agor-live 0.23.1 → 0.23.2

package/dist/daemon/oauth-auth-helpers.js

@@ -0,0 +1,14 @@
+// src/oauth-auth-helpers.ts
+import { runWithTenantDatabaseScope } from "@agor/core/db";
+async function runInOAuthTenantScope(db, tenantId, work) {
+  if (!tenantId) return work();
+  return runWithTenantDatabaseScope(db, tenantId, work);
+}
+function resolveForUserIdWithGate(opts) {
+  const canUseExplicitUser = opts.isServiceAccount === true || opts.authPayloadType === "executor-session" && opts.queryForUserId === opts.callerUserId;
+  return opts.queryForUserId && canUseExplicitUser ? opts.queryForUserId : opts.callerUserId;
+}
+export {
+  resolveForUserIdWithGate,
+  runInOAuthTenantScope
+};

package/dist/daemon/register-hooks.d.ts

@@ -44,6 +44,7 @@ export declare const PROMPT_FLOW_PATCH_FIELDS: readonly string[];
 export declare function isPromptFlowPatchOnly(data: unknown): boolean;
 export declare function shouldRunSessionPostTurnHooks(session: Pick<Session, 'status' | 'ready_for_prompt'>): boolean;
 export declare function shouldDrainQueueAfterSessionPostTurnPatch(session: Pick<Session, 'status' | 'ready_for_prompt'>, params?: Params): boolean;
+export declare function getTrustedSessionTenantId(session: unknown): string | undefined;
 export declare function enrichSessionFindResultWithRemoteRelationships(result: Paginated<Session> | Session[], sessionsService: Pick<SessionsServiceImpl, 'enrichRemoteRelationships'>): Promise<Paginated<Session> | Session[]>;
 /**
  * Interface for dependencies needed by hook registration.

package/dist/daemon/register-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-hooks.d.ts","sourceRoot":"","sources":["../src/register-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,KAAK,UAAU,EAWhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EAEtB,KAAK,wBAAwB,EAE7B,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAOvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAcvD,OAAO,KAAK,EAMV,WAAW,EAEX,SAAS,EACT,MAAM,EACN,OAAO,EAGR,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAkG3B,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5E;AAwFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAQrD,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB,CAAC,GACpD,OAAO,CAET;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB,CAAC,EACrD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAMT;AAED,wBAAsB,8CAA8C,CAClE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,EACtC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,GACtE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC,CAazC;AAeD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,GAAG,EAAE,WAAW,GAAG;QAAE,EAAE,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,cAAc,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;IAG7C,eAAe,EAAE,mBAAmB,CAAC;IACrC,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,CAAC;CACvC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,UAwCtC,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,IAAI,CAmuF7D"}
+{"version":3,"file":"register-hooks.d.ts","sourceRoot":"","sources":["../src/register-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EACL,KAAK,UAAU,EAWhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,gBAAgB,EAErB,KAAK,iBAAiB,EAEtB,KAAK,wBAAwB,EAE7B,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAOvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAcvD,OAAO,KAAK,EAOV,WAAW,EAEX,SAAS,EACT,MAAM,EACN,OAAO,EAGR,MAAM,kBAAkB,CAAC;AAQ1B,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,mBAAmB,CAAC;AAoG3B,wBAAgB,oCAAoC,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE5E;AAwFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAQrD,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAK5D;AAED,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB,CAAC,GACpD,OAAO,CAET;AAED,wBAAgB,yCAAyC,CACvD,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,GAAG,kBAAkB,CAAC,EACrD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAMT;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED,wBAAsB,8CAA8C,CAClE,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,EACtC,eAAe,EAAE,IAAI,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,GACtE,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,OAAO,EAAE,CAAC,CAazC;AAeD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,GAAG,EAAE,WAAW,GAAG;QAAE,EAAE,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,cAAc,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;IAG7C,eAAe,EAAE,mBAAmB,CAAC;IACrC,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,CAAC;CACvC;AAED;;GAEG;AACH,eAAO,MAAM,0BAA0B,UAiDtC,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,oBAAoB,GAAG,IAAI,CA6xF7D"}

package/dist/daemon/register-hooks.js

@@ -672,7 +672,7 @@ import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
 } from "@agor/core/types";
-import jwt3 from "jsonwebtoken";
+import jwt4 from "jsonwebtoken";
 import { MCP_TOKEN_AUDIENCE as MCP_TOKEN_AUDIENCE2, MCP_TOKEN_ISSUER as MCP_TOKEN_ISSUER2 } from "@agor/core/types";
 function mcpTokenDebug(...args) {
   if (DEBUG_MCP_TOKENS) {
@@ -744,7 +744,7 @@ async function generateSessionToken2(app, sessionId, userId) {
     exp: expSec,
     jti
   };
-  const token = jwt3.sign(payload, jwtSecret, { algorithm: "HS256" });
+  const token = jwt4.sign(payload, jwtSecret, { algorithm: "HS256" });
   s.tokenCache.set(cacheKey, { token, expiresAtMs });
   mcpTokenDebug(
     `\u{1F3AB} MCP token issued: session=${shortId3(sessionId)} jti=${jti.substring(0, 8)} exp=+${Math.floor(s.expirationMs / 1e3)}s`
@@ -760,15 +760,15 @@ async function validateSessionToken(app, token) {
   }
   let payload;
   try {
-    payload = jwt3.verify(token, jwtSecret, {
+    payload = jwt4.verify(token, jwtSecret, {
       audience: MCP_TOKEN_AUDIENCE,
       issuer: MCP_TOKEN_ISSUER,
       algorithms: ["HS256"]
     });
   } catch (err) {
-    if (err instanceof jwt3.TokenExpiredError) {
+    if (err instanceof jwt4.TokenExpiredError) {
       console.warn("[mcp-tokens] token rejected: expired");
-    } else if (err instanceof jwt3.JsonWebTokenError) {
+    } else if (err instanceof jwt4.JsonWebTokenError) {
       console.warn(`[mcp-tokens] token rejected: ${err.message}`);
     } else {
       console.error("[mcp-tokens] token verify error:", err);
@@ -1237,12 +1237,12 @@ import {
   permissionModeForCli,
   slugForCwd
 } from "@agor/core/claude-cli";
-import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig3 } from "@agor/core/config";
 import {
   generateId as generateId4,
   getCurrentTenantId as getCurrentTenantId3,
   runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope2,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope2,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
   SessionRepository as SessionRepository3,
   shortId as shortId4,
   TaskRepository
@@ -1262,7 +1262,7 @@ function getDb(app) {
 }
 function getCliFallbackTenantId(app) {
   const config = app.get("config");
-  return resolveMultiTenancyConfig2(config ?? {}).static_tenant_id;
+  return resolveMultiTenancyConfig3(config ?? {}).static_tenant_id;
 }
 function captureCliWatcherTenantId(app) {
   return getCurrentTenantId3() ?? getCliFallbackTenantId(app);
@@ -1274,7 +1274,7 @@ async function runCliCallbackDatabaseScope(app, sessionId, work) {
   const db = getDb(app);
   if (!db) return work();
   const tenantId = cliWatcherTenantBySession.get(sessionId) ?? captureCliWatcherTenantId(app);
-  return runWithTenantDatabaseScope2(db, tenantId, work);
+  return runWithTenantDatabaseScope4(db, tenantId, work);
 }
 async function persistActiveTurnSnapshot(app, sessionId, turn) {
   const db = getDb(app);
@@ -2120,7 +2120,7 @@ import {
   isUnixImpersonationEnabled,
   loadConfig,
   resolveExecutionSecurityMode,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig3,
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig4,
   resolveMultiTenancyDatabaseDialect,
   resolveTenantContext as resolveTenantContext3,
   TenantResolutionError as TenantResolutionError3,
@@ -2162,19 +2162,33 @@ import {
 
 // src/auth/executor-runtime-scope.ts
 import { Forbidden } from "@agor/core/feathers";
+
+// src/auth/executor-session-token.ts
+var EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+var EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record = payload;
+  return record.type === EXECUTOR_SESSION_TOKEN_TYPE && record.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+
+// src/auth/executor-runtime-scope.ts
 function scopedPayload(context) {
   const params = context.params;
   const payload = params.authentication?.payload;
-  if (payload?.type === "executor-session") {
-    if (payload.purpose !== "executor-task") {
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
       throw new Forbidden("Executor token is not valid for this request");
     }
     return payload;
   }
   if (params.authentication?.strategy === "jwt" && params.task_id) {
     return {
-      type: "executor-session",
-      purpose: "executor-task",
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
       task_id: params.task_id,
       session_id: params.session_id,
       sessionId: params.sessionId,
@@ -2284,7 +2298,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };
@@ -2534,6 +2548,13 @@ var gatewayRouteHook = async (context) => {
   return context;
 };
 
+// src/oauth-auth-helpers.ts
+import { runWithTenantDatabaseScope } from "@agor/core/db";
+function resolveForUserIdWithGate(opts) {
+  const canUseExplicitUser = opts.isServiceAccount === true || opts.authPayloadType === "executor-session" && opts.queryForUserId === opts.callerUserId;
+  return opts.queryForUserId && canUseExplicitUser ? opts.queryForUserId : opts.callerUserId;
+}
+
 // src/services/groups.ts
 import { BoardRepository, GroupRepository } from "@agor/core/db";
 import { BadRequest, Forbidden as Forbidden3, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
@@ -3528,11 +3549,26 @@ function injectCreatedBy() {
 // src/utils/mcp-header-secrets.ts
 import { redactMCPAuthSecrets } from "@agor/core/tools/mcp/auth-secrets";
 import { redactMCPCustomHeaders } from "@agor/core/tools/mcp/http-headers";
+import jwt2 from "jsonwebtoken";
 function shouldExposeMCPServerSecretsForSessionToken(params, options = {}) {
-  const payload = params?.authentication?.payload;
-  const sessionId = params?.session_id ?? payload?.session_id ?? payload?.sessionId;
+  const payload = params?.authentication?.payload ?? decodeExecutorSessionPayload(params);
+  const sessionId = params?.session_id ?? getPayloadSessionId(payload);
   return !!params?.provider && (params.authentication?.strategy === "session-token" || payload?.type === "executor-session") && !!sessionId && (!options.sessionId || sessionId === options.sessionId);
 }
+function decodeExecutorSessionPayload(params) {
+  if (params?.authentication?.strategy !== "jwt" || !params.authentication.accessToken) {
+    return void 0;
+  }
+  const decoded = jwt2.decode(params.authentication.accessToken);
+  if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+    return void 0;
+  }
+  if (!isExecutorSessionTokenPayload(decoded)) return void 0;
+  return decoded;
+}
+function getPayloadSessionId(payload) {
+  return payload ? getExecutorSessionTokenSessionId(payload) : void 0;
+}
 function shouldExposeMCPServerSecrets(params, options = {}) {
   if (!params?.provider) return true;
   if (params.user?._isServiceAccount || params.user?.role === "service") return true;
@@ -3618,6 +3654,7 @@ var RealtimeAccessCache = class {
   }
   branchVisibility = /* @__PURE__ */ new Map();
   sessionBranches = /* @__PURE__ */ new Map();
+  sessionOwners = /* @__PURE__ */ new Map();
   branchVisibilityTtlMs;
   sessionBranchTtlMs;
   now;
@@ -3634,6 +3671,27 @@ var RealtimeAccessCache = class {
     });
     return branchId;
   }
+  /**
+   * Owning user id for a session, cached on the same cadence as the
+   * session→branch map. Used only to offer streaming events to the session
+   * creator's own connections as a fallback when they haven't subscribed to
+   * the per-session stream channel yet.
+   */
+  async getSessionOwnerId(sessionId) {
+    const cached = this.sessionOwners.get(sessionId);
+    const now = this.now();
+    if (cached && cached.expiresAt > now) {
+      return cached.ownerId;
+    }
+    const ownerId = await this.options.sessionsRepository.findCreatedByBySessionId(
+      sessionId
+    ) ?? null;
+    this.sessionOwners.set(sessionId, {
+      ownerId,
+      expiresAt: now + this.sessionBranchTtlMs
+    });
+    return ownerId;
+  }
   async getBranchVisibility(branchId) {
     const cached = this.branchVisibility.get(branchId);
     const now = this.now();
@@ -3669,6 +3727,7 @@ var RealtimeAccessCache = class {
   }
   invalidateSession(sessionId) {
     this.sessionBranches.delete(sessionId);
+    this.sessionOwners.delete(sessionId);
   }
   clearVisibility() {
     this.branchVisibility.clear();
@@ -3676,6 +3735,7 @@ var RealtimeAccessCache = class {
   clearAll() {
     this.branchVisibility.clear();
     this.sessionBranches.clear();
+    this.sessionOwners.clear();
   }
   visibilityFromEntry(entry) {
     return entry.mode === "allAuthenticated" ? { mode: "allAuthenticated" } : { mode: "explicitUsers", userIds: entry.userIds };
@@ -3692,6 +3752,13 @@ import { hasMinimumRole as hasMinimumRole7, ROLES as ROLES8 } from "@agor/core/t
 function tenantChannelName(tenantId) {
   return `tenant:${tenantId}`;
 }
+var SESSION_STREAM_CHANNEL_PREFIX = "session-stream:";
+function sessionStreamChannelName(sessionId) {
+  return `${SESSION_STREAM_CHANNEL_PREFIX}${sessionId}`;
+}
+function existingChannel(app, name) {
+  return (app.channels ?? []).includes(name) ? app.channel(name) : null;
+}
 var DEBUG_REALTIME_PUBLISH = process.env.AGOR_DEBUG_REALTIME_PUBLISH === "1" || process.env.DEBUG?.includes("realtime-publish");
 function realtimePublishDebug(...args) {
   if (DEBUG_REALTIME_PUBLISH) {
@@ -3707,8 +3774,27 @@ var SESSION_ID_SCOPED_PATHS = /* @__PURE__ */ new Set([
   "session-env-selections"
 ]);
 var OPTIONAL_BRANCH_OR_SESSION_SCOPED_PATHS = /* @__PURE__ */ new Set(["board-objects", "board-comments"]);
+var MESSAGE_STREAMING_EVENTS = /* @__PURE__ */ new Set([
+  "streaming:start",
+  "streaming:chunk",
+  "streaming:end",
+  "streaming:error",
+  "thinking:start",
+  "thinking:chunk",
+  "thinking:end"
+]);
+var TASK_STREAMING_EVENTS = /* @__PURE__ */ new Set(["thinking:chunk", "tool:start", "tool:complete"]);
 function isStreamingEvent(context) {
-  return context.path === "messages/streaming" || context.path === "messages" && context.event?.startsWith("streaming:") === true;
+  if (context.path === "messages/streaming") return true;
+  const event = context.event;
+  if (!event) return false;
+  if (context.path === "messages") {
+    return event.startsWith("streaming:") || MESSAGE_STREAMING_EVENTS.has(event);
+  }
+  if (context.path === "tasks") {
+    return TASK_STREAMING_EVENTS.has(event);
+  }
+  return false;
 }
 function asRecord2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : null;
@@ -3844,6 +3930,47 @@ async function resolvePublishScope(data, context, accessCache) {
 function filterToServiceConnections(authenticated) {
   return authenticated.filter((connection) => isServiceConnection(connection));
 }
+async function resolveStreamingDelivery(app, data, tenantScoped, accessCache, branchRbacEnabled, allowSuperadmin) {
+  const serviceConnections = filterToServiceConnections(tenantScoped);
+  const sessionId = extractSessionId(data);
+  if (!sessionId) return serviceConnections;
+  const tenantConnections = new Set(
+    tenantScoped.connections
+  );
+  const existingRoom = existingChannel(app, sessionStreamChannelName(sessionId));
+  const room = existingRoom ? existingRoom.filter((connection) => tenantConnections.has(connection)) : null;
+  let ownerId = null;
+  try {
+    ownerId = await accessCache.getSessionOwnerId(sessionId);
+  } catch {
+  }
+  const ownerChannel = () => tenantScoped.filter(
+    (connection) => userFromConnection(connection)?.user_id === ownerId
+  );
+  if (!branchRbacEnabled) {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const branchId = await accessCache.getBranchIdForSession(sessionId);
+  const visibility = branchId ? await accessCache.getBranchVisibility(branchId) : null;
+  if (!visibility) return serviceConnections;
+  if (visibility.mode === "allAuthenticated") {
+    const channels2 = [serviceConnections];
+    if (room) channels2.push(room);
+    if (ownerId) channels2.push(ownerChannel());
+    return channels2;
+  }
+  const channels = [serviceConnections];
+  if (room) {
+    channels.push(filterToUserIdsOrSuperadmins(room, visibility.userIds, allowSuperadmin));
+  }
+  if (ownerId && visibility.userIds.has(ownerId)) {
+    channels.push(ownerChannel());
+  }
+  return channels;
+}
 function filterToUserIdsOrAdmins(authenticated, userIds, allowSuperadmin) {
   return authenticated.filter((connection) => {
     if (isServiceConnection(connection) || isAdminConnection(connection, allowSuperadmin)) {
@@ -3917,6 +4044,16 @@ function configureRealtimePublish(options) {
         throw error;
       }
     }
+    if (isStreamingEvent(context)) {
+      return resolveStreamingDelivery(
+        app,
+        data,
+        tenantScoped,
+        accessCache,
+        branchRbacEnabled,
+        allowSuperadmin
+      );
+    }
     if (!branchRbacEnabled) return tenantScoped;
     const scope = await resolvePublishScope(data, context, accessCache);
     if (scope.kind === "global") return tenantScoped;
@@ -4049,19 +4186,9 @@ function recomputeNextRunAt() {
   };
 }
 
-// src/utils/session-task-state.ts
-import {
-  isTerminalTaskStatus,
-  SessionStatus as SessionStatus2,
-  sessionCanStartTask,
-  TaskStatus
-} from "@agor/core/types";
-function isTerminalQueueProcessingSuppressed(params) {
-  return params?.suppressTerminalQueueProcessing === true;
-}
-
-// src/register-hooks.ts
-init_spawn_executor();
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig2 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope3 } from "@agor/core/db";
 
 // src/utils/tenant-db-scope.ts
 init_runtime_tokens();
@@ -4074,10 +4201,10 @@ import {
   enqueueTenantDatabasePostCommitCallback,
   getCurrentTenantId as getCurrentTenantId2,
   runWithoutTenantDatabaseScope,
-  runWithTenantDatabaseScope
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope2
 } from "@agor/core/db";
 import { NotAuthenticated as NotAuthenticated7 } from "@agor/core/feathers";
-import jwt2 from "jsonwebtoken";
+import jwt3 from "jsonwebtoken";
 function readHeaderValue(headers, name) {
   if (!headers) return null;
   const wanted = name.toLowerCase();
@@ -4106,7 +4233,7 @@ function deferWithTenantDatabaseScope(db, params, work, onError) {
   const schedule = () => {
     runWithoutTenantDatabaseScope(() => {
       setImmediate(() => {
-        void runWithTenantDatabaseScope(db, tenantId, work).catch((error) => {
+        void runWithTenantDatabaseScope2(db, tenantId, work).catch((error) => {
           if (onError) {
             onError(error);
             return;
@@ -4128,7 +4255,7 @@ function createTenantDatabaseScopeAroundHook(options) {
     const match = authorization?.match(/^Bearer\s+(.+)$/i);
     if (!match || !options.jwtSecret) return void 0;
     try {
-      return jwt2.verify(match[1], options.jwtSecret, {
+      return jwt3.verify(match[1], options.jwtSecret, {
         issuer: RUNTIME_JWT_ISSUER,
         audience: RUNTIME_JWT_AUDIENCE
       });
@@ -4163,11 +4290,74 @@ function createTenantDatabaseScopeAroundHook(options) {
       }
       throw error;
     }
-    await runWithTenantDatabaseScope(options.db, context.params.tenant?.tenant_id, next);
+    await runWithTenantDatabaseScope2(options.db, context.params.tenant?.tenant_id, next);
   };
 }
 
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config) {
+  const multiTenancy = resolveMultiTenancyConfig2(config);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error) => {
+    if (onError) {
+      onError(error);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+
+// src/utils/session-task-state.ts
+import {
+  isTerminalTaskStatus,
+  SessionStatus as SessionStatus2,
+  sessionCanStartTask,
+  TaskStatus
+} from "@agor/core/types";
+function isTerminalQueueProcessingSuppressed(params) {
+  return params?.suppressTerminalQueueProcessing === true;
+}
+
 // src/register-hooks.ts
+init_spawn_executor();
 var DEBUG_MCP_TOKENS2 = process.env.AGOR_DEBUG_MCP_TOKENS === "1" || process.env.DEBUG?.includes("mcp-tokens");
 function mcpTokenDebug2(...args) {
   if (DEBUG_MCP_TOKENS2) {
@@ -4279,6 +4469,10 @@ function shouldRunSessionPostTurnHooks(session) {
 function shouldDrainQueueAfterSessionPostTurnPatch(session, params) {
   return shouldRunSessionPostTurnHooks(session) && session.ready_for_prompt === true && !isTerminalQueueProcessingSuppressed(params);
 }
+function getTrustedSessionTenantId(session) {
+  const tenantId = session?.tenant_id;
+  return typeof tenantId === "string" && tenantId.length > 0 ? tenantId : void 0;
+}
 async function enrichSessionFindResultWithRemoteRelationships(result, sessionsService) {
   if (isRemoteRelationshipsEnrichedResult(result)) return result;
   if (Array.isArray(result)) {
@@ -4293,6 +4487,7 @@ async function enrichSessionFindResultWithRemoteRelationships(result, sessionsSe
 }
 var TENANT_OWNED_SERVICE_PATHS = [
   "sessions",
+  "sessions/:id/mcp-servers",
   "session-relationships",
   "tasks",
   "messages",
@@ -4309,6 +4504,14 @@ var TENANT_OWNED_SERVICE_PATHS = [
   "boards/:id/group-grants",
   "app-variables",
   "mcp-servers",
+  "mcp-servers/discover",
+  "mcp-servers/oauth-auth-headers",
+  "mcp-servers/oauth-complete",
+  "mcp-servers/oauth-disconnect",
+  "mcp-servers/oauth-refresh",
+  "mcp-servers/oauth-start",
+  "mcp-servers/oauth-status",
+  "mcp-servers/test-oauth",
   "card-types",
   "cards",
   "artifacts",
@@ -4355,7 +4558,7 @@ function registerHooks(ctx) {
       return void 0;
     }
   };
-  const multiTenancy = resolveMultiTenancyConfig3(config);
+  const multiTenancy = resolveMultiTenancyConfig4(config);
   const tenantColumnsEnabled = resolveMultiTenancyDatabaseDialect(config) === "postgresql";
   const executionMode = resolveExecutionSecurityMode(config);
   const tenantOwnedServicePaths = TENANT_OWNED_SERVICE_PATHS;
@@ -4513,16 +4716,36 @@ function registerHooks(ctx) {
     );
     return context;
   };
-  const syncUnixAccessForAllBranches = async (context, logPrefix) => {
+  const membershipGroupIdFromContext = (context) => {
+    const resultGroupId = context.result?.group_id;
+    if (typeof resultGroupId === "string" && resultGroupId.length > 0) {
+      return resultGroupId;
+    }
+    const dataGroupId = context.data?.group_id;
+    if (typeof dataGroupId === "string" && dataGroupId.length > 0) return dataGroupId;
+    const queryGroupId = context.params.query?.group_id;
+    if (typeof queryGroupId === "string" && queryGroupId.length > 0) return queryGroupId;
+    const routeGroupId = context.params.route?.groupId;
+    if (typeof routeGroupId === "string" && routeGroupId.length > 0) return routeGroupId;
+    return void 0;
+  };
+  const syncUnixAccessForGroupGrantedBranches = async (context, logPrefix) => {
     if (!executionMode.unixFsIsolationEnabled) return context;
-    const branches = await branchRepository.findAll({ includeArchived: false });
-    for (const branch of branches) {
-      syncBranchUnixAccess(
-        branch.branch_id,
-        logPrefix,
-        context.params
+    const groupId = membershipGroupIdFromContext(context);
+    if (!groupId) {
+      console.warn(
+        `[Unix Integration] Could not resolve group_id for ${context.path}.${context.method}; skipping group membership permission sync`
       );
-      await invalidateRealtimeBranchAccess(branch.branch_id);
+      return context;
+    }
+    const branchIds = await branchRepository.findExplicitFsAccessBranchIdsForGroup(groupId);
+    if (branchIds.length === 0) return context;
+    console.log(
+      `[Unix Integration] Queueing group membership permission sync for ${branchIds.length} branch(es) granted to group ${shortId5(groupId)}`
+    );
+    for (const branchId of branchIds) {
+      syncBranchUnixAccess(branchId, logPrefix, context.params);
+      await invalidateRealtimeBranchAccess(branchId);
     }
     return context;
   };
@@ -5066,7 +5289,13 @@ function registerHooks(ctx) {
   });
   const injectPerUserOAuthTokens = async (context) => {
     const queryForUserId = context.params?.query?.forUserId;
-    const userId = context.params?.user?.user_id || queryForUserId;
+    const authPayloadType = context.params?.authentication?.payload?.type;
+    const userId = resolveForUserIdWithGate({
+      queryForUserId,
+      isServiceAccount: context.params?.user?._isServiceAccount,
+      authPayloadType,
+      callerUserId: context.params?.user?.user_id
+    });
     if (!userId) {
       return context;
     }
@@ -5423,11 +5652,11 @@ function registerHooks(ctx) {
     after: {
       create: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.create]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.create]")
       ],
       remove: [
         clearRealtimeBranchVisibility,
-        (context) => syncUnixAccessForAllBranches(context, "[Executor/group-memberships.remove]")
+        (context) => syncUnixAccessForGroupGrantedBranches(context, "[Executor/group-memberships.remove]")
       ]
     }
   });
@@ -6073,19 +6302,29 @@ function registerHooks(ctx) {
               }
             });
             if (shouldDrainQueueAfterSessionPostTurnPatch(session, context.params)) {
-              deferWithTenantDatabaseScope(db, context.params, async () => {
-                try {
+              const sessionTenantId = getTrustedSessionTenantId(session);
+              deferWithSessionQueueTenantScope(
+                {
+                  db,
+                  config,
+                  sessionId: session.session_id,
+                  params: context.params,
+                  tenantIdHint: sessionTenantId,
+                  label: "SessionsService.after.patch queue drain"
+                },
+                async (queueParams) => {
                   console.log(
                     `\u{1F504} [SessionsService.after.patch] Session ${shortId5(session.session_id)} became promptable (${session.status}), checking for queued tasks...`
                   );
-                  await sessionsService.triggerQueueProcessing(session.session_id, context.params);
-                } catch (error) {
+                  await sessionsService.triggerQueueProcessing(session.session_id, queueParams);
+                },
+                (error) => {
                   console.error(
                     `\u274C [SessionsService.after.patch] Failed to process queue for session ${shortId5(session.session_id)}:`,
                     error
                   );
                 }
-              });
+              );
             } else {
               console.log(
                 `\u23ED\uFE0F  [SessionsService.after.patch] Queue drain suppressed for session ${shortId5(session.session_id)} (suppressTerminalQueueProcessing or not ready)`
@@ -6294,6 +6533,17 @@ function registerHooks(ctx) {
             context.dispatch = result;
             return context;
           }
+          if (_action === "mergeObjectFields" && objects) {
+            if (!context.id) throw new Error("Board ID required");
+            const result = await boardsService.mergeBoardObjectFields(
+              context.id,
+              objects
+            );
+            context.result = result;
+            app.service("boards").emit("patched", result);
+            context.dispatch = result;
+            return context;
+          }
           if (_action === "deleteZone" && objectId) {
             if (!context.id) throw new Error("Board ID required");
             const result = await boardsService.deleteZone(
@@ -6505,6 +6755,7 @@ export {
   PROMPT_FLOW_PATCH_FIELDS,
   TENANT_OWNED_SERVICE_PATHS,
   enrichSessionFindResultWithRemoteRelationships,
+  getTrustedSessionTenantId,
   isPromptFlowPatchOnly,
   registerHooks,
   shouldDrainQueueAfterSessionPostTurnPatch,

package/dist/daemon/register-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register-routes.d.ts","sourceRoot":"","sources":["../src/register-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAOhB,iBAAiB,EAGjB,KAAK,wBAAwB,EAC7B,eAAe,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAML,aAAa,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAEV,oBAAoB,EACpB,WAAW,EAIX,MAAM,EAIN,WAAW,EASZ,MAAM,kBAAkB,CAAC;AAwB1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEnB,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAQ3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgEhE,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK3C,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;CAOhD;AA0BD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,GAAG,EAAE,WAAW,GAAG;QAAE,EAAE,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,qBAAqB,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,cAAc,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;IAC7D,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAG/D,eAAe,EAAE,mBAAmB,CAAC;IACrC,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,wBAAwB,EAAE,UAAU,CAClC,cAAc,mCAAmC,EAAE,8BAA8B,CAClF,CAAC;IACF,2BAA2B,EAAE,UAAU,CACrC,cAAc,sCAAsC,EAAE,iCAAiC,CACxF,CAAC;IACF,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAgjH9E"}
+{"version":3,"file":"register-routes.d.ts","sourceRoot":"","sources":["../src/register-routes.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,gBAAgB,EAOhB,iBAAiB,EAGjB,KAAK,wBAAwB,EAC7B,eAAe,EAChB,MAAM,eAAe,CAAC;AAEvB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAML,aAAa,EAGd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAEV,oBAAoB,EACpB,WAAW,EAIX,MAAM,EAIN,WAAW,EASZ,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EACV,iBAAiB,EAEjB,mBAAmB,EAEnB,mBAAmB,EAEpB,MAAM,mBAAmB,CAAC;AAS3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAoEhE,qBAAa,iBAAkB,SAAQ,aAAa;IAC5C,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK3C,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;CAOhD;AA0BD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,wBAAwB,CAAC;IAC7B,GAAG,EAAE,WAAW,GAAG;QAAE,EAAE,CAAC,EAAE,OAAO,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACvD,MAAM,EAAE,UAAU,CAAC;IACnB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACvC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,WAAW,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5D,qBAAqB,EAAE,CAAC,OAAO,EAAE,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,cAAc,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;IAC7D,cAAc,EAAE,oBAAoB,CAAC;IACrC;;;OAGG;IACH,gBAAgB,EAAE,OAAO,mBAAmB,EAAE,gBAAgB,CAAC;IAG/D,eAAe,EAAE,mBAAmB,CAAC;IACrC,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAC7C,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,eAAe,EAAE,eAAe,CAAC;IACjC,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,wBAAwB,EAAE,UAAU,CAClC,cAAc,mCAAmC,EAAE,8BAA8B,CAClF,CAAC;IACF,2BAA2B,EAAE,UAAU,CACrC,cAAc,sCAAsC,EAAE,iCAAiC,CACxF,CAAC;IACF,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAC3C;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CA6kH9E"}