+  }
+  const sessionsService = ctx.app.service("sessions");
+  const session = await sessionsService.get(ctx.sessionId);
+  if (!session.branch_id || channel.target_branch_id !== session.branch_id) {
+    throw new Forbidden13("Gateway channel is not bound to this session's branch");
+  }
+  const requested = new Set(params.fields);
+  const extra = Object.keys(submit.tokens).filter((field) => !requested.has(field));
+  if (extra.length > 0) {
+    throw new Forbidden13(
+      `Submitted token fields were not requested: ${orderedFields(extra).join(", ")}`
+    );
+  }
+  const testService = ctx.app.service(
+    "gateway-channels/test"
+  );
+  const testResult = await testService.create({
+    gatewayChannelId: params.gatewayChannelId,
+    config: submit.tokens
+  });
+  const appTokenExpected = params.fields.includes("app_token");
+  const { enable, status, summary } = classifyGatewayTokenTest(testResult, appTokenExpected);
+  await channelsService.patch(
+    params.gatewayChannelId,
+    { config: submit.tokens, enabled: enable },
+    { user: { user_id: ctx.submitterUserId, role: ctx.submitterRole } }
+  );
+  submitOutcomes.set(submit, {
+    channelId: channel.id,
+    channelName: channel.name,
+    channelType: channel.channel_type,
+    enabled: enable,
+    unverified: status === "unverifiable",
+    test: { ok: testResult.ok, summary }
+  });
+}
+function registerGatewayTokenWidget() {
+  registerWidget(gatewayTokenWidget);
+}
+var SUPPORTED_CHANNEL_TYPES, MAX_TOKEN_LENGTH, gatewayTokenParamsSchema, gatewayTokenSubmitSchema, submitOutcomes, HARD_CREDENTIAL_SLACK_ERRORS, gatewayTokenWidget;
+var init_gateway_token = __esm({
+  "src/widgets/gateway-token/index.ts"() {
+    "use strict";
+    init_zod();
+    init_registry();
+    SUPPORTED_CHANNEL_TYPES = [
+      "slack",
+      "github",
+      "teams"
+    ];
+    MAX_TOKEN_LENGTH = 8192;
+    gatewayTokenParamsSchema = external_exports.object({
+      gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+      channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+      channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+      fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS3)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS3.length).refine((fields) => new Set(fields).size === fields.length, {
+        message: "Token field names must be unique"
+      }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+      reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+    }).strict();
+    gatewayTokenSubmitSchema = external_exports.object({
+      tokens: external_exports.partialRecord(
+        external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS3),
+        external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+      ).describe("Map of sensitive field name \u2192 credential value.")
+    }).strict();
+    submitOutcomes = /* @__PURE__ */ new WeakMap();
+    HARD_CREDENTIAL_SLACK_ERRORS = /* @__PURE__ */ new Set([
+      "invalid_auth",
+      "account_inactive",
+      "token_revoked",
+      "token_expired",
+      "not_authed",
+      "no_permission"
+    ]);
+    gatewayTokenWidget = {
+      type: "gateway_token",
+      schemaVersion: 1,
+      paramsSchema: gatewayTokenParamsSchema,
+      submitSchema: gatewayTokenSubmitSchema,
+      buildResultMeta: (submit) => {
+        const outcome = submitOutcomes.get(submit);
+        return {
+          channelId: outcome?.channelId ?? "",
+          channelName: outcome?.channelName ?? "",
+          channelType: outcome?.channelType ?? "slack",
+          fieldsSet: orderedFields(Object.keys(submit.tokens)),
+          enabled: outcome?.enabled ?? false,
+          unverified: outcome?.unverified ?? false,
+          test: outcome?.test ?? { ok: false, summary: "" }
+        };
+      },
+      applySubmit: applyGatewayTokenSubmit,
+      buildAutoResumePrompt: (rm3, params) => {
+        const fields = orderedFields(rm3.fieldsSet).join(", ");
+        const name = rm3.channelName || params.channelName;
+        const channelType = rm3.channelType || params.channelType;
+        if (rm3.enabled) {
+          return `[Agor] User set the ${channelType} tokens (${fields}) for channel "${name}". Channel enabled. Connection test: ${rm3.test.summary || "passed"}.`;
+        }
+        if (rm3.unverified) {
+          return `[Agor] Tokens saved for "${name}" (${fields}); ${channelType} credentials can't be auto-verified yet, so the channel is left disabled \u2014 enable it manually once confirmed.`;
+        }
+        return `[Agor] User set the ${channelType} tokens (${fields}) for channel "${name}", but it was left disabled; test failed: ${rm3.test.summary || "unknown error"}. Ask the user to double-check the tokens/scopes.`;
+      },
+      buildDismissedPrompt: (params) => `[Agor] User declined to provide tokens for "${params.channelName}"; it stays disabled. Don't immediately re-ask.`,
+      // Dismissal is admin-only too — otherwise a member could terminally decline
+      // an admin-only credential flow via the generic dismiss endpoint.
+      authorizeDismiss: (ctx) => assertGatewayTokenAdmin(ctx)
+    };
+  }
+});
+
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole3 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole13, MessageRole as MessageRole3, ROLES as ROLES16 } from "@agor/core/types";
+function requireAdmin4(ctx, action) {
+  if (!hasMinimumRole13(ctx.authenticatedUser?.role, ROLES16.ADMIN)) {
+    throw new Error(`Access denied: admin role required to ${action}`);
+  }
+}
 function widgetContentPreview(params) {
   const list = params.names.join(", ");
   return params.names.length === 1 ? `Please provide ${list}: ${params.reason}` : `Please provide ${list}: ${params.reason}`;
@@ -29027,13 +29357,113 @@ function registerWidgetTools(server, ctx) {
       return textResult({ widget_id: widgetId, status: "requested" });
     }
   );
+  server.registerTool(
+    "agor_widgets_request_gateway_token",
+    {
+      description: "Ask an admin to securely provide a gateway channel's platform tokens (Slack bot/app tokens, GitHub private key, Teams app password) via a compact form that appears at the end of your message, so setup finishes without anyone pasting xoxb-/xapp- tokens into chat. FIRE-AND-FORGET: the widget renders inline at the end of your turn; end your turn after calling. You will receive a user-role message when it is resolved. Token values never enter your context \u2014 only the channel identity and field NAMES do. Admin-only: a non-admin agent cannot mint this widget. Keep `reason` to ONE short sentence (\u2264200 chars).",
+      annotations: { destructiveHint: false, openWorldHint: false },
+      inputSchema: external_exports.object({
+        gatewayChannelId: external_exports.string().min(1).describe("Gateway channel ID (UUIDv7 or short ID) whose tokens are being set."),
+        reason: external_exports.string().max(200).optional().describe("One short sentence explaining why the tokens are needed.")
+      })
+    },
+    async (args) => {
+      if (!ctx.sessionId) return sessionContextRequiredResult();
+      const currentSessionId = ctx.sessionId;
+      requireAdmin4(ctx, "set gateway channel tokens");
+      const channel = await ctx.app.service("gateway-channels").get(args.gatewayChannelId, ctx.baseServiceParams);
+      const channelType = channel.channel_type;
+      if (!isSupportedGatewayTokenChannelType(channelType)) {
+        throw new Error(
+          `Gateway channel type "${channelType}" does not support token entry via this widget.`
+        );
+      }
+      const fields = getRequiredSecretFields2(channelType, channel.config);
+      if (fields.length === 0) {
+        throw new Error(
+          `Gateway channel "${channel.name}" has no required secret fields to collect.`
+        );
+      }
+      const params = gatewayTokenParamsSchema.parse({
+        gatewayChannelId: channel.id,
+        channelType,
+        channelName: channel.name,
+        fields,
+        reason: args.reason ?? `Provide the ${channelType} credentials to finish connecting "${channel.name}".`
+      });
+      const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const baseWidgetMeta = {
+        widget_type: "gateway_token",
+        schema_version: 1,
+        params,
+        status: "pending",
+        requested_at: requestedAt,
+        auto_resume: true
+      };
+      const hostTask = await findHostTaskForSession(
+        ctx.app,
+        currentSessionId,
+        ctx.baseServiceParams
+      );
+      const hostTaskId = hostTask?.task_id;
+      const created = await appendSystemMessage({
+        app: ctx.app,
+        db: ctx.db,
+        sessionId: currentSessionId,
+        taskId: hostTaskId,
+        content: `Please provide the ${channelType} tokens for "${channel.name}": ${params.reason}`,
+        contentPreview: `Widget: gateway_token (${channel.name})`,
+        type: "widget_request",
+        role: MessageRole3.SYSTEM,
+        metadata: {
+          widget: {
+            ...baseWidgetMeta,
+            widget_id: "pending"
+          }
+        }
+      });
+      const widgetId = created.message_id;
+      if (hostTask?.message_range) {
+        try {
+          await ctx.app.service("tasks").patch(
+            hostTask.task_id,
+            {
+              message_range: {
+                start_index: hostTask.message_range.start_index,
+                end_index: created.index
+              }
+            },
+            ctx.baseServiceParams
+          );
+        } catch (err) {
+          console.warn(
+            `[widgets] failed to extend task.message_range for widget ${widgetId}:`,
+            err
+          );
+        }
+      }
+      await ctx.app.service("messages").patch(
+        widgetId,
+        {
+          metadata: {
+            ...created.metadata ?? {},
+            widget: { ...baseWidgetMeta, widget_id: widgetId }
+          }
+        },
+        ctx.baseServiceParams
+      );
+      return textResult({ widget_id: widgetId, status: "requested" });
+    }
+  );
 }
 var init_widgets = __esm({
   "src/mcp/tools/widgets.ts"() {
     "use strict";
+    init_zod();
     init_append_system_message();
     init_session_tasks();
     init_env_vars();
+    init_gateway_token();
     init_server();
   }
 });
@@ -31323,13 +31753,13 @@ var init_identity_token = __esm({
 function oidcFederationProvider(config2) {
   return async () => {
     requireSecureTokenEndpoint(config2.baseURL);
-    const jwt12 = await config2.identityTokenProvider();
-    if (jwt12.length > 16 * 1024) {
-      throw new WorkloadIdentityError(`Identity token is ${Math.ceil(jwt12.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
+    const jwt13 = await config2.identityTokenProvider();
+    if (jwt13.length > 16 * 1024) {
+      throw new WorkloadIdentityError(`Identity token is ${Math.ceil(jwt13.length / 1024)} KiB, exceeds the 16 KiB assertion limit`);
     }
     const body = {
       grant_type: GRANT_TYPE_JWT_BEARER,
-      assertion: jwt12,
+      assertion: jwt13,
       federation_rule_id: config2.federationRuleId,
       organization_id: config2.organizationId
     };
@@ -41711,7 +42141,7 @@ __export(session_token_service_exports, {
   SessionTokenService: () => SessionTokenService
 });
 import { getCurrentTenantId as getCurrentTenantId6 } from "@agor/core/db";
-import jwt11 from "jsonwebtoken";
+import jwt12 from "jsonwebtoken";
 function sessionTokenDebug(...args) {
   if (DEBUG_SESSION_TOKENS) {
     console.debug(...args);
@@ -41721,6 +42151,7 @@ var DEBUG_SESSION_TOKENS, SessionTokenService;
 var init_session_token_service = __esm({
   "src/services/session-token-service.ts"() {
     "use strict";
+    init_executor_session_token();
     DEBUG_SESSION_TOKENS = process.env.AGOR_DEBUG_SESSION_TOKENS === "1" || process.env.DEBUG?.includes("session-token");
     SessionTokenService = class {
       constructor(config2) {
@@ -41750,10 +42181,8 @@ var init_session_token_service = __esm({
         const payload = {
           sub: userId,
           // Standard JWT subject claim (used by Feathers for user lookup)
-          type: "executor-session",
-          purpose: "executor-task",
-          sessionId,
-          // Custom claim for session tracking
+          type: EXECUTOR_SESSION_TOKEN_TYPE,
+          purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
           session_id: sessionId,
           task_id: scope.taskId,
           branch_id: scope.branchId,
@@ -41767,7 +42196,7 @@ var init_session_token_service = __esm({
           iss: "agor"
           // Must match Feathers jwtOptions.issuer
         };
-        const token = jwt11.sign(payload, this.jwtSecret, {
+        const token = jwt12.sign(payload, this.jwtSecret, {
           algorithm: "HS256"
           // Must match Feathers jwtOptions.algorithm
           // No expiresIn here - we set exp directly in payload
@@ -42012,16 +42441,16 @@ import {
   loadConfigFromFile,
   renderGitConfigParametersForLog,
   resolveGitConfigParameters,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig7,
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig8,
   resolveSecurity,
   resolveTenantContext as resolveTenantContext6,
   saveConfig as saveConfig4,
   TenantResolutionError as TenantResolutionError5
 } from "@agor/core/config";
-import { getDatabaseUrl, runWithTenantDatabaseScope as runWithTenantDatabaseScope11 } from "@agor/core/db";
+import { getDatabaseUrl, runWithTenantDatabaseScope as runWithTenantDatabaseScope13 } from "@agor/core/db";
 import {
   authenticate,
-  Forbidden as Forbidden26,
+  Forbidden as Forbidden27,
   feathers,
   feathersExpress,
   NotAuthenticated as NotAuthenticated22,
@@ -42036,20 +42465,21 @@ import express from "express";
 import expressStaticGzip from "express-static-gzip";
 
 // src/auth/executor-runtime-scope.ts
+init_executor_session_token();
 import { Forbidden } from "@agor/core/feathers";
 function scopedPayload(context) {
   const params = context.params;
   const payload = params.authentication?.payload;
-  if (payload?.type === "executor-session") {
-    if (payload.purpose !== "executor-task") {
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
       throw new Forbidden("Executor token is not valid for this request");
     }
     return payload;
   }
   if (params.authentication?.strategy === "jwt" && params.task_id) {
     return {
-      type: "executor-session",
-      purpose: "executor-task",
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
       task_id: params.task_id,
       session_id: params.session_id,
       sessionId: params.sessionId,
@@ -42165,7 +42595,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };
@@ -42304,7 +42734,7 @@ import {
   isUnixImpersonationEnabled,
   loadConfig,
   resolveExecutionSecurityMode,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig3,
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig4,
   resolveMultiTenancyDatabaseDialect,
   resolveTenantContext as resolveTenantContext3,
   TenantResolutionError as TenantResolutionError3,
@@ -42461,6 +42891,17 @@ var gatewayRouteHook = async (context) => {
   return context;
 };
 
+// src/oauth-auth-helpers.ts
+import { runWithTenantDatabaseScope } from "@agor/core/db";
+async function runInOAuthTenantScope(db, tenantId, work) {
+  if (!tenantId) return work();
+  return runWithTenantDatabaseScope(db, tenantId, work);
+}
+function resolveForUserIdWithGate(opts) {
+  const canUseExplicitUser = opts.isServiceAccount === true || opts.authPayloadType === "executor-session" && opts.queryForUserId === opts.callerUserId;
+  return opts.queryForUserId && canUseExplicitUser ? opts.queryForUserId : opts.callerUserId;
+}
+
 // src/services/groups.ts
 init_branch_authorization();
 import { BoardRepository, GroupRepository } from "@agor/core/db";
@@ -43676,13 +44117,29 @@ function injectCreatedBy() {
 }
 
 // src/utils/mcp-header-secrets.ts
+init_executor_session_token();
 import { redactMCPAuthSecrets } from "@agor/core/tools/mcp/auth-secrets";
 import { redactMCPCustomHeaders } from "@agor/core/tools/mcp/http-headers";
+import jwt2 from "jsonwebtoken";
 function shouldExposeMCPServerSecretsForSessionToken(params, options = {}) {
-  const payload = params?.authentication?.payload;
-  const sessionId = params?.session_id ?? payload?.session_id ?? payload?.sessionId;
+  const payload = params?.authentication?.payload ?? decodeExecutorSessionPayload(params);
+  const sessionId = params?.session_id ?? getPayloadSessionId(payload);
   return !!params?.provider && (params.authentication?.strategy === "session-token" || payload?.type === "executor-session") && !!sessionId && (!options.sessionId || sessionId === options.sessionId);
 }
+function decodeExecutorSessionPayload(params) {
+  if (params?.authentication?.strategy !== "jwt" || !params.authentication.accessToken) {
+    return void 0;
+  }
+  const decoded = jwt2.decode(params.authentication.accessToken);
+  if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+    return void 0;
+  }
+  if (!isExecutorSessionTokenPayload(decoded)) return void 0;
+  return decoded;
+}
+function getPayloadSessionId(payload) {
+  return payload ? getExecutorSessionTokenSessionId(payload) : void 0;
+}
 function shouldExposeMCPServerSecrets(params, options = {}) {
   if (!params?.provider) return true;
   if (params.user?._isServiceAccount || params.user?.role === "service") return true;
@@ -43778,6 +44235,7 @@ var RealtimeAccessCache = class {
   }
   branchVisibility = /* @__PURE__ */ new Map();
   sessionBranches = /* @__PURE__ */ new Map();
+  sessionOwners = /* @__PURE__ */ new Map();
   branchVisibilityTtlMs;
   sessionBranchTtlMs;
   now;
@@ -43794,6 +44252,27 @@ var RealtimeAccessCache = class {
     });
     return branchId;
   }
+  /**
+   * Owning user id for a session, cached on the same cadence as the
+   * session→branch map. Used only to offer streaming events to the session
+   * creator's own connections as a fallback when they haven't subscribed to
+   * the per-session stream channel yet.
+   */
+  async getSessionOwnerId(sessionId) {
+    const cached2 = this.sessionOwners.get(sessionId);
+    const now = this.now();
+    if (cached2 && cached2.expiresAt > now) {
+      return cached2.ownerId;
+    }
+    const ownerId = await this.options.sessionsRepository.findCreatedByBySessionId(
+      sessionId
+    ) ?? null;
+    this.sessionOwners.set(sessionId, {
+      ownerId,
+      expiresAt: now + this.sessionBranchTtlMs
+    });
+    return ownerId;
+  }
   async getBranchVisibility(branchId) {
     const cached2 = this.branchVisibility.get(branchId);
     const now = this.now();
@@ -43829,6 +44308,7 @@ var RealtimeAccessCache = class {
   }
   invalidateSession(sessionId) {
     this.sessionBranches.delete(sessionId);
+    this.sessionOwners.delete(sessionId);
   }
   clearVisibility() {
     this.branchVisibility.clear();
@@ -43836,6 +44316,7 @@ var RealtimeAccessCache = class {
   clearAll() {
     this.branchVisibility.clear();
     this.sessionBranches.clear();
+    this.sessionOwners.clear();
   }
   visibilityFromEntry(entry) {
     return entry.mode === "allAuthenticated" ? { mode: "allAuthenticated" } : { mode: "explicitUsers", userIds: entry.userIds };
@@ -43853,6 +44334,26 @@ import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES8 } from "@agor/core/t
 function tenantChannelName(tenantId) {
   return `tenant:${tenantId}`;
 }
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function leaveAllSessionStreamChannels(app, connection) {
+  for (const name of app.channels ?? []) {
+    if (name.startsWith(SESSION_STREAM_CHANNEL_PREFIX)) {
+      app.channel(name).leave(connection);
+    }
+  }
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
+function joinSessionStreamChannel(app, sessionId, connection) {
+  app.channel(sessionStreamChannelName(sessionId)).join(connection);
+}
+function leaveSessionStreamChannel(app, sessionId, connection) {
+  existingChannel(app, sessionStreamChannelName(sessionId))?.leave(connection);
+}
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -43868,8 +44369,27 @@ var SESSION_ID_SCOPED_PATHS = /* @__PURE__ */ new Set([
   "session-env-selections"
 ]);
 var OPTIONAL_BRANCH_OR_SESSION_SCOPED_PATHS = /* @__PURE__ */ new Set(["board-objects", "board-comments"]);
+var MESSAGE_STREAMING_EVENTS = /* @__PURE__ */ new Set([
+  "streaming:start",
+  "streaming:chunk",
+  "streaming:end",
+  "streaming:error",
+  "thinking:start",
+  "thinking:chunk",
+  "thinking:end"
+]);
+var TASK_STREAMING_EVENTS = /* @__PURE__ */ new Set(["thinking:chunk", "tool:start", "tool:complete"]);
 function isStreamingEvent(context) {
-  return context.path === "messages/streaming" || context.path === "messages" && context.event?.startsWith("streaming:") === true;
+  if (context.path === "messages/streaming") return true;
+  const event = context.event;
+  if (!event) return false;
+  if (context.path === "messages") {
+    return event.startsWith("streaming:") || MESSAGE_STREAMING_EVENTS.has(event);
+  }
+  if (context.path === "tasks") {
+    return TASK_STREAMING_EVENTS.has(event);
+  }
+  return false;
 }
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -44005,6 +44525,47 @@ async function resolvePublishScope(data, context, accessCache) {
 function filterToServiceConnections(authenticated) {
   return authenticated.filter((connection) => isServiceConnection(connection));
 }
+async function resolveStreamingDelivery(app, data, tenantScoped, accessCache, branchRbacEnabled, allowSuperadmin) {
+  const serviceConnections = filterToServiceConnections(tenantScoped);
+  const sessionId = extractSessionId(data);
+  if (!sessionId) return serviceConnections;
+  const tenantConnections = new Set(
+    tenantScoped.connections
+  );
+  const existingRoom = existingChannel(app, sessionStreamChannelName(sessionId));
+  const room = existingRoom ? existingRoom.filter((connection) => tenantConnections.has(connection)) : null;
+  let ownerId = null;
+  try {
+    ownerId = await accessCache.getSessionOwnerId(sessionId);
+  } catch {
+  }
+  const ownerChannel = () => tenantScoped.filter(
+    (connection) => userFromConnection(connection)?.user_id === ownerId
+  );
+  if (!branchRbacEnabled) {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const branchId = await accessCache.getBranchIdForSession(sessionId);
+  const visibility = branchId ? await accessCache.getBranchVisibility(branchId) : null;
+  if (!visibility) return serviceConnections;
+  if (visibility.mode === "allAuthenticated") {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const channels = [serviceConnections];
+  if (room) {
+    channels.push(filterToUserIdsOrSuperadmins(room, visibility.userIds, allowSuperadmin));
+  }
+  if (ownerId && visibility.userIds.has(ownerId)) {
+    channels.push(ownerChannel());
+  }
+  return channels;
+}
 function filterToUserIdsOrAdmins(authenticated, userIds, allowSuperadmin) {
   return authenticated.filter((connection) => {
     if (isServiceConnection(connection) || isAdminConnection(connection, allowSuperadmin)) {
@@ -44078,6 +44639,16 @@ function configureRealtimePublish(options) {
         throw error51;
       }
     }
+    if (isStreamingEvent(context)) {
+      return resolveStreamingDelivery(
+        app,
+        data,
+        tenantScoped,
+        accessCache,
+        branchRbacEnabled,
+        allowSuperadmin
+      );
+    }
     if (!branchRbacEnabled) return tenantScoped;
     const scope = await resolvePublishScope(data, context, accessCache);
     if (scope.kind === "global") return tenantScoped;
@@ -44210,28 +44781,9 @@ function recomputeNextRunAt() {
   };
 }
 
-// src/utils/session-task-state.ts
-import {
-  isTerminalTaskStatus,
-  SessionStatus as SessionStatus2,
-  sessionCanStartTask,
-  TaskStatus
-} from "@agor/core/types";
-function isTaskBlockingPrompt(task) {
-  return task.status !== TaskStatus.QUEUED && !isTerminalTaskStatus(task.status);
-}
-function isTerminalQueueProcessingSuppressed(params) {
-  return params?.suppressTerminalQueueProcessing === true;
-}
-function shouldReconcileSessionPromptState(session, tasks3, options = {}) {
-  if (session.status !== SessionStatus2.FAILED) return false;
-  if (session.ready_for_prompt === true) return false;
-  const ignoredTaskIds = new Set(options.ignoredTaskIds ?? []);
-  return !tasks3.some((task) => !ignoredTaskIds.has(task.task_id) && isTaskBlockingPrompt(task));
-}
-
-// src/register-hooks.ts
-init_spawn_executor();
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope3 } from "@agor/core/db";
 
 // src/utils/tenant-db-scope.ts
 init_runtime_tokens();
@@ -44244,10 +44796,10 @@ import {
   enqueueTenantDatabasePostCommitCallback,
   getCurrentTenantId as getCurrentTenantId2,
   runWithoutTenantDatabaseScope,
-  runWithTenantDatabaseScope
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope2
 } from "@agor/core/db";
 import { NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
-import jwt2 from "jsonwebtoken";
+import jwt3 from "jsonwebtoken";
 function readHeaderValue(headers, name) {
   if (!headers) return null;
   const wanted = name.toLowerCase();
@@ -44276,7 +44828,7 @@ function deferWithTenantDatabaseScope(db, params, work, onError) {
   const schedule = () => {
     runWithoutTenantDatabaseScope(() => {
       setImmediate(() => {
-        void runWithTenantDatabaseScope(db, tenantId, work).catch((error51) => {
+        void runWithTenantDatabaseScope2(db, tenantId, work).catch((error51) => {
           if (onError) {
             onError(error51);
             return;
@@ -44298,7 +44850,7 @@ function createTenantDatabaseScopeAroundHook(options) {
     const match = authorization?.match(/^Bearer\s+(.+)$/i);
     if (!match || !options.jwtSecret) return void 0;
     try {
-      return jwt2.verify(match[1], options.jwtSecret, {
+      return jwt3.verify(match[1], options.jwtSecret, {
         issuer: RUNTIME_JWT_ISSUER,
         audience: RUNTIME_JWT_AUDIENCE
       });
@@ -44333,11 +44885,104 @@ function createTenantDatabaseScopeAroundHook(options) {
       }
       throw error51;
     }
-    await runWithTenantDatabaseScope(options.db, context.params.tenant?.tenant_id, next);
+    await runWithTenantDatabaseScope2(options.db, context.params.tenant?.tenant_id, next);
   };
 }
 
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config2) {
+  const multiTenancy = resolveMultiTenancyConfig2(config2);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+async function runWithSessionQueueTenantScope(options, work) {
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    return runWithTenantDatabaseScope3(options.db, capturedTenantId, () => work(scopedParams2));
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    return runWithTenantDatabaseScope3(options.db, tenantIdHint, () => work(scopedParams2));
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    console.error(
+      `\u274C [Queue] ${options.label} skipped for session ${options.sessionId}: missing tenant context`
+    );
+    return void 0;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  return runWithTenantDatabaseScope3(options.db, configuredStaticTenantId, () => work(scopedParams));
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error51) => {
+    if (onError) {
+      onError(error51);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error51);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+
+// src/utils/session-task-state.ts
+import {
+  isTerminalTaskStatus,
+  SessionStatus as SessionStatus2,
+  sessionCanStartTask,
+  TaskStatus
+} from "@agor/core/types";
+function isTaskBlockingPrompt(task) {
+  return task.status !== TaskStatus.QUEUED && !isTerminalTaskStatus(task.status);
+}
+function isTerminalQueueProcessingSuppressed(params) {
+  return params?.suppressTerminalQueueProcessing === true;
+}
+function shouldReconcileSessionPromptState(session, tasks3, options = {}) {
+  if (session.status !== SessionStatus2.FAILED) return false;
+  if (session.ready_for_prompt === true) return false;
+  const ignoredTaskIds = new Set(options.ignoredTaskIds ?? []);
+  return !tasks3.some((task) => !ignoredTaskIds.has(task.task_id) && isTaskBlockingPrompt(task));
+}
+
 // src/register-hooks.ts
+init_spawn_executor();
 var DEBUG_MCP_TOKENS2 = process.env.AGOR_DEBUG_MCP_TOKENS === "1" || process.env.DEBUG?.includes("mcp-tokens");
 function mcpTokenDebug2(...args) {
   if (DEBUG_MCP_TOKENS2) {
@@ -44449,6 +45094,10 @@ function shouldRunSessionPostTurnHooks(session) {
 function shouldDrainQueueAfterSessionPostTurnPatch(session, params) {
   return shouldRunSessionPostTurnHooks(session) && session.ready_for_prompt === true && !isTerminalQueueProcessingSuppressed(params);
 }
+function getTrustedSessionTenantId(session) {
+  const tenantId = session?.tenant_id;
+  return typeof tenantId === "string" && tenantId.length > 0 ? tenantId : void 0;
+}
 async function enrichSessionFindResultWithRemoteRelationships(result, sessionsService) {
   if (isRemoteRelationshipsEnrichedResult(result)) return result;
   if (Array.isArray(result)) {
@@ -44463,6 +45112,7 @@ async function enrichSessionFindResultWithRemoteRelationships(result, sessionsSe
 }
 var TENANT_OWNED_SERVICE_PATHS = [
   "sessions",
+  "sessions/:id/mcp-servers",
   "session-relationships",
   "tasks",
   "messages",
@@ -44479,6 +45129,14 @@ var TENANT_OWNED_SERVICE_PATHS = [
   "boards/:id/group-grants",
   "app-variables",
   "mcp-servers",
+  "mcp-servers/discover",
+  "mcp-servers/oauth-auth-headers",
+  "mcp-servers/oauth-complete",
+  "mcp-servers/oauth-disconnect",
+  "mcp-servers/oauth-refresh",
+  "mcp-servers/oauth-start",
+  "mcp-servers/oauth-status",
+  "mcp-servers/test-oauth",
   "card-types",
   "cards",
   "artifacts",
@@ -44525,7 +45183,7 @@ function registerHooks(ctx) {
       return void 0;
     }
   };
-  const multiTenancy = resolveMultiTenancyConfig3(config2);
+  const multiTenancy = resolveMultiTenancyConfig4(config2);
   const tenantColumnsEnabled = resolveMultiTenancyDatabaseDialect(config2) === "postgresql";
   const executionMode = resolveExecutionSecurityMode(config2);
   const tenantOwnedServicePaths = TENANT_OWNED_SERVICE_PATHS;
@@ -44683,16 +45341,36 @@ function registerHooks(ctx) {
     );
     return context;
   };
-  const syncUnixAccessForAllBranches = async (context, logPrefix) => {
+  const membershipGroupIdFromContext = (context) => {
+    const resultGroupId = context.result?.group_id;
+    if (typeof resultGroupId === "string" && resultGroupId.length > 0) {
+      return resultGroupId;
+    }
+    const dataGroupId = context.data?.group_id;
+    if (typeof dataGroupId === "string" && dataGroupId.length > 0) return dataGroupId;
+    const queryGroupId = context.params.query?.group_id;
+    if (typeof queryGroupId === "string" && queryGroupId.length > 0) return queryGroupId;
+    const routeGroupId = context.params.route?.groupId;
+    if (typeof routeGroupId === "string" && routeGroupId.length > 0) return routeGroupId;
+    return void 0;
+  };
+  const syncUnixAccessForGroupGrantedBranches = async (context, logPrefix) => {
     if (!executionMode.unixFsIsolationEnabled) return context;
-    const branches3 = await branchRepository.findAll({ includeArchived: false });
-    for (const branch of branches3) {
-      syncBranchUnixAccess(
-        branch.branch_id,
-        logPrefix,
-        context.params
+    const groupId = membershipGroupIdFromContext(context);
+    if (!groupId) {
+      console.warn(
+        `[Unix Integration] Could not resolve group_id for ${context.path}.${context.method}; skipping group membership permission sync`
       );
-      await invalidateRealtimeBranchAccess(branch.branch_id);
+      return context;
+    }
+    const branchIds = await branchRepository.findExplicitFsAccessBranchIdsForGroup(groupId);
+    if (branchIds.length === 0) return context;
+    console.log(
+      `[Unix Integration] Queueing group membership permission sync for ${branchIds.length} branch(es) granted to group ${shortId5(groupId)}`
+    );
+    for (const branchId of branchIds) {
+      syncBranchUnixAccess(branchId, logPrefix, context.params);
+      await invalidateRealtimeBranchAccess(branchId);
     }
     return context;
   };
@@ -45236,7 +45914,13 @@ function registerHooks(ctx) {
   });
   const injectPerUserOAuthTokens = async (context) => {
     const queryForUserId = context.params?.query?.forUserId;
-    const userId = context.params?.user?.user_id || queryForUserId;
+    const authPayloadType = context.params?.authentication?.payload?.type;
+    const userId = resolveForUserIdWithGate({
+      queryForUserId,
+      isServiceAccount: context.params?.user?._isServiceAccount,
+      authPayloadType,
+      callerUserId: context.params?.user?.user_id
+    });
     if (!userId) {
       return context;
     }
@@ -45593,11 +46277,11 @@ function registerHooks(ctx) {
     after: {
       create: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.create]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.create]")
       ],
       remove: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.remove]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.remove]")
       ]
     }
   });
@@ -46243,19 +46927,29 @@ function registerHooks(ctx) {
               }
             });
             if (shouldDrainQueueAfterSessionPostTurnPatch(session, context.params)) {
-              deferWithTenantDatabaseScope(db, context.params, async () => {
-                try {
+              const sessionTenantId = getTrustedSessionTenantId(session);
+              deferWithSessionQueueTenantScope(
+                {
+                  db,
+                  config: config2,
+                  sessionId: session.session_id,
+                  params: context.params,
+                  tenantIdHint: sessionTenantId,
+                  label: "SessionsService.after.patch queue drain"
+                },
+                async (queueParams) => {
                   console.log(
                     `\u{1F504} [SessionsService.after.patch] Session ${shortId5(session.session_id)} became promptable (${session.status}), checking for queued tasks...`
                   );
-                  await sessionsService.triggerQueueProcessing(session.session_id, context.params);
-                } catch (error51) {
+                  await sessionsService.triggerQueueProcessing(session.session_id, queueParams);
+                },
+                (error51) => {
                   console.error(
                     `\u274C [SessionsService.after.patch] Failed to process queue for session ${shortId5(session.session_id)}:`,
                     error51
                   );
                 }
-              });
+              );
             } else {
               console.log(
                 `\u23ED\uFE0F  [SessionsService.after.patch] Queue drain suppressed for session ${shortId5(session.session_id)} (suppressTerminalQueueProcessing or not ready)`
@@ -46464,6 +47158,17 @@ function registerHooks(ctx) {
             context.dispatch = result;
             return context;
           }
+          if (_action === "mergeObjectFields" && objects) {
+            if (!context.id) throw new Error("Board ID required");
+            const result = await boardsService.mergeBoardObjectFields(
+              context.id,
+              objects
+            );
+            context.result = result;
+            app.service("boards").emit("patched", result);
+            context.dispatch = result;
+            return context;
+          }
           if (_action === "deleteZone" && objectId) {
             if (!context.id) throw new Error("Board ID required");
             const result = await boardsService.deleteZone(
@@ -46676,7 +47381,7 @@ function registerHooks(ctx) {
 import {
   loadConfig as loadConfig4,
   resolveBranchStorageConfig,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig5
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig6
 } from "@agor/core/config";
 import {
   BranchRepository as BranchRepository9,
@@ -46697,7 +47402,7 @@ import {
   BadRequest as BadRequest9,
   Conflict as Conflict2,
   errorHandler,
-  Forbidden as Forbidden13,
+  Forbidden as Forbidden14,
   LocalStrategy,
   NotAuthenticated as NotAuthenticated15,
   NotFound as NotFound5
@@ -46705,9 +47410,9 @@ import {
 import { PermissionService } from "@agor/core/permissions";
 import {
   AGENTIC_TOOL_CAPABILITIES as AGENTIC_TOOL_CAPABILITIES2,
-  hasMinimumRole as hasMinimumRole12,
+  hasMinimumRole as hasMinimumRole14,
   MessageRole as MessageRole4,
-  ROLES as ROLES15,
+  ROLES as ROLES17,
   SERVICE_GROUP_NAMES as SERVICE_GROUP_NAMES2,
   SessionStatus as SessionStatus6,
   TaskStatus as TaskStatus5
@@ -46715,12 +47420,64 @@ import {
 import { NotFoundError as NotFoundError4 } from "@agor/core/utils/errors";
 import { rateLimit as rateLimit2 } from "express-rate-limit";
 
+// src/auth/issue-browser-tokens-hook.ts
+init_runtime_tokens();
+init_token_invalidation();
+
+// src/auth/user-redaction.ts
+function redactUserAuthMetadata(user) {
+  const {
+    tokens_valid_after: _tokensValidAfter,
+    password: _password,
+    tenant_id: _tenantId,
+    ...publicUser
+  } = user;
+  return publicUser;
+}
+
+// src/auth/issue-browser-tokens-hook.ts
+var MACHINE_TOKEN_TYPES = /* @__PURE__ */ new Set(["executor-session", "service"]);
+function createIssueBrowserTokensHook(options) {
+  const { jwtSecret, accessTokenTtl, refreshTokenTtl, tenantClaim, debug } = options;
+  return async (context) => {
+    debug?.("\u2705 Authentication succeeded:", {
+      strategy: context.result?.authentication?.strategy,
+      hasUser: !!context.result?.user,
+      user_id: context.result?.user?.user_id,
+      hasAccessToken: !!context.result?.accessToken
+    });
+    if (!context.result?.user) {
+      return context;
+    }
+    const payloadType = context.result.authentication?.payload?.type;
+    if (typeof payloadType === "string" && MACHINE_TOKEN_TYPES.has(payloadType)) {
+      context.result.user = redactUserAuthMetadata(context.result.user);
+      return context;
+    }
+    const tenantId = context.params?.tenant?.tenant_id ?? context.result.user.tenant_id;
+    const tokens = issueRuntimeTokenPair(
+      context.result.user,
+      jwtSecret,
+      accessTokenTtl,
+      refreshTokenTtl,
+      {
+        ...authTokenIssuedAtClaim(Date.now(), context.result.user),
+        ...runtimeTenantClaims(tenantId, tenantClaim)
+      }
+    );
+    context.result.accessToken = tokens.accessToken;
+    context.result.refreshToken = tokens.refreshToken;
+    context.result.user = redactUserAuthMetadata(context.result.user);
+    return context;
+  };
+}
+
 // src/auth/launch-auth.ts
 init_runtime_tokens();
 init_token_invalidation();
 import { createHash, createPublicKey, randomBytes } from "crypto";
 import {
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig4,
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig5,
   resolveTenantContext as resolveTenantContext4,
   TenantResolutionError as TenantResolutionError4
 } from "@agor/core/config";
@@ -46730,27 +47487,14 @@ import {
   hash as hash2,
   insert as insert2,
   reattributeLegacyAnonymousRows,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope3,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope5,
   select as select2,
   update as update2,
   users as users2
 } from "@agor/core/db";
 import { BadRequest as BadRequest6, NotAuthenticated as NotAuthenticated10 } from "@agor/core/feathers";
 import { normalizeRole as normalizeRole2, ROLES as ROLES11 } from "@agor/core/types";
-import jwt4 from "jsonwebtoken";
-
-// src/auth/user-redaction.ts
-function redactUserAuthMetadata(user) {
-  const {
-    tokens_valid_after: _tokensValidAfter,
-    password: _password,
-    tenant_id: _tenantId,
-    ...publicUser
-  } = user;
-  return publicUser;
-}
-
-// src/auth/launch-auth.ts
+import jwt5 from "jsonwebtoken";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_SERVICE_TOKEN_ENV = "AGOR_EXTERNAL_LAUNCH_SERVICE_TOKEN";
 var DEFAULT_SHARED_SECRET_ENV = "AGOR_EXTERNAL_LAUNCH_SHARED_SECRET";
@@ -47015,13 +47759,13 @@ async function resolveVerificationKey(header, settings) {
   return createPublicKey({ key: jwk, format: "jwk" });
 }
 async function verifyLaunchAssertion(assertion, settings) {
-  const decoded = jwt4.decode(assertion, { complete: true });
+  const decoded = jwt5.decode(assertion, { complete: true });
   if (!decoded || typeof decoded !== "object") {
     throw new NotAuthenticated10("Invalid one-time launch assertion");
   }
   const key = await resolveVerificationKey(decoded.header, settings);
   const algorithms = settings.algorithms ?? (settings.devSharedSecret ? ["HS256"] : void 0);
-  const claims = jwt4.verify(assertion, key, {
+  const claims = jwt5.verify(assertion, key, {
     issuer: settings.issuer,
     audience: settings.audience,
     algorithms
@@ -47064,7 +47808,7 @@ function issueRuntimeTokens(user, jwtSecret, accessTokenTtl, refreshTokenTtl, te
   };
 }
 function createLaunchAuthService(options) {
-  const multiTenancy = resolveMultiTenancyConfig4(options.config);
+  const multiTenancy = resolveMultiTenancyConfig5(options.config);
   const tenantClaim = multiTenancy.auth_claim ?? "tenant_id";
   return {
     async create(data, params) {
@@ -47088,7 +47832,7 @@ function createLaunchAuthService(options) {
           authPayload: claims,
           headers: params?.headers
         });
-        return await runWithTenantDatabaseScope3(options.db, tenant.tenant_id, async () => {
+        return await runWithTenantDatabaseScope5(options.db, tenant.tenant_id, async () => {
           const user = await upsertLaunchUser(options, claims, tenant);
           return issueRuntimeTokens(
             user,
@@ -47116,12 +47860,12 @@ function createLaunchAuthService(options) {
 init_runtime_tokens();
 init_token_invalidation();
 import { NotAuthenticated as NotAuthenticated11 } from "@agor/core/feathers";
-import jwt5 from "jsonwebtoken";
+import jwt6 from "jsonwebtoken";
 function createRefreshTokenService(options) {
   return {
     async create(data, _params) {
       try {
-        const decoded = jwt5.verify(data.refreshToken, options.jwtSecret, {
+        const decoded = jwt6.verify(data.refreshToken, options.jwtSecret, {
           issuer: RUNTIME_JWT_ISSUER,
           audience: RUNTIME_JWT_AUDIENCE
         });
@@ -47210,7 +47954,7 @@ import {
   getCurrentTenantId as getCurrentTenantId4,
   isPostgresDatabase,
   runWithSystemDatabaseScope,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope6,
   ScheduleRepository as ScheduleRepository2,
   SessionMCPServerRepository as SessionMCPServerRepository2,
   SessionRepository as SessionRepository4,
@@ -47382,7 +48126,7 @@ var SchedulerService = class {
           continue;
         }
         try {
-          await runWithTenantDatabaseScope4(this.db, ref.tenantId, async () => {
+          await runWithTenantDatabaseScope6(this.db, ref.tenantId, async () => {
             const schedule = await this.scheduleRepo.findById(ref.scheduleId);
             if (!schedule) return;
             await this.processSchedule(schedule, now);
@@ -47405,7 +48149,7 @@ var SchedulerService = class {
       }));
     };
     if (this.config.tenantId) {
-      return runWithTenantDatabaseScope4(
+      return runWithTenantDatabaseScope6(
         this.db,
         this.config.tenantId,
         () => findDue(this.config.tenantId)
@@ -47875,7 +48619,7 @@ init_users();
 init_runtime_tokens();
 import { resolveProxies } from "@agor/core/config";
 import { rateLimit } from "express-rate-limit";
-import jwt6 from "jsonwebtoken";
+import jwt7 from "jsonwebtoken";
 var RATE_LIMIT_PER_MINUTE = 600;
 var MAX_RESPONSE_BYTES = 5 * 1024 * 1024;
 var UPSTREAM_TIMEOUT_MS = 3e4;
@@ -47900,7 +48644,7 @@ async function authenticateRequest(req, app, jwtSecret) {
   if (!match) return null;
   let decoded;
   try {
-    decoded = jwt6.verify(match[1], jwtSecret, {
+    decoded = jwt7.verify(match[1], jwtSecret, {
       issuer: RUNTIME_JWT_ISSUER,
       audience: [RUNTIME_JWT_AUDIENCE, ARTIFACT_RUNTIME_JWT_AUDIENCE]
     });
@@ -48612,6 +49356,14 @@ async function doResolveWidget(widgetId, action, caller, deps) {
   const entry = getWidget(widget.widget_type);
   let resultMeta;
   let autoResumePrompt;
+  const ctx = {
+    // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
+    app: deps.app,
+    sessionId: message.session_id,
+    submitterUserId: caller.user_id,
+    submitterRole: caller.role,
+    sessionCreatorUserId: session.created_by
+  };
   if (action.kind === "submit") {
     if (!entry) {
       throw new NotFound3(
@@ -48623,18 +49375,13 @@ async function doResolveWidget(widgetId, action, caller, deps) {
       throw new Forbidden12(`Invalid submit payload: ${parsed.error.message}`);
     }
     const submit = parsed.data;
-    const submitCtx = {
-      // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
-      app: deps.app,
-      sessionId: message.session_id,
-      submitterUserId: caller.user_id,
-      submitterRole: caller.role,
-      sessionCreatorUserId: session.created_by
-    };
-    await entry.applySubmit(submitCtx, submit, widget.params);
+    await entry.applySubmit(ctx, submit, widget.params);
     resultMeta = entry.buildResultMeta(submit);
     autoResumePrompt = entry.buildAutoResumePrompt(resultMeta, widget.params);
   } else {
+    if (entry?.authorizeDismiss) {
+      await entry.authorizeDismiss(ctx, widget.params);
+    }
     autoResumePrompt = entry ? entry.buildDismissedPrompt(widget.params) : `[Agor] User dismissed a widget request. Do not re-request immediately \u2014 ask whether to proceed without, or move on to other work.`;
   }
   const newStatus = action.kind === "submit" ? "submitted" : "dismissed";
@@ -48767,7 +49514,7 @@ async function registerRoutes(ctx) {
   const appRecord = app;
   const sessionTokenService = appRecord.sessionTokenService;
   const authStrategiesArray = ["api-key", "jwt", "local"];
-  const multiTenancy = resolveMultiTenancyConfig5(config2);
+  const multiTenancy = resolveMultiTenancyConfig6(config2);
   const tenantTokenClaim = multiTenancy.auth_claim ?? "tenant_id";
   if (sessionTokenService) {
     authStrategiesArray.push("session-token");
@@ -48832,32 +49579,13 @@ async function registerRoutes(ctx) {
   authService.hooks({
     after: {
       create: [
-        // biome-ignore lint/suspicious/noExplicitAny: FeathersJS context type not fully typed
-        async (context) => {
-          authEventDebug("\u2705 Authentication succeeded:", {
-            strategy: context.result?.authentication?.strategy,
-            hasUser: !!context.result?.user,
-            user_id: context.result?.user?.user_id,
-            hasAccessToken: !!context.result?.accessToken
-          });
-          if (context.result?.user) {
-            const tenantId = context.params?.tenant?.tenant_id ?? context.result.user.tenant_id;
-            const tokens = issueRuntimeTokenPair(
-              context.result.user,
-              jwtSecret,
-              ACCESS_TOKEN_TTL,
-              REFRESH_TOKEN_TTL,
-              {
-                ...authTokenIssuedAtClaim(Date.now(), context.result.user),
-                ...runtimeTenantClaims(tenantId, tenantTokenClaim)
-              }
-            );
-            context.result.accessToken = tokens.accessToken;
-            context.result.refreshToken = tokens.refreshToken;
-            context.result.user = redactUserAuthMetadata(context.result.user);
-          }
-          return context;
-        }
+        createIssueBrowserTokensHook({
+          jwtSecret,
+          accessTokenTtl: ACCESS_TOKEN_TTL,
+          refreshTokenTtl: REFRESH_TOKEN_TTL,
+          tenantClaim: tenantTokenClaim,
+          debug: authEventDebug
+        })
       ]
     }
   });
@@ -48901,12 +49629,12 @@ async function registerRoutes(ctx) {
         throw new NotAuthenticated15("Authentication required");
       }
       const caller = authParams.user;
-      if (!hasMinimumRole12(caller.role, ROLES15.SUPERADMIN)) {
-        throw new Forbidden13("Superadmin role required for impersonation");
+      if (!hasMinimumRole14(caller.role, ROLES17.SUPERADMIN)) {
+        throw new Forbidden14("Superadmin role required for impersonation");
       }
       const authPayload = authParams.authentication?.payload;
       if (authPayload?.is_impersonated === true) {
-        throw new Forbidden13("Cannot impersonate from an already-impersonated token");
+        throw new Forbidden14("Cannot impersonate from an already-impersonated token");
       }
       if (!data?.user_id) {
         throw new BadRequest9("user_id is required");
@@ -48987,7 +49715,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "create messages" }
+      create: { role: ROLES17.MEMBER, action: "create messages" }
     },
     requireAuth
   );
@@ -49009,7 +49737,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "broadcast streaming events" }
+      create: { role: ROLES17.MEMBER, action: "broadcast streaming events" }
     },
     requireAuth
   );
@@ -49037,10 +49765,12 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "broadcast task streaming events" }
+      create: { role: ROLES17.MEMBER, action: "broadcast task streaming events" }
     },
     requireAuth
   );
+  app.service("/messages/streaming").publish(() => []);
+  app.service("/tasks/streaming").publish(() => []);
   registerAuthenticatedRoute2(
     app,
     "/sessions/:id/fork",
@@ -49059,7 +49789,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "fork sessions" }
+      create: { role: ROLES17.MEMBER, action: "fork sessions" }
     },
     requireAuth
   );
@@ -49081,7 +49811,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "spawn sessions" }
+      create: { role: ROLES17.MEMBER, action: "spawn sessions" }
     },
     requireAuth
   );
@@ -49097,7 +49827,7 @@ async function registerRoutes(ctx) {
       // biome-ignore lint/suspicious/noExplicitAny: FeathersJS route handler type mismatch with Express RouteParams
     },
     {
-      find: { role: ROLES15.MEMBER, action: "view session genealogy" }
+      find: { role: ROLES17.MEMBER, action: "view session genealogy" }
     },
     requireAuth
   );
@@ -49121,7 +49851,7 @@ async function registerRoutes(ctx) {
           callerRole: params.user?.role,
           sessionCreatedBy: session.created_by
         })) {
-          throw new Forbidden13("You can only restart Claude CLI sessions you created.");
+          throw new Forbidden14("You can only restart Claude CLI sessions you created.");
         }
         const tabName = `cli-${shortId16(session.session_id)}`;
         const channel = `user/${targetUserId}/terminal`;
@@ -49172,7 +49902,7 @@ async function registerRoutes(ctx) {
       // biome-ignore lint/suspicious/noExplicitAny: FeathersJS route handler type mismatch
     },
     {
-      create: { role: ROLES15.MEMBER, action: "restart claude CLI session" }
+      create: { role: ROLES17.MEMBER, action: "restart claude CLI session" }
     },
     requireAuth
   );
@@ -49518,7 +50248,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "execute prompts" }
+      create: { role: ROLES17.MEMBER, action: "execute prompts" }
     },
     requireAuth
   );
@@ -49548,7 +50278,7 @@ ${errorMessage}`;
           } else {
             const userId = params.user?.user_id;
             if (!userId) {
-              throw new Forbidden13("Authentication required to run tasks");
+              throw new Forbidden14("Authentication required to run tasks");
             }
             const wt = await branchRepository.findById(session.branch_id);
             if (!wt) {
@@ -49566,7 +50296,7 @@ ${errorMessage}`;
             );
             const canRun = PERMISSION_RANK[effectiveLevel] >= PERMISSION_RANK.prompt || effectiveLevel === "session" && session.created_by === userId;
             if (!canRun) {
-              throw new Forbidden13(
+              throw new Forbidden14(
                 `You have '${effectiveLevel}' permission on this branch, which does not allow running tasks. Need 'prompt' or 'all' (or 'session' for own sessions).`
               );
             }
@@ -49609,7 +50339,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "execute prompts" }
+      create: { role: ROLES17.MEMBER, action: "execute prompts" }
     },
     requireAuth
   );
@@ -49636,7 +50366,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "send spawn-subsession prompts" }
+      create: { role: ROLES17.MEMBER, action: "send spawn-subsession prompts" }
     },
     requireAuth
   );
@@ -49685,7 +50415,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "fire zone triggers" }
+      create: { role: ROLES17.MEMBER, action: "fire zone triggers" }
     },
     requireAuth
   );
@@ -49696,7 +50426,7 @@ ${errorMessage}`;
     try {
       const { sessionId } = req.params;
       const params = req.feathers;
-      ensureMinimumRole(params, ROLES15.MEMBER, "upload files");
+      ensureMinimumRole(params, ROLES17.MEMBER, "upload files");
       const session = await sessionsService.get(sessionId, params);
       if (!session) {
         console.error(`\u274C [Upload Authz] Session not found: ${shortId16(sessionId)}`);
@@ -49940,7 +50670,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "stop sessions" }
+      create: { role: ROLES17.MEMBER, action: "stop sessions" }
     },
     requireAuth
   );
@@ -49961,12 +50691,24 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES15.MEMBER, action: "view queue" }
+      find: { role: ROLES17.MEMBER, action: "view queue" }
     },
     requireAuth
   );
   const queueRetryScheduled = /* @__PURE__ */ new Set();
   async function processNextQueuedTask(sessionId, params) {
+    await runWithSessionQueueTenantScope(
+      {
+        db,
+        config: config2,
+        sessionId,
+        params,
+        label: "processNextQueuedTask"
+      },
+      async (scopedParams) => processNextQueuedTaskInTenantScope(sessionId, scopedParams)
+    );
+  }
+  async function processNextQueuedTaskInTenantScope(sessionId, params) {
     const existingLock = sessionTurnLocks.get(sessionId);
     if (existingLock) {
       console.log(`\u23F3 [Queue] Session turn in progress for ${shortId16(sessionId)}, waiting...`);
@@ -49985,14 +50727,27 @@ ${errorMessage}`;
       }
       if (!queueRetryScheduled.has(sessionId)) {
         queueRetryScheduled.add(sessionId);
-        deferInFreshTenantScope(params, async () => {
-          queueRetryScheduled.delete(sessionId);
-          try {
-            await processNextQueuedTask(sessionId, params);
-          } catch (error51) {
+        deferWithSessionQueueTenantScope(
+          {
+            db,
+            config: config2,
+            sessionId,
+            params,
+            label: "processNextQueuedTask retry"
+          },
+          async (retryParams) => {
+            queueRetryScheduled.delete(sessionId);
+            try {
+              await processNextQueuedTask(sessionId, retryParams);
+            } catch (error51) {
+              console.error(`\u274C [Queue] Retry failed for session ${shortId16(sessionId)}:`, error51);
+            }
+          },
+          (error51) => {
+            queueRetryScheduled.delete(sessionId);
             console.error(`\u274C [Queue] Retry failed for session ${shortId16(sessionId)}:`, error51);
           }
-        });
+        );
       } else {
         console.log(
           `\u23ED\uFE0F  [Queue] Retry already scheduled for session ${shortId16(sessionId)}, not queueing another`
@@ -50147,7 +50902,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "respond to permission requests" }
+      create: { role: ROLES17.MEMBER, action: "respond to permission requests" }
     },
     requireAuth
   );
@@ -50176,7 +50931,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "submit widgets" }
+      create: { role: ROLES17.MEMBER, action: "submit widgets" }
     },
     requireAuth
   );
@@ -50199,7 +50954,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "dismiss widgets" }
+      create: { role: ROLES17.MEMBER, action: "dismiss widgets" }
     },
     requireAuth
   );
@@ -50212,7 +50967,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "create tasks" }
+      create: { role: ROLES17.MEMBER, action: "create tasks" }
     },
     requireAuth
   );
@@ -50227,7 +50982,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "complete tasks" }
+      create: { role: ROLES17.MEMBER, action: "complete tasks" }
     },
     requireAuth
   );
@@ -50242,7 +50997,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "fail tasks" }
+      create: { role: ROLES17.MEMBER, action: "fail tasks" }
     },
     requireAuth
   );
@@ -50255,7 +51010,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "add local repositories" }
+      create: { role: ROLES17.MEMBER, action: "add local repositories" }
     },
     requireAuth
   );
@@ -50268,7 +51023,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "clone repositories" }
+      create: { role: ROLES17.MEMBER, action: "clone repositories" }
     },
     requireAuth
   );
@@ -50287,7 +51042,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.MEMBER, action: "create branches" }
+      create: { role: ROLES17.MEMBER, action: "create branches" }
     },
     requireAuth
   );
@@ -50304,7 +51059,7 @@ ${errorMessage}`;
       }
     },
     {
-      remove: { role: ROLES15.MEMBER, action: "remove branches" }
+      remove: { role: ROLES17.MEMBER, action: "remove branches" }
     },
     requireAuth
   );
@@ -50320,7 +51075,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES15.ADMIN, action: "import environment config from .agor.yml" }
+      create: { role: ROLES17.ADMIN, action: "import environment config from .agor.yml" }
     },
     requireAuth
   );
@@ -50339,7 +51094,7 @@ ${errorMessage}`;
       // Admin-only, matching Import and repo.environment edit. Export writes a
       // file to the branch working tree, so even though the content is
       // derivable, the side effect warrants the same permission bar as import.
-      create: { role: ROLES15.ADMIN, action: "export .agor.yml" }
+      create: { role: ROLES17.ADMIN, action: "export .agor.yml" }
     },
     requireAuth
   );
@@ -50364,10 +51119,10 @@ ${errorMessage}`;
       }
     },
     {
-      find: { role: ROLES15.MEMBER, action: "list API keys" },
-      create: { role: ROLES15.MEMBER, action: "create API keys" },
-      patch: { role: ROLES15.MEMBER, action: "update API keys" },
-      remove: { role: ROLES15.MEMBER, action: "delete API keys" }
+      find: { role: ROLES17.MEMBER, action: "list API keys" },
+      create: { role: ROLES17.MEMBER, action: "create API keys" },
+      patch: { role: ROLES17.MEMBER, action: "update API keys" },
+      remove: { role: ROLES17.MEMBER, action: "delete API keys" }
     },
     requireAuth
   );
@@ -50388,7 +51143,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES15.MEMBER, action: "react to board comments" }
+        create: { role: ROLES17.MEMBER, action: "react to board comments" }
       },
       requireAuth
     );
@@ -50410,7 +51165,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES15.MEMBER, action: "reply to board comments" }
+        create: { role: ROLES17.MEMBER, action: "reply to board comments" }
       },
       requireAuth
     );
@@ -50429,7 +51184,7 @@ ${errorMessage}`;
       // Branch `all`/admin control is enforced at the service layer. This
       // route-level gate is just "authenticated" so the service remains
       // the single source of truth across REST, WebSocket, and MCP.
-      create: { role: ROLES15.VIEWER, action: "start branch environments" }
+      create: { role: ROLES17.VIEWER, action: "start branch environments" }
     },
     requireAuth
   );
@@ -50445,7 +51200,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES15.VIEWER, action: "stop branch environments" }
+      create: { role: ROLES17.VIEWER, action: "stop branch environments" }
     },
     requireAuth
   );
@@ -50464,7 +51219,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES15.VIEWER, action: "restart branch environments" }
+      create: { role: ROLES17.VIEWER, action: "restart branch environments" }
     },
     requireAuth
   );
@@ -50480,7 +51235,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES15.VIEWER, action: "nuke branch environments" }
+      create: { role: ROLES17.VIEWER, action: "nuke branch environments" }
     },
     requireAuth
   );
@@ -50500,7 +51255,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES15.VIEWER, action: "render branch environment" }
+      create: { role: ROLES17.VIEWER, action: "render branch environment" }
     },
     requireAuth
   );
@@ -50516,7 +51271,7 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES15.VIEWER, action: "check branch health" }
+      find: { role: ROLES17.VIEWER, action: "check branch health" }
     },
     requireAuth
   );
@@ -50536,13 +51291,13 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES15.MEMBER, "archive or delete branches"),
+        requireMinimumRole(ROLES17.MEMBER, "archive or delete branches"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new Error("Branch ID required");
           const branch = await branchRepository.findById(id);
           if (!branch) {
-            throw new Forbidden13(`Branch not found: ${id}`);
+            throw new Forbidden14(`Branch not found: ${id}`);
           }
           await cacheBranchAccess(context.params, branchRepository, branch);
           return context;
@@ -50550,8 +51305,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "archive or delete branches", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole12(userRole, ROLES15.ADMIN)) {
-            throw new Forbidden13(
+          if (!isOwner && !hasMinimumRole14(userRole, ROLES17.ADMIN)) {
+            throw new Forbidden14(
               "You must be the branch owner or a global admin to archive/delete branches"
             );
           }
@@ -50572,13 +51327,13 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES15.MEMBER, "unarchive branches"),
+        requireMinimumRole(ROLES17.MEMBER, "unarchive branches"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new Error("Branch ID required");
           const branch = await branchRepository.findById(id);
           if (!branch) {
-            throw new Forbidden13(`Branch not found: ${id}`);
+            throw new Forbidden14(`Branch not found: ${id}`);
           }
           await cacheBranchAccess(context.params, branchRepository, branch);
           return context;
@@ -50586,8 +51341,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "unarchive branches", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole12(userRole, ROLES15.ADMIN)) {
-            throw new Forbidden13(
+          if (!isOwner && !hasMinimumRole14(userRole, ROLES17.ADMIN)) {
+            throw new Forbidden14(
               "You must be the branch owner or a global admin to unarchive branches"
             );
           }
@@ -50637,7 +51392,7 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES15.MEMBER, "run schedule"),
+        requireMinimumRole(ROLES17.MEMBER, "run schedule"),
         // Reuse the canonical hook so caching semantics (params.schedule
         // / params.branch / params.isBranchOwner) match every other
         // schedule-touching path.
@@ -50646,8 +51401,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "run schedule", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole12(userRole, ROLES15.ADMIN)) {
-            throw new Forbidden13(
+          if (!isOwner && !hasMinimumRole14(userRole, ROLES17.ADMIN)) {
+            throw new Forbidden14(
               "You must be the branch owner or a global admin to run schedules"
             );
           }
@@ -50711,7 +51466,7 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES15.MEMBER, "execute scheduled runs"),
+        requireMinimumRole(ROLES17.MEMBER, "execute scheduled runs"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new BadRequest9("Branch ID required");
@@ -50725,8 +51480,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "execute scheduled runs", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole12(userRole, ROLES15.ADMIN)) {
-            throw new Forbidden13(
+          if (!isOwner && !hasMinimumRole14(userRole, ROLES17.ADMIN)) {
+            throw new Forbidden14(
               "You must be the branch owner or a global admin to execute scheduled runs"
             );
           }
@@ -50750,7 +51505,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      find: { role: ROLES15.VIEWER, action: "view branch logs" }
+      find: { role: ROLES17.VIEWER, action: "view branch logs" }
     },
     requireAuth
   );
@@ -50767,7 +51522,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES15.MEMBER, action: "modify board sessions" }
+        create: { role: ROLES17.MEMBER, action: "modify board sessions" }
       },
       requireAuth
     );
@@ -50797,7 +51552,15 @@ ${errorMessage}`;
           const includeGlobal = params.query?.includeGlobal === "true" || params.query?.includeGlobal === true;
           const includeMetadata = params.query?.includeMetadata === "true" || params.query?.includeMetadata === true;
           const mcpService = app.service("mcp-servers");
-          const userId = params.user?.user_id;
+          const queryForUserId = typeof params.query?.forUserId === "string" ? params.query.forUserId : void 0;
+          const authPayloadType = params.authentication?.payload?.type;
+          const routeUser = params.user;
+          const userId = resolveForUserIdWithGate({
+            queryForUserId,
+            isServiceAccount: routeUser?._isServiceAccount,
+            authPayloadType,
+            callerUserId: params.user?.user_id
+          });
           const rawLookupParams = {
             ...params,
             provider: void 0,
@@ -50932,10 +51695,10 @@ ${errorMessage}`;
         // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
       },
       {
-        find: { role: ROLES15.MEMBER, action: "view session MCP servers" },
-        create: { role: ROLES15.MEMBER, action: "modify session MCP servers" },
-        remove: { role: ROLES15.MEMBER, action: "modify session MCP servers" },
-        patch: { role: ROLES15.MEMBER, action: "modify session MCP servers" }
+        find: { role: ROLES17.MEMBER, action: "view session MCP servers" },
+        create: { role: ROLES17.MEMBER, action: "modify session MCP servers" },
+        remove: { role: ROLES17.MEMBER, action: "modify session MCP servers" },
+        patch: { role: ROLES17.MEMBER, action: "modify session MCP servers" }
       },
       requireAuth
     );
@@ -51024,10 +51787,10 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES15.MEMBER, action: "view session env selections" },
-      create: { role: ROLES15.MEMBER, action: "modify session env selections" },
-      remove: { role: ROLES15.MEMBER, action: "modify session env selections" },
-      patch: { role: ROLES15.MEMBER, action: "modify session env selections" }
+      find: { role: ROLES17.MEMBER, action: "view session env selections" },
+      create: { role: ROLES17.MEMBER, action: "modify session env selections" },
+      remove: { role: ROLES17.MEMBER, action: "modify session env selections" },
+      patch: { role: ROLES17.MEMBER, action: "modify session env selections" }
     },
     requireAuth
   );
@@ -51308,7 +52071,9 @@ import {
   BoardRepository as BoardRepository6,
   BranchRepository as BranchRepository16,
   eq as eq6,
+  getCurrentTenantId as getCurrentTenantId7,
   inArray as inArray2,
+  isPostgresDatabase as isPostgresDatabase8,
   MCPServerRepository as MCPServerRepository5,
   SessionMCPServerRepository as SessionMCPServerRepository5,
   select as select6,
@@ -51317,12 +52082,12 @@ import {
   UserMCPOAuthTokenRepository as UserMCPOAuthTokenRepository4,
   visibleSessionReferenceAccessExists as visibleSessionReferenceAccessExists2
 } from "@agor/core/db";
-import { Forbidden as Forbidden25, NotAuthenticated as NotAuthenticated21 } from "@agor/core/feathers";
+import { Forbidden as Forbidden26, NotAuthenticated as NotAuthenticated21 } from "@agor/core/feathers";
 import {
   AGENTIC_TOOL_CAPABILITIES as AGENTIC_TOOL_CAPABILITIES3,
   isSessionExecuting as isSessionExecuting2,
   isTaskExecuting as isTaskExecuting2,
-  ROLES as ROLES23,
+  ROLES as ROLES25,
   SessionStatus as SessionStatus9,
   TaskStatus as TaskStatus7
 } from "@agor/core/types";
@@ -51441,10 +52206,10 @@ import {
 import {
   ARTIFACT_SCOPED_ONLY_GRANT_KEYS,
   GRANT_ENV_VAR_NAMES,
-  hasMinimumRole as hasMinimumRole13,
+  hasMinimumRole as hasMinimumRole15,
   NO_CONSENT_GRANT_KEYS,
   proxyGrantEnvName,
-  ROLES as ROLES16
+  ROLES as ROLES18
 } from "@agor/core/types";
 
 // src/utils/agor-runtime-source.ts
@@ -52197,7 +52962,7 @@ var ArtifactsService = class extends DrizzleService {
     const existing = await this.artifactRepo.findById(artifactId);
     if (!existing) throw new Error(`Artifact ${artifactId} not found`);
     const isOwner = !!userId && existing.created_by === userId;
-    const isAdmin4 = !!userRole && hasMinimumRole13(userRole, ROLES16.ADMIN);
+    const isAdmin4 = !!userRole && hasMinimumRole15(userRole, ROLES18.ADMIN);
     if (userId && !isOwner && !isAdmin4) {
       throw new Error("Forbidden: only the artifact's creator or an admin may update it");
     }
@@ -53263,7 +54028,7 @@ var ArtifactsService = class extends DrizzleService {
     const artifact = await this.artifactRepo.findById(artifactId);
     if (!artifact) throw new Error(`Artifact ${artifactId} not found`);
     const isOwner = !!userId && artifact.created_by === userId;
-    const isAdmin4 = !!userRole && hasMinimumRole13(userRole, ROLES16.ADMIN);
+    const isAdmin4 = !!userRole && hasMinimumRole15(userRole, ROLES18.ADMIN);
     if (!isOwner && !isAdmin4) {
       throw new Error("Forbidden: only the artifact's creator or an admin may delete it");
     }
@@ -53874,20 +54639,20 @@ function createBoardObjectsService(db) {
 }
 
 // src/services/board-owners.ts
-import { Forbidden as Forbidden14, NotAuthenticated as NotAuthenticated16 } from "@agor/core/feathers";
-import { hasMinimumRole as hasMinimumRole14, ROLES as ROLES17 } from "@agor/core/types";
+import { Forbidden as Forbidden15, NotAuthenticated as NotAuthenticated16 } from "@agor/core/feathers";
+import { hasMinimumRole as hasMinimumRole16, ROLES as ROLES19 } from "@agor/core/types";
 function requireBoardAccess(boardRepo, mode) {
   return async (context) => {
     if (!context.params.provider) return context;
     if (context.params.user?._isServiceAccount) return context;
     const user = context.params.user;
     if (!user?.user_id) throw new NotAuthenticated16("Authentication required");
-    if (hasMinimumRole14(user.role, ROLES17.ADMIN)) return context;
+    if (hasMinimumRole16(user.role, ROLES19.ADMIN)) return context;
     const boardId = context.params.route?.id;
     if (!boardId) throw new Error("Board ID is required");
     const allowed = mode === "view" ? await boardRepo.canView(boardId, user.user_id) : await boardRepo.canMutate(boardId, user.user_id);
     if (allowed) return context;
-    throw new Forbidden14(
+    throw new Forbidden15(
       mode === "view" ? "You need board access to view board owners" : "You need board owner or board group 'all' access to manage board owners"
     );
   };
@@ -54121,6 +54886,13 @@ var BoardsService = class extends DrizzleService {
   async batchUpsertBoardObjects(boardId, objects, _params) {
     return this.boardRepo.batchUpsertBoardObjects(boardId, objects);
   }
+  /**
+   * Custom method: Atomically shallow-merge field patches into existing board
+   * objects (used by z-order reorder to persist only the changed zIndex).
+   */
+  async mergeBoardObjectFields(boardId, patches, _params) {
+    return this.boardRepo.mergeBoardObjectFields(boardId, patches);
+  }
   /**
    * Custom method: Delete a zone and handle associated sessions
    */
@@ -54273,7 +55045,7 @@ function createBoardsService(db, emitBoardObjectPatched) {
 init_branch_authorization();
 init_spawn_executor();
 import { shortId as shortId18 } from "@agor/core/db";
-import { Forbidden as Forbidden15, NotAuthenticated as NotAuthenticated17 } from "@agor/core/feathers";
+import { Forbidden as Forbidden16, NotAuthenticated as NotAuthenticated17 } from "@agor/core/feathers";
 function requireViewPermission(branchRepo, allowSuperadmin = true) {
   return async (context) => {
     if (!context.params.provider) {
@@ -54296,12 +55068,12 @@ function requireViewPermission(branchRepo, allowSuperadmin = true) {
     }
     const branch = await branchRepo.findById(branchId);
     if (!branch) {
-      throw new Forbidden15(`Branch not found: ${branchId}`);
+      throw new Forbidden16(`Branch not found: ${branchId}`);
     }
     const isOwner = await branchRepo.isOwner(branch.branch_id, userId);
     const effectivePermission = isOwner ? "all" : await branchRepo.resolveUserPermission(branch, userId);
     if (PERMISSION_RANK[effectivePermission] < PERMISSION_RANK.view) {
-      throw new Forbidden15("You do not have permission to view this branch");
+      throw new Forbidden16("You do not have permission to view this branch");
     }
     return context;
   };
@@ -54328,7 +55100,7 @@ function requireBranchOwner(branchRepo, allowSuperadmin = true) {
     }
     const isOwner = await branchRepo.isOwner(branchId, userId);
     if (!isOwner) {
-      throw new Forbidden15("Only branch owners can manage owners");
+      throw new Forbidden16("Only branch owners can manage owners");
     }
     return context;
   };
@@ -54484,7 +55256,7 @@ import {
   validateManagedEnvLifecyclePolicy as validateManagedEnvLifecyclePolicy2,
   validateRenderedManagedEnvUrlFields as validateRenderedManagedEnvUrlFields2
 } from "@agor/core/environment/webhook";
-import { BadRequest as BadRequest10, Forbidden as Forbidden16, NotAuthenticated as NotAuthenticated18 } from "@agor/core/feathers";
+import { BadRequest as BadRequest10, Forbidden as Forbidden17, NotAuthenticated as NotAuthenticated18 } from "@agor/core/feathers";
 import { stripGitUrlCredentials } from "@agor/core/git/pure";
 import {
   BRANCH_ENVIRONMENT_CLEARABLE_FIELDS,
@@ -54507,6 +55279,27 @@ function shouldUseCloneReferencePath() {
   return (config2.execution?.unix_user_mode ?? "simple") !== "strict";
 }
 
+// src/utils/emit-service-event.ts
+var DEFAULT_EVENT_METHOD = {
+  created: "create",
+  updated: "update",
+  patched: "patch",
+  removed: "remove"
+};
+function emitServiceEvent(app, event) {
+  const service = app.service(event.path);
+  service.emit?.(event.event, event.data, {
+    app,
+    service,
+    path: event.path,
+    method: event.method ?? DEFAULT_EVENT_METHOD[event.event] ?? "patch",
+    event: event.event,
+    id: event.id,
+    result: event.data,
+    params: event.params ?? {}
+  });
+}
+
 // src/utils/git-impersonation.ts
 async function resolveDaemonUserForGroupRefresh() {
   const { getDaemonUser: getDaemonUser2, isUnixGroupRefreshNeeded } = await import("@agor/core/config");
@@ -54928,7 +55721,7 @@ var BranchesService = class extends DrizzleService {
       }
       const isService = !!caller._isServiceAccount;
       if (!isService) {
-        throw new Forbidden16("Only the executor service account may initialize Unix groups");
+        throw new Forbidden17("Only the executor service account may initialize Unix groups");
       }
     }
     const { initializeBranchUnixGroup: initializeBranchUnixGroup2 } = await Promise.resolve().then(() => (init_unix_group_init(), unix_group_init_exports));
@@ -55013,7 +55806,7 @@ var BranchesService = class extends DrizzleService {
     if (await this.branchRepo.isOwner(branch.branch_id, userId)) {
       return;
     }
-    throw new Forbidden16("Only branch owners or admins can manage assistant knowledge");
+    throw new Forbidden17("Only branch owners or admins can manage assistant knowledge");
   }
   containsAssistantKnowledgeConfigMutation(data) {
     if (!Object.hasOwn(data, "custom_context")) return false;
@@ -55074,7 +55867,7 @@ var BranchesService = class extends DrizzleService {
     if (!userId) throw new NotAuthenticated18("Authentication required");
     const permission = await namespaces.resolveNamespacePermission(namespace.namespace_id, userId);
     if (permission !== "write" && permission !== "own") {
-      throw new Forbidden16(
+      throw new Forbidden17(
         "You need write access to use this Knowledge namespace as assistant home"
       );
     }
@@ -55751,7 +56544,13 @@ var BranchesService = class extends DrizzleService {
       },
       resolvedParams
     );
-    this.app.service("branches").emit?.("patched", branch);
+    emitServiceEvent(this.app, {
+      path: "branches",
+      event: "patched",
+      data: branch,
+      params: resolvedParams,
+      id
+    });
     return branch;
   }
   /**
@@ -56186,7 +56985,9 @@ var BranchesService = class extends DrizzleService {
         path: branch.path,
         custom_context: branch.custom_context,
         unix_gid: unixGid,
-        host_ip_address: hostIpAddress
+        host_ip_address: hostIpAddress,
+        base_ref: branch.base_ref,
+        ref_type: branch.ref_type
       },
       requestedVariant
     );
@@ -56643,6 +57444,9 @@ function isAlias(id) {
 }
 var CONTEXT_1M_BETA = "context-1m-2025-08-07";
 var ONE_MILLION_TOKENS = 9e5;
+function hasNativeMillionContext(id) {
+  return id.startsWith("claude-fable");
+}
 function toModelOptions(models) {
   const aliases = models.filter((m) => isAlias(m.id));
   const options = [];
@@ -56653,7 +57457,7 @@ function toModelOptions(models) {
       description: void 0,
       source: "dynamic"
     });
-    if (m.max_input_tokens && m.max_input_tokens >= ONE_MILLION_TOKENS) {
+    if (m.max_input_tokens && m.max_input_tokens >= ONE_MILLION_TOKENS && !hasNativeMillionContext(m.id)) {
       options.push({
         id: `${m.id}[1m]`,
         displayName: `${m.display_name} (1M context)`,
@@ -56737,11 +57541,11 @@ import {
   resolveApiKey as resolveApiKey3,
   saveConfig
 } from "@agor/core/config";
-import { BadRequest as BadRequest11, Forbidden as Forbidden17, NotAuthenticated as NotAuthenticated19 } from "@agor/core/feathers";
+import { BadRequest as BadRequest11, Forbidden as Forbidden18, NotAuthenticated as NotAuthenticated19 } from "@agor/core/feathers";
 import {
   TOOL_API_KEY_NAMES as TOOL_API_KEY_NAMES2
 } from "@agor/core/types";
-import jwt9 from "jsonwebtoken";
+import jwt10 from "jsonwebtoken";
 var RESOLVABLE_API_KEY_NAMES = {
   ANTHROPIC_API_KEY: true,
   ANTHROPIC_AUTH_TOKEN: true,
@@ -56762,7 +57566,7 @@ function getExecutorTokenPayload(params) {
   }
   const accessToken = params?.authentication?.accessToken;
   if (typeof accessToken === "string") {
-    const decoded = jwt9.decode(accessToken);
+    const decoded = jwt10.decode(accessToken);
     if (decoded?.type === "executor-session" && decoded.purpose === "executor-task") {
       return decoded;
     }
@@ -56863,10 +57667,10 @@ var ConfigService = class {
         if (!caller) {
           throw new NotAuthenticated19("Authentication required");
         }
-        throw new Forbidden17("Only executor runtime credentials may resolve API keys");
+        throw new Forbidden18("Only executor runtime credentials may resolve API keys");
       }
       if (executorPayload?.task_id && executorPayload.task_id !== taskId) {
-        throw new Forbidden17("Executor token task scope does not match this request");
+        throw new Forbidden18("Executor token task scope does not match this request");
       }
     }
     let userId;
@@ -56881,31 +57685,31 @@ var ConfigService = class {
     } catch (err) {
       console.warn(`[Config.resolveApiKey] Failed to fetch task ${taskId}:`, err);
       if (executorPayload) {
-        throw new Forbidden17("Executor token task scope could not be verified");
+        throw new Forbidden18("Executor token task scope could not be verified");
       }
     }
     if (executorPayload && (!userId || !sessionId)) {
-      throw new Forbidden17("Executor token task scope could not be verified");
+      throw new Forbidden18("Executor token task scope could not be verified");
     }
     if (executorPayload) {
       const verifiedSessionId = sessionId;
       if (!verifiedSessionId) {
-        throw new Forbidden17("Executor token task scope could not be verified");
+        throw new Forbidden18("Executor token task scope could not be verified");
       }
       if (!tool) {
         throw new BadRequest11("Tool is required for executor API key resolution");
       }
       const expectedKeyName = TOOL_API_KEY_NAMES2[tool];
       if (!expectedKeyName || expectedKeyName !== keyName) {
-        throw new Forbidden17("Executor token is not valid for this API key");
+        throw new Forbidden18("Executor token is not valid for this API key");
       }
       const sessionsService = this.app?.service("sessions");
       if (!sessionsService) {
-        throw new Forbidden17("Executor token tool scope could not be verified");
+        throw new Forbidden18("Executor token tool scope could not be verified");
       }
       const session = await sessionsService.get(verifiedSessionId, { provider: void 0 });
       if (session?.agentic_tool !== tool) {
-        throw new Forbidden17("Executor token tool scope does not match this session");
+        throw new Forbidden18("Executor token tool scope does not match this session");
       }
     }
     const result = await resolveApiKey3(keyName, {
@@ -56990,7 +57794,7 @@ function createConfigService(db) {
 // src/services/context.ts
 import { readdir as readdir3, readFile as readFile3, stat as stat2 } from "fs/promises";
 import { isAbsolute as isAbsolute4, join as join6, relative as relative3, resolve as resolve5 } from "path";
-import { ROLES as ROLES18 } from "@agor/core/types";
+import { ROLES as ROLES20 } from "@agor/core/types";
 var ContextService = class {
   branchRepo;
   constructor(branchRepo) {
@@ -57006,7 +57810,7 @@ var ContextService = class {
     console.warn(
       "[Context Service] DEPRECATED: This service is deprecated. Use /file endpoint instead for browsing all files in a branch."
     );
-    ensureMinimumRole(params, ROLES18.MEMBER, "list context files");
+    ensureMinimumRole(params, ROLES20.MEMBER, "list context files");
     const branchId = params?.query?.branch_id;
     if (!branchId) {
       throw new Error("branch_id query parameter is required");
@@ -57032,7 +57836,7 @@ var ContextService = class {
    * @param id - Relative path from branch root (e.g., "context/concepts/core.md", "CLAUDE.md")
    */
   async get(id, params) {
-    ensureMinimumRole(params, ROLES18.MEMBER, "read context file");
+    ensureMinimumRole(params, ROLES20.MEMBER, "read context file");
     const branchId = params?.query?.branch_id;
     if (!branchId) {
       throw new Error("branch_id query parameter is required");
@@ -57294,7 +58098,7 @@ function createCursorModelsService(db) {
 // src/services/file.ts
 import { lstat as lstat2, readdir as readdir4, readFile as readFile4, realpath as realpath5 } from "fs/promises";
 import { extname, isAbsolute as isAbsolute5, join as join7, relative as relative4, resolve as resolve6, sep as sep5 } from "path";
-import { ROLES as ROLES19 } from "@agor/core/types";
+import { ROLES as ROLES21 } from "@agor/core/types";
 var MAX_FILES = 5e4;
 var MAX_PREVIEW_SIZE = 1024 * 1024;
 var MAX_TITLE_READ_BYTES = 4096;
@@ -57388,7 +58192,7 @@ var FileService = class {
    * Returns lightweight list items without content
    */
   async find(params) {
-    ensureMinimumRole(params, ROLES19.MEMBER, "list files");
+    ensureMinimumRole(params, ROLES21.MEMBER, "list files");
     const branchId = params?.query?.branch_id;
     if (!branchId) {
       throw new Error("branch_id query parameter is required");
@@ -57421,7 +58225,7 @@ var FileService = class {
    * @param id - Relative path from branch root (e.g., "src/index.ts", "README.md")
    */
   async get(id, params) {
-    ensureMinimumRole(params, ROLES19.MEMBER, "read file");
+    ensureMinimumRole(params, ROLES21.MEMBER, "read file");
     const branchId = params?.query?.branch_id;
     if (!branchId) {
       throw new Error("branch_id query parameter is required");
@@ -57682,7 +58486,8 @@ import {
   getHiddenTenantId,
   MCPServerRepository as MCPServerRepository3,
   runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope3,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope5,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope7,
+  SessionRepository as SessionRepository9,
   shortId as shortId23,
   ThreadSessionMapRepository as ThreadSessionMapRepository2,
   UserMCPOAuthTokenRepository as UserMCPOAuthTokenRepository3,
@@ -57699,7 +58504,7 @@ import {
   parseGitHubThreadId
 } from "@agor/core/gateway";
 import { resolveSessionDefaults as resolveSessionDefaults5 } from "@agor/core/sessions";
-import { hasMinimumRole as hasMinimumRole15, ROLES as ROLES20, SessionStatus as SessionStatus7 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole17, ROLES as ROLES22, SessionStatus as SessionStatus7 } from "@agor/core/types";
 import { getSessionUrl } from "@agor/core/utils/url";
 function hasListeningConfig(channel) {
   const config2 = channel.config;
@@ -57777,6 +58582,13 @@ function oneLineForPrompt(text, maxChars = 900) {
   if (normalized.length <= maxChars) return normalized;
   return `${normalized.slice(0, Math.max(0, maxChars - 1))}\u2026`;
 }
+var SLACK_GATEWAY_REPLY_NOTE = "Note: Any assistant message you send in this current Agor session is streamed back directly to the Slack conversation. Only use outbound gateway tools when you intentionally need to start a separate thread, DM, or message.";
+function prependSlackGatewayReplyNote(prompt) {
+  if (prompt.includes(SLACK_GATEWAY_REPLY_NOTE)) return prompt;
+  return `${SLACK_GATEWAY_REPLY_NOTE}
+
+${prompt}`;
+}
 function formatSlackCatchUpPrompt(args) {
   const slackChannelName = typeof args.metadata?.slack_channel_name === "string" ? args.metadata.slack_channel_name : null;
   const slackChannelId = typeof args.metadata?.channel === "string" ? args.metadata.channel : args.threadId.split("-")[0];
@@ -57963,6 +58775,7 @@ var GatewayService = class _GatewayService {
   threadMapRepo;
   outboundRepo;
   branchRepo;
+  sessionRepo;
   usersRepo;
   mcpServerRepo;
   userTokenRepo;
@@ -58005,6 +58818,7 @@ var GatewayService = class _GatewayService {
     this.threadMapRepo = new ThreadSessionMapRepository2(db);
     this.outboundRepo = new GatewayOutboundMessageRepository(db);
     this.branchRepo = new BranchRepository13(db);
+    this.sessionRepo = new SessionRepository9(db);
     this.usersRepo = new UsersRepository9(db);
     this.mcpServerRepo = new MCPServerRepository3(db);
     this.userTokenRepo = new UserMCPOAuthTokenRepository3(db);
@@ -58500,8 +59314,26 @@ ${chunk}` : chunk;
       console.warn("[gateway] Failed to mirror message stream to Slack:", error51);
     }
   }
+  /**
+   * Session-context emits are hard-bound to the session's branch, with no
+   * admin-role bypass — agent sessions run as admin users, so a role bypass
+   * would let any session impersonate another assistant's channel. The error
+   * deliberately never echoes the channel's target branch, so a denied emit
+   * cannot be used to enumerate which branch a foreign channel serves.
+   */
+  async ensureSessionBranchBoundToChannel(channel, sessionId) {
+    const session = await this.sessionRepo.findById(sessionId);
+    if (!session) {
+      throw new Error("Gateway outbound denied: emitting session not found");
+    }
+    if (session.branch_id !== channel.target_branch_id) {
+      throw new Error(
+        `Gateway outbound denied: session ${shortId23(sessionId)} runs on branch ${shortId23(session.branch_id)}, but this channel targets a different branch. Sessions can emit only through gateway channels whose target branch matches their own. Call agor_gateway_outbound_targets_list to see usable channels.`
+      );
+    }
+  }
   async ensureCanEmitFromChannel(channel, userId, userRole) {
-    if (hasMinimumRole15(userRole, ROLES20.ADMIN)) return;
+    if (hasMinimumRole17(userRole, ROLES22.ADMIN)) return;
     const branch = await this.branchRepo.findById(channel.target_branch_id);
     if (!branch) {
       throw new Error(`Branch not found for gateway channel ${shortId23(channel.id)}`);
@@ -58533,6 +59365,9 @@ ${chunk}` : chunk;
     if (config2.outbound_enabled !== true) {
       throw new Error("Gateway outbound is disabled for this channel");
     }
+    if (data.emittedBySessionId) {
+      await this.ensureSessionBranchBoundToChannel(channel, data.emittedBySessionId);
+    }
     await this.ensureCanEmitFromChannel(channel, data.emittedByUserId, data.userRole);
     const target = data.target ?? (typeof config2.default_outbound_target === "string" ? config2.default_outbound_target : void 0);
     if (!target) throw new Error("No usable default outbound target configured");
@@ -59107,6 +59942,9 @@ ${chunk}` : chunk;
           promptText = contextPrefix + promptText;
         }
       }
+      if (channel.channel_type === "slack") {
+        promptText = prependSlackGatewayReplyNote(promptText);
+      }
       if (created && mcpAuthWarning) {
         promptText = `${mcpAuthWarning}
 
@@ -59414,7 +60252,7 @@ ${promptText}`;
     if (!tenantId) {
       throw new Error(`Missing tenant context for gateway listener channel ${channel.id}`);
     }
-    await runWithTenantDatabaseScope5(this.db, tenantId, async () => {
+    await runWithTenantDatabaseScope7(this.db, tenantId, async () => {
       await this.create({
         channel_key: channel.channel_key,
         thread_id: msg.threadId,
@@ -59470,11 +60308,11 @@ function createGatewayChannelsService(db) {
 import { GatewayChannelRepository as GatewayChannelRepository5 } from "@agor/core/db";
 import { NotFound as NotFound6 } from "@agor/core/feathers";
 import { getConnector as getConnector3 } from "@agor/core/gateway";
-import { GATEWAY_REDACTED_SENTINEL as GATEWAY_REDACTED_SENTINEL3, GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS3 } from "@agor/core/types";
+import { GATEWAY_REDACTED_SENTINEL as GATEWAY_REDACTED_SENTINEL3, GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS4 } from "@agor/core/types";
 function resolveEffectiveConfig(stored, overrides) {
   const resolved = { ...stored };
   if (!overrides) return resolved;
-  const sensitive = new Set(GATEWAY_SENSITIVE_CONFIG_FIELDS3);
+  const sensitive = new Set(GATEWAY_SENSITIVE_CONFIG_FIELDS4);
   for (const [key, value] of Object.entries(overrides)) {
     if (value === void 0 || value === null) continue;
     if (value === GATEWAY_REDACTED_SENTINEL3) continue;
@@ -59532,7 +60370,7 @@ function createGatewayChannelsTestService(db) {
 
 // src/services/github-app-setup.ts
 import { shortId as shortId24 } from "@agor/core/db";
-import { hasMinimumRole as hasMinimumRole16, ROLES as ROLES21 } from "@agor/core/types";
+import { hasMinimumRole as hasMinimumRole18, ROLES as ROLES23 } from "@agor/core/types";
 
 // src/utils/html.ts
 function escapeHtml(value) {
@@ -59638,7 +60476,7 @@ function handleIssueState(app) {
       res.status(401).json({ error: "Authentication required to initiate GitHub App install" });
       return;
     }
-    if (!hasMinimumRole16(authed.role, ROLES21.ADMIN)) {
+    if (!hasMinimumRole18(authed.role, ROLES23.ADMIN)) {
       res.status(403).json({ error: "Admin role required to initiate GitHub App install" });
       return;
     }
@@ -59850,7 +60688,7 @@ function registerGitHubAppSetupRoutes(app, opts) {
 // src/services/knowledge-document-edits.ts
 init_knowledge_access();
 import { KnowledgeDocumentVersionRepository, KnowledgeNamespaceRepository as KnowledgeNamespaceRepository4 } from "@agor/core/db";
-import { BadRequest as BadRequest12, Forbidden as Forbidden18, NotFound as NotFound7 } from "@agor/core/feathers";
+import { BadRequest as BadRequest12, Forbidden as Forbidden19, NotFound as NotFound7 } from "@agor/core/feathers";
 import { applyKnowledgeEditOps, KnowledgeEditError } from "@agor/core/knowledge";
 import { createTwoFilesPatch as createTwoFilesPatch2, structuredPatch } from "diff";
 function versionToToken(version2) {
@@ -59880,7 +60718,7 @@ var KnowledgeDocumentEditsService = class {
   }
   async ensureCanEdit(document, user) {
     if (await canWriteKnowledgeDocument(this.namespaceRepo, document, user)) return;
-    throw new Forbidden18("You do not have permission to edit this knowledge document");
+    throw new Forbidden19("You do not have permission to edit this knowledge document");
   }
   async create(data, params) {
     if (!data || !Array.isArray(data.ops) || data.ops.length === 0) {
@@ -60007,7 +60845,7 @@ import {
   KnowledgeGraphRepository,
   KnowledgeNamespaceRepository as KnowledgeNamespaceRepository5
 } from "@agor/core/db";
-import { BadRequest as BadRequest13, Forbidden as Forbidden19, NotFound as NotFound8 } from "@agor/core/feathers";
+import { BadRequest as BadRequest13, Forbidden as Forbidden20, NotFound as NotFound8 } from "@agor/core/feathers";
 import {
   buildKnowledgeDocumentUri as buildKnowledgeDocumentUri2,
   extractKnowledgeLinks,
@@ -60637,7 +61475,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     const statusChanged = data.status !== void 0 && data.status !== existing.status;
     if (!visibilityChanged && !editPolicyChanged && !statusChanged) return;
     if (!this.canManageDocument(existing, user)) {
-      throw new Forbidden19(
+      throw new Forbidden20(
         "Only the owner or an admin can change knowledge document visibility, lifecycle status, or edit policy"
       );
     }
@@ -60663,7 +61501,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
       user
     );
     if (!hasKnowledgeNamespacePermission(permission, "write")) {
-      throw new Forbidden19("You do not have permission to write to this knowledge namespace");
+      throw new Forbidden20("You do not have permission to write to this knowledge namespace");
     }
   }
   prepareWriteData(data, existing) {
@@ -60851,7 +61689,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     if (!doc) throw new NotFound8(`Knowledge document not found: ${id}`);
     await this.assertActiveDocument(doc);
     if (!await this.canRead(doc, params?.user)) {
-      throw new Forbidden19("You do not have permission to view this knowledge document");
+      throw new Forbidden20("You do not have permission to view this knowledge document");
     }
     return this.hydrateDocument(doc, params?.query);
   }
@@ -60860,7 +61698,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     if (!doc) throw new NotFound8("Knowledge document not found");
     await this.assertActiveDocument(doc);
     if (!await this.canRead(doc, params?.user)) {
-      throw new Forbidden19("You do not have permission to view this knowledge document");
+      throw new Forbidden20("You do not have permission to view this knowledge document");
     }
     return this.hydrateDocument(doc, data);
   }
@@ -60879,7 +61717,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
       await this.assertActiveDocument(existing);
       this.assertCanChangeGovernance(existing, data, params?.user);
       if (!await this.canEdit(existing, params?.user)) {
-        throw new Forbidden19("You do not have permission to update this knowledge document");
+        throw new Forbidden20("You do not have permission to update this knowledge document");
       }
       await this.assertExpectedVersion(existing, data.expected_version);
       const result2 = await this.repo.update(
@@ -60979,7 +61817,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     await this.assertActiveDocument(existing);
     this.assertCanChangeGovernance(existing, data, params?.user);
     if (!await this.canEdit(existing, params?.user)) {
-      throw new Forbidden19("You do not have permission to update this knowledge document");
+      throw new Forbidden20("You do not have permission to update this knowledge document");
     }
     const result = await this.repo.update(String(id), {
       ...this.prepareWriteData(data, existing),
@@ -61004,7 +61842,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     await this.assertActiveDocument(existing);
     this.assertCanChangeGovernance(existing, data, params?.user);
     if (!await this.canEdit(existing, params?.user)) {
-      throw new Forbidden19("You do not have permission to update this knowledge document");
+      throw new Forbidden20("You do not have permission to update this knowledge document");
     }
     const result = await this.repo.update(String(id), {
       ...this.prepareWriteData(data, existing),
@@ -61030,7 +61868,7 @@ var KnowledgeDocumentsService = class extends DrizzleService {
     await this.assertActiveDocument(existing);
     await this.assertCanWriteNamespace(existing.namespace_id, params?.user);
     if (!this.canManageDocument(existing, params?.user)) {
-      throw new Forbidden19("You do not have permission to delete this knowledge document");
+      throw new Forbidden20("You do not have permission to delete this knowledge document");
     }
     await this.repo.delete(String(id));
     this.emit?.("removed", existing, params);
@@ -61048,7 +61886,7 @@ import {
   KnowledgeGraphRepository as KnowledgeGraphRepository2,
   KnowledgeNamespaceRepository as KnowledgeNamespaceRepository6
 } from "@agor/core/db";
-import { Forbidden as Forbidden20, NotFound as NotFound9 } from "@agor/core/feathers";
+import { Forbidden as Forbidden21, NotFound as NotFound9 } from "@agor/core/feathers";
 import {
   KNOWLEDGE_DOCUMENT_URI_PREFIX as KNOWLEDGE_DOCUMENT_URI_PREFIX2,
   KNOWLEDGE_UNIT_URI_PREFIX,
@@ -61195,7 +62033,7 @@ var KnowledgeGraphService = class {
     }
     if (!document) return;
     if (!await this.canWrite(document, user)) {
-      throw new Forbidden20("You do not have permission to link this knowledge document");
+      throw new Forbidden21("You do not have permission to link this knowledge document");
     }
   }
   async documentForNode(node) {
@@ -61337,7 +62175,7 @@ import {
   GroupRepository as GroupRepository2,
   KnowledgeNamespaceRepository as KnowledgeNamespaceRepository7
 } from "@agor/core/db";
-import { BadRequest as BadRequest14, Forbidden as Forbidden21, NotFound as NotFound10 } from "@agor/core/feathers";
+import { BadRequest as BadRequest14, Forbidden as Forbidden22, NotFound as NotFound10 } from "@agor/core/feathers";
 var KnowledgeNamespacesService = class extends DrizzleService {
   repo;
   groups;
@@ -61398,13 +62236,13 @@ var KnowledgeNamespacesService = class extends DrizzleService {
   async assertCanReadNamespace(namespace, params) {
     const permission = await this.namespacePermission(namespace, params);
     if (permission === "none") {
-      throw new Forbidden21("You do not have permission to view this knowledge namespace");
+      throw new Forbidden22("You do not have permission to view this knowledge namespace");
     }
   }
   async assertCanManage(namespace, params) {
     const permission = await this.namespacePermission(namespace, params);
     if (permission !== "own") {
-      throw new Forbidden21("You do not have permission to manage this knowledge namespace");
+      throw new Forbidden22("You do not have permission to manage this knowledge namespace");
     }
   }
   attributionUserId(params, requestedUserId) {
@@ -62230,7 +63068,7 @@ import {
   KnowledgeDocumentVersionRepository as KnowledgeDocumentVersionRepository3,
   KnowledgeNamespaceRepository as KnowledgeNamespaceRepository9
 } from "@agor/core/db";
-import { BadRequest as BadRequest17, Forbidden as Forbidden22 } from "@agor/core/feathers";
+import { BadRequest as BadRequest17, Forbidden as Forbidden23 } from "@agor/core/feathers";
 import {
   parseKnowledgeUri as parseKnowledgeUri4
 } from "@agor/core/types";
@@ -62274,7 +63112,7 @@ var KnowledgeVersionsService = class extends DrizzleService {
     const namespace = await this.namespaces.findById(document.namespace_id);
     if (!namespace || namespace.archived) return [];
     if (!await this.canRead(document, params?.user)) {
-      throw new Forbidden22("You do not have permission to view this knowledge document history");
+      throw new Forbidden23("You do not have permission to view this knowledge document history");
     }
     const versions = await this.versions.findAll({
       document_id: documentId
@@ -62963,7 +63801,7 @@ import {
   shortId as shortId26
 } from "@agor/core/db";
 import { autoAssignBranchUniqueId } from "@agor/core/environment/variable-resolver";
-import { BadRequest as BadRequest19, Forbidden as Forbidden23, NotAuthenticated as NotAuthenticated20 } from "@agor/core/feathers";
+import { BadRequest as BadRequest19, Forbidden as Forbidden24, NotAuthenticated as NotAuthenticated20 } from "@agor/core/feathers";
 import {
   assertRemoteRefVisibleForClone,
   getDefaultBranch,
@@ -63183,7 +64021,7 @@ var ReposService = class extends DrizzleService {
       }
       const isService = !!caller._isServiceAccount;
       if (!isService) {
-        throw new Forbidden23("Only the executor service account may initialize Unix groups");
+        throw new Forbidden24("Only the executor service account may initialize Unix groups");
       }
     }
     const { initializeRepoUnixGroup: initializeRepoUnixGroup2 } = await Promise.resolve().then(() => (init_unix_group_init(), unix_group_init_exports));
@@ -63857,6 +64695,50 @@ function createSessionMCPServersService(db) {
   return new SessionMCPServersService(db);
 }
 
+// src/services/session-streams.ts
+import { BadRequest as BadRequest20 } from "@agor/core/feathers";
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isCanonicalSessionId(id) {
+  return UUID_RE.test(id);
+}
+function createSessionStreamsService(app) {
+  const resolveAccessibleSessionId = async (sessionId, params) => {
+    const session = await app.service("sessions").get(sessionId, { ...params ?? {}, query: {} });
+    return session?.session_id ?? null;
+  };
+  return {
+    async create(data, params) {
+      const connection = params?.connection;
+      if (!connection) {
+        throw new BadRequest20("session stream subscription requires a realtime connection");
+      }
+      const sessionId = data?.session_id ?? data?.sessionId;
+      if (!sessionId || typeof sessionId !== "string") {
+        throw new BadRequest20("session_id is required");
+      }
+      const canonicalId = await resolveAccessibleSessionId(sessionId, params) ?? sessionId;
+      joinSessionStreamChannel(app, canonicalId, connection);
+      return { session_id: canonicalId, subscribed: true };
+    },
+    async remove(id, params) {
+      const connection = params?.connection;
+      const sessionId = typeof id === "string" ? id : "";
+      if (!connection || !sessionId) {
+        return { session_id: sessionId, subscribed: false };
+      }
+      let canonicalId = sessionId;
+      if (!isCanonicalSessionId(sessionId)) {
+        try {
+          canonicalId = await resolveAccessibleSessionId(sessionId, params) ?? sessionId;
+        } catch {
+        }
+      }
+      leaveSessionStreamChannel(app, canonicalId, connection);
+      return { session_id: canonicalId, subscribed: false };
+    }
+  };
+}
+
 // src/services/tasks.ts
 init_drizzle();
 init_append_system_message();
@@ -64761,14 +65643,14 @@ function createTasksService(db, app) {
 }
 
 // src/services/templates.ts
-import { BadRequest as BadRequest20 } from "@agor/core/feathers";
+import { BadRequest as BadRequest21 } from "@agor/core/feathers";
 import { renderTemplate as renderTemplate2 } from "@agor/core/templates/handlebars-helpers";
-import { ROLES as ROLES22 } from "@agor/core/types";
+import { ROLES as ROLES24 } from "@agor/core/types";
 var TemplatesService = class {
   async create(data, params) {
-    ensureMinimumRole(params, ROLES22.MEMBER, "render templates");
+    ensureMinimumRole(params, ROLES24.MEMBER, "render templates");
     if (typeof data?.template !== "string") {
-      throw new BadRequest20("template (string) is required");
+      throw new BadRequest21("template (string) is required");
     }
     const context = data.context && typeof data.context === "object" ? data.context : {};
     const rendered = renderTemplate2(data.template, context, { onError: data.onError ?? "empty" });
@@ -64796,11 +65678,11 @@ import {
 } from "@agor/core/config";
 import {
   BranchRepository as BranchRepository15,
-  SessionRepository as SessionRepository9,
+  SessionRepository as SessionRepository10,
   shortId as shortId29,
   UsersRepository as UsersRepository10
 } from "@agor/core/db";
-import { Forbidden as Forbidden24 } from "@agor/core/feathers";
+import { Forbidden as Forbidden25 } from "@agor/core/feathers";
 import {
   getBranchSymlinkPath,
   resolveUnixUserForImpersonation as resolveUnixUserForImpersonation3,
@@ -64904,12 +65786,12 @@ var TerminalsService = class {
       if (rbacEnabled) {
         const userId = params?.user?.user_id;
         if (!userId) {
-          throw new Forbidden24("Authentication required to open terminals");
+          throw new Forbidden25("Authentication required to open terminals");
         }
         const branchRepo = new BranchRepository15(this.db);
         const branch = await branchRepo.findById(data.branchId);
         if (!branch) {
-          throw new Forbidden24(`Branch not found: ${data.branchId}`);
+          throw new Forbidden25(`Branch not found: ${data.branchId}`);
         }
         const isOwner = await branchRepo.isOwner(branch.branch_id, userId);
         const effectivePermission = await branchRepo.resolveUserPermission(branch, userId);
@@ -64924,7 +65806,7 @@ var TerminalsService = class {
           allowSuperadmin,
           effectivePermission
         )) {
-          throw new Forbidden24(
+          throw new Forbidden25(
             `You need 'session' permission on branch ${branch.name} to open a terminal there.`
           );
         }
@@ -65025,11 +65907,11 @@ var TerminalsService = class {
   async resolveEnsureCliTab(sessionId, claimedBranchId, params) {
     if (!sessionId) return null;
     try {
-      const sessionRepo = new SessionRepository9(this.db);
+      const sessionRepo = new SessionRepository10(this.db);
       const session = await sessionRepo.findById(sessionId).catch(() => null);
       if (session?.agentic_tool !== "claude-code-cli") return null;
       if (claimedBranchId && claimedBranchId !== session.branch_id) {
-        throw new Forbidden24(
+        throw new Forbidden25(
           `ensureCliSessionId session belongs to a different branch than the one provided.`
         );
       }
@@ -65039,12 +65921,12 @@ var TerminalsService = class {
         if (rbacEnabled) {
           const callerUserId = params?.user?.user_id;
           if (!callerUserId) {
-            throw new Forbidden24("Authentication required to ensure a CLI tab");
+            throw new Forbidden25("Authentication required to ensure a CLI tab");
           }
           const branchRepo2 = new BranchRepository15(this.db);
           const wt = await branchRepo2.findById(session.branch_id);
           if (!wt) {
-            throw new Forbidden24(`Session's branch not found: ${session.branch_id}`);
+            throw new Forbidden25(`Session's branch not found: ${session.branch_id}`);
           }
           const isOwner = await branchRepo2.isOwner(wt.branch_id, callerUserId);
           const effectivePermission = await branchRepo2.resolveUserPermission(wt, callerUserId);
@@ -65059,7 +65941,7 @@ var TerminalsService = class {
             allowSuperadmin,
             effectivePermission
           )) {
-            throw new Forbidden24(
+            throw new Forbidden25(
               `You need 'session' permission on the session's branch to ensure its CLI tab.`
             );
           }
@@ -65070,7 +65952,7 @@ var TerminalsService = class {
         callerRole: params.user?.role,
         sessionCreatedBy: session.created_by
       })) {
-        throw new Forbidden24("You can only ensure CLI tabs for Claude CLI sessions you created.");
+        throw new Forbidden25("You can only ensure CLI tabs for Claude CLI sessions you created.");
       }
       const branchRepo = new BranchRepository15(this.db);
       const branch = await branchRepo.findById(session.branch_id);
@@ -65089,7 +65971,7 @@ var TerminalsService = class {
         sessionId: session.session_id
       };
     } catch (err) {
-      if (err instanceof Forbidden24) throw err;
+      if (err instanceof Forbidden25) throw err;
       console.warn("[TerminalsService] resolveEnsureCliTab failed", err);
       return null;
     }
@@ -65403,7 +66285,7 @@ init_users();
 init_runtime_tokens();
 import { resolveTenantContext as resolveTenantContext5 } from "@agor/core/config";
 import { shortId as shortId30 } from "@agor/core/db";
-import jwt10 from "jsonwebtoken";
+import jwt11 from "jsonwebtoken";
 function socketAuthState(userId, isService, tenant) {
   return tenant ? { userId, isService, tenant } : { userId, isService };
 }
@@ -65494,7 +66376,7 @@ function createSocketIOConfig(app, options) {
           console.log(`\u{1F513} WebSocket connection without auth (for login flow): ${socket.id}`);
           return next();
         }
-        const decoded = jwt10.verify(token, jwtSecret, {
+        const decoded = jwt11.verify(token, jwtSecret, {
           issuer: RUNTIME_JWT_ISSUER,
           audience: RUNTIME_JWT_AUDIENCE
         });
@@ -65849,6 +66731,7 @@ function configureChannels(app, options = {}) {
           app.channel(tenantUserChannelName(tenant.tenant_id, userId)).leave(context.connection);
         }
       }
+      leaveAllSessionStreamChannels(app, context.connection);
     }
   });
 }
@@ -66073,6 +66956,13 @@ async function registerServices(ctx) {
   sessionsService.setExecuteHandler(
     createExecuteHandler(ctx, sessionsService, sessionTokenService)
   );
+  app.use("/session-streams", createSessionStreamsService(app), {
+    methods: ["create", "remove"]
+  });
+  app.service("/session-streams").hooks({
+    before: { all: [ctx.requireAuth] }
+  });
+  app.service("/session-streams").publish(() => []);
   app.use("/tasks", createTasksService(db, app), {
     // Custom events not in this list are dropped at the FeathersJS transport
     // boundary — they fire on the local EventEmitter but never reach socket
@@ -66275,7 +67165,7 @@ async function registerServices(ctx) {
     app.use("/gateway-channels/test", createGatewayChannelsTestService(db));
     app.service("gateway-channels/test").hooks({
       before: {
-        create: [ctx.requireAuth, requireMinimumRole(ROLES23.ADMIN, "test gateway channels")]
+        create: [ctx.requireAuth, requireMinimumRole(ROLES25.ADMIN, "test gateway channels")]
       }
     });
     app.use("/thread-session-map", createThreadSessionMapService(db));
@@ -66313,9 +67203,9 @@ async function registerServices(ctx) {
   app.use("/cursor-models", createCursorModelsService(db));
   app.service("/cursor-models").hooks({ before: { find: [ctx.requireAuth] } });
   const branchRepository = new BranchRepository16(db);
-  const { UsersRepository: UsersRepository11, SessionRepository: SessionRepository11 } = await import("@agor/core/db");
+  const { UsersRepository: UsersRepository11, SessionRepository: SessionRepository12 } = await import("@agor/core/db");
   const usersRepository = new UsersRepository11(db);
-  const sessionsRepository = new SessionRepository11(db);
+  const sessionsRepository = new SessionRepository12(db);
   if (svcEnabled("file_browser")) {
     app.use("/context", createContextService(branchRepository));
     app.use("/file", createFileService(branchRepository));
@@ -66792,6 +67682,7 @@ async function registerMCPServices(ctx, sessionsService) {
       mcpServerId: opts.mcpServerId,
       userId: opts.userId,
       oauthMode: opts.oauthMode,
+      tenantId: opts.tenantId ?? getCurrentTenantId7(),
       socketId: opts.socketId,
       createdAt: Date.now(),
       tokenResolve,
@@ -66815,6 +67706,31 @@ async function registerMCPServices(ctx, sessionsService) {
     }
     return base;
   }
+  const tenantIdFromParams = (params) => params?.tenant?.tenant_id ?? getCurrentTenantId7();
+  const persistOAuthTokenForPendingFlow = async (tokenResponse, pendingFlow, logPrefix) => {
+    const work = () => persistOAuthToken(
+      db,
+      tokenResponse,
+      pendingFlow.mcpUrl,
+      {
+        ...pendingFlow,
+        clientId: pendingFlow.context.clientId,
+        clientSecret: pendingFlow.context.clientSecret,
+        tokenEndpoint: pendingFlow.context.tokenEndpoint
+      },
+      logPrefix
+    );
+    if (pendingFlow.tenantId) {
+      await runInOAuthTenantScope(db, pendingFlow.tenantId, work);
+      return;
+    }
+    if (isPostgresDatabase8(db) && pendingFlow.mcpServerId) {
+      throw new Error(
+        "Missing tenant context for MCP OAuth callback. Please restart the OAuth flow."
+      );
+    }
+    await work();
+  };
   const oauthCallbackHandler = async (req, res) => {
     res.setHeader("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'");
     res.setHeader("X-Content-Type-Options", "nosniff");
@@ -66857,18 +67773,7 @@ async function registerMCPServices(ctx, sessionsService) {
         const { completeMCPOAuthFlow } = await import("@agor/core/tools/mcp/oauth-mcp-transport");
         const tokenResponse = await completeMCPOAuthFlow(pendingFlow.context, code, state);
         pendingOAuthFlows.delete(state);
-        await persistOAuthToken(
-          db,
-          tokenResponse,
-          pendingFlow.mcpUrl,
-          {
-            ...pendingFlow,
-            clientId: pendingFlow.context.clientId,
-            clientSecret: pendingFlow.context.clientSecret,
-            tokenEndpoint: pendingFlow.context.tokenEndpoint
-          },
-          "OAuth Callback"
-        );
+        await persistOAuthTokenForPendingFlow(tokenResponse, pendingFlow, "OAuth Callback");
         if (app.io) {
           const oauthEvent = {
             state,
@@ -66997,6 +67902,7 @@ async function registerMCPServices(ctx, sessionsService) {
                   // call (writes to the shared MCP server row, not per-user).
                   oauthMode: "shared",
                   clientId: data.client_id,
+                  tenantId: tenantIdFromParams(params),
                   socketId: connection?.id
                 });
               } catch (err) {
@@ -67199,6 +68105,7 @@ async function registerMCPServices(ctx, sessionsService) {
       try {
         console.log("[OAuth Start] Starting two-phase OAuth flow for:", data.mcp_url);
         const userId = params?.user?.user_id;
+        const tenantId = tenantIdFromParams(params);
         let oauthMode;
         let authorizationUrlOverride;
         let tokenUrlOverride;
@@ -67206,8 +68113,10 @@ async function registerMCPServices(ctx, sessionsService) {
         let clientIdFromConfig;
         let scopeOverride;
         if (data.mcp_server_id) {
-          const mcpServerRepo = new MCPServerRepository5(db);
-          const server = await mcpServerRepo.findById(data.mcp_server_id);
+          const server = await runInOAuthTenantScope(db, tenantId, () => {
+            const mcpServerRepo = new MCPServerRepository5(db);
+            return mcpServerRepo.findById(data.mcp_server_id);
+          });
           if (server?.auth?.type === "oauth") {
             oauthMode = server.auth.oauth_mode || "per_user";
             authorizationUrlOverride = server.auth.oauth_authorization_url;
@@ -67255,6 +68164,7 @@ async function registerMCPServices(ctx, sessionsService) {
             authorizationUrlOverride,
             tokenUrlOverride,
             scope: scopeOverride,
+            tenantId,
             socketId
           });
         } catch (err) {
@@ -67299,18 +68209,13 @@ async function registerMCPServices(ctx, sessionsService) {
           };
         const tokenResponse = await completeMCPOAuthFlow(pendingFlow.context, code, state);
         pendingOAuthFlows.delete(state);
-        await persistOAuthToken(
-          db,
-          tokenResponse,
-          pendingFlow.mcpUrl,
-          {
-            ...pendingFlow,
-            clientId: pendingFlow.context.clientId,
-            clientSecret: pendingFlow.context.clientSecret,
-            tokenEndpoint: pendingFlow.context.tokenEndpoint
-          },
-          "OAuth Complete"
-        );
+        const activeTenantId = getCurrentTenantId7();
+        if (pendingFlow.tenantId && activeTenantId && pendingFlow.tenantId !== activeTenantId) {
+          throw new Error(
+            "OAuth flow belongs to a different tenant. Please restart the OAuth flow."
+          );
+        }
+        await persistOAuthTokenForPendingFlow(tokenResponse, pendingFlow, "OAuth Complete");
         return { success: true, message: "OAuth authentication successful!", tokenObtained: true };
       } catch (error51) {
         console.error("[OAuth Complete] Error:", error51);
@@ -67367,17 +68272,35 @@ async function registerMCPServices(ctx, sessionsService) {
       }
       const sessionId = params?.session_id;
       const trustedInternalOrService = shouldExposeMCPServerSecrets(params);
-      const trustedSessionExecutor = shouldExposeMCPServerSecretsForSessionToken(params, {
+      let trustedSessionExecutor = shouldExposeMCPServerSecretsForSessionToken(params, {
         sessionId
       });
+      let executorSessionId = sessionId;
+      if (!trustedSessionExecutor && params?.provider && data.executorSessionToken) {
+        const executorTokenService = app.sessionTokenService;
+        const sessionInfo = await executorTokenService?.validateToken(
+          data.executorSessionToken,
+          {}
+        );
+        if (sessionInfo?.session_id) {
+          executorSessionId = sessionInfo.session_id;
+          trustedSessionExecutor = true;
+        }
+      }
       if (!trustedInternalOrService && !trustedSessionExecutor) {
-        throw new Forbidden25("oauth-auth-headers is only available to trusted executor paths");
+        throw new Forbidden26("oauth-auth-headers is only available to trusted executor paths");
       }
       const userTokenRepo = new UserMCPOAuthTokenRepository4(db);
       const mcpServerRepo = new MCPServerRepository5(db);
       if (trustedSessionExecutor) {
+        if (!executorSessionId) {
+          throw new Forbidden26("oauth-auth-headers requires executor session scope");
+        }
         const sessionMcpRepo = new SessionMCPServerRepository5(db);
-        const attachedServers = await sessionMcpRepo.listServers(sessionId, true);
+        const attachedServers = await sessionMcpRepo.listServers(
+          executorSessionId,
+          true
+        );
         const globalServers = await mcpServerRepo.findAll({ scope: "global", enabled: true });
         const allowedServerIds = /* @__PURE__ */ new Set([
           ...globalServers.map((server) => server.mcp_server_id),
@@ -67517,7 +68440,7 @@ async function registerMCPServices(ctx, sessionsService) {
         const { restoreRedactedMCPAuthSecrets } = await import("@agor/core/tools/mcp/auth-secrets");
         const { resolveMCPAuthHeaders } = await import("@agor/core/tools/mcp/jwt-auth");
         const { mergeMCPRemoteHeaders, restoreRedactedMCPCustomHeaders } = await import("@agor/core/tools/mcp/http-headers");
-        const { hasMinimumRole: hasMinimumRole17, ROLES: ROLES24 } = await import("@agor/core/types");
+        const { hasMinimumRole: hasMinimumRole19, ROLES: ROLES26 } = await import("@agor/core/types");
         const mcpServerRepo = new MCPServerRepository5(db);
         const validateUrl = (url2) => {
           try {
@@ -67552,7 +68475,7 @@ async function registerMCPServices(ctx, sessionsService) {
             if (params?.provider && params.user) {
               const userId2 = params.user.user_id;
               const userRole = params.user.role?.toLowerCase();
-              const isAdmin4 = hasMinimumRole17(userRole, ROLES24.ADMIN);
+              const isAdmin4 = hasMinimumRole19(userRole, ROLES26.ADMIN);
               const isOwner = server.owner_user_id === userId2;
               if (server.scope === "global" && !isOwner && !isAdmin4)
                 return {
@@ -67581,7 +68504,7 @@ async function registerMCPServices(ctx, sessionsService) {
           if (params?.provider && params.user) {
             const userId2 = params.user.user_id;
             const userRole = params.user.role?.toLowerCase();
-            const isAdmin4 = hasMinimumRole17(userRole, ROLES24.ADMIN);
+            const isAdmin4 = hasMinimumRole19(userRole, ROLES26.ADMIN);
             const isOwner = server.owner_user_id === userId2;
             if (server.scope === "global" && !isOwner && !isAdmin4)
               return {
@@ -67674,6 +68597,7 @@ async function registerMCPServices(ctx, sessionsService) {
               // call). Without a serverId nothing is persisted to the DB; the
               // daemon-level cache below carries the token for this request.
               oauthMode: "shared",
+              tenantId: tenantIdFromParams(params),
               socketId: connection?.id
             });
             const tokenResponse = await started.awaitToken();
@@ -67848,7 +68772,7 @@ async function registerMCPServices(ctx, sessionsService) {
   return { oauthCallbackHandler };
 }
 async function bootstrapSuperadminUsers(config2, usersService, allowSuperadmin) {
-  const { ROLES: ROLES24 } = await import("@agor/core/types");
+  const { ROLES: ROLES26 } = await import("@agor/core/types");
   const bootstrapUsers = config2.execution?.bootstrap_superadmin_users ?? [];
   if (bootstrapUsers.length === 0) return;
   if (!allowSuperadmin) {
@@ -67863,8 +68787,8 @@ async function bootstrapSuperadminUsers(config2, usersService, allowSuperadmin)
     if (!userId) continue;
     try {
       const user = await usersService.get(userId);
-      if (user.role === ROLES24.SUPERADMIN) continue;
-      await usersService.patch(userId, { role: ROLES24.SUPERADMIN });
+      if (user.role === ROLES26.SUPERADMIN) continue;
+      await usersService.patch(userId, { role: ROLES26.SUPERADMIN });
       promotedCount++;
       console.log(
         `[RBAC] Bootstrap promoted user ${shortId32(userId)} (${user.email}) to superadmin`
@@ -68091,7 +69015,7 @@ import {
   createTenantScopedDatabaseProxy,
   formatPendingMigrationsMessage,
   runWithSystemDatabaseScope as runWithSystemDatabaseScope2,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope6,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope8,
   seedInitialData
 } from "@agor/core/db";
 import { extractDbFilePath } from "@agor/core/utils/path";
@@ -68348,7 +69272,7 @@ async function initializeDatabase(dbPath, options = {}) {
     }
   };
   if (options.tenantId) {
-    await runWithTenantDatabaseScope6(scopedDb, options.tenantId, runInitialDataSetup);
+    await runWithTenantDatabaseScope8(scopedDb, options.tenantId, runInitialDataSetup);
   } else {
     await runWithSystemDatabaseScope2(scopedDb, "database initialization", runInitialDataSetup);
   }
@@ -68484,15 +69408,15 @@ import path17 from "path";
 import {
   getAgorHome as getAgorHome2,
   resolveExecutorHeartbeatConfig as resolveExecutorHeartbeatConfig3,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig6
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig7
 } from "@agor/core/config";
 import {
   MessagesRepository as MessagesRepository3,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope9,
-  SessionRepository as SessionRepository10,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope11,
+  SessionRepository as SessionRepository11,
   shortId as shortId37
 } from "@agor/core/db";
-import { SessionStatus as SessionStatus10, TaskStatus as TaskStatus8 } from "@agor/core/types";
+import { isTerminalTaskStatus as isTerminalTaskStatus3, SessionStatus as SessionStatus10, TaskStatus as TaskStatus8 } from "@agor/core/types";
 
 // src/services/executor-heartbeat-supervisor.ts
 import { shortId as shortId33 } from "@agor/core/db";
@@ -68566,8 +69490,9 @@ import { ENVIRONMENT as ENVIRONMENT2 } from "@agor/core/config";
 import {
   BranchRepository as BranchRepository17,
   getHiddenTenantId as getHiddenTenantId2,
+  runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope4,
   runWithSystemDatabaseScope as runWithSystemDatabaseScope3,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope7,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope9,
   shortId as shortId34
 } from "@agor/core/db";
 import { NotFoundError as NotFoundError7 } from "@agor/core/utils/errors";
@@ -68655,15 +69580,17 @@ var HealthMonitor = class {
   startMonitoring(branchId, params = this.branchParams.get(branchId)) {
     this.stopMonitoring(branchId);
     if (params) this.branchParams.set(branchId, params);
-    setTimeout(() => {
-      if (this.isShuttingDown) return;
-      this.checkHealth(branchId);
-      const interval = setInterval(() => {
+    runWithoutTenantDatabaseScope4(() => {
+      setTimeout(() => {
         if (this.isShuttingDown) return;
         this.checkHealth(branchId);
-      }, ENVIRONMENT2.HEALTH_CHECK_INTERVAL_MS);
-      this.intervals.set(branchId, interval);
-    }, ENVIRONMENT2.STARTUP_GRACE_PERIOD_MS);
+        const interval = setInterval(() => {
+          if (this.isShuttingDown) return;
+          this.checkHealth(branchId);
+        }, ENVIRONMENT2.HEALTH_CHECK_INTERVAL_MS);
+        this.intervals.set(branchId, interval);
+      }, ENVIRONMENT2.STARTUP_GRACE_PERIOD_MS);
+    });
   }
   /**
    * Stop monitoring a branch's health
@@ -68776,7 +69703,7 @@ var HealthMonitor = class {
           activeCount += 1;
         };
         if (this.db) {
-          await runWithTenantDatabaseScope7(this.db, ref.tenantId, loadAndStart);
+          await runWithTenantDatabaseScope9(this.db, ref.tenantId, loadAndStart);
         } else {
           await loadAndStart();
         }
@@ -68802,7 +69729,7 @@ var HealthMonitor = class {
     };
     if (this.tenantId) {
       if (!this.db) return findRefs(this.tenantId);
-      return runWithTenantDatabaseScope7(this.db, this.tenantId, () => findRefs(this.tenantId));
+      return runWithTenantDatabaseScope9(this.db, this.tenantId, () => findRefs(this.tenantId));
     }
     if (!this.db) return findRefs();
     return runWithSystemDatabaseScope3(
@@ -68846,11 +69773,11 @@ import {
   generateId as generateId9,
   inArray as inArray3,
   insert as insert3,
-  isPostgresDatabase as isPostgresDatabase8,
+  isPostgresDatabase as isPostgresDatabase9,
   kbDocumentUnits as kbDocumentUnits3,
   kbDocumentVersions as kbDocumentVersions2,
   kbEmbeddingSpaces,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope8,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope10,
   select as select7,
   shortId as shortId35,
   sql as sql7,
@@ -69102,7 +70029,7 @@ var KnowledgeEmbeddingIndexer = class {
   }
   async tick() {
     if (this.options.tenantId) {
-      return runWithTenantDatabaseScope8(this.db, this.options.tenantId, () => this.tickInScope());
+      return runWithTenantDatabaseScope10(this.db, this.options.tenantId, () => this.tickInScope());
     }
     return this.tickInScope();
   }
@@ -69124,7 +70051,7 @@ var KnowledgeEmbeddingIndexer = class {
     const semantic = config2.knowledge?.semantic_search;
     if (semantic?.enabled !== true) return this.idle();
     if (semantic.indexing?.paused === true) return this.idle();
-    if (!isPostgresDatabase8(this.db)) return this.idle();
+    if (!isPostgresDatabase9(this.db)) return this.idle();
     const provider = semantic.provider ?? "openai";
     if (provider !== "openai") return this.idle();
     const apiKey = await this.variables.getPlain(
@@ -69357,7 +70284,7 @@ async function readAndClearSentinel() {
   }
 }
 function startupTenantParams(config2) {
-  const multiTenancy = resolveMultiTenancyConfig6(config2);
+  const multiTenancy = resolveMultiTenancyConfig7(config2);
   return {
     tenant: {
       tenant_id: multiTenancy.static_tenant_id,
@@ -69366,7 +70293,7 @@ function startupTenantParams(config2) {
   };
 }
 async function runStartupTenantDatabaseScope(ctx, work) {
-  return runWithTenantDatabaseScope9(ctx.db, startupTenantParams(ctx.config).tenant.tenant_id, work);
+  return runWithTenantDatabaseScope11(ctx.db, startupTenantParams(ctx.config).tenant.tenant_id, work);
 }
 async function cleanupOrphanStatuses(ctx) {
   return runStartupTenantDatabaseScope(ctx, () => cleanupOrphanStatusesInTenantScope(ctx));
@@ -69459,18 +70386,36 @@ async function cleanupOrphanStatusesInTenantScope(ctx) {
       }
     }
   }
-  const stuckIdleResult = await sessionsService.find({
+  const bootInterruptedTaskIds = /* @__PURE__ */ new Set([
+    ...orphanedTasks.map((t) => t.task_id),
+    ...queuedTasks.map((t) => t.task_id)
+  ]);
+  const idleNotReadyResult = await sessionsService.find({
     query: { status: SessionStatus10.IDLE, ready_for_prompt: false, $limit: 1e3 },
     ...startupParams
   });
-  const stuckIdleSessions = stuckIdleResult.data;
-  if (stuckIdleSessions.length > 0) {
-    for (const session of stuckIdleSessions) {
-      await app.service("sessions").patch(session.session_id, { ready_for_prompt: true }, startupParams);
-      startupDebug(
-        `   \u2713 Unblocked stuck-idle session ${shortId37(session.session_id)} (ready_for_prompt was false)`
-      );
+  const stuckIdleSessions = [];
+  for (const session of idleNotReadyResult.data) {
+    const latestTaskId = session.tasks?.at(-1);
+    if (!latestTaskId) {
+      continue;
     }
+    let wasInterrupted = bootInterruptedTaskIds.has(latestTaskId);
+    if (!wasInterrupted) {
+      try {
+        const latestTask = await tasksService.get(latestTaskId, startupParams);
+        wasInterrupted = !isTerminalTaskStatus3(latestTask.status);
+      } catch {
+      }
+    }
+    if (!wasInterrupted) {
+      continue;
+    }
+    stuckIdleSessions.push(session);
+    await app.service("sessions").patch(session.session_id, { ready_for_prompt: true }, startupParams);
+    startupDebug(
+      `   \u2713 Unblocked stuck-idle session ${shortId37(session.session_id)} (ready_for_prompt was false, latest task interrupted)`
+    );
   }
   const cleanupParts = [
     `${orphanedTasks.length} orphaned task(s) stopped`,
@@ -69522,7 +70467,7 @@ async function injectRestartNoticesInTenantScope(ctx, cleanupResult) {
       lastOrphanedTaskBySession.set(sid, task);
     }
   }
-  const sessionRepo = new SessionRepository10(db);
+  const sessionRepo = new SessionRepository11(db);
   const messageRepo = new MessagesRepository3(db);
   for (const sessionId of affectedSessionIds) {
     try {
@@ -69620,7 +70565,7 @@ async function startup(ctx) {
     terminalsService
   } = ctx;
   const orphanCleanupResult = await cleanupOrphanStatuses(ctx);
-  const startupMultiTenancy = resolveMultiTenancyConfig6(config2);
+  const startupMultiTenancy = resolveMultiTenancyConfig7(config2);
   const healthMonitor = new HealthMonitor(app, {
     defaultParams: startupTenantParams(config2),
     db,
@@ -69670,7 +70615,7 @@ async function startup(ctx) {
   }
   let schedulerService = null;
   if (svcEnabled("scheduler")) {
-    const multiTenancy = resolveMultiTenancyConfig6(config2);
+    const multiTenancy = resolveMultiTenancyConfig7(config2);
     schedulerService = new SchedulerService(db, app, {
       tickInterval: 3e4,
       // 30 seconds
@@ -69806,7 +70751,7 @@ import {
   eq as eq7,
   gte as gte3,
   lt,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope10,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope12,
   select as select8,
   sessions as sessions2,
   tasks as tasks2
@@ -69897,7 +70842,7 @@ async function flushOpenSourceTelemetryUsageSummary(db) {
 }
 function startOpenSourceTelemetryUsageSummaryInterval(db, options) {
   const run = () => {
-    runWithTenantDatabaseScope10(
+    runWithTenantDatabaseScope12(
       db,
       options.tenantId,
       () => flushOpenSourceTelemetryUsageSummary(db)
@@ -69920,9 +70865,11 @@ init_spawn_executor();
 
 // src/widgets/index.ts
 init_env_vars();
+init_gateway_token();
 init_registry();
 function registerAllWidgets() {
   registerEnvVarsWidget();
+  registerGatewayTokenWidget();
 }
 
 // src/index.ts
@@ -69960,7 +70907,7 @@ async function startDaemon(options) {
   process.env.GIT_TERMINAL_PROMPT = "0";
   process.env.GIT_ASKPASS = "echo";
   let config2 = options?.config ? options.config : options?.configPath ? await loadConfigFromFile(options.configPath) : await loadConfig16();
-  const multiTenancy = resolveMultiTenancyConfig7(config2);
+  const multiTenancy = resolveMultiTenancyConfig8(config2);
   console.log(
     `\u{1F3E2} Multi-tenancy: mode=${multiTenancy.mode} tenant=${multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : "auth-resolved"}`
   );
@@ -70027,14 +70974,14 @@ async function startDaemon(options) {
         if (context.method === "patch") {
           const data = context.data;
           if (data?.password) return context;
-          throw new Forbidden26("Password change required. Please update your password.", {
+          throw new Forbidden27("Password change required. Please update your password.", {
             code: "PASSWORD_CHANGE_REQUIRED",
             user_id: freshUser.user_id
           });
         }
       }
     }
-    throw new Forbidden26("Password change required. Please update your password.", {
+    throw new Forbidden27("Password change required. Please update your password.", {
       code: "PASSWORD_CHANGE_REQUIRED",
       user_id: freshUser.user_id
     });
@@ -70381,14 +71328,14 @@ async function startDaemon(options) {
   });
   runPostStartJob("cli-watcher-rehydrate", async () => {
     const { rehydrateCliWatchers: rehydrateCliWatchers2, scanCliWatcherRehydrateSessions: scanCliWatcherRehydrateSessions2 } = await Promise.resolve().then(() => (init_claude_cli_integration(), claude_cli_integration_exports));
-    const cliSessions = await runWithTenantDatabaseScope11(
+    const cliSessions = await runWithTenantDatabaseScope13(
       db,
       multiTenancy.static_tenant_id,
       () => scanCliWatcherRehydrateSessions2(app)
     );
     await rehydrateCliWatchers2(
       app,
-      (branchId) => runWithTenantDatabaseScope11(db, multiTenancy.static_tenant_id, async () => {
+      (branchId) => runWithTenantDatabaseScope13(db, multiTenancy.static_tenant_id, async () => {
         try {
           const branch = await app.service("branches").get(branchId);
           return branch?.path ?? null;