From e21f9b6ff7b39b1d8ac4821dc0c2a137f7ef341c Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 10:05:55 -0600
Subject: [PATCH 1/6] feat: add central users table with admin management and
 auto-registration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add users table (id, displayName, isAdmin, isAgent, avatarUrl, timestamps)
- Apply DB migration: CREATE TABLE + GRANT to team_user
- Seed initial users: chris, clio, domingo, zumie, gonzo
- auth.ts: remove hardcoded validMailboxes set, load from users table at startup
- auth.ts: export listUsers() for admin use
- register.post.ts: auto-upsert users row on invite redemption
- Add GET /api/admin/users — list users with presence enrichment
- Add PATCH /api/admin/users/:id — update user profile/status
- api.ts: add listUsers() and updateUser() client helpers
---
 server/routes/api/admin/users.get.ts        | 39 +++++++++++
 server/routes/api/admin/users/[id].patch.ts | 72 +++++++++++++++++++++
 server/routes/api/auth/register.post.ts     | 10 ++-
 src/db/schema.ts                            | 17 +++++
 src/lib/api.ts                              |  8 +++
 src/lib/auth.ts                             | 30 ++++++++-
 6 files changed, 174 insertions(+), 2 deletions(-)
 create mode 100644 server/routes/api/admin/users.get.ts
 create mode 100644 server/routes/api/admin/users/[id].patch.ts

diff --git a/server/routes/api/admin/users.get.ts b/server/routes/api/admin/users.get.ts
new file mode 100644
index 0000000..7c5e660
--- /dev/null
+++ b/server/routes/api/admin/users.get.ts
@@ -0,0 +1,39 @@
+import { defineEventHandler } from "h3";
+import { authenticateEvent, listUsers } from "@/lib/auth";
+import { getPresence } from "@/lib/presence";
+
+/**
+ * GET /api/admin/users
+ * Returns all active users enriched with presence data.
+ * Admin only.
+ */
+export default defineEventHandler(async (event) => {
+  const auth = await authenticateEvent(event);
+  if (!auth) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  if (!auth.isAdmin) {
+    return new Response(JSON.stringify({ error: "Admin required" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const [userRows, presence] = await Promise.all([listUsers(), getPresence()]);
+
+  const enriched = userRows.map((user) => {
+    const p = presence[user.id];
+    return {
+      ...user,
+      online: p?.online ?? false,
+      lastSeen: p?.lastSeen ?? null,
+      presenceSource: p?.source ?? null,
+    };
+  });
+
+  return { users: enriched };
+});
diff --git a/server/routes/api/admin/users/[id].patch.ts b/server/routes/api/admin/users/[id].patch.ts
new file mode 100644
index 0000000..23da083
--- /dev/null
+++ b/server/routes/api/admin/users/[id].patch.ts
@@ -0,0 +1,72 @@
+import { defineEventHandler, readBody, getRouterParam } from "h3";
+import { authenticateEvent } from "@/lib/auth";
+import { db } from "@/db";
+import { users } from "@/db/schema";
+import { eq } from "drizzle-orm";
+
+interface UserPatchBody {
+  displayName?: string;
+  isAdmin?: boolean;
+  isAgent?: boolean;
+  avatarUrl?: string | null;
+  archivedAt?: string | null;
+}
+
+/**
+ * PATCH /api/admin/users/:id
+ * Update a user's profile. Admin only.
+ */
+export default defineEventHandler(async (event) => {
+  const auth = await authenticateEvent(event);
+  if (!auth) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  if (!auth.isAdmin) {
+    return new Response(JSON.stringify({ error: "Admin required" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const id = getRouterParam(event, "id");
+  if (!id) {
+    return new Response(JSON.stringify({ error: "User ID required" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const raw = await readBody<Record<string, unknown>>(event);
+  const body: UserPatchBody = raw ?? {};
+
+  const patch: Partial<typeof users.$inferInsert> & { updatedAt: Date } = {
+    updatedAt: new Date(),
+  };
+
+  if ("displayName" in body && body.displayName !== undefined) patch.displayName = String(body.displayName);
+  if ("isAdmin" in body && body.isAdmin !== undefined) patch.isAdmin = Boolean(body.isAdmin);
+  if ("isAgent" in body && body.isAgent !== undefined) patch.isAgent = Boolean(body.isAgent);
+  if ("avatarUrl" in body) patch.avatarUrl = body.avatarUrl ?? null;
+  if ("archivedAt" in body) {
+    patch.archivedAt = body.archivedAt ? new Date(body.archivedAt) : null;
+  }
+
+  const [updated] = await db
+    .update(users)
+    .set(patch)
+    .where(eq(users.id, id))
+    .returning();
+
+  if (!updated) {
+    return new Response(JSON.stringify({ error: "User not found" }), {
+      status: 404,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  return { user: updated };
+});
diff --git a/server/routes/api/auth/register.post.ts b/server/routes/api/auth/register.post.ts
index ed7a129..46e07a8 100644
--- a/server/routes/api/auth/register.post.ts
+++ b/server/routes/api/auth/register.post.ts
@@ -2,7 +2,7 @@ import { randomBytes } from "node:crypto";
 import { and, eq, gt, isNull, or } from "drizzle-orm";
 import { defineEventHandler, readBody } from "h3";
 import { db } from "@/db";
-import { invites, mailboxTokens } from "@/db/schema";
+import { invites, mailboxTokens, users } from "@/db/schema";
 import { clearAuthCache, registerMailbox } from "@/lib/auth";
 
 export default defineEventHandler(async (event) => {
@@ -85,6 +85,14 @@ export default defineEventHandler(async (event) => {
     .set({ useCount: invite.useCount + 1 })
     .where(eq(invites.id, invite.id));
 
+  // Ensure a users row exists for this identity
+  await db.insert(users).values({
+    id: identity,
+    displayName: body.displayName || identity,
+    isAdmin: invite.isAdmin,
+    isAgent: false, // humans registering via invite
+  }).onConflictDoNothing();
+
   // Register the mailbox and clear auth cache
   registerMailbox(identity);
   clearAuthCache();
diff --git a/src/db/schema.ts b/src/db/schema.ts
index 0aeb8ec..da7e4c4 100644
--- a/src/db/schema.ts
+++ b/src/db/schema.ts
@@ -455,6 +455,22 @@ export const attachments = pgTable(
     index("idx_attachments_entity").on(table.entityType, table.entityId),
   ],
 );
+// ============================================================
+// USERS (central registry)
+// ============================================================
+
+export const users = pgTable("users", {
+  id: varchar("id", { length: 50 }).primaryKey(), // = identity slug ("gonzo", "chris")
+  displayName: varchar("display_name", { length: 100 }).notNull(),
+  isAdmin: boolean("is_admin").notNull().default(false),
+  isAgent: boolean("is_agent").notNull().default(false), // true for AI agents
+  avatarUrl: text("avatar_url"),
+  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull(),
+  lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
+  archivedAt: timestamp("archived_at", { withTimezone: true }), // soft-deactivate
+});
+
 
 // ============================================================
 // TYPES
@@ -479,3 +495,4 @@ export type NotebookPage = typeof notebookPages.$inferSelect;
 export type SwarmTaskNotebookPage = typeof swarmTaskNotebookPages.$inferSelect;
 export type Attachment = typeof attachments.$inferSelect;
 export type ContentProjectTag = typeof contentProjectTags.$inferSelect;
+export type User = typeof users.$inferSelect;
diff --git a/src/lib/api.ts b/src/lib/api.ts
index fa71ee7..ee9e398 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -306,6 +306,14 @@ export const api = {
   // Admin
   getUserStats: () => apiFetch("/admin/user-stats"),
 
+  listUsers: () => apiFetch("/admin/users"),
+
+  updateUser: (id: string, data: Record<string, unknown>) =>
+    apiFetch(`/admin/users/${id}`, {
+      method: "PATCH",
+      body: JSON.stringify(data),
+    }),
+
   searchChatMessages: (params: {
     q: string;
     channelId?: string;
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 2089dea..dedeafc 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -3,7 +3,7 @@ import { and, eq, gt, isNull, or } from "drizzle-orm";
 import type { H3Event } from "h3";
 import { getHeader } from "h3";
 import { db } from "@/db";
-import { mailboxTokens } from "@/db/schema";
+import { mailboxTokens, users } from "@/db/schema";
 
 config({ path: ".env" });
 config({ path: "/etc/clawdbot/vault.env" });
@@ -22,6 +22,31 @@ const validMailboxes = new Set<string>();
 const dbCache = new Map<string, { ctx: AuthContext | null; expires: number }>();
 const DB_CACHE_TTL = 30_000; // 30 seconds
 
+/** Load all active users from DB into validMailboxes at startup */
+async function loadUsersFromDb() {
+  try {
+    const rows = await db
+      .select({ id: users.id })
+      .from(users)
+      .where(isNull(users.archivedAt));
+    for (const row of rows) {
+      validMailboxes.add(row.id);
+    }
+    console.log(`[auth] Loaded ${rows.length} user(s) from DB into validMailboxes`);
+  } catch (err) {
+    console.error("[auth] Failed to load users from DB:", err);
+  }
+}
+
+/** Return all non-archived users ordered by display name */
+export async function listUsers() {
+  return db
+    .select()
+    .from(users)
+    .where(isNull(users.archivedAt))
+    .orderBy(users.displayName);
+}
+
 export function isValidMailbox(name: string): boolean {
   return validMailboxes.has(name);
 }
@@ -185,6 +210,9 @@ export function initAuth() {
   }
 
   console.log(`[auth] Loaded ${envTokens.size} env token(s), DB auth enabled`);
+
+  // Load known users from DB into validMailboxes (fire-and-forget)
+  loadUsersFromDb().catch(err => console.error("[auth] Failed to load users from DB:", err));
 }
 
 /** Clear the DB token cache (e.g., after creating/revoking tokens) */

From cf70ce14c6b13acb1666b0a623f2105f00f504a5 Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 10:27:06 -0600
Subject: [PATCH 2/6] feat: replace hardcoded user lists with dynamic users API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add GET /api/users — authenticated endpoint returning all active users
- Add useUsers() / useUserIds() React hook with 5-min module-level cache
- Replace ALL_USERS/KNOWN_USERS/KNOWN_RECIPIENTS constants in:
  - src/components/nav.tsx (presence avatar bar)
  - src/routes/presence.tsx (team list, group chat dialog)
  - src/routes/swarm.tsx (task assignee pickers, project lead pickers)
  - src/routes/admin.tsx (recurring task assignee picker)
  - src/components/compose-dialog.tsx (recipient quick-pick)
- Any new user added to the users table now automatically appears everywhere
---
 server/routes/api/users.get.ts    | 30 +++++----------------
 src/components/compose-dialog.tsx |  6 ++---
 src/components/nav.tsx            |  6 ++---
 src/lib/api.ts                    |  2 ++
 src/lib/use-users.ts              | 44 +++++++++++++++++++++++++++++++
 src/routes/admin.tsx              |  9 ++++---
 src/routes/presence.tsx           |  9 ++++---
 src/routes/swarm.tsx              | 23 +++++++++-------
 8 files changed, 85 insertions(+), 44 deletions(-)
 create mode 100644 src/lib/use-users.ts

diff --git a/server/routes/api/users.get.ts b/server/routes/api/users.get.ts
index c69da16..239b571 100644
--- a/server/routes/api/users.get.ts
+++ b/server/routes/api/users.get.ts
@@ -1,9 +1,10 @@
-import { isNull } from "drizzle-orm";
 import { defineEventHandler } from "h3";
-import { db } from "@/db";
-import { mailboxTokens } from "@/db/schema";
-import { authenticateEvent } from "@/lib/auth";
+import { authenticateEvent, listUsers } from "@/lib/auth";
 
+/**
+ * GET /api/users
+ * Returns all active users. Requires authentication (not admin-only).
+ */
 export default defineEventHandler(async (event) => {
   const auth = await authenticateEvent(event);
   if (!auth) {
@@ -13,23 +14,6 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Get identities from DB tokens (non-revoked)
-  const dbTokens = await db
-    .select({ identity: mailboxTokens.identity })
-    .from(mailboxTokens)
-    .where(isNull(mailboxTokens.revokedAt));
-
-  const identities = new Set(dbTokens.map((t) => t.identity));
-
-  // Also include env token identities
-  for (const key of Object.keys(process.env)) {
-    if (key.startsWith("MAILBOX_TOKEN_")) {
-      identities.add(key.replace("MAILBOX_TOKEN_", "").toLowerCase());
-    }
-  }
-
-  // Remove the admin token key if it slipped in
-  identities.delete("admin");
-
-  return { users: [...identities].sort() };
+  const users = await listUsers();
+  return { users };
 });
diff --git a/src/components/compose-dialog.tsx b/src/components/compose-dialog.tsx
index a3a6c9b..0425f2f 100644
--- a/src/components/compose-dialog.tsx
+++ b/src/components/compose-dialog.tsx
@@ -1,4 +1,5 @@
 import { useState } from "react";
+import { useUserIds } from "@/lib/use-users";
 import { Button } from "@/components/ui/button";
 import {
   Dialog,
@@ -11,8 +12,6 @@ import { Label } from "@/components/ui/label";
 import { Textarea } from "@/components/ui/textarea";
 import { api } from "@/lib/api";
 
-const KNOWN_RECIPIENTS = ["chris", "clio", "domingo", "zumie"];
-
 export function ComposeDialog({
   open,
   onOpenChange,
@@ -22,6 +21,7 @@ export function ComposeDialog({
   onOpenChange: (open: boolean) => void;
   onSent: () => void;
 }) {
+  const knownRecipients = useUserIds();
   const [recipient, setRecipient] = useState("");
   const [title, setTitle] = useState("");
   const [body, setBody] = useState("");
@@ -70,7 +70,7 @@ export function ComposeDialog({
           <div className="space-y-2">
             <Label>To</Label>
             <div className="flex flex-wrap gap-1.5 mb-2">
-              {KNOWN_RECIPIENTS.map((r) => (
+              {knownRecipients.map((r) => (
                 <Button
                   key={r}
                   type="button"
diff --git a/src/components/nav.tsx b/src/components/nav.tsx
index 0f532c3..ea3eac6 100644
--- a/src/components/nav.tsx
+++ b/src/components/nav.tsx
@@ -14,6 +14,7 @@ import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { UserAvatar } from "@/components/user-avatar";
 import { api, clearMailboxKey } from "@/lib/api";
+import { useUserIds } from "@/lib/use-users";
 import { ThemeToggle } from "./theme-toggle";
 
 const navItems = [
@@ -28,8 +29,6 @@ const navItems = [
 
 // Avatars served via /api/avatars/:identity with UserAvatar component
 
-const ALL_USERS = ["chris", "clio", "domingo", "zumie"];
-
 interface UserPresence {
   online: boolean;
   lastSeen: string | null;
@@ -53,6 +52,7 @@ function getBorderColor(online: boolean, lastSeen: string | null): string {
 }
 
 function PresenceDots() {
+  const allUsers = useUserIds();
   const [presence, setPresence] = useState<Record<string, UserPresence>>({});
 
   useEffect(() => {
@@ -69,7 +69,7 @@ function PresenceDots() {
     return () => clearInterval(interval);
   }, []);
 
-  const users = ALL_USERS.map((name) => ({
+  const users = allUsers.map((name) => ({
     name,
     info: presence[name] || {
       online: false,
diff --git a/src/lib/api.ts b/src/lib/api.ts
index ee9e398..bb1c25c 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -91,6 +91,8 @@ export const api = {
 
   getPresence: () => apiFetch("/presence"),
 
+  getUsers: () => apiFetch("/users"),
+
   // Broadcast
   listBroadcastEvents: (appName?: string) => {
     const params = appName ? `?appName=${encodeURIComponent(appName)}` : "";
diff --git a/src/lib/use-users.ts b/src/lib/use-users.ts
new file mode 100644
index 0000000..d6a8f9c
--- /dev/null
+++ b/src/lib/use-users.ts
@@ -0,0 +1,44 @@
+import { useEffect, useState } from "react";
+import { api } from "@/lib/api";
+
+export interface HiveUser {
+  id: string;
+  displayName: string;
+  isAdmin: boolean;
+  isAgent: boolean;
+  avatarUrl: string | null;
+}
+
+let cachedUsers: HiveUser[] | null = null;
+let cacheExpires = 0;
+const CACHE_TTL = 5 * 60 * 1000; // 5 minutes
+
+/** Fetch all active users. Results are cached in-memory for 5 minutes. */
+export function useUsers(): HiveUser[] {
+  const [users, setUsers] = useState<HiveUser[]>(cachedUsers ?? []);
+
+  useEffect(() => {
+    if (cachedUsers && Date.now() < cacheExpires) {
+      setUsers(cachedUsers);
+      return;
+    }
+
+    api
+      .getUsers()
+      .then((data: { users: HiveUser[] }) => {
+        cachedUsers = data.users;
+        cacheExpires = Date.now() + CACHE_TTL;
+        setUsers(data.users);
+      })
+      .catch(() => {
+        // Fall back to empty list — components should handle gracefully
+      });
+  }, []);
+
+  return users;
+}
+
+/** Just the ids (strings) for backwards-compat with ALL_USERS / KNOWN_USERS patterns */
+export function useUserIds(): string[] {
+  return useUsers().map((u) => u.id);
+}
diff --git a/src/routes/admin.tsx b/src/routes/admin.tsx
index 07cc57d..41a0c16 100644
--- a/src/routes/admin.tsx
+++ b/src/routes/admin.tsx
@@ -39,6 +39,7 @@ import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { Textarea } from "@/components/ui/textarea";
 import { UserAvatar } from "@/components/user-avatar";
 import { api, getMailboxKey } from "@/lib/api";
+import { useUserIds } from "@/lib/use-users";
 
 export const Route = createFileRoute("/admin")({
   component: AdminPage,
@@ -897,7 +898,7 @@ const CRON_PRESETS = [
   { label: "Every Friday 4 PM", value: "0 16 * * 5" },
 ];
 
-const KNOWN_USERS = ["chris", "clio", "domingo", "zumie"];
+// Users loaded dynamically via useUserIds()
 
 function RecurringPanel({
   projects,
@@ -1123,6 +1124,7 @@ function CreateRecurringDialog({
   projects: Array<{ id: string; title: string; color: string }>;
   onCreated: () => void;
 }) {
+  const knownUsers = useUserIds();
   const [title, setTitle] = useState("");
   const [detail, setDetail] = useState("");
   const [cronExpr, setCronExpr] = useState("0 9 * * 1");
@@ -1246,7 +1248,7 @@ function CreateRecurringDialog({
                 onChange={(e) => setAssignee(e.target.value)}
               >
                 <option value="">Unassigned</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -1305,6 +1307,7 @@ function EditRecurringDialog({
   projects: Array<{ id: string; title: string; color: string }>;
   onUpdated: () => void;
 }) {
+  const knownUsers = useUserIds();
   const [title, setTitle] = useState("");
   const [detail, setDetail] = useState("");
   const [cronExpr, setCronExpr] = useState("");
@@ -1430,7 +1433,7 @@ function EditRecurringDialog({
                 onChange={(e) => setAssignee(e.target.value)}
               >
                 <option value="">Unassigned</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
diff --git a/src/routes/presence.tsx b/src/routes/presence.tsx
index cba5c61..8241563 100644
--- a/src/routes/presence.tsx
+++ b/src/routes/presence.tsx
@@ -23,6 +23,7 @@ import { ScrollArea } from "@/components/ui/scroll-area";
 import { UserAvatar } from "@/components/user-avatar";
 import { api, getMailboxKey } from "@/lib/api";
 import { type ChatSSEEvent, useChatSSE } from "@/lib/use-chat-sse";
+import { useUserIds } from "@/lib/use-users";
 
 export const Route = createFileRoute("/presence")({
   component: PresencePage,
@@ -60,7 +61,7 @@ interface ChatMessage {
 
 // Avatars served via /api/avatars/:identity with UserAvatar component
 
-const ALL_USERS = ["chris", "clio", "domingo", "zumie"];
+// Users loaded dynamically via useUserIds()
 
 function getTimeSince(date: string | null): number {
   if (!date) return Infinity;
@@ -147,6 +148,7 @@ function PresencePage() {
 }
 
 function PresenceView({ onLogout }: { onLogout: () => void }) {
+  const allUserIds = useUserIds();
   const [presence, setPresence] = useState<Record<string, UserPresence>>({});
   const [loading, setLoading] = useState(false);
   const [channels, setChannels] = useState<ChatChannel[]>([]);
@@ -213,7 +215,7 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
 
   const totalUnread = channels.reduce((sum, ch) => sum + ch.unread_count, 0);
 
-  const users = ALL_USERS.map((name) => ({
+  const users = allUserIds.map((name) => ({
     name,
     info: presence[name] || {
       online: false,
@@ -747,6 +749,7 @@ function NewGroupDialog({
   onOpenChange: (open: boolean) => void;
   onCreated: (channelId: string) => void;
 }) {
+  const allUserIds = useUserIds();
   const [name, setName] = useState("");
   const [selected, setSelected] = useState<Set<string>>(new Set());
   const [creating, setCreating] = useState(false);
@@ -793,7 +796,7 @@ function NewGroupDialog({
           <div>
             <p className="text-xs text-muted-foreground mb-2">Members</p>
             <div className="flex flex-wrap gap-2">
-              {ALL_USERS.map((user) => (
+              {allUserIds.map((user) => (
                 <Button
                   key={user}
                   type="button"
diff --git a/src/routes/swarm.tsx b/src/routes/swarm.tsx
index 90197eb..4edc17c 100644
--- a/src/routes/swarm.tsx
+++ b/src/routes/swarm.tsx
@@ -39,6 +39,7 @@ import { Textarea } from "@/components/ui/textarea";
 import { UserAvatar } from "@/components/user-avatar";
 import { api, getMailboxKey } from "@/lib/api";
 import { useSwarmSSE } from "@/lib/use-swarm-sse";
+import { useUserIds } from "@/lib/use-users";
 
 export const Route = createFileRoute("/swarm")({
   component: SwarmPage,
@@ -142,7 +143,7 @@ const ALL_STATUSES = [
   "complete",
 ];
 
-const KNOWN_USERS = ["chris", "clio", "domingo", "zumie"];
+// Users loaded dynamically via useUserIds()
 
 function SwarmPage() {
   const [authed, setAuthed] = useState(false);
@@ -949,6 +950,7 @@ function TaskDetailDialog({
   onUpdated: () => void;
   onStatusChange: (id: string, status: string) => void;
 }) {
+  const knownUsers = useUserIds();
   const [editing, setEditing] = useState(false);
   const [title, setTitle] = useState("");
   const [detail, setDetail] = useState("");
@@ -1146,7 +1148,7 @@ function TaskDetailDialog({
                 onChange={(e) => setAssignee(e.target.value)}
               >
                 <option value="">Unassigned</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -1204,7 +1206,7 @@ function TaskDetailDialog({
                   onChange={(e) => setNextTaskAssignee(e.target.value)}
                 >
                   <option value="">None</option>
-                  {KNOWN_USERS.map((u) => (
+                  {knownUsers.map((u) => (
                     <option key={u} value={u}>
                       {u}
                     </option>
@@ -1509,6 +1511,7 @@ function CreateTaskDialog({
   tasks: SwarmTask[];
   onCreated: () => void;
 }) {
+  const knownUsers = useUserIds();
   const [title, setTitle] = useState("");
   const [detail, setDetail] = useState("");
   const [issueUrl, setIssueUrl] = useState("");
@@ -1607,7 +1610,7 @@ function CreateTaskDialog({
               onChange={(e) => setAssignee(e.target.value)}
             >
               <option value="">Unassigned</option>
-              {KNOWN_USERS.map((u) => (
+              {knownUsers.map((u) => (
                 <option key={u} value={u}>
                   {u}
                 </option>
@@ -1663,7 +1666,7 @@ function CreateTaskDialog({
                 onChange={(e) => setNextTaskAssignee(e.target.value)}
               >
                 <option value="">None</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -1714,6 +1717,7 @@ function CreateProjectDialog({
   onOpenChange: (open: boolean) => void;
   onCreated: () => void;
 }) {
+  const knownUsers = useUserIds();
   const [title, setTitle] = useState("");
   const [description, setDescription] = useState("");
   const [color, setColor] = useState(PROJECT_COLORS[0]);
@@ -1813,7 +1817,7 @@ function CreateProjectDialog({
                 onChange={(e) => setLead(e.target.value)}
               >
                 <option value="">Select...</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -1828,7 +1832,7 @@ function CreateProjectDialog({
                 onChange={(e) => setDevLead(e.target.value)}
               >
                 <option value="">Select...</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -1898,6 +1902,7 @@ function EditProjectDialog({
   onClose: () => void;
   onUpdated: () => void;
 }) {
+  const knownUsers = useUserIds();
   const [title, setTitle] = useState("");
   const [description, setDescription] = useState("");
   const [color, setColor] = useState("");
@@ -2012,7 +2017,7 @@ function EditProjectDialog({
                 onChange={(e) => setLead(e.target.value)}
               >
                 <option value="">Select...</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>
@@ -2027,7 +2032,7 @@ function EditProjectDialog({
                 onChange={(e) => setDevLead(e.target.value)}
               >
                 <option value="">Select...</option>
-                {KNOWN_USERS.map((u) => (
+                {knownUsers.map((u) => (
                   <option key={u} value={u}>
                     {u}
                   </option>

From e42740a9aa569da736c81fa1bcabe17a4118cc21 Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 11:45:33 -0600
Subject: [PATCH 3/6] =?UTF-8?q?feat:=20soft-delete=20(archive)=20for=20cha?=
 =?UTF-8?q?ts=20=E2=80=94=20per-member,=20sends=20to=20archive=20view?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add archived_at column to chat_members (per-member, others unaffected)
- DB migration applied
- chat.ts: filter archived channels from default list; add archiveChannel/unarchiveChannel
- GET /api/chat/channels: support ?archived=true to fetch archived chats
- POST /api/chat/channels/:id/archive + /unarchive endpoints
- api.ts: archiveChat() / unarchiveChat() / listChatChannels(archived) client helpers
- presence.tsx: hover on chat row shows Archive icon (replaces timestamp)
  Archive button: removes from active list instantly
  Archived view: Archive icon in header toggles between active/archived
  ArchiveRestore icon in archived view to unarchive
---
 server/routes/api/chat/channels.get.ts        |  7 +-
 .../api/chat/channels/[id]/archive.post.ts    | 37 ++++++++
 .../api/chat/channels/[id]/unarchive.post.ts  | 36 ++++++++
 src/db/schema.ts                              |  1 +
 src/lib/api.ts                                |  9 +-
 src/lib/chat.ts                               | 35 ++++++-
 src/routes/presence.tsx                       | 92 +++++++++++++++----
 7 files changed, 196 insertions(+), 21 deletions(-)
 create mode 100644 server/routes/api/chat/channels/[id]/archive.post.ts
 create mode 100644 server/routes/api/chat/channels/[id]/unarchive.post.ts

diff --git a/server/routes/api/chat/channels.get.ts b/server/routes/api/chat/channels.get.ts
index 10bc606..640e0e3 100644
--- a/server/routes/api/chat/channels.get.ts
+++ b/server/routes/api/chat/channels.get.ts
@@ -1,4 +1,4 @@
-import { defineEventHandler } from "h3";
+import { defineEventHandler, getQuery } from "h3";
 import { authenticateEvent } from "@/lib/auth";
 import { listChannels } from "@/lib/chat";
 
@@ -11,6 +11,9 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  const channels = await listChannels(auth.identity);
+  const query = getQuery(event);
+  const archived = query.archived === "true";
+
+  const channels = await listChannels(auth.identity, { archived });
   return { channels };
 });
diff --git a/server/routes/api/chat/channels/[id]/archive.post.ts b/server/routes/api/chat/channels/[id]/archive.post.ts
new file mode 100644
index 0000000..8f7bff1
--- /dev/null
+++ b/server/routes/api/chat/channels/[id]/archive.post.ts
@@ -0,0 +1,37 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { authenticateEvent } from "@/lib/auth";
+import { archiveChannel, isMember } from "@/lib/chat";
+
+/**
+ * POST /api/chat/channels/:id/archive
+ * Soft-deletes this channel from the current user's view.
+ * Other members are unaffected.
+ */
+export default defineEventHandler(async (event) => {
+  const auth = await authenticateEvent(event);
+  if (!auth) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const channelId = getRouterParam(event, "id");
+  if (!channelId) {
+    return new Response(JSON.stringify({ error: "Channel ID required" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const member = await isMember(channelId, auth.identity);
+  if (!member) {
+    return new Response(JSON.stringify({ error: "Not a member" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  await archiveChannel(channelId, auth.identity);
+  return { ok: true };
+});
diff --git a/server/routes/api/chat/channels/[id]/unarchive.post.ts b/server/routes/api/chat/channels/[id]/unarchive.post.ts
new file mode 100644
index 0000000..9963990
--- /dev/null
+++ b/server/routes/api/chat/channels/[id]/unarchive.post.ts
@@ -0,0 +1,36 @@
+import { defineEventHandler, getRouterParam } from "h3";
+import { authenticateEvent } from "@/lib/auth";
+import { unarchiveChannel, isMember } from "@/lib/chat";
+
+/**
+ * POST /api/chat/channels/:id/unarchive
+ * Restores a previously archived channel for the current user.
+ */
+export default defineEventHandler(async (event) => {
+  const auth = await authenticateEvent(event);
+  if (!auth) {
+    return new Response(JSON.stringify({ error: "Unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const channelId = getRouterParam(event, "id");
+  if (!channelId) {
+    return new Response(JSON.stringify({ error: "Channel ID required" }), {
+      status: 400,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  const member = await isMember(channelId, auth.identity);
+  if (!member) {
+    return new Response(JSON.stringify({ error: "Not a member" }), {
+      status: 403,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
+  await unarchiveChannel(channelId, auth.identity);
+  return { ok: true };
+});
diff --git a/src/db/schema.ts b/src/db/schema.ts
index da7e4c4..1ede1c8 100644
--- a/src/db/schema.ts
+++ b/src/db/schema.ts
@@ -291,6 +291,7 @@ export const chatMembers = pgTable("chat_members", {
     .defaultNow()
     .notNull(),
   lastReadAt: timestamp("last_read_at", { withTimezone: true }),
+  archivedAt: timestamp("archived_at", { withTimezone: true }), // per-member soft delete
 });
 
 export const chatMessages = pgTable("chat_messages", {
diff --git a/src/lib/api.ts b/src/lib/api.ts
index bb1c25c..a288c94 100644
--- a/src/lib/api.ts
+++ b/src/lib/api.ts
@@ -264,7 +264,14 @@ export const api = {
     apiFetch(`/auth/tokens/${id}/revoke`, { method: "POST" }),
 
   // Chat
-  listChatChannels: () => apiFetch("/chat/channels"),
+  listChatChannels: (archived = false) =>
+    apiFetch(`/chat/channels${archived ? "?archived=true" : ""}`),
+
+  archiveChat: (channelId: string) =>
+    apiFetch(`/chat/channels/${channelId}/archive`, { method: "POST" }),
+
+  unarchiveChat: (channelId: string) =>
+    apiFetch(`/chat/channels/${channelId}/unarchive`, { method: "POST" }),
 
   openDm: (identity: string) =>
     apiFetch("/chat/channels", {
diff --git a/src/lib/chat.ts b/src/lib/chat.ts
index 67ca297..50adadc 100644
--- a/src/lib/chat.ts
+++ b/src/lib/chat.ts
@@ -63,7 +63,11 @@ export async function createGroupChannel(
 }
 
 /** List channels for a user with last message and unread count */
-export async function listChannels(identity: string) {
+export async function listChannels(identity: string, options: { archived?: boolean } = {}) {
+  const archivedFilter = options.archived
+    ? rawSql`m.archived_at IS NOT NULL`
+    : rawSql`m.archived_at IS NULL`;
+
   const rows = await db.execute(rawSql`
     SELECT 
       c.id,
@@ -72,6 +76,7 @@ export async function listChannels(identity: string) {
       c.created_by,
       c.created_at,
       m.last_read_at,
+      m.archived_at,
       (
         SELECT json_agg(json_build_object('identity', cm.identity))
         FROM chat_members cm WHERE cm.channel_id = c.id
@@ -94,6 +99,7 @@ export async function listChannels(identity: string) {
       ) as unread_count
     FROM chat_channels c
     JOIN chat_members m ON m.channel_id = c.id AND m.identity = ${identity}
+    WHERE ${archivedFilter}
     ORDER BY (
       SELECT max(cm2.created_at) FROM chat_messages cm2 WHERE cm2.channel_id = c.id
     ) DESC NULLS LAST
@@ -106,6 +112,7 @@ export async function listChannels(identity: string) {
     created_by: string;
     created_at: string;
     last_read_at: string | null;
+    archived_at: string | null;
     members: Array<{ identity: string }>;
     last_message: {
       id: number;
@@ -117,6 +124,32 @@ export async function listChannels(identity: string) {
   }>;
 }
 
+/** Archive a channel for the current user (soft delete — other members unaffected) */
+export async function archiveChannel(channelId: string, identity: string) {
+  await db
+    .update(chatMembers)
+    .set({ archivedAt: new Date() })
+    .where(
+      and(
+        eq(chatMembers.channelId, channelId),
+        eq(chatMembers.identity, identity),
+      ),
+    );
+}
+
+/** Unarchive a channel for the current user */
+export async function unarchiveChannel(channelId: string, identity: string) {
+  await db
+    .update(chatMembers)
+    .set({ archivedAt: null })
+    .where(
+      and(
+        eq(chatMembers.channelId, channelId),
+        eq(chatMembers.identity, identity),
+      ),
+    );
+}
+
 /** Get messages for a channel */
 export async function getMessages(
   channelId: string,
diff --git a/src/routes/presence.tsx b/src/routes/presence.tsx
index 8241563..2000973 100644
--- a/src/routes/presence.tsx
+++ b/src/routes/presence.tsx
@@ -1,5 +1,7 @@
 import { createFileRoute } from "@tanstack/react-router";
 import {
+  Archive,
+  ArchiveRestore,
   ArrowLeft,
   MessageCircle,
   Plus,
@@ -156,6 +158,8 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
   const [showChats, setShowChats] = useState(false);
   const [groupDialogOpen, setGroupDialogOpen] = useState(false);
   const [chatEvent, setChatEvent] = useState<ChatSSEEvent | null>(null);
+  const [showArchived, setShowArchived] = useState(false);
+  const [hoveredChannel, setHoveredChannel] = useState<string | null>(null);
   const myIdentity = useVerifiedIdentity();
 
   // SSE for real-time chat events
@@ -181,12 +185,12 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
 
   const fetchChannels = useCallback(async () => {
     try {
-      const data = await api.listChatChannels();
+      const data = await api.listChatChannels(showArchived);
       setChannels(data.channels || []);
     } catch (err) {
       console.error("Failed to fetch channels:", err);
     }
-  }, []);
+  }, [showArchived]);
 
   useEffect(() => {
     fetchPresence();
@@ -213,6 +217,27 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
     }
   };
 
+  const handleArchive = async (e: React.MouseEvent, channelId: string) => {
+    e.stopPropagation();
+    try {
+      await api.archiveChat(channelId);
+      if (activeChannel === channelId) setActiveChannel(null);
+      fetchChannels();
+    } catch (err) {
+      console.error("Failed to archive channel:", err);
+    }
+  };
+
+  const handleUnarchive = async (e: React.MouseEvent, channelId: string) => {
+    e.stopPropagation();
+    try {
+      await api.unarchiveChat(channelId);
+      fetchChannels();
+    } catch (err) {
+      console.error("Failed to unarchive channel:", err);
+    }
+  };
+
   const totalUnread = channels.reduce((sum, ch) => sum + ch.unread_count, 0);
 
   const users = allUserIds.map((name) => ({
@@ -326,17 +351,34 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
             /* Chat list */
             <ScrollArea className="flex-1">
               <div className="p-2">
-                <Button
-                  variant="ghost"
-                  size="sm"
-                  className="w-full justify-start text-xs gap-1.5 mb-1"
-                  onClick={() => setGroupDialogOpen(true)}
-                >
-                  <Plus className="h-3.5 w-3.5" /> New group chat
-                </Button>
+                <div className="flex items-center gap-1 mb-1">
+                  {!showArchived && (
+                    <Button
+                      variant="ghost"
+                      size="sm"
+                      className="flex-1 justify-start text-xs gap-1.5"
+                      onClick={() => setGroupDialogOpen(true)}
+                    >
+                      <Plus className="h-3.5 w-3.5" /> New group chat
+                    </Button>
+                  )}
+                  <Button
+                    variant={showArchived ? "secondary" : "ghost"}
+                    size="sm"
+                    className="text-xs gap-1.5 shrink-0"
+                    onClick={() => { setShowArchived(!showArchived); setActiveChannel(null); }}
+                    title={showArchived ? "Back to chats" : "Archived chats"}
+                  >
+                    {showArchived ? (
+                      <><ArchiveRestore className="h-3.5 w-3.5" /> Back</>
+                    ) : (
+                      <Archive className="h-3.5 w-3.5" />
+                    )}
+                  </Button>
+                </div>
                 {channels.length === 0 && (
                   <p className="text-xs text-muted-foreground text-center py-8">
-                    No chats yet. Click a team member to start.
+                    {showArchived ? "No archived chats." : "No chats yet. Click a team member to start."}
                   </p>
                 )}
                 {channels.map((ch) => {
@@ -350,12 +392,14 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                   return (
                     <div
                       key={ch.id}
-                      className={`flex items-center gap-2.5 p-2 rounded-lg cursor-pointer transition-colors ${
+                      className={`group relative flex items-center gap-2.5 p-2 rounded-lg cursor-pointer transition-colors ${
                         activeChannel === ch.id
                           ? "bg-muted"
                           : "hover:bg-muted/50"
                       }`}
                       onClick={() => setActiveChannel(ch.id)}
+                      onMouseEnter={() => setHoveredChannel(ch.id)}
+                      onMouseLeave={() => setHoveredChannel(null)}
                     >
                       {isGroup ? (
                         <div className="h-9 w-9 rounded-full bg-muted flex items-center justify-center shrink-0">
@@ -379,11 +423,25 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                           <p className="font-medium text-sm capitalize truncate">
                             {name}
                           </p>
-                          {ch.last_message && (
-                            <span className="text-[10px] text-muted-foreground shrink-0 ml-1">
-                              {formatMessageTime(ch.last_message.created_at)}
-                            </span>
-                          )}
+                          <div className="shrink-0 ml-1 flex items-center">
+                            {hoveredChannel === ch.id ? (
+                              <button
+                                type="button"
+                                className="h-5 w-5 flex items-center justify-center rounded text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
+                                title={showArchived ? "Unarchive" : "Archive"}
+                                onClick={(e) => showArchived ? handleUnarchive(e, ch.id) : handleArchive(e, ch.id)}
+                              >
+                                {showArchived
+                                  ? <ArchiveRestore className="h-3.5 w-3.5" />
+                                  : <Archive className="h-3.5 w-3.5" />
+                                }
+                              </button>
+                            ) : ch.last_message ? (
+                              <span className="text-[10px] text-muted-foreground">
+                                {formatMessageTime(ch.last_message.created_at)}
+                              </span>
+                            ) : null}
+                          </div>
                         </div>
                         <div className="flex items-center justify-between">
                           <p className="text-xs text-muted-foreground truncate">

From 144f1b3ac9e0f817bde00c11b383b4054745d9d4 Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 12:13:58 -0600
Subject: [PATCH 4/6] fix: address Codex P1/P2 findings on users API and admin
 patch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1: user-select.tsx was spreading data.users (now HiveUser[]) directly
into a string[] — map to ids before merging with value set

P2: Boolean() coercion in admin PATCH endpoint would accept any
non-empty string as true for isAdmin/isAgent flags — now requires
strict boolean type, returns 400 on anything else
---
 server/routes/api/admin/users/[id].patch.ts   | 33 +++++++++--
 server/routes/api/auth/register.post.ts       | 15 +++--
 .../api/chat/channels/[id]/unarchive.post.ts  |  2 +-
 src/components/compose-dialog.tsx             |  2 +-
 src/components/nav.tsx                        | 30 +++++-----
 src/components/user-select.tsx                |  6 +-
 src/db/schema.ts                              |  9 ++-
 src/lib/auth.ts                               |  8 ++-
 src/lib/chat.ts                               |  5 +-
 src/routes/presence.tsx                       | 58 ++++++++++++-------
 10 files changed, 111 insertions(+), 57 deletions(-)

diff --git a/server/routes/api/admin/users/[id].patch.ts b/server/routes/api/admin/users/[id].patch.ts
index 23da083..42ba64e 100644
--- a/server/routes/api/admin/users/[id].patch.ts
+++ b/server/routes/api/admin/users/[id].patch.ts
@@ -1,8 +1,8 @@
-import { defineEventHandler, readBody, getRouterParam } from "h3";
-import { authenticateEvent } from "@/lib/auth";
+import { eq } from "drizzle-orm";
+import { defineEventHandler, getRouterParam, readBody } from "h3";
 import { db } from "@/db";
 import { users } from "@/db/schema";
-import { eq } from "drizzle-orm";
+import { authenticateEvent } from "@/lib/auth";
 
 interface UserPatchBody {
   displayName?: string;
@@ -47,9 +47,30 @@ export default defineEventHandler(async (event) => {
     updatedAt: new Date(),
   };
 
-  if ("displayName" in body && body.displayName !== undefined) patch.displayName = String(body.displayName);
-  if ("isAdmin" in body && body.isAdmin !== undefined) patch.isAdmin = Boolean(body.isAdmin);
-  if ("isAgent" in body && body.isAgent !== undefined) patch.isAgent = Boolean(body.isAgent);
+  if ("displayName" in body && body.displayName !== undefined)
+    patch.displayName = String(body.displayName);
+  if ("isAdmin" in body && body.isAdmin !== undefined) {
+    if (typeof body.isAdmin !== "boolean")
+      return new Response(
+        JSON.stringify({ error: "isAdmin must be a boolean" }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        },
+      );
+    patch.isAdmin = body.isAdmin;
+  }
+  if ("isAgent" in body && body.isAgent !== undefined) {
+    if (typeof body.isAgent !== "boolean")
+      return new Response(
+        JSON.stringify({ error: "isAgent must be a boolean" }),
+        {
+          status: 400,
+          headers: { "Content-Type": "application/json" },
+        },
+      );
+    patch.isAgent = body.isAgent;
+  }
   if ("avatarUrl" in body) patch.avatarUrl = body.avatarUrl ?? null;
   if ("archivedAt" in body) {
     patch.archivedAt = body.archivedAt ? new Date(body.archivedAt) : null;
diff --git a/server/routes/api/auth/register.post.ts b/server/routes/api/auth/register.post.ts
index 46e07a8..14947ad 100644
--- a/server/routes/api/auth/register.post.ts
+++ b/server/routes/api/auth/register.post.ts
@@ -86,12 +86,15 @@ export default defineEventHandler(async (event) => {
     .where(eq(invites.id, invite.id));
 
   // Ensure a users row exists for this identity
-  await db.insert(users).values({
-    id: identity,
-    displayName: body.displayName || identity,
-    isAdmin: invite.isAdmin,
-    isAgent: false, // humans registering via invite
-  }).onConflictDoNothing();
+  await db
+    .insert(users)
+    .values({
+      id: identity,
+      displayName: body.displayName || identity,
+      isAdmin: invite.isAdmin,
+      isAgent: false, // humans registering via invite
+    })
+    .onConflictDoNothing();
 
   // Register the mailbox and clear auth cache
   registerMailbox(identity);
diff --git a/server/routes/api/chat/channels/[id]/unarchive.post.ts b/server/routes/api/chat/channels/[id]/unarchive.post.ts
index 9963990..f96e128 100644
--- a/server/routes/api/chat/channels/[id]/unarchive.post.ts
+++ b/server/routes/api/chat/channels/[id]/unarchive.post.ts
@@ -1,6 +1,6 @@
 import { defineEventHandler, getRouterParam } from "h3";
 import { authenticateEvent } from "@/lib/auth";
-import { unarchiveChannel, isMember } from "@/lib/chat";
+import { isMember, unarchiveChannel } from "@/lib/chat";
 
 /**
  * POST /api/chat/channels/:id/unarchive
diff --git a/src/components/compose-dialog.tsx b/src/components/compose-dialog.tsx
index 0425f2f..5c94863 100644
--- a/src/components/compose-dialog.tsx
+++ b/src/components/compose-dialog.tsx
@@ -1,5 +1,4 @@
 import { useState } from "react";
-import { useUserIds } from "@/lib/use-users";
 import { Button } from "@/components/ui/button";
 import {
   Dialog,
@@ -11,6 +10,7 @@ import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Textarea } from "@/components/ui/textarea";
 import { api } from "@/lib/api";
+import { useUserIds } from "@/lib/use-users";
 
 export function ComposeDialog({
   open,
diff --git a/src/components/nav.tsx b/src/components/nav.tsx
index ea3eac6..8afd227 100644
--- a/src/components/nav.tsx
+++ b/src/components/nav.tsx
@@ -69,20 +69,22 @@ function PresenceDots() {
     return () => clearInterval(interval);
   }, []);
 
-  const users = allUsers.map((name) => ({
-    name,
-    info: presence[name] || {
-      online: false,
-      lastSeen: null,
-      source: null,
-      unread: 0,
-    },
-  })).sort((a, b) => {
-    if (a.info.online !== b.info.online) return a.info.online ? -1 : 1;
-    const aTime = a.info.lastSeen ? new Date(a.info.lastSeen).getTime() : 0;
-    const bTime = b.info.lastSeen ? new Date(b.info.lastSeen).getTime() : 0;
-    return bTime - aTime;
-  });
+  const users = allUsers
+    .map((name) => ({
+      name,
+      info: presence[name] || {
+        online: false,
+        lastSeen: null,
+        source: null,
+        unread: 0,
+      },
+    }))
+    .sort((a, b) => {
+      if (a.info.online !== b.info.online) return a.info.online ? -1 : 1;
+      const aTime = a.info.lastSeen ? new Date(a.info.lastSeen).getTime() : 0;
+      const bTime = b.info.lastSeen ? new Date(b.info.lastSeen).getTime() : 0;
+      return bTime - aTime;
+    });
 
   return (
     <div className="flex items-center gap-1.5">
diff --git a/src/components/user-select.tsx b/src/components/user-select.tsx
index fa2beea..4cb265b 100644
--- a/src/components/user-select.tsx
+++ b/src/components/user-select.tsx
@@ -32,7 +32,11 @@ export function UserSelect({ value, onChange, className }: UserSelectProps) {
     })
       .then((r) => r.json())
       .then((data) => {
-        const all = new Set([...(data.users || []), ...value]);
+        // data.users is HiveUser[] — extract ids for this string-based picker
+        const ids: string[] = (data.users || []).map(
+          (u: { id: string }) => u.id,
+        );
+        const all = new Set([...ids, ...value]);
         setUsers([...all].sort());
       })
       .catch(() => {});
diff --git a/src/db/schema.ts b/src/db/schema.ts
index 1ede1c8..453c4d4 100644
--- a/src/db/schema.ts
+++ b/src/db/schema.ts
@@ -466,13 +466,16 @@ export const users = pgTable("users", {
   isAdmin: boolean("is_admin").notNull().default(false),
   isAgent: boolean("is_agent").notNull().default(false), // true for AI agents
   avatarUrl: text("avatar_url"),
-  createdAt: timestamp("created_at", { withTimezone: true }).defaultNow().notNull(),
-  updatedAt: timestamp("updated_at", { withTimezone: true }).defaultNow().notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true })
+    .defaultNow()
+    .notNull(),
+  updatedAt: timestamp("updated_at", { withTimezone: true })
+    .defaultNow()
+    .notNull(),
   lastSeenAt: timestamp("last_seen_at", { withTimezone: true }),
   archivedAt: timestamp("archived_at", { withTimezone: true }), // soft-deactivate
 });
 
-
 // ============================================================
 // TYPES
 // ============================================================
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index dedeafc..a1c28b6 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -32,7 +32,9 @@ async function loadUsersFromDb() {
     for (const row of rows) {
       validMailboxes.add(row.id);
     }
-    console.log(`[auth] Loaded ${rows.length} user(s) from DB into validMailboxes`);
+    console.log(
+      `[auth] Loaded ${rows.length} user(s) from DB into validMailboxes`,
+    );
   } catch (err) {
     console.error("[auth] Failed to load users from DB:", err);
   }
@@ -212,7 +214,9 @@ export function initAuth() {
   console.log(`[auth] Loaded ${envTokens.size} env token(s), DB auth enabled`);
 
   // Load known users from DB into validMailboxes (fire-and-forget)
-  loadUsersFromDb().catch(err => console.error("[auth] Failed to load users from DB:", err));
+  loadUsersFromDb().catch((err) =>
+    console.error("[auth] Failed to load users from DB:", err),
+  );
 }
 
 /** Clear the DB token cache (e.g., after creating/revoking tokens) */
diff --git a/src/lib/chat.ts b/src/lib/chat.ts
index 50adadc..55a6270 100644
--- a/src/lib/chat.ts
+++ b/src/lib/chat.ts
@@ -63,7 +63,10 @@ export async function createGroupChannel(
 }
 
 /** List channels for a user with last message and unread count */
-export async function listChannels(identity: string, options: { archived?: boolean } = {}) {
+export async function listChannels(
+  identity: string,
+  options: { archived?: boolean } = {},
+) {
   const archivedFilter = options.archived
     ? rawSql`m.archived_at IS NOT NULL`
     : rawSql`m.archived_at IS NULL`;
diff --git a/src/routes/presence.tsx b/src/routes/presence.tsx
index 2000973..2a522af 100644
--- a/src/routes/presence.tsx
+++ b/src/routes/presence.tsx
@@ -240,20 +240,22 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
 
   const totalUnread = channels.reduce((sum, ch) => sum + ch.unread_count, 0);
 
-  const users = allUserIds.map((name) => ({
-    name,
-    info: presence[name] || {
-      online: false,
-      lastSeen: null,
-      source: null,
-      unread: 0,
-    },
-  })).sort((a, b) => {
-    if (a.info.online !== b.info.online) return a.info.online ? -1 : 1;
-    const aTime = a.info.lastSeen ? new Date(a.info.lastSeen).getTime() : 0;
-    const bTime = b.info.lastSeen ? new Date(b.info.lastSeen).getTime() : 0;
-    return bTime - aTime;
-  });
+  const users = allUserIds
+    .map((name) => ({
+      name,
+      info: presence[name] || {
+        online: false,
+        lastSeen: null,
+        source: null,
+        unread: 0,
+      },
+    }))
+    .sort((a, b) => {
+      if (a.info.online !== b.info.online) return a.info.online ? -1 : 1;
+      const aTime = a.info.lastSeen ? new Date(a.info.lastSeen).getTime() : 0;
+      const bTime = b.info.lastSeen ? new Date(b.info.lastSeen).getTime() : 0;
+      return bTime - aTime;
+    });
 
   const getChannelName = (ch: ChatChannel): string => {
     if (ch.name) return ch.name;
@@ -366,11 +368,16 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                     variant={showArchived ? "secondary" : "ghost"}
                     size="sm"
                     className="text-xs gap-1.5 shrink-0"
-                    onClick={() => { setShowArchived(!showArchived); setActiveChannel(null); }}
+                    onClick={() => {
+                      setShowArchived(!showArchived);
+                      setActiveChannel(null);
+                    }}
                     title={showArchived ? "Back to chats" : "Archived chats"}
                   >
                     {showArchived ? (
-                      <><ArchiveRestore className="h-3.5 w-3.5" /> Back</>
+                      <>
+                        <ArchiveRestore className="h-3.5 w-3.5" /> Back
+                      </>
                     ) : (
                       <Archive className="h-3.5 w-3.5" />
                     )}
@@ -378,7 +385,9 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                 </div>
                 {channels.length === 0 && (
                   <p className="text-xs text-muted-foreground text-center py-8">
-                    {showArchived ? "No archived chats." : "No chats yet. Click a team member to start."}
+                    {showArchived
+                      ? "No archived chats."
+                      : "No chats yet. Click a team member to start."}
                   </p>
                 )}
                 {channels.map((ch) => {
@@ -429,12 +438,17 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                                 type="button"
                                 className="h-5 w-5 flex items-center justify-center rounded text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
                                 title={showArchived ? "Unarchive" : "Archive"}
-                                onClick={(e) => showArchived ? handleUnarchive(e, ch.id) : handleArchive(e, ch.id)}
-                              >
-                                {showArchived
-                                  ? <ArchiveRestore className="h-3.5 w-3.5" />
-                                  : <Archive className="h-3.5 w-3.5" />
+                                onClick={(e) =>
+                                  showArchived
+                                    ? handleUnarchive(e, ch.id)
+                                    : handleArchive(e, ch.id)
                                 }
+                              >
+                                {showArchived ? (
+                                  <ArchiveRestore className="h-3.5 w-3.5" />
+                                ) : (
+                                  <Archive className="h-3.5 w-3.5" />
+                                )}
                               </button>
                             ) : ch.last_message ? (
                               <span className="text-[10px] text-muted-foreground">

From d2edc0175a5a4a42a3ea10bfa6a63edba3623aa3 Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 12:23:13 -0600
Subject: [PATCH 5/6] fix: address second round of Codex findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1 (auth.ts): archived users stay in validMailboxes until restart
- Add deregisterMailbox() to auth.ts
- PATCH /api/admin/users/:id now calls deregister/registerMailbox
  immediately when archivedAt is set/cleared — no restart needed

P2 (presence.tsx): hover-only archive button unreachable on touch
- Remove hoveredChannel state and mouse enter/leave handlers
- Archive icon always visible (text-muted-foreground/30, tap target)
  with hover:text-muted-foreground for desktop polish
- Timestamp shown alongside archive button at all times
---
 server/routes/api/admin/users/[id].patch.ts | 15 +++++++-
 src/lib/auth.ts                             |  5 +++
 src/routes/presence.tsx                     | 42 ++++++++++-----------
 3 files changed, 38 insertions(+), 24 deletions(-)

diff --git a/server/routes/api/admin/users/[id].patch.ts b/server/routes/api/admin/users/[id].patch.ts
index 42ba64e..03e728d 100644
--- a/server/routes/api/admin/users/[id].patch.ts
+++ b/server/routes/api/admin/users/[id].patch.ts
@@ -2,7 +2,11 @@ import { eq } from "drizzle-orm";
 import { defineEventHandler, getRouterParam, readBody } from "h3";
 import { db } from "@/db";
 import { users } from "@/db/schema";
-import { authenticateEvent } from "@/lib/auth";
+import {
+  authenticateEvent,
+  deregisterMailbox,
+  registerMailbox,
+} from "@/lib/auth";
 
 interface UserPatchBody {
   displayName?: string;
@@ -89,5 +93,14 @@ export default defineEventHandler(async (event) => {
     });
   }
 
+  // Sync in-memory mailbox set immediately — no restart required
+  if ("archivedAt" in patch) {
+    if (patch.archivedAt) {
+      deregisterMailbox(id);
+    } else {
+      registerMailbox(id);
+    }
+  }
+
   return { user: updated };
 });
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index a1c28b6..41990db 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -57,6 +57,11 @@ export function registerMailbox(name: string) {
   validMailboxes.add(name);
 }
 
+/** Remove an identity from the valid mailbox set (call when archiving/deactivating a user) */
+export function deregisterMailbox(name: string) {
+  validMailboxes.delete(name);
+}
+
 /** Check DB for a valid token */
 async function authenticateFromDb(token: string): Promise<AuthContext | null> {
   // Check cache first
diff --git a/src/routes/presence.tsx b/src/routes/presence.tsx
index 2a522af..1fa02a1 100644
--- a/src/routes/presence.tsx
+++ b/src/routes/presence.tsx
@@ -159,7 +159,6 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
   const [groupDialogOpen, setGroupDialogOpen] = useState(false);
   const [chatEvent, setChatEvent] = useState<ChatSSEEvent | null>(null);
   const [showArchived, setShowArchived] = useState(false);
-  const [hoveredChannel, setHoveredChannel] = useState<string | null>(null);
   const myIdentity = useVerifiedIdentity();
 
   // SSE for real-time chat events
@@ -407,8 +406,6 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                           : "hover:bg-muted/50"
                       }`}
                       onClick={() => setActiveChannel(ch.id)}
-                      onMouseEnter={() => setHoveredChannel(ch.id)}
-                      onMouseLeave={() => setHoveredChannel(null)}
                     >
                       {isGroup ? (
                         <div className="h-9 w-9 rounded-full bg-muted flex items-center justify-center shrink-0">
@@ -432,29 +429,28 @@ function PresenceView({ onLogout }: { onLogout: () => void }) {
                           <p className="font-medium text-sm capitalize truncate">
                             {name}
                           </p>
-                          <div className="shrink-0 ml-1 flex items-center">
-                            {hoveredChannel === ch.id ? (
-                              <button
-                                type="button"
-                                className="h-5 w-5 flex items-center justify-center rounded text-muted-foreground hover:text-foreground hover:bg-muted transition-colors"
-                                title={showArchived ? "Unarchive" : "Archive"}
-                                onClick={(e) =>
-                                  showArchived
-                                    ? handleUnarchive(e, ch.id)
-                                    : handleArchive(e, ch.id)
-                                }
-                              >
-                                {showArchived ? (
-                                  <ArchiveRestore className="h-3.5 w-3.5" />
-                                ) : (
-                                  <Archive className="h-3.5 w-3.5" />
-                                )}
-                              </button>
-                            ) : ch.last_message ? (
+                          <div className="shrink-0 ml-1 flex items-center gap-1">
+                            {ch.last_message && (
                               <span className="text-[10px] text-muted-foreground">
                                 {formatMessageTime(ch.last_message.created_at)}
                               </span>
-                            ) : null}
+                            )}
+                            <button
+                              type="button"
+                              className="h-5 w-5 flex items-center justify-center rounded text-muted-foreground/30 hover:text-muted-foreground hover:bg-muted transition-colors"
+                              title={showArchived ? "Unarchive" : "Archive"}
+                              onClick={(e) =>
+                                showArchived
+                                  ? handleUnarchive(e, ch.id)
+                                  : handleArchive(e, ch.id)
+                              }
+                            >
+                              {showArchived ? (
+                                <ArchiveRestore className="h-3.5 w-3.5" />
+                              ) : (
+                                <Archive className="h-3.5 w-3.5" />
+                              )}
+                            </button>
                           </div>
                         </div>
                         <div className="flex items-center justify-between">

From c22f9f11f5465247b65b9253c0607fe4ce3894ba Mon Sep 17 00:00:00 2001
From: Domingo <domingo@biginformatics.com>
Date: Sat, 21 Feb 2026 12:30:50 -0600
Subject: [PATCH 6/6] fix: address third round of Codex P1 findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

P1 (users.get.ts): env-token users missing from /api/users
- Export getEnvIdentities() from auth.ts
- /api/users merges DB users + env-only identities as minimal objects
  so all authenticated users appear in UI selectors regardless of
  whether they have a users table row

P1 (patch.ts): archived users kept working tokens
- On archive: revoke all mailboxTokens rows for that identity
  + clear DB auth cache — existing tokens immediately stop working
- On restore: re-add to validMailboxes + clear cache
  (revoked tokens stay revoked; admin must issue new tokens)
---
 server/routes/api/admin/users/[id].patch.ts | 14 ++++++++++--
 server/routes/api/users.get.ts              | 25 ++++++++++++++++++---
 src/lib/auth.ts                             |  9 ++++++++
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/server/routes/api/admin/users/[id].patch.ts b/server/routes/api/admin/users/[id].patch.ts
index 03e728d..21847aa 100644
--- a/server/routes/api/admin/users/[id].patch.ts
+++ b/server/routes/api/admin/users/[id].patch.ts
@@ -1,9 +1,10 @@
 import { eq } from "drizzle-orm";
 import { defineEventHandler, getRouterParam, readBody } from "h3";
 import { db } from "@/db";
-import { users } from "@/db/schema";
+import { mailboxTokens, users } from "@/db/schema";
 import {
   authenticateEvent,
+  clearAuthCache,
   deregisterMailbox,
   registerMailbox,
 } from "@/lib/auth";
@@ -93,12 +94,21 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  // Sync in-memory mailbox set immediately — no restart required
+  // Sync in-memory mailbox set and token validity immediately
   if ("archivedAt" in patch) {
     if (patch.archivedAt) {
+      // Archive: remove from valid mailboxes and revoke all DB tokens
       deregisterMailbox(id);
+      await db
+        .update(mailboxTokens)
+        .set({ revokedAt: new Date() })
+        .where(eq(mailboxTokens.identity, id));
+      clearAuthCache();
     } else {
+      // Restore: re-add to valid mailboxes; revoked tokens remain revoked
+      // (admin must issue new tokens via invite or token endpoint)
       registerMailbox(id);
+      clearAuthCache();
     }
   }
 
diff --git a/server/routes/api/users.get.ts b/server/routes/api/users.get.ts
index 239b571..905161e 100644
--- a/server/routes/api/users.get.ts
+++ b/server/routes/api/users.get.ts
@@ -1,9 +1,11 @@
 import { defineEventHandler } from "h3";
-import { authenticateEvent, listUsers } from "@/lib/auth";
+import { authenticateEvent, getEnvIdentities, listUsers } from "@/lib/auth";
 
 /**
  * GET /api/users
  * Returns all active users. Requires authentication (not admin-only).
+ * Includes users from the users table AND env-token identities that haven't
+ * been backfilled yet (returned as minimal user objects).
  */
 export default defineEventHandler(async (event) => {
   const auth = await authenticateEvent(event);
@@ -14,6 +16,23 @@ export default defineEventHandler(async (event) => {
     });
   }
 
-  const users = await listUsers();
-  return { users };
+  const dbUsers = await listUsers();
+  const dbIds = new Set(dbUsers.map((u) => u.id));
+
+  // Include env-token identities not yet in the users table
+  const envOnly = getEnvIdentities()
+    .filter((id) => !dbIds.has(id))
+    .map((id) => ({
+      id,
+      displayName: id,
+      isAdmin: false,
+      isAgent: false,
+      avatarUrl: null,
+      createdAt: null,
+      updatedAt: null,
+      lastSeenAt: null,
+      archivedAt: null,
+    }));
+
+  return { users: [...dbUsers, ...envOnly] };
 });
diff --git a/src/lib/auth.ts b/src/lib/auth.ts
index 41990db..ac7ce9d 100644
--- a/src/lib/auth.ts
+++ b/src/lib/auth.ts
@@ -62,6 +62,15 @@ export function deregisterMailbox(name: string) {
   validMailboxes.delete(name);
 }
 
+/** Return all identities registered via env tokens (HIVE_TOKEN_* / MAILBOX_TOKEN_* / UI_MAILBOX_KEYS) */
+export function getEnvIdentities(): string[] {
+  const ids = new Set<string>();
+  for (const ctx of envTokens.values()) {
+    if (ctx.identity && ctx.identity !== "admin") ids.add(ctx.identity);
+  }
+  return [...ids].sort();
+}
+
 /** Check DB for a valid token */
 async function authenticateFromDb(token: string): Promise<AuthContext | null> {
   // Check cache first