agor-live 0.23.1 → 0.23.2

package/dist/core/index.cjs

@@ -1655,6 +1655,21 @@ var init_file = __esm({
 });
 
 // src/types/gateway.ts
+function getRequiredSecretFields(channelType, config) {
+  switch (channelType) {
+    case "slack": {
+      const wantsInbound = config.connection_mode === "socket" || config.enable_channels === true || config.enable_groups === true || config.enable_mpim === true;
+      const outboundOnly = config.outbound_enabled === true && !wantsInbound;
+      return outboundOnly ? ["bot_token"] : ["bot_token", "app_token"];
+    }
+    case "github":
+      return ["private_key"];
+    case "teams":
+      return ["app_password"];
+    default:
+      return [];
+  }
+}
 var GATEWAY_SENSITIVE_CONFIG_FIELDS, GATEWAY_REDACTED_SENTINEL;
 var init_gateway = __esm({
   "src/types/gateway.ts"() {
@@ -5991,6 +6006,7 @@ __export(src_exports, {
   SudoCliExecutor: () => SudoCliExecutor,
   SudoDirectExecutor: () => SudoDirectExecutor,
   SymlinkCommands: () => SymlinkCommands,
+  TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS: () => TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS,
   TERMINAL_TASK_STATUSES: () => TERMINAL_TASK_STATUSES,
   TOOL_API_KEY_NAMES: () => TOOL_API_KEY_NAMES,
   TaskRepository: () => TaskRepository,
@@ -6052,6 +6068,7 @@ __export(src_exports, {
   checkAsUser: () => checkAsUser,
   checkMigrationStatus: () => checkMigrationStatus,
   compare: () => compare,
+  containsTemplate: () => containsTemplate,
   count: () => import_drizzle_orm38.count,
   createAdminExecutor: () => createAdminExecutor,
   createClient: () => createClient,
@@ -6141,6 +6158,7 @@ __export(src_exports, {
   getRepoReferenceOptions: () => getRepoReferenceOptions,
   getReposDir: () => getReposDir,
   getReposDirAsync: () => getReposDirAsync,
+  getRequiredSecretFields: () => getRequiredSecretFields,
   getServiceTier: () => getServiceTier,
   getSessionType: () => getSessionType,
   getUidFromUsername: () => getUidFromUsername,
@@ -6193,6 +6211,7 @@ __export(src_exports, {
   isThreadRoot: () => isThreadRoot,
   isUnixGroupRefreshNeeded: () => isUnixGroupRefreshNeeded,
   isUnixImpersonationEnabled: () => isUnixImpersonationEnabled,
+  isUserEnvPlaceholder: () => isUserEnvPlaceholder,
   isUserInGroup: () => isUserInGroup,
   isValid: () => isValid,
   isValidBranchGroupName: () => isValidBranchGroupName,
@@ -11497,6 +11516,63 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find non-archived branches whose explicit filesystem access set can change
+   * when membership in the given group changes.
+   *
+   * Keep this inverse lookup in lockstep with findExplicitFsAccessUserIds():
+   * both encode which group grants materialize into branch-folder access.
+   * App-only grants (`fs_access = 'none'`) are intentionally excluded because
+   * membership changes for those grants do not require branch-folder mutation.
+   */
+  async findExplicitFsAccessBranchIdsForGroup(groupId) {
+    const directRows = await select(this.db, { branch_id: branchGroupGrants3.branch_id }).from(branchGroupGrants3).innerJoin(branches3, (0, import_drizzle_orm18.eq)(branches3.branch_id, branchGroupGrants3.branch_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm18.and)((0, import_drizzle_orm18.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm18.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm18.and)(
+        (0, import_drizzle_orm18.eq)(branchGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm18.eq)(branches3.archived, false),
+        (0, import_drizzle_orm18.inArray)(
+          import_drizzle_orm18.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const boardRows = await select(this.db, { branch_id: branches3.branch_id }).from(boardGroupGrants3).innerJoin(
+      groups3,
+      (0, import_drizzle_orm18.and)((0, import_drizzle_orm18.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm18.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm18.and)(
+        (0, import_drizzle_orm18.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm18.eq)(import_drizzle_orm18.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      )
+    ).innerJoin(
+      branches3,
+      (0, import_drizzle_orm18.and)(
+        (0, import_drizzle_orm18.eq)(branches3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm18.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm18.eq)(branches3.archived, false)
+      )
+    ).where(
+      (0, import_drizzle_orm18.and)(
+        (0, import_drizzle_orm18.eq)(boardGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm18.inArray)(
+          import_drizzle_orm18.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const branchIds = /* @__PURE__ */ new Set();
+    for (const row of directRows) {
+      branchIds.add(row.branch_id);
+    }
+    for (const row of boardRows) {
+      branchIds.add(row.branch_id);
+    }
+    return Array.from(branchIds);
+  }
   async findBoardAlignedBranches(boardId) {
     const rows = await select(this.db).from(branches3).where(
       (0, import_drizzle_orm18.and)(
@@ -12504,6 +12580,60 @@ var BoardRepository = class {
       );
     }
   }
+  /**
+   * Shallow-merge field patches into existing board objects in a single
+   * read-modify-write.
+   *
+   * Unlike upsertBoardObject (which fully replaces the object value, dropping
+   * omitted fields), this overwrites ONLY the provided keys and leaves the rest
+   * of each object intact — so a narrow change (e.g. a zIndex reorder) has a
+   * smaller blast radius and won't clobber a field edited via a different patch
+   * call. Multiple objects in one call are merged before a single write, so a
+   * forward/backward swap touches both neighbors in one update.
+   *
+   * Objects that no longer exist are SKIPPED, never re-created — so a swap can't
+   * resurrect a neighbor deleted between the client's read and this write.
+   *
+   * Only an explicit allowlist of fields can be merged (currently just `zIndex`,
+   * which is also clamped into the board-object band [1, 499] so it can never be
+   * pushed onto the card (500) / comment (1000) layers). Any other key in a
+   * patch is ignored, so this narrow action cannot reshape an object (e.g. flip
+   * its `type`) the way a full upsert could.
+   *
+   * NOTE: this is NOT atomic against concurrent writers. Like every other board
+   * writer, the findById → update sequence has a lost-update window: a write
+   * that lands between the read and the update can be overwritten (last-write-
+   * wins). Merging only the patched keys narrows that window's blast radius
+   * versus a full-object upsert, but does not close it.
+   */
+  async mergeBoardObjectFields(boardId, patches) {
+    const Z_MIN = 1;
+    const Z_MAX = 499;
+    try {
+      const fullId = await this.resolveId(boardId);
+      const current = await this.findById(fullId);
+      if (!current) {
+        throw new EntityNotFoundError("Board", boardId);
+      }
+      const updatedObjects = { ...current.objects || {} };
+      for (const [objectId, fields] of Object.entries(patches)) {
+        const existing = updatedObjects[objectId];
+        if (!existing) continue;
+        const { zIndex } = fields;
+        if (typeof zIndex !== "number" || !Number.isFinite(zIndex)) continue;
+        const safeZIndex = Math.min(Z_MAX, Math.max(Z_MIN, zIndex));
+        updatedObjects[objectId] = { ...existing, zIndex: safeZIndex };
+      }
+      return this.update(fullId, { objects: updatedObjects });
+    } catch (error) {
+      if (error instanceof RepositoryError) throw error;
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to merge board object fields: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * DEPRECATED: Delete a zone and handle associated sessions
    * TODO: Reimplement using board-objects table
@@ -13238,6 +13368,28 @@ var GatewayChannelRepository = class {
       agentic_config: encryptedAgenticConfig
     };
   }
+  /**
+   * Enforce the "enabled requires secrets" invariant on every write path.
+   *
+   * An enabled channel can never exist without the secrets its type needs to
+   * function. Runs on the post-merge, decrypted config so a patch that only
+   * flips `enabled: true` on a channel with already-stored tokens passes.
+   * Disabled ("draft") channels are exempt.
+   */
+  assertRequiredSecretsWhenEnabled(channel) {
+    if (channel.enabled === false) return;
+    const channelType = channel.channel_type ?? "slack";
+    const config = channel.config ?? {};
+    const missing = getRequiredSecretFields(channelType, config).filter((field) => {
+      const value = config[field];
+      return typeof value !== "string" || value.trim() === "" || value === GATEWAY_REDACTED_SENTINEL;
+    });
+    if (missing.length > 0) {
+      throw new RepositoryError(
+        `Cannot enable ${channelType} gateway channel: missing required secret(s) ${missing.join(", ")}`
+      );
+    }
+  }
   /**
    * Resolve short ID to full ID
    */
@@ -13269,6 +13421,7 @@ var GatewayChannelRepository = class {
         id: data.id ?? generateId(),
         channel_key: data.channel_key ?? generateId()
       });
+      this.assertRequiredSecretsWhenEnabled(data);
       await insert(this.db, gatewayChannels3).values(insertData).run();
       const row = await select(this.db).from(gatewayChannels3).where((0, import_drizzle_orm22.eq)(gatewayChannels3.id, insertData.id)).one();
       if (!row) {
@@ -13335,6 +13488,7 @@ var GatewayChannelRepository = class {
         }
         merged.config = mergedConfig;
       }
+      this.assertRequiredSecretsWhenEnabled(merged);
       const insertData = this.channelToInsert(merged);
       await update(this.db, gatewayChannels3).set({
         name: insertData.name,
@@ -14849,90 +15003,439 @@ init_ids();
 // src/tools/mcp/auth-secrets.ts
 init_cjs_shims();
 
-// src/tools/mcp/http-headers.ts
+// src/mcp/template-resolver.ts
 init_cjs_shims();
-var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
-var RESERVED_MCP_CUSTOM_HEADER_NAMES = /* @__PURE__ */ new Set([
-  "authorization",
-  // Hop-by-hop / transport-controlled headers. These are managed by fetch,
-  // the MCP SDK transport, or the auth configuration and should not be stored
-  // as custom MCP service-account headers.
-  "connection",
-  "content-length",
-  "cookie",
-  "host",
-  "mcp-session-id",
-  "te",
-  "trailer",
-  "transfer-encoding",
-  "upgrade"
-]);
-var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-function isValidMCPHeaderName(name) {
-  return HEADER_NAME_RE.test(name);
-}
-function isReservedMCPCustomHeaderName(name) {
-  return RESERVED_MCP_CUSTOM_HEADER_NAMES.has(name.toLowerCase());
+
+// src/templates/handlebars-helpers.ts
+init_cjs_shims();
+var import_handlebars = __toESM(require("handlebars"), 1);
+var helpersRegistered = false;
+function registerHandlebarsHelpers() {
+  import_handlebars.default.registerHelper("add", (a, b) => {
+    const numA = Number(a);
+    const numB = Number(b);
+    if (Number.isNaN(numA) || Number.isNaN(numB)) {
+      console.warn(`\u26A0\uFE0F  add helper received non-numeric values: ${a}, ${b}`);
+      return 0;
+    }
+    return numA + numB;
+  });
+  import_handlebars.default.registerHelper("sub", (a, b) => {
+    const numA = Number(a);
+    const numB = Number(b);
+    if (Number.isNaN(numA) || Number.isNaN(numB)) {
+      console.warn(`\u26A0\uFE0F  sub helper received non-numeric values: ${a}, ${b}`);
+      return 0;
+    }
+    return numA - numB;
+  });
+  import_handlebars.default.registerHelper("mul", (a, b) => {
+    const numA = Number(a);
+    const numB = Number(b);
+    if (Number.isNaN(numA) || Number.isNaN(numB)) {
+      console.warn(`\u26A0\uFE0F  mul helper received non-numeric values: ${a}, ${b}`);
+      return 0;
+    }
+    return numA * numB;
+  });
+  import_handlebars.default.registerHelper("div", (a, b) => {
+    const numA = Number(a);
+    const numB = Number(b);
+    if (Number.isNaN(numA) || Number.isNaN(numB)) {
+      console.warn(`\u26A0\uFE0F  div helper received non-numeric values: ${a}, ${b}`);
+      return 0;
+    }
+    if (numB === 0) {
+      console.warn(`\u26A0\uFE0F  div helper received zero divisor`);
+      return 0;
+    }
+    return numA / numB;
+  });
+  import_handlebars.default.registerHelper("mod", (a, b) => {
+    const numA = Number(a);
+    const numB = Number(b);
+    if (Number.isNaN(numA) || Number.isNaN(numB)) {
+      console.warn(`\u26A0\uFE0F  mod helper received non-numeric values: ${a}, ${b}`);
+      return 0;
+    }
+    if (numB === 0) {
+      console.warn(`\u26A0\uFE0F  mod helper received zero divisor`);
+      return 0;
+    }
+    return numA % numB;
+  });
+  import_handlebars.default.registerHelper("uppercase", (str) => {
+    return String(str || "").toUpperCase();
+  });
+  import_handlebars.default.registerHelper("lowercase", (str) => {
+    return String(str || "").toLowerCase();
+  });
+  import_handlebars.default.registerHelper("replace", (str, search, replace) => {
+    return String(str || "").split(search).join(replace);
+  });
+  import_handlebars.default.registerHelper("eq", (a, b) => {
+    return a === b;
+  });
+  import_handlebars.default.registerHelper("neq", (a, b) => {
+    return a !== b;
+  });
+  import_handlebars.default.registerHelper("gt", (a, b) => {
+    return Number(a) > Number(b);
+  });
+  import_handlebars.default.registerHelper("lt", (a, b) => {
+    return Number(a) < Number(b);
+  });
+  import_handlebars.default.registerHelper("gte", (a, b) => {
+    return Number(a) >= Number(b);
+  });
+  import_handlebars.default.registerHelper("lte", (a, b) => {
+    return Number(a) <= Number(b);
+  });
+  import_handlebars.default.registerHelper("default", (value, defaultValue) => {
+    return value ?? defaultValue;
+  });
+  import_handlebars.default.registerHelper("json", (obj) => {
+    return JSON.stringify(obj, null, 2);
+  });
+  import_handlebars.default.registerHelper("isDefined", (value) => value !== void 0);
+  helpersRegistered = true;
 }
-function normalizeMCPCustomHeaders(headers) {
-  if (!headers) return void 0;
-  const normalized = {};
-  for (const [rawName, rawValue] of Object.entries(headers)) {
-    const name = rawName.trim();
-    if (!name || !isValidMCPHeaderName(name)) continue;
-    if (isReservedMCPCustomHeaderName(name)) continue;
-    if (typeof rawValue !== "string") continue;
-    normalized[name] = rawValue;
+function renderTemplate(templateString, context, options = {}) {
+  if (!templateString || typeof templateString !== "string") {
+    return "";
   }
-  return Object.keys(normalized).length > 0 ? normalized : void 0;
-}
-function restoreRedactedMCPCustomHeaders(options) {
-  if (!options.next) return void 0;
-  const restored = {};
-  for (const [key, value] of Object.entries(options.next)) {
-    restored[key] = value === MCP_HEADER_REDACTED_SENTINEL && options.current?.[key] !== void 0 ? options.current[key] : value;
+  if (!helpersRegistered) {
+    registerHandlebarsHelpers();
   }
-  return normalizeMCPCustomHeaders(restored);
-}
-
-// src/tools/mcp/auth-secrets.ts
-var MCP_AUTH_SECRET_FIELDS = [
-  "token",
-  "api_token",
-  "api_secret",
-  "oauth_client_secret",
-  "oauth_access_token",
-  "oauth_refresh_token"
-];
-function restoreRedactedMCPAuthSecrets(options) {
-  if (!options.next) return void 0;
-  const restored = { ...options.next };
-  const record = restored;
-  for (const field of MCP_AUTH_SECRET_FIELDS) {
-    if (restored[field] === MCP_HEADER_REDACTED_SENTINEL && options.current?.[field] !== void 0) {
-      record[field] = options.current[field];
+  try {
+    const template = import_handlebars.default.compile(templateString);
+    return template(context);
+  } catch (error) {
+    console.error("\u274C Handlebars template error:", error);
+    console.error("Template:", templateString);
+    console.error("Context keys:", Object.keys(context));
+    if (options.onError === "raw") {
+      return templateString;
     }
+    return "";
   }
-  return restored;
 }
-
-// src/db/repositories/mcp-servers.ts
-init_database_wrapper();
-init_schema();
-var MCPServerRepository = class {
-  constructor(db) {
-    this.db = db;
-  }
-  /**
-   * Convert database row to MCPServer type
-   */
-  rowToMCPServer(row) {
-    return {
-      mcp_server_id: row.mcp_server_id,
-      name: row.name,
-      transport: row.transport,
-      scope: row.scope,
-      enabled: Boolean(row.enabled),
+function buildBranchContext(branch) {
+  const branchEntity = {
+    unique_id: branch.branch_unique_id,
+    name: branch.name,
+    path: branch.path,
+    gid: branch.unix_gid,
+    base_ref: branch.base_ref || "",
+    ref_type: branch.ref_type || "branch"
+  };
+  return {
+    // Scoped entities (accessible as {{entity.property}})
+    branch: branchEntity,
+    // Legacy alias — preserved for existing env templates that reference
+    // {{worktree.*}} keys. Points at the same object so updates stay in sync.
+    worktree: branchEntity,
+    repo: {
+      slug: branch.repo_slug || ""
+    },
+    host: {
+      ip_address: branch.host_ip_address || ""
+    },
+    // User-defined custom context (accessible as {{custom.key}})
+    custom: branch.custom_context || {}
+  };
+}
+
+// src/mcp/template-patterns.ts
+init_cjs_shims();
+function containsTemplate(value) {
+  return value.includes("{{") && value.includes("}}");
+}
+var USER_ENV_PLACEHOLDER_RE = /^\{\{\s*user\.env\.[A-Za-z_][A-Za-z0-9_]*\s*\}\}$/;
+function isUserEnvPlaceholder(value) {
+  return USER_ENV_PLACEHOLDER_RE.test(value.trim());
+}
+
+// src/mcp/template-resolver.ts
+function buildMCPTemplateContextFromEnv(env) {
+  const userEnvKeysStr = env[AGOR_USER_ENV_KEYS_VAR];
+  const allowedKeys = userEnvKeysStr ? new Set(userEnvKeysStr.split(",")) : /* @__PURE__ */ new Set();
+  const userEnv = {};
+  for (const key of allowedKeys) {
+    const value = env[key];
+    if (value !== void 0) {
+      userEnv[key] = value;
+    }
+  }
+  return {
+    user: {
+      env: userEnv
+    }
+  };
+}
+function resolveStringValue(fieldName, templateValue, context) {
+  if (!containsTemplate(templateValue)) {
+    return templateValue;
+  }
+  try {
+    const resolved = renderTemplate(templateValue, context);
+    if (!resolved || resolved.trim() === "") {
+      console.log(`   \u2139\uFE0F  MCP "${fieldName}" resolved to empty (user may need to set env var)`);
+      return void 0;
+    }
+    return resolved;
+  } catch (error) {
+    console.warn(
+      `   \u26A0\uFE0F  Failed to resolve MCP template "${fieldName}":`,
+      error instanceof Error ? error.message : String(error)
+    );
+    return void 0;
+  }
+}
+function resolveMcpServerEnv(envTemplate, context) {
+  if (!envTemplate || Object.keys(envTemplate).length === 0) {
+    return void 0;
+  }
+  const result = {};
+  for (const [key, templateValue] of Object.entries(envTemplate)) {
+    const resolved = resolveStringValue(`env.${key}`, templateValue, context);
+    if (resolved !== void 0) {
+      result[key] = resolved;
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+var TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS = [
+  "token",
+  "api_token",
+  "api_secret",
+  "oauth_client_secret"
+];
+function resolveMcpServerTemplates(server, context) {
+  const resolved = { ...server };
+  const unresolvedFields = [];
+  const hadUrlTemplate = server.url && containsTemplate(server.url);
+  if (server.url) {
+    resolved.url = resolveStringValue("url", server.url, context);
+    if (hadUrlTemplate && !resolved.url) {
+      unresolvedFields.push("url");
+    }
+  }
+  if (server.env) {
+    const resolvedEnv = {};
+    for (const [key, templateValue] of Object.entries(server.env)) {
+      const hadTemplate = containsTemplate(templateValue);
+      const resolvedValue = resolveStringValue(`env.${key}`, templateValue, context);
+      if (resolvedValue !== void 0) {
+        resolvedEnv[key] = resolvedValue;
+      } else if (hadTemplate) {
+        unresolvedFields.push(`env.${key}`);
+      }
+    }
+    resolved.env = Object.keys(resolvedEnv).length > 0 ? resolvedEnv : void 0;
+  }
+  if (server.headers) {
+    const resolvedHeaders = {};
+    for (const [key, templateValue] of Object.entries(server.headers)) {
+      const hadTemplate = containsTemplate(templateValue);
+      const resolvedValue = resolveStringValue(`headers.${key}`, templateValue, context);
+      if (resolvedValue !== void 0) {
+        resolvedHeaders[key] = resolvedValue;
+      } else if (hadTemplate) {
+        unresolvedFields.push(`headers.${key}`);
+      }
+    }
+    resolved.headers = Object.keys(resolvedHeaders).length > 0 ? resolvedHeaders : void 0;
+  }
+  if (server.auth) {
+    const resolvedAuth = { ...server.auth };
+    if (server.auth.token) {
+      const hadTemplate = containsTemplate(server.auth.token);
+      resolvedAuth.token = resolveStringValue("auth.token", server.auth.token, context);
+      if (hadTemplate && !resolvedAuth.token) {
+        unresolvedFields.push("auth.token");
+      }
+    }
+    if (server.auth.api_url) {
+      const hadTemplate = containsTemplate(server.auth.api_url);
+      resolvedAuth.api_url = resolveStringValue("auth.api_url", server.auth.api_url, context);
+      if (hadTemplate && !resolvedAuth.api_url) {
+        unresolvedFields.push("auth.api_url");
+      }
+    }
+    if (server.auth.api_token) {
+      const hadTemplate = containsTemplate(server.auth.api_token);
+      resolvedAuth.api_token = resolveStringValue("auth.api_token", server.auth.api_token, context);
+      if (hadTemplate && !resolvedAuth.api_token) {
+        unresolvedFields.push("auth.api_token");
+      }
+    }
+    if (server.auth.api_secret) {
+      const hadTemplate = containsTemplate(server.auth.api_secret);
+      resolvedAuth.api_secret = resolveStringValue(
+        "auth.api_secret",
+        server.auth.api_secret,
+        context
+      );
+      if (hadTemplate && !resolvedAuth.api_secret) {
+        unresolvedFields.push("auth.api_secret");
+      }
+    }
+    if (server.auth.type === "oauth") {
+      if (server.auth.oauth_token_url) {
+        const _hadTemplate = containsTemplate(server.auth.oauth_token_url);
+        resolvedAuth.oauth_token_url = resolveStringValue(
+          "auth.oauth_token_url",
+          server.auth.oauth_token_url,
+          context
+        );
+      }
+      if (server.auth.oauth_client_id) {
+        const _hadTemplate = containsTemplate(server.auth.oauth_client_id);
+        resolvedAuth.oauth_client_id = resolveStringValue(
+          "auth.oauth_client_id",
+          server.auth.oauth_client_id,
+          context
+        );
+      }
+      if (server.auth.oauth_client_secret) {
+        const _hadTemplate = containsTemplate(server.auth.oauth_client_secret);
+        resolvedAuth.oauth_client_secret = resolveStringValue(
+          "auth.oauth_client_secret",
+          server.auth.oauth_client_secret,
+          context
+        );
+      }
+      if (server.auth.oauth_scope) {
+        const _hadTemplate = containsTemplate(server.auth.oauth_scope);
+        resolvedAuth.oauth_scope = resolveStringValue(
+          "auth.oauth_scope",
+          server.auth.oauth_scope,
+          context
+        );
+      }
+      resolvedAuth.oauth_grant_type = server.auth.oauth_grant_type || "client_credentials";
+    }
+    resolved.auth = resolvedAuth;
+  }
+  const isHttpTransport = server.transport === "http" || server.transport === "sse";
+  const urlRequired = isHttpTransport && hadUrlTemplate;
+  const urlMissing = urlRequired && !resolved.url;
+  const isValid2 = !urlMissing;
+  let errorMessage;
+  if (!isValid2) {
+    const missingVars = unresolvedFields.map((f) => {
+      let originalValue;
+      if (f === "url") {
+        originalValue = server.url;
+      } else if (f.startsWith("env.")) {
+        originalValue = server.env?.[f.slice(4)];
+      } else if (f.startsWith("headers.")) {
+        originalValue = server.headers?.[f.slice(8)];
+      } else if (f.startsWith("auth.") && server.auth) {
+        const authKey = f.slice(5);
+        const authValue = server.auth[authKey];
+        originalValue = typeof authValue === "string" ? authValue : void 0;
+      }
+      return originalValue || f;
+    }).join(", ");
+    errorMessage = `MCP server "${server.name}" has unresolved required templates: ${missingVars}. Set the corresponding environment variables in your user settings.`;
+  }
+  return {
+    server: resolved,
+    unresolvedFields,
+    isValid: isValid2,
+    errorMessage
+  };
+}
+function resolveMcpServersTemplates(servers, context) {
+  return servers.map((server) => resolveMcpServerTemplates(server, context));
+}
+
+// src/tools/mcp/http-headers.ts
+init_cjs_shims();
+var MCP_HEADER_REDACTED_SENTINEL = "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022";
+var RESERVED_MCP_CUSTOM_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  // Hop-by-hop / transport-controlled headers. These are managed by fetch,
+  // the MCP SDK transport, or the auth configuration and should not be stored
+  // as custom MCP service-account headers.
+  "connection",
+  "content-length",
+  "cookie",
+  "host",
+  "mcp-session-id",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade"
+]);
+var HEADER_NAME_RE = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function isValidMCPHeaderName(name) {
+  return HEADER_NAME_RE.test(name);
+}
+function isReservedMCPCustomHeaderName(name) {
+  return RESERVED_MCP_CUSTOM_HEADER_NAMES.has(name.toLowerCase());
+}
+function normalizeMCPCustomHeaders(headers) {
+  if (!headers) return void 0;
+  const normalized = {};
+  for (const [rawName, rawValue] of Object.entries(headers)) {
+    const name = rawName.trim();
+    if (!name || !isValidMCPHeaderName(name)) continue;
+    if (isReservedMCPCustomHeaderName(name)) continue;
+    if (typeof rawValue !== "string") continue;
+    normalized[name] = rawValue;
+  }
+  return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function restoreRedactedMCPCustomHeaders(options) {
+  if (!options.next) return void 0;
+  const restored = {};
+  for (const [key, value] of Object.entries(options.next)) {
+    restored[key] = value === MCP_HEADER_REDACTED_SENTINEL && options.current?.[key] !== void 0 ? options.current[key] : value;
+  }
+  return normalizeMCPCustomHeaders(restored);
+}
+
+// src/tools/mcp/auth-secrets.ts
+var MCP_AUTH_SECRET_FIELDS = [
+  "token",
+  "api_token",
+  "api_secret",
+  "oauth_client_secret",
+  "oauth_access_token",
+  "oauth_refresh_token"
+];
+function restoreRedactedMCPAuthSecrets(options) {
+  if (!options.next) return void 0;
+  const restored = { ...options.next };
+  const record = restored;
+  for (const field of MCP_AUTH_SECRET_FIELDS) {
+    if (restored[field] === MCP_HEADER_REDACTED_SENTINEL && options.current?.[field] !== void 0) {
+      record[field] = options.current[field];
+    }
+  }
+  return restored;
+}
+
+// src/db/repositories/mcp-servers.ts
+init_database_wrapper();
+init_schema();
+var MCPServerRepository = class {
+  constructor(db) {
+    this.db = db;
+  }
+  /**
+   * Convert database row to MCPServer type
+   */
+  rowToMCPServer(row) {
+    return {
+      mcp_server_id: row.mcp_server_id,
+      name: row.name,
+      transport: row.transport,
+      scope: row.scope,
+      enabled: Boolean(row.enabled),
       source: row.source,
       created_at: new Date(row.created_at),
       updated_at: row.updated_at ? new Date(row.updated_at) : new Date(row.created_at),
@@ -16138,40 +16641,43 @@ var SessionRepository = class {
     const sessionId = row.session_id;
     const boardId = branchBoardId ?? null;
     const url = baseUrl && boardId ? getSessionUrl(sessionId, baseUrl) : null;
-    return {
-      session_id: sessionId,
-      status: row.status,
-      agentic_tool: row.agentic_tool,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      unix_username: row.unix_username || null,
-      branch_id: row.branch_id,
-      branch_board_id: boardId,
-      url,
-      ...row.data,
-      tasks: row.data.tasks.map((id) => id),
-      genealogy: {
-        parent_session_id: row.parent_session_id,
-        forked_from_session_id: row.forked_from_session_id,
-        fork_point_task_id: genealogyData.fork_point_task_id,
-        fork_point_message_index: genealogyData.fork_point_message_index,
-        spawn_point_task_id: genealogyData.spawn_point_task_id,
-        spawn_point_message_index: genealogyData.spawn_point_message_index,
-        children: genealogyData.children.map((id) => id)
+    return attachHiddenTenant(
+      {
+        session_id: sessionId,
+        status: row.status,
+        agentic_tool: row.agentic_tool,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        unix_username: row.unix_username || null,
+        branch_id: row.branch_id,
+        branch_board_id: boardId,
+        url,
+        ...row.data,
+        tasks: row.data.tasks.map((id) => id),
+        genealogy: {
+          parent_session_id: row.parent_session_id,
+          forked_from_session_id: row.forked_from_session_id,
+          fork_point_task_id: genealogyData.fork_point_task_id,
+          fork_point_message_index: genealogyData.fork_point_message_index,
+          spawn_point_task_id: genealogyData.spawn_point_task_id,
+          spawn_point_message_index: genealogyData.spawn_point_message_index,
+          children: genealogyData.children.map((id) => id)
+        },
+        permission_config: row.data.permission_config,
+        scheduled_run_at: row.scheduled_run_at ?? void 0,
+        scheduled_from_branch: row.scheduled_from_branch ?? false,
+        schedule_id: row.schedule_id ?? void 0,
+        ready_for_prompt: row.ready_for_prompt ?? false,
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_reason: row.archived_reason ?? void 0,
+        current_context_usage: row.data.current_context_usage,
+        context_window_limit: row.data.context_window_limit,
+        last_context_update_at: row.data.last_context_update_at
       },
-      permission_config: row.data.permission_config,
-      scheduled_run_at: row.scheduled_run_at ?? void 0,
-      scheduled_from_branch: row.scheduled_from_branch ?? false,
-      schedule_id: row.schedule_id ?? void 0,
-      ready_for_prompt: row.ready_for_prompt ?? false,
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_reason: row.archived_reason ?? void 0,
-      current_context_usage: row.data.current_context_usage,
-      context_window_limit: row.data.context_window_limit,
-      last_context_update_at: row.data.last_context_update_at
-    };
+      row
+    );
   }
   /**
    * Convert Session to database insert format
@@ -16318,6 +16824,26 @@ var SessionRepository = class {
       );
     }
   }
+  /**
+   * Resolve the owning user id for a session without hydrating the full row.
+   * Used by realtime delivery to offer streaming events to the session
+   * creator's own connections as a fallback, so their open tabs keep updating
+   * even before they subscribe to the per-session stream channel.
+   */
+  async findCreatedByBySessionId(id) {
+    try {
+      const fullId = await this.resolveId(id);
+      const row = await select(this.db, { created_by: sessions3.created_by }).from(sessions3).where((0, import_drizzle_orm30.eq)(sessions3.session_id, fullId)).one();
+      return row?.created_by ?? null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      if (error instanceof AmbiguousIdError) throw error;
+      throw new RepositoryError(
+        `Failed to find session owner: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Find all sessions
    *
@@ -16584,7 +17110,7 @@ var SessionRepository = class {
           throw new RepositoryError("Session update did not produce an updated_at timestamp");
         }
         merged.last_updated = insertData.updated_at.toISOString();
-        return merged;
+        return attachHiddenTenant(merged, currentRow);
       });
       return result;
     } catch (error) {
@@ -18596,192 +19122,52 @@ var UsersRepository = class {
    */
   async deleteToolConfigField(userId, tool, field) {
     const fullId = await this.resolveId(userId);
-    const row = await this.getRawRow(fullId);
-    if (!row) {
-      throw new EntityNotFoundError("User", userId);
-    }
-    const stored = row.data.agentic_tools ?? {};
-    const toolFields = { ...stored[tool] ?? {} };
-    delete toolFields[field];
-    const next = { ...stored };
-    if (Object.keys(toolFields).length > 0) {
-      next[tool] = toolFields;
-    } else {
-      delete next[tool];
-    }
-    await update(this.db, users3).set({
-      data: { ...row.data, agentic_tools: next },
-      updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm37.eq)(users3.user_id, fullId)).run();
-  }
-};
-
-// src/db/index.ts
-init_schema();
-
-// src/db/session-guard.ts
-init_cjs_shims();
-init_ids();
-async function withSessionGuard(sessionId, sessionsRepo, operation) {
-  const sessionExists = await sessionsRepo?.findById(sessionId);
-  if (!sessionExists) {
-    console.warn(`\u26A0\uFE0F  Session ${shortId(sessionId)} no longer exists, skipping guarded operation`);
-    return null;
-  }
-  return operation();
-}
-function isForeignKeyConstraintError(error) {
-  return error instanceof Error && (error.message.includes("FOREIGN KEY constraint failed") || error.message.includes("SQLITE_CONSTRAINT_FOREIGNKEY"));
-}
-
-// src/db/index.ts
-init_tenant_scope();
-init_user_utils();
-var compare = import_bcryptjs3.default.compare;
-var hash = import_bcryptjs3.default.hash;
-
-// src/environment/render-snapshot.ts
-init_cjs_shims();
-
-// src/templates/handlebars-helpers.ts
-init_cjs_shims();
-var import_handlebars = __toESM(require("handlebars"), 1);
-var helpersRegistered = false;
-function registerHandlebarsHelpers() {
-  import_handlebars.default.registerHelper("add", (a, b) => {
-    const numA = Number(a);
-    const numB = Number(b);
-    if (Number.isNaN(numA) || Number.isNaN(numB)) {
-      console.warn(`\u26A0\uFE0F  add helper received non-numeric values: ${a}, ${b}`);
-      return 0;
-    }
-    return numA + numB;
-  });
-  import_handlebars.default.registerHelper("sub", (a, b) => {
-    const numA = Number(a);
-    const numB = Number(b);
-    if (Number.isNaN(numA) || Number.isNaN(numB)) {
-      console.warn(`\u26A0\uFE0F  sub helper received non-numeric values: ${a}, ${b}`);
-      return 0;
-    }
-    return numA - numB;
-  });
-  import_handlebars.default.registerHelper("mul", (a, b) => {
-    const numA = Number(a);
-    const numB = Number(b);
-    if (Number.isNaN(numA) || Number.isNaN(numB)) {
-      console.warn(`\u26A0\uFE0F  mul helper received non-numeric values: ${a}, ${b}`);
-      return 0;
-    }
-    return numA * numB;
-  });
-  import_handlebars.default.registerHelper("div", (a, b) => {
-    const numA = Number(a);
-    const numB = Number(b);
-    if (Number.isNaN(numA) || Number.isNaN(numB)) {
-      console.warn(`\u26A0\uFE0F  div helper received non-numeric values: ${a}, ${b}`);
-      return 0;
-    }
-    if (numB === 0) {
-      console.warn(`\u26A0\uFE0F  div helper received zero divisor`);
-      return 0;
-    }
-    return numA / numB;
-  });
-  import_handlebars.default.registerHelper("mod", (a, b) => {
-    const numA = Number(a);
-    const numB = Number(b);
-    if (Number.isNaN(numA) || Number.isNaN(numB)) {
-      console.warn(`\u26A0\uFE0F  mod helper received non-numeric values: ${a}, ${b}`);
-      return 0;
-    }
-    if (numB === 0) {
-      console.warn(`\u26A0\uFE0F  mod helper received zero divisor`);
-      return 0;
-    }
-    return numA % numB;
-  });
-  import_handlebars.default.registerHelper("uppercase", (str) => {
-    return String(str || "").toUpperCase();
-  });
-  import_handlebars.default.registerHelper("lowercase", (str) => {
-    return String(str || "").toLowerCase();
-  });
-  import_handlebars.default.registerHelper("replace", (str, search, replace) => {
-    return String(str || "").split(search).join(replace);
-  });
-  import_handlebars.default.registerHelper("eq", (a, b) => {
-    return a === b;
-  });
-  import_handlebars.default.registerHelper("neq", (a, b) => {
-    return a !== b;
-  });
-  import_handlebars.default.registerHelper("gt", (a, b) => {
-    return Number(a) > Number(b);
-  });
-  import_handlebars.default.registerHelper("lt", (a, b) => {
-    return Number(a) < Number(b);
-  });
-  import_handlebars.default.registerHelper("gte", (a, b) => {
-    return Number(a) >= Number(b);
-  });
-  import_handlebars.default.registerHelper("lte", (a, b) => {
-    return Number(a) <= Number(b);
-  });
-  import_handlebars.default.registerHelper("default", (value, defaultValue) => {
-    return value ?? defaultValue;
-  });
-  import_handlebars.default.registerHelper("json", (obj) => {
-    return JSON.stringify(obj, null, 2);
-  });
-  import_handlebars.default.registerHelper("isDefined", (value) => value !== void 0);
-  helpersRegistered = true;
-}
-function renderTemplate(templateString, context, options = {}) {
-  if (!templateString || typeof templateString !== "string") {
-    return "";
-  }
-  if (!helpersRegistered) {
-    registerHandlebarsHelpers();
-  }
-  try {
-    const template = import_handlebars.default.compile(templateString);
-    return template(context);
-  } catch (error) {
-    console.error("\u274C Handlebars template error:", error);
-    console.error("Template:", templateString);
-    console.error("Context keys:", Object.keys(context));
-    if (options.onError === "raw") {
-      return templateString;
+    const row = await this.getRawRow(fullId);
+    if (!row) {
+      throw new EntityNotFoundError("User", userId);
     }
-    return "";
+    const stored = row.data.agentic_tools ?? {};
+    const toolFields = { ...stored[tool] ?? {} };
+    delete toolFields[field];
+    const next = { ...stored };
+    if (Object.keys(toolFields).length > 0) {
+      next[tool] = toolFields;
+    } else {
+      delete next[tool];
+    }
+    await update(this.db, users3).set({
+      data: { ...row.data, agentic_tools: next },
+      updated_at: /* @__PURE__ */ new Date()
+    }).where((0, import_drizzle_orm37.eq)(users3.user_id, fullId)).run();
+  }
+};
+
+// src/db/index.ts
+init_schema();
+
+// src/db/session-guard.ts
+init_cjs_shims();
+init_ids();
+async function withSessionGuard(sessionId, sessionsRepo, operation) {
+  const sessionExists = await sessionsRepo?.findById(sessionId);
+  if (!sessionExists) {
+    console.warn(`\u26A0\uFE0F  Session ${shortId(sessionId)} no longer exists, skipping guarded operation`);
+    return null;
   }
+  return operation();
 }
-function buildBranchContext(branch) {
-  const branchEntity = {
-    unique_id: branch.branch_unique_id,
-    name: branch.name,
-    path: branch.path,
-    gid: branch.unix_gid
-  };
-  return {
-    // Scoped entities (accessible as {{entity.property}})
-    branch: branchEntity,
-    // Legacy alias — preserved for existing env templates that reference
-    // {{worktree.*}} keys. Points at the same object so updates stay in sync.
-    worktree: branchEntity,
-    repo: {
-      slug: branch.repo_slug || ""
-    },
-    host: {
-      ip_address: branch.host_ip_address || ""
-    },
-    // User-defined custom context (accessible as {{custom.key}})
-    custom: branch.custom_context || {}
-  };
+function isForeignKeyConstraintError(error) {
+  return error instanceof Error && (error.message.includes("FOREIGN KEY constraint failed") || error.message.includes("SQLITE_CONSTRAINT_FOREIGNKEY"));
 }
 
+// src/db/index.ts
+init_tenant_scope();
+init_user_utils();
+var compare = import_bcryptjs3.default.compare;
+var hash = import_bcryptjs3.default.hash;
+
 // src/environment/render-snapshot.ts
+init_cjs_shims();
 function deepMergeContext(base, overrides) {
   if (!overrides) return base;
   const out = { ...base };
@@ -18818,7 +19204,9 @@ function renderBranchSnapshot(repo, branch, variantName) {
     repo_slug: repo.slug,
     custom_context: branch.custom_context,
     unix_gid: branch.unix_gid,
-    host_ip_address: branch.host_ip_address
+    host_ip_address: branch.host_ip_address,
+    base_ref: branch.base_ref,
+    ref_type: branch.ref_type
   });
   const { custom, ...nonCustomBase } = baseContext;
   const overridden = deepMergeContext(
@@ -19032,200 +19420,6 @@ async function validateDirectory(path2, context = "Directory") {
 // src/mcp/index.ts
 init_cjs_shims();
 
-// src/mcp/template-resolver.ts
-init_cjs_shims();
-function buildMCPTemplateContextFromEnv(env) {
-  const userEnvKeysStr = env[AGOR_USER_ENV_KEYS_VAR];
-  const allowedKeys = userEnvKeysStr ? new Set(userEnvKeysStr.split(",")) : /* @__PURE__ */ new Set();
-  const userEnv = {};
-  for (const key of allowedKeys) {
-    const value = env[key];
-    if (value !== void 0) {
-      userEnv[key] = value;
-    }
-  }
-  return {
-    user: {
-      env: userEnv
-    }
-  };
-}
-function containsTemplate(value) {
-  return value.includes("{{") && value.includes("}}");
-}
-function resolveStringValue(fieldName, templateValue, context) {
-  if (!containsTemplate(templateValue)) {
-    return templateValue;
-  }
-  try {
-    const resolved = renderTemplate(templateValue, context);
-    if (!resolved || resolved.trim() === "") {
-      console.log(`   \u2139\uFE0F  MCP "${fieldName}" resolved to empty (user may need to set env var)`);
-      return void 0;
-    }
-    return resolved;
-  } catch (error) {
-    console.warn(
-      `   \u26A0\uFE0F  Failed to resolve MCP template "${fieldName}":`,
-      error instanceof Error ? error.message : String(error)
-    );
-    return void 0;
-  }
-}
-function resolveMcpServerEnv(envTemplate, context) {
-  if (!envTemplate || Object.keys(envTemplate).length === 0) {
-    return void 0;
-  }
-  const result = {};
-  for (const [key, templateValue] of Object.entries(envTemplate)) {
-    const resolved = resolveStringValue(`env.${key}`, templateValue, context);
-    if (resolved !== void 0) {
-      result[key] = resolved;
-    }
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-function resolveMcpServerTemplates(server, context) {
-  const resolved = { ...server };
-  const unresolvedFields = [];
-  const hadUrlTemplate = server.url && containsTemplate(server.url);
-  if (server.url) {
-    resolved.url = resolveStringValue("url", server.url, context);
-    if (hadUrlTemplate && !resolved.url) {
-      unresolvedFields.push("url");
-    }
-  }
-  if (server.env) {
-    const resolvedEnv = {};
-    for (const [key, templateValue] of Object.entries(server.env)) {
-      const hadTemplate = containsTemplate(templateValue);
-      const resolvedValue = resolveStringValue(`env.${key}`, templateValue, context);
-      if (resolvedValue !== void 0) {
-        resolvedEnv[key] = resolvedValue;
-      } else if (hadTemplate) {
-        unresolvedFields.push(`env.${key}`);
-      }
-    }
-    resolved.env = Object.keys(resolvedEnv).length > 0 ? resolvedEnv : void 0;
-  }
-  if (server.headers) {
-    const resolvedHeaders = {};
-    for (const [key, templateValue] of Object.entries(server.headers)) {
-      const hadTemplate = containsTemplate(templateValue);
-      const resolvedValue = resolveStringValue(`headers.${key}`, templateValue, context);
-      if (resolvedValue !== void 0) {
-        resolvedHeaders[key] = resolvedValue;
-      } else if (hadTemplate) {
-        unresolvedFields.push(`headers.${key}`);
-      }
-    }
-    resolved.headers = Object.keys(resolvedHeaders).length > 0 ? resolvedHeaders : void 0;
-  }
-  if (server.auth) {
-    const resolvedAuth = { ...server.auth };
-    if (server.auth.token) {
-      const hadTemplate = containsTemplate(server.auth.token);
-      resolvedAuth.token = resolveStringValue("auth.token", server.auth.token, context);
-      if (hadTemplate && !resolvedAuth.token) {
-        unresolvedFields.push("auth.token");
-      }
-    }
-    if (server.auth.api_url) {
-      const hadTemplate = containsTemplate(server.auth.api_url);
-      resolvedAuth.api_url = resolveStringValue("auth.api_url", server.auth.api_url, context);
-      if (hadTemplate && !resolvedAuth.api_url) {
-        unresolvedFields.push("auth.api_url");
-      }
-    }
-    if (server.auth.api_token) {
-      const hadTemplate = containsTemplate(server.auth.api_token);
-      resolvedAuth.api_token = resolveStringValue("auth.api_token", server.auth.api_token, context);
-      if (hadTemplate && !resolvedAuth.api_token) {
-        unresolvedFields.push("auth.api_token");
-      }
-    }
-    if (server.auth.api_secret) {
-      const hadTemplate = containsTemplate(server.auth.api_secret);
-      resolvedAuth.api_secret = resolveStringValue(
-        "auth.api_secret",
-        server.auth.api_secret,
-        context
-      );
-      if (hadTemplate && !resolvedAuth.api_secret) {
-        unresolvedFields.push("auth.api_secret");
-      }
-    }
-    if (server.auth.type === "oauth") {
-      if (server.auth.oauth_token_url) {
-        const _hadTemplate = containsTemplate(server.auth.oauth_token_url);
-        resolvedAuth.oauth_token_url = resolveStringValue(
-          "auth.oauth_token_url",
-          server.auth.oauth_token_url,
-          context
-        );
-      }
-      if (server.auth.oauth_client_id) {
-        const _hadTemplate = containsTemplate(server.auth.oauth_client_id);
-        resolvedAuth.oauth_client_id = resolveStringValue(
-          "auth.oauth_client_id",
-          server.auth.oauth_client_id,
-          context
-        );
-      }
-      if (server.auth.oauth_client_secret) {
-        const _hadTemplate = containsTemplate(server.auth.oauth_client_secret);
-        resolvedAuth.oauth_client_secret = resolveStringValue(
-          "auth.oauth_client_secret",
-          server.auth.oauth_client_secret,
-          context
-        );
-      }
-      if (server.auth.oauth_scope) {
-        const _hadTemplate = containsTemplate(server.auth.oauth_scope);
-        resolvedAuth.oauth_scope = resolveStringValue(
-          "auth.oauth_scope",
-          server.auth.oauth_scope,
-          context
-        );
-      }
-      resolvedAuth.oauth_grant_type = server.auth.oauth_grant_type || "client_credentials";
-    }
-    resolved.auth = resolvedAuth;
-  }
-  const isHttpTransport = server.transport === "http" || server.transport === "sse";
-  const urlRequired = isHttpTransport && hadUrlTemplate;
-  const urlMissing = urlRequired && !resolved.url;
-  const isValid2 = !urlMissing;
-  let errorMessage;
-  if (!isValid2) {
-    const missingVars = unresolvedFields.map((f) => {
-      let originalValue;
-      if (f === "url") {
-        originalValue = server.url;
-      } else if (f.startsWith("env.")) {
-        originalValue = server.env?.[f.slice(4)];
-      } else if (f.startsWith("headers.")) {
-        originalValue = server.headers?.[f.slice(8)];
-      } else if (f.startsWith("auth.") && server.auth) {
-        const authKey = f.slice(5);
-        const authValue = server.auth[authKey];
-        originalValue = typeof authValue === "string" ? authValue : void 0;
-      }
-      return originalValue || f;
-    }).join(", ");
-    errorMessage = `MCP server "${server.name}" has unresolved required templates: ${missingVars}. Set the corresponding environment variables in your user settings.`;
-  }
-  return {
-    server: resolved,
-    unresolvedFields,
-    isValid: isValid2,
-    errorMessage
-  };
-}
-function resolveMcpServersTemplates(servers, context) {
-  return servers.map((server) => resolveMcpServerTemplates(server, context));
-}
-
 // src/search/index.ts
 init_cjs_shims();
 
@@ -22543,6 +22737,7 @@ function unpatchConsole() {
   SudoCliExecutor,
   SudoDirectExecutor,
   SymlinkCommands,
+  TEMPLATE_RESOLVABLE_MCP_AUTH_SECRET_FIELDS,
   TERMINAL_TASK_STATUSES,
   TOOL_API_KEY_NAMES,
   TaskRepository,
@@ -22604,6 +22799,7 @@ function unpatchConsole() {
   checkAsUser,
   checkMigrationStatus,
   compare,
+  containsTemplate,
   count,
   createAdminExecutor,
   createClient,
@@ -22693,6 +22889,7 @@ function unpatchConsole() {
   getRepoReferenceOptions,
   getReposDir,
   getReposDirAsync,
+  getRequiredSecretFields,
   getServiceTier,
   getSessionType,
   getUidFromUsername,
@@ -22745,6 +22942,7 @@ function unpatchConsole() {
   isThreadRoot,
   isUnixGroupRefreshNeeded,
   isUnixImpersonationEnabled,
+  isUserEnvPlaceholder,
   isUserInGroup,
   isValid,
   isValidBranchGroupName,