sync: update from private repo (dfadcd5f)

docs/getting-started.md

@@ -134,6 +134,21 @@ By default it runs without authentication. To use Google / Gitea OAuth, configur
 Do not expose it to an untrusted network until authentication is enabled. When exposing it externally, also use a TLS-enabled
 reverse proxy. For operational caveats, see [../SECURITY.md](../SECURITY.md).
 
+### Share a workspace (invite links)
+
+With authentication enabled, a case workspace can be shared with several users. The
+member picker only lists users in the same organization (to avoid leaking the user
+list), so a user with no organization — for example a Google login the admin has not
+assigned a local org to — may see an empty picker.
+
+For that case, use an **invite link**. An owner or admin generates the link from the
+workspace's **Settings → Members** and picks the granted role (editor / viewer) and an
+optional expiry (never / 7 days / 30 days). Any logged-in user who has the link joins by
+opening `/ui/invite/<token>`. Links can grant editor or viewer only (never owner), and
+only an owner or admin can create or revoke them. Each workspace has at most one active
+link; regenerating it immediately invalidates the old one, and an invalid or expired link
+returns no workspace information. Invite links are disabled in no-auth mode.
+
 ## 8. Enable the Bash sandbox (optional, recommended for multi-user)
 
 Isolates the agent's Bash execution per task. In production: