agor-live 0.23.1 → 0.23.2

package/dist/core/db/index.js

@@ -768,6 +768,21 @@ var init_file = __esm({
 });
 
 // src/types/gateway.ts
+function getRequiredSecretFields(channelType, config) {
+  switch (channelType) {
+    case "slack": {
+      const wantsInbound = config.connection_mode === "socket" || config.enable_channels === true || config.enable_groups === true || config.enable_mpim === true;
+      const outboundOnly = config.outbound_enabled === true && !wantsInbound;
+      return outboundOnly ? ["bot_token"] : ["bot_token", "app_token"];
+    }
+    case "github":
+      return ["private_key"];
+    case "teams":
+      return ["app_password"];
+    default:
+      return [];
+  }
+}
 var GATEWAY_SENSITIVE_CONFIG_FIELDS, GATEWAY_REDACTED_SENTINEL;
 var init_gateway = __esm({
   "src/types/gateway.ts"() {
@@ -4879,7 +4894,7 @@ import {
   asc as asc3,
   count,
   desc as desc6,
-  eq as eq32,
+  eq as eq33,
   gt,
   gte,
   inArray as inArray11,
@@ -8038,6 +8053,63 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find non-archived branches whose explicit filesystem access set can change
+   * when membership in the given group changes.
+   *
+   * Keep this inverse lookup in lockstep with findExplicitFsAccessUserIds():
+   * both encode which group grants materialize into branch-folder access.
+   * App-only grants (`fs_access = 'none'`) are intentionally excluded because
+   * membership changes for those grants do not require branch-folder mutation.
+   */
+  async findExplicitFsAccessBranchIdsForGroup(groupId) {
+    const directRows = await select(this.db, { branch_id: branchGroupGrants3.branch_id }).from(branchGroupGrants3).innerJoin(branches3, eq11(branches3.branch_id, branchGroupGrants3.branch_id)).innerJoin(
+      groups3,
+      and11(eq11(groups3.group_id, branchGroupGrants3.group_id), eq11(groups3.archived, false))
+    ).where(
+      and11(
+        eq11(branchGroupGrants3.group_id, groupId),
+        eq11(branches3.archived, false),
+        inArray4(
+          sql9`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const boardRows = await select(this.db, { branch_id: branches3.branch_id }).from(boardGroupGrants3).innerJoin(
+      groups3,
+      and11(eq11(groups3.group_id, boardGroupGrants3.group_id), eq11(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      and11(
+        eq11(boards3.board_id, boardGroupGrants3.board_id),
+        eq11(sql9`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      )
+    ).innerJoin(
+      branches3,
+      and11(
+        eq11(branches3.board_id, boardGroupGrants3.board_id),
+        eq11(branches3.permission_source, "board"),
+        eq11(branches3.archived, false)
+      )
+    ).where(
+      and11(
+        eq11(boardGroupGrants3.group_id, groupId),
+        inArray4(
+          sql9`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const branchIds = /* @__PURE__ */ new Set();
+    for (const row of directRows) {
+      branchIds.add(row.branch_id);
+    }
+    for (const row of boardRows) {
+      branchIds.add(row.branch_id);
+    }
+    return Array.from(branchIds);
+  }
   async findBoardAlignedBranches(boardId) {
     const rows = await select(this.db).from(branches3).where(
       and11(
@@ -9045,6 +9117,60 @@ var BoardRepository = class {
       );
     }
   }
+  /**
+   * Shallow-merge field patches into existing board objects in a single
+   * read-modify-write.
+   *
+   * Unlike upsertBoardObject (which fully replaces the object value, dropping
+   * omitted fields), this overwrites ONLY the provided keys and leaves the rest
+   * of each object intact — so a narrow change (e.g. a zIndex reorder) has a
+   * smaller blast radius and won't clobber a field edited via a different patch
+   * call. Multiple objects in one call are merged before a single write, so a
+   * forward/backward swap touches both neighbors in one update.
+   *
+   * Objects that no longer exist are SKIPPED, never re-created — so a swap can't
+   * resurrect a neighbor deleted between the client's read and this write.
+   *
+   * Only an explicit allowlist of fields can be merged (currently just `zIndex`,
+   * which is also clamped into the board-object band [1, 499] so it can never be
+   * pushed onto the card (500) / comment (1000) layers). Any other key in a
+   * patch is ignored, so this narrow action cannot reshape an object (e.g. flip
+   * its `type`) the way a full upsert could.
+   *
+   * NOTE: this is NOT atomic against concurrent writers. Like every other board
+   * writer, the findById → update sequence has a lost-update window: a write
+   * that lands between the read and the update can be overwritten (last-write-
+   * wins). Merging only the patched keys narrows that window's blast radius
+   * versus a full-object upsert, but does not close it.
+   */
+  async mergeBoardObjectFields(boardId, patches) {
+    const Z_MIN = 1;
+    const Z_MAX = 499;
+    try {
+      const fullId = await this.resolveId(boardId);
+      const current = await this.findById(fullId);
+      if (!current) {
+        throw new EntityNotFoundError("Board", boardId);
+      }
+      const updatedObjects = { ...current.objects || {} };
+      for (const [objectId, fields] of Object.entries(patches)) {
+        const existing = updatedObjects[objectId];
+        if (!existing) continue;
+        const { zIndex } = fields;
+        if (typeof zIndex !== "number" || !Number.isFinite(zIndex)) continue;
+        const safeZIndex = Math.min(Z_MAX, Math.max(Z_MIN, zIndex));
+        updatedObjects[objectId] = { ...existing, zIndex: safeZIndex };
+      }
+      return this.update(fullId, { objects: updatedObjects });
+    } catch (error) {
+      if (error instanceof RepositoryError) throw error;
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to merge board object fields: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * DEPRECATED: Delete a zone and handle associated sessions
    * TODO: Reimplement using board-objects table
@@ -9779,6 +9905,28 @@ var GatewayChannelRepository = class {
       agentic_config: encryptedAgenticConfig
     };
   }
+  /**
+   * Enforce the "enabled requires secrets" invariant on every write path.
+   *
+   * An enabled channel can never exist without the secrets its type needs to
+   * function. Runs on the post-merge, decrypted config so a patch that only
+   * flips `enabled: true` on a channel with already-stored tokens passes.
+   * Disabled ("draft") channels are exempt.
+   */
+  assertRequiredSecretsWhenEnabled(channel) {
+    if (channel.enabled === false) return;
+    const channelType = channel.channel_type ?? "slack";
+    const config = channel.config ?? {};
+    const missing = getRequiredSecretFields(channelType, config).filter((field) => {
+      const value = config[field];
+      return typeof value !== "string" || value.trim() === "" || value === GATEWAY_REDACTED_SENTINEL;
+    });
+    if (missing.length > 0) {
+      throw new RepositoryError(
+        `Cannot enable ${channelType} gateway channel: missing required secret(s) ${missing.join(", ")}`
+      );
+    }
+  }
   /**
    * Resolve short ID to full ID
    */
@@ -9810,6 +9958,7 @@ var GatewayChannelRepository = class {
         id: data.id ?? generateId(),
         channel_key: data.channel_key ?? generateId()
       });
+      this.assertRequiredSecretsWhenEnabled(data);
       await insert(this.db, gatewayChannels3).values(insertData).run();
       const row = await select(this.db).from(gatewayChannels3).where(eq15(gatewayChannels3.id, insertData.id)).one();
       if (!row) {
@@ -9876,6 +10025,7 @@ var GatewayChannelRepository = class {
         }
         merged.config = mergedConfig;
       }
+      this.assertRequiredSecretsWhenEnabled(merged);
       const insertData = this.channelToInsert(merged);
       await update(this.db, gatewayChannels3).set({
         name: insertData.name,
@@ -11385,11 +11535,164 @@ var KnowledgeGraphRepository = class {
 // src/db/repositories/mcp-servers.ts
 init_esm_shims();
 init_ids();
-import { and as and16, eq as eq18, like as like10 } from "drizzle-orm";
+import { and as and17, eq as eq20, like as like10 } from "drizzle-orm";
 
 // src/tools/mcp/auth-secrets.ts
 init_esm_shims();
 
+// src/mcp/template-resolver.ts
+init_esm_shims();
+
+// src/config/env-resolver.ts
+init_esm_shims();
+init_database_wrapper();
+import { eq as eq19 } from "drizzle-orm";
+
+// src/db/repositories/session-env-selections.ts
+init_esm_shims();
+init_database_wrapper();
+init_schema();
+import { and as and16, eq as eq18 } from "drizzle-orm";
+var SessionEnvSelectionRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  /** Shared SELECT for a session's rows — single source of truth for reads. */
+  async fetchRows(sessionId) {
+    try {
+      return await select(this.db).from(sessionEnvSelections3).where(eq18(sessionEnvSelections3.session_id, sessionId)).all();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to list session env selections: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** List selected env var names for a session (not hydrated). */
+  async listNames(sessionId) {
+    const rows = await this.fetchRows(sessionId);
+    return rows.map((r) => r.env_var_name);
+  }
+  /** Return a Set for fast membership checks in the env resolver. */
+  async asSet(sessionId) {
+    const names = await this.listNames(sessionId);
+    return new Set(names);
+  }
+  /** Full rows with timestamps — for the REST API response. */
+  async list(sessionId) {
+    const rows = await this.fetchRows(sessionId);
+    return rows.map((r) => ({
+      session_id: r.session_id,
+      env_var_name: r.env_var_name,
+      created_at: new Date(r.created_at)
+    }));
+  }
+  /** Add a selection. No-op if it already exists. */
+  async add(sessionId, envVarName) {
+    try {
+      const existing = await select(this.db).from(sessionEnvSelections3).where(
+        and16(
+          eq18(sessionEnvSelections3.session_id, sessionId),
+          eq18(sessionEnvSelections3.env_var_name, envVarName)
+        )
+      ).one();
+      if (existing) return;
+      await insert(this.db, sessionEnvSelections3).values({
+        session_id: sessionId,
+        env_var_name: envVarName,
+        created_at: /* @__PURE__ */ new Date()
+      }).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to add session env selection: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** Remove a selection. No-op if it doesn't exist. */
+  async remove(sessionId, envVarName) {
+    try {
+      await deleteFrom(this.db, sessionEnvSelections3).where(
+        and16(
+          eq18(sessionEnvSelections3.session_id, sessionId),
+          eq18(sessionEnvSelections3.env_var_name, envVarName)
+        )
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to remove session env selection: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+  /** Bulk replace — deletes all existing rows, inserts the new set. */
+  async setAll(sessionId, envVarNames) {
+    try {
+      await deleteFrom(this.db, sessionEnvSelections3).where(eq18(sessionEnvSelections3.session_id, sessionId)).run();
+      if (envVarNames.length === 0) return;
+      const now = /* @__PURE__ */ new Date();
+      await insert(this.db, sessionEnvSelections3).values(
+        envVarNames.map((name) => ({
+          session_id: sessionId,
+          env_var_name: name,
+          created_at: now
+        }))
+      ).run();
+    } catch (error) {
+      throw new RepositoryError(
+        `Failed to set session env selections: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
+};
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_esm_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_esm_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+function normalizeStoredEnvVar(raw) {
+  if (typeof raw === "string") {
+    return { value_encrypted: raw, scope: "global" };
+  }
+  return {
+    value_encrypted: raw.value_encrypted,
+    scope: raw.scope,
+    resource_id: raw.resource_id ?? null,
+    extra_config: raw.extra_config ?? null
+  };
+}
+function normalizeStoredEnvMap(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const [key, value] of Object.entries(raw)) {
+    try {
+      out[key] = normalizeStoredEnvVar(value);
+    } catch (err) {
+      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
+    }
+  }
+  return out;
+}
+
+// src/templates/handlebars-helpers.ts
+init_esm_shims();
+import Handlebars from "handlebars";
+
+// src/mcp/template-patterns.ts
+init_esm_shims();
+
 // src/tools/mcp/http-headers.ts
 init_esm_shims();
 var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
@@ -11551,7 +11854,7 @@ var MCPServerRepository = class {
     try {
       const insertData = this.mcpServerToInsert(data);
       await insert(this.db, mcpServers3).values(insertData).run();
-      const row = await select(this.db).from(mcpServers3).where(eq18(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
+      const row = await select(this.db).from(mcpServers3).where(eq20(mcpServers3.mcp_server_id, insertData.mcp_server_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created MCP server");
       }
@@ -11570,7 +11873,7 @@ var MCPServerRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(mcpServers3).where(eq18(mcpServers3.mcp_server_id, fullId)).one();
+      const row = await select(this.db).from(mcpServers3).where(eq20(mcpServers3.mcp_server_id, fullId)).one();
       return row ? this.rowToMCPServer(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -11589,24 +11892,24 @@ var MCPServerRepository = class {
       let query = select(this.db).from(mcpServers3);
       const conditions = [];
       if (filters?.scope) {
-        conditions.push(eq18(mcpServers3.scope, filters.scope));
+        conditions.push(eq20(mcpServers3.scope, filters.scope));
       }
       if (filters?.scopeId) {
         if (filters.scope === "global") {
-          conditions.push(eq18(mcpServers3.owner_user_id, filters.scopeId));
+          conditions.push(eq20(mcpServers3.owner_user_id, filters.scopeId));
         }
       }
       if (filters?.transport) {
-        conditions.push(eq18(mcpServers3.transport, filters.transport));
+        conditions.push(eq20(mcpServers3.transport, filters.transport));
       }
       if (filters?.enabled !== void 0) {
-        conditions.push(eq18(mcpServers3.enabled, filters.enabled));
+        conditions.push(eq20(mcpServers3.enabled, filters.enabled));
       }
       if (filters?.source) {
-        conditions.push(eq18(mcpServers3.source, filters.source));
+        conditions.push(eq20(mcpServers3.source, filters.source));
       }
       if (conditions.length > 0) {
-        query = query.where(and16(...conditions));
+        query = query.where(and17(...conditions));
       }
       const rows = await query.all();
       return rows.map((row) => this.rowToMCPServer(row));
@@ -11653,7 +11956,7 @@ var MCPServerRepository = class {
         transport: insertData.transport,
         updated_at: /* @__PURE__ */ new Date(),
         data: insertData.data
-      }).where(eq18(mcpServers3.mcp_server_id, fullId)).run();
+      }).where(eq20(mcpServers3.mcp_server_id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated MCP server");
@@ -11674,7 +11977,7 @@ var MCPServerRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, mcpServers3).where(eq18(mcpServers3.mcp_server_id, fullId)).run();
+      const result = await deleteFrom(this.db, mcpServers3).where(eq20(mcpServers3.mcp_server_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("MCPServer", id);
       }
@@ -11706,7 +12009,7 @@ var MCPServerRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and17, eq as eq19, inArray as inArray7 } from "drizzle-orm";
+import { and as and18, eq as eq21, inArray as inArray7 } from "drizzle-orm";
 var MessagesRepository = class {
   constructor(db) {
     this.db = db;
@@ -11772,7 +12075,7 @@ var MessagesRepository = class {
    * Get message by ID
    */
   async findById(messageId) {
-    const row = await select(this.db).from(messages3).where(eq19(messages3.message_id, messageId)).one();
+    const row = await select(this.db).from(messages3).where(eq21(messages3.message_id, messageId)).one();
     return row ? this.rowToMessage(row) : null;
   }
   /**
@@ -11781,19 +12084,19 @@ var MessagesRepository = class {
   async findAll(filter) {
     if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
     const conditions = [];
-    if (filter?.sessionId) conditions.push(eq19(messages3.session_id, filter.sessionId));
+    if (filter?.sessionId) conditions.push(eq21(messages3.session_id, filter.sessionId));
     if (filter?.sessionIds !== void 0)
       conditions.push(inArray7(messages3.session_id, filter.sessionIds));
-    if (filter?.taskId) conditions.push(eq19(messages3.task_id, filter.taskId));
-    if (filter?.type) conditions.push(eq19(messages3.type, filter.type));
-    if (filter?.role) conditions.push(eq19(messages3.role, filter.role));
+    if (filter?.taskId) conditions.push(eq21(messages3.task_id, filter.taskId));
+    if (filter?.type) conditions.push(eq21(messages3.type, filter.type));
+    if (filter?.role) conditions.push(eq21(messages3.role, filter.role));
     if (filter?.visibleToUserId) {
       conditions.push(
         visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, messages3.session_id)
       );
     }
     let query = select(this.db).from(messages3);
-    if (conditions.length > 0) query = query.where(and17(...conditions));
+    if (conditions.length > 0) query = query.where(and18(...conditions));
     const rows = await query.orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
@@ -11801,21 +12104,21 @@ var MessagesRepository = class {
    * Get all messages for a session (ordered by index)
    */
   async findBySessionId(sessionId) {
-    const rows = await select(this.db).from(messages3).where(eq19(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq21(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a session filtered by type (ordered by index)
    */
   async findBySessionIdAndType(sessionId, type) {
-    const rows = await select(this.db).from(messages3).where(and17(eq19(messages3.session_id, sessionId), eq19(messages3.type, type))).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(and18(eq21(messages3.session_id, sessionId), eq21(messages3.type, type))).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a task (ordered by index)
    */
   async findByTaskId(taskId) {
-    const rows = await select(this.db).from(messages3).where(eq19(messages3.task_id, taskId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq21(messages3.task_id, taskId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
@@ -11823,7 +12126,7 @@ var MessagesRepository = class {
    * Used for task message_range queries
    */
   async findByRange(sessionId, startIndex, endIndex) {
-    const rows = await select(this.db).from(messages3).where(eq19(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where(eq21(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.filter((r) => r.index >= startIndex && r.index <= endIndex).map((r) => this.rowToMessage(r));
   }
   /**
@@ -11836,33 +12139,33 @@ var MessagesRepository = class {
     }
     const updated = { ...existing, ...updates };
     const row = this.messageToRow(updated);
-    const result = await update(this.db, messages3).set(row).where(eq19(messages3.message_id, messageId)).returning().one();
+    const result = await update(this.db, messages3).set(row).where(eq21(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(result);
   }
   /**
    * Update message task assignment
    */
   async assignToTask(messageId, taskId) {
-    const updated = await update(this.db, messages3).set({ task_id: taskId }).where(eq19(messages3.message_id, messageId)).returning().one();
+    const updated = await update(this.db, messages3).set({ task_id: taskId }).where(eq21(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(updated);
   }
   /**
    * Delete all messages for a session (cascades automatically via FK)
    */
   async deleteBySessionId(sessionId) {
-    await deleteFrom(this.db, messages3).where(eq19(messages3.session_id, sessionId)).run();
+    await deleteFrom(this.db, messages3).where(eq21(messages3.session_id, sessionId)).run();
   }
   /**
    * Delete a single message
    */
   async delete(messageId) {
-    await deleteFrom(this.db, messages3).where(eq19(messages3.message_id, messageId)).run();
+    await deleteFrom(this.db, messages3).where(eq21(messages3.message_id, messageId)).run();
   }
 };
 
 // src/db/repositories/repos.ts
 init_esm_shims();
-import { eq as eq20, like as like11, sql as sql11 } from "drizzle-orm";
+import { eq as eq22, like as like11, sql as sql11 } from "drizzle-orm";
 
 // src/config/variant-resolver.ts
 init_esm_shims();
@@ -12023,7 +12326,7 @@ var RepoRepository = class {
     try {
       const insertData = this.repoToInsert(data);
       await insert(this.db, repos3).values(insertData).run();
-      const row = await select(this.db).from(repos3).where(eq20(repos3.repo_id, insertData.repo_id)).one();
+      const row = await select(this.db).from(repos3).where(eq22(repos3.repo_id, insertData.repo_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created repo");
       }
@@ -12042,7 +12345,7 @@ var RepoRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(repos3).where(eq20(repos3.repo_id, fullId)).one();
+      const row = await select(this.db).from(repos3).where(eq22(repos3.repo_id, fullId)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -12058,7 +12361,7 @@ var RepoRepository = class {
    */
   async findBySlug(slug) {
     try {
-      const row = await select(this.db).from(repos3).where(eq20(repos3.slug, slug)).one();
+      const row = await select(this.db).from(repos3).where(eq22(repos3.slug, slug)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12126,8 +12429,8 @@ var RepoRepository = class {
       let changed = 0;
       for (const finding of scan.findings) {
         await this.db.transaction(async (tx) => {
-          await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq20(repos3.repo_id, finding.repo_id));
-          const currentRow = await select(txAsDb(tx)).from(repos3).where(eq20(repos3.repo_id, finding.repo_id)).one();
+          await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq22(repos3.repo_id, finding.repo_id));
+          const currentRow = await select(txAsDb(tx)).from(repos3).where(eq22(repos3.repo_id, finding.repo_id)).one();
           if (!currentRow) return;
           const data = currentRow.data;
           if (typeof data.remote_url !== "string" || !httpUrlHasUserinfo(data.remote_url)) {
@@ -12139,7 +12442,7 @@ var RepoRepository = class {
               ...data,
               remote_url: stripHttpUrlUserinfo(data.remote_url)
             }
-          }).where(eq20(repos3.repo_id, finding.repo_id)).run();
+          }).where(eq22(repos3.repo_id, finding.repo_id)).run();
           changed += 1;
         });
       }
@@ -12161,8 +12464,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq20(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq20(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq22(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq22(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -12176,7 +12479,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: merged.unix_group ?? null,
           data: insertData.data
-        }).where(eq20(repos3.repo_id, fullId)).run();
+        }).where(eq22(repos3.repo_id, fullId)).run();
         merged.clone_error = insertData.data.clone_error;
         merged.remote_url = insertData.data.remote_url;
         merged.last_updated = newUpdatedAt.toISOString();
@@ -12210,8 +12513,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq20(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq20(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, eq22(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where(eq22(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -12225,7 +12528,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: next.unix_group ?? null,
           data: insertData.data
-        }).where(eq20(repos3.repo_id, fullId)).run();
+        }).where(eq22(repos3.repo_id, fullId)).run();
         next.environment = insertData.data.environment;
         next.environment_config = insertData.data.environment_config;
         next.remote_url = insertData.data.remote_url;
@@ -12265,7 +12568,7 @@ var RepoRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, repos3).where(eq20(repos3.repo_id, fullId)).run();
+      const result = await deleteFrom(this.db, repos3).where(eq22(repos3.repo_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Repo", id);
       }
@@ -12312,7 +12615,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and18, asc as asc2, desc as desc3, eq as eq21, isNull as isNull6, like as like12, lte, or as or7, sql as sql12 } from "drizzle-orm";
+import { and as and19, asc as asc2, desc as desc3, eq as eq23, isNull as isNull6, like as like12, lte, or as or7, sql as sql12 } from "drizzle-orm";
 var ScheduleRepository = class {
   constructor(db) {
     this.db = db;
@@ -12411,7 +12714,7 @@ var ScheduleRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(schedules3).where(eq21(schedules3.schedule_id, fullId)).one();
+      const row = await select(this.db).from(schedules3).where(eq23(schedules3.schedule_id, fullId)).one();
       if (!row) return null;
       return this.rowToSchedule(row);
     } catch (error) {
@@ -12428,18 +12731,18 @@ var ScheduleRepository = class {
    */
   async findAll(filter) {
     const conditions = [];
-    if (filter?.branch_id) conditions.push(eq21(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push(eq21(schedules3.enabled, filter.enabled));
-    if (filter?.created_by) conditions.push(eq21(schedules3.created_by, filter.created_by));
+    if (filter?.branch_id) conditions.push(eq23(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push(eq23(schedules3.enabled, filter.enabled));
+    if (filter?.created_by) conditions.push(eq23(schedules3.created_by, filter.created_by));
     const query = select(this.db).from(schedules3);
-    const rows = conditions.length > 0 ? await query.where(and18(...conditions)).all() : await query.all();
+    const rows = conditions.length > 0 ? await query.where(and19(...conditions)).all() : await query.all();
     return rows.map((row) => this.rowToSchedule(row));
   }
   /**
    * All schedules on a branch (newest first by created_at).
    */
   async findByBranchId(branchId) {
-    const rows = await select(this.db).from(schedules3).where(eq21(schedules3.branch_id, branchId)).orderBy(desc3(schedules3.created_at)).all();
+    const rows = await select(this.db).from(schedules3).where(eq23(schedules3.branch_id, branchId)).orderBy(desc3(schedules3.created_at)).all();
     return rows.map((row) => this.rowToSchedule(row));
   }
   /**
@@ -12455,8 +12758,8 @@ var ScheduleRepository = class {
    * Uses the `schedules_enabled_next_run_idx` covering index.
    */
   dueCondition(now) {
-    return and18(
-      eq21(schedules3.enabled, true),
+    return and19(
+      eq23(schedules3.enabled, true),
       or7(isNull6(schedules3.next_run_at), lte(schedules3.next_run_at, now))
     );
   }
@@ -12490,13 +12793,13 @@ var ScheduleRepository = class {
    */
   async findAccessibleSchedules(userId, filter) {
     const conditions = [visibleBranchAccessCondition(this.db, userId)];
-    if (filter?.branch_id) conditions.push(eq21(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push(eq21(schedules3.enabled, filter.enabled));
-    if (filter?.created_by) conditions.push(eq21(schedules3.created_by, filter.created_by));
-    const results = await select(this.db).from(schedules3).innerJoin(branches3, eq21(schedules3.branch_id, branches3.branch_id)).leftJoin(
+    if (filter?.branch_id) conditions.push(eq23(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push(eq23(schedules3.enabled, filter.enabled));
+    if (filter?.created_by) conditions.push(eq23(schedules3.created_by, filter.created_by));
+    const results = await select(this.db).from(schedules3).innerJoin(branches3, eq23(schedules3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      and18(eq21(branchOwners3.branch_id, branches3.branch_id), eq21(branchOwners3.user_id, userId))
-    ).where(and18(...conditions)).all();
+      and19(eq23(branchOwners3.branch_id, branches3.branch_id), eq23(branchOwners3.user_id, userId))
+    ).where(and19(...conditions)).all();
     const seen = /* @__PURE__ */ new Set();
     const out = [];
     for (const r of results) {
@@ -12517,8 +12820,8 @@ var ScheduleRepository = class {
   async update(id, updates) {
     const fullId = await this.resolveId(id);
     return await this.db.transaction(async (tx) => {
-      await lockRowForUpdate(txAsDb(tx), this.db, schedules3, eq21(schedules3.schedule_id, fullId));
-      const currentRow = await select(txAsDb(tx)).from(schedules3).where(eq21(schedules3.schedule_id, fullId)).one();
+      await lockRowForUpdate(txAsDb(tx), this.db, schedules3, eq23(schedules3.schedule_id, fullId));
+      const currentRow = await select(txAsDb(tx)).from(schedules3).where(eq23(schedules3.schedule_id, fullId)).one();
       if (!currentRow) throw new EntityNotFoundError("Schedule", id);
       const current = this.rowToSchedule(currentRow);
       const merged = deepMerge(current, {
@@ -12532,13 +12835,13 @@ var ScheduleRepository = class {
       });
       const insertData = this.scheduleToInsert(merged);
       insertData.updated_at = /* @__PURE__ */ new Date();
-      const row = await update(txAsDb(tx), schedules3).set(insertData).where(eq21(schedules3.schedule_id, fullId)).returning().one();
+      const row = await update(txAsDb(tx), schedules3).set(insertData).where(eq23(schedules3.schedule_id, fullId)).returning().one();
       return this.rowToSchedule(row);
     });
   }
   async delete(id) {
     const fullId = await this.resolveId(id);
-    const result = await deleteFrom(this.db, schedules3).where(eq21(schedules3.schedule_id, fullId)).run();
+    const result = await deleteFrom(this.db, schedules3).where(eq23(schedules3.schedule_id, fullId)).run();
     if (result.rowsAffected === 0) throw new EntityNotFoundError("Schedule", id);
   }
   /**
@@ -12546,10 +12849,10 @@ var ScheduleRepository = class {
    */
   async count(filter) {
     const conditions = [];
-    if (filter?.branch_id) conditions.push(eq21(schedules3.branch_id, filter.branch_id));
-    if (filter?.enabled !== void 0) conditions.push(eq21(schedules3.enabled, filter.enabled));
+    if (filter?.branch_id) conditions.push(eq23(schedules3.branch_id, filter.branch_id));
+    if (filter?.enabled !== void 0) conditions.push(eq23(schedules3.enabled, filter.enabled));
     const query = select(this.db, { count: sql12`count(*)` }).from(schedules3);
-    const row = conditions.length > 0 ? await query.where(and18(...conditions)).one() : await query.one();
+    const row = conditions.length > 0 ? await query.where(and19(...conditions)).one() : await query.one();
     return Number(row?.count ?? 0);
   }
 };
@@ -12559,7 +12862,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and19, desc as desc4, eq as eq22, lt } from "drizzle-orm";
+import { and as and20, desc as desc4, eq as eq24, lt } from "drizzle-orm";
 function rowToSerializedSession(row) {
   return {
     id: row.id,
@@ -12583,7 +12886,7 @@ var SerializedSessionRepository = class {
   async findLatestDone(sessionId) {
     try {
       const row = await select(this.db).from(serializedSessions3).where(
-        and19(eq22(serializedSessions3.session_id, sessionId), eq22(serializedSessions3.status, "done"))
+        and20(eq24(serializedSessions3.session_id, sessionId), eq24(serializedSessions3.status, "done"))
       ).orderBy(desc4(serializedSessions3.turn_index), desc4(serializedSessions3.created_at)).limit(1).one();
       return row ? rowToSerializedSession(row) : null;
     } catch (error) {
@@ -12598,7 +12901,7 @@ var SerializedSessionRepository = class {
    */
   async findLatest(sessionId) {
     try {
-      const row = await select(this.db).from(serializedSessions3).where(eq22(serializedSessions3.session_id, sessionId)).orderBy(desc4(serializedSessions3.turn_index), desc4(serializedSessions3.created_at)).limit(1).one();
+      const row = await select(this.db).from(serializedSessions3).where(eq24(serializedSessions3.session_id, sessionId)).orderBy(desc4(serializedSessions3.turn_index), desc4(serializedSessions3.created_at)).limit(1).one();
       return row ? rowToSerializedSession(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -12649,7 +12952,7 @@ var SerializedSessionRepository = class {
    */
   async markDone(id, payload) {
     try {
-      await update(this.db, serializedSessions3).set({ status: "done", payload }).where(eq22(serializedSessions3.id, id)).run();
+      await update(this.db, serializedSessions3).set({ status: "done", payload }).where(eq24(serializedSessions3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to mark serialized session as done: ${error instanceof Error ? error.message : String(error)}`,
@@ -12662,7 +12965,7 @@ var SerializedSessionRepository = class {
    */
   async deleteById(id) {
     try {
-      await deleteFrom(this.db, serializedSessions3).where(eq22(serializedSessions3.id, id)).run();
+      await deleteFrom(this.db, serializedSessions3).where(eq24(serializedSessions3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to delete serialized session: ${error instanceof Error ? error.message : String(error)}`,
@@ -12677,8 +12980,8 @@ var SerializedSessionRepository = class {
   async deletePreviousTurns(sessionId, beforeTurnIndex) {
     try {
       await deleteFrom(this.db, serializedSessions3).where(
-        and19(
-          eq22(serializedSessions3.session_id, sessionId),
+        and20(
+          eq24(serializedSessions3.session_id, sessionId),
           lt(serializedSessions3.turn_index, beforeTurnIndex)
         )
       ).run();
@@ -12691,117 +12994,18 @@ var SerializedSessionRepository = class {
   }
 };
 
-// src/db/repositories/session-env-selections.ts
-init_esm_shims();
-init_database_wrapper();
-init_schema();
-import { and as and20, eq as eq23 } from "drizzle-orm";
-var SessionEnvSelectionRepository = class {
-  constructor(db) {
-    this.db = db;
-  }
-  /** Shared SELECT for a session's rows — single source of truth for reads. */
-  async fetchRows(sessionId) {
-    try {
-      return await select(this.db).from(sessionEnvSelections3).where(eq23(sessionEnvSelections3.session_id, sessionId)).all();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to list session env selections: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** List selected env var names for a session (not hydrated). */
-  async listNames(sessionId) {
-    const rows = await this.fetchRows(sessionId);
-    return rows.map((r) => r.env_var_name);
-  }
-  /** Return a Set for fast membership checks in the env resolver. */
-  async asSet(sessionId) {
-    const names = await this.listNames(sessionId);
-    return new Set(names);
-  }
-  /** Full rows with timestamps — for the REST API response. */
-  async list(sessionId) {
-    const rows = await this.fetchRows(sessionId);
-    return rows.map((r) => ({
-      session_id: r.session_id,
-      env_var_name: r.env_var_name,
-      created_at: new Date(r.created_at)
-    }));
-  }
-  /** Add a selection. No-op if it already exists. */
-  async add(sessionId, envVarName) {
-    try {
-      const existing = await select(this.db).from(sessionEnvSelections3).where(
-        and20(
-          eq23(sessionEnvSelections3.session_id, sessionId),
-          eq23(sessionEnvSelections3.env_var_name, envVarName)
-        )
-      ).one();
-      if (existing) return;
-      await insert(this.db, sessionEnvSelections3).values({
-        session_id: sessionId,
-        env_var_name: envVarName,
-        created_at: /* @__PURE__ */ new Date()
-      }).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to add session env selection: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** Remove a selection. No-op if it doesn't exist. */
-  async remove(sessionId, envVarName) {
-    try {
-      await deleteFrom(this.db, sessionEnvSelections3).where(
-        and20(
-          eq23(sessionEnvSelections3.session_id, sessionId),
-          eq23(sessionEnvSelections3.env_var_name, envVarName)
-        )
-      ).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to remove session env selection: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-  /** Bulk replace — deletes all existing rows, inserts the new set. */
-  async setAll(sessionId, envVarNames) {
-    try {
-      await deleteFrom(this.db, sessionEnvSelections3).where(eq23(sessionEnvSelections3.session_id, sessionId)).run();
-      if (envVarNames.length === 0) return;
-      const now = /* @__PURE__ */ new Date();
-      await insert(this.db, sessionEnvSelections3).values(
-        envVarNames.map((name) => ({
-          session_id: sessionId,
-          env_var_name: name,
-          created_at: now
-        }))
-      ).run();
-    } catch (error) {
-      throw new RepositoryError(
-        `Failed to set session env selections: ${error instanceof Error ? error.message : String(error)}`,
-        error
-      );
-    }
-  }
-};
-
 // src/db/repositories/session-mcp-servers.ts
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and22, eq as eq25 } from "drizzle-orm";
+import { and as and22, eq as eq26 } from "drizzle-orm";
 
 // src/db/repositories/sessions.ts
 init_esm_shims();
 init_types2();
 init_config_manager();
 init_ids();
-import { and as and21, desc as desc5, eq as eq24, inArray as inArray8, like as like13, or as or8, sql as sql13 } from "drizzle-orm";
+import { and as and21, desc as desc5, eq as eq25, inArray as inArray8, like as like13, or as or8, sql as sql13 } from "drizzle-orm";
 init_database_wrapper();
 init_schema();
 function isSessionTimestampNeutralPatch(updates) {
@@ -12826,40 +13030,43 @@ var SessionRepository = class {
     const sessionId = row.session_id;
     const boardId = branchBoardId ?? null;
     const url = baseUrl && boardId ? getSessionUrl(sessionId, baseUrl) : null;
-    return {
-      session_id: sessionId,
-      status: row.status,
-      agentic_tool: row.agentic_tool,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      unix_username: row.unix_username || null,
-      branch_id: row.branch_id,
-      branch_board_id: boardId,
-      url,
-      ...row.data,
-      tasks: row.data.tasks.map((id) => id),
-      genealogy: {
-        parent_session_id: row.parent_session_id,
-        forked_from_session_id: row.forked_from_session_id,
-        fork_point_task_id: genealogyData.fork_point_task_id,
-        fork_point_message_index: genealogyData.fork_point_message_index,
-        spawn_point_task_id: genealogyData.spawn_point_task_id,
-        spawn_point_message_index: genealogyData.spawn_point_message_index,
-        children: genealogyData.children.map((id) => id)
+    return attachHiddenTenant(
+      {
+        session_id: sessionId,
+        status: row.status,
+        agentic_tool: row.agentic_tool,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        unix_username: row.unix_username || null,
+        branch_id: row.branch_id,
+        branch_board_id: boardId,
+        url,
+        ...row.data,
+        tasks: row.data.tasks.map((id) => id),
+        genealogy: {
+          parent_session_id: row.parent_session_id,
+          forked_from_session_id: row.forked_from_session_id,
+          fork_point_task_id: genealogyData.fork_point_task_id,
+          fork_point_message_index: genealogyData.fork_point_message_index,
+          spawn_point_task_id: genealogyData.spawn_point_task_id,
+          spawn_point_message_index: genealogyData.spawn_point_message_index,
+          children: genealogyData.children.map((id) => id)
+        },
+        permission_config: row.data.permission_config,
+        scheduled_run_at: row.scheduled_run_at ?? void 0,
+        scheduled_from_branch: row.scheduled_from_branch ?? false,
+        schedule_id: row.schedule_id ?? void 0,
+        ready_for_prompt: row.ready_for_prompt ?? false,
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_reason: row.archived_reason ?? void 0,
+        current_context_usage: row.data.current_context_usage,
+        context_window_limit: row.data.context_window_limit,
+        last_context_update_at: row.data.last_context_update_at
       },
-      permission_config: row.data.permission_config,
-      scheduled_run_at: row.scheduled_run_at ?? void 0,
-      scheduled_from_branch: row.scheduled_from_branch ?? false,
-      schedule_id: row.schedule_id ?? void 0,
-      ready_for_prompt: row.ready_for_prompt ?? false,
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_reason: row.archived_reason ?? void 0,
-      current_context_usage: row.data.current_context_usage,
-      context_window_limit: row.data.context_window_limit,
-      last_context_update_at: row.data.last_context_update_at
-    };
+      row
+    );
   }
   /**
    * Convert Session to database insert format
@@ -12947,7 +13154,7 @@ var SessionRepository = class {
       const insertData = this.sessionToInsert(data);
       await insert(this.db, sessions3).values(insertData).run();
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, insertData.session_id)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(eq25(sessions3.session_id, insertData.session_id)).one();
       if (!result) {
         throw new RepositoryError("Failed to retrieve created session");
       }
@@ -12972,7 +13179,7 @@ var SessionRepository = class {
     try {
       const fullId = await this.resolveId(id);
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, fullId)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(eq25(sessions3.session_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -12995,7 +13202,7 @@ var SessionRepository = class {
   async findBranchIdBySessionId(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where(eq24(sessions3.session_id, fullId)).one();
+      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where(eq25(sessions3.session_id, fullId)).one();
       return row?.branch_id ?? null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -13006,6 +13213,26 @@ var SessionRepository = class {
       );
     }
   }
+  /**
+   * Resolve the owning user id for a session without hydrating the full row.
+   * Used by realtime delivery to offer streaming events to the session
+   * creator's own connections as a fallback, so their open tabs keep updating
+   * even before they subscribe to the per-session stream channel.
+   */
+  async findCreatedByBySessionId(id) {
+    try {
+      const fullId = await this.resolveId(id);
+      const row = await select(this.db, { created_by: sessions3.created_by }).from(sessions3).where(eq25(sessions3.session_id, fullId)).one();
+      return row?.created_by ?? null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      if (error instanceof AmbiguousIdError) throw error;
+      throw new RepositoryError(
+        `Failed to find session owner: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Find all sessions
    *
@@ -13018,13 +13245,13 @@ var SessionRepository = class {
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
         and21(
-          eq24(branchOwners3.branch_id, branches3.branch_id),
-          eq24(branchOwners3.user_id, filter.visibleToUserId)
+          eq25(branchOwners3.branch_id, branches3.branch_id),
+          eq25(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
+      ) : select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id));
       const results = conditions.length > 0 ? await query.where(and21(...conditions)).all() : await query.all();
       return results.map(
         (result) => {
@@ -13048,7 +13275,7 @@ var SessionRepository = class {
   async findByStatus(status) {
     try {
       const baseUrl = await getBaseUrl();
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.status, status)).all();
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(eq25(sessions3.status, status)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -13076,17 +13303,17 @@ var SessionRepository = class {
   async findByBoard(boardId, filter) {
     try {
       const baseUrl = await getBaseUrl();
-      const conditions = [eq24(branches3.board_id, boardId)];
+      const conditions = [eq25(branches3.board_id, boardId)];
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
         and21(
-          eq24(branchOwners3.branch_id, branches3.branch_id),
-          eq24(branchOwners3.user_id, filter.visibleToUserId)
+          eq25(branchOwners3.branch_id, branches3.branch_id),
+          eq25(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
+      ) : select(this.db).from(sessions3).innerJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id));
       const results = await query.where(and21(...conditions)).all();
       return results.map(
         (result) => {
@@ -13123,31 +13350,31 @@ var SessionRepository = class {
     try {
       const baseUrl = await getBaseUrl();
       const conditions = [];
-      if (opts.boardId !== void 0) conditions.push(eq24(branches3.board_id, opts.boardId));
-      if (opts.archived !== void 0) conditions.push(eq24(sessions3.archived, opts.archived));
+      if (opts.boardId !== void 0) conditions.push(eq25(branches3.board_id, opts.boardId));
+      if (opts.archived !== void 0) conditions.push(eq25(sessions3.archived, opts.archived));
       if (opts.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, opts.visibleToUserId));
       }
       const whereClause = conditions.length > 0 ? and21(...conditions) : void 0;
-      let countQuery = select(this.db, { count: sql13`count(*)` }).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
+      let countQuery = select(this.db, { count: sql13`count(*)` }).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         countQuery = countQuery.leftJoin(
           branchOwners3,
           and21(
-            eq24(branchOwners3.branch_id, branches3.branch_id),
-            eq24(branchOwners3.user_id, opts.visibleToUserId)
+            eq25(branchOwners3.branch_id, branches3.branch_id),
+            eq25(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       const countRow = await (whereClause ? countQuery.where(whereClause) : countQuery).one();
       const total = Number(countRow?.count ?? 0);
-      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id));
+      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         dataQuery = dataQuery.leftJoin(
           branchOwners3,
           and21(
-            eq24(branchOwners3.branch_id, branches3.branch_id),
-            eq24(branchOwners3.user_id, opts.visibleToUserId)
+            eq25(branchOwners3.branch_id, branches3.branch_id),
+            eq25(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
@@ -13184,7 +13411,7 @@ var SessionRepository = class {
       const fullId = await this.resolveId(sessionId);
       const baseUrl = await getBaseUrl();
       const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(
         or8(
           sql13`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
           sql13`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
@@ -13253,8 +13480,8 @@ var SessionRepository = class {
       const statusInfo = updates.status ? ` (status: ${updates.status}, ready_for_prompt: ${updates.ready_for_prompt})` : "";
       console.debug(`\u{1F504} [SessionRepo] Updating session ${shortId(fullId)}${statusInfo}`);
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, eq24(sessions3.session_id, fullId));
-        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.session_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, eq25(sessions3.session_id, fullId));
+        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(eq25(sessions3.session_id, fullId)).one();
         if (!currentResult) {
           throw new EntityNotFoundError("Session", id);
         }
@@ -13267,12 +13494,12 @@ var SessionRepository = class {
         if (shouldRefreshLastUpdated) {
           insertData.updated_at = /* @__PURE__ */ new Date();
         }
-        await update(txAsDb(tx), sessions3).set(insertData).where(eq24(sessions3.session_id, fullId)).run();
+        await update(txAsDb(tx), sessions3).set(insertData).where(eq25(sessions3.session_id, fullId)).run();
         if (!insertData.updated_at) {
           throw new RepositoryError("Session update did not produce an updated_at timestamp");
         }
         merged.last_updated = insertData.updated_at.toISOString();
-        return merged;
+        return attachHiddenTenant(merged, currentRow);
       });
       return result;
     } catch (error) {
@@ -13291,7 +13518,7 @@ var SessionRepository = class {
     const fullId = await this.resolveId(sessionId);
     const result = await select(this.db, {
       count: sql13`count(*)`
-    }).from(messages3).where(eq24(messages3.session_id, fullId)).one();
+    }).from(messages3).where(eq25(messages3.session_id, fullId)).one();
     return Number(result?.count ?? 0);
   }
   /**
@@ -13300,7 +13527,7 @@ var SessionRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, sessions3).where(eq24(sessions3.session_id, fullId)).run();
+      const result = await deleteFrom(this.db, sessions3).where(eq25(sessions3.session_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Session", id);
       }
@@ -13347,8 +13574,8 @@ var SessionRepository = class {
   async findScheduleRun(scheduleId, scheduledRunAt) {
     try {
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(
-        and21(eq24(sessions3.schedule_id, scheduleId), eq24(sessions3.scheduled_run_at, scheduledRunAt))
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(
+        and21(eq25(sessions3.schedule_id, scheduleId), eq25(sessions3.scheduled_run_at, scheduledRunAt))
       ).one();
       if (!result) return null;
       const r = result;
@@ -13371,7 +13598,7 @@ var SessionRepository = class {
   async findByScheduleId(scheduleId, opts = {}) {
     try {
       const baseUrl = await getBaseUrl();
-      let query = select(this.db).from(sessions3).leftJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).where(eq24(sessions3.schedule_id, scheduleId));
+      let query = select(this.db).from(sessions3).leftJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).where(eq25(sessions3.schedule_id, scheduleId));
       if (opts.orderByScheduledRunAt === "desc") {
         query = query.orderBy(desc5(sessions3.scheduled_run_at));
       } else if (opts.orderByScheduledRunAt === "asc") {
@@ -13398,7 +13625,7 @@ var SessionRepository = class {
    */
   async countByScheduleId(scheduleId) {
     try {
-      const result = await select(this.db, { count: sql13`count(*)` }).from(sessions3).where(eq24(sessions3.schedule_id, scheduleId)).one();
+      const result = await select(this.db, { count: sql13`count(*)` }).from(sessions3).where(eq25(sessions3.schedule_id, scheduleId)).one();
       return Number(result?.count ?? 0);
     } catch (error) {
       throw new RepositoryError(
@@ -13420,7 +13647,7 @@ var SessionRepository = class {
   async existsInBranchWithStatuses(branchId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: sql13`1` }).from(sessions3).where(and21(eq24(sessions3.branch_id, branchId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: sql13`1` }).from(sessions3).where(and21(eq25(sessions3.branch_id, branchId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13436,7 +13663,7 @@ var SessionRepository = class {
   async existsInScheduleWithStatuses(scheduleId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: sql13`1` }).from(sessions3).where(and21(eq24(sessions3.schedule_id, scheduleId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: sql13`1` }).from(sessions3).where(and21(eq25(sessions3.schedule_id, scheduleId), inArray8(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13467,10 +13694,10 @@ var SessionRepository = class {
   async findAccessibleSessions(userId, boardId) {
     const baseUrl = await getBaseUrl();
     const accessCondition = visibleBranchAccessCondition(this.db, userId);
-    const whereCondition = boardId ? and21(accessCondition, eq24(branches3.board_id, boardId)) : accessCondition;
-    const results = await select(this.db).from(sessions3).innerJoin(branches3, eq24(sessions3.branch_id, branches3.branch_id)).leftJoin(
+    const whereCondition = boardId ? and21(accessCondition, eq25(branches3.board_id, boardId)) : accessCondition;
+    const results = await select(this.db).from(sessions3).innerJoin(branches3, eq25(sessions3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      and21(eq24(branchOwners3.branch_id, branches3.branch_id), eq24(branchOwners3.user_id, userId))
+      and21(eq25(branchOwners3.branch_id, branches3.branch_id), eq25(branchOwners3.user_id, userId))
     ).where(whereCondition).all();
     const seen = /* @__PURE__ */ new Set();
     const sessionsOut = [];
@@ -13513,7 +13740,7 @@ var SessionRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where(and21(eq24(messagesTable.session_id, sessionId), eq24(messagesTable.role, "assistant")));
+        }).from(messagesTable).where(and21(eq25(messagesTable.session_id, sessionId), eq25(messagesTable.role, "assistant")));
         const lastMessage = await query.orderBy(desc5(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
@@ -13548,7 +13775,7 @@ var SessionRepository = class {
    */
   async exists(sessionId) {
     try {
-      const row = await select(this.db).from(sessions3).where(eq24(sessions3.session_id, sessionId)).one();
+      const row = await select(this.db).from(sessions3).where(eq25(sessions3.session_id, sessionId)).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -13583,15 +13810,15 @@ var SessionMCPServerRepository = class {
       }
       const existing = await select(this.db).from(sessionMcpServers3).where(
         and22(
-          eq25(sessionMcpServers3.session_id, sessionId),
-          eq25(sessionMcpServers3.mcp_server_id, serverId)
+          eq26(sessionMcpServers3.session_id, sessionId),
+          eq26(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).one();
       if (existing) {
         await update(this.db, sessionMcpServers3).set({ enabled: true }).where(
           and22(
-            eq25(sessionMcpServers3.session_id, sessionId),
-            eq25(sessionMcpServers3.mcp_server_id, serverId)
+            eq26(sessionMcpServers3.session_id, sessionId),
+            eq26(sessionMcpServers3.mcp_server_id, serverId)
           )
         ).run();
         return;
@@ -13618,8 +13845,8 @@ var SessionMCPServerRepository = class {
     try {
       const result = await deleteFrom(this.db, sessionMcpServers3).where(
         and22(
-          eq25(sessionMcpServers3.session_id, sessionId),
-          eq25(sessionMcpServers3.mcp_server_id, serverId)
+          eq26(sessionMcpServers3.session_id, sessionId),
+          eq26(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).run();
       if (result.rowsAffected === 0) {
@@ -13640,8 +13867,8 @@ var SessionMCPServerRepository = class {
     try {
       const result = await update(this.db, sessionMcpServers3).set({ enabled }).where(
         and22(
-          eq25(sessionMcpServers3.session_id, sessionId),
-          eq25(sessionMcpServers3.mcp_server_id, serverId)
+          eq26(sessionMcpServers3.session_id, sessionId),
+          eq26(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).run();
       if (result.rowsAffected === 0) {
@@ -13660,9 +13887,9 @@ var SessionMCPServerRepository = class {
    */
   async listServers(sessionId, enabledOnly = false) {
     try {
-      const conditions = [eq25(sessionMcpServers3.session_id, sessionId)];
+      const conditions = [eq26(sessionMcpServers3.session_id, sessionId)];
       if (enabledOnly) {
-        conditions.push(eq25(sessionMcpServers3.enabled, true));
+        conditions.push(eq26(sessionMcpServers3.enabled, true));
       }
       const relationships = await select(this.db).from(sessionMcpServers3).where(and22(...conditions)).all();
       const servers = [];
@@ -13686,9 +13913,9 @@ var SessionMCPServerRepository = class {
    */
   async listServersWithMetadata(sessionId, enabledOnly = false) {
     try {
-      const conditions = [eq25(sessionMcpServers3.session_id, sessionId)];
+      const conditions = [eq26(sessionMcpServers3.session_id, sessionId)];
       if (enabledOnly) {
-        conditions.push(eq25(sessionMcpServers3.enabled, true));
+        conditions.push(eq26(sessionMcpServers3.enabled, true));
       }
       const relationships = await select(this.db).from(sessionMcpServers3).where(and22(...conditions)).all();
       const results = [];
@@ -13721,7 +13948,7 @@ var SessionMCPServerRepository = class {
       if (!session) {
         throw new EntityNotFoundError("Session", sessionId);
       }
-      await deleteFrom(this.db, sessionMcpServers3).where(eq25(sessionMcpServers3.session_id, sessionId)).run();
+      await deleteFrom(this.db, sessionMcpServers3).where(eq26(sessionMcpServers3.session_id, sessionId)).run();
       if (serverIds.length > 0) {
         const inserts = serverIds.map((serverId) => ({
           session_id: sessionId,
@@ -13746,8 +13973,8 @@ var SessionMCPServerRepository = class {
     try {
       const row = await select(this.db).from(sessionMcpServers3).where(
         and22(
-          eq25(sessionMcpServers3.session_id, sessionId),
-          eq25(sessionMcpServers3.mcp_server_id, serverId)
+          eq26(sessionMcpServers3.session_id, sessionId),
+          eq26(sessionMcpServers3.mcp_server_id, serverId)
         )
       ).one();
       if (!row) {
@@ -13787,7 +14014,7 @@ init_esm_shims();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and23, eq as eq26, inArray as inArray9, or as or9 } from "drizzle-orm";
+import { and as and23, eq as eq27, inArray as inArray9, or as or9 } from "drizzle-orm";
 var SessionRelationshipRepository = class {
   constructor(db) {
     this.db = db;
@@ -13832,7 +14059,7 @@ var SessionRelationshipRepository = class {
   }
   async get(relationshipId) {
     try {
-      const row = await select(this.db).from(sessionRelationships3).where(eq26(sessionRelationships3.relationship_id, relationshipId)).one();
+      const row = await select(this.db).from(sessionRelationships3).where(eq27(sessionRelationships3.relationship_id, relationshipId)).one();
       if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
       return this.rowToRelationship(row);
     } catch (error) {
@@ -13847,8 +14074,8 @@ var SessionRelationshipRepository = class {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
         or9(
-          eq26(sessionRelationships3.source_session_id, sessionId),
-          eq26(sessionRelationships3.target_session_id, sessionId)
+          eq27(sessionRelationships3.source_session_id, sessionId),
+          eq27(sessionRelationships3.target_session_id, sessionId)
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -13880,8 +14107,8 @@ var SessionRelationshipRepository = class {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
         and23(
-          eq26(sessionRelationships3.source_session_id, sourceSessionId),
-          eq26(sessionRelationships3.relationship_type, "remote_create")
+          eq27(sessionRelationships3.source_session_id, sourceSessionId),
+          eq27(sessionRelationships3.relationship_type, "remote_create")
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -13896,8 +14123,8 @@ var SessionRelationshipRepository = class {
     try {
       const rows = await select(this.db).from(sessionRelationships3).where(
         and23(
-          eq26(sessionRelationships3.target_session_id, targetSessionId),
-          eq26(sessionRelationships3.relationship_type, "remote_create")
+          eq27(sessionRelationships3.target_session_id, targetSessionId),
+          eq27(sessionRelationships3.relationship_type, "remote_create")
         )
       ).all();
       return rows.map((row) => this.rowToRelationship(row));
@@ -13910,11 +14137,11 @@ var SessionRelationshipRepository = class {
   }
   async setCallbackEnabled(relationshipId, callbackEnabled) {
     try {
-      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(eq26(sessionRelationships3.relationship_id, relationshipId)).run();
+      const result = await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(eq27(sessionRelationships3.relationship_id, relationshipId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("SessionRelationship", relationshipId);
       }
-      const row = await select(this.db).from(sessionRelationships3).where(eq26(sessionRelationships3.relationship_id, relationshipId)).one();
+      const row = await select(this.db).from(sessionRelationships3).where(eq27(sessionRelationships3.relationship_id, relationshipId)).one();
       if (!row) throw new EntityNotFoundError("SessionRelationship", relationshipId);
       return this.rowToRelationship(row);
     } catch (error) {
@@ -13929,8 +14156,8 @@ var SessionRelationshipRepository = class {
     try {
       await update(this.db, sessionRelationships3).set({ callback_enabled: callbackEnabled, updated_at: /* @__PURE__ */ new Date() }).where(
         and23(
-          eq26(sessionRelationships3.target_session_id, targetSessionId),
-          eq26(sessionRelationships3.relationship_type, "remote_create")
+          eq27(sessionRelationships3.target_session_id, targetSessionId),
+          eq27(sessionRelationships3.relationship_type, "remote_create")
         )
       ).run();
     } catch (error) {
@@ -13948,7 +14175,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and24, eq as eq27, inArray as inArray10, like as like14, sql as sql14 } from "drizzle-orm";
+import { and as and24, eq as eq28, inArray as inArray10, like as like14, sql as sql14 } from "drizzle-orm";
 var TaskRepository = class {
   constructor(db) {
     this.db = db;
@@ -14044,7 +14271,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where(eq28(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -14084,7 +14311,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where(eq28(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14102,10 +14329,10 @@ var TaskRepository = class {
     try {
       if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
       const conditions = [];
-      if (filter?.sessionId) conditions.push(eq27(tasks3.session_id, filter.sessionId));
+      if (filter?.sessionId) conditions.push(eq28(tasks3.session_id, filter.sessionId));
       if (filter?.sessionIds !== void 0)
         conditions.push(inArray10(tasks3.session_id, filter.sessionIds));
-      if (filter?.status) conditions.push(eq27(tasks3.status, filter.status));
+      if (filter?.status) conditions.push(eq28(tasks3.status, filter.status));
       if (filter?.visibleToUserId) {
         conditions.push(
           visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, tasks3.session_id)
@@ -14126,7 +14353,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where(eq28(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14140,7 +14367,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where(eq28(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14196,7 +14423,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where(eq27(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where(eq28(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14218,8 +14445,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq27(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, eq28(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where(eq28(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -14233,7 +14460,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where(eq27(tasks3.task_id, fullId)).run();
+        }).where(eq28(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -14252,7 +14479,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where(eq27(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where(eq28(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -14314,7 +14541,7 @@ var TaskRepository = class {
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where(eq27(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where(eq28(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -14355,7 +14582,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: sql14`count(*)` }).from(tasks3).where(eq27(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: sql14`count(*)` }).from(tasks3).where(eq28(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -14372,7 +14599,7 @@ init_types2();
 init_ids();
 init_database_wrapper();
 init_schema();
-import { and as and25, eq as eq28, like as like15, lt as lt2 } from "drizzle-orm";
+import { and as and25, eq as eq29, like as like15, lt as lt2 } from "drizzle-orm";
 var ThreadSessionMapRepository = class {
   constructor(db) {
     this.db = db;
@@ -14442,7 +14669,7 @@ var ThreadSessionMapRepository = class {
         id: data.id ?? generateId()
       });
       await insert(this.db, threadSessionMap3).values(insertData).run();
-      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.id, insertData.id)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq29(threadSessionMap3.id, insertData.id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created thread-session mapping");
       }
@@ -14461,7 +14688,7 @@ var ThreadSessionMapRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.id, fullId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq29(threadSessionMap3.id, fullId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -14502,7 +14729,7 @@ var ThreadSessionMapRepository = class {
         status: insertData.status,
         last_message_at: insertData.last_message_at,
         metadata: insertData.metadata
-      }).where(eq28(threadSessionMap3.id, fullId)).run();
+      }).where(eq29(threadSessionMap3.id, fullId)).run();
       const updated = await this.findById(fullId);
       if (!updated) {
         throw new RepositoryError("Failed to retrieve updated thread-session mapping");
@@ -14523,7 +14750,7 @@ var ThreadSessionMapRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, threadSessionMap3).where(eq28(threadSessionMap3.id, fullId)).run();
+      const result = await deleteFrom(this.db, threadSessionMap3).where(eq29(threadSessionMap3.id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("ThreadSessionMap", id);
       }
@@ -14541,7 +14768,7 @@ var ThreadSessionMapRepository = class {
   async findByChannelAndThread(channelId, threadId) {
     try {
       const row = await select(this.db).from(threadSessionMap3).where(
-        and25(eq28(threadSessionMap3.channel_id, channelId), eq28(threadSessionMap3.thread_id, threadId))
+        and25(eq29(threadSessionMap3.channel_id, channelId), eq29(threadSessionMap3.thread_id, threadId))
       ).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
@@ -14558,7 +14785,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByThread(threadId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.thread_id, threadId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq29(threadSessionMap3.thread_id, threadId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14572,7 +14799,7 @@ var ThreadSessionMapRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const row = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.session_id, sessionId)).one();
+      const row = await select(this.db).from(threadSessionMap3).where(eq29(threadSessionMap3.session_id, sessionId)).one();
       return row ? this.rowToMapping(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -14586,9 +14813,9 @@ var ThreadSessionMapRepository = class {
    */
   async findByChannel(channelId, status) {
     try {
-      const conditions = [eq28(threadSessionMap3.channel_id, channelId)];
+      const conditions = [eq29(threadSessionMap3.channel_id, channelId)];
       if (status) {
-        conditions.push(eq28(threadSessionMap3.status, status));
+        conditions.push(eq29(threadSessionMap3.status, status));
       }
       const rows = await select(this.db).from(threadSessionMap3).where(and25(...conditions)).all();
       return rows.map((row) => this.rowToMapping(row));
@@ -14606,7 +14833,7 @@ var ThreadSessionMapRepository = class {
     try {
       await update(this.db, threadSessionMap3).set({
         last_message_at: /* @__PURE__ */ new Date()
-      }).where(eq28(threadSessionMap3.id, id)).run();
+      }).where(eq29(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update last message timestamp: ${error instanceof Error ? error.message : String(error)}`,
@@ -14619,7 +14846,7 @@ var ThreadSessionMapRepository = class {
    */
   async updateMetadata(id, metadata) {
     try {
-      await update(this.db, threadSessionMap3).set({ metadata }).where(eq28(threadSessionMap3.id, id)).run();
+      await update(this.db, threadSessionMap3).set({ metadata }).where(eq29(threadSessionMap3.id, id)).run();
     } catch (error) {
       throw new RepositoryError(
         `Failed to update metadata: ${error instanceof Error ? error.message : String(error)}`,
@@ -14634,7 +14861,7 @@ var ThreadSessionMapRepository = class {
     try {
       const cutoff = new Date(Date.now() - daysInactive * 24 * 60 * 60 * 1e3);
       const rows = await select(this.db).from(threadSessionMap3).where(
-        and25(eq28(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
+        and25(eq29(threadSessionMap3.status, "active"), lt2(threadSessionMap3.last_message_at, cutoff))
       ).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
@@ -14649,7 +14876,7 @@ var ThreadSessionMapRepository = class {
    */
   async findByBranch(branchId) {
     try {
-      const rows = await select(this.db).from(threadSessionMap3).where(eq28(threadSessionMap3.branch_id, branchId)).all();
+      const rows = await select(this.db).from(threadSessionMap3).where(eq29(threadSessionMap3.branch_id, branchId)).all();
       return rows.map((row) => this.rowToMapping(row));
     } catch (error) {
       throw new RepositoryError(
@@ -14668,7 +14895,7 @@ init_schema();
 init_tenant_context();
 import { randomBytes as randomBytes3 } from "crypto";
 import bcrypt2 from "bcryptjs";
-import { and as and26, eq as eq29 } from "drizzle-orm";
+import { and as and26, eq as eq30 } from "drizzle-orm";
 var KEY_PREFIX = "agor_sk_";
 var KEY_PREFIX_LENGTH = 12;
 var KEY_RANDOM_BYTES = 32;
@@ -14705,7 +14932,7 @@ var UserApiKeysRepository = class {
   }
   /** List all API keys for a user (never returns hashes) */
   async listByUser(userId) {
-    const rows = await select(this.db).from(userApiKeys3).where(eq29(userApiKeys3.user_id, userId)).all();
+    const rows = await select(this.db).from(userApiKeys3).where(eq30(userApiKeys3.user_id, userId)).all();
     return rows.map((r) => ({
       id: r.id,
       name: r.name,
@@ -14716,7 +14943,7 @@ var UserApiKeysRepository = class {
   }
   /** Find a key by prefix (for auth lookup). Returns rows with hash for verification. */
   async findByPrefix(prefix) {
-    return select(this.db).from(userApiKeys3).where(eq29(userApiKeys3.prefix, prefix)).all();
+    return select(this.db).from(userApiKeys3).where(eq30(userApiKeys3.prefix, prefix)).all();
   }
   /** Verify a raw API key against stored hashes. Returns the matching row or null. */
   async verifyKey(rawKey) {
@@ -14745,19 +14972,19 @@ var UserApiKeysRepository = class {
     await this.updateLastUsedNow(id);
   }
   async updateLastUsedNow(id) {
-    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq29(userApiKeys3.id, id)).run();
+    await update(this.db, userApiKeys3).set({ last_used_at: /* @__PURE__ */ new Date() }).where(eq30(userApiKeys3.id, id)).run();
   }
   /** Update key name */
   async updateName(id, userId, name) {
-    await update(this.db, userApiKeys3).set({ name }).where(and26(eq29(userApiKeys3.id, id), eq29(userApiKeys3.user_id, userId))).run();
+    await update(this.db, userApiKeys3).set({ name }).where(and26(eq30(userApiKeys3.id, id), eq30(userApiKeys3.user_id, userId))).run();
   }
   /** Delete a key */
   async delete(id, userId) {
-    await deleteFrom(this.db, userApiKeys3).where(and26(eq29(userApiKeys3.id, id), eq29(userApiKeys3.user_id, userId))).run();
+    await deleteFrom(this.db, userApiKeys3).where(and26(eq30(userApiKeys3.id, id), eq30(userApiKeys3.user_id, userId))).run();
   }
   /** Delete all keys for a user */
   async deleteAllForUser(userId) {
-    await deleteFrom(this.db, userApiKeys3).where(eq29(userApiKeys3.user_id, userId)).run();
+    await deleteFrom(this.db, userApiKeys3).where(eq30(userApiKeys3.user_id, userId)).run();
   }
 };
 
@@ -14765,7 +14992,7 @@ var UserApiKeysRepository = class {
 init_esm_shims();
 init_database_wrapper();
 init_schema();
-import { and as and27, eq as eq30, isNull as isNull7 } from "drizzle-orm";
+import { and as and27, eq as eq31, isNull as isNull7 } from "drizzle-orm";
 function rowToToken(row) {
   return {
     user_id: row.user_id ?? null,
@@ -14781,8 +15008,8 @@ function rowToToken(row) {
 }
 function matchKey(userId, serverId) {
   return and27(
-    userId === null ? isNull7(userMcpOauthTokens3.user_id) : eq30(userMcpOauthTokens3.user_id, userId),
-    eq30(userMcpOauthTokens3.mcp_server_id, serverId)
+    userId === null ? isNull7(userMcpOauthTokens3.user_id) : eq31(userMcpOauthTokens3.user_id, userId),
+    eq31(userMcpOauthTokens3.mcp_server_id, serverId)
   );
 }
 var UserMCPOAuthTokenRepository = class {
@@ -14899,7 +15126,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForUser(userId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.user_id, userId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq31(userMcpOauthTokens3.user_id, userId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -14910,7 +15137,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async deleteAllForServer(serverId) {
     try {
-      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.mcp_server_id, serverId)).run();
+      const result = await deleteFrom(this.db, userMcpOauthTokens3).where(eq31(userMcpOauthTokens3.mcp_server_id, serverId)).run();
       return result.rowsAffected;
     } catch (error) {
       throw new RepositoryError(
@@ -14921,7 +15148,7 @@ var UserMCPOAuthTokenRepository = class {
   }
   async listForUser(userId) {
     try {
-      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq30(userMcpOauthTokens3.user_id, userId)).all();
+      const rows = await select(this.db).from(userMcpOauthTokens3).where(eq31(userMcpOauthTokens3.user_id, userId)).all();
       return rows.map(rowToToken);
     } catch (error) {
       throw new RepositoryError(
@@ -14939,37 +15166,7 @@ var UserMCPOAuthTokenRepository = class {
 // src/db/repositories/users.ts
 init_esm_shims();
 init_types2();
-import { eq as eq31, like as like16, sql as sql15 } from "drizzle-orm";
-
-// src/config/env-vars.ts
-init_esm_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-function normalizeStoredEnvVar(raw) {
-  if (typeof raw === "string") {
-    return { value_encrypted: raw, scope: "global" };
-  }
-  return {
-    value_encrypted: raw.value_encrypted,
-    scope: raw.scope,
-    resource_id: raw.resource_id ?? null,
-    extra_config: raw.extra_config ?? null
-  };
-}
-function normalizeStoredEnvMap(raw) {
-  const out = {};
-  if (!raw) return out;
-  for (const [key, value] of Object.entries(raw)) {
-    try {
-      out[key] = normalizeStoredEnvVar(value);
-    } catch (err) {
-      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
-    }
-  }
-  return out;
-}
-
-// src/db/repositories/users.ts
+import { eq as eq32, like as like16, sql as sql15 } from "drizzle-orm";
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -15080,7 +15277,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where(eq31(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where(eq32(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -15103,7 +15300,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where(eq31(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where(eq32(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -15115,7 +15312,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq32(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -15131,7 +15328,7 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where(eq31(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where(eq32(users3.email, email)).one();
     if (!result) {
       return null;
     }
@@ -15202,8 +15399,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq31(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
+    }).where(eq32(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where(eq32(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -15214,7 +15411,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where(eq31(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where(eq32(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -15222,7 +15419,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where(eq31(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where(eq32(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -15304,7 +15501,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq31(users3.user_id, fullId)).run();
+    }).where(eq32(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -15330,7 +15527,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where(eq31(users3.user_id, fullId)).run();
+    }).where(eq32(users3.user_id, fullId)).run();
   }
 };
 
@@ -15442,7 +15639,7 @@ export {
   desc6 as desc,
   encryptApiKey,
   enqueueTenantDatabasePostCommitCallback,
-  eq32 as eq,
+  eq33 as eq,
   executeAll,
   executeGet,
   executeRaw,