@runeya/runeya 2.0.69 → 2.0.71

package/{src-MQWOIUB5.js → src-Q3PSCMS7.js}

@@ -60,9 +60,11 @@ import {
   isVaultLocked,
   keyRoot,
   keyedFilePath,
+  killInstance,
   legacyMachineFilePath,
   legacyVaultRoot,
   listCloudVaults,
+  listInstances,
   listOrgVaults,
   loadFromEnv,
   localVaultRoot,
@@ -79,6 +81,7 @@ import {
   readOrgNames,
   refOfProjectAmong,
   refsOfProjectId,
+  registerInstance,
   registerProjectLoader,
   rememberFile,
   rememberOrgName,
@@ -93,11 +96,12 @@ import {
   stableEncryptValue,
   stampOrgCloud,
   traefikManager,
+  unregisterInstance,
   vaultFor,
   vaultIdOfRoot,
   wasRead,
   writeEntity
-} from "./chunk-YSJ6OJGN.js";
+} from "./chunk-Z3KAXI7V.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -2555,1440 +2559,1448 @@ var settingsManager = new SettingsManager();
 import { isAbsolute as isAbsolute3 } from "path";
 
 // ../server/src/services/workspace-cwd.ts
-import { isAbsolute as isAbsolute2, join as join9, dirname as dirname4 } from "path";
-async function projectRoot(ref) {
-  const project = await projectStore.get(ref);
-  if (!project?.orgId) return null;
-  return projectPathStore.get(project);
+import { isAbsolute as isAbsolute2, join as join10, dirname as dirname5 } from "path";
+
+// ../server/src/services/conversation-store.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFile as readFile8, writeFile as writeFile8, rename as rename8, mkdir as mkdir8, chmod as chmod7 } from "fs/promises";
+import { dirname as dirname4, join as join9 } from "path";
+import { EventEmitter as EventEmitter2 } from "events";
+var FILENAME4 = "conversations.private.json";
+async function localProjectId() {
+  const projects = await projectStore.list().catch(() => []);
+  return projects.find((p) => !p.orgId)?.id ?? null;
 }
-async function resolveWorkspaceCwd(target) {
-  const launchDir = localVaultRootParent();
-  if (target.serviceId) {
-    const service = await serviceStore.get(target.serviceId);
-    if (service) {
-      const raw = (target.override ?? service.cwd ?? "").trim();
-      const projects = await projectStore.list();
-      const owner = projects.find((p) => p.serviceIds.includes(service.id));
-      const root = owner ? await projectRoot(owner) : null;
-      return root ? anchor(root, raw) : raw || ".";
-    }
+var ConversationStore = class {
+  conversations = /* @__PURE__ */ new Map();
+  /** Which vault each conversation was read from, until its project is known. */
+  roots = /* @__PURE__ */ new Map();
+  /**
+   * Les conversations qu'on n'a pas su déchiffrer, par coffre, sous leur forme
+   * de disque.
+   *
+   * Une entrée illisible était simplement ignorée. Tant qu'aucune de ses
+   * voisines ne se chargeait, le fichier n'était jamais réécrit et la donnée
+   * survivait par accident ; dès qu'une seule s'ouvrait, la sauvegarde suivante
+   * réécrivait le fichier avec elle seule — et effaçait les autres. Elles sont
+   * donc gardées ici, telles quelles, et réémises à l'identique.
+   */
+  unreadable = /* @__PURE__ */ new Map();
+  loaded = false;
+  events = new EventEmitter2().setMaxListeners(0);
+  saveQueue = Promise.resolve();
+  snapshotConversation(conv) {
+    return structuredClone(conv);
   }
-  if (target.projectId) {
-    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
-    const raw = (target.override ?? "").trim();
-    return root ? anchor(root, raw) : raw || launchDir;
+  /**
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
+   */
+  getFilePath() {
+    return keyedFilePath(FILENAME4);
   }
-  return anchor(launchDir, (target.override ?? "").trim());
-}
-function anchor(base, raw) {
-  if (!raw || raw === ".") return base;
-  if (raw.startsWith("~") || raw.startsWith("$") || isAbsolute2(raw)) return raw;
-  return join9(base, raw);
-}
-function localVaultRootParent() {
-  return dirname4(localVaultRoot());
-}
-async function resolveAgentCwd(target) {
-  if (target.serviceId) {
-    const service = await serviceStore.get(target.serviceId);
-    if (service) {
-      const projects = await projectStore.list();
-      const owner = projects.find((p) => p.serviceIds.includes(service.id));
-      const root = owner ? await projectRoot(owner) : null;
-      if (!root) return void 0;
-      return anchor(root, (target.override ?? service.cwd ?? "").trim());
-    }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME4);
   }
-  if (target.projectId) {
-    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
-    if (!root) return void 0;
-    return anchor(root, (target.override ?? "").trim());
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile8(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile8(this.getLegacyFilePath(), "utf-8");
+    }
   }
-  return void 0;
-}
-
-// ../server/src/trpc/routers/service.ts
-async function resolveEffectiveAgentId(service) {
-  const known = /* @__PURE__ */ new Set([
-    ...agentManager.listAgents().map((a) => a.config.id),
-    ...(await agentStore.list()).map((a) => a.id)
-  ]);
-  if (service.agentId && known.has(service.agentId)) return service.agentId;
-  const projects = await projectStore.list();
-  const project = projects.find((p) => p.serviceIds.includes(service.id));
-  if (project?.activeEnvironmentId) {
-    const activeEnv = await environmentStore.get(project.activeEnvironmentId);
-    if (activeEnv?.agentId && known.has(activeEnv.agentId)) return activeEnv.agentId;
+  async ensureDir() {
+    await mkdir8(dirname4(await this.getFilePath()), { recursive: true });
   }
-  return agentManager.getDefaultAgentId();
-}
-async function resolveServiceVariables(service) {
-  const projects = await projectStore.list();
-  const project = projects.find((p) => p.serviceIds.includes(service.id));
-  let resolvedService = service;
-  const anchored = await resolveWorkspaceCwd({ serviceId: service.id });
-  if (anchored !== (service.cwd ?? "").trim() && isAbsolute3(anchored)) {
-    resolvedService = { ...resolvedService, resolvedCwd: anchored };
+  encryptMessages(messages, vault) {
+    return encryptValue(JSON.stringify(messages), vault);
   }
-  try {
-    if (service.parserIds && service.parserIds.length > 0) {
-      const settings = await settingsManager.getSettings();
-      const allParsers = [...nativeParsers, ...settings.logParsers || []];
-      const resolvedParsers = service.parserIds.map((id) => allParsers.find((p) => p.id === id)).filter((p) => p !== void 0);
-      resolvedService = { ...resolvedService, resolvedLogParsers: resolvedParsers };
-    }
-  } catch (err) {
-    console.error("[service-router] Failed to resolve parsers for service", service.id + ":", err.message);
+  decryptMessages(encrypted, vault) {
+    const json = decryptValue(encrypted, vault);
+    return JSON.parse(json);
   }
-  if (!project || !project.activeEnvironmentId) {
-    return resolvedService;
+  /**
+   * Refuser d'écrire dans le coffre d'une organisation sans nommer sa clé.
+   *
+   * `getEncryptionKey(undefined)` rend la clé machine, et c'est le bon défaut
+   * pour le coffre local. Appliqué à un fichier rangé sous `orgs/<org>/`, il
+   * produit un chiffré que ce coffre n'emploie pas — lisible par personne à la
+   * relecture, et impossible à distinguer d'une corruption.
+   *
+   * Le cas a été observé plusieurs fois sans qu'on parvienne à nommer le
+   * chemin fautif : les garde-fous en place traitent le coffre fermé, le
+   * coffre mal résolu et la copie périmée, aucun ne couvrait « coffre non
+   * précisé ». Ces écritures-là n'ont jamais fonctionné — elles échouaient en
+   * silence, ce qui est pire. On les saute désormais en le disant, avec la
+   * pile d'appels qui manquait pour remonter au chemin fautif.
+   */
+  isVaultNamed(root, vault) {
+    const orgId = orgIdOfRoot(root);
+    if (!orgId || vault) return true;
+    console.error(
+      `[conversation-store] \xC9criture ignor\xE9e dans le coffre de l'organisation ${orgId} (${root}) : aucune cl\xE9 d'organisation nomm\xE9e, le contenu serait chiffr\xE9 par la cl\xE9 machine et illisible \xE0 la relecture.
+${new Error("trace").stack}`
+    );
+    return false;
   }
-  try {
-    const resolved = await environmentResolver.resolveForService({
-      serviceId: service.id,
-      activeEnvironmentId: project.activeEnvironmentId
-    });
-    const serviceBuiltins = {
-      HOST: env.HOST,
-      HOST_LAN: "0.0.0.0"
+  toDisk(conv, vault) {
+    return {
+      id: conv.id,
+      projectId: conv.projectId,
+      title: conv.title,
+      encryptedMessages: this.encryptMessages(conv.messages, vault),
+      isCli: conv.isCli,
+      runner: conv.runner,
+      providerId: conv.providerId,
+      codexThreadId: conv.codexThreadId,
+      contextUsage: conv.contextUsage,
+      workflowId: conv.workflowId,
+      workflowType: conv.workflowType,
+      kanbanBoardId: conv.kanbanBoardId,
+      kanbanCardId: conv.kanbanCardId,
+      archived: conv.archived,
+      createdAt: conv.createdAt,
+      updatedAt: conv.updatedAt
     };
-    const interpolatedEnv = {};
-    for (const [key, value] of Object.entries(resolved.env)) {
-      interpolatedEnv[key] = value.replace(
-        /\{\{service\.([^}]+)\}\}/g,
-        (match, k) => serviceBuiltins[k] !== void 0 ? serviceBuiltins[k] : match
-      );
-    }
-    resolvedService = {
-      ...resolvedService,
-      env: interpolatedEnv,
-      envSecrets: [...resolved.envSecrets]
+  }
+  fromDisk(disk, vault) {
+    const workflowType = (disk.workflowType === "scenario" ? "scenario" : void 0) ?? (disk.scenarioId ? "scenario" : void 0);
+    return {
+      id: disk.id,
+      projectId: disk.projectId,
+      title: disk.title,
+      messages: this.decryptMessages(disk.encryptedMessages, vault),
+      isCli: disk.isCli ?? disk.isClaudeCode ?? false,
+      runner: disk.runner,
+      providerId: disk.providerId,
+      codexThreadId: disk.codexThreadId,
+      contextUsage: disk.contextUsage,
+      workflowId: disk.workflowId ?? disk.scenarioId,
+      workflowType,
+      kanbanBoardId: disk.kanbanBoardId,
+      kanbanCardId: disk.kanbanCardId,
+      archived: disk.archived,
+      createdAt: disk.createdAt,
+      updatedAt: disk.updatedAt
     };
-  } catch (err) {
-    console.error("[service-router] Failed to resolve variables for service", service.id + ":", err.message);
   }
-  return resolvedService;
-}
-var DockerConfigInput = DockerConfigSchema;
-var serviceRouter = router({
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List all services", protect: true } }).output(z4.any()).query(async ({ ctx }) => {
-    const all = await serviceStore.list();
-    const allowedIds = getAllowedServiceIds(ctx);
-    const filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
-    return Promise.all(filtered.map(async (s) => ({
-      ...s,
-      effectiveAgentId: await resolveEffectiveAgentId(s)
-    })));
-  }),
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.any()).query(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.id, "service:read");
-    const service = await serviceStore.get(input.id);
-    if (!service) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+  /**
+   * Read every project vault, then the homes older versions used.
+   *
+   * A conversation found in a legacy file is attributed to the local project of
+   * that directory — which is what it was about, back when one directory meant
+   * one project. With no local project to point at, it is left unattributed
+   * rather than filed under a project picked at random.
+   */
+  async load() {
+    if (this.loaded) return;
+    if (!getEncryptionKey()) {
+      return;
     }
-    return service;
-  }),
-  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z4.any()).input(
-    z4.object({
-      agentId: z4.string().max(128).optional(),
-      name: z4.string().min(1).max(200),
-      commands: z4.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z4.string().max(4096).optional(),
-      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z4.array(z4.string().max(200)).max(20).optional(),
-      description: z4.string().max(2e3).optional(),
-      docsPath: z4.string().max(4096).optional(),
-      url: z4.string().max(2048).optional(),
-      localUrls: z4.array(z4.object({
-        url: z4.string().max(253),
-        port: z4.number().int().min(1).max(65535)
-      })).max(20).optional(),
-      openapiUrl: z4.string().max(2048).optional(),
-      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).optional(),
-      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z4.enum(["native", "docker"]).optional().default("native"),
-      dockerConfig: DockerConfigInput.optional(),
-      healthCheck: HealthCheckSchema.optional(),
-      autoRestart: z4.boolean().optional().default(false),
-      restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z4.number().int().nonnegative().optional(),
-      restartBackoffMs: z4.number().int().positive().optional().default(1e3),
-      orgId: z4.string().max(128).nullable().optional(),
-      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z4.array(z4.string().max(128)).max(50).optional()
-    })
-  ).mutation(async ({ input }) => {
-    if (input.agentId) {
-      const status = agentManager.getStatus(input.agentId);
-      if (!status) {
-        throw new TRPCError4({
-          code: "NOT_FOUND",
-          message: `Agent ${input.agentId} not found`
-        });
+    this.loaded = true;
+    this.unreadable.clear();
+    await ensureProjectsLoaded();
+    const vaults = await allVaultRoots();
+    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME4)];
+    const sources = [
+      ...legacyPaths.map((path) => ({ path, legacy: true })),
+      ...vaults.map((root) => ({ path: join9(root, FILENAME4), legacy: false }))
+    ];
+    for (const { path, legacy } of sources) {
+      let data;
+      try {
+        data = JSON.parse(await readFile8(path, "utf-8"));
+      } catch {
+        continue;
       }
-    }
-    if (input.runner === "docker") {
-      throw new TRPCError4({ code: "BAD_REQUEST", message: 'Docker runner is not yet supported. Use "native" runner.' });
-    }
-    const service = await serviceStore.create({
-      ...input,
-      agentId: input.agentId
-    });
-    await auditService.log({ userId: "local", action: "create", entityType: "service", entityId: service.id, metadata: { name: input.name } });
-    return service;
-  }),
-  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z4.any()).input(
-    z4.object({
-      id: z4.string().max(128),
-      agentId: z4.string().max(128).nullable().optional(),
-      // null = clear (inherit from env)
-      name: z4.string().min(1).max(200).optional(),
-      commands: z4.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z4.string().max(4096).nullable().optional(),
-      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z4.array(z4.string().max(200)).max(20).optional(),
-      description: z4.string().max(2e3).optional(),
-      docsPath: z4.string().max(4096).optional(),
-      url: z4.string().max(2048).optional(),
-      localUrls: z4.array(z4.object({
-        url: z4.string().max(253),
-        port: z4.number().int().min(1).max(65535)
-      })).max(20).optional(),
-      openapiUrl: z4.string().max(2048).optional(),
-      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).nullable().optional(),
-      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z4.enum(["native", "docker"]).optional(),
-      dockerConfig: DockerConfigInput.optional(),
-      healthCheck: HealthCheckSchema.nullable().optional(),
-      autoRestart: z4.boolean().optional(),
-      clearLogsOnStart: z4.boolean().optional(),
-      restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z4.number().int().nonnegative().optional(),
-      restartBackoffMs: z4.number().int().positive().optional(),
-      orgId: z4.string().max(128).nullable().optional(),
-      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z4.array(z4.string().max(128)).max(50).optional(),
-      logSources: z4.array(LogSourceConfigSchema).max(20).optional()
-    })
-  ).mutation(async ({ input }) => {
-    const existing = await serviceStore.get(input.id);
-    if (!existing) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
-    }
-    let stoppedForAgentChange = false;
-    if (input.agentId !== void 0 && input.agentId !== existing.agentId && existing.agentId) {
-      const oldAgentStatus = agentManager.getStatus(existing.agentId);
-      if (oldAgentStatus?.connected) {
+      const inherited = legacy ? await localProjectId() : null;
+      const root = dirname4(path);
+      await rememberFile(path);
+      for (const item of data) {
         try {
-          const processes = await agentManager.agentQuery(existing.agentId, "process.list");
-          const proc = processes.find((p) => p.serviceId === input.id);
-          if (proc && (proc.state === "running" || proc.state === "starting")) {
-            await agentManager.agentMutation(existing.agentId, "process.stop", { id: input.id }, AGENT_STOP_FETCH_TIMEOUT);
-            stoppedForAgentChange = true;
-          }
+          const conv = this.fromDisk(item, vaultIdOfRoot(root));
+          if (!conv.projectId && inherited) conv.projectId = inherited;
+          this.conversations.set(item.id, conv);
+          this.roots.set(item.id, root);
         } catch {
-        }
-      }
-      if (input.agentId) {
-        const newAgentStatus = agentManager.getStatus(input.agentId);
-        if (!newAgentStatus) {
-          throw new TRPCError4({
-            code: "NOT_FOUND",
-            message: `Agent ${input.agentId} not found`
-          });
-        }
-      }
-    }
-    const service = await serviceStore.update(input);
-    if (!service) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
-    }
-    if (input.name && input.name !== existing.name) {
-      await environmentStore.renameByReference(input.id, input.name);
-    }
-    if (service.agentId) {
-      const agentStatus = agentManager.getStatus(service.agentId);
-      if (agentStatus?.connected) {
-        try {
-          const resolvedService = await resolveServiceVariables(service);
-          await agentManager.agentMutation(service.agentId, "process.updateConfig", {
-            serviceId: service.id,
-            config: resolvedService
-          });
-        } catch (err) {
-          console.debug("[service-router] Failed to propagate config to agent", service.agentId + ":", err.message);
+          const bucket = this.unreadable.get(root) ?? [];
+          bucket.push(item);
+          this.unreadable.set(root, bucket);
         }
       }
     }
-    await auditService.log({ userId: "local", action: "update", entityType: "service", entityId: input.id });
-    return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service), stoppedForAgentChange };
-  }),
-  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.object({ success: z4.literal(true) })).mutation(async ({ input }) => {
-    const deleted = await serviceStore.delete(input.id);
-    if (!deleted) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+  }
+  /**
+   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
+   *
+   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
+   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
+   * qui n'existe plus. La laisser en place n'affichait pas seulement des
+   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
+   * par-dessus le nouveau, et défaisait l'adoption.
+   */
+  resetCache() {
+    this.conversations.clear();
+    this.roots.clear();
+    this.unreadable.clear();
+    this.loaded = false;
+    this.events.emit("changed", { type: "reloaded" });
+  }
+  /**
+   * Combien de conversations ce coffre garde sans savoir les lire, par
+   * organisation. La machine elle-même est rangée sous `null`.
+   */
+  async unreadableByVault() {
+    await this.load();
+    const out = /* @__PURE__ */ new Map();
+    for (const [root, items] of this.unreadable) {
+      const vault = vaultIdOfRoot(root) ?? null;
+      out.set(vault, (out.get(vault) ?? 0) + items.length);
     }
-    await auditService.log({ userId: "local", action: "delete", entityType: "service", entityId: input.id });
-    return { success: true };
-  }),
-  checkCwd: protectedProcedure.input(z4.object({ id: z4.string().max(128), checkReachability: z4.boolean().optional() })).query(async ({ input }) => {
-    const service = await serviceStore.get(input.id);
-    if (!service) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+    return out;
+  }
+  /**
+   * Write each vault that holds — or held — a conversation.
+   *
+   * A vault emptied by this save is still written, as an empty list: a
+   * conversation that found its project must not survive in the file it was
+   * read from.
+   */
+  async saveInternal() {
+    if (!getEncryptionKey()) return;
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, []);
+    for (const conv of this.conversations.values()) {
+      const root = await this.rootFor(conv);
+      this.roots.set(conv.id, root);
+      const bucket = byRoot.get(root) ?? [];
+      const vault = vaultIdOfRoot(root);
+      if (!this.isVaultNamed(root, vault)) continue;
+      bucket.push(this.toDisk(conv, vault));
+      byRoot.set(root, bucket);
     }
-    const effectiveAgentId = await resolveEffectiveAgentId(service);
-    if (!effectiveAgentId) {
-      throw new TRPCError4({ code: "BAD_REQUEST", message: "No agent configured for this service" });
+    for (const [root, items] of this.unreadable) {
+      byRoot.set(root, [...items, ...byRoot.get(root) ?? []]);
     }
-    const agentResult = await agentManager.agentQuery(effectiveAgentId, "git.checkCwd", {
-      // Anchored on the project, so the check answers about the directory the
-      // service will actually run in.
-      cwd: await resolveWorkspaceCwd({ serviceId: service.id }),
-      remote: service.git?.remote,
-      checkReachability: input.checkReachability
-    });
-    const { exists: exists4, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
-    if (unresolvedVars.length > 0) {
-      return { exists: false, canClone: false, unresolvedVars, resolvedCwd, gitMismatch: null };
+    const stale = /* @__PURE__ */ new Set();
+    for (const root of byRoot.keys()) {
+      const path = join9(root, FILENAME4);
+      if (wasRead(path) && await hasChangedSinceRead(path)) stale.add(root);
     }
-    const canClone = !!service.git?.remote && (!exists4 || actualRemote === null);
-    let gitMismatch = null;
-    if (exists4 && service.git?.remote && !canClone) {
-      if (actualRemote === null) {
-        gitMismatch = { actual: null, configured: service.git.remote };
-      } else if (actualRemote !== service.git.remote) {
-        gitMismatch = { actual: actualRemote, configured: service.git.remote };
-      } else if (unreachable) {
-        gitMismatch = { actual: actualRemote, configured: service.git.remote, unreachable: true };
+    for (const [root, data] of byRoot) {
+      const filePath = join9(root, FILENAME4);
+      if (stale.has(root)) {
+        console.warn(
+          `[conversation-store] ${filePath} a chang\xE9 depuis sa lecture \u2014 \xE9criture ignor\xE9e pour ne pas \xE9craser une r\xE9paration faite en dehors du serveur.`
+        );
+        continue;
       }
+      await mkdir8(root, { recursive: true });
+      const tmpPath = `${filePath}.tmp`;
+      await writeFile8(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+      await rename8(tmpPath, filePath);
+      await chmod7(filePath, 384);
+      await rememberFile(filePath);
     }
-    return { exists: exists4, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
-  }),
-  cloneRepository: protectedProcedure.input(z4.object({ id: z4.string().max(128) })).mutation(async ({ input }) => {
-    const service = await serviceStore.get(input.id);
-    if (!service) {
-      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
-    }
-    if (!service.git?.remote) {
-      throw new TRPCError4({ code: "BAD_REQUEST", message: "Service has no git remote configured" });
-    }
-    const effectiveAgentId = await resolveEffectiveAgentId(service);
-    if (!effectiveAgentId) {
-      throw new TRPCError4({ code: "BAD_REQUEST", message: "No agent configured for this service" });
-    }
-    await agentManager.agentMutation(effectiveAgentId, "git.clone", {
-      remote: service.git.remote,
-      // Clones WRITE: landing this in the launch directory instead of the
-      // project's is how a repository ends up in the wrong place.
-      cwd: await resolveWorkspaceCwd({ serviceId: service.id })
-    }, 5 * 60 * 1e3);
-    return { success: true };
-  })
-});
-
-// ../server/src/trpc/routers/agent.ts
-import { z as z5 } from "zod";
-import { TRPCError as TRPCError5 } from "@trpc/server";
-var SUBSCRIPTION_QUEUE_MAX = LOG_BUFFER_SIZE;
-var agentRouter = router({
-  /** List all registered agents with their connection status */
-  list: protectedProcedure.query(() => {
-    return agentManager.listAgents();
-  }),
-  /** Get a single agent's config and status */
-  get: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(({ input }) => {
-    const agent = agentManager.getAgent(input.id);
-    if (!agent) {
-      throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
-    }
-    return {
-      config: { ...agent.config, passphrase: "***" },
-      status: agent.status
-    };
-  }),
-  /** Test connectivity to an agent given url + passphrase */
-  testConnection: protectedProcedure.input(
-    z5.object({
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      agentId: z5.string().max(128).optional()
-    })
-  ).mutation(async ({ input }) => {
-    let passphrase = input.passphrase;
-    let targetUrl = input.url;
-    if (!passphrase && input.agentId) {
-      const agent = agentManager.getAgentConfig(input.agentId);
-      if (!agent) {
-        throw new TRPCError5({ code: "NOT_FOUND", message: "Agent not found" });
-      }
-      passphrase = agent.passphrase;
-      targetUrl = agent.url;
-    }
-    if (!passphrase) {
-      throw new TRPCError5({ code: "BAD_REQUEST", message: "Passphrase is required" });
-    }
-    const url = new URL("/api/trpc/health.check", targetUrl);
+  }
+  /**
+   * The vault a conversation is written to: its project's.
+   *
+   * One that names no project stays where it was read, falling back to the
+   * key's own directory — never lost for want of an owner.
+   */
+  async rootFor(conv) {
+    const known = this.roots.get(conv.id) ?? null;
+    if (conv.projectId) return rootOfProjectAmong(conv.projectId, known);
+    return known ?? dirname4(await keyedFilePath(FILENAME4));
+  }
+  /**
+   * Le projet d'une conversation, organisation comprise.
+   *
+   * Ce que la conversation ne dit pas d'elle-même : elle ne nomme que l'id.
+   * Le coffre d'où elle vient fournit l'organisation, et c'est ce couple qu'il
+   * faut pour retrouver le répertoire de travail du projet.
+   */
+  async projectRefOf(conv) {
+    if (!conv.projectId) return null;
+    const known = this.roots.get(conv.id) ?? null;
+    const ref = refOfProjectAmong(conv.projectId, known);
+    return { id: ref.id, orgId: ref.orgId ?? null };
+  }
+  /**
+   * Réécrire chaque coffre, en déplaçant ce qui appartient désormais ailleurs.
+   *
+   * Appelé quand un projet a changé de coffre : ses conversations sont écrites
+   * dans le nouveau, et le fichier d'où elles viennent est réécrit sans elles.
+   */
+  async relocateAll() {
+    await this.load();
+    await this.save();
+  }
+  async save() {
+    const write = this.saveQueue.then(() => this.saveInternal());
+    this.saveQueue = write.catch(() => {
+    });
+    return write;
+  }
+  async list() {
+    await this.load();
+    return Array.from(this.conversations.values()).sort((a, b) => b.updatedAt - a.updatedAt);
+  }
+  /**
+   * Les conversations d'un projet.
+   *
+   * Celle qui ne nomme aucun projet — écrite avant le champ, ou qu'une
+   * migration n'a pas su attribuer — n'est rendue que dans les projets de son
+   * propre coffre : elle reste atteignable là où elle a été écrite, sans se
+   * déverser dans toutes les organisations de la machine.
+   */
+  async listForProject(ref) {
+    const belongs = await this.matcherForProject(ref);
+    return (await this.list()).filter(belongs);
+  }
+  /**
+   * Le test d'appartenance à un projet, préparé une fois.
+   *
+   * Le flux temps réel en a besoin autant que la liste : une conversation qui
+   * arrive par événement doit passer le même filtre, sans quoi elle se
+   * réinvite dans un projet qui ne l'a jamais demandée.
+   */
+  async matcherForProject(ref) {
+    await this.load();
+    let projectRoot2 = null;
     try {
-      const res = await fetch(url.toString(), {
-        headers: { "Authorization": `Bearer ${passphrase}`, "Content-Type": "application/json" },
-        signal: AbortSignal.timeout(5e3)
-      });
-      if (!res.ok) {
-        return { success: false, error: `HTTP ${res.status} ${res.statusText}` };
-      }
-      const json = await res.json();
-      if (json.error) {
-        return { success: false, error: json.error.message ?? "Agent returned an error" };
-      }
-      return { success: true, uptime: json.result?.data?.uptime };
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : "Unknown error";
-      return { success: false, error: msg };
+      projectRoot2 = ref.orgId === void 0 ? rootOfProjectAmong(ref.id, null) : rootOfProjectRef({ id: ref.id, orgId: ref.orgId ?? null });
+    } catch {
+      projectRoot2 = null;
     }
-  }),
-  /** Register a new agent */
-  register: protectedProcedure.input(
-    z5.object({
-      name: z5.string().min(1).max(100),
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024),
-      // À quelle organisation rattacher l'agent. Absent = la machine, ce que
-      // font l'agent local et tout client antérieur à ce champ.
-      orgId: z5.string().min(1).max(128).nullable().optional()
-    })
-  ).mutation(async ({ input }) => {
-    const config = await agentManager.register(
-      input.name,
-      input.url,
-      input.passphrase,
-      input.orgId ?? null
-    );
-    return { ...config, passphrase: "***" };
-  }),
-  /** Update an existing agent */
-  update: protectedProcedure.input(
-    z5.object({
-      id: z5.string().max(128),
-      name: z5.string().min(1).max(100).optional(),
-      url: z5.string().url().max(2048).optional(),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      passthroughEnv: z5.array(
-        z5.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
-      ).max(100).optional()
-    })
-  ).mutation(async ({ input }) => {
-    try {
-      const { id, ...fields } = input;
-      const config = await agentManager.update(id, fields);
-      return { ...config, passphrase: "***" };
-    } catch (err) {
-      if (err instanceof Error) {
-        if (err.message.includes("not found")) {
-          throw new TRPCError5({ code: "NOT_FOUND", message: err.message });
-        }
-        if (err.message.includes("Cannot modify")) {
-          throw new TRPCError5({ code: "FORBIDDEN", message: err.message });
-        }
-      }
-      throw err;
+    return (conv) => {
+      if (conv.projectId) return conv.projectId === ref.id;
+      if (!projectRoot2) return true;
+      return this.roots.get(conv.id) === projectRoot2;
+    };
+  }
+  async get(id) {
+    await this.load();
+    return this.conversations.get(id) ?? null;
+  }
+  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId, projectId, orgId) {
+    await this.load();
+    const now = Date.now();
+    const conv = {
+      id: randomUUID3(),
+      projectId,
+      title: title ?? "New conversation",
+      messages: [],
+      isCli,
+      runner,
+      providerId,
+      workflowId,
+      workflowType,
+      kanbanBoardId,
+      kanbanCardId,
+      createdAt: now,
+      updatedAt: now
+    };
+    this.conversations.set(conv.id, conv);
+    if (projectId && orgId !== void 0) {
+      this.roots.set(conv.id, vaultFor({ id: projectId, orgId }).root);
     }
-  }),
-  /** Get resolved passthrough env values from an agent */
-  getPassthroughEnv: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(async ({ input }) => {
-    try {
-      return await agentManager.agentQuery(input.id, "config.getPassthroughEnv");
-    } catch {
-      return {};
+    await this.save();
+    this.events.emit("changed", { type: "created", conversation: this.snapshotConversation(conv) });
+    return conv;
+  }
+  async update(id, patch, options) {
+    await this.load();
+    const conv = this.conversations.get(id);
+    if (!conv) return null;
+    if (patch.title !== void 0) conv.title = patch.title;
+    if (patch.messages !== void 0) conv.messages = patch.messages;
+    if (patch.contextUsage !== void 0) conv.contextUsage = patch.contextUsage;
+    if (patch.workflowId !== void 0) conv.workflowId = patch.workflowId;
+    if (patch.archived !== void 0) conv.archived = patch.archived;
+    if (patch.codexThreadId !== void 0) conv.codexThreadId = patch.codexThreadId;
+    if (options?.touch !== false) conv.updatedAt = Date.now();
+    await this.save();
+    if (!options?.silent) {
+      this.events.emit("changed", { type: "updated", conversation: this.snapshotConversation(conv) });
     }
-  }),
-  /** Remove a registered agent */
-  remove: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).mutation(async ({ input }) => {
-    try {
-      const removed = await agentManager.remove(input.id);
-      if (!removed) {
-        throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
-      }
-      return { success: true };
-    } catch (err) {
-      if (err instanceof Error && err.message === "Cannot remove the local agent") {
-        throw new TRPCError5({ code: "FORBIDDEN", message: err.message });
-      }
-      throw err;
+    return conv;
+  }
+  /**
+   * Synchronously update the last assistant message content in memory, then schedule a save.
+   * Used by activeSessionRegistry.persistNow() to avoid the async get() → .then() race.
+   */
+  updateLastAssistantContent(id, content, parts) {
+    const conv = this.conversations.get(id);
+    if (!conv) return;
+    const lastMsg = conv.messages[conv.messages.length - 1];
+    if (!lastMsg || lastMsg.role !== "assistant") return;
+    lastMsg.content = content;
+    if (parts !== void 0) lastMsg.parts = parts;
+    conv.updatedAt = Date.now();
+    this.save().catch(() => {
+    });
+  }
+  async listByKanbanBoardId(boardId) {
+    await this.load();
+    return Array.from(this.conversations.values()).filter((c) => c.kanbanBoardId === boardId);
+  }
+  async listByKanbanCardId(cardId) {
+    await this.load();
+    return Array.from(this.conversations.values()).filter((c) => c.kanbanCardId === cardId);
+  }
+  async delete(id) {
+    await this.load();
+    const existed = this.conversations.delete(id);
+    await this.save();
+    if (existed) {
+      this.events.emit("changed", { type: "deleted", id });
     }
-  }),
-  /** Subscribe to real-time agent status changes */
-  onStatus: protectedProcedure.subscription(async function* () {
-    for (const agent of agentManager.listAgents()) {
-      yield { agentId: agent.config.id, status: agent.status };
+  }
+  onChanged(handler) {
+    this.events.on("changed", handler);
+  }
+  offChanged(handler) {
+    this.events.off("changed", handler);
+  }
+};
+var conversationStore = new ConversationStore();
+
+// ../server/src/services/workspace-cwd.ts
+async function projectRoot(ref) {
+  const project = await projectStore.get(ref);
+  if (!project?.orgId) return null;
+  return projectPathStore.get(project);
+}
+async function resolveWorkspaceCwd(target) {
+  const launchDir = localVaultRootParent();
+  if (target.serviceId) {
+    const service = await serviceStore.get(target.serviceId);
+    if (service) {
+      const raw = (target.override ?? service.cwd ?? "").trim();
+      const projects = await projectStore.list();
+      const owner = projects.find((p) => p.serviceIds.includes(service.id));
+      const root = owner ? await projectRoot(owner) : null;
+      return root ? anchor(root, raw) : raw || ".";
     }
-    const queue = [];
-    let resolve7 = null;
-    const handler = (event) => {
-      if (queue.length >= SUBSCRIPTION_QUEUE_MAX) queue.shift();
-      queue.push(event);
-      if (resolve7) {
-        resolve7();
-        resolve7 = null;
-      }
-    };
-    agentManager.on("status", handler);
-    try {
-      while (true) {
-        if (queue.length > 0) {
-          yield queue.shift();
-        } else {
-          await new Promise((r) => {
-            resolve7 = r;
-          });
-        }
-      }
-    } finally {
-      agentManager.off("status", handler);
+  }
+  if (target.projectId) {
+    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
+    const raw = (target.override ?? "").trim();
+    return root ? anchor(root, raw) : raw || launchDir;
+  }
+  return anchor(launchDir, (target.override ?? "").trim());
+}
+function anchor(base, raw) {
+  if (!raw || raw === ".") return base;
+  if (raw.startsWith("~") || raw.startsWith("$") || isAbsolute2(raw)) return raw;
+  return join10(base, raw);
+}
+function localVaultRootParent() {
+  return dirname5(localVaultRoot());
+}
+async function resolveAgentCwd(target) {
+  if (target.serviceId) {
+    const service = await serviceStore.get(target.serviceId);
+    if (service) {
+      const projects = await projectStore.list();
+      const owner = projects.find((p) => p.serviceIds.includes(service.id));
+      const root = owner ? await projectRoot(owner) : null;
+      if (!root) return void 0;
+      return anchor(root, (target.override ?? service.cwd ?? "").trim());
     }
-  })
-});
+  }
+  if (target.projectId) {
+    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
+    if (!root) return void 0;
+    return anchor(root, (target.override ?? "").trim());
+  }
+  return void 0;
+}
+async function resolveConversationCwd(conversationId) {
+  const conv = await conversationStore.get(conversationId);
+  const ref = conv ? await conversationStore.projectRefOf(conv) : null;
+  if (!ref) return resolveAgentCwd({});
+  return resolveAgentCwd({ projectId: ref.id, orgId: ref.orgId });
+}
 
-// ../server/src/trpc/routers/process.ts
-import { z as z6 } from "zod";
-import { TRPCError as TRPCError6 } from "@trpc/server";
-var SUBSCRIPTION_QUEUE_MAX2 = LOG_BUFFER_SIZE;
-async function* forwardEvents(eventName, filter) {
-  const queue = [];
-  let resolve7 = null;
-  const handler = (data) => {
-    if (filter && !filter(data)) return;
-    if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
-    queue.push(data);
-    if (resolve7) {
-      resolve7();
-      resolve7 = null;
+// ../server/src/trpc/routers/service.ts
+async function resolveEffectiveAgentId(service) {
+  const known = /* @__PURE__ */ new Set([
+    ...agentManager.listAgents().map((a) => a.config.id),
+    ...(await agentStore.list()).map((a) => a.id)
+  ]);
+  if (service.agentId && known.has(service.agentId)) return service.agentId;
+  const projects = await projectStore.list();
+  const project = projects.find((p) => p.serviceIds.includes(service.id));
+  if (project?.activeEnvironmentId) {
+    const activeEnv = await environmentStore.get(project.activeEnvironmentId);
+    if (activeEnv?.agentId && known.has(activeEnv.agentId)) return activeEnv.agentId;
+  }
+  return agentManager.getDefaultAgentId();
+}
+async function resolveServiceVariables(service) {
+  const projects = await projectStore.list();
+  const project = projects.find((p) => p.serviceIds.includes(service.id));
+  let resolvedService = service;
+  const anchored = await resolveWorkspaceCwd({ serviceId: service.id });
+  if (anchored !== (service.cwd ?? "").trim() && isAbsolute3(anchored)) {
+    resolvedService = { ...resolvedService, resolvedCwd: anchored };
+  }
+  try {
+    if (service.parserIds && service.parserIds.length > 0) {
+      const settings = await settingsManager.getSettings();
+      const allParsers = [...nativeParsers, ...settings.logParsers || []];
+      const resolvedParsers = service.parserIds.map((id) => allParsers.find((p) => p.id === id)).filter((p) => p !== void 0);
+      resolvedService = { ...resolvedService, resolvedLogParsers: resolvedParsers };
     }
-  };
-  agentManager.on(eventName, handler);
+  } catch (err) {
+    console.error("[service-router] Failed to resolve parsers for service", service.id + ":", err.message);
+  }
+  if (!project || !project.activeEnvironmentId) {
+    return resolvedService;
+  }
   try {
-    while (true) {
-      if (queue.length > 0) {
-        yield queue.shift();
-      } else {
-        await new Promise((r) => {
-          resolve7 = r;
-        });
-      }
+    const resolved = await environmentResolver.resolveForService({
+      serviceId: service.id,
+      activeEnvironmentId: project.activeEnvironmentId
+    });
+    const serviceBuiltins = {
+      HOST: env.HOST,
+      HOST_LAN: "0.0.0.0"
+    };
+    const interpolatedEnv = {};
+    for (const [key, value] of Object.entries(resolved.env)) {
+      interpolatedEnv[key] = value.replace(
+        /\{\{service\.([^}]+)\}\}/g,
+        (match, k) => serviceBuiltins[k] !== void 0 ? serviceBuiltins[k] : match
+      );
     }
-  } finally {
-    agentManager.off(eventName, handler);
+    resolvedService = {
+      ...resolvedService,
+      env: interpolatedEnv,
+      envSecrets: [...resolved.envSecrets]
+    };
+  } catch (err) {
+    console.error("[service-router] Failed to resolve variables for service", service.id + ":", err.message);
   }
+  return resolvedService;
 }
-async function* forwardLogBatches(agentId, processId) {
-  const queue = [];
-  let resolve7 = null;
-  const handler = (data) => {
-    if (data.agentId !== agentId) return;
-    const batch = data.batch;
-    if (!Array.isArray(batch)) return;
-    const filtered = batch.filter((log) => log.processId === processId);
-    if (filtered.length === 0) return;
-    if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
-    queue.push(filtered);
-    if (resolve7) {
-      resolve7();
-      resolve7 = null;
+var DockerConfigInput = DockerConfigSchema;
+var serviceRouter = router({
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List all services", protect: true } }).output(z4.any()).query(async ({ ctx }) => {
+    const all = await serviceStore.list();
+    const allowedIds = getAllowedServiceIds(ctx);
+    const filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
+    return Promise.all(filtered.map(async (s) => ({
+      ...s,
+      effectiveAgentId: await resolveEffectiveAgentId(s)
+    })));
+  }),
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.any()).query(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.id, "service:read");
+    const service = await serviceStore.get(input.id);
+    if (!service) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
     }
-  };
-  agentManager.on("process:log", handler);
-  try {
-    while (true) {
-      if (queue.length > 0) {
-        yield queue.shift();
-      } else {
-        await new Promise((r) => {
-          resolve7 = r;
+    return service;
+  }),
+  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z4.any()).input(
+    z4.object({
+      agentId: z4.string().max(128).optional(),
+      name: z4.string().min(1).max(200),
+      commands: z4.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z4.string().max(4096).optional(),
+      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z4.array(z4.string().max(200)).max(20).optional(),
+      description: z4.string().max(2e3).optional(),
+      docsPath: z4.string().max(4096).optional(),
+      url: z4.string().max(2048).optional(),
+      localUrls: z4.array(z4.object({
+        url: z4.string().max(253),
+        port: z4.number().int().min(1).max(65535)
+      })).max(20).optional(),
+      openapiUrl: z4.string().max(2048).optional(),
+      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).optional(),
+      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z4.enum(["native", "docker"]).optional().default("native"),
+      dockerConfig: DockerConfigInput.optional(),
+      healthCheck: HealthCheckSchema.optional(),
+      autoRestart: z4.boolean().optional().default(false),
+      restartStrategy: RestartStrategySchema.optional(),
+      maxRestarts: z4.number().int().nonnegative().optional(),
+      restartBackoffMs: z4.number().int().positive().optional().default(1e3),
+      orgId: z4.string().max(128).nullable().optional(),
+      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z4.array(z4.string().max(128)).max(50).optional()
+    })
+  ).mutation(async ({ input }) => {
+    if (input.agentId) {
+      const status = agentManager.getStatus(input.agentId);
+      if (!status) {
+        throw new TRPCError4({
+          code: "NOT_FOUND",
+          message: `Agent ${input.agentId} not found`
         });
       }
     }
-  } finally {
-    agentManager.off("process:log", handler);
-  }
-}
-var processRouter = router({
-  /** List all processes across all connected agents */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z6.any()).query(async () => {
-    const agents = agentManager.listAgents();
-    const results = [];
-    await Promise.allSettled(
-      agents.filter((a) => a.status.connected).map(async (a) => {
+    if (input.runner === "docker") {
+      throw new TRPCError4({ code: "BAD_REQUEST", message: 'Docker runner is not yet supported. Use "native" runner.' });
+    }
+    const service = await serviceStore.create({
+      ...input,
+      agentId: input.agentId
+    });
+    await auditService.log({ userId: "local", action: "create", entityType: "service", entityId: service.id, metadata: { name: input.name } });
+    return service;
+  }),
+  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z4.any()).input(
+    z4.object({
+      id: z4.string().max(128),
+      agentId: z4.string().max(128).nullable().optional(),
+      // null = clear (inherit from env)
+      name: z4.string().min(1).max(200).optional(),
+      commands: z4.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z4.string().max(4096).nullable().optional(),
+      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z4.array(z4.string().max(200)).max(20).optional(),
+      description: z4.string().max(2e3).optional(),
+      docsPath: z4.string().max(4096).optional(),
+      url: z4.string().max(2048).optional(),
+      localUrls: z4.array(z4.object({
+        url: z4.string().max(253),
+        port: z4.number().int().min(1).max(65535)
+      })).max(20).optional(),
+      openapiUrl: z4.string().max(2048).optional(),
+      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).nullable().optional(),
+      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z4.enum(["native", "docker"]).optional(),
+      dockerConfig: DockerConfigInput.optional(),
+      healthCheck: HealthCheckSchema.nullable().optional(),
+      autoRestart: z4.boolean().optional(),
+      clearLogsOnStart: z4.boolean().optional(),
+      restartStrategy: RestartStrategySchema.optional(),
+      maxRestarts: z4.number().int().nonnegative().optional(),
+      restartBackoffMs: z4.number().int().positive().optional(),
+      orgId: z4.string().max(128).nullable().optional(),
+      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z4.array(z4.string().max(128)).max(50).optional(),
+      logSources: z4.array(LogSourceConfigSchema).max(20).optional()
+    })
+  ).mutation(async ({ input }) => {
+    const existing = await serviceStore.get(input.id);
+    if (!existing) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+    }
+    let stoppedForAgentChange = false;
+    if (input.agentId !== void 0 && input.agentId !== existing.agentId && existing.agentId) {
+      const oldAgentStatus = agentManager.getStatus(existing.agentId);
+      if (oldAgentStatus?.connected) {
         try {
-          const processes = await agentManager.agentQuery(a.config.id, "process.list");
-          for (const proc of processes) {
-            results.push({ ...proc, agentId: a.config.id });
+          const processes = await agentManager.agentQuery(existing.agentId, "process.list");
+          const proc = processes.find((p) => p.serviceId === input.id);
+          if (proc && (proc.state === "running" || proc.state === "starting")) {
+            await agentManager.agentMutation(existing.agentId, "process.stop", { id: input.id }, AGENT_STOP_FETCH_TIMEOUT);
+            stoppedForAgentChange = true;
           }
         } catch {
         }
-      })
-    );
-    return results;
-  }),
-  /** Get a single process from a specific agent */
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z6.object({ agentId: z6.string().max(128), id: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.id, "service:read");
-    const status = agentManager.getStatus(input.agentId);
-    if (!status) {
-      throw new TRPCError6({ code: "NOT_FOUND", message: `Agent ${input.agentId} not found` });
-    }
-    const proc = await agentManager.agentQuery(input.agentId, "process.get", { id: input.id });
-    return { ...proc, agentId: input.agentId };
-  }),
-  /** Start a process on an agent.
-   *  Lazy deploy: the agent only learns about a service when it is first started
-   *  (or restarted). This avoids pushing configs for every service at agent boot,
-   *  which would be wasteful when many services are never started.
-   *  The deploy call is idempotent — creates the process if missing, updates config if it exists. */
-  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.processId, "service:start");
-    const service = await serviceStore.get(input.processId);
-    const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
-    if (!effectiveAgentId) {
-      throw new TRPCError6({ code: "BAD_REQUEST", message: "No agent assigned to this service. Set an agent on the service or on the active environment." });
-    }
-    if (service) {
-      try {
-        const resolved = await resolveServiceVariables(service);
-        await agentManager.agentMutation(effectiveAgentId, "process.deploy", resolved);
-      } catch (err) {
-        console.debug("[process-router] Failed to deploy before start for", input.processId + ":", err.message);
       }
-    }
-    if (service?.clearLogsOnStart) {
-      try {
-        await agentManager.agentMutation(effectiveAgentId, "process.clearLogBuffer", { id: input.processId });
-        agentManager.emit("process:log", { agentId: effectiveAgentId, batch: [{ processId: input.processId, __clearLogBuffer: true }] });
-      } catch (err) {
-        console.debug("[process-router] Failed to clear logs before start for", input.processId + ":", err.message);
+      if (input.agentId) {
+        const newAgentStatus = agentManager.getStatus(input.agentId);
+        if (!newAgentStatus) {
+          throw new TRPCError4({
+            code: "NOT_FOUND",
+            message: `Agent ${input.agentId} not found`
+          });
+        }
       }
     }
-    let result;
-    try {
-      result = await agentManager.agentMutation(effectiveAgentId, "process.start", { id: input.processId });
-    } catch (err) {
-      const err_ = err;
-      const isFetchError = err_?.cause?.code === "ECONNREFUSED" || err_?.message === "fetch failed" || err_?.name === "TypeError";
-      throw new TRPCError6({
-        code: "INTERNAL_SERVER_ERROR",
-        message: isFetchError ? `Cannot reach agent \u2014 make sure the agent is running` : err_?.message ?? "Failed to start process"
-      });
-    }
-    await auditService.log({ userId: "local", action: "start", entityType: "process", entityId: input.processId, metadata: { agentId: effectiveAgentId } });
-    return { ...result, agentId: effectiveAgentId };
-  }),
-  /** Stop a process on an agent */
-  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.processId, "service:stop");
-    const result = await agentManager.agentMutation(input.agentId, "process.stop", { id: input.processId }, AGENT_STOP_FETCH_TIMEOUT);
-    await auditService.log({ userId: "local", action: "stop", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
-    return { ...result, agentId: input.agentId };
-  }),
-  /** Restart a process on an agent.
-   *  Sends stop → deploy (latest resolved config) → start so that
-   *  config/variable changes take effect. Same lazy deploy pattern as start. */
-  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.processId, "service:restart");
-    const service = await serviceStore.get(input.processId);
-    const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
-    if (!effectiveAgentId) {
-      throw new TRPCError6({ code: "BAD_REQUEST", message: "No agent assigned to this service. Set an agent on the service or on the active environment." });
-    }
-    try {
-      await agentManager.agentMutation(effectiveAgentId, "process.stop", { id: input.processId }, AGENT_STOP_FETCH_TIMEOUT);
-    } catch (err) {
-      console.debug("[process-router] Stop before restart ignored (process not found on agent?):", err.message);
+    const service = await serviceStore.update(input);
+    if (!service) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
     }
-    if (service) {
-      try {
-        const resolved = await resolveServiceVariables(service);
-        await agentManager.agentMutation(effectiveAgentId, "process.deploy", resolved);
-      } catch (err) {
-        console.debug("[process-router] Failed to deploy before restart for", input.processId + ":", err.message);
-      }
+    if (input.name && input.name !== existing.name) {
+      await environmentStore.renameByReference(input.id, input.name);
     }
-    if (service?.clearLogsOnStart) {
-      try {
-        await agentManager.agentMutation(effectiveAgentId, "process.clearLogBuffer", { id: input.processId });
-        agentManager.emit("process:log", { agentId: effectiveAgentId, batch: [{ processId: input.processId, __clearLogBuffer: true }] });
-      } catch (err) {
-        console.debug("[process-router] Failed to clear logs before restart for", input.processId + ":", err.message);
+    if (service.agentId) {
+      const agentStatus = agentManager.getStatus(service.agentId);
+      if (agentStatus?.connected) {
+        try {
+          const resolvedService = await resolveServiceVariables(service);
+          await agentManager.agentMutation(service.agentId, "process.updateConfig", {
+            serviceId: service.id,
+            config: resolvedService
+          });
+        } catch (err) {
+          console.debug("[service-router] Failed to propagate config to agent", service.agentId + ":", err.message);
+        }
       }
     }
-    const result = await agentManager.agentMutation(effectiveAgentId, "process.start", { id: input.processId });
-    await auditService.log({ userId: "local", action: "restart", entityType: "process", entityId: input.processId, metadata: { agentId: effectiveAgentId } });
-    return { ...result, agentId: effectiveAgentId };
-  }),
-  /** Get buffered logs for a process from an agent */
-  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
-    requireServiceAction(ctx, input.processId, "logs:read");
-    return agentManager.agentQuery(input.agentId, "process.logs", { id: input.processId });
+    await auditService.log({ userId: "local", action: "update", entityType: "service", entityId: input.id });
+    return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service), stoppedForAgentChange };
   }),
-  /** Clear buffered logs for a process on an agent */
-  clearLogBuffer: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).mutation(async ({ input }) => {
-    await agentManager.agentMutation(input.agentId, "process.clearLogBuffer", { id: input.processId });
-    await auditService.log({ userId: "local", action: "clearLogBuffer", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
+  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.object({ success: z4.literal(true) })).mutation(async ({ input }) => {
+    const deleted = await serviceStore.delete(input.id);
+    if (!deleted) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+    }
+    await auditService.log({ userId: "local", action: "delete", entityType: "service", entityId: input.id });
     return { success: true };
   }),
-  /** Execute a shortcut command on an agent, streaming output into the process log */
-  executeShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    shortcut: ServiceShortcutSchema
-  })).mutation(async ({ input }) => {
-    const service = await serviceStore.get(input.processId);
-    if (service) {
-      try {
-        const resolved = await resolveServiceVariables(service);
-        await agentManager.agentMutation(input.agentId, "process.deploy", resolved);
-      } catch (err) {
-        console.debug("[process-router] Failed to deploy before executeShortcut for", input.processId + ":", err.message);
-      }
+  checkCwd: protectedProcedure.input(z4.object({ id: z4.string().max(128), checkReachability: z4.boolean().optional() })).query(async ({ input }) => {
+    const service = await serviceStore.get(input.id);
+    if (!service) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
     }
-    const result = await agentManager.agentMutation(
-      input.agentId,
-      "process.executeShortcut",
-      { id: input.processId, shortcut: input.shortcut },
-      AGENT_LONG_FETCH_TIMEOUT
-    );
-    await auditService.log({
-      userId: "local",
-      action: "executeShortcut",
-      entityType: "process",
-      entityId: input.processId,
-      metadata: { agentId: input.agentId, shortcutId: input.shortcut.id, shortcutLabel: input.shortcut.label }
+    const effectiveAgentId = await resolveEffectiveAgentId(service);
+    if (!effectiveAgentId) {
+      throw new TRPCError4({ code: "BAD_REQUEST", message: "No agent configured for this service" });
+    }
+    const agentResult = await agentManager.agentQuery(effectiveAgentId, "git.checkCwd", {
+      // Anchored on the project, so the check answers about the directory the
+      // service will actually run in.
+      cwd: await resolveWorkspaceCwd({ serviceId: service.id }),
+      remote: service.git?.remote,
+      checkReachability: input.checkReachability
     });
-    return result;
-  }),
-  /** Execute an ad-hoc command on an agent, streaming output into the process log */
-  executeAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    command: z6.string().min(1).max(4096),
-    cwd: z6.string().max(4096).optional(),
-    commandId: z6.string().max(128).optional()
-  })).mutation(async ({ input }) => {
-    const service = await serviceStore.get(input.processId);
-    if (service) {
-      try {
-        const resolved = await resolveServiceVariables(service);
-        await agentManager.agentMutation(input.agentId, "process.deploy", resolved);
-      } catch (err) {
-        console.debug("[process-router] Failed to deploy before executeAdHocCommand for", input.processId + ":", err.message);
+    const { exists: exists4, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
+    if (unresolvedVars.length > 0) {
+      return { exists: false, canClone: false, unresolvedVars, resolvedCwd, gitMismatch: null };
+    }
+    const canClone = !!service.git?.remote && (!exists4 || actualRemote === null);
+    let gitMismatch = null;
+    if (exists4 && service.git?.remote && !canClone) {
+      if (actualRemote === null) {
+        gitMismatch = { actual: null, configured: service.git.remote };
+      } else if (actualRemote !== service.git.remote) {
+        gitMismatch = { actual: actualRemote, configured: service.git.remote };
+      } else if (unreachable) {
+        gitMismatch = { actual: actualRemote, configured: service.git.remote, unreachable: true };
       }
     }
-    const result = await agentManager.agentMutation(
-      input.agentId,
-      "process.executeAdHocCommand",
-      {
-        id: input.processId,
-        command: input.command,
-        // An explicit cwd wins; otherwise the service's directory, anchored on
-        // its project rather than on the server's launch directory.
-        cwd: input.cwd ?? await resolveAgentCwd({ serviceId: input.processId }),
-        commandId: input.commandId
-      },
-      AGENT_LONG_FETCH_TIMEOUT
-    );
-    await auditService.log({
-      userId: "local",
-      action: "executeAdHocCommand",
-      entityType: "process",
-      entityId: input.processId,
-      metadata: { agentId: input.agentId, command: input.command }
-    });
-    return result;
+    return { exists: exists4, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
-  /** Cancel a running shortcut command on an agent */
-  cancelShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    shortcutId: z6.string().max(128)
-  })).mutation(async ({ input }) => {
-    await agentManager.agentMutation(input.agentId, "process.cancelShortcut", { id: input.processId, shortcutId: input.shortcutId });
+  cloneRepository: protectedProcedure.input(z4.object({ id: z4.string().max(128) })).mutation(async ({ input }) => {
+    const service = await serviceStore.get(input.id);
+    if (!service) {
+      throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
+    }
+    if (!service.git?.remote) {
+      throw new TRPCError4({ code: "BAD_REQUEST", message: "Service has no git remote configured" });
+    }
+    const effectiveAgentId = await resolveEffectiveAgentId(service);
+    if (!effectiveAgentId) {
+      throw new TRPCError4({ code: "BAD_REQUEST", message: "No agent configured for this service" });
+    }
+    await agentManager.agentMutation(effectiveAgentId, "git.clone", {
+      remote: service.git.remote,
+      // Clones WRITE: landing this in the launch directory instead of the
+      // project's is how a repository ends up in the wrong place.
+      cwd: await resolveWorkspaceCwd({ serviceId: service.id })
+    }, 5 * 60 * 1e3);
     return { success: true };
+  })
+});
+
+// ../server/src/trpc/routers/agent.ts
+import { z as z5 } from "zod";
+import { TRPCError as TRPCError5 } from "@trpc/server";
+var SUBSCRIPTION_QUEUE_MAX = LOG_BUFFER_SIZE;
+var agentRouter = router({
+  /** List all registered agents with their connection status */
+  list: protectedProcedure.query(() => {
+    return agentManager.listAgents();
   }),
-  /** Cancel a running ad-hoc command on an agent */
-  cancelAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    commandId: z6.string().max(128).optional()
-  })).mutation(async ({ input }) => {
-    await agentManager.agentMutation(input.agentId, "process.cancelAdHocCommand", { id: input.processId, commandId: input.commandId });
-    return { success: true };
+  /** Get a single agent's config and status */
+  get: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(({ input }) => {
+    const agent = agentManager.getAgent(input.id);
+    if (!agent) {
+      throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
+    }
+    return {
+      config: { ...agent.config, passphrase: "***" },
+      status: agent.status
+    };
   }),
-  /** Get current metrics for a process from an agent */
-  metrics: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).query(async ({ input }) => {
-    return agentManager.agentQuery(input.agentId, "process.metrics", { id: input.processId });
+  /** Test connectivity to an agent given url + passphrase */
+  testConnection: protectedProcedure.input(
+    z5.object({
+      url: z5.string().url().max(2048),
+      passphrase: z5.string().min(1).max(1024).optional(),
+      agentId: z5.string().max(128).optional()
+    })
+  ).mutation(async ({ input }) => {
+    let passphrase = input.passphrase;
+    let targetUrl = input.url;
+    if (!passphrase && input.agentId) {
+      const agent = agentManager.getAgentConfig(input.agentId);
+      if (!agent) {
+        throw new TRPCError5({ code: "NOT_FOUND", message: "Agent not found" });
+      }
+      passphrase = agent.passphrase;
+      targetUrl = agent.url;
+    }
+    if (!passphrase) {
+      throw new TRPCError5({ code: "BAD_REQUEST", message: "Passphrase is required" });
+    }
+    const url = new URL("/api/trpc/health.check", targetUrl);
+    try {
+      const res = await fetch(url.toString(), {
+        headers: { "Authorization": `Bearer ${passphrase}`, "Content-Type": "application/json" },
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (!res.ok) {
+        return { success: false, error: `HTTP ${res.status} ${res.statusText}` };
+      }
+      const json = await res.json();
+      if (json.error) {
+        return { success: false, error: json.error.message ?? "Agent returned an error" };
+      }
+      return { success: true, uptime: json.result?.data?.uptime };
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : "Unknown error";
+      return { success: false, error: msg };
+    }
   }),
-  /**
-   * Subscribe to real-time log stream for a process.
-   * Forwards batched events from the AgentWSBridge in real-time.
-   * Historical logs are fetched separately via process.logs query.
-   */
-  onLog: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).subscription(async function* ({ input, ctx }) {
-    requireServiceAction(ctx, input.processId, "logs:read");
-    yield* forwardLogBatches(input.agentId, input.processId);
+  /** Register a new agent */
+  register: protectedProcedure.input(
+    z5.object({
+      name: z5.string().min(1).max(100),
+      url: z5.string().url().max(2048),
+      passphrase: z5.string().min(1).max(1024),
+      // À quelle organisation rattacher l'agent. Absent = la machine, ce que
+      // font l'agent local et tout client antérieur à ce champ.
+      orgId: z5.string().min(1).max(128).nullable().optional()
+    })
+  ).mutation(async ({ input }) => {
+    const config = await agentManager.register(
+      input.name,
+      input.url,
+      input.passphrase,
+      input.orgId ?? null
+    );
+    return { ...config, passphrase: "***" };
   }),
-  /**
-   * Subscribe to real-time status changes for processes.
-   * Input is optional — omit agentId/processId for global monitoring (dashboard).
-   * Forwards events from the AgentWSBridge in real-time.
-   */
-  onStatus: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
-  }).optional()).subscription(async function* ({ input, ctx }) {
-    const allowedIds = getAllowedServiceIds(ctx);
-    if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
+  /** Update an existing agent */
+  update: protectedProcedure.input(
+    z5.object({
+      id: z5.string().max(128),
+      name: z5.string().min(1).max(100).optional(),
+      url: z5.string().url().max(2048).optional(),
+      passphrase: z5.string().min(1).max(1024).optional(),
+      passthroughEnv: z5.array(
+        z5.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
+      ).max(100).optional()
+    })
+  ).mutation(async ({ input }) => {
     try {
-      const agents = agentManager.listAgents();
-      for (const agent of agents.filter((a) => a.status.connected)) {
-        if (input?.agentId && agent.config.id !== input.agentId) continue;
-        try {
-          const processes = await agentManager.agentQuery(agent.config.id, "process.list");
-          for (const proc of processes) {
-            if (input?.processId && proc.id !== input.processId) continue;
-            if (allowedIds && !allowedIds.has(proc.id)) continue;
-            yield { ...proc, agentId: agent.config.id };
-          }
-        } catch {
+      const { id, ...fields } = input;
+      const config = await agentManager.update(id, fields);
+      return { ...config, passphrase: "***" };
+    } catch (err) {
+      if (err instanceof Error) {
+        if (err.message.includes("not found")) {
+          throw new TRPCError5({ code: "NOT_FOUND", message: err.message });
+        }
+        if (err.message.includes("Cannot modify")) {
+          throw new TRPCError5({ code: "FORBIDDEN", message: err.message });
         }
       }
-    } catch {
+      throw err;
     }
-    yield* forwardEvents("process:status", (d) => {
-      if (input?.agentId && d.agentId !== input.agentId) return false;
-      if (input?.processId && d.processId !== input.processId) return false;
-      if (allowedIds && !allowedIds.has(d.processId)) return false;
-      return true;
-    });
-  }),
-  /** Subscribe to real-time metrics for a process. */
-  onMetrics: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
-  }).optional()).subscription(async function* ({ input, ctx }) {
-    const allowedIds = getAllowedServiceIds(ctx);
-    if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
-    yield* forwardEvents("process:metrics", (d) => {
-      if (input?.agentId && d.agentId !== input.agentId) return false;
-      if (input?.processId && d.processId !== input.processId) return false;
-      if (allowedIds && !allowedIds.has(d.processId)) return false;
-      return true;
-    });
   }),
-  /** Subscribe to real-time health status changes. */
-  onHealth: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
-  }).optional()).subscription(async function* ({ input, ctx }) {
-    const allowedIds = getAllowedServiceIds(ctx);
-    if (input?.processId) requireServiceAction(ctx, input.processId, "service:healthcheck");
-    yield* forwardEvents("process:health", (d) => {
-      if (input?.agentId && d.agentId !== input.agentId) return false;
-      if (input?.processId && d.processId !== input.processId) return false;
-      if (allowedIds && !allowedIds.has(d.processId)) return false;
-      return true;
-    });
-  })
-});
-
-// ../server/src/trpc/routers/audit.ts
-import { z as z7 } from "zod";
-var auditRouter = router({
-  list: protectedProcedure.input(z7.object({
-    action: z7.string().max(50).optional(),
-    entityType: z7.string().max(50).optional(),
-    entityId: z7.string().max(100).optional(),
-    limit: z7.number().int().positive().max(100).default(50),
-    offset: z7.number().int().nonnegative().default(0)
-  }).optional()).query(async ({ input }) => {
-    return auditService.list(input ?? {});
-  })
-});
-
-// ../server/src/trpc/routers/setup.ts
-import { z as z8 } from "zod";
-
-// ../server/src/services/cloud-session-store.ts
-import { readFile as readFile8, writeFile as writeFile8, rename as rename8, mkdir as mkdir8, chmod as chmod7, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname5 } from "path";
-import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FILENAME4 = "cloud-session.json";
-var STATE_TTL_MS = 5 * 60 * 1e3;
-var CloudSessionStore = class {
-  session = null;
-  loaded = false;
-  /** Pending login states (CSRF binding between `start` and the callback). */
-  pending = /* @__PURE__ */ new Map();
-  /**
-   * Encrypted, so it lives beside the key that opens it — usually the machine
-   * root, but a launch directory owning its own key keeps both together.
-   */
-  getFilePath() {
-    return keyedFilePath(FILENAME4);
-  }
-  /** Where older versions kept it — read only, so an older Runeya keeps working. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME4);
-  }
-  /**
-   * Read the machine file, falling back to the launch directory of old.
-   *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
-   */
-  async readFromDisk() {
+  /** Get resolved passthrough env values from an agent */
+  getPassthroughEnv: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(async ({ input }) => {
     try {
-      return await readFile8(await this.getFilePath(), "utf-8");
+      return await agentManager.agentQuery(input.id, "config.getPassthroughEnv");
     } catch {
-      return readFile8(this.getLegacyFilePath(), "utf-8");
+      return {};
     }
-  }
-  async load() {
-    if (this.loaded) return;
+  }),
+  /** Remove a registered agent */
+  remove: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).mutation(async ({ input }) => {
     try {
-      const raw = await this.readFromDisk();
-      this.session = JSON.parse(raw);
-    } catch {
+      const removed = await agentManager.remove(input.id);
+      if (!removed) {
+        throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
+      }
+      return { success: true };
+    } catch (err) {
+      if (err instanceof Error && err.message === "Cannot remove the local agent") {
+        throw new TRPCError5({ code: "FORBIDDEN", message: err.message });
+      }
+      throw err;
     }
-    this.loaded = true;
-  }
-  /**
-   * Mint a state value binding a login attempt to this server. Returned to the
-   * cloud page and echoed back on the callback, so a redirect we never
-   * initiated cannot install a token.
-   */
-  createState(returnTo) {
-    this.sweepStates();
-    const state = randomBytes4(32).toString("hex");
-    this.pending.set(state, { expiresAt: Date.now() + STATE_TTL_MS, returnTo });
-    return state;
-  }
-  /**
-   * Consume a state — single use, constant-time compare, TTL enforced. Returns
-   * the URL to send the browser back to, or null when the state is unknown or
-   * expired (i.e. a callback this server never initiated).
-   */
-  consumeState(candidate) {
-    this.sweepStates();
-    for (const [state, entry] of this.pending) {
-      const a = Buffer.from(state);
-      const b = Buffer.from(candidate);
-      if (a.length === b.length && timingSafeEqual2(a, b)) {
-        this.pending.delete(state);
-        return entry.expiresAt > Date.now() ? entry.returnTo : null;
+  }),
+  /** Subscribe to real-time agent status changes */
+  onStatus: protectedProcedure.subscription(async function* () {
+    for (const agent of agentManager.listAgents()) {
+      yield { agentId: agent.config.id, status: agent.status };
+    }
+    const queue = [];
+    let resolve7 = null;
+    const handler = (event) => {
+      if (queue.length >= SUBSCRIPTION_QUEUE_MAX) queue.shift();
+      queue.push(event);
+      if (resolve7) {
+        resolve7();
+        resolve7 = null;
+      }
+    };
+    agentManager.on("status", handler);
+    try {
+      while (true) {
+        if (queue.length > 0) {
+          yield queue.shift();
+        } else {
+          await new Promise((r) => {
+            resolve7 = r;
+          });
+        }
+      }
+    } finally {
+      agentManager.off("status", handler);
+    }
+  })
+});
+
+// ../server/src/trpc/routers/process.ts
+import { z as z6 } from "zod";
+import { TRPCError as TRPCError6 } from "@trpc/server";
+var SUBSCRIPTION_QUEUE_MAX2 = LOG_BUFFER_SIZE;
+async function* forwardEvents(eventName, filter) {
+  const queue = [];
+  let resolve7 = null;
+  const handler = (data) => {
+    if (filter && !filter(data)) return;
+    if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
+    queue.push(data);
+    if (resolve7) {
+      resolve7();
+      resolve7 = null;
+    }
+  };
+  agentManager.on(eventName, handler);
+  try {
+    while (true) {
+      if (queue.length > 0) {
+        yield queue.shift();
+      } else {
+        await new Promise((r) => {
+          resolve7 = r;
+        });
       }
     }
-    return null;
+  } finally {
+    agentManager.off(eventName, handler);
   }
-  sweepStates() {
-    const now = Date.now();
-    for (const [state, entry] of this.pending) {
-      if (entry.expiresAt <= now) this.pending.delete(state);
+}
+async function* forwardLogBatches(agentId, processId) {
+  const queue = [];
+  let resolve7 = null;
+  const handler = (data) => {
+    if (data.agentId !== agentId) return;
+    const batch = data.batch;
+    if (!Array.isArray(batch)) return;
+    const filtered = batch.filter((log) => log.processId === processId);
+    if (filtered.length === 0) return;
+    if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
+    queue.push(filtered);
+    if (resolve7) {
+      resolve7();
+      resolve7 = null;
     }
-  }
-  async save() {
-    await mkdir8(dirname5(await this.getFilePath()), { recursive: true });
-    const filePath = await this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    await writeFile8(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
-    await rename8(tmpPath, filePath);
-    await chmod7(filePath, 384);
-  }
-  /** Store the session token obtained from the one-time-token exchange. */
-  async set(cloudUrl, token) {
-    await this.load();
-    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
-    await this.save();
-  }
-  /** The decrypted session token, or null when not logged in. */
-  async getToken() {
-    await this.load();
-    if (!this.session) return null;
-    try {
-      return decryptValue(this.session.encryptedToken);
-    } catch {
-      return null;
+  };
+  agentManager.on("process:log", handler);
+  try {
+    while (true) {
+      if (queue.length > 0) {
+        yield queue.shift();
+      } else {
+        await new Promise((r) => {
+          resolve7 = r;
+        });
+      }
     }
+  } finally {
+    agentManager.off("process:log", handler);
   }
-  /**
-   * The cloud this machine is signed into, or null when not linked.
-   *
-   * Needed to tell "an org I am not a member of" apart from "an org of another
-   * cloud instance entirely" — the ids of two clouds share no namespace, so
-   * comparing them without this would call every foreign-cloud project a
-   * permission problem.
-   */
-  async getCloudUrl() {
-    await this.load();
-    return this.session?.cloudUrl ?? null;
-  }
-  async isLinked() {
-    return await this.getToken() !== null;
-  }
-  /** Forget the session (sign-out). */
-  async clear() {
-    await this.load();
-    this.session = null;
-    this.pending.clear();
+}
+var processRouter = router({
+  /** List all processes across all connected agents */
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z6.any()).query(async () => {
+    const agents = agentManager.listAgents();
+    const results = [];
+    await Promise.allSettled(
+      agents.filter((a) => a.status.connected).map(async (a) => {
+        try {
+          const processes = await agentManager.agentQuery(a.config.id, "process.list");
+          for (const proc of processes) {
+            results.push({ ...proc, agentId: a.config.id });
+          }
+        } catch {
+        }
+      })
+    );
+    return results;
+  }),
+  /** Get a single process from a specific agent */
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z6.object({ agentId: z6.string().max(128), id: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.id, "service:read");
+    const status = agentManager.getStatus(input.agentId);
+    if (!status) {
+      throw new TRPCError6({ code: "NOT_FOUND", message: `Agent ${input.agentId} not found` });
+    }
+    const proc = await agentManager.agentQuery(input.agentId, "process.get", { id: input.id });
+    return { ...proc, agentId: input.agentId };
+  }),
+  /** Start a process on an agent.
+   *  Lazy deploy: the agent only learns about a service when it is first started
+   *  (or restarted). This avoids pushing configs for every service at agent boot,
+   *  which would be wasteful when many services are never started.
+   *  The deploy call is idempotent — creates the process if missing, updates config if it exists. */
+  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.processId, "service:start");
+    const service = await serviceStore.get(input.processId);
+    const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
+    if (!effectiveAgentId) {
+      throw new TRPCError6({ code: "BAD_REQUEST", message: "No agent assigned to this service. Set an agent on the service or on the active environment." });
+    }
+    if (service) {
+      try {
+        const resolved = await resolveServiceVariables(service);
+        await agentManager.agentMutation(effectiveAgentId, "process.deploy", resolved);
+      } catch (err) {
+        console.debug("[process-router] Failed to deploy before start for", input.processId + ":", err.message);
+      }
+    }
+    if (service?.clearLogsOnStart) {
+      try {
+        await agentManager.agentMutation(effectiveAgentId, "process.clearLogBuffer", { id: input.processId });
+        agentManager.emit("process:log", { agentId: effectiveAgentId, batch: [{ processId: input.processId, __clearLogBuffer: true }] });
+      } catch (err) {
+        console.debug("[process-router] Failed to clear logs before start for", input.processId + ":", err.message);
+      }
+    }
+    let result;
     try {
-      await unlink2(await this.getFilePath());
-    } catch {
+      result = await agentManager.agentMutation(effectiveAgentId, "process.start", { id: input.processId });
+    } catch (err) {
+      const err_ = err;
+      const isFetchError = err_?.cause?.code === "ECONNREFUSED" || err_?.message === "fetch failed" || err_?.name === "TypeError";
+      throw new TRPCError6({
+        code: "INTERNAL_SERVER_ERROR",
+        message: isFetchError ? `Cannot reach agent \u2014 make sure the agent is running` : err_?.message ?? "Failed to start process"
+      });
+    }
+    await auditService.log({ userId: "local", action: "start", entityType: "process", entityId: input.processId, metadata: { agentId: effectiveAgentId } });
+    return { ...result, agentId: effectiveAgentId };
+  }),
+  /** Stop a process on an agent */
+  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.processId, "service:stop");
+    const result = await agentManager.agentMutation(input.agentId, "process.stop", { id: input.processId }, AGENT_STOP_FETCH_TIMEOUT);
+    await auditService.log({ userId: "local", action: "stop", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
+    return { ...result, agentId: input.agentId };
+  }),
+  /** Restart a process on an agent.
+   *  Sends stop → deploy (latest resolved config) → start so that
+   *  config/variable changes take effect. Same lazy deploy pattern as start. */
+  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.processId, "service:restart");
+    const service = await serviceStore.get(input.processId);
+    const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
+    if (!effectiveAgentId) {
+      throw new TRPCError6({ code: "BAD_REQUEST", message: "No agent assigned to this service. Set an agent on the service or on the active environment." });
     }
-  }
-};
-var cloudSessionStore = new CloudSessionStore();
-
-// ../server/src/services/cloud-api.ts
-var DEFAULT_CLOUD_API_URL = "https://api.runeya.dev";
-var DEFAULT_CLOUD_APP_URL = "https://runeya.dev";
-function getCloudApiUrl() {
-  return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
-}
-function getCloudAppUrl() {
-  return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
-}
-var CloudNotLinkedError = class extends Error {
-  code = "CLOUD_NOT_LINKED";
-  constructor() {
-    super("Not linked to the Runeya cloud.");
-    this.name = "CloudNotLinkedError";
-  }
-};
-async function cloudFetch(path, init = {}) {
-  const token = await cloudSessionStore.getToken();
-  if (!token) throw new CloudNotLinkedError();
-  return fetch(`${getCloudApiUrl()}${path}`, {
-    method: init.method ?? "GET",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
-      [APP_VERSION_HEADER]: appVersion,
-      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
-    },
-    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-    // 15s suits a JSON call; attachment downloads pass a longer budget.
-    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
-  });
-}
-
-// ../server/src/services/conversation-store.ts
-import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile9, writeFile as writeFile9, rename as rename9, mkdir as mkdir9, chmod as chmod8 } from "fs/promises";
-import { dirname as dirname6, join as join10 } from "path";
-import { EventEmitter as EventEmitter2 } from "events";
-var FILENAME5 = "conversations.private.json";
-async function localProjectId() {
-  const projects = await projectStore.list().catch(() => []);
-  return projects.find((p) => !p.orgId)?.id ?? null;
-}
-var ConversationStore = class {
-  conversations = /* @__PURE__ */ new Map();
-  /** Which vault each conversation was read from, until its project is known. */
-  roots = /* @__PURE__ */ new Map();
-  /**
-   * Les conversations qu'on n'a pas su déchiffrer, par coffre, sous leur forme
-   * de disque.
-   *
-   * Une entrée illisible était simplement ignorée. Tant qu'aucune de ses
-   * voisines ne se chargeait, le fichier n'était jamais réécrit et la donnée
-   * survivait par accident ; dès qu'une seule s'ouvrait, la sauvegarde suivante
-   * réécrivait le fichier avec elle seule — et effaçait les autres. Elles sont
-   * donc gardées ici, telles quelles, et réémises à l'identique.
-   */
-  unreadable = /* @__PURE__ */ new Map();
-  loaded = false;
-  events = new EventEmitter2().setMaxListeners(0);
-  saveQueue = Promise.resolve();
-  snapshotConversation(conv) {
-    return structuredClone(conv);
-  }
-  /**
-   * Encrypted, so it lives beside the key that opens it — usually the machine
-   * root, but a launch directory owning its own key keeps both together.
-   */
-  getFilePath() {
-    return keyedFilePath(FILENAME5);
-  }
-  /** Where older versions kept it — read only, so an older Runeya keeps working. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME5);
-  }
-  /**
-   * Read the machine file, falling back to the launch directory of old.
-   *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
-   */
-  async readFromDisk() {
     try {
-      return await readFile9(await this.getFilePath(), "utf-8");
-    } catch {
-      return readFile9(this.getLegacyFilePath(), "utf-8");
+      await agentManager.agentMutation(effectiveAgentId, "process.stop", { id: input.processId }, AGENT_STOP_FETCH_TIMEOUT);
+    } catch (err) {
+      console.debug("[process-router] Stop before restart ignored (process not found on agent?):", err.message);
     }
-  }
-  async ensureDir() {
-    await mkdir9(dirname6(await this.getFilePath()), { recursive: true });
-  }
-  encryptMessages(messages, vault) {
-    return encryptValue(JSON.stringify(messages), vault);
-  }
-  decryptMessages(encrypted, vault) {
-    const json = decryptValue(encrypted, vault);
-    return JSON.parse(json);
-  }
+    if (service) {
+      try {
+        const resolved = await resolveServiceVariables(service);
+        await agentManager.agentMutation(effectiveAgentId, "process.deploy", resolved);
+      } catch (err) {
+        console.debug("[process-router] Failed to deploy before restart for", input.processId + ":", err.message);
+      }
+    }
+    if (service?.clearLogsOnStart) {
+      try {
+        await agentManager.agentMutation(effectiveAgentId, "process.clearLogBuffer", { id: input.processId });
+        agentManager.emit("process:log", { agentId: effectiveAgentId, batch: [{ processId: input.processId, __clearLogBuffer: true }] });
+      } catch (err) {
+        console.debug("[process-router] Failed to clear logs before restart for", input.processId + ":", err.message);
+      }
+    }
+    const result = await agentManager.agentMutation(effectiveAgentId, "process.start", { id: input.processId });
+    await auditService.log({ userId: "local", action: "restart", entityType: "process", entityId: input.processId, metadata: { agentId: effectiveAgentId } });
+    return { ...result, agentId: effectiveAgentId };
+  }),
+  /** Get buffered logs for a process from an agent */
+  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+    requireServiceAction(ctx, input.processId, "logs:read");
+    return agentManager.agentQuery(input.agentId, "process.logs", { id: input.processId });
+  }),
+  /** Clear buffered logs for a process on an agent */
+  clearLogBuffer: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).mutation(async ({ input }) => {
+    await agentManager.agentMutation(input.agentId, "process.clearLogBuffer", { id: input.processId });
+    await auditService.log({ userId: "local", action: "clearLogBuffer", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
+    return { success: true };
+  }),
+  /** Execute a shortcut command on an agent, streaming output into the process log */
+  executeShortcut: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128),
+    processId: z6.string().max(128),
+    shortcut: ServiceShortcutSchema
+  })).mutation(async ({ input }) => {
+    const service = await serviceStore.get(input.processId);
+    if (service) {
+      try {
+        const resolved = await resolveServiceVariables(service);
+        await agentManager.agentMutation(input.agentId, "process.deploy", resolved);
+      } catch (err) {
+        console.debug("[process-router] Failed to deploy before executeShortcut for", input.processId + ":", err.message);
+      }
+    }
+    const result = await agentManager.agentMutation(
+      input.agentId,
+      "process.executeShortcut",
+      { id: input.processId, shortcut: input.shortcut },
+      AGENT_LONG_FETCH_TIMEOUT
+    );
+    await auditService.log({
+      userId: "local",
+      action: "executeShortcut",
+      entityType: "process",
+      entityId: input.processId,
+      metadata: { agentId: input.agentId, shortcutId: input.shortcut.id, shortcutLabel: input.shortcut.label }
+    });
+    return result;
+  }),
+  /** Execute an ad-hoc command on an agent, streaming output into the process log */
+  executeAdHocCommand: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128),
+    processId: z6.string().max(128),
+    command: z6.string().min(1).max(4096),
+    cwd: z6.string().max(4096).optional(),
+    commandId: z6.string().max(128).optional()
+  })).mutation(async ({ input }) => {
+    const service = await serviceStore.get(input.processId);
+    if (service) {
+      try {
+        const resolved = await resolveServiceVariables(service);
+        await agentManager.agentMutation(input.agentId, "process.deploy", resolved);
+      } catch (err) {
+        console.debug("[process-router] Failed to deploy before executeAdHocCommand for", input.processId + ":", err.message);
+      }
+    }
+    const result = await agentManager.agentMutation(
+      input.agentId,
+      "process.executeAdHocCommand",
+      {
+        id: input.processId,
+        command: input.command,
+        // An explicit cwd wins; otherwise the service's directory, anchored on
+        // its project rather than on the server's launch directory.
+        cwd: input.cwd ?? await resolveAgentCwd({ serviceId: input.processId }),
+        commandId: input.commandId
+      },
+      AGENT_LONG_FETCH_TIMEOUT
+    );
+    await auditService.log({
+      userId: "local",
+      action: "executeAdHocCommand",
+      entityType: "process",
+      entityId: input.processId,
+      metadata: { agentId: input.agentId, command: input.command }
+    });
+    return result;
+  }),
+  /** Cancel a running shortcut command on an agent */
+  cancelShortcut: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128),
+    processId: z6.string().max(128),
+    shortcutId: z6.string().max(128)
+  })).mutation(async ({ input }) => {
+    await agentManager.agentMutation(input.agentId, "process.cancelShortcut", { id: input.processId, shortcutId: input.shortcutId });
+    return { success: true };
+  }),
+  /** Cancel a running ad-hoc command on an agent */
+  cancelAdHocCommand: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128),
+    processId: z6.string().max(128),
+    commandId: z6.string().max(128).optional()
+  })).mutation(async ({ input }) => {
+    await agentManager.agentMutation(input.agentId, "process.cancelAdHocCommand", { id: input.processId, commandId: input.commandId });
+    return { success: true };
+  }),
+  /** Get current metrics for a process from an agent */
+  metrics: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).query(async ({ input }) => {
+    return agentManager.agentQuery(input.agentId, "process.metrics", { id: input.processId });
+  }),
   /**
-   * Refuser d'écrire dans le coffre d'une organisation sans nommer sa clé.
-   *
-   * `getEncryptionKey(undefined)` rend la clé machine, et c'est le bon défaut
-   * pour le coffre local. Appliqué à un fichier rangé sous `orgs/<org>/`, il
-   * produit un chiffré que ce coffre n'emploie pas — lisible par personne à la
-   * relecture, et impossible à distinguer d'une corruption.
-   *
-   * Le cas a été observé plusieurs fois sans qu'on parvienne à nommer le
-   * chemin fautif : les garde-fous en place traitent le coffre fermé, le
-   * coffre mal résolu et la copie périmée, aucun ne couvrait « coffre non
-   * précisé ». Ces écritures-là n'ont jamais fonctionné — elles échouaient en
-   * silence, ce qui est pire. On les saute désormais en le disant, avec la
-   * pile d'appels qui manquait pour remonter au chemin fautif.
+   * Subscribe to real-time log stream for a process.
+   * Forwards batched events from the AgentWSBridge in real-time.
+   * Historical logs are fetched separately via process.logs query.
    */
-  isVaultNamed(root, vault) {
-    const orgId = orgIdOfRoot(root);
-    if (!orgId || vault) return true;
-    console.error(
-      `[conversation-store] \xC9criture ignor\xE9e dans le coffre de l'organisation ${orgId} (${root}) : aucune cl\xE9 d'organisation nomm\xE9e, le contenu serait chiffr\xE9 par la cl\xE9 machine et illisible \xE0 la relecture.
-${new Error("trace").stack}`
-    );
-    return false;
-  }
-  toDisk(conv, vault) {
-    return {
-      id: conv.id,
-      projectId: conv.projectId,
-      title: conv.title,
-      encryptedMessages: this.encryptMessages(conv.messages, vault),
-      isCli: conv.isCli,
-      runner: conv.runner,
-      providerId: conv.providerId,
-      codexThreadId: conv.codexThreadId,
-      contextUsage: conv.contextUsage,
-      workflowId: conv.workflowId,
-      workflowType: conv.workflowType,
-      kanbanBoardId: conv.kanbanBoardId,
-      kanbanCardId: conv.kanbanCardId,
-      archived: conv.archived,
-      createdAt: conv.createdAt,
-      updatedAt: conv.updatedAt
-    };
-  }
-  fromDisk(disk, vault) {
-    const workflowType = (disk.workflowType === "scenario" ? "scenario" : void 0) ?? (disk.scenarioId ? "scenario" : void 0);
-    return {
-      id: disk.id,
-      projectId: disk.projectId,
-      title: disk.title,
-      messages: this.decryptMessages(disk.encryptedMessages, vault),
-      isCli: disk.isCli ?? disk.isClaudeCode ?? false,
-      runner: disk.runner,
-      providerId: disk.providerId,
-      codexThreadId: disk.codexThreadId,
-      contextUsage: disk.contextUsage,
-      workflowId: disk.workflowId ?? disk.scenarioId,
-      workflowType,
-      kanbanBoardId: disk.kanbanBoardId,
-      kanbanCardId: disk.kanbanCardId,
-      archived: disk.archived,
-      createdAt: disk.createdAt,
-      updatedAt: disk.updatedAt
-    };
-  }
+  onLog: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).subscription(async function* ({ input, ctx }) {
+    requireServiceAction(ctx, input.processId, "logs:read");
+    yield* forwardLogBatches(input.agentId, input.processId);
+  }),
   /**
-   * Read every project vault, then the homes older versions used.
-   *
-   * A conversation found in a legacy file is attributed to the local project of
-   * that directory — which is what it was about, back when one directory meant
-   * one project. With no local project to point at, it is left unattributed
-   * rather than filed under a project picked at random.
+   * Subscribe to real-time status changes for processes.
+   * Input is optional — omit agentId/processId for global monitoring (dashboard).
+   * Forwards events from the AgentWSBridge in real-time.
    */
-  async load() {
-    if (this.loaded) return;
-    if (!getEncryptionKey()) {
-      return;
-    }
-    this.loaded = true;
-    this.unreadable.clear();
-    await ensureProjectsLoaded();
-    const vaults = await allVaultRoots();
-    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME5)];
-    const sources = [
-      ...legacyPaths.map((path) => ({ path, legacy: true })),
-      ...vaults.map((root) => ({ path: join10(root, FILENAME5), legacy: false }))
-    ];
-    for (const { path, legacy } of sources) {
-      let data;
-      try {
-        data = JSON.parse(await readFile9(path, "utf-8"));
-      } catch {
-        continue;
-      }
-      const inherited = legacy ? await localProjectId() : null;
-      const root = dirname6(path);
-      await rememberFile(path);
-      for (const item of data) {
+  onStatus: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128).optional(),
+    processId: z6.string().max(128).optional()
+  }).optional()).subscription(async function* ({ input, ctx }) {
+    const allowedIds = getAllowedServiceIds(ctx);
+    if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
+    try {
+      const agents = agentManager.listAgents();
+      for (const agent of agents.filter((a) => a.status.connected)) {
+        if (input?.agentId && agent.config.id !== input.agentId) continue;
         try {
-          const conv = this.fromDisk(item, vaultIdOfRoot(root));
-          if (!conv.projectId && inherited) conv.projectId = inherited;
-          this.conversations.set(item.id, conv);
-          this.roots.set(item.id, root);
+          const processes = await agentManager.agentQuery(agent.config.id, "process.list");
+          for (const proc of processes) {
+            if (input?.processId && proc.id !== input.processId) continue;
+            if (allowedIds && !allowedIds.has(proc.id)) continue;
+            yield { ...proc, agentId: agent.config.id };
+          }
         } catch {
-          const bucket = this.unreadable.get(root) ?? [];
-          bucket.push(item);
-          this.unreadable.set(root, bucket);
         }
       }
+    } catch {
     }
-  }
+    yield* forwardEvents("process:status", (d) => {
+      if (input?.agentId && d.agentId !== input.agentId) return false;
+      if (input?.processId && d.processId !== input.processId) return false;
+      if (allowedIds && !allowedIds.has(d.processId)) return false;
+      return true;
+    });
+  }),
+  /** Subscribe to real-time metrics for a process. */
+  onMetrics: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128).optional(),
+    processId: z6.string().max(128).optional()
+  }).optional()).subscription(async function* ({ input, ctx }) {
+    const allowedIds = getAllowedServiceIds(ctx);
+    if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
+    yield* forwardEvents("process:metrics", (d) => {
+      if (input?.agentId && d.agentId !== input.agentId) return false;
+      if (input?.processId && d.processId !== input.processId) return false;
+      if (allowedIds && !allowedIds.has(d.processId)) return false;
+      return true;
+    });
+  }),
+  /** Subscribe to real-time health status changes. */
+  onHealth: protectedProcedure.input(z6.object({
+    agentId: z6.string().max(128).optional(),
+    processId: z6.string().max(128).optional()
+  }).optional()).subscription(async function* ({ input, ctx }) {
+    const allowedIds = getAllowedServiceIds(ctx);
+    if (input?.processId) requireServiceAction(ctx, input.processId, "service:healthcheck");
+    yield* forwardEvents("process:health", (d) => {
+      if (input?.agentId && d.agentId !== input.agentId) return false;
+      if (input?.processId && d.processId !== input.processId) return false;
+      if (allowedIds && !allowedIds.has(d.processId)) return false;
+      return true;
+    });
+  })
+});
+
+// ../server/src/trpc/routers/audit.ts
+import { z as z7 } from "zod";
+var auditRouter = router({
+  list: protectedProcedure.input(z7.object({
+    action: z7.string().max(50).optional(),
+    entityType: z7.string().max(50).optional(),
+    entityId: z7.string().max(100).optional(),
+    limit: z7.number().int().positive().max(100).default(50),
+    offset: z7.number().int().nonnegative().default(0)
+  }).optional()).query(async ({ input }) => {
+    return auditService.list(input ?? {});
+  })
+});
+
+// ../server/src/trpc/routers/setup.ts
+import { z as z8 } from "zod";
+
+// ../server/src/services/cloud-session-store.ts
+import { readFile as readFile9, writeFile as writeFile9, rename as rename9, mkdir as mkdir9, chmod as chmod8, unlink as unlink2 } from "fs/promises";
+import { dirname as dirname6 } from "path";
+import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FILENAME5 = "cloud-session.json";
+var STATE_TTL_MS = 5 * 60 * 1e3;
+var CloudSessionStore = class {
+  session = null;
+  loaded = false;
+  /** Pending login states (CSRF binding between `start` and the callback). */
+  pending = /* @__PURE__ */ new Map();
   /**
-   * Oublier ce qui a été lu, pour tout relire sous la clé courante.
-   *
-   * Appelé après l'adoption d'une clé d'organisation : le disque vient d'être
-   * re-chiffré sous les pieds du store, si bien que sa mémoire décrit un état
-   * qui n'existe plus. La laisser en place n'affichait pas seulement des
-   * comptes périmés — la sauvegarde suivante réécrivait l'ancien chiffré
-   * par-dessus le nouveau, et défaisait l'adoption.
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
    */
-  resetCache() {
-    this.conversations.clear();
-    this.roots.clear();
-    this.unreadable.clear();
-    this.loaded = false;
-    this.events.emit("changed", { type: "reloaded" });
+  getFilePath() {
+    return keyedFilePath(FILENAME5);
   }
-  /**
-   * Combien de conversations ce coffre garde sans savoir les lire, par
-   * organisation. La machine elle-même est rangée sous `null`.
-   */
-  async unreadableByVault() {
-    await this.load();
-    const out = /* @__PURE__ */ new Map();
-    for (const [root, items] of this.unreadable) {
-      const vault = vaultIdOfRoot(root) ?? null;
-      out.set(vault, (out.get(vault) ?? 0) + items.length);
-    }
-    return out;
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME5);
   }
   /**
-   * Write each vault that holds — or held — a conversation.
+   * Read the machine file, falling back to the launch directory of old.
    *
-   * A vault emptied by this save is still written, as an empty list: a
-   * conversation that found its project must not survive in the file it was
-   * read from.
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
    */
-  async saveInternal() {
-    if (!getEncryptionKey()) return;
-    const byRoot = /* @__PURE__ */ new Map();
-    for (const root of this.roots.values()) byRoot.set(root, []);
-    for (const conv of this.conversations.values()) {
-      const root = await this.rootFor(conv);
-      this.roots.set(conv.id, root);
-      const bucket = byRoot.get(root) ?? [];
-      const vault = vaultIdOfRoot(root);
-      if (!this.isVaultNamed(root, vault)) continue;
-      bucket.push(this.toDisk(conv, vault));
-      byRoot.set(root, bucket);
-    }
-    for (const [root, items] of this.unreadable) {
-      byRoot.set(root, [...items, ...byRoot.get(root) ?? []]);
-    }
-    const stale = /* @__PURE__ */ new Set();
-    for (const root of byRoot.keys()) {
-      const path = join10(root, FILENAME5);
-      if (wasRead(path) && await hasChangedSinceRead(path)) stale.add(root);
-    }
-    for (const [root, data] of byRoot) {
-      const filePath = join10(root, FILENAME5);
-      if (stale.has(root)) {
-        console.warn(
-          `[conversation-store] ${filePath} a chang\xE9 depuis sa lecture \u2014 \xE9criture ignor\xE9e pour ne pas \xE9craser une r\xE9paration faite en dehors du serveur.`
-        );
-        continue;
-      }
-      await mkdir9(root, { recursive: true });
-      const tmpPath = `${filePath}.tmp`;
-      await writeFile9(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-      await rename9(tmpPath, filePath);
-      await chmod8(filePath, 384);
-      await rememberFile(filePath);
+  async readFromDisk() {
+    try {
+      return await readFile9(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile9(this.getLegacyFilePath(), "utf-8");
     }
   }
-  /**
-   * The vault a conversation is written to: its project's.
-   *
-   * One that names no project stays where it was read, falling back to the
-   * key's own directory — never lost for want of an owner.
-   */
-  async rootFor(conv) {
-    const known = this.roots.get(conv.id) ?? null;
-    if (conv.projectId) return rootOfProjectAmong(conv.projectId, known);
-    return known ?? dirname6(await keyedFilePath(FILENAME5));
-  }
-  /**
-   * Le projet d'une conversation, organisation comprise.
-   *
-   * Ce que la conversation ne dit pas d'elle-même : elle ne nomme que l'id.
-   * Le coffre d'où elle vient fournit l'organisation, et c'est ce couple qu'il
-   * faut pour retrouver le répertoire de travail du projet.
-   */
-  async projectRefOf(conv) {
-    if (!conv.projectId) return null;
-    const known = this.roots.get(conv.id) ?? null;
-    const ref = refOfProjectAmong(conv.projectId, known);
-    return { id: ref.id, orgId: ref.orgId ?? null };
+  async load() {
+    if (this.loaded) return;
+    try {
+      const raw = await this.readFromDisk();
+      this.session = JSON.parse(raw);
+    } catch {
+    }
+    this.loaded = true;
   }
   /**
-   * Réécrire chaque coffre, en déplaçant ce qui appartient désormais ailleurs.
-   *
-   * Appelé quand un projet a changé de coffre : ses conversations sont écrites
-   * dans le nouveau, et le fichier d'où elles viennent est réécrit sans elles.
+   * Mint a state value binding a login attempt to this server. Returned to the
+   * cloud page and echoed back on the callback, so a redirect we never
+   * initiated cannot install a token.
    */
-  async relocateAll() {
-    await this.load();
-    await this.save();
-  }
-  async save() {
-    const write = this.saveQueue.then(() => this.saveInternal());
-    this.saveQueue = write.catch(() => {
-    });
-    return write;
-  }
-  async list() {
-    await this.load();
-    return Array.from(this.conversations.values()).sort((a, b) => b.updatedAt - a.updatedAt);
+  createState(returnTo) {
+    this.sweepStates();
+    const state = randomBytes4(32).toString("hex");
+    this.pending.set(state, { expiresAt: Date.now() + STATE_TTL_MS, returnTo });
+    return state;
   }
   /**
-   * Les conversations d'un projet.
-   *
-   * Celle qui ne nomme aucun projet — écrite avant le champ, ou qu'une
-   * migration n'a pas su attribuer — n'est rendue que dans les projets de son
-   * propre coffre : elle reste atteignable là où elle a été écrite, sans se
-   * déverser dans toutes les organisations de la machine.
+   * Consume a state — single use, constant-time compare, TTL enforced. Returns
+   * the URL to send the browser back to, or null when the state is unknown or
+   * expired (i.e. a callback this server never initiated).
    */
-  async listForProject(ref) {
-    const belongs = await this.matcherForProject(ref);
-    return (await this.list()).filter(belongs);
+  consumeState(candidate) {
+    this.sweepStates();
+    for (const [state, entry] of this.pending) {
+      const a = Buffer.from(state);
+      const b = Buffer.from(candidate);
+      if (a.length === b.length && timingSafeEqual2(a, b)) {
+        this.pending.delete(state);
+        return entry.expiresAt > Date.now() ? entry.returnTo : null;
+      }
+    }
+    return null;
   }
-  /**
-   * Le test d'appartenance à un projet, préparé une fois.
-   *
-   * Le flux temps réel en a besoin autant que la liste : une conversation qui
-   * arrive par événement doit passer le même filtre, sans quoi elle se
-   * réinvite dans un projet qui ne l'a jamais demandée.
-   */
-  async matcherForProject(ref) {
-    await this.load();
-    let projectRoot2 = null;
-    try {
-      projectRoot2 = ref.orgId === void 0 ? rootOfProjectAmong(ref.id, null) : rootOfProjectRef({ id: ref.id, orgId: ref.orgId ?? null });
-    } catch {
-      projectRoot2 = null;
+  sweepStates() {
+    const now = Date.now();
+    for (const [state, entry] of this.pending) {
+      if (entry.expiresAt <= now) this.pending.delete(state);
     }
-    return (conv) => {
-      if (conv.projectId) return conv.projectId === ref.id;
-      if (!projectRoot2) return true;
-      return this.roots.get(conv.id) === projectRoot2;
-    };
   }
-  async get(id) {
-    await this.load();
-    return this.conversations.get(id) ?? null;
+  async save() {
+    await mkdir9(dirname6(await this.getFilePath()), { recursive: true });
+    const filePath = await this.getFilePath();
+    const tmpPath = filePath + ".tmp";
+    await writeFile9(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await rename9(tmpPath, filePath);
+    await chmod8(filePath, 384);
   }
-  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId, projectId, orgId) {
+  /** Store the session token obtained from the one-time-token exchange. */
+  async set(cloudUrl, token) {
     await this.load();
-    const now = Date.now();
-    const conv = {
-      id: randomUUID3(),
-      projectId,
-      title: title ?? "New conversation",
-      messages: [],
-      isCli,
-      runner,
-      providerId,
-      workflowId,
-      workflowType,
-      kanbanBoardId,
-      kanbanCardId,
-      createdAt: now,
-      updatedAt: now
-    };
-    this.conversations.set(conv.id, conv);
-    if (projectId && orgId !== void 0) {
-      this.roots.set(conv.id, vaultFor({ id: projectId, orgId }).root);
-    }
+    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
     await this.save();
-    this.events.emit("changed", { type: "created", conversation: this.snapshotConversation(conv) });
-    return conv;
   }
-  async update(id, patch, options) {
+  /** The decrypted session token, or null when not logged in. */
+  async getToken() {
     await this.load();
-    const conv = this.conversations.get(id);
-    if (!conv) return null;
-    if (patch.title !== void 0) conv.title = patch.title;
-    if (patch.messages !== void 0) conv.messages = patch.messages;
-    if (patch.contextUsage !== void 0) conv.contextUsage = patch.contextUsage;
-    if (patch.workflowId !== void 0) conv.workflowId = patch.workflowId;
-    if (patch.archived !== void 0) conv.archived = patch.archived;
-    if (patch.codexThreadId !== void 0) conv.codexThreadId = patch.codexThreadId;
-    if (options?.touch !== false) conv.updatedAt = Date.now();
-    await this.save();
-    if (!options?.silent) {
-      this.events.emit("changed", { type: "updated", conversation: this.snapshotConversation(conv) });
+    if (!this.session) return null;
+    try {
+      return decryptValue(this.session.encryptedToken);
+    } catch {
+      return null;
     }
-    return conv;
   }
   /**
-   * Synchronously update the last assistant message content in memory, then schedule a save.
-   * Used by activeSessionRegistry.persistNow() to avoid the async get() → .then() race.
+   * The cloud this machine is signed into, or null when not linked.
+   *
+   * Needed to tell "an org I am not a member of" apart from "an org of another
+   * cloud instance entirely" — the ids of two clouds share no namespace, so
+   * comparing them without this would call every foreign-cloud project a
+   * permission problem.
    */
-  updateLastAssistantContent(id, content, parts) {
-    const conv = this.conversations.get(id);
-    if (!conv) return;
-    const lastMsg = conv.messages[conv.messages.length - 1];
-    if (!lastMsg || lastMsg.role !== "assistant") return;
-    lastMsg.content = content;
-    if (parts !== void 0) lastMsg.parts = parts;
-    conv.updatedAt = Date.now();
-    this.save().catch(() => {
-    });
-  }
-  async listByKanbanBoardId(boardId) {
+  async getCloudUrl() {
     await this.load();
-    return Array.from(this.conversations.values()).filter((c) => c.kanbanBoardId === boardId);
+    return this.session?.cloudUrl ?? null;
   }
-  async listByKanbanCardId(cardId) {
-    await this.load();
-    return Array.from(this.conversations.values()).filter((c) => c.kanbanCardId === cardId);
+  async isLinked() {
+    return await this.getToken() !== null;
   }
-  async delete(id) {
+  /** Forget the session (sign-out). */
+  async clear() {
     await this.load();
-    const existed = this.conversations.delete(id);
-    await this.save();
-    if (existed) {
-      this.events.emit("changed", { type: "deleted", id });
+    this.session = null;
+    this.pending.clear();
+    try {
+      await unlink2(await this.getFilePath());
+    } catch {
     }
   }
-  onChanged(handler) {
-    this.events.on("changed", handler);
-  }
-  offChanged(handler) {
-    this.events.off("changed", handler);
+};
+var cloudSessionStore = new CloudSessionStore();
+
+// ../server/src/services/cloud-api.ts
+var DEFAULT_CLOUD_API_URL = "https://api.runeya.dev";
+var DEFAULT_CLOUD_APP_URL = "https://runeya.dev";
+function getCloudApiUrl() {
+  return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
+}
+function getCloudAppUrl() {
+  return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
+}
+var CloudNotLinkedError = class extends Error {
+  code = "CLOUD_NOT_LINKED";
+  constructor() {
+    super("Not linked to the Runeya cloud.");
+    this.name = "CloudNotLinkedError";
   }
 };
-var conversationStore = new ConversationStore();
+async function cloudFetch(path, init = {}) {
+  const token = await cloudSessionStore.getToken();
+  if (!token) throw new CloudNotLinkedError();
+  return fetch(`${getCloudApiUrl()}${path}`, {
+    method: init.method ?? "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
+      [APP_VERSION_HEADER]: appVersion,
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
+    // 15s suits a JSON call; attachment downloads pass a longer budget.
+    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
+  });
+}
 
 // ../server/src/trpc/routers/setup.ts
 var setupRouter = router({
@@ -4844,20 +4856,20 @@ var settingsRouter = router({
     });
     if (config?.wildcardDomain?.trim()) {
       const sanitisedDomain = config.wildcardDomain.replace(/^\*\./, "").replace(/[^a-z0-9.-]/gi, "");
-      const probe2 = `probe.${sanitisedDomain}`;
+      const probe = `probe.${sanitisedDomain}`;
       try {
-        const addresses = await dns.resolve4(probe2);
+        const addresses = await dns.resolve4(probe);
         const pointsToLocalhost = addresses.some((a) => a === "127.0.0.1");
         checks.push({
           id: "dns_resolution",
           ok: pointsToLocalhost,
-          message: pointsToLocalhost ? `${probe2} \u2192 127.0.0.1 \u2713` : `${probe2} r\xE9sout vers ${addresses.join(", ")} (attendu : 127.0.0.1)`
+          message: pointsToLocalhost ? `${probe} \u2192 127.0.0.1 \u2713` : `${probe} r\xE9sout vers ${addresses.join(", ")} (attendu : 127.0.0.1)`
         });
       } catch {
         checks.push({
           id: "dns_resolution",
           ok: false,
-          message: `${probe2} ne r\xE9sout pas \u2014 v\xE9rifiez le DNS wildcard`
+          message: `${probe} ne r\xE9sout pas \u2014 v\xE9rifiez le DNS wildcard`
         });
       }
     }
@@ -7951,7 +7963,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-74WZPMVQ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-UUSQK6S2.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -8076,6 +8088,15 @@ async function runClaudeViaPty(params) {
           });
         } catch {
         }
+        if (skipTokenInstructions && entry.type === "assistant" && entry.message?.stop_reason === "end_turn") {
+          settle({
+            output: state.assistantText,
+            tokenStatus: "none",
+            tokenMessage: "",
+            actualSessionId: sessionId
+          });
+          return;
+        }
         if (!skipTokenInstructions) {
           const { status, message, branchChoice } = parseEndToken(state.assistantText);
           if (status !== "none") {
@@ -8094,11 +8115,21 @@ async function runClaudeViaPty(params) {
       cli: "claude",
       args,
       env: params.injectedEnv && Object.keys(params.injectedEnv).length > 0 ? params.injectedEnv : void 0,
+      // Le répertoire que l'appelant a résolu — celui du projet de la
+      // conversation. Sans lui, le PTY naissait dans le répertoire de l'agent,
+      // c'est-à-dire là où Runeya a été lancé : une carte kanban du projet A
+      // faisait travailler le CLI dans le code de Runeya.
+      cwd: params.cwd || void 0,
       cols: 120,
       rows: 30,
       sessionId,
       enableMcp: !!params.mcpConfig,
-      mcpApiBaseUrl: params.apiBaseUrl || void 0
+      mcpApiBaseUrl: params.apiBaseUrl || void 0,
+      // Sans lui, l'agent lance le CLI et son serveur MCP sans RUNEYA_API_TOKEN :
+      // toutes les tools répondent « No auth token available », et `$RUNEYA_API_TOKEN`
+      // ne résout à rien dans le shell du CLI. Le jeton est déjà là — la file le
+      // signe elle-même, faute de requête HTTP d'où le tirer.
+      mcpApiToken: params.apiToken || void 0
     }).then(({ spawnId: id }) => {
       spawnId = id;
       if (signal.aborted) {
@@ -8673,7 +8704,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-74WZPMVQ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-UUSQK6S2.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -9359,7 +9390,10 @@ async function* drainSession(session, signal, isReconnect) {
 }
 async function buildCliSystemContext(conv, jwt) {
   const allServices = await serviceStore.list();
-  const resolvedServices = await Promise.all(allServices.map(resolveServiceVariables));
+  const ref = conv ? await conversationStore.projectRefOf(conv) : null;
+  const project = ref ? await projectStore.get(ref) : null;
+  const ownServices = project ? allServices.filter((svc) => project.serviceIds.includes(svc.id)) : allServices;
+  const resolvedServices = await Promise.all(ownServices.map(resolveServiceVariables));
   let systemContext = generateAdminLlmsTxt(resolvedServices, jwt);
   if (conv?.kanbanBoardId) {
     const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
@@ -9529,9 +9563,7 @@ var StoredMessageSchema = z16.object({
   parts: z16.array(MessagePartSchema).max(200).optional()
 });
 async function conversationCwd(conv) {
-  const ref = await conversationStore.projectRefOf(conv);
-  if (!ref) return resolveAgentCwd({});
-  return resolveAgentCwd({ projectId: ref.id, orgId: ref.orgId });
+  return resolveConversationCwd(conv.id);
 }
 var chatRouter = router({
   conversations: router({
@@ -10219,9 +10251,13 @@ ${apiDocs}` : systemContext;
           cli,
           args,
           env: injectedEnv,
-          // An explicit cwd wins; otherwise the service's directory, then the
-          // project's — never the directory the server was launched in.
-          cwd: input.cwd ?? await resolveAgentCwd({
+          // An explicit cwd wins; then le projet de la conversation, s'il y en
+          // a une : c'est elle que ce terminal poursuit, et son projet n'est
+          // pas forcément celui ouvert dans l'onglet — ouvrir le terminal
+          // d'une carte kanban depuis ailleurs lançait le CLI dans le
+          // répertoire de lancement de Runeya. Sinon le service, puis le
+          // projet actif — jamais le répertoire du serveur.
+          cwd: input.cwd ?? (input.sessionId ? await resolveConversationCwd(input.sessionId) : void 0) ?? await resolveAgentCwd({
             serviceId: input.serviceId,
             projectId: input.projectId,
             orgId: input.orgId
@@ -11588,9 +11624,11 @@ async function runNodeCall(conversationId, node, systemContext, userMessage, run
     const result = await state.runner.run({
       agentId: runOverrides?.agentId ?? agentManager.getDefaultAgentId() ?? void 0,
       // Without this the CLI would run wherever the server was launched, whatever
-      // project the scenario belongs to. No project: left unset, so the runner
-      // keeps its own default rather than being sent to this machine's path.
-      cwd: await resolveAgentCwd({ projectId: runOverrides?.projectId, orgId: runOverrides?.orgId }),
+      // project the scenario belongs to. Read from the conversation, so un lancement
+      // sans requête HTTP — la file kanban — est ancré comme les autres. No project:
+      // left unset, so the runner keeps its own default rather than being sent to
+      // this machine's path.
+      cwd: await resolveConversationCwd(conversationId),
       sessionId: state.sessionId,
       prompt: currentPrompt,
       isResume: state.isResume,
@@ -12468,7 +12506,6 @@ var scenarioRouter = router({
         runnerOverride: input.runnerOverride,
         modelOverride: input.modelOverride,
         agentId: input.agentId,
-        projectId: input.projectId,
         orgId: input.orgId
       }, !!input.resume);
       await new Promise((r) => setTimeout(r, 10));
@@ -12664,7 +12701,8 @@ var debugRouter = router({
 });
 
 // ../server/src/trpc/routers/diagnostics.ts
-import { z as z21 } from "zod";
+import { z as z20 } from "zod";
+import { TRPCError as TRPCError18 } from "@trpc/server";
 
 // ../server/src/services/log-buffer.ts
 import { EventEmitter as EventEmitter4 } from "events";
@@ -12732,132 +12770,10 @@ function onEntry(listener) {
   return () => emitter.off("entry", listener);
 }
 
-// ../server/src/services/instance-registry.ts
-import { mkdir as mkdir16, readdir as readdir5, readFile as readFile15, writeFile as writeFile14, rm as rm3 } from "fs/promises";
-import { join as join19 } from "path";
-import { z as z20 } from "zod";
-var InstanceFileSchema = z20.object({
-  pid: z20.number().int().positive(),
-  port: z20.number().int().min(1).max(65535),
-  agentPort: z20.number().int().min(1).max(65535),
-  cwd: z20.string().max(4096),
-  dataDir: z20.string().max(4096),
-  version: z20.string().max(64),
-  fromDesktop: z20.boolean(),
-  startedAt: z20.number().int().nonnegative()
-});
-function registryDir() {
-  return join19(machineRoot(), "instances");
-}
-function fileFor(pid) {
-  return join19(registryDir(), `${pid}.json`);
-}
-function selfRecord() {
-  return {
-    pid: process.pid,
-    port: env.PORT,
-    agentPort: env.RUNEYA_AGENT_PORT,
-    cwd: process.cwd(),
-    dataDir: env.DATA_DIR,
-    version: process.env["RUNEYA_VERSION"] ?? "unknown",
-    fromDesktop: env.FROM_DESKTOP,
-    startedAt: Date.now()
-  };
-}
-async function registerInstance() {
-  try {
-    await mkdir16(registryDir(), { recursive: true });
-    await writeFile14(fileFor(process.pid), JSON.stringify(selfRecord(), null, 2));
-  } catch (err) {
-    console.log("[instances] Could not register this instance:", err.message);
-  }
-}
-async function unregisterInstance() {
-  await rm3(fileFor(process.pid), { force: true }).catch(() => {
-  });
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
-}
-async function probe(port) {
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}/api/trpc/health.check`, {
-      signal: AbortSignal.timeout(1500)
-    });
-    if (!res.ok) return { ok: false, uptimeMs: null, version: null };
-    const body = await res.json();
-    const data = body.result?.data;
-    return { ok: true, uptimeMs: data?.uptime ?? null, version: data?.version ?? null };
-  } catch {
-    return { ok: false, uptimeMs: null, version: null };
-  }
-}
-async function listInstances() {
-  let files;
-  try {
-    files = await readdir5(registryDir());
-  } catch {
-    return [];
-  }
-  const found = await Promise.all(
-    files.filter((f) => f.endsWith(".json")).map(async (name) => {
-      const path = join19(registryDir(), name);
-      let record;
-      try {
-        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile15(path, "utf8")));
-        if (!parsed.success) {
-          await rm3(path, { force: true }).catch(() => {
-          });
-          return null;
-        }
-        record = parsed.data;
-      } catch {
-        return null;
-      }
-      if (!isProcessAlive(record.pid)) {
-        await rm3(path, { force: true }).catch(() => {
-        });
-        return null;
-      }
-      const { ok, uptimeMs, version } = await probe(record.port);
-      if (!ok) {
-        await rm3(path, { force: true }).catch(() => {
-        });
-        return null;
-      }
-      return {
-        ...record,
-        // Trust the live answer over the file: the file was written at boot
-        // and an upgraded instance would keep claiming its old version.
-        version: version ?? record.version,
-        reachable: true,
-        current: record.pid === process.pid,
-        uptimeMs
-      };
-    })
-  );
-  return dedupeByPort(found.filter((i) => i !== null)).sort((a, b) => Number(b.current) - Number(a.current) || a.port - b.port);
-}
-function dedupeByPort(instances) {
-  const byPort = /* @__PURE__ */ new Map();
-  for (const instance of instances) {
-    const kept = byPort.get(instance.port);
-    if (!kept || instance.current || !kept.current && instance.startedAt > kept.startedAt) {
-      byPort.set(instance.port, instance);
-    }
-  }
-  return [...byPort.values()];
-}
-
 // ../server/src/trpc/routers/diagnostics.ts
 var diagnosticsRouter = router({
   /** Backlog for a client that just opened the panel. */
-  recentLogs: protectedProcedure.input(z21.object({ limit: z21.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
+  recentLogs: protectedProcedure.input(z20.object({ limit: z20.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
   /**
    * Live log stream.
    *
@@ -12866,7 +12782,7 @@ var diagnosticsRouter = router({
    * silently loses lines, which is precisely what someone watching a boot
    * failure cannot afford.
    */
-  streamLogs: protectedProcedure.input(z21.object({ afterSeq: z21.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
+  streamLogs: protectedProcedure.input(z20.object({ afterSeq: z20.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
     for (const entry of entriesSince(input?.afterSeq ?? 0)) yield entry;
     const queue = [];
     let wake = null;
@@ -12891,11 +12807,33 @@ var diagnosticsRouter = router({
     }
   }),
   /** Every Runeya answering on this machine, this one included. */
-  instances: protectedProcedure.query(() => listInstances())
+  instances: protectedProcedure.query(() => listInstances()),
+  /**
+   * Stop another Runeya on this machine — its agent first, then its server.
+   *
+   * The pid is a *selector*, not an instruction: it is looked up in the list
+   * `listInstances()` has just vouched for, and anything absent from it is
+   * refused. That is what keeps this from being a way to signal arbitrary
+   * processes with the server's privileges.
+   */
+  killInstance: protectedProcedure.input(z20.object({ pid: z20.number().int().positive() })).mutation(async ({ input }) => {
+    try {
+      return await killInstance(input.pid);
+    } catch (err) {
+      const reason = err.message;
+      if (reason === "instance-not-found") {
+        throw new TRPCError18({ code: "NOT_FOUND", message: "No live Runeya instance with this pid." });
+      }
+      if (reason === "instance-is-current") {
+        throw new TRPCError18({ code: "BAD_REQUEST", message: "This instance cannot stop itself." });
+      }
+      throw new TRPCError18({ code: "INTERNAL_SERVER_ERROR", message: reason });
+    }
+  })
 });
 
 // ../server/src/trpc/routers/kanban-queue.ts
-import { z as z22 } from "zod";
+import { z as z21 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
 import { randomUUID as randomUUID10 } from "crypto";
@@ -13083,36 +13021,36 @@ var kanbanQueue = new KanbanQueueService();
 // ../server/src/trpc/routers/kanban-queue.ts
 var kanbanQueueRouter = router({
   getState: protectedProcedure.query(() => kanbanQueue.getState()),
-  add: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    cardId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
+  add: protectedProcedure.input(z21.object({
+    boardId: z21.string().max(128),
+    cardId: z21.string().max(128),
+    runner: z21.enum(["claude-code", "codex"]).optional(),
+    model: z21.string().max(128).optional(),
+    scenarioId: z21.string().max(128).optional(),
     // Le projet ouvert quand la carte a été mise en file : la conversation
     // qui en naîtra lui appartient, plutôt que de rester orpheline et de
     // s'afficher dans tous les projets.
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+    projectId: z21.string().max(128).optional(),
+    orgId: z21.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
-  addColumn: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    columnId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+  addColumn: protectedProcedure.input(z21.object({
+    boardId: z21.string().max(128),
+    columnId: z21.string().max(128),
+    runner: z21.enum(["claude-code", "codex"]).optional(),
+    model: z21.string().max(128).optional(),
+    scenarioId: z21.string().max(128).optional(),
+    projectId: z21.string().max(128).optional(),
+    orgId: z21.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
   }),
-  remove: protectedProcedure.input(z22.object({ itemId: z22.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
+  remove: protectedProcedure.input(z21.object({ itemId: z21.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
   stopAll: protectedProcedure.mutation(() => {
     kanbanQueue.stopAll();
     return { ok: true };
   }),
-  setMaxConcurrent: protectedProcedure.input(z22.object({ max: z22.number().int().min(1).max(20) })).mutation(({ input }) => {
+  setMaxConcurrent: protectedProcedure.input(z21.object({ max: z21.number().int().min(1).max(20) })).mutation(({ input }) => {
     kanbanQueue.setMaxConcurrent(input.max);
     return kanbanQueue.getState();
   }),
@@ -13146,12 +13084,12 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
-import { mkdir as mkdir17, readdir as readdir6, rm as rm4, stat as stat5, writeFile as writeFile15 } from "fs/promises";
+import { mkdir as mkdir16, readdir as readdir5, rm as rm3, stat as stat5, writeFile as writeFile14 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { join as join20 } from "path";
-import { z as z23 } from "zod";
-import { TRPCError as TRPCError18 } from "@trpc/server";
+import { join as join19 } from "path";
+import { z as z22 } from "zod";
+import { TRPCError as TRPCError19 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
     boardId,
@@ -13200,37 +13138,37 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join20(tmpdir(), "runeya-kanban-attachments");
+  return join19(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
-    for (const name of await readdir6(dir)) {
-      const path = join20(dir, name);
+    for (const name of await readdir5(dir)) {
+      const path = join19(dir, name);
       const info = await stat5(path).catch(() => null);
-      if (info && info.mtimeMs < cutoff) await rm4(path, { force: true });
+      if (info && info.mtimeMs < cutoff) await rm3(path, { force: true });
     }
   } catch {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join20(machineRoot(), "kanban-attachments")];
+  return [attachmentCacheDir(), join19(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
-      await mkdir17(dir, { recursive: true });
-      const path = join20(dir, safeLocalName(id, name));
-      await writeFile15(path, body);
+      await mkdir16(dir, { recursive: true });
+      const path = join19(dir, safeLocalName(id, name));
+      await writeFile14(path, body);
       void purgeStaleAttachments(dir);
       return path;
     } catch (err) {
       refusals.push(`${dir} (${err instanceof Error ? err.message : String(err)})`);
     }
   }
-  throw new TRPCError18({
+  throw new TRPCError19({
     code: "INTERNAL_SERVER_ERROR",
     message: `Impossible d'\xE9crire la pi\xE8ce jointe sur cette machine. Emplacements essay\xE9s : ${refusals.join(" ; ")}. V\xE9rifiez les droits d'\xE9criture, ou l'espace disque.`
   });
@@ -13246,9 +13184,9 @@ var kanbanRouter = router({
    * card graph, so listing them in full would be megabytes to answer "which
    * boards exist?". Use `getBoard` for the cards of one.
    */
-  listBoards: protectedProcedure.input(z23.object({
-    includeArchived: z23.boolean().optional(),
-    organizationId: z23.string().max(128).optional()
+  listBoards: protectedProcedure.input(z22.object({
+    includeArchived: z22.boolean().optional(),
+    organizationId: z22.string().max(128).optional()
   }).optional()).query(async ({ input }) => {
     const { organizationId, boards } = await kanbanStore.list(
       input?.includeArchived ?? false,
@@ -13274,7 +13212,7 @@ var kanbanRouter = router({
     };
   }),
   /** One board: its columns, and the cards in each. */
-  getBoard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => {
+  getBoard: protectedProcedure.input(z22.object({ boardId: z22.string().max(128) })).query(async ({ input }) => {
     const board = await kanbanStore.get(input.boardId);
     if (!board) return { board: null };
     const { links } = await kanbanStore.cardLinks(input.boardId);
@@ -13313,11 +13251,11 @@ var kanbanRouter = router({
    * organization — or one board when `boardId` is given. Archived boards are
    * left out: they are what the team decided to stop looking at.
    */
-  searchCards: protectedProcedure.input(z23.object({
-    query: z23.string().min(1).max(256),
-    boardId: z23.string().max(128).optional(),
-    limit: z23.number().int().min(1).max(100).optional(),
-    organizationId: z23.string().max(128).optional()
+  searchCards: protectedProcedure.input(z22.object({
+    query: z22.string().min(1).max(256),
+    boardId: z22.string().max(128).optional(),
+    limit: z22.number().int().min(1).max(100).optional(),
+    organizationId: z22.string().max(128).optional()
   })).query(async ({ input }) => {
     const needle = normalize(input.query);
     const ids = input.boardId ? [input.boardId] : (await kanbanStore.list(false, input.organizationId)).boards.map((b) => b.id);
@@ -13336,10 +13274,10 @@ var kanbanRouter = router({
    * qu'un `commentCount`, et rien n'en donnait le texte. Cette route est la
    * relecture, pour une seule carte : c'est le journal qui pèse, pas le reste.
    */
-  getCardComments: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    limit: z23.number().int().min(1).max(200).optional()
+  getCardComments: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    limit: z22.number().int().min(1).max(200).optional()
   })).query(async ({ input }) => {
     const history = await kanbanStore.cardHistory(input.boardId, input.cardId);
     const comments = history.filter((e) => e.type === "comment");
@@ -13368,18 +13306,18 @@ var kanbanRouter = router({
    * `getBoard` en donne déjà l'essentiel carte par carte ; cette route sert
    * quand c'est l'arbre lui-même qu'on veut, dates et auteurs compris.
    */
-  getCardLinks: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
+  getCardLinks: protectedProcedure.input(z22.object({ boardId: z22.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
   /**
    * Rattacher une carte à une carte parente, ou l'en détacher.
    *
    * Sans `parentCardId`, le lien est retiré. Le parent peut vivre sur un autre
    * tableau : `parentBoardId` le désigne alors, sinon c'est celui de la carte.
    */
-  setCardParent: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    parentCardId: z23.string().max(128).optional(),
-    parentBoardId: z23.string().max(128).optional()
+  setCardParent: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    parentCardId: z22.string().max(128).optional(),
+    parentBoardId: z22.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardParent(
       input.boardId,
@@ -13387,35 +13325,35 @@ var kanbanRouter = router({
       input.parentCardId ? { boardId: input.parentBoardId ?? input.boardId, cardId: input.parentCardId } : null
     );
     if (!ok) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "The cloud refused the link (unknown card, or a cycle)." });
     }
     return { ok: true };
   }),
-  moveCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    targetColumn: z23.string().max(256)
+  moveCard: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    targetColumn: z22.string().max(256)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "move_card", columnTitle: input.targetColumn }
     ]);
     return { ok: true };
   }),
-  addComment: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    comment: z23.string().max(2e4)
+  addComment: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    cardId: z22.string().max(128),
+    comment: z22.string().max(2e4)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "add_comment", comment: input.comment }
     ]);
     return { ok: true };
   }),
-  addCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    column: z23.string().max(256),
-    title: z23.string().max(512),
-    content: z23.string().max(2e4).optional()
+  addCard: protectedProcedure.input(z22.object({
+    boardId: z22.string().max(128),
+    column: z22.string().max(256),
+    title: z22.string().max(512),
+    content: z22.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     await executeKanbanBoardCommands(input.boardId, [
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
@@ -13427,28 +13365,28 @@ var kanbanRouter = router({
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z23.object({ attachmentId: z23.string().max(128) })).mutation(async ({ input }) => {
+  downloadAttachment: protectedProcedure.input(z22.object({ attachmentId: z22.string().max(128) })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
-      throw new TRPCError18({ code: "BAD_REQUEST", message: "Invalid attachment id" });
+      throw new TRPCError19({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
     const res = await cloudFetch2(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
     if (res.status === 404) {
-      throw new TRPCError18({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
+      throw new TRPCError19({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
     if (!res.ok) {
-      throw new TRPCError18({
+      throw new TRPCError19({
         code: res.status === 403 ? "FORBIDDEN" : "INTERNAL_SERVER_ERROR",
         message: `Cloud refused the attachment (HTTP ${res.status})`
       });
     }
     const declared = Number(res.headers.get("content-length") ?? 0);
     if (declared > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const body = Buffer.from(await res.arrayBuffer());
     if (body.length > MAX_ATTACHMENT_BYTES) {
-      throw new TRPCError18({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
+      throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Attachment too large to download" });
     }
     const contentType = res.headers.get("content-type") ?? "application/octet-stream";
     const disposition = res.headers.get("content-disposition") ?? "";
@@ -13460,20 +13398,21 @@ var kanbanRouter = router({
 });
 
 // ../server/src/trpc/routers/terminal.ts
-import { z as z24 } from "zod";
-import { TRPCError as TRPCError19 } from "@trpc/server";
+import { z as z23 } from "zod";
+import { TRPCError as TRPCError20 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
-  create: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    cwd: z24.string().max(512).optional(),
+  create: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    cwd: z23.string().max(512).optional(),
     /** Anchors the terminal when no explicit cwd is given. */
-    serviceId: z24.string().max(128).optional(),
-    projectId: z24.string().max(128).optional(),
+    serviceId: z23.string().max(128).optional(),
+    projectId: z23.string().max(128).optional(),
     /** L'organisation du projet : un id seul peut en nommer un par organisation. */
-    orgId: z24.string().max(128).nullable().optional(),
-    cols: z24.number().int().min(1).max(512).optional(),
-    rows: z24.number().int().min(1).max(256).optional()
+    orgId: z23.string().max(128).nullable().optional(),
+    cols: z23.number().int().min(1).max(512).optional(),
+    rows: z23.number().int().min(1).max(256).optional(),
+    title: z23.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
@@ -13487,16 +13426,37 @@ var terminalRouter = router({
           orgId: input.orgId
         }),
         cols: input.cols,
-        rows: input.rows
+        rows: input.rows,
+        title: input.title
       }
     );
     return result;
   }),
+  /** Les sessions PTY encore vivantes sur l'agent (onglets à retrouver) */
+  list: protectedProcedure.input(z23.object({ agentId: z23.string().max(128) })).query(async ({ input }) => {
+    return agentManager.agentQuery(
+      input.agentId,
+      "terminal.list"
+    );
+  }),
+  /** Renommer un onglet */
+  rename: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    title: z23.string().max(128)
+  })).mutation(async ({ input }) => {
+    await agentManager.agentMutation(
+      input.agentId,
+      "terminal.rename",
+      { sessionId: input.sessionId, title: input.title }
+    );
+    return { ok: true };
+  }),
   /** Send keystrokes / data to a PTY session */
-  write: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    data: z24.string().max(65536)
+  write: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    data: z23.string().max(65536)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13506,11 +13466,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Resize the PTY */
-  resize: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    cols: z24.number().int().min(1).max(512),
-    rows: z24.number().int().min(1).max(256)
+  resize: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    cols: z23.number().int().min(1).max(512),
+    rows: z23.number().int().min(1).max(256)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13520,9 +13480,9 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Destroy a PTY session */
-  destroy: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128)
+  destroy: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -13532,9 +13492,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Stream PTY output — proxied via AgentWSBridge dynamic subscription */
-  onData: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128)
+  onData: protectedProcedure.input(z23.object({
+    agentId: z23.string().max(128),
+    sessionId: z23.string().max(128),
+    /** Rejouer l'historique de la session avant le flux temps réel. */
+    replay: z23.boolean().optional()
   })).subscription(async function* ({ input }) {
     const queue = [];
     let resolve7 = null;
@@ -13544,7 +13506,7 @@ var terminalRouter = router({
       unsubscribe = agentManager.agentSubscribe(
         input.agentId,
         "terminal.onData",
-        { sessionId: input.sessionId },
+        { sessionId: input.sessionId, replay: input.replay },
         (data) => {
           if (typeof data === "string") queue.push(data);
           if (resolve7) {
@@ -13561,7 +13523,7 @@ var terminalRouter = router({
         }
       );
     } catch (err) {
-      throw new TRPCError19({
+      throw new TRPCError20({
         code: "BAD_REQUEST",
         message: `Cannot subscribe to terminal: ${err.message}`
       });
@@ -13583,11 +13545,11 @@ var terminalRouter = router({
 });
 
 // ../server/src/trpc/routers/utility.ts
-import { z as z25 } from "zod";
+import { z as z24 } from "zod";
 var MAX_WAIT_MS = 5 * 60 * 1e3;
 var utilityRouter = router({
-  wait: protectedProcedure.input(z25.object({
-    ms: z25.number().int().min(0).max(MAX_WAIT_MS)
+  wait: protectedProcedure.input(z24.object({
+    ms: z24.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
     await new Promise((resolve7) => setTimeout(resolve7, input.ms));
     return { waited: input.ms };
@@ -13595,15 +13557,15 @@ var utilityRouter = router({
 });
 
 // ../server/src/trpc/routers/wiki.ts
-import { z as z26 } from "zod";
-import { TRPCError as TRPCError20 } from "@trpc/server";
-import { readFile as readFile16, readdir as readdir7, stat as stat6, realpath, writeFile as writeFile16, mkdir as mkdir18, rename as rename12, rm as rm5 } from "fs/promises";
-import { resolve as resolvePath, join as join21, relative, sep as sep3, dirname as dirname9 } from "path";
-var SCOPE_SCHEMA = z26.union([
-  z26.literal("global"),
-  z26.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+import { z as z25 } from "zod";
+import { TRPCError as TRPCError21 } from "@trpc/server";
+import { readFile as readFile15, readdir as readdir6, stat as stat6, realpath, writeFile as writeFile15, mkdir as mkdir17, rename as rename12, rm as rm4 } from "fs/promises";
+import { resolve as resolvePath, join as join20, relative, sep as sep3, dirname as dirname9 } from "path";
+var SCOPE_SCHEMA = z25.union([
+  z25.literal("global"),
+  z25.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
 ]);
-var REL_PATH_SCHEMA = z26.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+var REL_PATH_SCHEMA = z25.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
   message: "Path must be a relative path without traversal"
 });
 var MAX_FILES = 500;
@@ -13623,36 +13585,36 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "target",
   "out"
 ]);
-var DocsEntrySchema = z26.lazy(() => z26.union([
-  z26.object({ type: z26.literal("file"), name: z26.string(), path: z26.string() }),
-  z26.object({ type: z26.literal("dir"), name: z26.string(), path: z26.string(), children: z26.array(DocsEntrySchema) })
+var DocsEntrySchema = z25.lazy(() => z25.union([
+  z25.object({ type: z25.literal("file"), name: z25.string(), path: z25.string() }),
+  z25.object({ type: z25.literal("dir"), name: z25.string(), path: z25.string(), children: z25.array(DocsEntrySchema) })
 ]));
 async function resolveScope(scope) {
   if (scope === "global") {
     const settings = await settingsManager.getSettings();
     const sub = (settings.globalDocsPath?.trim() || "wiki").replace(/^[\\/]+|[\\/]+$/g, "");
     if (sub.includes("..") || sub.includes("\0")) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir18(dataDirAbs, { recursive: true });
+    await mkdir17(dataDirAbs, { recursive: true });
     const base = dirname9(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir18(target, { recursive: true });
+    await mkdir17(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep3).startsWith(base + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
     }
     return { mode: "local", root };
   }
   const serviceId = scope.slice("service:".length);
   const service = await serviceStore.get(serviceId);
-  if (!service) throw new TRPCError20({ code: "NOT_FOUND", message: "Service introuvable" });
+  if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
-  if (!agentId) throw new TRPCError20({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
+  if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
   const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
   return { mode: "agent", agentId, cwd };
 }
@@ -13660,7 +13622,7 @@ async function walkLocal(root, dir, depth, counter) {
   if (depth > MAX_DEPTH || counter.n >= MAX_FILES) return [];
   let entries2;
   try {
-    entries2 = await readdir7(dir, { withFileTypes: true });
+    entries2 = await readdir6(dir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -13668,7 +13630,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries2) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join21(dir, e.name);
+    const abs = join20(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -13687,7 +13649,7 @@ async function walkLocal(root, dir, depth, counter) {
 }
 async function resolveSafeLocal(root, relPath, requireExist) {
   if (relPath.includes("..") || relPath.startsWith("/")) {
-    throw new TRPCError20({ code: "BAD_REQUEST", message: "Chemin invalide" });
+    throw new TRPCError21({ code: "BAD_REQUEST", message: "Chemin invalide" });
   }
   const target = resolvePath(root, relPath);
   if (requireExist) {
@@ -13695,10 +13657,10 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     try {
       real = await realpath(target);
     } catch {
-      throw new TRPCError20({ code: "NOT_FOUND", message: "Chemin introuvable" });
+      throw new TRPCError21({ code: "NOT_FOUND", message: "Chemin introuvable" });
     }
     if (real !== root && !(real + sep3).startsWith(root + sep3)) {
-      throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+      throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
     }
     return real;
   }
@@ -13710,12 +13672,12 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     realParent = parent;
   }
   if (realParent !== root && !(realParent + sep3).startsWith(root + sep3)) {
-    throw new TRPCError20({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
+    throw new TRPCError21({ code: "FORBIDDEN", message: "Hors du dossier autoris\xE9" });
   }
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
 var wikiRouter = router({
-  list: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).output(z26.object({ root: z26.string(), entries: z26.array(DocsEntrySchema), truncated: z26.boolean() })).query(async ({ input }) => {
+  list: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA })).output(z25.object({ root: z25.string(), entries: z25.array(DocsEntrySchema), truncated: z25.boolean() })).query(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
@@ -13724,9 +13686,9 @@ var wikiRouter = router({
     const entries2 = await walkLocal(target.root, target.root, 0, counter);
     return { root: target.root, entries: entries2, truncated: counter.n >= MAX_FILES };
   }),
-  read: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z26.object({ path: z26.string(), content: z26.string() })).query(async ({ input }) => {
+  read: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z25.object({ path: z25.string(), content: z25.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -13734,27 +13696,27 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
     const s = await stat6(file);
-    if (!s.isFile()) throw new TRPCError20({ code: "BAD_REQUEST", message: "Pas un fichier" });
-    if (s.size > MAX_FILE_BYTES) throw new TRPCError20({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
-    const content = await readFile16(file, "utf-8");
+    if (!s.isFile()) throw new TRPCError21({ code: "BAD_REQUEST", message: "Pas un fichier" });
+    if (s.size > MAX_FILE_BYTES) throw new TRPCError21({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
+    const content = await readFile15(file, "utf-8");
     return { path: input.path, content };
   }),
-  write: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z26.string().max(5e6) })).mutation(async ({ input }) => {
+  write: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z25.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir18(dirname9(file), { recursive: true });
-    await writeFile16(file, input.content, "utf-8");
+    await mkdir17(dirname9(file), { recursive: true });
+    await writeFile15(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
-  createFile: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createFile: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
-      throw new TRPCError20({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
+      throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
@@ -13763,24 +13725,24 @@ var wikiRouter = router({
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
       await stat6(file);
-      throw new TRPCError20({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
+      throw new TRPCError21({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
-      if (err instanceof TRPCError20) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir18(dirname9(file), { recursive: true });
-    await writeFile16(file, "", "utf-8");
+    await mkdir17(dirname9(file), { recursive: true });
+    await writeFile15(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
-  createDir: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createDir: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir18(dir, { recursive: true });
+    await mkdir17(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
-  rename: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  rename: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
@@ -13789,35 +13751,35 @@ var wikiRouter = router({
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
       await stat6(to);
-      throw new TRPCError20({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
+      throw new TRPCError21({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
-      if (err instanceof TRPCError20) throw err;
+      if (err instanceof TRPCError21) throw err;
     }
-    await mkdir18(dirname9(to), { recursive: true });
+    await mkdir17(dirname9(to), { recursive: true });
     await rename12(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
-  ensureRoot: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+  ensureRoot: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
     if (input.scope === "global") {
       await resolveScope("global");
       return { ok: true };
     }
     const serviceId = input.scope.slice("service:".length);
     const service = await serviceStore.get(serviceId);
-    if (!service) throw new TRPCError20({ code: "NOT_FOUND", message: "Service introuvable" });
+    if (!service) throw new TRPCError21({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
-    if (!agentId) throw new TRPCError20({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
+    if (!agentId) throw new TRPCError21({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
     const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
-  delete: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z25.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
-    if (fp === target.root) throw new TRPCError20({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
-    await rm5(fp, { recursive: true, force: true });
+    if (fp === target.root) throw new TRPCError21({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
+    await rm4(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
 });
@@ -13836,14 +13798,14 @@ var configRouter = router({
 });
 
 // ../server/src/trpc/routers/cloud-sync.ts
-import { z as z27 } from "zod";
-import { TRPCError as TRPCError21 } from "@trpc/server";
+import { z as z26 } from "zod";
+import { TRPCError as TRPCError22 } from "@trpc/server";
 
 // ../server/src/services/org-sync-scope.ts
 import { access as access2 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join21 } from "path";
 async function isMaterialized(root) {
-  return access2(join22(root, "project.json")).then(() => true, () => false);
+  return access2(join21(root, "project.json")).then(() => true, () => false);
 }
 async function orgsToSync() {
   const cloudUrl = getCloudApiUrl();
@@ -13905,16 +13867,16 @@ async function reconcileOrgCanary(orgId) {
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID11 } from "crypto";
-import { mkdir as mkdir20, rm as rm6 } from "fs/promises";
+import { mkdir as mkdir19, rm as rm5 } from "fs/promises";
 import * as Y from "yjs";
 
 // ../server/src/services/org-lock.ts
-import { open as open2, readFile as readFile17, unlink as unlink4, mkdir as mkdir19 } from "fs/promises";
+import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir18 } from "fs/promises";
 import { readFileSync, unlinkSync } from "fs";
-import { join as join23 } from "path";
+import { join as join22 } from "path";
 var held = /* @__PURE__ */ new Set();
 function lockPath(orgId) {
-  return join23(orgVaultRoot(orgId), "org.lock");
+  return join22(orgVaultRoot(orgId), "org.lock");
 }
 function isRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -13927,7 +13889,7 @@ function isRunning(pid) {
 }
 async function readLock(path) {
   try {
-    const parsed = JSON.parse(await readFile17(path, "utf-8"));
+    const parsed = JSON.parse(await readFile16(path, "utf-8"));
     return typeof parsed?.pid === "number" ? parsed : null;
   } catch {
     return null;
@@ -13935,7 +13897,7 @@ async function readLock(path) {
 }
 async function acquireOrgLock(orgId) {
   const path = lockPath(orgId);
-  await mkdir19(orgVaultRoot(orgId), { recursive: true });
+  await mkdir18(orgVaultRoot(orgId), { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await open2(path, "wx");
@@ -14346,7 +14308,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir20(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir19(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -14362,7 +14324,7 @@ var OrgSyncConnection = class {
   async unfollowProject(projectId) {
     this.tracked.delete(projectId);
     await projectStore.forgetLocally({ id: projectId, orgId: this.link.orgId });
-    await rm6(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
+    await rm5(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
     });
   }
   /**
@@ -14722,8 +14684,8 @@ var CloudSyncBridge = class {
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir8, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir21, copyFile, rename as rename13, stat as stat7 } from "fs/promises";
-import { join as join24 } from "path";
+import { readdir as readdir7, readFile as readFile17, writeFile as writeFile16, mkdir as mkdir20, copyFile, rename as rename13, stat as stat7 } from "fs/promises";
+import { join as join23 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes5 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 function isAgentTriplet(value) {
@@ -14780,7 +14742,7 @@ async function rootsOfOrg(orgId) {
 }
 async function jsonFilesIn(root) {
   try {
-    const entries2 = await readdir8(root, { withFileTypes: true });
+    const entries2 = await readdir7(root, { withFileTypes: true });
     return entries2.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
   } catch {
     return [];
@@ -14803,10 +14765,10 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const touchedRoots = /* @__PURE__ */ new Set();
   for (const vaultRoot of await rootsOfOrg(orgId)) {
     for (const name of await jsonFilesIn(vaultRoot)) {
-      const path = join24(vaultRoot, name);
+      const path = join23(vaultRoot, name);
       let parsed;
       try {
-        parsed = JSON.parse(await readFile18(path, "utf-8"));
+        parsed = JSON.parse(await readFile17(path, "utf-8"));
       } catch {
         continue;
       }
@@ -14820,21 +14782,21 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backups = [];
   for (const vaultRoot of touchedRoots) {
-    const backupDir = join24(vaultRoot, `backup-key-${stamp}`);
-    await mkdir21(backupDir, { recursive: true });
+    const backupDir = join23(vaultRoot, `backup-key-${stamp}`);
+    await mkdir20(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
-      await copyFile(join24(vaultRoot, name), join24(backupDir, name));
+      await copyFile(join23(vaultRoot, name), join23(backupDir, name));
     }
     for (const name of [".encryption.key.enc", ".runeya-verify"]) {
-      if (await exists(join24(vaultRoot, name))) {
-        await copyFile(join24(vaultRoot, name), join24(backupDir, name));
+      if (await exists(join23(vaultRoot, name))) {
+        await copyFile(join23(vaultRoot, name), join23(backupDir, name));
       }
     }
     backups.push(backupDir);
   }
   for (const item of pending) {
     const tmp = item.path + ".tmp";
-    await writeFile17(tmp, item.content, "utf-8");
+    await writeFile16(tmp, item.content, "utf-8");
     await rename13(tmp, item.path);
   }
   await installOrgKey(orgId, newKey, masterPassword);
@@ -14866,7 +14828,7 @@ async function assertOrgReadable(orgId) {
     await assertOrgVaultReadable(orgId);
   } catch (err) {
     if (err instanceof OrgVaultUnreadableError) {
-      throw new TRPCError21({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     throw err;
   }
@@ -14876,10 +14838,10 @@ async function assertOrgKey(orgId) {
     await reconcileOrgCanary(orgId);
   } catch (err) {
     if (err instanceof OrgKeyMismatchError) {
-      throw new TRPCError21({ code: "FORBIDDEN", message: err.message });
+      throw new TRPCError22({ code: "FORBIDDEN", message: err.message });
     }
     if (err instanceof CanaryUnavailableError) {
-      throw new TRPCError21({ code: "PRECONDITION_FAILED", message: err.message });
+      throw new TRPCError22({ code: "PRECONDITION_FAILED", message: err.message });
     }
     throw err;
   }
@@ -14896,10 +14858,10 @@ var cloudSyncRouter = router({
    * "open this project" is the whole gesture.
    */
   trackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      cloudUrl: z26.string().url().max(2048),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
@@ -14914,7 +14876,7 @@ var cloudSyncRouter = router({
       return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError21({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -14933,18 +14895,18 @@ var cloudSyncRouter = router({
    * fusionné.
    */
   publishProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      cloudUrl: z26.string().url().max(2048),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
     if (!local) {
-      throw new TRPCError21({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_LOCAL" });
     }
     if (await projectStore.get({ id: input.projectId, orgId: input.orgId })) {
-      throw new TRPCError21({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
+      throw new TRPCError22({ code: "CONFLICT", message: "PROJECT_ALREADY_IN_ORG" });
     }
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
@@ -14963,7 +14925,7 @@ var cloudSyncRouter = router({
       await cloudSyncBridge.followProject(input.orgId, input.projectId);
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
-        throw new TRPCError21({ code: "CONFLICT", message: err.code, cause: err });
+        throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
       }
       throw err;
     }
@@ -14977,16 +14939,16 @@ var cloudSyncRouter = router({
    * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
    * les yeux — donc le canari est rapatrié et jugé ici.
    */
-  checkOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i)
+  checkOrgKey: protectedProcedure.input(z26.object({
+    orgId: z26.string().min(1).max(128),
+    keyHex: z26.string().length(64).regex(/^[0-9a-f]+$/i)
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
       { method: "GET" }
     );
     if (!res.ok) {
-      throw new TRPCError21({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
+      throw new TRPCError22({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
     }
     const { canary } = await res.json();
     if (typeof canary !== "string") return { matches: false, published: false };
@@ -15002,10 +14964,10 @@ var cloudSyncRouter = router({
    * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
    * organisations et la machine gardent leur clé.
    */
-  adoptOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i),
-    masterPassword: z27.string().min(1).max(1024)
+  adoptOrgKey: protectedProcedure.input(z26.object({
+    orgId: z26.string().min(1).max(128),
+    keyHex: z26.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z26.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const report = await adoptOrgKey(
       input.orgId,
@@ -15029,10 +14991,10 @@ var cloudSyncRouter = router({
    * Elle ne re-chiffre rien : ce qui a déjà été synchronisé sous l'ancienne clé
    * reste illisible. L'interface le dit avant de la déclencher.
    */
-  resetOrgKey: protectedProcedure.input(z27.object({ orgId: z27.string().min(1).max(128) })).mutation(async ({ input }) => {
+  resetOrgKey: protectedProcedure.input(z26.object({ orgId: z26.string().min(1).max(128) })).mutation(async ({ input }) => {
     const canary = await readVerifyFile(await keyRoot());
     if (!canary) {
-      throw new TRPCError21({
+      throw new TRPCError22({
         code: "PRECONDITION_FAILED",
         message: "Cette machine n'a pas encore de cl\xE9 de chiffrement."
       });
@@ -15043,7 +15005,7 @@ var cloudSyncRouter = router({
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
-      throw new TRPCError21({
+      throw new TRPCError22({
         code: res.status === 403 ? "FORBIDDEN" : "BAD_GATEWAY",
         message: detail || `ORG_KEY_RESET_FAILED (${res.status})`
       });
@@ -15059,9 +15021,9 @@ var cloudSyncRouter = router({
    * every other member and for this one on another machine.
    */
   untrackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
@@ -15077,9 +15039,9 @@ var cloudSyncRouter = router({
    * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
    */
   deleteProjectFromOrg: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z26.object({
+      orgId: z26.string().min(1).max(128),
+      projectId: z26.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     let res;
@@ -15089,8 +15051,8 @@ var cloudSyncRouter = router({
         body: { organizationId: input.orgId, projectId: input.projectId }
       });
     } catch (err) {
-      if (err instanceof TRPCError21 && err.code === "PRECONDITION_FAILED") {
-        throw new TRPCError21({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
+      if (err instanceof TRPCError22 && err.code === "PRECONDITION_FAILED") {
+        throw new TRPCError22({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
       }
       throw err;
     }
@@ -15098,12 +15060,12 @@ var cloudSyncRouter = router({
     const detail = await cloudMessage(res);
     if (res.status === 403) {
       const code = /not a member/i.test(detail) ? "PROJECT_NOT_MEMBER" : "PROJECT_DELETE_FORBIDDEN";
-      throw new TRPCError21({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
+      throw new TRPCError22({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
     }
     if (res.status === 404) {
-      throw new TRPCError21({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
+      throw new TRPCError22({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
     }
-    throw new TRPCError21({
+    throw new TRPCError22({
       code: "BAD_GATEWAY",
       message: detail || `PROJECT_DELETE_FAILED (${res.status})`
     });
@@ -15123,10 +15085,10 @@ var cloudSyncRouter = router({
    * afficher. Le nom est donc recopié dans le tampon du coffre au passage, là
    * où il est déjà lu au démarrage suivant.
    */
-  rememberOrgNames: protectedProcedure.input(z27.object({
-    orgs: z27.array(z27.object({
-      orgId: z27.string().min(1).max(128),
-      name: z27.string().min(1).max(100)
+  rememberOrgNames: protectedProcedure.input(z26.object({
+    orgs: z26.array(z26.object({
+      orgId: z26.string().min(1).max(128),
+      name: z26.string().min(1).max(100)
     })).max(200)
   })).mutation(async ({ input }) => {
     for (const { orgId, name } of input.orgs) await rememberOrgName(orgId, name);
@@ -15160,15 +15122,15 @@ var cloudSyncRouter = router({
 });
 
 // ../server/src/trpc/routers/filesystem.ts
-import { readdir as readdir9, stat as stat8 } from "fs/promises";
+import { readdir as readdir8, stat as stat8 } from "fs/promises";
 import { homedir as homedir5 } from "os";
-import { isAbsolute as isAbsolute4, join as join25, resolve as resolve5, dirname as dirname10, basename as basename2 } from "path";
-import { z as z28 } from "zod";
+import { isAbsolute as isAbsolute4, join as join24, resolve as resolve5, dirname as dirname10, basename as basename2 } from "path";
+import { z as z27 } from "zod";
 var MAX_ENTRIES2 = 500;
-var PATH_SCHEMA = z28.string().min(1).max(4096);
+var PATH_SCHEMA = z27.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join25(homedir5(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join24(homedir5(), input.slice(1)) : input;
   if (!isAbsolute4(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve5(expanded);
 }
@@ -15189,7 +15151,7 @@ var filesystemRouter = router({
    * Hidden entries are skipped: they are noise for choosing a workspace, and
    * `.runeya` itself would invite placing a project inside another's data.
    */
-  listDirectories: protectedProcedure.input(z28.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  listDirectories: protectedProcedure.input(z27.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
     if (!info?.isDirectory()) {
@@ -15197,14 +15159,14 @@ var filesystemRouter = router({
     }
     let names;
     try {
-      names = (await readdir9(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+      names = (await readdir8(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
     } catch {
       throw new Error(`R\xE9pertoire illisible : ${dir}`);
     }
     const truncated = names.length > MAX_ENTRIES2;
     const entries2 = [];
     for (const name of names.slice(0, MAX_ENTRIES2)) {
-      const path = join25(dir, name);
+      const path = join24(dir, name);
       entries2.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
@@ -15223,10 +15185,10 @@ var filesystemRouter = router({
    * Two projects in one directory is what makes services run against the wrong
    * code, so a directory that already holds one is refused outright.
    */
-  checkProjectTarget: protectedProcedure.input(z28.object({
+  checkProjectTarget: protectedProcedure.input(z27.object({
     path: PATH_SCHEMA,
-    projectId: z28.string().min(1).max(128),
-    orgId: z28.string().max(128).nullable().optional()
+    projectId: z27.string().min(1).max(128),
+    orgId: z27.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
@@ -15336,8 +15298,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir10, readFile as readFile19, writeFile as writeFile18, mkdir as mkdir22, copyFile as copyFile2, unlink as unlink5, rename as rename14, stat as stat10 } from "fs/promises";
-import { join as join26 } from "path";
+import { readdir as readdir9, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir21, copyFile as copyFile2, unlink as unlink5, rename as rename14, stat as stat10 } from "fs/promises";
+import { join as join25 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -15349,7 +15311,7 @@ var MACHINE_FILES = [
 ];
 var rekeyValue = rekeyJsonValue;
 async function vaultJsonFiles(root) {
-  const entries2 = await readdir10(root, { withFileTypes: true });
+  const entries2 = await readdir9(root, { withFileTypes: true });
   return entries2.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
 }
 async function exists2(path) {
@@ -15367,17 +15329,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join26(legacyRoot, `backup-${stamp}`);
-  await mkdir22(backupDir, { recursive: true });
+  const backupDir = join25(legacyRoot, `backup-${stamp}`);
+  await mkdir21(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists2(join26(legacyRoot, name))) {
-      await copyFile2(join26(legacyRoot, name), join26(backupDir, name));
+    if (await exists2(join25(legacyRoot, name))) {
+      await copyFile2(join25(legacyRoot, name), join25(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile19(join26(legacyRoot, name), "utf-8");
+    const raw = await readFile18(join25(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -15387,13 +15349,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join26(legacyRoot, `${name}.tmp`);
-    await writeFile18(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename14(tmp, join26(legacyRoot, name));
+    const tmp = join25(legacyRoot, `${name}.tmp`);
+    await writeFile17(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename14(tmp, join25(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile19(join26(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile18(join25(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -15402,13 +15364,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir22(machineRootDir, { recursive: true });
+  await mkdir21(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join26(legacyRoot, name);
+    const from = join25(legacyRoot, name);
     if (!await exists2(from)) continue;
-    const to = join26(machineRootDir, name);
+    const to = join25(machineRootDir, name);
     if (await exists2(to)) {
       skipped.push(name);
       continue;
@@ -15418,15 +15380,15 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join26(legacyRoot, name);
+    const path = join25(legacyRoot, name);
     if (await exists2(path)) await unlink5(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile20, writeFile as writeFile19, rename as rename15, unlink as unlink6, mkdir as mkdir23, chmod as chmod12, stat as stat11 } from "fs/promises";
-import { join as join27 } from "path";
+import { readFile as readFile19, writeFile as writeFile18, rename as rename15, unlink as unlink6, mkdir as mkdir22, chmod as chmod12, stat as stat11 } from "fs/promises";
+import { join as join26 } from "path";
 var SETTINGS_FILE2 = "settings.json";
 var SETTINGS_PRIVATE_FILE2 = "settings.private.json";
 async function exists3(path) {
@@ -15439,11 +15401,11 @@ async function legacySource(filename) {
   return null;
 }
 async function moveInto(root, filename, from) {
-  await mkdir23(root, { recursive: true });
-  const to = join27(root, filename);
-  const contents = await readFile20(from, "utf-8");
+  await mkdir22(root, { recursive: true });
+  const to = join26(root, filename);
+  const contents = await readFile19(from, "utf-8");
   const tmp = to + ".tmp";
-  await writeFile19(tmp, contents, "utf-8");
+  await writeFile18(tmp, contents, "utf-8");
   await rename15(tmp, to);
   await chmod12(to, 384);
   await unlink6(from);
@@ -15465,7 +15427,7 @@ async function migrateSettingsIntoVaults() {
   const orgId = orgs[0];
   const root = orgVaultRoot(orgId);
   for (const { filename, from } of sources) {
-    if (await exists3(join27(root, filename))) continue;
+    if (await exists3(join26(root, filename))) continue;
     await moveInto(root, filename, from);
     report.files.push(filename);
   }
@@ -15481,14 +15443,14 @@ import { createRequire as createRequire2 } from "module";
 import { randomBytes as randomBytes6, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile21,
-  writeFile as writeFile20,
+  readFile as readFile20,
+  writeFile as writeFile19,
   rename as rename16,
-  mkdir as mkdir24,
+  mkdir as mkdir23,
   access as access3,
-  readdir as readdir11
+  readdir as readdir10
 } from "fs/promises";
-import { join as join28, dirname as dirname11 } from "path";
+import { join as join27, dirname as dirname11 } from "path";
 var _require = createRequire2(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -15597,7 +15559,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile21(filePath, "utf-8")).trim();
+  const raw = (await readFile20(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -15617,12 +15579,12 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile20(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await writeFile19(tmp, JSON.stringify(data, null, 2), "utf-8");
   await rename16(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join28(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join27(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
   } catch {
@@ -15630,20 +15592,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join28(abCwd, ".runeya-tmp");
+  const legacyTmp = join27(abCwd, ".runeya-tmp");
   await rename16(legacyRoot, legacyTmp);
-  await mkdir24(dataDir, { recursive: true });
-  const legacyOld = join28(dataDir, `backup-${timestamp}`);
+  await mkdir23(dataDir, { recursive: true });
+  const legacyOld = join27(dataDir, `backup-${timestamp}`);
   await rename16(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile21(join28(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile20(join27(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join28(legacyOld, "dbs");
+  const dbsDir = join27(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -15652,29 +15614,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join28(dbsDir, "envs");
-  const envFiles = (await readdir11(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join27(dbsDir, "envs");
+  const envFiles = (await readdir10(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join28(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join27(envsDir, file));
   }
-  const servicesDir = join28(dbsDir, "services");
-  const serviceFiles = (await readdir11(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join27(dbsDir, "services");
+  const serviceFiles = (await readdir10(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join28(servicesDir, file));
+    const data = await readEncrypted(join27(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join28(dbsDir, "overrides");
-  const overrideFiles = (await readdir11(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join27(dbsDir, "overrides");
+  const overrideFiles = (await readdir10(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join28(overridesDir, file));
+    const data = await readEncrypted(join27(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -15682,11 +15644,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join28(dbsDir, "parsers");
-  const parserFiles = (await readdir11(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join27(dbsDir, "parsers");
+  const parserFiles = (await readdir10(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join28(parsersDir, file));
+    const data = await readEncrypted(join27(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -16027,7 +15989,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile21(join28(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile20(join27(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -16048,11 +16010,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join28(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join28(dataDir, "services.json"), runeServices);
-  await atomicWrite(join28(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join28(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join28(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join27(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join27(dataDir, "services.json"), runeServices);
+  await atomicWrite(join27(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join27(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join27(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -16063,12 +16025,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries2 = await readdir11(dataDir);
+    const entries2 = await readdir10(dataDir);
     const backupDirs = entries2.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join28(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join27(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile21(keyJsonPath, "utf-8");
+        const raw = await readFile20(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -16089,14 +16051,14 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve7 } = await import("path");
   const abDataDir = resolve7(dataDir);
   const candidateDirs = [
-    join28(dirname11(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join28(abDataDir, "dbs", "overrides")
+    join27(dirname11(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join27(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir11(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir10(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -16106,7 +16068,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join28(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join27(overridesDir, "..", "encryption-key.json");
   try {
     await access3(legacyKeyPath);
     return false;
@@ -16124,7 +16086,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile21(join28(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile20(join27(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -16143,7 +16105,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile21(join28(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile20(join27(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -16160,7 +16122,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join28(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join27(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -16187,7 +16149,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join28(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join27(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -16197,7 +16159,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join28(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join27(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -16256,7 +16218,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join28(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join27(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -16271,7 +16233,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join29 } from "path";
+import { join as join28 } from "path";
 import { stat as stat12 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -16281,22 +16243,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat12(join29(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat12(join28(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, VERIFY_FILENAME2));
+    await stat12(join28(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, "projects.json"));
+    await stat12(join28(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat12(join29(dataDir, "project.json"));
+    await stat12(join28(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -17556,4 +17518,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-MQWOIUB5.js.map
+//# sourceMappingURL=src-Q3PSCMS7.js.map