agor-live 0.9.3 → 0.10.0

package/dist/cli/commands/init.d.ts

@@ -11,6 +11,7 @@ declare class Init extends Command {
         'daemon-port': _oclif_core_interfaces.OptionFlag<number | undefined, _oclif_core_interfaces.CustomOptions>;
         'daemon-host': _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
         'set-config': _oclif_core_interfaces.BooleanFlag<boolean>;
+        'instance-label': _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
     };
     private pathExists;
     private expandHome;

package/dist/cli/commands/init.js

@@ -41,6 +41,10 @@ var Init = class _Init extends Command {
     "set-config": Flags.boolean({
       description: "Set daemon config values even if .agor already exists (for Docker/deployment)",
       default: false
+    }),
+    "instance-label": Flags.string({
+      description: 'Instance label for deployment identification (e.g., "staging", "prod-us-east")',
+      required: false
     })
   };
   async pathExists(path) {
@@ -529,6 +533,11 @@ var Init = class _Init extends Command {
     const daemonHost = flags["daemon-host"] || "localhost";
     await setConfigValue("daemon.host", daemonHost);
     this.log(`${chalk.green("   \u2713")} Set daemon.host = ${daemonHost}`);
+    const instanceLabel = flags["instance-label"] || process.env.INSTANCE_LABEL;
+    if (instanceLabel) {
+      await setConfigValue("daemon.instanceLabel", instanceLabel);
+      this.log(`${chalk.green("   \u2713")} Set daemon.instanceLabel = ${instanceLabel}`);
+    }
     await setConfigValue("daemon.requireAuth", true);
     await setConfigValue("daemon.allowAnonymous", false);
     this.log(`${chalk.green("   \u2713")} Enabled authentication`);

package/dist/cli/commands/user/create.d.ts

@@ -11,6 +11,7 @@ declare class UserCreate extends BaseCommand {
         name: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
         password: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
         role: _oclif_core_interfaces.OptionFlag<string, _oclif_core_interfaces.CustomOptions>;
+        'force-password-change': _oclif_core_interfaces.BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/cli/commands/user/create.js

@@ -167,6 +167,10 @@ var UserCreate = class _UserCreate extends BaseCommand {
       ],
       // owner role unused
       default: "admin"
+    }),
+    "force-password-change": Flags.boolean({
+      description: "Force user to change password on first login",
+      default: false
     })
   };
   async run() {
@@ -228,7 +232,8 @@ var UserCreate = class _UserCreate extends BaseCommand {
         email,
         password,
         name: name || void 0,
-        role: flags.role
+        role: flags.role,
+        must_change_password: flags["force-password-change"]
       };
       const user = await client.service("users").create(userData);
       this.log(`${chalk2.green("\u2713")} User created successfully`);
@@ -237,6 +242,9 @@ var UserCreate = class _UserCreate extends BaseCommand {
       this.log(`  Name:  ${chalk2.cyan(user.name || "(not set)")}`);
       this.log(`  Role:  ${chalk2.cyan(user.role)}`);
       this.log(`  ID:    ${chalk2.gray(user.user_id.substring(0, 8))}`);
+      if (user.must_change_password) {
+        this.log(`  ${chalk2.yellow("\u26A0")} User must change password on first login`);
+      }
       this.log("");
       this.log(chalk2.gray("Next steps:"));
       this.log(chalk2.gray("  1. Start daemon: pnpm --filter @agor/daemon dev"));

package/dist/cli/commands/user/update.d.ts

@@ -14,6 +14,7 @@ declare class UserUpdate extends BaseCommand {
         name: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
         password: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
         role: _oclif_core_interfaces.OptionFlag<string | undefined, _oclif_core_interfaces.CustomOptions>;
+        'force-password-change': _oclif_core_interfaces.BooleanFlag<boolean>;
     };
     run(): Promise<void>;
 }

package/dist/cli/commands/user/update.js

@@ -163,6 +163,11 @@ var UserUpdate = class _UserUpdate extends BaseCommand {
     role: Flags.string({
       description: "New role",
       options: ["owner", "admin", "member", "viewer"]
+    }),
+    "force-password-change": Flags.boolean({
+      description: "Force user to change password on next login",
+      allowNo: true
+      // Allows --no-force-password-change to clear the flag
     })
   };
   async run() {
@@ -182,7 +187,7 @@ var UserUpdate = class _UserUpdate extends BaseCommand {
 ${chalk2.gray(`  No user matching: ${args.user}`)}`
         );
       }
-      if (!flags.email && !flags.name && !flags.password && !flags.role) {
+      if (!flags.email && !flags.name && !flags.password && !flags.role && flags["force-password-change"] === void 0) {
         const { fields } = await inquirer.prompt([
           {
             type: "checkbox",
@@ -252,6 +257,9 @@ ${chalk2.gray(`  No user matching: ${args.user}`)}`
       if (flags.name) updates.name = flags.name;
       if (flags.password) updates.password = flags.password;
       if (flags.role) updates.role = flags.role;
+      if (flags["force-password-change"] !== void 0) {
+        updates.must_change_password = flags["force-password-change"];
+      }
       if (Object.keys(updates).length === 0) {
         this.log(chalk2.gray("No changes to apply"));
         await this.cleanupClient(client);
@@ -266,6 +274,9 @@ ${chalk2.gray(`  No user matching: ${args.user}`)}`
       this.log(`  Name:  ${chalk2.cyan(updatedUser.name || "(not set)")}`);
       this.log(`  Role:  ${chalk2.cyan(updatedUser.role)}`);
       this.log(`  ID:    ${chalk2.gray(updatedUser.user_id.substring(0, 8))}`);
+      if (updatedUser.must_change_password) {
+        this.log(`  ${chalk2.yellow("\u26A0")} User must change password on next login`);
+      }
       await this.cleanupClient(client);
     } catch (error) {
       await this.cleanupClient(client);

package/dist/core/api/index.d.cts

@@ -3,7 +3,7 @@ import { e as Board, f as BoardExportBlob } from '../board-BGkmgUH3.cjs';
 import { a as ContextFileListItem, b as ContextFileDetail } from '../context-ByxGjp5l.cjs';
 import { b as AuthenticationResult } from '../feathers-BzHEPnpl.cjs';
 import { i as MCPServer } from '../mcp-oU9TGu_S.cjs';
-import { d as User } from '../user-zv1BTkAp.cjs';
+import { d as User } from '../user-RShA3iU6.cjs';
 import { b as Repo, d as Worktree } from '../repo-DbOIBw1c.cjs';
 import { f as Session } from '../session-DE9tT7Cm.cjs';
 import { c as Task } from '../task-D5cWUcAY.cjs';

package/dist/core/api/index.d.ts

@@ -3,7 +3,7 @@ import { e as Board, f as BoardExportBlob } from '../board-CKJQAhxz.js';
 import { a as ContextFileListItem, b as ContextFileDetail } from '../context-ByxGjp5l.js';
 import { b as AuthenticationResult } from '../feathers-BzHEPnpl.js';
 import { i as MCPServer } from '../mcp-C-LwrhHt.js';
-import { d as User } from '../user-CMQOATsn.js';
+import { d as User } from '../user-DhXUWd3o.js';
 import { b as Repo, d as Worktree } from '../repo-DkEPOBbI.js';
 import { f as Session } from '../session-DrzT_Csl.js';
 import { c as Task } from '../task-D0i_mU9u.js';

package/dist/core/claude/index.cjs

@@ -513,6 +513,8 @@ var users = (0, import_pg_core.pgTable)(
     unix_username: (0, import_pg_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
@@ -957,6 +959,8 @@ var users2 = (0, import_sqlite_core.sqliteTable)(
     unix_username: (0, import_sqlite_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },

package/dist/core/claude/index.js

@@ -488,6 +488,8 @@ var users = pgTable(
     unix_username: text("unix_username"),
     // Onboarding state
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
@@ -932,6 +934,8 @@ var users2 = sqliteTable(
     unix_username: text2("unix_username"),
     // Onboarding state
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },

package/dist/core/{client-By3Q6aQA.d.ts → client-CFqfLUUF.d.ts}

@@ -2007,6 +2007,23 @@ declare const users$1: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_pg_core.PgColumn<{
             name: string;
             tableName: "users";
@@ -5036,6 +5053,23 @@ declare const users: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: string;
             tableName: "users";

package/dist/core/{client-KDgnPBwr.d.cts → client-Dq6QefL9.d.cts}

@@ -2007,6 +2007,23 @@ declare const users$1: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_pg_core.PgColumn<{
             name: string;
             tableName: "users";
@@ -5036,6 +5053,23 @@ declare const users: drizzle_orm_sqlite_core.SQLiteTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: string;
             tableName: "users";

package/dist/core/config/browser.d.cts

@@ -52,6 +52,12 @@ interface AgorDaemonSettings {
      * Required when Unix isolation is enabled (worktree_rbac or unix_user_mode).
      * In dev mode without isolation, falls back to current process user. */
     unix_user?: string;
+    /** Instance label for deployment identification (e.g., "staging", "prod-us-east").
+     * Displayed as a Tag in the UI navbar when set. */
+    instanceLabel?: string;
+    /** Instance description (markdown supported).
+     * Displayed as a popover around the instance label Tag. */
+    instanceDescription?: string;
 }
 /**
  * UI settings

package/dist/core/config/browser.d.ts

@@ -52,6 +52,12 @@ interface AgorDaemonSettings {
      * Required when Unix isolation is enabled (worktree_rbac or unix_user_mode).
      * In dev mode without isolation, falls back to current process user. */
     unix_user?: string;
+    /** Instance label for deployment identification (e.g., "staging", "prod-us-east").
+     * Displayed as a Tag in the UI navbar when set. */
+    instanceLabel?: string;
+    /** Instance description (markdown supported).
+     * Displayed as a popover around the instance label Tag. */
+    instanceDescription?: string;
 }
 /**
  * UI settings

package/dist/core/config/index.cjs

@@ -137,6 +137,7 @@ var init_ids = __esm({
 var config_exports = {};
 __export(config_exports, {
   AGOR_INTERNAL_ENV_VARS: () => AGOR_INTERNAL_ENV_VARS,
+  AGOR_USER_ENV_KEYS_VAR: () => AGOR_USER_ENV_KEYS_VAR,
   BLOCKED_ENV_VARS: () => BLOCKED_ENV_VARS,
   CredentialKey: () => CredentialKey,
   DAEMON: () => DAEMON,
@@ -1043,6 +1044,8 @@ var users = (0, import_pg_core.pgTable)(
     unix_username: (0, import_pg_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
@@ -1487,6 +1490,8 @@ var users2 = (0, import_sqlite_core.sqliteTable)(
     unix_username: (0, import_sqlite_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },
@@ -1733,16 +1738,19 @@ async function resolveUserEnvironment(userId, db) {
 function resolveSystemEnvironment() {
   return { ...process.env };
 }
+var AGOR_USER_ENV_KEYS_VAR = "AGOR_USER_ENV_KEYS";
 async function createUserProcessEnvironment(userId, db, additionalEnv) {
   const env = { ...process.env };
   for (const internalVar of AGOR_INTERNAL_ENV_VARS) {
     delete env[internalVar];
   }
+  const userEnvKeys = [];
   if (userId && db) {
     const userEnv = await resolveUserEnvironment(userId, db);
     for (const [key, value] of Object.entries(userEnv)) {
       if (value && value.trim() !== "") {
         env[key] = value;
+        userEnvKeys.push(key);
       }
     }
   }
@@ -1753,6 +1761,9 @@ async function createUserProcessEnvironment(userId, db, additionalEnv) {
       }
     }
   }
+  if (userEnvKeys.length > 0) {
+    env[AGOR_USER_ENV_KEYS_VAR] = userEnvKeys.join(",");
+  }
   return env;
 }
 
@@ -2252,6 +2263,7 @@ var CredentialKey = /* @__PURE__ */ ((CredentialKey2) => {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGOR_INTERNAL_ENV_VARS,
+  AGOR_USER_ENV_KEYS_VAR,
   BLOCKED_ENV_VARS,
   CredentialKey,
   DAEMON,

package/dist/core/config/index.d.cts

@@ -1,7 +1,7 @@
 import { h as RepoEnvironmentConfig } from '../repo-DbOIBw1c.cjs';
 import { AgorConfig } from './browser.cjs';
 export { AgorCodexSettings, AgorCredentials, AgorDaemonSettings, AgorDatabaseSettings, AgorDefaults, AgorDisplaySettings, AgorExecutionSettings, AgorOpenCodeSettings, AgorUISettings, ConfigKey, CredentialKey, DAEMON, DATABASE, ENVIRONMENT, GIT, PAGINATION, RepoReference, RepoReferenceOption, SESSION, UnknownJson, WEBSOCKET, extractSlugFromUrl, formatRepoReference, getDefaultRepoReference, getGroupedRepoReferenceOptions, getRepoReferenceOptions, isValidGitUrl, isValidSlug, parseRepoReference, resolveRepoReference } from './browser.cjs';
-import { d as Database } from '../client-KDgnPBwr.cjs';
+import { d as Database } from '../client-Dq6QefL9.cjs';
 import { b as UserID } from '../id-BwPJtWxW.cjs';
 import 'drizzle-orm/libsql';
 import 'drizzle-orm/postgres-js';
@@ -264,6 +264,11 @@ declare function resolveUserEnvironment(userId: UserID, db: Database): Promise<R
  * Synchronous version - returns system env only
  */
 declare function resolveSystemEnvironment(): Record<string, string>;
+/**
+ * Special environment variable that contains comma-separated list of user-defined env var keys.
+ * Used by MCP template resolver to restrict template context to user-scoped vars only.
+ */
+declare const AGOR_USER_ENV_KEYS_VAR = "AGOR_USER_ENV_KEYS";
 /**
  * Create a clean environment for user processes (worktrees, terminals, etc.)
  *
@@ -272,6 +277,7 @@ declare function resolveSystemEnvironment(): Record<string, string>;
  * 2. Filters out Agor-internal variables (NODE_ENV, AGOR_*, etc.)
  * 3. Resolves and merges user-specific encrypted environment variables
  * 4. Optionally merges additional environment variables
+ * 5. Sets AGOR_USER_ENV_KEYS with comma-separated list of user-defined var keys
  *
  * @param userId - User ID to resolve environment for (optional)
  * @param db - Database instance (required if userId provided)
@@ -373,4 +379,4 @@ declare function resolveApiKey(keyName: ApiKeyName, context?: KeyResolutionConte
  */
 declare function resolveApiKeySync(keyName: ApiKeyName): KeyResolutionResult;
 
-export { AGOR_INTERNAL_ENV_VARS, AgorConfig, type AgorYmlSchema, type ApiKeyName, BLOCKED_ENV_VARS, ENV_VAR_CONSTRAINTS, type KeyResolutionContext, type KeyResolutionResult, type ValidationError, createUserProcessEnvironment, ensureCodexHome, expandHomePath, formatValidationError, formatValidationErrors, getAgorHome, getConfigPath, getConfigValue, getCredential, getDaemonUrl, getDaemonUser, getDefaultConfig, getEnvVarBlockReason, initConfig, isEnvVarAllowed, isValid, isWorktreeRbacEnabled, loadConfig, loadConfigSync, parseAgorYml, requireDaemonUser, resolveApiKey, resolveApiKeySync, resolveCodexHome, resolveSystemEnvironment, resolveUserEnvironment, saveConfig, setConfigValue, unsetConfigValue, validateEnvVar, withUserEnvironment, withUserEnvironmentSync, writeAgorYml };
+export { AGOR_INTERNAL_ENV_VARS, AGOR_USER_ENV_KEYS_VAR, AgorConfig, type AgorYmlSchema, type ApiKeyName, BLOCKED_ENV_VARS, ENV_VAR_CONSTRAINTS, type KeyResolutionContext, type KeyResolutionResult, type ValidationError, createUserProcessEnvironment, ensureCodexHome, expandHomePath, formatValidationError, formatValidationErrors, getAgorHome, getConfigPath, getConfigValue, getCredential, getDaemonUrl, getDaemonUser, getDefaultConfig, getEnvVarBlockReason, initConfig, isEnvVarAllowed, isValid, isWorktreeRbacEnabled, loadConfig, loadConfigSync, parseAgorYml, requireDaemonUser, resolveApiKey, resolveApiKeySync, resolveCodexHome, resolveSystemEnvironment, resolveUserEnvironment, saveConfig, setConfigValue, unsetConfigValue, validateEnvVar, withUserEnvironment, withUserEnvironmentSync, writeAgorYml };

package/dist/core/config/index.d.ts

@@ -1,7 +1,7 @@
 import { h as RepoEnvironmentConfig } from '../repo-DkEPOBbI.js';
 import { AgorConfig } from './browser.js';
 export { AgorCodexSettings, AgorCredentials, AgorDaemonSettings, AgorDatabaseSettings, AgorDefaults, AgorDisplaySettings, AgorExecutionSettings, AgorOpenCodeSettings, AgorUISettings, ConfigKey, CredentialKey, DAEMON, DATABASE, ENVIRONMENT, GIT, PAGINATION, RepoReference, RepoReferenceOption, SESSION, UnknownJson, WEBSOCKET, extractSlugFromUrl, formatRepoReference, getDefaultRepoReference, getGroupedRepoReferenceOptions, getRepoReferenceOptions, isValidGitUrl, isValidSlug, parseRepoReference, resolveRepoReference } from './browser.js';
-import { d as Database } from '../client-By3Q6aQA.js';
+import { d as Database } from '../client-CFqfLUUF.js';
 import { b as UserID } from '../id-BwPJtWxW.js';
 import 'drizzle-orm/libsql';
 import 'drizzle-orm/postgres-js';
@@ -264,6 +264,11 @@ declare function resolveUserEnvironment(userId: UserID, db: Database): Promise<R
  * Synchronous version - returns system env only
  */
 declare function resolveSystemEnvironment(): Record<string, string>;
+/**
+ * Special environment variable that contains comma-separated list of user-defined env var keys.
+ * Used by MCP template resolver to restrict template context to user-scoped vars only.
+ */
+declare const AGOR_USER_ENV_KEYS_VAR = "AGOR_USER_ENV_KEYS";
 /**
  * Create a clean environment for user processes (worktrees, terminals, etc.)
  *
@@ -272,6 +277,7 @@ declare function resolveSystemEnvironment(): Record<string, string>;
  * 2. Filters out Agor-internal variables (NODE_ENV, AGOR_*, etc.)
  * 3. Resolves and merges user-specific encrypted environment variables
  * 4. Optionally merges additional environment variables
+ * 5. Sets AGOR_USER_ENV_KEYS with comma-separated list of user-defined var keys
  *
  * @param userId - User ID to resolve environment for (optional)
  * @param db - Database instance (required if userId provided)
@@ -373,4 +379,4 @@ declare function resolveApiKey(keyName: ApiKeyName, context?: KeyResolutionConte
  */
 declare function resolveApiKeySync(keyName: ApiKeyName): KeyResolutionResult;
 
-export { AGOR_INTERNAL_ENV_VARS, AgorConfig, type AgorYmlSchema, type ApiKeyName, BLOCKED_ENV_VARS, ENV_VAR_CONSTRAINTS, type KeyResolutionContext, type KeyResolutionResult, type ValidationError, createUserProcessEnvironment, ensureCodexHome, expandHomePath, formatValidationError, formatValidationErrors, getAgorHome, getConfigPath, getConfigValue, getCredential, getDaemonUrl, getDaemonUser, getDefaultConfig, getEnvVarBlockReason, initConfig, isEnvVarAllowed, isValid, isWorktreeRbacEnabled, loadConfig, loadConfigSync, parseAgorYml, requireDaemonUser, resolveApiKey, resolveApiKeySync, resolveCodexHome, resolveSystemEnvironment, resolveUserEnvironment, saveConfig, setConfigValue, unsetConfigValue, validateEnvVar, withUserEnvironment, withUserEnvironmentSync, writeAgorYml };
+export { AGOR_INTERNAL_ENV_VARS, AGOR_USER_ENV_KEYS_VAR, AgorConfig, type AgorYmlSchema, type ApiKeyName, BLOCKED_ENV_VARS, ENV_VAR_CONSTRAINTS, type KeyResolutionContext, type KeyResolutionResult, type ValidationError, createUserProcessEnvironment, ensureCodexHome, expandHomePath, formatValidationError, formatValidationErrors, getAgorHome, getConfigPath, getConfigValue, getCredential, getDaemonUrl, getDaemonUser, getDefaultConfig, getEnvVarBlockReason, initConfig, isEnvVarAllowed, isValid, isWorktreeRbacEnabled, loadConfig, loadConfigSync, parseAgorYml, requireDaemonUser, resolveApiKey, resolveApiKeySync, resolveCodexHome, resolveSystemEnvironment, resolveUserEnvironment, saveConfig, setConfigValue, unsetConfigValue, validateEnvVar, withUserEnvironment, withUserEnvironmentSync, writeAgorYml };

package/dist/core/config/index.js

@@ -974,6 +974,8 @@ var users = pgTable(
     unix_username: text("unix_username"),
     // Onboarding state
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
@@ -1418,6 +1420,8 @@ var users2 = sqliteTable(
     unix_username: text2("unix_username"),
     // Onboarding state
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },
@@ -1664,16 +1668,19 @@ async function resolveUserEnvironment(userId, db) {
 function resolveSystemEnvironment() {
   return { ...process.env };
 }
+var AGOR_USER_ENV_KEYS_VAR = "AGOR_USER_ENV_KEYS";
 async function createUserProcessEnvironment(userId, db, additionalEnv) {
   const env = { ...process.env };
   for (const internalVar of AGOR_INTERNAL_ENV_VARS) {
     delete env[internalVar];
   }
+  const userEnvKeys = [];
   if (userId && db) {
     const userEnv = await resolveUserEnvironment(userId, db);
     for (const [key, value] of Object.entries(userEnv)) {
       if (value && value.trim() !== "") {
         env[key] = value;
+        userEnvKeys.push(key);
       }
     }
   }
@@ -1684,6 +1691,9 @@ async function createUserProcessEnvironment(userId, db, additionalEnv) {
       }
     }
   }
+  if (userEnvKeys.length > 0) {
+    env[AGOR_USER_ENV_KEYS_VAR] = userEnvKeys.join(",");
+  }
   return env;
 }
 
@@ -2182,6 +2192,7 @@ var CredentialKey = /* @__PURE__ */ ((CredentialKey2) => {
 })(CredentialKey || {});
 export {
   AGOR_INTERNAL_ENV_VARS,
+  AGOR_USER_ENV_KEYS_VAR,
   BLOCKED_ENV_VARS,
   CredentialKey,
   DAEMON,

package/dist/core/db/index.cjs

@@ -829,6 +829,8 @@ var users = (0, import_pg_core.pgTable)(
     unix_username: (0, import_pg_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t.json("data").$type().notNull()
   },
@@ -1273,6 +1275,8 @@ var users2 = (0, import_sqlite_core.sqliteTable)(
     unix_username: (0, import_sqlite_core.text)("unix_username"),
     // Onboarding state
     onboarding_completed: t2.bool("onboarding_completed").notNull().default(false),
+    // Force password change flag (admin-settable, auto-cleared on password change)
+    must_change_password: t2.bool("must_change_password").notNull().default(false),
     // JSON blob for profile/preferences
     data: t2.json("data").$type().notNull()
   },
@@ -4632,6 +4636,7 @@ var UsersRepository = class {
       role: row.role,
       unix_username: row.unix_username ?? void 0,
       onboarding_completed: row.onboarding_completed,
+      must_change_password: row.must_change_password,
       avatar: row.data.avatar,
       preferences: row.data.preferences,
       // Convert encrypted keys to boolean flags (true = key exists, false/undefined = no key)
@@ -5279,6 +5284,7 @@ async function createUser(db, data) {
     avatar: userData.avatar,
     preferences: userData.preferences,
     onboarding_completed: !!row.onboarding_completed,
+    must_change_password: !!row.must_change_password,
     created_at: row.created_at,
     updated_at: row.updated_at ?? void 0
   };
@@ -5303,6 +5309,7 @@ async function getUserByEmail(db, email) {
     avatar: userData.avatar,
     preferences: userData.preferences,
     onboarding_completed: !!row.onboarding_completed,
+    must_change_password: !!row.must_change_password,
     created_at: row.created_at,
     updated_at: row.updated_at ?? void 0
   };

package/dist/core/db/index.d.cts

@@ -1,8 +1,8 @@
 import { SQL } from 'drizzle-orm';
 export { SQL, and, asc, desc, eq, inArray, like, or, sql } from 'drizzle-orm';
 import bcryptjs from 'bcryptjs';
-import { d as Database, w as sqliteSchema, x as postgresSchema } from '../client-KDgnPBwr.cjs';
-export { v as BoardCommentInsert, u as BoardCommentRow, k as BoardInsert, t as BoardObjectInsert, s as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, p as MCPServerInsert, o as MCPServerRow, j as MessageInsert, M as MessageRow, l as RepoInsert, R as RepoRow, h as SessionInsert, r as SessionMCPServerInsert, q as SessionMCPServerRow, S as SessionRow, i as TaskInsert, T as TaskRow, n as UserInsert, U as UserRow, m as WorktreeInsert, W as WorktreeRow, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, g as getDatabaseUrl } from '../client-KDgnPBwr.cjs';
+import { d as Database, w as sqliteSchema, x as postgresSchema } from '../client-Dq6QefL9.cjs';
+export { v as BoardCommentInsert, u as BoardCommentRow, k as BoardInsert, t as BoardObjectInsert, s as BoardObjectRow, B as BoardRow, e as DEFAULT_DB_PATH, a as DatabaseConnectionError, D as DbConfig, p as MCPServerInsert, o as MCPServerRow, j as MessageInsert, M as MessageRow, l as RepoInsert, R as RepoRow, h as SessionInsert, r as SessionMCPServerInsert, q as SessionMCPServerRow, S as SessionRow, i as TaskInsert, T as TaskRow, n as UserInsert, U as UserRow, m as WorktreeInsert, W as WorktreeRow, c as createDatabase, b as createDatabaseAsync, f as createLocalDatabase, g as getDatabaseUrl } from '../client-Dq6QefL9.cjs';
 import { LibSQLDatabase } from 'drizzle-orm/libsql';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { PgTable } from 'drizzle-orm/pg-core';
@@ -17,7 +17,7 @@ import { e as Message } from '../message-BFjPtffm.cjs';
 import { b as Repo, d as Worktree } from '../repo-DbOIBw1c.cjs';
 import { f as Session, P as PermissionMode, c as CodexSandboxMode, d as CodexApprovalPolicy } from '../session-DE9tT7Cm.cjs';
 import { c as Task } from '../task-D5cWUcAY.cjs';
-import { d as User } from '../user-zv1BTkAp.cjs';
+import { d as User } from '../user-RShA3iU6.cjs';
 import '../context-ByxGjp5l.cjs';
 
 /**
@@ -5173,6 +5173,23 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_pg_core.PgColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_pg_core.PgColumn<{
             name: string;
             tableName: "users";
@@ -5486,6 +5503,23 @@ declare const users: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        must_change_password: drizzle_orm_sqlite_core.SQLiteColumn<{
+            name: string;
+            tableName: "users";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         data: drizzle_orm_sqlite_core.SQLiteColumn<{
             name: string;
             tableName: "users";