@runeya/runeya 2.0.116 → 2.0.118

package/{chunk-44XAJ3MK.js → chunk-WE6EOX4C.js}

@@ -31,7 +31,7 @@ import {
   runCompanionNow,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-VPANMGAI.js";
+} from "./chunk-XIRMRWVU.js";
 import {
   agentManager,
   agentStore,
@@ -51,10 +51,10 @@ import {
   rememberFile,
   serviceStore,
   wasRead
-} from "./chunk-OGCEFBSS.js";
+} from "./chunk-P47X3LT3.js";
 import {
   settingsManager
-} from "./chunk-77UQ2UKW.js";
+} from "./chunk-I2AZCZMR.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
@@ -62,6 +62,7 @@ import {
   HealthCheckSchema,
   JSLogParserSchema,
   LogSourceConfigSchema,
+  MissingVariableSchema,
   RestartStrategySchema,
   ScenarioSchema,
   ServiceCommandSchema,
@@ -75,7 +76,7 @@ import {
   serviceUrlValues,
   urlHostFor,
   withDeprecatedAliases
-} from "./chunk-6T7R2JZR.js";
+} from "./chunk-RN4X65D3.js";
 import {
   allVaultRoots,
   env,
@@ -90,7 +91,7 @@ import {
 } from "./chunk-ZFELQG4B.js";
 
 // ../server/src/trpc/routers/chat.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 import Anthropic2 from "@anthropic-ai/sdk";
 import OpenAI2 from "openai";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -407,6 +408,7 @@ var ApiKeyStore = class {
 var apiKeyStore = new ApiKeyStore();
 
 // ../server/src/trpc/trpc.ts
+import { z } from "zod";
 function createContext({ req }) {
   return {
     authorization: req.headers.authorization ?? null,
@@ -415,13 +417,27 @@ function createContext({ req }) {
     remoteAddress: req.socket.remoteAddress ?? null
   };
 }
+function extractMissingVariables(cause) {
+  if (!cause || typeof cause !== "object") return {};
+  const parsed = z.object({
+    missingVariables: z.array(MissingVariableSchema).max(500),
+    environmentId: z.string().max(128)
+  }).safeParse(cause);
+  return parsed.success ? parsed.data : {};
+}
 var t = initTRPC.context().meta().create({
   errorFormatter({ shape, error }) {
     return {
       ...shape,
       data: {
         ...shape.data,
-        message: error.message
+        message: error.message,
+        // La cause d'une erreur n'est PAS transportée par défaut, et c'est
+        // voulu : elle porte souvent la pile ou l'objet interne qui a échoué.
+        // Un seul champ traverse, nommé et validé — la liste des variables à
+        // remplir, dont le client a besoin pour ouvrir l'assistant sur ce qui
+        // vient exactement d'être refusé.
+        ...extractMissingVariables(error.cause)
       }
     };
   }
@@ -489,7 +505,7 @@ function getAllowedServiceIds(ctx) {
   if (ctx.callerType !== "api") return null;
   return new Set(ctx.apiKey.scopes.services.map((p) => p.serviceId));
 }
-function requireEnvAction(ctx, environmentId, action, serviceId) {
+function findEnvPermission(ctx, environmentId, action, serviceId) {
   if (ctx.callerType !== "api") return { includeSecrets: true };
   const permsToCheck = serviceId ? ctx.apiKey.scopes.services.filter((p) => p.serviceId === serviceId) : ctx.apiKey.scopes.services;
   for (const svcPerm of permsToCheck) {
@@ -498,19 +514,27 @@ function requireEnvAction(ctx, environmentId, action, serviceId) {
       return { includeSecrets: envPerm.includeSecrets };
     }
   }
+  return null;
+}
+function requireEnvAction(ctx, environmentId, action, serviceId) {
+  const permission = findEnvPermission(ctx, environmentId, action, serviceId);
+  if (permission) return permission;
   throw new TRPCError({
     code: "FORBIDDEN",
     message: `API key lacks '${action}' permission on environment ${environmentId}`
   });
 }
+function canEnvAction(ctx, environmentId, action) {
+  return findEnvPermission(ctx, environmentId, action) !== null;
+}
 
 // ../server/src/trpc/shared-schemas.ts
-import { z } from "zod";
-var Id128Schema = z.string().max(128);
-var ConversationIdSchema = z.string().max(128);
-var NameSchema = z.string().min(1).max(200);
-var ShortString200Schema = z.string().max(200);
-var DescriptionSchema = z.string().max(2e3);
+import { z as z2 } from "zod";
+var Id128Schema = z2.string().max(128);
+var ConversationIdSchema = z2.string().max(128);
+var NameSchema = z2.string().min(1).max(200);
+var ShortString200Schema = z2.string().max(200);
+var DescriptionSchema = z2.string().max(2e3);
 var OptionalProviderIdSchema = Id128Schema.optional();
 
 // ../server/src/services/workspace-cwd.ts
@@ -837,6 +861,97 @@ var EnvironmentResolver = class {
     }
     return injected;
   }
+  /**
+   * Les variables qu'il faut remplir avant qu'un service de cet environnement
+   * puisse démarrer.
+   *
+   * Deux motifs, et ils ne se mesurent pas au même endroit :
+   *
+   * - `required` porte sur la valeur **finale**, interpolation et surcharge
+   *   comprises : une variable obligatoire dont la valeur ne tient qu'à une
+   *   référence morte est aussi vide qu'une case blanche.
+   * - `overrideOnly` porte sur l'**existence d'une surcharge machine**. Elle
+   *   n'a par construction pas de valeur partagée ; ce qui manque n'est pas un
+   *   contenu, c'est la réponse de ce poste-ci.
+   *
+   * Les drapeaux se lisent sur la définition, jamais sur le slot résolu : une
+   * surcharge remplace le slot entier et ne porte aucun drapeau — les y lire
+   * rendrait toute variable surchargée silencieusement facultative.
+   */
+  async findMissingVariables(environmentId) {
+    if (!environmentId) return [];
+    const [{ env: env2 }, definitions, overridesByKey] = await Promise.all([
+      this.resolveEnvironment(environmentId),
+      this.resolveDag(environmentId, /* @__PURE__ */ new Set()),
+      this.resolveOverridesByKey(environmentId)
+    ]);
+    const missing = [];
+    for (const [variableId, variable] of Object.entries(definitions.variables)) {
+      const slot = variable.value;
+      const source = definitions.sources[variableId];
+      const base = {
+        variableId,
+        key: variable.key,
+        description: slot.description,
+        isSecret: slot.isSecret,
+        environmentId: source?.environmentId ?? environmentId,
+        environmentName: source?.environmentName ?? ""
+      };
+      if (slot.overrideOnly && !overridesByKey[variable.key]) {
+        missing.push({ ...base, reason: "overrideOnly" });
+        continue;
+      }
+      if (slot.required && (env2[variable.key] ?? "") === "") {
+        missing.push({ ...base, reason: "required" });
+      }
+    }
+    return missing;
+  }
+  /**
+   * Tout ce qu'il reste à remplir sous l'environnement courant.
+   *
+   * Deux périmètres, et il faut les deux :
+   *
+   * 1. **L'environnement courant lui-même**, héritage compris —
+   *    `findMissingVariables` remonte ses `parentIds`. C'est là que vivent les
+   *    variables globales du projet, et c'est la première branche balayée.
+   * 2. **Les environnements de service qui s'activent avec lui**
+   *    (`activateOn`). Ceux-là ne sont pas des ancêtres du global : ils en
+   *    héritent, dans l'autre sens. Ne pas y descendre revenait à ne rien
+   *    réclamer d'un service jusqu'à ce qu'on essaie de le démarrer.
+   *
+   * Dédoublonné par identifiant de variable : une variable du global remonte
+   * dans chaque branche de service qui en hérite, et l'assistant ne doit pas
+   * demander deux fois la même chose.
+   */
+  async findMissingForActiveEnvironment(globalEnvId) {
+    if (!globalEnvId) return [];
+    const serviceEnvs = await environmentStore.listByActivateOn(globalEnvId);
+    const branches = await Promise.all([
+      this.findMissingVariables(globalEnvId),
+      ...serviceEnvs.map((env2) => this.findMissingVariables(env2.id))
+    ]);
+    const seen = /* @__PURE__ */ new Set();
+    const missing = [];
+    for (const branch of branches) {
+      for (const item of branch) {
+        if (seen.has(item.variableId)) continue;
+        seen.add(item.variableId);
+        missing.push(item);
+      }
+    }
+    return missing;
+  }
+  /**
+   * Idem, pour ce qu'un service verra réellement : son environnement dédié
+   * quand il en a un, l'environnement global sinon. Miroir de
+   * `resolveForService`, dont il partage la règle de sélection.
+   */
+  async findMissingForService(ctx) {
+    if (!ctx.activeEnvironmentId) return [];
+    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
+    return this.findMissingVariables(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
+  }
   async resolveEnvironmentWithSources(environmentId) {
     const visited = /* @__PURE__ */ new Set();
     const result = await this.resolveDag(environmentId, visited);
@@ -1980,7 +2095,7 @@ async function executeTool(rawName, input, apiKey, authToken) {
 }
 
 // ../server/src/trpc/routers/service.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 import { TRPCError as TRPCError2 } from "@trpc/server";
 
 // ../server/src/services/audit-service.ts
@@ -2355,10 +2470,10 @@ var serviceRouter = router({
    * silencieux ferait croire au filtrage tout en rendant les services des
    * autres organisations.
    */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed by project or organization)", protect: true } }).input(z2.object({
-    projectId: z2.string().max(128).optional(),
-    orgId: z2.string().max(128).nullable().optional()
-  }).optional()).output(z2.any()).query(async ({ input, ctx }) => {
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed by project or organization)", protect: true } }).input(z3.object({
+    projectId: z3.string().max(128).optional(),
+    orgId: z3.string().max(128).nullable().optional()
+  }).optional()).output(z3.any()).query(async ({ input, ctx }) => {
     const all = await serviceStore.list();
     const allowedIds = getAllowedServiceIds(ctx);
     let filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
@@ -2378,7 +2493,7 @@ var serviceRouter = router({
       effectiveAgentId: await resolveEffectiveAgentId(s)
     })));
   }),
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z2.object({ id: z2.string().max(128) })).output(z2.any()).query(async ({ input, ctx }) => {
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z3.object({ id: z3.string().max(128) })).output(z3.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const service = await serviceStore.get(input.id);
     if (!service) {
@@ -2386,34 +2501,34 @@ var serviceRouter = router({
     }
     return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service) };
   }),
-  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z2.any()).input(
-    z2.object({
-      agentId: z2.string().max(128).optional(),
-      name: z2.string().min(1).max(200),
-      commands: z2.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z2.string().max(4096).optional(),
-      ports: z2.array(z2.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z2.array(z2.string().max(200)).max(20).optional(),
-      description: z2.string().max(2e3).optional(),
-      docsPath: z2.string().max(4096).optional(),
-      url: z2.string().max(2048).optional(),
-      localUrls: z2.array(z2.object({
-        url: z2.string().max(253),
-        port: z2.number().int().min(1).max(65535)
+  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z3.any()).input(
+    z3.object({
+      agentId: z3.string().max(128).optional(),
+      name: z3.string().min(1).max(200),
+      commands: z3.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z3.string().max(4096).optional(),
+      ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z3.array(z3.string().max(200)).max(20).optional(),
+      description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
+      url: z3.string().max(2048).optional(),
+      localUrls: z3.array(z3.object({
+        url: z3.string().max(253),
+        port: z3.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z2.string().max(2048).optional(),
-      git: z2.object({ remote: z2.string().max(2048).optional(), home: z2.string().max(2048).optional() }).optional(),
-      meta: z2.record(z2.string().max(256), z2.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z2.enum(["native", "docker"]).optional().default("native"),
+      openapiUrl: z3.string().max(2048).optional(),
+      git: z3.object({ remote: z3.string().max(2048).optional(), home: z3.string().max(2048).optional() }).optional(),
+      meta: z3.record(z3.string().max(256), z3.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z3.enum(["native", "docker"]).optional().default("native"),
       dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.optional(),
-      autoRestart: z2.boolean().optional().default(false),
+      autoRestart: z3.boolean().optional().default(false),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z2.number().int().nonnegative().optional(),
-      restartBackoffMs: z2.number().int().positive().optional().default(1e3),
-      orgId: z2.string().max(128).nullable().optional(),
-      shortcuts: z2.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z2.array(z2.string().max(128)).max(50).optional()
+      maxRestarts: z3.number().int().nonnegative().optional(),
+      restartBackoffMs: z3.number().int().positive().optional().default(1e3),
+      orgId: z3.string().max(128).nullable().optional(),
+      shortcuts: z3.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z3.array(z3.string().max(128)).max(50).optional()
     })
   ).mutation(async ({ input }) => {
     if (input.agentId) {
@@ -2435,38 +2550,38 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "create", entityType: "service", entityId: service.id, metadata: { name: input.name } });
     return service;
   }),
-  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z2.any()).input(
-    z2.object({
-      id: z2.string().max(128),
-      agentId: z2.string().max(128).nullable().optional(),
+  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z3.any()).input(
+    z3.object({
+      id: z3.string().max(128),
+      agentId: z3.string().max(128).nullable().optional(),
       // null = clear (inherit from env)
-      name: z2.string().min(1).max(200).optional(),
-      commands: z2.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z2.string().max(4096).nullable().optional(),
-      ports: z2.array(z2.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z2.array(z2.string().max(200)).max(20).optional(),
-      description: z2.string().max(2e3).optional(),
-      docsPath: z2.string().max(4096).optional(),
-      url: z2.string().max(2048).optional(),
-      localUrls: z2.array(z2.object({
-        url: z2.string().max(253),
-        port: z2.number().int().min(1).max(65535)
+      name: z3.string().min(1).max(200).optional(),
+      commands: z3.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z3.string().max(4096).nullable().optional(),
+      ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z3.array(z3.string().max(200)).max(20).optional(),
+      description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
+      url: z3.string().max(2048).optional(),
+      localUrls: z3.array(z3.object({
+        url: z3.string().max(253),
+        port: z3.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z2.string().max(2048).optional(),
-      git: z2.object({ remote: z2.string().max(2048).optional(), home: z2.string().max(2048).optional() }).nullable().optional(),
-      meta: z2.record(z2.string().max(256), z2.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z2.enum(["native", "docker"]).optional(),
+      openapiUrl: z3.string().max(2048).optional(),
+      git: z3.object({ remote: z3.string().max(2048).optional(), home: z3.string().max(2048).optional() }).nullable().optional(),
+      meta: z3.record(z3.string().max(256), z3.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z3.enum(["native", "docker"]).optional(),
       dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.nullable().optional(),
-      autoRestart: z2.boolean().optional(),
-      clearLogsOnStart: z2.boolean().optional(),
+      autoRestart: z3.boolean().optional(),
+      clearLogsOnStart: z3.boolean().optional(),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z2.number().int().nonnegative().optional(),
-      restartBackoffMs: z2.number().int().positive().optional(),
-      orgId: z2.string().max(128).nullable().optional(),
-      shortcuts: z2.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z2.array(z2.string().max(128)).max(50).optional(),
-      logSources: z2.array(LogSourceConfigSchema).max(20).optional()
+      maxRestarts: z3.number().int().nonnegative().optional(),
+      restartBackoffMs: z3.number().int().positive().optional(),
+      orgId: z3.string().max(128).nullable().optional(),
+      shortcuts: z3.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z3.array(z3.string().max(128)).max(50).optional(),
+      logSources: z3.array(LogSourceConfigSchema).max(20).optional()
     })
   ).mutation(async ({ input }) => {
     const existing = await serviceStore.get(input.id);
@@ -2521,7 +2636,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "update", entityType: "service", entityId: input.id });
     return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service), stoppedForAgentChange };
   }),
-  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z2.object({ id: z2.string().max(128) })).output(z2.object({ success: z2.literal(true) })).mutation(async ({ input }) => {
+  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z3.object({ id: z3.string().max(128) })).output(z3.object({ success: z3.literal(true) })).mutation(async ({ input }) => {
     const deleted = await serviceStore.delete(input.id);
     if (!deleted) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -2529,7 +2644,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "delete", entityType: "service", entityId: input.id });
     return { success: true };
   }),
-  checkCwd: protectedProcedure.input(z2.object({ id: z2.string().max(128), checkReachability: z2.boolean().optional() })).query(async ({ input }) => {
+  checkCwd: protectedProcedure.input(z3.object({ id: z3.string().max(128), checkReachability: z3.boolean().optional() })).query(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -2562,7 +2677,7 @@ var serviceRouter = router({
     }
     return { exists, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
-  cloneRepository: protectedProcedure.input(z2.object({ id: z2.string().max(128) })).mutation(async ({ input }) => {
+  cloneRepository: protectedProcedure.input(z3.object({ id: z3.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3547,7 +3662,7 @@ async function resolveImagesToBase64(images, contextId) {
 }
 
 // ../server/src/trpc/routers/cloud-auth.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { hostname } from "os";
 import { basename } from "path";
 import { TRPCError as TRPCError3 } from "@trpc/server";
@@ -3804,12 +3919,12 @@ var cloudSessionStore = new CloudSessionStore();
 import { networkInterfaces } from "os";
 import { readFile as readFile8, writeFile as writeFile6, rename as rename6, mkdir as mkdir8 } from "fs/promises";
 import { join as join7 } from "path";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 var LOOPBACK2 = "127.0.0.1";
 var ANY = "0.0.0.0";
 var NETWORK_FILE = "network.json";
-var NetworkFileSchema = z3.object({
-  instances: z3.record(z3.string(), z3.object({ lanEnabled: z3.boolean().default(false) })).default({})
+var NetworkFileSchema = z4.object({
+  instances: z4.record(z4.string(), z4.object({ lanEnabled: z4.boolean().default(false) })).default({})
 });
 var httpServer = null;
 function instanceKey() {
@@ -4077,15 +4192,15 @@ function isAllowedProxyPath(path) {
   const [pathname] = path.split("?");
   return PROXY_PREFIXES.some((p) => pathname === p || pathname.startsWith(p));
 }
-var ScopeSchema = z4.object({
-  accountId: z4.string().min(1).max(64)
+var ScopeSchema = z5.object({
+  accountId: z5.string().min(1).max(64)
 });
 function scopeOf(input) {
   return { accountId: input.accountId };
 }
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
-  startLogin: protectedProcedure.input(z4.object({ returnTo: z4.string().url().max(2048) })).mutation(async ({ input }) => {
+  startLogin: protectedProcedure.input(z5.object({ returnTo: z5.string().url().max(2048) })).mutation(async ({ input }) => {
     const callback = callbackForReturnTo(input.returnTo);
     if (!callback) {
       throw new TRPCError3({
@@ -4123,7 +4238,7 @@ var cloudAuthRouter = router({
    * `null` quand rien ne rattache cette organisation à un compte de ce poste :
    * l'interface l'affiche comme déconnectée, ce qu'elle est.
    */
-  accountForOrg: protectedProcedure.input(z4.object({ orgId: z4.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
+  accountForOrg: protectedProcedure.input(z5.object({ orgId: z5.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
   /**
    * Les comptes liés à ce poste, et l'organisation dont chacun répond.
    *
@@ -4179,7 +4294,7 @@ var cloudAuthRouter = router({
    * drops the session, and the local token is dropped here too, so nothing is
    * left holding a dead credential.
    */
-  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z4.string().min(1).max(128) })).mutation(async ({ input }) => {
+  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z5.string().min(1).max(128) })).mutation(async ({ input }) => {
     const { accountId } = input;
     if (!accountId) throw new TRPCError3({ code: "PRECONDITION_FAILED", message: "No cloud account for this scope." });
     const res = await cloudFetch2("/api/auth/device/revoke", {
@@ -4202,17 +4317,17 @@ var cloudAuthRouter = router({
    * the cloud: the web UI asks its own server, which holds the credential.
    */
   proxy: protectedProcedure.input(
-    z4.object({
-      path: z4.string().min(1).max(512),
-      method: z4.enum(["GET", "POST"]).default("GET"),
-      query: z4.record(z4.string().max(128), z4.string().max(2048)).optional(),
-      body: z4.unknown().optional(),
+    z5.object({
+      path: z5.string().min(1).max(512),
+      method: z5.enum(["GET", "POST"]).default("GET"),
+      query: z5.record(z5.string().max(128), z5.string().max(2048)).optional(),
+      body: z5.unknown().optional(),
       // Obligatoire, et seul : c'est la porte par laquelle passent tous les
       // appels cloud de l'interface. La laisser optionnelle est ce qui a
       // permis aux composables partagées de n'envoyer aucune portée pendant
       // trente routes, et au serveur de retomber sur « le compte unique du
       // poste » — muet dès qu'il y en a eu deux.
-      accountId: z4.string().min(1).max(64)
+      accountId: z5.string().min(1).max(64)
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -4994,7 +5109,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-APY7SZ75.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-HOL7ZG4V.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5686,7 +5801,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-APY7SZ75.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-HOL7ZG4V.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -6124,18 +6239,18 @@ ${prompt}`;
 };
 
 // ../server/src/trpc/routers/chat.ts
-var MessageSchema = z5.object({
-  role: z5.enum(["user", "assistant"]),
-  content: z5.string().max(1e5)
+var MessageSchema = z6.object({
+  role: z6.enum(["user", "assistant"]),
+  content: z6.string().max(1e5)
 });
-var ImagePartSchema = z5.object({
-  type: z5.literal("image"),
-  imageId: z5.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
-  url: z5.string().max(500),
-  mimeType: z5.string().max(100),
-  altText: z5.string().max(500).optional()
+var ImagePartSchema = z6.object({
+  type: z6.literal("image"),
+  imageId: z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
+  url: z6.string().max(500),
+  mimeType: z6.string().max(100),
+  altText: z6.string().max(500).optional()
 });
-var ImagePartsSchema = z5.array(ImagePartSchema).max(5).optional();
+var ImagePartsSchema = z6.array(ImagePartSchema).max(5).optional();
 var LANGUAGE_INSTRUCTION = "Always respond in the same language the user writes in.";
 async function buildSystemPrompt(apiKey) {
   const allServices = await serviceStore.list();
@@ -6523,24 +6638,24 @@ async function startCodexSession(convId, prompt, opts = {}) {
   });
   return { session, done };
 }
-var MessagePartSchema = z5.discriminatedUnion("type", [
-  z5.object({ type: z5.literal("thinking"), text: z5.string().max(1e5) }),
-  z5.object({ type: z5.literal("text"), text: z5.string().max(1e5) }),
-  z5.object({
-    type: z5.literal("tool"),
+var MessagePartSchema = z6.discriminatedUnion("type", [
+  z6.object({ type: z6.literal("thinking"), text: z6.string().max(1e5) }),
+  z6.object({ type: z6.literal("text"), text: z6.string().max(1e5) }),
+  z6.object({
+    type: z6.literal("tool"),
     id: Id128Schema,
     name: Id128Schema,
-    input: z5.record(z5.string(), z5.unknown()).optional(),
-    rawInput: z5.string().max(1e4).optional(),
-    result: z5.unknown().optional(),
-    isError: z5.boolean().optional(),
-    pending: z5.boolean()
+    input: z6.record(z6.string(), z6.unknown()).optional(),
+    rawInput: z6.string().max(1e4).optional(),
+    result: z6.unknown().optional(),
+    isError: z6.boolean().optional(),
+    pending: z6.boolean()
   })
 ]);
-var StoredMessageSchema = z5.object({
-  role: z5.enum(["user", "assistant"]),
-  content: z5.string().max(1e5),
-  parts: z5.array(MessagePartSchema).max(200).optional()
+var StoredMessageSchema = z6.object({
+  role: z6.enum(["user", "assistant"]),
+  content: z6.string().max(1e5),
+  parts: z6.array(MessagePartSchema).max(200).optional()
 });
 async function conversationCwd(conv) {
   return resolveConversationCwd(conv.id);
@@ -6557,7 +6672,7 @@ var chatRouter = router({
      * et sans le même filtre il y reversait toutes les conversations de la
      * machine, une seconde après un chargement pourtant filtré.
      */
-    onChanged: protectedProcedure.input(z5.object({
+    onChanged: protectedProcedure.input(z6.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).subscription(async function* ({ input }) {
@@ -6605,7 +6720,7 @@ var chatRouter = router({
      * reachable where they were written, without leaking into every other
      * organization's projects.
      */
-    list: protectedProcedure.input(z5.object({
+    list: protectedProcedure.input(z6.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).query(async ({ input }) => {
@@ -6613,24 +6728,24 @@ var chatRouter = router({
       if (!projectId) return conversationStore.list();
       return conversationStore.listForProject({ id: projectId, orgId: input?.orgId });
     }),
-    get: protectedProcedure.input(z5.object({ id: Id128Schema })).query(async ({ input }) => {
+    get: protectedProcedure.input(z6.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     }),
-    create: protectedProcedure.input(z5.object({
+    create: protectedProcedure.input(z6.object({
       title: ShortString200Schema.optional(),
-      isCli: z5.boolean().optional(),
-      runner: z5.enum(["claude-code", "codex"]).optional(),
+      isCli: z6.boolean().optional(),
+      runner: z6.enum(["claude-code", "codex"]).optional(),
       providerId: Id128Schema.optional(),
       scenarioId: Id128Schema.optional(),
-      scenarioInput: z5.string().max(1e5).optional(),
+      scenarioInput: z6.string().max(1e5).optional(),
       kanbanBoardId: Id128Schema.optional(),
       kanbanCardId: Id128Schema.optional(),
       // The project the conversation is about: only the caller knows which
       // one it is looking at.
       projectId: Id128Schema.optional(),
-      orgId: z5.string().max(128).nullable().optional()
+      orgId: z6.string().max(128).nullable().optional()
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
@@ -6664,13 +6779,13 @@ var chatRouter = router({
       }
       return conv;
     }),
-    update: protectedProcedure.input(z5.object({
+    update: protectedProcedure.input(z6.object({
       id: Id128Schema,
       title: ShortString200Schema.optional(),
-      messages: z5.array(StoredMessageSchema).max(500).optional(),
-      contextUsage: z5.object({
-        inputTokens: z5.number().int().nonnegative(),
-        contextWindow: z5.number().int().positive()
+      messages: z6.array(StoredMessageSchema).max(500).optional(),
+      contextUsage: z6.object({
+        inputTokens: z6.number().int().nonnegative(),
+        contextWindow: z6.number().int().positive()
       }).optional()
     })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { title: input.title, messages: input.messages, contextUsage: input.contextUsage });
@@ -6684,10 +6799,10 @@ var chatRouter = router({
      * messages, et un réglage qui voyage avec 500 messages se perdrait dans un
      * patch dont ce n'est pas le sujet.
      */
-    setCompanion: protectedProcedure.input(z5.object({
+    setCompanion: protectedProcedure.input(z6.object({
       id: Id128Schema,
-      enabled: z5.boolean(),
-      runner: z5.enum(["claude-code", "codex"]).optional()
+      enabled: z6.boolean(),
+      runner: z6.enum(["claude-code", "codex"]).optional()
     })).mutation(async ({ input }) => {
       const existing = await conversationStore.get(input.id);
       if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
@@ -6710,7 +6825,7 @@ var chatRouter = router({
      * compagnon silencieux parce qu'il n'avait rien à dire et un message qui
      * n'a pas pu être transmis se ressemblent parfaitement sans cette trace.
      */
-    companionDelivery: protectedProcedure.input(z5.object({ id: Id128Schema })).query(async ({ input }) => {
+    companionDelivery: protectedProcedure.input(z6.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       const companionId = conv?.companionConversationId;
       const running = isCompanionThinking(input.id) || (companionId ? activeSessionRegistry.get(companionId)?.status === "running" : false);
@@ -6760,7 +6875,7 @@ var chatRouter = router({
      * route emprunte exactement le chemin de livraison, sans le jugement, et
      * rend PAR OÙ le message est passé.
      */
-    testCompanionBridge: protectedProcedure.input(z5.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    testCompanionBridge: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       const route = await deliverToMainConversation(
@@ -6781,7 +6896,7 @@ var chatRouter = router({
      * entier, bien plus qu'une requête ne doit rester ouverte. L'interface suit
      * l'avancement par l'état poussé « il relit », déjà en place.
      */
-    runCompanionNow: protectedProcedure.input(z5.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    runCompanionNow: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       if (conv.isCompanion) {
@@ -6798,7 +6913,7 @@ var chatRouter = router({
       });
       return { started: true };
     }),
-    delete: protectedProcedure.input(z5.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    delete: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const existing = await conversationStore.get(input.id);
       if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       resetRelaunches(input.id);
@@ -6826,18 +6941,29 @@ var chatRouter = router({
         (err) => console.error("[chat.delete] Image cleanup error:", err)
       );
     }),
-    archive: protectedProcedure.input(z5.object({ id: Id128Schema, archived: z5.boolean() })).mutation(async ({ input }) => {
+    archive: protectedProcedure.input(z6.object({ id: Id128Schema, archived: z6.boolean() })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { archived: input.archived });
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
+    }),
+    pin: protectedProcedure.input(z6.object({ id: Id128Schema, pinned: z6.boolean() })).mutation(async ({ input }) => {
+      const conv = await conversationStore.setPinned(input.id, input.pinned);
+      if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
+      return conv;
+    }),
+    // L'ordre ne vaut que pour les ids donnés : l'écran ne connaît que les
+    // conversations du projet courant, et les épinglées des autres projets
+    // n'ont pas à bouger parce qu'on a rangé celles-ci.
+    reorderPinned: protectedProcedure.input(z6.object({ ids: z6.array(Id128Schema).max(500) })).mutation(async ({ input }) => {
+      await conversationStore.reorderPinned(input.ids);
     })
   }),
-  listModels: protectedProcedure.input(z5.object({
+  listModels: protectedProcedure.input(z6.object({
     providerId: Id128Schema.optional(),
     // Le projet dit de quelle organisation lire les fournisseurs ; absent,
     // ce sont ceux du poste.
     projectId: Id128Schema.optional(),
-    orgId: z5.string().max(128).nullable().optional()
+    orgId: z6.string().max(128).nullable().optional()
   }).optional()).query(async ({ input }) => {
     const active = await getActiveProvider(
       input?.providerId,
@@ -6850,7 +6976,7 @@ var chatRouter = router({
       return [];
     }
   }),
-  checkCliAvailability: protectedProcedure.input(z5.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
+  checkCliAvailability: protectedProcedure.input(z6.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
     if (input?.agentId) {
       try {
         const res = await agentManager.agentQuery(
@@ -6868,12 +6994,12 @@ var chatRouter = router({
     ]);
     return { available: claudeOk, codexAvailable: codexOk };
   }),
-  enhanceScenarioPrompt: protectedProcedure.input(z5.object({
-    text: z5.string().max(1e4),
+  enhanceScenarioPrompt: protectedProcedure.input(z6.object({
+    text: z6.string().max(1e4),
     providerId: Id128Schema.optional(),
-    model: z5.string().max(200).optional(),
+    model: z6.string().max(200).optional(),
     projectId: Id128Schema.optional(),
-    orgId: z5.string().max(128).nullable().optional()
+    orgId: z6.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const active = await getActiveProvider(
       input.providerId,
@@ -6930,22 +7056,22 @@ Return ONLY the improved text, no explanation, no preamble.`;
     }
   }),
   getStreamingStatus: protectedProcedure.query(() => activeSessionRegistry.listActive()),
-  stopSession: protectedProcedure.input(z5.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
+  stopSession: protectedProcedure.input(z6.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: stopSession");
     const killed = activeSessionRegistry.kill(input.conversationId);
     if (!killed) throw new TRPCError4({ code: "NOT_FOUND", message: "No active session for this conversation" });
     return { ok: true };
   }),
-  streamViaClaudeCode: protectedProcedure.input(z5.object({
+  streamViaClaudeCode: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    prompt: z5.string().max(1e5),
-    contextNote: z5.string().max(2e5).optional(),
+    prompt: z6.string().max(1e5),
+    contextNote: z6.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    effort: z5.enum(["low", "medium", "high"]).optional(),
-    reconnect: z5.boolean().optional(),
+    effort: z6.enum(["low", "medium", "high"]).optional(),
+    reconnect: z6.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z5.string().max(128).optional(),
-    imageIds: z5.array(z5.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z6.string().max(128).optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: Reconnect");
@@ -7047,15 +7173,15 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: drainSession...");
     yield* drainSession(session, signal, false);
   }),
-  streamViaCodex: protectedProcedure.input(z5.object({
+  streamViaCodex: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    prompt: z5.string().max(1e5),
-    contextNote: z5.string().max(2e5).optional(),
+    prompt: z6.string().max(1e5),
+    contextNote: z6.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    reconnect: z5.boolean().optional(),
+    reconnect: z6.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z5.string().max(128).optional(),
-    imageIds: z5.array(z5.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z6.string().max(128).optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -7125,13 +7251,13 @@ ${input.prompt}` : input.prompt;
     });
     yield* drainSession(session, signal, false);
   }),
-  send: protectedProcedure.input(z5.object({
+  send: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    messages: z5.array(MessageSchema).min(0).max(100),
+    messages: z6.array(MessageSchema).min(0).max(100),
     model: ShortString200Schema.optional(),
-    contextNote: z5.string().max(2e5).optional(),
-    reconnect: z5.boolean().optional(),
-    imageIds: z5.array(z5.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    contextNote: z6.string().max(2e5).optional(),
+    reconnect: z6.boolean().optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -7244,25 +7370,25 @@ ${input.prompt}` : input.prompt;
   // ── PTY passthrough (interactive Claude Code session) ────────────────────
   pty: router({
     /** Start a PTY session running `claude --resume <sessionId>` (or fresh). */
-    start: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      sessionId: z5.string().max(128).optional(),
-      runner: z5.enum(["claude-code", "codex"]).default("claude-code"),
-      resume: z5.boolean().default(false),
-      model: z5.string().max(128).optional(),
-      cwd: z5.string().max(4096).optional(),
+    start: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128).optional(),
+      runner: z6.enum(["claude-code", "codex"]).default("claude-code"),
+      resume: z6.boolean().default(false),
+      model: z6.string().max(128).optional(),
+      cwd: z6.string().max(4096).optional(),
       /** Anchors the session when no explicit cwd is given. */
-      serviceId: z5.string().max(128).optional(),
+      serviceId: z6.string().max(128).optional(),
       projectId: Id128Schema.optional(),
-      orgId: z5.string().max(128).nullable().optional(),
-      cols: z5.number().int().min(1).max(1e3).default(120),
-      rows: z5.number().int().min(1).max(1e3).default(30),
-      enableMcp: z5.boolean().default(false),
-      apiBaseUrl: z5.string().max(512).optional(),
-      environmentId: z5.string().max(128).optional(),
-      attachedContexts: z5.array(z5.object({
-        label: z5.string().max(200),
-        text: z5.string().max(1e6)
+      orgId: z6.string().max(128).nullable().optional(),
+      cols: z6.number().int().min(1).max(1e3).default(120),
+      rows: z6.number().int().min(1).max(1e3).default(30),
+      enableMcp: z6.boolean().default(false),
+      apiBaseUrl: z6.string().max(512).optional(),
+      environmentId: z6.string().max(128).optional(),
+      attachedContexts: z6.array(z6.object({
+        label: z6.string().max(200),
+        text: z6.string().max(1e6)
       })).max(20).optional()
     })).mutation(async ({ input, ctx }) => {
       const t0 = Date.now();
@@ -7420,10 +7546,10 @@ Context:
       return { spawnId: res.spawnId, agentId, reattached: false };
     }),
     /** Subscribe to PTY output stream (raw text with ANSI). */
-    stream: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      spawnId: z5.string().max(128),
-      fromOffset: z5.number().int().min(0).default(0)
+    stream: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      fromOffset: z6.number().int().min(0).default(0)
     })).subscription(async function* ({ input, signal }) {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7478,10 +7604,10 @@ Context:
       }
     }),
     /** Write input to a PTY session (keystrokes from xterm). */
-    write: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      spawnId: z5.string().max(128),
-      data: z5.string().max(1e6)
+    write: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      data: z6.string().max(1e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7491,11 +7617,11 @@ Context:
       });
     }),
     /** Resize a PTY session. */
-    resize: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      spawnId: z5.string().max(128),
-      cols: z5.number().int().min(1).max(1e3),
-      rows: z5.number().int().min(1).max(1e3)
+    resize: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      cols: z6.number().int().min(1).max(1e3),
+      rows: z6.number().int().min(1).max(1e3)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7511,11 +7637,11 @@ Context:
      * picks it up. Returns the tmp path and which clipboard method succeeded
      * (null if none — caller should inject `@<path>` instead of Ctrl+V).
      */
-    pasteImage: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      sessionId: z5.string().max(128).optional(),
-      mimeType: z5.string().max(64),
-      base64: z5.string().max(15e6)
+    pasteImage: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128).optional(),
+      mimeType: z6.string().max(64),
+      base64: z6.string().max(15e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7533,7 +7659,7 @@ Context:
      * Read the transcript Claude Code stores on disk for a given session.
      * Returns parsed JSONL entries (user / assistant messages, tool uses, etc.).
      */
-    transcript: protectedProcedure.input(z5.object({ sessionId: z5.string().max(128) })).query(async ({ input }) => {
+    transcript: protectedProcedure.input(z6.object({ sessionId: z6.string().max(128) })).query(async ({ input }) => {
       return readClaudeTranscript(input.sessionId);
     }),
     /**
@@ -7541,9 +7667,9 @@ Context:
      * when was the transcript JSONL last touched? Used by the non-PTY view
      * to show a "Claude is thinking…" indicator while output streams.
      */
-    activity: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      sessionId: z5.string().max(128)
+    activity: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128)
     })).query(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       let running = false;
@@ -7569,7 +7695,7 @@ Context:
      * them on the conversation, so the non-PTY chat view stays in sync.
      * Uses the conversation id as session id (PTY sessions are spawned that way).
      */
-    syncTranscript: protectedProcedure.input(z5.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
+    syncTranscript: protectedProcedure.input(z6.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.conversationId);
       if (!conv) {
         throw new TRPCError4({ code: "NOT_FOUND", message: `Conversation ${input.conversationId} not found` });
@@ -7583,14 +7709,14 @@ Context:
      * with the given sessionId. Used to benchmark the PTY → tRPC → xterm.js
      * pipeline. Open the conversation in PTY mode to attach to it.
      */
-    debugStress: protectedProcedure.input(z5.object({
-      sessionId: z5.string().max(128),
-      agentId: z5.string().max(128).optional(),
-      bytesPerSec: z5.number().int().min(100).max(1e7).default(5e4),
-      chunkSize: z5.number().int().min(1).max(65536).default(256),
-      durationMs: z5.number().int().min(0).max(36e5).default(0),
-      cols: z5.number().int().min(1).max(1e3).default(120),
-      rows: z5.number().int().min(1).max(1e3).default(30)
+    debugStress: protectedProcedure.input(z6.object({
+      sessionId: z6.string().max(128),
+      agentId: z6.string().max(128).optional(),
+      bytesPerSec: z6.number().int().min(100).max(1e7).default(5e4),
+      chunkSize: z6.number().int().min(1).max(65536).default(256),
+      durationMs: z6.number().int().min(0).max(36e5).default(0),
+      cols: z6.number().int().min(1).max(1e3).default(120),
+      rows: z6.number().int().min(1).max(1e3).default(30)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7637,9 +7763,9 @@ Context:
       return { spawnId: res.spawnId, agentId, stressSessionId };
     }),
     /** Kill a PTY session. */
-    kill: protectedProcedure.input(z5.object({
-      agentId: z5.string().max(128).optional(),
-      spawnId: z5.string().max(128)
+    kill: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -7661,6 +7787,7 @@ export {
   requireServiceAction,
   getAllowedServiceIds,
   requireEnvAction,
+  canEnvAction,
   appVersion,
   APP_VERSION_HEADER,
   cloudSessionStore,
@@ -7718,4 +7845,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-44XAJ3MK.js.map
+//# sourceMappingURL=chunk-WE6EOX4C.js.map