@runeya/runeya 2.0.153 → 2.0.154

package/{chunk-QJSIN26R.js → chunk-VKYSHTYT.js}

@@ -55,7 +55,7 @@ import {
   syncConversationFromClaudeTranscript,
   verifyJwt,
   waitForPtyInput
-} from "./chunk-EUTW2S4P.js";
+} from "./chunk-OLHL5NFP.js";
 import {
   conversationSectionStore,
   projectStore
@@ -134,7 +134,7 @@ import { z as z6 } from "zod";
 import Anthropic2 from "@anthropic-ai/sdk";
 import OpenAI2 from "openai";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 
 // ../../packages/mcp-server/src/launch.ts
 import { fileURLToPath } from "url";
@@ -1557,6 +1557,105 @@ var serviceRouter = router({
   })
 });
 
+// ../server/src/services/conversation-secret-env-store.ts
+import { mkdir as mkdir2, readFile as readFile3, rm } from "fs/promises";
+import { dirname } from "path";
+var DIRNAME = "conversation-secret-env";
+var SECRET_ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var SECRET_ENV_MAX_ENTRIES = 50;
+var SECRET_ENV_MAX_KEY_LENGTH = 128;
+var SECRET_ENV_MAX_VALUE_LENGTH = 8192;
+var CONVERSATION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+function dict(entries = []) {
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of entries) out[k] = v;
+  return out;
+}
+function isSecretFile(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+var ConversationSecretEnvStore = class {
+  /** File en mémoire : sérialise les écritures de ce process. */
+  queue = Promise.resolve();
+  pathOf(conversationId) {
+    if (!CONVERSATION_ID_PATTERN.test(conversationId)) {
+      throw new Error("Identifiant de conversation invalide");
+    }
+    return machineFilePath(`${DIRNAME}/${conversationId}.json`);
+  }
+  /**
+   * Seul `ENOENT` veut dire « rien d'enregistré ». Toute autre erreur (lecture
+   * impossible, contenu invalide) remonte : la rendre en `{}` ferait écraser
+   * le fichier à l'écriture suivante.
+   */
+  async read(conversationId) {
+    let raw;
+    try {
+      raw = await readFile3(this.pathOf(conversationId), "utf-8");
+    } catch (err) {
+      if (err.code === "ENOENT") return {};
+      throw err;
+    }
+    const parsed = JSON.parse(raw);
+    if (!isSecretFile(parsed)) throw new Error(`${DIRNAME}/${conversationId}.json : contenu inattendu, \xE9criture refus\xE9e`);
+    return dict(Object.entries(parsed));
+  }
+  serialize(fn) {
+    const next = this.queue.then(fn, fn);
+    this.queue = next.catch(() => void 0);
+    return next;
+  }
+  /** Les noms enregistrés pour une conversation, jamais les valeurs. */
+  async keys(conversationId) {
+    return Object.keys(await this.read(conversationId));
+  }
+  /** Nom → valeur en clair, prêt à entrer dans l'environnement d'un process. */
+  async resolve(conversationId) {
+    const stored = await this.read(conversationId);
+    const result = dict();
+    for (const [key, encrypted] of Object.entries(stored)) {
+      try {
+        result[key] = decryptValue(encrypted);
+      } catch (err) {
+        console.warn(`[conversation-secret-env] ${key} illisible pour ${conversationId} :`, err.message);
+      }
+    }
+    return result;
+  }
+  /**
+   * Remplace l'ensemble des variables de la conversation. Un nom absent de
+   * `entries` est supprimé ; une ligne sans valeur garde celle de la base.
+   */
+  replace(conversationId, entries) {
+    return this.serialize(async () => {
+      const previous = await this.read(conversationId);
+      const next = dict();
+      for (const { key, value } of entries) {
+        if (value !== void 0 && value !== "") {
+          next[key] = encryptValue(value);
+        } else if (Object.hasOwn(previous, key)) {
+          next[key] = previous[key];
+        } else {
+          throw new Error(`Aucune valeur pour ${key}`);
+        }
+      }
+      const path = this.pathOf(conversationId);
+      if (Object.keys(next).length === 0) {
+        await rm(path, { force: true });
+      } else {
+        await mkdir2(dirname(path), { recursive: true });
+        await atomicWriteSecure(path, JSON.stringify(next, null, 2));
+      }
+      return Object.keys(next);
+    });
+  }
+  /** La conversation disparaît : ses secrets partent avec elle. */
+  remove(conversationId) {
+    return this.serialize(() => rm(this.pathOf(conversationId), { force: true }));
+  }
+};
+var conversationSecretEnvStore = new ConversationSecretEnvStore();
+
 // ../server/src/services/scenario-store.ts
 function normalizeNode(raw) {
   const aiCli = raw.aiCli ?? "claude-code";
@@ -1718,7 +1817,7 @@ var ScenarioStore = class {
 var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
-import { mkdir as mkdir2, rm, readFile as readFile3 } from "fs/promises";
+import { mkdir as mkdir3, rm as rm2, readFile as readFile4 } from "fs/promises";
 import { join as join3 } from "path";
 function sanitizeSlug(value) {
   return value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60) || "member";
@@ -1735,7 +1834,7 @@ var ScenarioRunStore = class _ScenarioRunStore {
   }
   async initializeConversationWorkspace(conversationId, scenario, userInput) {
     const dir = this.getRunDir(conversationId);
-    await mkdir2(dir, { recursive: true });
+    await mkdir3(dir, { recursive: true });
     await this.saveScenarioSnapshot(conversationId, scenario);
     const nodesById = new Map(scenario.nodes.map((p) => [p.id, p]));
     const teamMap = new Map(scenario.groups.map((t2) => [t2.id, t2.name]));
@@ -1791,7 +1890,7 @@ ${userInput.trim() || "(empty)"}
     }
   }
   async deleteRunDir(conversationId) {
-    await rm(this.getRunDir(conversationId), { recursive: true, force: true });
+    await rm2(this.getRunDir(conversationId), { recursive: true, force: true });
     this.activeRuns.delete(conversationId);
   }
   ensureRunState(conversationId) {
@@ -1847,7 +1946,7 @@ ${userInput.trim() || "(empty)"}
     if (!runState) return;
     try {
       const dir = this.getRunDir(conversationId);
-      await mkdir2(dir, { recursive: true });
+      await mkdir3(dir, { recursive: true });
       const data = {
         nodeStates: { ...runState.nodeStates },
         nodeOutputs: { ...runState.nodeOutputs },
@@ -1866,7 +1965,7 @@ ${userInput.trim() || "(empty)"}
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile3(join3(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile4(join3(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -1875,14 +1974,14 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile3(join3(dir, "README.md"), "utf-8");
+      return await readFile4(join3(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
   }
   async saveScenarioSnapshot(conversationId, scenario) {
     const dir = this.getRunDir(conversationId);
-    await mkdir2(dir, { recursive: true });
+    await mkdir3(dir, { recursive: true });
     await atomicWriteJsonSecure(
       join3(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
@@ -1899,12 +1998,17 @@ var scenarioRunStore = new ScenarioRunStore();
 // ../server/src/services/ai-provider-utils.ts
 import Anthropic from "@anthropic-ai/sdk";
 import OpenAI from "openai";
+var OLLAMA_BASE_URL = "http://localhost:11434";
 var OPENAI_COMPAT_BASE_URLS = {
   openai: "https://api.openai.com/v1",
   groq: "https://api.groq.com/openai/v1",
   mistral: "https://api.mistral.ai/v1",
-  ollama: "http://localhost:11434/v1"
+  ollama: `${OLLAMA_BASE_URL}/v1`
 };
+function truncationError(finishReason) {
+  if (finishReason !== "length") return null;
+  return new Error("The response was cut off: the model reached its context or output token limit (finish_reason: length).");
+}
 var DEFAULT_MODELS = {
   anthropic: "claude-opus-4-6",
   openai: "gpt-4o",
@@ -1935,6 +2039,159 @@ async function fetchProviderModels(provider, plaintextKey) {
   return [];
 }
 
+// ../server/src/services/ollama-chat.ts
+import { randomUUID as randomUUID3 } from "crypto";
+var OLLAMA_RESPONSE_MARGIN = 8192;
+var CHARS_PER_TOKEN = 4;
+var SHOW_TIMEOUT_MS = 5e3;
+var CHAT_TIMEOUT_MS = 10 * 6e4;
+var contextLimits = /* @__PURE__ */ new Map();
+async function modelContextLimit(model) {
+  if (contextLimits.has(model)) return contextLimits.get(model);
+  let limit = null;
+  try {
+    const res = await fetch(`${OLLAMA_BASE_URL}/api/show`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ model }),
+      signal: AbortSignal.timeout(SHOW_TIMEOUT_MS)
+    });
+    if (res.ok) {
+      const body = await res.json();
+      for (const [key, value] of Object.entries(body.model_info ?? {})) {
+        if (key.endsWith(".context_length") && typeof value === "number" && value > 0) limit = value;
+      }
+    }
+  } catch {
+  }
+  if (limit !== null) contextLimits.set(model, limit);
+  return limit;
+}
+function computeNumCtx(promptChars, modelLimit) {
+  const wanted = Math.ceil(promptChars / CHARS_PER_TOKEN) + OLLAMA_RESPONSE_MARGIN;
+  return modelLimit ? Math.min(wanted, modelLimit) : wanted;
+}
+function textOf(content) {
+  if (typeof content === "string") return { text: content, images: [] };
+  const images = [];
+  const texts = [];
+  for (const part of content ?? []) {
+    if (part.type === "text") texts.push(part.text);
+    else if (part.type === "image_url") {
+      const base64 = part.image_url.url.split(",", 2)[1];
+      if (base64) images.push(base64);
+    }
+  }
+  return { text: texts.join("\n"), images };
+}
+function toOllamaMessages(messages) {
+  const toolNames = /* @__PURE__ */ new Map();
+  return messages.map((m) => {
+    if (m.role === "tool") {
+      return { role: "tool", content: textOf(m.content).text, tool_name: toolNames.get(m.tool_call_id) };
+    }
+    if (m.role === "assistant") {
+      const toolCalls = (m.tool_calls ?? []).flatMap((tc) => {
+        if (tc.type !== "function") return [];
+        toolNames.set(tc.id, tc.function.name);
+        let args = {};
+        try {
+          args = JSON.parse(tc.function.arguments || "{}");
+        } catch {
+        }
+        return [{ function: { name: tc.function.name, arguments: args } }];
+      });
+      const msg2 = { role: "assistant", content: textOf(m.content ?? "").text };
+      if (toolCalls.length > 0) msg2.tool_calls = toolCalls;
+      return msg2;
+    }
+    const { text, images } = textOf(m.content);
+    const role = m.role === "developer" ? "system" : m.role;
+    const msg = { role, content: text };
+    if (images.length > 0) msg.images = images;
+    return msg;
+  });
+}
+function chunk(delta, finishReason = null) {
+  return {
+    id: "",
+    object: "chat.completion.chunk",
+    created: 0,
+    model: "",
+    choices: [{ index: 0, delta, finish_reason: finishReason }]
+  };
+}
+async function* streamOllamaChat(params) {
+  const messages = toOllamaMessages(params.messages);
+  const promptChars = JSON.stringify(messages).length + JSON.stringify(params.tools).length;
+  const numCtx = computeNumCtx(promptChars, await modelContextLimit(params.model));
+  const timeout = AbortSignal.timeout(CHAT_TIMEOUT_MS);
+  const res = await fetch(`${OLLAMA_BASE_URL}/api/chat`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      model: params.model,
+      messages,
+      tools: params.tools,
+      stream: true,
+      options: { num_ctx: numCtx, temperature: params.temperature ?? 0 }
+    }),
+    signal: params.signal ? AbortSignal.any([params.signal, timeout]) : timeout
+  });
+  if (!res.ok || !res.body) {
+    throw new Error(`Ollama error ${res.status}: ${(await res.text().catch(() => "")).slice(0, 500)}`);
+  }
+  const decoder = new TextDecoder();
+  let buffer = "";
+  let toolIndex = 0;
+  const handle = function* (line) {
+    if (!line.trim()) return;
+    const data = JSON.parse(line);
+    if (data.error) throw new Error(`Ollama error: ${data.error}`);
+    const content = data.message?.content;
+    if (content) yield chunk({ content });
+    for (const tc of data.message?.tool_calls ?? []) {
+      yield chunk({
+        tool_calls: [{
+          index: toolIndex++,
+          id: `call_${randomUUID3()}`,
+          type: "function",
+          function: { name: tc.function.name, arguments: JSON.stringify(tc.function.arguments ?? {}) }
+        }]
+      });
+    }
+    if (data.done) yield chunk({}, data.done_reason === "length" ? "length" : "stop");
+  };
+  for await (const bytes of res.body) {
+    buffer += decoder.decode(bytes, { stream: true });
+    let nl;
+    while ((nl = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, nl);
+      buffer = buffer.slice(nl + 1);
+      yield* handle(line);
+    }
+  }
+  yield* handle(buffer + decoder.decode());
+}
+var OLLAMA_MODEL_PREFIX = "ollama:";
+async function listOllamaModels() {
+  try {
+    const res = await fetch(`${OLLAMA_BASE_URL}/api/tags`, { signal: AbortSignal.timeout(SHOW_TIMEOUT_MS) });
+    if (!res.ok) return [];
+    const body = await res.json();
+    return (body.models ?? []).flatMap((m) => typeof m.name === "string" ? [m.name] : []);
+  } catch {
+    return [];
+  }
+}
+function claudeOllamaTarget(model) {
+  if (!model?.startsWith(OLLAMA_MODEL_PREFIX)) return null;
+  return {
+    model: model.slice(OLLAMA_MODEL_PREFIX.length),
+    env: { ANTHROPIC_BASE_URL: OLLAMA_BASE_URL, ANTHROPIC_AUTH_TOKEN: "ollama", ANTHROPIC_API_KEY: "" }
+  };
+}
+
 // ../server/src/services/settings-scope.ts
 async function vaultOfProject(projectId) {
   if (!projectId) return void 0;
@@ -1945,8 +2202,8 @@ async function vaultOfProject(projectId) {
 }
 
 // ../server/src/services/image-storage.service.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { mkdir as mkdir3, writeFile, readFile as readFile4, unlink as unlink2, readdir as readdir3 } from "fs/promises";
+import { randomUUID as randomUUID4 } from "crypto";
+import { mkdir as mkdir4, writeFile, readFile as readFile5, unlink as unlink2, readdir as readdir3 } from "fs/promises";
 import { existsSync as existsSync2 } from "fs";
 import { join as join4, extname, resolve, sep } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
@@ -1965,7 +2222,7 @@ var ImageStorageService = class {
     this.dir = dir;
   }
   async ensureTmpDir() {
-    await mkdir3(this.dir, { recursive: true, mode: 448 });
+    await mkdir4(this.dir, { recursive: true, mode: 448 });
   }
   async saveImage(buffer, originalName, mimeType, contextId) {
     if (!ALLOWED_MIME_TYPES.has(mimeType)) {
@@ -1982,7 +2239,7 @@ var ImageStorageService = class {
       throw new Error(`Unsupported extension: ${ext}`);
     }
     await this.ensureTmpDir();
-    const imageId = randomUUID3();
+    const imageId = randomUUID4();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
     const filePath = join4(this.dir, fileName);
@@ -2011,7 +2268,7 @@ var ImageStorageService = class {
       const files = await readdir3(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile4(join4(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile5(join4(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync2(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -2037,7 +2294,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile5(join4(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -2052,7 +2309,7 @@ var ImageStorageService = class {
   async readImageAsBase64(imageId, expectedContextId) {
     const result = await this.getImagePath(imageId, expectedContextId);
     if (!result) return null;
-    const buffer = await readFile4(result.filePath);
+    const buffer = await readFile5(result.filePath);
     return { base64: buffer.toString("base64"), mimeType: result.mimeType };
   }
   async listExpiredImages(ttlMs = IMAGE_TTL_MS) {
@@ -2067,7 +2324,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile4(join4(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile5(join4(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -2136,8 +2393,8 @@ import { basename } from "path";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
-import { readFile as readFile5, writeFile as writeFile2, mkdir as mkdir4, chmod, unlink as unlink3 } from "fs/promises";
-import { dirname } from "path";
+import { readFile as readFile6, writeFile as writeFile2, mkdir as mkdir5, chmod, unlink as unlink3 } from "fs/promises";
+import { dirname as dirname2 } from "path";
 import { randomBytes as randomBytes2, createHash, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var FILENAME = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
@@ -2168,9 +2425,9 @@ var CloudSessionStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile5(await this.getFilePath(), "utf-8");
+      return await readFile6(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile5(this.getLegacyFilePath(), "utf-8");
+      return readFile6(this.getLegacyFilePath(), "utf-8");
     }
   }
   /**
@@ -2244,7 +2501,7 @@ var CloudSessionStore = class {
   }
   async save() {
     const filePath = await this.getFilePath();
-    await mkdir4(dirname(filePath), { recursive: true });
+    await mkdir5(dirname2(filePath), { recursive: true });
     const payload = { version: 2, accounts: this.accounts };
     const tmpPath = filePath + ".tmp";
     await writeFile2(tmpPath, JSON.stringify(payload, null, 2), "utf-8");
@@ -2385,7 +2642,7 @@ var cloudSessionStore = new CloudSessionStore();
 
 // ../server/src/services/lan-mode.ts
 import { networkInterfaces } from "os";
-import { readFile as readFile6, writeFile as writeFile3, mkdir as mkdir5 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile3, mkdir as mkdir6 } from "fs/promises";
 import { join as join5 } from "path";
 import { z as z4 } from "zod";
 var LOOPBACK2 = "127.0.0.1";
@@ -2403,7 +2660,7 @@ function networkFilePath() {
 }
 async function readFileState() {
   try {
-    return NetworkFileSchema.parse(JSON.parse(await readFile6(networkFilePath(), "utf-8")));
+    return NetworkFileSchema.parse(JSON.parse(await readFile7(networkFilePath(), "utf-8")));
   } catch {
     return { instances: {} };
   }
@@ -2414,7 +2671,7 @@ async function readPersisted() {
 }
 async function writePersisted(lanEnabled) {
   const root = machineRoot();
-  await mkdir5(root, { recursive: true });
+  await mkdir6(root, { recursive: true });
   const state = await readFileState();
   state.instances[instanceKey()] = { lanEnabled };
   const filePath = networkFilePath();
@@ -2932,8 +3189,17 @@ async function resolveOrganizationId(explicit) {
   if (explicit) return explicit;
   const accounts = await cloudSessionStore.list();
   if (accounts.length > 1) {
+    const perAccount = await Promise.all(accounts.map(async (account) => {
+      const res = await callCloud(
+        "/organization/list",
+        { accountId: account.id }
+      );
+      return { account, orgs: res.ok ? res.data ?? [] : [], failure: res.ok ? null : res.reason };
+    }));
+    const listed2 = perAccount.flatMap((r) => r.orgs).map((o) => `${o.name ?? "(sans nom)"} \u2014 ${o.id}`).join(", ");
+    const failures = perAccount.filter((r) => r.failure).map((r) => `${r.account.email} (${r.failure})`);
     throw new KanbanUnavailableError(
-      `Ce poste est li\xE9 \xE0 ${accounts.length} comptes cloud : pr\xE9cisez organizationId, sans quoi rien ne dit lequel interroger.`
+      `Ce poste est li\xE9 \xE0 ${accounts.length} comptes cloud : relancez l'appel avec organizationId` + (listed2 ? `, \xE0 choisir parmi : ${listed2}.` : " (celui de la carte ou du tableau concern\xE9).") + (failures.length ? ` Liste ${listed2 ? "partielle" : "indisponible"}, organisations illisibles pour : ${failures.join(" ; ")}.` : "")
     );
   }
   const accountId = await soleAccountScope();
@@ -3559,7 +3825,7 @@ Ne jamais omettre ce tag. Il doit \xEAtre la toute derni\xE8re ligne de ta r\xE9
 `.trim();
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 
 // ../server/src/services/ai-runners/claude-pty-tail.ts
 import { open } from "fs/promises";
@@ -3759,9 +4025,9 @@ function dispatchEntry(entry, state, cbs) {
 async function runClaudeViaPty(params) {
   const { agentId, signal, skipTokenInstructions } = params;
   if (!agentId) throw new Error("runClaudeViaPty requires an agentId");
-  const sessionId = params.sessionId && params.sessionId.length > 0 ? params.sessionId : randomUUID4();
+  const sessionId = params.sessionId && params.sessionId.length > 0 ? params.sessionId : randomUUID5();
   const deferPrompt = !!params.mcpConfig;
-  const mcpReadyId = deferPrompt ? randomUUID4() : void 0;
+  const mcpReadyId = deferPrompt ? randomUUID5() : void 0;
   const args = buildPtyArgs(params, sessionId, { excludeMcp: true, deferPrompt });
   const agentMgr = await getAgentManager();
   const displayArgs = args.map((a) => {
@@ -4166,14 +4432,14 @@ var ClaudeCodeRunner = class {
       };
       signal.addEventListener("abort", onAbort, { once: true });
       let stderrBuffer = "";
-      proc.stdout.on("data", (chunk) => {
-        stdoutBuffer += chunk.toString("utf-8");
+      proc.stdout.on("data", (chunk2) => {
+        stdoutBuffer += chunk2.toString("utf-8");
         const lines = stdoutBuffer.split("\n");
         stdoutBuffer = lines.pop() ?? "";
         processClaudeStdoutLines(lines, streamState, params, ctx);
       });
-      proc.stderr.on("data", (chunk) => {
-        stderrBuffer += chunk.toString("utf-8");
+      proc.stderr.on("data", (chunk2) => {
+        stderrBuffer += chunk2.toString("utf-8");
       });
       proc.on("close", (code) => {
         if (ctx.earlyResult) {
@@ -4827,6 +5093,38 @@ var CodexRunner = class {
   }
 };
 
+// ../server/src/services/pty-session-stopper.ts
+var POLL_MS = 50;
+var EXIT_TIMEOUT_MS = 5e3;
+async function stopPtysOf(sessionId) {
+  const results = await Promise.allSettled(agentManager.listAgents().map(async (agent) => {
+    const agentId = agent.config.id;
+    const query = () => agentManager.agentQuery(agentId, "ai.findPtyBySession", { sessionId });
+    let pty;
+    try {
+      pty = await query();
+    } catch {
+      return;
+    }
+    if (pty?.status !== "running") return;
+    await agentManager.agentMutation(agentId, "ai.kill", { spawnId: pty.spawnId });
+    const deadline = Date.now() + EXIT_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      let state;
+      try {
+        state = await query();
+      } catch (err) {
+        throw new Error(`Terminal de la conversation : \xE9tat illisible apr\xE8s l'arr\xEAt (${err.message})`);
+      }
+      if (state?.status !== "running") return;
+      await new Promise((r) => setTimeout(r, POLL_MS));
+    }
+    throw new Error(`Le terminal de la conversation tourne encore ${EXIT_TIMEOUT_MS / 1e3} s apr\xE8s la demande d'arr\xEAt`);
+  }));
+  const failure = results.find((r) => r.status === "rejected");
+  if (failure) throw failure.reason instanceof Error ? failure.reason : new Error(String(failure.reason));
+}
+
 // ../server/src/services/cli-models.ts
 var CACHE_MS = 5 * 6e4;
 var MAX_PAGES = 10;
@@ -4980,23 +5278,18 @@ async function* runAnthropic(client, model, system, initialMessages, apiKey, aut
   }
   yield { type: "done", text: "" };
 }
-async function* runOpenAI(client, model, initialMessages, apiKey, authToken, signal, anchor = {}) {
+async function* runOpenAI(createStream, initialMessages, apiKey, authToken, signal, anchor = {}) {
   const messages = [...initialMessages];
   const MAX_TOOL_ROUNDS = 10;
   for (let round = 0; round < MAX_TOOL_ROUNDS; round++) {
     const toolCallsAcc = {};
     if (signal?.aborted) return;
-    const stream = await client.chat.completions.create({
-      model,
-      messages,
-      tools: CHAT_TOOLS_OPENAI,
-      stream: true,
-      max_tokens: 16384,
-      temperature: 0
-    }, { signal });
-    for await (const chunk of stream) {
-      const choice = chunk.choices[0];
+    const stream = await createStream(messages, signal);
+    let finishReason = null;
+    for await (const chunk2 of stream) {
+      const choice = chunk2.choices[0];
       if (!choice) continue;
+      if (choice.finish_reason) finishReason = choice.finish_reason;
       if (choice.delta?.content) {
         yield { type: "delta", text: choice.delta.content };
       }
@@ -5008,6 +5301,8 @@ async function* runOpenAI(client, model, initialMessages, apiKey, authToken, sig
         toolCallsAcc[tc.index] = acc;
       }
     }
+    const truncated = truncationError(finishReason);
+    if (truncated) throw truncated;
     if (Object.keys(toolCallsAcc).length === 0) {
       yield { type: "done", text: "" };
       return;
@@ -5142,15 +5437,23 @@ async function buildCliSystemContext(conv, jwt) {
   });
   return systemContext;
 }
-async function resolveInjectedEnv(environmentId) {
-  if (!environmentId) return void 0;
-  try {
-    const injected = await environmentResolver.resolveAiInjectedEnv(environmentId);
-    return Object.keys(injected).length > 0 ? injected : void 0;
-  } catch (err) {
-    console.warn("[chat] resolveInjectedEnv failed:", err.message);
-    return void 0;
+async function resolveInjectedEnv(environmentId, secretOwnerId) {
+  let injected = {};
+  if (environmentId) {
+    try {
+      injected = await environmentResolver.resolveAiInjectedEnv(environmentId);
+    } catch (err) {
+      console.warn("[chat] resolveInjectedEnv failed:", err.message);
+    }
+  }
+  if (secretOwnerId) {
+    try {
+      injected = { ...injected, ...await conversationSecretEnvStore.resolve(secretOwnerId) };
+    } catch (err) {
+      console.warn("[chat] secret env unreadable, started without it:", err.message);
+    }
   }
+  return Object.keys(injected).length > 0 ? injected : void 0;
 }
 async function startClaudeCodeSession(convId, prompt, opts = {}) {
   const conv = await conversationStore.get(convId);
@@ -5180,7 +5483,7 @@ async function startClaudeCodeSession(convId, prompt, opts = {}) {
   if (resolvedAgentId) {
     session.agentId = resolvedAgentId;
   }
-  const injectedEnv = await resolveInjectedEnv(opts.environmentId);
+  const injectedEnv = await resolveInjectedEnv(opts.environmentId, opts.secretEnvOwnerId ?? convId);
   const done = new ClaudeCodeRunner().run({
     agentId: resolvedAgentId ?? void 0,
     // The conversation's project, not the server's launch directory.
@@ -5247,7 +5550,7 @@ async function startCodexSession(convId, prompt, opts = {}) {
   if (resolvedAgentId) {
     session.agentId = resolvedAgentId;
   }
-  const injectedEnv = await resolveInjectedEnv(opts.environmentId);
+  const injectedEnv = await resolveInjectedEnv(opts.environmentId, opts.secretEnvOwnerId ?? convId);
   const done = new CodexRunner().run({
     agentId: resolvedAgentId ?? void 0,
     cwd: await conversationCwd(conv),
@@ -5423,7 +5726,9 @@ var chatRouter = router({
       projectId: Id128Schema.optional(),
       orgId: z6.string().max(128).nullable().optional(),
       // L'agent où la conversation travaille. Absent = agent par défaut.
-      agentId: Id128Schema.optional()
+      agentId: Id128Schema.optional(),
+      // Modèle du terminal Claude Code (`ollama:<nom>` : Claude Code sur Ollama).
+      cliModel: z6.string().max(128).optional()
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
@@ -5440,6 +5745,7 @@ var chatRouter = router({
       );
       const extra = {
         ...input.agentId ? { agentId: input.agentId } : {},
+        ...input.cliModel ? { cliModel: input.cliModel } : {},
         ...companionDefaults
       };
       const conv = await conversationStore.create(
@@ -5510,6 +5816,52 @@ var chatRouter = router({
       forgetCompanionSkip(input.id);
       return conv;
     }),
+    /**
+     * Les noms des variables secrètes d'une conversation. Jamais les valeurs :
+     * elles entrent dans l'environnement du CLI et n'en ressortent pas.
+     */
+    secretEnvKeys: protectedProcedure.input(z6.object({ id: Id128Schema })).query(async ({ input }) => {
+      const existing = await conversationStore.get(input.id);
+      if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
+      return conversationSecretEnvStore.keys(input.id);
+    }),
+    /**
+     * Remplace les variables secrètes d'une conversation, puis arrête son
+     * process et celui de son compagnon : un process ne reçoit son
+     * environnement qu'à son lancement, la prochaine ouverture repart avec les
+     * nouvelles valeurs. `value` absent = garder la valeur enregistrée.
+     */
+    setSecretEnv: protectedProcedure.input(z6.object({
+      id: Id128Schema,
+      entries: z6.array(z6.object({
+        key: z6.string().min(1).max(SECRET_ENV_MAX_KEY_LENGTH).regex(SECRET_ENV_KEY_PATTERN),
+        value: z6.string().max(SECRET_ENV_MAX_VALUE_LENGTH).optional()
+      })).max(SECRET_ENV_MAX_ENTRIES).refine((list) => new Set(list.map((e) => e.key)).size === list.length, { message: "Duplicate variable name" })
+    })).mutation(async ({ input }) => {
+      const existing = await conversationStore.get(input.id);
+      if (!existing) throw new TRPCError4({ code: "NOT_FOUND", message: "Conversation not found" });
+      if (existing.isCompanion) {
+        throw new TRPCError4({ code: "BAD_REQUEST", message: "A companion uses the secrets of the conversation it reviews" });
+      }
+      let keys;
+      try {
+        keys = await conversationSecretEnvStore.replace(input.id, input.entries);
+      } catch (err) {
+        throw new TRPCError4({ code: "BAD_REQUEST", message: err.message });
+      }
+      activeSessionRegistry.kill(input.id);
+      const stops = [stopPtysOf(input.id)];
+      if (existing.companionConversationId) {
+        activeSessionRegistry.kill(existing.companionConversationId);
+        stops.push(stopPtysOf(existing.companionConversationId));
+      }
+      try {
+        await Promise.all(stops);
+      } catch (err) {
+        throw new TRPCError4({ code: "INTERNAL_SERVER_ERROR", message: `Variables enregistr\xE9es, mais le process n'a pas pu \xEAtre arr\xEAt\xE9 : ${err.message}` });
+      }
+      return keys;
+    }),
     /**
      * La dernière livraison du compagnon vers cette conversation.
      *
@@ -5614,19 +5966,9 @@ var chatRouter = router({
       forgetReviewProgress(input.id);
       forgetDelivery(input.id);
       forgetCompanionSkip(input.id);
-      for (const agent of agentManager.listAgents()) {
-        const agentId = agent.config.id;
-        agentManager.agentQuery(
-          agentId,
-          "ai.findPtyBySession",
-          { sessionId: input.id }
-        ).then((pty) => {
-          if (pty?.status === "running") {
-            return agentManager.agentMutation(agentId, "ai.kill", { spawnId: pty.spawnId });
-          }
-        }).catch(() => {
-        });
-      }
+      await stopPtysOf(input.id).catch(() => {
+      });
+      await conversationSecretEnvStore.remove(input.id);
       await conversationStore.delete(input.id);
       await scenarioRunStore.deleteRunDir(input.id);
       imageStorageService.deleteByContextId(input.id).catch(
@@ -5705,6 +6047,11 @@ var chatRouter = router({
       return [];
     }
   }),
+  /**
+   * POC : les modèles Ollama installés, proposés dans « Choisir votre IA » pour
+   * lancer le terminal Claude Code sur Ollama. Liste vide si Ollama ne répond pas.
+   */
+  listOllamaModels: protectedProcedure.query(async () => ({ models: await listOllamaModels() })),
   /**
    * Les modèles proposés pour un runner CLI : alias fixes pour Claude Code,
    * `model/list` de l'app-server pour Codex, sur l'agent visé (celui par
@@ -5851,7 +6198,7 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
       session.agentId = resolvedAgentId;
     }
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: claude run...");
-    const injectedEnv = await resolveInjectedEnv(input.environmentId);
+    const injectedEnv = await resolveInjectedEnv(input.environmentId, convId);
     new ClaudeCodeRunner().run({
       agentId: resolvedAgentId ?? void 0,
       cwd: await conversationCwd(conv),
@@ -5940,7 +6287,7 @@ ${input.prompt}` : input.prompt;
     if (resolvedAgentId) {
       session.agentId = resolvedAgentId;
     }
-    const injectedEnv = await resolveInjectedEnv(input.environmentId);
+    const injectedEnv = await resolveInjectedEnv(input.environmentId, convId);
     new CodexRunner().run({
       agentId: resolvedAgentId ?? void 0,
       cwd: await conversationCwd(conv),
@@ -6048,8 +6395,6 @@ ${input.prompt}` : input.prompt;
           });
           gen = runAnthropic(client, model, system, msgs, apiKey, authToken, apiSignal, anchor);
         } else if (provider.provider in OPENAI_COMPAT_BASE_URLS) {
-          const baseURL = OPENAI_COMPAT_BASE_URLS[provider.provider];
-          const client = new OpenAI2({ apiKey: plaintextKey || "ollama", baseURL });
           const msgs = [
             { role: "system", content: system },
             ...input.messages.map((m, i) => {
@@ -6065,7 +6410,22 @@ ${input.prompt}` : input.prompt;
               return { role: m.role, content: m.content };
             })
           ];
-          gen = runOpenAI(client, model, msgs, apiKey, authToken, apiSignal, anchor);
+          let createStream;
+          if (provider.provider === "ollama") {
+            createStream = (messages, signal2) => streamOllamaChat({ model, messages, tools: CHAT_TOOLS_OPENAI, temperature: 0, signal: signal2 });
+          } else {
+            const baseURL = OPENAI_COMPAT_BASE_URLS[provider.provider];
+            const client = new OpenAI2({ apiKey: plaintextKey || "ollama", baseURL });
+            createStream = (messages, signal2) => client.chat.completions.create({
+              model,
+              messages,
+              tools: CHAT_TOOLS_OPENAI,
+              stream: true,
+              max_tokens: 16384,
+              temperature: 0
+            }, { signal: signal2 });
+          }
+          gen = runOpenAI(createStream, msgs, apiKey, authToken, apiSignal, anchor);
         } else {
           activeSessionRegistry.pushEvent(input.conversationId, { type: "error", message: `Provider "${provider.provider}" is not supported.` });
           activeSessionRegistry.pushEvent(input.conversationId, { type: "done", text: "" });
@@ -6154,6 +6514,7 @@ ${input.prompt}` : input.prompt;
       lap("findPtyBySession (no reattach)");
       const ptyConv = input.sessionId ? await conversationStore.get(input.sessionId).catch(() => null) : null;
       const isCodex = input.runner === "codex";
+      let ollamaEnv = {};
       const cli = isCodex ? "codex" : "claude";
       const args = [];
       if (isCodex) {
@@ -6172,7 +6533,10 @@ ${input.prompt}` : input.prompt;
             args.push("--session-id", input.sessionId);
           }
         }
-        if (input.model) args.push("--model", input.model);
+        const ollama = claudeOllamaTarget(input.model ?? ptyConv?.cliModel);
+        if (ollama) ollamaEnv = ollama.env;
+        const model = ollama?.model ?? input.model ?? ptyConv?.cliModel;
+        if (model) args.push("--model", model);
         args.push("--dangerously-skip-permissions");
       }
       const ptyRef = (ptyConv ? await conversationStore.projectRefOf(ptyConv) : null) ?? (input.projectId ? { id: input.projectId, orgId: input.orgId ?? null } : null);
@@ -6192,9 +6556,9 @@ ${input.prompt}` : input.prompt;
         }
         lap("buildCliSystemContext");
       }
-      const injectedEnv = await resolveInjectedEnv(input.environmentId);
+      const injectedEnv = { ...await resolveInjectedEnv(input.environmentId, ptyConv?.id), ...ollamaEnv };
       lap("resolveInjectedEnv");
-      const mcpReadyId = input.enableMcp && input.initialPrompt?.trim() ? randomUUID5() : void 0;
+      const mcpReadyId = input.enableMcp && input.initialPrompt?.trim() ? randomUUID6() : void 0;
       const res = await agentManager.agentMutation(
         agentId,
         "ai.spawnPty",
@@ -6529,6 +6893,7 @@ export {
   accountForOrgScope,
   soleAccountScope,
   cloudAuthRouter,
+  KanbanUnavailableError,
   kanbanStore,
   executeKanbanCommands,
   executeKanbanBoardCommands,
@@ -6543,4 +6908,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-QJSIN26R.js.map
+//# sourceMappingURL=chunk-VKYSHTYT.js.map