agor-live 0.7.9 → 0.7.11

package/dist/core/api/index.d.cts

@@ -1,5 +1,5 @@
 import { e as Message } from '../message-2XWJyHm9.cjs';
-import { e as Board } from '../board-DV5ph4MH.cjs';
+import { e as Board } from '../board-U6lVA7h2.cjs';
 import { a as ContextFileListItem, b as ContextFileDetail } from '../context-ByxGjp5l.cjs';
 import { b as AuthenticationResult } from '../feathers-BzHEPnpl.cjs';
 import { h as MCPServer } from '../mcp-DpJnAKie.cjs';

package/dist/core/api/index.d.ts

@@ -1,5 +1,5 @@
 import { e as Message } from '../message-CvkDJT8d.js';
-import { e as Board } from '../board-BG4dLPPR.js';
+import { e as Board } from '../board-slTuqYl5.js';
 import { a as ContextFileListItem, b as ContextFileDetail } from '../context-ByxGjp5l.js';
 import { b as AuthenticationResult } from '../feathers-BzHEPnpl.js';
 import { h as MCPServer } from '../mcp-BJoCdfzv.js';

package/dist/core/{board-DV5ph4MH.d.cts → board-U6lVA7h2.d.cts}

@@ -68,6 +68,11 @@ interface ZoneBoardObject {
     width: number;
     height: number;
     label: string;
+    /** Border color (supports alpha) - falls back to `color` for backwards compatibility */
+    borderColor?: string;
+    /** Background color (supports alpha) - falls back to derived from `color` for backwards compatibility */
+    backgroundColor?: string;
+    /** @deprecated Use borderColor instead. Kept for backwards compatibility */
     color?: string;
     status?: string;
     /** Lock zone to prevent dragging/resizing */

package/dist/core/{board-BG4dLPPR.d.ts → board-slTuqYl5.d.ts}

@@ -68,6 +68,11 @@ interface ZoneBoardObject {
     width: number;
     height: number;
     label: string;
+    /** Border color (supports alpha) - falls back to `color` for backwards compatibility */
+    borderColor?: string;
+    /** Background color (supports alpha) - falls back to derived from `color` for backwards compatibility */
+    backgroundColor?: string;
+    /** @deprecated Use borderColor instead. Kept for backwards compatibility */
     color?: string;
     status?: string;
     /** Lock zone to prevent dragging/resizing */

package/dist/core/{client-D3prsJYh.d.cts → client-BitSyI31.d.cts}

@@ -1,7 +1,7 @@
 import { LibSQLDatabase } from 'drizzle-orm/libsql';
 import { e as Message } from './message-2XWJyHm9.cjs';
 import { c as CodexSandboxMode, d as CodexApprovalPolicy } from './agentic-tool-Beqe459E.cjs';
-import { d as BoardObject } from './board-DV5ph4MH.cjs';
+import { d as BoardObject } from './board-U6lVA7h2.cjs';
 import { a as Session, P as PermissionMode } from './session-BvKYnyu1.cjs';
 import { c as Task } from './task-D3MLENFX.cjs';
 import * as drizzle_orm_sqlite_core from 'drizzle-orm/sqlite-core';

package/dist/core/{client-XOAVBUuQ.d.ts → client-RCxWXp9Z.d.ts}

@@ -1,7 +1,7 @@
 import { LibSQLDatabase } from 'drizzle-orm/libsql';
 import { e as Message } from './message-CvkDJT8d.js';
 import { c as CodexSandboxMode, d as CodexApprovalPolicy } from './agentic-tool-DQc61m9k.js';
-import { d as BoardObject } from './board-BG4dLPPR.js';
+import { d as BoardObject } from './board-slTuqYl5.js';
 import { a as Session, P as PermissionMode } from './session-BKy_YLbt.js';
 import { c as Task } from './task-P83UMXcT.js';
 import * as drizzle_orm_sqlite_core from 'drizzle-orm/sqlite-core';

package/dist/core/config/index.d.cts

@@ -1,12 +1,12 @@
 import { AgorConfig } from './browser.cjs';
 export { AgorCredentials, AgorDaemonSettings, AgorDefaults, AgorDisplaySettings, AgorOpenCodeSettings, AgorUISettings, ConfigKey, CredentialKey, DAEMON, DATABASE, ENVIRONMENT, GIT, RepoReference, RepoReferenceOption, SESSION, UnknownJson, WEBSOCKET, extractSlugFromUrl, formatRepoReference, getDefaultRepoReference, getGroupedRepoReferenceOptions, getRepoReferenceOptions, isValidGitUrl, isValidSlug, parseRepoReference, resolveRepoReference } from './browser.cjs';
-import { d as Database } from '../client-D3prsJYh.cjs';
+import { d as Database } from '../client-BitSyI31.cjs';
 import { b as UserID } from '../id-DMqyogFB.cjs';
 import '../repo-D4EXWOuB.cjs';
 import 'drizzle-orm/libsql';
 import '../message-2XWJyHm9.cjs';
 import '../agentic-tool-Beqe459E.cjs';
-import '../board-DV5ph4MH.cjs';
+import '../board-U6lVA7h2.cjs';
 import '../session-BvKYnyu1.cjs';
 import '../context-ByxGjp5l.cjs';
 import '../task-D3MLENFX.cjs';

package/dist/core/config/index.d.ts

@@ -1,12 +1,12 @@
 import { AgorConfig } from './browser.js';
 export { AgorCredentials, AgorDaemonSettings, AgorDefaults, AgorDisplaySettings, AgorOpenCodeSettings, AgorUISettings, ConfigKey, CredentialKey, DAEMON, DATABASE, ENVIRONMENT, GIT, RepoReference, RepoReferenceOption, SESSION, UnknownJson, WEBSOCKET, extractSlugFromUrl, formatRepoReference, getDefaultRepoReference, getGroupedRepoReferenceOptions, getRepoReferenceOptions, isValidGitUrl, isValidSlug, parseRepoReference, resolveRepoReference } from './browser.js';
-import { d as Database } from '../client-XOAVBUuQ.js';
+import { d as Database } from '../client-RCxWXp9Z.js';
 import { b as UserID } from '../id-DMqyogFB.js';
 import '../repo-B1M9axPS.js';
 import 'drizzle-orm/libsql';
 import '../message-CvkDJT8d.js';
 import '../agentic-tool-DQc61m9k.js';
-import '../board-BG4dLPPR.js';
+import '../board-slTuqYl5.js';
 import '../session-BKy_YLbt.js';
 import '../context-ByxGjp5l.js';
 import '../task-P83UMXcT.js';

package/dist/core/db/index.d.cts

@@ -1,12 +1,12 @@
 export { SQL, and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
 import bcryptjs from 'bcryptjs';
-import { d as Database } from '../client-D3prsJYh.cjs';
-export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from '../client-D3prsJYh.cjs';
-import { B as BaseRepository, c as SessionRepository } from '../worktrees-Bq1te_We.cjs';
-export { A as AmbiguousIdError, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, W as WorktreeRepository } from '../worktrees-Bq1te_We.cjs';
+import { d as Database } from '../client-BitSyI31.cjs';
+export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from '../client-BitSyI31.cjs';
+import { B as BaseRepository, c as SessionRepository } from '../worktrees-DRL7PV6j.cjs';
+export { A as AmbiguousIdError, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, W as WorktreeRepository } from '../worktrees-DRL7PV6j.cjs';
 import { B as BoardComment } from '../board-comment-CaUiaZB5.cjs';
 import { B as BoardID, W as WorktreeID, a as SessionID } from '../id-DMqyogFB.cjs';
-import { a as BoardEntityObject, e as Board, d as BoardObject } from '../board-DV5ph4MH.cjs';
+import { a as BoardEntityObject, e as Board, d as BoardObject } from '../board-U6lVA7h2.cjs';
 import { c as Task } from '../task-D3MLENFX.cjs';
 import { d as User } from '../user-rPwVqPEv.cjs';
 import 'drizzle-orm/libsql';

package/dist/core/db/index.d.ts

@@ -1,12 +1,12 @@
 export { SQL, and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
 import bcryptjs from 'bcryptjs';
-import { d as Database } from '../client-XOAVBUuQ.js';
-export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from '../client-XOAVBUuQ.js';
-import { B as BaseRepository, c as SessionRepository } from '../worktrees-DffEZMyv.js';
-export { A as AmbiguousIdError, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, W as WorktreeRepository } from '../worktrees-DffEZMyv.js';
+import { d as Database } from '../client-RCxWXp9Z.js';
+export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from '../client-RCxWXp9Z.js';
+import { B as BaseRepository, c as SessionRepository } from '../worktrees-BLxDBeu5.js';
+export { A as AmbiguousIdError, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, W as WorktreeRepository } from '../worktrees-BLxDBeu5.js';
 import { B as BoardComment } from '../board-comment-BCrDUioT.js';
 import { B as BoardID, W as WorktreeID, a as SessionID } from '../id-DMqyogFB.js';
-import { a as BoardEntityObject, e as Board, d as BoardObject } from '../board-BG4dLPPR.js';
+import { a as BoardEntityObject, e as Board, d as BoardObject } from '../board-slTuqYl5.js';
 import { c as Task } from '../task-P83UMXcT.js';
 import { d as User } from '../user-tNPw17ie.js';
 import 'drizzle-orm/libsql';

package/dist/core/git/index.cjs

@@ -63,16 +63,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return (0, import_simple_git.simpleGit)({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = (0, import_simple_git.simpleGit)({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return (0, import_node_path.join)((0, import_node_os.homedir)(), ".agor", "repos");
@@ -107,7 +123,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });
@@ -174,8 +190,8 @@ function getWorktreesDir() {
 function getWorktreePath(repoSlug, worktreeName) {
   return (0, import_node_path.join)(getWorktreesDir(), repoSlug, worktreeName);
 }
-async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch) {
-  const git = createGit(repoPath);
+async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch, env) {
+  const git = createGit(repoPath, env);
   let fetchSucceeded = false;
   if (pullLatest) {
     try {

package/dist/core/git/index.d.cts

@@ -4,6 +4,27 @@ export { simpleGit } from 'simple-git';
  * Git Utils for Agor
  *
  * Provides Git operations for repo management and worktree isolation
+ *
+ * ## Authentication Strategy
+ *
+ * Git operations (clone, fetch, etc.) require authentication for private repositories.
+ * This module supports multiple authentication methods:
+ *
+ * 1. **SSH Keys** - Traditional SSH key-based auth (works automatically if keys are mounted)
+ * 2. **User Environment Variables** - Per-user GITHUB_TOKEN or GH_TOKEN from Agor user settings
+ * 3. **System Credential Helpers** - Existing git credential helpers (e.g., gh auth, git-credential-store)
+ *
+ * ### How User Environment Variables Work
+ *
+ * When a user configures GITHUB_TOKEN in their Agor user settings:
+ * 1. The token is encrypted and stored in the database
+ * 2. During git operations, we decrypt and pass it via the `env` parameter
+ * 3. We configure a **Git credential helper** (via `-c credential.helper=...`) that provides the token
+ * 4. When Git needs credentials for HTTPS operations, it calls our helper function
+ * 5. The helper outputs `username=x-access-token\npassword=TOKEN` in the format Git expects
+ *
+ * This approach mirrors how `gh auth` works - it's clean, secure, and doesn't pollute URLs with tokens.
+ * The credential helper is **ephemeral** and **scoped to the specific git command**, not system-wide.
  */
 
 interface CloneOptions {
@@ -11,6 +32,7 @@ interface CloneOptions {
     targetDir?: string;
     bare?: boolean;
     onProgress?: (progress: CloneProgress) => void;
+    env?: Record<string, string>;
 }
 interface CloneProgress {
     method: string;
@@ -101,9 +123,10 @@ interface WorktreeInfo {
  * @param createBranch - Whether to create a new branch
  * @param pullLatest - Whether to fetch from remote before creating worktree (defaults to true)
  * @param sourceBranch - Source branch to base new branch on (used with createBranch)
+ * @param env - Optional user environment variables (e.g., for private repo access)
  */
 declare function createWorktree(repoPath: string, worktreePath: string, ref: string, createBranch?: boolean, pullLatest?: boolean, // Changed default to true - always fetch latest!
-sourceBranch?: string): Promise<void>;
+sourceBranch?: string, env?: Record<string, string>): Promise<void>;
 /**
  * List all worktrees for a repository
  */

package/dist/core/git/index.d.ts

@@ -4,6 +4,27 @@ export { simpleGit } from 'simple-git';
  * Git Utils for Agor
  *
  * Provides Git operations for repo management and worktree isolation
+ *
+ * ## Authentication Strategy
+ *
+ * Git operations (clone, fetch, etc.) require authentication for private repositories.
+ * This module supports multiple authentication methods:
+ *
+ * 1. **SSH Keys** - Traditional SSH key-based auth (works automatically if keys are mounted)
+ * 2. **User Environment Variables** - Per-user GITHUB_TOKEN or GH_TOKEN from Agor user settings
+ * 3. **System Credential Helpers** - Existing git credential helpers (e.g., gh auth, git-credential-store)
+ *
+ * ### How User Environment Variables Work
+ *
+ * When a user configures GITHUB_TOKEN in their Agor user settings:
+ * 1. The token is encrypted and stored in the database
+ * 2. During git operations, we decrypt and pass it via the `env` parameter
+ * 3. We configure a **Git credential helper** (via `-c credential.helper=...`) that provides the token
+ * 4. When Git needs credentials for HTTPS operations, it calls our helper function
+ * 5. The helper outputs `username=x-access-token\npassword=TOKEN` in the format Git expects
+ *
+ * This approach mirrors how `gh auth` works - it's clean, secure, and doesn't pollute URLs with tokens.
+ * The credential helper is **ephemeral** and **scoped to the specific git command**, not system-wide.
  */
 
 interface CloneOptions {
@@ -11,6 +32,7 @@ interface CloneOptions {
     targetDir?: string;
     bare?: boolean;
     onProgress?: (progress: CloneProgress) => void;
+    env?: Record<string, string>;
 }
 interface CloneProgress {
     method: string;
@@ -101,9 +123,10 @@ interface WorktreeInfo {
  * @param createBranch - Whether to create a new branch
  * @param pullLatest - Whether to fetch from remote before creating worktree (defaults to true)
  * @param sourceBranch - Source branch to base new branch on (used with createBranch)
+ * @param env - Optional user environment variables (e.g., for private repo access)
  */
 declare function createWorktree(repoPath: string, worktreePath: string, ref: string, createBranch?: boolean, pullLatest?: boolean, // Changed default to true - always fetch latest!
-sourceBranch?: string): Promise<void>;
+sourceBranch?: string, env?: Record<string, string>): Promise<void>;
 /**
  * List all worktrees for a repository
  */

package/dist/core/git/index.js

@@ -20,16 +20,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return simpleGit({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = simpleGit({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return join(homedir(), ".agor", "repos");
@@ -64,7 +80,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });
@@ -131,8 +147,8 @@ function getWorktreesDir() {
 function getWorktreePath(repoSlug, worktreeName) {
   return join(getWorktreesDir(), repoSlug, worktreeName);
 }
-async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch) {
-  const git = createGit(repoPath);
+async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch, env) {
+  const git = createGit(repoPath, env);
   let fetchSucceeded = false;
   if (pullLatest) {
     try {

package/dist/core/index.cjs

@@ -4680,16 +4680,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return (0, import_simple_git.simpleGit)({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = (0, import_simple_git.simpleGit)({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return (0, import_node_path4.join)((0, import_node_os3.homedir)(), ".agor", "repos");
@@ -4724,7 +4740,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });
@@ -4791,8 +4807,8 @@ function getWorktreesDir() {
 function getWorktreePath(repoSlug, worktreeName) {
   return (0, import_node_path4.join)(getWorktreesDir(), repoSlug, worktreeName);
 }
-async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch) {
-  const git = createGit(repoPath);
+async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch, env) {
+  const git = createGit(repoPath, env);
   let fetchSucceeded = false;
   if (pullLatest) {
     try {

package/dist/core/index.d.cts

@@ -5,7 +5,7 @@ export { BoardCommentsRepository, BoardObjectRepository, BoardRepository, Create
 export { CloneOptions, CloneProgress, CloneResult, WorktreeInfo, cleanWorktree, cloneRepo, createWorktree, extractRepoName, getCurrentBranch, getCurrentSha, getDefaultBranch, getGitState, getRemoteBranches, getRemoteUrl, getReposDir, getWorktreePath, getWorktreesDir, hasRemoteBranch, isClean, isGitRepo, listWorktrees, pruneWorktrees, removeWorktree } from './git/index.cjs';
 export { PermissionDecision, PermissionRequest } from './permissions/index.cjs';
 export { b as AgenticTool, A as AgenticToolName, C as ClaudeCodePermissionMode, d as CodexApprovalPolicy, e as CodexNetworkAccess, a as CodexPermissionMode, c as CodexSandboxMode, G as GeminiPermissionMode, O as OpenCodePermissionMode } from './agentic-tool-Beqe459E.cjs';
-export { e as Board, a as BoardEntityObject, d as BoardObject, B as BoardObjectType, T as TextBoardObject, c as ZoneBoardObject, b as ZoneTrigger, Z as ZoneTriggerBehavior } from './board-DV5ph4MH.cjs';
+export { e as Board, a as BoardEntityObject, d as BoardObject, B as BoardObjectType, T as TextBoardObject, c as ZoneBoardObject, b as ZoneTrigger, Z as ZoneTriggerBehavior } from './board-U6lVA7h2.cjs';
 export { B as BoardComment, b as BoardCommentCreate, c as BoardCommentPatch, a as CommentAttachmentType, C as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, f as groupReactions, d as isReply, e as isResolvable, i as isThreadRoot } from './board-comment-CaUiaZB5.cjs';
 export { b as ContextFileDetail, a as ContextFileListItem, C as ContextFilePath } from './context-ByxGjp5l.cjs';
 export { a as AuthenticatedParams, A as AuthenticatedUser, b as AuthenticationResult, B as BaseService, C as CreateHookContext, H as HookContext, Q as QueryParams, S as ServiceWithEvents } from './feathers-BzHEPnpl.cjs';
@@ -18,8 +18,8 @@ export { b as Report, R as ReportPath, a as ReportTemplate, c as Task, T as Task
 export { P as PermissionMode, b as ScheduledRunMetadata, a as Session, S as SessionStatus, g as getDefaultPermissionMode } from './session-BvKYnyu1.cjs';
 export { A as AudioPreferences, C as ChimeSound, e as CreateUserInput, b as DefaultAgenticConfig, a as DefaultAgenticToolConfig, D as DefaultModelConfig, f as UpdateUserInput, d as User, c as UserPreferences, U as UserRole } from './user-rPwVqPEv.cjs';
 export { SQL, and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
-export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, d as Database, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from './client-D3prsJYh.cjs';
-export { A as AmbiguousIdError, B as BaseRepository, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, c as SessionRepository, W as WorktreeRepository } from './worktrees-Bq1te_We.cjs';
+export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, d as Database, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from './client-BitSyI31.cjs';
+export { A as AmbiguousIdError, B as BaseRepository, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, c as SessionRepository, W as WorktreeRepository } from './worktrees-DRL7PV6j.cjs';
 export { simpleGit } from 'simple-git';
 export { Id, NullableId, Paginated, Params, Service, ServiceMethods } from '@feathersjs/feathers';
 import 'socket.io-client';

package/dist/core/index.d.ts

@@ -5,7 +5,7 @@ export { BoardCommentsRepository, BoardObjectRepository, BoardRepository, Create
 export { CloneOptions, CloneProgress, CloneResult, WorktreeInfo, cleanWorktree, cloneRepo, createWorktree, extractRepoName, getCurrentBranch, getCurrentSha, getDefaultBranch, getGitState, getRemoteBranches, getRemoteUrl, getReposDir, getWorktreePath, getWorktreesDir, hasRemoteBranch, isClean, isGitRepo, listWorktrees, pruneWorktrees, removeWorktree } from './git/index.js';
 export { PermissionDecision, PermissionRequest } from './permissions/index.js';
 export { b as AgenticTool, A as AgenticToolName, C as ClaudeCodePermissionMode, d as CodexApprovalPolicy, e as CodexNetworkAccess, a as CodexPermissionMode, c as CodexSandboxMode, G as GeminiPermissionMode, O as OpenCodePermissionMode } from './agentic-tool-DQc61m9k.js';
-export { e as Board, a as BoardEntityObject, d as BoardObject, B as BoardObjectType, T as TextBoardObject, c as ZoneBoardObject, b as ZoneTrigger, Z as ZoneTriggerBehavior } from './board-BG4dLPPR.js';
+export { e as Board, a as BoardEntityObject, d as BoardObject, B as BoardObjectType, T as TextBoardObject, c as ZoneBoardObject, b as ZoneTrigger, Z as ZoneTriggerBehavior } from './board-slTuqYl5.js';
 export { B as BoardComment, b as BoardCommentCreate, c as BoardCommentPatch, a as CommentAttachmentType, C as CommentReaction, R as ReactionSummary, g as getCommentAttachmentType, f as groupReactions, d as isReply, e as isResolvable, i as isThreadRoot } from './board-comment-BCrDUioT.js';
 export { b as ContextFileDetail, a as ContextFileListItem, C as ContextFilePath } from './context-ByxGjp5l.js';
 export { a as AuthenticatedParams, A as AuthenticatedUser, b as AuthenticationResult, B as BaseService, C as CreateHookContext, H as HookContext, Q as QueryParams, S as ServiceWithEvents } from './feathers-BzHEPnpl.js';
@@ -18,8 +18,8 @@ export { b as Report, R as ReportPath, a as ReportTemplate, c as Task, T as Task
 export { P as PermissionMode, b as ScheduledRunMetadata, a as Session, S as SessionStatus, g as getDefaultPermissionMode } from './session-BKy_YLbt.js';
 export { A as AudioPreferences, C as ChimeSound, e as CreateUserInput, b as DefaultAgenticConfig, a as DefaultAgenticToolConfig, D as DefaultModelConfig, f as UpdateUserInput, d as User, c as UserPreferences, U as UserRole } from './user-tNPw17ie.js';
 export { SQL, and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
-export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, d as Database, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from './client-XOAVBUuQ.js';
-export { A as AmbiguousIdError, B as BaseRepository, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, c as SessionRepository, W as WorktreeRepository } from './worktrees-DffEZMyv.js';
+export { H as BoardCommentInsert, G as BoardCommentRow, p as BoardInsert, F as BoardObjectInsert, E as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, d as Database, a as DatabaseConnectionError, D as DbConfig, z as MCPServerInsert, y as MCPServerRow, o as MessageInsert, M as MessageRow, q as RepoInsert, R as RepoRow, l as SessionInsert, C as SessionMCPServerInsert, A as SessionMCPServerRow, S as SessionRow, n as TaskInsert, T as TaskRow, x as UserInsert, U as UserRow, v as WorktreeInsert, W as WorktreeRow, k as boardComments, i as boardObjects, g as boards, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, h as mcpServers, m as messages, r as repos, j as sessionMcpServers, s as sessions, t as tasks, u as users, w as worktrees } from './client-RCxWXp9Z.js';
+export { A as AmbiguousIdError, B as BaseRepository, E as EntityNotFoundError, M as MCPServerRepository, a as MessagesRepository, b as RepoRepository, R as RepositoryError, S as SessionMCPServerRepository, c as SessionRepository, W as WorktreeRepository } from './worktrees-BLxDBeu5.js';
 export { simpleGit } from 'simple-git';
 export { Id, NullableId, Paginated, Params, Service, ServiceMethods } from '@feathersjs/feathers';
 import 'socket.io-client';

package/dist/core/index.js

@@ -4516,16 +4516,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return simpleGit({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = simpleGit({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return join3(homedir2(), ".agor", "repos");
@@ -4560,7 +4576,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });
@@ -4627,8 +4643,8 @@ function getWorktreesDir() {
 function getWorktreePath(repoSlug, worktreeName) {
   return join3(getWorktreesDir(), repoSlug, worktreeName);
 }
-async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch) {
-  const git = createGit(repoPath);
+async function createWorktree(repoPath, worktreePath, ref, createBranch = false, pullLatest = true, sourceBranch, env) {
+  const git = createGit(repoPath, env);
   let fetchSucceeded = false;
   if (pullLatest) {
     try {

package/dist/core/seed/index.cjs

@@ -1455,16 +1455,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return (0, import_simple_git.simpleGit)({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = (0, import_simple_git.simpleGit)({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return (0, import_node_path2.join)((0, import_node_os2.homedir)(), ".agor", "repos");
@@ -1499,7 +1515,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });

package/dist/core/seed/index.js

@@ -1428,16 +1428,32 @@ function getGitBinary() {
   }
   return void 0;
 }
-function createGit(baseDir) {
+function createGit(baseDir, env) {
   const gitBinary = getGitBinary();
   const config = [
     "core.sshCommand=ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
   ];
-  return simpleGit({
+  if (env?.GITHUB_TOKEN) {
+    const token = env.GITHUB_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  } else if (env?.GH_TOKEN) {
+    const token = env.GH_TOKEN;
+    const credentialHelper = `!f() { echo "username=x-access-token"; echo "password=${token}"; }; f`;
+    config.push(`credential.helper=${credentialHelper}`);
+  }
+  const git = simpleGit({
     baseDir,
     binary: gitBinary,
-    config
+    config,
+    spawnOptions: env ? {
+      // Merge user env vars with process.env (user vars take precedence)
+      // This allows per-user GitHub PATs, SSH keys, etc. to work with git operations
+      env: { ...process.env, ...env }
+      // biome-ignore lint/suspicious/noExplicitAny: simple-git types don't expose env in spawnOptions but it works at runtime
+    } : void 0
   });
+  return git;
 }
 function getReposDir() {
   return join2(homedir2(), ".agor", "repos");
@@ -1472,7 +1488,7 @@ Please delete this directory manually and try again.`
       );
     }
   }
-  const git = createGit();
+  const git = createGit(void 0, options.env);
   if (options.onProgress) {
     git.outputHandler((_command, _stdout, _stderr) => {
     });

package/dist/core/tools/index.cjs

@@ -2150,9 +2150,10 @@ async function setupQuery(sessionId, prompt, deps, options = {}) {
     }
   }
   if (resume) {
-    const parentSessionId = session.genealogy?.forked_from_session_id || session.genealogy?.parent_session_id;
-    if (parentSessionId && !session.sdk_session_id && deps.sessionsRepo) {
-      const parentSession = await deps.sessionsRepo.findById(parentSessionId);
+    const forkedFromSessionId = session.genealogy?.forked_from_session_id;
+    const parentSessionId = session.genealogy?.parent_session_id;
+    if (forkedFromSessionId && !session.sdk_session_id && deps.sessionsRepo) {
+      const parentSession = await deps.sessionsRepo.findById(forkedFromSessionId);
       if (parentSession?.sdk_session_id) {
         queryOptions.resume = parentSession.sdk_session_id;
         queryOptions.forkSession = true;
@@ -2162,9 +2163,14 @@ async function setupQuery(sessionId, prompt, deps, options = {}) {
         console.log(`   SDK will return new session ID for this fork`);
       } else {
         console.warn(
-          `\u26A0\uFE0F  Parent session ${parentSessionId.substring(0, 8)} has no sdk_session_id - starting fresh`
+          `\u26A0\uFE0F  Parent session ${forkedFromSessionId.substring(0, 8)} has no sdk_session_id - starting fresh`
         );
       }
+    } else if (parentSessionId && !forkedFromSessionId && !session.sdk_session_id) {
+      console.log(
+        `\u{1F331} Spawning fresh session (parent: ${parentSessionId.substring(0, 8)}) - NOT forking SDK session`
+      );
+      console.log(`   Child will start with clean context (spawns don't inherit parent history)`);
     } else if (session?.sdk_session_id) {
       const hoursSinceUpdate = session.last_updated ? (Date.now() - new Date(session.last_updated).getTime()) / (1e3 * 60 * 60) : 999;
       const isLikelyStale = hoursSinceUpdate > 24 || // Session older than 24 hours