@runeya/runeya 2.0.144 → 2.0.146

package/{src-5TEXF3SU.js → src-LEDGW5KP.js}

@@ -19,6 +19,7 @@ import {
   applyPersistedLanMode,
   attachServiceToProject,
   auditService,
+  buildKanbanCardPrompt,
   buildServerBuiltins,
   canEnvAction,
   chatRouter,
@@ -49,6 +50,8 @@ import {
   readCloudIdentity,
   registerHttpServer,
   requireEnvAction,
+  requireHuman,
+  requireLoopback,
   requireLoopbackOrToken,
   requireServiceAction,
   resolveEffectiveAgentId,
@@ -62,13 +65,16 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-P73PTVII.js";
+} from "./chunk-SEPAURTQ.js";
+import "./chunk-6IBPK6UE.js";
 import {
   settingsManager
-} from "./chunk-UR3HL373.js";
+} from "./chunk-NPMSBYXC.js";
 import {
+  CONVERSATIONS_DIRNAME,
   LocalProjectRefusedError,
   activeSessionRegistry,
+  companionCreateDefaults,
   companionDefaultPrompt,
   companionSettings,
   conversationStore,
@@ -81,13 +87,14 @@ import {
   resolveAgentCwd,
   resolveConversationCwd,
   resolveWorkspaceCwd,
+  setMcpClientCheck,
   signJwt,
   startClaudeTranscriptWatcher,
   startCodexTranscriptWatcher,
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-NSS47H26.js";
+} from "./chunk-UD42LACH.js";
 import {
   agentManager,
   agentSpawner,
@@ -126,14 +133,48 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-GXE5TLLJ.js";
+} from "./chunk-KV4GJKXU.js";
+import {
+  decryptValueWith,
+  encryptValueWith,
+  isCliAvailable,
+  resolveCliInvocation,
+  whichCommand
+} from "./chunk-OZBSOSAS.js";
 import {
   atomicWriteSecure,
   renameWithRetry,
   resolveConversationRunDir,
   sweepStaleTempFiles
-} from "./chunk-7L6AQUBR.js";
+} from "./chunk-4LJQIQMN.js";
 import "./chunk-MD3VW4HQ.js";
+import {
+  allVaultRoots,
+  backfillOrgCloud,
+  env,
+  forgetOrgLogo,
+  keyRoot,
+  keyedFilePath,
+  legacyMachineFilePath,
+  legacyVaultRoot,
+  listCloudVaults,
+  listOrgVaults,
+  localVaultCollidesWithMachineRoot,
+  machineFilePath,
+  machineRoot,
+  orgVaultRoot,
+  projectVaultRoot,
+  readOrgAccounts,
+  readOrgClouds,
+  readOrgLogo,
+  readOrgLogos,
+  readOrgNames,
+  rememberOrgAccount,
+  rememberOrgLogo,
+  rememberOrgName,
+  stampOrgCloud,
+  vaultFor
+} from "./chunk-VPSQJOSN.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -146,6 +187,7 @@ import {
   EDITOR_BY_KEY,
   JSLogParser,
   JSLogParserSchema,
+  LAUNCHER_PROJECT_ID_PATTERN,
   LOG_BUFFER_SIZE,
   MissingVariableReasonSchema,
   NotificationPreferencesSchema,
@@ -170,45 +212,13 @@ import {
   serviceSlug,
   suggestBuiltinReferences,
   writeEntity
-} from "./chunk-XAFOP677.js";
-import {
-  allVaultRoots,
-  backfillOrgCloud,
-  env,
-  forgetOrgLogo,
-  keyRoot,
-  legacyMachineFilePath,
-  legacyVaultRoot,
-  listCloudVaults,
-  listOrgVaults,
-  localVaultCollidesWithMachineRoot,
-  machineFilePath,
-  machineRoot,
-  orgVaultRoot,
-  projectVaultRoot,
-  readOrgAccounts,
-  readOrgClouds,
-  readOrgLogo,
-  readOrgLogos,
-  readOrgNames,
-  rememberOrgAccount,
-  rememberOrgLogo,
-  rememberOrgName,
-  stampOrgCloud,
-  vaultFor
-} from "./chunk-IXO5KIO5.js";
-import {
-  decryptValueWith,
-  encryptValueWith,
-  resolveCliInvocation,
-  whichCommand
-} from "./chunk-OZBSOSAS.js";
+} from "./chunk-MZSDTA4A.js";
 
 // ../server/src/create-server.ts
 import express from "express";
 import cors from "cors";
 import { createServer } from "http";
-import { resolve as resolve3 } from "path";
+import { join as join18, resolve as resolve4 } from "path";
 import { WebSocketServer } from "ws";
 import { createExpressMiddleware } from "@trpc/server/adapters/express";
 import { applyWSSHandler } from "@trpc/server/adapters/ws";
@@ -223,7 +233,16 @@ import { z } from "zod";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { existsSync, mkdtempSync, readFileSync, rmdirSync } from "fs";
-import { dirname, isAbsolute, join, relative } from "path";
+import { dirname, join } from "path";
+
+// ../server/src/utils/is-inside.ts
+import { isAbsolute, relative } from "path";
+function isInside(dir, path) {
+  const rel = relative(dir, path);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
+}
+
+// ../server/src/services/npm-cli.ts
 var execFileAsync = promisify(execFile);
 var PACKAGE_NAME = "@runeya/runeya";
 var INSTALL_TIMEOUT_MS = 10 * 6e4;
@@ -329,10 +348,6 @@ function installPrefix(globalPrefix, platform = process.platform) {
   const modules = platform === "win32" ? join(globalPrefix, "node_modules") : join(globalPrefix, "lib", "node_modules");
   return isWritable(modules) ? globalPrefix : userPrefix();
 }
-function isInside(dir, path) {
-  const rel = relative(dir, path);
-  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel);
-}
 function updatePrefix(globalPrefix, runningEntry) {
   if (isInside(userPrefix(), runningEntry)) return userPrefix();
   if (!globalPrefix) return null;
@@ -639,6 +654,23 @@ function onCurrentProjectChanged(listener) {
   return () => listeners.delete(listener);
 }
 
+// ../server/src/services/project-containing.ts
+import { resolve } from "path";
+function projectContaining(paths, path) {
+  const target = resolve(path);
+  let best = null;
+  for (const [key, dir] of Object.entries(paths)) {
+    const root = resolve(dir);
+    if (root !== target && !isInside(root, target)) continue;
+    if (!best || root.length > best.depth) best = { key, depth: root.length };
+  }
+  if (!best) return null;
+  const sep2 = best.key.indexOf(":");
+  if (sep2 === -1) return { id: best.key };
+  const owner = best.key.slice(0, sep2);
+  return { id: best.key.slice(sep2 + 1), orgId: owner === "local" ? null : owner };
+}
+
 // ../server/src/services/org-keys.ts
 import { mkdir } from "fs/promises";
 
@@ -947,6 +979,13 @@ async function assertReadable(orgId) {
     throw err;
   }
 }
+async function localProjectPaths() {
+  const paths = await projectPathStore.all();
+  for (const project of await projectStore.list()) {
+    if (!project.orgId) paths[`local:${project.id}`] = dirname2(vaultFor(project).root);
+  }
+  return paths;
+}
 var projectRouter = router({
   list: protectedProcedure.query(async () => {
     return projectStore.list();
@@ -1228,12 +1267,16 @@ var projectRouter = router({
    * Le dossier de chaque projet sur cette machine, par clé `org:projet`
    * (`local:<id>` pour un projet local, dont le dossier contient son `.runeya`).
    */
-  localPaths: protectedProcedure.query(async () => {
-    const paths = await projectPathStore.all();
-    for (const project of await projectStore.list()) {
-      if (!project.orgId) paths[`local:${project.id}`] = dirname2(vaultFor(project).root);
-    }
-    return paths;
+  localPaths: protectedProcedure.query(() => localProjectPaths()),
+  /**
+   * Le projet dont le dossier contient ce chemin, ou `null`. Sert d'ancrage à
+   * un outil IA lancé hors de Runeya (`runeya mcp`), qui sait seulement dans
+   * quel dossier il tourne.
+   */
+  containing: protectedProcedure.input(z5.object({ path: z5.string().min(1).max(4096) })).query(async ({ input }) => {
+    const ref = projectContaining(await localProjectPaths(), input.path);
+    const project = ref ? await projectStore.get(ref).catch(() => null) : null;
+    return project ? { projectId: project.id, orgId: project.orgId ?? null, name: project.name } : null;
   }),
   getLocalPath: protectedProcedure.input(z5.object({
     id: z5.string().min(1).max(128),
@@ -1331,8 +1374,8 @@ var projectRouter = router({
           touched.clear();
           yield { collections };
         } else {
-          await new Promise((resolve4) => {
-            wake = resolve4;
+          await new Promise((resolve5) => {
+            wake = resolve5;
           });
         }
       }
@@ -1480,13 +1523,13 @@ var agentRouter = router({
       yield { agentId: agent.config.id, status: agent.status };
     }
     const queue = [];
-    let resolve4 = null;
+    let resolve5 = null;
     const handler = (event) => {
       if (queue.length >= SUBSCRIPTION_QUEUE_MAX) queue.shift();
       queue.push(event);
-      if (resolve4) {
-        resolve4();
-        resolve4 = null;
+      if (resolve5) {
+        resolve5();
+        resolve5 = null;
       }
     };
     agentManager.on("status", handler);
@@ -1496,7 +1539,7 @@ var agentRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve4 = r;
+            resolve5 = r;
           });
         }
       }
@@ -1615,14 +1658,14 @@ async function listAllProcesses() {
 var SUBSCRIPTION_QUEUE_MAX2 = LOG_BUFFER_SIZE;
 async function* forwardEvents(eventName, filter) {
   const queue = [];
-  let resolve4 = null;
+  let resolve5 = null;
   const handler = (data) => {
     if (filter && !filter(data)) return;
     if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
     queue.push(data);
-    if (resolve4) {
-      resolve4();
-      resolve4 = null;
+    if (resolve5) {
+      resolve5();
+      resolve5 = null;
     }
   };
   agentManager.on(eventName, handler);
@@ -1632,7 +1675,7 @@ async function* forwardEvents(eventName, filter) {
         yield queue.shift();
       } else {
         await new Promise((r) => {
-          resolve4 = r;
+          resolve5 = r;
         });
       }
     }
@@ -1642,7 +1685,7 @@ async function* forwardEvents(eventName, filter) {
 }
 async function* forwardLogBatches(agentId, processId) {
   const queue = [];
-  let resolve4 = null;
+  let resolve5 = null;
   const handler = (data) => {
     if (data.agentId !== agentId) return;
     const batch = data.batch;
@@ -1651,9 +1694,9 @@ async function* forwardLogBatches(agentId, processId) {
     if (filtered.length === 0) return;
     if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
     queue.push(filtered);
-    if (resolve4) {
-      resolve4();
-      resolve4 = null;
+    if (resolve5) {
+      resolve5();
+      resolve5 = null;
     }
   };
   agentManager.on("process:log", handler);
@@ -1663,7 +1706,7 @@ async function* forwardLogBatches(agentId, processId) {
         yield queue.shift();
       } else {
         await new Promise((r) => {
-          resolve4 = r;
+          resolve5 = r;
         });
       }
     }
@@ -2553,6 +2596,10 @@ var ScopeShape = {
 async function scopeOf(input) {
   return input?.orgId ?? await vaultOfProject(input?.projectId);
 }
+function keepOrReplace(key, current2, next) {
+  const value = next === void 0 ? current2 : next || void 0;
+  return value ? { [key]: value } : {};
+}
 var settingsRouter = router({
   /**
    * Get all settings
@@ -2681,8 +2728,8 @@ var settingsRouter = router({
           pending = false;
           yield listWithOrigin(await logParserStore.list(vault), vault);
         } else {
-          await new Promise((resolve4) => {
-            wake = resolve4;
+          await new Promise((resolve5) => {
+            wake = resolve5;
           });
         }
       }
@@ -2772,6 +2819,10 @@ var settingsRouter = router({
     return {
       enabledByDefault: c.enabledByDefault ?? false,
       prompt: c.prompt ?? "",
+      /** Chaîne vide = pas de runner imposé : celui de la conversation. */
+      runner: c.runner ?? "",
+      model: c.model ?? "",
+      effort: c.effort ?? "",
       /**
        * Conservé dans la réponse pour ne pas casser un client déjà construit,
        * mais l'écran n'en fait plus un texte à modifier : le réglage ajoute
@@ -2784,7 +2835,11 @@ var settingsRouter = router({
     enabledByDefault: z11.boolean().optional(),
     // Rejeté au-delà, jamais tronqué : un prompt coupé produirait des
     // relectures incohérentes sans rien signaler.
-    prompt: z11.string().max(2e4).optional()
+    prompt: z11.string().max(2e4).optional(),
+    /** Chaîne vide = retirer le défaut. */
+    runner: z11.enum(["claude-code", "codex", ""]).optional(),
+    model: z11.string().max(200).optional(),
+    effort: z11.enum(["low", "normal", "high", ""]).optional()
   })).mutation(async ({ input }) => {
     const settings = await settingsManager.getSettings();
     const current2 = settings.companion ?? { enabledByDefault: false };
@@ -2795,7 +2850,10 @@ var settingsRouter = router({
         enabledByDefault: input.enabledByDefault ?? current2.enabledByDefault ?? false,
         // Vide = « celles de Runeya » : on efface le réglage plutôt que d'y
         // ranger une chaîne vide qui signifierait « aucune consigne ».
-        ...input.prompt === void 0 ? current2.prompt ? { prompt: current2.prompt } : {} : prompt ? { prompt } : {}
+        ...input.prompt === void 0 ? current2.prompt ? { prompt: current2.prompt } : {} : prompt ? { prompt } : {},
+        ...keepOrReplace("runner", current2.runner, input.runner),
+        ...keepOrReplace("model", current2.model, input.model?.trim()),
+        ...keepOrReplace("effort", current2.effort, input.effort)
       }
     });
     return { ok: true };
@@ -3028,7 +3086,7 @@ var settingsRouter = router({
         }
       } catch {
       }
-      await new Promise((resolve4) => setTimeout(resolve4, 500));
+      await new Promise((resolve5) => setTimeout(resolve5, 500));
     }
   }),
   /**
@@ -3215,7 +3273,7 @@ import { z as z13 } from "zod";
 import { TRPCError as TRPCError9 } from "@trpc/server";
 import { execFile as execFile3, spawn as spawn2 } from "child_process";
 import { stat as stat2 } from "fs/promises";
-import { resolve, join as join4 } from "path";
+import { resolve as resolve2, join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 
 // ../server/src/services/user-config-manager.ts
@@ -3310,9 +3368,9 @@ async function getServiceCwd(serviceId) {
   return resolveCwd(await resolveWorkspaceCwd({ serviceId }));
 }
 async function isCommandAvailable(command) {
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     execFile3(whichCommand(), [command], { timeout: 5e3, windowsHide: true }, (err) => {
-      resolve4(!err);
+      resolve5(!err);
     });
   });
 }
@@ -3383,7 +3441,7 @@ var editorRouter = router({
       throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const expanded = input.path.replace(/^~(\/|$)/, `${process.env["HOME"] ?? "/tmp"}$1`).replace(/\$\{(\w+)\}|\$(\w+)/g, (_, a, b) => process.env[a || b] ?? "");
-    const resolvedPath = resolve(expanded || ".");
+    const resolvedPath = resolve2(expanded || ".");
     try {
       await stat2(resolvedPath);
     } catch (err) {
@@ -3690,7 +3748,7 @@ Rules:
   onStatusChange: protectedProcedure.input(z15.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
     const { agentId, cwd } = await resolveGitContext(input);
     const queue = [];
-    let resolve4 = null;
+    let resolve5 = null;
     let done = false;
     let unsubscribe;
     try {
@@ -3700,16 +3758,16 @@ Rules:
         { cwd },
         (data) => {
           queue.push(data);
-          if (resolve4) {
-            resolve4();
-            resolve4 = null;
+          if (resolve5) {
+            resolve5();
+            resolve5 = null;
           }
         },
         () => {
           done = true;
-          if (resolve4) {
-            resolve4();
-            resolve4 = null;
+          if (resolve5) {
+            resolve5();
+            resolve5 = null;
           }
         }
       );
@@ -3725,7 +3783,7 @@ Rules:
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve4 = r;
+            resolve5 = r;
           });
         }
       }
@@ -4073,21 +4131,21 @@ async function* tapBus(conversationId, signal) {
     }
     if (bus.done) return;
     if (signal.aborted) return;
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const onAbort = () => {
         bus.listeners.delete(notify);
-        resolve4();
+        resolve5();
       };
       const notify = () => {
         signal.removeEventListener("abort", onAbort);
-        resolve4();
+        resolve5();
       };
       bus.listeners.add(notify);
       signal.addEventListener("abort", onAbort, { once: true });
       if (cursor < bus.baseIndex + bus.buffer.length || bus.done || signal.aborted) {
         bus.listeners.delete(notify);
         signal.removeEventListener("abort", onAbort);
-        resolve4();
+        resolve5();
       }
     });
   }
@@ -4597,9 +4655,9 @@ async function runNodeCall(conversationId, node, systemContext, userMessage, run
       publish2({ type: "node_waiting_input", nodeId: node.id, question: result.tokenMessage });
       await readme?.(`- \u2753 [${formatTs()}] **${node.label}** \u2014 waiting for user input
 `);
-      const answer = await new Promise((resolve4, reject) => {
+      const answer = await new Promise((resolve5, reject) => {
         const key = pendingNodeKey(conversationId, node.id);
-        pendingNodeInputs.set(key, resolve4);
+        pendingNodeInputs.set(key, resolve5);
         signal.addEventListener("abort", () => {
           pendingNodeInputs.delete(key);
           reject(new Error("Aborted"));
@@ -5004,9 +5062,9 @@ ${outputs.get(node.id) ?? ""}`.trim();
         publish2({ type: "node_waiting_input", nodeId: node.id, question });
         await readme(`- \u2753 [${ts()}] **${node.label || node.id}** \u2014 waiting for user input
 `);
-        const answer = await new Promise((resolve4, reject) => {
+        const answer = await new Promise((resolve5, reject) => {
           const key = pendingNodeKey(conversationId, node.id);
-          pendingNodeInputs.set(key, resolve4);
+          pendingNodeInputs.set(key, resolve5);
           signal.addEventListener("abort", () => {
             pendingNodeInputs.delete(key);
             reject(new Error("Aborted"));
@@ -5559,21 +5617,21 @@ async function* tapJob(job, signal) {
       yield evt;
     }
     if (job.done || signal.aborted) return;
-    await new Promise((resolve4) => {
+    await new Promise((resolve5) => {
       const onAbort = () => {
         job.listeners.delete(notify);
-        resolve4();
+        resolve5();
       };
       const notify = () => {
         signal.removeEventListener("abort", onAbort);
-        resolve4();
+        resolve5();
       };
       job.listeners.add(notify);
       signal.addEventListener("abort", onAbort, { once: true });
       if (cursor < job.baseIndex + job.buffer.length || job.done || signal.aborted) {
         job.listeners.delete(notify);
         signal.removeEventListener("abort", onAbort);
-        resolve4();
+        resolve5();
       }
     });
   }
@@ -5725,9 +5783,9 @@ var diagnosticsRouter = router({
     try {
       while (!signal?.aborted) {
         if (queue.length === 0) {
-          await new Promise((resolve4) => {
-            wake = resolve4;
-            signal?.addEventListener("abort", () => resolve4(), { once: true });
+          await new Promise((resolve5) => {
+            wake = resolve5;
+            signal?.addEventListener("abort", () => resolve5(), { once: true });
           });
           wake = null;
           continue;
@@ -5799,11 +5857,395 @@ var diagnosticsRouter = router({
   })
 });
 
-// ../server/src/trpc/routers/kanban-queue.ts
+// ../server/src/trpc/routers/mcp-pairing.ts
+import { z as z20 } from "zod";
+import { TRPCError as TRPCError17 } from "@trpc/server";
+
+// ../server/src/services/mcp-pairing.ts
+import { createHash, randomBytes as randomBytes2, randomInt, randomUUID as randomUUID5, timingSafeEqual } from "crypto";
+import { readFile as readFile3 } from "fs/promises";
 import { z as z19 } from "zod";
+var REQUEST_TTL_MS = 2 * 60 * 1e3;
+var MCP_TOKEN_TTL = "15m";
+var FILE = "mcp-clients.json";
+var McpClientSchema = z19.object({
+  id: z19.string().uuid(),
+  name: z19.string().min(1).max(100),
+  cwd: z19.string().max(4096),
+  /** SHA-256 du secret, en hexadécimal. */
+  secretHash: z19.string().regex(/^[0-9a-f]{64}$/),
+  createdAt: z19.string().max(64)
+});
+var McpClientsFileSchema = z19.object({ clients: z19.array(McpClientSchema).max(500) });
+function hashSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+var McpPairing = class {
+  constructor(filePath, now = Date.now) {
+    this.filePath = filePath;
+    this.now = now;
+  }
+  requests = /* @__PURE__ */ new Map();
+  /**
+   * Relu à chaque accès, sans copie en mémoire. Plusieurs Runeya d'un poste
+   * partagent ce fichier : une copie mémoire ferait réécrire à l'une la liste
+   * d'avant l'accord donné par l'autre, et cacherait ses révocations. Le
+   * fichier tient en quelques lignes ; le relire coûte moins qu'un tel oubli.
+   */
+  async load() {
+    const path = await this.filePath();
+    let text;
+    try {
+      text = await readFile3(path, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return [];
+      throw err;
+    }
+    const unreadable = () => new Error(`${path} est illisible : les acc\xE8s MCP ne sont pas modifi\xE9s.`);
+    let raw;
+    try {
+      raw = JSON.parse(text);
+    } catch {
+      throw unreadable();
+    }
+    const parsed = McpClientsFileSchema.safeParse(raw);
+    if (!parsed.success) throw unreadable();
+    return parsed.data.clients;
+  }
+  async save(clients) {
+    await atomicWriteSecure(await this.filePath(), JSON.stringify({ clients }, null, 2));
+  }
+  sweep() {
+    for (const [id, r] of this.requests) {
+      if (this.now() - r.createdAt > REQUEST_TTL_MS) this.requests.delete(id);
+    }
+  }
+  toPublic(r) {
+    return { id: r.id, name: r.name, cwd: r.cwd, code: r.code, expiresAt: r.createdAt + REQUEST_TTL_MS };
+  }
+  /** Une demande d'accès. Refusée tant qu'une autre attend une réponse. */
+  request(name, cwd) {
+    this.sweep();
+    if ([...this.requests.values()].some((r2) => r2.status === "pending")) {
+      throw new Error("Une autre demande d'acc\xE8s attend d\xE9j\xE0 une r\xE9ponse dans Runeya.");
+    }
+    const r = {
+      id: randomUUID5(),
+      name,
+      cwd,
+      code: String(randomInt(0, 1e4)).padStart(4, "0"),
+      createdAt: this.now(),
+      status: "pending"
+    };
+    this.requests.set(r.id, r);
+    return this.toPublic(r);
+  }
+  /**
+   * Où en est une demande. Le secret n'est rendu qu'une fois : la demande est
+   * oubliée dès qu'il est remis.
+   */
+  status(requestId) {
+    this.sweep();
+    const r = this.requests.get(requestId);
+    if (!r) return { status: "expired" };
+    if (r.status === "approved") {
+      this.requests.delete(requestId);
+      return { status: "approved", secret: r.secret };
+    }
+    if (r.status === "denied") this.requests.delete(requestId);
+    return { status: r.status };
+  }
+  pending() {
+    this.sweep();
+    return [...this.requests.values()].filter((r) => r.status === "pending").map((r) => this.toPublic(r));
+  }
+  async decide(requestId, approve) {
+    this.sweep();
+    const r = this.requests.get(requestId);
+    if (!r || r.status !== "pending") throw new Error("Cette demande n'existe plus ou a expir\xE9.");
+    if (!approve) {
+      r.status = "denied";
+      return;
+    }
+    const id = randomUUID5();
+    const secret = `${id}.${randomBytes2(32).toString("hex")}`;
+    const clients = await this.load();
+    await this.save([...clients, {
+      id,
+      name: r.name,
+      cwd: r.cwd,
+      secretHash: hashSecret(secret),
+      createdAt: new Date(this.now()).toISOString()
+    }]);
+    r.status = "approved";
+    r.secret = secret;
+  }
+  /** Échange le secret d'un client appairé contre un jeton court. */
+  async exchange(secret) {
+    const id = secret.split(".")[0] ?? "";
+    const client = (await this.load()).find((c) => c.id === id);
+    const expected = Buffer.from(client?.secretHash ?? "0".repeat(64), "hex");
+    const match = timingSafeEqual(expected, Buffer.from(hashSecret(secret), "hex"));
+    if (!client || !match) throw new Error("Appairage inconnu ou r\xE9voqu\xE9.");
+    return signJwt({ mcpClientId: client.id, ttl: MCP_TOKEN_TTL });
+  }
+  /** Faux aussi quand le fichier est illisible : dans le doute, l'accès est refusé. */
+  async isPaired(clientId) {
+    return this.load().then((clients) => clients.some((c) => c.id === clientId), () => false);
+  }
+  async list() {
+    return (await this.load()).map(({ secretHash: _, ...rest }) => rest);
+  }
+  async revoke(clientId) {
+    const clients = await this.load();
+    await this.save(clients.filter((c) => c.id !== clientId));
+  }
+};
+var mcpPairing = new McpPairing(() => keyedFilePath(FILE));
+
+// ../server/src/trpc/routers/mcp-pairing.ts
+function asBadRequest(fn) {
+  return Promise.resolve().then(fn).catch((err) => {
+    throw new TRPCError17({ code: "BAD_REQUEST", message: err.message });
+  });
+}
+var mcpPairingRouter = router({
+  request: publicProcedure.input(z20.object({ name: z20.string().min(1).max(100), cwd: z20.string().max(4096) })).mutation(({ ctx, input }) => {
+    requireLoopback(ctx);
+    if (isCiMode()) {
+      throw new TRPCError17({
+        code: "PRECONDITION_FAILED",
+        message: "Runeya tourne en mode CI : l'appairage y est d\xE9sactiv\xE9. Passe une cl\xE9 d'API dans RUNEYA_API_TOKEN."
+      });
+    }
+    return asBadRequest(() => mcpPairing.request(input.name, input.cwd));
+  }),
+  status: publicProcedure.input(z20.object({ requestId: z20.string().uuid() })).query(({ ctx, input }) => {
+    requireLoopback(ctx);
+    return mcpPairing.status(input.requestId);
+  }),
+  exchange: publicProcedure.input(z20.object({ secret: z20.string().min(1).max(200) })).mutation(({ ctx, input }) => {
+    requireLoopback(ctx);
+    return mcpPairing.exchange(input.secret).then((token) => ({ token })).catch(() => {
+      throw new TRPCError17({ code: "UNAUTHORIZED", message: "Unknown or revoked MCP pairing." });
+    });
+  }),
+  pending: protectedProcedure.query(({ ctx }) => {
+    requireHuman(ctx);
+    return mcpPairing.pending();
+  }),
+  decide: protectedProcedure.input(z20.object({ requestId: z20.string().uuid(), approve: z20.boolean() })).mutation(({ ctx, input }) => {
+    requireHuman(ctx);
+    return asBadRequest(() => mcpPairing.decide(input.requestId, input.approve));
+  }),
+  clients: protectedProcedure.query(({ ctx }) => {
+    requireHuman(ctx);
+    return mcpPairing.list();
+  }),
+  revoke: protectedProcedure.input(z20.object({ id: z20.string().uuid() })).mutation(({ ctx, input }) => {
+    requireHuman(ctx);
+    return mcpPairing.revoke(input.id);
+  })
+});
+
+// ../server/src/trpc/routers/ai-clients.ts
+import { z as z21 } from "zod";
+import { TRPCError as TRPCError18 } from "@trpc/server";
+
+// ../server/src/services/ai-client-mcp.ts
+import { execFile as execFile4 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { mkdir as mkdir5, readFile as readFile4, realpath } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname4, join as join7 } from "path";
+var SERVER_NAME = "runeya";
+function mcpEntry(override = env.MCP_COMMAND ?? null, home = env.HOME_DIR, platform = process.platform) {
+  const [command, ...args] = override ? override.split(/\s+/) : ["runeya"];
+  const envPart = home ? { env: { RUNEYA_HOME: home } } : {};
+  if (platform === "win32" && command !== "node" && !/\.exe$/i.test(command)) {
+    return { command: "cmd", args: ["/c", command, ...args, "mcp"], ...envPart };
+  }
+  return { command, args: [...args, "mcp"], ...envPart };
+}
+function envFlags(flag, entry) {
+  return Object.entries(entry.env ?? {}).flatMap(([k, v]) => [flag, `${k}=${v}`]);
+}
+function vscodeUserDir(home) {
+  if (process.platform === "darwin") return join7(home, "Library", "Application Support", "Code", "User");
+  if (process.platform === "win32") return join7(process.env["APPDATA"] ?? join7(home, "AppData", "Roaming"), "Code", "User");
+  return join7(home, ".config", "Code", "User");
+}
+function claudeDesktopDir(home) {
+  if (process.platform === "darwin") return join7(home, "Library", "Application Support", "Claude");
+  if (process.platform === "win32") return join7(process.env["APPDATA"] ?? join7(home, "AppData", "Roaming"), "Claude");
+  return join7(home, ".config", "Claude");
+}
+var AI_CLIENTS = [
+  {
+    id: "claude-code",
+    label: "Claude Code",
+    kind: "cli",
+    binary: "claude",
+    configFile: (home) => join7(home, ".claude.json"),
+    isInstalled: (content) => {
+      try {
+        const servers2 = JSON.parse(content).mcpServers;
+        return Boolean(servers2 && SERVER_NAME in servers2);
+      } catch {
+        return false;
+      }
+    },
+    // `-e` prend plusieurs valeurs : placé avant le nom, il l'avalerait. `--` l'arrête.
+    addArgs: (e) => ["mcp", "add", "--scope", "user", SERVER_NAME, ...envFlags("-e", e), "--", e.command, ...e.args],
+    removeArgs: ["mcp", "remove", "--scope", "user", SERVER_NAME]
+  },
+  {
+    id: "codex",
+    label: "Codex",
+    kind: "cli",
+    binary: "codex",
+    configFile: (home) => join7(home, ".codex", "config.toml"),
+    isInstalled: (content) => new RegExp(`^\\s*\\[mcp_servers\\.${SERVER_NAME}\\]`, "m").test(content),
+    addArgs: (e) => ["mcp", "add", ...envFlags("--env", e), SERVER_NAME, "--", e.command, ...e.args],
+    removeArgs: ["mcp", "remove", SERVER_NAME]
+  },
+  { id: "cursor", label: "Cursor", kind: "json", detectDir: (h) => join7(h, ".cursor"), configFile: (h) => join7(h, ".cursor", "mcp.json") },
+  { id: "gemini", label: "Gemini CLI", kind: "json", detectDir: (h) => join7(h, ".gemini"), configFile: (h) => join7(h, ".gemini", "settings.json") },
+  {
+    id: "windsurf",
+    label: "Windsurf",
+    kind: "json",
+    detectDir: (h) => join7(h, ".codeium", "windsurf"),
+    configFile: (h) => join7(h, ".codeium", "windsurf", "mcp_config.json")
+  },
+  {
+    id: "claude-desktop",
+    label: "Claude Desktop",
+    kind: "json",
+    detectDir: claudeDesktopDir,
+    configFile: (h) => join7(claudeDesktopDir(h), "claude_desktop_config.json")
+  },
+  {
+    id: "vscode",
+    label: "VS Code",
+    kind: "json",
+    detectDir: vscodeUserDir,
+    configFile: (h) => join7(vscodeUserDir(h), "mcp.json"),
+    serversKey: "servers",
+    entryFields: { type: "stdio" }
+  }
+];
+async function readText(path) {
+  try {
+    return await readFile4(path, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function readJsonConfig(path) {
+  const text = await readText(path);
+  if (text === null || text.trim() === "") return {};
+  const parsed = JSON.parse(text);
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`${path} ne contient pas un objet JSON.`);
+  }
+  return parsed;
+}
+function servers(config, key = "mcpServers") {
+  const value = config[key];
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+async function setJsonEntry(path, present, entry = mcpEntry(), key = "mcpServers", entryFields = {}) {
+  const config = await readJsonConfig(path);
+  const current2 = config[key];
+  if (current2 !== void 0 && (!current2 || typeof current2 !== "object" || Array.isArray(current2))) {
+    throw new Error(`${path} : \xAB ${key} \xBB n'est pas un objet, le fichier n'est pas modifi\xE9.`);
+  }
+  const next = { ...servers(config, key) };
+  if (present) next[SERVER_NAME] = { ...entryFields, ...entry };
+  else delete next[SERVER_NAME];
+  const target = await realpath(path).catch(() => path);
+  await mkdir5(dirname4(target), { recursive: true });
+  await atomicWriteSecure(target, `${JSON.stringify({ ...config, [key]: next }, null, 2)}
+`);
+}
+function run(binary, args) {
+  const { command, args: fullArgs } = resolveCliInvocation(binary, args);
+  return new Promise((resolve5, reject) => {
+    execFile4(command, fullArgs, { timeout: 2e4, windowsHide: true }, (err, _stdout, stderr) => {
+      if (err) reject(new Error(`${binary} ${args.join(" ")} : ${String(stderr).trim() || err.message}`));
+      else resolve5();
+    });
+  });
+}
+async function isRuneyaMcpAvailable(entry = mcpEntry()) {
+  const { command, args } = resolveCliInvocation(entry.command, [...entry.args.slice(0, -1), "--help"]);
+  return new Promise((resolve5) => {
+    execFile4(command, args, { timeout: 1e4, windowsHide: true }, (err, stdout) => {
+      resolve5(!err && /^\s+mcp\s/m.test(String(stdout)));
+    });
+  });
+}
+async function isDetected(client, home) {
+  if (client.kind === "cli") return isCliAvailable(client.binary);
+  return existsSync2(client.detectDir(home));
+}
+async function isInstalled(client, home) {
+  if (client.kind === "cli") {
+    const content = await readText(client.configFile(home));
+    return content !== null && client.isInstalled(content);
+  }
+  try {
+    return SERVER_NAME in servers(await readJsonConfig(client.configFile(home)), client.serversKey);
+  } catch {
+    return false;
+  }
+}
+async function listAiClients(home = homedir3()) {
+  const [runeyaMcpAvailable, statuses] = await Promise.all([
+    isRuneyaMcpAvailable(),
+    Promise.all(AI_CLIENTS.map(async (client) => {
+      if (!await isDetected(client, home)) return null;
+      return { id: client.id, label: client.label, installed: await isInstalled(client, home), configFile: client.configFile(home) };
+    }))
+  ]);
+  return { runeyaMcpAvailable, clients: statuses.filter((s) => s !== null) };
+}
+async function setAiClientMcp(id, present, home = homedir3()) {
+  const client = AI_CLIENTS.find((c) => c.id === id);
+  if (!client) throw new Error(`Outil IA inconnu : ${id}`);
+  if (present && !await isRuneyaMcpAvailable()) {
+    const { command, args } = mcpEntry();
+    throw new Error(`La commande \xAB ${[command, ...args].join(" ")} \xBB est introuvable ou ne conna\xEEt pas \xAB mcp \xBB : installez une version de Runeya qui la fournit.`);
+  }
+  if (client.kind === "json") return setJsonEntry(client.configFile(home), present, mcpEntry(), client.serversKey, client.entryFields);
+  if (await isInstalled(client, home)) await run(client.binary, client.removeArgs);
+  if (present) await run(client.binary, client.addArgs(mcpEntry()));
+}
+
+// ../server/src/trpc/routers/ai-clients.ts
+var AiClientIdSchema = z21.enum(["claude-code", "codex", "cursor", "gemini", "windsurf", "claude-desktop", "vscode"]);
+var aiClientsRouter = router({
+  list: protectedProcedure.query(({ ctx }) => {
+    requireHuman(ctx);
+    return listAiClients();
+  }),
+  setInstalled: protectedProcedure.input(z21.object({ id: AiClientIdSchema, installed: z21.boolean() })).mutation(async ({ ctx, input }) => {
+    requireHuman(ctx);
+    try {
+      await setAiClientMcp(input.id, input.installed);
+    } catch (err) {
+      throw new TRPCError18({ code: "BAD_REQUEST", message: err.message });
+    }
+    return listAiClients();
+  })
+});
+
+// ../server/src/trpc/routers/kanban-queue.ts
+import { z as z22 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { EventEmitter as EventEmitter2 } from "events";
 var KanbanQueueService = class extends EventEmitter2 {
   items = [];
@@ -5831,7 +6273,7 @@ var KanbanQueueService = class extends EventEmitter2 {
       return { id: alreadyRunning.id, addedAt: alreadyRunning.startedAt, ...item };
     }
     const queueItem = {
-      id: randomUUID5(),
+      id: randomUUID6(),
       ...item,
       addedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
@@ -5859,9 +6301,9 @@ var KanbanQueueService = class extends EventEmitter2 {
     }
     const runIdx = this.running.findIndex((r) => r.id === itemId);
     if (runIdx >= 0) {
-      const run = this.running[runIdx];
-      abortScenario(run.conversationId);
-      activeSessionRegistry.kill(run.conversationId);
+      const run2 = this.running[runIdx];
+      abortScenario(run2.conversationId);
+      activeSessionRegistry.kill(run2.conversationId);
       this.running.splice(runIdx, 1);
       this.emit("changed");
       this.tick();
@@ -5871,9 +6313,9 @@ var KanbanQueueService = class extends EventEmitter2 {
   }
   stopAll() {
     this.items = [];
-    for (const run of this.running) {
-      abortScenario(run.conversationId);
-      activeSessionRegistry.kill(run.conversationId);
+    for (const run2 of this.running) {
+      abortScenario(run2.conversationId);
+      activeSessionRegistry.kill(run2.conversationId);
     }
     this.running = [];
     this.emit("changed");
@@ -5909,7 +6351,7 @@ var KanbanQueueService = class extends EventEmitter2 {
       this.tick();
       return;
     }
-    const companionByDefault = (await companionSettings()).enabledByDefault;
+    const companionDefaults = companionCreateDefaults(await companionSettings(), item.runner);
     const conv = await conversationStore.create(
       `Queue: ${card.title}`,
       !!item.runner,
@@ -5921,7 +6363,7 @@ var KanbanQueueService = class extends EventEmitter2 {
       void 0,
       item.projectId,
       item.orgId,
-      companionByDefault ? { companionEnabled: true } : void 0
+      Object.keys(companionDefaults).length > 0 ? companionDefaults : void 0
     );
     const cardContent = card.title + (card.markdown ? "\n\n" + card.markdown : "");
     if (item.scenarioId) {
@@ -5992,50 +6434,50 @@ var kanbanQueue = new KanbanQueueService();
 // ../server/src/trpc/routers/kanban-queue.ts
 var kanbanQueueRouter = router({
   getState: protectedProcedure.query(() => kanbanQueue.getState()),
-  add: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    cardId: z19.string().max(128),
-    runner: z19.enum(["claude-code", "codex"]).optional(),
-    model: z19.string().max(128).optional(),
-    scenarioId: z19.string().max(128).optional(),
+  add: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    runner: z22.enum(["claude-code", "codex"]).optional(),
+    model: z22.string().max(128).optional(),
+    scenarioId: z22.string().max(128).optional(),
     // Le projet ouvert quand la carte a été mise en file : la conversation
     // qui en naîtra lui appartient, plutôt que de rester orpheline et de
     // s'afficher dans tous les projets.
-    projectId: z19.string().max(128).optional(),
-    orgId: z19.string().max(128).nullable().optional()
+    projectId: z22.string().max(128).optional(),
+    orgId: z22.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
-  addColumn: protectedProcedure.input(z19.object({
-    boardId: z19.string().max(128),
-    columnId: z19.string().max(128),
+  addColumn: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    columnId: z22.string().max(128),
     // Les cartes visibles côté écran : une colonne filtrée n'envoie qu'elles.
-    cardIds: z19.array(z19.string().max(128)).max(5e3).optional(),
-    runner: z19.enum(["claude-code", "codex"]).optional(),
-    model: z19.string().max(128).optional(),
-    scenarioId: z19.string().max(128).optional(),
-    projectId: z19.string().max(128).optional(),
-    orgId: z19.string().max(128).nullable().optional()
+    cardIds: z22.array(z22.string().max(128)).max(5e3).optional(),
+    runner: z22.enum(["claude-code", "codex"]).optional(),
+    model: z22.string().max(128).optional(),
+    scenarioId: z22.string().max(128).optional(),
+    projectId: z22.string().max(128).optional(),
+    orgId: z22.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
   }),
-  remove: protectedProcedure.input(z19.object({ itemId: z19.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
+  remove: protectedProcedure.input(z22.object({ itemId: z22.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
   stopAll: protectedProcedure.mutation(() => {
     kanbanQueue.stopAll();
     return { ok: true };
   }),
-  setMaxConcurrent: protectedProcedure.input(z19.object({ max: z19.number().int().min(1).max(20) })).mutation(({ input }) => {
+  setMaxConcurrent: protectedProcedure.input(z22.object({ max: z22.number().int().min(1).max(20) })).mutation(({ input }) => {
     kanbanQueue.setMaxConcurrent(input.max);
     return kanbanQueue.getState();
   }),
   onChanged: protectedProcedure.subscription(async function* () {
     const queue = [];
-    let resolve4 = null;
+    let resolve5 = null;
     const handler = () => {
       if (queue.length >= 50) queue.shift();
       queue.push(kanbanQueue.getState());
-      if (resolve4) {
-        resolve4();
-        resolve4 = null;
+      if (resolve5) {
+        resolve5();
+        resolve5 = null;
       }
     };
     kanbanQueue.on("changed", handler);
@@ -6046,7 +6488,7 @@ var kanbanQueueRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve4 = r;
+            resolve5 = r;
           });
         }
       }
@@ -6057,12 +6499,12 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
-import { mkdir as mkdir5, readdir, rm, stat as stat3, writeFile as writeFile4 } from "fs/promises";
-import { createHash } from "crypto";
+import { mkdir as mkdir6, readdir, rm, stat as stat3, writeFile as writeFile4 } from "fs/promises";
+import { createHash as createHash2 } from "crypto";
 import { tmpdir } from "os";
-import { join as join7 } from "path";
-import { z as z20 } from "zod";
-import { TRPCError as TRPCError17 } from "@trpc/server";
+import { join as join8 } from "path";
+import { z as z23 } from "zod";
+import { TRPCError as TRPCError19 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -6103,14 +6545,14 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join7(tmpdir(), "runeya-kanban-attachments");
+  return join8(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
     for (const name of await readdir(dir)) {
-      const path = join7(dir, name);
+      const path = join8(dir, name);
       const info = await stat3(path).catch(() => null);
       if (info && info.mtimeMs < cutoff) await rm(path, { force: true });
     }
@@ -6118,14 +6560,14 @@ async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join7(machineRoot(), "kanban-attachments")];
+  return [attachmentCacheDir(), join8(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
-      await mkdir5(dir, { recursive: true });
-      const path = join7(dir, safeLocalName(id, name));
+      await mkdir6(dir, { recursive: true });
+      const path = join8(dir, safeLocalName(id, name));
       await writeFile4(path, body);
       void purgeStaleAttachments(dir);
       return path;
@@ -6133,13 +6575,13 @@ async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
       refusals.push(`${dir} (${err instanceof Error ? err.message : String(err)})`);
     }
   }
-  throw new TRPCError17({
+  throw new TRPCError19({
     code: "INTERNAL_SERVER_ERROR",
     message: `Impossible d'\xE9crire la pi\xE8ce jointe sur cette machine. Emplacements essay\xE9s : ${refusals.join(" ; ")}. V\xE9rifiez les droits d'\xE9criture, ou l'espace disque.`
   });
 }
 function safeLocalName(id, name) {
-  const base = createHash("sha256").update(id).digest("hex").slice(0, 32);
+  const base = createHash2("sha256").update(id).digest("hex").slice(0, 32);
   const ext = /\.([A-Za-z0-9]{1,12})$/.exec(name)?.[1];
   return ext ? `${base}.${ext.toLowerCase()}` : base;
 }
@@ -6154,9 +6596,9 @@ var kanbanRouter = router({
    * card graph, so listing them in full would be megabytes to answer "which
    * boards exist?". Use `getBoard` for the cards of one.
    */
-  listBoards: protectedProcedure.input(z20.object({
-    includeArchived: z20.boolean().optional(),
-    organizationId: z20.string().max(128).optional()
+  listBoards: protectedProcedure.input(z23.object({
+    includeArchived: z23.boolean().optional(),
+    organizationId: z23.string().max(128).optional()
   }).optional()).query(async ({ input }) => {
     const { organizationId, boards } = await kanbanStore.list(
       input?.includeArchived ?? false,
@@ -6182,7 +6624,7 @@ var kanbanRouter = router({
     };
   }),
   /** One board: its columns, and the cards in each. */
-  getBoard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128) })).query(async ({ input }) => {
+  getBoard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => {
     const board = await kanbanStore.get(input.boardId);
     if (!board) return { board: null };
     const { links } = await kanbanStore.cardLinks(input.boardId);
@@ -6221,12 +6663,12 @@ var kanbanRouter = router({
    * organization — or one board when `boardId` is given. Archived boards are
    * left out: they are what the team decided to stop looking at.
    */
-  searchCards: protectedProcedure.input(z20.object({
-    query: z20.string().max(256).optional(),
-    createdBy: z20.string().min(1).max(200).optional(),
-    boardId: z20.string().max(128).optional(),
-    limit: z20.number().int().min(1).max(100).optional(),
-    organizationId: z20.string().max(128).optional()
+  searchCards: protectedProcedure.input(z23.object({
+    query: z23.string().max(256).optional(),
+    createdBy: z23.string().min(1).max(200).optional(),
+    boardId: z23.string().max(128).optional(),
+    limit: z23.number().int().min(1).max(100).optional(),
+    organizationId: z23.string().max(128).optional()
   }).refine((i) => !!i.query?.trim() || !!i.createdBy?.trim(), { message: "query or createdBy is required." })).query(async ({ input }) => {
     return kanbanStore.searchCards(input);
   }),
@@ -6234,10 +6676,10 @@ var kanbanRouter = router({
    * Les conversations de support liées à une carte, avec leur fil — ce que
    * le client a écrit à l'équipe, séparé des commentaires de la carte.
    */
-  getCardConversations: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    limit: z20.number().int().min(1).max(500).optional()
+  getCardConversations: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    limit: z23.number().int().min(1).max(500).optional()
   })).query(async ({ input }) => {
     const conversations = await kanbanStore.cardConversations(input.boardId, input.cardId);
     const limit = input.limit ?? 100;
@@ -6250,13 +6692,13 @@ var kanbanRouter = router({
     };
   }),
   /** Chercher une conversation chez les fournisseurs de l'organisation (lecture seule côté fournisseur). */
-  searchConversations: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), query: z20.string().trim().min(1).max(500) })).query(async ({ input }) => ({ results: await kanbanStore.searchConversations(input.boardId, input.query) })),
+  searchConversations: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), query: z23.string().trim().min(1).max(500) })).query(async ({ input }) => ({ results: await kanbanStore.searchConversations(input.boardId, input.query) })),
   /** Lier une conversation trouvée à une carte. N'écrit rien chez le fournisseur. */
-  linkConversation: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    connectionId: z20.string().max(128),
-    externalId: z20.string().max(128)
+  linkConversation: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    connectionId: z23.string().max(128),
+    externalId: z23.string().max(128)
   })).mutation(async ({ input }) => ({ conversations: await kanbanStore.linkConversation(input) })),
   /**
    * Le fil de commentaires d'une carte, relu à la demande.
@@ -6267,10 +6709,10 @@ var kanbanRouter = router({
    * qu'un `commentCount`, et rien n'en donnait le texte. Cette route est la
    * relecture, pour une seule carte : c'est le journal qui pèse, pas le reste.
    */
-  getCardComments: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    limit: z20.number().int().min(1).max(200).optional()
+  getCardComments: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    limit: z23.number().int().min(1).max(200).optional()
   })).query(async ({ input }) => {
     const history = await kanbanStore.cardHistory(input.boardId, input.cardId);
     const comments = history.filter((e) => e.type === "comment");
@@ -6299,18 +6741,18 @@ var kanbanRouter = router({
    * `getBoard` en donne déjà l'essentiel carte par carte ; cette route sert
    * quand c'est l'arbre lui-même qu'on veut, dates et auteurs compris.
    */
-  getCardLinks: protectedProcedure.input(z20.object({ boardId: z20.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
+  getCardLinks: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
   /**
    * Rattacher une carte à une carte parente, ou l'en détacher.
    *
    * Sans `parentCardId`, le lien est retiré. Le parent peut vivre sur un autre
    * tableau : `parentBoardId` le désigne alors, sinon c'est celui de la carte.
    */
-  setCardParent: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    parentCardId: z20.string().max(128).optional(),
-    parentBoardId: z20.string().max(128).optional()
+  setCardParent: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    parentCardId: z23.string().max(128).optional(),
+    parentBoardId: z23.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardParent(
       input.boardId,
@@ -6318,7 +6760,7 @@ var kanbanRouter = router({
       input.parentCardId ? { boardId: input.parentBoardId ?? input.boardId, cardId: input.parentCardId } : null
     );
     if (!ok) {
-      throw new TRPCError17({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
     }
     return { ok: true };
   }),
@@ -6327,48 +6769,48 @@ var kanbanRouter = router({
    * `boardId` est le tableau où on la pose (ou d'où on la retire) ; la carte
    * reste sur son tableau d'origine.
    */
-  getCardPlacements: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).query(async ({ input }) => ({ placements: await kanbanStore.cardPlacements(input.boardId, input.cardId) })),
-  placeCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128), column: z20.string().min(1).max(200) })).mutation(async ({ input }) => {
+  getCardPlacements: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), cardId: z23.string().max(128) })).query(async ({ input }) => ({ placements: await kanbanStore.cardPlacements(input.boardId, input.cardId) })),
+  placeCard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), cardId: z23.string().max(128), column: z23.string().min(1).max(200) })).mutation(async ({ input }) => {
     const res = await kanbanStore.placeCard(input.boardId, input.cardId, input.column);
     if (!res.ok) {
-      throw new TRPCError17({
+      throw new TRPCError19({
         code: "BAD_REQUEST",
         message: res.reason ?? "The cloud refused the placement (unknown card or column, archived card, or already on this board)."
       });
     }
     return { ok: true };
   }),
-  unplaceCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).mutation(async ({ input }) => {
+  unplaceCard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), cardId: z23.string().max(128) })).mutation(async ({ input }) => {
     if (!await kanbanStore.unplaceCard(input.boardId, input.cardId)) {
-      throw new TRPCError17({ code: "NOT_FOUND", message: "This card is not placed on this board." });
+      throw new TRPCError19({ code: "NOT_FOUND", message: "This card is not placed on this board." });
     }
     return { ok: true };
   }),
-  moveCard: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    targetColumn: z20.string().max(256)
+  moveCard: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    targetColumn: z23.string().max(256)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "move_card", columnTitle: input.targetColumn }
     ]);
     return { ok: true };
   }),
-  addComment: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    comment: z20.string().max(1e5)
+  addComment: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    comment: z23.string().max(1e5)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "add_comment", comment: input.comment }
     ]);
     return { ok: true };
   }),
-  addCard: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    column: z20.string().max(256),
-    title: z20.string().max(512),
-    content: z20.string().max(2e4).optional()
+  addCard: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    column: z23.string().max(256),
+    title: z23.string().max(512),
+    content: z23.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     await executeKanbanBoardCommands(input.boardId, [
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
@@ -6381,11 +6823,34 @@ var kanbanRouter = router({
    * `getBoard` rapatrie le tableau entier pour n'en regarder qu'une ; et il ne
    * porte pas les cartes rangées. Une carte s'adresse par son identifiant.
    */
-  getCard: protectedProcedure.input(z20.object({ boardId: z20.string().max(128), cardId: z20.string().max(128) })).query(async ({ input }) => {
+  getCard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), cardId: z23.string().max(128) })).query(async ({ input }) => {
     const found = await kanbanStore.card(input.boardId, input.cardId);
     if (!found) throw new Error(`Carte ${input.cardId} introuvable sur le tableau ${input.boardId}.`);
     return { ...summarizeCard(found.card, input.boardId, ""), columnId: found.columnId };
   }),
+  /**
+   * Le contexte d'une carte pour un outil IA lancé hors de Runeya : le même
+   * texte qu'une session lancée depuis la carte reçoit, construit au même
+   * endroit (`buildKanbanCardPrompt`). L'outil le reçoit comme un message, pas
+   * comme une consigne système : il guide le travail sans en avoir la force.
+   */
+  cardContext: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    projectId: z23.string().max(128).optional(),
+    orgId: z23.string().max(128).optional()
+  })).query(async ({ input }) => {
+    const board = await kanbanStore.get(input.boardId);
+    if (!board) throw new TRPCError19({ code: "NOT_FOUND", message: `Tableau ${input.boardId} introuvable.` });
+    if (!board.columns.some((col) => col.cards.some((c) => c.id === input.cardId))) {
+      throw new TRPCError19({ code: "NOT_FOUND", message: `Carte ${input.cardId} introuvable sur le tableau ${input.boardId}.` });
+    }
+    const scope = {
+      ...input.projectId ? { projectId: input.projectId } : {},
+      ...input.orgId ? { orgId: input.orgId } : {}
+    };
+    return { context: await buildKanbanCardPrompt(board, input.cardId, scope) };
+  }),
   /**
    * Modifier une carte.
    *
@@ -6395,16 +6860,16 @@ var kanbanRouter = router({
    * Un champ absent n'est pas touché ; `null` l'efface. La distinction compte —
    * changer un titre ne doit pas vider une couleur.
    */
-  updateCard: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    title: z20.string().min(1).max(512).optional(),
-    content: z20.string().max(1e5).optional(),
-    priority: z20.number().int().min(1).max(10).nullable().optional(),
-    color: z20.string().max(32).nullable().optional(),
-    groups: z20.array(z20.string().min(1).max(60)).max(30).optional(),
-    deadline: z20.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
-    assignees: z20.array(z20.string().max(128)).max(50).optional()
+  updateCard: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    title: z23.string().min(1).max(512).optional(),
+    content: z23.string().max(1e5).optional(),
+    priority: z23.number().int().min(1).max(10).nullable().optional(),
+    color: z23.string().max(32).nullable().optional(),
+    groups: z23.array(z23.string().min(1).max(60)).max(30).optional(),
+    deadline: z23.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
+    assignees: z23.array(z23.string().max(128)).max(50).optional()
   })).mutation(async ({ input }) => {
     const { boardId, cardId, content, ...rest } = input;
     const patch = { ...rest };
@@ -6415,10 +6880,10 @@ var kanbanRouter = router({
     return summarizeCard(card, boardId, "");
   }),
   /** Ranger une carte, ou la reprendre. */
-  setCardArchived: protectedProcedure.input(z20.object({
-    boardId: z20.string().max(128),
-    cardId: z20.string().max(128),
-    archived: z20.boolean()
+  setCardArchived: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    archived: z23.boolean()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardArchived(input.boardId, input.cardId, input.archived);
     if (!ok) throw new Error(`La carte ${input.cardId} n'a pas pu \xEAtre ${input.archived ? "archiv\xE9e" : "reprise"}.`);
@@ -6430,48 +6895,48 @@ var kanbanRouter = router({
    * Sans cette liste, assigner revient à deviner un identifiant — et l'agent
    * n'a aucun moyen de le trouver.
    */
-  listMembers: protectedProcedure.input(z20.object({ organizationId: z20.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
+  listMembers: protectedProcedure.input(z23.object({ organizationId: z23.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
   /**
    * Fetch one card attachment from the cloud and drop it on this machine, so an
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z20.object({
-    attachmentId: z20.string().max(128),
+  downloadAttachment: protectedProcedure.input(z23.object({
+    attachmentId: z23.string().max(128),
     // La pièce jointe appartient à une organisation : la nommer dit sous quel
     // compte la demander.
-    orgId: z20.string().max(128).optional(),
+    orgId: z23.string().max(128).optional(),
     // À défaut, le tableau d'où vient la carte suffit : il désigne un compte
     // comme le fait n'importe quel autre appel du kanban. Sans lui, la route
     // retombait sur le compte unique du poste et refusait de servir dès qu'il
     // y en avait plusieurs — alors que l'agent, qui n'a qu'un identifiant de
     // fichier, n'avait aucun moyen de nommer l'organisation.
-    boardId: z20.string().max(128).optional()
+    boardId: z23.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
-      throw new TRPCError17({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
     const res = await cloudFetch2(`/api/kanban/file/${id}`, {
       timeoutMs: 12e4,
       accountId: await attachmentScope(input)
     });
     if (res.status === 404) {
-      throw new TRPCError17({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+      throw new TRPCError19({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
     if (!res.ok) {
-      throw new TRPCError17({
+      throw new TRPCError19({
         code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
         message: `Cloud refused the attachment (HTTP ${res.status})`
       });
     }
     const declared = Number(res.headers.get("content-length") ?? 0);
     if (declared > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const body = Buffer.from(await res.arrayBuffer());
     if (body.length > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError17({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const contentType = res.headers.get("content-type") ?? "application/octet-stream";
     const disposition = res.headers.get("content-disposition") ?? "";
@@ -6483,21 +6948,21 @@ var kanbanRouter = router({
 });
 
 // ../server/src/trpc/routers/terminal.ts
-import { z as z21 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
+import { z as z24 } from "zod";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
-  create: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    cwd: z21.string().max(512).optional(),
+  create: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    cwd: z24.string().max(512).optional(),
     /** Anchors the terminal when no explicit cwd is given. */
-    serviceId: z21.string().max(128).optional(),
-    projectId: z21.string().max(128).optional(),
+    serviceId: z24.string().max(128).optional(),
+    projectId: z24.string().max(128).optional(),
     /** L'organisation du projet : un id seul peut en nommer un par organisation. */
-    orgId: z21.string().max(128).nullable().optional(),
-    cols: z21.number().int().min(1).max(512).optional(),
-    rows: z21.number().int().min(1).max(256).optional(),
-    title: z21.string().max(128).optional()
+    orgId: z24.string().max(128).nullable().optional(),
+    cols: z24.number().int().min(1).max(512).optional(),
+    rows: z24.number().int().min(1).max(256).optional(),
+    title: z24.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
@@ -6518,17 +6983,17 @@ var terminalRouter = router({
     return result;
   }),
   /** Les sessions PTY encore vivantes sur l'agent (onglets à retrouver) */
-  list: protectedProcedure.input(z21.object({ agentId: z21.string().max(128) })).query(async ({ input }) => {
+  list: protectedProcedure.input(z24.object({ agentId: z24.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "terminal.list"
     );
   }),
   /** Renommer un onglet */
-  rename: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    sessionId: z21.string().max(128),
-    title: z21.string().max(128)
+  rename: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    sessionId: z24.string().max(128),
+    title: z24.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6538,10 +7003,10 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Send keystrokes / data to a PTY session */
-  write: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    sessionId: z21.string().max(128),
-    data: z21.string().max(65536)
+  write: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    sessionId: z24.string().max(128),
+    data: z24.string().max(65536)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6551,11 +7016,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Resize the PTY */
-  resize: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    sessionId: z21.string().max(128),
-    cols: z21.number().int().min(1).max(512),
-    rows: z21.number().int().min(1).max(256)
+  resize: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    sessionId: z24.string().max(128),
+    cols: z24.number().int().min(1).max(512),
+    rows: z24.number().int().min(1).max(256)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6565,9 +7030,9 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Destroy a PTY session */
-  destroy: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    sessionId: z21.string().max(128)
+  destroy: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    sessionId: z24.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -6577,14 +7042,14 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Stream PTY output — proxied via AgentWSBridge dynamic subscription */
-  onData: protectedProcedure.input(z21.object({
-    agentId: z21.string().max(128),
-    sessionId: z21.string().max(128),
+  onData: protectedProcedure.input(z24.object({
+    agentId: z24.string().max(128),
+    sessionId: z24.string().max(128),
     /** Rejouer l'historique de la session avant le flux temps réel. */
-    replay: z21.boolean().optional()
+    replay: z24.boolean().optional()
   })).subscription(async function* ({ input }) {
     const queue = [];
-    let resolve4 = null;
+    let resolve5 = null;
     let done = false;
     let unsubscribe;
     try {
@@ -6594,21 +7059,21 @@ var terminalRouter = router({
         { sessionId: input.sessionId, replay: input.replay },
         (data) => {
           if (typeof data === "string") queue.push(data);
-          if (resolve4) {
-            resolve4();
-            resolve4 = null;
+          if (resolve5) {
+            resolve5();
+            resolve5 = null;
           }
         },
         () => {
           done = true;
-          if (resolve4) {
-            resolve4();
-            resolve4 = null;
+          if (resolve5) {
+            resolve5();
+            resolve5 = null;
           }
         }
       );
     } catch (err) {
-      throw new TRPCError18({
+      throw new TRPCError20({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -6619,7 +7084,7 @@ var terminalRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve4 = r;
+            resolve5 = r;
           });
         }
       }
@@ -6630,27 +7095,27 @@ var terminalRouter = router({
 });
 
 // ../server/src/trpc/routers/utility.ts
-import { z as z22 } from "zod";
+import { z as z25 } from "zod";
 var MAX_WAIT_MS = 5 * 60 * 1e3;
 var utilityRouter = router({
-  wait: protectedProcedure.input(z22.object({
-    ms: z22.number().int().min(0).max(MAX_WAIT_MS)
+  wait: protectedProcedure.input(z25.object({
+    ms: z25.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
-    await new Promise((resolve4) => setTimeout(resolve4, input.ms));
+    await new Promise((resolve5) => setTimeout(resolve5, input.ms));
     return { waited: input.ms };
   })
 });
 
 // ../server/src/trpc/routers/wiki.ts
-import { z as z23 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
-import { readFile as readFile3, readdir as readdir2, stat as stat4, realpath, writeFile as writeFile5, mkdir as mkdir6, rename, rm as rm2 } from "fs/promises";
-import { resolve as resolvePath, join as join8, relative as relative2, sep, dirname as dirname4 } from "path";
-var SCOPE_SCHEMA = z23.union([
-  z23.literal("global"),
-  z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+import { z as z26 } from "zod";
+import { TRPCError as TRPCError21 } from "@trpc/server";
+import { readFile as readFile5, readdir as readdir2, stat as stat4, realpath as realpath2, writeFile as writeFile5, mkdir as mkdir7, rename, rm as rm2 } from "fs/promises";
+import { resolve as resolvePath, join as join9, relative as relative2, sep, dirname as dirname5 } from "path";
+var SCOPE_SCHEMA = z26.union([
+  z26.literal("global"),
+  z26.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
 ]);
-var REL_PATH_SCHEMA = z23.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+var REL_PATH_SCHEMA = z26.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
   message: "Path must be a relative path without traversal"
 });
 var MAX_FILES = 500;
@@ -6670,36 +7135,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "target",
   "out"
 ]);
-var DocsEntrySchema = z23.lazy(() => z23.union([
-  z23.object({ type: z23.literal("file"), name: z23.string(), path: z23.string() }),
-  z23.object({ type: z23.literal("dir"), name: z23.string(), path: z23.string(), children: z23.array(DocsEntrySchema) })
+var DocsEntrySchema = z26.lazy(() => z26.union([
+  z26.object({ type: z26.literal("file"), name: z26.string(), path: z26.string() }),
+  z26.object({ type: z26.literal("dir"), name: z26.string(), path: z26.string(), children: z26.array(DocsEntrySchema) })
 ]));
 async function resolveScope(scope) {
   if (scope === "global") {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError19({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir6(dataDirAbs, { recursive: true });
-    const base = dirname4(await realpath(dataDirAbs));
+    await mkdir7(dataDirAbs, { recursive: true });
+    const base = dirname5(await realpath2(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep).startsWith(base + sep)) {
-      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir6(target, { recursive: true });
-    const root = await realpath(target);
+    await mkdir7(target, { recursive: true });
+    const root = await realpath2(target);
     if (root !== base && !(root + sep).startsWith(base + sep)) {
-      throw new TRPCError19({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
   return { mode: "agent", agentId, cwd };
 }
@@ -6715,7 +7180,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries2) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join8(dir, e.name);
+    const abs = join9(dir, e.name);
     const rel = relative2(root, abs).split(sep).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -6734,35 +7199,35 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError19({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError21({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
     let real;
     try {
-      real = await realpath(target);
+      real = await realpath2(target);
     } catch {
-      throw new TRPCError19({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError21({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep).startsWith(root + sep)) {
-      throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
-  const parent = dirname4(target);
+  const parent = dirname5(target);
   let realParent;
   try {
-    realParent = await realpath(parent);
+    realParent = await realpath2(parent);
   } catch {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep).startsWith(root + sep)) {
-    throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
 var wikiRouter = router({
-  list: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA })).output(z23.object({ root: z23.string(), entries: z23.array(DocsEntrySchema), truncated: z23.boolean() })).query(async ({ input }) => {
+  list: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).output(z26.object({ root: z26.string(), entries: z26.array(DocsEntrySchema), truncated: z26.boolean() })).query(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
@@ -6771,9 +7236,9 @@ var wikiRouter = router({
     const entries2 = await walkLocal(target.root, target.root, 0, counter);
     return { root: target.root, entries: entries2, truncated: counter.n >= MAX_FILES };
   }),
-  read: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z23.object({ path: z23.string(), content: z23.string() })).query(async ({ input }) => {
+  read: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z26.object({ path: z26.string(), content: z26.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -6781,27 +7246,27 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
     const s = await stat4(file);
-    if (!s.isFile()) throw new TRPCError19({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
-    const content = await readFile3(file, "utf-8");
+    if (!s.isFile()) throw new TRPCError21({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError21({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    const content = await readFile5(file, "utf-8");
     return { path: input.path, content };
   }),
-  write: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z23.string().max(5e6) })).mutation(async ({ input }) => {
+  write: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z26.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir6(dirname4(file), { recursive: true });
+    await mkdir7(dirname5(file), { recursive: true });
     await writeFile5(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
-  createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createFile: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError19({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -6810,24 +7275,24 @@ var wikiRouter = router({
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
       await stat4(file);
-      throw new TRPCError19({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      throw new TRPCError21({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError19) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir6(dirname4(file), { recursive: true });
+    await mkdir7(dirname5(file), { recursive: true });
     await writeFile5(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
-  createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createDir: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir6(dir, { recursive: true });
+    await mkdir7(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
-  rename: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  rename: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
@@ -6836,34 +7301,34 @@ var wikiRouter = router({
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
       await stat4(to);
-      throw new TRPCError19({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      throw new TRPCError21({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError19) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir6(dirname4(to), { recursive: true });
+    await mkdir7(dirname5(to), { recursive: true });
     await rename(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
-  ensureRoot: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+  ensureRoot: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
     if (input.scope === "global") {
       await resolveScope("global");
       return { ok: true };
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
-  delete: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError19({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    if (fp === target.root) throw new TRPCError21({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
     await rm2(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
@@ -6878,19 +7343,21 @@ var configRouter = router({
   /** How this instance was launched, and where it answers. */
   app: publicProcedure.query(() => ({
     fromDesktop: env.FROM_DESKTOP,
-    port: env.PORT
+    port: env.PORT,
+    /** Projet figé par `--project`, ou null. */
+    projectId: env.PROJECT_ID
   }))
 });
 
 // ../server/src/trpc/routers/cloud-sync.ts
-import { z as z24 } from "zod";
-import { TRPCError as TRPCError20 } from "@trpc/server";
+import { z as z27 } from "zod";
+import { TRPCError as TRPCError22 } from "@trpc/server";
 
 // ../server/src/services/org-sync-scope.ts
 import { access } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function isMaterialized(root) {
-  return access(join9(root, "project.json")).then(() => true, () => false);
+  return access(join10(root, "project.json")).then(() => true, () => false);
 }
 async function orgsToSync() {
   const [stamps, stampedAccounts, accounts] = await Promise.all([
@@ -6965,23 +7432,23 @@ async function reconcileOrgCanary(orgId) {
 }
 
 // ../server/src/services/cloud-sync-bridge.ts
-import { randomUUID as randomUUID7 } from "crypto";
-import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
+import { randomUUID as randomUUID8 } from "crypto";
+import { mkdir as mkdir8, rm as rm3 } from "fs/promises";
 import * as Y2 from "yjs";
 
 // ../server/src/services/sync-doc-cache.ts
 import { readFileSync as readFileSync2, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
-import { readFile as readFile4 } from "fs/promises";
-import { dirname as dirname5, join as join10 } from "path";
-import { randomUUID as randomUUID6 } from "crypto";
+import { readFile as readFile6 } from "fs/promises";
+import { dirname as dirname6, join as join11 } from "path";
+import { randomUUID as randomUUID7 } from "crypto";
 import * as Y from "yjs";
-var FILE = "sync-doc.bin";
+var FILE2 = "sync-doc.bin";
 function cachePath(orgId) {
-  return join10(orgVaultRoot(orgId), FILE);
+  return join11(orgVaultRoot(orgId), FILE2);
 }
 async function readSyncDoc(orgId) {
   try {
-    return new Uint8Array(await readFile4(cachePath(orgId)));
+    return new Uint8Array(await readFile6(cachePath(orgId)));
   } catch {
     return null;
   }
@@ -7004,8 +7471,8 @@ function writeSyncDocSync(orgId, state) {
     existing = new Uint8Array(readFileSync2(path));
   } catch {
   }
-  mkdirSync(dirname5(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.${randomUUID6()}.tmp`;
+  mkdirSync(dirname6(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomUUID7()}.tmp`;
   try {
     writeFileSync(tmp, mergeWith(existing, state), { mode: 384 });
     renameSync(tmp, path);
@@ -7058,7 +7525,7 @@ var OrgSyncConnection = class {
   services = getCollection(this.doc, "services");
   environments = getCollection(this.doc, "environments");
   logParsers = getCollection(this.doc, PARSERS);
-  conn = randomUUID7();
+  conn = randomUUID8();
   link;
   stopped = false;
   initializing = true;
@@ -7108,8 +7575,8 @@ var OrgSyncConnection = class {
    * Réglée quand le document tient l'état d'ouverture du cloud — ou quand il ne
    * l'aura pas : session refusée, app trop ancienne, connexion arrêtée.
    */
-  opened = new Promise((resolve4) => {
-    this.markOpened = resolve4;
+  opened = new Promise((resolve5) => {
+    this.markOpened = resolve5;
   });
   /** Store applications started by remote events and not finished yet. */
   applying = /* @__PURE__ */ new Set();
@@ -7491,7 +7958,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir7(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir8(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -7970,8 +8437,8 @@ var CloudSyncBridge = class {
     let timer;
     await Promise.race([
       conn.opened,
-      new Promise((resolve4) => {
-        timer = setTimeout(resolve4, timeoutMs);
+      new Promise((resolve5) => {
+        timer = setTimeout(resolve5, timeoutMs);
       })
     ]);
     clearTimeout(timer);
@@ -7988,9 +8455,9 @@ var CloudSyncBridge = class {
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename2, stat as stat5 } from "fs/promises";
-import { join as join11 } from "path";
-import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
+import { readdir as readdir3, readFile as readFile7, writeFile as writeFile6, mkdir as mkdir9, copyFile, rename as rename2, stat as stat5 } from "fs/promises";
+import { dirname as dirname7, join as join12 } from "path";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes3 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 function isAgentTriplet(value) {
   const hex = (v) => typeof v === "string" && /^[0-9a-f]+$/i.test(v);
@@ -8002,7 +8469,7 @@ function decryptTriplet(key, t) {
   return decipher.update(t.encrypted, "hex", "utf-8") + decipher.final("utf-8");
 }
 function encryptTriplet(key, plaintext) {
-  const iv = randomBytes2(16);
+  const iv = randomBytes3(16);
   const cipher = createCipheriv2(ALGORITHM, key, iv);
   const encrypted = cipher.update(plaintext, "utf-8", "hex") + cipher.final("hex");
   return { encrypted, iv: iv.toString("hex"), authTag: cipher.getAuthTag().toString("hex") };
@@ -8044,14 +8511,22 @@ async function rootsOfOrg(orgId) {
   }
   return Array.from(roots);
 }
-async function jsonFilesIn(root) {
+var ENCRYPTED_SUBDIRS = [CONVERSATIONS_DIRNAME];
+async function jsonNamesIn(dir) {
   try {
-    const entries2 = await readdir3(root, { withFileTypes: true });
+    const entries2 = await readdir3(dir, { withFileTypes: true });
     return entries2.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
   } catch {
     return [];
   }
 }
+async function jsonFilesIn(root) {
+  const names = await jsonNamesIn(root);
+  for (const sub of ENCRYPTED_SUBDIRS) {
+    names.push(...(await jsonNamesIn(join12(root, sub))).map((n) => join12(sub, n)));
+  }
+  return names;
+}
 async function exists(path) {
   return stat5(path).then(() => true, () => false);
 }
@@ -8086,10 +8561,10 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const touchedRoots = /* @__PURE__ */ new Set();
   for (const vaultRoot of await rootsOfOrg(orgId)) {
     for (const name of await jsonFilesIn(vaultRoot)) {
-      const path = join11(vaultRoot, name);
+      const path = join12(vaultRoot, name);
       let parsed;
       try {
-        parsed = JSON.parse(await readFile5(path, "utf-8"));
+        parsed = JSON.parse(await readFile7(path, "utf-8"));
       } catch {
         continue;
       }
@@ -8103,14 +8578,15 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backups = [];
   for (const vaultRoot of touchedRoots) {
-    const backupDir = join11(vaultRoot, `backup-key-${stamp}`);
-    await mkdir8(backupDir, { recursive: true });
+    const backupDir = join12(vaultRoot, `backup-key-${stamp}`);
+    await mkdir9(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
-      await copyFile(join11(vaultRoot, name), join11(backupDir, name));
+      await mkdir9(dirname7(join12(backupDir, name)), { recursive: true });
+      await copyFile(join12(vaultRoot, name), join12(backupDir, name));
     }
     for (const name of [".encryption.key.enc", ".runeya-verify"]) {
-      if (await exists(join11(vaultRoot, name))) {
-        await copyFile(join11(vaultRoot, name), join11(backupDir, name));
+      if (await exists(join12(vaultRoot, name))) {
+        await copyFile(join12(vaultRoot, name), join12(backupDir, name));
       }
     }
     backups.push(backupDir);
@@ -8129,7 +8605,7 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   return { converted: pending.map(({ path, values }) => ({ file: path, values })), backups };
 }
 async function resetOrgKeyToFresh(orgId, masterPassword, now) {
-  const freshKey = randomBytes2(32);
+  const freshKey = randomBytes3(32);
   if (isVaultLocked(orgId) || !getEncryptionKey(orgId)) {
     await readEncryptedKey(await keyRoot(), masterPassword);
     await installOrgKey(orgId, freshKey, masterPassword);
@@ -8165,7 +8641,7 @@ async function assertOrgReadable(orgId) {
     await assertOrgVaultReadable(orgId);
   } catch (err) {
     if (err instanceof OrgVaultUnreadableError) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     throw err;
   }
@@ -8175,10 +8651,10 @@ async function assertOrgKey(orgId) {
     await reconcileOrgCanary(orgId);
   } catch (err) {
     if (err instanceof OrgKeyMismatchError) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     if (err instanceof CanaryUnavailableError) {
-      throw new TRPCError20({ code: "PRECONDITION_FAILED", message: err.message });
+      throw new TRPCError22({ code: "PRECONDITION_FAILED", message: err.message });
     }
     throw err;
   }
@@ -8195,14 +8671,14 @@ var cloudSyncRouter = router({
    * "open this project" is the whole gesture.
    */
   trackProject: protectedProcedure.input(
-    z24.object({
-      orgId: z24.string().min(1).max(128),
-      cloudUrl: z24.string().url().max(2048),
-      projectId: z24.string().min(1).max(128),
+    z27.object({
+      orgId: z27.string().min(1).max(128),
+      cloudUrl: z27.string().url().max(2048),
+      projectId: z27.string().min(1).max(128),
       // Le compte sous lequel cette organisation a été listée. Tamponné avec
       // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
       // bon token sans qu'on ait à le lui redire.
-      accountId: z24.string().max(64).optional()
+      accountId: z27.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
@@ -8224,7 +8700,7 @@ var cloudSyncRouter = router({
       return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -8243,22 +8719,22 @@ var cloudSyncRouter = router({
    * fusionné.
    */
   publishProject: protectedProcedure.input(
-    z24.object({
-      orgId: z24.string().min(1).max(128),
-      cloudUrl: z24.string().url().max(2048),
-      projectId: z24.string().min(1).max(128),
+    z27.object({
+      orgId: z27.string().min(1).max(128),
+      cloudUrl: z27.string().url().max(2048),
+      projectId: z27.string().min(1).max(128),
       // Le compte sous lequel cette organisation a été listée. Tamponné avec
       // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
       // bon token sans qu'on ait à le lui redire.
-      accountId: z24.string().max(64).optional()
+      accountId: z27.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
     if (!local) {
-      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
     }
     if (await projectStore.get({ id: input.projectId, orgId: input.orgId })) {
-      throw new TRPCError20({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
+      throw new TRPCError22({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
     }
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
@@ -8283,7 +8759,7 @@ var cloudSyncRouter = router({
       await cloudSyncBridge.followProject(input.orgId, input.projectId);
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -8297,16 +8773,16 @@ var cloudSyncRouter = router({
    * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
    * les yeux — donc le canari est rapatrié et jugé ici.
    */
-  checkOrgKey: protectedProcedure.input(z24.object({
-    orgId: z24.string().min(1).max(128),
-    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i)
+  checkOrgKey: protectedProcedure.input(z27.object({
+    orgId: z27.string().min(1).max(128),
+    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i)
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
       { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) {
-      throw new TRPCError20({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
+      throw new TRPCError22({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
     }
     const { canary } = await res.json();
     if (typeof canary !== "string") return { matches: false, published: false };
@@ -8321,7 +8797,7 @@ var cloudSyncRouter = router({
    * que l'interface puisse proposer ni l'adoption ni la remise à zéro — le seul
    * chemin qui la répare. Rien n'est écrit ici, ni sur le disque ni sur le cloud.
    */
-  orgKeyStatus: protectedProcedure.input(z24.object({ orgId: z24.string().min(1).max(128) })).query(async ({ input }) => {
+  orgKeyStatus: protectedProcedure.input(z27.object({ orgId: z27.string().min(1).max(128) })).query(async ({ input }) => {
     const key = getEncryptionKey(input.orgId);
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
@@ -8344,10 +8820,10 @@ var cloudSyncRouter = router({
    * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
    * organisations et la machine gardent leur clé.
    */
-  adoptOrgKey: protectedProcedure.input(z24.object({
-    orgId: z24.string().min(1).max(128),
-    keyHex: z24.string().length(64).regex(/^[0-9a-f]+$/i),
-    masterPassword: z24.string().min(1).max(1024)
+  adoptOrgKey: protectedProcedure.input(z27.object({
+    orgId: z27.string().min(1).max(128),
+    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z27.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const report = await adoptOrgKey(
       input.orgId,
@@ -8377,14 +8853,14 @@ var cloudSyncRouter = router({
    * Ce qui a déjà été synchronisé sous l'ancienne clé de référence reste
    * illisible : aucune clé d'ici ne l'ouvre. L'interface le dit avant.
    */
-  resetOrgKey: protectedProcedure.input(z24.object({
-    orgId: z24.string().min(1).max(128),
-    masterPassword: z24.string().min(1).max(1024)
+  resetOrgKey: protectedProcedure.input(z27.object({
+    orgId: z27.string().min(1).max(128),
+    masterPassword: z27.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const { keyHex } = await resetOrgKeyToFresh(input.orgId, input.masterPassword, /* @__PURE__ */ new Date());
     const canary = await readVerifyFile(orgVaultRoot(input.orgId));
     if (!canary) {
-      throw new TRPCError20({
+      throw new TRPCError22({
         code: "PRECONDITION_FAILED",
         message: "Le coffre de cette organisation n'a pas re\xE7u sa cl\xE9."
       });
@@ -8396,7 +8872,7 @@ var cloudSyncRouter = router({
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
-      throw new TRPCError20({
+      throw new TRPCError22({
         code: res.status === 403 ? "FORBIDDEN" : "BAD_GATEWAY",
         message: detail || `ORG_KEY_RESET_FAILED (${res.status})`
       });
@@ -8412,9 +8888,9 @@ var cloudSyncRouter = router({
    * every other member and for this one on another machine.
    */
   untrackProject: protectedProcedure.input(
-    z24.object({
-      orgId: z24.string().min(1).max(128),
-      projectId: z24.string().min(1).max(128)
+    z27.object({
+      orgId: z27.string().min(1).max(128),
+      projectId: z27.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
@@ -8430,9 +8906,9 @@ var cloudSyncRouter = router({
    * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
    */
   deleteProjectFromOrg: protectedProcedure.input(
-    z24.object({
-      orgId: z24.string().min(1).max(128),
-      projectId: z24.string().min(1).max(128)
+    z27.object({
+      orgId: z27.string().min(1).max(128),
+      projectId: z27.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     let res;
@@ -8445,8 +8921,8 @@ var cloudSyncRouter = router({
         accountId: await accountForOrgScope(input.orgId)
       });
     } catch (err) {
-      if (err instanceof TRPCError20 && err.code === "PRECONDITION_FAILED") {
-        throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
+      if (err instanceof TRPCError22 && err.code === "PRECONDITION_FAILED") {
+        throw new TRPCError22({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
       }
       throw err;
     }
@@ -8454,12 +8930,12 @@ var cloudSyncRouter = router({
     const detail = await cloudMessage(res);
     if (res.status === 403) {
       const code = /not a member/i.test(detail) ? "PROJECT_NOT_MEMBER" : "PROJECT_DELETE_FORBIDDEN";
-      throw new TRPCError20({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
+      throw new TRPCError22({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
     }
     if (res.status === 404) {
-      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
     }
-    throw new TRPCError20({
+    throw new TRPCError22({
       code: "BAD_GATEWAY",
       message: detail || `PROJECT_DELETE_FAILED (${res.status})`
     });
@@ -8488,10 +8964,10 @@ var cloudSyncRouter = router({
    * d'un autre. Même forme que `rememberOrgNames`, et pour la même raison :
    * ce que seul le cloud sait, on le recopie quand il le dit.
    */
-  rememberOrgAccounts: protectedProcedure.input(z24.object({
-    orgs: z24.array(z24.object({
-      orgId: z24.string().min(1).max(128),
-      accountId: z24.string().min(1).max(64)
+  rememberOrgAccounts: protectedProcedure.input(z27.object({
+    orgs: z27.array(z27.object({
+      orgId: z27.string().min(1).max(128),
+      accountId: z27.string().min(1).max(64)
     })).max(200)
   })).mutation(async ({ input }) => {
     const candidates = /* @__PURE__ */ new Map();
@@ -8518,10 +8994,10 @@ var cloudSyncRouter = router({
     }
     return { remembered };
   }),
-  rememberOrgNames: protectedProcedure.input(z24.object({
-    orgs: z24.array(z24.object({
-      orgId: z24.string().min(1).max(128),
-      name: z24.string().min(1).max(100)
+  rememberOrgNames: protectedProcedure.input(z27.object({
+    orgs: z27.array(z27.object({
+      orgId: z27.string().min(1).max(128),
+      name: z27.string().min(1).max(100)
     })).max(200)
   })).mutation(async ({ input }) => {
     for (const { orgId, name } of input.orgs) await rememberOrgName(orgId, name);
@@ -8551,7 +9027,7 @@ var cloudSyncRouter = router({
    * Un 404 efface le logo retenu — l'organisation en a retiré un — tandis qu'un
    * réseau muet laisse en place ce qui est déjà là : hors ligne, on garde.
    */
-  cacheOrgLogos: protectedProcedure.input(z24.object({ orgIds: z24.array(z24.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
+  cacheOrgLogos: protectedProcedure.input(z27.object({ orgIds: z27.array(z27.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
     let cached = 0;
     for (const orgId of input.orgIds) {
       const base = await orgCloudUrl(orgId);
@@ -8608,22 +9084,22 @@ var cloudSyncRouter = router({
 
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir4, stat as stat6 } from "fs/promises";
-import { homedir as homedir3 } from "os";
-import { isAbsolute as isAbsolute3, join as join12, resolve as resolve2, dirname as dirname6, basename } from "path";
-import { z as z25 } from "zod";
+import { homedir as homedir4 } from "os";
+import { isAbsolute as isAbsolute3, join as join13, resolve as resolve3, dirname as dirname8, basename } from "path";
+import { z as z28 } from "zod";
 var MAX_ENTRIES2 = 500;
-var PATH_SCHEMA = z25.string().min(1).max(4096);
+var PATH_SCHEMA = z28.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join12(homedir3(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join13(homedir4(), input.slice(1)) : input;
   if (!isAbsolute3(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
-  return resolve2(expanded);
+  return resolve3(expanded);
 }
 var filesystemRouter = router({
   /** Where a picker should open when the user has chosen nothing yet. */
   suggestedRoots: protectedProcedure.query(async () => {
     const roots = [
-      { label: "home", path: homedir3() },
+      { label: "home", path: homedir4() },
       // The launch directory, taken from the vault rather than the process.
       { label: "cwd", path: await resolveWorkspaceCwd({}) }
     ];
@@ -8636,7 +9112,7 @@ var filesystemRouter = router({
    * Hidden entries are skipped: they are noise for choosing a workspace, and
    * `.runeya` itself would invite placing a project inside another's data.
    */
-  listDirectories: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  listDirectories: protectedProcedure.input(z28.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
     if (!info?.isDirectory()) {
@@ -8651,13 +9127,13 @@ var filesystemRouter = router({
     const truncated = names.length > MAX_ENTRIES2;
     const entries2 = [];
     for (const name of names.slice(0, MAX_ENTRIES2)) {
-      const path = join12(dir, name);
+      const path = join13(dir, name);
       entries2.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
       path: dir,
       // Null at the filesystem root, which is what stops "up" from looping.
-      parent: dirname6(dir) === dir ? null : dirname6(dir),
+      parent: dirname8(dir) === dir ? null : dirname8(dir),
       name: basename(dir) || dir,
       entries: entries2,
       truncated,
@@ -8669,7 +9145,7 @@ var filesystemRouter = router({
    * qui s'y trouve, ou rien (déjà dans la liste, lié à un projet d'organisation,
    * racine machine).
    */
-  checkLocalProjectTarget: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  checkLocalProjectTarget: protectedProcedure.input(z28.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
     if (!info?.isDirectory()) return { path: dir, status: "missing", projectName: null };
@@ -8681,10 +9157,10 @@ var filesystemRouter = router({
    * Two projects in one directory is what makes services run against the wrong
    * code, so a directory that already holds one is refused outright.
    */
-  checkProjectTarget: protectedProcedure.input(z25.object({
+  checkProjectTarget: protectedProcedure.input(z28.object({
     path: PATH_SCHEMA,
-    projectId: z25.string().min(1).max(128),
-    orgId: z25.string().max(128).nullable().optional()
+    projectId: z28.string().min(1).max(128),
+    orgId: z28.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat6(dir).catch(() => null);
@@ -8703,15 +9179,15 @@ var filesystemRouter = router({
 });
 
 // ../server/src/trpc/routers/desktop.ts
-import { z as z26 } from "zod";
+import { z as z29 } from "zod";
 import { isAbsolute as isAbsolute5 } from "path";
-import { TRPCError as TRPCError21 } from "@trpc/server";
+import { TRPCError as TRPCError23 } from "@trpc/server";
 
 // ../server/src/services/desktop-launcher.ts
-import { execFile as execFile4 } from "child_process";
+import { execFile as execFile5 } from "child_process";
 import { isAbsolute as isAbsolute4 } from "path";
 import { promisify as promisify3 } from "util";
-var exec = promisify3(execFile4);
+var exec = promisify3(execFile5);
 var INSTALL_TIMEOUT_MS2 = 3e4;
 var cli = null;
 function registerCli(location) {
@@ -8742,7 +9218,8 @@ async function installLauncher(input) {
     "--port",
     String(input.port),
     "--agent-port",
-    String(input.agentPort)
+    String(input.agentPort),
+    ...input.projectId ? ["--project", input.projectId] : []
   ];
   const { stdout, stderr } = await exec(cli.execPath, args, {
     timeout: INSTALL_TIMEOUT_MS2,
@@ -8788,43 +9265,45 @@ var desktopRouter = router({
    * dessinée par le serveur. Sans cette annonce elle garderait la teinte figée
    * du fichier livré avec le CLI. Rien n'est persisté — voir `tray-accent.ts`.
    */
-  setTrayAccent: protectedProcedure.input(z26.object({
+  setTrayAccent: protectedProcedure.input(z29.object({
     // `#rgb` ou `#rrggbb` : la forme est vérifiée ici, pas rabotée plus loin.
-    color: z26.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/).nullable()
+    color: z29.string().regex(/^#(?:[0-9a-fA-F]{3}|[0-9a-fA-F]{6})$/).nullable()
   })).mutation(({ input }) => {
     setTrayAccent(input.color);
     return { ok: true };
   }),
-  installLauncher: protectedProcedure.input(z26.object({
-    name: z26.string().trim().min(1).max(120),
+  installLauncher: protectedProcedure.input(z29.object({
+    name: z29.string().trim().min(1).max(120),
     /**
      * `null` : raccourci global, sans dossier épinglé. Sinon un chemin
      * absolu, refusé autrement : le dossier devient un argument positionnel
      * du CLI, où une valeur commençant par un tiret passerait pour un drapeau.
      */
-    workingDir: z26.string().max(4096).refine(isAbsolute5, {
+    workingDir: z29.string().max(4096).refine(isAbsolute5, {
       message: "Le dossier de travail doit \xEAtre un chemin absolu."
     }).nullable(),
-    port: z26.number().int().min(1).max(65535),
-    agentPort: z26.number().int().min(1).max(65535)
+    port: z29.number().int().min(1).max(65535),
+    agentPort: z29.number().int().min(1).max(65535),
+    /** Projet ouvert directement par le raccourci (`--project`). Absent : liste des projets. */
+    projectId: z29.string().max(128).regex(LAUNCHER_PROJECT_ID_PATTERN).nullable().optional()
   })).mutation(async ({ input }) => {
     try {
       return await installLauncher(input);
     } catch (err) {
       const message = err.message;
       if (message === "launcher-working-dir-not-absolute") {
-        throw new TRPCError21({
+        throw new TRPCError23({
           code: "BAD_REQUEST",
           message: "Le dossier de travail doit \xEAtre un chemin absolu."
         });
       }
       if (message === "launcher-unavailable") {
-        throw new TRPCError21({
+        throw new TRPCError23({
           code: "PRECONDITION_FAILED",
           message: "Cette Runeya ne sait pas o\xF9 trouver son CLI : cr\xE9ez le raccourci avec `runeya install-desktop`."
         });
       }
-      throw new TRPCError21({ code: "INTERNAL_SERVER_ERROR", message });
+      throw new TRPCError23({ code: "INTERNAL_SERVER_ERROR", message });
     }
   })
 });
@@ -8836,6 +9315,8 @@ var appRouter = router({
   appUpdate: appUpdateRouter,
   changelog: changelogRouter,
   diagnostics: diagnosticsRouter,
+  mcpPairing: mcpPairingRouter,
+  aiClients: aiClientsRouter,
   project: projectRouter,
   service: serviceRouter,
   agent: agentRouter,
@@ -8924,8 +9405,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename3, stat as stat8 } from "fs/promises";
-import { join as join13 } from "path";
+import { readdir as readdir5, readFile as readFile8, writeFile as writeFile7, mkdir as mkdir10, copyFile as copyFile2, unlink, rename as rename3, stat as stat8 } from "fs/promises";
+import { join as join14 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -8955,17 +9436,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join13(legacyRoot, `backup-${stamp}`);
-  await mkdir9(backupDir, { recursive: true });
+  const backupDir = join14(legacyRoot, `backup-${stamp}`);
+  await mkdir10(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists2(join13(legacyRoot, name))) {
-      await copyFile2(join13(legacyRoot, name), join13(backupDir, name));
+    if (await exists2(join14(legacyRoot, name))) {
+      await copyFile2(join14(legacyRoot, name), join14(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile6(join13(legacyRoot, name), "utf-8");
+    const raw = await readFile8(join14(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -8975,13 +9456,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join13(legacyRoot, `${name}.tmp`);
+    const tmp = join14(legacyRoot, `${name}.tmp`);
     await writeFile7(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename3(tmp, join13(legacyRoot, name));
+    await rename3(tmp, join14(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile6(join13(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile8(join14(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -8990,13 +9471,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir9(machineRootDir, { recursive: true });
+  await mkdir10(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join13(legacyRoot, name);
+    const from = join14(legacyRoot, name);
     if (!await exists2(from)) continue;
-    const to = join13(machineRootDir, name);
+    const to = join14(machineRootDir, name);
     if (await exists2(to)) {
       skipped.push(name);
       continue;
@@ -9006,15 +9487,15 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join13(legacyRoot, name);
+    const path = join14(legacyRoot, name);
     if (await exists2(path)) await unlink(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile7, writeFile as writeFile8, rename as rename4, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
-import { join as join14 } from "path";
+import { readFile as readFile9, writeFile as writeFile8, rename as rename4, unlink as unlink2, mkdir as mkdir11, chmod as chmod4, stat as stat9 } from "fs/promises";
+import { join as join15 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 async function exists3(path) {
@@ -9027,9 +9508,9 @@ async function legacySource(filename) {
   return null;
 }
 async function moveInto(root, filename, from) {
-  await mkdir10(root, { recursive: true });
-  const to = join14(root, filename);
-  const contents = await readFile7(from, "utf-8");
+  await mkdir11(root, { recursive: true });
+  const to = join15(root, filename);
+  const contents = await readFile9(from, "utf-8");
   const tmp = to + ".tmp";
   await writeFile8(tmp, contents, "utf-8");
   await rename4(tmp, to);
@@ -9053,7 +9534,7 @@ async function migrateSettingsIntoVaults() {
   const orgId = orgs[0];
   const root = orgVaultRoot(orgId);
   for (const { filename, from } of sources) {
-    if (await exists3(join14(root, filename))) continue;
+    if (await exists3(join15(root, filename))) continue;
     await moveInto(root, filename, from);
     report.files.push(filename);
   }
@@ -9066,17 +9547,17 @@ async function migrateSettingsIntoVaults() {
 
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
-import { randomBytes as randomBytes3, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomBytes as randomBytes4, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import {
-  readFile as readFile8,
+  readFile as readFile10,
   writeFile as writeFile9,
   rename as rename5,
-  mkdir as mkdir11,
+  mkdir as mkdir12,
   access as access2,
   readdir as readdir6
 } from "fs/promises";
-import { join as join15, dirname as dirname7 } from "path";
+import { join as join16, dirname as dirname9 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -9089,7 +9570,7 @@ var PARSER_ID_MAP = {
 function encryptValue2(plaintext) {
   const key = getEncryptionKey();
   if (!key) throw new Error("[legacy-migration] Encryption key not loaded");
-  const iv = randomBytes3(16);
+  const iv = randomBytes4(16);
   const cipher = createCipheriv3("aes-256-gcm", key, iv);
   let enc = cipher.update(plaintext, "utf-8", "hex");
   enc += cipher.final("hex");
@@ -9193,7 +9674,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile8(filePath, "utf-8")).trim();
+  const raw = (await readFile10(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -9218,7 +9699,7 @@ async function atomicWrite(path, data) {
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join15(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join16(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -9228,18 +9709,18 @@ async function runLegacyMigration(dataDir) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const legacyTmp = `${legacyRoot}-tmp`;
   await rename5(legacyRoot, legacyTmp);
-  await mkdir11(dataDir, { recursive: true });
-  const legacyOld = join15(dataDir, `backup-${timestamp}`);
+  await mkdir12(dataDir, { recursive: true });
+  const legacyOld = join16(dataDir, `backup-${timestamp}`);
   await rename5(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile8(join15(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile10(join16(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join15(legacyOld, "dbs");
+  const dbsDir = join16(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -9248,29 +9729,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join15(dbsDir, "envs");
+  const envsDir = join16(dbsDir, "envs");
   const envFiles = (await readdir6(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join15(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join16(envsDir, file));
   }
-  const servicesDir = join15(dbsDir, "services");
+  const servicesDir = join16(dbsDir, "services");
   const serviceFiles = (await readdir6(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join15(servicesDir, file));
+    const data = await readEncrypted(join16(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join15(dbsDir, "overrides");
+  const overridesDir = join16(dbsDir, "overrides");
   const overrideFiles = (await readdir6(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join15(overridesDir, file));
+    const data = await readEncrypted(join16(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -9278,18 +9759,18 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join15(dbsDir, "parsers");
+  const parsersDir = join16(dbsDir, "parsers");
   const parserFiles = (await readdir6(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join15(parsersDir, file));
+    const data = await readEncrypted(join16(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
-  const projectMonoId = randomUUID8();
+  const projectMonoId = randomUUID9();
   const envIdMap = {};
   const labelToKey = {};
   for (const [name, legacyEnv] of Object.entries(legacyEnvs)) {
-    envIdMap[name] = randomUUID8();
+    envIdMap[name] = randomUUID9();
     if (legacyEnv?.label) labelToKey[legacyEnv.label] = name;
   }
   const runeEnvs = [];
@@ -9314,7 +9795,7 @@ async function runLegacyMigration(dataDir) {
         if (hasInvalidInterpolation(value)) continue;
         const cleaned = cleanVarKey(key);
         if (inheritedVars[cleaned] === value) continue;
-        const varId = randomUUID8();
+        const varId = randomUUID9();
         variables[varId] = makeVariable(cleaned, value);
         varIdLookup.set(`${envIdMap[name]}:${cleaned}`, varId);
       }
@@ -9335,7 +9816,7 @@ async function runLegacyMigration(dataDir) {
   const serviceIdMap = {};
   const runeServices = [];
   for (const [name, legacy] of Object.entries(legacyServices)) {
-    const id = randomUUID8();
+    const id = randomUUID9();
     serviceIdMap[name] = id;
     const rootPath = legacy.rootPath || "";
     const rootPathCwd = rootPath && rootPath !== "." ? rootPath : "";
@@ -9344,7 +9825,7 @@ async function runLegacyMigration(dataDir) {
       const parts = [cmd.spawnCmd, ...cmd.spawnArgs || []].filter(Boolean);
       if (!parts.length) continue;
       commands.push({
-        id: cmd.id || randomUUID8(),
+        id: cmd.id || randomUUID9(),
         label: "Launch",
         command: parts.join(" "),
         cwd: cmd.spawnOptions?.cwd || "",
@@ -9405,7 +9886,7 @@ async function runLegacyMigration(dataDir) {
       const legacyBootstrapCmds = container.bootstrap?.commands || [];
       if (legacyBootstrapCmds.length > 0) {
         dockerConfig.bootstrapCommands = legacyBootstrapCmds.filter((bs) => bs.cmd || bs.entrypoint).map((bs, idx) => ({
-          id: bs.id || randomUUID8(),
+          id: bs.id || randomUUID9(),
           label: bs.label || `Bootstrap ${idx + 1}`,
           command: bs.cmd || "",
           ...bs.entrypoint ? { entrypoint: bs.entrypoint } : {},
@@ -9453,7 +9934,7 @@ async function runLegacyMigration(dataDir) {
       cwd: serviceCwd,
       runner: dockerConfig ? "docker" : "native",
       shortcuts: (legacy.shortcuts || []).filter((s) => s.spawnCmd || s.label).map((s) => ({
-        id: s.id || randomUUID8(),
+        id: s.id || randomUUID9(),
         label: s.label || s.spawnCmd || "",
         command: [s.spawnCmd, ...s.spawnArgs || []].filter(Boolean).join(" "),
         ...s.spawnOptions?.cwd ? { cwd: s.spawnOptions.cwd } : {}
@@ -9493,7 +9974,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID8(),
+          id: randomUUID9(),
           projectId: projectMonoId,
           name: `${service?.name || name} (${globalEnv.name})`,
           scope: "service",
@@ -9517,7 +9998,7 @@ async function runLegacyMigration(dataDir) {
         const varPost = typeof varData === "object" ? String(varData.suffix ?? "") : "";
         if (!varKey || existingKeys.has(cleanVarKey(varKey))) continue;
         const cleaned = cleanVarKey(varKey);
-        const varId = randomUUID8();
+        const varId = randomUUID9();
         svcScopedEnv.variables[varId] = makeVariable(cleaned, varValue, varPre, varPost);
         existingKeys.add(cleaned);
       }
@@ -9537,7 +10018,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID8(),
+          id: randomUUID9(),
           projectId: projectMonoId,
           name: `${service?.name || serviceName} (${globalEnv.name})`,
           scope: "service",
@@ -9558,7 +10039,7 @@ async function runLegacyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv.variables).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID8();
+          varId = randomUUID9();
           svcScopedEnv.variables[varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -9588,13 +10069,13 @@ async function runLegacyMigration(dataDir) {
             flatOverrides[varId] = makeVariable(cleaned, value);
           }
         } else {
-          flatOverrides[randomUUID8()] = makeVariable(cleaned, value);
+          flatOverrides[randomUUID9()] = makeVariable(cleaned, value);
         }
       } else {
         const cleaned = cleanVarKey(key);
         const existingVarId = Object.entries(env2.variables).find(([, v]) => v.key === cleaned)?.[0];
         if (!existingVarId) {
-          const varId = randomUUID8();
+          const varId = randomUUID9();
           env2.variables[varId] = makeVariable(cleaned, value);
           varIdLookup.set(`${envId}:${cleaned}`, varId);
         }
@@ -9623,7 +10104,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile8(join15(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile10(join16(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -9644,11 +10125,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join15(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join15(dataDir, "services.json"), runeServices);
-  await atomicWrite(join15(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join15(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join15(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join16(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join16(dataDir, "services.json"), runeServices);
+  await atomicWrite(join16(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join16(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join16(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -9662,9 +10143,9 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries2 = await readdir6(dataDir);
     const backupDirs = entries2.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join15(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join16(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile8(keyJsonPath, "utf-8");
+        const raw = await readFile10(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -9682,11 +10163,11 @@ async function findLegacyKeyInBackup(dataDir) {
   return null;
 }
 async function runOverrideOnlyMigration(dataDir) {
-  const { resolve: resolve4 } = await import("path");
-  const abDataDir = resolve4(dataDir);
+  const { resolve: resolve5 } = await import("path");
+  const abDataDir = resolve5(dataDir);
   const candidateDirs = [
-    join15(dirname7(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join15(abDataDir, "dbs", "overrides")
+    join16(dirname9(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join16(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -9702,7 +10183,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join15(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join16(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -9720,7 +10201,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile8(join15(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile10(join16(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -9739,7 +10220,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile8(join15(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile10(join16(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -9756,7 +10237,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join16(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9778,12 +10259,12 @@ async function runOverrideOnlyMigration(dataDir) {
         if (isSameAsBase(value, baseVar)) continue;
         flatOverrides[varId] = makeVariable(cleaned, value);
       } else {
-        flatOverrides[randomUUID8()] = makeVariable(cleaned, value);
+        flatOverrides[randomUUID9()] = makeVariable(cleaned, value);
       }
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join15(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join16(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -9793,7 +10274,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join16(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9815,7 +10296,7 @@ async function runOverrideOnlyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID8(),
+          id: randomUUID9(),
           projectId: globalEnv["projectId"],
           name: `${service?.["name"] || serviceName} (${globalEnv["name"]})`,
           scope: "service",
@@ -9837,7 +10318,7 @@ async function runOverrideOnlyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv["variables"]).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID8();
+          varId = randomUUID9();
           svcScopedEnv["variables"][varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -9852,7 +10333,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join15(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join16(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -9867,7 +10348,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { stat as stat10 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -9877,22 +10358,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat10(join16(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat10(join17(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, VERIFY_FILENAME2));
+    await stat10(join17(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, "projects.json"));
+    await stat10(join17(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat10(join16(dataDir, "project.json"));
+    await stat10(join17(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -10198,7 +10679,7 @@ function getOpenApiDocument() {
 
 // ../server/src/create-server.ts
 import rateLimit from "express-rate-limit";
-import { existsSync as existsSync2, createReadStream } from "fs";
+import { existsSync as existsSync3, createReadStream } from "fs";
 import multer from "multer";
 
 // ../server/src/services/image-cleanup.service.ts
@@ -10295,6 +10776,7 @@ var llmsLimiter = rateLimit({
 async function createLocalServer() {
   installLogCapture();
   generateJwtSecret();
+  setMcpClientCheck((clientId) => mcpPairing.isPaired(clientId));
   const ciMode = await loadFromEnv();
   await runLegacyMigration(env.DATA_DIR);
   const keyDir = await keyRoot();
@@ -10313,10 +10795,10 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  const absoluteDataDir = resolve3(env.DATA_DIR);
+  const absoluteDataDir = resolve4(env.DATA_DIR);
   console.log(`[server] Local project directory: ${absoluteDataDir}`);
   console.log(`[server] Machine directory: ${machineRoot()}`);
-  if (existsSync2(env.DATA_DIR)) {
+  if (existsSync3(env.DATA_DIR)) {
     await ensureDataGitignore(env.DATA_DIR);
   }
   await settingsManager.getSettings();
@@ -10394,9 +10876,18 @@ async function createLocalServer() {
     await serviceStore.list().catch((err) => {
       console.warn("[server] Failed to preload services:", err);
     });
+    void conversationStore.list().catch((err) => {
+      console.warn("[server] Failed to preload conversations:", err);
+    });
     void (async () => {
       const orgRoots = (await listOrgVaults()).map((orgId) => orgVaultRoot(orgId));
-      const removed = await sweepStaleTempFiles([machineRoot(), ...orgRoots, ...await allVaultRoots()]);
+      const vaultRoots = await allVaultRoots();
+      const removed = await sweepStaleTempFiles([
+        machineRoot(),
+        ...orgRoots,
+        ...vaultRoots,
+        ...[machineRoot(), ...vaultRoots].map((root) => join18(root, CONVERSATIONS_DIRNAME))
+      ]);
       if (removed > 0) console.log(`[server] ${removed} fichier(s) temporaire(s) orphelin(s) retir\xE9(s)`);
     })().catch((err) => console.warn("[server] Temp file sweep failed:", err));
     cloudSyncBridge.start().catch((err) => {
@@ -10656,13 +11147,14 @@ async function createLocalServer() {
   app.post("/api/auth/refresh", refreshLimiter, async (req, res) => {
     const auth = req.headers.authorization;
     const jwt = typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7) : "";
+    let mcpClientId;
     try {
-      await verifyJwt(jwt);
+      ({ mcpClientId } = await verifyJwt(jwt, { allowMcp: true }));
     } catch {
       res.status(401).json({ error: "Session invalide" });
       return;
     }
-    res.json({ token: await signJwt() });
+    res.json({ token: await signJwt(mcpClientId ? { mcpClientId, ttl: MCP_TOKEN_TTL } : {}) });
   });
   app.post("/api/unlock", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
     try {
@@ -10720,8 +11212,8 @@ async function createLocalServer() {
           }
           encKey = Buffer.from(encryptionKeyHex, "hex");
         } else {
-          const { randomBytes: randomBytes4 } = await import("crypto");
-          encKey = randomBytes4(32);
+          const { randomBytes: randomBytes5 } = await import("crypto");
+          encKey = randomBytes5(32);
         }
       }
       await writeEncryptedKey(await keyRoot(), masterPassword, encKey);
@@ -11043,16 +11535,16 @@ async function createLocalServer() {
     ]);
     server.closeAllConnections();
     await Promise.race([
-      new Promise((resolve4) => wss.close(() => resolve4())),
-      new Promise((resolve4) => setTimeout(resolve4, 2e3))
+      new Promise((resolve5) => wss.close(() => resolve5())),
+      new Promise((resolve5) => setTimeout(resolve5, 2e3))
     ]);
     await Promise.race([
-      new Promise((resolve4) => server.close(() => resolve4())),
-      new Promise((resolve4) => setTimeout(resolve4, 2e3))
+      new Promise((resolve5) => server.close(() => resolve5())),
+      new Promise((resolve5) => setTimeout(resolve5, 2e3))
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-2LHKU577.js");
+  const { initCompanion } = await import("./companion-W3UMZWGH.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -11071,7 +11563,7 @@ var PullEnvError = class extends Error {
 };
 async function promptPassword() {
   process.stderr.write("Master password: ");
-  return new Promise((resolve4) => {
+  return new Promise((resolve5) => {
     const stdin = process.stdin;
     const wasRaw = stdin.isRaw;
     if (stdin.isTTY) stdin.setRawMode(true);
@@ -11084,7 +11576,7 @@ async function promptPassword() {
         stdin.pause();
         stdin.removeListener("data", onData);
         process.stderr.write("\n");
-        resolve4(input);
+        resolve5(input);
       } else if (ch === "") {
         process.exit(1);
       } else if (ch === "\x7F" || ch === "\b") {
@@ -11182,8 +11674,8 @@ function onTrayServicesChanged(listener) {
 }
 
 // ../server/src/services/tray-icon.ts
-import { mkdir as mkdir12, writeFile as writeFile10, rename as rename6 } from "fs/promises";
-import { join as join17 } from "path";
+import { mkdir as mkdir13, writeFile as writeFile10, rename as rename6 } from "fs/promises";
+import { join as join19 } from "path";
 
 // ../server/src/services/png-to-ico.ts
 function isPng(bytes) {
@@ -11343,7 +11835,7 @@ var FETCH_TIMEOUT_MS = 3e3;
 var CACHE_TTL_MS = 10 * 6e4;
 var cache2 = /* @__PURE__ */ new Map();
 function trayIconDir() {
-  return join17(machineRoot(), "tray-icons");
+  return join19(machineRoot(), "tray-icons");
 }
 async function resolveTrayIcon(platform = process.platform) {
   const orgId = getCurrentProject()?.orgId;
@@ -11371,8 +11863,8 @@ async function renderThemedIcon(platform) {
 }
 async function writeTrayIcon(stem, png, platform) {
   const dir = trayIconDir();
-  await mkdir12(dir, { recursive: true });
-  const path = join17(dir, stem);
+  await mkdir13(dir, { recursive: true });
+  const path = join19(dir, stem);
   if (platform === "win32") {
     const ico = pngToIco(png);
     return ico ? writeAtomic(`${path}.ico`, ico) : null;
@@ -11414,7 +11906,7 @@ if (process.env["RUNEYA_DATA_DIR"]) {
   console.log(`[server] Working directory: ${resolved} (from RUNEYA_DATA_DIR)`);
 }
 function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500) {
-  return new Promise((resolve4, reject) => {
+  return new Promise((resolve5, reject) => {
     let attempts = 0;
     const wssErrorHandler = () => {
     };
@@ -11435,7 +11927,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
       server.listen(port, host, () => {
         server.removeListener("error", onError);
         wss?.removeListener("error", wssErrorHandler);
-        resolve4();
+        resolve5();
       });
     };
     tryListen();
@@ -11448,6 +11940,7 @@ async function main() {
   console.log("Hello World 2");
   const { server, wss, shutdown } = await createLocalServer();
   await listenWithRetry(server, env.PORT, env.HOST, wss);
+  await registerInstance();
   console.log(`[server] Local server listening on ${env.HOST}:${env.PORT}`);
   console.log(`[server] tRPC HTTP: http://${env.HOST}:${env.PORT}/api/trpc`);
   console.log(`[server] tRPC WS: ws://${env.HOST}:${env.PORT}`);
@@ -11507,4 +12000,4 @@ export {
   stopProcess,
   userPrefix
 };
-//# sourceMappingURL=src-5TEXF3SU.js.map
+//# sourceMappingURL=src-LEDGW5KP.js.map