@runeya/runeya 2.0.145 → 2.0.147

package/{chunk-ONVAH65J.js → chunk-2NE52CL5.js}

@@ -1,8 +1,7 @@
-import {
-  settingsManager
-} from "./chunk-FE53XX4M.js";
 import {
   COMPANION_SIGNATURE,
+  PASTED_TASK_LEAD,
+  PTY_MCP_READY_MAX_MS,
   activeSessionRegistry,
   claudeSessionExists,
   companionCreateDefaults,
@@ -11,7 +10,6 @@ import {
   companionSkips,
   companionSystemNote,
   companionThinkingIds,
-  conversationSectionStore,
   conversationStore,
   deliverToMainConversation,
   findClaudeSessionFile,
@@ -27,7 +25,7 @@ import {
   noteSpawnConversation,
   observePtyChunk,
   onCompanionThinkingChanged,
-  projectStore,
+  pasteToPty,
   readClaudeTranscript,
   resetRelaunches,
   resolveAgentCwd,
@@ -37,31 +35,54 @@ import {
   signJwt,
   stopCompanion,
   syncConversationFromClaudeTranscript,
-  verifyJwt
-} from "./chunk-Q4RPY3VW.js";
+  verifyJwt,
+  waitForPtyInput
+} from "./chunk-JNK6H5KH.js";
+import {
+  RUNEYA_CAPABILITIES,
+  applyProjectAnchor,
+  buildAnthropicTools,
+  buildOpenAITools,
+  buildToolSafetyInstruction,
+  runCapability,
+  toRawParams
+} from "./chunk-6IBPK6UE.js";
+import {
+  conversationSectionStore,
+  projectStore
+} from "./chunk-7QXP4FXD.js";
+import {
+  describeVariables,
+  environmentOverridesStore,
+  environmentResolver,
+  filterEnvForAi
+} from "./chunk-WDHLEO5S.js";
 import {
-  StoreDiskCoordinator,
   agentManager,
-  agentStore,
+  agentStore
+} from "./chunk-5XG3X2TM.js";
+import {
+  serviceStore
+} from "./chunk-4D3GCBPO.js";
+import {
+  StoreDiskCoordinator,
   decryptValue,
-  decryptVariableSlots,
   encryptValue,
-  encryptVariableSlots,
   ensureProjectsLoaded,
   environmentStore,
-  extractEncryptedVariableSlots,
-  getEncryptionKey,
   hasEncryptionKey,
   isCiMode,
   isEncryptedValue,
   recordLocalRemoval,
-  refsOfProjectId,
-  serviceStore
-} from "./chunk-QF56Z6LI.js";
+  refsOfProjectId
+} from "./chunk-DFPZ4MTI.js";
 import {
   isCliAvailable,
   resolveCliInvocation
 } from "./chunk-OZBSOSAS.js";
+import {
+  settingsManager
+} from "./chunk-NPMSBYXC.js";
 import {
   atomicWriteJsonSecure,
   atomicWriteSecure,
@@ -72,41 +93,33 @@ import {
   renameWithRetry,
   resolveConversationRunDir,
   wasRead
-} from "./chunk-NCO4OOYT.js";
+} from "./chunk-4LJQIQMN.js";
 import {
-  allVaultRoots,
   env,
   keyedFilePath,
   legacyMachineFilePath,
   listOrgVaults,
   machineFilePath,
   machineRoot,
-  orgVaultRoot,
-  vaultIdOfRoot
-} from "./chunk-KS7A5CTW.js";
+  orgVaultRoot
+} from "./chunk-VPSQJOSN.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
   ApiKeysFileSchema,
-  BUILTIN_VARIABLES,
-  BootstrapCommandSchema,
   CLAUDE_CODE_MODELS,
   DockerConfigSchema,
   HealthCheckSchema,
   JSLogParserSchema,
   LogSourceConfigSchema,
-  MASKED_VALUE,
   MissingVariableSchema,
   RestartStrategySchema,
   ScenarioSchema,
   ServiceCommandSchema,
-  ServiceConfigSchema,
   ServiceShortcutSchema,
   ambiguousServiceSlugs,
   crossServiceValues,
   findUnresolvedReferences,
   interpolateBuiltinsInEnv,
-  isSharedWithAi,
-  maskLogSourceSecrets,
   nativeParsers,
   restoreLogSourceSecrets,
   servicePortValues,
@@ -117,10 +130,11 @@ import {
 } from "./chunk-MZSDTA4A.js";
 
 // ../server/src/trpc/routers/chat.ts
-import { z as z9 } from "zod";
+import { z as z6 } from "zod";
 import Anthropic2 from "@anthropic-ai/sdk";
 import OpenAI2 from "openai";
 import { fileURLToPath as fileURLToPath2 } from "url";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // ../../packages/mcp-server/src/launch.ts
 import { fileURLToPath } from "url";
@@ -152,7 +166,8 @@ function pickEnv(env2) {
     ...env2.RUNEYA_BASE_URL ? { RUNEYA_BASE_URL: env2.RUNEYA_BASE_URL } : {},
     ...env2.RUNEYA_API_TOKEN ? { RUNEYA_API_TOKEN: env2.RUNEYA_API_TOKEN } : {},
     ...env2.RUNEYA_PROJECT_ID ? { RUNEYA_PROJECT_ID: env2.RUNEYA_PROJECT_ID } : {},
-    ...env2.RUNEYA_ORG_ID ? { RUNEYA_ORG_ID: env2.RUNEYA_ORG_ID } : {}
+    ...env2.RUNEYA_ORG_ID ? { RUNEYA_ORG_ID: env2.RUNEYA_ORG_ID } : {},
+    ...env2.RUNEYA_MCP_READY_ID ? { RUNEYA_MCP_READY_ID: env2.RUNEYA_MCP_READY_ID } : {}
   };
 }
 function runeyaMcpConfig(env2) {
@@ -178,6 +193,16 @@ function codexMcpArgs(env2) {
   }
   return ["-c", `mcp_servers.runeya={${fields.join(",")}}`];
 }
+function codexRuneyaMcpArgs(env2, build = codexMcpArgs, warn = console.warn) {
+  const disabled = ["-c", "mcp_servers.runeya.enabled=false"];
+  if (!env2.RUNEYA_API_TOKEN) return disabled;
+  try {
+    return build(env2);
+  } catch (err) {
+    warn(`[codex] Failed to resolve MCP server path: ${err.message}`);
+    return disabled;
+  }
+}
 function tomlString(value) {
   const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/[\u0000-\u001f\u007f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
   return `"${escaped}"`;
@@ -500,7 +525,8 @@ var router = t.router;
 var createCallerFactory = t.createCallerFactory;
 var publicProcedure = t.procedure;
 var API_KEY_REGEX = /^[0-9a-f]{64}$/i;
-var authMiddleware = t.middleware(async ({ ctx, next }) => {
+var MCP_CLIENT_ROUTES = /* @__PURE__ */ new Set([...RUNEYA_CAPABILITIES.map((c) => c.route), "project.containing"]);
+var authMiddleware = t.middleware(async ({ ctx, next, path }) => {
   const { authorization } = ctx;
   if (authorization?.startsWith("Bearer ") && API_KEY_REGEX.test(authorization.slice(7))) {
     if (!hasEncryptionKey()) {
@@ -520,15 +546,24 @@ var authMiddleware = t.middleware(async ({ ctx, next }) => {
     throw new TRPCError({ code: "UNAUTHORIZED", message: "Missing or invalid Authorization header" });
   }
   const token = authorization.slice(7);
+  let mcpClientId = null;
   try {
-    await verifyJwt(token);
+    mcpClientId = (await verifyJwt(token, { allowMcp: true })).mcpClientId ?? null;
   } catch {
     throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
   }
-  return next({ ctx: { ...ctx, callerType: "app", apiKey: null } });
+  if (mcpClientId && !MCP_CLIENT_ROUTES.has(path)) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "An MCP client cannot call this route." });
+  }
+  return next({ ctx: { ...ctx, callerType: "app", apiKey: null, mcpClientId } });
 });
 var protectedProcedure = t.procedure.use(authMiddleware);
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
+function requireLoopback(ctx) {
+  if (!ctx.remoteAddress || !LOOPBACK.has(ctx.remoteAddress)) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "This route only answers the local machine." });
+  }
+}
 async function requireLoopbackOrToken(ctx) {
   if (ctx.remoteAddress && LOOPBACK.has(ctx.remoteAddress)) return;
   if (isCiMode()) return;
@@ -545,6 +580,11 @@ async function requireLoopbackOrToken(ctx) {
     throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
   }
 }
+function requireHuman(ctx) {
+  if (isCiMode() || ctx.callerType !== "app" || ctx.mcpClientId) {
+    throw new TRPCError({ code: "FORBIDDEN", message: "Only the Runeya app can do this." });
+  }
+}
 function requireServiceAction(ctx, serviceId, action) {
   if (ctx.callerType !== "api") return;
   const perm = ctx.apiKey.scopes.services.find((p) => p.serviceId === serviceId);
@@ -591,1790 +631,6 @@ var ShortString200Schema = z2.string().max(200);
 var DescriptionSchema = z2.string().max(2e3);
 var OptionalProviderIdSchema = Id128Schema.optional();
 
-// ../server/src/services/environment-overrides-store.ts
-import { readFile as readFile2, writeFile, mkdir, chmod } from "fs/promises";
-import { dirname, join as join3 } from "path";
-var FILENAME = "environment-overrides.json";
-var EnvironmentOverridesStore = class {
-  data = {};
-  loaded = false;
-  /**
-   * Le coordinateur partagé par les stores : un seul rechargement à la fois,
-   * jamais pendant une écriture, et une substitution atomique à la fin.
-   *
-   * Ce store faisait sa propre cuisine et se marquait « chargé » avant ses
-   * `await` : toute lecture concurrente repartait avec une table vide — une
-   * surcharge déjà écrite paraissait absente, et l'assistant réclamait au
-   * déverrouillage des variables que ce poste avait déjà renseignées.
-   */
-  disk = new StoreDiskCoordinator();
-  /** Ce que le disque portait au dernier chargement (cf. `load`). */
-  fingerprint = "";
-  diskEncryptedSlots = {};
-  /**
-   * Les surcharges dont le secret ne s'est pas ouvert.
-   *
-   * Vides en mémoire, elles doivent repartir chiffrées : sans cela, la
-   * sauvegarde suivante remplacerait par du blanc une valeur dont il ne
-   * manquait que la clé.
-   */
-  unreadableSecrets = /* @__PURE__ */ new Set();
-  /** Which vault each override was read from, until its project is known. */
-  roots = /* @__PURE__ */ new Map();
-  /**
-   * An override belongs to the project whose variable it answers.
-   *
-   * Nothing in an override says so — they are keyed by variable id alone — so
-   * the owning project is resolved through the environment that defines the
-   * variable. Overrides are never synced: they stay in the project's vault on
-   * this machine, and no other machine sees them.
-   *
-   * An override whose variable no longer exists (a deleted environment, a row
-   * left behind) has no project to belong to. It stays wherever it was read,
-   * falling back to the key's own directory — never dropped, since the variable
-   * may simply not be loaded yet.
-   */
-  async rootFor(variableId) {
-    const root = await environmentStore.rootOfVariable(variableId);
-    if (root) return root;
-    return this.roots.get(variableId) ?? dirname(await keyedFilePath(FILENAME));
-  }
-  /** Where earlier versions kept them: read once, rewritten to their vaults. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME);
-  }
-  /** Les fichiers qui portent des surcharges : les coffres, et l'emplacement d'avant. */
-  async sourcePaths() {
-    const roots = await allVaultRoots();
-    return [
-      this.getLegacyFilePath(),
-      await keyedFilePath(FILENAME),
-      ...roots.map((root) => join3(root, FILENAME))
-    ];
-  }
-  /**
-   * Charger, et recharger quand les fichiers ont bougé sous nos pieds.
-   *
-   * L'empreinte se prend **après** `ensureProjectsLoaded` : la liste des coffres
-   * en dépend, et une empreinte prise sur une liste incomplète ne ressemblerait
-   * à aucune des suivantes — le store se rechargerait à chaque lecture.
-   */
-  async load() {
-    await this.disk.load(async () => {
-      if (!getEncryptionKey()) return null;
-      await ensureProjectsLoaded();
-      const fingerprint = await fingerprintFiles(await this.sourcePaths());
-      if (this.loaded && fingerprint === this.fingerprint) return null;
-      const next = await this.readVaults();
-      return () => {
-        this.data = next.data;
-        this.diskEncryptedSlots = next.diskEncryptedSlots;
-        this.roots = next.roots;
-        this.unreadableSecrets = next.unreadableSecrets;
-        this.fingerprint = fingerprint;
-        this.loaded = true;
-      };
-    });
-  }
-  /**
-   * Read every vault, then the places older versions used, into fresh tables
-   * that `load` swaps in at once.
-   *
-   * Variable ids are unique, so merging the files cannot collide; a vault read
-   * later simply wins over a legacy copy of the same override.
-   */
-  async readVaults() {
-    const data = {};
-    const diskEncryptedSlots = {};
-    const roots = /* @__PURE__ */ new Map();
-    const unreadableSecrets = /* @__PURE__ */ new Set();
-    for (const path of await this.sourcePaths()) {
-      let parsed;
-      try {
-        parsed = JSON.parse(await readFile2(path, "utf-8"));
-      } catch {
-        continue;
-      }
-      Object.assign(
-        diskEncryptedSlots,
-        extractEncryptedVariableSlots(parsed)
-      );
-      const decrypted = decryptVariableSlots(
-        parsed,
-        "environment-overrides",
-        (variableId) => unreadableSecrets.add(variableId),
-        vaultIdOfRoot(dirname(path))
-      );
-      for (const [id, override] of Object.entries(decrypted)) {
-        data[id] = { value: override.value };
-        roots.set(id, dirname(path));
-      }
-    }
-    return { data, diskEncryptedSlots, roots, unreadableSecrets };
-  }
-  save() {
-    return this.disk.save(() => this.doSave());
-  }
-  /**
-   * Write each vault that holds — or held — an override.
-   *
-   * A vault emptied by this save is still written, as an empty object: an
-   * override that moved to its project's vault must not survive in the one it
-   * came from.
-   */
-  async doSave() {
-    const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) byRoot.set(root, {});
-    for (const [variableId, override] of Object.entries(this.data)) {
-      const root = await this.rootFor(variableId);
-      this.roots.set(variableId, root);
-      const bucket = byRoot.get(root) ?? {};
-      bucket[variableId] = override;
-      byRoot.set(root, bucket);
-    }
-    for (const [root, overrides] of byRoot) {
-      const encrypted = this.keepUnreadableSecrets(encryptVariableSlots(
-        overrides,
-        this.diskEncryptedSlots,
-        vaultIdOfRoot(root)
-      ));
-      Object.assign(
-        this.diskEncryptedSlots,
-        extractEncryptedVariableSlots(encrypted)
-      );
-      await mkdir(root, { recursive: true });
-      const path = join3(root, FILENAME);
-      const tmpPath = path + ".tmp";
-      await writeFile(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
-      await renameWithRetry(tmpPath, path);
-      await chmod(path, 384);
-    }
-  }
-  /**
-   * Rendre au disque le chiffré d'une surcharge illisible, plutôt qu'un blanc.
-   *
-   * Pendant du garde-fou du store des environnements : tant que la valeur en
-   * mémoire est vide, c'est que personne n'a retouché la variable et que son
-   * chiffré fait toujours foi.
-   */
-  keepUnreadableSecrets(overrides) {
-    if (this.unreadableSecrets.size === 0) return overrides;
-    const result = { ...overrides };
-    for (const variableId of this.unreadableSecrets) {
-      const ciphertext = this.diskEncryptedSlots[variableId];
-      const override = result[variableId];
-      if (!ciphertext || !override || override.value.value) continue;
-      result[variableId] = { ...override, value: { ...override.value, value: ciphertext } };
-    }
-    return result;
-  }
-  async getOverride(variableId) {
-    await this.load();
-    return this.data[variableId] ?? null;
-  }
-  async setOverride(variableId, override) {
-    await this.load();
-    this.data[variableId] = { value: override.value };
-    await this.save();
-  }
-  async removeOverride(variableId) {
-    await this.load();
-    if (!this.data[variableId]) return;
-    delete this.data[variableId];
-    this.unreadableSecrets.delete(variableId);
-    await this.save();
-  }
-  async getAll() {
-    await this.load();
-    return { ...this.data };
-  }
-  async removeOverridesForVariables(variableIds) {
-    await this.load();
-    let changed = false;
-    for (const id of variableIds) {
-      if (this.data[id]) {
-        delete this.data[id];
-        this.unreadableSecrets.delete(id);
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-};
-var environmentOverridesStore = new EnvironmentOverridesStore();
-
-// ../server/src/services/environment-resolver.ts
-function interpolateValue(raw, envContext) {
-  return raw.replace(/\{\{environment\.([^}]+)\}\}/g, (match, key) => {
-    return envContext[key] !== void 0 ? envContext[key] : match;
-  });
-}
-function resolveVariable(variable, envContext) {
-  const slot = variable.value;
-  const finalValue = interpolateValue(slot.pre, envContext) + interpolateValue(slot.value, envContext) + interpolateValue(slot.post, envContext);
-  return { value: finalValue, isSecret: slot.isSecret };
-}
-function slotReferenceText(variable) {
-  const slot = variable.value;
-  return `${slot.pre}
-${slot.value}
-${slot.post}`;
-}
-var HIDDEN_VALUES_NOTICE = `Values shown as ${MASKED_VALUE} are secrets their author did not share with AI. The service does receive them: never treat such a key as missing, and never pass ${MASKED_VALUE} as its value.`;
-function filterEnvForAi(resolved, sharedKeys) {
-  const secret = new Set(resolved.envSecrets);
-  const shared = new Set(sharedKeys);
-  const env2 = {};
-  const envSecrets = [];
-  const hiddenKeys = [];
-  for (const [key, value] of Object.entries(resolved.env)) {
-    const hidden = secret.has(key) && !shared.has(key);
-    env2[key] = hidden ? MASKED_VALUE : value;
-    if (secret.has(key)) envSecrets.push(key);
-    if (hidden) hiddenKeys.push(key);
-  }
-  return {
-    env: env2,
-    envSecrets,
-    hiddenKeys,
-    ...hiddenKeys.length > 0 ? { hiddenNotice: HIDDEN_VALUES_NOTICE } : {}
-  };
-}
-function describeVariables(environments, ctx) {
-  const details = [];
-  for (const environment of environments) {
-    for (const [variableId, variable] of Object.entries(environment.variables ?? {})) {
-      const slot = variable.value;
-      const isOverridden = ctx.overriddenVariableIds.has(variableId);
-      const isSecret = slot.isSecret || ctx.resolvedSecretKeys.has(variable.key);
-      const readableByAi = ctx.maskedKeys.has(variable.key) ? false : !isSecret || isSharedWithAi(slot);
-      details.push({
-        key: variable.key,
-        inService: ctx.serviceKeys.has(variable.key),
-        environmentId: environment.id,
-        environmentName: environment.name,
-        scope: environment.scope,
-        ...environment.scope === "service" && environment.reference ? { environmentServiceId: environment.reference } : {},
-        ...slot.description ? { description: slot.description } : {},
-        secret: isSecret,
-        readableByAi,
-        injectedIntoAi: slot.injectIntoAi,
-        required: slot.required,
-        overrideOnly: slot.overrideOnly,
-        overridden: isOverridden,
-        ...isOverridden && ctx.sharedValues[variable.key] !== void 0 ? { sharedValue: ctx.sharedValues[variable.key] } : {}
-      });
-    }
-  }
-  return details.sort((a, b) => a.key.localeCompare(b.key) || a.environmentName.localeCompare(b.environmentName));
-}
-function withOverriddenValue(variable, override) {
-  return {
-    ...variable,
-    value: {
-      ...variable.value,
-      value: override.value,
-      pre: override.pre,
-      post: override.post
-    }
-  };
-}
-var EnvironmentResolver = class {
-  async resolveForService(ctx, opts) {
-    if (!ctx.activeEnvironmentId) {
-      return { env: {}, envSecrets: [] };
-    }
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    if (!serviceEnv) {
-      return this.resolveEnvironment(ctx.activeEnvironmentId, opts);
-    }
-    return this.resolveEnvironment(serviceEnv.id, opts);
-  }
-  /**
-   * `applyOverrides: false` rend ce que l'équipe partage, sans ce que ce poste
-   * a mis par-dessus : c'est la réponse à « qu'est-ce que ma surcharge
-   * remplace ». Le défaut reste `true` — tout le reste du produit veut la
-   * valeur avec laquelle le service tourne réellement.
-   */
-  async resolveEnvironment(environmentId, opts) {
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = opts?.applyOverrides === false ? {} : await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-      }
-    }
-    const rawEnv = {};
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
-    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
-    const env2 = {};
-    const envSecrets = [];
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
-      env2[variable.key] = value;
-      if (isSecret || secretKeys.has(variable.key)) {
-        envSecrets.push(variable.key);
-      }
-    }
-    return { env: env2, envSecrets };
-  }
-  /**
-   * Resolve an environment (with inheritance) and return only the variables
-   * flagged `injectIntoAi`, as a flat KEY→value dict ready to be injected into
-   * the process environment of an AI agent spawn.
-   */
-  async resolveAiInjectedEnv(environmentId) {
-    if (!environmentId) return {};
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-      }
-    }
-    const rawEnv = {};
-    for (const variable of Object.values(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx } = await this.buildInterpolationContext(
-      environmentId,
-      rawEnv,
-      result.parentEnv,
-      result.parentSecretKeys,
-      result.parentKeySources
-    );
-    const injected = {};
-    for (const variable of Object.values(result.variables)) {
-      if (!variable.value.injectIntoAi) continue;
-      const { value } = resolveVariable(variable, interpolationCtx);
-      injected[variable.key] = value;
-    }
-    return injected;
-  }
-  /**
-   * Les variables qu'il faut remplir avant qu'un service de cet environnement
-   * puisse démarrer.
-   *
-   * Deux motifs, et ils ne se mesurent pas au même endroit :
-   *
-   * - `required` porte sur la valeur **finale**, interpolation et surcharge
-   *   comprises : une variable obligatoire dont la valeur ne tient qu'à une
-   *   référence morte est aussi vide qu'une case blanche.
-   * - `overrideOnly` porte sur l'**existence d'une surcharge machine**. Elle
-   *   n'a par construction pas de valeur partagée ; ce qui manque n'est pas un
-   *   contenu, c'est la réponse de ce poste-ci.
-   *
-   * Les drapeaux se lisent sur la définition, jamais sur le slot résolu : une
-   * surcharge remplace le slot entier et ne porte aucun drapeau — les y lire
-   * rendrait toute variable surchargée silencieusement facultative.
-   */
-  async findMissingVariables(environmentId) {
-    if (!environmentId) return [];
-    const [{ env: env2 }, definitions, overridesByKey] = await Promise.all([
-      this.resolveEnvironment(environmentId),
-      this.resolveDag(environmentId, /* @__PURE__ */ new Set()),
-      this.resolveOverridesByKey(environmentId)
-    ]);
-    const missing = [];
-    for (const [variableId, variable] of Object.entries(definitions.variables)) {
-      const slot = variable.value;
-      const source = definitions.sources[variableId];
-      const base = {
-        variableId,
-        key: variable.key,
-        description: slot.description,
-        isSecret: slot.isSecret,
-        environmentId: source?.environmentId ?? environmentId,
-        environmentName: source?.environmentName ?? ""
-      };
-      if (slot.overrideOnly && !overridesByKey[variable.key]) {
-        missing.push({ ...base, reason: "overrideOnly" });
-        continue;
-      }
-      if (slot.required && (env2[variable.key] ?? "") === "") {
-        missing.push({ ...base, reason: "required" });
-      }
-    }
-    return missing;
-  }
-  /**
-   * Tout ce qu'il reste à remplir sous l'environnement courant.
-   *
-   * Deux périmètres, et il faut les deux :
-   *
-   * 1. **L'environnement courant lui-même**, héritage compris —
-   *    `findMissingVariables` remonte ses `parentIds`. C'est là que vivent les
-   *    variables globales du projet, et c'est la première branche balayée.
-   * 2. **Les environnements de service qui s'activent avec lui**
-   *    (`activateOn`). Ceux-là ne sont pas des ancêtres du global : ils en
-   *    héritent, dans l'autre sens. Ne pas y descendre revenait à ne rien
-   *    réclamer d'un service jusqu'à ce qu'on essaie de le démarrer.
-   *
-   * Dédoublonné par identifiant de variable : une variable du global remonte
-   * dans chaque branche de service qui en hérite, et l'assistant ne doit pas
-   * demander deux fois la même chose.
-   */
-  async findMissingForActiveEnvironment(globalEnvId) {
-    if (!globalEnvId) return [];
-    const serviceEnvs = await environmentStore.listByActivateOn(globalEnvId);
-    const branches = await Promise.all([
-      this.findMissingVariables(globalEnvId),
-      ...serviceEnvs.map((env2) => this.findMissingVariables(env2.id))
-    ]);
-    const seen = /* @__PURE__ */ new Set();
-    const missing = [];
-    for (const branch of branches) {
-      for (const item of branch) {
-        if (seen.has(item.variableId)) continue;
-        seen.add(item.variableId);
-        missing.push(item);
-      }
-    }
-    return missing;
-  }
-  /**
-   * Les clés que leur auteur a partagées avec les IA, héritage compris.
-   *
-   * Le partage se lit sur la **définition**, et seulement là : une surcharge
-   * machine ne dit que la valeur de ce poste (`withOverriddenValue`). Il n'y a
-   * donc qu'un endroit où ce drapeau existe, et rien à réconcilier.
-   *
-   * Des clés, pas des valeurs : la valeur rendue reste celle que le service
-   * reçoit, surcharges et interpolation comprises.
-   */
-  async resolveAiSharedKeys(environmentId) {
-    if (!environmentId) return /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, /* @__PURE__ */ new Set());
-    const keys = /* @__PURE__ */ new Set();
-    for (const variable of Object.values(result.variables)) {
-      if (isSharedWithAi(variable.value)) keys.add(variable.key);
-    }
-    return keys;
-  }
-  /**
-   * Idem, pour ce qu'un service verra réellement : son environnement dédié
-   * quand il en a un, l'environnement global sinon — la règle de sélection de
-   * `resolveForService`.
-   */
-  async resolveAiSharedKeysForService(ctx) {
-    if (!ctx.activeEnvironmentId) return /* @__PURE__ */ new Set();
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    return this.resolveAiSharedKeys(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
-  }
-  /**
-   * Idem, pour ce qu'un service verra réellement : son environnement dédié
-   * quand il en a un, l'environnement global sinon. Miroir de
-   * `resolveForService`, dont il partage la règle de sélection.
-   */
-  async findMissingForService(ctx) {
-    if (!ctx.activeEnvironmentId) return [];
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    return this.findMissingVariables(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
-  }
-  async resolveEnvironmentWithSources(environmentId) {
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-        result.sources[varId] = {
-          ...result.sources[varId],
-          overridden: true,
-          ...override.source ? { overriddenBy: override.source } : {}
-        };
-      }
-    }
-    const rawEnv = {};
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys, keySources } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
-    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
-    const env2 = {};
-    const envSecrets = [];
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
-      env2[variable.key] = value;
-      if (isSecret || secretKeys.has(variable.key)) {
-        envSecrets.push(variable.key);
-      }
-    }
-    const refPattern = /^\{\{environment\.([^}]+)\}\}$/;
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const match = variable.value.value.match(refPattern);
-      if (match) {
-        const refSource = keySources[match[1]];
-        if (refSource && result.sources[varId]?.environmentId !== refSource.environmentId) {
-          result.sources[varId] = {
-            ...result.sources[varId],
-            resolvedFrom: refSource
-          };
-        }
-      }
-    }
-    return {
-      variables: result.variables,
-      env: env2,
-      envSecrets,
-      sources: result.sources
-    };
-  }
-  /** Check if a raw value string interpolates any key that is secret in the context */
-  /**
-   * Toutes les clés dont la valeur est, directement ou par interpolation, un
-   * secret.
-   *
-   * Le contexte d'interpolation ne connaît que les secrets *hérités* : les
-   * secrets définis dans le même environnement n'y figurent pas, si bien qu'un
-   * `AUTH='Bearer {{environment.TOKEN}}'` voisin de son propre `TOKEN` secret
-   * ressortait non marqué — et donc non masqué par toute la chaîne en aval.
-   *
-   * On part des secrets hérités plus ceux déclarés ici, puis on propage
-   * jusqu'au point fixe : une valeur qui référence une clé secrète devient
-   * secrète à son tour, y compris en chaîne (A secret → B cite A → C cite B).
-   */
-  collectSecretKeys(variables, parentSecretKeys) {
-    const secretKeys = new Set(parentSecretKeys);
-    for (const variable of Object.values(variables)) {
-      if (variable.value.isSecret) secretKeys.add(variable.key);
-    }
-    let changed = true;
-    while (changed) {
-      changed = false;
-      for (const variable of Object.values(variables)) {
-        if (secretKeys.has(variable.key)) continue;
-        if (this.interpolatesSecretKey(slotReferenceText(variable), secretKeys)) {
-          secretKeys.add(variable.key);
-          changed = true;
-        }
-      }
-    }
-    return secretKeys;
-  }
-  interpolatesSecretKey(rawValue, ctxSecretKeys) {
-    const refs2 = [...rawValue.matchAll(/\{\{environment\.([^}]+)\}\}/g)].map((m) => m[1]);
-    return refs2.some((ref) => ctxSecretKeys.has(ref));
-  }
-  /**
-   * Build the interpolation context for an environment.
-   *
-   * For inheriting envs (has parents): start from parent concrete values,
-   * then overlay with current concrete values. This ensures that
-   * {{environment.KEY}} resolves against the parent's value when the child
-   * redefines KEY as an interpolation reference.
-   *
-   * For isolated service envs (scope=service, activateOn set, no parents):
-   * the global env is resolved and used as fallback.
-   */
-  async buildInterpolationContext(environmentId, rawEnv, parentEnv, parentSecretKeys, parentKeySources) {
-    const environment = await environmentStore.get(environmentId);
-    if (environment && environment.scope === "service" && environment.activateOn && (!environment.parentIds || environment.parentIds.length === 0)) {
-      const globalResolved = await this.resolveEnvironmentWithSources(environment.activateOn);
-      const secretKeys = new Set(globalResolved.envSecrets);
-      const keySources = {};
-      for (const [varId, variable] of Object.entries(globalResolved.variables)) {
-        const source = globalResolved.sources[varId];
-        if (source) {
-          keySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
-        }
-      }
-      const ctx2 = { ...globalResolved.env };
-      for (const [key, value] of Object.entries(rawEnv)) {
-        if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
-          ctx2[key] = value;
-        }
-      }
-      return { ctx: ctx2, secretKeys, keySources };
-    }
-    const ctx = { ...parentEnv };
-    for (const [key, value] of Object.entries(rawEnv)) {
-      if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
-        ctx[key] = value;
-      }
-    }
-    return { ctx, secretKeys: parentSecretKeys, keySources: parentKeySources };
-  }
-  /**
-   * For service-scoped envs, compute effective parentIds by also including
-   * the service-scoped envs of ancestor global environments.
-   *
-   * Example: "Server (test)" has parentIds=[test-global]. test-global has
-   * parentIds=[Local-global]. This method adds "Server (Local)" to the
-   * effective parents so service-specific variables from ancestor envs
-   * are inherited correctly.
-   */
-  async getEffectiveParentIds(environment) {
-    if (environment.scope !== "service" || !environment.reference || !environment.activateOn) {
-      return environment.parentIds;
-    }
-    const additionalIds = [];
-    for (const parentId of environment.parentIds) {
-      const parentEnv = await environmentStore.get(parentId);
-      if (!parentEnv || parentEnv.scope !== "global") continue;
-      for (const grandparentGlobalId of parentEnv.parentIds) {
-        const ancestorServiceEnv = await environmentStore.findServiceEnvironment(environment.reference, grandparentGlobalId);
-        if (ancestorServiceEnv && !environment.parentIds.includes(ancestorServiceEnv.id)) {
-          additionalIds.push(ancestorServiceEnv.id);
-        }
-      }
-    }
-    if (additionalIds.length === 0) return environment.parentIds;
-    return [...environment.parentIds, ...additionalIds];
-  }
-  /**
-   * Project an environment's variables onto their overrides: keep only the
-   * variables that have one, and swap in the override's value slot. The key
-   * always comes from the definition.
-   *
-   * Feeding this projection back through `resolveDag` resolves the override
-   * chain with the exact same inheritance and dedup-by-key rules as the value
-   * chain — so an override set on a parent env is no longer swallowed when a
-   * child (or a service env) redeclares the same key.
-   */
-  projectOverrides(variables, overrides) {
-    const projected = {};
-    for (const [varId, variable] of Object.entries(variables)) {
-      const override = overrides[varId];
-      if (override) {
-        projected[varId] = { key: variable.key, value: override.value };
-      }
-    }
-    return projected;
-  }
-  /**
-   * Resolve the override chain independently of the value chain and return the
-   * winning override per variable key (empty when nothing is overridden).
-   */
-  async resolveOverridesByKey(environmentId) {
-    const allOverrides = await environmentOverridesStore.getAll();
-    if (Object.keys(allOverrides).length === 0) return {};
-    const result = await this.resolveDag(
-      environmentId,
-      /* @__PURE__ */ new Set(),
-      (variables) => this.projectOverrides(variables, allOverrides)
-    );
-    const byKey = {};
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const source = result.sources[varId];
-      byKey[variable.key] = {
-        variable,
-        ...source ? { source: { environmentId: source.environmentId, environmentName: source.environmentName } } : {}
-      };
-    }
-    return byKey;
-  }
-  async resolveDag(environmentId, visited, project) {
-    if (visited.has(environmentId)) {
-      throw new Error(`Circular dependency detected in environment inheritance for ${environmentId}`);
-    }
-    const environment = await environmentStore.get(environmentId);
-    if (!environment) {
-      throw new Error(`Environment "${environmentId}" not found`);
-    }
-    visited.add(environmentId);
-    const effectiveParentIds = await this.getEffectiveParentIds(environment);
-    const parentResults = [];
-    for (const parentId of effectiveParentIds) {
-      const parentVisited = new Set(visited);
-      const parentResult = await this.resolveDag(parentId, parentVisited, project);
-      parentResults.push(parentResult);
-    }
-    const mergedVariables = {};
-    const sources = {};
-    for (const result of parentResults) {
-      for (const [varId, variable] of Object.entries(result.variables)) {
-        for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-          if (existingVar.key === variable.key && existingId !== varId) {
-            delete mergedVariables[existingId];
-            delete sources[existingId];
-          }
-        }
-        mergedVariables[varId] = variable;
-        sources[varId] = result.sources[varId] ?? sources[varId];
-      }
-    }
-    const parentEnv = {};
-    const parentSecretKeys = /* @__PURE__ */ new Set();
-    const parentKeySources = {};
-    for (const [varId, variable] of Object.entries(mergedVariables)) {
-      const slot = variable.value;
-      parentEnv[variable.key] = slot.pre + slot.value + slot.post;
-      if (slot.isSecret) {
-        parentSecretKeys.add(variable.key);
-      }
-      const source = sources[varId];
-      if (source) {
-        parentKeySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
-      }
-    }
-    const isInterpRef = (v) => /\{\{environment\.[^}]+\}\}/.test(v);
-    for (const result of parentResults) {
-      for (const [key, value] of Object.entries(result.parentEnv)) {
-        const existingIsRef = key in parentEnv && isInterpRef(parentEnv[key]);
-        const newIsConcrete = !isInterpRef(value);
-        if (!(key in parentEnv) || existingIsRef && newIsConcrete) {
-          parentEnv[key] = value;
-        }
-      }
-      for (const key of result.parentSecretKeys) {
-        parentSecretKeys.add(key);
-      }
-      for (const [key, source] of Object.entries(result.parentKeySources)) {
-        if (!(key in parentKeySources)) {
-          parentKeySources[key] = source;
-        }
-      }
-    }
-    for (const key of this.collectSecretKeys(mergedVariables, parentSecretKeys)) {
-      parentSecretKeys.add(key);
-    }
-    const ownVariables = project ? project(environment.variables) : environment.variables;
-    for (const [varId, variable] of Object.entries(ownVariables)) {
-      let wasInherited = varId in mergedVariables;
-      for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-        if (existingVar.key === variable.key && existingId !== varId) {
-          delete mergedVariables[existingId];
-          delete sources[existingId];
-          wasInherited = true;
-        }
-      }
-      mergedVariables[varId] = variable;
-      sources[varId] = {
-        environmentId: environment.id,
-        environmentName: environment.name,
-        overridden: wasInherited
-      };
-    }
-    return {
-      variables: mergedVariables,
-      sources,
-      parentEnv,
-      parentSecretKeys,
-      parentKeySources
-    };
-  }
-};
-var environmentResolver = new EnvironmentResolver();
-
-// ../../packages/ai-capabilities/src/capabilities.ts
-import { z as z3 } from "zod";
-function toList(raw) {
-  if (!raw) return [];
-  const text = raw.trim();
-  if (text.startsWith("[")) {
-    try {
-      const parsed = JSON.parse(text);
-      if (Array.isArray(parsed)) return parsed.map((v) => String(v).trim()).filter(Boolean);
-    } catch {
-    }
-  }
-  return text.split(",").map((v) => v.trim().replace(/^["'[]+|["'\]]+$/g, "")).filter(Boolean);
-}
-function clearable(raw, parse, key) {
-  if (raw === void 0) return {};
-  const text = String(raw).trim();
-  if (!text || text === "null") return { [key]: null };
-  return { [key]: parse(text) };
-}
-function gitTarget(p) {
-  return {
-    ...p.serviceId ? { serviceId: p.serviceId } : {},
-    ...p.projectId ? { projectId: p.projectId } : {},
-    ...p.agentId ? { agentId: p.agentId } : {},
-    ...p.orgId ? { orgId: p.orgId } : {}
-  };
-}
-var toBool = (raw) => raw.trim().toLowerCase() === "true";
-var newId = () => globalThis.crypto.randomUUID();
-function listItem(raw) {
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return raw;
-  }
-}
-function parseTyped(name, schema, raw) {
-  if (raw === void 0) return void 0;
-  let result = raw.trim() === "null" ? schema.safeParse(null) : schema.safeParse(raw);
-  if (!result.success && raw.trim() === "null") result = schema.safeParse(raw);
-  if (!result.success) {
-    const text = raw.trim();
-    const json = listItem(text);
-    if (json !== text) result = schema.safeParse(json);
-    if (!result.success && !/^[[{]/.test(text)) {
-      const list = schema.safeParse(toList(text).map(listItem));
-      if (list.success) result = list;
-    }
-  }
-  if (!result.success) throw new Error(`${name}: ${z3.prettifyError(result.error)}`);
-  return result.data;
-}
-function withIds(items) {
-  return items.map((item) => ({ ...item, id: item.id || newId() }));
-}
-var optionalId = (schema) => schema.extend({ id: z3.string().min(1).max(64).optional() });
-var DockerConfigInput = DockerConfigSchema.extend({
-  bootstrapCommands: z3.array(optionalId(BootstrapCommandSchema)).max(20).default([])
-}).refine((c) => !!c.image !== !!c.dockerfile, {
-  message: 'dockerConfig needs exactly one of "image" (an image to pull) or "dockerfile" (a Dockerfile to build)'
-});
-var SERVICE_FIELDS = [
-  { name: "description", description: "What the service is, in a sentence" },
-  { name: "agentId", description: "The agent that runs it, from list_agents. Omit to inherit from the environment.", clearable: true },
-  { name: "cwd", description: `Working directory, RELATIVE to the project root (e.g. "apps/web", or omit for the root). The project is synced between machines and lives in a different folder on each: Runeya resolves a relative cwd against each machine's own project folder, while an absolute path (/home/you/\u2026) breaks on every other machine. Use an absolute path only for something outside the project, written with ~ or an environment variable ($NAME) rather than a literal home directory.`, clearable: true },
-  { name: "command", description: 'Shortcut for a single command line (e.g. "npm run dev"). Replaces every existing command. Use commands for several.' },
-  { name: "commands", description: 'The processes of the service. They all start AT THE SAME TIME, in parallel, and the service runs while they run \u2014 not one after another. Use several for processes that live side by side (a web server and a worker). Steps that must follow each other (build, then install, then launch) go in ONE command chained with &&. A one-off action the user triggers by hand (build, deploy, read logs) is a shortcut, not a command. Each command runs in the service cwd, or its own "cwd", relative to the project root. No absolute paths of this machine: the service is synced to other machines. Replaces every existing command. "id" is generated when omitted; "shell" runs the line through a shell (default true).', schema: z3.array(optionalId(ServiceCommandSchema)).max(50) },
-  { name: "ports", description: "Ports the service listens on. Declare them: they become {{service.PORT}}, {{service.URL}} and {{services.<slug>.URL}} for the other services, which environment variables should reference instead of repeating the numbers.", schema: ServiceConfigSchema.shape.ports.unwrap().unwrap() },
-  { name: "groups", description: "Groups the service belongs to. Replaces the current ones.", schema: ServiceConfigSchema.shape.groups.unwrap().unwrap() },
-  { name: "url", description: "URL where the service is reached" },
-  { name: "localUrls", description: 'Local domain names routed to a port of the service (e.g. {"url":"api.localhost.dev","port":3000})', schema: ServiceConfigSchema.shape.localUrls.unwrap().unwrap() },
-  { name: "openapiUrl", description: "URL of its OpenAPI document" },
-  { name: "docsPath", description: "Where its markdown docs live, relative to cwd or absolute. Defaults to cwd." },
-  { name: "git", description: 'Its git repository: "remote" URL and "home" page', schema: ServiceConfigSchema.shape.git.unwrap(), clearable: true },
-  { name: "meta", description: "Free key/value metadata (strings)", schema: ServiceConfigSchema.shape.meta.unwrap(), clearable: true },
-  { name: "runner", description: '"native" runs the commands on the machine; "docker" runs the service in a container and then needs dockerConfig', schema: ServiceConfigSchema.shape.runner.unwrap().unwrap() },
-  { name: "dockerConfig", description: 'With runner "docker": the container. Exactly one of "image" (pull) or "dockerfile" (inline Dockerfile, built with "buildContext", "buildArgs", "targetStage"). Ports and volumes use Docker syntax ("8080:80", "./data:/data"); host paths in volumes relative to the service directory, never an absolute path of this machine. "useNativeCommand" runs the service commands inside the container instead of its CMD ("nativeCommandMode": one shared container or one per command). "bootstrapCommands" run once when the container starts. Replaces the whole Docker configuration: read it first with get_service to keep what you do not change.', schema: DockerConfigInput },
-  { name: "healthCheck", description: 'How to tell the service is ready: an HTTP "path" to call, or a "command" that must succeed', schema: HealthCheckSchema, clearable: true },
-  { name: "autoRestart", description: "Restart the service when it crashes", schema: z3.boolean() },
-  { name: "restartStrategy", description: "When to restart it", schema: RestartStrategySchema.unwrap() },
-  { name: "maxRestarts", description: "Give up after this many restarts", schema: ServiceConfigSchema.shape.maxRestarts.unwrap() },
-  { name: "restartBackoffMs", description: "Delay before a restart, in milliseconds", schema: ServiceConfigSchema.shape.restartBackoffMs.unwrap().unwrap() },
-  { name: "clearLogsOnStart", description: "Clear the logs each time the service starts", schema: z3.boolean() },
-  { name: "shortcuts", description: 'One-click actions shown on the service, run on demand and independently of the running commands (build, deploy, migrate, read logs). Same path rules as commands: relative to the project root, never an absolute path of this machine. Replaces the current ones. "id" is generated when omitted.', schema: z3.array(optionalId(ServiceShortcutSchema)).max(50) },
-  { name: "parserIds", description: "Log parsers applied to its output, by id", schema: ServiceConfigSchema.shape.parserIds.unwrap() },
-  { name: "logSources", description: 'Extra log sources beyond the console output (files, databases\u2026). Replaces the current ones. Credentials (mongo connectionString, mysql password) read as "***": send "***" back to keep the stored value, or the real value to change it.', schema: ServiceConfigSchema.shape.logSources.unwrap().unwrap() }
-];
-function serviceParams(clearable2) {
-  return SERVICE_FIELDS.map((f) => {
-    const nullable = clearable2 && f.clearable;
-    const base = f.schema ?? (nullable ? z3.string() : void 0);
-    return {
-      name: f.name,
-      description: nullable ? `${f.description} null clears it.` : f.description,
-      required: false,
-      ...base ? { schema: nullable ? base.nullable() : base } : {}
-    };
-  });
-}
-function serviceFields(p, params) {
-  const out = {};
-  for (const param of params) {
-    if (p[param.name] === void 0 || param.name === "command") continue;
-    out[param.name] = param.schema ? parseTyped(param.name, param.schema, p[param.name]) : p[param.name];
-  }
-  if (p.command !== void 0 && p.commands === void 0) out["commands"] = [{ label: "", command: p.command, shell: true }];
-  if (Array.isArray(out["commands"])) out["commands"] = withIds(out["commands"]);
-  if (Array.isArray(out["shortcuts"])) out["shortcuts"] = withIds(out["shortcuts"]);
-  const docker = out["dockerConfig"];
-  if (docker?.bootstrapCommands) out["dockerConfig"] = { ...docker, bootstrapCommands: withIds(docker.bootstrapCommands) };
-  return out;
-}
-function maskServices(result) {
-  if (Array.isArray(result)) return result.map(maskServices);
-  if (result && typeof result === "object" && Array.isArray(result.logSources)) {
-    const service = result;
-    return { ...service, logSources: maskLogSourceSecrets(service.logSources) };
-  }
-  return result;
-}
-var refs = (scope) => BUILTIN_VARIABLES.filter((b) => b.scope === scope).map((b) => `{{${b.name}}}`).join(", ");
-var BUILTINS_HELP = `Built-in references Runeya fills itself \u2014 filled when the service is deployed, from the service that receives the variable: ${refs("server")}, the numbered {{service.PORT_2}} / {{service.URL_2}}\u2026 for its other ports, and {{services.<slug>.PORT}}, .URL, .BASE_URL, .NAME, .ID for a sibling service of the project (slug = its name in lowercase-dashes). Filled on the machine when the service starts: ${refs("agent")}.`;
-var CREATE_SERVICE_PARAMS = serviceParams(false);
-var UPDATE_SERVICE_PARAMS = serviceParams(true);
-var RUNEYA_CAPABILITIES = [
-  {
-    name: "list_services",
-    transformOutput: maskServices,
-    description: "List services, with the serviceId and agentId to use in other calls. Pass the projectId your context names to stay on the project the user is looking at, or another one from list_projects to look elsewhere. Called with no project, this can answer for every project of every organization on the machine \u2014 far more than the interface shows.",
-    route: "service.list",
-    method: "GET",
-    params: [
-      { name: "projectId", description: "Restrict to this project, from list_projects. Omit to list every service on the machine.", required: false },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
-    ],
-    buildInput: (p) => p.projectId ? { projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} } : void 0
-  },
-  {
-    name: "get_service_status",
-    description: "Get the current status (running, stopped, etc.) of a service. A service that has never been started on this agent has no process yet, and this answers 404 Process not found \u2014 that means STOPPED, not forbidden and not missing. Start it, or read its configuration with get_service.",
-    route: "process.get",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, id: p.serviceId })
-  },
-  {
-    name: "get_logs",
-    description: "Get the recent buffered logs for a service.",
-    route: "process.logs",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
-  },
-  {
-    name: "start_service",
-    description: "Start a service on an agent.",
-    route: "process.start",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to start", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  {
-    name: "stop_service",
-    description: "Stop a running service on an agent.",
-    route: "process.stop",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to stop", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  {
-    name: "restart_service",
-    description: "Restart a service on an agent (stop \u2192 redeploy \u2192 start).",
-    route: "process.restart",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to restart", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  // ─── Utility ─────────────────────────────────────────────────────────────
-  {
-    name: "wait",
-    description: "Wait for a given number of milliseconds before continuing.",
-    route: "utility.wait",
-    method: "POST",
-    params: [
-      { name: "ms", description: "Number of MILLISECONDS to wait. Convert from seconds: 1s=1000, 10s=10000, 1min=60000. Max 300000.", required: true }
-    ],
-    buildInput: (p) => ({ ms: Number(p.ms) }),
-    usageHint: '"wait 5s" \u2192 wait(ms=5000), "pause 10 seconds" \u2192 wait(ms=10000), "attends 3 secondes" \u2192 wait(ms=3000). Always convert to milliseconds.'
-  },
-  // ─── Kanban ───────────────────────────────────────────────────────────────
-  {
-    name: "kanban_list_boards",
-    description: "List the kanban boards of the organization. Returns the organizationId actually queried, the boardId to use in the other kanban tools, plus column and card counts. Cards themselves are not included \u2014 use kanban_get_board for those. An empty list means that organization really has no board: a failure to reach the cloud is reported as an error instead, never as an empty list.",
-    route: "kanban.listBoards",
-    method: "GET",
-    params: [
-      { name: "includeArchived", description: 'Set to "true" to include archived boards. Default: false.', required: false },
-      { name: "organizationId", description: "Which organization to read. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => ({
-      includeArchived: p.includeArchived === "true",
-      ...p.organizationId ? { organizationId: p.organizationId } : {}
-    })
-  },
-  {
-    name: "kanban_get_board",
-    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
-    route: "kanban.getBoard",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID, from kanban_list_boards", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId })
-  },
-  {
-    name: "kanban_get_card_comments",
-    description: "Read the comment thread of one kanban card, newest last: who wrote each comment (ai or user, with the person's name), when, its text, and its attachments. The comments in your task context are a snapshot taken when the task started \u2014 call this to see anything written since, whenever someone tells you a comment was added or kanban_get_board reports a higher commentCount than you have.",
-    route: "kanban.getCardComments",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID whose comments to read", required: true },
-      { name: "limit", description: "How many of the most recent comments to return (1-200). Default: 50.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.limit ? { limit: Number(p.limit) } : {}
-    }),
-    usageHint: '"le support a ajout\xE9 un commentaire" / "regarde les nouveaux commentaires" \u2192 kanban_get_card_comments(boardId, cardId). Never answer from the snapshot in your context when fresh comments are mentioned.'
-  },
-  {
-    name: "kanban_search_cards",
-    description: 'Search kanban cards by free text, matched against their title, body, comments and the support conversations they follow (title, messages, internal notes, and the names of message authors) \u2014 accent- and case-insensitive. Archived cards are included. Searches every board of the organization unless boardId narrows it down. createdBy narrows to the cards someone created ("les cartes cr\xE9\xE9es par Isabelle"), alone or with a query.',
-    route: "kanban.searchCards",
-    method: "GET",
-    params: [
-      { name: "query", description: "Text to look for in card titles, bodies, comments and followed conversations. Optional when createdBy is given.", required: false },
-      { name: "createdBy", description: "Only cards created by this author: a user id, or a name (accent- and case-insensitive, partial match).", required: false },
-      { name: "boardId", description: "Restrict the search to this board. Omit to search all boards.", required: false },
-      { name: "limit", description: "Maximum number of cards to return (1-100). Default: 25.", required: false },
-      { name: "organizationId", description: "Which organization to search. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => ({
-      ...p.query ? { query: p.query } : {},
-      ...p.createdBy ? { createdBy: p.createdBy } : {},
-      ...p.boardId ? { boardId: p.boardId } : {},
-      ...p.limit ? { limit: Number(p.limit) } : {},
-      ...p.organizationId ? { organizationId: p.organizationId } : {}
-    })
-  },
-  {
-    name: "kanban_download_attachment",
-    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context, from kanban_get_board, or from kanban_get_card_comments \u2014 a file attached to a comment downloads exactly like one attached to the card.",
-    route: "kanban.downloadAttachment",
-    method: "POST",
-    params: [
-      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true },
-      { name: "boardId", description: "The board the attachment comes from. Pass it whenever you know it: on a machine linked to several cloud accounts, it is what says which one holds the file.", required: false },
-      { name: "organizationId", description: "Which organization the attachment belongs to. Optional: needed only when neither the board id is known nor the machine has a single account.", required: false }
-    ],
-    buildInput: (p) => ({
-      attachmentId: p.attachmentId,
-      ...p.boardId ? { boardId: p.boardId } : {},
-      ...p.organizationId ? { orgId: p.organizationId } : {}
-    })
-  },
-  {
-    name: "kanban_move_card",
-    description: "Move a kanban card to another column. Use the exact column name.",
-    route: "kanban.moveCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID to move", required: true },
-      { name: "targetColumn", description: "Exact name of the target column", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, targetColumn: p.targetColumn })
-  },
-  {
-    name: "kanban_add_comment",
-    description: "Add a comment to a kanban card.",
-    route: "kanban.addComment",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "comment", description: "The comment text (markdown supported)", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, comment: p.comment })
-  },
-  {
-    name: "kanban_get_card_conversations",
-    description: "Read the customer support conversations (Intercom\u2026) linked to one kanban card: for each, its title, provider, state (open/resolved), link, the opening message and the thread of messages (author name, customer or team, internal note or not, date, text, attached files \u2014 fetch their bytes with kanban_download_attachment), plus the other cards following the same conversation. These messages are NOT comments of the card \u2014 read them here.",
-    route: "kanban.getCardConversations",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID whose conversations to read", required: true },
-      { name: "limit", description: "How many of the most recent messages to return per conversation (1-500). Default: 100.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.limit ? { limit: Number(p.limit) } : {}
-    }),
-    usageHint: `"regarde la conversation Intercom de la carte" / "qu'a dit le client" \u2192 kanban_get_card_conversations(boardId, cardId).`
-  },
-  {
-    name: "kanban_search_conversations",
-    description: "Search customer support conversations (Intercom\u2026) at the providers connected to the board's organization, by words of the conversation title, or by conversation number or URL. Read-only at the provider. Each result gives connectionId and externalId (needed to link it), title, state, a preview and the cards already following it.",
-    route: "kanban.searchConversations",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "Any kanban board ID of the organization to search in", required: true },
-      { name: "query", description: "Words of the conversation title, a conversation number, or a conversation URL", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, query: p.query })
-  },
-  {
-    name: "kanban_link_conversation",
-    description: "Link a customer support conversation found with kanban_search_conversations to a kanban card. Its whole thread is imported and new messages keep arriving on the card. A conversation can be linked to several cards. Nothing is written at the provider.",
-    route: "kanban.linkConversation",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID of the card", required: true },
-      { name: "cardId", description: "The card to link the conversation to", required: true },
-      { name: "connectionId", description: "The connectionId of the search result", required: true },
-      { name: "externalId", description: "The externalId of the search result", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, connectionId: p.connectionId, externalId: p.externalId })
-  },
-  {
-    name: "kanban_get_card_links",
-    description: "Read the filiation of a board: which card depends on which. Returns one entry per link (child card \u2194 parent card), plus the title, board, column, assignees and comment count of any linked card living on another board. Use it when a card context says it has a parent or sub-cards and you need their ids to read them.",
-    route: "kanban.getCardLinks",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID whose links to read", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId })
-  },
-  {
-    name: "kanban_set_card_parent",
-    description: "Link a kanban card to a parent card, or detach it. The parent is the card the other one depends on \u2014 an epic and its tasks, a bug and its follow-ups. A card has at most one parent, and setting a new one replaces it. Omit parentCardId to detach. kanban_get_board reports the current filiation as parentCardId / childCardIds on each card.",
-    route: "kanban.setCardParent",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID of the card being linked", required: true },
-      { name: "cardId", description: "The card that depends on the parent (the child)", required: true },
-      { name: "parentCardId", description: "The parent card ID. Omit to detach the card from its parent.", required: false },
-      { name: "parentBoardId", description: "The parent's board, when it lives on another board of the same organization. Defaults to boardId.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.parentCardId ? { parentCardId: p.parentCardId } : {},
-      ...p.parentBoardId ? { parentBoardId: p.parentBoardId } : {}
-    })
-  },
-  {
-    name: "kanban_place_card",
-    description: "Place an existing kanban card on another board of the same organization, without copying it \u2014 a reference. The card stays on its origin board; the target board gives it a column of its own. Editing, commenting, archiving or deleting the card from either board acts on the same card; moving it on the target board only moves the reference. Use it to show an issue from an issue list on a team kanban, for instance.",
-    route: "kanban.placeCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The board to place the card on (not its own board)", required: true },
-      { name: "cardId", description: "The card to place", required: true },
-      { name: "column", description: "The column on that board: its ID or its title", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, column: p.column })
-  },
-  {
-    name: "kanban_remove_card_placement",
-    description: "Remove a card from a board where it was placed as a reference. The card itself is untouched and stays on its origin board.",
-    route: "kanban.unplaceCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The board the reference is on", required: true },
-      { name: "cardId", description: "The card to remove from that board", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
-  },
-  {
-    name: "kanban_get_card_placements",
-    description: "List where a kanban card is: its origin board (home: true), then every board it is placed on as a reference, with the column on each. kanban_get_board flags a referenced card with an `origin` field naming its origin board.",
-    route: "kanban.getCardPlacements",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "Any board the card is on", required: true },
-      { name: "cardId", description: "The card", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
-  },
-  {
-    name: "kanban_add_card",
-    description: "Add a new card to a kanban column.",
-    route: "kanban.addCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "column", description: "Exact name of the target column", required: true },
-      { name: "title", description: "Card title", required: true },
-      { name: "content", description: "Card content in markdown", required: false }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, column: p.column, title: p.title, content: p.content })
-  },
-  {
-    name: "kanban_get_card",
-    description: "Read one kanban card by id, including archived ones. Cheaper than fetching the whole board, and the only way to read a card that has been archived.",
-    route: "kanban.getCard",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
-  },
-  {
-    name: "kanban_update_card",
-    description: "Update an existing kanban card. Only the fields you pass are changed; passing null to priority, color or deadline clears it. Prefer this over creating a second card when something needs correcting.",
-    route: "kanban.updateCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "title", description: "New title", required: false },
-      { name: "content", description: "New card content, in markdown", required: false },
-      { name: "priority", description: "Priority from 1 to 10, or null to clear it", required: false },
-      { name: "color", description: "Card colour, or null to clear it", required: false },
-      { name: "groups", description: "Labels, as a list of strings. Replaces the current ones.", required: false },
-      { name: "deadline", description: "Due date as YYYY-MM-DD, or null to clear it", required: false },
-      { name: "assignees", description: "User ids to assign, as a list. Replaces the current ones; use kanban_list_members to find the ids.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.title !== void 0 ? { title: p.title } : {},
-      ...p.content !== void 0 ? { content: p.content } : {},
-      // Tout arrive en chaîne : un modèle n'écrit pas des nombres, des listes
-      // ni des `null` typés. `clearable` distingue « efface » de « ne touche
-      // pas » — sans quoi vider une couleur serait impossible à exprimer, et
-      // changer un titre risquerait de vider le reste.
-      ...clearable(p.priority, (v) => Number(v), "priority"),
-      ...clearable(p.color, (v) => v, "color"),
-      ...clearable(p.deadline, (v) => v, "deadline"),
-      ...p.groups !== void 0 ? { groups: toList(p.groups) } : {},
-      ...p.assignees !== void 0 ? { assignees: toList(p.assignees) } : {}
-    })
-  },
-  {
-    name: "kanban_set_card_archived",
-    description: "Archive a kanban card (it leaves the board but is not deleted) or bring it back. An unarchived card returns to the column it left.",
-    route: "kanban.setCardArchived",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "archived", description: "true to archive, false to bring the card back", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, archived: p.archived === "true" })
-  },
-  {
-    name: "kanban_list_members",
-    description: "List the people of the organization who can be assigned to a card, with their ids. Needed before assigning anyone with kanban_update_card.",
-    route: "kanban.listMembers",
-    method: "GET",
-    params: [
-      { name: "organizationId", description: "Which organization. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => p.organizationId ? { organizationId: p.organizationId } : {}
-  },
-  // ─── Lecture seule ───────────────────────────────────────────────────────
-  //
-  // Tout ce qui se consulte sans rien changer. Les écritures s'ajoutent au cas
-  // par cas : aujourd'hui les services et leurs variables, plus bas.
-  //
-  // Volontairement absentes, et à ne pas ajouter sans y regarder à deux fois,
-  // parce qu'elles rendent un secret : `environment.list` / `get` / `resolve` /
-  // `resolveFlat` (un `Environment` porte ses variables, valeurs comprises),
-  // `apiKeys.list` / `reveal`, `setup.getEncryptionKeyHex` et `getOrgKeys`
-  // (clés de chiffrement), `settings.get` et `settings.listAIProviders` (clés
-  // de fournisseurs d'IA — `settings.getPaths` et `getNetwork`, eux, ne
-  // rendent que des chemins et une adresse, d'où leur présence ci-dessous),
-  // `cloudAuth.session`, `agent.getPassthroughEnv`. Un agent n'a pas besoin de
-  // ces valeurs pour travailler, et ce qu'il lit finit dans une transcription.
-  //
-  // La seule exception est `service.getEnv` (`get_service_env` ci-dessous),
-  // et elle n'en est une que parce qu'elle filtre : les variables publiques, et
-  // les seuls secrets que leur auteur a partagés avec les IA (`isSharedWithAi`
-  // — « Lisible par l'IA », ou l'injection, qui vaut la lecture). Un secret non
-  // partagé n'y apparaît pas, pas même par son nom.
-  {
-    name: "list_processes",
-    description: "List every process across all agents with its current state (running, stopped, exit code, uptime). Use this to see the whole machine at once, rather than calling get_service_status service by service. An agent only learns about a service when it is first started, so this lists what is deployed, not what is configured: an empty list means nothing has been started, not that you cannot see them \u2014 list_services shows what exists.",
-    route: "process.list",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_service",
-    transformOutput: maskServices,
-    description: "Read the full configuration of one service: its commands, ports, groups, runner, log sources and restart policy. list_services gives the ids.",
-    route: "service.get",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true }
-    ],
-    buildInput: (p) => ({ id: p.serviceId })
-  },
-  {
-    name: "get_service_env",
-    description: 'Read the environment variables a service runs with, and the project\'s variable inventory. `env` lists every key the service receives; a value reads "***" when it is a secret whose author did not share it with AI (sharing = ticking "AI read", or injecting it into the agents\' environment, which grants reading too). `envSecrets` says which keys are secret, `hiddenKeys` which ones are masked. A masked key is set on the service: never treat it as missing, never suggest adding it, and never pass "***" as a value \u2014 ask the user for it. `variables` describes every variable of the project \u2014 which environment defines it and its scope, its description, its flags, whether this machine overrides it, and `inService: false` for the ones this service does not receive. Use it to say where a variable must be changed instead of guessing. On an overridden variable, `sharedValue` is what the machine-local override replaces (the team\'s value, masked as "***" when unreadable); no other value appears there. This is the resolver: the values are what the service would receive \u2014 inheritance, {{environment.KEY}} references, this machine\'s overrides and server built-ins applied; agent built-ins stay as written until the service starts. Use it to check a variable you just composed. `unresolvedReferences` lists references nothing will fill (a typo, a variable that does not exist): fix them.',
-    route: "service.getEnv",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "environmentId", description: "A global environment of the project to resolve in instead of the active one, without activating it (from list_environments). Omit for the active one.", required: false }
-    ],
-    buildInput: (p) => ({ id: p.serviceId, ...p.environmentId ? { environmentId: p.environmentId } : {} })
-  },
-  // ─── Écrire un service et ses variables ────────────────────────────────────
-  //
-  // Les variables s'écrivent à l'aveugle (`environment.setVariableBlind`) : une
-  // IA remplace la valeur d'un secret sans la lire, et ne peut ni le rendre
-  // public, ni le partager avec les IA. La règle tient côté serveur, dans la
-  // route ; ces outils ne passent jamais par une route qui renvoie des valeurs
-  // (`upsertVariable`, `removeVariable`, `update` rendent l'environnement entier).
-  {
-    name: "create_service",
-    transformOutput: maskServices,
-    description: "Create a service, native or Docker, in a project: it joins the project and gets its environments in the same call. Pass the projectId your context names. Projects are synced between machines, so write paths relative to the project root and put machine-specific values (a device serial, a local token) in environment variables, referenced as $NAME in commands \u2014 see the cwd, commands and shortcuts parameters. Then set its variables with set_environment_variable.",
-    route: "service.create",
-    method: "POST",
-    params: [
-      { name: "name", description: "The service name", required: true },
-      { name: "projectId", description: "The project it joins: the one your context names, or another from list_projects. Without it, the service belongs to no project.", required: false },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false },
-      ...CREATE_SERVICE_PARAMS
-    ],
-    buildInput: (p) => {
-      const fields = serviceFields(p, CREATE_SERVICE_PARAMS);
-      if (fields["runner"] === "docker" && !fields["dockerConfig"]) {
-        throw new Error('dockerConfig: required with runner "docker" \u2014 give an "image" or a "dockerfile"');
-      }
-      return {
-        name: p.name,
-        ...fields,
-        ...p.projectId ? { projectId: p.projectId } : {},
-        ...p.orgId ? { orgId: p.orgId } : {}
-      };
-    }
-  },
-  {
-    name: "add_service_to_project",
-    description: "Add an existing service to a project, and create its environments \u2014 one for each of the project's environments, where its own variables go. Not needed after create_service, which already does it; calling it again changes nothing.",
-    route: "project.addService",
-    method: "POST",
-    params: [
-      { name: "projectId", description: "The project ID, from list_projects", required: true },
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
-    ],
-    buildInput: (p) => ({ projectId: p.projectId, serviceId: p.serviceId, ...p.orgId ? { orgId: p.orgId } : {} })
-  },
-  {
-    name: "update_service",
-    transformOutput: maskServices,
-    description: "Change any part of a service configuration \u2014 commands, ports, health check, restart policy, shortcuts, log sources, whether it runs natively or in Docker (runner, dockerConfig)\u2026 Only the fields you pass change; a list or an object you pass replaces the current one whole. Read the service first with get_service.",
-    route: "service.update",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "name", description: "New name", required: false },
-      { name: "orgId", description: "Move the service to this organization vault. Leave unset unless asked.", required: false, schema: z3.string().max(128).nullable() },
-      ...UPDATE_SERVICE_PARAMS
-    ],
-    buildInput: (p) => ({
-      id: p.serviceId,
-      ...p.name ? { name: p.name } : {},
-      ...p.orgId !== void 0 ? { orgId: parseTyped("orgId", z3.string().max(128).nullable(), p.orgId) } : {},
-      ...serviceFields(p, UPDATE_SERVICE_PARAMS)
-    })
-  },
-  {
-    name: "list_environments",
-    description: "List the environments of a project, with no value: each one's id, name and scope (global = shared by the whole project, service = one service's own variables), which global environment is active, which service a service environment belongs to and which global environment activates it, its parents (it inherits their variables), `isolated` when a service environment does not inherit from its global one, and the variables it defines with their flags. Empty environments are listed too \u2014 a service you just created has one per global environment, where its own variables go. Use it to find the environmentId before set_environment_variable.",
-    route: "environment.listForAi",
-    method: "GET",
-    params: [
-      { name: "projectId", description: "The project ID: the one your context names, or another from list_projects", required: true },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
-    ],
-    buildInput: (p) => ({ projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
-  },
-  {
-    name: "resolve_environment",
-    description: "Resolve one environment alone \u2014 its variables with those inherited from its parents and this machine's overrides \u2014 as an AI may read it: secrets not shared with AI read \"***\". Built-in references ({{service.*}}, {{services.*}}, {{agent.*}}\u2026) are NOT filled, since they depend on the service that receives the variable; use get_service_env for a service's final values. `unresolvedReferences` lists references nothing will fill: a misspelled {{environment.KEY}}, or a name that is no built-in.",
-    route: "environment.resolveForAi",
-    method: "GET",
-    params: [
-      { name: "environmentId", description: "The environment, from list_environments", required: true }
-    ],
-    buildInput: (p) => ({ environmentId: p.environmentId })
-  },
-  {
-    name: "set_environment_variable",
-    description: `Create or change an environment variable, by name, in one environment \u2014 global or service, same rules for both. Find the environmentId with list_environments. Where it belongs: a value shared by several services (a database host, an API base URL) goes ONCE in the active global environment; services inherit it. A value only one service needs goes in that service's environment (scope service, activated by the active global one), where it also overrides a global variable of the same name. Never hardcode what Runeya already knows: a service's own port is {{service.PORT}}, its own URL {{service.URL}}, another service's address {{services.<slug>.URL}} \u2014 a copied "3210" or "http://localhost:3211" breaks as soon as a port changes or the project runs on another machine. If the port a variable needs is not declared on its service, declare it there (update_service, ports) instead of writing the number. When a written value contains a port or URL of a project service, the response lists \`suggestions\`: rewrite the value with those references. Compose instead of copying: a value can reference another variable of the resolved environment as {{environment.KEY}} (e.g. "postgres://{{environment.DB_USER}}@{{environment.DB_HOST}}:5432"). ${BUILTINS_HELP} After writing, check the result with get_service_env (a service, optionally in another global environment) or resolve_environment (an environment alone). References are substituted in one pass: a reference to a variable whose own value is only a reference may stay unexpanded, so point at the variable that holds the actual value. $NAME is not a reference here: it only expands inside a shell command. pre and post are concatenated around the value, each resolved separately. You can replace a secret's value without reading it, and create a variable as secret. You cannot make a secret public nor make it readable by AI: that stays the user's decision. Never pass "***" as a value. The response never contains the value.`,
-    route: "environment.setVariableBlind",
-    method: "POST",
-    params: [
-      { name: "environmentId", description: "The environment that holds the variable, from list_environments", required: true },
-      { name: "key", description: "The variable name, e.g. DATABASE_URL", required: true },
-      { name: "value", description: "The new value, possibly with {{environment.KEY}} references. Omit to leave it unchanged.", required: false },
-      { name: "pre", description: 'Text put before the value (e.g. "https://"). Omit to leave it unchanged.', required: false },
-      { name: "post", description: 'Text put after the value (e.g. "/api"). Omit to leave it unchanged.', required: false },
-      { name: "isSecret", description: '"true" to store it as a secret. On an existing public variable, makes it secret.', required: false },
-      { name: "description", description: "What the variable is for, in markdown", required: false }
-    ],
-    buildInput: (p) => ({
-      environmentId: p.environmentId,
-      key: p.key,
-      ...p.value !== void 0 ? { value: p.value } : {},
-      ...p.pre !== void 0 ? { pre: p.pre } : {},
-      ...p.post !== void 0 ? { post: p.post } : {},
-      ...p.isSecret !== void 0 ? { isSecret: toBool(p.isSecret) } : {},
-      ...p.description !== void 0 ? { description: p.description } : {}
-    })
-  },
-  {
-    name: "set_environment_inheritance",
-    description: "Switch whether a service environment inherits the variables of the global environment that activates it (the default), or is isolated from it and receives only its own variables. list_environments shows this as `isolated`. Isolating a service is unusual: it loses every shared variable of the project. Do it only when the user asks, and never to work around a variable \u2014 override it in the service environment instead.",
-    route: "environment.setInheritanceBlind",
-    method: "POST",
-    params: [
-      { name: "environmentId", description: "A service environment (scope service), from list_environments", required: true },
-      { name: "inherit", description: '"true" to inherit from the global environment, "false" to isolate', required: true, schema: z3.boolean() }
-    ],
-    buildInput: (p) => ({ environmentId: p.environmentId, inherit: toBool(p.inherit ?? "true") })
-  },
-  {
-    name: "remove_environment_variable",
-    description: "Delete an environment variable, by name, from one environment. Its value is lost.",
-    route: "environment.removeVariableBlind",
-    method: "POST",
-    params: [
-      { name: "environmentId", description: "The environment that holds the variable", required: true },
-      { name: "key", description: "The variable name", required: true }
-    ],
-    buildInput: (p) => ({ environmentId: p.environmentId, key: p.key }),
-    destructive: true
-  },
-  {
-    name: "get_service_metrics",
-    description: "Read the CPU and memory currently used by a running service.",
-    route: "process.metrics",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
-  },
-  {
-    name: "list_agents",
-    description: "List the agents connected to this Runeya, with their status and whether they run on this machine. Passphrases are never returned.",
-    route: "agent.list",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "list_projects",
-    description: "List the projects known to this Runeya, with their ids and the services they hold.",
-    route: "project.list",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_project",
-    description: "Read one project: its services, its active environment, its organization.",
-    route: "project.get",
-    method: "GET",
-    params: [
-      { name: "projectId", description: "The project ID, from list_projects", required: true },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
-    ],
-    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
-  },
-  {
-    name: "list_project_paths",
-    description: "Where each project lives on this machine. Use it to find the directory to work in before reading or editing files.",
-    route: "project.localPaths",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "git_status",
-    description: "Read the git working tree of a service or a project: staged, modified and untracked files, current branch, ahead/behind counts.",
-    route: "git.status",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
-    ],
-    buildInput: (p) => gitTarget(p)
-  },
-  {
-    name: "git_log",
-    description: "Read the recent commits of a service or project repository: hash, author, date, message.",
-    route: "git.log",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
-      { name: "limit", description: "How many commits to return (1-200). Default: 50.", required: false }
-    ],
-    buildInput: (p) => ({ ...gitTarget(p), ...p.limit ? { limit: Number(p.limit) } : {} })
-  },
-  {
-    name: "git_branches",
-    description: "List the local and remote branches of a service or project repository.",
-    route: "git.branches",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
-    ],
-    buildInput: (p) => gitTarget(p)
-  },
-  {
-    name: "git_diff",
-    description: "Read the diff of a service or project repository \u2014 everything, or one file. Use it to see what changed before describing or reviewing it.",
-    route: "git.diff",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
-      { name: "path", description: "Restrict the diff to this file path", required: false },
-      { name: "staged", description: 'Set to "true" to read the staged diff instead of the working tree', required: false },
-      { name: "untracked", description: 'Set to "true" to include untracked files', required: false }
-    ],
-    buildInput: (p) => ({
-      ...gitTarget(p),
-      ...p.path ? { path: p.path } : {},
-      ...p.staged !== void 0 ? { staged: p.staged === "true" } : {},
-      ...p.untracked !== void 0 ? { untracked: p.untracked === "true" } : {}
-    })
-  },
-  {
-    name: "list_docs",
-    description: "List the markdown documentation files of a scope, as a tree. Pair it with read_doc to answer from the project's own docs rather than from guesswork.",
-    route: "wiki.list",
-    method: "GET",
-    params: [
-      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true }
-    ],
-    buildInput: (p) => ({ scope: p.scope })
-  },
-  {
-    name: "read_doc",
-    description: "Read one markdown documentation file. Paths come from list_docs; only .md and .markdown can be read.",
-    route: "wiki.read",
-    method: "GET",
-    params: [
-      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true },
-      { name: "path", description: "Relative path of the file, as returned by list_docs", required: true }
-    ],
-    buildInput: (p) => ({ scope: p.scope, path: p.path })
-  },
-  {
-    name: "get_server_logs",
-    description: "Read Runeya's own recent log entries. Use it to explain why Runeya itself misbehaved \u2014 not to read a service's output, which is get_logs.",
-    route: "diagnostics.recentLogs",
-    method: "GET",
-    params: [
-      { name: "limit", description: "How many entries to return (1-2000). Default: 500.", required: false }
-    ],
-    buildInput: (p) => p.limit ? { limit: Number(p.limit) } : void 0
-  },
-  {
-    name: "get_kanban_queue_state",
-    description: "Read the state of the kanban task queue: what is running, what is waiting. Use it before queuing work, or to explain why a card has not started.",
-    route: "kanbanQueue.getState",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "export_project",
-    description: "Read a project and every service it holds in one call, with secrets stripped out. Cheaper and safer than calling get_service for each service \u2014 prefer it whenever you need the whole picture of a project.",
-    route: "project.export",
-    method: "GET",
-    params: [
-      { name: "projectId", description: "The project ID, from list_projects", required: true },
-      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
-    ],
-    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
-  },
-  {
-    name: "git_remotes",
-    description: "List the git remotes of a service or project repository, with their URLs.",
-    route: "git.remotes",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
-    ],
-    buildInput: (p) => gitTarget(p)
-  },
-  {
-    name: "git_stash_list",
-    description: "List the stashes of a service or project repository. Useful before assuming work was lost: it may simply be stashed.",
-    route: "git.stashList",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "Target the repository of this service", required: false },
-      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
-      { name: "agentId", description: "The agent hosting the repository", required: false },
-      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
-    ],
-    buildInput: (p) => gitTarget(p)
-  },
-  {
-    name: "get_runeya_version",
-    description: "Read the version of Runeya running here, the latest published one, and whether this install is up to date. Use it before blaming a bug on the code: the machine may simply be behind.",
-    route: "health.versionInfo",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_runeya_paths",
-    description: "Read where Runeya keeps its things on this machine: its launch directory, its data directory, and the machine-wide directory holding cloud projects.",
-    route: "settings.getPaths",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_network_info",
-    description: "Read where this Runeya listens (host and port) and whether it is reachable from the local network, with the URLs to use. Use it to give someone a working link instead of guessing one.",
-    route: "settings.getNetwork",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "list_runeya_instances",
-    description: "List every Runeya answering on this machine, this one included, with its port and directory. Use it when a port is taken or when two instances seem to disagree.",
-    route: "diagnostics.instances",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_cloud_status",
-    description: "Say whether this Runeya is linked to a cloud account, and to which cloud. A kanban tool failing for lack of a cloud link is explained here.",
-    route: "cloudAuth.status",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  }
-];
-
-// ../../packages/ai-capabilities/src/adapters/json-schema.ts
-import { z as z4 } from "zod";
-function paramJsonSchema(param) {
-  if (!param.schema) return { type: "string", description: param.description };
-  const { $schema: _ignored, ...schema } = z4.toJSONSchema(param.schema, { io: "input", unrepresentable: "any" });
-  return { ...schema, description: param.description };
-}
-
-// ../../packages/ai-capabilities/src/adapters/anthropic.ts
-function buildAnthropicTools(capabilities) {
-  return capabilities.map((cap) => ({
-    name: cap.name,
-    description: cap.description,
-    input_schema: {
-      type: "object",
-      properties: Object.fromEntries(
-        cap.params.map((p) => [p.name, paramJsonSchema(p)])
-      ),
-      required: cap.params.filter((p) => p.required).map((p) => p.name)
-    }
-  }));
-}
-
-// ../../packages/ai-capabilities/src/adapters/openai.ts
-function buildOpenAITools(capabilities) {
-  return capabilities.map((cap) => ({
-    type: "function",
-    function: {
-      name: cap.name,
-      description: cap.description,
-      parameters: {
-        type: "object",
-        properties: Object.fromEntries(
-          cap.params.map((p) => [p.name, paramJsonSchema(p)])
-        ),
-        required: cap.params.filter((p) => p.required).map((p) => p.name)
-      }
-    }
-  }));
-}
-
-// ../../packages/ai-capabilities/src/adapters/prompt.ts
-function buildToolSafetyInstruction(capabilities) {
-  const destructive = capabilities.filter((c) => c.destructive).map((c) => c.name);
-  const withHints = capabilities.filter((c) => c.usageHint);
-  const lines = ["## Tool use safety rules"];
-  if (destructive.length > 0) {
-    lines.push(`CRITICAL: Never call ${destructive.join(", ")} unless the user has EXPLICITLY and UNAMBIGUOUSLY requested it.`);
-    lines.push(`- Only call destructive tools (${destructive.join(", ")}) when the user explicitly uses action words for a specific service.`);
-  }
-  if (withHints.length > 0) {
-    lines.push("");
-    lines.push("## Tool usage hints");
-    for (const cap of withHints) {
-      lines.push(`- ${cap.usageHint}`);
-    }
-  }
-  return lines.join("\n");
-}
-
-// ../../packages/ai-capabilities/src/adapters/mcp.ts
-import { z as z5 } from "zod";
-function toRawParams(input, cap) {
-  const typed = new Set(cap?.params.filter((p) => p.schema).map((p) => p.name));
-  return Object.fromEntries(Object.entries(input).map(([k, v]) => [
-    k,
-    v === null && typed.has(k) ? "null" : v == null ? void 0 : typeof v === "object" ? JSON.stringify(v) : String(v)
-  ]));
-}
-
-// ../../packages/ai-capabilities/src/trpc-caller.ts
-async function callTrpc(baseUrl, route, method, input, authToken, fetchImpl = fetch) {
-  const headers = {
-    "Content-Type": "application/json",
-    "Authorization": `Bearer ${authToken}`
-  };
-  const url = method === "GET" && input ? `${baseUrl}/api/trpc/${route}?input=${encodeURIComponent(JSON.stringify(input))}` : `${baseUrl}/api/trpc/${route}`;
-  const res = await fetchImpl(url, {
-    method,
-    headers,
-    ...method === "POST" ? { body: JSON.stringify(input ?? {}) } : {},
-    signal: AbortSignal.timeout(15e3)
-  });
-  const json = await res.json();
-  if (json["error"]) throw new Error(JSON.stringify(json["error"]));
-  const result = json["result"];
-  return result?.["data"] ?? result ?? json;
-}
-async function runCapability(cap, baseUrl, params, authToken, fetchImpl = fetch) {
-  const result = await callTrpc(baseUrl, cap.route, cap.method, cap.buildInput(params), authToken, fetchImpl);
-  return cap.transformOutput ? cap.transformOutput(result) : result;
-}
-
-// ../../packages/ai-capabilities/src/project-anchor.ts
-function applyProjectAnchor(cap, params, anchor) {
-  const accepts = (name) => cap.params.some((p) => p.name === name);
-  const anchored = { ...params };
-  const mayAnchorOrg = !params["projectId"] || params["projectId"] === anchor.projectId;
-  if (anchor.projectId && accepts("projectId") && !anchored["projectId"]) {
-    anchored["projectId"] = anchor.projectId;
-  }
-  if (mayAnchorOrg && anchor.orgId && !anchored["orgId"] && accepts("orgId")) {
-    anchored["orgId"] = anchor.orgId;
-  }
-  if (mayAnchorOrg && anchor.orgId && !anchored["organizationId"] && accepts("organizationId")) {
-    anchored["organizationId"] = anchor.orgId;
-  }
-  return anchored;
-}
-
 // ../server/src/services/llms-txt-generator.ts
 function generateAdminLlmsTxt(services, jwt, project) {
   const lines = [];
@@ -2584,11 +840,11 @@ async function executeTool(rawName, input, apiKey, authToken, anchor = {}) {
 }
 
 // ../server/src/trpc/routers/service.ts
-import { z as z6 } from "zod";
+import { z as z3 } from "zod";
 import { TRPCError as TRPCError2 } from "@trpc/server";
 
 // ../server/src/services/audit-service.ts
-import { appendFile, readFile as readFile3, stat, rename, unlink, readdir as readdir2, mkdir as mkdir2 } from "fs/promises";
+import { appendFile, readFile as readFile2, stat, rename, unlink, readdir as readdir2, mkdir } from "fs/promises";
 var AUDIT_FILENAME = "audit.log";
 var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_AGE_DAYS = 30;
@@ -2608,7 +864,7 @@ var AuditService = class {
     const line = JSON.stringify(record) + "\n";
     const filepath = this.getFilePath();
     try {
-      await mkdir2(machineRoot(), { recursive: true });
+      await mkdir(machineRoot(), { recursive: true });
       await appendFile(filepath, line, "utf-8");
       await this.rotateIfNeeded();
     } catch (err) {
@@ -2621,7 +877,7 @@ var AuditService = class {
     const filepath = this.getFilePath();
     let lines;
     try {
-      const content = await readFile3(filepath, "utf-8");
+      const content = await readFile2(filepath, "utf-8");
       lines = content.trim().split("\n").filter(Boolean);
     } catch {
       return { entries: [], total: 0 };
@@ -2977,7 +1233,7 @@ async function resolveServiceVariables(service, opts = {}) {
   }
   return resolvedService;
 }
-var DockerConfigInput2 = DockerConfigSchema;
+var DockerConfigInput = DockerConfigSchema;
 var serviceRouter = router({
   /**
    * Sans filtre, la réponse couvre TOUT le poste : `serviceStore.list()` rend
@@ -2994,10 +1250,10 @@ var serviceRouter = router({
    * silencieux ferait croire au filtrage tout en rendant les services des
    * autres organisations.
    */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed by project or organization)", protect: true } }).input(z6.object({
-    projectId: z6.string().max(128).optional(),
-    orgId: z6.string().max(128).nullable().optional()
-  }).optional()).output(z6.any()).query(async ({ input, ctx }) => {
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed by project or organization)", protect: true } }).input(z3.object({
+    projectId: z3.string().max(128).optional(),
+    orgId: z3.string().max(128).nullable().optional()
+  }).optional()).output(z3.any()).query(async ({ input, ctx }) => {
     const all = await serviceStore.list();
     const allowedIds = getAllowedServiceIds(ctx);
     let filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
@@ -3017,7 +1273,7 @@ var serviceRouter = router({
       effectiveAgentId: await resolveEffectiveAgentId(s)
     })));
   }),
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z6.object({ id: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z3.object({ id: z3.string().max(128) })).output(z3.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const service = await serviceStore.get(input.id);
     if (!service) {
@@ -3043,11 +1299,11 @@ var serviceRouter = router({
    * valeurs** — où chacune est définie, ce que ses cases disent, et si ce
    * service la reçoit. Sans lui, un agent lisait l'effet sans la cause.
    */
-  getEnv: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}/env", tags: ["services"], summary: "Get a service's environment variables (unshared secrets masked) plus the project's value-free variable inventory", protect: true } }).input(z6.object({
-    id: z6.string().max(128),
+  getEnv: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}/env", tags: ["services"], summary: "Get a service's environment variables (unshared secrets masked) plus the project's value-free variable inventory", protect: true } }).input(z3.object({
+    id: z3.string().max(128),
     // Un environnement global du projet où résoudre, sans l'activer. Absent : l'actif.
-    environmentId: z6.string().max(128).optional()
-  })).output(z6.any()).query(async ({ input, ctx }) => {
+    environmentId: z3.string().max(128).optional()
+  })).output(z3.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const service = await serviceStore.get(input.id);
     if (!service) {
@@ -3094,38 +1350,38 @@ var serviceRouter = router({
       variables
     };
   }),
-  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z6.any()).input(
-    z6.object({
-      agentId: z6.string().max(128).optional(),
-      name: z6.string().min(1).max(200),
-      commands: z6.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z6.string().max(4096).optional(),
-      ports: z6.array(z6.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z6.array(z6.string().max(200)).max(20).optional(),
-      description: z6.string().max(2e3).optional(),
-      docsPath: z6.string().max(4096).optional(),
-      url: z6.string().max(2048).optional(),
-      localUrls: z6.array(z6.object({
-        url: z6.string().max(253),
-        port: z6.number().int().min(1).max(65535)
+  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z3.any()).input(
+    z3.object({
+      agentId: z3.string().max(128).optional(),
+      name: z3.string().min(1).max(200),
+      commands: z3.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z3.string().max(4096).optional(),
+      ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z3.array(z3.string().max(200)).max(20).optional(),
+      description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
+      url: z3.string().max(2048).optional(),
+      localUrls: z3.array(z3.object({
+        url: z3.string().max(253),
+        port: z3.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z6.string().max(2048).optional(),
-      git: z6.object({ remote: z6.string().max(2048).optional(), home: z6.string().max(2048).optional() }).optional(),
-      meta: z6.record(z6.string().max(256), z6.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z6.enum(["native", "docker"]).optional().default("native"),
-      dockerConfig: DockerConfigInput2.optional(),
+      openapiUrl: z3.string().max(2048).optional(),
+      git: z3.object({ remote: z3.string().max(2048).optional(), home: z3.string().max(2048).optional() }).optional(),
+      meta: z3.record(z3.string().max(256), z3.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z3.enum(["native", "docker"]).optional().default("native"),
+      dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.optional(),
-      autoRestart: z6.boolean().optional().default(false),
-      clearLogsOnStart: z6.boolean().optional(),
+      autoRestart: z3.boolean().optional().default(false),
+      clearLogsOnStart: z3.boolean().optional(),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z6.number().int().nonnegative().optional(),
-      restartBackoffMs: z6.number().int().positive().optional().default(1e3),
-      orgId: z6.string().max(128).nullable().optional(),
-      logSources: z6.array(LogSourceConfigSchema).max(20).optional(),
+      maxRestarts: z3.number().int().nonnegative().optional(),
+      restartBackoffMs: z3.number().int().positive().optional().default(1e3),
+      orgId: z3.string().max(128).nullable().optional(),
+      logSources: z3.array(LogSourceConfigSchema).max(20).optional(),
       // Le projet qui va l'adopter : le service naît dans son coffre.
-      projectId: z6.string().max(128).optional(),
-      shortcuts: z6.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z6.array(z6.string().max(128)).max(50).optional()
+      projectId: z3.string().max(128).optional(),
+      shortcuts: z3.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z3.array(z3.string().max(128)).max(50).optional()
     })
   ).mutation(async ({ input }) => {
     if (input.agentId) {
@@ -3151,38 +1407,38 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "create", entityType: "service", entityId: service.id, metadata: { name: input.name } });
     return service;
   }),
-  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z6.any()).input(
-    z6.object({
-      id: z6.string().max(128),
-      agentId: z6.string().max(128).nullable().optional(),
+  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z3.any()).input(
+    z3.object({
+      id: z3.string().max(128),
+      agentId: z3.string().max(128).nullable().optional(),
       // null = clear (inherit from env)
-      name: z6.string().min(1).max(200).optional(),
-      commands: z6.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z6.string().max(4096).nullable().optional(),
-      ports: z6.array(z6.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z6.array(z6.string().max(200)).max(20).optional(),
-      description: z6.string().max(2e3).optional(),
-      docsPath: z6.string().max(4096).optional(),
-      url: z6.string().max(2048).optional(),
-      localUrls: z6.array(z6.object({
-        url: z6.string().max(253),
-        port: z6.number().int().min(1).max(65535)
+      name: z3.string().min(1).max(200).optional(),
+      commands: z3.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z3.string().max(4096).nullable().optional(),
+      ports: z3.array(z3.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z3.array(z3.string().max(200)).max(20).optional(),
+      description: z3.string().max(2e3).optional(),
+      docsPath: z3.string().max(4096).optional(),
+      url: z3.string().max(2048).optional(),
+      localUrls: z3.array(z3.object({
+        url: z3.string().max(253),
+        port: z3.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z6.string().max(2048).optional(),
-      git: z6.object({ remote: z6.string().max(2048).optional(), home: z6.string().max(2048).optional() }).nullable().optional(),
-      meta: z6.record(z6.string().max(256), z6.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z6.enum(["native", "docker"]).optional(),
-      dockerConfig: DockerConfigInput2.optional(),
+      openapiUrl: z3.string().max(2048).optional(),
+      git: z3.object({ remote: z3.string().max(2048).optional(), home: z3.string().max(2048).optional() }).nullable().optional(),
+      meta: z3.record(z3.string().max(256), z3.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z3.enum(["native", "docker"]).optional(),
+      dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.nullable().optional(),
-      autoRestart: z6.boolean().optional(),
-      clearLogsOnStart: z6.boolean().optional(),
+      autoRestart: z3.boolean().optional(),
+      clearLogsOnStart: z3.boolean().optional(),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z6.number().int().nonnegative().optional(),
-      restartBackoffMs: z6.number().int().positive().optional(),
-      orgId: z6.string().max(128).nullable().optional(),
-      shortcuts: z6.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z6.array(z6.string().max(128)).max(50).optional(),
-      logSources: z6.array(LogSourceConfigSchema).max(20).optional()
+      maxRestarts: z3.number().int().nonnegative().optional(),
+      restartBackoffMs: z3.number().int().positive().optional(),
+      orgId: z3.string().max(128).nullable().optional(),
+      shortcuts: z3.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z3.array(z3.string().max(128)).max(50).optional(),
+      logSources: z3.array(LogSourceConfigSchema).max(20).optional()
     })
   ).mutation(async ({ input }) => {
     const existing = await serviceStore.get(input.id);
@@ -3238,7 +1494,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "update", entityType: "service", entityId: input.id });
     return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service), stoppedForAgentChange };
   }),
-  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z6.object({ id: z6.string().max(128) })).output(z6.object({ success: z6.literal(true) })).mutation(async ({ input }) => {
+  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z3.object({ id: z3.string().max(128) })).output(z3.object({ success: z3.literal(true) })).mutation(async ({ input }) => {
     const deleted = await serviceStore.delete(input.id);
     if (!deleted) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3246,7 +1502,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "delete", entityType: "service", entityId: input.id });
     return { success: true };
   }),
-  checkCwd: protectedProcedure.input(z6.object({ id: z6.string().max(128), checkReachability: z6.boolean().optional() })).query(async ({ input }) => {
+  checkCwd: protectedProcedure.input(z3.object({ id: z3.string().max(128), checkReachability: z3.boolean().optional() })).query(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3279,7 +1535,7 @@ var serviceRouter = router({
     }
     return { exists, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
-  cloneRepository: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).mutation(async ({ input }) => {
+  cloneRepository: protectedProcedure.input(z3.object({ id: z3.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3462,8 +1718,8 @@ var ScenarioStore = class {
 var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
-import { mkdir as mkdir3, rm, readFile as readFile4 } from "fs/promises";
-import { join as join4 } from "path";
+import { mkdir as mkdir2, rm, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
 function sanitizeSlug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "member";
 }
@@ -3479,7 +1735,7 @@ var ScenarioRunStore = class _ScenarioRunStore {
   }
   async initializeConversationWorkspace(conversationId, scenario, userInput) {
     const dir = this.getRunDir(conversationId);
-    await mkdir3(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await this.saveScenarioSnapshot(conversationId, scenario);
     const nodesById = new Map(scenario.nodes.map((p) => [p.id, p]));
     const teamMap = new Map(scenario.groups.map((t2) => [t2.id, t2.name]));
@@ -3504,8 +1760,8 @@ var ScenarioRunStore = class _ScenarioRunStore {
       "- Use read-only references from linked upstream files as context.",
       ""
     ].join("\n");
-    await atomicWriteSecure(join4(dir, "README.md"), overview);
-    await atomicWriteSecure(join4(dir, "USER_REQUEST.md"), `# User request
+    await atomicWriteSecure(join3(dir, "README.md"), overview);
+    await atomicWriteSecure(join3(dir, "USER_REQUEST.md"), `# User request
 
 ${userInput.trim() || "(empty)"}
 `);
@@ -3531,7 +1787,7 @@ ${userInput.trim() || "(empty)"}
         "- Waiting for assignment.",
         ""
       ].join("\n");
-      await atomicWriteSecure(join4(dir, fileName), content);
+      await atomicWriteSecure(join3(dir, fileName), content);
     }
   }
   async deleteRunDir(conversationId) {
@@ -3591,7 +1847,7 @@ ${userInput.trim() || "(empty)"}
     if (!runState) return;
     try {
       const dir = this.getRunDir(conversationId);
-      await mkdir3(dir, { recursive: true });
+      await mkdir2(dir, { recursive: true });
       const data = {
         nodeStates: { ...runState.nodeStates },
         nodeOutputs: { ...runState.nodeOutputs },
@@ -3599,18 +1855,18 @@ ${userInput.trim() || "(empty)"}
         ...Object.keys(runState.nodeAgentIds).length > 0 ? { nodeAgentIds: { ...runState.nodeAgentIds } } : {},
         ...Object.keys(runState.waitingInputs).length > 0 ? { waitingInputs: { ...runState.waitingInputs } } : {}
       };
-      await atomicWriteJsonSecure(join4(dir, "run-state.json"), data);
+      await atomicWriteJsonSecure(join3(dir, "run-state.json"), data);
     } catch {
     }
   }
   async loadPersistedRunState(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join4(dir, "run-state.json"));
+    return readJsonFileSafe(join3(dir, "run-state.json"));
   }
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile4(join4(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile3(join3(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -3619,23 +1875,23 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile4(join4(dir, "README.md"), "utf-8");
+      return await readFile3(join3(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
   }
   async saveScenarioSnapshot(conversationId, scenario) {
     const dir = this.getRunDir(conversationId);
-    await mkdir3(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await atomicWriteJsonSecure(
-      join4(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
+      join3(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
       true
     );
   }
   async loadScenarioSnapshot(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join4(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
+    return readJsonFileSafe(join3(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
   }
 };
 var scenarioRunStore = new ScenarioRunStore();
@@ -3683,16 +1939,16 @@ async function fetchProviderModels(provider, plaintextKey) {
 async function vaultOfProject(projectId) {
   if (!projectId) return void 0;
   await ensureProjectsLoaded();
-  const refs2 = refsOfProjectId(projectId);
-  if (refs2.length !== 1) return void 0;
-  return refs2[0]?.orgId ?? void 0;
+  const refs = refsOfProjectId(projectId);
+  if (refs.length !== 1) return void 0;
+  return refs[0]?.orgId ?? void 0;
 }
 
 // ../server/src/services/image-storage.service.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir4, writeFile as writeFile2, readFile as readFile5, unlink as unlink2, readdir as readdir3 } from "fs/promises";
+import { mkdir as mkdir3, writeFile, readFile as readFile4, unlink as unlink2, readdir as readdir3 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import { join as join5, extname, resolve, sep } from "path";
+import { join as join4, extname, resolve, sep } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/jpeg",
@@ -3709,7 +1965,7 @@ var ImageStorageService = class {
     this.dir = dir;
   }
   async ensureTmpDir() {
-    await mkdir4(this.dir, { recursive: true, mode: 448 });
+    await mkdir3(this.dir, { recursive: true, mode: 448 });
   }
   async saveImage(buffer, originalName, mimeType, contextId) {
     if (!ALLOWED_MIME_TYPES.has(mimeType)) {
@@ -3729,15 +1985,15 @@ var ImageStorageService = class {
     const imageId = randomUUID3();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
-    const filePath = join5(this.dir, fileName);
+    const filePath = join4(this.dir, fileName);
     const resolvedPath = resolve(filePath);
     const resolvedDir = resolve(this.dir);
     if (resolvedPath !== resolvedDir && !resolvedPath.startsWith(resolvedDir + sep)) {
       throw new Error("Invalid file path");
     }
-    await writeFile2(filePath, buffer, { mode: 384 });
+    await writeFile(filePath, buffer, { mode: 384 });
     const meta = { imageId, filePath, mimeType, originalName, createdAt: Date.now(), contextId };
-    await writeFile2(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
+    await writeFile(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
     return meta;
   }
   /**
@@ -3755,7 +2011,7 @@ var ImageStorageService = class {
       const files = await readdir3(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile5(join5(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile4(join4(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync2(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -3781,7 +2037,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile5(join5(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -3796,7 +2052,7 @@ var ImageStorageService = class {
   async readImageAsBase64(imageId, expectedContextId) {
     const result = await this.getImagePath(imageId, expectedContextId);
     if (!result) return null;
-    const buffer = await readFile5(result.filePath);
+    const buffer = await readFile4(result.filePath);
     return { base64: buffer.toString("base64"), mimeType: result.mimeType };
   }
   async listExpiredImages(ttlMs = IMAGE_TTL_MS) {
@@ -3811,7 +2067,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile5(join5(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -3874,16 +2130,16 @@ async function resolveImagesToBase64(images, contextId) {
 }
 
 // ../server/src/trpc/routers/cloud-auth.ts
-import { z as z8 } from "zod";
+import { z as z5 } from "zod";
 import { hostname } from "os";
 import { basename } from "path";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
-import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir5, chmod as chmod2, unlink as unlink3 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir4, chmod, unlink as unlink3 } from "fs/promises";
+import { dirname } from "path";
 import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FILENAME2 = "cloud-session.json";
+var FILENAME = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
 function accountIdFor(cloudUrl, userId) {
   return createHash("sha256").update(`${cloudUrl.replace(/\/+$/, "")}|${userId}`).digest("hex").slice(0, 32);
@@ -3898,11 +2154,11 @@ var CloudSessionStore = class {
    * root, but a launch directory owning its own key keeps both together.
    */
   getFilePath() {
-    return keyedFilePath(FILENAME2);
+    return keyedFilePath(FILENAME);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME2);
+    return legacyMachineFilePath(FILENAME);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -3912,9 +2168,9 @@ var CloudSessionStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile6(await this.getFilePath(), "utf-8");
+      return await readFile5(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile6(this.getLegacyFilePath(), "utf-8");
+      return readFile5(this.getLegacyFilePath(), "utf-8");
     }
   }
   /**
@@ -3988,12 +2244,12 @@ var CloudSessionStore = class {
   }
   async save() {
     const filePath = await this.getFilePath();
-    await mkdir5(dirname2(filePath), { recursive: true });
+    await mkdir4(dirname(filePath), { recursive: true });
     const payload = { version: 2, accounts: this.accounts };
     const tmpPath = filePath + ".tmp";
-    await writeFile3(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
+    await writeFile2(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
     await renameWithRetry(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    await chmod(filePath, 384);
   }
   /**
    * Ranger le token obtenu par l'échange de jeton à usage unique.
@@ -4129,25 +2385,25 @@ var cloudSessionStore = new CloudSessionStore();
 
 // ../server/src/services/lan-mode.ts
 import { networkInterfaces } from "os";
-import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
-import { join as join6 } from "path";
-import { z as z7 } from "zod";
+import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir5 } from "fs/promises";
+import { join as join5 } from "path";
+import { z as z4 } from "zod";
 var LOOPBACK2 = "127.0.0.1";
 var ANY = "0.0.0.0";
 var NETWORK_FILE = "network.json";
-var NetworkFileSchema = z7.object({
-  instances: z7.record(z7.string(), z7.object({ lanEnabled: z7.boolean().default(false) })).default({})
+var NetworkFileSchema = z4.object({
+  instances: z4.record(z4.string(), z4.object({ lanEnabled: z4.boolean().default(false) })).default({})
 });
 var httpServer = null;
 function instanceKey() {
   return env.DATA_DIR;
 }
 function networkFilePath() {
-  return join6(machineRoot(), NETWORK_FILE);
+  return join5(machineRoot(), NETWORK_FILE);
 }
 async function readFileState() {
   try {
-    return NetworkFileSchema.parse(JSON.parse(await readFile7(networkFilePath(), "utf-8")));
+    return NetworkFileSchema.parse(JSON.parse(await readFile6(networkFilePath(), "utf-8")));
   } catch {
     return { instances: {} };
   }
@@ -4158,12 +2414,12 @@ async function readPersisted() {
 }
 async function writePersisted(lanEnabled) {
   const root = machineRoot();
-  await mkdir6(root, { recursive: true });
+  await mkdir5(root, { recursive: true });
   const state = await readFileState();
   state.instances[instanceKey()] = { lanEnabled };
   const filePath = networkFilePath();
   const tmpPath = filePath + ".tmp";
-  await writeFile4(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+  await writeFile3(tmpPath, JSON.stringify(state, null, 2), "utf-8");
   await renameWithRetry(tmpPath, filePath);
 }
 function registerHttpServer(server) {
@@ -4261,12 +2517,12 @@ function getCloudApiUrl() {
   return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
 }
 async function orgCloudUrl(orgId) {
-  const { readOrgClouds } = await import("./vault-resolver-PN3TYCLJ.js");
+  const { readOrgClouds } = await import("./vault-resolver-E7KPKA5C.js");
   const clouds = await readOrgClouds();
   return (clouds[orgId] ?? getCloudApiUrl()).replace(/\/+$/, "");
 }
 async function accountForOrg(orgId) {
-  const { readOrgAccounts, readOrgClouds } = await import("./vault-resolver-PN3TYCLJ.js");
+  const { readOrgAccounts, readOrgClouds } = await import("./vault-resolver-E7KPKA5C.js");
   const [stampedAccounts, stampedClouds, accounts] = await Promise.all([
     readOrgAccounts(),
     readOrgClouds(),
@@ -4429,15 +2685,15 @@ function isAllowedProxyPath(path) {
   const [pathname] = path.split("?");
   return PROXY_PREFIXES.some((p) => pathname === p || pathname.startsWith(p));
 }
-var ScopeSchema = z8.object({
-  accountId: z8.string().min(1).max(64)
+var ScopeSchema = z5.object({
+  accountId: z5.string().min(1).max(64)
 });
 function scopeOf(input) {
   return { accountId: input.accountId };
 }
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
-  startLogin: protectedProcedure.input(z8.object({ returnTo: z8.string().url().max(2048) })).mutation(async ({ input }) => {
+  startLogin: protectedProcedure.input(z5.object({ returnTo: z5.string().url().max(2048) })).mutation(async ({ input }) => {
     const callback = callbackForReturnTo(input.returnTo);
     if (!callback) {
       throw new TRPCError3({
@@ -4475,7 +2731,7 @@ var cloudAuthRouter = router({
    * `null` quand rien ne rattache cette organisation à un compte de ce poste :
    * l'interface l'affiche comme déconnectée, ce qu'elle est.
    */
-  accountForOrg: protectedProcedure.input(z8.object({ orgId: z8.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
+  accountForOrg: protectedProcedure.input(z5.object({ orgId: z5.string().min(1).max(128) })).query(async ({ input }) => ({ accountId: await accountForOrg(input.orgId) })),
   /**
    * Les comptes liés à ce poste, et l'organisation dont chacun répond.
    *
@@ -4483,7 +2739,7 @@ var cloudAuthRouter = router({
    * du projet ouvert, sous quel compte il se synchronise.
    */
   accounts: protectedProcedure.query(async () => {
-    const { readOrgAccounts } = await import("./vault-resolver-PN3TYCLJ.js");
+    const { readOrgAccounts } = await import("./vault-resolver-E7KPKA5C.js");
     return { accounts: await cloudSessionStore.list(), orgAccounts: await readOrgAccounts() };
   }),
   /** The cloud session (user + org), fetched with the stored token. */
@@ -4501,7 +2757,7 @@ var cloudAuthRouter = router({
       const identity = await readCloudIdentity(account.cloudUrl, await cloudSessionStore.getToken(accountId) ?? "");
       if (identity) {
         const settled = await cloudSessionStore.describe(accountId, identity);
-        const { renameOrgAccount } = await import("./vault-resolver-PN3TYCLJ.js");
+        const { renameOrgAccount } = await import("./vault-resolver-E7KPKA5C.js");
         await renameOrgAccount(accountId, settled);
       }
     }
@@ -4531,7 +2787,7 @@ var cloudAuthRouter = router({
    * drops the session, and the local token is dropped here too, so nothing is
    * left holding a dead credential.
    */
-  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z8.string().min(1).max(128) })).mutation(async ({ input }) => {
+  revokeDevice: protectedProcedure.input(ScopeSchema.extend({ id: z5.string().min(1).max(128) })).mutation(async ({ input }) => {
     const { accountId } = input;
     if (!accountId) throw new TRPCError3({ code: "PRECONDITION_FAILED", message: "No cloud account for this scope." });
     const res = await cloudFetch2("/api/auth/device/revoke", {
@@ -4554,17 +2810,17 @@ var cloudAuthRouter = router({
    * the cloud: the web UI asks its own server, which holds the credential.
    */
   proxy: protectedProcedure.input(
-    z8.object({
-      path: z8.string().min(1).max(512),
-      method: z8.enum(["GET", "POST"]).default("GET"),
-      query: z8.record(z8.string().max(128), z8.string().max(2048)).optional(),
-      body: z8.unknown().optional(),
+    z5.object({
+      path: z5.string().min(1).max(512),
+      method: z5.enum(["GET", "POST"]).default("GET"),
+      query: z5.record(z5.string().max(128), z5.string().max(2048)).optional(),
+      body: z5.unknown().optional(),
       // Obligatoire, et seul : c'est la porte par laquelle passent tous les
       // appels cloud de l'interface. La laisser optionnelle est ce qui a
       // permis aux composables partagées de n'envoyer aucune portée pendant
       // trente routes, et au serveur de retomber sur « le compte unique du
       // poste » — muet dès qu'il y en a eu deux.
-      accountId: z8.string().min(1).max(64)
+      accountId: z5.string().min(1).max(64)
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -5259,6 +3515,12 @@ function generateKanbanPopulatePrompt(board, scope) {
   lines.push("");
   return lines.join("\n");
 }
+async function kanbanContextFor(conv, scope) {
+  if (!conv?.kanbanBoardId) return "";
+  const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
+  if (!kanbanBoard) return "";
+  return "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId, scope) : generateKanbanPopulatePrompt(kanbanBoard, scope));
+}
 
 // ../server/src/services/ai-runners/claude-code-runner.ts
 import { spawn } from "child_process";
@@ -5431,7 +3693,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-THV3LJOF.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-46C4NIQ2.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -5449,7 +3711,7 @@ ${TOKEN_INSTRUCTIONS}`;
     "--append-system-prompt",
     systemPrompt,
     ...mcpArgs,
-    prompt
+    ...opts.deferPrompt ? [] : [prompt]
   ];
   return args;
 }
@@ -5498,7 +3760,9 @@ async function runClaudeViaPty(params) {
   const { agentId, signal, skipTokenInstructions } = params;
   if (!agentId) throw new Error("runClaudeViaPty requires an agentId");
   const sessionId = params.sessionId && params.sessionId.length > 0 ? params.sessionId : randomUUID4();
-  const args = buildPtyArgs(params, sessionId, { excludeMcp: true });
+  const deferPrompt = !!params.mcpConfig;
+  const mcpReadyId = deferPrompt ? randomUUID4() : void 0;
+  const args = buildPtyArgs(params, sessionId, { excludeMcp: true, deferPrompt });
   const agentMgr = await getAgentManager();
   const displayArgs = args.map((a) => {
     if (a === params.prompt) return "<prompt>";
@@ -5578,7 +3842,7 @@ async function runClaudeViaPty(params) {
         }
       }
     });
-    agentMgr.agentMutation(agentId, "ai.spawnPty", {
+    const spawned = agentMgr.agentMutation(agentId, "ai.spawnPty", {
       cli: "claude",
       args,
       env: params.injectedEnv && Object.keys(params.injectedEnv).length > 0 ? params.injectedEnv : void 0,
@@ -5598,7 +3862,9 @@ async function runClaudeViaPty(params) {
       // signe elle-même, faute de requête HTTP d'où le tirer.
       mcpApiToken: params.apiToken || void 0,
       mcpProjectId: params.projectId || void 0,
-      mcpOrgId: params.orgId || void 0
+      mcpOrgId: params.orgId || void 0,
+      // Un agent ancien ignore ce champ : le plafond de `waitForPtyInput` couvre ce cas.
+      mcpReadyId
     }).then(({ spawnId: id }) => {
       spawnId = id;
       if (signal.aborted) {
@@ -5608,6 +3874,18 @@ async function runClaudeViaPty(params) {
     }).catch((err) => {
       fail(new Error(`Failed to spawn claude PTY: ${err.message}`));
     });
+    if (mcpReadyId) {
+      void spawned.then(async () => {
+        if (settled || !spawnId) return;
+        const id = spawnId;
+        const wait = await waitForPtyInput({ agentId, spawnId: id, mcpReadyId, runner: "claude-code", signal: innerAbort.signal });
+        if (settled || wait.status !== "ready") return;
+        if (!wait.mcpReady) console.warn(`[claude-pty] serveur MCP non signal\xE9 apr\xE8s ${PTY_MCP_READY_MAX_MS} ms, prompt \xE9crit quand m\xEAme (session ${sessionId})`);
+        await pasteToPty((data) => agentMgr.agentMutation(agentId, "ai.writePty", { spawnId: id, data }), params.prompt, { lead: PASTED_TASK_LEAD });
+      }).catch((err) => {
+        fail(new Error(`Failed to write the prompt to the claude PTY: ${err.message}`));
+      });
+    }
     signal.addEventListener("abort", () => fail(new Error("Aborted")), { once: true });
     void tail.whenDone.then(() => {
       if (settled) return;
@@ -5931,18 +4209,6 @@ var ClaudeCodeRunner = class {
 import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { EventEmitter } from "events";
-function resolveMcpArgs(env2) {
-  if (!env2["RUNEYA_API_TOKEN"]) return [];
-  try {
-    return codexMcpArgs({
-      RUNEYA_BASE_URL: env2["RUNEYA_BASE_URL"],
-      RUNEYA_API_TOKEN: env2["RUNEYA_API_TOKEN"]
-    });
-  } catch (err) {
-    console.warn("[codex-app-server] Failed to resolve MCP server path:", err.message);
-    return [];
-  }
-}
 var CodexAppServerClient = class extends EventEmitter {
   proc = null;
   rl = null;
@@ -5964,7 +4230,10 @@ var CodexAppServerClient = class extends EventEmitter {
    */
   async connect(runeyaEnv) {
     const env2 = { ...process.env, ...runeyaEnv };
-    const invocation = resolveCliInvocation("codex", [...resolveMcpArgs(env2), "app-server"]);
+    const invocation = resolveCliInvocation("codex", [
+      ...codexRuneyaMcpArgs({ RUNEYA_BASE_URL: env2["RUNEYA_BASE_URL"], RUNEYA_API_TOKEN: env2["RUNEYA_API_TOKEN"] }),
+      "app-server"
+    ]);
     this.proc = spawn2(invocation.command, invocation.args, {
       windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"],
@@ -6125,7 +4394,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-THV3LJOF.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-46C4NIQ2.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -6609,19 +4878,19 @@ function toConversationSummary(conv) {
   const { messages, ...rest } = conv;
   return { ...rest, messages: [], messagesOmitted: true, messageCount: messages.length };
 }
-var MessageSchema = z9.object({
-  role: z9.enum(["user", "assistant"]),
-  content: z9.string().max(1e5)
+var MessageSchema = z6.object({
+  role: z6.enum(["user", "assistant"]),
+  content: z6.string().max(1e5)
 });
-var ImagePartSchema = z9.object({
-  type: z9.literal("image"),
-  imageId: z9.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
-  url: z9.string().max(500),
-  mimeType: z9.string().max(100),
-  altText: z9.string().max(500).optional()
+var ImagePartSchema = z6.object({
+  type: z6.literal("image"),
+  imageId: z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
+  url: z6.string().max(500),
+  mimeType: z6.string().max(100),
+  altText: z6.string().max(500).optional()
 });
-var ImagePartsSchema = z9.array(ImagePartSchema).max(5).optional();
-var SectionNameSchema = z9.string().trim().min(1).max(80);
+var ImagePartsSchema = z6.array(ImagePartSchema).max(5).optional();
+var SectionNameSchema = z6.string().trim().min(1).max(80);
 var LANGUAGE_INSTRUCTION = "Always respond in the same language the user writes in.";
 async function buildSystemPrompt(apiKey) {
   const allServices = await serviceStore.list();
@@ -6853,12 +5122,6 @@ async function* drainSession(session, signal, isReconnect) {
     if (signal?.aborted) return;
   }
 }
-async function kanbanContextFor(conv, scope) {
-  if (!conv?.kanbanBoardId) return "";
-  const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-  if (!kanbanBoard) return "";
-  return "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId, scope) : generateKanbanPopulatePrompt(kanbanBoard, scope));
-}
 async function cliToken(ctx) {
   const bearer = ctx.authorization?.startsWith("Bearer ") ? ctx.authorization.slice(7) : void 0;
   if (!bearer || ctx.callerType !== "app") return bearer;
@@ -7018,24 +5281,24 @@ async function startCodexSession(convId, prompt, opts = {}) {
   });
   return { session, done };
 }
-var MessagePartSchema = z9.discriminatedUnion("type", [
-  z9.object({ type: z9.literal("thinking"), text: z9.string().max(1e5) }),
-  z9.object({ type: z9.literal("text"), text: z9.string().max(1e5) }),
-  z9.object({
-    type: z9.literal("tool"),
+var MessagePartSchema = z6.discriminatedUnion("type", [
+  z6.object({ type: z6.literal("thinking"), text: z6.string().max(1e5) }),
+  z6.object({ type: z6.literal("text"), text: z6.string().max(1e5) }),
+  z6.object({
+    type: z6.literal("tool"),
     id: Id128Schema,
     name: Id128Schema,
-    input: z9.record(z9.string(), z9.unknown()).optional(),
-    rawInput: z9.string().max(1e4).optional(),
-    result: z9.unknown().optional(),
-    isError: z9.boolean().optional(),
-    pending: z9.boolean()
+    input: z6.record(z6.string(), z6.unknown()).optional(),
+    rawInput: z6.string().max(1e4).optional(),
+    result: z6.unknown().optional(),
+    isError: z6.boolean().optional(),
+    pending: z6.boolean()
   })
 ]);
-var StoredMessageSchema = z9.object({
-  role: z9.enum(["user", "assistant"]),
-  content: z9.string().max(1e5),
-  parts: z9.array(MessagePartSchema).max(200).optional()
+var StoredMessageSchema = z6.object({
+  role: z6.enum(["user", "assistant"]),
+  content: z6.string().max(1e5),
+  parts: z6.array(MessagePartSchema).max(200).optional()
 });
 async function conversationCwd(conv) {
   return resolveConversationCwd(conv.id);
@@ -7043,6 +5306,26 @@ async function conversationCwd(conv) {
 function startCliSession(runner, convId, prompt, opts = {}) {
   return runner === "codex" ? startCodexSession(convId, prompt, opts) : startClaudeCodeSession(convId, prompt, opts);
 }
+async function writeWhenPtyReady(opts) {
+  const { agentId, spawnId } = opts;
+  const write = (data) => agentManager.agentMutation(agentId, "ai.writePty", { spawnId, data });
+  try {
+    const wait = await waitForPtyInput({ agentId, spawnId, mcpReadyId: opts.mcpReadyId, runner: opts.runner });
+    if (wait.status !== "ready") return;
+    if (opts.contexts.length > 0) {
+      const body = opts.contexts.map((c) => `### ${c.label}
+${c.text}`).join("\n\n");
+      await write(`\x1B[200~---------
+Context:
+\x1B[201~\x1B[200~${body}\x1B[201~\x1B[200~
+---------
+\x1B[201~`);
+    }
+    if (opts.initialPrompt) await pasteToPty(write, opts.initialPrompt, { lead: PASTED_TASK_LEAD });
+  } catch (err) {
+    console.warn("[chat.pty.start] deferred writePty failed:", err.message);
+  }
+}
 var chatRouter = router({
   conversations: router({
     /**
@@ -7052,7 +5335,7 @@ var chatRouter = router({
      * et sans le même filtre il y reversait toutes les conversations de la
      * machine, une seconde après un chargement pourtant filtré.
      */
-    onChanged: protectedProcedure.input(z9.object({
+    onChanged: protectedProcedure.input(z6.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).subscription(async function* ({ input }) {
@@ -7104,7 +5387,7 @@ var chatRouter = router({
      * reachable where they were written, without leaking into every other
      * organization's projects.
      */
-    list: protectedProcedure.input(z9.object({
+    list: protectedProcedure.input(z6.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).query(async ({ input }) => {
@@ -7112,24 +5395,24 @@ var chatRouter = router({
       const convs = projectId ? await conversationStore.listForProject({ id: projectId, orgId: input?.orgId }) : await conversationStore.list();
       return convs.map(toConversationSummary);
     }),
-    get: protectedProcedure.input(z9.object({ id: Id128Schema })).query(async ({ input }) => {
+    get: protectedProcedure.input(z6.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     }),
-    create: protectedProcedure.input(z9.object({
+    create: protectedProcedure.input(z6.object({
       title: ShortString200Schema.optional(),
-      isCli: z9.boolean().optional(),
-      runner: z9.enum(["claude-code", "codex"]).optional(),
+      isCli: z6.boolean().optional(),
+      runner: z6.enum(["claude-code", "codex"]).optional(),
       providerId: Id128Schema.optional(),
       scenarioId: Id128Schema.optional(),
-      scenarioInput: z9.string().max(1e5).optional(),
+      scenarioInput: z6.string().max(1e5).optional(),
       kanbanBoardId: Id128Schema.optional(),
       kanbanCardId: Id128Schema.optional(),
       // The project the conversation is about: only the caller knows which
       // one it is looking at.
       projectId: Id128Schema.optional(),
-      orgId: z9.string().max(128).nullable().optional(),
+      orgId: z6.string().max(128).nullable().optional(),
       // L'agent où la conversation travaille. Absent = agent par défaut.
       agentId: Id128Schema.optional()
     })).mutation(async ({ input }) => {
@@ -7172,13 +5455,13 @@ var chatRouter = router({
       }
       return conv;
     }),
-    update: protectedProcedure.input(z9.object({
+    update: protectedProcedure.input(z6.object({
       id: Id128Schema,
       title: ShortString200Schema.optional(),
-      messages: z9.array(StoredMessageSchema).max(500).optional(),
-      contextUsage: z9.object({
-        inputTokens: z9.number().int().nonnegative(),
-        contextWindow: z9.number().int().positive()
+      messages: z6.array(StoredMessageSchema).max(500).optional(),
+      contextUsage: z6.object({
+        inputTokens: z6.number().int().nonnegative(),
+        contextWindow: z6.number().int().positive()
       }).optional()
     })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { title: input.title, messages: input.messages, contextUsage: input.contextUsage });
@@ -7192,14 +5475,14 @@ var chatRouter = router({
      * messages, et un réglage qui voyage avec 500 messages se perdrait dans un
      * patch dont ce n'est pas le sujet.
      */
-    setCompanion: protectedProcedure.input(z9.object({
+    setCompanion: protectedProcedure.input(z6.object({
       id: Id128Schema,
-      enabled: z9.boolean(),
-      runner: z9.enum(["claude-code", "codex"]).optional(),
+      enabled: z6.boolean(),
+      runner: z6.enum(["claude-code", "codex"]).optional(),
       /** Chaîne vide = modèle par défaut du runner. */
-      model: z9.string().max(200).optional(),
+      model: z6.string().max(200).optional(),
       /** Chaîne vide = effort par défaut. */
-      effort: z9.enum(["low", "normal", "high", ""]).optional()
+      effort: z6.enum(["low", "normal", "high", ""]).optional()
     })).mutation(async ({ input }) => {
       const existing = await conversationStore.get(input.id);
       if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
@@ -7225,7 +5508,7 @@ var chatRouter = router({
      * compagnon silencieux parce qu'il n'avait rien à dire et un message qui
      * n'a pas pu être transmis se ressemblent parfaitement sans cette trace.
      */
-    companionDelivery: protectedProcedure.input(z9.object({ id: Id128Schema })).query(async ({ input }) => {
+    companionDelivery: protectedProcedure.input(z6.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       const companionId = conv?.companionConversationId;
       const running = isCompanionThinking(input.id) || (companionId ? activeSessionRegistry.get(companionId)?.status === "running" : false);
@@ -7275,7 +5558,7 @@ var chatRouter = router({
      * route emprunte exactement le chemin de livraison, sans le jugement, et
      * rend PAR OÙ le message est passé.
      */
-    testCompanionBridge: protectedProcedure.input(z9.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    testCompanionBridge: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       const route = await deliverToMainConversation(
@@ -7296,7 +5579,7 @@ var chatRouter = router({
      * entier, bien plus qu'une requête ne doit rester ouverte. L'interface suit
      * l'avancement par l'état poussé « il relit », déjà en place.
      */
-    runCompanionNow: protectedProcedure.input(z9.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    runCompanionNow: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       if (conv.isCompanion) {
@@ -7313,7 +5596,7 @@ var chatRouter = router({
       });
       return { started: true };
     }),
-    delete: protectedProcedure.input(z9.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    delete: protectedProcedure.input(z6.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const existing = await conversationStore.get(input.id);
       if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       resetRelaunches(input.id);
@@ -7341,12 +5624,12 @@ var chatRouter = router({
         (err) => console.error("[chat.delete] Image cleanup error:", err)
       );
     }),
-    archive: protectedProcedure.input(z9.object({ id: Id128Schema, archived: z9.boolean() })).mutation(async ({ input }) => {
+    archive: protectedProcedure.input(z6.object({ id: Id128Schema, archived: z6.boolean() })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { archived: input.archived });
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     }),
-    pin: protectedProcedure.input(z9.object({ id: Id128Schema, pinned: z9.boolean() })).mutation(async ({ input }) => {
+    pin: protectedProcedure.input(z6.object({ id: Id128Schema, pinned: z6.boolean() })).mutation(async ({ input }) => {
       const conv = await conversationStore.setPinned(input.id, input.pinned);
       if (!conv) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
@@ -7354,16 +5637,16 @@ var chatRouter = router({
     // L'ordre ne vaut que pour les ids donnés : l'écran ne connaît que les
     // conversations du projet courant, et les épinglées des autres projets
     // n'ont pas à bouger parce qu'on a rangé celles-ci.
-    reorderPinned: protectedProcedure.input(z9.object({ ids: z9.array(Id128Schema).max(500) })).mutation(async ({ input }) => {
+    reorderPinned: protectedProcedure.input(z6.object({ ids: z6.array(Id128Schema).max(500) })).mutation(async ({ input }) => {
       await conversationStore.reorderPinned(input.ids);
     }),
     // Ranger des conversations dans une section du projet, ou les en sortir
     // (`sectionId: null`). Une conversation d'un autre projet est refusée :
     // la section ne se verrait pas là où la conversation s'affiche.
-    setSection: protectedProcedure.input(z9.object({
+    setSection: protectedProcedure.input(z6.object({
       projectId: Id128Schema,
       sectionId: Id128Schema.nullable(),
-      ids: z9.array(Id128Schema).max(500)
+      ids: z6.array(Id128Schema).max(500)
     })).mutation(async ({ input }) => {
       if (input.sectionId !== null && !await conversationSectionStore.get(input.projectId, input.sectionId)) {
         throw new TRPCError4({ code: "NOT_FOUND", message: "Section not found" });
@@ -7379,28 +5662,28 @@ var chatRouter = router({
   }),
   // Les sections de la barre latérale, propres à chaque projet.
   sections: router({
-    list: protectedProcedure.input(z9.object({ projectId: Id128Schema })).query(({ input }) => conversationSectionStore.list(input.projectId)),
-    create: protectedProcedure.input(z9.object({ projectId: Id128Schema, name: SectionNameSchema })).mutation(({ input }) => conversationSectionStore.create(input.projectId, input.name)),
-    rename: protectedProcedure.input(z9.object({ projectId: Id128Schema, id: Id128Schema, name: SectionNameSchema })).mutation(async ({ input }) => {
+    list: protectedProcedure.input(z6.object({ projectId: Id128Schema })).query(({ input }) => conversationSectionStore.list(input.projectId)),
+    create: protectedProcedure.input(z6.object({ projectId: Id128Schema, name: SectionNameSchema })).mutation(({ input }) => conversationSectionStore.create(input.projectId, input.name)),
+    rename: protectedProcedure.input(z6.object({ projectId: Id128Schema, id: Id128Schema, name: SectionNameSchema })).mutation(async ({ input }) => {
       const section = await conversationSectionStore.rename(input.projectId, input.id, input.name);
       if (!section) throw new TRPCError4({ code: "NOT_FOUND", message: "Section not found" });
       return section;
     }),
     // Les conversations de la section retombent dans la liste, rien n'est supprimé.
-    delete: protectedProcedure.input(z9.object({ projectId: Id128Schema, id: Id128Schema })).mutation(async ({ input }) => {
+    delete: protectedProcedure.input(z6.object({ projectId: Id128Schema, id: Id128Schema })).mutation(async ({ input }) => {
       if (!await conversationSectionStore.remove(input.projectId, input.id)) {
         throw new TRPCError4({ code: "NOT_FOUND", message: "Section not found" });
       }
       await conversationStore.clearSection(input.id);
     }),
-    reorder: protectedProcedure.input(z9.object({ projectId: Id128Schema, ids: z9.array(Id128Schema).max(200) })).mutation(({ input }) => conversationSectionStore.reorder(input.projectId, input.ids))
+    reorder: protectedProcedure.input(z6.object({ projectId: Id128Schema, ids: z6.array(Id128Schema).max(200) })).mutation(({ input }) => conversationSectionStore.reorder(input.projectId, input.ids))
   }),
-  listModels: protectedProcedure.input(z9.object({
+  listModels: protectedProcedure.input(z6.object({
     providerId: Id128Schema.optional(),
     // Le projet dit de quelle organisation lire les fournisseurs ; absent,
     // ce sont ceux du poste.
     projectId: Id128Schema.optional(),
-    orgId: z9.string().max(128).nullable().optional()
+    orgId: z6.string().max(128).nullable().optional()
   }).optional()).query(async ({ input }) => {
     const active = await getActiveProvider(
       input?.providerId,
@@ -7418,11 +5701,11 @@ var chatRouter = router({
    * `model/list` de l'app-server pour Codex, sur l'agent visé (celui par
    * défaut sinon). Liste vide si Codex ne répond pas.
    */
-  listCliModels: protectedProcedure.input(z9.object({
-    runner: z9.enum(["claude-code", "codex"]),
+  listCliModels: protectedProcedure.input(z6.object({
+    runner: z6.enum(["claude-code", "codex"]),
     agentId: Id128Schema.optional()
   })).query(async ({ input }) => ({ models: await listCliModels(input.runner, input.agentId) })),
-  checkCliAvailability: protectedProcedure.input(z9.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
+  checkCliAvailability: protectedProcedure.input(z6.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
     if (input?.agentId) {
       try {
         const res = await agentManager.agentQuery(
@@ -7440,12 +5723,12 @@ var chatRouter = router({
     ]);
     return { available: claudeOk, codexAvailable: codexOk };
   }),
-  enhanceScenarioPrompt: protectedProcedure.input(z9.object({
-    text: z9.string().max(1e4),
+  enhanceScenarioPrompt: protectedProcedure.input(z6.object({
+    text: z6.string().max(1e4),
     providerId: Id128Schema.optional(),
-    model: z9.string().max(200).optional(),
+    model: z6.string().max(200).optional(),
     projectId: Id128Schema.optional(),
-    orgId: z9.string().max(128).nullable().optional()
+    orgId: z6.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const active = await getActiveProvider(
       input.providerId,
@@ -7488,22 +5771,22 @@ Return ONLY the improved text, no explanation, no preamble.`;
   }),
   listClaudeCodeModels: protectedProcedure.query(() => ["opus", "sonnet", "haiku"]),
   getStreamingStatus: protectedProcedure.query(() => activeSessionRegistry.listActive()),
-  stopSession: protectedProcedure.input(z9.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
+  stopSession: protectedProcedure.input(z6.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: stopSession");
     const killed = activeSessionRegistry.kill(input.conversationId);
     if (!killed) throw new TRPCError4({ code: "NOT_FOUND", message: "No active session for this conversation" });
     return { ok: true };
   }),
-  streamViaClaudeCode: protectedProcedure.input(z9.object({
+  streamViaClaudeCode: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    prompt: z9.string().max(1e5),
-    contextNote: z9.string().max(2e5).optional(),
+    prompt: z6.string().max(1e5),
+    contextNote: z6.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    effort: z9.enum(["low", "medium", "high"]).optional(),
-    reconnect: z9.boolean().optional(),
+    effort: z6.enum(["low", "medium", "high"]).optional(),
+    reconnect: z6.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z9.string().max(128).optional(),
-    imageIds: z9.array(z9.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z6.string().max(128).optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: Reconnect");
@@ -7605,15 +5888,15 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: drainSession...");
     yield* drainSession(session, signal, false);
   }),
-  streamViaCodex: protectedProcedure.input(z9.object({
+  streamViaCodex: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    prompt: z9.string().max(1e5),
-    contextNote: z9.string().max(2e5).optional(),
+    prompt: z6.string().max(1e5),
+    contextNote: z6.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    reconnect: z9.boolean().optional(),
+    reconnect: z6.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z9.string().max(128).optional(),
-    imageIds: z9.array(z9.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z6.string().max(128).optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -7683,13 +5966,13 @@ ${input.prompt}` : input.prompt;
     });
     yield* drainSession(session, signal, false);
   }),
-  send: protectedProcedure.input(z9.object({
+  send: protectedProcedure.input(z6.object({
     conversationId: ConversationIdSchema,
-    messages: z9.array(MessageSchema).min(0).max(100),
+    messages: z6.array(MessageSchema).min(0).max(100),
     model: ShortString200Schema.optional(),
-    contextNote: z9.string().max(2e5).optional(),
-    reconnect: z9.boolean().optional(),
-    imageIds: z9.array(z9.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    contextNote: z6.string().max(2e5).optional(),
+    reconnect: z6.boolean().optional(),
+    imageIds: z6.array(z6.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -7806,26 +6089,31 @@ ${input.prompt}` : input.prompt;
   // ── PTY passthrough (interactive Claude Code session) ────────────────────
   pty: router({
     /** Start a PTY session running `claude --resume <sessionId>` (or fresh). */
-    start: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      sessionId: z9.string().max(128).optional(),
-      runner: z9.enum(["claude-code", "codex"]).default("claude-code"),
-      resume: z9.boolean().default(false),
-      model: z9.string().max(128).optional(),
-      cwd: z9.string().max(4096).optional(),
+    start: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128).optional(),
+      runner: z6.enum(["claude-code", "codex"]).default("claude-code"),
+      resume: z6.boolean().default(false),
+      model: z6.string().max(128).optional(),
+      cwd: z6.string().max(4096).optional(),
       /** Anchors the session when no explicit cwd is given. */
-      serviceId: z9.string().max(128).optional(),
+      serviceId: z6.string().max(128).optional(),
       projectId: Id128Schema.optional(),
-      orgId: z9.string().max(128).nullable().optional(),
-      cols: z9.number().int().min(1).max(1e3).default(120),
-      rows: z9.number().int().min(1).max(1e3).default(30),
-      enableMcp: z9.boolean().default(false),
-      apiBaseUrl: z9.string().max(512).optional(),
-      environmentId: z9.string().max(128).optional(),
-      attachedContexts: z9.array(z9.object({
-        label: z9.string().max(200),
-        text: z9.string().max(1e6)
-      })).max(20).optional()
+      orgId: z6.string().max(128).nullable().optional(),
+      cols: z6.number().int().min(1).max(1e3).default(120),
+      rows: z6.number().int().min(1).max(1e3).default(30),
+      enableMcp: z6.boolean().default(false),
+      apiBaseUrl: z6.string().max(512).optional(),
+      environmentId: z6.string().max(128).optional(),
+      attachedContexts: z6.array(z6.object({
+        label: z6.string().max(200),
+        text: z6.string().max(1e6)
+      })).max(20).optional(),
+      /**
+       * Prompt collé puis soumis dès que le CLI accepte la saisie (remplissage
+       * d'un tableau kanban). Ignoré quand on se rattache à un terminal existant.
+       */
+      initialPrompt: z6.string().max(1e6).optional()
     })).mutation(async ({ input, ctx }) => {
       const t0 = Date.now();
       const lap = (label) => {
@@ -7897,6 +6185,8 @@ ${input.prompt}` : input.prompt;
       }
       const injectedEnv = await resolveInjectedEnv(input.environmentId);
       lap("resolveInjectedEnv");
+      const hasStartupInput = (input.attachedContexts?.length ?? 0) > 0 || !!input.initialPrompt?.trim();
+      const mcpReadyId = input.enableMcp && hasStartupInput ? randomUUID5() : void 0;
       const res = await agentManager.agentMutation(
         agentId,
         "ai.spawnPty",
@@ -7922,74 +6212,32 @@ ${input.prompt}` : input.prompt;
           mcpApiBaseUrl: input.apiBaseUrl ?? `http://localhost:${env.PORT}`,
           mcpApiToken: jwt,
           ...ptyRef?.id ? { mcpProjectId: ptyRef.id } : {},
-          ...ptyRef?.orgId ? { mcpOrgId: ptyRef.orgId } : {}
+          ...ptyRef?.orgId ? { mcpOrgId: ptyRef.orgId } : {},
+          // Un agent ancien ignore ce champ : le plafond de `waitForPtyInput` couvre ce cas.
+          ...mcpReadyId ? { mcpReadyId } : {}
         }
       );
       lap("agent ai.spawnPty");
-      const contexts = [...input.attachedContexts ?? []];
-      if (contexts.length > 0) {
-        const body = contexts.map((c) => `### ${c.label}
-${c.text}`).join("\n\n");
-        const injection = `\x1B[200~---------
-Context:
-\x1B[201~\x1B[200~${body}\x1B[201~\x1B[200~
----------
-\x1B[201~`;
-        const doInject = () => {
-          agentManager.agentMutation(agentId, "ai.writePty", { spawnId: res.spawnId, data: injection }).catch((err) => {
-            console.warn("[chat.pty.start] deferred context writePty failed:", err.message);
-          });
-        };
-        const startedAt = Date.now();
-        const MIN_MS = input.runner === "codex" ? 500 : 1200;
-        const QUIET_MS = 400;
-        const MAX_MS = 8e3;
-        let injected = false;
-        let quietTimer = null;
-        let maxTimer = null;
-        let unsub = null;
-        const cleanup = () => {
-          if (quietTimer) clearTimeout(quietTimer);
-          if (maxTimer) clearTimeout(maxTimer);
-          unsub?.();
-        };
-        const inject = () => {
-          if (injected) return;
-          injected = true;
-          cleanup();
-          doInject();
-        };
-        const scheduleQuiet = () => {
-          if (quietTimer) clearTimeout(quietTimer);
-          const wait = Math.max(QUIET_MS, MIN_MS - (Date.now() - startedAt));
-          quietTimer = setTimeout(inject, wait);
-        };
-        maxTimer = setTimeout(inject, MAX_MS);
-        unsub = agentManager.agentSubscribe(
+      const contexts = input.attachedContexts ?? [];
+      const initialPrompt = input.initialPrompt?.trim() ? input.initialPrompt : void 0;
+      if (contexts.length > 0 || initialPrompt) {
+        void writeWhenPtyReady({
           agentId,
-          "ai.stream",
-          { spawnId: res.spawnId, fromOffset: 0 },
-          (data) => {
-            const chunk = data.chunk;
-            if (chunk?.type === "exit") {
-              injected = true;
-              cleanup();
-              return;
-            }
-            scheduleQuiet();
-          },
-          () => {
-          }
-        );
+          spawnId: res.spawnId,
+          runner: input.runner,
+          mcpReadyId,
+          contexts,
+          initialPrompt
+        });
       }
       noteSpawnConversation(res.spawnId, input.sessionId);
       return { spawnId: res.spawnId, agentId, reattached: false };
     }),
     /** Subscribe to PTY output stream (raw text with ANSI). */
-    stream: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      spawnId: z9.string().max(128),
-      fromOffset: z9.number().int().min(0).default(0)
+    stream: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      fromOffset: z6.number().int().min(0).default(0)
     })).subscription(async function* ({ input, signal }) {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8044,10 +6292,10 @@ Context:
       }
     }),
     /** Write input to a PTY session (keystrokes from xterm). */
-    write: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      spawnId: z9.string().max(128),
-      data: z9.string().max(1e6)
+    write: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      data: z6.string().max(1e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8057,11 +6305,11 @@ Context:
       });
     }),
     /** Resize a PTY session. */
-    resize: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      spawnId: z9.string().max(128),
-      cols: z9.number().int().min(1).max(1e3),
-      rows: z9.number().int().min(1).max(1e3)
+    resize: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128),
+      cols: z6.number().int().min(1).max(1e3),
+      rows: z6.number().int().min(1).max(1e3)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8077,11 +6325,11 @@ Context:
      * picks it up. Returns the tmp path and which clipboard method succeeded
      * (null if none — caller should inject `@<path>` instead of Ctrl+V).
      */
-    pasteImage: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      sessionId: z9.string().max(128).optional(),
-      mimeType: z9.string().max(64),
-      base64: z9.string().max(15e6)
+    pasteImage: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128).optional(),
+      mimeType: z6.string().max(64),
+      base64: z6.string().max(15e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8099,7 +6347,7 @@ Context:
      * Read the transcript Claude Code stores on disk for a given session.
      * Returns parsed JSONL entries (user / assistant messages, tool uses, etc.).
      */
-    transcript: protectedProcedure.input(z9.object({ sessionId: z9.string().max(128) })).query(async ({ input }) => {
+    transcript: protectedProcedure.input(z6.object({ sessionId: z6.string().max(128) })).query(async ({ input }) => {
       return readClaudeTranscript(input.sessionId);
     }),
     /**
@@ -8107,9 +6355,9 @@ Context:
      * when was the transcript JSONL last touched? Used by the non-PTY view
      * to show a "Claude is thinking…" indicator while output streams.
      */
-    activity: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      sessionId: z9.string().max(128)
+    activity: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      sessionId: z6.string().max(128)
     })).query(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       let running = false;
@@ -8136,7 +6384,7 @@ Context:
      * them on the conversation, so the non-PTY chat view stays in sync.
      * Uses the conversation id as session id (PTY sessions are spawned that way).
      */
-    syncTranscript: protectedProcedure.input(z9.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
+    syncTranscript: protectedProcedure.input(z6.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.conversationId);
       if (!conv) {
         throw new TRPCError4({ code: "NOT_FOUND", message: `Conversation ${input.conversationId} not found` });
@@ -8150,14 +6398,14 @@ Context:
      * with the given sessionId. Used to benchmark the PTY → tRPC → xterm.js
      * pipeline. Open the conversation in PTY mode to attach to it.
      */
-    debugStress: protectedProcedure.input(z9.object({
-      sessionId: z9.string().max(128),
-      agentId: z9.string().max(128).optional(),
-      bytesPerSec: z9.number().int().min(100).max(1e7).default(5e4),
-      chunkSize: z9.number().int().min(1).max(65536).default(256),
-      durationMs: z9.number().int().min(0).max(36e5).default(0),
-      cols: z9.number().int().min(1).max(1e3).default(120),
-      rows: z9.number().int().min(1).max(1e3).default(30)
+    debugStress: protectedProcedure.input(z6.object({
+      sessionId: z6.string().max(128),
+      agentId: z6.string().max(128).optional(),
+      bytesPerSec: z6.number().int().min(100).max(1e7).default(5e4),
+      chunkSize: z6.number().int().min(1).max(65536).default(256),
+      durationMs: z6.number().int().min(0).max(36e5).default(0),
+      cols: z6.number().int().min(1).max(1e3).default(120),
+      rows: z6.number().int().min(1).max(1e3).default(30)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8204,9 +6452,9 @@ Context:
       return { spawnId: res.spawnId, agentId, stressSessionId };
     }),
     /** Kill a PTY session. */
-    kill: protectedProcedure.input(z9.object({
-      agentId: z9.string().max(128).optional(),
-      spawnId: z9.string().max(128)
+    kill: protectedProcedure.input(z6.object({
+      agentId: z6.string().max(128).optional(),
+      spawnId: z6.string().max(128)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError4({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -8224,7 +6472,9 @@ export {
   router,
   publicProcedure,
   protectedProcedure,
+  requireLoopback,
   requireLoopbackOrToken,
+  requireHuman,
   requireServiceAction,
   getAllowedServiceIds,
   requireEnvAction,
@@ -8239,9 +6489,6 @@ export {
   cloudFetch,
   readCloudIdentity,
   attachServiceToProject,
-  environmentOverridesStore,
-  filterEnvForAi,
-  environmentResolver,
   auditService,
   isShareable,
   logParserStore,
@@ -8254,6 +6501,7 @@ export {
   networkInfo,
   applyPersistedLanMode,
   setLanMode,
+  runeyaMcpConfig,
   Id128Schema,
   ConversationIdSchema,
   NameSchema,
@@ -8276,6 +6524,8 @@ export {
   kanbanStore,
   executeKanbanCommands,
   executeKanbanBoardCommands,
+  buildKanbanCardPrompt,
+  kanbanContextFor,
   ClaudeCodeRunner,
   shutdownCodexAppServer,
   CodexRunner,
@@ -8285,4 +6535,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-ONVAH65J.js.map
+//# sourceMappingURL=chunk-2NE52CL5.js.map