Tell replies their envs and call queued work runs

Chat replies now list the envs that reach them (keys and descriptions,
never values), so a bot no longer asks for keys that are set or "checks"
them with show_secret or printenv. request_secret refuses a key that's
already set unless the user asked to replace it, and search_computers
says envs aren't loaded in its shell.

start_task and delegate_task results say "Run #N" and that list_tasks
doesn't show it, since bots sent users to the to-do list for queue jobs.
start_task refuses a second open run in the session on the same
computer unless it's separate work, and says how many runs are ahead on
that computer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/functions/backend/db/envs/grab-reachable-envs.ts

@@ -0,0 +1,46 @@
+import grabRunEnvs from "../extensions/grab-run-envs";
+import type { DecryptedEnv } from "./grab-all-envs";
+import grabComputerEnvs from "./grab-computer-envs";
+
+type Params = {
+    bot_id: number | string;
+    user_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * The computer the run is on (the bot's current one), whose envs count.
+     */
+    computer_id?: number | string | null;
+};
+
+export type ReachableEnvs = {
+    /**
+     * Set on the computer for its tasks ($KEY in their shells and code).
+     */
+    on_computer: DecryptedEnv[];
+    /**
+     * Only filled into tools' templates ({{env.KEY}}): not exposed to
+     * computers, or there's no computer.
+     */
+    tools_only: DecryptedEnv[];
+};
+
+/**
+ * Every env that reaches one run, one per key: the computer's
+ * (`grabComputerEnvs`) first, then the ones only tools read
+ * (`grabRunEnvs`). What `show_secret` can show, what `request_secret`
+ * mustn't ask for again, and what a reply is told it has.
+ */
+export default async function grabReachableEnvs({
+    bot_id,
+    user_id,
+    workspace_id,
+    computer_id,
+}: Params): Promise<ReachableEnvs> {
+    const [on_computer, run] = await Promise.all([
+        computer_id ? grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id }) : [],
+        grabRunEnvs({ bot_id, user_id, workspace_id }),
+    ]);
+    const keys = new Set(on_computer.map((env) => env.key));
+
+    return { on_computer, tools_only: run.filter((env) => !keys.has(env.key)) };
+}