@runeya/runeya 2.0.73 → 2.0.75

package/agent/index.js

@@ -66,767 +66,54 @@ import { TRPCError as TRPCError2 } from "@trpc/server";
 // src/services/process-manager.ts
 import { EventEmitter as EventEmitter7 } from "events";
 import { randomUUID as randomUUID3 } from "crypto";
-import { networkInterfaces } from "os";
+import { networkInterfaces, homedir as homedir5, platform as platform2 } from "os";
 import { join as join3, isAbsolute, resolve } from "path";
 
-// ../../packages/runner-native/src/native-runner.ts
-import { execa } from "execa";
-import { execSync } from "child_process";
-import { homedir } from "os";
+// ../../packages/shared/src/schemas/user.schema.ts
+import { z } from "zod";
+var UserSchema = z.object({
+  id: z.string().max(128),
+  email: z.string().email().max(320),
+  name: z.string().min(1).max(500),
+  avatar: z.string().url().max(2048).nullable().optional()
+});
 
-// ../../node_modules/shellwords/dist/esm/index.js
-var scan = (string, pattern, callback) => {
-  let result = "";
-  while (string.length > 0) {
-    const match = string.match(pattern);
-    if (match && match.index != null && match[0] != null) {
-      result += string.slice(0, match.index);
-      result += callback(match);
-      string = string.slice(match.index + match[0].length);
-    } else {
-      result += string;
-      string = "";
-    }
-  }
-  return result;
-};
-var split = (line = "") => {
-  const words = [];
-  let field = "";
-  scan(
-    line,
-    /\s*(?:([^\s\\'"]+)|'((?:[^'\\]|\\.)*)'|"((?:[^"\\]|\\.)*)"|(\\.?)|(\S))(\s|$)?/,
-    (match) => {
-      const [_raw, word, sq, dq, escape2, garbage, separator] = match;
-      if (garbage != null) {
-        throw new Error(`Unmatched quote: ${line}`);
-      }
-      if (word) {
-        field += word;
-      } else {
-        let addition;
-        if (sq) {
-          addition = sq;
-        } else if (dq) {
-          addition = dq;
-        } else if (escape2) {
-          addition = escape2;
-        }
-        if (addition) {
-          field += addition.replace(/\\(?=.)/, "");
-        }
-      }
-      if (separator != null) {
-        words.push(field);
-        field = "";
-      }
-    }
-  );
-  if (field) {
-    words.push(field);
-  }
-  return words;
-};
+// ../../packages/shared/src/schemas/org.schema.ts
+import { z as z2 } from "zod";
+var OrgSchema = z2.object({
+  id: z2.string().max(128),
+  name: z2.string().min(1).max(100),
+  slug: z2.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
+  ownerId: z2.string().max(128)
+});
+var OrgMemberSchema = z2.object({
+  id: z2.string().max(128),
+  orgId: z2.string().max(128),
+  userId: z2.string().max(128),
+  globalRole: z2.enum(["owner", "admin", "member"]),
+  invitedAt: z2.coerce.date(),
+  joinedAt: z2.coerce.date().nullable().optional()
+});
 
-// ../../packages/runner-native/src/native-runner.ts
-var shellwordsSplit = split;
-function expandEnvVars(str, serviceEnv) {
-  const withHome = str.replace(/^~(\/|$)/, `${homedir()}$1`);
-  return withHome.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
-    const name = braced ?? plain;
-    return serviceEnv?.[name] ?? "";
-  });
-}
-function resolveCwd(cwd, env2) {
-  if (!cwd) return ".";
-  return expandEnvVars(cwd, env2) || ".";
-}
-function findUnresolvedEnvVars(str, serviceEnv) {
-  const unresolved = [];
-  str.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
-    const name = braced ?? plain;
-    if (serviceEnv?.[name] === void 0) {
-      unresolved.push(name);
-    }
-    return "";
-  });
-  return unresolved;
-}
-var SYSTEM_PATH_DIRS = ["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"];
-function buildSafeEnv(configEnv = {}) {
-  const safeKeys = ["PATH", "HOME", "USER", "SHELL", "LANG", "TERM", "NODE_ENV", "TMPDIR", "TZ", "DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR"];
-  const env2 = {};
-  for (const key of safeKeys) {
-    if (process.env[key]) {
-      env2[key] = process.env[key];
-    }
-  }
-  const existingPath = env2["PATH"] ?? "";
-  const existingDirs = new Set(existingPath.split(":").filter(Boolean));
-  const missingDirs = SYSTEM_PATH_DIRS.filter((d) => !existingDirs.has(d));
-  if (missingDirs.length > 0) {
-    env2["PATH"] = [existingPath, ...missingDirs].filter(Boolean).join(":");
-  }
-  return { ...env2, ...configEnv };
-}
-var NativeRunner = class {
-  type = "native";
-  start(config) {
-    let subprocess;
-    const cwd = resolveCwd(config.cwd, config.env);
-    const isWindows = process.platform === "win32";
-    if (config.shell) {
-      subprocess = execa(config.command, {
-        cwd,
-        env: buildSafeEnv(config.env),
-        shell: true,
-        detached: !isWindows,
-        // Create new process group for group kill (not supported on Windows)
-        windowsHide: true,
-        // Prevent terminal windows from appearing on Windows
-        stdio: ["ignore", "pipe", "pipe"],
-        reject: false,
-        // Don't throw on non-zero exit
-        buffer: false
-        // Don't accumulate stdout/stderr in memory — we stream via readline
-      });
-    } else {
-      const args = shellwordsSplit(config.command);
-      const cmd = args.shift();
-      if (!cmd) {
-        throw new Error("Invalid command: cannot parse empty or whitespace-only command");
-      }
-      subprocess = execa(cmd, args, {
-        cwd,
-        env: buildSafeEnv(config.env),
-        shell: false,
-        // SECURITY: shell:false prevents command injection
-        detached: !isWindows,
-        // Create new process group for group kill (not supported on Windows)
-        windowsHide: true,
-        // Prevent terminal windows from appearing on Windows
-        stdio: ["ignore", "pipe", "pipe"],
-        reject: false,
-        // Don't throw on non-zero exit
-        buffer: false
-        // Don't accumulate stdout/stderr in memory — we stream via readline
-      });
-    }
-    const exitPromise = new Promise((resolve2) => {
-      subprocess.then((result) => {
-        resolve2({
-          exitCode: result.exitCode ?? null,
-          signal: result.signal ?? null,
-          error: result.failed && result.shortMessage ? result.shortMessage : void 0
-        });
-      }).catch((err) => {
-        resolve2({ exitCode: 1, signal: null, error: err.message ?? "Unknown error" });
-      });
-    });
-    return {
-      pid: subprocess.pid,
-      kill(signal = "SIGTERM") {
-        try {
-          if (process.platform === "win32") {
-            if (!subprocess.pid) return false;
-            execSync(`taskkill /F /T /PID ${subprocess.pid}`, { stdio: "ignore" });
-            return true;
-          }
-          if (subprocess.pid) {
-            process.kill(-subprocess.pid, signal);
-            return true;
-          }
-          return subprocess.kill(signal);
-        } catch {
-          return false;
-        }
-      },
-      stdout: subprocess.stdout,
-      stderr: subprocess.stderr,
-      exitPromise
-    };
-  }
-  async isAvailable() {
-    return true;
-  }
-};
-
-// ../../packages/runner-docker/src/index.ts
-import { execa as execa2 } from "execa";
-import { PassThrough } from "stream";
-import { randomUUID } from "crypto";
-import { writeFile, unlink, mkdir } from "fs/promises";
-import { tmpdir, homedir as homedir2, userInfo } from "os";
-import { join } from "path";
-function splitShellArgs(cmd) {
-  const args = [];
-  let current = "";
-  let inSingle = false;
-  let inDouble = false;
-  for (let i = 0; i < cmd.length; i++) {
-    const ch = cmd[i];
-    if (ch === "'" && !inDouble) {
-      inSingle = !inSingle;
-    } else if (ch === '"' && !inSingle) {
-      inDouble = !inDouble;
-    } else if (ch === "\\" && inDouble && i + 1 < cmd.length) {
-      current += cmd[++i];
-    } else if (/\s/.test(ch) && !inSingle && !inDouble) {
-      if (current) {
-        args.push(current);
-        current = "";
-      }
-    } else {
-      current += ch;
-    }
-  }
-  if (current) args.push(current);
-  return args;
-}
-function sanitizeDockerName(name) {
-  return name.toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/-{2,}/g, "-");
-}
-function expandEnvVars2(str, serviceEnv) {
-  const withHome = str.replace(/^~(\/|$)/, `${homedir2()}$1`);
-  return withHome.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
-    const name = braced ?? plain;
-    return serviceEnv?.[name] ?? "";
-  });
-}
-async function preMkdirVolumes(volumes, serviceEnv) {
-  for (const v of volumes) {
-    const expanded = expandEnvVars2(v, serviceEnv);
-    const parts = expanded.split(":");
-    if (parts.length < 2) continue;
-    const hostPath = parts[0];
-    if (!hostPath.startsWith("/") && !hostPath.startsWith(".")) continue;
-    await mkdir(hostPath, { recursive: true }).catch(() => {
-    });
-  }
-}
-var DockerRunner = class {
-  type = "docker";
-  start(config) {
-    const stdout = new PassThrough();
-    const stderr = new PassThrough();
-    const containerName = sanitizeDockerName(config.cmdId ? `runeya-${config.serviceId}-${config.cmdId}` : `runeya-${config.serviceId}`);
-    let killed = false;
-    const exitPromise = new Promise(
-      (resolve2) => {
-        void (async () => {
-          try {
-            await execa2("docker", ["rm", "-f", containerName], { reject: false });
-            const dc = config.dockerConfig;
-            let lastCardId = null;
-            const envFlags = Object.entries(config.env ?? {}).flatMap(
-              ([k, v]) => ["-e", `${k}=${v}`]
-            );
-            await preMkdirVolumes(dc.volumes ?? [], config.env);
-            const volumeFlags = (dc.volumes ?? []).flatMap((v) => ["-v", expandEnvVars2(v, config.env)]);
-            if (dc.mountRootpath && config.cwd) {
-              volumeFlags.push("-v", `${config.cwd}:${config.cwd}`);
-            }
-            if (dc.image && !dc.dockerfile) {
-              lastCardId = randomUUID();
-              stdout.write(
-                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "pull", _cardId: lastCardId, _cardState: "open", message: `--- Docker Pull: ${dc.image} ---` }) + "\n"
-              );
-              const pull = execa2("docker", ["pull", dc.image], { reject: false });
-              pull.stdout?.pipe(stdout, { end: false });
-              pull.stderr?.pipe(stderr, { end: false });
-              await pull;
-            }
-            let imageName = dc.image ?? containerName + ":latest";
-            if (dc.dockerfile) {
-              lastCardId = randomUUID();
-              stdout.write(
-                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "build", _cardId: lastCardId, _cardState: "open", message: "--- Docker Build ---" }) + "\n"
-              );
-              const tmpFile = join(tmpdir(), `runeya-${config.serviceId}-${randomUUID()}.dockerfile`);
-              try {
-                await writeFile(tmpFile, dc.dockerfile, "utf8");
-                const buildArgs = Object.entries(dc.buildArgs ?? {}).flatMap(
-                  ([k, v]) => ["--build-arg", `${k}=${v}`]
-                );
-                const targetArgs = dc.targetStage ? ["--target", dc.targetStage] : [];
-                const buildContext = dc.buildContext ?? config.cwd ?? ".";
-                imageName = `${containerName}:latest`;
-                const build = execa2(
-                  "docker",
-                  ["build", "-f", tmpFile, "-t", imageName, ...buildArgs, ...targetArgs, buildContext],
-                  { reject: false }
-                );
-                build.stdout?.pipe(stdout, { end: false });
-                build.stderr?.pipe(stderr, { end: false });
-                await build;
-              } finally {
-                await unlink(tmpFile).catch(() => {
-                });
-              }
-            }
-            if (killed) {
-              resolve2({ exitCode: null, signal: "SIGTERM" });
-              return;
-            }
-            if (lastCardId) {
-              stdout.write(
-                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "close", _cardId: lastCardId, _cardState: "close" }) + "\n"
-              );
-            }
-            const bootstrapCmds = config.skipBootstrap ? [] : (dc.bootstrapCommands ?? []).filter((c) => c.command.trim());
-            for (const bsCmd of bootstrapCmds) {
-              if (killed) {
-                resolve2({ exitCode: null, signal: "SIGTERM" });
-                return;
-              }
-              const bsCardId = randomUUID();
-              const bsCmdName = bsCmd.label || bsCmd.command;
-              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "bootstrap", _cardId: bsCardId, _cardState: "open", message: `Bootstrap: ${bsCmdName}` })}
-`);
-              const exitCode = await this.runBootstrap(bsCmd, imageName, config.env ?? {}, dc.volumes ?? [], stdout, stderr);
-              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: bsCardId, _cardState: "close" })}
-`);
-              if (exitCode !== 0) {
-                stderr.write(`Bootstrap command "${bsCmdName}" failed with exit code ${exitCode}
-`);
-                resolve2({ exitCode, signal: null, error: `Bootstrap "${bsCmdName}" failed (exit ${exitCode})` });
-                return;
-              }
-            }
-            if (killed) {
-              resolve2({ exitCode: null, signal: "SIGTERM" });
-              return;
-            }
-            const networkFlags = dc.networkMode === "host" ? ["--network", "host"] : (dc.ports ?? []).flatMap((p) => ["-p", p]);
-            let cmdArgs;
-            let entrypointFlags;
-            if (dc.useNativeCommand) {
-              const shell = dc.nativeShell || "sh";
-              entrypointFlags = [];
-              cmdArgs = config.command ? [shell, "-c", config.command] : [];
-            } else {
-              entrypointFlags = dc.entrypoint ? ["--entrypoint", dc.entrypoint] : [];
-              cmdArgs = dc.command ? splitShellArgs(dc.command) : [];
-            }
-            const { uid, gid } = userInfo();
-            const rmFlag = config.rm ? ["--rm"] : [];
-            const runArgs = [
-              "run",
-              ...rmFlag,
-              "--init",
-              "--name",
-              containerName,
-              "--user",
-              dc.user || `${uid}:${gid}`,
-              ...networkFlags,
-              ...envFlags,
-              ...volumeFlags,
-              ...entrypointFlags,
-              imageName,
-              ...cmdArgs
-            ];
-            const debugCardId = randomUUID();
-            stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "run", _cardId: debugCardId, _cardState: "open", message: "Docker Run" })}
-`);
-            stdout.write(`docker ${runArgs.join(" ")}
-`);
-            stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: debugCardId, _cardState: "close" })}
-`);
-            const runProc = execa2("docker", runArgs, { reject: false });
-            runProc.stdout?.pipe(stdout, { end: false });
-            runProc.stderr?.pipe(stderr, { end: false });
-            const result = await runProc;
-            resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            stderr.write(`Docker infrastructure error: ${msg}
-`);
-            resolve2({ exitCode: 1, signal: null });
-          } finally {
-            stdout.end();
-            stderr.end();
-          }
-        })();
-      }
-    );
-    return {
-      pid: void 0,
-      containerName,
-      stdout,
-      stderr,
-      exitPromise,
-      kill(_signal = "SIGTERM") {
-        killed = true;
-        execa2("docker", ["stop", containerName]).catch(() => {
-        });
-        return true;
-      }
-    };
-  }
-  /** Start a long-lived container (sleep infinity) for shared mode.
-   *  Returns the RunnerProcess (lifetime) plus a `containerReady` promise that resolves
-   *  once `docker run --detach` has completed and the container is confirmed running.
-   *  Callers must await `containerReady` before calling `execInContainer`. */
-  startSharedContainer(config) {
-    const stdout = new PassThrough();
-    const stderr = new PassThrough();
-    const containerName = sanitizeDockerName(`runeya-${config.serviceId}`);
-    let killed = false;
-    let resolveReady;
-    let rejectReady;
-    const containerReady = new Promise((res, rej) => {
-      resolveReady = res;
-      rejectReady = rej;
-    });
-    let exitResolve;
-    const exitPromise = new Promise(
-      (resolve2) => {
-        exitResolve = resolve2;
-      }
-    );
-    void (async () => {
-      try {
-        await execa2("docker", ["rm", "-f", containerName], { reject: false });
-        const dc = config.dockerConfig;
-        let lastCardId = null;
-        const envFlags = Object.entries(config.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
-        await preMkdirVolumes(dc.volumes ?? [], config.env);
-        const volumeFlags = (dc.volumes ?? []).flatMap((v) => ["-v", expandEnvVars2(v, config.env)]);
-        if (dc.mountRootpath && config.cwd) {
-          volumeFlags.push("-v", `${config.cwd}:${config.cwd}`);
-        }
-        if (dc.image && !dc.dockerfile) {
-          lastCardId = randomUUID();
-          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "pull", _cardId: lastCardId, _cardState: "open", message: `--- Docker Pull: ${dc.image} ---` }) + "\n");
-          const pull = execa2("docker", ["pull", dc.image], { reject: false });
-          pull.stdout?.pipe(stdout, { end: false });
-          pull.stderr?.pipe(stderr, { end: false });
-          await pull;
-        }
-        let imageName = dc.image ?? containerName + ":latest";
-        if (dc.dockerfile) {
-          lastCardId = randomUUID();
-          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "build", _cardId: lastCardId, _cardState: "open", message: "--- Docker Build ---" }) + "\n");
-          const tmpFile = join(tmpdir(), `runeya-${config.serviceId}-${randomUUID()}.dockerfile`);
-          try {
-            await writeFile(tmpFile, dc.dockerfile, "utf8");
-            const buildArgs = Object.entries(dc.buildArgs ?? {}).flatMap(([k, v]) => ["--build-arg", `${k}=${v}`]);
-            const targetArgs = dc.targetStage ? ["--target", dc.targetStage] : [];
-            const buildContext = dc.buildContext ?? config.cwd ?? ".";
-            imageName = `${containerName}:latest`;
-            const build = execa2("docker", ["build", "-f", tmpFile, "-t", imageName, ...buildArgs, ...targetArgs, buildContext], { reject: false });
-            build.stdout?.pipe(stdout, { end: false });
-            build.stderr?.pipe(stderr, { end: false });
-            await build;
-          } finally {
-            await unlink(tmpFile).catch(() => {
-            });
-          }
-        }
-        if (killed) {
-          rejectReady(new Error("Killed before container started"));
-          exitResolve({ exitCode: null, signal: "SIGTERM" });
-          return;
-        }
-        if (lastCardId) {
-          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "close", _cardId: lastCardId, _cardState: "close" }) + "\n");
-        }
-        const networkFlags = dc.networkMode === "host" ? ["--network", "host"] : (dc.ports ?? []).flatMap((p) => ["-p", p]);
-        const { uid, gid } = userInfo();
-        const runArgs = [
-          "run",
-          "--detach",
-          "--init",
-          "--name",
-          containerName,
-          "--user",
-          dc.user || `${uid}:${gid}`,
-          ...networkFlags,
-          ...envFlags,
-          ...volumeFlags,
-          imageName,
-          "sleep",
-          "infinity"
-        ];
-        const debugCardId = randomUUID();
-        stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "run", _cardId: debugCardId, _cardState: "open", message: "Docker Run (shared container)" })}
-`);
-        stdout.write(`docker ${runArgs.join(" ")}
-`);
-        stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: debugCardId, _cardState: "close" })}
-`);
-        const runProc = execa2("docker", runArgs, { reject: false });
-        runProc.stdout?.pipe(stdout, { end: false });
-        runProc.stderr?.pipe(stderr, { end: false });
-        const runResult = await runProc;
-        if (runResult.exitCode !== 0) {
-          rejectReady(new Error(`docker run exited with code ${runResult.exitCode}`));
-          exitResolve({ exitCode: runResult.exitCode ?? 1, signal: null });
-          return;
-        }
-        resolveReady();
-        const waitProc = execa2("docker", ["wait", containerName], { reject: false });
-        await waitProc;
-        exitResolve({ exitCode: 0, signal: null });
-      } catch (err) {
-        const msg = err instanceof Error ? err.message : String(err);
-        stderr.write(`Docker infrastructure error: ${msg}
-`);
-        rejectReady(new Error(msg));
-        exitResolve({ exitCode: 1, signal: null });
-      } finally {
-        stdout.end();
-        stderr.end();
-      }
-    })();
-    return {
-      pid: void 0,
-      containerName,
-      stdout,
-      stderr,
-      exitPromise,
-      containerReady,
-      kill(_signal = "SIGTERM") {
-        killed = true;
-        execa2("docker", ["kill", containerName]).then(() => exitResolve({ exitCode: null, signal: "SIGKILL" })).catch(() => exitResolve({ exitCode: 1, signal: null }));
-        return true;
-      }
-    };
-  }
-  /** Run a command inside a running shared container via `docker exec`.
-   *  Kill terminates the docker-exec process but does NOT stop the container. */
-  execInContainer(containerName, command, envVars = {}, shell = "sh") {
-    const stdout = new PassThrough();
-    const stderr = new PassThrough();
-    let dockerProc = null;
-    const exitPromise = new Promise(
-      (resolve2) => {
-        void (async () => {
-          try {
-            const envFlags = Object.entries(envVars).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
-            const shellCmd = command.length ? command : "true";
-            dockerProc = execa2(
-              "docker",
-              ["exec", ...envFlags, containerName, shell, "-c", shellCmd],
-              { reject: false }
-            );
-            dockerProc.stdout?.pipe(stdout, { end: false });
-            dockerProc.stderr?.pipe(stderr, { end: false });
-            const result = await dockerProc;
-            resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            stderr.write(`docker execInContainer error: ${msg}
-`);
-            resolve2({ exitCode: 1, signal: null });
-          } finally {
-            stdout.end();
-            stderr.end();
-          }
-        })();
-      }
-    );
-    return {
-      pid: void 0,
-      containerName,
-      stdout,
-      stderr,
-      exitPromise,
-      kill(_signal = "SIGTERM") {
-        dockerProc?.kill("SIGTERM");
-        return true;
-      }
-    };
-  }
-  /** Run a shortcut command in the context of a Docker service.
-   *  If a service container is running (shared or isolated), uses `docker exec`.
-   *  If not running, reuses `start()` with `--rm` and `skipBootstrap`. */
-  runShortcut(config, shortcutCommand) {
-    const stdout = new PassThrough();
-    const stderr = new PassThrough();
-    let innerProcess = null;
-    let dockerProc = null;
-    const exitPromise = new Promise(
-      (resolve2) => {
-        void (async () => {
-          try {
-            const psResult = await execa2(
-              "docker",
-              ["ps", "--filter", `name=runeya-${config.serviceId}`, "--format", "{{.Names}}"],
-              { reject: false }
-            );
-            const runningContainer = psResult.stdout.trim().split("\n").find((n) => n.startsWith(`runeya-${config.serviceId}`));
-            if (runningContainer) {
-              const shell = config.dockerConfig.nativeShell || "sh";
-              const envFlags = Object.entries(config.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
-              const args = ["exec", ...envFlags, runningContainer, shell, "-c", shortcutCommand || "true"];
-              const cardId = randomUUID();
-              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "exec", _cardId: cardId, _cardState: "open", message: "Docker Exec" })}
-`);
-              stdout.write(`docker ${args.join(" ")}
-`);
-              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: cardId, _cardState: "close" })}
-`);
-              dockerProc = execa2("docker", args, { reject: false });
-              dockerProc.stdout?.pipe(stdout, { end: false });
-              dockerProc.stderr?.pipe(stderr, { end: false });
-              const result = await dockerProc;
-              resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
-            } else {
-              innerProcess = this.start({
-                ...config,
-                command: shortcutCommand,
-                cmdId: `shortcut-${randomUUID()}`,
-                rm: true,
-                skipBootstrap: true,
-                dockerConfig: { ...config.dockerConfig, useNativeCommand: true }
-              });
-              innerProcess.stdout?.pipe(stdout, { end: false });
-              innerProcess.stderr?.pipe(stderr, { end: false });
-              const result = await innerProcess.exitPromise;
-              resolve2(result);
-            }
-          } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            stderr.write(`docker shortcut error: ${msg}
-`);
-            resolve2({ exitCode: 1, signal: null });
-          } finally {
-            stdout.end();
-            stderr.end();
-          }
-        })();
-      }
-    );
-    return {
-      pid: void 0,
-      stdout,
-      stderr,
-      exitPromise,
-      kill(signal = "SIGTERM") {
-        if (innerProcess) return innerProcess.kill(signal);
-        dockerProc?.kill("SIGTERM");
-        return true;
-      }
-    };
-  }
-  async isAvailable() {
-    const result = await execa2("docker", ["info"], { reject: false });
-    return result.exitCode === 0;
-  }
-  /** Run a single bootstrap command sequentially inside a temporary container (--rm).
-   * Streams stdout/stderr into the provided PassThrough streams.
-   * Resolves with the exit code when the container exits. */
-  async runBootstrap(cmd, imageName, env2, volumes, stdout, stderr) {
-    const containerName = sanitizeDockerName(`runeya-bootstrap-${randomUUID()}`);
-    const envFlags = Object.entries(env2).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
-    await preMkdirVolumes(volumes, env2);
-    const volumeFlags = volumes.map((v) => expandEnvVars2(v, env2)).flatMap((v) => ["-v", v]);
-    const entrypointFlags = cmd.entrypoint ? ["--entrypoint", cmd.entrypoint] : [];
-    const { uid, gid } = userInfo();
-    const defaultUser = `${uid}:${gid}`;
-    const userFlags = ["--user", cmd.user || defaultUser];
-    const cmdArgs = splitShellArgs(cmd.command);
-    const runArgs = [
-      "run",
-      "--rm",
-      "--init",
-      "--name",
-      containerName,
-      "--network",
-      "host",
-      ...envFlags,
-      ...volumeFlags,
-      ...entrypointFlags,
-      ...userFlags,
-      imageName,
-      ...cmdArgs
-    ];
-    const proc = execa2("docker", runArgs, { reject: false });
-    proc.stdout?.pipe(stdout, { end: false });
-    proc.stderr?.pipe(stderr, { end: false });
-    const result = await proc;
-    return result.exitCode ?? 1;
-  }
-};
-
-// src/services/process-store.ts
-var ProcessStore = class {
-  processes = /* @__PURE__ */ new Map();
-  get(id) {
-    return this.processes.get(id);
-  }
-  getAll() {
-    return Array.from(this.processes.values());
-  }
-  set(id, process2) {
-    this.processes.set(id, process2);
-  }
-  delete(id) {
-    return this.processes.delete(id);
-  }
-  has(id) {
-    return this.processes.has(id);
-  }
-  clear() {
-    this.processes.clear();
-  }
-  getByServiceId(serviceId) {
-    return this.getAll().find((p) => p.serviceConfig.id === serviceId);
-  }
-};
-var processStore = new ProcessStore();
-
-// src/services/log-sources/console-log-source.ts
-import { createInterface } from "readline";
-import { EventEmitter } from "events";
-import { randomUUID as randomUUID2 } from "crypto";
-
-// ../../packages/shared/src/schemas/user.schema.ts
-import { z } from "zod";
-var UserSchema = z.object({
-  id: z.string().max(128),
-  email: z.string().email().max(320),
-  name: z.string().min(1).max(500),
-  avatar: z.string().url().max(2048).nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/org.schema.ts
-import { z as z2 } from "zod";
-var OrgSchema = z2.object({
-  id: z2.string().max(128),
-  name: z2.string().min(1).max(100),
-  slug: z2.string().min(1).max(100).regex(/^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/),
-  ownerId: z2.string().max(128)
-});
-var OrgMemberSchema = z2.object({
-  id: z2.string().max(128),
-  orgId: z2.string().max(128),
-  userId: z2.string().max(128),
-  globalRole: z2.enum(["owner", "admin", "member"]),
-  invitedAt: z2.coerce.date(),
-  joinedAt: z2.coerce.date().nullable().optional()
-});
-
-// ../../packages/shared/src/schemas/project.schema.ts
-import { z as z3 } from "zod";
-var ProjectSchema = z3.object({
-  id: z3.string().max(128),
-  orgId: z3.string().max(128).nullable().optional(),
-  name: z3.string().min(1).max(200),
-  description: z3.string().max(1e4).optional().default(""),
-  serviceIds: z3.array(z3.string().max(128)).max(1e4).default([]),
-  // Environment support
-  // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
-  // It's initialized to 'local' by default at load time
-  activeEnvironmentId: z3.string().max(128).optional(),
-  environmentIds: z3.array(z3.string().max(128)).max(100).default([]),
-  // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
-  // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
-  groupOrder: z3.array(z3.string().max(200)).max(100).default([])
-});
-var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
-var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
+// ../../packages/shared/src/schemas/project.schema.ts
+import { z as z3 } from "zod";
+var ProjectSchema = z3.object({
+  id: z3.string().max(128),
+  orgId: z3.string().max(128).nullable().optional(),
+  name: z3.string().min(1).max(200),
+  description: z3.string().max(1e4).optional().default(""),
+  serviceIds: z3.array(z3.string().max(128)).max(1e4).default([]),
+  // Environment support
+  // NOTE: activeEnvironmentId is runtime-only (not persisted to JSON)
+  // It's initialized to 'local' by default at load time
+  activeEnvironmentId: z3.string().max(128).optional(),
+  environmentIds: z3.array(z3.string().max(128)).max(100).default([]),
+  // Ordre d'affichage des groupes de services dans la sidebar (noms de groupes).
+  // Les groupes absents de cette liste sont affichés après, par ordre alphabétique.
+  groupOrder: z3.array(z3.string().max(200)).max(100).default([])
+});
+var CreateProjectSchema = ProjectSchema.omit({ id: true }).partial().required({ name: true });
+var UpdateProjectSchema = ProjectSchema.partial().required({ id: true });
 
 // ../../packages/shared/src/schemas/service.schema.ts
 import { z as z7 } from "zod";
@@ -1309,7 +596,16 @@ var AgentStatusSchema = z10.object({
   lastSeen: z10.string().nullable().optional(),
   uptime: z10.number().nonnegative().default(0),
   runnersAvailable: z10.array(z10.enum(["native", "docker"])).default(["native"]),
-  lanIp: z10.string().optional()
+  lanIp: z10.string().optional(),
+  /**
+   * Ce que la machine de l'agent vaut pour les builtins de portée `agent`.
+   * Sert à PRÉVISUALISER — la valeur injectée reste calculée au lancement, par
+   * l'agent lui-même : une IP change, un agent se déconnecte, et un statut
+   * n'est qu'un cliché.
+   */
+  os: z10.string().max(64).optional(),
+  home: z10.string().max(4096).optional(),
+  cwd: z10.string().max(4096).optional()
 });
 
 // ../../packages/shared/src/schemas/permission.schema.ts
@@ -1721,238 +1017,1000 @@ var KanbanCardRefSchema = z19.object({
   commentCount: z19.number().int().nonnegative().default(0)
 });
 
-// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
-import { z as z20 } from "zod";
-var CloudApiScopeSchema = z20.enum([
-  "kanban:read",
-  "kanban:write",
-  "kanban:comment",
-  "kanban:delete"
-]);
-var CloudApiKeySecretSchema = z20.string().regex(/^rk_[0-9a-f]{64}$/);
-var CloudApiKeySchema = z20.object({
-  id: z20.string().max(128),
-  organizationId: z20.string().max(128),
-  name: z20.string().min(1).max(200),
-  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
-  /**
-   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
-   * l'organisation ».
-   *
-   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
-   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
-   * nommait plus que lui.
-   */
-  boards: z20.array(z20.string().max(64)).max(200).nullable(),
-  createdAt: z20.string().max(64),
-  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
-  lastUsedAt: z20.string().max(64).nullable(),
-  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
-  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }),
-  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
-  keyPreview: z20.string().max(8)
-});
-var CreatedCloudApiKeySchema = z20.object({
-  key: CloudApiKeySchema,
-  secret: CloudApiKeySecretSchema
-});
-var CreateCloudApiKeyInput = z20.object({
-  organizationId: z20.string().min(1).max(128),
-  name: z20.string().min(1).max(200),
-  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
-  boards: z20.array(z20.string().max(64)).max(200).nullable().default(null)
-});
-var UpdateCloudApiKeyInput = z20.object({
-  id: z20.string().min(1).max(128),
-  name: z20.string().min(1).max(200).optional(),
-  scopes: z20.array(CloudApiScopeSchema).min(1).max(10).optional(),
-  boards: z20.array(z20.string().max(64)).max(200).nullable().optional()
-});
+// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
+import { z as z20 } from "zod";
+var CloudApiScopeSchema = z20.enum([
+  "kanban:read",
+  "kanban:write",
+  "kanban:comment",
+  "kanban:delete"
+]);
+var CloudApiKeySecretSchema = z20.string().regex(/^rk_[0-9a-f]{64}$/);
+var CloudApiKeySchema = z20.object({
+  id: z20.string().max(128),
+  organizationId: z20.string().max(128),
+  name: z20.string().min(1).max(200),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
+  /**
+   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
+   * l'organisation ».
+   *
+   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
+   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
+   * nommait plus que lui.
+   */
+  boards: z20.array(z20.string().max(64)).max(200).nullable(),
+  createdAt: z20.string().max(64),
+  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
+  lastUsedAt: z20.string().max(64).nullable(),
+  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
+  createdBy: z20.object({ id: z20.string().max(128), name: z20.string().max(200) }),
+  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
+  keyPreview: z20.string().max(8)
+});
+var CreatedCloudApiKeySchema = z20.object({
+  key: CloudApiKeySchema,
+  secret: CloudApiKeySecretSchema
+});
+var CreateCloudApiKeyInput = z20.object({
+  organizationId: z20.string().min(1).max(128),
+  name: z20.string().min(1).max(200),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10),
+  boards: z20.array(z20.string().max(64)).max(200).nullable().default(null)
+});
+var UpdateCloudApiKeyInput = z20.object({
+  id: z20.string().min(1).max(128),
+  name: z20.string().min(1).max(200).optional(),
+  scopes: z20.array(CloudApiScopeSchema).min(1).max(10).optional(),
+  boards: z20.array(z20.string().max(64)).max(200).nullable().optional()
+});
+
+// ../../packages/shared/src/utils/crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypto";
+
+// ../../packages/shared/src/js-log-parser.ts
+import vm from "vm";
+var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
+var PARSE_TIMEOUT_MS = 50;
+var MAX_CONSECUTIVE_TIMEOUTS = 10;
+var JSLogParser = class {
+  parsers = [];
+  constructor(definitions = []) {
+    this.setParsers(definitions);
+  }
+  setParsers(definitions) {
+    this.parsers = [];
+    for (const def of definitions) {
+      if (!def.enabled) continue;
+      try {
+        const compiled = this.compileParser(def);
+        this.parsers.push({
+          id: def.id,
+          name: def.name,
+          enabled: true,
+          fn: compiled
+        });
+      } catch (err) {
+        console.warn(
+          `[js-log-parser] Failed to compile parser "${def.name}" (${def.id}): ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+  }
+  parse(line) {
+    let current = line;
+    for (const parser of this.parsers) {
+      try {
+        current = parser.fn(current);
+      } catch (err) {
+        console.warn(
+          `[js-log-parser] Parser "${parser.name}" threw error: ${err instanceof Error ? err.message : String(err)}`
+        );
+      }
+    }
+    return this.sanitize(current);
+  }
+  /**
+   * Compile le code utilisateur en une fonction bornée en temps.
+   *
+   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
+   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
+   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
+   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
+   * métriques de *tous* les services. Chaque invocation repasse maintenant par
+   * la vm, avec son propre budget.
+   */
+  compileParser(def) {
+    const forbidden = ["require(", "import ", "eval("];
+    for (const pat of forbidden) {
+      if (def.code.includes(pat)) {
+        throw new Error("Code contains forbidden patterns (require, import, eval)");
+      }
+    }
+    const sandbox = {
+      RegExp,
+      String,
+      Object,
+      Array,
+      JSON,
+      Math,
+      Date,
+      undefined: void 0,
+      null: null
+    };
+    let script;
+    try {
+      script = new vm.Script(`(${def.code})`, { filename: `parser-${def.id}.js` });
+    } catch (err) {
+      throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
+    let parserFn;
+    try {
+      parserFn = script.runInContext(context, { timeout: 100 });
+    } catch (err) {
+      throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (typeof parserFn !== "function") {
+      throw new Error("Parser code must export a function");
+    }
+    context["__parserFn"] = parserFn;
+    const callScript = new vm.Script("__result = __parserFn(__line);", {
+      filename: `parser-${def.id}-call.js`
+    });
+    let consecutiveTimeouts = 0;
+    let disabled = false;
+    return (line) => {
+      if (disabled) return line;
+      const ctx = context;
+      ctx["__line"] = line;
+      ctx["__result"] = null;
+      try {
+        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
+        consecutiveTimeouts = 0;
+      } catch (err) {
+        const e = err;
+        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
+        if (!timedOut) throw err;
+        consecutiveTimeouts += 1;
+        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
+          disabled = true;
+          console.warn(
+            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
+          );
+        }
+        return line;
+      }
+      const result = ctx["__result"];
+      if (result === null || result === void 0 || typeof result !== "object") {
+        return line;
+      }
+      return result;
+    };
+  }
+  /** Sanitize the final LogLine: truncate message, limit metadata, validate level */
+  sanitize(line) {
+    let { message, metadata, level } = line;
+    if (message.length > 16384) {
+      message = message.substring(0, 16384) + "...[truncated]";
+    }
+    metadata = metadata ?? {};
+    const metaKeys = Object.keys(metadata);
+    if (metaKeys.length > 100) {
+      const limited = {};
+      for (let i = 0; i < 100; i++) {
+        limited[metaKeys[i]] = metadata[metaKeys[i]];
+      }
+      metadata = limited;
+    }
+    if (!VALID_LEVELS.has(level)) {
+      level = "info";
+    }
+    if (message !== line.message || metadata !== line.metadata || level !== line.level) {
+      return { ...line, message, metadata, level };
+    }
+    return line;
+  }
+};
+
+// ../../packages/shared/src/builtins.ts
+var BUILTIN_VARIABLES = [
+  // ── Le service ───────────────────────────────────────────────────────────
+  { name: "service.NAME", scope: "server", descriptionKey: "serviceName" },
+  { name: "service.ID", scope: "server", descriptionKey: "serviceId" },
+  { name: "service.PORT", scope: "server", descriptionKey: "servicePort" },
+  { name: "service.URL", scope: "server", descriptionKey: "serviceUrl" },
+  { name: "service.BASE_URL", scope: "server", descriptionKey: "serviceBaseUrl" },
+  { name: "service.CWD", scope: "agent", descriptionKey: "serviceCwd" },
+  // ── Le projet et l'environnement actif ───────────────────────────────────
+  { name: "project.NAME", scope: "server", descriptionKey: "projectName" },
+  { name: "runeya.ENV_NAME", scope: "server", descriptionKey: "envName" },
+  // ── Le serveur Runeya ────────────────────────────────────────────────────
+  // `service.HOST` a toujours désigné l'adresse d'écoute du SERVEUR, pas une
+  // propriété du service : le nom trompait, il devient un alias.
+  { name: "runeya.HOST", scope: "server", descriptionKey: "runeyaHost", deprecatedAlias: "service.HOST" },
+  // ── La machine qui exécute ───────────────────────────────────────────────
+  { name: "agent.HOST_LAN", scope: "agent", descriptionKey: "agentHostLan", deprecatedAlias: "service.HOST_LAN" },
+  // Le NOM de l'agent est une étiquette de la configuration du serveur, pas
+  // une propriété de la machine : c'est le serveur qui le connaît et le résout.
+  { name: "agent.NAME", scope: "server", descriptionKey: "agentName" },
+  { name: "agent.OS", scope: "agent", descriptionKey: "agentOs" },
+  { name: "agent.HOME", scope: "agent", descriptionKey: "agentHome" }
+];
+var BUILTIN_REFERENCE_RE = /\{\{([A-Za-z][A-Za-z0-9_.-]*)\}\}/g;
+var ENVIRONMENT_NAMESPACE = "environment.";
+function interpolateBuiltins(text, values) {
+  return text.replace(BUILTIN_REFERENCE_RE, (match, name) => {
+    if (name.startsWith(ENVIRONMENT_NAMESPACE)) return match;
+    return values[name] ?? match;
+  });
+}
+function interpolateBuiltinsInEnv(env2, values) {
+  const out = {};
+  for (const [key, value] of Object.entries(env2)) {
+    out[key] = interpolateBuiltins(value, values);
+  }
+  return out;
+}
+function withDeprecatedAliases(values) {
+  const out = { ...values };
+  for (const builtin of BUILTIN_VARIABLES) {
+    if (builtin.deprecatedAlias && out[builtin.name] !== void 0) {
+      out[builtin.deprecatedAlias] = out[builtin.name];
+    }
+  }
+  return out;
+}
 
-// ../../packages/shared/src/utils/crypto.ts
-import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypto";
+// ../../packages/shared/src/constants/intervals.ts
+var HEALTH_CHECK_INTERVAL = 3e4;
+var METRICS_INTERVAL = 5e3;
+var HEALTH_CHECK_INITIAL_DELAY = 5e3;
+var HEALTH_WS_INTERVAL = 1e4;
+
+// ../../packages/shared/src/constants/buffers.ts
+var LOG_BUFFER_SIZE = 5e3;
+
+// ../../packages/shared/src/constants/timeouts.ts
+var GRACE_PERIOD = 1e4;
+var AGENT_STOP_FETCH_TIMEOUT = GRACE_PERIOD + 15e3;
+
+// ../../packages/shared/src/constants/editors.ts
+var SUPPORTED_EDITORS = [
+  { key: "vscode", name: "Visual Studio Code", command: "code" },
+  { key: "cursor", name: "Cursor", command: "cursor" },
+  { key: "windsurf", name: "Windsurf", command: "windsurf" },
+  { key: "sublime", name: "Sublime Text", command: "subl" },
+  { key: "atom", name: "Atom", command: "atom" },
+  { key: "antigravity", name: "Antigravity", command: "antigravity" },
+  { key: "intellij", name: "IntelliJ IDEA", command: "idea" },
+  { key: "android-studio", name: "Android Studio", command: "studio" },
+  { key: "webstorm", name: "WebStorm", command: "webstorm" },
+  { key: "zed", name: "Zed", command: "zed" },
+  { key: "neovim", name: "Neovim", command: "nvim" },
+  { key: "vim", name: "Vim", command: "vim" },
+  { key: "emacs", name: "Emacs", command: "emacs" },
+  { key: "fleet", name: "Fleet", command: "fleet" }
+];
+var EDITOR_BY_KEY = new Map(
+  SUPPORTED_EDITORS.map((e) => [e.key, e])
+);
+
+// ../../packages/shared/src/sync/json-crdt.ts
+import * as Y from "yjs";
+
+// ../../packages/runner-native/src/native-runner.ts
+import { execa } from "execa";
+import { execSync } from "child_process";
+import { homedir } from "os";
+
+// ../../node_modules/shellwords/dist/esm/index.js
+var scan = (string, pattern, callback) => {
+  let result = "";
+  while (string.length > 0) {
+    const match = string.match(pattern);
+    if (match && match.index != null && match[0] != null) {
+      result += string.slice(0, match.index);
+      result += callback(match);
+      string = string.slice(match.index + match[0].length);
+    } else {
+      result += string;
+      string = "";
+    }
+  }
+  return result;
+};
+var split = (line = "") => {
+  const words = [];
+  let field = "";
+  scan(
+    line,
+    /\s*(?:([^\s\\'"]+)|'((?:[^'\\]|\\.)*)'|"((?:[^"\\]|\\.)*)"|(\\.?)|(\S))(\s|$)?/,
+    (match) => {
+      const [_raw, word, sq, dq, escape2, garbage, separator] = match;
+      if (garbage != null) {
+        throw new Error(`Unmatched quote: ${line}`);
+      }
+      if (word) {
+        field += word;
+      } else {
+        let addition;
+        if (sq) {
+          addition = sq;
+        } else if (dq) {
+          addition = dq;
+        } else if (escape2) {
+          addition = escape2;
+        }
+        if (addition) {
+          field += addition.replace(/\\(?=.)/, "");
+        }
+      }
+      if (separator != null) {
+        words.push(field);
+        field = "";
+      }
+    }
+  );
+  if (field) {
+    words.push(field);
+  }
+  return words;
+};
+
+// ../../packages/runner-native/src/native-runner.ts
+var shellwordsSplit = split;
+function expandEnvVars(str, serviceEnv) {
+  const withHome = str.replace(/^~(\/|$)/, `${homedir()}$1`);
+  return withHome.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
+    const name = braced ?? plain;
+    return serviceEnv?.[name] ?? "";
+  });
+}
+function resolveCwd(cwd, env2) {
+  if (!cwd) return ".";
+  return expandEnvVars(cwd, env2) || ".";
+}
+function findUnresolvedEnvVars(str, serviceEnv) {
+  const unresolved = [];
+  str.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
+    const name = braced ?? plain;
+    if (serviceEnv?.[name] === void 0) {
+      unresolved.push(name);
+    }
+    return "";
+  });
+  return unresolved;
+}
+var SYSTEM_PATH_DIRS = ["/usr/local/sbin", "/usr/local/bin", "/usr/sbin", "/usr/bin", "/sbin", "/bin"];
+function buildSafeEnv(configEnv = {}) {
+  const safeKeys = ["PATH", "HOME", "USER", "SHELL", "LANG", "TERM", "NODE_ENV", "TMPDIR", "TZ", "DBUS_SESSION_BUS_ADDRESS", "XDG_RUNTIME_DIR"];
+  const env2 = {};
+  for (const key of safeKeys) {
+    if (process.env[key]) {
+      env2[key] = process.env[key];
+    }
+  }
+  const existingPath = env2["PATH"] ?? "";
+  const existingDirs = new Set(existingPath.split(":").filter(Boolean));
+  const missingDirs = SYSTEM_PATH_DIRS.filter((d) => !existingDirs.has(d));
+  if (missingDirs.length > 0) {
+    env2["PATH"] = [existingPath, ...missingDirs].filter(Boolean).join(":");
+  }
+  return { ...env2, ...configEnv };
+}
+var NativeRunner = class {
+  type = "native";
+  start(config) {
+    let subprocess;
+    const cwd = resolveCwd(config.cwd, config.env);
+    const isWindows = process.platform === "win32";
+    if (config.shell) {
+      subprocess = execa(config.command, {
+        cwd,
+        env: buildSafeEnv(config.env),
+        shell: true,
+        detached: !isWindows,
+        // Create new process group for group kill (not supported on Windows)
+        windowsHide: true,
+        // Prevent terminal windows from appearing on Windows
+        stdio: ["ignore", "pipe", "pipe"],
+        reject: false,
+        // Don't throw on non-zero exit
+        buffer: false
+        // Don't accumulate stdout/stderr in memory — we stream via readline
+      });
+    } else {
+      const args = shellwordsSplit(config.command);
+      const cmd = args.shift();
+      if (!cmd) {
+        throw new Error("Invalid command: cannot parse empty or whitespace-only command");
+      }
+      subprocess = execa(cmd, args, {
+        cwd,
+        env: buildSafeEnv(config.env),
+        shell: false,
+        // SECURITY: shell:false prevents command injection
+        detached: !isWindows,
+        // Create new process group for group kill (not supported on Windows)
+        windowsHide: true,
+        // Prevent terminal windows from appearing on Windows
+        stdio: ["ignore", "pipe", "pipe"],
+        reject: false,
+        // Don't throw on non-zero exit
+        buffer: false
+        // Don't accumulate stdout/stderr in memory — we stream via readline
+      });
+    }
+    const exitPromise = new Promise((resolve2) => {
+      subprocess.then((result) => {
+        resolve2({
+          exitCode: result.exitCode ?? null,
+          signal: result.signal ?? null,
+          error: result.failed && result.shortMessage ? result.shortMessage : void 0
+        });
+      }).catch((err) => {
+        resolve2({ exitCode: 1, signal: null, error: err.message ?? "Unknown error" });
+      });
+    });
+    return {
+      pid: subprocess.pid,
+      kill(signal = "SIGTERM") {
+        try {
+          if (process.platform === "win32") {
+            if (!subprocess.pid) return false;
+            execSync(`taskkill /F /T /PID ${subprocess.pid}`, { stdio: "ignore" });
+            return true;
+          }
+          if (subprocess.pid) {
+            process.kill(-subprocess.pid, signal);
+            return true;
+          }
+          return subprocess.kill(signal);
+        } catch {
+          return false;
+        }
+      },
+      stdout: subprocess.stdout,
+      stderr: subprocess.stderr,
+      exitPromise
+    };
+  }
+  async isAvailable() {
+    return true;
+  }
+};
 
-// ../../packages/shared/src/js-log-parser.ts
-import vm from "vm";
-var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
-var PARSE_TIMEOUT_MS = 50;
-var MAX_CONSECUTIVE_TIMEOUTS = 10;
-var JSLogParser = class {
-  parsers = [];
-  constructor(definitions = []) {
-    this.setParsers(definitions);
+// ../../packages/runner-docker/src/index.ts
+import { execa as execa2 } from "execa";
+import { PassThrough } from "stream";
+import { randomUUID } from "crypto";
+import { writeFile, unlink, mkdir } from "fs/promises";
+import { tmpdir, homedir as homedir2, userInfo } from "os";
+import { join } from "path";
+function splitShellArgs(cmd) {
+  const args = [];
+  let current = "";
+  let inSingle = false;
+  let inDouble = false;
+  for (let i = 0; i < cmd.length; i++) {
+    const ch = cmd[i];
+    if (ch === "'" && !inDouble) {
+      inSingle = !inSingle;
+    } else if (ch === '"' && !inSingle) {
+      inDouble = !inDouble;
+    } else if (ch === "\\" && inDouble && i + 1 < cmd.length) {
+      current += cmd[++i];
+    } else if (/\s/.test(ch) && !inSingle && !inDouble) {
+      if (current) {
+        args.push(current);
+        current = "";
+      }
+    } else {
+      current += ch;
+    }
   }
-  setParsers(definitions) {
-    this.parsers = [];
-    for (const def of definitions) {
-      if (!def.enabled) continue;
-      try {
-        const compiled = this.compileParser(def);
-        this.parsers.push({
-          id: def.id,
-          name: def.name,
-          enabled: true,
-          fn: compiled
+  if (current) args.push(current);
+  return args;
+}
+function sanitizeDockerName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/-{2,}/g, "-");
+}
+function expandEnvVars2(str, serviceEnv) {
+  const withHome = str.replace(/^~(\/|$)/, `${homedir2()}$1`);
+  return withHome.replace(/\$\{(\w+)\}|\$(\w+)/g, (_, braced, plain) => {
+    const name = braced ?? plain;
+    return serviceEnv?.[name] ?? "";
+  });
+}
+async function preMkdirVolumes(volumes, serviceEnv) {
+  for (const v of volumes) {
+    const expanded = expandEnvVars2(v, serviceEnv);
+    const parts = expanded.split(":");
+    if (parts.length < 2) continue;
+    const hostPath = parts[0];
+    if (!hostPath.startsWith("/") && !hostPath.startsWith(".")) continue;
+    await mkdir(hostPath, { recursive: true }).catch(() => {
+    });
+  }
+}
+var DockerRunner = class {
+  type = "docker";
+  start(config) {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    const containerName = sanitizeDockerName(config.cmdId ? `runeya-${config.serviceId}-${config.cmdId}` : `runeya-${config.serviceId}`);
+    let killed = false;
+    const exitPromise = new Promise(
+      (resolve2) => {
+        void (async () => {
+          try {
+            await execa2("docker", ["rm", "-f", containerName], { reject: false });
+            const dc = config.dockerConfig;
+            let lastCardId = null;
+            const envFlags = Object.entries(config.env ?? {}).flatMap(
+              ([k, v]) => ["-e", `${k}=${v}`]
+            );
+            await preMkdirVolumes(dc.volumes ?? [], config.env);
+            const volumeFlags = (dc.volumes ?? []).flatMap((v) => ["-v", expandEnvVars2(v, config.env)]);
+            if (dc.mountRootpath && config.cwd) {
+              volumeFlags.push("-v", `${config.cwd}:${config.cwd}`);
+            }
+            if (dc.image && !dc.dockerfile) {
+              lastCardId = randomUUID();
+              stdout.write(
+                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "pull", _cardId: lastCardId, _cardState: "open", message: `--- Docker Pull: ${dc.image} ---` }) + "\n"
+              );
+              const pull = execa2("docker", ["pull", dc.image], { reject: false });
+              pull.stdout?.pipe(stdout, { end: false });
+              pull.stderr?.pipe(stderr, { end: false });
+              await pull;
+            }
+            let imageName = dc.image ?? containerName + ":latest";
+            if (dc.dockerfile) {
+              lastCardId = randomUUID();
+              stdout.write(
+                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "build", _cardId: lastCardId, _cardState: "open", message: "--- Docker Build ---" }) + "\n"
+              );
+              const tmpFile = join(tmpdir(), `runeya-${config.serviceId}-${randomUUID()}.dockerfile`);
+              try {
+                await writeFile(tmpFile, dc.dockerfile, "utf8");
+                const buildArgs = Object.entries(dc.buildArgs ?? {}).flatMap(
+                  ([k, v]) => ["--build-arg", `${k}=${v}`]
+                );
+                const targetArgs = dc.targetStage ? ["--target", dc.targetStage] : [];
+                const buildContext = dc.buildContext ?? config.cwd ?? ".";
+                imageName = `${containerName}:latest`;
+                const build = execa2(
+                  "docker",
+                  ["build", "-f", tmpFile, "-t", imageName, ...buildArgs, ...targetArgs, buildContext],
+                  { reject: false }
+                );
+                build.stdout?.pipe(stdout, { end: false });
+                build.stderr?.pipe(stderr, { end: false });
+                await build;
+              } finally {
+                await unlink(tmpFile).catch(() => {
+                });
+              }
+            }
+            if (killed) {
+              resolve2({ exitCode: null, signal: "SIGTERM" });
+              return;
+            }
+            if (lastCardId) {
+              stdout.write(
+                "\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "close", _cardId: lastCardId, _cardState: "close" }) + "\n"
+              );
+            }
+            const bootstrapCmds = config.skipBootstrap ? [] : (dc.bootstrapCommands ?? []).filter((c) => c.command.trim());
+            for (const bsCmd of bootstrapCmds) {
+              if (killed) {
+                resolve2({ exitCode: null, signal: "SIGTERM" });
+                return;
+              }
+              const bsCardId = randomUUID();
+              const bsCmdName = bsCmd.label || bsCmd.command;
+              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "bootstrap", _cardId: bsCardId, _cardState: "open", message: `Bootstrap: ${bsCmdName}` })}
+`);
+              const exitCode = await this.runBootstrap(bsCmd, imageName, config.env ?? {}, dc.volumes ?? [], stdout, stderr);
+              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: bsCardId, _cardState: "close" })}
+`);
+              if (exitCode !== 0) {
+                stderr.write(`Bootstrap command "${bsCmdName}" failed with exit code ${exitCode}
+`);
+                resolve2({ exitCode, signal: null, error: `Bootstrap "${bsCmdName}" failed (exit ${exitCode})` });
+                return;
+              }
+            }
+            if (killed) {
+              resolve2({ exitCode: null, signal: "SIGTERM" });
+              return;
+            }
+            const networkFlags = dc.networkMode === "host" ? ["--network", "host"] : (dc.ports ?? []).flatMap((p) => ["-p", p]);
+            let cmdArgs;
+            let entrypointFlags;
+            if (dc.useNativeCommand) {
+              const shell = dc.nativeShell || "sh";
+              entrypointFlags = [];
+              cmdArgs = config.command ? [shell, "-c", config.command] : [];
+            } else {
+              entrypointFlags = dc.entrypoint ? ["--entrypoint", dc.entrypoint] : [];
+              cmdArgs = dc.command ? splitShellArgs(dc.command) : [];
+            }
+            const { uid, gid } = userInfo();
+            const rmFlag = config.rm ? ["--rm"] : [];
+            const runArgs = [
+              "run",
+              ...rmFlag,
+              "--init",
+              "--name",
+              containerName,
+              "--user",
+              dc.user || `${uid}:${gid}`,
+              ...networkFlags,
+              ...envFlags,
+              ...volumeFlags,
+              ...entrypointFlags,
+              imageName,
+              ...cmdArgs
+            ];
+            const debugCardId = randomUUID();
+            stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "run", _cardId: debugCardId, _cardState: "open", message: "Docker Run" })}
+`);
+            stdout.write(`docker ${runArgs.join(" ")}
+`);
+            stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: debugCardId, _cardState: "close" })}
+`);
+            const runProc = execa2("docker", runArgs, { reject: false });
+            runProc.stdout?.pipe(stdout, { end: false });
+            runProc.stderr?.pipe(stderr, { end: false });
+            const result = await runProc;
+            resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr.write(`Docker infrastructure error: ${msg}
+`);
+            resolve2({ exitCode: 1, signal: null });
+          } finally {
+            stdout.end();
+            stderr.end();
+          }
+        })();
+      }
+    );
+    return {
+      pid: void 0,
+      containerName,
+      stdout,
+      stderr,
+      exitPromise,
+      kill(_signal = "SIGTERM") {
+        killed = true;
+        execa2("docker", ["stop", containerName]).catch(() => {
         });
-      } catch (err) {
-        console.warn(
-          `[js-log-parser] Failed to compile parser "${def.name}" (${def.id}): ${err instanceof Error ? err.message : String(err)}`
-        );
+        return true;
       }
-    }
+    };
   }
-  parse(line) {
-    let current = line;
-    for (const parser of this.parsers) {
+  /** Start a long-lived container (sleep infinity) for shared mode.
+   *  Returns the RunnerProcess (lifetime) plus a `containerReady` promise that resolves
+   *  once `docker run --detach` has completed and the container is confirmed running.
+   *  Callers must await `containerReady` before calling `execInContainer`. */
+  startSharedContainer(config) {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    const containerName = sanitizeDockerName(`runeya-${config.serviceId}`);
+    let killed = false;
+    let resolveReady;
+    let rejectReady;
+    const containerReady = new Promise((res, rej) => {
+      resolveReady = res;
+      rejectReady = rej;
+    });
+    let exitResolve;
+    const exitPromise = new Promise(
+      (resolve2) => {
+        exitResolve = resolve2;
+      }
+    );
+    void (async () => {
       try {
-        current = parser.fn(current);
+        await execa2("docker", ["rm", "-f", containerName], { reject: false });
+        const dc = config.dockerConfig;
+        let lastCardId = null;
+        const envFlags = Object.entries(config.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+        await preMkdirVolumes(dc.volumes ?? [], config.env);
+        const volumeFlags = (dc.volumes ?? []).flatMap((v) => ["-v", expandEnvVars2(v, config.env)]);
+        if (dc.mountRootpath && config.cwd) {
+          volumeFlags.push("-v", `${config.cwd}:${config.cwd}`);
+        }
+        if (dc.image && !dc.dockerfile) {
+          lastCardId = randomUUID();
+          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "pull", _cardId: lastCardId, _cardState: "open", message: `--- Docker Pull: ${dc.image} ---` }) + "\n");
+          const pull = execa2("docker", ["pull", dc.image], { reject: false });
+          pull.stdout?.pipe(stdout, { end: false });
+          pull.stderr?.pipe(stderr, { end: false });
+          await pull;
+        }
+        let imageName = dc.image ?? containerName + ":latest";
+        if (dc.dockerfile) {
+          lastCardId = randomUUID();
+          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "build", _cardId: lastCardId, _cardState: "open", message: "--- Docker Build ---" }) + "\n");
+          const tmpFile = join(tmpdir(), `runeya-${config.serviceId}-${randomUUID()}.dockerfile`);
+          try {
+            await writeFile(tmpFile, dc.dockerfile, "utf8");
+            const buildArgs = Object.entries(dc.buildArgs ?? {}).flatMap(([k, v]) => ["--build-arg", `${k}=${v}`]);
+            const targetArgs = dc.targetStage ? ["--target", dc.targetStage] : [];
+            const buildContext = dc.buildContext ?? config.cwd ?? ".";
+            imageName = `${containerName}:latest`;
+            const build = execa2("docker", ["build", "-f", tmpFile, "-t", imageName, ...buildArgs, ...targetArgs, buildContext], { reject: false });
+            build.stdout?.pipe(stdout, { end: false });
+            build.stderr?.pipe(stderr, { end: false });
+            await build;
+          } finally {
+            await unlink(tmpFile).catch(() => {
+            });
+          }
+        }
+        if (killed) {
+          rejectReady(new Error("Killed before container started"));
+          exitResolve({ exitCode: null, signal: "SIGTERM" });
+          return;
+        }
+        if (lastCardId) {
+          stdout.write("\0DOCKER_PHASE:" + JSON.stringify({ _dockerPhase: "close", _cardId: lastCardId, _cardState: "close" }) + "\n");
+        }
+        const networkFlags = dc.networkMode === "host" ? ["--network", "host"] : (dc.ports ?? []).flatMap((p) => ["-p", p]);
+        const { uid, gid } = userInfo();
+        const runArgs = [
+          "run",
+          "--detach",
+          "--init",
+          "--name",
+          containerName,
+          "--user",
+          dc.user || `${uid}:${gid}`,
+          ...networkFlags,
+          ...envFlags,
+          ...volumeFlags,
+          imageName,
+          "sleep",
+          "infinity"
+        ];
+        const debugCardId = randomUUID();
+        stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "run", _cardId: debugCardId, _cardState: "open", message: "Docker Run (shared container)" })}
+`);
+        stdout.write(`docker ${runArgs.join(" ")}
+`);
+        stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: debugCardId, _cardState: "close" })}
+`);
+        const runProc = execa2("docker", runArgs, { reject: false });
+        runProc.stdout?.pipe(stdout, { end: false });
+        runProc.stderr?.pipe(stderr, { end: false });
+        const runResult = await runProc;
+        if (runResult.exitCode !== 0) {
+          rejectReady(new Error(`docker run exited with code ${runResult.exitCode}`));
+          exitResolve({ exitCode: runResult.exitCode ?? 1, signal: null });
+          return;
+        }
+        resolveReady();
+        const waitProc = execa2("docker", ["wait", containerName], { reject: false });
+        await waitProc;
+        exitResolve({ exitCode: 0, signal: null });
       } catch (err) {
-        console.warn(
-          `[js-log-parser] Parser "${parser.name}" threw error: ${err instanceof Error ? err.message : String(err)}`
-        );
+        const msg = err instanceof Error ? err.message : String(err);
+        stderr.write(`Docker infrastructure error: ${msg}
+`);
+        rejectReady(new Error(msg));
+        exitResolve({ exitCode: 1, signal: null });
+      } finally {
+        stdout.end();
+        stderr.end();
       }
-    }
-    return this.sanitize(current);
+    })();
+    return {
+      pid: void 0,
+      containerName,
+      stdout,
+      stderr,
+      exitPromise,
+      containerReady,
+      kill(_signal = "SIGTERM") {
+        killed = true;
+        execa2("docker", ["kill", containerName]).then(() => exitResolve({ exitCode: null, signal: "SIGKILL" })).catch(() => exitResolve({ exitCode: 1, signal: null }));
+        return true;
+      }
+    };
   }
-  /**
-   * Compile le code utilisateur en une fonction bornée en temps.
-   *
-   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
-   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
-   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
-   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
-   * métriques de *tous* les services. Chaque invocation repasse maintenant par
-   * la vm, avec son propre budget.
-   */
-  compileParser(def) {
-    const forbidden = ["require(", "import ", "eval("];
-    for (const pat of forbidden) {
-      if (def.code.includes(pat)) {
-        throw new Error("Code contains forbidden patterns (require, import, eval)");
+  /** Run a command inside a running shared container via `docker exec`.
+   *  Kill terminates the docker-exec process but does NOT stop the container. */
+  execInContainer(containerName, command, envVars = {}, shell = "sh") {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    let dockerProc = null;
+    const exitPromise = new Promise(
+      (resolve2) => {
+        void (async () => {
+          try {
+            const envFlags = Object.entries(envVars).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+            const shellCmd = command.length ? command : "true";
+            dockerProc = execa2(
+              "docker",
+              ["exec", ...envFlags, containerName, shell, "-c", shellCmd],
+              { reject: false }
+            );
+            dockerProc.stdout?.pipe(stdout, { end: false });
+            dockerProc.stderr?.pipe(stderr, { end: false });
+            const result = await dockerProc;
+            resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr.write(`docker execInContainer error: ${msg}
+`);
+            resolve2({ exitCode: 1, signal: null });
+          } finally {
+            stdout.end();
+            stderr.end();
+          }
+        })();
+      }
+    );
+    return {
+      pid: void 0,
+      containerName,
+      stdout,
+      stderr,
+      exitPromise,
+      kill(_signal = "SIGTERM") {
+        dockerProc?.kill("SIGTERM");
+        return true;
       }
-    }
-    const sandbox = {
-      RegExp,
-      String,
-      Object,
-      Array,
-      JSON,
-      Math,
-      Date,
-      undefined: void 0,
-      null: null
     };
-    let script;
-    try {
-      script = new vm.Script(`(${def.code})`, { filename: `parser-${def.id}.js` });
-    } catch (err) {
-      throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
-    let parserFn;
-    try {
-      parserFn = script.runInContext(context, { timeout: 100 });
-    } catch (err) {
-      throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    if (typeof parserFn !== "function") {
-      throw new Error("Parser code must export a function");
-    }
-    context["__parserFn"] = parserFn;
-    const callScript = new vm.Script("__result = __parserFn(__line);", {
-      filename: `parser-${def.id}-call.js`
-    });
-    let consecutiveTimeouts = 0;
-    let disabled = false;
-    return (line) => {
-      if (disabled) return line;
-      const ctx = context;
-      ctx["__line"] = line;
-      ctx["__result"] = null;
-      try {
-        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
-        consecutiveTimeouts = 0;
-      } catch (err) {
-        const e = err;
-        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
-        if (!timedOut) throw err;
-        consecutiveTimeouts += 1;
-        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
-          disabled = true;
-          console.warn(
-            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
-          );
-        }
-        return line;
+  }
+  /** Run a shortcut command in the context of a Docker service.
+   *  If a service container is running (shared or isolated), uses `docker exec`.
+   *  If not running, reuses `start()` with `--rm` and `skipBootstrap`. */
+  runShortcut(config, shortcutCommand) {
+    const stdout = new PassThrough();
+    const stderr = new PassThrough();
+    let innerProcess = null;
+    let dockerProc = null;
+    const exitPromise = new Promise(
+      (resolve2) => {
+        void (async () => {
+          try {
+            const psResult = await execa2(
+              "docker",
+              ["ps", "--filter", `name=runeya-${config.serviceId}`, "--format", "{{.Names}}"],
+              { reject: false }
+            );
+            const runningContainer = psResult.stdout.trim().split("\n").find((n) => n.startsWith(`runeya-${config.serviceId}`));
+            if (runningContainer) {
+              const shell = config.dockerConfig.nativeShell || "sh";
+              const envFlags = Object.entries(config.env ?? {}).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+              const args = ["exec", ...envFlags, runningContainer, shell, "-c", shortcutCommand || "true"];
+              const cardId = randomUUID();
+              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "exec", _cardId: cardId, _cardState: "open", message: "Docker Exec" })}
+`);
+              stdout.write(`docker ${args.join(" ")}
+`);
+              stdout.write(`\0DOCKER_PHASE:${JSON.stringify({ _dockerPhase: "close", _cardId: cardId, _cardState: "close" })}
+`);
+              dockerProc = execa2("docker", args, { reject: false });
+              dockerProc.stdout?.pipe(stdout, { end: false });
+              dockerProc.stderr?.pipe(stderr, { end: false });
+              const result = await dockerProc;
+              resolve2({ exitCode: result.exitCode ?? null, signal: result.signal ?? null });
+            } else {
+              innerProcess = this.start({
+                ...config,
+                command: shortcutCommand,
+                cmdId: `shortcut-${randomUUID()}`,
+                rm: true,
+                skipBootstrap: true,
+                dockerConfig: { ...config.dockerConfig, useNativeCommand: true }
+              });
+              innerProcess.stdout?.pipe(stdout, { end: false });
+              innerProcess.stderr?.pipe(stderr, { end: false });
+              const result = await innerProcess.exitPromise;
+              resolve2(result);
+            }
+          } catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            stderr.write(`docker shortcut error: ${msg}
+`);
+            resolve2({ exitCode: 1, signal: null });
+          } finally {
+            stdout.end();
+            stderr.end();
+          }
+        })();
       }
-      const result = ctx["__result"];
-      if (result === null || result === void 0 || typeof result !== "object") {
-        return line;
+    );
+    return {
+      pid: void 0,
+      stdout,
+      stderr,
+      exitPromise,
+      kill(signal = "SIGTERM") {
+        if (innerProcess) return innerProcess.kill(signal);
+        dockerProc?.kill("SIGTERM");
+        return true;
       }
-      return result;
     };
   }
-  /** Sanitize the final LogLine: truncate message, limit metadata, validate level */
-  sanitize(line) {
-    let { message, metadata, level } = line;
-    if (message.length > 16384) {
-      message = message.substring(0, 16384) + "...[truncated]";
-    }
-    metadata = metadata ?? {};
-    const metaKeys = Object.keys(metadata);
-    if (metaKeys.length > 100) {
-      const limited = {};
-      for (let i = 0; i < 100; i++) {
-        limited[metaKeys[i]] = metadata[metaKeys[i]];
-      }
-      metadata = limited;
-    }
-    if (!VALID_LEVELS.has(level)) {
-      level = "info";
-    }
-    if (message !== line.message || metadata !== line.metadata || level !== line.level) {
-      return { ...line, message, metadata, level };
-    }
-    return line;
+  async isAvailable() {
+    const result = await execa2("docker", ["info"], { reject: false });
+    return result.exitCode === 0;
+  }
+  /** Run a single bootstrap command sequentially inside a temporary container (--rm).
+   * Streams stdout/stderr into the provided PassThrough streams.
+   * Resolves with the exit code when the container exits. */
+  async runBootstrap(cmd, imageName, env2, volumes, stdout, stderr) {
+    const containerName = sanitizeDockerName(`runeya-bootstrap-${randomUUID()}`);
+    const envFlags = Object.entries(env2).flatMap(([k, v]) => ["-e", `${k}=${v}`]);
+    await preMkdirVolumes(volumes, env2);
+    const volumeFlags = volumes.map((v) => expandEnvVars2(v, env2)).flatMap((v) => ["-v", v]);
+    const entrypointFlags = cmd.entrypoint ? ["--entrypoint", cmd.entrypoint] : [];
+    const { uid, gid } = userInfo();
+    const defaultUser = `${uid}:${gid}`;
+    const userFlags = ["--user", cmd.user || defaultUser];
+    const cmdArgs = splitShellArgs(cmd.command);
+    const runArgs = [
+      "run",
+      "--rm",
+      "--init",
+      "--name",
+      containerName,
+      "--network",
+      "host",
+      ...envFlags,
+      ...volumeFlags,
+      ...entrypointFlags,
+      ...userFlags,
+      imageName,
+      ...cmdArgs
+    ];
+    const proc = execa2("docker", runArgs, { reject: false });
+    proc.stdout?.pipe(stdout, { end: false });
+    proc.stderr?.pipe(stderr, { end: false });
+    const result = await proc;
+    return result.exitCode ?? 1;
   }
 };
 
-// ../../packages/shared/src/constants/intervals.ts
-var HEALTH_CHECK_INTERVAL = 3e4;
-var METRICS_INTERVAL = 5e3;
-var HEALTH_CHECK_INITIAL_DELAY = 5e3;
-var HEALTH_WS_INTERVAL = 1e4;
-
-// ../../packages/shared/src/constants/buffers.ts
-var LOG_BUFFER_SIZE = 5e3;
-
-// ../../packages/shared/src/constants/timeouts.ts
-var GRACE_PERIOD = 1e4;
-var AGENT_STOP_FETCH_TIMEOUT = GRACE_PERIOD + 15e3;
-
-// ../../packages/shared/src/constants/editors.ts
-var SUPPORTED_EDITORS = [
-  { key: "vscode", name: "Visual Studio Code", command: "code" },
-  { key: "cursor", name: "Cursor", command: "cursor" },
-  { key: "windsurf", name: "Windsurf", command: "windsurf" },
-  { key: "sublime", name: "Sublime Text", command: "subl" },
-  { key: "atom", name: "Atom", command: "atom" },
-  { key: "antigravity", name: "Antigravity", command: "antigravity" },
-  { key: "intellij", name: "IntelliJ IDEA", command: "idea" },
-  { key: "android-studio", name: "Android Studio", command: "studio" },
-  { key: "webstorm", name: "WebStorm", command: "webstorm" },
-  { key: "zed", name: "Zed", command: "zed" },
-  { key: "neovim", name: "Neovim", command: "nvim" },
-  { key: "vim", name: "Vim", command: "vim" },
-  { key: "emacs", name: "Emacs", command: "emacs" },
-  { key: "fleet", name: "Fleet", command: "fleet" }
-];
-var EDITOR_BY_KEY = new Map(
-  SUPPORTED_EDITORS.map((e) => [e.key, e])
-);
+// src/services/process-store.ts
+var ProcessStore = class {
+  processes = /* @__PURE__ */ new Map();
+  get(id) {
+    return this.processes.get(id);
+  }
+  getAll() {
+    return Array.from(this.processes.values());
+  }
+  set(id, process2) {
+    this.processes.set(id, process2);
+  }
+  delete(id) {
+    return this.processes.delete(id);
+  }
+  has(id) {
+    return this.processes.has(id);
+  }
+  clear() {
+    this.processes.clear();
+  }
+  getByServiceId(serviceId) {
+    return this.getAll().find((p) => p.serviceConfig.id === serviceId);
+  }
+};
+var processStore = new ProcessStore();
 
-// ../../packages/shared/src/sync/json-crdt.ts
-import * as Y from "yjs";
+// src/services/log-sources/console-log-source.ts
+import { createInterface } from "readline";
+import { EventEmitter } from "events";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // src/services/log-parser.ts
 var DEFAULT_LEVEL_PATTERNS = [
@@ -3596,13 +3654,20 @@ function getLanIp() {
   }
   return "127.0.0.1";
 }
-function resolveServiceBuiltins(serviceEnv) {
-  const hostLan = getLanIp();
-  const resolved = {};
-  for (const [key, value] of Object.entries(serviceEnv)) {
-    resolved[key] = value.replaceAll("{{service.HOST_LAN}}", hostLan);
-  }
-  return resolved;
+function resolveAgentBuiltins(serviceConfig) {
+  const values = {
+    "agent.HOST_LAN": getLanIp(),
+    "agent.OS": platform2(),
+    "agent.HOME": homedir5(),
+    // Le cwd est calculé avec l'env AVANT substitution : une variable qui
+    // référencerait `{{service.CWD}}` ne peut donc pas se boucler sur
+    // elle-même — la substitution ne repasse jamais sur son propre résultat.
+    "service.CWD": resolve(resolveCwd(
+      serviceConfig.resolvedCwd ?? serviceConfig.cwd,
+      resolveEnv(serviceConfig.env)
+    ))
+  };
+  return withDeprecatedAliases(values);
 }
 var ProcessManager = class extends EventEmitter7 {
   runners = /* @__PURE__ */ new Map();
@@ -3701,7 +3766,10 @@ var ProcessManager = class extends EventEmitter7 {
       throw new Error(`Process ${processId} is already ${proc.state}`);
     }
     if (proc.serviceConfig.env) {
-      proc.serviceConfig = { ...proc.serviceConfig, env: resolveServiceBuiltins(proc.serviceConfig.env) };
+      proc.serviceConfig = {
+        ...proc.serviceConfig,
+        env: interpolateBuiltinsInEnv(proc.serviceConfig.env, resolveAgentBuiltins(proc.serviceConfig))
+      };
     }
     const commands = (proc.serviceConfig.commands ?? []).filter((c) => c.command.trim());
     const isDocker = proc.serviceConfig.runner === "docker";
@@ -4549,7 +4617,7 @@ var processRouter = router({
 });
 
 // src/trpc/routers/health.ts
-import { networkInterfaces as networkInterfaces2 } from "os";
+import { networkInterfaces as networkInterfaces2, homedir as homedir6, platform as platform3 } from "os";
 import { execFile as execFile3 } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile3);
@@ -4574,7 +4642,14 @@ async function getHealthData() {
     runnersAvailable: runners,
     processCount: processes.length,
     runningCount: processes.filter((p) => p.state === "running").length,
-    lanIp: getLanIp2()
+    lanIp: getLanIp2(),
+    // Ce qui décrit la machine, pour que l'interface puisse montrer la valeur
+    // qu'aura `{{agent.OS}}`, `{{agent.HOME}}`, `{{service.CWD}}` AVANT que le
+    // service ne démarre. La résolution, elle, reste faite ici au lancement :
+    // ce statut n'est qu'un cliché, et l'agent reste l'autorité sur sa machine.
+    os: platform3(),
+    home: homedir6(),
+    cwd: process.cwd()
   };
 }
 var healthRouter = router({
@@ -6469,7 +6544,7 @@ function appendToPath(dir, environment = process.env) {
 // ../../packages/shared/src/node/user-path.ts
 import { execFile as execFile5 } from "child_process";
 import { promisify as promisify3 } from "util";
-import { homedir as homedir5 } from "os";
+import { homedir as homedir7 } from "os";
 import { existsSync as existsSync4, statSync } from "fs";
 import { join as join6, delimiter as delimiter2 } from "path";
 var execFileAsync3 = promisify3(execFile5);
@@ -6506,7 +6581,7 @@ async function readLoginShellPath() {
     return null;
   }
 }
-async function ensureUserBinsOnPath(environment = process.env, home = homedir5()) {
+async function ensureUserBinsOnPath(environment = process.env, home = homedir7()) {
   const shellPath = await readLoginShellPath();
   if (shellPath) {
     for (const entry of shellPath.split(delimiter2).filter(Boolean)) {