@runeya/runeya 2.0.106 → 2.0.107

package/{src-US4EBM64.js → src-MILB2SQA.js}

@@ -11,6 +11,7 @@ import {
   NameSchema,
   OPENAI_COMPAT_BASE_URLS,
   OptionalProviderIdSchema,
+  accountForOrg,
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
@@ -40,6 +41,7 @@ import {
   orgCloudUrl,
   protectedProcedure,
   publicProcedure,
+  readCloudIdentity,
   registerHttpServer,
   requireEnvAction,
   requireLoopbackOrToken,
@@ -58,7 +60,7 @@ import {
   shutdownCodexAppServer,
   startCliSession,
   vaultOfProject
-} from "./chunk-YQISK6BL.js";
+} from "./chunk-JNI4CXJ7.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -81,7 +83,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-CQCCVPTX.js";
+} from "./chunk-TE57T5GO.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -120,10 +122,10 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-NPORVPEO.js";
+} from "./chunk-ELI2TELD.js";
 import {
   settingsManager
-} from "./chunk-5GYBAMHV.js";
+} from "./chunk-ZDHLWTHW.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -155,6 +157,7 @@ import {
   writeEntity
 } from "./chunk-QRMG6GMX.js";
 import {
+  adoptUnstampedOrgs,
   env,
   forgetOrgLogo,
   keyRoot,
@@ -166,6 +169,7 @@ import {
   machineRoot,
   orgVaultRoot,
   projectVaultRoot,
+  readOrgAccounts,
   readOrgClouds,
   readOrgLogo,
   readOrgLogos,
@@ -173,7 +177,7 @@ import {
   rememberOrgLogo,
   rememberOrgName,
   stampOrgCloud
-} from "./chunk-LTLOVQJQ.js";
+} from "./chunk-J3NAI636.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -1638,6 +1642,10 @@ var setupRouter = router({
     const names = await readOrgNames();
     const clouds = await readOrgClouds();
     const currentCloud = getCloudApiUrl();
+    const ownCloudUrls = /* @__PURE__ */ new Set([
+      currentCloud,
+      ...(await cloudSessionStore.list()).map((a) => a.cloudUrl.replace(/\/+$/, ""))
+    ]);
     const [unreadableConversations, unreadableSecrets] = await Promise.all([
       conversationStore.unreadableByVault(),
       environmentStore.unreadableByVault()
@@ -1650,7 +1658,7 @@ var setupRouter = router({
       orgs: await Promise.all(orgs.map(async (orgId) => {
         const name = names[orgId] ?? null;
         const cloudUrl = clouds[orgId] ?? currentCloud;
-        const foreign = cloudUrl !== currentCloud;
+        const foreign = !ownCloudUrls.has(cloudUrl.replace(/\/+$/, ""));
         const unreadable = {
           apiKeys: await apiKeyStore.unreadableCount(orgId),
           conversations: unreadableConversations.get(orgId) ?? 0,
@@ -5801,12 +5809,21 @@ var kanbanRouter = router({
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z19.object({ attachmentId: z19.string().max(128) })).mutation(async ({ input }) => {
+  downloadAttachment: protectedProcedure.input(z19.object({
+    attachmentId: z19.string().max(128),
+    // La pièce jointe appartient à une organisation : la nommer dit sous quel
+    // compte la demander. Omise, c'est le compte unique du poste — la
+    // situation d'avant le multicompte.
+    orgId: z19.string().max(128).optional()
+  })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
       throw new TRPCError16({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
-    const res = await cloudFetch2(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
+    const res = await cloudFetch2(`/api/kanban/file/${id}`, {
+      timeoutMs: 12e4,
+      ...input.orgId ? { orgId: input.orgId } : {}
+    });
     if (res.status === 404) {
       throw new TRPCError16({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
@@ -6244,16 +6261,29 @@ async function isMaterialized(root) {
   return access(join9(root, "project.json")).then(() => true, () => false);
 }
 async function orgsToSync() {
-  const cloudUrl = getCloudApiUrl();
-  const stamps = await readOrgClouds();
-  const orgIds = /* @__PURE__ */ new Set();
+  const [stamps, stampedAccounts, accounts] = await Promise.all([
+    readOrgClouds(),
+    readOrgAccounts(),
+    cloudSessionStore.list()
+  ]);
+  const known = /* @__PURE__ */ new Set([
+    getCloudApiUrl(),
+    ...accounts.map((a) => a.cloudUrl.replace(/\/+$/, ""))
+  ]);
+  const fallback = accounts.length <= 1 ? accounts[0]?.cloudUrl.replace(/\/+$/, "") ?? getCloudApiUrl() : null;
+  const targets = /* @__PURE__ */ new Map();
   for (const vault of await listCloudVaults()) {
-    if (orgIds.has(vault.orgId)) continue;
-    const stamped = stamps[vault.orgId];
-    if (stamped && stamped.replace(/\/+$/, "") !== cloudUrl) continue;
-    if (await isMaterialized(vault.root)) orgIds.add(vault.orgId);
+    if (targets.has(vault.orgId)) continue;
+    const stamped = stamps[vault.orgId]?.replace(/\/+$/, "");
+    if (stamped ? !known.has(stamped) : fallback === null) continue;
+    const cloudUrl = stamped ?? fallback;
+    if (!cloudUrl) continue;
+    const accountId = stampedAccounts[vault.orgId] ?? (accounts.length === 1 ? accounts[0].id : void 0);
+    if (await isMaterialized(vault.root)) {
+      targets.set(vault.orgId, { orgId: vault.orgId, cloudUrl, ...accountId ? { accountId } : {} });
+    }
   }
-  return Array.from(orgIds, (orgId) => ({ orgId, cloudUrl }));
+  return Array.from(targets.values());
 }
 
 // ../server/src/services/org-canary.ts
@@ -6289,7 +6319,8 @@ async function reconcileOrgCanary(orgId) {
   if (!local) throw new CanaryUnavailableError("This machine has no key canary yet.");
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
-    body: { organizationId: orgId, canary: local }
+    body: { organizationId: orgId, canary: local },
+    orgId
   });
   if (!res.ok) {
     throw new CanaryUnavailableError("Could not reach the organization on the cloud.");
@@ -6514,7 +6545,7 @@ var OrgSyncConnection = class {
    * treat as terminal exactly like a rejection from the cloud.
    */
   async authHeader() {
-    const token = await cloudSessionStore.getToken();
+    const token = await cloudSessionStore.getToken(this.link.accountId);
     if (!token) throw new SyncAuthError(401);
     return `Bearer ${token}`;
   }
@@ -7362,6 +7393,10 @@ async function cloudMessage(res) {
     return "";
   }
 }
+async function accountScope(orgId) {
+  const accountId = await accountForOrg(orgId);
+  return accountId ? { accountId } : {};
+}
 async function assertOrgReadable(orgId) {
   try {
     await assertOrgVaultReadable(orgId);
@@ -7404,15 +7439,23 @@ var cloudSyncRouter = router({
     z23.object({
       orgId: z23.string().min(1).max(128),
       cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128)
+      projectId: z23.string().min(1).max(128),
+      // Le compte sous lequel cette organisation a été listée. Tamponné avec
+      // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
+      // bon token sans qu'on ait à le lui redire.
+      accountId: z23.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
     if (!connected) {
       await assertOrgKey(input.orgId);
-      await stampOrgCloud(input.orgId, input.cloudUrl);
-      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
+      await cloudSyncBridge.connect({
+        orgId: input.orgId,
+        cloudUrl: input.cloudUrl,
+        ...await accountScope(input.orgId)
+      });
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
@@ -7441,7 +7484,11 @@ var cloudSyncRouter = router({
     z23.object({
       orgId: z23.string().min(1).max(128),
       cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128)
+      projectId: z23.string().min(1).max(128),
+      // Le compte sous lequel cette organisation a été listée. Tamponné avec
+      // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
+      // bon token sans qu'on ait à le lui redire.
+      accountId: z23.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
@@ -7455,8 +7502,12 @@ var cloudSyncRouter = router({
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
     if (!connected) {
       await assertOrgKey(input.orgId);
-      await stampOrgCloud(input.orgId, input.cloudUrl);
-      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
+      await cloudSyncBridge.connect({
+        orgId: input.orgId,
+        cloudUrl: input.cloudUrl,
+        ...await accountScope(input.orgId)
+      });
     }
     await projectStore.moveToOrg(input.projectId, input.orgId);
     await projectPathStore.relocate(
@@ -7488,7 +7539,7 @@ var cloudSyncRouter = router({
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET" }
+      { method: "GET", orgId: input.orgId }
     );
     if (!res.ok) {
       throw new TRPCError19({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
@@ -7511,7 +7562,7 @@ var cloudSyncRouter = router({
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET" }
+      { method: "GET", orgId: input.orgId }
     );
     if (!res.ok) return { status: "unknown" };
     const { canary } = await res.json();
@@ -7565,7 +7616,8 @@ var cloudSyncRouter = router({
     }
     const res = await cloudFetch2("/api/auth/organization/canary/reset", {
       method: "POST",
-      body: { organizationId: input.orgId, canary }
+      body: { organizationId: input.orgId, canary },
+      orgId: input.orgId
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
@@ -7575,7 +7627,7 @@ var cloudSyncRouter = router({
       });
     }
     const cloudUrl = (await orgsToSync()).find((l) => l.orgId === input.orgId)?.cloudUrl ?? getCloudApiUrl();
-    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl });
+    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl, ...await accountScope(input.orgId) });
     return { state: syncState(input.orgId) };
   }),
   /**
@@ -7612,7 +7664,8 @@ var cloudSyncRouter = router({
     try {
       res = await cloudFetch2("/api/auth/project/delete", {
         method: "POST",
-        body: { organizationId: input.orgId, projectId: input.projectId }
+        body: { organizationId: input.orgId, projectId: input.projectId },
+        orgId: input.orgId
       });
     } catch (err) {
       if (err instanceof TRPCError19 && err.code === "PRECONDITION_FAILED") {
@@ -9568,7 +9621,19 @@ async function createLocalServer() {
         res.status(502).send("The cloud did not return a session token.");
         return;
       }
-      await cloudSessionStore.set(getCloudApiUrl(), sessionToken);
+      const identity = await readCloudIdentity(getCloudApiUrl(), sessionToken);
+      if (!identity) {
+        res.status(502).send("The cloud did not say who this session belongs to.");
+        return;
+      }
+      const before = await cloudSessionStore.list();
+      if (before.length === 1 && before[0].userId !== identity.userId) {
+        const adopted = await adoptUnstampedOrgs(before[0].id);
+        if (adopted.length > 0) {
+          console.log(`[cloud] ${adopted.length} organisation(s) rattach\xE9e(s) au compte ${before[0].email || before[0].id}`);
+        }
+      }
+      await cloudSessionStore.add(getCloudApiUrl(), sessionToken, identity);
       void cloudSyncBridge.resumeAll();
       res.redirect(`${returnTo}?cloud=linked`);
     } catch {
@@ -9589,16 +9654,18 @@ async function createLocalServer() {
         res.status(400).end();
         return;
       }
-      const token = await cloudSessionStore.getToken();
-      if (!token) {
+      const accountId = await accountForOrg(organizationId);
+      const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
+      if (!accountId || !token) {
         res.status(401).end();
         return;
       }
+      const streamBase = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
       const upstreamAbort = new AbortController();
       req.on("close", () => upstreamAbort.abort());
       try {
         const upstream = await fetch(
-          `${getCloudApiUrl()}${upstreamPath}?organizationId=${encodeURIComponent(organizationId)}`,
+          `${streamBase.replace(/\/+$/, "")}${upstreamPath}?organizationId=${encodeURIComponent(organizationId)}`,
           {
             headers: {
               Authorization: `Bearer ${token}`,
@@ -9647,16 +9714,18 @@ async function createLocalServer() {
         res.status(400).end();
         return;
       }
-      const token = await cloudSessionStore.getToken();
-      if (!token) {
+      const accountId = await accountForOrg(organizationId);
+      const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
+      if (!accountId || !token) {
         res.status(401).end();
         return;
       }
+      const streamBase = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
       const upstreamQuery = new URLSearchParams({ organizationId });
       if (typeof req.query["name"] === "string") upstreamQuery.set("name", req.query["name"]);
       try {
         const upstream = await fetch(
-          `${getCloudApiUrl()}/api/kanban/image?${upstreamQuery.toString()}`,
+          `${streamBase.replace(/\/+$/, "")}/api/kanban/image?${upstreamQuery.toString()}`,
           {
             method: "POST",
             headers: {
@@ -9683,14 +9752,16 @@ async function createLocalServer() {
       res.status(401).end();
       return;
     }
-    const token = await cloudSessionStore.getToken();
+    const fileOrgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const fileAccountId = fileOrgId ? await accountForOrg(fileOrgId) : null;
+    const token = await cloudSessionStore.getToken(fileAccountId ?? void 0);
     if (!token) {
       res.status(401).end();
       return;
     }
     try {
       const upstream = await fetch(
-        `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${(await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()).replace(/\/+$/, "")}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           method: "DELETE",
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
@@ -9710,14 +9781,16 @@ async function createLocalServer() {
       res.status(401).end();
       return;
     }
-    const token = await cloudSessionStore.getToken();
+    const fileOrgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const fileAccountId = fileOrgId ? await accountForOrg(fileOrgId) : null;
+    const token = await cloudSessionStore.getToken(fileAccountId ?? void 0);
     if (!token) {
       res.status(401).end();
       return;
     }
     try {
       const upstream = await fetch(
-        `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${(await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()).replace(/\/+$/, "")}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
           signal: AbortSignal.timeout(3e5)
@@ -10117,7 +10190,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-7AFRBUQI.js");
+  const { initCompanion } = await import("./companion-NZU7FNID.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10564,4 +10637,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-US4EBM64.js.map
+//# sourceMappingURL=src-MILB2SQA.js.map