@runeya/runeya 2.0.92 → 2.0.94

package/{src-K5L5HTKP.js → src-GGPKDQGD.js}

@@ -5,6 +5,9 @@ import {
   AmbiguousProjectError,
   ApiKeyScopeSchema,
   ApiKeysFileSchema,
+  ChangelogIndexItemSchema,
+  ChangelogReleaseSchema,
+  ChangelogSurfaceSchema,
   CreateEnvironmentSchema,
   DockerConfigSchema,
   EDITOR_BY_KEY,
@@ -114,7 +117,7 @@ import {
   wasRead,
   withDeprecatedAliases,
   writeEntity
-} from "./chunk-PDRWT47K.js";
+} from "./chunk-4PQXBTV6.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -494,6 +497,28 @@ function compareSemver(a, b) {
   }
   return 0;
 }
+var VERSION_CACHE_MS = 4 * 60 * 1e3;
+var versionCache = null;
+async function fetchLatestVersion() {
+  if (versionCache && Date.now() - versionCache.at < VERSION_CACHE_MS) {
+    return versionCache.latest;
+  }
+  let latest = null;
+  try {
+    const res = await fetch(NPM_LATEST_URL, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (res.ok) {
+      const parsed = z.object({ version: z.string().max(64) }).safeParse(await res.json());
+      if (parsed.success) latest = parsed.data.version;
+    }
+  } catch {
+    latest = null;
+  }
+  versionCache = { at: Date.now(), latest };
+  return latest;
+}
 var healthRouter = router({
   check: publicProcedure.meta({ openapi: { method: "GET", path: "/health", tags: ["health"], summary: "Health check" } }).output(z.object({ status: z.literal("ok"), uptime: z.number(), version: z.string() })).query(() => {
     return {
@@ -512,25 +537,13 @@ var healthRouter = router({
     if (appVersion === "dev") {
       return { current: appVersion, latest: null, status: "dev" };
     }
-    try {
-      const res = await fetch(NPM_LATEST_URL, {
-        headers: { accept: "application/json" },
-        signal: AbortSignal.timeout(5e3)
-      });
-      if (!res.ok) {
-        return { current: appVersion, latest: null, status: "unknown" };
-      }
-      const parsed = z.object({ version: z.string().max(64) }).safeParse(await res.json());
-      if (!parsed.success) {
-        return { current: appVersion, latest: null, status: "unknown" };
-      }
-      const latest = parsed.data.version;
-      const cmp = compareSemver(appVersion, latest);
-      const status = cmp === 0 ? "up-to-date" : cmp < 0 ? "outdated" : "ahead";
-      return { current: appVersion, latest, status };
-    } catch {
+    const latest = await fetchLatestVersion();
+    if (latest === null) {
       return { current: appVersion, latest: null, status: "unknown" };
     }
+    const cmp = compareSemver(appVersion, latest);
+    const status = cmp === 0 ? "up-to-date" : cmp < 0 ? "outdated" : "ahead";
+    return { current: appVersion, latest, status };
   }),
   systemInfo: protectedProcedure.output(
     z.object({
@@ -701,18 +714,233 @@ var appUpdateRouter = router({
   })
 });
 
-// ../server/src/trpc/routers/project.ts
+// ../server/src/trpc/routers/changelog.ts
 import { z as z3 } from "zod";
+
+// ../server/src/services/cloud-session-store.ts
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2, unlink } from "fs/promises";
+import { dirname as dirname3 } from "path";
+import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
+var FILENAME = "cloud-session.json";
+var STATE_TTL_MS = 5 * 60 * 1e3;
+var CloudSessionStore = class {
+  session = null;
+  loaded = false;
+  /** Pending login states (CSRF binding between `start` and the callback). */
+  pending = /* @__PURE__ */ new Map();
+  /**
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
+   */
+  getFilePath() {
+    return keyedFilePath(FILENAME);
+  }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME);
+  }
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile2(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile2(this.getLegacyFilePath(), "utf-8");
+    }
+  }
+  async load() {
+    if (this.loaded) return;
+    try {
+      const raw = await this.readFromDisk();
+      this.session = JSON.parse(raw);
+    } catch {
+    }
+    this.loaded = true;
+  }
+  /**
+   * Mint a state value binding a login attempt to this server. Returned to the
+   * cloud page and echoed back on the callback, so a redirect we never
+   * initiated cannot install a token.
+   */
+  createState(returnTo) {
+    this.sweepStates();
+    const state = randomBytes3(32).toString("hex");
+    this.pending.set(state, { expiresAt: Date.now() + STATE_TTL_MS, returnTo });
+    return state;
+  }
+  /**
+   * Consume a state — single use, constant-time compare, TTL enforced. Returns
+   * the URL to send the browser back to, or null when the state is unknown or
+   * expired (i.e. a callback this server never initiated).
+   */
+  consumeState(candidate) {
+    this.sweepStates();
+    for (const [state, entry] of this.pending) {
+      const a = Buffer.from(state);
+      const b = Buffer.from(candidate);
+      if (a.length === b.length && timingSafeEqual2(a, b)) {
+        this.pending.delete(state);
+        return entry.expiresAt > Date.now() ? entry.returnTo : null;
+      }
+    }
+    return null;
+  }
+  sweepStates() {
+    const now = Date.now();
+    for (const [state, entry] of this.pending) {
+      if (entry.expiresAt <= now) this.pending.delete(state);
+    }
+  }
+  async save() {
+    await mkdir2(dirname3(await this.getFilePath()), { recursive: true });
+    const filePath = await this.getFilePath();
+    const tmpPath = filePath + ".tmp";
+    await writeFile2(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await rename2(tmpPath, filePath);
+    await chmod2(filePath, 384);
+  }
+  /** Store the session token obtained from the one-time-token exchange. */
+  async set(cloudUrl, token) {
+    await this.load();
+    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
+    await this.save();
+  }
+  /** The decrypted session token, or null when not logged in. */
+  async getToken() {
+    await this.load();
+    if (!this.session) return null;
+    try {
+      return decryptValue(this.session.encryptedToken);
+    } catch {
+      return null;
+    }
+  }
+  /**
+   * The cloud this machine is signed into, or null when not linked.
+   *
+   * Needed to tell "an org I am not a member of" apart from "an org of another
+   * cloud instance entirely" — the ids of two clouds share no namespace, so
+   * comparing them without this would call every foreign-cloud project a
+   * permission problem.
+   */
+  async getCloudUrl() {
+    await this.load();
+    return this.session?.cloudUrl ?? null;
+  }
+  async isLinked() {
+    return await this.getToken() !== null;
+  }
+  /** Forget the session (sign-out). */
+  async clear() {
+    await this.load();
+    this.session = null;
+    this.pending.clear();
+    try {
+      await unlink(await this.getFilePath());
+    } catch {
+    }
+  }
+};
+var cloudSessionStore = new CloudSessionStore();
+
+// ../server/src/services/cloud-api.ts
+var DEFAULT_CLOUD_API_URL = "https://api.runeya.dev";
+var DEFAULT_CLOUD_APP_URL = "https://runeya.dev";
+function getCloudApiUrl() {
+  return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
+}
+function getCloudAppUrl() {
+  return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
+}
+var CloudNotLinkedError = class extends Error {
+  code = "CLOUD_NOT_LINKED";
+  constructor() {
+    super("Not linked to the Runeya cloud.");
+    this.name = "CloudNotLinkedError";
+  }
+};
+async function cloudFetch(path, init = {}) {
+  const token = await cloudSessionStore.getToken();
+  if (!token) throw new CloudNotLinkedError();
+  return fetch(`${getCloudApiUrl()}${path}`, {
+    method: init.method ?? "GET",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
+      [APP_VERSION_HEADER]: appVersion,
+      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
+    },
+    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
+    // 15s suits a JSON call; attachment downloads pass a longer budget.
+    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
+  });
+}
+
+// ../server/src/trpc/routers/changelog.ts
+var CACHE_MS = 5 * 60 * 1e3;
+var cache = /* @__PURE__ */ new Map();
+async function cloudChangelog(path, params) {
+  const search = new URLSearchParams();
+  for (const [key, value2] of Object.entries(params)) if (value2) search.set(key, value2);
+  const url = `${getCloudApiUrl()}${path}?${search.toString()}`;
+  const hit = cache.get(url);
+  if (hit && Date.now() - hit.at < CACHE_MS) return hit.value;
+  const res = await fetch(url, {
+    headers: { accept: "application/json" },
+    signal: AbortSignal.timeout(8e3)
+  });
+  if (!res.ok) throw new Error(`changelog: HTTP ${res.status}`);
+  const value = await res.json();
+  cache.set(url, { at: Date.now(), value });
+  return value;
+}
+function appCeiling() {
+  return appVersion === "dev" ? null : appVersion;
+}
+var inputSchema = z3.object({
+  surface: ChangelogSurfaceSchema,
+  /** Dernière version déjà vue par ce navigateur, exclue du résultat. */
+  since: z3.string().max(32).nullish()
+});
+var changelogRouter = router({
+  /** Ce qu'il y a à lire, sans les corps. */
+  index: publicProcedure.input(inputSchema).output(z3.object({ releases: z3.array(ChangelogIndexItemSchema), currentAppVersion: z3.string() })).query(async ({ input }) => {
+    const data = await cloudChangelog("/api/changelog", {
+      surface: input.surface,
+      since: input.since ?? null,
+      until: input.surface === "app" ? appCeiling() : null
+    });
+    const parsed = z3.object({ releases: z3.array(ChangelogIndexItemSchema) }).parse(data);
+    return { releases: parsed.releases, currentAppVersion: appVersion };
+  }),
+  /** Les entrées complètes. */
+  releases: publicProcedure.input(inputSchema).output(z3.object({ releases: z3.array(ChangelogReleaseSchema), currentAppVersion: z3.string() })).query(async ({ input }) => {
+    const data = await cloudChangelog("/api/changelog/releases", {
+      surface: input.surface,
+      since: input.since ?? null,
+      until: input.surface === "app" ? appCeiling() : null
+    });
+    const parsed = z3.object({ releases: z3.array(ChangelogReleaseSchema) }).parse(data);
+    return { releases: parsed.releases, currentAppVersion: appVersion };
+  })
+});
+
+// ../server/src/trpc/routers/project.ts
+import { z as z4 } from "zod";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/project-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { EventEmitter } from "events";
-import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3, rm } from "fs/promises";
+import { readFile as readFile4, writeFile as writeFile5, rename as rename4, mkdir as mkdir4, chmod as chmod4, rm } from "fs/promises";
 import { join as join5 } from "path";
 
 // ../server/src/utils/ensure-data-gitignore.ts
-import { writeFile as writeFile2 } from "fs/promises";
+import { writeFile as writeFile3 } from "fs/promises";
 import { join as join3 } from "path";
 var GITIGNORE_CONTENT = `
 #################
@@ -751,19 +979,19 @@ conversations.private.json
 `;
 async function ensureDataGitignore(dataDir) {
   const gitignorePath = join3(dataDir, ".gitignore");
-  await writeFile2(gitignorePath, GITIGNORE_CONTENT, "utf-8");
+  await writeFile3(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 
 // ../server/src/services/project-path-store.ts
-import { readFile as readFile2, writeFile as writeFile3, rename as rename2, mkdir as mkdir2, chmod as chmod2, stat } from "fs/promises";
+import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3, stat } from "fs/promises";
 import { isAbsolute, join as join4, resolve } from "path";
-var FILENAME = "project-paths.json";
+var FILENAME2 = "project-paths.json";
 var ProjectPathStore = class {
   paths = null;
   async load() {
     if (this.paths) return this.paths;
     try {
-      const raw = await readFile2(machineFilePath(FILENAME), "utf-8");
+      const raw = await readFile3(machineFilePath(FILENAME2), "utf-8");
       const parsed = JSON.parse(raw);
       this.paths = isPathMap(parsed) ? parsed : {};
     } catch {
@@ -772,12 +1000,12 @@ var ProjectPathStore = class {
     return this.paths;
   }
   async persist() {
-    await mkdir2(machineRoot(), { recursive: true });
-    const filePath = machineFilePath(FILENAME);
+    await mkdir3(machineRoot(), { recursive: true });
+    const filePath = machineFilePath(FILENAME2);
     const tmpPath = `${filePath}.tmp`;
-    await writeFile3(tmpPath, JSON.stringify(this.paths ?? {}, null, 2), "utf-8");
-    await rename2(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    await writeFile4(tmpPath, JSON.stringify(this.paths ?? {}, null, 2), "utf-8");
+    await rename3(tmpPath, filePath);
+    await chmod3(filePath, 384);
   }
   /** The directory chosen for this project, or null while it has none. */
   async get(ref) {
@@ -855,7 +1083,7 @@ async function holdsRuneyaProject(path) {
 var projectPathStore = new ProjectPathStore();
 
 // ../server/src/services/project-store.ts
-var FILENAME2 = "project.json";
+var FILENAME3 = "project.json";
 var LEGACY_FILENAME = "projects.json";
 function toDiskForm(project) {
   const { activeEnvironmentId: _runtimeOnly, ...rest } = project;
@@ -865,14 +1093,14 @@ async function readLocalProject() {
   const root = localVaultRoot();
   let current = null;
   try {
-    const raw = await readFile3(join5(root, FILENAME2), "utf-8");
+    const raw = await readFile4(join5(root, FILENAME3), "utf-8");
     const parsed = ProjectSchema.safeParse(JSON.parse(raw));
     if (parsed.success) current = parsed.data;
   } catch {
   }
   let legacy;
   try {
-    legacy = JSON.parse(await readFile3(join5(root, LEGACY_FILENAME), "utf-8"));
+    legacy = JSON.parse(await readFile4(join5(root, LEGACY_FILENAME), "utf-8"));
   } catch {
     return { local: current, strayCloud: [] };
   }
@@ -891,7 +1119,7 @@ async function readCloudProjects() {
   const found = [];
   for (const { orgId, projectId, root } of await listCloudVaults()) {
     try {
-      const raw = await readFile3(join5(root, FILENAME2), "utf-8");
+      const raw = await readFile4(join5(root, FILENAME3), "utf-8");
       const parsed = ProjectSchema.safeParse({ ...JSON.parse(raw), id: projectId, orgId });
       if (parsed.success) found.push({ project: parsed.data, root });
     } catch {
@@ -921,13 +1149,13 @@ var ProjectStore = class {
   /** Emits `'saved'` after every persisted mutation, for the cloud sync bridge. */
   events = new EventEmitter();
   getFilePath(root = localVaultRoot()) {
-    return join5(root, FILENAME2);
+    return join5(root, FILENAME3);
   }
   async writeAtomic(filePath, data) {
     const tmpPath = filePath + ".tmp";
-    await writeFile4(tmpPath, data, "utf-8");
-    await rename3(tmpPath, filePath);
-    await chmod3(filePath, 384);
+    await writeFile5(tmpPath, data, "utf-8");
+    await rename4(tmpPath, filePath);
+    await chmod4(filePath, 384);
   }
   /** Adopt a project read from disk, remembering which vault it came from. */
   async absorb(p, root) {
@@ -1002,10 +1230,10 @@ var ProjectStore = class {
       await rm(this.getFilePath(), { force: true }).catch(() => {
       });
     }
-    await rename3(join5(localVaultRoot(), LEGACY_FILENAME), join5(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
+    await rename4(join5(localVaultRoot(), LEGACY_FILENAME), join5(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
     });
     for (const { project, root } of cloud) {
-      await mkdir3(root, { recursive: true });
+      await mkdir4(root, { recursive: true });
       await this.writeAtomic(this.getFilePath(root), JSON.stringify(toDiskForm(project), null, 2));
       setProjectVault(project, root);
     }
@@ -1296,9 +1524,9 @@ var projectStore = new ProjectStore();
 registerProjectLoader(() => projectStore.list().then(() => void 0));
 
 // ../server/src/services/environment-overrides-store.ts
-import { readFile as readFile4, writeFile as writeFile5, rename as rename4, mkdir as mkdir4, chmod as chmod4 } from "fs/promises";
-import { dirname as dirname3, join as join6 } from "path";
-var FILENAME3 = "environment-overrides.json";
+import { readFile as readFile5, writeFile as writeFile6, rename as rename5, mkdir as mkdir5, chmod as chmod5 } from "fs/promises";
+import { dirname as dirname4, join as join6 } from "path";
+var FILENAME4 = "environment-overrides.json";
 var EnvironmentOverridesStore = class {
   data = {};
   loaded = false;
@@ -1330,11 +1558,11 @@ var EnvironmentOverridesStore = class {
   async rootFor(variableId) {
     const root = await environmentStore.rootOfVariable(variableId);
     if (root) return root;
-    return this.roots.get(variableId) ?? dirname3(await keyedFilePath(FILENAME3));
+    return this.roots.get(variableId) ?? dirname4(await keyedFilePath(FILENAME4));
   }
   /** Where earlier versions kept them: read once, rewritten to their vaults. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME3);
+    return legacyMachineFilePath(FILENAME4);
   }
   /**
    * Read every vault, then the places older versions used.
@@ -1350,13 +1578,13 @@ var EnvironmentOverridesStore = class {
     const roots = await allVaultRoots();
     const sources = [
       this.getLegacyFilePath(),
-      await keyedFilePath(FILENAME3),
-      ...roots.map((root) => join6(root, FILENAME3))
+      await keyedFilePath(FILENAME4),
+      ...roots.map((root) => join6(root, FILENAME4))
     ];
     for (const path of sources) {
       let parsed;
       try {
-        parsed = JSON.parse(await readFile4(path, "utf-8"));
+        parsed = JSON.parse(await readFile5(path, "utf-8"));
       } catch {
         continue;
       }
@@ -1368,11 +1596,11 @@ var EnvironmentOverridesStore = class {
         parsed,
         "environment-overrides",
         (variableId) => this.unreadableSecrets.add(variableId),
-        vaultIdOfRoot(dirname3(path))
+        vaultIdOfRoot(dirname4(path))
       );
       for (const [id, override] of Object.entries(decrypted)) {
         this.data[id] = { value: override.value };
-        this.roots.set(id, dirname3(path));
+        this.roots.set(id, dirname4(path));
       }
     }
   }
@@ -1407,12 +1635,12 @@ var EnvironmentOverridesStore = class {
         this.diskEncryptedSlots,
         extractEncryptedVariableSlots(encrypted)
       );
-      await mkdir4(root, { recursive: true });
-      const path = join6(root, FILENAME3);
+      await mkdir5(root, { recursive: true });
+      const path = join6(root, FILENAME4);
       const tmpPath = path + ".tmp";
-      await writeFile5(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
-      await rename4(tmpPath, path);
-      await chmod4(path, 384);
+      await writeFile6(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
+      await rename5(tmpPath, path);
+      await chmod5(path, 384);
     }
   }
   /**
@@ -1849,7 +2077,7 @@ var EnvironmentResolver = class {
 var environmentResolver = new EnvironmentResolver();
 
 // ../server/src/services/audit-service.ts
-import { appendFile, readFile as readFile5, stat as stat2, rename as rename5, unlink, readdir, mkdir as mkdir5 } from "fs/promises";
+import { appendFile, readFile as readFile6, stat as stat2, rename as rename6, unlink as unlink2, readdir, mkdir as mkdir6 } from "fs/promises";
 var AUDIT_FILENAME = "audit.log";
 var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_AGE_DAYS = 30;
@@ -1869,7 +2097,7 @@ var AuditService = class {
     const line = JSON.stringify(record) + "\n";
     const filepath = this.getFilePath();
     try {
-      await mkdir5(machineRoot(), { recursive: true });
+      await mkdir6(machineRoot(), { recursive: true });
       await appendFile(filepath, line, "utf-8");
       await this.rotateIfNeeded();
     } catch (err) {
@@ -1882,7 +2110,7 @@ var AuditService = class {
     const filepath = this.getFilePath();
     let lines;
     try {
-      const content = await readFile5(filepath, "utf-8");
+      const content = await readFile6(filepath, "utf-8");
       lines = content.trim().split("\n").filter(Boolean);
     } catch {
       return { entries: [], total: 0 };
@@ -1915,7 +2143,7 @@ var AuditService = class {
     try {
       const stats = await stat2(filepath);
       if (stats.size > MAX_FILE_SIZE) {
-        await rename5(filepath, this.getRotatedPath());
+        await rename6(filepath, this.getRotatedPath());
       }
     } catch {
     }
@@ -1930,7 +2158,7 @@ var AuditService = class {
         const ts = Number.parseInt(tsStr, 10);
         if (!Number.isNaN(ts) && ts < cutoff) {
           try {
-            await unlink(machineFilePath(file));
+            await unlink2(machineFilePath(file));
           } catch {
           }
         }
@@ -1941,11 +2169,11 @@ var AuditService = class {
 var auditService = new AuditService();
 
 // ../server/src/services/org-keys.ts
-import { mkdir as mkdir6 } from "fs/promises";
+import { mkdir as mkdir7 } from "fs/promises";
 
 // ../server/src/services/master-password.ts
-import { randomBytes as randomBytes3, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile6, writeFile as writeFile6, chmod as chmod5, stat as stat3, rename as rename6 } from "fs/promises";
+import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
+import { readFile as readFile7, writeFile as writeFile7, chmod as chmod6, stat as stat3, rename as rename7 } from "fs/promises";
 import { join as join7 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
@@ -1960,10 +2188,10 @@ var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen
 async function readKeyFile(filePath) {
   const s = await stat3(filePath);
   if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
-  return readFile6(filePath);
+  return readFile7(filePath);
 }
 function aesEncrypt(key, plaintext) {
-  const iv = randomBytes3(12);
+  const iv = randomBytes4(12);
   const cipher = createCipheriv("aes-256-gcm", key, iv);
   const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
   const authTag = cipher.getAuthTag();
@@ -1989,9 +2217,9 @@ async function getPepperFromFile(dataDir) {
 async function writePepperToFile(dataDir, pepper) {
   const filePath = join7(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile6(tmpPath, pepper.toString("hex"), "utf-8");
-  await chmod5(tmpPath, 384);
-  await rename6(tmpPath, filePath);
+  await writeFile7(tmpPath, pepper.toString("hex"), "utf-8");
+  await chmod6(tmpPath, 384);
+  await rename7(tmpPath, filePath);
 }
 function tryKeyringGet() {
   try {
@@ -2015,7 +2243,7 @@ async function getOrCreatePepper(dataDir) {
   }
   const filePepper = await getPepperFromFile(dataDir);
   if (filePepper) return filePepper;
-  const pepper = randomBytes3(32);
+  const pepper = randomBytes4(32);
   const saved = tryKeyringSet(pepper.toString("hex"));
   if (!saved) {
     console.warn("[master-password] Keyring unavailable, storing pepper in dataDir (fallback)");
@@ -2033,16 +2261,16 @@ async function deriveKey(masterPassword, pepper, salt) {
 }
 async function writeEncryptedKey(dataDir, masterPassword, encryptionKey, pepperDir = dataDir) {
   const pepper = await getOrCreatePepper(pepperDir);
-  const salt = randomBytes3(16);
+  const salt = randomBytes4(16);
   const derivedKey = await deriveKey(masterPassword, pepper, salt);
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
   const filePath = join7(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile6(tmpPath, encoded, "utf-8");
-  await chmod5(tmpPath, 384);
-  await rename6(tmpPath, filePath);
+  await writeFile7(tmpPath, encoded, "utf-8");
+  await chmod6(tmpPath, 384);
+  await rename7(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword, pepperDir = dataDir) {
   const filePath = join7(dataDir, ENCRYPTED_KEY_FILENAME);
@@ -2067,8 +2295,8 @@ async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
   const filePath = join7(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile6(tmpPath, payload.toString("base64"), "utf-8");
-  await rename6(tmpPath, filePath);
+  await writeFile7(tmpPath, payload.toString("base64"), "utf-8");
+  await rename7(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
   const filePath = join7(dataDir, VERIFY_FILENAME);
@@ -2142,7 +2370,7 @@ async function unlockOrgKeys(masterPassword) {
       }
       continue;
     }
-    await mkdir6(root, { recursive: true });
+    await mkdir7(root, { recursive: true });
     await writeEncryptedKey(root, masterPassword, machineKey, await keyRoot());
     await writeVerifyFile(root, machineKey);
     setEncryptionKeyInMemory(machineKey, orgId);
@@ -2152,7 +2380,7 @@ async function unlockOrgKeys(masterPassword) {
 }
 async function installOrgKey(orgId, key, masterPassword) {
   const root = orgVaultRoot(orgId);
-  await mkdir6(root, { recursive: true });
+  await mkdir7(root, { recursive: true });
   const pepperDir = await keyRoot();
   await writeEncryptedKey(root, masterPassword, key, pepperDir);
   const readBack = await readEncryptedKey(root, masterPassword, pepperDir);
@@ -2208,7 +2436,7 @@ var projectRouter = router({
    * `orgId` names which project — the same id can exist in several
    * organizations. Left out, the id must answer for exactly one project.
    */
-  get: protectedProcedure.input(z3.object({ id: z3.string().max(128), orgId: z3.string().max(128).nullable().optional() })).query(async ({ input }) => {
+  get: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).query(async ({ input }) => {
     const project = await projectStore.get(input);
     if (!project) {
       throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
@@ -2222,7 +2450,7 @@ var projectRouter = router({
    * Environments are intentionally excluded — they carry secret values that
    * stay local.
    */
-  export: protectedProcedure.input(z3.object({ id: z3.string().max(128), orgId: z3.string().max(128).nullable().optional() })).query(async ({ input }) => {
+  export: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).query(async ({ input }) => {
     const project = await projectStore.get(input);
     if (!project) {
       throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
@@ -2232,11 +2460,11 @@ var projectRouter = router({
     return { project, services };
   }),
   create: protectedProcedure.input(
-    z3.object({
-      name: z3.string().min(1).max(200),
-      description: z3.string().max(1e4).optional(),
-      orgId: z3.string().max(128).nullable().optional(),
-      serviceIds: z3.array(z3.string().max(128)).max(1e4).optional()
+    z4.object({
+      name: z4.string().min(1).max(200),
+      description: z4.string().max(1e4).optional(),
+      orgId: z4.string().max(128).nullable().optional(),
+      serviceIds: z4.array(z4.string().max(128)).max(1e4).optional()
     })
   ).mutation(async ({ input }) => {
     let project;
@@ -2270,13 +2498,13 @@ var projectRouter = router({
     return result;
   }),
   update: protectedProcedure.input(
-    z3.object({
-      id: z3.string().max(128),
-      name: z3.string().min(1).max(200).optional(),
-      description: z3.string().max(1e4).optional(),
-      orgId: z3.string().max(128).nullable().optional(),
-      serviceIds: z3.array(z3.string().max(128)).max(1e4).optional(),
-      groupOrder: z3.array(z3.string().max(200)).max(100).optional()
+    z4.object({
+      id: z4.string().max(128),
+      name: z4.string().min(1).max(200).optional(),
+      description: z4.string().max(1e4).optional(),
+      orgId: z4.string().max(128).nullable().optional(),
+      serviceIds: z4.array(z4.string().max(128)).max(1e4).optional(),
+      groupOrder: z4.array(z4.string().max(200)).max(100).optional()
     })
   ).mutation(async ({ input }) => {
     const project = await projectStore.update(input);
@@ -2286,7 +2514,7 @@ var projectRouter = router({
     await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id });
     return project;
   }),
-  delete: protectedProcedure.input(z3.object({ id: z3.string().max(128), orgId: z3.string().max(128).nullable().optional() })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z4.object({ id: z4.string().max(128), orgId: z4.string().max(128).nullable().optional() })).mutation(async ({ input }) => {
     const deleted = await projectStore.delete(input);
     if (!deleted) {
       throw new TRPCError3({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
@@ -2294,10 +2522,10 @@ var projectRouter = router({
     await auditService.log({ userId: "local", action: "delete", entityType: "project", entityId: input.id });
     return { success: true };
   }),
-  addService: protectedProcedure.input(z3.object({
-    projectId: z3.string().max(128),
-    orgId: z3.string().max(128).nullable().optional(),
-    serviceId: z3.string().max(128)
+  addService: protectedProcedure.input(z4.object({
+    projectId: z4.string().max(128),
+    orgId: z4.string().max(128).nullable().optional(),
+    serviceId: z4.string().max(128)
   })).mutation(async ({ input }) => {
     const target = { id: input.projectId, orgId: input.orgId };
     const project = await projectStore.addService(target, input.serviceId);
@@ -2329,10 +2557,10 @@ var projectRouter = router({
     });
     return project;
   }),
-  removeService: protectedProcedure.input(z3.object({
-    projectId: z3.string().max(128),
-    orgId: z3.string().max(128).nullable().optional(),
-    serviceId: z3.string().max(128)
+  removeService: protectedProcedure.input(z4.object({
+    projectId: z4.string().max(128),
+    orgId: z4.string().max(128).nullable().optional(),
+    serviceId: z4.string().max(128)
   })).mutation(async ({ input }) => {
     const project = await projectStore.removeService(
       { id: input.projectId, orgId: input.orgId },
@@ -2350,10 +2578,10 @@ var projectRouter = router({
     });
     return project;
   }),
-  setActiveEnvironment: protectedProcedure.input(z3.object({
-    projectId: z3.string().max(128),
-    orgId: z3.string().max(128).nullable().optional(),
-    environmentId: z3.string().max(128)
+  setActiveEnvironment: protectedProcedure.input(z4.object({
+    projectId: z4.string().max(128),
+    orgId: z4.string().max(128).nullable().optional(),
+    environmentId: z4.string().max(128)
   })).mutation(async ({ input }) => {
     const project = await projectStore.get({ id: input.projectId, orgId: input.orgId });
     if (!project) {
@@ -2433,9 +2661,9 @@ var projectRouter = router({
   localPaths: protectedProcedure.query(async () => {
     return projectPathStore.all();
   }),
-  getLocalPath: protectedProcedure.input(z3.object({
-    id: z3.string().min(1).max(128),
-    orgId: z3.string().max(128).nullable().optional()
+  getLocalPath: protectedProcedure.input(z4.object({
+    id: z4.string().min(1).max(128),
+    orgId: z4.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return { path: await projectPathStore.get(input) };
   }),
@@ -2446,10 +2674,10 @@ var projectRouter = router({
    * project was already placed in: two projects sharing a directory is what
    * makes services run against the wrong code.
    */
-  setLocalPath: protectedProcedure.input(z3.object({
-    id: z3.string().min(1).max(128),
-    orgId: z3.string().max(128).nullable().optional(),
-    path: z3.string().min(1).max(4096)
+  setLocalPath: protectedProcedure.input(z4.object({
+    id: z4.string().min(1).max(128),
+    orgId: z4.string().max(128).nullable().optional(),
+    path: z4.string().min(1).max(4096)
   })).mutation(async ({ input }) => {
     const project = await projectStore.get(input);
     if (!project) throw new TRPCError3({ code: "NOT_FOUND", message: "Projet introuvable" });
@@ -2467,20 +2695,20 @@ var projectRouter = router({
       });
     }
     await projectPathStore.set(project, input.path);
-    await auditService.log("local", "update", "project", input.id, { localPath: input.path });
+    await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id, metadata: { localPath: input.path } });
     return { path: input.path };
   })
 });
 
 // ../server/src/trpc/routers/service.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 import { TRPCError as TRPCError4 } from "@trpc/server";
 
 // ../server/src/services/log-parser-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
 
 // ../server/src/services/settings-manager.ts
-import { readFile as readFile7, writeFile as writeFile7, rename as rename7, mkdir as mkdir7, chmod as chmod6 } from "fs/promises";
+import { readFile as readFile8, writeFile as writeFile8, rename as rename8, mkdir as mkdir8, chmod as chmod7 } from "fs/promises";
 import { join as join8 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
@@ -2506,12 +2734,12 @@ var SettingsManager = class {
   }
   async atomicWrite(filename, data, vault) {
     const root = this.rootOf(vault);
-    await mkdir7(root, { recursive: true });
+    await mkdir8(root, { recursive: true });
     const filePath = join8(root, filename);
     const tmpPath = filePath + ".tmp";
-    await writeFile7(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-    await rename7(tmpPath, filePath);
-    await chmod6(filePath, 384);
+    await writeFile8(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+    await rename8(tmpPath, filePath);
+    await chmod7(filePath, 384);
   }
   /**
    * Lire le fichier de CE coffre, et rien d'autre.
@@ -2524,7 +2752,7 @@ var SettingsManager = class {
    */
   async readJson(filename, vault) {
     try {
-      return JSON.parse(await readFile7(join8(this.rootOf(vault), filename), "utf-8"));
+      return JSON.parse(await readFile8(join8(this.rootOf(vault), filename), "utf-8"));
     } catch {
       return null;
     }
@@ -2538,7 +2766,7 @@ var SettingsManager = class {
   async readMachineJson(filename) {
     for (const path of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
       try {
-        return JSON.parse(await readFile7(path, "utf-8"));
+        return JSON.parse(await readFile8(path, "utf-8"));
       } catch {
       }
     }
@@ -2603,12 +2831,12 @@ var SettingsManager = class {
   }
   async saveSchemaVersion(sv) {
     this.schemaVersion = sv;
-    await mkdir7(machineRoot(), { recursive: true });
+    await mkdir8(machineRoot(), { recursive: true });
     const filePath = machineFilePath(SCHEMA_VERSION_FILE);
     const tmpPath = filePath + ".tmp";
-    await writeFile7(tmpPath, JSON.stringify(sv, null, 2), "utf-8");
-    await rename7(tmpPath, filePath);
-    await chmod6(filePath, 384);
+    await writeFile8(tmpPath, JSON.stringify(sv, null, 2), "utf-8");
+    await rename8(tmpPath, filePath);
+    await chmod7(filePath, 384);
   }
   getCurrentSchemaVersion() {
     return CURRENT_SCHEMA_VERSION;
@@ -2817,14 +3045,14 @@ function buildServerBuiltins(input) {
 import { isAbsolute as isAbsolute3 } from "path";
 
 // ../server/src/services/workspace-cwd.ts
-import { isAbsolute as isAbsolute2, join as join10, dirname as dirname5 } from "path";
+import { isAbsolute as isAbsolute2, join as join10, dirname as dirname6 } from "path";
 
 // ../server/src/services/conversation-store.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { readFile as readFile8, writeFile as writeFile8, rename as rename8, mkdir as mkdir8, chmod as chmod7 } from "fs/promises";
-import { dirname as dirname4, join as join9 } from "path";
+import { readFile as readFile9, writeFile as writeFile9, rename as rename9, mkdir as mkdir9, chmod as chmod8 } from "fs/promises";
+import { dirname as dirname5, join as join9 } from "path";
 import { EventEmitter as EventEmitter2 } from "events";
-var FILENAME4 = "conversations.private.json";
+var FILENAME5 = "conversations.private.json";
 async function localProjectId() {
   const projects = await projectStore.list().catch(() => []);
   return projects.find((p) => !p.orgId)?.id ?? null;
@@ -2855,11 +3083,11 @@ var ConversationStore = class {
    * root, but a launch directory owning its own key keeps both together.
    */
   getFilePath() {
-    return keyedFilePath(FILENAME4);
+    return keyedFilePath(FILENAME5);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME4);
+    return legacyMachineFilePath(FILENAME5);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -2869,13 +3097,13 @@ var ConversationStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile8(await this.getFilePath(), "utf-8");
+      return await readFile9(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile8(this.getLegacyFilePath(), "utf-8");
+      return readFile9(this.getLegacyFilePath(), "utf-8");
     }
   }
   async ensureDir() {
-    await mkdir8(dirname4(await this.getFilePath()), { recursive: true });
+    await mkdir9(dirname5(await this.getFilePath()), { recursive: true });
   }
   encryptMessages(messages, vault) {
     return encryptValue(JSON.stringify(messages), vault);
@@ -2966,20 +3194,20 @@ ${new Error("trace").stack}`
     this.unreadable.clear();
     await ensureProjectsLoaded();
     const vaults = await allVaultRoots();
-    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME4)];
+    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME5)];
     const sources = [
       ...legacyPaths.map((path) => ({ path, legacy: true })),
-      ...vaults.map((root) => ({ path: join9(root, FILENAME4), legacy: false }))
+      ...vaults.map((root) => ({ path: join9(root, FILENAME5), legacy: false }))
     ];
     for (const { path, legacy } of sources) {
       let data;
       try {
-        data = JSON.parse(await readFile8(path, "utf-8"));
+        data = JSON.parse(await readFile9(path, "utf-8"));
       } catch {
         continue;
       }
       const inherited = legacy ? await localProjectId() : null;
-      const root = dirname4(path);
+      const root = dirname5(path);
       await rememberFile(path);
       for (const item of data) {
         try {
@@ -3049,22 +3277,22 @@ ${new Error("trace").stack}`
     }
     const stale = /* @__PURE__ */ new Set();
     for (const root of byRoot.keys()) {
-      const path = join9(root, FILENAME4);
+      const path = join9(root, FILENAME5);
       if (wasRead(path) && await hasChangedSinceRead(path)) stale.add(root);
     }
     for (const [root, data] of byRoot) {
-      const filePath = join9(root, FILENAME4);
+      const filePath = join9(root, FILENAME5);
       if (stale.has(root)) {
         console.warn(
           `[conversation-store] ${filePath} a chang\xE9 depuis sa lecture \u2014 \xE9criture ignor\xE9e pour ne pas \xE9craser une r\xE9paration faite en dehors du serveur.`
         );
         continue;
       }
-      await mkdir8(root, { recursive: true });
+      await mkdir9(root, { recursive: true });
       const tmpPath = `${filePath}.tmp`;
-      await writeFile8(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-      await rename8(tmpPath, filePath);
-      await chmod7(filePath, 384);
+      await writeFile9(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+      await rename9(tmpPath, filePath);
+      await chmod8(filePath, 384);
       await rememberFile(filePath);
     }
   }
@@ -3077,7 +3305,7 @@ ${new Error("trace").stack}`
   async rootFor(conv) {
     const known = this.roots.get(conv.id) ?? null;
     if (conv.projectId) return rootOfProjectAmong(conv.projectId, known);
-    return known ?? dirname4(await keyedFilePath(FILENAME4));
+    return known ?? dirname5(await keyedFilePath(FILENAME5));
   }
   /**
    * Le projet d'une conversation, organisation comprise.
@@ -3263,7 +3491,7 @@ function anchor(base, raw) {
   return join10(base, raw);
 }
 function localVaultRootParent() {
-  return dirname5(localVaultRoot());
+  return dirname6(localVaultRoot());
 }
 async function resolveAgentCwd(target) {
   if (target.serviceId) {
@@ -3358,7 +3586,7 @@ async function resolveServiceVariables(service) {
 }
 var DockerConfigInput = DockerConfigSchema;
 var serviceRouter = router({
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List all services", protect: true } }).output(z4.any()).query(async ({ ctx }) => {
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List all services", protect: true } }).output(z5.any()).query(async ({ ctx }) => {
     const all = await serviceStore.list();
     const allowedIds = getAllowedServiceIds(ctx);
     const filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
@@ -3367,7 +3595,7 @@ var serviceRouter = router({
       effectiveAgentId: await resolveEffectiveAgentId(s)
     })));
   }),
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.any()).query(async ({ input, ctx }) => {
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/services/{id}", tags: ["services"], summary: "Get a service by ID", protect: true } }).input(z5.object({ id: z5.string().max(128) })).output(z5.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const service = await serviceStore.get(input.id);
     if (!service) {
@@ -3375,34 +3603,34 @@ var serviceRouter = router({
     }
     return service;
   }),
-  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z4.any()).input(
-    z4.object({
-      agentId: z4.string().max(128).optional(),
-      name: z4.string().min(1).max(200),
-      commands: z4.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z4.string().max(4096).optional(),
-      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z4.array(z4.string().max(200)).max(20).optional(),
-      description: z4.string().max(2e3).optional(),
-      docsPath: z4.string().max(4096).optional(),
-      url: z4.string().max(2048).optional(),
-      localUrls: z4.array(z4.object({
-        url: z4.string().max(253),
-        port: z4.number().int().min(1).max(65535)
+  create: protectedProcedure.meta({ openapi: { method: "POST", path: "/services", tags: ["services"], summary: "Create a new service", protect: true } }).output(z5.any()).input(
+    z5.object({
+      agentId: z5.string().max(128).optional(),
+      name: z5.string().min(1).max(200),
+      commands: z5.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z5.string().max(4096).optional(),
+      ports: z5.array(z5.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z5.array(z5.string().max(200)).max(20).optional(),
+      description: z5.string().max(2e3).optional(),
+      docsPath: z5.string().max(4096).optional(),
+      url: z5.string().max(2048).optional(),
+      localUrls: z5.array(z5.object({
+        url: z5.string().max(253),
+        port: z5.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z4.string().max(2048).optional(),
-      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).optional(),
-      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z4.enum(["native", "docker"]).optional().default("native"),
+      openapiUrl: z5.string().max(2048).optional(),
+      git: z5.object({ remote: z5.string().max(2048).optional(), home: z5.string().max(2048).optional() }).optional(),
+      meta: z5.record(z5.string().max(256), z5.string().max(2e3)).optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z5.enum(["native", "docker"]).optional().default("native"),
       dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.optional(),
-      autoRestart: z4.boolean().optional().default(false),
+      autoRestart: z5.boolean().optional().default(false),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z4.number().int().nonnegative().optional(),
-      restartBackoffMs: z4.number().int().positive().optional().default(1e3),
-      orgId: z4.string().max(128).nullable().optional(),
-      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z4.array(z4.string().max(128)).max(50).optional()
+      maxRestarts: z5.number().int().nonnegative().optional(),
+      restartBackoffMs: z5.number().int().positive().optional().default(1e3),
+      orgId: z5.string().max(128).nullable().optional(),
+      shortcuts: z5.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z5.array(z5.string().max(128)).max(50).optional()
     })
   ).mutation(async ({ input }) => {
     if (input.agentId) {
@@ -3424,38 +3652,38 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "create", entityType: "service", entityId: service.id, metadata: { name: input.name } });
     return service;
   }),
-  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z4.any()).input(
-    z4.object({
-      id: z4.string().max(128),
-      agentId: z4.string().max(128).nullable().optional(),
+  update: protectedProcedure.meta({ openapi: { method: "PATCH", path: "/services/{id}", tags: ["services"], summary: "Update a service", protect: true } }).output(z5.any()).input(
+    z5.object({
+      id: z5.string().max(128),
+      agentId: z5.string().max(128).nullable().optional(),
       // null = clear (inherit from env)
-      name: z4.string().min(1).max(200).optional(),
-      commands: z4.array(ServiceCommandSchema).max(50).optional(),
-      cwd: z4.string().max(4096).nullable().optional(),
-      ports: z4.array(z4.number().int().min(1).max(65535)).max(20).optional(),
-      groups: z4.array(z4.string().max(200)).max(20).optional(),
-      description: z4.string().max(2e3).optional(),
-      docsPath: z4.string().max(4096).optional(),
-      url: z4.string().max(2048).optional(),
-      localUrls: z4.array(z4.object({
-        url: z4.string().max(253),
-        port: z4.number().int().min(1).max(65535)
+      name: z5.string().min(1).max(200).optional(),
+      commands: z5.array(ServiceCommandSchema).max(50).optional(),
+      cwd: z5.string().max(4096).nullable().optional(),
+      ports: z5.array(z5.number().int().min(1).max(65535)).max(20).optional(),
+      groups: z5.array(z5.string().max(200)).max(20).optional(),
+      description: z5.string().max(2e3).optional(),
+      docsPath: z5.string().max(4096).optional(),
+      url: z5.string().max(2048).optional(),
+      localUrls: z5.array(z5.object({
+        url: z5.string().max(253),
+        port: z5.number().int().min(1).max(65535)
       })).max(20).optional(),
-      openapiUrl: z4.string().max(2048).optional(),
-      git: z4.object({ remote: z4.string().max(2048).optional(), home: z4.string().max(2048).optional() }).nullable().optional(),
-      meta: z4.record(z4.string().max(256), z4.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
-      runner: z4.enum(["native", "docker"]).optional(),
+      openapiUrl: z5.string().max(2048).optional(),
+      git: z5.object({ remote: z5.string().max(2048).optional(), home: z5.string().max(2048).optional() }).nullable().optional(),
+      meta: z5.record(z5.string().max(256), z5.string().max(2e3)).nullable().optional().refine((obj) => !obj || Object.keys(obj).length <= 100, { message: "Too many meta keys (max 100)" }),
+      runner: z5.enum(["native", "docker"]).optional(),
       dockerConfig: DockerConfigInput.optional(),
       healthCheck: HealthCheckSchema.nullable().optional(),
-      autoRestart: z4.boolean().optional(),
-      clearLogsOnStart: z4.boolean().optional(),
+      autoRestart: z5.boolean().optional(),
+      clearLogsOnStart: z5.boolean().optional(),
       restartStrategy: RestartStrategySchema.optional(),
-      maxRestarts: z4.number().int().nonnegative().optional(),
-      restartBackoffMs: z4.number().int().positive().optional(),
-      orgId: z4.string().max(128).nullable().optional(),
-      shortcuts: z4.array(ServiceShortcutSchema).max(50).optional(),
-      parserIds: z4.array(z4.string().max(128)).max(50).optional(),
-      logSources: z4.array(LogSourceConfigSchema).max(20).optional()
+      maxRestarts: z5.number().int().nonnegative().optional(),
+      restartBackoffMs: z5.number().int().positive().optional(),
+      orgId: z5.string().max(128).nullable().optional(),
+      shortcuts: z5.array(ServiceShortcutSchema).max(50).optional(),
+      parserIds: z5.array(z5.string().max(128)).max(50).optional(),
+      logSources: z5.array(LogSourceConfigSchema).max(20).optional()
     })
   ).mutation(async ({ input }) => {
     const existing = await serviceStore.get(input.id);
@@ -3510,7 +3738,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "update", entityType: "service", entityId: input.id });
     return { ...service, effectiveAgentId: await resolveEffectiveAgentId(service), stoppedForAgentChange };
   }),
-  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z4.object({ id: z4.string().max(128) })).output(z4.object({ success: z4.literal(true) })).mutation(async ({ input }) => {
+  delete: protectedProcedure.meta({ openapi: { method: "DELETE", path: "/services/{id}", tags: ["services"], summary: "Delete a service", protect: true } }).input(z5.object({ id: z5.string().max(128) })).output(z5.object({ success: z5.literal(true) })).mutation(async ({ input }) => {
     const deleted = await serviceStore.delete(input.id);
     if (!deleted) {
       throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3518,7 +3746,7 @@ var serviceRouter = router({
     await auditService.log({ userId: "local", action: "delete", entityType: "service", entityId: input.id });
     return { success: true };
   }),
-  checkCwd: protectedProcedure.input(z4.object({ id: z4.string().max(128), checkReachability: z4.boolean().optional() })).query(async ({ input }) => {
+  checkCwd: protectedProcedure.input(z5.object({ id: z5.string().max(128), checkReachability: z5.boolean().optional() })).query(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3551,7 +3779,7 @@ var serviceRouter = router({
     }
     return { exists: exists4, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
-  cloneRepository: protectedProcedure.input(z4.object({ id: z4.string().max(128) })).mutation(async ({ input }) => {
+  cloneRepository: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
     if (!service) {
       throw new TRPCError4({ code: "NOT_FOUND", message: `Service ${input.id} not found` });
@@ -3574,7 +3802,7 @@ var serviceRouter = router({
 });
 
 // ../server/src/trpc/routers/agent.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 import { TRPCError as TRPCError5 } from "@trpc/server";
 var SUBSCRIPTION_QUEUE_MAX = LOG_BUFFER_SIZE;
 var agentRouter = router({
@@ -3583,7 +3811,7 @@ var agentRouter = router({
     return agentManager.listAgents();
   }),
   /** Get a single agent's config and status */
-  get: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(({ input }) => {
+  get: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).query(({ input }) => {
     const agent = agentManager.getAgent(input.id);
     if (!agent) {
       throw new TRPCError5({ code: "NOT_FOUND", message: `Agent ${input.id} not found` });
@@ -3595,10 +3823,10 @@ var agentRouter = router({
   }),
   /** Test connectivity to an agent given url + passphrase */
   testConnection: protectedProcedure.input(
-    z5.object({
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      agentId: z5.string().max(128).optional()
+    z6.object({
+      url: z6.string().url().max(2048),
+      passphrase: z6.string().min(1).max(1024).optional(),
+      agentId: z6.string().max(128).optional()
     })
   ).mutation(async ({ input }) => {
     let passphrase = input.passphrase;
@@ -3635,13 +3863,13 @@ var agentRouter = router({
   }),
   /** Register a new agent */
   register: protectedProcedure.input(
-    z5.object({
-      name: z5.string().min(1).max(100),
-      url: z5.string().url().max(2048),
-      passphrase: z5.string().min(1).max(1024),
+    z6.object({
+      name: z6.string().min(1).max(100),
+      url: z6.string().url().max(2048),
+      passphrase: z6.string().min(1).max(1024),
       // À quelle organisation rattacher l'agent. Absent = la machine, ce que
       // font l'agent local et tout client antérieur à ce champ.
-      orgId: z5.string().min(1).max(128).nullable().optional()
+      orgId: z6.string().min(1).max(128).nullable().optional()
     })
   ).mutation(async ({ input }) => {
     const config = await agentManager.register(
@@ -3654,13 +3882,13 @@ var agentRouter = router({
   }),
   /** Update an existing agent */
   update: protectedProcedure.input(
-    z5.object({
-      id: z5.string().max(128),
-      name: z5.string().min(1).max(100).optional(),
-      url: z5.string().url().max(2048).optional(),
-      passphrase: z5.string().min(1).max(1024).optional(),
-      passthroughEnv: z5.array(
-        z5.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
+    z6.object({
+      id: z6.string().max(128),
+      name: z6.string().min(1).max(100).optional(),
+      url: z6.string().url().max(2048).optional(),
+      passphrase: z6.string().min(1).max(1024).optional(),
+      passthroughEnv: z6.array(
+        z6.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256)
       ).max(100).optional()
     })
   ).mutation(async ({ input }) => {
@@ -3681,7 +3909,7 @@ var agentRouter = router({
     }
   }),
   /** Get resolved passthrough env values from an agent */
-  getPassthroughEnv: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).query(async ({ input }) => {
+  getPassthroughEnv: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).query(async ({ input }) => {
     try {
       return await agentManager.agentQuery(input.id, "config.getPassthroughEnv");
     } catch {
@@ -3689,7 +3917,7 @@ var agentRouter = router({
     }
   }),
   /** Remove a registered agent */
-  remove: protectedProcedure.input(z5.object({ id: z5.string().max(128) })).mutation(async ({ input }) => {
+  remove: protectedProcedure.input(z6.object({ id: z6.string().max(128) })).mutation(async ({ input }) => {
     try {
       const removed = await agentManager.remove(input.id);
       if (!removed) {
@@ -3736,7 +3964,7 @@ var agentRouter = router({
 });
 
 // ../server/src/trpc/routers/process.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 import { TRPCError as TRPCError6 } from "@trpc/server";
 var SUBSCRIPTION_QUEUE_MAX2 = LOG_BUFFER_SIZE;
 async function* forwardEvents(eventName, filter) {
@@ -3799,7 +4027,7 @@ async function* forwardLogBatches(agentId, processId) {
 }
 var processRouter = router({
   /** List all processes across all connected agents */
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z6.any()).query(async () => {
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes", tags: ["processes"], summary: "List all processes", protect: true } }).output(z7.any()).query(async () => {
     const agents = agentManager.listAgents();
     const results = [];
     await Promise.allSettled(
@@ -3816,7 +4044,7 @@ var processRouter = router({
     return results;
   }),
   /** Get a single process from a specific agent */
-  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z6.object({ agentId: z6.string().max(128), id: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+  get: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{id}", tags: ["processes"], summary: "Get a process by agent and ID", protect: true } }).input(z7.object({ agentId: z7.string().max(128), id: z7.string().max(128) })).output(z7.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.id, "service:read");
     const status = agentManager.getStatus(input.agentId);
     if (!status) {
@@ -3830,7 +4058,7 @@ var processRouter = router({
    *  (or restarted). This avoids pushing configs for every service at agent boot,
    *  which would be wasteful when many services are never started.
    *  The deploy call is idempotent — creates the process if missing, updates config if it exists. */
-  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  start: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/start", tags: ["processes"], summary: "Start a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128).optional(), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:start");
     const service = await serviceStore.get(input.processId);
     const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
@@ -3868,7 +4096,7 @@ var processRouter = router({
     return { ...result, agentId: effectiveAgentId };
   }),
   /** Stop a process on an agent */
-  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  stop: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/stop", tags: ["processes"], summary: "Stop a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:stop");
     const result = await agentManager.agentMutation(input.agentId, "process.stop", { id: input.processId }, AGENT_STOP_FETCH_TIMEOUT);
     await auditService.log({ userId: "local", action: "stop", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
@@ -3877,7 +4105,7 @@ var processRouter = router({
   /** Restart a process on an agent.
    *  Sends stop → deploy (latest resolved config) → start so that
    *  config/variable changes take effect. Same lazy deploy pattern as start. */
-  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128).optional(), processId: z6.string().max(128) })).output(z6.any()).mutation(async ({ input, ctx }) => {
+  restart: protectedProcedure.meta({ openapi: { method: "POST", path: "/processes/{agentId}/{processId}/restart", tags: ["processes"], summary: "Restart a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128).optional(), processId: z7.string().max(128) })).output(z7.any()).mutation(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "service:restart");
     const service = await serviceStore.get(input.processId);
     const effectiveAgentId = (service ? await resolveEffectiveAgentId(service) : null) ?? input.agentId ?? null;
@@ -3910,20 +4138,20 @@ var processRouter = router({
     return { ...result, agentId: effectiveAgentId };
   }),
   /** Get buffered logs for a process from an agent */
-  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).output(z6.any()).query(async ({ input, ctx }) => {
+  logs: protectedProcedure.meta({ openapi: { method: "GET", path: "/processes/{agentId}/{processId}/logs", tags: ["processes"], summary: "Get buffered logs for a process", protect: true } }).input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).output(z7.any()).query(async ({ input, ctx }) => {
     requireServiceAction(ctx, input.processId, "logs:read");
     return agentManager.agentQuery(input.agentId, "process.logs", { id: input.processId });
   }),
   /** Clear buffered logs for a process on an agent */
-  clearLogBuffer: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).mutation(async ({ input }) => {
+  clearLogBuffer: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.clearLogBuffer", { id: input.processId });
     await auditService.log({ userId: "local", action: "clearLogBuffer", entityType: "process", entityId: input.processId, metadata: { agentId: input.agentId } });
     return { success: true };
   }),
   /** Execute a shortcut command on an agent, streaming output into the process log */
-  executeShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
+  executeShortcut: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
     shortcut: ServiceShortcutSchema
   })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.processId);
@@ -3951,12 +4179,12 @@ var processRouter = router({
     return result;
   }),
   /** Execute an ad-hoc command on an agent, streaming output into the process log */
-  executeAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    command: z6.string().min(1).max(4096),
-    cwd: z6.string().max(4096).optional(),
-    commandId: z6.string().max(128).optional()
+  executeAdHocCommand: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    command: z7.string().min(1).max(4096),
+    cwd: z7.string().max(4096).optional(),
+    commandId: z7.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.processId);
     if (service) {
@@ -3990,25 +4218,25 @@ var processRouter = router({
     return result;
   }),
   /** Cancel a running shortcut command on an agent */
-  cancelShortcut: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    shortcutId: z6.string().max(128)
+  cancelShortcut: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    shortcutId: z7.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.cancelShortcut", { id: input.processId, shortcutId: input.shortcutId });
     return { success: true };
   }),
   /** Cancel a running ad-hoc command on an agent */
-  cancelAdHocCommand: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128),
-    processId: z6.string().max(128),
-    commandId: z6.string().max(128).optional()
+  cancelAdHocCommand: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128),
+    processId: z7.string().max(128),
+    commandId: z7.string().max(128).optional()
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(input.agentId, "process.cancelAdHocCommand", { id: input.processId, commandId: input.commandId });
     return { success: true };
   }),
   /** Get current metrics for a process from an agent */
-  metrics: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).query(async ({ input }) => {
+  metrics: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(input.agentId, "process.metrics", { id: input.processId });
   }),
   /**
@@ -4016,7 +4244,7 @@ var processRouter = router({
    * Forwards batched events from the AgentWSBridge in real-time.
    * Historical logs are fetched separately via process.logs query.
    */
-  onLog: protectedProcedure.input(z6.object({ agentId: z6.string().max(128), processId: z6.string().max(128) })).subscription(async function* ({ input, ctx }) {
+  onLog: protectedProcedure.input(z7.object({ agentId: z7.string().max(128), processId: z7.string().max(128) })).subscription(async function* ({ input, ctx }) {
     requireServiceAction(ctx, input.processId, "logs:read");
     yield* forwardLogBatches(input.agentId, input.processId);
   }),
@@ -4025,9 +4253,9 @@ var processRouter = router({
    * Input is optional — omit agentId/processId for global monitoring (dashboard).
    * Forwards events from the AgentWSBridge in real-time.
    */
-  onStatus: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onStatus: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
@@ -4055,9 +4283,9 @@ var processRouter = router({
     });
   }),
   /** Subscribe to real-time metrics for a process. */
-  onMetrics: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onMetrics: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:status");
@@ -4069,9 +4297,9 @@ var processRouter = router({
     });
   }),
   /** Subscribe to real-time health status changes. */
-  onHealth: protectedProcedure.input(z6.object({
-    agentId: z6.string().max(128).optional(),
-    processId: z6.string().max(128).optional()
+  onHealth: protectedProcedure.input(z7.object({
+    agentId: z7.string().max(128).optional(),
+    processId: z7.string().max(128).optional()
   }).optional()).subscription(async function* ({ input, ctx }) {
     const allowedIds = getAllowedServiceIds(ctx);
     if (input?.processId) requireServiceAction(ctx, input.processId, "service:healthcheck");
@@ -4085,186 +4313,21 @@ var processRouter = router({
 });
 
 // ../server/src/trpc/routers/audit.ts
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var auditRouter = router({
-  list: protectedProcedure.input(z7.object({
-    action: z7.string().max(50).optional(),
-    entityType: z7.string().max(50).optional(),
-    entityId: z7.string().max(100).optional(),
-    limit: z7.number().int().positive().max(100).default(50),
-    offset: z7.number().int().nonnegative().default(0)
+  list: protectedProcedure.input(z8.object({
+    action: z8.string().max(50).optional(),
+    entityType: z8.string().max(50).optional(),
+    entityId: z8.string().max(100).optional(),
+    limit: z8.number().int().positive().max(100).default(50),
+    offset: z8.number().int().nonnegative().default(0)
   }).optional()).query(async ({ input }) => {
     return auditService.list(input ?? {});
   })
 });
 
 // ../server/src/trpc/routers/setup.ts
-import { z as z8 } from "zod";
-
-// ../server/src/services/cloud-session-store.ts
-import { readFile as readFile9, writeFile as writeFile9, rename as rename9, mkdir as mkdir9, chmod as chmod8, unlink as unlink2 } from "fs/promises";
-import { dirname as dirname6 } from "path";
-import { randomBytes as randomBytes4, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FILENAME5 = "cloud-session.json";
-var STATE_TTL_MS = 5 * 60 * 1e3;
-var CloudSessionStore = class {
-  session = null;
-  loaded = false;
-  /** Pending login states (CSRF binding between `start` and the callback). */
-  pending = /* @__PURE__ */ new Map();
-  /**
-   * Encrypted, so it lives beside the key that opens it — usually the machine
-   * root, but a launch directory owning its own key keeps both together.
-   */
-  getFilePath() {
-    return keyedFilePath(FILENAME5);
-  }
-  /** Where older versions kept it — read only, so an older Runeya keeps working. */
-  getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME5);
-  }
-  /**
-   * Read the machine file, falling back to the launch directory of old.
-   *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
-   */
-  async readFromDisk() {
-    try {
-      return await readFile9(await this.getFilePath(), "utf-8");
-    } catch {
-      return readFile9(this.getLegacyFilePath(), "utf-8");
-    }
-  }
-  async load() {
-    if (this.loaded) return;
-    try {
-      const raw = await this.readFromDisk();
-      this.session = JSON.parse(raw);
-    } catch {
-    }
-    this.loaded = true;
-  }
-  /**
-   * Mint a state value binding a login attempt to this server. Returned to the
-   * cloud page and echoed back on the callback, so a redirect we never
-   * initiated cannot install a token.
-   */
-  createState(returnTo) {
-    this.sweepStates();
-    const state = randomBytes4(32).toString("hex");
-    this.pending.set(state, { expiresAt: Date.now() + STATE_TTL_MS, returnTo });
-    return state;
-  }
-  /**
-   * Consume a state — single use, constant-time compare, TTL enforced. Returns
-   * the URL to send the browser back to, or null when the state is unknown or
-   * expired (i.e. a callback this server never initiated).
-   */
-  consumeState(candidate) {
-    this.sweepStates();
-    for (const [state, entry] of this.pending) {
-      const a = Buffer.from(state);
-      const b = Buffer.from(candidate);
-      if (a.length === b.length && timingSafeEqual2(a, b)) {
-        this.pending.delete(state);
-        return entry.expiresAt > Date.now() ? entry.returnTo : null;
-      }
-    }
-    return null;
-  }
-  sweepStates() {
-    const now = Date.now();
-    for (const [state, entry] of this.pending) {
-      if (entry.expiresAt <= now) this.pending.delete(state);
-    }
-  }
-  async save() {
-    await mkdir9(dirname6(await this.getFilePath()), { recursive: true });
-    const filePath = await this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    await writeFile9(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
-    await rename9(tmpPath, filePath);
-    await chmod8(filePath, 384);
-  }
-  /** Store the session token obtained from the one-time-token exchange. */
-  async set(cloudUrl, token) {
-    await this.load();
-    this.session = { cloudUrl, encryptedToken: encryptValue(token) };
-    await this.save();
-  }
-  /** The decrypted session token, or null when not logged in. */
-  async getToken() {
-    await this.load();
-    if (!this.session) return null;
-    try {
-      return decryptValue(this.session.encryptedToken);
-    } catch {
-      return null;
-    }
-  }
-  /**
-   * The cloud this machine is signed into, or null when not linked.
-   *
-   * Needed to tell "an org I am not a member of" apart from "an org of another
-   * cloud instance entirely" — the ids of two clouds share no namespace, so
-   * comparing them without this would call every foreign-cloud project a
-   * permission problem.
-   */
-  async getCloudUrl() {
-    await this.load();
-    return this.session?.cloudUrl ?? null;
-  }
-  async isLinked() {
-    return await this.getToken() !== null;
-  }
-  /** Forget the session (sign-out). */
-  async clear() {
-    await this.load();
-    this.session = null;
-    this.pending.clear();
-    try {
-      await unlink2(await this.getFilePath());
-    } catch {
-    }
-  }
-};
-var cloudSessionStore = new CloudSessionStore();
-
-// ../server/src/services/cloud-api.ts
-var DEFAULT_CLOUD_API_URL = "https://api.runeya.dev";
-var DEFAULT_CLOUD_APP_URL = "https://runeya.dev";
-function getCloudApiUrl() {
-  return (env.CLOUD_URL ?? DEFAULT_CLOUD_API_URL).replace(/\/+$/, "");
-}
-function getCloudAppUrl() {
-  return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
-}
-var CloudNotLinkedError = class extends Error {
-  code = "CLOUD_NOT_LINKED";
-  constructor() {
-    super("Not linked to the Runeya cloud.");
-    this.name = "CloudNotLinkedError";
-  }
-};
-async function cloudFetch(path, init = {}) {
-  const token = await cloudSessionStore.getToken();
-  if (!token) throw new CloudNotLinkedError();
-  return fetch(`${getCloudApiUrl()}${path}`, {
-    method: init.method ?? "GET",
-    headers: {
-      Authorization: `Bearer ${token}`,
-      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
-      [APP_VERSION_HEADER]: appVersion,
-      ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
-    },
-    ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
-    // 15s suits a JSON call; attachment downloads pass a longer budget.
-    signal: AbortSignal.timeout(init.timeoutMs ?? 15e3)
-  });
-}
-
-// ../server/src/trpc/routers/setup.ts
+import { z as z9 } from "zod";
 var setupRouter = router({
   /**
    * Check if encryption key is required (project initialized but no key).
@@ -4364,9 +4427,9 @@ var setupRouter = router({
    * une validation de la clé à adopter rendait le parcours impossible : vert
    * quand le geste est inutile, rouge sinon.
    */
-  checkOrgKeyLocal: protectedProcedure.input(z8.object({
-    orgId: z8.string().min(1).max(128),
-    keyHex: z8.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
+  checkOrgKeyLocal: protectedProcedure.input(z9.object({
+    orgId: z9.string().min(1).max(128),
+    keyHex: z9.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
   })).query(async ({ input }) => {
     const canary = await readVerifyFile(orgVaultRoot(input.orgId));
     if (!canary) return { isCurrentKey: false, hasCanary: false };
@@ -4381,8 +4444,8 @@ var setupRouter = router({
    * Spawns the local agent if in local-simple mode.
    */
   submitEncryptionKey: publicProcedure.input(
-    z8.object({
-      keyHex: z8.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
+    z9.object({
+      keyHex: z9.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
     })
   ).mutation(async ({ input }) => {
     try {
@@ -4401,32 +4464,32 @@ var setupRouter = router({
 });
 
 // ../server/src/trpc/routers/environment.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import { TRPCError as TRPCError7 } from "@trpc/server";
 var environmentRouter = router({
-  list: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional()
+  list: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return await environmentStore.list(input.projectId, input.orgId);
   }),
-  get: protectedProcedure.input(z9.object({ id: z9.string().max(128) })).query(async ({ input }) => {
+  get: protectedProcedure.input(z10.object({ id: z10.string().max(128) })).query(async ({ input }) => {
     const env2 = await environmentStore.get(input.id);
     if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     return env2;
   }),
-  listByScope: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional(),
-    scope: z9.enum(["global", "service"])
+  listByScope: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional(),
+    scope: z10.enum(["global", "service"])
   })).query(async ({ input }) => {
     return await environmentStore.listByScope(input.projectId, input.scope, input.orgId);
   }),
-  findServiceEnvironment: protectedProcedure.input(z9.object({ serviceId: z9.string().max(128), globalEnvId: z9.string().max(128) })).query(async ({ input }) => {
+  findServiceEnvironment: protectedProcedure.input(z10.object({ serviceId: z10.string().max(128), globalEnvId: z10.string().max(128) })).query(async ({ input }) => {
     return await environmentStore.findServiceEnvironment(input.serviceId, input.globalEnvId);
   }),
   create: protectedProcedure.input(CreateEnvironmentSchema.extend({
-    orgId: z9.string().max(128).nullable().optional()
+    orgId: z10.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { orgId, ...environment } = input;
     const target = { id: input.projectId, orgId };
@@ -4478,7 +4541,7 @@ var environmentRouter = router({
     }
     return env2;
   }),
-  delete: protectedProcedure.input(z9.object({ id: z9.string().max(128) })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z10.object({ id: z10.string().max(128) })).mutation(async ({ input }) => {
     const env2 = await environmentStore.get(input.id);
     if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     if (env2.immutable) {
@@ -4492,7 +4555,7 @@ var environmentRouter = router({
     await projectStore.removeEnvironment(environmentStore.projectRefOf(env2) ?? env2.projectId, input.id);
     return { success: true };
   }),
-  resolve: protectedProcedure.input(z9.object({ environmentId: z9.string().max(128) })).query(async ({ input, ctx }) => {
+  resolve: protectedProcedure.input(z10.object({ environmentId: z10.string().max(128) })).query(async ({ input, ctx }) => {
     const { includeSecrets } = requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
     if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
@@ -4511,7 +4574,7 @@ var environmentRouter = router({
     }
     return resolved;
   }),
-  resolveFlat: protectedProcedure.meta({ openapi: { method: "GET", path: "/environments/{environmentId}/resolve-flat", tags: ["environments"], summary: "Resolve environment variables as a flat key-value map", protect: true } }).input(z9.object({ environmentId: z9.string().max(128) })).output(z9.record(z9.string(), z9.string())).query(async ({ input, ctx }) => {
+  resolveFlat: protectedProcedure.meta({ openapi: { method: "GET", path: "/environments/{environmentId}/resolve-flat", tags: ["environments"], summary: "Resolve environment variables as a flat key-value map", protect: true } }).input(z10.object({ environmentId: z10.string().max(128) })).output(z10.record(z10.string(), z10.string())).query(async ({ input, ctx }) => {
     const { includeSecrets } = requireEnvAction(ctx, input.environmentId, "env:read");
     const env2 = await environmentStore.get(input.environmentId);
     if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
@@ -4527,8 +4590,8 @@ var environmentRouter = router({
     return result;
   }),
   // --- Overrides (flat, by variableId) ---
-  setOverride: protectedProcedure.input(z9.object({
-    variableId: z9.string().max(128),
+  setOverride: protectedProcedure.input(z10.object({
+    variableId: z10.string().max(128),
     // Only the value slot: the env var name comes from the variable
     // definition (a `key` sent by an older client is stripped here).
     variable: VariableOverrideSchema
@@ -4536,8 +4599,8 @@ var environmentRouter = router({
     await environmentOverridesStore.setOverride(input.variableId, input.variable);
     return { success: true };
   }),
-  removeOverride: protectedProcedure.input(z9.object({
-    variableId: z9.string().max(128)
+  removeOverride: protectedProcedure.input(z10.object({
+    variableId: z10.string().max(128)
   })).mutation(async ({ input }) => {
     await environmentOverridesStore.removeOverride(input.variableId);
     return { success: true };
@@ -4545,9 +4608,9 @@ var environmentRouter = router({
   getOverrides: protectedProcedure.query(async () => {
     return await environmentOverridesStore.getAll();
   }),
-  upsertVariable: protectedProcedure.meta({ openapi: { method: "PUT", path: "/environments/{environmentId}/variables/{variableId}", tags: ["environments"], summary: "Upsert a variable in an environment", protect: true } }).output(z9.any()).input(z9.object({
-    environmentId: z9.string().max(128),
-    variableId: z9.string().max(128),
+  upsertVariable: protectedProcedure.meta({ openapi: { method: "PUT", path: "/environments/{environmentId}/variables/{variableId}", tags: ["environments"], summary: "Upsert a variable in an environment", protect: true } }).output(z10.any()).input(z10.object({
+    environmentId: z10.string().max(128),
+    variableId: z10.string().max(128),
     variable: VariableSchema
   })).mutation(async ({ input, ctx }) => {
     requireEnvAction(ctx, input.environmentId, "env:write");
@@ -4562,12 +4625,12 @@ var environmentRouter = router({
    * define it, and variables that reference it through {{environment.KEY}}.
    * Used by the UI to warn before editing a shared variable from a resolved view.
    */
-  keyUsages: protectedProcedure.input(z9.object({
-    projectId: z9.string().max(128),
-    orgId: z9.string().max(128).nullable().optional(),
-    key: z9.string().min(1).max(256),
+  keyUsages: protectedProcedure.input(z10.object({
+    projectId: z10.string().max(128),
+    orgId: z10.string().max(128).nullable().optional(),
+    key: z10.string().min(1).max(256),
     /** Environment holding the variable about to be edited — enables inherited-impact detection */
-    environmentId: z9.string().max(128).optional()
+    environmentId: z10.string().max(128).optional()
   })).query(async ({ input }) => {
     const environments = await environmentStore.list(input.projectId, input.orgId);
     const services = await serviceStore.list();
@@ -4624,9 +4687,9 @@ var environmentRouter = router({
     }
     return { definedIn, referencedBy, inheritedBy };
   }),
-  removeVariable: protectedProcedure.input(z9.object({
-    environmentId: z9.string().max(128),
-    variableId: z9.string().max(128)
+  removeVariable: protectedProcedure.input(z10.object({
+    environmentId: z10.string().max(128),
+    variableId: z10.string().max(128)
   })).mutation(async ({ input }) => {
     const env2 = await environmentStore.get(input.environmentId);
     if (!env2) throw new TRPCError7({ code: "NOT_FOUND", message: `Environment ${input.environmentId} not found` });
@@ -4638,7 +4701,7 @@ var environmentRouter = router({
 
 // ../server/src/trpc/routers/settings.ts
 import { promises as dns } from "dns";
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 import { TRPCError as TRPCError8 } from "@trpc/server";
 
 // ../server/src/services/settings-scope.ts
@@ -4654,12 +4717,12 @@ async function vaultOfProject(projectId) {
 import { networkInterfaces } from "os";
 import { readFile as readFile10, writeFile as writeFile10, rename as rename10, mkdir as mkdir10 } from "fs/promises";
 import { join as join11 } from "path";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 var LOOPBACK2 = "127.0.0.1";
 var ANY = "0.0.0.0";
 var NETWORK_FILE = "network.json";
-var NetworkFileSchema = z10.object({
-  instances: z10.record(z10.string(), z10.object({ lanEnabled: z10.boolean().default(false) })).default({})
+var NetworkFileSchema = z11.object({
+  instances: z11.record(z11.string(), z11.object({ lanEnabled: z11.boolean().default(false) })).default({})
 });
 var httpServer = null;
 function instanceKey() {
@@ -4779,8 +4842,8 @@ function maskApiKey2(plaintext) {
   return plaintext.slice(0, 4) + "****" + plaintext.slice(-4);
 }
 var ScopeShape = {
-  orgId: z11.string().max(128).nullable().optional(),
-  projectId: z11.string().max(128).optional()
+  orgId: z12.string().max(128).nullable().optional(),
+  projectId: z12.string().max(128).optional()
 };
 async function scopeOf(input) {
   return input?.orgId ?? await vaultOfProject(input?.projectId);
@@ -4818,7 +4881,7 @@ var settingsRouter = router({
    * celle de l'onglet qui bascule, ne sont pas coupées. Le choix est mémorisé
    * dans les réglages, donc conservé au prochain démarrage.
    */
-  setLanMode: protectedProcedure.input(z11.object({ enabled: z11.boolean() })).mutation(async ({ input }) => {
+  setLanMode: protectedProcedure.input(z12.object({ enabled: z12.boolean() })).mutation(async ({ input }) => {
     try {
       return await setLanMode(input.enabled);
     } catch (err) {
@@ -4843,7 +4906,7 @@ var settingsRouter = router({
   /**
    * Get notification preferences
    */
-  getNotificationPreferences: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
+  getNotificationPreferences: protectedProcedure.input(z12.object(ScopeShape).optional()).query(async ({ input }) => {
     const priv = await settingsManager.getPrivateSettings(await scopeOf(input));
     return NotificationPreferencesSchema.parse(priv.notifications ?? {});
   }),
@@ -4871,7 +4934,7 @@ var settingsRouter = router({
    * parseur d'organisation se modifie pour toute l'équipe, et l'interface doit
    * pouvoir le dire avant que quelqu'un le change sans le savoir.
    */
-  listParsers: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
+  listParsers: protectedProcedure.input(z12.object(ScopeShape).optional()).query(async ({ input }) => {
     const vault = await scopeOf(input);
     return listWithOrigin(await logParserStore.list(vault), vault);
   }),
@@ -4883,7 +4946,7 @@ var settingsRouter = router({
    * retard — affichant une liste dans laquelle le parseur qu'un service vient
    * de référencer n'existe pas encore.
    */
-  onParsersChanged: protectedProcedure.input(z11.object(ScopeShape).optional()).subscription(async function* ({ input, signal }) {
+  onParsersChanged: protectedProcedure.input(z12.object(ScopeShape).optional()).subscription(async function* ({ input, signal }) {
     const vault = await scopeOf(input);
     let pending = true;
     let wake = null;
@@ -4921,7 +4984,7 @@ var settingsRouter = router({
   /**
    * Get single parser by ID
    */
-  getParser: protectedProcedure.input(z11.object({ id: z11.string().max(128), ...ScopeShape })).query(async ({ input }) => {
+  getParser: protectedProcedure.input(z12.object({ id: z12.string().max(128), ...ScopeShape })).query(async ({ input }) => {
     const parser = await logParserStore.get(input.id, await scopeOf(input));
     if (!parser) {
       throw new TRPCError8({ code: "NOT_FOUND", message: `Parser not found: ${input.id}` });
@@ -4969,7 +5032,7 @@ var settingsRouter = router({
   /**
    * Delete parser by ID
    */
-  deleteParser: protectedProcedure.input(z11.object({ id: z11.string().max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  deleteParser: protectedProcedure.input(z12.object({ id: z12.string().max(128), ...ScopeShape })).mutation(async ({ input }) => {
     if (input.id.startsWith("native:")) {
       throw new TRPCError8({ code: "FORBIDDEN", message: "Cannot delete built-in parsers" });
     }
@@ -4985,7 +5048,7 @@ var settingsRouter = router({
   /**
    * List AI providers (API keys are masked)
    */
-  listAIProviders: protectedProcedure.input(z11.object(ScopeShape).optional()).query(async ({ input }) => {
+  listAIProviders: protectedProcedure.input(z12.object(ScopeShape).optional()).query(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     return (priv.aiProviders ?? []).map((p) => {
@@ -5003,12 +5066,12 @@ var settingsRouter = router({
   /**
    * Create AI provider
    */
-  createAIProvider: protectedProcedure.input(z11.object({
-    name: z11.string().min(1).max(200),
+  createAIProvider: protectedProcedure.input(z12.object({
+    name: z12.string().min(1).max(200),
     provider: AIProviderSchema.shape.provider,
-    apiKey: z11.string().max(500).optional(),
+    apiKey: z12.string().max(500).optional(),
     // optional for providers like Ollama
-    model: z11.string().max(200).optional(),
+    model: z12.string().max(200).optional(),
     ...ScopeShape
   })).mutation(async ({ input }) => {
     if (input.provider !== "ollama" && !input.apiKey?.trim()) {
@@ -5041,12 +5104,12 @@ var settingsRouter = router({
   /**
    * Update AI provider (apiKey optional — omit to keep existing)
    */
-  updateAIProvider: protectedProcedure.input(z11.object({
-    id: z11.string().min(1).max(128),
-    name: z11.string().min(1).max(200).optional(),
+  updateAIProvider: protectedProcedure.input(z12.object({
+    id: z12.string().min(1).max(128),
+    name: z12.string().min(1).max(200).optional(),
     provider: AIProviderSchema.shape.provider.optional(),
-    apiKey: z11.string().min(1).max(500).optional(),
-    model: z11.string().max(200).optional(),
+    apiKey: z12.string().min(1).max(500).optional(),
+    model: z12.string().max(200).optional(),
     ...ScopeShape
   })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
@@ -5079,7 +5142,7 @@ var settingsRouter = router({
   /**
    * Delete AI provider
    */
-  deleteAIProvider: protectedProcedure.input(z11.object({ id: z11.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  deleteAIProvider: protectedProcedure.input(z12.object({ id: z12.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
@@ -5093,7 +5156,7 @@ var settingsRouter = router({
   /**
    * Set one provider as active (clears active flag on all others)
    */
-  setActiveAIProvider: protectedProcedure.input(z11.object({ id: z11.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
+  setActiveAIProvider: protectedProcedure.input(z12.object({ id: z12.string().min(1).max(128), ...ScopeShape })).mutation(async ({ input }) => {
     const vault = await scopeOf(input);
     const priv = await settingsManager.getPrivateSettings(vault);
     const providers = priv.aiProviders ?? [];
@@ -5109,7 +5172,7 @@ var settingsRouter = router({
   /**
    * Get Traefik config for a specific agent (never returns credentials or cert key in plain text)
    */
-  getAgentTraefikConfig: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikConfig: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).query(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -5129,16 +5192,16 @@ var settingsRouter = router({
   /**
    * Update Traefik config for a specific agent (credentials are encrypted before saving)
    */
-  updateAgentTraefikConfig: protectedProcedure.input(z11.object({
-    agentId: z11.string().max(128),
-    enabled: z11.boolean().optional(),
-    acmeEmail: z11.string().email().max(256).optional(),
-    wildcardDomain: z11.string().max(253).optional(),
-    httpPort: z11.number().int().min(1).max(65535).optional(),
-    httpsPort: z11.number().int().min(1).max(65535).optional(),
-    dnsProvider: z11.string().max(64).optional(),
-    dnsCredentials: z11.record(z11.string().max(64), z11.string().max(2048)).optional(),
-    acmeStaging: z11.boolean().optional()
+  updateAgentTraefikConfig: protectedProcedure.input(z12.object({
+    agentId: z12.string().max(128),
+    enabled: z12.boolean().optional(),
+    acmeEmail: z12.string().email().max(256).optional(),
+    wildcardDomain: z12.string().max(253).optional(),
+    httpPort: z12.number().int().min(1).max(65535).optional(),
+    httpsPort: z12.number().int().min(1).max(65535).optional(),
+    dnsProvider: z12.string().max(64).optional(),
+    dnsCredentials: z12.record(z12.string().max(64), z12.string().max(2048)).optional(),
+    acmeStaging: z12.boolean().optional()
   })).mutation(async ({ input }) => {
     const { agentId, ...fields } = input;
     const raw = agentStore.getTraefikConfig(agentId);
@@ -5167,13 +5230,13 @@ var settingsRouter = router({
   /**
    * Get Traefik config files content for a specific agent
    */
-  getAgentTraefikConfigFiles: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikConfigFiles: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "config.getTraefikConfigFiles"
     );
   }),
-  getAgentTraefikFileTree: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
+  getAgentTraefikFileTree: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "config.getTraefikFileTree"
@@ -5182,7 +5245,7 @@ var settingsRouter = router({
   /**
    * Get Traefik container logs for a specific agent (snapshot)
    */
-  getAgentTraefikLogs: protectedProcedure.input(z11.object({ agentId: z11.string().max(128), lines: z11.number().int().min(1).max(500).default(100) })).query(async ({ input }) => {
+  getAgentTraefikLogs: protectedProcedure.input(z12.object({ agentId: z12.string().max(128), lines: z12.number().int().min(1).max(500).default(100) })).query(async ({ input }) => {
     const result = await agentManager.agentQuery(
       input.agentId,
       "config.getTraefikLogs",
@@ -5193,7 +5256,7 @@ var settingsRouter = router({
   /**
    * Stream Traefik logs in real-time (subscription, yields new lines every 500ms)
    */
-  streamAgentTraefikLogs: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).subscription(async function* ({ input, signal }) {
+  streamAgentTraefikLogs: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).subscription(async function* ({ input, signal }) {
     let seen = 0;
     while (!signal?.aborted) {
       try {
@@ -5216,7 +5279,7 @@ var settingsRouter = router({
   /**
    * Restart Traefik container on a specific agent (re-pushes config first to handle agent restarts)
    */
-  restartAgentTraefik: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).mutation(async ({ input }) => {
+  restartAgentTraefik: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).mutation(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -5229,7 +5292,7 @@ var settingsRouter = router({
   /**
    * Force certificate renewal for a specific agent (wipes acme.json + restarts container)
    */
-  renewAgentTraefikCert: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).mutation(async ({ input }) => {
+  renewAgentTraefikCert: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).mutation(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -5242,7 +5305,7 @@ var settingsRouter = router({
   /**
    * Validate Traefik configuration for a specific agent
    */
-  validateAgentTraefikConfig: protectedProcedure.input(z11.object({ agentId: z11.string().max(128) })).query(async ({ input }) => {
+  validateAgentTraefikConfig: protectedProcedure.input(z12.object({ agentId: z12.string().max(128) })).query(async ({ input }) => {
     const raw = agentStore.getTraefikConfig(input.agentId);
     const parsed = raw ? TraefikConfigSchema.safeParse(raw) : null;
     const config = parsed?.success ? parsed.data : null;
@@ -5344,12 +5407,12 @@ var settingsRouter = router({
    * Test parser code: compile and run it against sample logs, return per-line results
    */
   testParser: protectedProcedure.input(
-    z11.object({
-      code: z11.string().max(5e4),
-      sampleLogs: z11.array(
-        z11.object({
-          raw: z11.string().max(16384),
-          stream: z11.enum(["stdout", "stderr"])
+    z12.object({
+      code: z12.string().max(5e4),
+      sampleLogs: z12.array(
+        z12.object({
+          raw: z12.string().max(16384),
+          stream: z12.enum(["stdout", "stderr"])
         })
       ).max(100).default([])
     })
@@ -5393,7 +5456,7 @@ var settingsRouter = router({
 });
 
 // ../server/src/trpc/routers/editor.ts
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 import { TRPCError as TRPCError9 } from "@trpc/server";
 import { execFile as execFile3, spawn as spawn2 } from "child_process";
 import { stat as stat4 } from "fs/promises";
@@ -5404,19 +5467,19 @@ import { homedir as homedir2 } from "os";
 import { readFile as readFile11, writeFile as writeFile11, rename as rename11, mkdir as mkdir11, chmod as chmod9 } from "fs/promises";
 import { join as join12 } from "path";
 import { homedir } from "os";
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var CONFIG_DIR = join12(homedir(), ".runeya");
 var CONFIG_FILE = "runeya.conf";
-var EditorPreferencesSchema = z12.object({
-  default: z12.string().max(64).optional()
-}).catchall(z12.string().max(64)).refine((obj) => Object.keys(obj).length <= 500, "Too many editor preferences");
-var ProjectSettingsSchema = z12.object({
-  settings: z12.object({
+var EditorPreferencesSchema = z13.object({
+  default: z13.string().max(64).optional()
+}).catchall(z13.string().max(64)).refine((obj) => Object.keys(obj).length <= 500, "Too many editor preferences");
+var ProjectSettingsSchema = z13.object({
+  settings: z13.object({
     editors: EditorPreferencesSchema.optional()
   }).optional()
 });
-var UserConfigSchema = z12.record(
-  z12.string().max(128),
+var UserConfigSchema = z13.record(
+  z13.string().max(128),
   ProjectSettingsSchema
 ).refine((obj) => Object.keys(obj).length <= 100, "Too many projects in config");
 function configKey(ref) {
@@ -5493,7 +5556,7 @@ async function getServiceCwd(serviceId) {
 }
 async function isCommandAvailable(command) {
   return new Promise((resolve7) => {
-    execFile3("which", [command], { timeout: 5e3 }, (err) => {
+    execFile3("which", [command], { timeout: 5e3, windowsHide: true }, (err) => {
       resolve7(!err);
     });
   });
@@ -5508,16 +5571,16 @@ var editorRouter = router({
     );
     return results;
   }),
-  getPreferences: protectedProcedure.input(z13.object({
-    projectId: z13.string().max(128),
-    orgId: z13.string().max(128).nullable().optional()
+  getPreferences: protectedProcedure.input(z14.object({
+    projectId: z14.string().max(128),
+    orgId: z14.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     return userConfigManager.getEditorPreferences({ id: input.projectId, orgId: input.orgId });
   }),
-  setDefault: protectedProcedure.input(z13.object({
-    projectId: z13.string().max(128),
-    orgId: z13.string().max(128).nullable().optional(),
-    editorKey: z13.string().max(64)
+  setDefault: protectedProcedure.input(z14.object({
+    projectId: z14.string().max(128),
+    orgId: z14.string().max(128).nullable().optional(),
+    editorKey: z14.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
       throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
@@ -5529,11 +5592,11 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  setServiceEditor: protectedProcedure.input(z13.object({
-    projectId: z13.string().max(128),
-    orgId: z13.string().max(128).nullable().optional(),
-    serviceId: z13.string().max(128),
-    editorKey: z13.string().max(64)
+  setServiceEditor: protectedProcedure.input(z14.object({
+    projectId: z14.string().max(128),
+    orgId: z14.string().max(128).nullable().optional(),
+    serviceId: z14.string().max(128),
+    editorKey: z14.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
       throw new TRPCError9({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
@@ -5545,10 +5608,10 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  removeServiceEditor: protectedProcedure.input(z13.object({
-    projectId: z13.string().max(128),
-    orgId: z13.string().max(128).nullable().optional(),
-    serviceId: z13.string().max(128)
+  removeServiceEditor: protectedProcedure.input(z14.object({
+    projectId: z14.string().max(128),
+    orgId: z14.string().max(128).nullable().optional(),
+    serviceId: z14.string().max(128)
   })).mutation(async ({ input }) => {
     await userConfigManager.removeEditorPreference(
       { id: input.projectId, orgId: input.orgId },
@@ -5556,9 +5619,9 @@ var editorRouter = router({
     );
     return { success: true };
   }),
-  open: protectedProcedure.input(z13.object({
-    editorKey: z13.string().max(64),
-    path: z13.string().max(4096)
+  open: protectedProcedure.input(z14.object({
+    editorKey: z14.string().max(64),
+    path: z14.string().max(4096)
   })).mutation(async ({ input }) => {
     const editor = EDITOR_BY_KEY.get(input.editorKey);
     if (!editor) {
@@ -5581,10 +5644,10 @@ var editorRouter = router({
     child.unref();
     return { success: true };
   }),
-  openFile: protectedProcedure.input(z13.object({
-    editorKey: z13.string().max(64),
-    serviceId: z13.string().max(128),
-    relativePath: z13.string().max(4096)
+  openFile: protectedProcedure.input(z14.object({
+    editorKey: z14.string().max(64),
+    serviceId: z14.string().max(128),
+    relativePath: z14.string().max(4096)
   })).mutation(async ({ input }) => {
     const editor = EDITOR_BY_KEY.get(input.editorKey);
     if (!editor) {
@@ -5612,7 +5675,7 @@ var editorRouter = router({
 });
 
 // ../server/src/trpc/routers/api-keys.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 import { TRPCError as TRPCError10 } from "@trpc/server";
 import { mkdir as mkdir12, writeFile as writeFile12 } from "fs/promises";
 import { join as join14, dirname as dirname7 } from "path";
@@ -5621,43 +5684,43 @@ var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
   ".cursor/rules/runeya.mdc",
   ".windsurf/rules/runeya.md"
 ]);
-var KeyInputSchema = z14.object({
-  name: z14.string().min(1).max(200),
+var KeyInputSchema = z15.object({
+  name: z15.string().min(1).max(200),
   scopes: ApiKeyScopeSchema,
-  isPublic: z14.boolean().default(false)
+  isPublic: z15.boolean().default(false)
 });
 var apiKeysRouter = router({
   list: protectedProcedure.query(() => apiKeyStore.list()),
-  create: protectedProcedure.input(KeyInputSchema.extend({ orgId: z14.string().min(1).max(128).nullable().optional() })).mutation(
+  create: protectedProcedure.input(KeyInputSchema.extend({ orgId: z15.string().min(1).max(128).nullable().optional() })).mutation(
     ({ input }) => apiKeyStore.create(input.name, input.scopes, input.isPublic, input.orgId ?? null)
   ),
   /**
    * Renvoie le secret d'une seule clé, sur demande explicite. `list` ne le
    * contient pas : une clé ne doit jamais être re-servie en masse.
    */
-  reveal: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).query(async ({ input }) => {
+  reveal: protectedProcedure.input(z15.object({ id: z15.string().max(128) })).query(async ({ input }) => {
     const key = await apiKeyStore.reveal(input.id);
     if (!key) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return { key };
   }),
-  update: protectedProcedure.input(KeyInputSchema.extend({ id: z14.string().max(128) })).mutation(async ({ input }) => {
+  update: protectedProcedure.input(KeyInputSchema.extend({ id: z15.string().max(128) })).mutation(async ({ input }) => {
     const updated = await apiKeyStore.update(input.id, input.name, input.scopes, input.isPublic);
     if (!updated) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return maskApiKey(updated);
   }),
-  remove: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).mutation(async ({ input }) => {
+  remove: protectedProcedure.input(z15.object({ id: z15.string().max(128) })).mutation(async ({ input }) => {
     const removed = await apiKeyStore.remove(input.id);
     if (!removed) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return { success: true };
   }),
-  renewKey: protectedProcedure.input(z14.object({ id: z14.string().max(128) })).mutation(async ({ input }) => {
+  renewKey: protectedProcedure.input(z15.object({ id: z15.string().max(128) })).mutation(async ({ input }) => {
     const renewed = await apiKeyStore.renewKey(input.id);
     if (!renewed) throw new TRPCError10({ code: "NOT_FOUND", message: "API key not found" });
     return renewed;
   }),
-  writeSkillFile: protectedProcedure.input(z14.object({
-    relativePath: z14.string().max(256),
-    content: z14.string().max(32768)
+  writeSkillFile: protectedProcedure.input(z15.object({
+    relativePath: z15.string().max(256),
+    content: z15.string().max(32768)
   })).mutation(async ({ input }) => {
     if (!ALLOWED_SKILL_PATHS.has(input.relativePath)) {
       throw new TRPCError10({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
@@ -5670,7 +5733,7 @@ var apiKeysRouter = router({
 });
 
 // ../server/src/trpc/routers/chat.ts
-import { z as z17 } from "zod";
+import { z as z18 } from "zod";
 import Anthropic2 from "@anthropic-ai/sdk";
 import OpenAI2 from "openai";
 import { execFile as execFile4 } from "child_process";
@@ -6343,12 +6406,12 @@ async function codexSessionExists(sessionId) {
 import { TRPCError as TRPCError12 } from "@trpc/server";
 
 // ../server/src/trpc/shared-schemas.ts
-import { z as z15 } from "zod";
-var Id128Schema = z15.string().max(128);
-var ConversationIdSchema = z15.string().max(128);
-var NameSchema = z15.string().min(1).max(200);
-var ShortString200Schema = z15.string().max(200);
-var DescriptionSchema = z15.string().max(2e3);
+import { z as z16 } from "zod";
+var Id128Schema = z16.string().max(128);
+var ConversationIdSchema = z16.string().max(128);
+var NameSchema = z16.string().min(1).max(200);
+var ShortString200Schema = z16.string().max(200);
+var DescriptionSchema = z16.string().max(2e3);
 var OptionalProviderIdSchema = Id128Schema.optional();
 
 // ../server/src/services/llms-txt-generator.ts
@@ -7722,7 +7785,7 @@ async function resolveImagesToBase64(images, contextId) {
 }
 
 // ../server/src/trpc/routers/cloud-auth.ts
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 import { hostname } from "os";
 import { basename } from "path";
 import { TRPCError as TRPCError11 } from "@trpc/server";
@@ -7767,7 +7830,7 @@ function isAllowedProxyPath(path) {
 }
 var cloudAuthRouter = router({
   /** Build the cloud authorization URL to open in the browser. */
-  startLogin: protectedProcedure.input(z16.object({ returnTo: z16.string().url().max(2048) })).mutation(async ({ input }) => {
+  startLogin: protectedProcedure.input(z17.object({ returnTo: z17.string().url().max(2048) })).mutation(async ({ input }) => {
     const callback = callbackForReturnTo(input.returnTo);
     if (!callback) {
       throw new TRPCError11({
@@ -7815,7 +7878,7 @@ var cloudAuthRouter = router({
    * drops the session, and the local token is dropped here too, so nothing is
    * left holding a dead credential.
    */
-  revokeDevice: protectedProcedure.input(z16.object({ id: z16.string().min(1).max(128) })).mutation(async ({ input }) => {
+  revokeDevice: protectedProcedure.input(z17.object({ id: z17.string().min(1).max(128) })).mutation(async ({ input }) => {
     const res = await cloudFetch2("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
     if (!res.ok) {
       if (res.status === 401) await cloudSessionStore.clear();
@@ -7832,11 +7895,11 @@ var cloudAuthRouter = router({
    * the cloud: the web UI asks its own server, which holds the credential.
    */
   proxy: protectedProcedure.input(
-    z16.object({
-      path: z16.string().min(1).max(512),
-      method: z16.enum(["GET", "POST"]).default("GET"),
-      query: z16.record(z16.string().max(128), z16.string().max(2048)).optional(),
-      body: z16.unknown().optional()
+    z17.object({
+      path: z17.string().min(1).max(512),
+      method: z17.enum(["GET", "POST"]).default("GET"),
+      query: z17.record(z17.string().max(128), z17.string().max(2048)).optional(),
+      body: z17.unknown().optional()
     })
   ).mutation(async ({ input }) => {
     if (!isAllowedProxyPath(input.path)) {
@@ -8545,7 +8608,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-U454MXAX.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-3KSS7BHP.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -8980,6 +9043,7 @@ var ClaudeCodeRunner = class {
       });
       params.onCommand?.(`claude ${displayArgs.join(" ")}`);
       const proc = spawn3("claude", args, {
+        windowsHide: true,
         stdio: ["pipe", "pipe", "pipe"],
         shell: false,
         env: env2
@@ -9128,6 +9192,7 @@ var CodexAppServerClient = class extends EventEmitter3 {
   async connect(runeyaEnv) {
     const env2 = { ...process.env, ...runeyaEnv };
     this.proc = spawn4("codex", [...resolveMcpArgs(env2), "app-server"], {
+      windowsHide: true,
       stdio: ["pipe", "pipe", "pipe"],
       env: env2
     });
@@ -9286,7 +9351,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-U454MXAX.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-3KSS7BHP.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -9727,18 +9792,18 @@ ${prompt}`;
 
 // ../server/src/trpc/routers/chat.ts
 var execFileAsync3 = promisify3(execFile4);
-var MessageSchema = z17.object({
-  role: z17.enum(["user", "assistant"]),
-  content: z17.string().max(1e5)
+var MessageSchema = z18.object({
+  role: z18.enum(["user", "assistant"]),
+  content: z18.string().max(1e5)
 });
-var ImagePartSchema = z17.object({
-  type: z17.literal("image"),
-  imageId: z17.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
-  url: z17.string().max(500),
-  mimeType: z17.string().max(100),
-  altText: z17.string().max(500).optional()
+var ImagePartSchema = z18.object({
+  type: z18.literal("image"),
+  imageId: z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i),
+  url: z18.string().max(500),
+  mimeType: z18.string().max(100),
+  altText: z18.string().max(500).optional()
 });
-var ImagePartsSchema = z17.array(ImagePartSchema).max(5).optional();
+var ImagePartsSchema = z18.array(ImagePartSchema).max(5).optional();
 var LANGUAGE_INSTRUCTION = "Always respond in the same language the user writes in.";
 async function buildSystemPrompt(apiKey) {
   const allServices = await serviceStore.list();
@@ -10125,24 +10190,24 @@ async function startCodexSession(convId, prompt, opts = {}) {
   });
   return { session, done };
 }
-var MessagePartSchema = z17.discriminatedUnion("type", [
-  z17.object({ type: z17.literal("thinking"), text: z17.string().max(1e5) }),
-  z17.object({ type: z17.literal("text"), text: z17.string().max(1e5) }),
-  z17.object({
-    type: z17.literal("tool"),
+var MessagePartSchema = z18.discriminatedUnion("type", [
+  z18.object({ type: z18.literal("thinking"), text: z18.string().max(1e5) }),
+  z18.object({ type: z18.literal("text"), text: z18.string().max(1e5) }),
+  z18.object({
+    type: z18.literal("tool"),
     id: Id128Schema,
     name: Id128Schema,
-    input: z17.record(z17.string(), z17.unknown()).optional(),
-    rawInput: z17.string().max(1e4).optional(),
-    result: z17.unknown().optional(),
-    isError: z17.boolean().optional(),
-    pending: z17.boolean()
+    input: z18.record(z18.string(), z18.unknown()).optional(),
+    rawInput: z18.string().max(1e4).optional(),
+    result: z18.unknown().optional(),
+    isError: z18.boolean().optional(),
+    pending: z18.boolean()
   })
 ]);
-var StoredMessageSchema = z17.object({
-  role: z17.enum(["user", "assistant"]),
-  content: z17.string().max(1e5),
-  parts: z17.array(MessagePartSchema).max(200).optional()
+var StoredMessageSchema = z18.object({
+  role: z18.enum(["user", "assistant"]),
+  content: z18.string().max(1e5),
+  parts: z18.array(MessagePartSchema).max(200).optional()
 });
 async function conversationCwd(conv) {
   return resolveConversationCwd(conv.id);
@@ -10156,7 +10221,7 @@ var chatRouter = router({
      * et sans le même filtre il y reversait toutes les conversations de la
      * machine, une seconde après un chargement pourtant filtré.
      */
-    onChanged: protectedProcedure.input(z17.object({
+    onChanged: protectedProcedure.input(z18.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).subscription(async function* ({ input }) {
@@ -10204,7 +10269,7 @@ var chatRouter = router({
      * reachable where they were written, without leaking into every other
      * organization's projects.
      */
-    list: protectedProcedure.input(z17.object({
+    list: protectedProcedure.input(z18.object({
       projectId: Id128Schema.optional(),
       orgId: Id128Schema.nullable().optional()
     }).optional()).query(async ({ input }) => {
@@ -10212,24 +10277,24 @@ var chatRouter = router({
       if (!projectId) return conversationStore.list();
       return conversationStore.listForProject({ id: projectId, orgId: input?.orgId });
     }),
-    get: protectedProcedure.input(z17.object({ id: Id128Schema })).query(async ({ input }) => {
+    get: protectedProcedure.input(z18.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError12({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     }),
-    create: protectedProcedure.input(z17.object({
+    create: protectedProcedure.input(z18.object({
       title: ShortString200Schema.optional(),
-      isCli: z17.boolean().optional(),
-      runner: z17.enum(["claude-code", "codex"]).optional(),
+      isCli: z18.boolean().optional(),
+      runner: z18.enum(["claude-code", "codex"]).optional(),
       providerId: Id128Schema.optional(),
       scenarioId: Id128Schema.optional(),
-      scenarioInput: z17.string().max(1e5).optional(),
+      scenarioInput: z18.string().max(1e5).optional(),
       kanbanBoardId: Id128Schema.optional(),
       kanbanCardId: Id128Schema.optional(),
       // The project the conversation is about: only the caller knows which
       // one it is looking at.
       projectId: Id128Schema.optional(),
-      orgId: z17.string().max(128).nullable().optional()
+      orgId: z18.string().max(128).nullable().optional()
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
@@ -10260,20 +10325,20 @@ var chatRouter = router({
       }
       return conv;
     }),
-    update: protectedProcedure.input(z17.object({
+    update: protectedProcedure.input(z18.object({
       id: Id128Schema,
       title: ShortString200Schema.optional(),
-      messages: z17.array(StoredMessageSchema).max(500).optional(),
-      contextUsage: z17.object({
-        inputTokens: z17.number().int().nonnegative(),
-        contextWindow: z17.number().int().positive()
+      messages: z18.array(StoredMessageSchema).max(500).optional(),
+      contextUsage: z18.object({
+        inputTokens: z18.number().int().nonnegative(),
+        contextWindow: z18.number().int().positive()
       }).optional()
     })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { title: input.title, messages: input.messages, contextUsage: input.contextUsage });
       if (!conv) throw new TRPCError12({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     }),
-    delete: protectedProcedure.input(z17.object({ id: Id128Schema })).mutation(async ({ input }) => {
+    delete: protectedProcedure.input(z18.object({ id: Id128Schema })).mutation(async ({ input }) => {
       const existing = await conversationStore.get(input.id);
       if (!existing) throw new TRPCError12({ code: "NOT_FOUND", message: "Conversation not found" });
       for (const agent of agentManager.listAgents()) {
@@ -10295,18 +10360,18 @@ var chatRouter = router({
         (err) => console.error("[chat.delete] Image cleanup error:", err)
       );
     }),
-    archive: protectedProcedure.input(z17.object({ id: Id128Schema, archived: z17.boolean() })).mutation(async ({ input }) => {
+    archive: protectedProcedure.input(z18.object({ id: Id128Schema, archived: z18.boolean() })).mutation(async ({ input }) => {
       const conv = await conversationStore.update(input.id, { archived: input.archived });
       if (!conv) throw new TRPCError12({ code: "NOT_FOUND", message: "Conversation not found" });
       return conv;
     })
   }),
-  listModels: protectedProcedure.input(z17.object({
+  listModels: protectedProcedure.input(z18.object({
     providerId: Id128Schema.optional(),
     // Le projet dit de quelle organisation lire les fournisseurs ; absent,
     // ce sont ceux du poste.
     projectId: Id128Schema.optional(),
-    orgId: z17.string().max(128).nullable().optional()
+    orgId: z18.string().max(128).nullable().optional()
   }).optional()).query(async ({ input }) => {
     const active = await getActiveProvider(
       input?.providerId,
@@ -10319,7 +10384,7 @@ var chatRouter = router({
       return [];
     }
   }),
-  checkCliAvailability: protectedProcedure.input(z17.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
+  checkCliAvailability: protectedProcedure.input(z18.object({ agentId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
     if (input?.agentId) {
       try {
         const res = await agentManager.agentQuery(
@@ -10332,17 +10397,17 @@ var chatRouter = router({
       }
     }
     const [claudeOk, codexOk] = await Promise.all([
-      execFileAsync3("claude", ["--version"], { timeout: 5e3, shell: false }).then(() => true).catch(() => false),
-      execFileAsync3("codex", ["--version"], { timeout: 5e3, shell: false }).then(() => true).catch(() => false)
+      execFileAsync3("claude", ["--version"], { timeout: 5e3, shell: false, windowsHide: true }).then(() => true).catch(() => false),
+      execFileAsync3("codex", ["--version"], { timeout: 5e3, shell: false, windowsHide: true }).then(() => true).catch(() => false)
     ]);
     return { available: claudeOk, codexAvailable: codexOk };
   }),
-  enhanceScenarioPrompt: protectedProcedure.input(z17.object({
-    text: z17.string().max(1e4),
+  enhanceScenarioPrompt: protectedProcedure.input(z18.object({
+    text: z18.string().max(1e4),
     providerId: Id128Schema.optional(),
-    model: z17.string().max(200).optional(),
+    model: z18.string().max(200).optional(),
     projectId: Id128Schema.optional(),
-    orgId: z17.string().max(128).nullable().optional()
+    orgId: z18.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const active = await getActiveProvider(
       input.providerId,
@@ -10399,22 +10464,22 @@ Return ONLY the improved text, no explanation, no preamble.`;
     }
   }),
   getStreamingStatus: protectedProcedure.query(() => activeSessionRegistry.listActive()),
-  stopSession: protectedProcedure.input(z17.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
+  stopSession: protectedProcedure.input(z18.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: stopSession");
     const killed = activeSessionRegistry.kill(input.conversationId);
     if (!killed) throw new TRPCError12({ code: "NOT_FOUND", message: "No active session for this conversation" });
     return { ok: true };
   }),
-  streamViaClaudeCode: protectedProcedure.input(z17.object({
+  streamViaClaudeCode: protectedProcedure.input(z18.object({
     conversationId: ConversationIdSchema,
-    prompt: z17.string().max(1e5),
-    contextNote: z17.string().max(2e5).optional(),
+    prompt: z18.string().max(1e5),
+    contextNote: z18.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    effort: z17.enum(["low", "medium", "high"]).optional(),
-    reconnect: z17.boolean().optional(),
+    effort: z18.enum(["low", "medium", "high"]).optional(),
+    reconnect: z18.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z17.string().max(128).optional(),
-    imageIds: z17.array(z17.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z18.string().max(128).optional(),
+    imageIds: z18.array(z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: Reconnect");
@@ -10525,15 +10590,15 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
     if (process.env.RUNEYA_DEBUG) console.log("[chat]: drainSession...");
     yield* drainSession(session, signal, false);
   }),
-  streamViaCodex: protectedProcedure.input(z17.object({
+  streamViaCodex: protectedProcedure.input(z18.object({
     conversationId: ConversationIdSchema,
-    prompt: z17.string().max(1e5),
-    contextNote: z17.string().max(2e5).optional(),
+    prompt: z18.string().max(1e5),
+    contextNote: z18.string().max(2e5).optional(),
     model: ShortString200Schema.optional(),
-    reconnect: z17.boolean().optional(),
+    reconnect: z18.boolean().optional(),
     agentId: Id128Schema.optional(),
-    environmentId: z17.string().max(128).optional(),
-    imageIds: z17.array(z17.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    environmentId: z18.string().max(128).optional(),
+    imageIds: z18.array(z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -10611,13 +10676,13 @@ ${input.prompt}` : input.prompt;
     });
     yield* drainSession(session, signal, false);
   }),
-  send: protectedProcedure.input(z17.object({
+  send: protectedProcedure.input(z18.object({
     conversationId: ConversationIdSchema,
-    messages: z17.array(MessageSchema).min(0).max(100),
+    messages: z18.array(MessageSchema).min(0).max(100),
     model: ShortString200Schema.optional(),
-    contextNote: z17.string().max(2e5).optional(),
-    reconnect: z17.boolean().optional(),
-    imageIds: z17.array(z17.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
+    contextNote: z18.string().max(2e5).optional(),
+    reconnect: z18.boolean().optional(),
+    imageIds: z18.array(z18.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i)).max(5).optional(),
     imageParts: ImagePartsSchema
   })).subscription(async function* ({ input, ctx, signal }) {
     const existingSession = activeSessionRegistry.get(input.conversationId);
@@ -10735,25 +10800,25 @@ ${input.prompt}` : input.prompt;
   // ── PTY passthrough (interactive Claude Code session) ────────────────────
   pty: router({
     /** Start a PTY session running `claude --resume <sessionId>` (or fresh). */
-    start: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      sessionId: z17.string().max(128).optional(),
-      runner: z17.enum(["claude-code", "codex"]).default("claude-code"),
-      resume: z17.boolean().default(false),
-      model: z17.string().max(128).optional(),
-      cwd: z17.string().max(4096).optional(),
+    start: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      sessionId: z18.string().max(128).optional(),
+      runner: z18.enum(["claude-code", "codex"]).default("claude-code"),
+      resume: z18.boolean().default(false),
+      model: z18.string().max(128).optional(),
+      cwd: z18.string().max(4096).optional(),
       /** Anchors the session when no explicit cwd is given. */
-      serviceId: z17.string().max(128).optional(),
+      serviceId: z18.string().max(128).optional(),
       projectId: Id128Schema.optional(),
-      orgId: z17.string().max(128).nullable().optional(),
-      cols: z17.number().int().min(1).max(1e3).default(120),
-      rows: z17.number().int().min(1).max(1e3).default(30),
-      enableMcp: z17.boolean().default(false),
-      apiBaseUrl: z17.string().max(512).optional(),
-      environmentId: z17.string().max(128).optional(),
-      attachedContexts: z17.array(z17.object({
-        label: z17.string().max(200),
-        text: z17.string().max(1e6)
+      orgId: z18.string().max(128).nullable().optional(),
+      cols: z18.number().int().min(1).max(1e3).default(120),
+      rows: z18.number().int().min(1).max(1e3).default(30),
+      enableMcp: z18.boolean().default(false),
+      apiBaseUrl: z18.string().max(512).optional(),
+      environmentId: z18.string().max(128).optional(),
+      attachedContexts: z18.array(z18.object({
+        label: z18.string().max(200),
+        text: z18.string().max(1e6)
       })).max(20).optional()
     })).mutation(async ({ input, ctx }) => {
       const t0 = Date.now();
@@ -10912,10 +10977,10 @@ Context:
       return { spawnId: res.spawnId, agentId, reattached: false };
     }),
     /** Subscribe to PTY output stream (raw text with ANSI). */
-    stream: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      spawnId: z17.string().max(128),
-      fromOffset: z17.number().int().min(0).default(0)
+    stream: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      spawnId: z18.string().max(128),
+      fromOffset: z18.number().int().min(0).default(0)
     })).subscription(async function* ({ input, signal }) {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -10967,10 +11032,10 @@ Context:
       }
     }),
     /** Write input to a PTY session (keystrokes from xterm). */
-    write: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      spawnId: z17.string().max(128),
-      data: z17.string().max(1e6)
+    write: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      spawnId: z18.string().max(128),
+      data: z18.string().max(1e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -10980,11 +11045,11 @@ Context:
       });
     }),
     /** Resize a PTY session. */
-    resize: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      spawnId: z17.string().max(128),
-      cols: z17.number().int().min(1).max(1e3),
-      rows: z17.number().int().min(1).max(1e3)
+    resize: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      spawnId: z18.string().max(128),
+      cols: z18.number().int().min(1).max(1e3),
+      rows: z18.number().int().min(1).max(1e3)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -11000,11 +11065,11 @@ Context:
      * picks it up. Returns the tmp path and which clipboard method succeeded
      * (null if none — caller should inject `@<path>` instead of Ctrl+V).
      */
-    pasteImage: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      sessionId: z17.string().max(128).optional(),
-      mimeType: z17.string().max(64),
-      base64: z17.string().max(15e6)
+    pasteImage: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      sessionId: z18.string().max(128).optional(),
+      mimeType: z18.string().max(64),
+      base64: z18.string().max(15e6)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -11022,7 +11087,7 @@ Context:
      * Read the transcript Claude Code stores on disk for a given session.
      * Returns parsed JSONL entries (user / assistant messages, tool uses, etc.).
      */
-    transcript: protectedProcedure.input(z17.object({ sessionId: z17.string().max(128) })).query(async ({ input }) => {
+    transcript: protectedProcedure.input(z18.object({ sessionId: z18.string().max(128) })).query(async ({ input }) => {
       return readClaudeTranscript(input.sessionId);
     }),
     /**
@@ -11030,9 +11095,9 @@ Context:
      * when was the transcript JSONL last touched? Used by the non-PTY view
      * to show a "Claude is thinking…" indicator while output streams.
      */
-    activity: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      sessionId: z17.string().max(128)
+    activity: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      sessionId: z18.string().max(128)
     })).query(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       let running = false;
@@ -11058,7 +11123,7 @@ Context:
      * them on the conversation, so the non-PTY chat view stays in sync.
      * Uses the conversation id as session id (PTY sessions are spawned that way).
      */
-    syncTranscript: protectedProcedure.input(z17.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
+    syncTranscript: protectedProcedure.input(z18.object({ conversationId: ConversationIdSchema })).mutation(async ({ input }) => {
       const conv = await conversationStore.get(input.conversationId);
       if (!conv) {
         throw new TRPCError12({ code: "NOT_FOUND", message: `Conversation ${input.conversationId} not found` });
@@ -11072,14 +11137,14 @@ Context:
      * with the given sessionId. Used to benchmark the PTY → tRPC → xterm.js
      * pipeline. Open the conversation in PTY mode to attach to it.
      */
-    debugStress: protectedProcedure.input(z17.object({
-      sessionId: z17.string().max(128),
-      agentId: z17.string().max(128).optional(),
-      bytesPerSec: z17.number().int().min(100).max(1e7).default(5e4),
-      chunkSize: z17.number().int().min(1).max(65536).default(256),
-      durationMs: z17.number().int().min(0).max(36e5).default(0),
-      cols: z17.number().int().min(1).max(1e3).default(120),
-      rows: z17.number().int().min(1).max(1e3).default(30)
+    debugStress: protectedProcedure.input(z18.object({
+      sessionId: z18.string().max(128),
+      agentId: z18.string().max(128).optional(),
+      bytesPerSec: z18.number().int().min(100).max(1e7).default(5e4),
+      chunkSize: z18.number().int().min(1).max(65536).default(256),
+      durationMs: z18.number().int().min(0).max(36e5).default(0),
+      cols: z18.number().int().min(1).max(1e3).default(120),
+      rows: z18.number().int().min(1).max(1e3).default(30)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -11126,9 +11191,9 @@ Context:
       return { spawnId: res.spawnId, agentId, stressSessionId };
     }),
     /** Kill a PTY session. */
-    kill: protectedProcedure.input(z17.object({
-      agentId: z17.string().max(128).optional(),
-      spawnId: z17.string().max(128)
+    kill: protectedProcedure.input(z18.object({
+      agentId: z18.string().max(128).optional(),
+      spawnId: z18.string().max(128)
     })).mutation(async ({ input }) => {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError12({ code: "PRECONDITION_FAILED", message: "No agent available" });
@@ -11140,16 +11205,16 @@ Context:
 });
 
 // ../server/src/trpc/routers/git.ts
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 import { TRPCError as TRPCError13 } from "@trpc/server";
 import Anthropic3 from "@anthropic-ai/sdk";
 import OpenAI3 from "openai";
-var SERVICE_ID_SCHEMA = z18.string().max(128);
-var SAFE_PATH_SCHEMA = z18.string().min(1).max(4096).refine((p) => !p.startsWith("/") && !p.includes("../"), {
+var SERVICE_ID_SCHEMA = z19.string().max(128);
+var SAFE_PATH_SCHEMA = z19.string().min(1).max(4096).refine((p) => !p.startsWith("/") && !p.includes("../"), {
   message: "Path must be relative and not traverse up"
 });
-var REMOTE_SCHEMA = z18.string().min(1).max(128).regex(/^[a-zA-Z0-9_\-.]+$/);
-var BRANCH_SCHEMA = z18.string().min(1).max(256).regex(/^[a-zA-Z0-9._\-/]+$/);
+var REMOTE_SCHEMA = z19.string().min(1).max(128).regex(/^[a-zA-Z0-9_\-.]+$/);
+var BRANCH_SCHEMA = z19.string().min(1).max(256).regex(/^[a-zA-Z0-9._\-/]+$/);
 async function resolveServiceContext(serviceId) {
   const service = await serviceStore.get(serviceId);
   if (!service) {
@@ -11163,11 +11228,11 @@ async function resolveServiceContext(serviceId) {
 }
 var gitTargetShape = {
   serviceId: SERVICE_ID_SCHEMA.optional(),
-  agentId: z18.string().max(128).optional(),
+  agentId: z19.string().max(128).optional(),
   /** Anchors on a project when no service is targeted (e.g. from the AI chat). */
-  projectId: z18.string().max(128).optional(),
+  projectId: z19.string().max(128).optional(),
   /** Son organisation : un id de projet seul peut en nommer un par organisation. */
-  orgId: z18.string().max(128).nullable().optional()
+  orgId: z19.string().max(128).nullable().optional()
 };
 async function resolveGitContext(input) {
   if (input.serviceId) return resolveServiceContext(input.serviceId);
@@ -11180,82 +11245,82 @@ async function resolveGitContext(input) {
 }
 var gitRouter = router({
   /** Get full git status */
-  status: protectedProcedure.input(z18.object({ ...gitTargetShape })).query(async ({ input }) => {
+  status: protectedProcedure.input(z19.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.status", { cwd });
   }),
   /** Get commit log */
-  log: protectedProcedure.input(z18.object({ ...gitTargetShape, limit: z18.number().int().min(1).max(200).default(50) })).query(async ({ input }) => {
+  log: protectedProcedure.input(z19.object({ ...gitTargetShape, limit: z19.number().int().min(1).max(200).default(50) })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.log", { cwd, limit: input.limit });
   }),
   /** List local and remote branches */
-  branches: protectedProcedure.input(z18.object({ ...gitTargetShape })).query(async ({ input }) => {
+  branches: protectedProcedure.input(z19.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.branches", { cwd });
   }),
   /** Checkout a branch */
-  checkout: protectedProcedure.input(z18.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, create: z18.boolean().default(false) })).mutation(async ({ input }) => {
+  checkout: protectedProcedure.input(z19.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, create: z19.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.checkout", { cwd, branch: input.branch, create: input.create });
   }),
   /** Stage files */
-  stage: protectedProcedure.input(z18.object({ ...gitTargetShape, paths: z18.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  stage: protectedProcedure.input(z19.object({ ...gitTargetShape, paths: z19.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stage", { cwd, paths: input.paths });
   }),
   /** Stage all files */
-  stageAll: protectedProcedure.input(z18.object({ ...gitTargetShape })).mutation(async ({ input }) => {
+  stageAll: protectedProcedure.input(z19.object({ ...gitTargetShape })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stageAll", { cwd });
   }),
   /** Unstage files */
-  unstage: protectedProcedure.input(z18.object({ ...gitTargetShape, paths: z18.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  unstage: protectedProcedure.input(z19.object({ ...gitTargetShape, paths: z19.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.unstage", { cwd, paths: input.paths });
   }),
   /** Unstage all files */
-  unstageAll: protectedProcedure.input(z18.object({ ...gitTargetShape })).mutation(async ({ input }) => {
+  unstageAll: protectedProcedure.input(z19.object({ ...gitTargetShape })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.unstageAll", { cwd });
   }),
   /** Commit staged changes */
-  commit: protectedProcedure.input(z18.object({ ...gitTargetShape, message: z18.string().min(1).max(4096) })).mutation(async ({ input }) => {
+  commit: protectedProcedure.input(z19.object({ ...gitTargetShape, message: z19.string().min(1).max(4096) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.commit", { cwd, message: input.message });
   }),
   /** Push to remote */
-  push: protectedProcedure.input(z18.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin"), setUpstream: z18.boolean().default(false) })).mutation(async ({ input }) => {
+  push: protectedProcedure.input(z19.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin"), setUpstream: z19.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.push", { cwd, remote: input.remote, setUpstream: input.setUpstream });
   }),
   /** Pull from remote */
-  pull: protectedProcedure.input(z18.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
+  pull: protectedProcedure.input(z19.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.pull", { cwd, remote: input.remote });
   }),
   /** Fetch from remote */
-  fetch: protectedProcedure.input(z18.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
+  fetch: protectedProcedure.input(z19.object({ ...gitTargetShape, remote: REMOTE_SCHEMA.default("origin") })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.fetch", { cwd, remote: input.remote });
   }),
   /** Get diff for a file or the whole index */
-  diff: protectedProcedure.input(z18.object({
+  diff: protectedProcedure.input(z19.object({
     ...gitTargetShape,
-    path: z18.string().max(4096).optional(),
-    staged: z18.boolean().default(false),
-    untracked: z18.boolean().default(false)
+    path: z19.string().max(4096).optional(),
+    staged: z19.boolean().default(false),
+    untracked: z19.boolean().default(false)
   })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.diff", { cwd, path: input.path, staged: input.staged, untracked: input.untracked });
   }),
   /** Discard changes to working tree files */
-  discard: protectedProcedure.input(z18.object({ ...gitTargetShape, paths: z18.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
+  discard: protectedProcedure.input(z19.object({ ...gitTargetShape, paths: z19.array(SAFE_PATH_SCHEMA).min(1).max(500) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.discard", { cwd, paths: input.paths });
   }),
   /** Generate a commit message from staged diffs using AI (diff fetched from agent, AI runs on server) */
-  generateCommitMessage: protectedProcedure.input(z18.object({ ...gitTargetShape, providerId: OptionalProviderIdSchema, model: z18.string().max(200).optional() })).mutation(async ({ input }) => {
+  generateCommitMessage: protectedProcedure.input(z19.object({ ...gitTargetShape, providerId: OptionalProviderIdSchema, model: z19.string().max(200).optional() })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     const { diff } = await agentManager.agentQuery(agentId, "git.stagedDiff", { cwd });
     if (!diff.trim()) {
@@ -11302,42 +11367,42 @@ Rules:
     throw new TRPCError13({ code: "BAD_REQUEST", message: "Unsupported AI provider" });
   }),
   /** Merge a branch into the current branch */
-  merge: protectedProcedure.input(z18.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, noFf: z18.boolean().default(false) })).mutation(async ({ input }) => {
+  merge: protectedProcedure.input(z19.object({ ...gitTargetShape, branch: BRANCH_SCHEMA, noFf: z19.boolean().default(false) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.merge", { cwd, branch: input.branch, noFf: input.noFf });
   }),
   /** Rebase current branch onto another branch */
-  rebase: protectedProcedure.input(z18.object({ ...gitTargetShape, branch: BRANCH_SCHEMA })).mutation(async ({ input }) => {
+  rebase: protectedProcedure.input(z19.object({ ...gitTargetShape, branch: BRANCH_SCHEMA })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.rebase", { cwd, branch: input.branch });
   }),
   /** List stash entries */
-  stashList: protectedProcedure.input(z18.object({ ...gitTargetShape })).query(async ({ input }) => {
+  stashList: protectedProcedure.input(z19.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.stashList", { cwd });
   }),
   /** Stash current changes */
-  stashPush: protectedProcedure.input(z18.object({ ...gitTargetShape, message: z18.string().max(4096).optional(), includeUntracked: z18.boolean().default(true) })).mutation(async ({ input }) => {
+  stashPush: protectedProcedure.input(z19.object({ ...gitTargetShape, message: z19.string().max(4096).optional(), includeUntracked: z19.boolean().default(true) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashPush", { cwd, message: input.message, includeUntracked: input.includeUntracked });
   }),
   /** Pop a stash entry */
-  stashPop: protectedProcedure.input(z18.object({ ...gitTargetShape, index: z18.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashPop: protectedProcedure.input(z19.object({ ...gitTargetShape, index: z19.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashPop", { cwd, index: input.index });
   }),
   /** Apply a stash entry without dropping it */
-  stashApply: protectedProcedure.input(z18.object({ ...gitTargetShape, index: z18.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashApply: protectedProcedure.input(z19.object({ ...gitTargetShape, index: z19.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashApply", { cwd, index: input.index });
   }),
   /** Drop a stash entry */
-  stashDrop: protectedProcedure.input(z18.object({ ...gitTargetShape, index: z18.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
+  stashDrop: protectedProcedure.input(z19.object({ ...gitTargetShape, index: z19.number().int().min(0).max(1e3).default(0) })).mutation(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentMutation(agentId, "git.stashDrop", { cwd, index: input.index });
   }),
   /** Watch .git/ for changes and stream updated status */
-  onStatusChange: protectedProcedure.input(z18.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
+  onStatusChange: protectedProcedure.input(z19.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
     const { agentId, cwd } = await resolveGitContext(input);
     const queue = [];
     let resolve7 = null;
@@ -11384,7 +11449,7 @@ Rules:
     }
   }),
   /** List remotes */
-  remotes: protectedProcedure.input(z18.object({ ...gitTargetShape })).query(async ({ input }) => {
+  remotes: protectedProcedure.input(z19.object({ ...gitTargetShape })).query(async ({ input }) => {
     const { agentId, cwd } = await resolveGitContext(input);
     return agentManager.agentQuery(agentId, "git.remotes", { cwd });
   })
@@ -11393,7 +11458,7 @@ Rules:
 // ../server/src/trpc/routers/scenario.ts
 import { randomUUID as randomUUID8 } from "crypto";
 import { TRPCError as TRPCError16 } from "@trpc/server";
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 
 // ../server/src/trpc/crud-procedure-utils.ts
 import { TRPCError as TRPCError14 } from "@trpc/server";
@@ -12992,28 +13057,28 @@ Modify the scenario. Keep existing ids when possible.`;
   return `Generate an scenario org-chart based on: ${userPrompt}`;
 }
 var ScopeShape2 = {
-  orgId: z19.string().max(128).nullable().optional(),
+  orgId: z20.string().max(128).nullable().optional(),
   projectId: Id128Schema.optional()
 };
 async function scopeOf2(input) {
   return input?.orgId ?? await vaultOfProject(input?.projectId);
 }
 var scenarioRouter = router({
-  list: protectedProcedure.input(z19.object(ScopeShape2).optional()).query(async ({ input }) => scenarioStore.list(await scopeOf2(input))),
-  get: protectedProcedure.input(z19.object({ id: Id128Schema, ...ScopeShape2 })).query(async ({ input }) => getOrNotFound(
+  list: protectedProcedure.input(z20.object(ScopeShape2).optional()).query(async ({ input }) => scenarioStore.list(await scopeOf2(input))),
+  get: protectedProcedure.input(z20.object({ id: Id128Schema, ...ScopeShape2 })).query(async ({ input }) => getOrNotFound(
     async () => scenarioStore.get(input.id, await scopeOf2(input)),
     "Scenario not found"
   )),
-  create: protectedProcedure.input(z19.object({
+  create: protectedProcedure.input(z20.object({
     name: NameSchema,
-    icon: z19.string().max(64).optional(),
+    icon: z20.string().max(64).optional(),
     description: DescriptionSchema.optional(),
     leaderId: Id128Schema,
-    groups: z19.array(ScenarioGroupSchema).max(100).optional(),
-    nodes: z19.array(ScenarioNodeSchema).min(1).max(500),
-    traversalMode: z19.enum(["hierarchical", "topological"]).optional(),
-    presetId: z19.string().max(128).optional(),
-    isPublished: z19.boolean().optional(),
+    groups: z20.array(ScenarioGroupSchema).max(100).optional(),
+    nodes: z20.array(ScenarioNodeSchema).min(1).max(500),
+    traversalMode: z20.enum(["hierarchical", "topological"]).optional(),
+    presetId: z20.string().max(128).optional(),
+    isPublished: z20.boolean().optional(),
     ...ScopeShape2
   })).mutation(({ input }) => {
     const now = Date.now();
@@ -13032,17 +13097,17 @@ var scenarioRouter = router({
       updatedAt: now
     }));
   }),
-  update: protectedProcedure.input(z19.object({
+  update: protectedProcedure.input(z20.object({
     id: Id128Schema,
     name: NameSchema.optional(),
-    icon: z19.string().max(64).optional(),
+    icon: z20.string().max(64).optional(),
     description: DescriptionSchema.optional(),
     leaderId: Id128Schema.optional(),
-    groups: z19.array(ScenarioGroupSchema).max(100).optional(),
-    nodes: z19.array(ScenarioNodeSchema).min(1).max(500).optional(),
-    traversalMode: z19.enum(["hierarchical", "topological"]).optional(),
-    presetId: z19.string().max(128).optional(),
-    isPublished: z19.boolean().optional(),
+    groups: z20.array(ScenarioGroupSchema).max(100).optional(),
+    nodes: z20.array(ScenarioNodeSchema).min(1).max(500).optional(),
+    traversalMode: z20.enum(["hierarchical", "topological"]).optional(),
+    presetId: z20.string().max(128).optional(),
+    isPublished: z20.boolean().optional(),
     ...ScopeShape2
   })).mutation(({ input }) => updateOrThrow(
     async () => scenarioStore.update(input.id, {
@@ -13059,22 +13124,22 @@ var scenarioRouter = router({
     }, await scopeOf2(input)),
     "Scenario not found"
   )),
-  delete: protectedProcedure.input(z19.object({ id: Id128Schema, ...ScopeShape2 })).mutation(({ input }) => deleteOrNotFound(
+  delete: protectedProcedure.input(z20.object({ id: Id128Schema, ...ScopeShape2 })).mutation(({ input }) => deleteOrNotFound(
     async () => scenarioStore.delete(input.id, await scopeOf2(input)),
     "Scenario not found"
   )),
-  run: protectedProcedure.input(z19.object({
+  run: protectedProcedure.input(z20.object({
     conversationId: ConversationIdSchema,
     scenarioId: Id128Schema,
-    userRequest: z19.string().max(1e5),
-    runnerOverride: z19.enum(["claude-code", "codex"]).optional(),
+    userRequest: z20.string().max(1e5),
+    runnerOverride: z20.enum(["claude-code", "codex"]).optional(),
     modelOverride: Id128Schema.optional(),
     agentId: Id128Schema.optional(),
     /** Anchors the run's working directory on the project it belongs to. */
     projectId: Id128Schema.optional(),
     /** Son organisation : sans elle, un id partagé désignerait un projet au hasard. */
-    orgId: z19.string().max(128).nullable().optional(),
-    resume: z19.boolean().optional()
+    orgId: z20.string().max(128).nullable().optional(),
+    resume: z20.boolean().optional()
   })).subscription(async function* ({ input, signal }) {
     const scenario = await scenarioStore.get(input.scenarioId, await scopeOf2(input));
     if (!scenario) throw new TRPCError16({ code: "NOT_FOUND", message: "Scenario not found" });
@@ -13094,41 +13159,41 @@ var scenarioRouter = router({
     }
     yield* tapBus(input.conversationId, signal ?? new AbortController().signal);
   }),
-  stop: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
+  stop: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).mutation(({ input }) => {
     abortScenario(input.conversationId);
     return { ok: true };
   }),
-  sendNodeInput: protectedProcedure.input(z19.object({
+  sendNodeInput: protectedProcedure.input(z20.object({
     conversationId: ConversationIdSchema,
     nodeId: Id128Schema,
-    text: z19.string().min(1).max(1e5)
+    text: z20.string().min(1).max(1e5)
   })).mutation(({ input }) => {
     const resolved = resolveNodeInput(input.conversationId, input.nodeId, input.text);
     if (!resolved) throw new TRPCError16({ code: "NOT_FOUND", message: "No pending input request for this node" });
     return { ok: true };
   }),
-  isRunning: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).query(({ input }) => ({ running: isScenarioRunning(input.conversationId) })),
-  runState: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).query(({ input }) => {
+  isRunning: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).query(({ input }) => ({ running: isScenarioRunning(input.conversationId) })),
+  runState: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).query(({ input }) => {
     const runState = scenarioRunStore.getRunState(input.conversationId);
     return runState ?? { nodeStates: {}, nodeOutputs: {}, activeNodeId: void 0 };
   }),
-  getPersistedRunState: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getPersistedRunState: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.loadPersistedRunState(input.conversationId);
   }),
-  getReadme: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getReadme: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.readReadme(input.conversationId);
   }),
-  getSnapshot: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
+  getSnapshot: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).query(async ({ input }) => {
     return await scenarioRunStore.loadScenarioSnapshot(input.conversationId);
   }),
-  streamGenerateWithAI: protectedProcedure.input(z19.object({
-    prompt: z19.string().min(1).max(1e4),
+  streamGenerateWithAI: protectedProcedure.input(z20.object({
+    prompt: z20.string().min(1).max(1e4),
     providerId: OptionalProviderIdSchema,
-    model: z19.string().max(200).optional(),
-    current: z19.object({
+    model: z20.string().max(200).optional(),
+    current: z20.object({
       leaderId: Id128Schema,
-      groups: z19.array(ScenarioGroupSchema).max(100),
-      nodes: z19.array(ScenarioNodeSchema).max(500)
+      groups: z20.array(ScenarioGroupSchema).max(100),
+      nodes: z20.array(ScenarioNodeSchema).max(500)
     }).optional()
   })).subscription(async function* ({ input, signal }) {
     const userMessage = buildScenarioUserMessage(input.prompt, input.current);
@@ -13141,7 +13206,7 @@ var scenarioRouter = router({
       signal: signal ?? void 0
     });
   }),
-  streamRunEvents: protectedProcedure.input(z19.object({ conversationId: ConversationIdSchema })).subscription(async function* ({ input }) {
+  streamRunEvents: protectedProcedure.input(z20.object({ conversationId: ConversationIdSchema })).subscription(async function* ({ input }) {
     const convId = input.conversationId;
     const runState = scenarioRunStore.getRunState(convId);
     if (runState) {
@@ -13155,14 +13220,14 @@ var scenarioRouter = router({
    * open a debug PTY with `claude --resume <sessionId>` on the right agent.
    * Falls back to the persisted run-state for past nodes.
    */
-  getNodeSession: protectedProcedure.input(z19.object({
+  getNodeSession: protectedProcedure.input(z20.object({
     conversationId: ConversationIdSchema,
     nodeId: Id128Schema
   })).query(async ({ input }) => {
     return await scenarioRunStore.getNodeSessionPersistent(input.conversationId, input.nodeId);
   }),
   listPresets: protectedProcedure.query(() => listPresets()),
-  getPreset: protectedProcedure.input(z19.object({ id: Id128Schema })).query(({ input }) => {
+  getPreset: protectedProcedure.input(z20.object({ id: Id128Schema })).query(({ input }) => {
     const preset = getPreset(input.id);
     if (!preset) throw new TRPCError16({ code: "NOT_FOUND", message: "Preset not found" });
     return preset;
@@ -13172,7 +13237,7 @@ var scenarioRouter = router({
 // ../server/src/trpc/routers/debug.ts
 import { randomUUID as randomUUID9 } from "crypto";
 import { TRPCError as TRPCError17 } from "@trpc/server";
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 var MAX_BUFFER3 = 300;
 var jobs = /* @__PURE__ */ new Map();
 function publish(job, event) {
@@ -13229,9 +13294,9 @@ async function* tapJob(job, signal) {
   }
 }
 var debugRouter = router({
-  startRandomJob: protectedProcedure.input(z20.object({
-    intervalMs: z20.number().int().min(100).max(5e3).optional(),
-    maxTicks: z20.number().int().min(1).max(1e4).optional()
+  startRandomJob: protectedProcedure.input(z21.object({
+    intervalMs: z21.number().int().min(100).max(5e3).optional(),
+    maxTicks: z21.number().int().min(1).max(1e4).optional()
   }).optional()).mutation(({ input }) => {
     const jobId = randomUUID9();
     const intervalMs = input?.intervalMs ?? 400;
@@ -13265,15 +13330,15 @@ var debugRouter = router({
     jobs.set(jobId, job);
     return { jobId, intervalMs, maxTicks, startedAt: job.startedAt };
   }),
-  streamRandomJob: protectedProcedure.input(z20.object({ jobId: z20.string().max(128) })).subscription(async function* ({ input, signal }) {
+  streamRandomJob: protectedProcedure.input(z21.object({ jobId: z21.string().max(128) })).subscription(async function* ({ input, signal }) {
     const job = jobs.get(input.jobId);
     if (!job) {
       throw new TRPCError17({ code: "NOT_FOUND", message: "Random job not found" });
     }
     yield* tapJob(job, signal ?? new AbortController().signal);
   }),
-  stopRandomJob: protectedProcedure.input(z20.object({ jobId: z20.string().max(128) })).mutation(({ input }) => ({ ok: stopJob(input.jobId, "stopped") })),
-  randomJobStatus: protectedProcedure.input(z20.object({ jobId: z20.string().max(128) })).query(({ input }) => {
+  stopRandomJob: protectedProcedure.input(z21.object({ jobId: z21.string().max(128) })).mutation(({ input }) => ({ ok: stopJob(input.jobId, "stopped") })),
+  randomJobStatus: protectedProcedure.input(z21.object({ jobId: z21.string().max(128) })).query(({ input }) => {
     const job = jobs.get(input.jobId);
     return {
       running: !!job && !job.done,
@@ -13283,7 +13348,7 @@ var debugRouter = router({
 });
 
 // ../server/src/trpc/routers/diagnostics.ts
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 import { TRPCError as TRPCError18 } from "@trpc/server";
 
 // ../server/src/services/log-buffer.ts
@@ -13355,7 +13420,7 @@ function onEntry(listener) {
 // ../server/src/trpc/routers/diagnostics.ts
 var diagnosticsRouter = router({
   /** Backlog for a client that just opened the panel. */
-  recentLogs: protectedProcedure.input(z21.object({ limit: z21.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
+  recentLogs: protectedProcedure.input(z22.object({ limit: z22.number().int().min(1).max(2e3).default(500) }).optional()).query(({ input }) => recentEntries(input?.limit ?? 500)),
   /**
    * Live log stream.
    *
@@ -13364,7 +13429,7 @@ var diagnosticsRouter = router({
    * silently loses lines, which is precisely what someone watching a boot
    * failure cannot afford.
    */
-  streamLogs: protectedProcedure.input(z21.object({ afterSeq: z21.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
+  streamLogs: protectedProcedure.input(z22.object({ afterSeq: z22.number().int().nonnegative().default(0) }).optional()).subscription(async function* ({ input, signal }) {
     for (const entry of entriesSince(input?.afterSeq ?? 0)) yield entry;
     const queue = [];
     let wake = null;
@@ -13398,7 +13463,7 @@ var diagnosticsRouter = router({
    * refused. That is what keeps this from being a way to signal arbitrary
    * processes with the server's privileges.
    */
-  killInstance: protectedProcedure.input(z21.object({ pid: z21.number().int().positive() })).mutation(async ({ input }) => {
+  killInstance: protectedProcedure.input(z22.object({ pid: z22.number().int().positive() })).mutation(async ({ input }) => {
     try {
       return await killInstance(input.pid);
     } catch (err) {
@@ -13426,7 +13491,7 @@ var diagnosticsRouter = router({
    * reproductible : instance trop ancienne pour avoir publié sa ligne de
    * commande, ou lancée avec un secret que le registre ne conserve pas.
    */
-  restartInstance: protectedProcedure.input(z21.object({ pid: z21.number().int().positive() })).mutation(async ({ input }) => {
+  restartInstance: protectedProcedure.input(z22.object({ pid: z22.number().int().positive() })).mutation(async ({ input }) => {
     try {
       if (input.pid === process.pid) {
         const { relauncherPid, port } = await scheduleSelfRestart();
@@ -13450,7 +13515,7 @@ var diagnosticsRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban-queue.ts
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // ../server/src/services/kanban-queue.ts
 import { randomUUID as randomUUID10 } from "crypto";
@@ -13638,36 +13703,36 @@ var kanbanQueue = new KanbanQueueService();
 // ../server/src/trpc/routers/kanban-queue.ts
 var kanbanQueueRouter = router({
   getState: protectedProcedure.query(() => kanbanQueue.getState()),
-  add: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    cardId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
+  add: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    cardId: z23.string().max(128),
+    runner: z23.enum(["claude-code", "codex"]).optional(),
+    model: z23.string().max(128).optional(),
+    scenarioId: z23.string().max(128).optional(),
     // Le projet ouvert quand la carte a été mise en file : la conversation
     // qui en naîtra lui appartient, plutôt que de rester orpheline et de
     // s'afficher dans tous les projets.
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+    projectId: z23.string().max(128).optional(),
+    orgId: z23.string().max(128).nullable().optional()
   })).mutation(({ input }) => kanbanQueue.add(input)),
-  addColumn: protectedProcedure.input(z22.object({
-    boardId: z22.string().max(128),
-    columnId: z22.string().max(128),
-    runner: z22.enum(["claude-code", "codex"]).optional(),
-    model: z22.string().max(128).optional(),
-    scenarioId: z22.string().max(128).optional(),
-    projectId: z22.string().max(128).optional(),
-    orgId: z22.string().max(128).nullable().optional()
+  addColumn: protectedProcedure.input(z23.object({
+    boardId: z23.string().max(128),
+    columnId: z23.string().max(128),
+    runner: z23.enum(["claude-code", "codex"]).optional(),
+    model: z23.string().max(128).optional(),
+    scenarioId: z23.string().max(128).optional(),
+    projectId: z23.string().max(128).optional(),
+    orgId: z23.string().max(128).nullable().optional()
   })).mutation(async ({ input }) => {
     const { boardId, columnId, ...options } = input;
     return kanbanQueue.addColumn(boardId, columnId, options);
   }),
-  remove: protectedProcedure.input(z22.object({ itemId: z22.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
+  remove: protectedProcedure.input(z23.object({ itemId: z23.string().max(128) })).mutation(({ input }) => ({ removed: kanbanQueue.remove(input.itemId) })),
   stopAll: protectedProcedure.mutation(() => {
     kanbanQueue.stopAll();
     return { ok: true };
   }),
-  setMaxConcurrent: protectedProcedure.input(z22.object({ max: z22.number().int().min(1).max(20) })).mutation(({ input }) => {
+  setMaxConcurrent: protectedProcedure.input(z23.object({ max: z23.number().int().min(1).max(20) })).mutation(({ input }) => {
     kanbanQueue.setMaxConcurrent(input.max);
     return kanbanQueue.getState();
   }),
@@ -13705,7 +13770,7 @@ import { mkdir as mkdir17, readdir as readdir5, rm as rm3, stat as stat5, writeF
 import { createHash } from "crypto";
 import { tmpdir } from "os";
 import { join as join20 } from "path";
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 import { TRPCError as TRPCError19 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
   return {
@@ -13793,9 +13858,9 @@ var kanbanRouter = router({
    * card graph, so listing them in full would be megabytes to answer "which
    * boards exist?". Use `getBoard` for the cards of one.
    */
-  listBoards: protectedProcedure.input(z23.object({
-    includeArchived: z23.boolean().optional(),
-    organizationId: z23.string().max(128).optional()
+  listBoards: protectedProcedure.input(z24.object({
+    includeArchived: z24.boolean().optional(),
+    organizationId: z24.string().max(128).optional()
   }).optional()).query(async ({ input }) => {
     const { organizationId, boards } = await kanbanStore.list(
       input?.includeArchived ?? false,
@@ -13821,7 +13886,7 @@ var kanbanRouter = router({
     };
   }),
   /** One board: its columns, and the cards in each. */
-  getBoard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => {
+  getBoard: protectedProcedure.input(z24.object({ boardId: z24.string().max(128) })).query(async ({ input }) => {
     const board = await kanbanStore.get(input.boardId);
     if (!board) return { board: null };
     const { links } = await kanbanStore.cardLinks(input.boardId);
@@ -13860,11 +13925,11 @@ var kanbanRouter = router({
    * organization — or one board when `boardId` is given. Archived boards are
    * left out: they are what the team decided to stop looking at.
    */
-  searchCards: protectedProcedure.input(z23.object({
-    query: z23.string().min(1).max(256),
-    boardId: z23.string().max(128).optional(),
-    limit: z23.number().int().min(1).max(100).optional(),
-    organizationId: z23.string().max(128).optional()
+  searchCards: protectedProcedure.input(z24.object({
+    query: z24.string().min(1).max(256),
+    boardId: z24.string().max(128).optional(),
+    limit: z24.number().int().min(1).max(100).optional(),
+    organizationId: z24.string().max(128).optional()
   })).query(async ({ input }) => {
     return kanbanStore.searchCards(input);
   }),
@@ -13877,10 +13942,10 @@ var kanbanRouter = router({
    * qu'un `commentCount`, et rien n'en donnait le texte. Cette route est la
    * relecture, pour une seule carte : c'est le journal qui pèse, pas le reste.
    */
-  getCardComments: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    limit: z23.number().int().min(1).max(200).optional()
+  getCardComments: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    limit: z24.number().int().min(1).max(200).optional()
   })).query(async ({ input }) => {
     const history = await kanbanStore.cardHistory(input.boardId, input.cardId);
     const comments = history.filter((e) => e.type === "comment");
@@ -13909,18 +13974,18 @@ var kanbanRouter = router({
    * `getBoard` en donne déjà l'essentiel carte par carte ; cette route sert
    * quand c'est l'arbre lui-même qu'on veut, dates et auteurs compris.
    */
-  getCardLinks: protectedProcedure.input(z23.object({ boardId: z23.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
+  getCardLinks: protectedProcedure.input(z24.object({ boardId: z24.string().max(128) })).query(async ({ input }) => kanbanStore.cardLinks(input.boardId)),
   /**
    * Rattacher une carte à une carte parente, ou l'en détacher.
    *
    * Sans `parentCardId`, le lien est retiré. Le parent peut vivre sur un autre
    * tableau : `parentBoardId` le désigne alors, sinon c'est celui de la carte.
    */
-  setCardParent: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    parentCardId: z23.string().max(128).optional(),
-    parentBoardId: z23.string().max(128).optional()
+  setCardParent: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    parentCardId: z24.string().max(128).optional(),
+    parentBoardId: z24.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardParent(
       input.boardId,
@@ -13932,31 +13997,31 @@ var kanbanRouter = router({
     }
     return { ok: true };
   }),
-  moveCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    targetColumn: z23.string().max(256)
+  moveCard: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    targetColumn: z24.string().max(256)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "move_card", columnTitle: input.targetColumn }
     ]);
     return { ok: true };
   }),
-  addComment: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    comment: z23.string().max(1e5)
+  addComment: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    comment: z24.string().max(1e5)
   })).mutation(async ({ input }) => {
     await executeKanbanCommands(input.boardId, input.cardId, [
       { type: "add_comment", comment: input.comment }
     ]);
     return { ok: true };
   }),
-  addCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    column: z23.string().max(256),
-    title: z23.string().max(512),
-    content: z23.string().max(2e4).optional()
+  addCard: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    column: z24.string().max(256),
+    title: z24.string().max(512),
+    content: z24.string().max(2e4).optional()
   })).mutation(async ({ input }) => {
     await executeKanbanBoardCommands(input.boardId, [
       { type: "add_card", columnTitle: input.column, cardTitle: input.title, cardContent: input.content }
@@ -13969,7 +14034,7 @@ var kanbanRouter = router({
    * `getBoard` rapatrie le tableau entier pour n'en regarder qu'une ; et il ne
    * porte pas les cartes rangées. Une carte s'adresse par son identifiant.
    */
-  getCard: protectedProcedure.input(z23.object({ boardId: z23.string().max(128), cardId: z23.string().max(128) })).query(async ({ input }) => {
+  getCard: protectedProcedure.input(z24.object({ boardId: z24.string().max(128), cardId: z24.string().max(128) })).query(async ({ input }) => {
     const found = await kanbanStore.card(input.boardId, input.cardId);
     if (!found) throw new Error(`Carte ${input.cardId} introuvable sur le tableau ${input.boardId}.`);
     return { ...summarizeCard(found.card, input.boardId, ""), columnId: found.columnId };
@@ -13983,16 +14048,16 @@ var kanbanRouter = router({
    * Un champ absent n'est pas touché ; `null` l'efface. La distinction compte —
    * changer un titre ne doit pas vider une couleur.
    */
-  updateCard: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    title: z23.string().min(1).max(512).optional(),
-    content: z23.string().max(1e5).optional(),
-    priority: z23.number().int().min(1).max(10).nullable().optional(),
-    color: z23.string().max(32).nullable().optional(),
-    groups: z23.array(z23.string().min(1).max(60)).max(30).optional(),
-    deadline: z23.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
-    assignees: z23.array(z23.string().max(128)).max(50).optional()
+  updateCard: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    title: z24.string().min(1).max(512).optional(),
+    content: z24.string().max(1e5).optional(),
+    priority: z24.number().int().min(1).max(10).nullable().optional(),
+    color: z24.string().max(32).nullable().optional(),
+    groups: z24.array(z24.string().min(1).max(60)).max(30).optional(),
+    deadline: z24.string().regex(/^\d{4}-\d{2}-\d{2}$/).nullable().optional(),
+    assignees: z24.array(z24.string().max(128)).max(50).optional()
   })).mutation(async ({ input }) => {
     const { boardId, cardId, content, ...rest } = input;
     const patch = { ...rest };
@@ -14003,10 +14068,10 @@ var kanbanRouter = router({
     return summarizeCard(card, boardId, "");
   }),
   /** Ranger une carte, ou la reprendre. */
-  setCardArchived: protectedProcedure.input(z23.object({
-    boardId: z23.string().max(128),
-    cardId: z23.string().max(128),
-    archived: z23.boolean()
+  setCardArchived: protectedProcedure.input(z24.object({
+    boardId: z24.string().max(128),
+    cardId: z24.string().max(128),
+    archived: z24.boolean()
   })).mutation(async ({ input }) => {
     const ok = await kanbanStore.setCardArchived(input.boardId, input.cardId, input.archived);
     if (!ok) throw new Error(`La carte ${input.cardId} n'a pas pu \xEAtre ${input.archived ? "archiv\xE9e" : "reprise"}.`);
@@ -14018,13 +14083,13 @@ var kanbanRouter = router({
    * Sans cette liste, assigner revient à deviner un identifiant — et l'agent
    * n'a aucun moyen de le trouver.
    */
-  listMembers: protectedProcedure.input(z23.object({ organizationId: z23.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
+  listMembers: protectedProcedure.input(z24.object({ organizationId: z24.string().max(128).optional() })).query(async ({ input }) => ({ members: await kanbanStore.members(input.organizationId) })),
   /**
    * Fetch one card attachment from the cloud and drop it on this machine, so an
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z23.object({ attachmentId: z23.string().max(128) })).mutation(async ({ input }) => {
+  downloadAttachment: protectedProcedure.input(z24.object({ attachmentId: z24.string().max(128) })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
       throw new TRPCError19({ code: "BAD_REQUEST", message: "Invalid attachment id" });
@@ -14057,21 +14122,21 @@ var kanbanRouter = router({
 });
 
 // ../server/src/trpc/routers/terminal.ts
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 import { TRPCError as TRPCError20 } from "@trpc/server";
 var terminalRouter = router({
   /** Create a PTY shell session on the target agent */
-  create: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    cwd: z24.string().max(512).optional(),
+  create: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    cwd: z25.string().max(512).optional(),
     /** Anchors the terminal when no explicit cwd is given. */
-    serviceId: z24.string().max(128).optional(),
-    projectId: z24.string().max(128).optional(),
+    serviceId: z25.string().max(128).optional(),
+    projectId: z25.string().max(128).optional(),
     /** L'organisation du projet : un id seul peut en nommer un par organisation. */
-    orgId: z24.string().max(128).nullable().optional(),
-    cols: z24.number().int().min(1).max(512).optional(),
-    rows: z24.number().int().min(1).max(256).optional(),
-    title: z24.string().max(128).optional()
+    orgId: z25.string().max(128).nullable().optional(),
+    cols: z25.number().int().min(1).max(512).optional(),
+    rows: z25.number().int().min(1).max(256).optional(),
+    title: z25.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
@@ -14092,17 +14157,17 @@ var terminalRouter = router({
     return result;
   }),
   /** Les sessions PTY encore vivantes sur l'agent (onglets à retrouver) */
-  list: protectedProcedure.input(z24.object({ agentId: z24.string().max(128) })).query(async ({ input }) => {
+  list: protectedProcedure.input(z25.object({ agentId: z25.string().max(128) })).query(async ({ input }) => {
     return agentManager.agentQuery(
       input.agentId,
       "terminal.list"
     );
   }),
   /** Renommer un onglet */
-  rename: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    title: z24.string().max(128)
+  rename: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    sessionId: z25.string().max(128),
+    title: z25.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -14112,10 +14177,10 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Send keystrokes / data to a PTY session */
-  write: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    data: z24.string().max(65536)
+  write: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    sessionId: z25.string().max(128),
+    data: z25.string().max(65536)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -14125,11 +14190,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Resize the PTY */
-  resize: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
-    cols: z24.number().int().min(1).max(512),
-    rows: z24.number().int().min(1).max(256)
+  resize: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    sessionId: z25.string().max(128),
+    cols: z25.number().int().min(1).max(512),
+    rows: z25.number().int().min(1).max(256)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -14139,9 +14204,9 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Destroy a PTY session */
-  destroy: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128)
+  destroy: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    sessionId: z25.string().max(128)
   })).mutation(async ({ input }) => {
     await agentManager.agentMutation(
       input.agentId,
@@ -14151,11 +14216,11 @@ var terminalRouter = router({
     return { ok: true };
   }),
   /** Stream PTY output — proxied via AgentWSBridge dynamic subscription */
-  onData: protectedProcedure.input(z24.object({
-    agentId: z24.string().max(128),
-    sessionId: z24.string().max(128),
+  onData: protectedProcedure.input(z25.object({
+    agentId: z25.string().max(128),
+    sessionId: z25.string().max(128),
     /** Rejouer l'historique de la session avant le flux temps réel. */
-    replay: z24.boolean().optional()
+    replay: z25.boolean().optional()
   })).subscription(async function* ({ input }) {
     const queue = [];
     let resolve7 = null;
@@ -14204,11 +14269,11 @@ var terminalRouter = router({
 });
 
 // ../server/src/trpc/routers/utility.ts
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var MAX_WAIT_MS = 5 * 60 * 1e3;
 var utilityRouter = router({
-  wait: protectedProcedure.input(z25.object({
-    ms: z25.number().int().min(0).max(MAX_WAIT_MS)
+  wait: protectedProcedure.input(z26.object({
+    ms: z26.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
     await new Promise((resolve7) => setTimeout(resolve7, input.ms));
     return { waited: input.ms };
@@ -14216,15 +14281,15 @@ var utilityRouter = router({
 });
 
 // ../server/src/trpc/routers/wiki.ts
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 import { TRPCError as TRPCError21 } from "@trpc/server";
 import { readFile as readFile16, readdir as readdir6, stat as stat6, realpath, writeFile as writeFile16, mkdir as mkdir18, rename as rename13, rm as rm4 } from "fs/promises";
 import { resolve as resolvePath, join as join21, relative, sep as sep3, dirname as dirname9 } from "path";
-var SCOPE_SCHEMA = z26.union([
-  z26.literal("global"),
-  z26.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
+var SCOPE_SCHEMA = z27.union([
+  z27.literal("global"),
+  z27.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
 ]);
-var REL_PATH_SCHEMA = z26.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
+var REL_PATH_SCHEMA = z27.string().min(1).max(512).regex(/^[A-Za-z0-9_./-]+$/).refine((p) => !p.includes("..") && !p.startsWith("/"), {
   message: "Path must be a relative path without traversal"
 });
 var MAX_FILES = 500;
@@ -14244,9 +14309,9 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
   "target",
   "out"
 ]);
-var DocsEntrySchema = z26.lazy(() => z26.union([
-  z26.object({ type: z26.literal("file"), name: z26.string(), path: z26.string() }),
-  z26.object({ type: z26.literal("dir"), name: z26.string(), path: z26.string(), children: z26.array(DocsEntrySchema) })
+var DocsEntrySchema = z27.lazy(() => z27.union([
+  z27.object({ type: z27.literal("file"), name: z27.string(), path: z27.string() }),
+  z27.object({ type: z27.literal("dir"), name: z27.string(), path: z27.string(), children: z27.array(DocsEntrySchema) })
 ]));
 async function resolveScope(scope) {
   if (scope === "global") {
@@ -14336,7 +14401,7 @@ async function resolveSafeLocal(root, relPath, requireExist) {
   return resolvePath(realParent, target.slice(parent.length).replace(/^[\\/]+/, ""));
 }
 var wikiRouter = router({
-  list: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).output(z26.object({ root: z26.string(), entries: z26.array(DocsEntrySchema), truncated: z26.boolean() })).query(async ({ input }) => {
+  list: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA })).output(z27.object({ root: z27.string(), entries: z27.array(DocsEntrySchema), truncated: z27.boolean() })).query(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentQuery(target.agentId, "wiki.listRepoMarkdown", { cwd: target.cwd });
@@ -14345,7 +14410,7 @@ var wikiRouter = router({
     const entries2 = await walkLocal(target.root, target.root, 0, counter);
     return { root: target.root, entries: entries2, truncated: counter.n >= MAX_FILES };
   }),
-  read: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z26.object({ path: z26.string(), content: z26.string() })).query(async ({ input }) => {
+  read: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).output(z27.object({ path: z27.string(), content: z27.string() })).query(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
       throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
@@ -14360,7 +14425,7 @@ var wikiRouter = router({
     const content = await readFile16(file, "utf-8");
     return { path: input.path, content };
   }),
-  write: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z26.string().max(5e6) })).mutation(async ({ input }) => {
+  write: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z27.string().max(5e6) })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
       throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
@@ -14373,7 +14438,7 @@ var wikiRouter = router({
     await writeFile16(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
-  createFile: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createFile: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     if (!/\.(md|markdown)$/i.test(input.path)) {
       throw new TRPCError21({ code: "BAD_REQUEST", message: "Seuls les .md/.markdown sont autoris\xE9s" });
     }
@@ -14392,7 +14457,7 @@ var wikiRouter = router({
     await writeFile16(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
-  createDir: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  createDir: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
@@ -14401,7 +14466,7 @@ var wikiRouter = router({
     await mkdir18(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
-  rename: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  rename: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.renamePath", { cwd: target.cwd, fromPath: input.fromPath, toPath: input.toPath });
@@ -14418,7 +14483,7 @@ var wikiRouter = router({
     await rename13(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
-  ensureRoot: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
+  ensureRoot: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
     if (input.scope === "global") {
       await resolveScope("global");
       return { ok: true };
@@ -14431,7 +14496,7 @@ var wikiRouter = router({
     const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
-  delete: protectedProcedure.input(z26.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
+  delete: protectedProcedure.input(z27.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
     const target = await resolveScope(input.scope);
     if (target.mode === "agent") {
       return agentManager.agentMutation(target.agentId, "wiki.deletePath", { cwd: target.cwd, path: input.path });
@@ -14457,7 +14522,7 @@ var configRouter = router({
 });
 
 // ../server/src/trpc/routers/cloud-sync.ts
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 import { TRPCError as TRPCError22 } from "@trpc/server";
 
 // ../server/src/services/org-sync-scope.ts
@@ -15624,10 +15689,10 @@ var cloudSyncRouter = router({
    * "open this project" is the whole gesture.
    */
   trackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z28.object({
+      orgId: z28.string().min(1).max(128),
+      cloudUrl: z28.string().url().max(2048),
+      projectId: z28.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
@@ -15661,10 +15726,10 @@ var cloudSyncRouter = router({
    * fusionné.
    */
   publishProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      cloudUrl: z27.string().url().max(2048),
-      projectId: z27.string().min(1).max(128)
+    z28.object({
+      orgId: z28.string().min(1).max(128),
+      cloudUrl: z28.string().url().max(2048),
+      projectId: z28.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
@@ -15705,9 +15770,9 @@ var cloudSyncRouter = router({
    * publié. Le cloud, lui, ne peut pas répondre — il n'a que du chiffré sous
    * les yeux — donc le canari est rapatrié et jugé ici.
    */
-  checkOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i)
+  checkOrgKey: protectedProcedure.input(z28.object({
+    orgId: z28.string().min(1).max(128),
+    keyHex: z28.string().length(64).regex(/^[0-9a-f]+$/i)
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
@@ -15729,7 +15794,7 @@ var cloudSyncRouter = router({
    * que l'interface puisse proposer ni l'adoption ni la remise à zéro — le seul
    * chemin qui la répare. Rien n'est écrit ici, ni sur le disque ni sur le cloud.
    */
-  orgKeyStatus: protectedProcedure.input(z27.object({ orgId: z27.string().min(1).max(128) })).query(async ({ input }) => {
+  orgKeyStatus: protectedProcedure.input(z28.object({ orgId: z28.string().min(1).max(128) })).query(async ({ input }) => {
     const key = getEncryptionKey(input.orgId);
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
@@ -15751,10 +15816,10 @@ var cloudSyncRouter = router({
    * Bornée au coffre de l'organisation et à ceux de ses projets : les autres
    * organisations et la machine gardent leur clé.
    */
-  adoptOrgKey: protectedProcedure.input(z27.object({
-    orgId: z27.string().min(1).max(128),
-    keyHex: z27.string().length(64).regex(/^[0-9a-f]+$/i),
-    masterPassword: z27.string().min(1).max(1024)
+  adoptOrgKey: protectedProcedure.input(z28.object({
+    orgId: z28.string().min(1).max(128),
+    keyHex: z28.string().length(64).regex(/^[0-9a-f]+$/i),
+    masterPassword: z28.string().min(1).max(1024)
   })).mutation(async ({ input }) => {
     const report = await adoptOrgKey(
       input.orgId,
@@ -15778,7 +15843,7 @@ var cloudSyncRouter = router({
    * Elle ne re-chiffre rien : ce qui a déjà été synchronisé sous l'ancienne clé
    * reste illisible. L'interface le dit avant de la déclencher.
    */
-  resetOrgKey: protectedProcedure.input(z27.object({ orgId: z27.string().min(1).max(128) })).mutation(async ({ input }) => {
+  resetOrgKey: protectedProcedure.input(z28.object({ orgId: z28.string().min(1).max(128) })).mutation(async ({ input }) => {
     const canary = await readVerifyFile(orgVaultRoot(input.orgId)) ?? await readVerifyFile(await keyRoot());
     if (!canary) {
       throw new TRPCError22({
@@ -15808,9 +15873,9 @@ var cloudSyncRouter = router({
    * every other member and for this one on another machine.
    */
   untrackProject: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z28.object({
+      orgId: z28.string().min(1).max(128),
+      projectId: z28.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
@@ -15826,9 +15891,9 @@ var cloudSyncRouter = router({
    * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
    */
   deleteProjectFromOrg: protectedProcedure.input(
-    z27.object({
-      orgId: z27.string().min(1).max(128),
-      projectId: z27.string().min(1).max(128)
+    z28.object({
+      orgId: z28.string().min(1).max(128),
+      projectId: z28.string().min(1).max(128)
     })
   ).mutation(async ({ input }) => {
     let res;
@@ -15872,10 +15937,10 @@ var cloudSyncRouter = router({
    * afficher. Le nom est donc recopié dans le tampon du coffre au passage, là
    * où il est déjà lu au démarrage suivant.
    */
-  rememberOrgNames: protectedProcedure.input(z27.object({
-    orgs: z27.array(z27.object({
-      orgId: z27.string().min(1).max(128),
-      name: z27.string().min(1).max(100)
+  rememberOrgNames: protectedProcedure.input(z28.object({
+    orgs: z28.array(z28.object({
+      orgId: z28.string().min(1).max(128),
+      name: z28.string().min(1).max(100)
     })).max(200)
   })).mutation(async ({ input }) => {
     for (const { orgId, name } of input.orgs) await rememberOrgName(orgId, name);
@@ -15905,7 +15970,7 @@ var cloudSyncRouter = router({
    * Un 404 efface le logo retenu — l'organisation en a retiré un — tandis qu'un
    * réseau muet laisse en place ce qui est déjà là : hors ligne, on garde.
    */
-  cacheOrgLogos: protectedProcedure.input(z27.object({ orgIds: z27.array(z27.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
+  cacheOrgLogos: protectedProcedure.input(z28.object({ orgIds: z28.array(z28.string().min(1).max(128)).max(200) })).mutation(async ({ input }) => {
     const clouds = await readOrgClouds();
     let cached = 0;
     for (const orgId of input.orgIds) {
@@ -15967,9 +16032,9 @@ var cloudSyncRouter = router({
 import { readdir as readdir8, stat as stat8 } from "fs/promises";
 import { homedir as homedir5 } from "os";
 import { isAbsolute as isAbsolute4, join as join25, resolve as resolve5, dirname as dirname10, basename as basename2 } from "path";
-import { z as z28 } from "zod";
+import { z as z29 } from "zod";
 var MAX_ENTRIES2 = 500;
-var PATH_SCHEMA = z28.string().min(1).max(4096);
+var PATH_SCHEMA = z29.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
   const expanded = input.startsWith("~") ? join25(homedir5(), input.slice(1)) : input;
@@ -15993,7 +16058,7 @@ var filesystemRouter = router({
    * Hidden entries are skipped: they are noise for choosing a workspace, and
    * `.runeya` itself would invite placing a project inside another's data.
    */
-  listDirectories: protectedProcedure.input(z28.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+  listDirectories: protectedProcedure.input(z29.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
     if (!info?.isDirectory()) {
@@ -16027,10 +16092,10 @@ var filesystemRouter = router({
    * Two projects in one directory is what makes services run against the wrong
    * code, so a directory that already holds one is refused outright.
    */
-  checkProjectTarget: protectedProcedure.input(z28.object({
+  checkProjectTarget: protectedProcedure.input(z29.object({
     path: PATH_SCHEMA,
-    projectId: z28.string().min(1).max(128),
-    orgId: z28.string().max(128).nullable().optional()
+    projectId: z29.string().min(1).max(128),
+    orgId: z29.string().max(128).nullable().optional()
   })).query(async ({ input }) => {
     const dir = safeResolve(input.path);
     const info = await stat8(dir).catch(() => null);
@@ -16052,6 +16117,7 @@ var filesystemRouter = router({
 var appRouter = router({
   health: healthRouter,
   appUpdate: appUpdateRouter,
+  changelog: changelogRouter,
   diagnostics: diagnosticsRouter,
   project: projectRouter,
   service: serviceRouter,
@@ -16434,7 +16500,7 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join28(abCwd, ".runeya-tmp");
+  const legacyTmp = `${legacyRoot}-tmp`;
   await rename17(legacyRoot, legacyTmp);
   await mkdir24(dataDir, { recursive: true });
   const legacyOld = join28(dataDir, `backup-${timestamp}`);
@@ -18364,4 +18430,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-K5L5HTKP.js.map
+//# sourceMappingURL=src-GGPKDQGD.js.map