@piecemaker-legal/piecemaker 1.0.0

package/server/piecemaker/timesheet/service.ts

@@ -0,0 +1,298 @@
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+import { projectsDb, sessionsDb } from '@/modules/database/index.js';
+import { sessionsService } from '@/modules/providers/index.js';
+import type { FetchHistoryResult, NormalizedMessage } from '@/shared/types.js';
+import { AppError } from '@/shared/utils.js';
+
+import type { TimesheetEntry } from './store.js';
+
+export type TimesheetScope = 'all' | 'project';
+
+export type TimesheetQuery = {
+  scope: TimesheetScope;
+  projectId?: string;
+};
+
+export type TimesheetRefreshError = {
+  sessionId: string;
+  code: 'EXTRACTION_FAILED';
+};
+
+export type TimesheetRefreshResult = {
+  entries: TimesheetPublicEntry[];
+  refreshedAt: string;
+  refreshedCount: number;
+  skippedCount: number;
+  errors: TimesheetRefreshError[];
+};
+
+export type TimesheetPublicEntry = Omit<TimesheetEntry, 'transcriptFingerprint' | 'extractedAt'>;
+
+type SessionRecord = ReturnType<typeof sessionsDb.getAllSessions>[number];
+
+type TimesheetStore = {
+  upsert(entry: TimesheetEntry): void;
+  findBySessionId(sessionId: string): TimesheetEntry | null;
+  list(projectId?: string): TimesheetEntry[];
+};
+
+type TimesheetDependencies = {
+  sessions: Pick<typeof sessionsDb, 'getAllSessions' | 'getSessionsByProjectPath'> &
+    Partial<Pick<typeof sessionsDb, 'getArchivedSessions'>>;
+  projects: Pick<typeof projectsDb, 'getProjectById' | 'getProjectPath'>;
+  history: Pick<typeof sessionsService, 'fetchHistory'>;
+};
+
+const DEFAULT_DEPENDENCIES: TimesheetDependencies = {
+  sessions: sessionsDb,
+  projects: projectsDb,
+  history: sessionsService,
+};
+
+const MAX_ACTIVE_GAP_SECONDS = 15 * 60;
+
+function projectDisplayName(projectPath: string, customName: string | null | undefined): string {
+  const name = customName?.trim();
+  return name || path.basename(projectPath) || projectPath || 'Sans dossier';
+}
+
+function messageText(message: NormalizedMessage): string {
+  if (message.kind !== 'text' || message.role !== 'assistant') return '';
+  const text = message.content ?? message.displayText ?? '';
+  return typeof text === 'string' ? text.trim() : '';
+}
+
+function validTimestamp(value: string | null | undefined): string | null {
+  if (!value) return null;
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+
+function hashFile(filePath: string): string {
+  const hash = createHash('sha256');
+  let descriptor: number | undefined;
+  try {
+    descriptor = fs.openSync(filePath, 'r');
+    const buffer = Buffer.allocUnsafe(64 * 1024);
+    let bytesRead = 0;
+    do {
+      bytesRead = fs.readSync(descriptor, buffer, 0, buffer.length, null);
+      if (bytesRead > 0) hash.update(buffer.subarray(0, bytesRead));
+    } while (bytesRead > 0);
+    return hash.digest('hex');
+  } catch {
+    return 'missing';
+  } finally {
+    if (descriptor !== undefined) {
+      try { fs.closeSync(descriptor); } catch { }
+    }
+  }
+}
+
+function hashHistory(messages: NormalizedMessage[]): string {
+  const hash = createHash('sha256');
+  for (const message of messages) hash.update(JSON.stringify(message));
+  return hash.digest('hex');
+}
+
+function fingerprint(
+  session: SessionRecord,
+  dependencies: TimesheetDependencies,
+  messages?: NormalizedMessage[],
+): string {
+  const project = session.project_path ? dependencies.projects.getProjectPath(session.project_path) : null;
+  return createHash('sha256').update(JSON.stringify({
+    sessionId: session.session_id,
+    provider: session.provider,
+    providerSessionId: session.provider_session_id,
+    jsonlPath: session.jsonl_path,
+    customName: session.custom_name,
+    projectId: project?.project_id ?? null,
+    projectName: project?.custom_project_name ?? null,
+    createdAt: session.created_at,
+    updatedAt: session.updated_at,
+    transcript: session.jsonl_path
+      ? { path: session.jsonl_path, content: hashFile(session.jsonl_path) }
+      : { history: messages ? hashHistory(messages) : 'pending' },
+  })).digest('hex');
+}
+
+function validateProjectId(projectId: unknown): string {
+  if (typeof projectId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(projectId)) {
+    throw new AppError('projectId is required and must be a valid identifier.', {
+      code: 'TIMESHEET_PROJECT_ID_INVALID',
+      statusCode: 400,
+    });
+  }
+  return projectId;
+}
+
+export function parseTimesheetQuery(input: { scope?: unknown; projectId?: unknown }): TimesheetQuery {
+  if (input.scope !== 'all' && input.scope !== 'project') {
+    throw new AppError('scope must be "all" or "project".', {
+      code: 'TIMESHEET_SCOPE_INVALID',
+      statusCode: 400,
+    });
+  }
+  if (input.scope === 'all') {
+    if (input.projectId !== undefined) {
+      throw new AppError('projectId is only valid with project scope.', {
+        code: 'TIMESHEET_PROJECT_ID_UNEXPECTED',
+        statusCode: 400,
+      });
+    }
+    return { scope: 'all' };
+  }
+  return { scope: 'project', projectId: validateProjectId(input.projectId) };
+}
+
+export function createTimesheetService(
+  store: TimesheetStore,
+  dependencies: TimesheetDependencies = DEFAULT_DEPENDENCIES,
+) {
+  const refreshes = new Map<string, Promise<TimesheetRefreshResult>>();
+
+  function resolveProject(projectId: string) {
+    const project = dependencies.projects.getProjectById(projectId);
+    if (!project) {
+      throw new AppError('The requested project was not found.', {
+        code: 'TIMESHEET_PROJECT_NOT_FOUND',
+        statusCode: 404,
+      });
+    }
+    return project;
+  }
+
+  function sessionsFor(query: TimesheetQuery): SessionRecord[] {
+    const projectPath = query.scope === 'project'
+      ? resolveProject(query.projectId as string).project_path
+      : null;
+    const activeSessions = projectPath
+      ? dependencies.sessions.getSessionsByProjectPath(projectPath)
+      : dependencies.sessions.getAllSessions();
+    const archivedSessions = dependencies.sessions.getArchivedSessions?.() ?? [];
+    const sessions = projectPath
+      ? [...activeSessions, ...archivedSessions.filter((session) => session.project_path === projectPath)]
+      : [...activeSessions, ...archivedSessions];
+    return [...new Map(sessions.map((session) => [session.session_id, session])).values()];
+  }
+
+  async function refreshNow(query: TimesheetQuery): Promise<TimesheetRefreshResult> {
+    const sessions = sessionsFor(query);
+    let refreshedCount = 0;
+    let skippedCount = 0;
+    const errors: TimesheetRefreshError[] = [];
+
+    for (const session of sessions) {
+      try {
+        const existing = store.findBySessionId(session.session_id);
+        const hasJsonlTranscript = Boolean(session.jsonl_path);
+        let history: FetchHistoryResult | undefined;
+        let entryFingerprint = hasJsonlTranscript ? fingerprint(session, dependencies) : '';
+        if (!hasJsonlTranscript || !existing || existing.transcriptFingerprint !== entryFingerprint) {
+          history = await dependencies.history.fetchHistory(session.session_id, { limit: null, offset: 0 });
+          if (!hasJsonlTranscript) entryFingerprint = fingerprint(session, dependencies, history.messages);
+        }
+        if (existing?.transcriptFingerprint === entryFingerprint) {
+          skippedCount += 1;
+          continue;
+        }
+        const summary = summarizeHistoryWithDependencies(session, history?.messages ?? [], entryFingerprint, dependencies);
+        store.upsert({ ...summary, extractedAt: new Date().toISOString() });
+        refreshedCount += 1;
+      } catch {
+        errors.push({ sessionId: session.session_id, code: 'EXTRACTION_FAILED' });
+      }
+    }
+
+    return {
+      entries: store.list(query.scope === 'project' ? query.projectId : undefined).map(toPublicEntry),
+      refreshedAt: new Date().toISOString(),
+      refreshedCount,
+      skippedCount,
+      errors,
+    };
+  }
+
+  function refresh(query: TimesheetQuery): Promise<TimesheetRefreshResult> {
+    const key = query.scope === 'all' ? 'all' : `project:${query.projectId}`;
+    const current = refreshes.get(key);
+    if (current) return current;
+    const pending = refreshNow(query);
+    refreshes.set(key, pending);
+    void pending.then(() => {
+      if (refreshes.get(key) === pending) refreshes.delete(key);
+    }, () => {
+      if (refreshes.get(key) === pending) refreshes.delete(key);
+    });
+    return pending;
+  }
+
+  return {
+    list(query: TimesheetQuery): TimesheetPublicEntry[] {
+      if (query.scope === 'project') resolveProject(query.projectId as string);
+      return store.list(query.scope === 'project' ? query.projectId : undefined).map(toPublicEntry);
+    },
+    refresh,
+  };
+}
+
+function toPublicEntry(entry: TimesheetEntry): TimesheetPublicEntry {
+  return {
+    sessionId: entry.sessionId,
+    provider: entry.provider,
+    projectId: entry.projectId,
+    projectPath: entry.projectPath,
+    projectName: entry.projectName,
+    sessionName: entry.sessionName,
+    startedAt: entry.startedAt,
+    endedAt: entry.endedAt,
+    elapsedSeconds: entry.elapsedSeconds,
+    activeSeconds: entry.activeSeconds,
+    conclusion: entry.conclusion,
+    conclusionAt: entry.conclusionAt,
+  };
+}
+
+function summarizeHistoryWithDependencies(
+  session: SessionRecord,
+  messages: NormalizedMessage[],
+  entryFingerprint: string,
+  dependencies: TimesheetDependencies,
+): Omit<TimesheetEntry, 'extractedAt'> {
+  const events = messages
+    .map((message) => ({ message, timestamp: validTimestamp(message.timestamp) }))
+    .filter((event): event is { message: NormalizedMessage; timestamp: string } => Boolean(event.timestamp))
+    .sort((left, right) => Date.parse(left.timestamp) - Date.parse(right.timestamp));
+  const fallbackStartedAt = validTimestamp(session.created_at);
+  const fallbackEndedAt = validTimestamp(session.updated_at) ?? fallbackStartedAt;
+  const startedAt = events[0]?.timestamp ?? fallbackStartedAt;
+  const endedAt = events.at(-1)?.timestamp ?? fallbackEndedAt;
+  const elapsedSeconds = startedAt && endedAt ? Math.max(0, Math.floor((Date.parse(endedAt) - Date.parse(startedAt)) / 1000)) : 0;
+  let activeSeconds = 0;
+  for (let index = 1; index < events.length; index += 1) {
+    const gapSeconds = Math.max(0, Math.floor((Date.parse(events[index].timestamp) - Date.parse(events[index - 1].timestamp)) / 1000));
+    activeSeconds += Math.min(gapSeconds, MAX_ACTIVE_GAP_SECONDS);
+  }
+  const conclusionEvent = [...events].reverse().find((event) => Boolean(messageText(event.message)));
+  const projectPath = session.project_path ?? '';
+  const project = projectPath ? dependencies.projects.getProjectPath(projectPath) : null;
+  return {
+    sessionId: session.session_id,
+    provider: session.provider,
+    projectId: project?.project_id ?? null,
+    projectPath,
+    projectName: projectDisplayName(projectPath, project?.custom_project_name),
+    sessionName: session.custom_name?.trim() || session.session_id,
+    startedAt,
+    endedAt,
+    elapsedSeconds,
+    activeSeconds,
+    conclusion: conclusionEvent ? messageText(conclusionEvent.message) : null,
+    conclusionAt: conclusionEvent?.timestamp ?? null,
+    transcriptFingerprint: entryFingerprint,
+  };
+}

package/server/piecemaker/timesheet/store.ts

@@ -0,0 +1,167 @@
+import fs from 'node:fs';
+import path from 'node:path';
+
+import Database from 'better-sqlite3';
+
+export type TimesheetEntry = {
+  sessionId: string;
+  provider: string;
+  projectId: string | null;
+  projectPath: string;
+  projectName: string;
+  sessionName: string;
+  startedAt: string | null;
+  endedAt: string | null;
+  elapsedSeconds: number;
+  activeSeconds: number;
+  conclusion: string | null;
+  conclusionAt: string | null;
+  transcriptFingerprint: string;
+  extractedAt: string;
+};
+
+type TimesheetEntryRow = {
+  session_id: string;
+  provider: string;
+  project_id: string | null;
+  project_path: string;
+  project_name: string;
+  session_name: string;
+  started_at: string | null;
+  ended_at: string | null;
+  elapsed_seconds: number;
+  active_seconds: number;
+  conclusion: string | null;
+  conclusion_at: string | null;
+  transcript_fingerprint: string;
+  extracted_at: string;
+};
+
+const CURRENT_SCHEMA_VERSION = 1;
+type TimesheetDatabase = InstanceType<typeof Database>;
+
+function createSchema(database: TimesheetDatabase): void {
+  database.exec(`
+    CREATE TABLE IF NOT EXISTS timesheet_sessions (
+      session_id TEXT PRIMARY KEY,
+      provider TEXT NOT NULL,
+      project_id TEXT,
+      project_path TEXT NOT NULL,
+      project_name TEXT NOT NULL,
+      session_name TEXT NOT NULL,
+      started_at TEXT,
+      ended_at TEXT,
+      elapsed_seconds INTEGER NOT NULL,
+      active_seconds INTEGER NOT NULL,
+      conclusion TEXT,
+      conclusion_at TEXT,
+      transcript_fingerprint TEXT NOT NULL,
+      extracted_at TEXT NOT NULL
+    );
+    CREATE INDEX IF NOT EXISTS timesheet_project_date
+      ON timesheet_sessions(project_id, started_at);
+    CREATE INDEX IF NOT EXISTS timesheet_date
+      ON timesheet_sessions(started_at);
+  `);
+}
+
+function migrate(database: TimesheetDatabase): void {
+  const currentVersion = Number(database.pragma('user_version', { simple: true }));
+  if (currentVersion > CURRENT_SCHEMA_VERSION) {
+    throw new Error('Timesheet database schema is newer than this server.');
+  }
+  createSchema(database);
+  if (currentVersion < 1) {
+    database.pragma(`user_version = ${CURRENT_SCHEMA_VERSION}`);
+  }
+}
+
+function secureDatabaseFiles(databasePath: string): void {
+  for (const filePath of [databasePath, `${databasePath}-wal`, `${databasePath}-shm`]) {
+    try {
+      fs.chmodSync(filePath, 0o600);
+    } catch {
+      continue;
+    }
+  }
+}
+
+function toEntry(row: TimesheetEntryRow): TimesheetEntry {
+  return {
+    sessionId: row.session_id,
+    provider: row.provider,
+    projectId: row.project_id,
+    projectPath: row.project_path,
+    projectName: row.project_name,
+    sessionName: row.session_name,
+    startedAt: row.started_at,
+    endedAt: row.ended_at,
+    elapsedSeconds: row.elapsed_seconds,
+    activeSeconds: row.active_seconds,
+    conclusion: row.conclusion,
+    conclusionAt: row.conclusion_at,
+    transcriptFingerprint: row.transcript_fingerprint,
+    extractedAt: row.extracted_at,
+  };
+}
+
+export function createTimesheetStore(homeDir: string) {
+  const directory = path.join(homeDir, 'timesheet');
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  fs.chmodSync(directory, 0o700);
+  const databasePath = path.join(directory, 'timesheet.sqlite');
+  fs.closeSync(fs.openSync(databasePath, 'a', 0o600));
+  fs.chmodSync(databasePath, 0o600);
+  const database = new Database(databasePath);
+  database.pragma('journal_mode = WAL');
+  migrate(database);
+  secureDatabaseFiles(databasePath);
+
+  const upsert = database.prepare(`
+    INSERT INTO timesheet_sessions (
+      session_id, provider, project_id, project_path, project_name, session_name,
+      started_at, ended_at, elapsed_seconds, active_seconds, conclusion,
+      conclusion_at, transcript_fingerprint, extracted_at
+    ) VALUES (
+      @sessionId, @provider, @projectId, @projectPath, @projectName, @sessionName,
+      @startedAt, @endedAt, @elapsedSeconds, @activeSeconds, @conclusion,
+      @conclusionAt, @transcriptFingerprint, @extractedAt
+    )
+    ON CONFLICT(session_id) DO UPDATE SET
+      provider = excluded.provider,
+      project_id = excluded.project_id,
+      project_path = excluded.project_path,
+      project_name = excluded.project_name,
+      session_name = excluded.session_name,
+      started_at = excluded.started_at,
+      ended_at = excluded.ended_at,
+      elapsed_seconds = excluded.elapsed_seconds,
+      active_seconds = excluded.active_seconds,
+      conclusion = excluded.conclusion,
+      conclusion_at = excluded.conclusion_at,
+      transcript_fingerprint = excluded.transcript_fingerprint,
+      extracted_at = excluded.extracted_at
+  `);
+  const findBySessionId = database.prepare('SELECT * FROM timesheet_sessions WHERE session_id = ?');
+  const listAll = database.prepare('SELECT * FROM timesheet_sessions ORDER BY datetime(started_at) DESC, session_id DESC');
+  const listByProject = database.prepare('SELECT * FROM timesheet_sessions WHERE project_id = ? ORDER BY datetime(started_at) DESC, session_id DESC');
+
+  return {
+    databasePath,
+    upsert(entry: TimesheetEntry): void {
+      upsert.run(entry);
+      secureDatabaseFiles(databasePath);
+    },
+    findBySessionId(sessionId: string): TimesheetEntry | null {
+      const row = findBySessionId.get(sessionId) as TimesheetEntryRow | undefined;
+      return row ? toEntry(row) : null;
+    },
+    list(projectId?: string): TimesheetEntry[] {
+      const rows = (projectId ? listByProject.all(projectId) : listAll.all()) as TimesheetEntryRow[];
+      return rows.map(toEntry);
+    },
+    close(): void {
+      if (database.open) database.close();
+    },
+  };
+}

package/server/piecemaker/vendor/.env

@@ -0,0 +1,2 @@
+PYTHON_PATH=/Users/tsardet/.piecemaker/venv/bin/python
+SMART_CONVERTER_PATH=/Users/tsardet/Documents/GitHub/piecemaker-droit-francais/server/piecemaker/vendor/websocket-server/scripts/smart_converter.py

package/server/piecemaker/vendor/installer/assets/PieceMakerApp.swift

@@ -0,0 +1,189 @@
+import Cocoa
+import WebKit
+
+private let kAdminURL = "https://localhost:43098/admin/"
+private let kRetryInterval: TimeInterval = 1.0
+private let kMaxRetries = 30
+private let kSections = [
+    (label: "Dossiers", id: "history"),
+    (label: "Configuration", id: "configuration"),
+    (label: "Tampon et pièces", id: "pieces"),
+    (label: "Skills et agents", id: "files"),
+]
+
+class AppDelegate: NSObject, NSApplicationDelegate {
+    var window: NSWindow!
+    var webView: WKWebView!
+    var sectionControl: NSSegmentedControl!
+    var statusLabel: NSTextField!
+    var retryCount = 0
+
+    func applicationDidFinishLaunching(_ notification: Notification) {
+        startServer()
+
+        let config = WKWebViewConfiguration()
+        config.preferences.setValue(true, forKey: "developerExtrasEnabled")
+        config.userContentController.add(self, name: "piecemakerShell")
+        config.userContentController.addUserScript(WKUserScript(
+            source: "document.documentElement.dataset.nativeShell = 'macos';",
+            injectionTime: .atDocumentStart,
+            forMainFrameOnly: true
+        ))
+        webView = WKWebView(frame: .zero, configuration: config)
+        webView.navigationDelegate = self
+
+        let screen = NSScreen.main?.visibleFrame ?? NSRect(x: 0, y: 0, width: 1200, height: 800)
+        let w: CGFloat = min(1280, screen.width * 0.85)
+        let h: CGFloat = min(900, screen.height * 0.85)
+        let x = screen.origin.x + (screen.width - w) / 2
+        let y = screen.origin.y + (screen.height - h) / 2
+
+        window = NSWindow(
+            contentRect: NSRect(x: x, y: y, width: w, height: h),
+            styleMask: [.titled, .closable, .miniaturizable, .resizable],
+            backing: .buffered,
+            defer: false
+        )
+        window.title = "PieceMaker"
+        window.contentView = webView
+        installTitlebarControls()
+        window.makeKeyAndOrderFront(nil)
+
+        loadAdmin()
+    }
+
+    func applicationShouldTerminateAfterLastWindowClosed(_ sender: NSApplication) -> Bool { true }
+
+    private func installTitlebarControls() {
+        sectionControl = NSSegmentedControl(
+            labels: kSections.map { $0.label },
+            trackingMode: .selectOne,
+            target: self,
+            action: #selector(selectSection(_:))
+        )
+        sectionControl.controlSize = .small
+        sectionControl.segmentStyle = .texturedRounded
+        sectionControl.selectedSegment = 0
+        sectionControl.setAccessibilityLabel("Sections PieceMaker")
+        sectionControl.sizeToFit()
+
+        let navigationContainer = NSView(frame: NSRect(
+            x: 0,
+            y: 0,
+            width: sectionControl.frame.width + 12,
+            height: max(28, sectionControl.frame.height)
+        ))
+        sectionControl.frame.origin = NSPoint(
+            x: 6,
+            y: (navigationContainer.frame.height - sectionControl.frame.height) / 2
+        )
+        navigationContainer.addSubview(sectionControl)
+        let navigationAccessory = NSTitlebarAccessoryViewController()
+        navigationAccessory.layoutAttribute = .left
+        navigationAccessory.view = navigationContainer
+        window.addTitlebarAccessoryViewController(navigationAccessory)
+
+        statusLabel = NSTextField(labelWithString: "Connexion…")
+        statusLabel.font = .systemFont(ofSize: 11, weight: .semibold)
+        statusLabel.textColor = .secondaryLabelColor
+        statusLabel.alignment = .right
+        statusLabel.sizeToFit()
+        let statusContainer = NSView(frame: NSRect(x: 0, y: 0, width: 142, height: 28))
+        statusLabel.frame = NSRect(x: 0, y: 5, width: 134, height: 18)
+        statusContainer.addSubview(statusLabel)
+        let statusAccessory = NSTitlebarAccessoryViewController()
+        statusAccessory.layoutAttribute = .right
+        statusAccessory.view = statusContainer
+        window.addTitlebarAccessoryViewController(statusAccessory)
+    }
+
+    @objc private func selectSection(_ sender: NSSegmentedControl) {
+        guard sender.selectedSegment >= 0, sender.selectedSegment < kSections.count else { return }
+        let section = kSections[sender.selectedSegment].id
+        webView.evaluateJavaScript("window.piecemakerNavigateTo?.('\(section)')")
+    }
+
+    private func startServer() {
+        var node = "/usr/local/bin/node"
+        var cli = NSString(string: "~/PieceMaker/installer/bin/piecemaker.mjs").expandingTildeInPath
+
+        if let bundlePlist = Bundle.main.url(forResource: "environment", withExtension: "plist"),
+           let dict = NSDictionary(contentsOf: bundlePlist) {
+            if let n = dict["PIECEMAKER_NODE"] as? String { node = n }
+            if let c = dict["PIECEMAKER_CLI"] as? String { cli = c }
+        }
+        if let n = ProcessInfo.processInfo.environment["PIECEMAKER_NODE"] { node = n }
+        if let c = ProcessInfo.processInfo.environment["PIECEMAKER_CLI"] { cli = c }
+
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: node)
+        process.arguments = [cli, "start"]
+        process.standardOutput = FileHandle.nullDevice
+        process.standardError = FileHandle.nullDevice
+        try? process.run()
+        process.waitUntilExit()
+    }
+
+    private func loadAdmin() {
+        guard let url = URL(string: kAdminURL) else { return }
+        webView.load(URLRequest(url: url, cachePolicy: .reloadIgnoringLocalCacheData))
+    }
+}
+
+extension AppDelegate: WKScriptMessageHandler {
+    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
+        guard message.name == "piecemakerShell",
+              let payload = message.body as? [String: Any],
+              let kind = payload["kind"] as? String else { return }
+
+        if kind == "section", let section = payload["value"] as? String,
+           let index = kSections.firstIndex(where: { $0.id == section }) {
+            sectionControl.selectedSegment = index
+            return
+        }
+
+        if kind == "status", let label = payload["label"] as? String {
+            statusLabel.stringValue = label
+            statusLabel.textColor = payload["value"] as? String == "ok" ? .systemGreen : .systemRed
+        }
+    }
+}
+
+extension AppDelegate: WKNavigationDelegate {
+    func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
+        retryCount += 1
+        guard retryCount <= kMaxRetries else {
+            webView.loadHTMLString(
+                "<html><body style='font-family:system-ui;padding:40px;color:#666'>"
+                + "<h2>Serveur inaccessible</h2>"
+                + "<p>Le serveur local PieceMaker n'a pas répondu après \(kMaxRetries) tentatives.</p>"
+                + "<p>Lancez <code>piecemaker start</code> dans le terminal, puis réessayez.</p>"
+                + "</body></html>",
+                baseURL: nil
+            )
+            return
+        }
+        DispatchQueue.main.asyncAfter(deadline: .now() + kRetryInterval) { [weak self] in
+            self?.loadAdmin()
+        }
+    }
+
+    func webView(
+        _ webView: WKWebView,
+        respondTo challenge: URLAuthenticationChallenge
+    ) async -> (URLSession.AuthChallengeDisposition, URLCredential?) {
+        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
+              challenge.protectionSpace.host == "localhost",
+              let trust = challenge.protectionSpace.serverTrust else {
+            return (.performDefaultHandling, nil)
+        }
+        return (.useCredential, URLCredential(trust: trust))
+    }
+}
+
+let app = NSApplication.shared
+let delegate = AppDelegate()
+app.delegate = delegate
+app.setActivationPolicy(.regular)
+app.activate(ignoringOtherApps: true)
+app.run()