agor-live 0.23.1 → 0.23.2

package/dist/core/seed/index.cjs

@@ -7195,6 +7195,63 @@ var BranchRepository = class {
     }
     return Array.from(userIds);
   }
+  /**
+   * Find non-archived branches whose explicit filesystem access set can change
+   * when membership in the given group changes.
+   *
+   * Keep this inverse lookup in lockstep with findExplicitFsAccessUserIds():
+   * both encode which group grants materialize into branch-folder access.
+   * App-only grants (`fs_access = 'none'`) are intentionally excluded because
+   * membership changes for those grants do not require branch-folder mutation.
+   */
+  async findExplicitFsAccessBranchIdsForGroup(groupId) {
+    const directRows = await select(this.db, { branch_id: branchGroupGrants3.branch_id }).from(branchGroupGrants3).innerJoin(branches3, (0, import_drizzle_orm11.eq)(branches3.branch_id, branchGroupGrants3.branch_id)).innerJoin(
+      groups3,
+      (0, import_drizzle_orm11.and)((0, import_drizzle_orm11.eq)(groups3.group_id, branchGroupGrants3.group_id), (0, import_drizzle_orm11.eq)(groups3.archived, false))
+    ).where(
+      (0, import_drizzle_orm11.and)(
+        (0, import_drizzle_orm11.eq)(branchGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm11.eq)(branches3.archived, false),
+        (0, import_drizzle_orm11.inArray)(
+          import_drizzle_orm11.sql`coalesce(${branchGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const boardRows = await select(this.db, { branch_id: branches3.branch_id }).from(boardGroupGrants3).innerJoin(
+      groups3,
+      (0, import_drizzle_orm11.and)((0, import_drizzle_orm11.eq)(groups3.group_id, boardGroupGrants3.group_id), (0, import_drizzle_orm11.eq)(groups3.archived, false))
+    ).innerJoin(
+      boards3,
+      (0, import_drizzle_orm11.and)(
+        (0, import_drizzle_orm11.eq)(boards3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm11.eq)(import_drizzle_orm11.sql`coalesce(${jsonExtract(this.db, boards3.data, "access_mode")}, 'shared')`, "shared")
+      )
+    ).innerJoin(
+      branches3,
+      (0, import_drizzle_orm11.and)(
+        (0, import_drizzle_orm11.eq)(branches3.board_id, boardGroupGrants3.board_id),
+        (0, import_drizzle_orm11.eq)(branches3.permission_source, "board"),
+        (0, import_drizzle_orm11.eq)(branches3.archived, false)
+      )
+    ).where(
+      (0, import_drizzle_orm11.and)(
+        (0, import_drizzle_orm11.eq)(boardGroupGrants3.group_id, groupId),
+        (0, import_drizzle_orm11.inArray)(
+          import_drizzle_orm11.sql`coalesce(${boardGroupGrants3.fs_access}, 'read')`,
+          FS_ACCESS_BRANCH_PERMISSIONS
+        )
+      )
+    ).all();
+    const branchIds = /* @__PURE__ */ new Set();
+    for (const row of directRows) {
+      branchIds.add(row.branch_id);
+    }
+    for (const row of boardRows) {
+      branchIds.add(row.branch_id);
+    }
+    return Array.from(branchIds);
+  }
   async findBoardAlignedBranches(boardId) {
     const rows = await select(this.db).from(branches3).where(
       (0, import_drizzle_orm11.and)(
@@ -8202,6 +8259,60 @@ var BoardRepository = class {
       );
     }
   }
+  /**
+   * Shallow-merge field patches into existing board objects in a single
+   * read-modify-write.
+   *
+   * Unlike upsertBoardObject (which fully replaces the object value, dropping
+   * omitted fields), this overwrites ONLY the provided keys and leaves the rest
+   * of each object intact — so a narrow change (e.g. a zIndex reorder) has a
+   * smaller blast radius and won't clobber a field edited via a different patch
+   * call. Multiple objects in one call are merged before a single write, so a
+   * forward/backward swap touches both neighbors in one update.
+   *
+   * Objects that no longer exist are SKIPPED, never re-created — so a swap can't
+   * resurrect a neighbor deleted between the client's read and this write.
+   *
+   * Only an explicit allowlist of fields can be merged (currently just `zIndex`,
+   * which is also clamped into the board-object band [1, 499] so it can never be
+   * pushed onto the card (500) / comment (1000) layers). Any other key in a
+   * patch is ignored, so this narrow action cannot reshape an object (e.g. flip
+   * its `type`) the way a full upsert could.
+   *
+   * NOTE: this is NOT atomic against concurrent writers. Like every other board
+   * writer, the findById → update sequence has a lost-update window: a write
+   * that lands between the read and the update can be overwritten (last-write-
+   * wins). Merging only the patched keys narrows that window's blast radius
+   * versus a full-object upsert, but does not close it.
+   */
+  async mergeBoardObjectFields(boardId, patches) {
+    const Z_MIN = 1;
+    const Z_MAX = 499;
+    try {
+      const fullId = await this.resolveId(boardId);
+      const current = await this.findById(fullId);
+      if (!current) {
+        throw new EntityNotFoundError("Board", boardId);
+      }
+      const updatedObjects = { ...current.objects || {} };
+      for (const [objectId, fields] of Object.entries(patches)) {
+        const existing = updatedObjects[objectId];
+        if (!existing) continue;
+        const { zIndex } = fields;
+        if (typeof zIndex !== "number" || !Number.isFinite(zIndex)) continue;
+        const safeZIndex = Math.min(Z_MAX, Math.max(Z_MIN, zIndex));
+        updatedObjects[objectId] = { ...existing, zIndex: safeZIndex };
+      }
+      return this.update(fullId, { objects: updatedObjects });
+    } catch (error) {
+      if (error instanceof RepositoryError) throw error;
+      if (error instanceof EntityNotFoundError) throw error;
+      throw new RepositoryError(
+        `Failed to merge board object fields: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * DEPRECATED: Delete a zone and handle associated sessions
    * TODO: Reimplement using board-objects table
@@ -8822,12 +8933,72 @@ init_schema();
 
 // src/db/repositories/mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm21 = require("drizzle-orm");
+var import_drizzle_orm23 = require("drizzle-orm");
 init_ids();
 
 // src/tools/mcp/auth-secrets.ts
 init_cjs_shims();
 
+// src/mcp/template-resolver.ts
+init_cjs_shims();
+
+// src/config/env-resolver.ts
+init_cjs_shims();
+var import_drizzle_orm22 = require("drizzle-orm");
+init_database_wrapper();
+
+// src/db/repositories/session-env-selections.ts
+init_cjs_shims();
+var import_drizzle_orm21 = require("drizzle-orm");
+init_database_wrapper();
+init_schema();
+
+// src/config/env-resolver.ts
+init_schema();
+
+// src/config/env-blocklist.ts
+init_cjs_shims();
+var BLOCKED_ENV_PATTERNS = Object.freeze([
+  /^LD_/i,
+  /^DYLD_/i,
+  /^PYTHON(?!_AGOR_)/i
+]);
+
+// src/config/env-vars.ts
+init_cjs_shims();
+var V05_SCOPES = ["global", "session"];
+var V05_SCOPE_SET = new Set(V05_SCOPES);
+function normalizeStoredEnvVar(raw) {
+  if (typeof raw === "string") {
+    return { value_encrypted: raw, scope: "global" };
+  }
+  return {
+    value_encrypted: raw.value_encrypted,
+    scope: raw.scope,
+    resource_id: raw.resource_id ?? null,
+    extra_config: raw.extra_config ?? null
+  };
+}
+function normalizeStoredEnvMap(raw) {
+  const out = {};
+  if (!raw) return out;
+  for (const [key, value] of Object.entries(raw)) {
+    try {
+      out[key] = normalizeStoredEnvVar(value);
+    } catch (err) {
+      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
+    }
+  }
+  return out;
+}
+
+// src/templates/handlebars-helpers.ts
+init_cjs_shims();
+var import_handlebars = __toESM(require("handlebars"), 1);
+
+// src/mcp/template-patterns.ts
+init_cjs_shims();
+
 // src/tools/mcp/http-headers.ts
 init_cjs_shims();
 
@@ -8837,7 +9008,7 @@ init_schema();
 
 // src/db/repositories/messages.ts
 init_cjs_shims();
-var import_drizzle_orm22 = require("drizzle-orm");
+var import_drizzle_orm24 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 var MessagesRepository = class {
@@ -8905,7 +9076,7 @@ var MessagesRepository = class {
    * Get message by ID
    */
   async findById(messageId) {
-    const row = await select(this.db).from(messages3).where((0, import_drizzle_orm22.eq)(messages3.message_id, messageId)).one();
+    const row = await select(this.db).from(messages3).where((0, import_drizzle_orm24.eq)(messages3.message_id, messageId)).one();
     return row ? this.rowToMessage(row) : null;
   }
   /**
@@ -8914,19 +9085,19 @@ var MessagesRepository = class {
   async findAll(filter) {
     if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
     const conditions = [];
-    if (filter?.sessionId) conditions.push((0, import_drizzle_orm22.eq)(messages3.session_id, filter.sessionId));
+    if (filter?.sessionId) conditions.push((0, import_drizzle_orm24.eq)(messages3.session_id, filter.sessionId));
     if (filter?.sessionIds !== void 0)
-      conditions.push((0, import_drizzle_orm22.inArray)(messages3.session_id, filter.sessionIds));
-    if (filter?.taskId) conditions.push((0, import_drizzle_orm22.eq)(messages3.task_id, filter.taskId));
-    if (filter?.type) conditions.push((0, import_drizzle_orm22.eq)(messages3.type, filter.type));
-    if (filter?.role) conditions.push((0, import_drizzle_orm22.eq)(messages3.role, filter.role));
+      conditions.push((0, import_drizzle_orm24.inArray)(messages3.session_id, filter.sessionIds));
+    if (filter?.taskId) conditions.push((0, import_drizzle_orm24.eq)(messages3.task_id, filter.taskId));
+    if (filter?.type) conditions.push((0, import_drizzle_orm24.eq)(messages3.type, filter.type));
+    if (filter?.role) conditions.push((0, import_drizzle_orm24.eq)(messages3.role, filter.role));
     if (filter?.visibleToUserId) {
       conditions.push(
         visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, messages3.session_id)
       );
     }
     let query = select(this.db).from(messages3);
-    if (conditions.length > 0) query = query.where((0, import_drizzle_orm22.and)(...conditions));
+    if (conditions.length > 0) query = query.where((0, import_drizzle_orm24.and)(...conditions));
     const rows = await query.orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
@@ -8934,21 +9105,21 @@ var MessagesRepository = class {
    * Get all messages for a session (ordered by index)
    */
   async findBySessionId(sessionId) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm22.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm24.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a session filtered by type (ordered by index)
    */
   async findBySessionIdAndType(sessionId, type) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm22.and)((0, import_drizzle_orm22.eq)(messages3.session_id, sessionId), (0, import_drizzle_orm22.eq)(messages3.type, type))).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm24.and)((0, import_drizzle_orm24.eq)(messages3.session_id, sessionId), (0, import_drizzle_orm24.eq)(messages3.type, type))).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
    * Get all messages for a task (ordered by index)
    */
   async findByTaskId(taskId) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm22.eq)(messages3.task_id, taskId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm24.eq)(messages3.task_id, taskId)).orderBy(messages3.index).all();
     return rows.map((r) => this.rowToMessage(r));
   }
   /**
@@ -8956,7 +9127,7 @@ var MessagesRepository = class {
    * Used for task message_range queries
    */
   async findByRange(sessionId, startIndex, endIndex) {
-    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm22.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
+    const rows = await select(this.db).from(messages3).where((0, import_drizzle_orm24.eq)(messages3.session_id, sessionId)).orderBy(messages3.index).all();
     return rows.filter((r) => r.index >= startIndex && r.index <= endIndex).map((r) => this.rowToMessage(r));
   }
   /**
@@ -8969,33 +9140,33 @@ var MessagesRepository = class {
     }
     const updated = { ...existing, ...updates };
     const row = this.messageToRow(updated);
-    const result = await update(this.db, messages3).set(row).where((0, import_drizzle_orm22.eq)(messages3.message_id, messageId)).returning().one();
+    const result = await update(this.db, messages3).set(row).where((0, import_drizzle_orm24.eq)(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(result);
   }
   /**
    * Update message task assignment
    */
   async assignToTask(messageId, taskId) {
-    const updated = await update(this.db, messages3).set({ task_id: taskId }).where((0, import_drizzle_orm22.eq)(messages3.message_id, messageId)).returning().one();
+    const updated = await update(this.db, messages3).set({ task_id: taskId }).where((0, import_drizzle_orm24.eq)(messages3.message_id, messageId)).returning().one();
     return this.rowToMessage(updated);
   }
   /**
    * Delete all messages for a session (cascades automatically via FK)
    */
   async deleteBySessionId(sessionId) {
-    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm22.eq)(messages3.session_id, sessionId)).run();
+    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm24.eq)(messages3.session_id, sessionId)).run();
   }
   /**
    * Delete a single message
    */
   async delete(messageId) {
-    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm22.eq)(messages3.message_id, messageId)).run();
+    await deleteFrom(this.db, messages3).where((0, import_drizzle_orm24.eq)(messages3.message_id, messageId)).run();
   }
 };
 
 // src/db/repositories/repos.ts
 init_cjs_shims();
-var import_drizzle_orm23 = require("drizzle-orm");
+var import_drizzle_orm25 = require("drizzle-orm");
 
 // src/config/variant-resolver.ts
 init_cjs_shims();
@@ -9145,7 +9316,7 @@ var RepoRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Repo", async (pattern) => {
-      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm23.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(repos3).where((0, import_drizzle_orm25.like)(repos3.repo_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.repo_id);
     });
   }
@@ -9156,7 +9327,7 @@ var RepoRepository = class {
     try {
       const insertData = this.repoToInsert(data);
       await insert(this.db, repos3).values(insertData).run();
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, insertData.repo_id)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, insertData.repo_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created repo");
       }
@@ -9175,7 +9346,7 @@ var RepoRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -9191,7 +9362,7 @@ var RepoRepository = class {
    */
   async findBySlug(slug) {
     try {
-      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.slug, slug)).one();
+      const row = await select(this.db).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.slug, slug)).one();
       return row ? this.rowToRepo(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -9259,8 +9430,8 @@ var RepoRepository = class {
       let changed = 0;
       for (const finding of scan.findings) {
         await this.db.transaction(async (tx) => {
-          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id));
-          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id)).one();
+          await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm25.eq)(repos3.repo_id, finding.repo_id));
+          const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, finding.repo_id)).one();
           if (!currentRow) return;
           const data = currentRow.data;
           if (typeof data.remote_url !== "string" || !httpUrlHasUserinfo(data.remote_url)) {
@@ -9272,7 +9443,7 @@ var RepoRepository = class {
               ...data,
               remote_url: stripHttpUrlUserinfo(data.remote_url)
             }
-          }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, finding.repo_id)).run();
+          }).where((0, import_drizzle_orm25.eq)(repos3.repo_id, finding.repo_id)).run();
           changed += 1;
         });
       }
@@ -9294,8 +9465,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm25.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -9309,7 +9480,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: merged.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).run();
         merged.clone_error = insertData.data.clone_error;
         merged.remote_url = insertData.data.remote_url;
         merged.last_updated = newUpdatedAt.toISOString();
@@ -9343,8 +9514,8 @@ var RepoRepository = class {
     try {
       const fullId = await this.resolveId(id);
       return await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm23.eq)(repos3.repo_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, repos3, (0, import_drizzle_orm25.eq)(repos3.repo_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Repo", id);
         }
@@ -9358,7 +9529,7 @@ var RepoRepository = class {
           repo_type: insertData.repo_type,
           unix_group: next.unix_group ?? null,
           data: insertData.data
-        }).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
+        }).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).run();
         next.environment = insertData.data.environment;
         next.environment_config = insertData.data.environment_config;
         next.remote_url = insertData.data.remote_url;
@@ -9398,7 +9569,7 @@ var RepoRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm23.eq)(repos3.repo_id, fullId)).run();
+      const result = await deleteFrom(this.db, repos3).where((0, import_drizzle_orm25.eq)(repos3.repo_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Repo", id);
       }
@@ -9429,7 +9600,7 @@ var RepoRepository = class {
    */
   async count() {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm23.sql`count(*)` }).from(repos3).one();
+      const result = await select(this.db, { count: import_drizzle_orm25.sql`count(*)` }).from(repos3).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -9442,34 +9613,28 @@ var RepoRepository = class {
 
 // src/db/repositories/schedules.ts
 init_cjs_shims();
-var import_drizzle_orm24 = require("drizzle-orm");
+var import_drizzle_orm26 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/serialized-sessions.ts
 init_cjs_shims();
-var import_drizzle_orm25 = require("drizzle-orm");
+var import_drizzle_orm27 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
 
-// src/db/repositories/session-env-selections.ts
-init_cjs_shims();
-var import_drizzle_orm26 = require("drizzle-orm");
-init_database_wrapper();
-init_schema();
-
 // src/db/repositories/session-mcp-servers.ts
 init_cjs_shims();
-var import_drizzle_orm28 = require("drizzle-orm");
+var import_drizzle_orm29 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/sessions.ts
 init_cjs_shims();
 init_types();
-var import_drizzle_orm27 = require("drizzle-orm");
+var import_drizzle_orm28 = require("drizzle-orm");
 init_config_manager();
 init_ids();
 init_database_wrapper();
@@ -9496,40 +9661,43 @@ var SessionRepository = class {
     const sessionId = row.session_id;
     const boardId = branchBoardId ?? null;
     const url = baseUrl && boardId ? getSessionUrl(sessionId, baseUrl) : null;
-    return {
-      session_id: sessionId,
-      status: row.status,
-      agentic_tool: row.agentic_tool,
-      created_at: new Date(row.created_at).toISOString(),
-      last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
-      created_by: row.created_by,
-      unix_username: row.unix_username || null,
-      branch_id: row.branch_id,
-      branch_board_id: boardId,
-      url,
-      ...row.data,
-      tasks: row.data.tasks.map((id) => id),
-      genealogy: {
-        parent_session_id: row.parent_session_id,
-        forked_from_session_id: row.forked_from_session_id,
-        fork_point_task_id: genealogyData.fork_point_task_id,
-        fork_point_message_index: genealogyData.fork_point_message_index,
-        spawn_point_task_id: genealogyData.spawn_point_task_id,
-        spawn_point_message_index: genealogyData.spawn_point_message_index,
-        children: genealogyData.children.map((id) => id)
+    return attachHiddenTenant(
+      {
+        session_id: sessionId,
+        status: row.status,
+        agentic_tool: row.agentic_tool,
+        created_at: new Date(row.created_at).toISOString(),
+        last_updated: row.updated_at ? new Date(row.updated_at).toISOString() : new Date(row.created_at).toISOString(),
+        created_by: row.created_by,
+        unix_username: row.unix_username || null,
+        branch_id: row.branch_id,
+        branch_board_id: boardId,
+        url,
+        ...row.data,
+        tasks: row.data.tasks.map((id) => id),
+        genealogy: {
+          parent_session_id: row.parent_session_id,
+          forked_from_session_id: row.forked_from_session_id,
+          fork_point_task_id: genealogyData.fork_point_task_id,
+          fork_point_message_index: genealogyData.fork_point_message_index,
+          spawn_point_task_id: genealogyData.spawn_point_task_id,
+          spawn_point_message_index: genealogyData.spawn_point_message_index,
+          children: genealogyData.children.map((id) => id)
+        },
+        permission_config: row.data.permission_config,
+        scheduled_run_at: row.scheduled_run_at ?? void 0,
+        scheduled_from_branch: row.scheduled_from_branch ?? false,
+        schedule_id: row.schedule_id ?? void 0,
+        ready_for_prompt: row.ready_for_prompt ?? false,
+        archived: Boolean(row.archived),
+        // Convert SQLite integer (0/1) to boolean
+        archived_reason: row.archived_reason ?? void 0,
+        current_context_usage: row.data.current_context_usage,
+        context_window_limit: row.data.context_window_limit,
+        last_context_update_at: row.data.last_context_update_at
       },
-      permission_config: row.data.permission_config,
-      scheduled_run_at: row.scheduled_run_at ?? void 0,
-      scheduled_from_branch: row.scheduled_from_branch ?? false,
-      schedule_id: row.schedule_id ?? void 0,
-      ready_for_prompt: row.ready_for_prompt ?? false,
-      archived: Boolean(row.archived),
-      // Convert SQLite integer (0/1) to boolean
-      archived_reason: row.archived_reason ?? void 0,
-      current_context_usage: row.data.current_context_usage,
-      context_window_limit: row.data.context_window_limit,
-      last_context_update_at: row.data.last_context_update_at
-    };
+      row
+    );
   }
   /**
    * Convert Session to database insert format
@@ -9605,7 +9773,7 @@ var SessionRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Session", async (pattern) => {
-      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm27.like)(sessions3.session_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(sessions3).where((0, import_drizzle_orm28.like)(sessions3.session_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.session_id);
     });
   }
@@ -9617,7 +9785,7 @@ var SessionRepository = class {
       const insertData = this.sessionToInsert(data);
       await insert(this.db, sessions3).values(insertData).run();
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm27.eq)(sessions3.session_id, insertData.session_id)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, insertData.session_id)).one();
       if (!result) {
         throw new RepositoryError("Failed to retrieve created session");
       }
@@ -9642,7 +9810,7 @@ var SessionRepository = class {
     try {
       const fullId = await this.resolveId(id);
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm27.eq)(sessions3.session_id, fullId)).one();
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -9665,7 +9833,7 @@ var SessionRepository = class {
   async findBranchIdBySessionId(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where((0, import_drizzle_orm27.eq)(sessions3.session_id, fullId)).one();
+      const row = await select(this.db, { branch_id: sessions3.branch_id }).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
       return row?.branch_id ?? null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -9676,6 +9844,26 @@ var SessionRepository = class {
       );
     }
   }
+  /**
+   * Resolve the owning user id for a session without hydrating the full row.
+   * Used by realtime delivery to offer streaming events to the session
+   * creator's own connections as a fallback, so their open tabs keep updating
+   * even before they subscribe to the per-session stream channel.
+   */
+  async findCreatedByBySessionId(id) {
+    try {
+      const fullId = await this.resolveId(id);
+      const row = await select(this.db, { created_by: sessions3.created_by }).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
+      return row?.created_by ?? null;
+    } catch (error) {
+      if (error instanceof EntityNotFoundError) return null;
+      if (error instanceof AmbiguousIdError) throw error;
+      throw new RepositoryError(
+        `Failed to find session owner: ${error instanceof Error ? error.message : String(error)}`,
+        error
+      );
+    }
+  }
   /**
    * Find all sessions
    *
@@ -9688,14 +9876,14 @@ var SessionRepository = class {
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
-        (0, import_drizzle_orm27.and)(
-          (0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id),
-          (0, import_drizzle_orm27.eq)(branchOwners3.user_id, filter.visibleToUserId)
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
+          (0, import_drizzle_orm28.eq)(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id));
-      const results = conditions.length > 0 ? await query.where((0, import_drizzle_orm27.and)(...conditions)).all() : await query.all();
+      ) : select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
+      const results = conditions.length > 0 ? await query.where((0, import_drizzle_orm28.and)(...conditions)).all() : await query.all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -9718,7 +9906,7 @@ var SessionRepository = class {
   async findByStatus(status) {
     try {
       const baseUrl = await getBaseUrl();
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm27.eq)(sessions3.status, status)).all();
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.status, status)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -9746,18 +9934,18 @@ var SessionRepository = class {
   async findByBoard(boardId, filter) {
     try {
       const baseUrl = await getBaseUrl();
-      const conditions = [(0, import_drizzle_orm27.eq)(branches3.board_id, boardId)];
+      const conditions = [(0, import_drizzle_orm28.eq)(branches3.board_id, boardId)];
       if (filter?.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, filter.visibleToUserId));
       }
-      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+      const query = filter?.visibleToUserId ? select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
         branchOwners3,
-        (0, import_drizzle_orm27.and)(
-          (0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id),
-          (0, import_drizzle_orm27.eq)(branchOwners3.user_id, filter.visibleToUserId)
+        (0, import_drizzle_orm28.and)(
+          (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
+          (0, import_drizzle_orm28.eq)(branchOwners3.user_id, filter.visibleToUserId)
         )
-      ) : select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id));
-      const results = await query.where((0, import_drizzle_orm27.and)(...conditions)).all();
+      ) : select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
+      const results = await query.where((0, import_drizzle_orm28.and)(...conditions)).all();
       return results.map(
         (result) => {
           const sessionRow = result.sessions;
@@ -9793,38 +9981,38 @@ var SessionRepository = class {
     try {
       const baseUrl = await getBaseUrl();
       const conditions = [];
-      if (opts.boardId !== void 0) conditions.push((0, import_drizzle_orm27.eq)(branches3.board_id, opts.boardId));
-      if (opts.archived !== void 0) conditions.push((0, import_drizzle_orm27.eq)(sessions3.archived, opts.archived));
+      if (opts.boardId !== void 0) conditions.push((0, import_drizzle_orm28.eq)(branches3.board_id, opts.boardId));
+      if (opts.archived !== void 0) conditions.push((0, import_drizzle_orm28.eq)(sessions3.archived, opts.archived));
       if (opts.visibleToUserId) {
         conditions.push(visibleBranchAccessCondition(this.db, opts.visibleToUserId));
       }
-      const whereClause = conditions.length > 0 ? (0, import_drizzle_orm27.and)(...conditions) : void 0;
-      let countQuery = select(this.db, { count: import_drizzle_orm27.sql`count(*)` }).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id));
+      const whereClause = conditions.length > 0 ? (0, import_drizzle_orm28.and)(...conditions) : void 0;
+      let countQuery = select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         countQuery = countQuery.leftJoin(
           branchOwners3,
-          (0, import_drizzle_orm27.and)(
-            (0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id),
-            (0, import_drizzle_orm27.eq)(branchOwners3.user_id, opts.visibleToUserId)
+          (0, import_drizzle_orm28.and)(
+            (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
+            (0, import_drizzle_orm28.eq)(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       const countRow = await (whereClause ? countQuery.where(whereClause) : countQuery).one();
       const total = Number(countRow?.count ?? 0);
-      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id));
+      let dataQuery = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id));
       if (opts.visibleToUserId) {
         dataQuery = dataQuery.leftJoin(
           branchOwners3,
-          (0, import_drizzle_orm27.and)(
-            (0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id),
-            (0, import_drizzle_orm27.eq)(branchOwners3.user_id, opts.visibleToUserId)
+          (0, import_drizzle_orm28.and)(
+            (0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id),
+            (0, import_drizzle_orm28.eq)(branchOwners3.user_id, opts.visibleToUserId)
           )
         );
       }
       if (whereClause) dataQuery = dataQuery.where(whereClause);
       if (opts.sortUpdatedAt !== void 0) {
         dataQuery = dataQuery.orderBy(
-          opts.sortUpdatedAt === -1 ? (0, import_drizzle_orm27.desc)(sessions3.updated_at) : sessions3.updated_at
+          opts.sortUpdatedAt === -1 ? (0, import_drizzle_orm28.desc)(sessions3.updated_at) : sessions3.updated_at
         );
       }
       if (opts.limit !== void 0) dataQuery = dataQuery.limit(opts.limit);
@@ -9854,10 +10042,10 @@ var SessionRepository = class {
       const fullId = await this.resolveId(sessionId);
       const baseUrl = await getBaseUrl();
       const { jsonExtract: jsonExtract2 } = await Promise.resolve().then(() => (init_database_wrapper(), database_wrapper_exports));
-      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where(
-        (0, import_drizzle_orm27.or)(
-          import_drizzle_orm27.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
-          import_drizzle_orm27.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
+      const results = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where(
+        (0, import_drizzle_orm28.or)(
+          import_drizzle_orm28.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.parent_session_id")} = ${fullId}`,
+          import_drizzle_orm28.sql`${jsonExtract2(this.db, sessions3.data, "genealogy.forked_from_session_id")} = ${fullId}`
         )
       ).all();
       return results.map(
@@ -9923,8 +10111,8 @@ var SessionRepository = class {
       const statusInfo = updates.status ? ` (status: ${updates.status}, ready_for_prompt: ${updates.ready_for_prompt})` : "";
       console.debug(`\u{1F504} [SessionRepo] Updating session ${shortId(fullId)}${statusInfo}`);
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, (0, import_drizzle_orm27.eq)(sessions3.session_id, fullId));
-        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm27.eq)(sessions3.session_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, sessions3, (0, import_drizzle_orm28.eq)(sessions3.session_id, fullId));
+        const currentResult = await select(txAsDb(tx)).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).one();
         if (!currentResult) {
           throw new EntityNotFoundError("Session", id);
         }
@@ -9937,12 +10125,12 @@ var SessionRepository = class {
         if (shouldRefreshLastUpdated) {
           insertData.updated_at = /* @__PURE__ */ new Date();
         }
-        await update(txAsDb(tx), sessions3).set(insertData).where((0, import_drizzle_orm27.eq)(sessions3.session_id, fullId)).run();
+        await update(txAsDb(tx), sessions3).set(insertData).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).run();
         if (!insertData.updated_at) {
           throw new RepositoryError("Session update did not produce an updated_at timestamp");
         }
         merged.last_updated = insertData.updated_at.toISOString();
-        return merged;
+        return attachHiddenTenant(merged, currentRow);
       });
       return result;
     } catch (error) {
@@ -9960,8 +10148,8 @@ var SessionRepository = class {
   async countMessages(sessionId) {
     const fullId = await this.resolveId(sessionId);
     const result = await select(this.db, {
-      count: import_drizzle_orm27.sql`count(*)`
-    }).from(messages3).where((0, import_drizzle_orm27.eq)(messages3.session_id, fullId)).one();
+      count: import_drizzle_orm28.sql`count(*)`
+    }).from(messages3).where((0, import_drizzle_orm28.eq)(messages3.session_id, fullId)).one();
     return Number(result?.count ?? 0);
   }
   /**
@@ -9970,7 +10158,7 @@ var SessionRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, sessions3).where((0, import_drizzle_orm27.eq)(sessions3.session_id, fullId)).run();
+      const result = await deleteFrom(this.db, sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Session", id);
       }
@@ -9994,7 +10182,7 @@ var SessionRepository = class {
    */
   async count() {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm27.sql`count(*)` }).from(sessions3).one();
+      const result = await select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -10017,8 +10205,8 @@ var SessionRepository = class {
   async findScheduleRun(scheduleId, scheduledRunAt) {
     try {
       const baseUrl = await getBaseUrl();
-      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where(
-        (0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm27.eq)(sessions3.scheduled_run_at, scheduledRunAt))
+      const result = await select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where(
+        (0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm28.eq)(sessions3.scheduled_run_at, scheduledRunAt))
       ).one();
       if (!result) return null;
       const r = result;
@@ -10041,9 +10229,9 @@ var SessionRepository = class {
   async findByScheduleId(scheduleId, opts = {}) {
     try {
       const baseUrl = await getBaseUrl();
-      let query = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm27.eq)(sessions3.schedule_id, scheduleId));
+      let query = select(this.db).from(sessions3).leftJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).where((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId));
       if (opts.orderByScheduledRunAt === "desc") {
-        query = query.orderBy((0, import_drizzle_orm27.desc)(sessions3.scheduled_run_at));
+        query = query.orderBy((0, import_drizzle_orm28.desc)(sessions3.scheduled_run_at));
       } else if (opts.orderByScheduledRunAt === "asc") {
         query = query.orderBy(sessions3.scheduled_run_at);
       }
@@ -10068,7 +10256,7 @@ var SessionRepository = class {
    */
   async countByScheduleId(scheduleId) {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm27.sql`count(*)` }).from(sessions3).where((0, import_drizzle_orm27.eq)(sessions3.schedule_id, scheduleId)).one();
+      const result = await select(this.db, { count: import_drizzle_orm28.sql`count(*)` }).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId)).one();
       return Number(result?.count ?? 0);
     } catch (error) {
       throw new RepositoryError(
@@ -10090,7 +10278,7 @@ var SessionRepository = class {
   async existsInBranchWithStatuses(branchId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: import_drizzle_orm27.sql`1` }).from(sessions3).where((0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(sessions3.branch_id, branchId), (0, import_drizzle_orm27.inArray)(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: import_drizzle_orm28.sql`1` }).from(sessions3).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.branch_id, branchId), (0, import_drizzle_orm28.inArray)(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10106,7 +10294,7 @@ var SessionRepository = class {
   async existsInScheduleWithStatuses(scheduleId, statuses) {
     if (statuses.length === 0) return false;
     try {
-      const row = await select(this.db, { one: import_drizzle_orm27.sql`1` }).from(sessions3).where((0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm27.inArray)(sessions3.status, [...statuses]))).limit(1).one();
+      const row = await select(this.db, { one: import_drizzle_orm28.sql`1` }).from(sessions3).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(sessions3.schedule_id, scheduleId), (0, import_drizzle_orm28.inArray)(sessions3.status, [...statuses]))).limit(1).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10137,10 +10325,10 @@ var SessionRepository = class {
   async findAccessibleSessions(userId, boardId) {
     const baseUrl = await getBaseUrl();
     const accessCondition = visibleBranchAccessCondition(this.db, userId);
-    const whereCondition = boardId ? (0, import_drizzle_orm27.and)(accessCondition, (0, import_drizzle_orm27.eq)(branches3.board_id, boardId)) : accessCondition;
-    const results = await select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm27.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
+    const whereCondition = boardId ? (0, import_drizzle_orm28.and)(accessCondition, (0, import_drizzle_orm28.eq)(branches3.board_id, boardId)) : accessCondition;
+    const results = await select(this.db).from(sessions3).innerJoin(branches3, (0, import_drizzle_orm28.eq)(sessions3.branch_id, branches3.branch_id)).leftJoin(
       branchOwners3,
-      (0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm27.eq)(branchOwners3.user_id, userId))
+      (0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(branchOwners3.branch_id, branches3.branch_id), (0, import_drizzle_orm28.eq)(branchOwners3.user_id, userId))
     ).where(whereCondition).all();
     const seen = /* @__PURE__ */ new Set();
     const sessionsOut = [];
@@ -10183,8 +10371,8 @@ var SessionRepository = class {
       for (const sessionId of sessionIds) {
         const query = select(this.db, {
           data: messagesTable.data
-        }).from(messagesTable).where((0, import_drizzle_orm27.and)((0, import_drizzle_orm27.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm27.eq)(messagesTable.role, "assistant")));
-        const lastMessage = await query.orderBy((0, import_drizzle_orm27.desc)(messagesTable.index)).limit(1).one();
+        }).from(messagesTable).where((0, import_drizzle_orm28.and)((0, import_drizzle_orm28.eq)(messagesTable.session_id, sessionId), (0, import_drizzle_orm28.eq)(messagesTable.role, "assistant")));
+        const lastMessage = await query.orderBy((0, import_drizzle_orm28.desc)(messagesTable.index)).limit(1).one();
         if (lastMessage) {
           const messageData = lastMessage.data;
           let fullText = "";
@@ -10218,7 +10406,7 @@ var SessionRepository = class {
    */
   async exists(sessionId) {
     try {
-      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm27.eq)(sessions3.session_id, sessionId)).one();
+      const row = await select(this.db).from(sessions3).where((0, import_drizzle_orm28.eq)(sessions3.session_id, sessionId)).one();
       return row != null;
     } catch (error) {
       throw new RepositoryError(
@@ -10231,7 +10419,7 @@ var SessionRepository = class {
 
 // src/db/repositories/session-relationships.ts
 init_cjs_shims();
-var import_drizzle_orm29 = require("drizzle-orm");
+var import_drizzle_orm30 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10239,7 +10427,7 @@ init_schema();
 // src/db/repositories/tasks.ts
 init_cjs_shims();
 init_types();
-var import_drizzle_orm30 = require("drizzle-orm");
+var import_drizzle_orm31 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10327,7 +10515,7 @@ var TaskRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "Task", async (pattern) => {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.like)(tasks3.task_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.task_id);
     });
   }
@@ -10338,7 +10526,7 @@ var TaskRepository = class {
     try {
       const insertData = this.taskToInsert(data);
       await insert(this.db, tasks3).values(insertData).run();
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created task");
       }
@@ -10362,7 +10550,7 @@ var TaskRepository = class {
       const inserts = taskList.map((task) => this.taskToInsert(task));
       await insert(this.db, tasks3).values(inserts).run();
       const taskIds = inserts.map((t3) => t3.task_id);
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.inArray)(tasks3.task_id, taskIds)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.inArray)(tasks3.task_id, taskIds)).all();
       const rowsById = new Map(rows.map((r) => [r.task_id, r]));
       return taskIds.map((id) => this.rowToTask(rowsById.get(id)));
     } catch (error) {
@@ -10378,7 +10566,7 @@ var TaskRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.task_id, fullId)).one();
+      const row = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       if (error instanceof EntityNotFoundError) return null;
@@ -10396,17 +10584,17 @@ var TaskRepository = class {
     try {
       if (filter?.sessionIds !== void 0 && filter.sessionIds.length === 0) return [];
       const conditions = [];
-      if (filter?.sessionId) conditions.push((0, import_drizzle_orm30.eq)(tasks3.session_id, filter.sessionId));
+      if (filter?.sessionId) conditions.push((0, import_drizzle_orm31.eq)(tasks3.session_id, filter.sessionId));
       if (filter?.sessionIds !== void 0)
-        conditions.push((0, import_drizzle_orm30.inArray)(tasks3.session_id, filter.sessionIds));
-      if (filter?.status) conditions.push((0, import_drizzle_orm30.eq)(tasks3.status, filter.status));
+        conditions.push((0, import_drizzle_orm31.inArray)(tasks3.session_id, filter.sessionIds));
+      if (filter?.status) conditions.push((0, import_drizzle_orm31.eq)(tasks3.status, filter.status));
       if (filter?.visibleToUserId) {
         conditions.push(
           visibleSessionReferenceAccessExists(this.db, filter.visibleToUserId, tasks3.session_id)
         );
       }
       const query = select(this.db).from(tasks3);
-      const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm30.and)(...conditions)).all() : await query.all();
+      const rows = conditions.length > 0 ? await query.where((0, import_drizzle_orm31.and)(...conditions)).all() : await query.all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10420,7 +10608,7 @@ var TaskRepository = class {
    */
   async findBySession(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.session_id, sessionId)).orderBy(tasks3.created_at).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10434,7 +10622,7 @@ var TaskRepository = class {
    */
   async findRunning() {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.status, TaskStatus.RUNNING)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.status, TaskStatus.RUNNING)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10455,7 +10643,7 @@ var TaskRepository = class {
   async findOrphaned() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm30.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
+        import_drizzle_orm31.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input')`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -10475,7 +10663,7 @@ var TaskRepository = class {
   async findActiveWithExecutorHeartbeat() {
     try {
       const rows = await select(this.db).from(tasks3).where(
-        import_drizzle_orm30.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
+        import_drizzle_orm31.sql`${tasks3.status} IN ('running', 'stopping', 'awaiting_permission', 'awaiting_input') AND ${tasks3.last_executor_heartbeat_at} IS NOT NULL`
       ).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
@@ -10490,7 +10678,7 @@ var TaskRepository = class {
    */
   async findByStatus(status) {
     try {
-      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.status, status)).all();
+      const rows = await select(this.db).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.status, status)).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10512,8 +10700,8 @@ var TaskRepository = class {
         `\u{1F504} [TaskRepo] Updating task ${shortId(fullId)}${updates.status ? ` (status: ${updates.status})` : ""}`
       );
       const result = await this.db.transaction(async (tx) => {
-        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm30.eq)(tasks3.task_id, fullId));
-        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.task_id, fullId)).one();
+        await lockRowForUpdate(txAsDb(tx), this.db, tasks3, (0, import_drizzle_orm31.eq)(tasks3.task_id, fullId));
+        const currentRow = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).one();
         if (!currentRow) {
           throw new EntityNotFoundError("Task", id);
         }
@@ -10527,7 +10715,7 @@ var TaskRepository = class {
           last_executor_heartbeat_at: insertData.last_executor_heartbeat_at,
           session_md5: insertData.session_md5,
           data: insertData.data
-        }).where((0, import_drizzle_orm30.eq)(tasks3.task_id, fullId)).run();
+        }).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).run();
         return merged;
       });
       return result;
@@ -10546,7 +10734,7 @@ var TaskRepository = class {
   async delete(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm30.eq)(tasks3.task_id, fullId)).run();
+      const result = await deleteFrom(this.db, tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, fullId)).run();
       if (result.rowsAffected === 0) {
         throw new EntityNotFoundError("Task", id);
       }
@@ -10600,15 +10788,15 @@ var TaskRepository = class {
     }
     return this.db.transaction(async (tx) => {
       const positionRow = await select(txAsDb(tx), {
-        maxPos: import_drizzle_orm30.sql`max(${tasks3.queue_position})`
-      }).from(tasks3).where(import_drizzle_orm30.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
+        maxPos: import_drizzle_orm31.sql`max(${tasks3.queue_position})`
+      }).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${input.session_id} AND ${tasks3.status} = 'queued'`).one();
       const nextPosition = (positionRow?.maxPos ?? 0) + 1;
       const insertData = this.taskToInsert({
         ...taskBase,
         queue_position: nextPosition
       });
       await insert(txAsDb(tx), tasks3).values(insertData).run();
-      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.task_id, insertData.task_id)).one();
+      const row = await select(txAsDb(tx)).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.task_id, insertData.task_id)).one();
       if (!row) {
         throw new RepositoryError("Failed to retrieve created queued task");
       }
@@ -10620,7 +10808,7 @@ var TaskRepository = class {
    */
   async findQueued(sessionId) {
     try {
-      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm30.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
+      const rows = await select(this.db).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).all();
       return rows.map((row) => this.rowToTask(row));
     } catch (error) {
       throw new RepositoryError(
@@ -10635,7 +10823,7 @@ var TaskRepository = class {
    */
   async getNextQueued(sessionId) {
     try {
-      const row = await select(this.db).from(tasks3).where(import_drizzle_orm30.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
+      const row = await select(this.db).from(tasks3).where(import_drizzle_orm31.sql`${tasks3.session_id} = ${sessionId} AND ${tasks3.status} = 'queued'`).orderBy(tasks3.queue_position).limit(1).one();
       return row ? this.rowToTask(row) : null;
     } catch (error) {
       throw new RepositoryError(
@@ -10649,7 +10837,7 @@ var TaskRepository = class {
    */
   async countBySession(sessionId) {
     try {
-      const result = await select(this.db, { count: import_drizzle_orm30.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm30.eq)(tasks3.session_id, sessionId)).one();
+      const result = await select(this.db, { count: import_drizzle_orm31.sql`count(*)` }).from(tasks3).where((0, import_drizzle_orm31.eq)(tasks3.session_id, sessionId)).one();
       return result?.count ?? 0;
     } catch (error) {
       throw new RepositoryError(
@@ -10663,7 +10851,7 @@ var TaskRepository = class {
 // src/db/repositories/thread-session-map.ts
 init_cjs_shims();
 init_types();
-var import_drizzle_orm31 = require("drizzle-orm");
+var import_drizzle_orm32 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10672,7 +10860,7 @@ init_schema();
 init_cjs_shims();
 var import_node_crypto5 = require("crypto");
 var import_bcryptjs2 = __toESM(require("bcryptjs"), 1);
-var import_drizzle_orm32 = require("drizzle-orm");
+var import_drizzle_orm33 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10680,44 +10868,14 @@ init_tenant_context();
 
 // src/db/repositories/user-mcp-oauth-tokens.ts
 init_cjs_shims();
-var import_drizzle_orm33 = require("drizzle-orm");
+var import_drizzle_orm34 = require("drizzle-orm");
 init_database_wrapper();
 init_schema();
 
 // src/db/repositories/users.ts
 init_cjs_shims();
 init_types();
-var import_drizzle_orm34 = require("drizzle-orm");
-
-// src/config/env-vars.ts
-init_cjs_shims();
-var V05_SCOPES = ["global", "session"];
-var V05_SCOPE_SET = new Set(V05_SCOPES);
-function normalizeStoredEnvVar(raw) {
-  if (typeof raw === "string") {
-    return { value_encrypted: raw, scope: "global" };
-  }
-  return {
-    value_encrypted: raw.value_encrypted,
-    scope: raw.scope,
-    resource_id: raw.resource_id ?? null,
-    extra_config: raw.extra_config ?? null
-  };
-}
-function normalizeStoredEnvMap(raw) {
-  const out = {};
-  if (!raw) return out;
-  for (const [key, value] of Object.entries(raw)) {
-    try {
-      out[key] = normalizeStoredEnvVar(value);
-    } catch (err) {
-      console.warn(`[env-vars] Skipping malformed env var entry ${key}:`, err);
-    }
-  }
-  return out;
-}
-
-// src/db/repositories/users.ts
+var import_drizzle_orm35 = require("drizzle-orm");
 init_ids();
 init_database_wrapper();
 init_schema();
@@ -10820,7 +10978,7 @@ var UsersRepository = class {
    */
   async resolveId(id) {
     return resolveByShortIdPrefix(id, "User", async (pattern) => {
-      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm34.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
+      const rows = await select(this.db).from(users3).where((0, import_drizzle_orm35.like)(users3.user_id, pattern)).limit(RESOLVE_SHORT_ID_FETCH_LIMIT).all();
       return rows.map((r) => r.user_id);
     });
   }
@@ -10828,7 +10986,7 @@ var UsersRepository = class {
    * Check if unix_username is already taken by another user
    */
   async isUnixUsernameTaken(unixUsername, excludeUserId) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.unix_username, unixUsername)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.unix_username, unixUsername)).one();
     if (!result) {
       return false;
     }
@@ -10851,7 +11009,7 @@ var UsersRepository = class {
     }
     const insertData = this.userToInsert(data);
     await insert(this.db, users3).values(insertData).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, insertData.user_id)).one();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, insertData.user_id)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve created user");
     }
@@ -10863,7 +11021,7 @@ var UsersRepository = class {
   async findById(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
       if (!result) {
         return null;
       }
@@ -10879,7 +11037,7 @@ var UsersRepository = class {
    * Find user by email
    */
   async findByEmail(email) {
-    const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.email, email)).one();
+    const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.email, email)).one();
     if (!result) {
       return null;
     }
@@ -10900,7 +11058,7 @@ var UsersRepository = class {
     if (!normalizedEmail) return null;
     const exact = await this.findByEmail(normalizedEmail);
     if (exact) return exact;
-    const results = await select(this.db).from(users3).where(import_drizzle_orm34.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
+    const results = await select(this.db).from(users3).where(import_drizzle_orm35.sql`LOWER(${users3.email}) = ${normalizedEmail}`).all();
     if (results.length !== 1) {
       if (results.length > 1) {
         console.warn(
@@ -10950,8 +11108,8 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       ...insertData,
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
-    const row = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
+    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
+    const row = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
     if (!row) {
       throw new RepositoryError("Failed to retrieve updated user");
     }
@@ -10962,7 +11120,7 @@ var UsersRepository = class {
    */
   async delete(id) {
     const fullId = await this.resolveId(id);
-    await deleteFrom(this.db, users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
+    await deleteFrom(this.db, users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Get raw database row (internal use only - includes encrypted keys)
@@ -10970,7 +11128,7 @@ var UsersRepository = class {
   async getRawRow(id) {
     try {
       const fullId = await this.resolveId(id);
-      const result = await select(this.db).from(users3).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).one();
+      const result = await select(this.db).from(users3).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).one();
       return result;
     } catch (error) {
       if (error instanceof EntityNotFoundError) {
@@ -11052,7 +11210,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
   }
   /**
    * Delete a single credential field for a tool.
@@ -11078,7 +11236,7 @@ var UsersRepository = class {
     await update(this.db, users3).set({
       data: { ...row.data, agentic_tools: next },
       updated_at: /* @__PURE__ */ new Date()
-    }).where((0, import_drizzle_orm34.eq)(users3.user_id, fullId)).run();
+    }).where((0, import_drizzle_orm35.eq)(users3.user_id, fullId)).run();
   }
 };
 
@@ -11794,23 +11952,9 @@ var import_node_fs2 = __toESM(require("fs"), 1);
 init_config_manager();
 init_constants();
 
-// src/config/env-blocklist.ts
-init_cjs_shims();
-var BLOCKED_ENV_PATTERNS = Object.freeze([
-  /^LD_/i,
-  /^DYLD_/i,
-  /^PYTHON(?!_AGOR_)/i
-]);
-
 // src/config/env-locking.ts
 init_cjs_shims();
 
-// src/config/env-resolver.ts
-init_cjs_shims();
-var import_drizzle_orm35 = require("drizzle-orm");
-init_database_wrapper();
-init_schema();
-
 // src/config/env-validation.ts
 init_cjs_shims();
 var ENV_VAR_CONSTRAINTS = {