@runeya/runeya 2.0.96 → 2.0.98

package/{chunk-ZVUSEO5P.js → chunk-MBHLFZ7C.js}

@@ -24,7 +24,7 @@ import {
   resetRelaunches,
   syncConversationFromClaudeTranscript,
   verifyJwt
-} from "./chunk-BV7A2N5C.js";
+} from "./chunk-3SKXNOMC.js";
 import {
   agentManager,
   agentStore,
@@ -87,466 +87,104 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
-// ../../packages/ai-capabilities/src/capabilities.ts
-function toList(raw) {
-  if (!raw) return [];
-  const text = raw.trim();
-  if (text.startsWith("[")) {
+// ../../packages/mcp-server/src/launch.ts
+import { fileURLToPath } from "url";
+import { createRequire } from "module";
+import { existsSync } from "fs";
+function resolveMcpServerPath() {
+  try {
+    const req = createRequire(import.meta.url);
+    return req.resolve("@runeya/packages-mcp-server");
+  } catch {
+  }
+  const candidates = [
+    // Build packagé du CLI : dist/agent/index.js et dist/index.js côtoient
+    // dist/mcp-server/, copié là par le post-build.
+    new URL("../mcp-server/index.js", import.meta.url),
+    new URL("./mcp-server/index.js", import.meta.url),
+    // Monorepo, depuis un dist d'app.
+    new URL("../../../packages/mcp-server/dist/index.js", import.meta.url),
+    new URL("../../../../packages/mcp-server/dist/index.js", import.meta.url)
+  ];
+  for (const c of candidates) {
+    const p = fileURLToPath(c);
+    if (existsSync(p)) return p;
+  }
+  throw new Error("Could not locate @runeya/packages-mcp-server (built dist not found)");
+}
+function pickEnv(env2) {
+  return {
+    ...env2.RUNEYA_BASE_URL ? { RUNEYA_BASE_URL: env2.RUNEYA_BASE_URL } : {},
+    ...env2.RUNEYA_API_TOKEN ? { RUNEYA_API_TOKEN: env2.RUNEYA_API_TOKEN } : {},
+    ...env2.RUNEYA_PROJECT_ID ? { RUNEYA_PROJECT_ID: env2.RUNEYA_PROJECT_ID } : {},
+    ...env2.RUNEYA_ORG_ID ? { RUNEYA_ORG_ID: env2.RUNEYA_ORG_ID } : {}
+  };
+}
+function runeyaMcpConfig(env2) {
+  return JSON.stringify({
+    mcpServers: {
+      runeya: {
+        command: "node",
+        args: [resolveMcpServerPath()],
+        env: pickEnv(env2)
+      }
+    }
+  });
+}
+function codexMcpArgs(env2) {
+  const fields = [
+    `command=${tomlString("node")}`,
+    `args=[${tomlString(resolveMcpServerPath())}]`
+  ];
+  const entries = Object.entries(pickEnv(env2));
+  if (entries.length > 0) {
+    const inline = entries.map(([k, v]) => `${k}=${tomlString(v)}`).join(",");
+    fields.push(`env={${inline}}`);
+  }
+  return ["-c", `mcp_servers.runeya={${fields.join(",")}}`];
+}
+function tomlString(value) {
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/[\u0000-\u001f\u007f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+  return `"${escaped}"`;
+}
+
+// ../server/src/services/codex-sessions.ts
+import { readdir } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var CODEX_SESSIONS_DIR = join(homedir(), ".codex", "sessions");
+async function findCodexSessionFile(sessionId) {
+  const suffix = `-${sessionId}.jsonl`;
+  async function walk(dir) {
+    let entries;
     try {
-      const parsed = JSON.parse(text);
-      if (Array.isArray(parsed)) return parsed.map((v) => String(v).trim()).filter(Boolean);
+      entries = await readdir(dir, { withFileTypes: true });
     } catch {
+      return null;
+    }
+    for (const entry of entries) {
+      const full = join(dir, entry.name);
+      if (entry.isDirectory()) {
+        const found = await walk(full);
+        if (found) return found;
+      } else if (entry.name.endsWith(suffix)) {
+        return full;
+      }
     }
+    return null;
   }
-  return text.split(",").map((v) => v.trim().replace(/^["'[]+|["'\]]+$/g, "")).filter(Boolean);
+  return walk(CODEX_SESSIONS_DIR);
 }
-function clearable(raw, parse2, key) {
-  if (raw === void 0) return {};
-  const text = String(raw).trim();
-  if (!text || text === "null") return { [key]: null };
-  return { [key]: parse2(text) };
+async function codexSessionExists(sessionId) {
+  const { threadExists } = await import("./codex-thread-db-LE5FYDDA.js");
+  if (threadExists(sessionId)) return true;
+  return await findCodexSessionFile(sessionId) !== null;
 }
-var RUNEYA_CAPABILITIES = [
-  {
-    name: "list_services",
-    description: "List all available services. Returns serviceId and agentId for each \u2014 use these exact fields in other calls.",
-    route: "service.list",
-    method: "GET",
-    params: [],
-    buildInput: () => void 0
-  },
-  {
-    name: "get_service_status",
-    description: "Get the current status (running, stopped, etc.) of a service.",
-    route: "process.get",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, id: p.serviceId })
-  },
-  {
-    name: "get_logs",
-    description: "Get the recent buffered logs for a service.",
-    route: "process.logs",
-    method: "GET",
-    params: [
-      { name: "serviceId", description: "The service ID", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
-  },
-  {
-    name: "start_service",
-    description: "Start a service on an agent.",
-    route: "process.start",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to start", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  {
-    name: "stop_service",
-    description: "Stop a running service on an agent.",
-    route: "process.stop",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to stop", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  {
-    name: "restart_service",
-    description: "Restart a service on an agent (stop \u2192 redeploy \u2192 start).",
-    route: "process.restart",
-    method: "POST",
-    params: [
-      { name: "serviceId", description: "The service ID to restart", required: true },
-      { name: "agentId", description: "The agent ID hosting this service", required: true }
-    ],
-    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
-    destructive: true
-  },
-  // ─── Utility ─────────────────────────────────────────────────────────────
-  {
-    name: "wait",
-    description: "Wait for a given number of milliseconds before continuing.",
-    route: "utility.wait",
-    method: "POST",
-    params: [
-      { name: "ms", description: "Number of MILLISECONDS to wait. Convert from seconds: 1s=1000, 10s=10000, 1min=60000. Max 300000.", required: true }
-    ],
-    buildInput: (p) => ({ ms: Number(p.ms) }),
-    usageHint: '"wait 5s" \u2192 wait(ms=5000), "pause 10 seconds" \u2192 wait(ms=10000), "attends 3 secondes" \u2192 wait(ms=3000). Always convert to milliseconds.'
-  },
-  // ─── Kanban ───────────────────────────────────────────────────────────────
-  {
-    name: "kanban_list_boards",
-    description: "List the kanban boards of the organization. Returns the organizationId actually queried, the boardId to use in the other kanban tools, plus column and card counts. Cards themselves are not included \u2014 use kanban_get_board for those. An empty list means that organization really has no board: a failure to reach the cloud is reported as an error instead, never as an empty list.",
-    route: "kanban.listBoards",
-    method: "GET",
-    params: [
-      { name: "includeArchived", description: 'Set to "true" to include archived boards. Default: false.', required: false },
-      { name: "organizationId", description: "Which organization to read. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => ({
-      includeArchived: p.includeArchived === "true",
-      ...p.organizationId ? { organizationId: p.organizationId } : {}
-    })
-  },
-  {
-    name: "kanban_get_board",
-    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
-    route: "kanban.getBoard",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID, from kanban_list_boards", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId })
-  },
-  {
-    name: "kanban_get_card_comments",
-    description: "Read the comment thread of one kanban card, newest last: who wrote each comment (ai or user, with the person's name), when, its text, and its attachments. The comments in your task context are a snapshot taken when the task started \u2014 call this to see anything written since, whenever someone tells you a comment was added or kanban_get_board reports a higher commentCount than you have.",
-    route: "kanban.getCardComments",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID whose comments to read", required: true },
-      { name: "limit", description: "How many of the most recent comments to return (1-200). Default: 50.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.limit ? { limit: Number(p.limit) } : {}
-    }),
-    usageHint: '"le support a ajout\xE9 un commentaire" / "regarde les nouveaux commentaires" \u2192 kanban_get_card_comments(boardId, cardId). Never answer from the snapshot in your context when fresh comments are mentioned.'
-  },
-  {
-    name: "kanban_search_cards",
-    description: "Search kanban cards by free text, matched against their title, body and comments (accent- and case-insensitive). Archived cards are included. Searches every board of the organization unless boardId narrows it down.",
-    route: "kanban.searchCards",
-    method: "GET",
-    params: [
-      { name: "query", description: "Text to look for in card titles, bodies and comments", required: true },
-      { name: "boardId", description: "Restrict the search to this board. Omit to search all boards.", required: false },
-      { name: "limit", description: "Maximum number of cards to return (1-100). Default: 25.", required: false },
-      { name: "organizationId", description: "Which organization to search. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => ({
-      query: p.query,
-      ...p.boardId ? { boardId: p.boardId } : {},
-      ...p.limit ? { limit: Number(p.limit) } : {},
-      ...p.organizationId ? { organizationId: p.organizationId } : {}
-    })
-  },
-  {
-    name: "kanban_download_attachment",
-    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context, from kanban_get_board, or from kanban_get_card_comments \u2014 a file attached to a comment downloads exactly like one attached to the card.",
-    route: "kanban.downloadAttachment",
-    method: "POST",
-    params: [
-      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true }
-    ],
-    buildInput: (p) => ({ attachmentId: p.attachmentId })
-  },
-  {
-    name: "kanban_move_card",
-    description: "Move a kanban card to another column. Use the exact column name.",
-    route: "kanban.moveCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID to move", required: true },
-      { name: "targetColumn", description: "Exact name of the target column", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, targetColumn: p.targetColumn })
-  },
-  {
-    name: "kanban_add_comment",
-    description: "Add a comment to a kanban card.",
-    route: "kanban.addComment",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "comment", description: "The comment text (markdown supported)", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, comment: p.comment })
-  },
-  {
-    name: "kanban_get_card_links",
-    description: "Read the filiation of a board: which card depends on which. Returns one entry per link (child card \u2194 parent card), plus the title, board, column, assignees and comment count of any linked card living on another board. Use it when a card context says it has a parent or sub-cards and you need their ids to read them.",
-    route: "kanban.getCardLinks",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID whose links to read", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId })
-  },
-  {
-    name: "kanban_set_card_parent",
-    description: "Link a kanban card to a parent card, or detach it. The parent is the card the other one depends on \u2014 an epic and its tasks, a bug and its follow-ups. A card has at most one parent, and setting a new one replaces it. Omit parentCardId to detach. kanban_get_board reports the current filiation as parentCardId / childCardIds on each card.",
-    route: "kanban.setCardParent",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID of the card being linked", required: true },
-      { name: "cardId", description: "The card that depends on the parent (the child)", required: true },
-      { name: "parentCardId", description: "The parent card ID. Omit to detach the card from its parent.", required: false },
-      { name: "parentBoardId", description: "The parent's board, when it lives on another board of the same organization. Defaults to boardId.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.parentCardId ? { parentCardId: p.parentCardId } : {},
-      ...p.parentBoardId ? { parentBoardId: p.parentBoardId } : {}
-    })
-  },
-  {
-    name: "kanban_add_card",
-    description: "Add a new card to a kanban column.",
-    route: "kanban.addCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "column", description: "Exact name of the target column", required: true },
-      { name: "title", description: "Card title", required: true },
-      { name: "content", description: "Card content in markdown", required: false }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, column: p.column, title: p.title, content: p.content })
-  },
-  {
-    name: "kanban_get_card",
-    description: "Read one kanban card by id, including archived ones. Cheaper than fetching the whole board, and the only way to read a card that has been archived.",
-    route: "kanban.getCard",
-    method: "GET",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
-  },
-  {
-    name: "kanban_update_card",
-    description: "Update an existing kanban card. Only the fields you pass are changed; passing null to priority, color or deadline clears it. Prefer this over creating a second card when something needs correcting.",
-    route: "kanban.updateCard",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "title", description: "New title", required: false },
-      { name: "content", description: "New card content, in markdown", required: false },
-      { name: "priority", description: "Priority from 1 to 10, or null to clear it", required: false },
-      { name: "color", description: "Card colour, or null to clear it", required: false },
-      { name: "groups", description: "Labels, as a list of strings. Replaces the current ones.", required: false },
-      { name: "deadline", description: "Due date as YYYY-MM-DD, or null to clear it", required: false },
-      { name: "assignees", description: "User ids to assign, as a list. Replaces the current ones; use kanban_list_members to find the ids.", required: false }
-    ],
-    buildInput: (p) => ({
-      boardId: p.boardId,
-      cardId: p.cardId,
-      ...p.title !== void 0 ? { title: p.title } : {},
-      ...p.content !== void 0 ? { content: p.content } : {},
-      // Tout arrive en chaîne : un modèle n'écrit pas des nombres, des listes
-      // ni des `null` typés. `clearable` distingue « efface » de « ne touche
-      // pas » — sans quoi vider une couleur serait impossible à exprimer, et
-      // changer un titre risquerait de vider le reste.
-      ...clearable(p.priority, (v) => Number(v), "priority"),
-      ...clearable(p.color, (v) => v, "color"),
-      ...clearable(p.deadline, (v) => v, "deadline"),
-      ...p.groups !== void 0 ? { groups: toList(p.groups) } : {},
-      ...p.assignees !== void 0 ? { assignees: toList(p.assignees) } : {}
-    })
-  },
-  {
-    name: "kanban_set_card_archived",
-    description: "Archive a kanban card (it leaves the board but is not deleted) or bring it back. An unarchived card returns to the column it left.",
-    route: "kanban.setCardArchived",
-    method: "POST",
-    params: [
-      { name: "boardId", description: "The kanban board ID", required: true },
-      { name: "cardId", description: "The card ID", required: true },
-      { name: "archived", description: "true to archive, false to bring the card back", required: true }
-    ],
-    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, archived: p.archived === "true" })
-  },
-  {
-    name: "kanban_list_members",
-    description: "List the people of the organization who can be assigned to a card, with their ids. Needed before assigning anyone with kanban_update_card.",
-    route: "kanban.listMembers",
-    method: "GET",
-    params: [
-      { name: "organizationId", description: "Which organization. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
-    ],
-    buildInput: (p) => p.organizationId ? { organizationId: p.organizationId } : {}
-  }
-];
-
-// ../../packages/ai-capabilities/src/adapters/anthropic.ts
-function buildAnthropicTools(capabilities) {
-  return capabilities.map((cap) => ({
-    name: cap.name,
-    description: cap.description,
-    input_schema: {
-      type: "object",
-      properties: Object.fromEntries(
-        cap.params.map((p) => [p.name, { type: "string", description: p.description }])
-      ),
-      required: cap.params.filter((p) => p.required).map((p) => p.name)
-    }
-  }));
-}
-
-// ../../packages/ai-capabilities/src/adapters/openai.ts
-function buildOpenAITools(capabilities) {
-  return capabilities.map((cap) => ({
-    type: "function",
-    function: {
-      name: cap.name,
-      description: cap.description,
-      parameters: {
-        type: "object",
-        properties: Object.fromEntries(
-          cap.params.map((p) => [p.name, { type: "string", description: p.description }])
-        ),
-        required: cap.params.filter((p) => p.required).map((p) => p.name)
-      }
-    }
-  }));
-}
-
-// ../../packages/ai-capabilities/src/adapters/prompt.ts
-function buildToolSafetyInstruction(capabilities) {
-  const destructive = capabilities.filter((c) => c.destructive).map((c) => c.name);
-  const withHints = capabilities.filter((c) => c.usageHint);
-  const lines = ["## Tool use safety rules"];
-  if (destructive.length > 0) {
-    lines.push(`CRITICAL: Never call ${destructive.join(", ")} unless the user has EXPLICITLY and UNAMBIGUOUSLY requested it.`);
-    lines.push(`- Only call destructive tools (${destructive.join(", ")}) when the user explicitly uses action words for a specific service.`);
-  }
-  if (withHints.length > 0) {
-    lines.push("");
-    lines.push("## Tool usage hints");
-    for (const cap of withHints) {
-      lines.push(`- ${cap.usageHint}`);
-    }
-  }
-  return lines.join("\n");
-}
-function buildPromptDocs(baseUrl, token, capabilities) {
-  if (!token) return "";
-  const lines = [
-    "## Runeya API",
-    "",
-    `Tu peux interagir avec Runeya via l'API HTTP tRPC ci-dessous.`,
-    `Base URL : ${baseUrl}/api/trpc`,
-    "Auth header : Authorization: Bearer $RUNEYA_API_TOKEN",
-    ""
-  ];
-  const gets = capabilities.filter((c) => c.method === "GET");
-  const posts = capabilities.filter((c) => c.method === "POST");
-  if (gets.length > 0) {
-    lines.push("### GET routes (param\xE8tres en query string ?input=<JSON encod\xE9>)", "");
-    for (const cap of gets) {
-      const example = cap.params.length > 0 ? `?input=${JSON.stringify(Object.fromEntries(cap.params.map((p) => [p.name === "serviceId" ? "id" : p.name, "..."])))}` : "";
-      lines.push(`- \`${cap.route}${example}\` \u2014 ${cap.description}`);
-    }
-    lines.push("");
-  }
-  if (posts.length > 0) {
-    lines.push("### POST routes (body JSON)", "");
-    for (const cap of posts) {
-      const bodyExample = cap.params.length > 0 ? JSON.stringify(Object.fromEntries(cap.params.map((p) => [p.name === "serviceId" ? "processId" : p.name, "..."]))) : "{}";
-      lines.push(`- \`${cap.route}\` \u2014 \`${bodyExample}\``);
-    }
-    lines.push("");
-  }
-  const hints = capabilities.filter((c) => c.usageHint);
-  if (hints.length > 0) {
-    lines.push("### Usage hints", "");
-    for (const cap of hints) {
-      lines.push(`- ${cap.usageHint}`);
-    }
-    lines.push("");
-  }
-  lines.push(
-    "### Exemple curl",
-    "",
-    "```bash",
-    `curl -H "Authorization: Bearer $RUNEYA_API_TOKEN" \\`,
-    `  "${baseUrl}/api/trpc/service.list"`,
-    "",
-    `curl -X POST -H "Authorization: Bearer $RUNEYA_API_TOKEN" \\`,
-    '  -H "Content-Type: application/json" \\',
-    `  -d '{"agentId":"local","processId":"my-service"}' \\`,
-    `  "${baseUrl}/api/trpc/process.start"`,
-    "```",
-    "",
-    'La r\xE9ponse est de la forme `{"result":{"data":<r\xE9sultat>}}`.'
-  );
-  return lines.join("\n");
-}
-
-// ../../packages/ai-capabilities/src/trpc-caller.ts
-async function callTrpc(baseUrl, route, method, input, authToken) {
-  const headers = {
-    "Content-Type": "application/json",
-    "Authorization": `Bearer ${authToken}`
-  };
-  const url = method === "GET" && input ? `${baseUrl}/api/trpc/${route}?input=${encodeURIComponent(JSON.stringify(input))}` : `${baseUrl}/api/trpc/${route}`;
-  const res = await fetch(url, {
-    method,
-    headers,
-    ...method === "POST" ? { body: JSON.stringify(input ?? {}) } : {},
-    signal: AbortSignal.timeout(15e3)
-  });
-  const json = await res.json();
-  if (json["error"]) throw new Error(JSON.stringify(json["error"]));
-  const result = json["result"];
-  return result?.["data"] ?? result ?? json;
-}
-
-// ../server/src/services/ai-runners/runeya-api-docs.ts
-function buildApiDocs(apiBaseUrl, apiToken) {
-  return buildPromptDocs(apiBaseUrl, apiToken, RUNEYA_CAPABILITIES);
-}
-
-// ../server/src/services/codex-sessions.ts
-import { readdir } from "fs/promises";
-import { homedir } from "os";
-import { join } from "path";
-var CODEX_SESSIONS_DIR = join(homedir(), ".codex", "sessions");
-async function findCodexSessionFile(sessionId) {
-  const suffix = `-${sessionId}.jsonl`;
-  async function walk(dir) {
-    let entries;
-    try {
-      entries = await readdir(dir, { withFileTypes: true });
-    } catch {
-      return null;
-    }
-    for (const entry of entries) {
-      const full = join(dir, entry.name);
-      if (entry.isDirectory()) {
-        const found = await walk(full);
-        if (found) return found;
-      } else if (entry.name.endsWith(suffix)) {
-        return full;
-      }
-    }
-    return null;
+async function resolveCodexResumeId(sessionId, codexThreadId) {
+  for (const candidate of [codexThreadId, sessionId]) {
+    if (candidate && await codexSessionExists(candidate)) return candidate;
   }
-  return walk(CODEX_SESSIONS_DIR);
-}
-async function codexSessionExists(sessionId) {
-  const { threadExists } = await import("./codex-thread-db-LE5FYDDA.js");
-  if (threadExists(sessionId)) return true;
-  return await findCodexSessionFile(sessionId) !== null;
+  return null;
 }
 
 // ../server/src/trpc/routers/chat.ts
@@ -1386,112 +1024,752 @@ var EnvironmentResolver = class {
     }
     return byKey;
   }
-  async resolveDag(environmentId, visited, project) {
-    if (visited.has(environmentId)) {
-      throw new Error(`Circular dependency detected in environment inheritance for ${environmentId}`);
-    }
-    const environment = await environmentStore.get(environmentId);
-    if (!environment) {
-      throw new Error(`Environment "${environmentId}" not found`);
-    }
-    visited.add(environmentId);
-    const effectiveParentIds = await this.getEffectiveParentIds(environment);
-    const parentResults = [];
-    for (const parentId of effectiveParentIds) {
-      const parentVisited = new Set(visited);
-      const parentResult = await this.resolveDag(parentId, parentVisited, project);
-      parentResults.push(parentResult);
-    }
-    const mergedVariables = {};
-    const sources = {};
-    for (const result of parentResults) {
-      for (const [varId, variable] of Object.entries(result.variables)) {
-        for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-          if (existingVar.key === variable.key && existingId !== varId) {
-            delete mergedVariables[existingId];
-            delete sources[existingId];
-          }
-        }
-        mergedVariables[varId] = variable;
-        sources[varId] = result.sources[varId] ?? sources[varId];
-      }
-    }
-    const parentEnv = {};
-    const parentSecretKeys = /* @__PURE__ */ new Set();
-    const parentKeySources = {};
-    for (const [varId, variable] of Object.entries(mergedVariables)) {
-      const slot = variable.value;
-      parentEnv[variable.key] = slot.pre + slot.value + slot.post;
-      if (slot.isSecret) {
-        parentSecretKeys.add(variable.key);
-      }
-      const source = sources[varId];
-      if (source) {
-        parentKeySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
-      }
+  async resolveDag(environmentId, visited, project) {
+    if (visited.has(environmentId)) {
+      throw new Error(`Circular dependency detected in environment inheritance for ${environmentId}`);
+    }
+    const environment = await environmentStore.get(environmentId);
+    if (!environment) {
+      throw new Error(`Environment "${environmentId}" not found`);
+    }
+    visited.add(environmentId);
+    const effectiveParentIds = await this.getEffectiveParentIds(environment);
+    const parentResults = [];
+    for (const parentId of effectiveParentIds) {
+      const parentVisited = new Set(visited);
+      const parentResult = await this.resolveDag(parentId, parentVisited, project);
+      parentResults.push(parentResult);
+    }
+    const mergedVariables = {};
+    const sources = {};
+    for (const result of parentResults) {
+      for (const [varId, variable] of Object.entries(result.variables)) {
+        for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
+          if (existingVar.key === variable.key && existingId !== varId) {
+            delete mergedVariables[existingId];
+            delete sources[existingId];
+          }
+        }
+        mergedVariables[varId] = variable;
+        sources[varId] = result.sources[varId] ?? sources[varId];
+      }
+    }
+    const parentEnv = {};
+    const parentSecretKeys = /* @__PURE__ */ new Set();
+    const parentKeySources = {};
+    for (const [varId, variable] of Object.entries(mergedVariables)) {
+      const slot = variable.value;
+      parentEnv[variable.key] = slot.pre + slot.value + slot.post;
+      if (slot.isSecret) {
+        parentSecretKeys.add(variable.key);
+      }
+      const source = sources[varId];
+      if (source) {
+        parentKeySources[variable.key] = { environmentId: source.environmentId, environmentName: source.environmentName };
+      }
+    }
+    const isInterpRef = (v) => /\{\{environment\.[^}]+\}\}/.test(v);
+    for (const result of parentResults) {
+      for (const [key, value] of Object.entries(result.parentEnv)) {
+        const existingIsRef = key in parentEnv && isInterpRef(parentEnv[key]);
+        const newIsConcrete = !isInterpRef(value);
+        if (!(key in parentEnv) || existingIsRef && newIsConcrete) {
+          parentEnv[key] = value;
+        }
+      }
+      for (const key of result.parentSecretKeys) {
+        parentSecretKeys.add(key);
+      }
+      for (const [key, source] of Object.entries(result.parentKeySources)) {
+        if (!(key in parentKeySources)) {
+          parentKeySources[key] = source;
+        }
+      }
+    }
+    for (const key of this.collectSecretKeys(mergedVariables, parentSecretKeys)) {
+      parentSecretKeys.add(key);
+    }
+    const ownVariables = project ? project(environment.variables) : environment.variables;
+    for (const [varId, variable] of Object.entries(ownVariables)) {
+      let wasInherited = varId in mergedVariables;
+      for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
+        if (existingVar.key === variable.key && existingId !== varId) {
+          delete mergedVariables[existingId];
+          delete sources[existingId];
+          wasInherited = true;
+        }
+      }
+      mergedVariables[varId] = variable;
+      sources[varId] = {
+        environmentId: environment.id,
+        environmentName: environment.name,
+        overridden: wasInherited
+      };
+    }
+    return {
+      variables: mergedVariables,
+      sources,
+      parentEnv,
+      parentSecretKeys,
+      parentKeySources
+    };
+  }
+};
+var environmentResolver = new EnvironmentResolver();
+
+// ../../packages/ai-capabilities/src/capabilities.ts
+function toList(raw) {
+  if (!raw) return [];
+  const text = raw.trim();
+  if (text.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(text);
+      if (Array.isArray(parsed)) return parsed.map((v) => String(v).trim()).filter(Boolean);
+    } catch {
+    }
+  }
+  return text.split(",").map((v) => v.trim().replace(/^["'[]+|["'\]]+$/g, "")).filter(Boolean);
+}
+function clearable(raw, parse2, key) {
+  if (raw === void 0) return {};
+  const text = String(raw).trim();
+  if (!text || text === "null") return { [key]: null };
+  return { [key]: parse2(text) };
+}
+function gitTarget(p) {
+  return {
+    ...p.serviceId ? { serviceId: p.serviceId } : {},
+    ...p.projectId ? { projectId: p.projectId } : {},
+    ...p.agentId ? { agentId: p.agentId } : {},
+    ...p.orgId ? { orgId: p.orgId } : {}
+  };
+}
+var RUNEYA_CAPABILITIES = [
+  {
+    name: "list_services",
+    description: "List services, with the serviceId and agentId to use in other calls. Pass the projectId your context names to stay on the project the user is looking at, or another one from list_projects to look elsewhere. Called with no project, this can answer for every project of every organization on the machine \u2014 far more than the interface shows.",
+    route: "service.list",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "Restrict to this project, from list_projects. Omit to list every service on the machine.", required: false },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => p.projectId ? { projectId: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} } : void 0
+  },
+  {
+    name: "get_service_status",
+    description: "Get the current status (running, stopped, etc.) of a service. A service that has never been started on this agent has no process yet, and this answers 404 Process not found \u2014 that means STOPPED, not forbidden and not missing. Start it, or read its configuration with get_service.",
+    route: "process.get",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, id: p.serviceId })
+  },
+  {
+    name: "get_logs",
+    description: "Get the recent buffered logs for a service.",
+    route: "process.logs",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
+  },
+  {
+    name: "start_service",
+    description: "Start a service on an agent.",
+    route: "process.start",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to start", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  {
+    name: "stop_service",
+    description: "Stop a running service on an agent.",
+    route: "process.stop",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to stop", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  {
+    name: "restart_service",
+    description: "Restart a service on an agent (stop \u2192 redeploy \u2192 start).",
+    route: "process.restart",
+    method: "POST",
+    params: [
+      { name: "serviceId", description: "The service ID to restart", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId }),
+    destructive: true
+  },
+  // ─── Utility ─────────────────────────────────────────────────────────────
+  {
+    name: "wait",
+    description: "Wait for a given number of milliseconds before continuing.",
+    route: "utility.wait",
+    method: "POST",
+    params: [
+      { name: "ms", description: "Number of MILLISECONDS to wait. Convert from seconds: 1s=1000, 10s=10000, 1min=60000. Max 300000.", required: true }
+    ],
+    buildInput: (p) => ({ ms: Number(p.ms) }),
+    usageHint: '"wait 5s" \u2192 wait(ms=5000), "pause 10 seconds" \u2192 wait(ms=10000), "attends 3 secondes" \u2192 wait(ms=3000). Always convert to milliseconds.'
+  },
+  // ─── Kanban ───────────────────────────────────────────────────────────────
+  {
+    name: "kanban_list_boards",
+    description: "List the kanban boards of the organization. Returns the organizationId actually queried, the boardId to use in the other kanban tools, plus column and card counts. Cards themselves are not included \u2014 use kanban_get_board for those. An empty list means that organization really has no board: a failure to reach the cloud is reported as an error instead, never as an empty list.",
+    route: "kanban.listBoards",
+    method: "GET",
+    params: [
+      { name: "includeArchived", description: 'Set to "true" to include archived boards. Default: false.', required: false },
+      { name: "organizationId", description: "Which organization to read. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => ({
+      includeArchived: p.includeArchived === "true",
+      ...p.organizationId ? { organizationId: p.organizationId } : {}
+    })
+  },
+  {
+    name: "kanban_get_board",
+    description: "Read one kanban board: its columns, and the cards in each (id, title, markdown body, assignees, comment count, and attachment metadata \u2014 use kanban_download_attachment to fetch the bytes of a file). Use the exact column names it returns when moving or adding a card.",
+    route: "kanban.getBoard",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID, from kanban_list_boards", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId })
+  },
+  {
+    name: "kanban_get_card_comments",
+    description: "Read the comment thread of one kanban card, newest last: who wrote each comment (ai or user, with the person's name), when, its text, and its attachments. The comments in your task context are a snapshot taken when the task started \u2014 call this to see anything written since, whenever someone tells you a comment was added or kanban_get_board reports a higher commentCount than you have.",
+    route: "kanban.getCardComments",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID whose comments to read", required: true },
+      { name: "limit", description: "How many of the most recent comments to return (1-200). Default: 50.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.limit ? { limit: Number(p.limit) } : {}
+    }),
+    usageHint: '"le support a ajout\xE9 un commentaire" / "regarde les nouveaux commentaires" \u2192 kanban_get_card_comments(boardId, cardId). Never answer from the snapshot in your context when fresh comments are mentioned.'
+  },
+  {
+    name: "kanban_search_cards",
+    description: "Search kanban cards by free text, matched against their title, body and comments (accent- and case-insensitive). Archived cards are included. Searches every board of the organization unless boardId narrows it down.",
+    route: "kanban.searchCards",
+    method: "GET",
+    params: [
+      { name: "query", description: "Text to look for in card titles, bodies and comments", required: true },
+      { name: "boardId", description: "Restrict the search to this board. Omit to search all boards.", required: false },
+      { name: "limit", description: "Maximum number of cards to return (1-100). Default: 25.", required: false },
+      { name: "organizationId", description: "Which organization to search. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => ({
+      query: p.query,
+      ...p.boardId ? { boardId: p.boardId } : {},
+      ...p.limit ? { limit: Number(p.limit) } : {},
+      ...p.organizationId ? { organizationId: p.organizationId } : {}
+    })
+  },
+  {
+    name: "kanban_download_attachment",
+    description: "Download a kanban card attachment (image, PDF, any file) onto this machine and return its local path, so it can be opened with file-reading tools. Attachment ids come from the card context, from kanban_get_board, or from kanban_get_card_comments \u2014 a file attached to a comment downloads exactly like one attached to the card.",
+    route: "kanban.downloadAttachment",
+    method: "POST",
+    params: [
+      { name: "attachmentId", description: "The attachment ID, as listed on the card", required: true }
+    ],
+    buildInput: (p) => ({ attachmentId: p.attachmentId })
+  },
+  {
+    name: "kanban_move_card",
+    description: "Move a kanban card to another column. Use the exact column name.",
+    route: "kanban.moveCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID to move", required: true },
+      { name: "targetColumn", description: "Exact name of the target column", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, targetColumn: p.targetColumn })
+  },
+  {
+    name: "kanban_add_comment",
+    description: "Add a comment to a kanban card.",
+    route: "kanban.addComment",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "comment", description: "The comment text (markdown supported)", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, comment: p.comment })
+  },
+  {
+    name: "kanban_get_card_links",
+    description: "Read the filiation of a board: which card depends on which. Returns one entry per link (child card \u2194 parent card), plus the title, board, column, assignees and comment count of any linked card living on another board. Use it when a card context says it has a parent or sub-cards and you need their ids to read them.",
+    route: "kanban.getCardLinks",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID whose links to read", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId })
+  },
+  {
+    name: "kanban_set_card_parent",
+    description: "Link a kanban card to a parent card, or detach it. The parent is the card the other one depends on \u2014 an epic and its tasks, a bug and its follow-ups. A card has at most one parent, and setting a new one replaces it. Omit parentCardId to detach. kanban_get_board reports the current filiation as parentCardId / childCardIds on each card.",
+    route: "kanban.setCardParent",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID of the card being linked", required: true },
+      { name: "cardId", description: "The card that depends on the parent (the child)", required: true },
+      { name: "parentCardId", description: "The parent card ID. Omit to detach the card from its parent.", required: false },
+      { name: "parentBoardId", description: "The parent's board, when it lives on another board of the same organization. Defaults to boardId.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.parentCardId ? { parentCardId: p.parentCardId } : {},
+      ...p.parentBoardId ? { parentBoardId: p.parentBoardId } : {}
+    })
+  },
+  {
+    name: "kanban_add_card",
+    description: "Add a new card to a kanban column.",
+    route: "kanban.addCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "column", description: "Exact name of the target column", required: true },
+      { name: "title", description: "Card title", required: true },
+      { name: "content", description: "Card content in markdown", required: false }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, column: p.column, title: p.title, content: p.content })
+  },
+  {
+    name: "kanban_get_card",
+    description: "Read one kanban card by id, including archived ones. Cheaper than fetching the whole board, and the only way to read a card that has been archived.",
+    route: "kanban.getCard",
+    method: "GET",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId })
+  },
+  {
+    name: "kanban_update_card",
+    description: "Update an existing kanban card. Only the fields you pass are changed; passing null to priority, color or deadline clears it. Prefer this over creating a second card when something needs correcting.",
+    route: "kanban.updateCard",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "title", description: "New title", required: false },
+      { name: "content", description: "New card content, in markdown", required: false },
+      { name: "priority", description: "Priority from 1 to 10, or null to clear it", required: false },
+      { name: "color", description: "Card colour, or null to clear it", required: false },
+      { name: "groups", description: "Labels, as a list of strings. Replaces the current ones.", required: false },
+      { name: "deadline", description: "Due date as YYYY-MM-DD, or null to clear it", required: false },
+      { name: "assignees", description: "User ids to assign, as a list. Replaces the current ones; use kanban_list_members to find the ids.", required: false }
+    ],
+    buildInput: (p) => ({
+      boardId: p.boardId,
+      cardId: p.cardId,
+      ...p.title !== void 0 ? { title: p.title } : {},
+      ...p.content !== void 0 ? { content: p.content } : {},
+      // Tout arrive en chaîne : un modèle n'écrit pas des nombres, des listes
+      // ni des `null` typés. `clearable` distingue « efface » de « ne touche
+      // pas » — sans quoi vider une couleur serait impossible à exprimer, et
+      // changer un titre risquerait de vider le reste.
+      ...clearable(p.priority, (v) => Number(v), "priority"),
+      ...clearable(p.color, (v) => v, "color"),
+      ...clearable(p.deadline, (v) => v, "deadline"),
+      ...p.groups !== void 0 ? { groups: toList(p.groups) } : {},
+      ...p.assignees !== void 0 ? { assignees: toList(p.assignees) } : {}
+    })
+  },
+  {
+    name: "kanban_set_card_archived",
+    description: "Archive a kanban card (it leaves the board but is not deleted) or bring it back. An unarchived card returns to the column it left.",
+    route: "kanban.setCardArchived",
+    method: "POST",
+    params: [
+      { name: "boardId", description: "The kanban board ID", required: true },
+      { name: "cardId", description: "The card ID", required: true },
+      { name: "archived", description: "true to archive, false to bring the card back", required: true }
+    ],
+    buildInput: (p) => ({ boardId: p.boardId, cardId: p.cardId, archived: p.archived === "true" })
+  },
+  {
+    name: "kanban_list_members",
+    description: "List the people of the organization who can be assigned to a card, with their ids. Needed before assigning anyone with kanban_update_card.",
+    route: "kanban.listMembers",
+    method: "GET",
+    params: [
+      { name: "organizationId", description: "Which organization. Optional: needed only when the account belongs to several and the error message asks for it.", required: false }
+    ],
+    buildInput: (p) => p.organizationId ? { organizationId: p.organizationId } : {}
+  },
+  // ─── Lecture seule ───────────────────────────────────────────────────────
+  //
+  // Tout ce qui se consulte sans rien changer. La création, la mise à jour et
+  // la suppression restent hors MCP : elles s'ajouteront au cas par cas.
+  //
+  // Volontairement absentes, et à ne pas ajouter sans y regarder à deux fois,
+  // parce qu'elles rendent un secret : `environment.list` / `get` / `resolve` /
+  // `resolveFlat` (un `Environment` porte ses variables, valeurs comprises),
+  // `apiKeys.list` / `reveal`, `setup.getEncryptionKeyHex` et `getOrgKeys`
+  // (clés de chiffrement), `settings.get` et `settings.listAIProviders` (clés
+  // de fournisseurs d'IA — `settings.getPaths` et `getNetwork`, eux, ne
+  // rendent que des chemins et une adresse, d'où leur présence ci-dessous),
+  // `cloudAuth.session`, `agent.getPassthroughEnv`. Un agent n'a pas besoin de
+  // ces valeurs pour travailler, et ce qu'il lit finit dans une transcription.
+  {
+    name: "list_processes",
+    description: "List every process across all agents with its current state (running, stopped, exit code, uptime). Use this to see the whole machine at once, rather than calling get_service_status service by service. An agent only learns about a service when it is first started, so this lists what is deployed, not what is configured: an empty list means nothing has been started, not that you cannot see them \u2014 list_services shows what exists.",
+    route: "process.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_service",
+    description: "Read the full configuration of one service: its commands, ports, groups, runner, log sources and restart policy. list_services gives the ids.",
+    route: "service.get",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true }
+    ],
+    buildInput: (p) => ({ id: p.serviceId })
+  },
+  {
+    name: "get_service_metrics",
+    description: "Read the CPU and memory currently used by a running service.",
+    route: "process.metrics",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "The service ID", required: true },
+      { name: "agentId", description: "The agent ID hosting this service", required: true }
+    ],
+    buildInput: (p) => ({ agentId: p.agentId, processId: p.serviceId })
+  },
+  {
+    name: "list_agents",
+    description: "List the agents connected to this Runeya, with their status and whether they run on this machine. Passphrases are never returned.",
+    route: "agent.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "list_projects",
+    description: "List the projects known to this Runeya, with their ids and the services they hold.",
+    route: "project.list",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_project",
+    description: "Read one project: its services, its active environment, its organization.",
+    route: "project.get",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "The project ID, from list_projects", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "list_project_paths",
+    description: "Where each project lives on this machine. Use it to find the directory to work in before reading or editing files.",
+    route: "project.localPaths",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "git_status",
+    description: "Read the git working tree of a service or a project: staged, modified and untracked files, current branch, ahead/behind counts.",
+    route: "git.status",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_log",
+    description: "Read the recent commits of a service or project repository: hash, author, date, message.",
+    route: "git.log",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
+      { name: "limit", description: "How many commits to return (1-200). Default: 50.", required: false }
+    ],
+    buildInput: (p) => ({ ...gitTarget(p), ...p.limit ? { limit: Number(p.limit) } : {} })
+  },
+  {
+    name: "git_branches",
+    description: "List the local and remote branches of a service or project repository.",
+    route: "git.branches",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_diff",
+    description: "Read the diff of a service or project repository \u2014 everything, or one file. Use it to see what changed before describing or reviewing it.",
+    route: "git.diff",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false },
+      { name: "path", description: "Restrict the diff to this file path", required: false },
+      { name: "staged", description: 'Set to "true" to read the staged diff instead of the working tree', required: false },
+      { name: "untracked", description: 'Set to "true" to include untracked files', required: false }
+    ],
+    buildInput: (p) => ({
+      ...gitTarget(p),
+      ...p.path ? { path: p.path } : {},
+      ...p.staged !== void 0 ? { staged: p.staged === "true" } : {},
+      ...p.untracked !== void 0 ? { untracked: p.untracked === "true" } : {}
+    })
+  },
+  {
+    name: "list_docs",
+    description: "List the markdown documentation files of a scope, as a tree. Pair it with read_doc to answer from the project's own docs rather than from guesswork.",
+    route: "wiki.list",
+    method: "GET",
+    params: [
+      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true }
+    ],
+    buildInput: (p) => ({ scope: p.scope })
+  },
+  {
+    name: "read_doc",
+    description: "Read one markdown documentation file. Paths come from list_docs; only .md and .markdown can be read.",
+    route: "wiki.read",
+    method: "GET",
+    params: [
+      { name: "scope", description: `"global" for this Runeya, or "service:<serviceId>" for one service's repository`, required: true },
+      { name: "path", description: "Relative path of the file, as returned by list_docs", required: true }
+    ],
+    buildInput: (p) => ({ scope: p.scope, path: p.path })
+  },
+  {
+    name: "get_server_logs",
+    description: "Read Runeya's own recent log entries. Use it to explain why Runeya itself misbehaved \u2014 not to read a service's output, which is get_logs.",
+    route: "diagnostics.recentLogs",
+    method: "GET",
+    params: [
+      { name: "limit", description: "How many entries to return (1-2000). Default: 500.", required: false }
+    ],
+    buildInput: (p) => p.limit ? { limit: Number(p.limit) } : void 0
+  },
+  {
+    name: "get_kanban_queue_state",
+    description: "Read the state of the kanban task queue: what is running, what is waiting. Use it before queuing work, or to explain why a card has not started.",
+    route: "kanbanQueue.getState",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "export_project",
+    description: "Read a project and every service it holds in one call, with secrets stripped out. Cheaper and safer than calling get_service for each service \u2014 prefer it whenever you need the whole picture of a project.",
+    route: "project.export",
+    method: "GET",
+    params: [
+      { name: "projectId", description: "The project ID, from list_projects", required: true },
+      { name: "orgId", description: "Its organization. Needed only when the same project id exists in several.", required: false }
+    ],
+    buildInput: (p) => ({ id: p.projectId, ...p.orgId ? { orgId: p.orgId } : {} })
+  },
+  {
+    name: "git_remotes",
+    description: "List the git remotes of a service or project repository, with their URLs.",
+    route: "git.remotes",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "git_stash_list",
+    description: "List the stashes of a service or project repository. Useful before assuming work was lost: it may simply be stashed.",
+    route: "git.stashList",
+    method: "GET",
+    params: [
+      { name: "serviceId", description: "Target the repository of this service", required: false },
+      { name: "projectId", description: "Target the repository of this project, when no service is given", required: false },
+      { name: "agentId", description: "The agent hosting the repository", required: false },
+      { name: "orgId", description: "Its organization, when a project id alone is ambiguous", required: false }
+    ],
+    buildInput: (p) => gitTarget(p)
+  },
+  {
+    name: "get_runeya_version",
+    description: "Read the version of Runeya running here, the latest published one, and whether this install is up to date. Use it before blaming a bug on the code: the machine may simply be behind.",
+    route: "health.versionInfo",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_runeya_paths",
+    description: "Read where Runeya keeps its things on this machine: its launch directory, its data directory, and the machine-wide directory holding cloud projects.",
+    route: "settings.getPaths",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_network_info",
+    description: "Read where this Runeya listens (host and port) and whether it is reachable from the local network, with the URLs to use. Use it to give someone a working link instead of guessing one.",
+    route: "settings.getNetwork",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "list_runeya_instances",
+    description: "List every Runeya answering on this machine, this one included, with its port and directory. Use it when a port is taken or when two instances seem to disagree.",
+    route: "diagnostics.instances",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  },
+  {
+    name: "get_cloud_status",
+    description: "Say whether this Runeya is linked to a cloud account, and to which cloud. A kanban tool failing for lack of a cloud link is explained here.",
+    route: "cloudAuth.status",
+    method: "GET",
+    params: [],
+    buildInput: () => void 0
+  }
+];
+
+// ../../packages/ai-capabilities/src/adapters/anthropic.ts
+function buildAnthropicTools(capabilities) {
+  return capabilities.map((cap) => ({
+    name: cap.name,
+    description: cap.description,
+    input_schema: {
+      type: "object",
+      properties: Object.fromEntries(
+        cap.params.map((p) => [p.name, { type: "string", description: p.description }])
+      ),
+      required: cap.params.filter((p) => p.required).map((p) => p.name)
     }
-    const isInterpRef = (v) => /\{\{environment\.[^}]+\}\}/.test(v);
-    for (const result of parentResults) {
-      for (const [key, value] of Object.entries(result.parentEnv)) {
-        const existingIsRef = key in parentEnv && isInterpRef(parentEnv[key]);
-        const newIsConcrete = !isInterpRef(value);
-        if (!(key in parentEnv) || existingIsRef && newIsConcrete) {
-          parentEnv[key] = value;
-        }
-      }
-      for (const key of result.parentSecretKeys) {
-        parentSecretKeys.add(key);
-      }
-      for (const [key, source] of Object.entries(result.parentKeySources)) {
-        if (!(key in parentKeySources)) {
-          parentKeySources[key] = source;
-        }
+  }));
+}
+
+// ../../packages/ai-capabilities/src/adapters/openai.ts
+function buildOpenAITools(capabilities) {
+  return capabilities.map((cap) => ({
+    type: "function",
+    function: {
+      name: cap.name,
+      description: cap.description,
+      parameters: {
+        type: "object",
+        properties: Object.fromEntries(
+          cap.params.map((p) => [p.name, { type: "string", description: p.description }])
+        ),
+        required: cap.params.filter((p) => p.required).map((p) => p.name)
       }
     }
-    for (const key of this.collectSecretKeys(mergedVariables, parentSecretKeys)) {
-      parentSecretKeys.add(key);
-    }
-    const ownVariables = project ? project(environment.variables) : environment.variables;
-    for (const [varId, variable] of Object.entries(ownVariables)) {
-      let wasInherited = varId in mergedVariables;
-      for (const [existingId, existingVar] of Object.entries(mergedVariables)) {
-        if (existingVar.key === variable.key && existingId !== varId) {
-          delete mergedVariables[existingId];
-          delete sources[existingId];
-          wasInherited = true;
-        }
-      }
-      mergedVariables[varId] = variable;
-      sources[varId] = {
-        environmentId: environment.id,
-        environmentName: environment.name,
-        overridden: wasInherited
-      };
+  }));
+}
+
+// ../../packages/ai-capabilities/src/adapters/prompt.ts
+function buildToolSafetyInstruction(capabilities) {
+  const destructive = capabilities.filter((c) => c.destructive).map((c) => c.name);
+  const withHints = capabilities.filter((c) => c.usageHint);
+  const lines = ["## Tool use safety rules"];
+  if (destructive.length > 0) {
+    lines.push(`CRITICAL: Never call ${destructive.join(", ")} unless the user has EXPLICITLY and UNAMBIGUOUSLY requested it.`);
+    lines.push(`- Only call destructive tools (${destructive.join(", ")}) when the user explicitly uses action words for a specific service.`);
+  }
+  if (withHints.length > 0) {
+    lines.push("");
+    lines.push("## Tool usage hints");
+    for (const cap of withHints) {
+      lines.push(`- ${cap.usageHint}`);
     }
-    return {
-      variables: mergedVariables,
-      sources,
-      parentEnv,
-      parentSecretKeys,
-      parentKeySources
-    };
   }
-};
-var environmentResolver = new EnvironmentResolver();
+  return lines.join("\n");
+}
+
+// ../../packages/ai-capabilities/src/trpc-caller.ts
+async function callTrpc(baseUrl, route, method, input, authToken) {
+  const headers = {
+    "Content-Type": "application/json",
+    "Authorization": `Bearer ${authToken}`
+  };
+  const url = method === "GET" && input ? `${baseUrl}/api/trpc/${route}?input=${encodeURIComponent(JSON.stringify(input))}` : `${baseUrl}/api/trpc/${route}`;
+  const res = await fetch(url, {
+    method,
+    headers,
+    ...method === "POST" ? { body: JSON.stringify(input ?? {}) } : {},
+    signal: AbortSignal.timeout(15e3)
+  });
+  const json = await res.json();
+  if (json["error"]) throw new Error(JSON.stringify(json["error"]));
+  const result = json["result"];
+  return result?.["data"] ?? result ?? json;
+}
 
 // ../server/src/services/llms-txt-generator.ts
-function generateAdminLlmsTxt(services, jwt) {
-  const baseUrl = `http://localhost:${env.PORT}`;
-  const trpcBase = `${baseUrl}/api/trpc`;
+function generateAdminLlmsTxt(services, jwt, project) {
   const lines = [];
-  lines.push("# Runeya \u2014 Service Management API");
+  lines.push("# Runeya \u2014 Service Management");
   lines.push("");
   lines.push("> You are operating as an authenticated admin with full access to all services.");
-  lines.push(`> Base URL: ${trpcBase}`);
-  if (jwt) {
-    lines.push("> Authentication: pass `Authorization: Bearer $RUNEYA_API_TOKEN` on all tRPC requests.");
-  }
+  lines.push("> Everything below is driven through the Runeya MCP tools.");
   lines.push("");
+  if (project) {
+    lines.push(`## Current project`);
+    lines.push("");
+    lines.push(`You are working on **${project.name}** (projectId: \`${project.id}\`${project.orgId ? `, orgId: \`${project.orgId}\`` : ""}).`);
+    lines.push(`The services listed below are its own. Name this project \u2014 \`projectId=${project.id}\` \u2014 on any tool that takes one, and you will stay on what the user actually sees.`);
+    lines.push("A call that names no project may answer for every project of the machine, which is far more than this screen shows: if a result mentions services you do not recognize, that is why.");
+    lines.push("");
+  }
   if (services.length === 0) {
     lines.push("No services configured.");
     return lines.join("\n");
@@ -1509,47 +1787,24 @@ function generateAdminLlmsTxt(services, jwt) {
   }
   lines.push("## MCP Tools");
   lines.push("");
-  lines.push("You have access to Runeya MCP tools to manage services. **Always prefer MCP tools** over raw HTTP calls.");
-  lines.push("Available tools: `list_services`, `get_service_status`, `start_service`, `stop_service`, `restart_service`, `get_logs`.");
+  lines.push("Runeya is driven exclusively through the MCP tools below. There is no HTTP API to fall back on.");
   lines.push("");
+  lines.push(RUNEYA_CAPABILITIES.map((c) => `\`${c.name}\``).join(", ") + ".");
+  lines.push("");
+  const hints = RUNEYA_CAPABILITIES.filter((c) => c.usageHint);
+  if (hints.length > 0) {
+    lines.push("### Usage hints");
+    lines.push("");
+    for (const cap of hints) lines.push(`- ${cap.usageHint}`);
+    lines.push("");
+  }
   if (jwt) {
     lines.push("**Important**: Pass the `authToken` parameter with value `$RUNEYA_API_TOKEN` (from environment) on every MCP tool call for authentication.");
     lines.push("");
   }
   lines.push("Use the service IDs and agent IDs listed above when calling these tools.");
   lines.push("");
-  lines.push("## API Reference (fallback)");
-  lines.push("");
-  lines.push("Only use raw HTTP calls if MCP tools are unavailable.");
-  lines.push("All endpoints use tRPC v11 over HTTP (`Content-Type: application/json`).");
-  lines.push("");
-  lines.push("**tRPC v11 request format:**");
-  lines.push('- **GET queries**: `?input={"id":"abc"}`');
-  lines.push('- **POST mutations**: JSON body `{"agentId":"<agentId>","processId":"<serviceId>"}`');
-  lines.push("");
-  lines.push(`### List services
-\`GET ${trpcBase}/service.list\``);
-  lines.push("");
-  lines.push(`### Get service
-\`GET ${trpcBase}/service.get?input={"agentId":"<agentId>","id":"<serviceId>"}\``);
-  lines.push("");
-  lines.push(`### Read logs
-\`GET ${trpcBase}/process.logs?input={"agentId":"<agentId>","processId":"<serviceId>"}\``);
-  lines.push("");
-  lines.push(`### Start service
-\`POST ${trpcBase}/process.start\`
-Body: \`{"agentId":"<agentId>","processId":"<serviceId>"}\``);
-  lines.push("");
-  lines.push(`### Stop service
-\`POST ${trpcBase}/process.stop\`
-Body: \`{"agentId":"<agentId>","processId":"<serviceId>"}\``);
-  lines.push("");
-  lines.push(`### Restart service
-\`POST ${trpcBase}/process.restart\`
-Body: \`{"agentId":"<agentId>","processId":"<serviceId>"}\``);
-  lines.push("");
-  lines.push(`### Get service status
-\`GET ${trpcBase}/process.status?input={"agentId":"<agentId>","processId":"<serviceId>"}\``);
+  lines.push("If a tool you need does not exist, say so instead of improvising another route.");
   lines.push("");
   return lines.join("\n");
 }
@@ -2075,10 +2330,31 @@ async function resolveServiceVariables(service) {
 }
 var DockerConfigInput = DockerConfigSchema;
 var serviceRouter = router({
-  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List all services", protect: true } }).output(z2.any()).query(async ({ ctx }) => {
+  /**
+   * Sans `projectId`, la réponse couvre TOUT le poste : `serviceStore.list()`
+   * rend chaque coffre, donc chaque organisation et chaque projet de la
+   * machine. L'interface le supporte — elle n'affiche que le projet ouvert —
+   * mais un appelant sans écran reçoit la liste entière, d'où le filtre.
+   *
+   * Un projet introuvable rend une liste vide, jamais tout le poste : un repli
+   * silencieux ferait croire au filtrage tout en rendant les services des
+   * autres organisations.
+   */
+  list: protectedProcedure.meta({ openapi: { method: "GET", path: "/services", tags: ["services"], summary: "List services (every project of the machine unless narrowed)", protect: true } }).input(z2.object({
+    projectId: z2.string().max(128).optional(),
+    orgId: z2.string().max(128).nullable().optional()
+  }).optional()).output(z2.any()).query(async ({ input, ctx }) => {
     const all = await serviceStore.list();
     const allowedIds = getAllowedServiceIds(ctx);
-    const filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
+    let filtered = allowedIds ? all.filter((s) => allowedIds.has(s.id)) : all;
+    if (input?.projectId) {
+      const project = await projectStore.get({
+        id: input.projectId,
+        ...input.orgId !== void 0 ? { orgId: input.orgId } : {}
+      });
+      const ids = new Set(project?.serviceIds ?? []);
+      filtered = filtered.filter((s) => ids.has(s.id));
+    }
     return Promise.all(filtered.map(async (s) => ({
       ...s,
       effectiveAgentId: await resolveEffectiveAgentId(s)
@@ -3256,7 +3532,7 @@ async function vaultOfProject(projectId) {
 // ../server/src/services/image-storage.service.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { mkdir as mkdir6, writeFile as writeFile4, readFile as readFile6, unlink as unlink2, readdir as readdir3 } from "fs/promises";
-import { existsSync } from "fs";
+import { existsSync as existsSync2 } from "fs";
 import { join as join6, extname, resolve as resolve2, sep as sep2 } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
@@ -3322,7 +3598,7 @@ var ImageStorageService = class {
       if (!metaFile) return null;
       const raw = JSON.parse(await readFile6(join6(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
-      if (!existsSync(raw.filePath)) return null;
+      if (!existsSync2(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
     } catch {
       return null;
@@ -4554,13 +4830,9 @@ async function getAgentManager() {
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
-  const { isResume, systemContext, apiBaseUrl, apiToken, model, mcpConfig, skipTokenInstructions, prompt } = params;
+  const { isResume, systemContext, model, mcpConfig, skipTokenInstructions, prompt } = params;
   const sessionArg = isResume ? ["--resume", sessionId] : ["--session-id", sessionId];
-  const apiDocs = buildApiDocs(apiBaseUrl, apiToken);
-  const fullSystemContext = apiDocs ? `${systemContext}
-
-${apiDocs}` : systemContext;
-  const systemPrompt = skipTokenInstructions ? fullSystemContext : `${fullSystemContext}
+  const systemPrompt = skipTokenInstructions ? systemContext : `${systemContext}
 
 ${TOKEN_INSTRUCTIONS}`;
   const mcpArgs = mcpConfig && !opts.excludeMcp ? ["--mcp-config", mcpConfig] : [];
@@ -4719,7 +4991,9 @@ async function runClaudeViaPty(params) {
       // toutes les tools répondent « No auth token available », et `$RUNEYA_API_TOKEN`
       // ne résout à rien dans le shell du CLI. Le jeton est déjà là — la file le
       // signe elle-même, faute de requête HTTP d'où le tirer.
-      mcpApiToken: params.apiToken || void 0
+      mcpApiToken: params.apiToken || void 0,
+      mcpProjectId: params.projectId || void 0,
+      mcpOrgId: params.orgId || void 0
     }).then(({ spawnId: id }) => {
       spawnId = id;
       if (signal.aborted) {
@@ -4866,16 +5140,12 @@ var EFFORT_THINKING_BUDGET = {
   high: 1e4
 };
 function buildClaudeSpawnConfig(params, opts) {
-  const { sessionId, prompt, isResume, systemContext, apiBaseUrl, apiToken, model, effort, images, mcpConfig, skipTokenInstructions, injectedEnv } = params;
+  const { sessionId, prompt, isResume, systemContext, apiToken, model, effort, images, mcpConfig, skipTokenInstructions, injectedEnv } = params;
   const hasImages = images && images.length > 0;
   const sessionArg = isResume ? ["--resume", sessionId] : sessionId ? ["--session-id", sessionId] : [];
   const thinkingBudget = EFFORT_THINKING_BUDGET[effort] ?? 0;
   const thinkingArgs = thinkingBudget > 0 ? ["--thinking", "enabled"] : [];
-  const apiDocs = buildApiDocs(apiBaseUrl, apiToken);
-  const fullSystemContext = apiDocs ? `${systemContext}
-
-${apiDocs}` : systemContext;
-  const systemPrompt = skipTokenInstructions ? fullSystemContext : `${fullSystemContext}
+  const systemPrompt = skipTokenInstructions ? systemContext : `${systemContext}
 
 ${TOKEN_INSTRUCTIONS}`;
   const inputArgs = hasImages ? ["--input-format", "stream-json"] : ["-p", prompt];
@@ -5053,56 +5323,6 @@ var ClaudeCodeRunner = class {
 import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { EventEmitter } from "events";
-
-// ../../packages/mcp-server/src/launch.ts
-import { fileURLToPath } from "url";
-import { createRequire } from "module";
-import { existsSync as existsSync2 } from "fs";
-function resolveMcpServerPath() {
-  try {
-    const req = createRequire(import.meta.url);
-    return req.resolve("@runeya/packages-mcp-server");
-  } catch {
-  }
-  const candidates = [
-    // Build packagé du CLI : dist/agent/index.js et dist/index.js côtoient
-    // dist/mcp-server/, copié là par le post-build.
-    new URL("../mcp-server/index.js", import.meta.url),
-    new URL("./mcp-server/index.js", import.meta.url),
-    // Monorepo, depuis un dist d'app.
-    new URL("../../../packages/mcp-server/dist/index.js", import.meta.url),
-    new URL("../../../../packages/mcp-server/dist/index.js", import.meta.url)
-  ];
-  for (const c of candidates) {
-    const p = fileURLToPath(c);
-    if (existsSync2(p)) return p;
-  }
-  throw new Error("Could not locate @runeya/packages-mcp-server (built dist not found)");
-}
-function pickEnv(env2) {
-  return {
-    ...env2.RUNEYA_BASE_URL ? { RUNEYA_BASE_URL: env2.RUNEYA_BASE_URL } : {},
-    ...env2.RUNEYA_API_TOKEN ? { RUNEYA_API_TOKEN: env2.RUNEYA_API_TOKEN } : {}
-  };
-}
-function codexMcpArgs(env2) {
-  const fields = [
-    `command=${tomlString("node")}`,
-    `args=[${tomlString(resolveMcpServerPath())}]`
-  ];
-  const entries = Object.entries(pickEnv(env2));
-  if (entries.length > 0) {
-    const inline = entries.map(([k, v]) => `${k}=${tomlString(v)}`).join(",");
-    fields.push(`env={${inline}}`);
-  }
-  return ["-c", `mcp_servers.runeya={${fields.join(",")}}`];
-}
-function tomlString(value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/[\u0000-\u001f\u007f]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
-  return `"${escaped}"`;
-}
-
-// ../server/src/services/ai-runners/codex-app-server-client.ts
 function resolveMcpArgs(env2) {
   if (!env2["RUNEYA_API_TOKEN"]) return [];
   try {
@@ -5399,8 +5619,7 @@ var CodexRunner = class {
       this.lastThreadId = threadId;
       params.onThreadId?.(threadId);
     }
-    const apiDocs = buildApiDocs(apiBaseUrl, apiToken);
-    const systemParts = [systemContext, ...skipTokenInstructions ? [] : [TOKEN_INSTRUCTIONS], apiDocs].filter(Boolean);
+    const systemParts = [systemContext, ...skipTokenInstructions ? [] : [TOKEN_INSTRUCTIONS]].filter(Boolean);
     const fullSystemContext = systemParts.join("\n\n");
     const fullPrompt = isResume && this.lastThreadId ? prompt : `${fullSystemContext}
 
@@ -5592,8 +5811,7 @@ ${prompt}`;
       this.lastThreadId = threadId;
       params.onThreadId?.(threadId);
     }
-    const apiDocs = buildApiDocs(apiBaseUrl, apiToken);
-    const systemParts = [systemContext, ...skipTokenInstructions ? [] : [TOKEN_INSTRUCTIONS], apiDocs].filter(Boolean);
+    const systemParts = [systemContext, ...skipTokenInstructions ? [] : [TOKEN_INSTRUCTIONS]].filter(Boolean);
     const fullSystemContext = systemParts.join("\n\n");
     const fullPrompt = isResume && this.lastThreadId ? prompt : `${fullSystemContext}
 
@@ -5980,20 +6198,21 @@ async function* drainSession(session, signal, isReconnect) {
     if (signal?.aborted) return;
   }
 }
+async function kanbanContextFor(conv) {
+  if (!conv?.kanbanBoardId) return "";
+  const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
+  if (!kanbanBoard) return "";
+  return "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
+}
 async function buildCliSystemContext(conv, jwt) {
   const allServices = await serviceStore.list();
   const ref = conv ? await conversationStore.projectRefOf(conv) : null;
   const project = ref ? await projectStore.get(ref) : null;
   const ownServices = project ? allServices.filter((svc) => project.serviceIds.includes(svc.id)) : allServices;
   const resolvedServices = await Promise.all(ownServices.map(resolveServiceVariables));
-  let systemContext = generateAdminLlmsTxt(resolvedServices, jwt);
+  let systemContext = generateAdminLlmsTxt(resolvedServices, jwt, project);
   if (!conv?.isCompanion) systemContext += "\n\n" + companionSystemNote();
-  if (conv?.kanbanBoardId) {
-    const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-    if (kanbanBoard) {
-      systemContext += "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
-    }
-  }
+  systemContext += await kanbanContextFor(conv);
   return systemContext;
 }
 async function resolveInjectedEnv(environmentId) {
@@ -6020,15 +6239,12 @@ async function startClaudeCodeSession(convId, prompt, opts = {}) {
   conversationStore.update(conv.id, { messages: conv.messages }, { silent: true }).catch(() => {
   });
   const systemContext = await buildCliSystemContext(conv, opts.jwt);
-  const mcpServerPath = fileURLToPath2(new URL("../mcp-server/index.js", import.meta.url));
-  const mcpConfig = JSON.stringify({
-    mcpServers: {
-      runeya: {
-        command: "node",
-        args: [mcpServerPath],
-        env: { RUNEYA_BASE_URL: `http://localhost:${env.PORT}`, ...opts.jwt ? { RUNEYA_API_TOKEN: opts.jwt } : {} }
-      }
-    }
+  const mcpRef = conv ? await conversationStore.projectRefOf(conv) : null;
+  const mcpConfig = runeyaMcpConfig({
+    RUNEYA_BASE_URL: `http://localhost:${env.PORT}`,
+    ...opts.jwt ? { RUNEYA_API_TOKEN: opts.jwt } : {},
+    ...mcpRef?.id ? { RUNEYA_PROJECT_ID: mcpRef.id } : {},
+    ...mcpRef?.orgId ? { RUNEYA_ORG_ID: mcpRef.orgId } : {}
   });
   const ac = new AbortController();
   const session = activeSessionRegistry.registerProviderApiSession(convId, ac);
@@ -6048,6 +6264,8 @@ async function startClaudeCodeSession(convId, prompt, opts = {}) {
     systemContext,
     apiBaseUrl: `http://localhost:${env.PORT}`,
     apiToken: opts.jwt ?? "",
+    ...mcpRef?.id ? { projectId: mcpRef.id } : {},
+    ...mcpRef?.orgId ? { orgId: mcpRef.orgId } : {},
     model: opts.model ?? "claude-opus-4-6",
     effort: opts.effort ?? "normal",
     signal: ac.signal,
@@ -6549,25 +6767,14 @@ Return ONLY the improved text, no explanation, no preamble.`;
     const cliPrompt = input.contextNote ? `${input.contextNote}
 
 ${input.prompt}` : input.prompt;
-    const allServices = await serviceStore.list();
-    const resolvedServices = await Promise.all(allServices.map(resolveServiceVariables));
     const jwt = ctx.authorization?.startsWith("Bearer ") ? ctx.authorization.slice(7) : void 0;
-    let systemContext = generateAdminLlmsTxt(resolvedServices, jwt);
-    if (conv.kanbanBoardId) {
-      const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-      if (kanbanBoard) {
-        systemContext += "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
-      }
-    }
-    const mcpServerPath = fileURLToPath2(new URL("../mcp-server/index.js", import.meta.url));
-    const mcpConfig = JSON.stringify({
-      mcpServers: {
-        runeya: {
-          command: "node",
-          args: [mcpServerPath],
-          env: { RUNEYA_BASE_URL: `http://localhost:${env.PORT}`, ...jwt ? { RUNEYA_API_TOKEN: jwt } : {} }
-        }
-      }
+    const systemContext = await buildCliSystemContext(conv, jwt);
+    const mcpRef = await conversationStore.projectRefOf(conv);
+    const mcpConfig = runeyaMcpConfig({
+      RUNEYA_BASE_URL: `http://localhost:${env.PORT}`,
+      ...jwt ? { RUNEYA_API_TOKEN: jwt } : {},
+      ...mcpRef?.id ? { RUNEYA_PROJECT_ID: mcpRef.id } : {},
+      ...mcpRef?.orgId ? { RUNEYA_ORG_ID: mcpRef.orgId } : {}
     });
     const imagePaths = [];
     if (input.imageIds && input.imageIds.length > 0) {
@@ -6603,6 +6810,8 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
       systemContext,
       apiBaseUrl: `http://localhost:${env.PORT}`,
       apiToken: jwt ?? "",
+      ...mcpRef?.id ? { projectId: mcpRef.id } : {},
+      ...mcpRef?.orgId ? { orgId: mcpRef.orgId } : {},
       model: input.model ?? "claude-opus-4-6",
       effort: input.effort ?? "normal",
       signal: ac.signal,
@@ -6665,16 +6874,8 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
     const cliPrompt = input.contextNote ? `${input.contextNote}
 
 ${input.prompt}` : input.prompt;
-    const allServices = await serviceStore.list();
-    const resolvedServices = await Promise.all(allServices.map(resolveServiceVariables));
     const jwt = ctx.authorization?.startsWith("Bearer ") ? ctx.authorization.slice(7) : void 0;
-    let systemContext = generateAdminLlmsTxt(resolvedServices, jwt);
-    if (conv.kanbanBoardId) {
-      const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-      if (kanbanBoard) {
-        systemContext += "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
-      }
-    }
+    const systemContext = await buildCliSystemContext(conv, jwt);
     const resolvedImages = input.imageIds && input.imageIds.length > 0 ? await resolveImagesToBase64(input.imageIds.map((id) => ({ imageId: id, mimeType: "" })), input.conversationId) : [];
     const convId = input.conversationId;
     const ac = new AbortController();
@@ -6764,12 +6965,7 @@ ${input.prompt}` : input.prompt;
     const authToken = ctx.authorization?.replace(/^Bearer\s+/i, "") ?? "";
     let system = await buildSystemPrompt(apiKey);
     system += "\n\n" + TOOL_SAFETY_INSTRUCTION;
-    if (conv && conv.kanbanBoardId) {
-      const kanbanBoard = await kanbanStore.get(conv.kanbanBoardId);
-      if (kanbanBoard) {
-        system += "\n\n" + (conv.kanbanCardId ? await buildKanbanCardPrompt(kanbanBoard, conv.kanbanCardId) : generateKanbanPopulatePrompt(kanbanBoard));
-      }
-    }
+    system += await kanbanContextFor(conv);
     const resolvedImages = input.imageIds && input.imageIds.length > 0 ? await resolveImagesToBase64(input.imageIds.map((id) => ({ imageId: id, mimeType: "" })), input.conversationId) : [];
     let session;
     try {
@@ -6896,12 +7092,14 @@ ${input.prompt}` : input.prompt;
         }
       }
       lap("findPtyBySession (no reattach)");
+      const ptyConv = input.sessionId ? await conversationStore.get(input.sessionId).catch(() => null) : null;
       const isCodex = input.runner === "codex";
       const cli = isCodex ? "codex" : "claude";
       const args = [];
       if (isCodex) {
-        if (input.sessionId && await codexSessionExists(input.sessionId)) {
-          args.push("resume", input.sessionId);
+        const resumeId = await resolveCodexResumeId(input.sessionId, ptyConv?.codexThreadId);
+        if (resumeId) {
+          args.push("resume", resumeId);
         }
         if (input.model) args.push("--model", input.model);
         args.push("--dangerously-bypass-approvals-and-sandbox");
@@ -6917,20 +7115,13 @@ ${input.prompt}` : input.prompt;
         if (input.model) args.push("--model", input.model);
         args.push("--dangerously-skip-permissions");
       }
+      const ptyRef = (ptyConv ? await conversationStore.projectRefOf(ptyConv) : null) ?? (input.projectId ? { id: input.projectId, orgId: input.orgId ?? null } : null);
       const jwt = ctx.authorization?.startsWith("Bearer ") ? ctx.authorization.slice(7) : void 0;
-      if (!isCodex && input.sessionId) {
+      if (!isCodex && ptyConv) {
         try {
-          const conv = await conversationStore.get(input.sessionId);
-          if (conv) {
-            const systemContext = await buildCliSystemContext(conv, jwt);
-            const apiBase = input.apiBaseUrl ?? `http://localhost:${env.PORT}`;
-            const apiDocs = buildApiDocs(apiBase, jwt ?? "");
-            const fullSystemPrompt = apiDocs ? `${systemContext}
-
-${apiDocs}` : systemContext;
-            if (fullSystemPrompt.trim().length > 0) {
-              args.push("--append-system-prompt", fullSystemPrompt);
-            }
+          const systemContext = await buildCliSystemContext(ptyConv, jwt);
+          if (systemContext.trim().length > 0) {
+            args.push("--append-system-prompt", systemContext);
           }
         } catch (err) {
           console.warn("[chat.pty.start] buildCliSystemContext failed:", err.message);
@@ -6962,7 +7153,9 @@ ${apiDocs}` : systemContext;
           sessionId: input.sessionId,
           enableMcp: input.enableMcp,
           mcpApiBaseUrl: input.apiBaseUrl ?? `http://localhost:${env.PORT}`,
-          mcpApiToken: jwt
+          mcpApiToken: jwt,
+          ...ptyRef?.id ? { mcpProjectId: ptyRef.id } : {},
+          ...ptyRef?.orgId ? { mcpOrgId: ptyRef.orgId } : {}
         }
       );
       lap("agent ai.spawnPty");
@@ -7319,4 +7512,4 @@ export {
   startCliSession,
   chatRouter
 };
-//# sourceMappingURL=chunk-ZVUSEO5P.js.map
+//# sourceMappingURL=chunk-MBHLFZ7C.js.map