agor-live 0.23.1 → 0.23.2

package/dist/daemon/register-routes.js

@@ -193,6 +193,24 @@ var init_append_system_message = __esm({
   }
 });
 
+// src/auth/executor-session-token.ts
+function isExecutorSessionTokenPayload(payload) {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return false;
+  const record2 = payload;
+  return record2.type === EXECUTOR_SESSION_TOKEN_TYPE && record2.purpose === EXECUTOR_SESSION_TOKEN_PURPOSE;
+}
+function getExecutorSessionTokenSessionId(payload) {
+  return payload.session_id ?? payload.sessionId;
+}
+var EXECUTOR_SESSION_TOKEN_TYPE, EXECUTOR_SESSION_TOKEN_PURPOSE;
+var init_executor_session_token = __esm({
+  "src/auth/executor-session-token.ts"() {
+    "use strict";
+    EXECUTOR_SESSION_TOKEN_TYPE = "executor-session";
+    EXECUTOR_SESSION_TOKEN_PURPOSE = "executor-task";
+  }
+});
+
 // src/utils/branch-authorization.ts
 import { shortId as shortId4 } from "@agor/core/db";
 import { Forbidden as Forbidden7, NotAuthenticated as NotAuthenticated7, NotFound } from "@agor/core/feathers";
@@ -479,7 +497,7 @@ __export(service_jwt_strategy_exports, {
   ServiceJWTStrategy: () => ServiceJWTStrategy
 });
 import { JWTStrategy } from "@agor/core/feathers";
-import jwt6 from "jsonwebtoken";
+import jwt7 from "jsonwebtoken";
 function persistExecutorJwtPayloadOnConnection(params, accessToken, payload) {
   const connection = params?.connection;
   if (!connection) return;
@@ -508,6 +526,7 @@ var init_service_jwt_strategy = __esm({
   "src/auth/service-jwt-strategy.ts"() {
     "use strict";
     init_users();
+    init_executor_session_token();
     init_runtime_tokens();
     init_token_invalidation();
     ServiceJWTStrategy = class extends JWTStrategy {
@@ -549,7 +568,7 @@ var init_service_jwt_strategy = __esm({
        */
       // biome-ignore lint/suspicious/noExplicitAny: Feathers type compatibility
       async authenticate(authentication, params) {
-        const decoded = jwt6.decode(authentication?.accessToken);
+        const decoded = jwt7.decode(authentication?.accessToken);
         propagateTenantFromJwtPayload(params, decoded, this.tenantClaim);
         const result = await super.authenticate(authentication, params);
         const payload = result.authentication?.payload;
@@ -568,14 +587,14 @@ var init_service_jwt_strategy = __esm({
           };
         }
         if (payload?.type === "executor-session") {
-          if (payload.purpose !== "executor-task") {
+          if (!isExecutorSessionTokenPayload(payload)) {
             throw new Error("Invalid executor token purpose");
           }
           const token = authentication?.accessToken;
           if (!token || !this.sessionTokenService) {
             throw new Error("Executor token validation unavailable");
           }
-          const sessionId = payload.session_id ?? payload.sessionId;
+          const sessionId = getExecutorSessionTokenSessionId(payload);
           const sessionInfo = await this.sessionTokenService.validateToken(token, {
             sessionId,
             taskId: payload.task_id,
@@ -1497,7 +1516,7 @@ import {
   MCP_TOKEN_AUDIENCE,
   MCP_TOKEN_ISSUER
 } from "@agor/core/types";
-import jwt7 from "jsonwebtoken";
+import jwt8 from "jsonwebtoken";
 import { MCP_TOKEN_AUDIENCE as MCP_TOKEN_AUDIENCE2, MCP_TOKEN_ISSUER as MCP_TOKEN_ISSUER2 } from "@agor/core/types";
 function mcpTokenDebug(...args) {
   if (DEBUG_MCP_TOKENS) {
@@ -1569,7 +1588,7 @@ async function generateSessionToken2(app, sessionId, userId) {
     exp: expSec,
     jti
   };
-  const token = jwt7.sign(payload, jwtSecret, { algorithm: "HS256" });
+  const token = jwt8.sign(payload, jwtSecret, { algorithm: "HS256" });
   s.tokenCache.set(cacheKey, { token, expiresAtMs });
   mcpTokenDebug(
     `\u{1F3AB} MCP token issued: session=${shortId8(sessionId)} jti=${jti.substring(0, 8)} exp=+${Math.floor(s.expirationMs / 1e3)}s`
@@ -1585,15 +1604,15 @@ async function validateSessionToken(app, token) {
   }
   let payload;
   try {
-    payload = jwt7.verify(token, jwtSecret, {
+    payload = jwt8.verify(token, jwtSecret, {
       audience: MCP_TOKEN_AUDIENCE,
       issuer: MCP_TOKEN_ISSUER,
       algorithms: ["HS256"]
     });
   } catch (err) {
-    if (err instanceof jwt7.TokenExpiredError) {
+    if (err instanceof jwt8.TokenExpiredError) {
       console.warn("[mcp-tokens] token rejected: expired");
-    } else if (err instanceof jwt7.JsonWebTokenError) {
+    } else if (err instanceof jwt8.JsonWebTokenError) {
       console.warn(`[mcp-tokens] token rejected: ${err.message}`);
     } else {
       console.error("[mcp-tokens] token verify error:", err);
@@ -1660,12 +1679,12 @@ import {
   permissionModeForCli,
   slugForCwd
 } from "@agor/core/claude-cli";
-import { resolveMultiTenancyConfig as resolveMultiTenancyConfig3 } from "@agor/core/config";
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig4 } from "@agor/core/config";
 import {
   generateId as generateId6,
   getCurrentTenantId as getCurrentTenantId3,
   runWithoutTenantDatabaseScope as runWithoutTenantDatabaseScope2,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope4,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope6,
   SessionRepository as SessionRepository4,
   shortId as shortId9,
   TaskRepository
@@ -1685,7 +1704,7 @@ function getDb(app) {
 }
 function getCliFallbackTenantId(app) {
   const config2 = app.get("config");
-  return resolveMultiTenancyConfig3(config2 ?? {}).static_tenant_id;
+  return resolveMultiTenancyConfig4(config2 ?? {}).static_tenant_id;
 }
 function captureCliWatcherTenantId(app) {
   return getCurrentTenantId3() ?? getCliFallbackTenantId(app);
@@ -1697,7 +1716,7 @@ async function runCliCallbackDatabaseScope(app, sessionId, work) {
   const db = getDb(app);
   if (!db) return work();
   const tenantId = cliWatcherTenantBySession.get(sessionId) ?? captureCliWatcherTenantId(app);
-  return runWithTenantDatabaseScope4(db, tenantId, work);
+  return runWithTenantDatabaseScope6(db, tenantId, work);
 }
 async function persistActiveTurnSnapshot(app, sessionId, turn) {
   const db = getDb(app);
@@ -15850,7 +15869,7 @@ __export(schemas_exports2, {
   ipv4: () => ipv42,
   ipv6: () => ipv62,
   json: () => json,
-  jwt: () => jwt8,
+  jwt: () => jwt9,
   keyof: () => keyof,
   ksuid: () => ksuid2,
   lazy: () => lazy,
@@ -16017,7 +16036,7 @@ function base64url2(params) {
 function e1642(params) {
   return _e164(ZodE164, params);
 }
-function jwt8(params) {
+function jwt9(params) {
   return _jwt(ZodJWT, params);
 }
 function stringFormat(format, fnOrRegex, _params = {}) {
@@ -17907,7 +17926,7 @@ __export(external_exports, {
   ipv6: () => ipv62,
   iso: () => iso_exports2,
   json: () => json,
-  jwt: () => jwt8,
+  jwt: () => jwt9,
   keyof: () => keyof,
   ksuid: () => ksuid2,
   lazy: () => lazy,
@@ -21041,11 +21060,15 @@ import {
   ThreadSessionMapRepository
 } from "@agor/core/db";
 import {
-  getConnector
+  buildSlackManifest,
+  getConnector,
+  requiredBotEvents,
+  requiredBotScopes
 } from "@agor/core/gateway";
 import {
   GATEWAY_REDACTED_SENTINEL,
   GATEWAY_SENSITIVE_CONFIG_FIELDS,
+  getRequiredSecretFields,
   hasMinimumRole as hasMinimumRole7,
   ROLES as ROLES8
 } from "@agor/core/types";
@@ -21054,6 +21077,19 @@ function requireAdmin(ctx, action) {
     throw new Error(`Access denied: admin role required to ${action}`);
   }
 }
+async function resolveCallerSessionBranchId(ctx) {
+  if (!ctx.sessionId) return null;
+  const session = await new SessionRepository5(ctx.db).findById(ctx.sessionId);
+  if (!session) {
+    throw new Error("Gateway access denied: calling session not found");
+  }
+  return session.branch_id;
+}
+function sessionBranchReadDeniedError() {
+  return new Error(
+    "Gateway read denied: this Slack thread belongs to a gateway channel targeting a different branch than the calling session's. Sessions can read Slack thread history only through gateway channels whose target branch matches their own."
+  );
+}
 async function canUseGatewayOutbound(ctx, branchRepo, branch) {
   if (hasMinimumRole7(ctx.authenticatedUser?.role, ROLES8.ADMIN)) return true;
   const userId = ctx.userId;
@@ -21134,16 +21170,23 @@ async function resolveSlackThreadHistoryTarget(ctx, args) {
   const channelRepo = new GatewayChannelRepository2(ctx.db);
   const threadMapRepo = new ThreadSessionMapRepository(ctx.db);
   const branchRepo = new BranchRepository4(ctx.db);
+  const callerSessionBranchId = await resolveCallerSessionBranchId(ctx);
   if (args.sessionId) {
     const session = await ctx.app.service("sessions").get(args.sessionId, ctx.baseServiceParams);
     const mapping2 = await threadMapRepo.findBySession(session.session_id);
     if (!mapping2) {
       throw new Error(`No gateway thread mapping found for session ${session.session_id}.`);
     }
+    if (callerSessionBranchId && mapping2.branch_id !== callerSessionBranchId) {
+      throw sessionBranchReadDeniedError();
+    }
     const channel2 = await channelRepo.findById(mapping2.channel_id);
     if (!channel2) {
       throw new Error(`Gateway channel not found for session mapping ${mapping2.id}.`);
     }
+    if (callerSessionBranchId && channel2.target_branch_id !== callerSessionBranchId) {
+      throw sessionBranchReadDeniedError();
+    }
     const branch2 = await branchRepo.findById(mapping2.branch_id);
     return {
       channel: channel2,
@@ -21158,6 +21201,9 @@ async function resolveSlackThreadHistoryTarget(ctx, args) {
   if (!channel) {
     throw new Error(`Gateway channel not found: ${args.gatewayChannelId}`);
   }
+  if (callerSessionBranchId && channel.target_branch_id !== callerSessionBranchId) {
+    throw sessionBranchReadDeniedError();
+  }
   const mapping = await threadMapRepo.findByChannelAndThread(channel.id, args.threadId);
   if (mapping) {
     const branch2 = await branchRepo.findById(mapping.branch_id);
@@ -21251,6 +21297,34 @@ function toServiceUpdateData(args) {
   }
   return updates;
 }
+function toSlackWizardOptions(args) {
+  return {
+    appName: args.appName,
+    ...args.botDisplayName ? { botDisplayName: args.botDisplayName } : {},
+    publicChannels: args.publicChannels,
+    privateChannels: args.privateChannels,
+    groupDms: args.groupDms,
+    alignUsers: args.alignUsers,
+    outbound: args.outbound
+  };
+}
+function toCreateChannelConfigHint(args) {
+  const config2 = {
+    connection_mode: "socket",
+    enable_channels: args.publicChannels,
+    enable_groups: args.privateChannels,
+    enable_mpim: args.groupDms,
+    align_slack_users: args.alignUsers,
+    outbound_enabled: args.outbound
+  };
+  if (args.restrictToChannelIds && args.restrictToChannelIds.length > 0) {
+    config2.allowed_channel_ids = args.restrictToChannelIds;
+  }
+  return { channelType: "slack", config: config2 };
+}
+function identityModeSetupStep(alignUsers) {
+  return alignUsers ? "Identity: the channel is set to align Slack users \u2014 each Slack user runs as their matched Agor account and unmatched users are rejected, so no run-as user is needed. Tell me if you would rather every message run as one fixed Agor user (that requires picking a user and passing agorUserId)." : "Identity: the channel is set to run every message as one fixed Agor user, which requires passing agorUserId to agor_gateway_channels_create. Tell me if you would rather align Slack users so each runs as their own matched Agor account instead.";
+}
 function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_channels_list",
@@ -21296,7 +21370,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_channels_create",
     {
-      description: 'Create a gateway channel definition (admin-only) through the same gateway-channels service used by the UI. Current connectors: Slack, GitHub, Teams. Slack example config: { bot_token, app_token, connection_mode:"socket", enable_channels:true, require_mention:true, allowed_channel_ids:["C123"] }. Secrets are encrypted by the service and returned redacted; prefer environment/template references where possible because raw secrets in tool arguments may appear in the MCP transcript.',
+      description: 'Create a gateway channel definition (admin-only) through the same gateway-channels service used by the UI. Current connectors: Slack, GitHub, Teams. For interactive/agent-driven setup, create the channel disabled and without secrets (enabled:false, no tokens), then collect credentials with agor_widgets_request_gateway_token so the user enters them in a secure inline form \u2014 raw secrets passed in tool arguments leak into the MCP transcript. Passing secrets directly here is for programmatic/non-interactive use only. Non-interactive Slack example config: { bot_token, app_token, connection_mode:"socket", enable_channels:true, require_mention:true, allowed_channel_ids:["C123"] }. Secrets are encrypted by the service and returned redacted.',
       annotations: { destructiveHint: false, idempotentHint: false },
       inputSchema: gatewayChannelCreateSchema
     },
@@ -21306,12 +21380,50 @@ function registerGatewayChannelTools(server, ctx) {
       return textResult({
         gateway_channel: redactGatewayChannel(created),
         next_steps: [
+          "If this channel was created disabled without tokens (the recommended interactive path), collect its credentials by calling agor_widgets_request_gateway_token for this channel so the user enters the tokens in the secure form that appears at the end of this message. Do NOT ask the user to paste xoxb-/xapp- tokens into the chat, and do NOT pass tokens as agor_gateway_channels_create arguments during interactive setup.",
+          ...created.channel_type === "slack" ? [
+            identityModeSetupStep(
+              created.config?.align_slack_users === true
+            )
+          ] : [],
           "Verify the channel in Settings > Gateway Channels or with agor_gateway_channels_list.",
           "Channel credentials, env vars, and inbound channel keys are intentionally redacted from MCP responses."
         ]
       });
     }
   );
+  server.registerTool(
+    "agor_gateway_slack_manifest_generate",
+    {
+      description: "Generate a ready-to-install Slack app manifest from desired gateway capabilities (admin-only). The agent-driven equivalent of the Slack setup wizard, backed by the same core generator. Returns the manifest JSON, the derived bot scopes/events, ordered setup steps, and the channel config to pass to agor_gateway_channels_create. This is pure: it creates no Slack app, no Agor channel, and validates no tokens.",
+      annotations: { readOnlyHint: true },
+      inputSchema: slackManifestGenerateSchema
+    },
+    async (args) => {
+      requireAdmin(ctx, "generate Slack app manifests");
+      const options = toSlackWizardOptions(args);
+      return textResult({
+        manifest: buildSlackManifest(options),
+        bot_scopes: requiredBotScopes(options),
+        bot_events: requiredBotEvents(options),
+        setup_steps: [
+          'Open https://api.slack.com/apps?new_app=1 and choose "Create New App".',
+          'Select "From a manifest", pick the target workspace, paste the manifest JSON below, and click "Create".',
+          'Install the app to the workspace, then open OAuth & Permissions and copy the Bot User OAuth Token (starts with "xoxb-").',
+          'Open Basic Information \u2192 App-Level Tokens \u2192 Generate Token and Scopes, add the connections:write scope, generate it, and copy the App-Level Token (starts with "xapp-").',
+          'Once the app is installed and you hold the xoxb-/xapp- tokens, call agor_gateway_channels_create with channelType "slack", enabled:false, no tokens, and create_channel_config_hint below to create the channel as a draft.',
+          "Then call agor_widgets_request_gateway_token for that channel so the user enters the xoxb-/xapp- tokens in the secure form that appears at the end of this message, which enables the channel. Do NOT ask the user to paste xoxb-/xapp- tokens into the chat, and do NOT pass tokens as agor_gateway_channels_create arguments.",
+          identityModeSetupStep(args.alignUsers)
+        ],
+        create_channel_config_hint: toCreateChannelConfigHint(args),
+        caveats: [
+          "GENERATED ONLY \u2014 no Slack app created, no Agor channel created, no tokens validated, no event delivery verified.",
+          "The app-level connections:write token is generated manually and is NOT part of the manifest bot scopes.",
+          "restrictToChannelIds maps to config.allowed_channel_ids when you call create \u2014 it does NOT change the manifest scopes or events."
+        ]
+      });
+    }
+  );
   server.registerTool(
     "agor_gateway_channels_update",
     {
@@ -21335,7 +21447,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_outbound_targets_list",
     {
-      description: "List Slack gateway outbound targets the caller can use. Returns only outbound-enabled channels where the caller has branch all permission or admin access. Secrets and inbound channel keys are never returned.",
+      description: "List Slack gateway outbound targets the caller can use. Returns only outbound-enabled channels where the caller has branch all permission or admin access; when called from a session, results are additionally scoped to channels targeting the session's branch. Secrets and inbound channel keys are never returned.",
       annotations: { readOnlyHint: true },
       inputSchema: external_exports.strictObject({
         branchId: mcpOptionalId("branchId", "Branch", "Filter by target branch ID."),
@@ -21350,15 +21462,24 @@ function registerGatewayChannelTools(server, ctx) {
     async (args) => {
       const channelRepo = new GatewayChannelRepository2(ctx.db);
       const branchRepo = new BranchRepository4(ctx.db);
+      const callerSessionBranchId = await resolveCallerSessionBranchId(ctx);
       const branchFilter = args.branchId ? await branchRepo.findById(args.branchId) : null;
-      const branchFilterId = branchFilter?.branch_id;
+      const requestedBranchId = branchFilter?.branch_id;
+      if (callerSessionBranchId && args.branchId && requestedBranchId !== callerSessionBranchId) {
+        return textResult({
+          channels: [],
+          binding: "Results are scoped to the calling session's branch; the requested branchId targets a different branch, so this session cannot use its channels."
+        });
+      }
+      const branchFilterId = callerSessionBranchId ?? requestedBranchId;
       const allChannels = args.gatewayChannelId ? [await channelRepo.findById(args.gatewayChannelId)] : await channelRepo.findAll();
       const channels = [];
       for (const channel of allChannels) {
         if (!channel) continue;
         if (args.channelType && channel.channel_type !== args.channelType) continue;
         if (channel.channel_type !== "slack") continue;
-        if (args.branchId && channel.target_branch_id !== branchFilterId) continue;
+        if ((callerSessionBranchId || args.branchId) && channel.target_branch_id !== branchFilterId)
+          continue;
         if (!channel.enabled) continue;
         const outbound = getOutboundConfig(channel);
         if (!outbound.outbound_enabled) continue;
@@ -21381,13 +21502,18 @@ function registerGatewayChannelTools(server, ctx) {
           ]
         });
       }
-      return textResult({ channels });
+      return textResult({
+        channels,
+        ...callerSessionBranchId && channels.length === 0 ? {
+          hint: "No outbound-enabled channel targets this session's branch \u2014 ask an operator to create/enable one."
+        } : {}
+      });
     }
   );
   server.registerTool(
     "agor_gateway_slack_thread_history_get",
     {
-      description: "Fetch Slack thread history for a gateway-mapped Slack thread without exposing Slack tokens. Prefer sessionId to resolve the gateway thread mapping from an accessible Agor session. Alternatively pass gatewayChannelId + threadId: mapped threads require admin or branch all permission on the mapped branch; unmapped arbitrary thread reads are admin-only. Slack message text is untrusted external content.",
+      description: "Fetch Slack thread history for a gateway-mapped Slack thread without exposing Slack tokens. Prefer sessionId to resolve the gateway thread mapping from an accessible Agor session. Alternatively pass gatewayChannelId + threadId: mapped threads require admin or branch all permission on the mapped branch; unmapped arbitrary thread reads are admin-only. When called from a session, reads are restricted to threads whose target branch matches the calling session's branch. Slack message text is untrusted external content.",
       annotations: { readOnlyHint: true },
       inputSchema: slackThreadHistorySchema
     },
@@ -21455,7 +21581,7 @@ function registerGatewayChannelTools(server, ctx) {
   server.registerTool(
     "agor_gateway_emit_message",
     {
-      description: "Send a proactive Slack message through an outbound-enabled gateway channel and persist a seed/audit record. Targets may be Slack channel IDs, channel names, or user emails; v0 intentionally starts a fresh Slack thread/DM message for each emit and does not create a thread-session mapping until a human replies.",
+      description: "Send a proactive Slack message through an outbound-enabled gateway channel and persist a seed/audit record. Targets may be Slack channel IDs, channel names, or user emails; v0 intentionally starts a fresh Slack thread/DM message for each emit and does not create a thread-session mapping until a human replies. When called from a session, outbound is restricted to channels whose target branch matches the calling session's branch.",
       annotations: { destructiveHint: false, idempotentHint: false },
       inputSchema: external_exports.strictObject({
         gatewayChannelId: mcpRequiredId(
@@ -21492,7 +21618,7 @@ function registerGatewayChannelTools(server, ctx) {
     }
   );
 }
-var configSchema, outboundTargetSchema, envVarSchema, agenticConfigSchema, gatewayChannelCreateSchema, slackThreadHistorySchema, gatewayChannelUpdateSchema;
+var configSchema, outboundTargetSchema, envVarSchema, agenticConfigSchema, gatewayChannelCreateSchema, slackThreadHistorySchema, gatewayChannelUpdateSchema, slackManifestGenerateSchema;
 var init_gateway_channels = __esm({
   "src/mcp/tools/gateway-channels.ts"() {
     "use strict";
@@ -21556,44 +21682,48 @@ var init_gateway_channels = __esm({
       agenticConfig: agenticConfigSchema.optional()
     }).superRefine((value, issue2) => {
       const config2 = value.config ?? {};
-      if (value.channelType === "slack") {
-        if (!config2.bot_token) {
-          issue2.addIssue({
-            code: "custom",
-            path: ["config", "bot_token"],
-            message: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible."
-          });
-        }
-        if (config2.connection_mode === "socket" && !config2.app_token) {
-          issue2.addIssue({
-            code: "custom",
-            path: ["config", "app_token"],
-            message: "config.app_token is required for Slack Socket Mode."
-          });
-        }
-      }
-      if (value.channelType === "github") {
-        for (const field of ["app_id", "private_key", "installation_id", "watch_repos"]) {
+      if (value.enabled !== false) {
+        const requiredSecretMessages = {
+          bot_token: "config.bot_token is required for Slack. Prefer a bot token stored outside the transcript when possible.",
+          app_token: "config.app_token is required for Slack Socket Mode.",
+          private_key: "config.private_key is required for GitHub gateway channels.",
+          app_password: "config.app_password is required for Teams gateway channels."
+        };
+        for (const field of getRequiredSecretFields(value.channelType, config2)) {
           if (!config2[field]) {
             issue2.addIssue({
               code: "custom",
               path: ["config", field],
-              message: `config.${field} is required for GitHub gateway channels.`
+              message: requiredSecretMessages[field] ?? `config.${field} is required for ${value.channelType} gateway channels.`
             });
           }
         }
       }
-      if (value.channelType === "teams") {
-        for (const field of ["app_id", "app_password"]) {
+      if (value.channelType === "github") {
+        for (const field of ["app_id", "installation_id", "watch_repos"]) {
           if (!config2[field]) {
             issue2.addIssue({
               code: "custom",
               path: ["config", field],
-              message: `config.${field} is required for Teams gateway channels.`
+              message: `config.${field} is required for GitHub gateway channels.`
             });
           }
         }
       }
+      if (value.channelType === "teams" && !config2.app_id) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["config", "app_id"],
+          message: "config.app_id is required for Teams gateway channels."
+        });
+      }
+      if (value.channelType === "slack" && config2.align_slack_users !== true && !value.agorUserId) {
+        issue2.addIssue({
+          code: "custom",
+          path: ["agorUserId"],
+          message: "Run-as-selected-user needs agorUserId \u2014 set config.align_slack_users:true to align by email, or pass agorUserId."
+        });
+      }
     });
     slackThreadHistorySchema = external_exports.strictObject({
       sessionId: mcpOptionalId(
@@ -21657,6 +21787,23 @@ var init_gateway_channels = __esm({
       ),
       agenticConfig: agenticConfigSchema.nullable().optional().describe("Replace agent/session defaults. null clears the gateway agentic config.")
     });
+    slackManifestGenerateSchema = external_exports.strictObject({
+      appName: mcpRequiredString("appName", 'Slack app display name, e.g. "Agor".'),
+      botDisplayName: mcpOptionalNonEmptyString(
+        "botDisplayName",
+        "Bot user display name. Defaults to appName."
+      ),
+      publicChannels: external_exports.boolean().default(false).describe("Listen in public channels (#channel) via @mention."),
+      privateChannels: external_exports.boolean().default(false).describe("Listen in private channels (groups) via @mention."),
+      groupDms: external_exports.boolean().default(false).describe("Listen in group DMs (multi-person IMs) via @mention."),
+      alignUsers: external_exports.boolean().default(true).describe(
+        "Resolve Slack user email \u2192 Agor user (adds the users:read.email scope). Defaults to true: each Slack user runs as their matched Agor account and unmatched users are rejected, so no fixed run-as user is needed. Set false to run every message as one fixed Agor user (then pass agorUserId to agor_gateway_channels_create)."
+      ),
+      outbound: external_exports.boolean().default(false).describe("Proactive outbound: post to channels by name and DM users by email."),
+      restrictToChannelIds: external_exports.array(external_exports.string().min(1)).optional().describe(
+        "Slack channel ID whitelist. Maps to config.allowed_channel_ids when you call agor_gateway_channels_create; it does NOT change the manifest scopes or events."
+      )
+    });
   }
 });
 
@@ -26844,8 +26991,53 @@ var init_env_vars = __esm({
   }
 });
 
+// src/widgets/gateway-token/index.ts
+import { Forbidden as Forbidden10 } from "@agor/core/feathers";
+import {
+  GATEWAY_SENSITIVE_CONFIG_FIELDS as GATEWAY_SENSITIVE_CONFIG_FIELDS2,
+  hasMinimumRole as hasMinimumRole9,
+  ROLES as ROLES11
+} from "@agor/core/types";
+function isSupportedGatewayTokenChannelType(channelType) {
+  return SUPPORTED_CHANNEL_TYPES.includes(channelType);
+}
+var SUPPORTED_CHANNEL_TYPES, MAX_TOKEN_LENGTH, gatewayTokenParamsSchema, gatewayTokenSubmitSchema;
+var init_gateway_token = __esm({
+  "src/widgets/gateway-token/index.ts"() {
+    "use strict";
+    init_zod();
+    init_registry();
+    SUPPORTED_CHANNEL_TYPES = [
+      "slack",
+      "github",
+      "teams"
+    ];
+    MAX_TOKEN_LENGTH = 8192;
+    gatewayTokenParamsSchema = external_exports.object({
+      gatewayChannelId: external_exports.string().min(1).describe("Gateway channel whose credentials are being set."),
+      channelType: external_exports.enum(["slack", "discord", "whatsapp", "telegram", "github", "teams"]).describe("Platform type of the channel; drives per-field placeholders."),
+      channelName: external_exports.string().min(1).max(200).describe("Human-readable channel name for the form heading and prompts."),
+      fields: external_exports.array(external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2)).min(1).max(GATEWAY_SENSITIVE_CONFIG_FIELDS2.length).refine((fields) => new Set(fields).size === fields.length, {
+        message: "Token field names must be unique"
+      }).describe("Secret config field names to collect (subset of the sensitive fields)."),
+      reason: external_exports.string().min(1).max(200).describe("One sentence explaining why the tokens are needed. Renders as a muted line.")
+    }).strict();
+    gatewayTokenSubmitSchema = external_exports.object({
+      tokens: external_exports.partialRecord(
+        external_exports.enum(GATEWAY_SENSITIVE_CONFIG_FIELDS2),
+        external_exports.string().min(1).max(MAX_TOKEN_LENGTH)
+      ).describe("Map of sensitive field name \u2192 credential value.")
+    }).strict();
+  }
+});
+
 // src/mcp/tools/widgets.ts
-import { MessageRole as MessageRole3 } from "@agor/core/types";
+import { getRequiredSecretFields as getRequiredSecretFields2, hasMinimumRole as hasMinimumRole10, MessageRole as MessageRole3, ROLES as ROLES12 } from "@agor/core/types";
+function requireAdmin2(ctx, action) {
+  if (!hasMinimumRole10(ctx.authenticatedUser?.role, ROLES12.ADMIN)) {
+    throw new Error(`Access denied: admin role required to ${action}`);
+  }
+}
 function widgetContentPreview(params) {
   const list = params.names.join(", ");
   return params.names.length === 1 ? `Please provide ${list}: ${params.reason}` : `Please provide ${list}: ${params.reason}`;
@@ -26964,13 +27156,113 @@ function registerWidgetTools(server, ctx) {
       return textResult({ widget_id: widgetId, status: "requested" });
     }
   );
+  server.registerTool(
+    "agor_widgets_request_gateway_token",
+    {
+      description: "Ask an admin to securely provide a gateway channel's platform tokens (Slack bot/app tokens, GitHub private key, Teams app password) via a compact form that appears at the end of your message, so setup finishes without anyone pasting xoxb-/xapp- tokens into chat. FIRE-AND-FORGET: the widget renders inline at the end of your turn; end your turn after calling. You will receive a user-role message when it is resolved. Token values never enter your context \u2014 only the channel identity and field NAMES do. Admin-only: a non-admin agent cannot mint this widget. Keep `reason` to ONE short sentence (\u2264200 chars).",
+      annotations: { destructiveHint: false, openWorldHint: false },
+      inputSchema: external_exports.object({
+        gatewayChannelId: external_exports.string().min(1).describe("Gateway channel ID (UUIDv7 or short ID) whose tokens are being set."),
+        reason: external_exports.string().max(200).optional().describe("One short sentence explaining why the tokens are needed.")
+      })
+    },
+    async (args) => {
+      if (!ctx.sessionId) return sessionContextRequiredResult();
+      const currentSessionId = ctx.sessionId;
+      requireAdmin2(ctx, "set gateway channel tokens");
+      const channel = await ctx.app.service("gateway-channels").get(args.gatewayChannelId, ctx.baseServiceParams);
+      const channelType = channel.channel_type;
+      if (!isSupportedGatewayTokenChannelType(channelType)) {
+        throw new Error(
+          `Gateway channel type "${channelType}" does not support token entry via this widget.`
+        );
+      }
+      const fields = getRequiredSecretFields2(channelType, channel.config);
+      if (fields.length === 0) {
+        throw new Error(
+          `Gateway channel "${channel.name}" has no required secret fields to collect.`
+        );
+      }
+      const params = gatewayTokenParamsSchema.parse({
+        gatewayChannelId: channel.id,
+        channelType,
+        channelName: channel.name,
+        fields,
+        reason: args.reason ?? `Provide the ${channelType} credentials to finish connecting "${channel.name}".`
+      });
+      const requestedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const baseWidgetMeta = {
+        widget_type: "gateway_token",
+        schema_version: 1,
+        params,
+        status: "pending",
+        requested_at: requestedAt,
+        auto_resume: true
+      };
+      const hostTask = await findHostTaskForSession(
+        ctx.app,
+        currentSessionId,
+        ctx.baseServiceParams
+      );
+      const hostTaskId = hostTask?.task_id;
+      const created = await appendSystemMessage({
+        app: ctx.app,
+        db: ctx.db,
+        sessionId: currentSessionId,
+        taskId: hostTaskId,
+        content: `Please provide the ${channelType} tokens for "${channel.name}": ${params.reason}`,
+        contentPreview: `Widget: gateway_token (${channel.name})`,
+        type: "widget_request",
+        role: MessageRole3.SYSTEM,
+        metadata: {
+          widget: {
+            ...baseWidgetMeta,
+            widget_id: "pending"
+          }
+        }
+      });
+      const widgetId = created.message_id;
+      if (hostTask?.message_range) {
+        try {
+          await ctx.app.service("tasks").patch(
+            hostTask.task_id,
+            {
+              message_range: {
+                start_index: hostTask.message_range.start_index,
+                end_index: created.index
+              }
+            },
+            ctx.baseServiceParams
+          );
+        } catch (err) {
+          console.warn(
+            `[widgets] failed to extend task.message_range for widget ${widgetId}:`,
+            err
+          );
+        }
+      }
+      await ctx.app.service("messages").patch(
+        widgetId,
+        {
+          metadata: {
+            ...created.metadata ?? {},
+            widget: { ...baseWidgetMeta, widget_id: widgetId }
+          }
+        },
+        ctx.baseServiceParams
+      );
+      return textResult({ widget_id: widgetId, status: "requested" });
+    }
+  );
 }
 var init_widgets = __esm({
   "src/mcp/tools/widgets.ts"() {
     "use strict";
+    init_zod();
     init_append_system_message();
     init_session_tasks();
     init_env_vars();
+    init_gateway_token();
     init_server();
   }
 });
@@ -27534,7 +27826,7 @@ Discover tools: search domains/summaries \u2192 get details for one tool \u2192
 import {
   loadConfig as loadConfig3,
   resolveBranchStorageConfig,
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig4
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig5
 } from "@agor/core/config";
 import {
   BranchRepository as BranchRepository8,
@@ -27555,7 +27847,7 @@ import {
   BadRequest as BadRequest5,
   Conflict as Conflict2,
   errorHandler,
-  Forbidden as Forbidden10,
+  Forbidden as Forbidden11,
   LocalStrategy,
   NotAuthenticated as NotAuthenticated12,
   NotFound as NotFound5
@@ -27563,9 +27855,9 @@ import {
 import { PermissionService } from "@agor/core/permissions";
 import {
   AGENTIC_TOOL_CAPABILITIES as AGENTIC_TOOL_CAPABILITIES2,
-  hasMinimumRole as hasMinimumRole9,
+  hasMinimumRole as hasMinimumRole11,
   MessageRole as MessageRole4,
-  ROLES as ROLES11,
+  ROLES as ROLES13,
   SERVICE_GROUP_NAMES as SERVICE_GROUP_NAMES2,
   SessionStatus as SessionStatus5,
   TaskStatus as TaskStatus5
@@ -27573,6 +27865,58 @@ import {
 import { NotFoundError as NotFoundError4 } from "@agor/core/utils/errors";
 import { rateLimit as rateLimit2 } from "express-rate-limit";
 
+// src/auth/issue-browser-tokens-hook.ts
+init_runtime_tokens();
+init_token_invalidation();
+
+// src/auth/user-redaction.ts
+function redactUserAuthMetadata(user) {
+  const {
+    tokens_valid_after: _tokensValidAfter,
+    password: _password,
+    tenant_id: _tenantId,
+    ...publicUser
+  } = user;
+  return publicUser;
+}
+
+// src/auth/issue-browser-tokens-hook.ts
+var MACHINE_TOKEN_TYPES = /* @__PURE__ */ new Set(["executor-session", "service"]);
+function createIssueBrowserTokensHook(options) {
+  const { jwtSecret, accessTokenTtl, refreshTokenTtl, tenantClaim, debug } = options;
+  return async (context) => {
+    debug?.("\u2705 Authentication succeeded:", {
+      strategy: context.result?.authentication?.strategy,
+      hasUser: !!context.result?.user,
+      user_id: context.result?.user?.user_id,
+      hasAccessToken: !!context.result?.accessToken
+    });
+    if (!context.result?.user) {
+      return context;
+    }
+    const payloadType = context.result.authentication?.payload?.type;
+    if (typeof payloadType === "string" && MACHINE_TOKEN_TYPES.has(payloadType)) {
+      context.result.user = redactUserAuthMetadata(context.result.user);
+      return context;
+    }
+    const tenantId = context.params?.tenant?.tenant_id ?? context.result.user.tenant_id;
+    const tokens = issueRuntimeTokenPair(
+      context.result.user,
+      jwtSecret,
+      accessTokenTtl,
+      refreshTokenTtl,
+      {
+        ...authTokenIssuedAtClaim(Date.now(), context.result.user),
+        ...runtimeTenantClaims(tenantId, tenantClaim)
+      }
+    );
+    context.result.accessToken = tokens.accessToken;
+    context.result.refreshToken = tokens.refreshToken;
+    context.result.user = redactUserAuthMetadata(context.result.user);
+    return context;
+  };
+}
+
 // src/auth/launch-auth.ts
 init_runtime_tokens();
 init_token_invalidation();
@@ -27596,19 +27940,6 @@ import {
 import { BadRequest, NotAuthenticated as NotAuthenticated2 } from "@agor/core/feathers";
 import { normalizeRole, ROLES } from "@agor/core/types";
 import jwt2 from "jsonwebtoken";
-
-// src/auth/user-redaction.ts
-function redactUserAuthMetadata(user) {
-  const {
-    tokens_valid_after: _tokensValidAfter,
-    password: _password,
-    tenant_id: _tenantId,
-    ...publicUser
-  } = user;
-  return publicUser;
-}
-
-// src/auth/launch-auth.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_SERVICE_TOKEN_ENV = "AGOR_EXTERNAL_LAUNCH_SERVICE_TOKEN";
 var DEFAULT_SHARED_SECRET_ENV = "AGOR_EXTERNAL_LAUNCH_SHARED_SECRET";
@@ -28055,6 +28386,13 @@ function killExecutorProcess(sessionId) {
   return true;
 }
 
+// src/oauth-auth-helpers.ts
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope2 } from "@agor/core/db";
+function resolveForUserIdWithGate(opts) {
+  const canUseExplicitUser = opts.isServiceAccount === true || opts.authPayloadType === "executor-session" && opts.queryForUserId === opts.callerUserId;
+  return opts.queryForUserId && canUseExplicitUser ? opts.queryForUserId : opts.callerUserId;
+}
+
 // src/services/scheduler.ts
 import {
   advisoryLockKeyForUuid,
@@ -28062,7 +28400,7 @@ import {
   getCurrentTenantId,
   isPostgresDatabase,
   runWithSystemDatabaseScope,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope2,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope3,
   ScheduleRepository,
   SessionMCPServerRepository,
   SessionRepository,
@@ -28433,20 +28771,21 @@ import { Forbidden as Forbidden6, NotAuthenticated as NotAuthenticated6 } from "
 import { hasMinimumRole as hasMinimumRole3, ROLES as ROLES4 } from "@agor/core/types";
 
 // src/auth/executor-runtime-scope.ts
+init_executor_session_token();
 import { Forbidden as Forbidden5 } from "@agor/core/feathers";
 function scopedPayload(context) {
   const params = context.params;
   const payload = params.authentication?.payload;
-  if (payload?.type === "executor-session") {
-    if (payload.purpose !== "executor-task") {
+  if (payload?.type === EXECUTOR_SESSION_TOKEN_TYPE) {
+    if (!isExecutorSessionTokenPayload(payload)) {
       throw new Forbidden5("Executor token is not valid for this request");
     }
     return payload;
   }
   if (params.authentication?.strategy === "jwt" && params.task_id) {
     return {
-      type: "executor-session",
-      purpose: "executor-task",
+      type: EXECUTOR_SESSION_TOKEN_TYPE,
+      purpose: EXECUTOR_SESSION_TOKEN_PURPOSE,
       task_id: params.task_id,
       session_id: params.session_id,
       sessionId: params.sessionId,
@@ -28556,7 +28895,7 @@ function executorRuntimeScopeGuard() {
     const payload = scopedPayload(context);
     if (!payload) return context;
     const scope = {
-      sessionId: payload.session_id ?? payload.sessionId,
+      sessionId: getExecutorSessionTokenSessionId(payload),
       taskId: payload.task_id,
       branchId: payload.branch_id
     };
@@ -28768,13 +29107,29 @@ ${rawPrompt}`,
 }
 
 // src/utils/mcp-header-secrets.ts
+init_executor_session_token();
 import { redactMCPAuthSecrets } from "@agor/core/tools/mcp/auth-secrets";
 import { redactMCPCustomHeaders } from "@agor/core/tools/mcp/http-headers";
+import jwt5 from "jsonwebtoken";
 function shouldExposeMCPServerSecretsForSessionToken(params, options = {}) {
-  const payload = params?.authentication?.payload;
-  const sessionId = params?.session_id ?? payload?.session_id ?? payload?.sessionId;
+  const payload = params?.authentication?.payload ?? decodeExecutorSessionPayload(params);
+  const sessionId = params?.session_id ?? getPayloadSessionId(payload);
   return !!params?.provider && (params.authentication?.strategy === "session-token" || payload?.type === "executor-session") && !!sessionId && (!options.sessionId || sessionId === options.sessionId);
 }
+function decodeExecutorSessionPayload(params) {
+  if (params?.authentication?.strategy !== "jwt" || !params.authentication.accessToken) {
+    return void 0;
+  }
+  const decoded = jwt5.decode(params.authentication.accessToken);
+  if (!decoded || typeof decoded !== "object" || Array.isArray(decoded)) {
+    return void 0;
+  }
+  if (!isExecutorSessionTokenPayload(decoded)) return void 0;
+  return decoded;
+}
+function getPayloadSessionId(payload) {
+  return payload ? getExecutorSessionTokenSessionId(payload) : void 0;
+}
 function shouldExposeMCPServerSecrets(params, options = {}) {
   if (!params?.provider) return true;
   if (params.user?._isServiceAccount || params.user?.role === "service") return true;
@@ -28826,6 +29181,186 @@ function ensureScheduleRunsAsCaller(options) {
   };
 }
 
+// src/utils/session-queue-tenant-scope.ts
+import { resolveMultiTenancyConfig as resolveMultiTenancyConfig3 } from "@agor/core/config";
+import { runWithTenantDatabaseScope as runWithTenantDatabaseScope5 } from "@agor/core/db";
+
+// src/utils/tenant-db-scope.ts
+init_runtime_tokens();
+import {
+  resolveMultiTenancyConfig as resolveMultiTenancyConfig2,
+  resolveTenantContext as resolveTenantContext2,
+  TenantResolutionError as TenantResolutionError2
+} from "@agor/core/config";
+import {
+  enqueueTenantDatabasePostCommitCallback,
+  getCurrentTenantId as getCurrentTenantId2,
+  runWithoutTenantDatabaseScope,
+  runWithTenantDatabaseScope as runWithTenantDatabaseScope4
+} from "@agor/core/db";
+import { NotAuthenticated as NotAuthenticated9 } from "@agor/core/feathers";
+import jwt6 from "jsonwebtoken";
+function readHeaderValue(headers, name) {
+  if (!headers) return null;
+  const wanted = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() !== wanted) continue;
+    const raw = Array.isArray(value) ? value[0] : value;
+    return typeof raw === "string" && raw.trim() ? raw.trim() : null;
+  }
+  return null;
+}
+function resolveTenantIdForDeferredScope(params) {
+  const scopedParams = params;
+  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId2();
+}
+function deferWithTenantDatabaseScope(db, params, work, onError) {
+  const tenantId = resolveTenantIdForDeferredScope(params);
+  if (!tenantId) {
+    const error51 = new Error("Missing tenant context for deferred tenant-scoped work");
+    if (onError) {
+      onError(error51);
+    } else {
+      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error51);
+    }
+    return;
+  }
+  const schedule = () => {
+    runWithoutTenantDatabaseScope(() => {
+      setImmediate(() => {
+        void runWithTenantDatabaseScope4(db, tenantId, work).catch((error51) => {
+          if (onError) {
+            onError(error51);
+            return;
+          }
+          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error51);
+        });
+      });
+    });
+  };
+  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
+    return;
+  }
+  schedule();
+}
+function createTenantDatabaseScopeAroundHook(options) {
+  const multiTenancy = resolveMultiTenancyConfig2(options.config);
+  const bearerPayloadFromHeaders = (headers) => {
+    const authorization = readHeaderValue(headers, "authorization");
+    const match = authorization?.match(/^Bearer\s+(.+)$/i);
+    if (!match || !options.jwtSecret) return void 0;
+    try {
+      return jwt6.verify(match[1], options.jwtSecret, {
+        issuer: RUNTIME_JWT_ISSUER,
+        audience: RUNTIME_JWT_AUDIENCE
+      });
+    } catch {
+      return void 0;
+    }
+  };
+  const resolveTenantForDatabaseScope = (context) => {
+    const params = context.params;
+    const connectionTenant = params.connection?.tenant ?? params.connection?.data?.tenant;
+    const paramsWithConnectionTenant = connectionTenant && typeof connectionTenant === "object" && "tenant_id" in connectionTenant ? { ...params, tenant: params.tenant ?? connectionTenant } : params;
+    try {
+      return resolveTenantContext2(multiTenancy, {
+        params: paramsWithConnectionTenant,
+        authPayload: paramsWithConnectionTenant.authentication?.payload ?? bearerPayloadFromHeaders(paramsWithConnectionTenant.headers),
+        headers: paramsWithConnectionTenant.headers
+      });
+    } catch (error51) {
+      const inheritedTenantId = getCurrentTenantId2();
+      if (error51 instanceof TenantResolutionError2 && inheritedTenantId) {
+        return { tenant_id: inheritedTenantId, source: "explicit" };
+      }
+      throw error51;
+    }
+  };
+  return async (context, next) => {
+    try {
+      context.params.tenant = resolveTenantForDatabaseScope(context);
+    } catch (error51) {
+      if (error51 instanceof TenantResolutionError2) {
+        throw new NotAuthenticated9(error51.message);
+      }
+      throw error51;
+    }
+    await runWithTenantDatabaseScope4(options.db, context.params.tenant?.tenant_id, next);
+  };
+}
+
+// src/utils/session-queue-tenant-scope.ts
+function staticTenantId(config2) {
+  const multiTenancy = resolveMultiTenancyConfig3(config2);
+  return multiTenancy.mode === "static" ? multiTenancy.static_tenant_id : void 0;
+}
+function trustedTenantIdHint(options) {
+  const hint = options.tenantIdHint?.trim();
+  return hint || void 0;
+}
+function queueTenantParams(params, tenantId, source = "explicit") {
+  const currentTenant = params?.tenant;
+  return {
+    ...params ?? {},
+    tenant: {
+      ...currentTenant,
+      tenant_id: tenantId,
+      source: currentTenant?.source ?? source
+    }
+  };
+}
+async function runWithSessionQueueTenantScope(options, work) {
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    return runWithTenantDatabaseScope5(options.db, capturedTenantId, () => work(scopedParams2));
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    return runWithTenantDatabaseScope5(options.db, tenantIdHint, () => work(scopedParams2));
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    console.error(
+      `\u274C [Queue] ${options.label} skipped for session ${options.sessionId}: missing tenant context`
+    );
+    return void 0;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  return runWithTenantDatabaseScope5(options.db, configuredStaticTenantId, () => work(scopedParams));
+}
+function deferWithSessionQueueTenantScope(options, work, onError) {
+  const handleError = (error51) => {
+    if (onError) {
+      onError(error51);
+      return;
+    }
+    console.error(`\u274C [Queue] ${options.label} failed:`, error51);
+  };
+  const capturedTenantId = resolveTenantIdForDeferredScope(options.params);
+  if (capturedTenantId) {
+    const scopedParams2 = queueTenantParams(options.params, capturedTenantId, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const tenantIdHint = trustedTenantIdHint(options);
+  if (tenantIdHint) {
+    const scopedParams2 = queueTenantParams(options.params, tenantIdHint, "explicit");
+    deferWithTenantDatabaseScope(options.db, scopedParams2, () => work(scopedParams2), handleError);
+    return;
+  }
+  const configuredStaticTenantId = staticTenantId(options.config);
+  if (!configuredStaticTenantId) {
+    handleError(
+      new Error(`${options.label} skipped for session ${options.sessionId}: missing tenant context`)
+    );
+    return;
+  }
+  const scopedParams = queueTenantParams(options.params, configuredStaticTenantId, "static");
+  deferWithTenantDatabaseScope(options.db, scopedParams, () => work(scopedParams), handleError);
+}
+
 // src/utils/session-stop.ts
 init_session_tasks();
 import { shortId as shortId6 } from "@agor/core/db";
@@ -28981,110 +29516,6 @@ function normalizeMessageSource(input, params) {
   return input;
 }
 
-// src/utils/tenant-db-scope.ts
-init_runtime_tokens();
-import {
-  resolveMultiTenancyConfig as resolveMultiTenancyConfig2,
-  resolveTenantContext as resolveTenantContext2,
-  TenantResolutionError as TenantResolutionError2
-} from "@agor/core/config";
-import {
-  enqueueTenantDatabasePostCommitCallback,
-  getCurrentTenantId as getCurrentTenantId2,
-  runWithoutTenantDatabaseScope,
-  runWithTenantDatabaseScope as runWithTenantDatabaseScope3
-} from "@agor/core/db";
-import { NotAuthenticated as NotAuthenticated9 } from "@agor/core/feathers";
-import jwt5 from "jsonwebtoken";
-function readHeaderValue(headers, name) {
-  if (!headers) return null;
-  const wanted = name.toLowerCase();
-  for (const [key, value] of Object.entries(headers)) {
-    if (key.toLowerCase() !== wanted) continue;
-    const raw = Array.isArray(value) ? value[0] : value;
-    return typeof raw === "string" && raw.trim() ? raw.trim() : null;
-  }
-  return null;
-}
-function resolveTenantIdForDeferredScope(params) {
-  const scopedParams = params;
-  return scopedParams?.tenant?.tenant_id ?? getCurrentTenantId2();
-}
-function deferWithTenantDatabaseScope(db, params, work, onError) {
-  const tenantId = resolveTenantIdForDeferredScope(params);
-  if (!tenantId) {
-    const error51 = new Error("Missing tenant context for deferred tenant-scoped work");
-    if (onError) {
-      onError(error51);
-    } else {
-      console.error("[tenant-db-scope] Deferred tenant-scoped work skipped:", error51);
-    }
-    return;
-  }
-  const schedule = () => {
-    runWithoutTenantDatabaseScope(() => {
-      setImmediate(() => {
-        void runWithTenantDatabaseScope3(db, tenantId, work).catch((error51) => {
-          if (onError) {
-            onError(error51);
-            return;
-          }
-          console.error("[tenant-db-scope] Deferred tenant-scoped work failed:", error51);
-        });
-      });
-    });
-  };
-  if (enqueueTenantDatabasePostCommitCallback(async () => schedule())) {
-    return;
-  }
-  schedule();
-}
-function createTenantDatabaseScopeAroundHook(options) {
-  const multiTenancy = resolveMultiTenancyConfig2(options.config);
-  const bearerPayloadFromHeaders = (headers) => {
-    const authorization = readHeaderValue(headers, "authorization");
-    const match = authorization?.match(/^Bearer\s+(.+)$/i);
-    if (!match || !options.jwtSecret) return void 0;
-    try {
-      return jwt5.verify(match[1], options.jwtSecret, {
-        issuer: RUNTIME_JWT_ISSUER,
-        audience: RUNTIME_JWT_AUDIENCE
-      });
-    } catch {
-      return void 0;
-    }
-  };
-  const resolveTenantForDatabaseScope = (context) => {
-    const params = context.params;
-    const connectionTenant = params.connection?.tenant ?? params.connection?.data?.tenant;
-    const paramsWithConnectionTenant = connectionTenant && typeof connectionTenant === "object" && "tenant_id" in connectionTenant ? { ...params, tenant: params.tenant ?? connectionTenant } : params;
-    try {
-      return resolveTenantContext2(multiTenancy, {
-        params: paramsWithConnectionTenant,
-        authPayload: paramsWithConnectionTenant.authentication?.payload ?? bearerPayloadFromHeaders(paramsWithConnectionTenant.headers),
-        headers: paramsWithConnectionTenant.headers
-      });
-    } catch (error51) {
-      const inheritedTenantId = getCurrentTenantId2();
-      if (error51 instanceof TenantResolutionError2 && inheritedTenantId) {
-        return { tenant_id: inheritedTenantId, source: "explicit" };
-      }
-      throw error51;
-    }
-  };
-  return async (context, next) => {
-    try {
-      context.params.tenant = resolveTenantForDatabaseScope(context);
-    } catch (error51) {
-      if (error51 instanceof TenantResolutionError2) {
-        throw new NotAuthenticated9(error51.message);
-      }
-      throw error51;
-    }
-    await runWithTenantDatabaseScope3(options.db, context.params.tenant?.tenant_id, next);
-  };
-}
-
 // src/utils/upload.ts
 import fs from "fs/promises";
 import path from "path";
@@ -29307,6 +29738,14 @@ async function doResolveWidget(widgetId, action, caller, deps) {
   const entry = getWidget(widget.widget_type);
   let resultMeta;
   let autoResumePrompt;
+  const ctx = {
+    // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
+    app: deps.app,
+    sessionId: message.session_id,
+    submitterUserId: caller.user_id,
+    submitterRole: caller.role,
+    sessionCreatorUserId: session.created_by
+  };
   if (action.kind === "submit") {
     if (!entry) {
       throw new NotFound3(
@@ -29318,18 +29757,13 @@ async function doResolveWidget(widgetId, action, caller, deps) {
       throw new Forbidden9(`Invalid submit payload: ${parsed.error.message}`);
     }
     const submit = parsed.data;
-    const submitCtx = {
-      // biome-ignore lint/suspicious/noExplicitAny: Pass-through Feathers Application
-      app: deps.app,
-      sessionId: message.session_id,
-      submitterUserId: caller.user_id,
-      submitterRole: caller.role,
-      sessionCreatorUserId: session.created_by
-    };
-    await entry.applySubmit(submitCtx, submit, widget.params);
+    await entry.applySubmit(ctx, submit, widget.params);
     resultMeta = entry.buildResultMeta(submit);
     autoResumePrompt = entry.buildAutoResumePrompt(resultMeta, widget.params);
   } else {
+    if (entry?.authorizeDismiss) {
+      await entry.authorizeDismiss(ctx, widget.params);
+    }
     autoResumePrompt = entry ? entry.buildDismissedPrompt(widget.params) : `[Agor] User dismissed a widget request. Do not re-request immediately \u2014 ask whether to proceed without, or move on to other work.`;
   }
   const newStatus = action.kind === "submit" ? "submitted" : "dismissed";
@@ -29462,7 +29896,7 @@ async function registerRoutes(ctx) {
   const appRecord = app;
   const sessionTokenService = appRecord.sessionTokenService;
   const authStrategiesArray = ["api-key", "jwt", "local"];
-  const multiTenancy = resolveMultiTenancyConfig4(config2);
+  const multiTenancy = resolveMultiTenancyConfig5(config2);
   const tenantTokenClaim = multiTenancy.auth_claim ?? "tenant_id";
   if (sessionTokenService) {
     authStrategiesArray.push("session-token");
@@ -29527,32 +29961,13 @@ async function registerRoutes(ctx) {
   authService.hooks({
     after: {
       create: [
-        // biome-ignore lint/suspicious/noExplicitAny: FeathersJS context type not fully typed
-        async (context) => {
-          authEventDebug("\u2705 Authentication succeeded:", {
-            strategy: context.result?.authentication?.strategy,
-            hasUser: !!context.result?.user,
-            user_id: context.result?.user?.user_id,
-            hasAccessToken: !!context.result?.accessToken
-          });
-          if (context.result?.user) {
-            const tenantId = context.params?.tenant?.tenant_id ?? context.result.user.tenant_id;
-            const tokens = issueRuntimeTokenPair(
-              context.result.user,
-              jwtSecret,
-              ACCESS_TOKEN_TTL,
-              REFRESH_TOKEN_TTL,
-              {
-                ...authTokenIssuedAtClaim(Date.now(), context.result.user),
-                ...runtimeTenantClaims(tenantId, tenantTokenClaim)
-              }
-            );
-            context.result.accessToken = tokens.accessToken;
-            context.result.refreshToken = tokens.refreshToken;
-            context.result.user = redactUserAuthMetadata(context.result.user);
-          }
-          return context;
-        }
+        createIssueBrowserTokensHook({
+          jwtSecret,
+          accessTokenTtl: ACCESS_TOKEN_TTL,
+          refreshTokenTtl: REFRESH_TOKEN_TTL,
+          tenantClaim: tenantTokenClaim,
+          debug: authEventDebug
+        })
       ]
     }
   });
@@ -29596,12 +30011,12 @@ async function registerRoutes(ctx) {
         throw new NotAuthenticated12("Authentication required");
       }
       const caller = authParams.user;
-      if (!hasMinimumRole9(caller.role, ROLES11.SUPERADMIN)) {
-        throw new Forbidden10("Superadmin role required for impersonation");
+      if (!hasMinimumRole11(caller.role, ROLES13.SUPERADMIN)) {
+        throw new Forbidden11("Superadmin role required for impersonation");
       }
       const authPayload = authParams.authentication?.payload;
       if (authPayload?.is_impersonated === true) {
-        throw new Forbidden10("Cannot impersonate from an already-impersonated token");
+        throw new Forbidden11("Cannot impersonate from an already-impersonated token");
       }
       if (!data?.user_id) {
         throw new BadRequest5("user_id is required");
@@ -29682,7 +30097,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "create messages" }
+      create: { role: ROLES13.MEMBER, action: "create messages" }
     },
     requireAuth
   );
@@ -29704,7 +30119,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "broadcast streaming events" }
+      create: { role: ROLES13.MEMBER, action: "broadcast streaming events" }
     },
     requireAuth
   );
@@ -29732,10 +30147,12 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "broadcast task streaming events" }
+      create: { role: ROLES13.MEMBER, action: "broadcast task streaming events" }
     },
     requireAuth
   );
+  app.service("/messages/streaming").publish(() => []);
+  app.service("/tasks/streaming").publish(() => []);
   registerAuthenticatedRoute2(
     app,
     "/sessions/:id/fork",
@@ -29754,7 +30171,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "fork sessions" }
+      create: { role: ROLES13.MEMBER, action: "fork sessions" }
     },
     requireAuth
   );
@@ -29776,7 +30193,7 @@ async function registerRoutes(ctx) {
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "spawn sessions" }
+      create: { role: ROLES13.MEMBER, action: "spawn sessions" }
     },
     requireAuth
   );
@@ -29792,7 +30209,7 @@ async function registerRoutes(ctx) {
       // biome-ignore lint/suspicious/noExplicitAny: FeathersJS route handler type mismatch with Express RouteParams
     },
     {
-      find: { role: ROLES11.MEMBER, action: "view session genealogy" }
+      find: { role: ROLES13.MEMBER, action: "view session genealogy" }
     },
     requireAuth
   );
@@ -29816,7 +30233,7 @@ async function registerRoutes(ctx) {
           callerRole: params.user?.role,
           sessionCreatedBy: session.created_by
         })) {
-          throw new Forbidden10("You can only restart Claude CLI sessions you created.");
+          throw new Forbidden11("You can only restart Claude CLI sessions you created.");
         }
         const tabName = `cli-${shortId14(session.session_id)}`;
         const channel = `user/${targetUserId}/terminal`;
@@ -29867,7 +30284,7 @@ async function registerRoutes(ctx) {
       // biome-ignore lint/suspicious/noExplicitAny: FeathersJS route handler type mismatch
     },
     {
-      create: { role: ROLES11.MEMBER, action: "restart claude CLI session" }
+      create: { role: ROLES13.MEMBER, action: "restart claude CLI session" }
     },
     requireAuth
   );
@@ -30213,7 +30630,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "execute prompts" }
+      create: { role: ROLES13.MEMBER, action: "execute prompts" }
     },
     requireAuth
   );
@@ -30243,7 +30660,7 @@ ${errorMessage}`;
           } else {
             const userId = params.user?.user_id;
             if (!userId) {
-              throw new Forbidden10("Authentication required to run tasks");
+              throw new Forbidden11("Authentication required to run tasks");
             }
             const wt = await branchRepository.findById(session.branch_id);
             if (!wt) {
@@ -30261,7 +30678,7 @@ ${errorMessage}`;
             );
             const canRun = PERMISSION_RANK[effectiveLevel] >= PERMISSION_RANK.prompt || effectiveLevel === "session" && session.created_by === userId;
             if (!canRun) {
-              throw new Forbidden10(
+              throw new Forbidden11(
                 `You have '${effectiveLevel}' permission on this branch, which does not allow running tasks. Need 'prompt' or 'all' (or 'session' for own sessions).`
               );
             }
@@ -30304,7 +30721,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "execute prompts" }
+      create: { role: ROLES13.MEMBER, action: "execute prompts" }
     },
     requireAuth
   );
@@ -30331,7 +30748,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "send spawn-subsession prompts" }
+      create: { role: ROLES13.MEMBER, action: "send spawn-subsession prompts" }
     },
     requireAuth
   );
@@ -30380,7 +30797,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "fire zone triggers" }
+      create: { role: ROLES13.MEMBER, action: "fire zone triggers" }
     },
     requireAuth
   );
@@ -30391,7 +30808,7 @@ ${errorMessage}`;
     try {
       const { sessionId } = req.params;
       const params = req.feathers;
-      ensureMinimumRole(params, ROLES11.MEMBER, "upload files");
+      ensureMinimumRole(params, ROLES13.MEMBER, "upload files");
       const session = await sessionsService.get(sessionId, params);
       if (!session) {
         console.error(`\u274C [Upload Authz] Session not found: ${shortId14(sessionId)}`);
@@ -30635,7 +31052,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "stop sessions" }
+      create: { role: ROLES13.MEMBER, action: "stop sessions" }
     },
     requireAuth
   );
@@ -30656,12 +31073,24 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES11.MEMBER, action: "view queue" }
+      find: { role: ROLES13.MEMBER, action: "view queue" }
     },
     requireAuth
   );
   const queueRetryScheduled = /* @__PURE__ */ new Set();
   async function processNextQueuedTask(sessionId, params) {
+    await runWithSessionQueueTenantScope(
+      {
+        db,
+        config: config2,
+        sessionId,
+        params,
+        label: "processNextQueuedTask"
+      },
+      async (scopedParams) => processNextQueuedTaskInTenantScope(sessionId, scopedParams)
+    );
+  }
+  async function processNextQueuedTaskInTenantScope(sessionId, params) {
     const existingLock = sessionTurnLocks.get(sessionId);
     if (existingLock) {
       console.log(`\u23F3 [Queue] Session turn in progress for ${shortId14(sessionId)}, waiting...`);
@@ -30680,14 +31109,27 @@ ${errorMessage}`;
       }
       if (!queueRetryScheduled.has(sessionId)) {
         queueRetryScheduled.add(sessionId);
-        deferInFreshTenantScope(params, async () => {
-          queueRetryScheduled.delete(sessionId);
-          try {
-            await processNextQueuedTask(sessionId, params);
-          } catch (error51) {
+        deferWithSessionQueueTenantScope(
+          {
+            db,
+            config: config2,
+            sessionId,
+            params,
+            label: "processNextQueuedTask retry"
+          },
+          async (retryParams) => {
+            queueRetryScheduled.delete(sessionId);
+            try {
+              await processNextQueuedTask(sessionId, retryParams);
+            } catch (error51) {
+              console.error(`\u274C [Queue] Retry failed for session ${shortId14(sessionId)}:`, error51);
+            }
+          },
+          (error51) => {
+            queueRetryScheduled.delete(sessionId);
             console.error(`\u274C [Queue] Retry failed for session ${shortId14(sessionId)}:`, error51);
           }
-        });
+        );
       } else {
         console.log(
           `\u23ED\uFE0F  [Queue] Retry already scheduled for session ${shortId14(sessionId)}, not queueing another`
@@ -30842,7 +31284,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "respond to permission requests" }
+      create: { role: ROLES13.MEMBER, action: "respond to permission requests" }
     },
     requireAuth
   );
@@ -30871,7 +31313,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "submit widgets" }
+      create: { role: ROLES13.MEMBER, action: "submit widgets" }
     },
     requireAuth
   );
@@ -30894,7 +31336,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "dismiss widgets" }
+      create: { role: ROLES13.MEMBER, action: "dismiss widgets" }
     },
     requireAuth
   );
@@ -30907,7 +31349,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "create tasks" }
+      create: { role: ROLES13.MEMBER, action: "create tasks" }
     },
     requireAuth
   );
@@ -30922,7 +31364,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "complete tasks" }
+      create: { role: ROLES13.MEMBER, action: "complete tasks" }
     },
     requireAuth
   );
@@ -30937,7 +31379,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "fail tasks" }
+      create: { role: ROLES13.MEMBER, action: "fail tasks" }
     },
     requireAuth
   );
@@ -30950,7 +31392,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "add local repositories" }
+      create: { role: ROLES13.MEMBER, action: "add local repositories" }
     },
     requireAuth
   );
@@ -30963,7 +31405,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "clone repositories" }
+      create: { role: ROLES13.MEMBER, action: "clone repositories" }
     },
     requireAuth
   );
@@ -30982,7 +31424,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.MEMBER, action: "create branches" }
+      create: { role: ROLES13.MEMBER, action: "create branches" }
     },
     requireAuth
   );
@@ -30999,7 +31441,7 @@ ${errorMessage}`;
       }
     },
     {
-      remove: { role: ROLES11.MEMBER, action: "remove branches" }
+      remove: { role: ROLES13.MEMBER, action: "remove branches" }
     },
     requireAuth
   );
@@ -31015,7 +31457,7 @@ ${errorMessage}`;
       }
     },
     {
-      create: { role: ROLES11.ADMIN, action: "import environment config from .agor.yml" }
+      create: { role: ROLES13.ADMIN, action: "import environment config from .agor.yml" }
     },
     requireAuth
   );
@@ -31034,7 +31476,7 @@ ${errorMessage}`;
       // Admin-only, matching Import and repo.environment edit. Export writes a
       // file to the branch working tree, so even though the content is
       // derivable, the side effect warrants the same permission bar as import.
-      create: { role: ROLES11.ADMIN, action: "export .agor.yml" }
+      create: { role: ROLES13.ADMIN, action: "export .agor.yml" }
     },
     requireAuth
   );
@@ -31059,10 +31501,10 @@ ${errorMessage}`;
       }
     },
     {
-      find: { role: ROLES11.MEMBER, action: "list API keys" },
-      create: { role: ROLES11.MEMBER, action: "create API keys" },
-      patch: { role: ROLES11.MEMBER, action: "update API keys" },
-      remove: { role: ROLES11.MEMBER, action: "delete API keys" }
+      find: { role: ROLES13.MEMBER, action: "list API keys" },
+      create: { role: ROLES13.MEMBER, action: "create API keys" },
+      patch: { role: ROLES13.MEMBER, action: "update API keys" },
+      remove: { role: ROLES13.MEMBER, action: "delete API keys" }
     },
     requireAuth
   );
@@ -31083,7 +31525,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES11.MEMBER, action: "react to board comments" }
+        create: { role: ROLES13.MEMBER, action: "react to board comments" }
       },
       requireAuth
     );
@@ -31105,7 +31547,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES11.MEMBER, action: "reply to board comments" }
+        create: { role: ROLES13.MEMBER, action: "reply to board comments" }
       },
       requireAuth
     );
@@ -31124,7 +31566,7 @@ ${errorMessage}`;
       // Branch `all`/admin control is enforced at the service layer. This
       // route-level gate is just "authenticated" so the service remains
       // the single source of truth across REST, WebSocket, and MCP.
-      create: { role: ROLES11.VIEWER, action: "start branch environments" }
+      create: { role: ROLES13.VIEWER, action: "start branch environments" }
     },
     requireAuth
   );
@@ -31140,7 +31582,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES11.VIEWER, action: "stop branch environments" }
+      create: { role: ROLES13.VIEWER, action: "stop branch environments" }
     },
     requireAuth
   );
@@ -31159,7 +31601,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES11.VIEWER, action: "restart branch environments" }
+      create: { role: ROLES13.VIEWER, action: "restart branch environments" }
     },
     requireAuth
   );
@@ -31175,7 +31617,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES11.VIEWER, action: "nuke branch environments" }
+      create: { role: ROLES13.VIEWER, action: "nuke branch environments" }
     },
     requireAuth
   );
@@ -31195,7 +31637,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      create: { role: ROLES11.VIEWER, action: "render branch environment" }
+      create: { role: ROLES13.VIEWER, action: "render branch environment" }
     },
     requireAuth
   );
@@ -31211,7 +31653,7 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES11.VIEWER, action: "check branch health" }
+      find: { role: ROLES13.VIEWER, action: "check branch health" }
     },
     requireAuth
   );
@@ -31231,13 +31673,13 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES11.MEMBER, "archive or delete branches"),
+        requireMinimumRole(ROLES13.MEMBER, "archive or delete branches"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new Error("Branch ID required");
           const branch = await branchRepository.findById(id);
           if (!branch) {
-            throw new Forbidden10(`Branch not found: ${id}`);
+            throw new Forbidden11(`Branch not found: ${id}`);
           }
           await cacheBranchAccess(context.params, branchRepository, branch);
           return context;
@@ -31245,8 +31687,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "archive or delete branches", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole9(userRole, ROLES11.ADMIN)) {
-            throw new Forbidden10(
+          if (!isOwner && !hasMinimumRole11(userRole, ROLES13.ADMIN)) {
+            throw new Forbidden11(
               "You must be the branch owner or a global admin to archive/delete branches"
             );
           }
@@ -31267,13 +31709,13 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES11.MEMBER, "unarchive branches"),
+        requireMinimumRole(ROLES13.MEMBER, "unarchive branches"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new Error("Branch ID required");
           const branch = await branchRepository.findById(id);
           if (!branch) {
-            throw new Forbidden10(`Branch not found: ${id}`);
+            throw new Forbidden11(`Branch not found: ${id}`);
           }
           await cacheBranchAccess(context.params, branchRepository, branch);
           return context;
@@ -31281,8 +31723,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "unarchive branches", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole9(userRole, ROLES11.ADMIN)) {
-            throw new Forbidden10(
+          if (!isOwner && !hasMinimumRole11(userRole, ROLES13.ADMIN)) {
+            throw new Forbidden11(
               "You must be the branch owner or a global admin to unarchive branches"
             );
           }
@@ -31332,7 +31774,7 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES11.MEMBER, "run schedule"),
+        requireMinimumRole(ROLES13.MEMBER, "run schedule"),
         // Reuse the canonical hook so caching semantics (params.schedule
         // / params.branch / params.isBranchOwner) match every other
         // schedule-touching path.
@@ -31341,8 +31783,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "run schedule", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole9(userRole, ROLES11.ADMIN)) {
-            throw new Forbidden10(
+          if (!isOwner && !hasMinimumRole11(userRole, ROLES13.ADMIN)) {
+            throw new Forbidden11(
               "You must be the branch owner or a global admin to run schedules"
             );
           }
@@ -31406,7 +31848,7 @@ ${errorMessage}`;
     before: {
       create: [
         requireAuth,
-        requireMinimumRole(ROLES11.MEMBER, "execute scheduled runs"),
+        requireMinimumRole(ROLES13.MEMBER, "execute scheduled runs"),
         async (context) => {
           const id = context.params.route?.id;
           if (!id) throw new BadRequest5("Branch ID required");
@@ -31420,8 +31862,8 @@ ${errorMessage}`;
         branchRbacEnabled ? ensureBranchPermission("all", "execute scheduled runs", superadminOpts) : (context) => {
           const isOwner = context.params.isBranchOwner;
           const userRole = context.params.user?.role;
-          if (!isOwner && !hasMinimumRole9(userRole, ROLES11.ADMIN)) {
-            throw new Forbidden10(
+          if (!isOwner && !hasMinimumRole11(userRole, ROLES13.ADMIN)) {
+            throw new Forbidden11(
               "You must be the branch owner or a global admin to execute scheduled runs"
             );
           }
@@ -31445,7 +31887,7 @@ ${errorMessage}`;
     },
     {
       // Branch `all`/admin control is enforced at the service layer.
-      find: { role: ROLES11.VIEWER, action: "view branch logs" }
+      find: { role: ROLES13.VIEWER, action: "view branch logs" }
     },
     requireAuth
   );
@@ -31462,7 +31904,7 @@ ${errorMessage}`;
         }
       },
       {
-        create: { role: ROLES11.MEMBER, action: "modify board sessions" }
+        create: { role: ROLES13.MEMBER, action: "modify board sessions" }
       },
       requireAuth
     );
@@ -31492,7 +31934,15 @@ ${errorMessage}`;
           const includeGlobal = params.query?.includeGlobal === "true" || params.query?.includeGlobal === true;
           const includeMetadata = params.query?.includeMetadata === "true" || params.query?.includeMetadata === true;
           const mcpService = app.service("mcp-servers");
-          const userId = params.user?.user_id;
+          const queryForUserId = typeof params.query?.forUserId === "string" ? params.query.forUserId : void 0;
+          const authPayloadType = params.authentication?.payload?.type;
+          const routeUser = params.user;
+          const userId = resolveForUserIdWithGate({
+            queryForUserId,
+            isServiceAccount: routeUser?._isServiceAccount,
+            authPayloadType,
+            callerUserId: params.user?.user_id
+          });
           const rawLookupParams = {
             ...params,
             provider: void 0,
@@ -31627,10 +32077,10 @@ ${errorMessage}`;
         // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
       },
       {
-        find: { role: ROLES11.MEMBER, action: "view session MCP servers" },
-        create: { role: ROLES11.MEMBER, action: "modify session MCP servers" },
-        remove: { role: ROLES11.MEMBER, action: "modify session MCP servers" },
-        patch: { role: ROLES11.MEMBER, action: "modify session MCP servers" }
+        find: { role: ROLES13.MEMBER, action: "view session MCP servers" },
+        create: { role: ROLES13.MEMBER, action: "modify session MCP servers" },
+        remove: { role: ROLES13.MEMBER, action: "modify session MCP servers" },
+        patch: { role: ROLES13.MEMBER, action: "modify session MCP servers" }
       },
       requireAuth
     );
@@ -31719,10 +32169,10 @@ ${errorMessage}`;
       // biome-ignore lint/suspicious/noExplicitAny: Service type not compatible with Express
     },
     {
-      find: { role: ROLES11.MEMBER, action: "view session env selections" },
-      create: { role: ROLES11.MEMBER, action: "modify session env selections" },
-      remove: { role: ROLES11.MEMBER, action: "modify session env selections" },
-      patch: { role: ROLES11.MEMBER, action: "modify session env selections" }
+      find: { role: ROLES13.MEMBER, action: "view session env selections" },
+      create: { role: ROLES13.MEMBER, action: "modify session env selections" },
+      remove: { role: ROLES13.MEMBER, action: "modify session env selections" },
+      patch: { role: ROLES13.MEMBER, action: "modify session env selections" }
     },
     requireAuth
   );