@runeya/runeya 2.0.146 → 2.0.148

package/{chunk-SEPAURTQ.js → chunk-2NE52CL5.js}

@@ -1,17 +1,7 @@
-import {
-  RUNEYA_CAPABILITIES,
-  applyProjectAnchor,
-  buildAnthropicTools,
-  buildOpenAITools,
-  buildToolSafetyInstruction,
-  runCapability,
-  toRawParams
-} from "./chunk-6IBPK6UE.js";
-import {
-  settingsManager
-} from "./chunk-NPMSBYXC.js";
 import {
   COMPANION_SIGNATURE,
+  PASTED_TASK_LEAD,
+  PTY_MCP_READY_MAX_MS,
   activeSessionRegistry,
   claudeSessionExists,
   companionCreateDefaults,
@@ -20,7 +10,6 @@ import {
   companionSkips,
   companionSystemNote,
   companionThinkingIds,
-  conversationSectionStore,
   conversationStore,
   deliverToMainConversation,
   findClaudeSessionFile,
@@ -36,7 +25,7 @@ import {
   noteSpawnConversation,
   observePtyChunk,
   onCompanionThinkingChanged,
-  projectStore,
+  pasteToPty,
   readClaudeTranscript,
   resetRelaunches,
   resolveAgentCwd,
@@ -46,31 +35,54 @@ import {
   signJwt,
   stopCompanion,
   syncConversationFromClaudeTranscript,
-  verifyJwt
-} from "./chunk-UD42LACH.js";
+  verifyJwt,
+  waitForPtyInput
+} from "./chunk-JNK6H5KH.js";
+import {
+  RUNEYA_CAPABILITIES,
+  applyProjectAnchor,
+  buildAnthropicTools,
+  buildOpenAITools,
+  buildToolSafetyInstruction,
+  runCapability,
+  toRawParams
+} from "./chunk-6IBPK6UE.js";
+import {
+  conversationSectionStore,
+  projectStore
+} from "./chunk-7QXP4FXD.js";
+import {
+  describeVariables,
+  environmentOverridesStore,
+  environmentResolver,
+  filterEnvForAi
+} from "./chunk-WDHLEO5S.js";
 import {
-  StoreDiskCoordinator,
   agentManager,
-  agentStore,
+  agentStore
+} from "./chunk-5XG3X2TM.js";
+import {
+  serviceStore
+} from "./chunk-4D3GCBPO.js";
+import {
+  StoreDiskCoordinator,
   decryptValue,
-  decryptVariableSlots,
   encryptValue,
-  encryptVariableSlots,
   ensureProjectsLoaded,
   environmentStore,
-  extractEncryptedVariableSlots,
-  getEncryptionKey,
   hasEncryptionKey,
   isCiMode,
   isEncryptedValue,
   recordLocalRemoval,
-  refsOfProjectId,
-  serviceStore
-} from "./chunk-KV4GJKXU.js";
+  refsOfProjectId
+} from "./chunk-DFPZ4MTI.js";
 import {
   isCliAvailable,
   resolveCliInvocation
 } from "./chunk-OZBSOSAS.js";
+import {
+  settingsManager
+} from "./chunk-NPMSBYXC.js";
 import {
   atomicWriteJsonSecure,
   atomicWriteSecure,
@@ -83,15 +95,13 @@ import {
   wasRead
 } from "./chunk-4LJQIQMN.js";
 import {
-  allVaultRoots,
   env,
   keyedFilePath,
   legacyMachineFilePath,
   listOrgVaults,
   machineFilePath,
   machineRoot,
-  orgVaultRoot,
-  vaultIdOfRoot
+  orgVaultRoot
 } from "./chunk-VPSQJOSN.js";
 import {
   AGENT_STOP_FETCH_TIMEOUT,
@@ -101,7 +111,6 @@ import {
   HealthCheckSchema,
   JSLogParserSchema,
   LogSourceConfigSchema,
-  MASKED_VALUE,
   MissingVariableSchema,
   RestartStrategySchema,
   ScenarioSchema,
@@ -111,7 +120,6 @@ import {
   crossServiceValues,
   findUnresolvedReferences,
   interpolateBuiltinsInEnv,
-  isSharedWithAi,
   nativeParsers,
   restoreLogSourceSecrets,
   servicePortValues,
@@ -126,6 +134,7 @@ import { z as z6 } from "zod";
 import Anthropic2 from "@anthropic-ai/sdk";
 import OpenAI2 from "openai";
 import { fileURLToPath as fileURLToPath2 } from "url";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // ../../packages/mcp-server/src/launch.ts
 import { fileURLToPath } from "url";
@@ -157,7 +166,8 @@ function pickEnv(env2) {
     ...env2.RUNEYA_BASE_URL ? { RUNEYA_BASE_URL: env2.RUNEYA_BASE_URL } : {},
     ...env2.RUNEYA_API_TOKEN ? { RUNEYA_API_TOKEN: env2.RUNEYA_API_TOKEN } : {},
     ...env2.RUNEYA_PROJECT_ID ? { RUNEYA_PROJECT_ID: env2.RUNEYA_PROJECT_ID } : {},
-    ...env2.RUNEYA_ORG_ID ? { RUNEYA_ORG_ID: env2.RUNEYA_ORG_ID } : {}
+    ...env2.RUNEYA_ORG_ID ? { RUNEYA_ORG_ID: env2.RUNEYA_ORG_ID } : {},
+    ...env2.RUNEYA_MCP_READY_ID ? { RUNEYA_MCP_READY_ID: env2.RUNEYA_MCP_READY_ID } : {}
   };
 }
 function runeyaMcpConfig(env2) {
@@ -621,783 +631,6 @@ var ShortString200Schema = z2.string().max(200);
 var DescriptionSchema = z2.string().max(2e3);
 var OptionalProviderIdSchema = Id128Schema.optional();
 
-// ../server/src/services/environment-overrides-store.ts
-import { readFile as readFile2, writeFile, mkdir, chmod } from "fs/promises";
-import { dirname, join as join3 } from "path";
-var FILENAME = "environment-overrides.json";
-var EnvironmentOverridesStore = class {
-  data = {};
-  loaded = false;
-  /**
-   * Le coordinateur partagé par les stores : un seul rechargement à la fois,
-   * jamais pendant une écriture, et une substitution atomique à la fin.
-   *
-   * Ce store faisait sa propre cuisine et se marquait « chargé » avant ses
-   * `await` : toute lecture concurrente repartait avec une table vide — une
-   * surcharge déjà écrite paraissait absente, et l'assistant réclamait au
-   * déverrouillage des variables que ce poste avait déjà renseignées.
-   */
-  disk = new StoreDiskCoordinator();
-  /** Ce que le disque portait au dernier chargement (cf. `load`). */
-  fingerprint = "";
-  diskEncryptedSlots = {};
-  /**
-   * Les surcharges dont le secret ne s'est pas ouvert.
-   *
-   * Vides en mémoire, elles doivent repartir chiffrées : sans cela, la
-   * sauvegarde suivante remplacerait par du blanc une valeur dont il ne
-   * manquait que la clé.
-   */
-  unreadableSecrets = /* @__PURE__ */ new Set();
-  /** Which vault each override was read from, until its project is known. */
-  roots = /* @__PURE__ */ new Map();
-  /**
-   * An override belongs to the project whose variable it answers.
-   *
-   * Nothing in an override says so — they are keyed by variable id alone — so
-   * the owning project is resolved through the environment that defines the
-   * variable. Overrides are never synced: they stay in the project's vault on
-   * this machine, and no other machine sees them.
-   *
-   * An override whose variable no longer exists (a deleted environment, a row
-   * left behind) has no project to belong to. It stays wherever it was read,
-   * falling back to the key's own directory — never dropped, since the variable
-   * may simply not be loaded yet.
-   */
-  async rootFor(variableId) {
-    const root = await environmentStore.rootOfVariable(variableId);
-    if (root) return root;
-    return this.roots.get(variableId) ?? dirname(await keyedFilePath(FILENAME));
-  }
-  /** Where earlier versions kept them: read once, rewritten to their vaults. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME);
-  }
-  /** Les fichiers qui portent des surcharges : les coffres, et l'emplacement d'avant. */
-  async sourcePaths() {
-    const roots = await allVaultRoots();
-    return [
-      this.getLegacyFilePath(),
-      await keyedFilePath(FILENAME),
-      ...roots.map((root) => join3(root, FILENAME))
-    ];
-  }
-  /**
-   * Charger, et recharger quand les fichiers ont bougé sous nos pieds.
-   *
-   * L'empreinte se prend **après** `ensureProjectsLoaded` : la liste des coffres
-   * en dépend, et une empreinte prise sur une liste incomplète ne ressemblerait
-   * à aucune des suivantes — le store se rechargerait à chaque lecture.
-   */
-  async load() {
-    await this.disk.load(async () => {
-      if (!getEncryptionKey()) return null;
-      await ensureProjectsLoaded();
-      const fingerprint = await fingerprintFiles(await this.sourcePaths());
-      if (this.loaded && fingerprint === this.fingerprint) return null;
-      const next = await this.readVaults();
-      return () => {
-        this.data = next.data;
-        this.diskEncryptedSlots = next.diskEncryptedSlots;
-        this.roots = next.roots;
-        this.unreadableSecrets = next.unreadableSecrets;
-        this.fingerprint = fingerprint;
-        this.loaded = true;
-      };
-    });
-  }
-  /**
-   * Read every vault, then the places older versions used, into fresh tables
-   * that `load` swaps in at once.
-   *
-   * Variable ids are unique, so merging the files cannot collide; a vault read
-   * later simply wins over a legacy copy of the same override.
-   */
-  async readVaults() {
-    const data = {};
-    const diskEncryptedSlots = {};
-    const roots = /* @__PURE__ */ new Map();
-    const unreadableSecrets = /* @__PURE__ */ new Set();
-    for (const path of await this.sourcePaths()) {
-      let parsed;
-      try {
-        parsed = JSON.parse(await readFile2(path, "utf-8"));
-      } catch {
-        continue;
-      }
-      Object.assign(
-        diskEncryptedSlots,
-        extractEncryptedVariableSlots(parsed)
-      );
-      const decrypted = decryptVariableSlots(
-        parsed,
-        "environment-overrides",
-        (variableId) => unreadableSecrets.add(variableId),
-        vaultIdOfRoot(dirname(path))
-      );
-      for (const [id, override] of Object.entries(decrypted)) {
-        data[id] = { value: override.value };
-        roots.set(id, dirname(path));
-      }
-    }
-    return { data, diskEncryptedSlots, roots, unreadableSecrets };
-  }
-  save() {
-    return this.disk.save(() => this.doSave());
-  }
-  /**
-   * Write each vault that holds — or held — an override.
-   *
-   * A vault emptied by this save is still written, as an empty object: an
-   * override that moved to its project's vault must not survive in the one it
-   * came from.
-   */
-  async doSave() {
-    const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) byRoot.set(root, {});
-    for (const [variableId, override] of Object.entries(this.data)) {
-      const root = await this.rootFor(variableId);
-      this.roots.set(variableId, root);
-      const bucket = byRoot.get(root) ?? {};
-      bucket[variableId] = override;
-      byRoot.set(root, bucket);
-    }
-    for (const [root, overrides] of byRoot) {
-      const encrypted = this.keepUnreadableSecrets(encryptVariableSlots(
-        overrides,
-        this.diskEncryptedSlots,
-        vaultIdOfRoot(root)
-      ));
-      Object.assign(
-        this.diskEncryptedSlots,
-        extractEncryptedVariableSlots(encrypted)
-      );
-      await mkdir(root, { recursive: true });
-      const path = join3(root, FILENAME);
-      const tmpPath = path + ".tmp";
-      await writeFile(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
-      await renameWithRetry(tmpPath, path);
-      await chmod(path, 384);
-    }
-  }
-  /**
-   * Rendre au disque le chiffré d'une surcharge illisible, plutôt qu'un blanc.
-   *
-   * Pendant du garde-fou du store des environnements : tant que la valeur en
-   * mémoire est vide, c'est que personne n'a retouché la variable et que son
-   * chiffré fait toujours foi.
-   */
-  keepUnreadableSecrets(overrides) {
-    if (this.unreadableSecrets.size === 0) return overrides;
-    const result = { ...overrides };
-    for (const variableId of this.unreadableSecrets) {
-      const ciphertext = this.diskEncryptedSlots[variableId];
-      const override = result[variableId];
-      if (!ciphertext || !override || override.value.value) continue;
-      result[variableId] = { ...override, value: { ...override.value, value: ciphertext } };
-    }
-    return result;
-  }
-  async getOverride(variableId) {
-    await this.load();
-    return this.data[variableId] ?? null;
-  }
-  async setOverride(variableId, override) {
-    await this.load();
-    this.data[variableId] = { value: override.value };
-    await this.save();
-  }
-  async removeOverride(variableId) {
-    await this.load();
-    if (!this.data[variableId]) return;
-    delete this.data[variableId];
-    this.unreadableSecrets.delete(variableId);
-    await this.save();
-  }
-  async getAll() {
-    await this.load();
-    return { ...this.data };
-  }
-  async removeOverridesForVariables(variableIds) {
-    await this.load();
-    let changed = false;
-    for (const id of variableIds) {
-      if (this.data[id]) {
-        delete this.data[id];
-        this.unreadableSecrets.delete(id);
-        changed = true;
-      }
-    }
-    if (changed) await this.save();
-  }
-};
-var environmentOverridesStore = new EnvironmentOverridesStore();
-
-// ../server/src/services/environment-resolver.ts
-function interpolateValue(raw, envContext) {
-  return raw.replace(/\{\{environment\.([^}]+)\}\}/g, (match, key) => {
-    return envContext[key] !== void 0 ? envContext[key] : match;
-  });
-}
-function resolveVariable(variable, envContext) {
-  const slot = variable.value;
-  const finalValue = interpolateValue(slot.pre, envContext) + interpolateValue(slot.value, envContext) + interpolateValue(slot.post, envContext);
-  return { value: finalValue, isSecret: slot.isSecret };
-}
-function slotReferenceText(variable) {
-  const slot = variable.value;
-  return `${slot.pre}
-${slot.value}
-${slot.post}`;
-}
-var HIDDEN_VALUES_NOTICE = `Values shown as ${MASKED_VALUE} are secrets their author did not share with AI. The service does receive them: never treat such a key as missing, and never pass ${MASKED_VALUE} as its value.`;
-function filterEnvForAi(resolved, sharedKeys) {
-  const secret = new Set(resolved.envSecrets);
-  const shared = new Set(sharedKeys);
-  const env2 = {};
-  const envSecrets = [];
-  const hiddenKeys = [];
-  for (const [key, value] of Object.entries(resolved.env)) {
-    const hidden = secret.has(key) && !shared.has(key);
-    env2[key] = hidden ? MASKED_VALUE : value;
-    if (secret.has(key)) envSecrets.push(key);
-    if (hidden) hiddenKeys.push(key);
-  }
-  return {
-    env: env2,
-    envSecrets,
-    hiddenKeys,
-    ...hiddenKeys.length > 0 ? { hiddenNotice: HIDDEN_VALUES_NOTICE } : {}
-  };
-}
-function describeVariables(environments, ctx) {
-  const details = [];
-  for (const environment of environments) {
-    for (const [variableId, variable] of Object.entries(environment.variables ?? {})) {
-      const slot = variable.value;
-      const isOverridden = ctx.overriddenVariableIds.has(variableId);
-      const isSecret = slot.isSecret || ctx.resolvedSecretKeys.has(variable.key);
-      const readableByAi = ctx.maskedKeys.has(variable.key) ? false : !isSecret || isSharedWithAi(slot);
-      details.push({
-        key: variable.key,
-        inService: ctx.serviceKeys.has(variable.key),
-        environmentId: environment.id,
-        environmentName: environment.name,
-        scope: environment.scope,
-        ...environment.scope === "service" && environment.reference ? { environmentServiceId: environment.reference } : {},
-        ...slot.description ? { description: slot.description } : {},
-        secret: isSecret,
-        readableByAi,
-        injectedIntoAi: slot.injectIntoAi,
-        required: slot.required,
-        overrideOnly: slot.overrideOnly,
-        overridden: isOverridden,
-        ...isOverridden && ctx.sharedValues[variable.key] !== void 0 ? { sharedValue: ctx.sharedValues[variable.key] } : {}
-      });
-    }
-  }
-  return details.sort((a, b) => a.key.localeCompare(b.key) || a.environmentName.localeCompare(b.environmentName));
-}
-function withOverriddenValue(variable, override) {
-  return {
-    ...variable,
-    value: {
-      ...variable.value,
-      value: override.value,
-      pre: override.pre,
-      post: override.post
-    }
-  };
-}
-var EnvironmentResolver = class {
-  async resolveForService(ctx, opts) {
-    if (!ctx.activeEnvironmentId) {
-      return { env: {}, envSecrets: [] };
-    }
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    if (!serviceEnv) {
-      return this.resolveEnvironment(ctx.activeEnvironmentId, opts);
-    }
-    return this.resolveEnvironment(serviceEnv.id, opts);
-  }
-  /**
-   * `applyOverrides: false` rend ce que l'équipe partage, sans ce que ce poste
-   * a mis par-dessus : c'est la réponse à « qu'est-ce que ma surcharge
-   * remplace ». Le défaut reste `true` — tout le reste du produit veut la
-   * valeur avec laquelle le service tourne réellement.
-   */
-  async resolveEnvironment(environmentId, opts) {
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = opts?.applyOverrides === false ? {} : await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-      }
-    }
-    const rawEnv = {};
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
-    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
-    const env2 = {};
-    const envSecrets = [];
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
-      env2[variable.key] = value;
-      if (isSecret || secretKeys.has(variable.key)) {
-        envSecrets.push(variable.key);
-      }
-    }
-    return { env: env2, envSecrets };
-  }
-  /**
-   * Resolve an environment (with inheritance) and return only the variables
-   * flagged `injectIntoAi`, as a flat KEY→value dict ready to be injected into
-   * the process environment of an AI agent spawn.
-   */
-  async resolveAiInjectedEnv(environmentId) {
-    if (!environmentId) return {};
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-      }
-    }
-    const rawEnv = {};
-    for (const variable of Object.values(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx } = await this.buildInterpolationContext(
-      environmentId,
-      rawEnv,
-      result.parentEnv,
-      result.parentSecretKeys,
-      result.parentKeySources
-    );
-    const injected = {};
-    for (const variable of Object.values(result.variables)) {
-      if (!variable.value.injectIntoAi) continue;
-      const { value } = resolveVariable(variable, interpolationCtx);
-      injected[variable.key] = value;
-    }
-    return injected;
-  }
-  /**
-   * Les variables qu'il faut remplir avant qu'un service de cet environnement
-   * puisse démarrer.
-   *
-   * Deux motifs, et ils ne se mesurent pas au même endroit :
-   *
-   * - `required` porte sur la valeur **finale**, interpolation et surcharge
-   *   comprises : une variable obligatoire dont la valeur ne tient qu'à une
-   *   référence morte est aussi vide qu'une case blanche.
-   * - `overrideOnly` porte sur l'**existence d'une surcharge machine**. Elle
-   *   n'a par construction pas de valeur partagée ; ce qui manque n'est pas un
-   *   contenu, c'est la réponse de ce poste-ci.
-   *
-   * Les drapeaux se lisent sur la définition, jamais sur le slot résolu : une
-   * surcharge remplace le slot entier et ne porte aucun drapeau — les y lire
-   * rendrait toute variable surchargée silencieusement facultative.
-   */
-  async findMissingVariables(environmentId) {
-    if (!environmentId) return [];
-    const [{ env: env2 }, definitions, overridesByKey] = await Promise.all([
-      this.resolveEnvironment(environmentId),
-      this.resolveDag(environmentId, /* @__PURE__ */ new Set()),
-      this.resolveOverridesByKey(environmentId)
-    ]);
-    const missing = [];
-    for (const [variableId, variable] of Object.entries(definitions.variables)) {
-      const slot = variable.value;
-      const source = definitions.sources[variableId];
-      const base = {
-        variableId,
-        key: variable.key,
-        description: slot.description,
-        isSecret: slot.isSecret,
-        environmentId: source?.environmentId ?? environmentId,
-        environmentName: source?.environmentName ?? ""
-      };
-      if (slot.overrideOnly && !overridesByKey[variable.key]) {
-        missing.push({ ...base, reason: "overrideOnly" });
-        continue;
-      }
-      if (slot.required && (env2[variable.key] ?? "") === "") {
-        missing.push({ ...base, reason: "required" });
-      }
-    }
-    return missing;
-  }
-  /**
-   * Tout ce qu'il reste à remplir sous l'environnement courant.
-   *
-   * Deux périmètres, et il faut les deux :
-   *
-   * 1. **L'environnement courant lui-même**, héritage compris —
-   *    `findMissingVariables` remonte ses `parentIds`. C'est là que vivent les
-   *    variables globales du projet, et c'est la première branche balayée.
-   * 2. **Les environnements de service qui s'activent avec lui**
-   *    (`activateOn`). Ceux-là ne sont pas des ancêtres du global : ils en
-   *    héritent, dans l'autre sens. Ne pas y descendre revenait à ne rien
-   *    réclamer d'un service jusqu'à ce qu'on essaie de le démarrer.
-   *
-   * Dédoublonné par identifiant de variable : une variable du global remonte
-   * dans chaque branche de service qui en hérite, et l'assistant ne doit pas
-   * demander deux fois la même chose.
-   */
-  async findMissingForActiveEnvironment(globalEnvId) {
-    if (!globalEnvId) return [];
-    const serviceEnvs = await environmentStore.listByActivateOn(globalEnvId);
-    const branches = await Promise.all([
-      this.findMissingVariables(globalEnvId),
-      ...serviceEnvs.map((env2) => this.findMissingVariables(env2.id))
-    ]);
-    const seen = /* @__PURE__ */ new Set();
-    const missing = [];
-    for (const branch of branches) {
-      for (const item of branch) {
-        if (seen.has(item.variableId)) continue;
-        seen.add(item.variableId);
-        missing.push(item);
-      }
-    }
-    return missing;
-  }
-  /**
-   * Les clés que leur auteur a partagées avec les IA, héritage compris.
-   *
-   * Le partage se lit sur la **définition**, et seulement là : une surcharge
-   * machine ne dit que la valeur de ce poste (`withOverriddenValue`). Il n'y a
-   * donc qu'un endroit où ce drapeau existe, et rien à réconcilier.
-   *
-   * Des clés, pas des valeurs : la valeur rendue reste celle que le service
-   * reçoit, surcharges et interpolation comprises.
-   */
-  async resolveAiSharedKeys(environmentId) {
-    if (!environmentId) return /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, /* @__PURE__ */ new Set());
-    const keys = /* @__PURE__ */ new Set();
-    for (const variable of Object.values(result.variables)) {
-      if (isSharedWithAi(variable.value)) keys.add(variable.key);
-    }
-    return keys;
-  }
-  /**
-   * Idem, pour ce qu'un service verra réellement : son environnement dédié
-   * quand il en a un, l'environnement global sinon — la règle de sélection de
-   * `resolveForService`.
-   */
-  async resolveAiSharedKeysForService(ctx) {
-    if (!ctx.activeEnvironmentId) return /* @__PURE__ */ new Set();
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    return this.resolveAiSharedKeys(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
-  }
-  /**
-   * Idem, pour ce qu'un service verra réellement : son environnement dédié
-   * quand il en a un, l'environnement global sinon. Miroir de
-   * `resolveForService`, dont il partage la règle de sélection.
-   */
-  async findMissingForService(ctx) {
-    if (!ctx.activeEnvironmentId) return [];
-    const serviceEnv = await environmentStore.findServiceEnvironment(ctx.serviceId, ctx.activeEnvironmentId);
-    return this.findMissingVariables(serviceEnv ? serviceEnv.id : ctx.activeEnvironmentId);
-  }
-  async resolveEnvironmentWithSources(environmentId) {
-    const visited = /* @__PURE__ */ new Set();
-    const result = await this.resolveDag(environmentId, visited);
-    const overridesByKey = await this.resolveOverridesByKey(environmentId);
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const override = overridesByKey[variable.key];
-      if (override) {
-        result.variables[varId] = withOverriddenValue(variable, override.variable.value);
-        result.sources[varId] = {
-          ...result.sources[varId],
-          overridden: true,
-          ...override.source ? { overriddenBy: override.source } : {}
-        };
-      }
-    }
-    const rawEnv = {};
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const slot = variable.value;
-      rawEnv[variable.key] = slot.pre + slot.value + slot.post;
-    }
-    const { ctx: interpolationCtx, secretKeys: ctxSecretKeys, keySources } = await this.buildInterpolationContext(environmentId, rawEnv, result.parentEnv, result.parentSecretKeys, result.parentKeySources);
-    const secretKeys = this.collectSecretKeys(result.variables, ctxSecretKeys);
-    const env2 = {};
-    const envSecrets = [];
-    for (const [_varId, variable] of Object.entries(result.variables)) {
-      const { value, isSecret } = resolveVariable(variable, interpolationCtx);
-      env2[variable.key] = value;
-      if (isSecret || secretKeys.has(variable.key)) {
-        envSecrets.push(variable.key);
-      }
-    }
-    const refPattern = /^\{\{environment\.([^}]+)\}\}$/;
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const match = variable.value.value.match(refPattern);
-      if (match) {
-        const refSource = keySources[match[1]];
-        if (refSource && result.sources[varId]?.environmentId !== refSource.environmentId) {
-          result.sources[varId] = {
-            ...result.sources[varId],
-            resolvedFrom: refSource
-          };
-        }
-      }
-    }
-    return {
-      variables: result.variables,
-      env: env2,
-      envSecrets,
-      sources: result.sources
-    };
-  }
-  /** Check if a raw value string interpolates any key that is secret in the context */
-  /**
-   * Toutes les clés dont la valeur est, directement ou par interpolation, un
-   * secret.
-   *
-   * Le contexte d'interpolation ne connaît que les secrets *hérités* : les
-   * secrets définis dans le même environnement n'y figurent pas, si bien qu'un
-   * `AUTH='Bearer {{environment.TOKEN}}'` voisin de son propre `TOKEN` secret
-   * ressortait non marqué — et donc non masqué par toute la chaîne en aval.
-   *
-   * On part des secrets hérités plus ceux déclarés ici, puis on propage
-   * jusqu'au point fixe : une valeur qui référence une clé secrète devient
-   * secrète à son tour, y compris en chaîne (A secret → B cite A → C cite B).
-   */
-  collectSecretKeys(variables, parentSecretKeys) {
-    const secretKeys = new Set(parentSecretKeys);
-    for (const variable of Object.values(variables)) {
-      if (variable.value.isSecret) secretKeys.add(variable.key);
-    }
-    let changed = true;
-    while (changed) {
-      changed = false;
-      for (const variable of Object.values(variables)) {
-        if (secretKeys.has(variable.key)) continue;
-        if (this.interpolatesSecretKey(slotReferenceText(variable), secretKeys)) {
-          secretKeys.add(variable.key);
-          changed = true;
-        }
-      }
-    }
-    return secretKeys;
-  }
-  interpolatesSecretKey(rawValue, ctxSecretKeys) {
-    const refs = [...rawValue.matchAll(/\{\{environment\.([^}]+)\}\}/g)].map((m) => m[1]);
-    return refs.some((ref) => ctxSecretKeys.has(ref));
-  }
-  /**
-   * Build the interpolation context for an environment.
-   *
-   * For inheriting envs (has parents): start from parent concrete values,
-   * then overlay with current concrete values. This ensures that
-   * {{environment.KEY}} resolves against the parent's value when the child
-   * redefines KEY as an interpolation reference.
-   *
-   * For isolated service envs (scope=service, activateOn set, no parents):
-   * the global env is resolved and used as fallback.
-   */
-  async buildInterpolationContext(environmentId, rawEnv, parentEnv, parentSecretKeys, parentKeySources) {
-    const environment = await environmentStore.get(environmentId);
-    if (environment && environment.scope === "service" && environment.activateOn && (!environment.parentIds || environment.parentIds.length === 0)) {
-      const globalResolved = await this.resolveEnvironmentWithSources(environment.activateOn);
-      const secretKeys = new Set(globalResolved.envSecrets);
-      const keySources = {};
-      for (const [varId, variable] of Object.entries(globalResolved.variables)) {
-        const source = globalResolved.sources[varId];
-        if (source) {
-          keySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
-        }
-      }
-      const ctx2 = { ...globalResolved.env };
-      for (const [key, value] of Object.entries(rawEnv)) {
-        if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
-          ctx2[key] = value;
-        }
-      }
-      return { ctx: ctx2, secretKeys, keySources };
-    }
-    const ctx = { ...parentEnv };
-    for (const [key, value] of Object.entries(rawEnv)) {
-      if (!/\{\{environment\.[^}]+\}\}/.test(value)) {
-        ctx[key] = value;
-      }
-    }
-    return { ctx, secretKeys: parentSecretKeys, keySources: parentKeySources };
-  }
-  /**
-   * For service-scoped envs, compute effective parentIds by also including
-   * the service-scoped envs of ancestor global environments.
-   *
-   * Example: "Server (test)" has parentIds=[test-global]. test-global has
-   * parentIds=[Local-global]. This method adds "Server (Local)" to the
-   * effective parents so service-specific variables from ancestor envs
-   * are inherited correctly.
-   */
-  async getEffectiveParentIds(environment) {
-    if (environment.scope !== "service" || !environment.reference || !environment.activateOn) {
-      return environment.parentIds;
-    }
-    const additionalIds = [];
-    for (const parentId of environment.parentIds) {
-      const parentEnv = await environmentStore.get(parentId);
-      if (!parentEnv || parentEnv.scope !== "global") continue;
-      for (const grandparentGlobalId of parentEnv.parentIds) {
-        const ancestorServiceEnv = await environmentStore.findServiceEnvironment(environment.reference, grandparentGlobalId);
-        if (ancestorServiceEnv && !environment.parentIds.includes(ancestorServiceEnv.id)) {
-          additionalIds.push(ancestorServiceEnv.id);
-        }
-      }
-    }
-    if (additionalIds.length === 0) return environment.parentIds;
-    return [...environment.parentIds, ...additionalIds];
-  }
-  /**
-   * Project an environment's variables onto their overrides: keep only the
-   * variables that have one, and swap in the override's value slot. The key
-   * always comes from the definition.
-   *
-   * Feeding this projection back through `resolveDag` resolves the override
-   * chain with the exact same inheritance and dedup-by-key rules as the value
-   * chain — so an override set on a parent env is no longer swallowed when a
-   * child (or a service env) redeclares the same key.
-   */
-  projectOverrides(variables, overrides) {
-    const projected = {};
-    for (const [varId, variable] of Object.entries(variables)) {
-      const override = overrides[varId];
-      if (override) {
-        projected[varId] = { key: variable.key, value: override.value };
-      }
-    }
-    return projected;
-  }
-  /**
-   * Resolve the override chain independently of the value chain and return the
-   * winning override per variable key (empty when nothing is overridden).
-   */
-  async resolveOverridesByKey(environmentId) {
-    const allOverrides = await environmentOverridesStore.getAll();
-    if (Object.keys(allOverrides).length === 0) return {};
-    const result = await this.resolveDag(
-      environmentId,
-      /* @__PURE__ */ new Set(),
-      (variables) => this.projectOverrides(variables, allOverrides)
-    );
-    const byKey = {};
-    for (const [varId, variable] of Object.entries(result.variables)) {
-      const source = result.sources[varId];
-      byKey[variable.key] = {
-        variable,
-        ...source ? { source: { environmentId: source.environmentId, environmentName: source.environmentName } } : {}
-      };
-    }
-    return byKey;
-  }
-  async resolveDag(environmentId, visited, project) {
-    if (visited.has(environmentId)) {
-      throw new Error(`Circular dependency detected in environment inheritance for ${environmentId}`);
-    }
-    const environment = await environmentStore.get(environmentId);
-    if (!environment) {
-      throw new Error(`Environment "${environmentId}" not found`);
-    }
-    visited.add(environmentId);
-    const effectiveParentIds = await this.getEffectiveParentIds(environment);
-    const parentResults = [];
-    for (const parentId of effectiveParentIds) {
-      const parentVisited = new Set(visited);
-      const parentResult = await this.resolveDag(parentId, parentVisited, project);
-      parentResults.push(parentResult);
-    }
-    const mergedVariables = {};
-    const sources = {};
-    for (const result of parentResults) {
-      for (const [varId, variable] of Object.entries(result.variables)) {
-        for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-          if (existingVar.key === variable.key && existingId !== varId) {
-            delete mergedVariables[existingId];
-            delete sources[existingId];
-          }
-        }
-        mergedVariables[varId] = variable;
-        sources[varId] = result.sources[varId] ?? sources[varId];
-      }
-    }
-    const parentEnv = {};
-    const parentSecretKeys = /* @__PURE__ */ new Set();
-    const parentKeySources = {};
-    for (const [varId, variable] of Object.entries(mergedVariables)) {
-      const slot = variable.value;
-      parentEnv[variable.key] = slot.pre + slot.value + slot.post;
-      if (slot.isSecret) {
-        parentSecretKeys.add(variable.key);
-      }
-      const source = sources[varId];
-      if (source) {
-        parentKeySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
-      }
-    }
-    const isInterpRef = (v) => /\{\{environment\.[^}]+\}\}/.test(v);
-    for (const result of parentResults) {
-      for (const [key, value] of Object.entries(result.parentEnv)) {
-        const existingIsRef = key in parentEnv && isInterpRef(parentEnv[key]);
-        const newIsConcrete = !isInterpRef(value);
-        if (!(key in parentEnv) || existingIsRef && newIsConcrete) {
-          parentEnv[key] = value;
-        }
-      }
-      for (const key of result.parentSecretKeys) {
-        parentSecretKeys.add(key);
-      }
-      for (const [key, source] of Object.entries(result.parentKeySources)) {
-        if (!(key in parentKeySources)) {
-          parentKeySources[key] = source;
-        }
-      }
-    }
-    for (const key of this.collectSecretKeys(mergedVariables, parentSecretKeys)) {
-      parentSecretKeys.add(key);
-    }
-    const ownVariables = project ? project(environment.variables) : environment.variables;
-    for (const [varId, variable] of Object.entries(ownVariables)) {
-      let wasInherited = varId in mergedVariables;
-      for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-        if (existingVar.key === variable.key && existingId !== varId) {
-          delete mergedVariables[existingId];
-          delete sources[existingId];
-          wasInherited = true;
-        }
-      }
-      mergedVariables[varId] = variable;
-      sources[varId] = {
-        environmentId: environment.id,
-        environmentName: environment.name,
-        overridden: wasInherited
-      };
-    }
-    return {
-      variables: mergedVariables,
-      sources,
-      parentEnv,
-      parentSecretKeys,
-      parentKeySources
-    };
-  }
-};
-var environmentResolver = new EnvironmentResolver();
-
 // ../server/src/services/llms-txt-generator.ts
 function generateAdminLlmsTxt(services, jwt, project) {
   const lines = [];
@@ -1611,7 +844,7 @@ import { z as z3 } from "zod";
 import { TRPCError as TRPCError2 } from "@trpc/server";
 
 // ../server/src/services/audit-service.ts
-import { appendFile, readFile as readFile3, stat, rename, unlink, readdir as readdir2, mkdir as mkdir2 } from "fs/promises";
+import { appendFile, readFile as readFile2, stat, rename, unlink, readdir as readdir2, mkdir } from "fs/promises";
 var AUDIT_FILENAME = "audit.log";
 var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_AGE_DAYS = 30;
@@ -1631,7 +864,7 @@ var AuditService = class {
     const line = JSON.stringify(record) + "\n";
     const filepath = this.getFilePath();
     try {
-      await mkdir2(machineRoot(), { recursive: true });
+      await mkdir(machineRoot(), { recursive: true });
       await appendFile(filepath, line, "utf-8");
       await this.rotateIfNeeded();
     } catch (err) {
@@ -1644,7 +877,7 @@ var AuditService = class {
     const filepath = this.getFilePath();
     let lines;
     try {
-      const content = await readFile3(filepath, "utf-8");
+      const content = await readFile2(filepath, "utf-8");
       lines = content.trim().split("\n").filter(Boolean);
     } catch {
       return { entries: [], total: 0 };
@@ -2485,8 +1718,8 @@ var ScenarioStore = class {
 var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
-import { mkdir as mkdir3, rm, readFile as readFile4 } from "fs/promises";
-import { join as join4 } from "path";
+import { mkdir as mkdir2, rm, readFile as readFile3 } from "fs/promises";
+import { join as join3 } from "path";
 function sanitizeSlug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "member";
 }
@@ -2502,7 +1735,7 @@ var ScenarioRunStore = class _ScenarioRunStore {
   }
   async initializeConversationWorkspace(conversationId, scenario, userInput) {
     const dir = this.getRunDir(conversationId);
-    await mkdir3(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await this.saveScenarioSnapshot(conversationId, scenario);
     const nodesById = new Map(scenario.nodes.map((p) => [p.id, p]));
     const teamMap = new Map(scenario.groups.map((t2) => [t2.id, t2.name]));
@@ -2527,8 +1760,8 @@ var ScenarioRunStore = class _ScenarioRunStore {
       "- Use read-only references from linked upstream files as context.",
       ""
     ].join("\n");
-    await atomicWriteSecure(join4(dir, "README.md"), overview);
-    await atomicWriteSecure(join4(dir, "USER_REQUEST.md"), `# User request
+    await atomicWriteSecure(join3(dir, "README.md"), overview);
+    await atomicWriteSecure(join3(dir, "USER_REQUEST.md"), `# User request
 
 ${userInput.trim() || "(empty)"}
 `);
@@ -2554,7 +1787,7 @@ ${userInput.trim() || "(empty)"}
         "- Waiting for assignment.",
         ""
       ].join("\n");
-      await atomicWriteSecure(join4(dir, fileName), content);
+      await atomicWriteSecure(join3(dir, fileName), content);
     }
   }
   async deleteRunDir(conversationId) {
@@ -2614,7 +1847,7 @@ ${userInput.trim() || "(empty)"}
     if (!runState) return;
     try {
       const dir = this.getRunDir(conversationId);
-      await mkdir3(dir, { recursive: true });
+      await mkdir2(dir, { recursive: true });
       const data = {
         nodeStates: { ...runState.nodeStates },
         nodeOutputs: { ...runState.nodeOutputs },
@@ -2622,18 +1855,18 @@ ${userInput.trim() || "(empty)"}
         ...Object.keys(runState.nodeAgentIds).length > 0 ? { nodeAgentIds: { ...runState.nodeAgentIds } } : {},
         ...Object.keys(runState.waitingInputs).length > 0 ? { waitingInputs: { ...runState.waitingInputs } } : {}
       };
-      await atomicWriteJsonSecure(join4(dir, "run-state.json"), data);
+      await atomicWriteJsonSecure(join3(dir, "run-state.json"), data);
     } catch {
     }
   }
   async loadPersistedRunState(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join4(dir, "run-state.json"));
+    return readJsonFileSafe(join3(dir, "run-state.json"));
   }
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile4(join4(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile3(join3(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -2642,23 +1875,23 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile4(join4(dir, "README.md"), "utf-8");
+      return await readFile3(join3(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
   }
   async saveScenarioSnapshot(conversationId, scenario) {
     const dir = this.getRunDir(conversationId);
-    await mkdir3(dir, { recursive: true });
+    await mkdir2(dir, { recursive: true });
     await atomicWriteJsonSecure(
-      join4(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
+      join3(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
       true
     );
   }
   async loadScenarioSnapshot(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join4(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
+    return readJsonFileSafe(join3(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
   }
 };
 var scenarioRunStore = new ScenarioRunStore();
@@ -2713,9 +1946,9 @@ async function vaultOfProject(projectId) {
 
 // ../server/src/services/image-storage.service.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir4, writeFile as writeFile2, readFile as readFile5, unlink as unlink2, readdir as readdir3 } from "fs/promises";
+import { mkdir as mkdir3, writeFile, readFile as readFile4, unlink as unlink2, readdir as readdir3 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
-import { join as join5, extname, resolve, sep } from "path";
+import { join as join4, extname, resolve, sep } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/jpeg",
@@ -2732,7 +1965,7 @@ var ImageStorageService = class {
     this.dir = dir;
   }
   async ensureTmpDir() {
-    await mkdir4(this.dir, { recursive: true, mode: 448 });
+    await mkdir3(this.dir, { recursive: true, mode: 448 });
   }
   async saveImage(buffer, originalName, mimeType, contextId) {
     if (!ALLOWED_MIME_TYPES.has(mimeType)) {
@@ -2752,15 +1985,15 @@ var ImageStorageService = class {
     const imageId = randomUUID3();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
-    const filePath = join5(this.dir, fileName);
+    const filePath = join4(this.dir, fileName);
     const resolvedPath = resolve(filePath);
     const resolvedDir = resolve(this.dir);
     if (resolvedPath !== resolvedDir && !resolvedPath.startsWith(resolvedDir + sep)) {
       throw new Error("Invalid file path");
     }
-    await writeFile2(filePath, buffer, { mode: 384 });
+    await writeFile(filePath, buffer, { mode: 384 });
     const meta = { imageId, filePath, mimeType, originalName, createdAt: Date.now(), contextId };
-    await writeFile2(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
+    await writeFile(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
     return meta;
   }
   /**
@@ -2778,7 +2011,7 @@ var ImageStorageService = class {
       const files = await readdir3(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile5(join5(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile4(join4(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync2(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -2804,7 +2037,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile5(join5(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -2819,7 +2052,7 @@ var ImageStorageService = class {
   async readImageAsBase64(imageId, expectedContextId) {
     const result = await this.getImagePath(imageId, expectedContextId);
     if (!result) return null;
-    const buffer = await readFile5(result.filePath);
+    const buffer = await readFile4(result.filePath);
     return { base64: buffer.toString("base64"), mimeType: result.mimeType };
   }
   async listExpiredImages(ttlMs = IMAGE_TTL_MS) {
@@ -2834,7 +2067,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile5(join5(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -2903,10 +2136,10 @@ import { basename } from "path";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
-import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir5, chmod as chmod2, unlink as unlink3 } from "fs/promises";
-import { dirname as dirname2 } from "path";
+import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir4, chmod, unlink as unlink3 } from "fs/promises";
+import { dirname } from "path";
 import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FILENAME2 = "cloud-session.json";
+var FILENAME = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
 function accountIdFor(cloudUrl, userId) {
   return createHash("sha256").update(`${cloudUrl.replace(/\/+$/, "")}|${userId}`).digest("hex").slice(0, 32);
@@ -2921,11 +2154,11 @@ var CloudSessionStore = class {
    * root, but a launch directory owning its own key keeps both together.
    */
   getFilePath() {
-    return keyedFilePath(FILENAME2);
+    return keyedFilePath(FILENAME);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME2);
+    return legacyMachineFilePath(FILENAME);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -2935,9 +2168,9 @@ var CloudSessionStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile6(await this.getFilePath(), "utf-8");
+      return await readFile5(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile6(this.getLegacyFilePath(), "utf-8");
+      return readFile5(this.getLegacyFilePath(), "utf-8");
     }
   }
   /**
@@ -3011,12 +2244,12 @@ var CloudSessionStore = class {
   }
   async save() {
     const filePath = await this.getFilePath();
-    await mkdir5(dirname2(filePath), { recursive: true });
+    await mkdir4(dirname(filePath), { recursive: true });
     const payload = { version: 2, accounts: this.accounts };
     const tmpPath = filePath + ".tmp";
-    await writeFile3(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
+    await writeFile2(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
     await renameWithRetry(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    await chmod(filePath, 384);
   }
   /**
    * Ranger le token obtenu par l'échange de jeton à usage unique.
@@ -3152,8 +2385,8 @@ var cloudSessionStore = new CloudSessionStore();
 
 // ../server/src/services/lan-mode.ts
 import { networkInterfaces } from "os";
-import { readFile as readFile7, writeFile as writeFile4, mkdir as mkdir6 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir5 } from "fs/promises";
+import { join as join5 } from "path";
 import { z as z4 } from "zod";
 var LOOPBACK2 = "127.0.0.1";
 var ANY = "0.0.0.0";
@@ -3166,11 +2399,11 @@ function instanceKey() {
   return env.DATA_DIR;
 }
 function networkFilePath() {
-  return join6(machineRoot(), NETWORK_FILE);
+  return join5(machineRoot(), NETWORK_FILE);
 }
 async function readFileState() {
   try {
-    return NetworkFileSchema.parse(JSON.parse(await readFile7(networkFilePath(), "utf-8")));
+    return NetworkFileSchema.parse(JSON.parse(await readFile6(networkFilePath(), "utf-8")));
   } catch {
     return { instances: {} };
   }
@@ -3181,12 +2414,12 @@ async function readPersisted() {
 }
 async function writePersisted(lanEnabled) {
   const root = machineRoot();
-  await mkdir6(root, { recursive: true });
+  await mkdir5(root, { recursive: true });
   const state = await readFileState();
   state.instances[instanceKey()] = { lanEnabled };
   const filePath = networkFilePath();
   const tmpPath = filePath + ".tmp";
-  await writeFile4(tmpPath, JSON.stringify(state, null, 2), "utf-8");
+  await writeFile3(tmpPath, JSON.stringify(state, null, 2), "utf-8");
   await renameWithRetry(tmpPath, filePath);
 }
 function registerHttpServer(server) {
@@ -4282,6 +3515,12 @@ function generateKanbanPopulatePrompt(board, scope) {
   lines.push("");
   return lines.join("\n");
 }
+async function kanbanContextFor(conv, scope) {
+  if (!conv?.kanbanBoardId) return "";
+  const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
+  if (!kanbanBoard) return "";
+  return "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId, scope) : generateKanbanPopulatePrompt(kanbanBoard, scope));
+}
 
 // ../server/src/services/ai-runners/claude-code-runner.ts
 import { spawn } from "child_process";
@@ -4454,7 +3693,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-R7BPQO6D.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-46C4NIQ2.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -4472,7 +3711,7 @@ ${TOKEN_INSTRUCTIONS}`;
     "--append-system-prompt",
     systemPrompt,
     ...mcpArgs,
-    prompt
+    ...opts.deferPrompt ? [] : [prompt]
   ];
   return args;
 }
@@ -4521,7 +3760,9 @@ async function runClaudeViaPty(params) {
   const { agentId, signal, skipTokenInstructions } = params;
   if (!agentId) throw new Error("runClaudeViaPty requires an agentId");
   const sessionId = params.sessionId && params.sessionId.length > 0 ? params.sessionId : randomUUID4();
-  const args = buildPtyArgs(params, sessionId, { excludeMcp: true });
+  const deferPrompt = !!params.mcpConfig;
+  const mcpReadyId = deferPrompt ? randomUUID4() : void 0;
+  const args = buildPtyArgs(params, sessionId, { excludeMcp: true, deferPrompt });
   const agentMgr = await getAgentManager();
   const displayArgs = args.map((a) => {
     if (a === params.prompt) return "<prompt>";
@@ -4601,7 +3842,7 @@ async function runClaudeViaPty(params) {
         }
       }
     });
-    agentMgr.agentMutation(agentId, "ai.spawnPty", {
+    const spawned = agentMgr.agentMutation(agentId, "ai.spawnPty", {
       cli: "claude",
       args,
       env: params.injectedEnv && Object.keys(params.injectedEnv).length > 0 ? params.injectedEnv : void 0,
@@ -4621,7 +3862,9 @@ async function runClaudeViaPty(params) {
       // signe elle-même, faute de requête HTTP d'où le tirer.
       mcpApiToken: params.apiToken || void 0,
       mcpProjectId: params.projectId || void 0,
-      mcpOrgId: params.orgId || void 0
+      mcpOrgId: params.orgId || void 0,
+      // Un agent ancien ignore ce champ : le plafond de `waitForPtyInput` couvre ce cas.
+      mcpReadyId
     }).then(({ spawnId: id }) => {
       spawnId = id;
       if (signal.aborted) {
@@ -4631,6 +3874,18 @@ async function runClaudeViaPty(params) {
     }).catch((err) => {
       fail(new Error(`Failed to spawn claude PTY: ${err.message}`));
     });
+    if (mcpReadyId) {
+      void spawned.then(async () => {
+        if (settled || !spawnId) return;
+        const id = spawnId;
+        const wait = await waitForPtyInput({ agentId, spawnId: id, mcpReadyId, runner: "claude-code", signal: innerAbort.signal });
+        if (settled || wait.status !== "ready") return;
+        if (!wait.mcpReady) console.warn(`[claude-pty] serveur MCP non signal\xE9 apr\xE8s ${PTY_MCP_READY_MAX_MS} ms, prompt \xE9crit quand m\xEAme (session ${sessionId})`);
+        await pasteToPty((data) => agentMgr.agentMutation(agentId, "ai.writePty", { spawnId: id, data }), params.prompt, { lead: PASTED_TASK_LEAD });
+      }).catch((err) => {
+        fail(new Error(`Failed to write the prompt to the claude PTY: ${err.message}`));
+      });
+    }
     signal.addEventListener("abort", () => fail(new Error("Aborted")), { once: true });
     void tail.whenDone.then(() => {
       if (settled) return;
@@ -5139,7 +4394,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-R7BPQO6D.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-46C4NIQ2.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -5867,12 +5122,6 @@ async function* drainSession(session, signal, isReconnect) {
     if (signal?.aborted) return;
   }
 }
-async function kanbanContextFor(conv, scope) {
-  if (!conv?.kanbanBoardId) return "";
-  const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-  if (!kanbanBoard) return "";
-  return "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId, scope) : generateKanbanPopulatePrompt(kanbanBoard, scope));
-}
 async function cliToken(ctx) {
   const bearer = ctx.authorization?.startsWith("Bearer ") ? ctx.authorization.slice(7) : void 0;
   if (!bearer || ctx.callerType !== "app") return bearer;
@@ -6057,6 +5306,26 @@ async function conversationCwd(conv) {
 function startCliSession(runner, convId, prompt, opts = {}) {
   return runner === "codex" ? startCodexSession(convId, prompt, opts) : startClaudeCodeSession(convId, prompt, opts);
 }
+async function writeWhenPtyReady(opts) {
+  const { agentId, spawnId } = opts;
+  const write = (data) => agentManager.agentMutation(agentId, "ai.writePty", { spawnId, data });
+  try {
+    const wait = await waitForPtyInput({ agentId, spawnId, mcpReadyId: opts.mcpReadyId, runner: opts.runner });
+    if (wait.status !== "ready") return;
+    if (opts.contexts.length > 0) {
+      const body = opts.contexts.map((c) => `### ${c.label}
+${c.text}`).join("\n\n");
+      await write(`\x1B[200~---------
+Context:
+\x1B[201~\x1B[200~${body}\x1B[201~\x1B[200~
+---------
+\x1B[201~`);
+    }
+    if (opts.initialPrompt) await pasteToPty(write, opts.initialPrompt, { lead: PASTED_TASK_LEAD });
+  } catch (err) {
+    console.warn("[chat.pty.start] deferred writePty failed:", err.message);
+  }
+}
 var chatRouter = router({
   conversations: router({
     /**
@@ -6839,7 +6108,12 @@ ${input.prompt}` : input.prompt;
       attachedContexts: z6.array(z6.object({
         label: z6.string().max(200),
         text: z6.string().max(1e6)
-      })).max(20).optional()
+      })).max(20).optional(),
+      /**
+       * Prompt collé puis soumis dès que le CLI accepte la saisie (remplissage
+       * d'un tableau kanban). Ignoré quand on se rattache à un terminal existant.
+       */
+      initialPrompt: z6.string().max(1e6).optional()
     })).mutation(async ({ input, ctx }) => {
       const t0 = Date.now();
       const lap = (label) => {
@@ -6911,6 +6185,8 @@ ${input.prompt}` : input.prompt;
       }
       const injectedEnv = await resolveInjectedEnv(input.environmentId);
       lap("resolveInjectedEnv");
+      const hasStartupInput = (input.attachedContexts?.length ?? 0) > 0 || !!input.initialPrompt?.trim();
+      const mcpReadyId = input.enableMcp && hasStartupInput ? randomUUID5() : void 0;
       const res = await agentManager.agentMutation(
         agentId,
         "ai.spawnPty",
@@ -6936,65 +6212,23 @@ ${input.prompt}` : input.prompt;
           mcpApiBaseUrl: input.apiBaseUrl ?? `http://localhost:${env.PORT}`,
           mcpApiToken: jwt,
           ...ptyRef?.id ? { mcpProjectId: ptyRef.id } : {},
-          ...ptyRef?.orgId ? { mcpOrgId: ptyRef.orgId } : {}
+          ...ptyRef?.orgId ? { mcpOrgId: ptyRef.orgId } : {},
+          // Un agent ancien ignore ce champ : le plafond de `waitForPtyInput` couvre ce cas.
+          ...mcpReadyId ? { mcpReadyId } : {}
         }
       );
       lap("agent ai.spawnPty");
-      const contexts = [...input.attachedContexts ?? []];
-      if (contexts.length > 0) {
-        const body = contexts.map((c) => `### ${c.label}
-${c.text}`).join("\n\n");
-        const injection = `\x1B[200~---------
-Context:
-\x1B[201~\x1B[200~${body}\x1B[201~\x1B[200~
----------
-\x1B[201~`;
-        const doInject = () => {
-          agentManager.agentMutation(agentId, "ai.writePty", { spawnId: res.spawnId, data: injection }).catch((err) => {
-            console.warn("[chat.pty.start] deferred context writePty failed:", err.message);
-          });
-        };
-        const startedAt = Date.now();
-        const MIN_MS = input.runner === "codex" ? 500 : 1200;
-        const QUIET_MS = 400;
-        const MAX_MS = 8e3;
-        let injected = false;
-        let quietTimer = null;
-        let maxTimer = null;
-        let unsub = null;
-        const cleanup = () => {
-          if (quietTimer) clearTimeout(quietTimer);
-          if (maxTimer) clearTimeout(maxTimer);
-          unsub?.();
-        };
-        const inject = () => {
-          if (injected) return;
-          injected = true;
-          cleanup();
-          doInject();
-        };
-        const scheduleQuiet = () => {
-          if (quietTimer) clearTimeout(quietTimer);
-          const wait = Math.max(QUIET_MS, MIN_MS - (Date.now() - startedAt));
-          quietTimer = setTimeout(inject, wait);
-        };
-        maxTimer = setTimeout(inject, MAX_MS);
-        unsub = agentManager.agentSubscribe(
+      const contexts = input.attachedContexts ?? [];
+      const initialPrompt = input.initialPrompt?.trim() ? input.initialPrompt : void 0;
+      if (contexts.length > 0 || initialPrompt) {
+        void writeWhenPtyReady({
           agentId,
-          "ai.stream",
-          { spawnId: res.spawnId, fromOffset: 0 },
-          (data) => {
-            const chunk = data.chunk;
-            if (chunk?.type === "exit") {
-              injected = true;
-              cleanup();
-              return;
-            }
-            scheduleQuiet();
-          },
-          () => {
-          }
-        );
+          spawnId: res.spawnId,
+          runner: input.runner,
+          mcpReadyId,
+          contexts,
+          initialPrompt
+        });
       }
       noteSpawnConversation(res.spawnId, input.sessionId);
       return { spawnId: res.spawnId, agentId, reattached: false };
@@ -7255,9 +6489,6 @@ export {
   cloudFetch,
   readCloudIdentity,
   attachServiceToProject,
-  environmentOverridesStore,
-  filterEnvForAi,
-  environmentResolver,
   auditService,
   isShareable,
   logParserStore,
@@ -7270,6 +6501,7 @@ export {
   networkInfo,
   applyPersistedLanMode,
   setLanMode,
+  runeyaMcpConfig,
   Id128Schema,
   ConversationIdSchema,
   NameSchema,
@@ -7293,6 +6525,7 @@ export {
   executeKanbanCommands,
   executeKanbanBoardCommands,
   buildKanbanCardPrompt,
+  kanbanContextFor,
   ClaudeCodeRunner,
   shutdownCodexAppServer,
   CodexRunner,
@@ -7302,4 +6535,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-SEPAURTQ.js.map
+//# sourceMappingURL=chunk-2NE52CL5.js.map