@runeya/runeya 2.0.118 → 2.0.120

package/agent-manager-ACPQWUZ5.js

@@ -0,0 +1,9 @@
+import {
+  agentManager
+} from "./chunk-2WXQIUVC.js";
+import "./chunk-H6VIS4OY.js";
+import "./chunk-ZFELQG4B.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-ACPQWUZ5.js.map

package/{chat-XUIXGKSR.js → chat-PXMMZIAY.js}

@@ -3,13 +3,13 @@ import {
   startClaudeCodeSession,
   startCliSession,
   startCodexSession
-} from "./chunk-WE6EOX4C.js";
+} from "./chunk-22RJM654.js";
 import "./chunk-B7MABGQN.js";
-import "./chunk-XIRMRWVU.js";
+import "./chunk-NYKFDU76.js";
 import "./chunk-MD3VW4HQ.js";
-import "./chunk-P47X3LT3.js";
-import "./chunk-I2AZCZMR.js";
-import "./chunk-RN4X65D3.js";
+import "./chunk-2WXQIUVC.js";
+import "./chunk-GIHR3BGT.js";
+import "./chunk-H6VIS4OY.js";
 import "./chunk-ZFELQG4B.js";
 export {
   chatRouter,
@@ -17,4 +17,4 @@ export {
   startCliSession,
   startCodexSession
 };
-//# sourceMappingURL=chat-XUIXGKSR.js.map
+//# sourceMappingURL=chat-PXMMZIAY.js.map

package/{chunk-WE6EOX4C.js → chunk-22RJM654.js}

@@ -31,7 +31,7 @@ import {
   runCompanionNow,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-XIRMRWVU.js";
+} from "./chunk-NYKFDU76.js";
 import {
   agentManager,
   agentStore,
@@ -51,10 +51,10 @@ import {
   rememberFile,
   serviceStore,
   wasRead
-} from "./chunk-P47X3LT3.js";
+} from "./chunk-2WXQIUVC.js";
 import {
   settingsManager
-} from "./chunk-I2AZCZMR.js";
+} from "./chunk-GIHR3BGT.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
@@ -70,13 +70,14 @@ import {
   ambiguousServiceSlugs,
   crossServiceValues,
   interpolateBuiltinsInEnv,
+  isSharedWithAi,
   nativeParsers,
   servicePortValues,
   serviceSlug,
   serviceUrlValues,
   urlHostFor,
   withDeprecatedAliases
-} from "./chunk-RN4X65D3.js";
+} from "./chunk-H6VIS4OY.js";
 import {
   allVaultRoots,
   env,
@@ -786,25 +787,91 @@ function slotReferenceText(variable) {
 ${slot.value}
 ${slot.post}`;
 }
+var MASKED_VALUE = "***";
+var HIDDEN_VALUES_NOTICE = `Values shown as ${MASKED_VALUE} are secrets their author did not share with AI. The service does receive them: never treat such a key as missing, and never pass ${MASKED_VALUE} as its value.`;
+function filterEnvForAi(resolved, sharedKeys) {
+  const secret = new Set(resolved.envSecrets);
+  const shared = new Set(sharedKeys);
+  const env2 = {};
+  const envSecrets = [];
+  const hiddenKeys = [];
+  for (const [key, value] of Object.entries(resolved.env)) {
+    const hidden = secret.has(key) && !shared.has(key);
+    env2[key] = hidden ? MASKED_VALUE : value;
+    if (secret.has(key)) envSecrets.push(key);
+    if (hidden) hiddenKeys.push(key);
+  }
+  return {
+    env: env2,
+    envSecrets,
+    hiddenKeys,
+    ...hiddenKeys.length > 0 ? { hiddenNotice: HIDDEN_VALUES_NOTICE } : {}
+  };
+}
+function describeVariables(environments, ctx) {
+  const details = [];
+  for (const environment of environments) {
+    for (const [variableId, variable] of Object.entries(environment.variables ?? {})) {
+      const slot = variable.value;
+      const isOverridden = ctx.overriddenVariableIds.has(variableId);
+      const isSecret = slot.isSecret || ctx.resolvedSecretKeys.has(variable.key);
+      const readableByAi = ctx.maskedKeys.has(variable.key) ? false : !isSecret || isSharedWithAi(slot);
+      details.push({
+        key: variable.key,
+        inService: ctx.serviceKeys.has(variable.key),
+        environmentId: environment.id,
+        environmentName: environment.name,
+        scope: environment.scope,
+        ...environment.scope === "service" && environment.reference ? { environmentServiceId: environment.reference } : {},
+        ...slot.description ? { description: slot.description } : {},
+        secret: isSecret,
+        readableByAi,
+        injectedIntoAi: slot.injectIntoAi,
+        required: slot.required,
+        overrideOnly: slot.overrideOnly,
+        overridden: isOverridden,
+        ...isOverridden && ctx.sharedValues[variable.key] !== void 0 ? { sharedValue: ctx.sharedValues[variable.key] } : {}
+      });
+    }
+  }
+  return details.sort((a, b) => a.key.localeCompare(b.key) || a.environmentName.localeCompare(b.environmentName));
+}
+function withOverriddenValue(variable, override) {
+  return {
+    ...variable,
+    value: {
+      ...variable.value,
+      value: override.value,
+      pre: override.pre,
+      post: override.post
+    }
+  };
+}
 var EnvironmentResolver = class {
-  async resolveForService(ctx) {
+  async resolveForService(ctx, opts) {
     if (!ctx.activeEnvironmentId) {
       return { env: {}, envSecrets: [] };
     }
     const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
     if (!serviceEnv) {
-      return this.resolveEnvironment(ctx.activeEnvironmentId);
+      return this.resolveEnvironment(ctx.activeEnvironmentId, opts);
     }
-    return this.resolveEnvironment(serviceEnv.id);
+    return this.resolveEnvironment(serviceEnv.id, opts);
   }
-  async resolveEnvironment(environmentId) {
+  /**
+   * `applyOverrides: false` rend ce que l'équipe partage, sans ce que ce poste
+   * a mis par-dessus : c'est la réponse à « qu'est-ce que ma surcharge
+   * remplace ». Le défaut reste `true` — tout le reste du produit veut la
+   * valeur avec laquelle le service tourne réellement.
+   */
+  async resolveEnvironment(environmentId, opts) {
     const visited = /* @__PURE__ */ new Set();
     const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = await this.resolveOverridesByKey(environmentId);
+    const overridesByKey = opts?.applyOverrides === false ? {} : await this.resolveOverridesByKey(environmentId);
     for (const [varId, variable] of Object.entries(result.variables)) {
       const override = overridesByKey[variable.key];
       if (override) {
-        result.variables[varId] = { ...variable, value: override.variable.value };
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
       }
     }
     const rawEnv = {};
@@ -838,7 +905,7 @@ var EnvironmentResolver = class {
     for (const [varId, variable] of Object.entries(result.variables)) {
       const override = overridesByKey[variable.key];
       if (override) {
-        result.variables[varId] = { ...variable, value: override.variable.value };
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
       }
     }
     const rawEnv = {};
@@ -942,6 +1009,35 @@ var EnvironmentResolver = class {
     }
     return missing;
   }
+  /**
+   * Les clés que leur auteur a partagées avec les IA, héritage compris.
+   *
+   * Le partage se lit sur la **définition**, et seulement là : une surcharge
+   * machine ne dit que la valeur de ce poste (`withOverriddenValue`). Il n'y a
+   * donc qu'un endroit où ce drapeau existe, et rien à réconcilier.
+   *
+   * Des clés, pas des valeurs : la valeur rendue reste celle que le service
+   * reçoit, surcharges et interpolation comprises.
+   */
+  async resolveAiSharedKeys(environmentId) {
+    if (!environmentId) return /* @__PURE__ */ new Set();
+    const result = await this.resolveDag(environmentId, /* @__PURE__ */ new Set());
+    const keys = /* @__PURE__ */ new Set();
+    for (const variable of Object.values(result.variables)) {
+      if (isSharedWithAi(variable.value)) keys.add(variable.key);
+    }
+    return keys;
+  }
+  /**
+   * Idem, pour ce qu'un service verra réellement : son environnement dédié
+   * quand il en a un, l'environnement global sinon — la règle de sélection de
+   * `resolveForService`.
+   */
+  async resolveAiSharedKeysForService(ctx) {
+    if (!ctx.activeEnvironmentId) return /* @__PURE__ */ new Set();
+    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
+    return this.resolveAiSharedKeys(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
+  }
   /**
    * Idem, pour ce qu'un service verra réellement : son environnement dédié
    * quand il en a un, l'environnement global sinon. Miroir de
@@ -959,7 +1055,7 @@ var EnvironmentResolver = class {
     for (const [varId, variable] of Object.entries(result.variables)) {
       const override = overridesByKey[variable.key];
       if (override) {
-        result.variables[varId] = { ...variable, value: override.variable.value };
+        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
         result.sources[varId] = {
           ...result.sources[varId],
           overridden: true,
@@ -1567,6 +1663,12 @@ var RUNEYA_CAPABILITIES = [
   // rendent que des chemins et une adresse, d'où leur présence ci-dessous),
   // `cloudAuth.session`, `agent.getPassthroughEnv`. Un agent n'a pas besoin de
   // ces valeurs pour travailler, et ce qu'il lit finit dans une transcription.
+  //
+  // La seule exception est `service.getEnv` (`get_service_env` ci-dessous),
+  // et elle n'en est une que parce qu'elle filtre : les variables publiques, et
+  // les seuls secrets que leur auteur a partagés avec les IA (`isSharedWithAi`
+  // — « Lisible par l'IA », ou l'injection, qui vaut la lecture). Un secret non
+  // partagé n'y apparaît pas, pas même par son nom.
   {
     name: "list_processes",
     description: "List every process across all agents with its current state (running, stopped, exit code, uptime). Use this to see the whole machine at once, rather than calling get_service_status service by service. An agent only learns about a service when it is first started, so this lists what is deployed, not what is configured: an empty list means nothing has been started, not that you cannot see them \u2014 list_services shows what exists.",
@@ -1585,6 +1687,16 @@ var RUNEYA_CAPABILITIES = [
     ],
     buildInput: (p) => ({ id: p.serviceId })
   },
+  {
+    name: "get_service_env",
+    description: 'Read the environment variables a service runs with, and the project\'s variable inventory. `env` lists every key the service receives; a value reads "***" when it is a secret whose author did not share it with AI (sharing = ticking "AI read", or injecting it into the agents\' environment, which grants reading too). `envSecrets` says which keys are secret, `hiddenKeys` which ones are masked. A masked key is set on the service: never treat it as missing, never suggest adding it, and never pass "***" as a value \u2014 ask the user for it. `variables` describes every variable of the project \u2014 which environment defines it and its scope, its description, its flags, whether this machine overrides it, and `inService: false` for the ones this service does not receive. Use it to say where a variable must be changed instead of guessing. On an overridden variable, `sharedValue` is what the machine-local override replaces (the team\'s value, masked as "***" when unreadable); no other value appears there.',
+    route: "service.getEnv",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true }
+    ],
+    buildInput: (p) => ({ id: p.serviceId })
+  },
   {
     name: "get_service_metrics",
     description: "Read the CPU and memory currently used by a running service.",
@@ -2501,6 +2613,57 @@ var serviceRouter = router({
     }
     return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service) };
   }),
+  /**
+   * Les variables d'environnement d'un service, telles qu'un agent IA a le
+   * droit de les lire : tout ce qui est public, et les seuls secrets que leur
+   * auteur a partagés avec les IA (« Lisible par l'IA », ou l'injection dans
+   * l'environnement des agents, qui la vaut).
+   *
+   * Route à part, et non un champ de `get` : `get` est appelé par chaque écran
+   * qui affiche un service, et résoudre un environnement complet à chacun de
+   * ces appels se paierait partout. C'est aussi ce qui rend la lecture des
+   * valeurs explicite du côté appelant.
+   *
+   * L'env part de `resolveServiceVariables`, donc exactement de ce que le
+   * service reçoit au déploiement — builtins serveur interpolés compris.
+   *
+   * S'y ajoute `variables` : l'inventaire des variables du projet, **sans
+   * valeurs** — où chacune est définie, ce que ses cases disent, et si ce
+   * service la reçoit. Sans lui, un agent lisait l'effet sans la cause.
+   */
+  getEnv: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}/env", tags: ["services"], summary: "Get a service's environment variables (unshared secrets masked) plus the project's value-free variable inventory", protect: true } }).input(z3.object({ id: z3.string().max(128) })).output(z3.any()).query(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.id, "service:read");
+    const service = await serviceStore.get(input.id);
+    if (!service) {
+      throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+    }
+    const resolved = await resolveServiceVariables(service);
+    const project = await projectStore.ofService(service.id);
+    const shared = project?.activeEnvironmentId ? await environmentResolver.resolveAiSharedKeysForService({
+      serviceId: service.id,
+      activeEnvironmentId: project.activeEnvironmentId
+    }) : /* @__PURE__ */ new Set();
+    const filtered = filterEnvForAi(
+      { env: resolved.env ?? {}, envSecrets: resolved.envSecrets ?? [] },
+      shared
+    );
+    const [environments, overrides, sharedResolved] = project ? await Promise.all([
+      environmentStore.getByProjectId(project.id, project.orgId ?? null),
+      environmentOverridesStore.getAll(),
+      project.activeEnvironmentId ? environmentResolver.resolveForService(
+        { serviceId: service.id, activeEnvironmentId: project.activeEnvironmentId },
+        { applyOverrides: false }
+      ) : Promise.resolve({ env: {}, envSecrets: [] })
+    ]) : [[], {}, { env: {}, envSecrets: [] }];
+    const variables = describeVariables(environments, {
+      serviceKeys: new Set(Object.keys(filtered.env)),
+      overriddenVariableIds: new Set(Object.keys(overrides)),
+      sharedValues: filterEnvForAi(sharedResolved, shared).env,
+      resolvedSecretKeys: new Set(resolved.envSecrets ?? []),
+      maskedKeys: new Set(filtered.hiddenKeys)
+    });
+    return { ...filtered, variables };
+  }),
   create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z3.any()).input(
     z3.object({
       agentId: z3.string().max(128).optional(),
@@ -5109,7 +5272,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-HOL7ZG4V.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-ACPQWUZ5.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5801,7 +5964,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-HOL7ZG4V.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-ACPQWUZ5.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7845,4 +8008,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-WE6EOX4C.js.map
+//# sourceMappingURL=chunk-22RJM654.js.map