@runeya/runeya 2.0.106 → 2.0.108

package/{src-US4EBM64.js → src-LONZKLMU.js}

@@ -11,6 +11,9 @@ import {
   NameSchema,
   OPENAI_COMPAT_BASE_URLS,
   OptionalProviderIdSchema,
+  accountForOrg,
+  accountForOrgOrThrow,
+  accountForOrgScope,
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
@@ -40,6 +43,7 @@ import {
   orgCloudUrl,
   protectedProcedure,
   publicProcedure,
+  readCloudIdentity,
   registerHttpServer,
   requireEnvAction,
   requireLoopbackOrToken,
@@ -56,9 +60,10 @@ import {
   serviceRouter,
   setLanMode,
   shutdownCodexAppServer,
+  soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-YQISK6BL.js";
+} from "./chunk-4SJCPFGK.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -81,7 +86,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-CQCCVPTX.js";
+} from "./chunk-DS66SEYH.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -120,10 +125,10 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-NPORVPEO.js";
+} from "./chunk-RIITTBK3.js";
 import {
   settingsManager
-} from "./chunk-5GYBAMHV.js";
+} from "./chunk-D2PF2FYU.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -166,14 +171,16 @@ import {
   machineRoot,
   orgVaultRoot,
   projectVaultRoot,
+  readOrgAccounts,
   readOrgClouds,
   readOrgLogo,
   readOrgLogos,
   readOrgNames,
+  rememberOrgAccount,
   rememberOrgLogo,
   rememberOrgName,
   stampOrgCloud
-} from "./chunk-LTLOVQJQ.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -1638,6 +1645,10 @@ var setupRouter = router({
     const names = await readOrgNames();
     const clouds = await readOrgClouds();
     const currentCloud = getCloudApiUrl();
+    const ownCloudUrls = /* @__PURE__ */ new Set([
+      currentCloud,
+      ...(await cloudSessionStore.list()).map((a) => a.cloudUrl.replace(/\/+$/, ""))
+    ]);
     const [unreadableConversations, unreadableSecrets] = await Promise.all([
       conversationStore.unreadableByVault(),
       environmentStore.unreadableByVault()
@@ -1650,7 +1661,7 @@ var setupRouter = router({
       orgs: await Promise.all(orgs.map(async (orgId) => {
         const name = names[orgId] ?? null;
         const cloudUrl = clouds[orgId] ?? currentCloud;
-        const foreign = cloudUrl !== currentCloud;
+        const foreign = !ownCloudUrls.has(cloudUrl.replace(/\/+$/, ""));
         const unreadable = {
           apiKeys: await apiKeyStore.unreadableCount(orgId),
           conversations: unreadableConversations.get(orgId) ?? 0,
@@ -5801,12 +5812,22 @@ var kanbanRouter = router({
    * agent can open it with its own file tools. The bytes never go through the
    * prompt: the card context lists the attachments, this returns a path.
    */
-  downloadAttachment: protectedProcedure.input(z19.object({ attachmentId: z19.string().max(128) })).mutation(async ({ input }) => {
+  downloadAttachment: protectedProcedure.input(z19.object({
+    attachmentId: z19.string().max(128),
+    // La pièce jointe appartient à une organisation : la nommer dit sous quel
+    // compte la demander. C'est le SEUL appel qui tolère de ne pas l'avoir —
+    // un agent n'a qu'un identifiant de fichier — et il échoue alors en le
+    // disant dès que ce poste a plusieurs comptes.
+    orgId: z19.string().max(128).optional()
+  })).mutation(async ({ input }) => {
     const id = input.attachmentId;
     if (!ATTACHMENT_ID_REGEX.test(id)) {
       throw new TRPCError16({ code: "BAD_REQUEST", message: "Invalid attachment id" });
     }
-    const res = await cloudFetch2(`/api/kanban/file/${id}`, { timeoutMs: 12e4 });
+    const res = await cloudFetch2(`/api/kanban/file/${id}`, {
+      timeoutMs: 12e4,
+      accountId: input.orgId ? await accountForOrgScope(input.orgId) : await soleAccountScope()
+    });
     if (res.status === 404) {
       throw new TRPCError16({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
     }
@@ -6244,16 +6265,29 @@ async function isMaterialized(root) {
   return access(join9(root, "project.json")).then(() => true, () => false);
 }
 async function orgsToSync() {
-  const cloudUrl = getCloudApiUrl();
-  const stamps = await readOrgClouds();
-  const orgIds = /* @__PURE__ */ new Set();
+  const [stamps, stampedAccounts, accounts] = await Promise.all([
+    readOrgClouds(),
+    readOrgAccounts(),
+    cloudSessionStore.list()
+  ]);
+  const known = /* @__PURE__ */ new Set([
+    getCloudApiUrl(),
+    ...accounts.map((a) => a.cloudUrl.replace(/\/+$/, ""))
+  ]);
+  const fallback = accounts.length <= 1 ? accounts[0]?.cloudUrl.replace(/\/+$/, "") ?? getCloudApiUrl() : null;
+  const targets = /* @__PURE__ */ new Map();
   for (const vault of await listCloudVaults()) {
-    if (orgIds.has(vault.orgId)) continue;
-    const stamped = stamps[vault.orgId];
-    if (stamped && stamped.replace(/\/+$/, "") !== cloudUrl) continue;
-    if (await isMaterialized(vault.root)) orgIds.add(vault.orgId);
+    if (targets.has(vault.orgId)) continue;
+    const stamped = stamps[vault.orgId]?.replace(/\/+$/, "");
+    if (stamped ? !known.has(stamped) : fallback === null) continue;
+    const cloudUrl = stamped ?? fallback;
+    if (!cloudUrl) continue;
+    const accountId = stampedAccounts[vault.orgId] ?? (accounts.length === 1 ? accounts[0].id : void 0);
+    if (await isMaterialized(vault.root)) {
+      targets.set(vault.orgId, { orgId: vault.orgId, cloudUrl, ...accountId ? { accountId } : {} });
+    }
   }
-  return Array.from(orgIds, (orgId) => ({ orgId, cloudUrl }));
+  return Array.from(targets.values());
 }
 
 // ../server/src/services/org-canary.ts
@@ -6289,7 +6323,8 @@ async function reconcileOrgCanary(orgId) {
   if (!local) throw new CanaryUnavailableError("This machine has no key canary yet.");
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
-    body: { organizationId: orgId, canary: local }
+    body: { organizationId: orgId, canary: local },
+    accountId: await accountForOrgOrThrow(orgId)
   });
   if (!res.ok) {
     throw new CanaryUnavailableError("Could not reach the organization on the cloud.");
@@ -6514,7 +6549,7 @@ var OrgSyncConnection = class {
    * treat as terminal exactly like a rejection from the cloud.
    */
   async authHeader() {
-    const token = await cloudSessionStore.getToken();
+    const token = await cloudSessionStore.getToken(this.link.accountId);
     if (!token) throw new SyncAuthError(401);
     return `Bearer ${token}`;
   }
@@ -7362,6 +7397,10 @@ async function cloudMessage(res) {
     return "";
   }
 }
+async function accountScope(orgId) {
+  const accountId = await accountForOrg(orgId);
+  return accountId ? { accountId } : {};
+}
 async function assertOrgReadable(orgId) {
   try {
     await assertOrgVaultReadable(orgId);
@@ -7404,15 +7443,25 @@ var cloudSyncRouter = router({
     z23.object({
       orgId: z23.string().min(1).max(128),
       cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128)
+      projectId: z23.string().min(1).max(128),
+      // Le compte sous lequel cette organisation a été listée. Tamponné avec
+      // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
+      // bon token sans qu'on ait à le lui redire.
+      accountId: z23.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     await assertOrgReadable(input.orgId);
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
     if (!connected) {
       await assertOrgKey(input.orgId);
-      await stampOrgCloud(input.orgId, input.cloudUrl);
-      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
+      await cloudSyncBridge.connect({
+        orgId: input.orgId,
+        cloudUrl: input.cloudUrl,
+        ...await accountScope(input.orgId)
+      });
+    } else if (input.accountId) {
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
@@ -7441,7 +7490,11 @@ var cloudSyncRouter = router({
     z23.object({
       orgId: z23.string().min(1).max(128),
       cloudUrl: z23.string().url().max(2048),
-      projectId: z23.string().min(1).max(128)
+      projectId: z23.string().min(1).max(128),
+      // Le compte sous lequel cette organisation a été listée. Tamponné avec
+      // elle : c'est ce qui permettra à tout appel ultérieur de retrouver le
+      // bon token sans qu'on ait à le lui redire.
+      accountId: z23.string().max(64).optional()
     })
   ).mutation(async ({ input }) => {
     const local = await projectStore.get({ id: input.projectId, orgId: null });
@@ -7455,8 +7508,14 @@ var cloudSyncRouter = router({
     const connected = cloudSyncBridge.states().some((s) => s.orgId === input.orgId);
     if (!connected) {
       await assertOrgKey(input.orgId);
-      await stampOrgCloud(input.orgId, input.cloudUrl);
-      await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
+      await cloudSyncBridge.connect({
+        orgId: input.orgId,
+        cloudUrl: input.cloudUrl,
+        ...await accountScope(input.orgId)
+      });
+    } else if (input.accountId) {
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
     }
     await projectStore.moveToOrg(input.projectId, input.orgId);
     await projectPathStore.relocate(
@@ -7488,7 +7547,7 @@ var cloudSyncRouter = router({
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET" }
+      { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) {
       throw new TRPCError19({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
@@ -7511,7 +7570,7 @@ var cloudSyncRouter = router({
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET" }
+      { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) return { status: "unknown" };
     const { canary } = await res.json();
@@ -7565,7 +7624,8 @@ var cloudSyncRouter = router({
     }
     const res = await cloudFetch2("/api/auth/organization/canary/reset", {
       method: "POST",
-      body: { organizationId: input.orgId, canary }
+      body: { organizationId: input.orgId, canary },
+      accountId: await accountForOrgScope(input.orgId)
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
@@ -7575,7 +7635,7 @@ var cloudSyncRouter = router({
       });
     }
     const cloudUrl = (await orgsToSync()).find((l) => l.orgId === input.orgId)?.cloudUrl ?? getCloudApiUrl();
-    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl });
+    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl, ...await accountScope(input.orgId) });
     return { state: syncState(input.orgId) };
   }),
   /**
@@ -7612,7 +7672,10 @@ var cloudSyncRouter = router({
     try {
       res = await cloudFetch2("/api/auth/project/delete", {
         method: "POST",
-        body: { organizationId: input.orgId, projectId: input.projectId }
+        body: { organizationId: input.orgId, projectId: input.projectId },
+        // Dans le `try` : ne rien avoir à quoi rattacher l'organisation doit
+        // ressortir comme CLOUD_NOT_LINKED, pas comme une erreur interne.
+        accountId: await accountForOrgScope(input.orgId)
       });
     } catch (err) {
       if (err instanceof TRPCError19 && err.code === "PRECONDITION_FAILED") {
@@ -7649,6 +7712,35 @@ var cloudSyncRouter = router({
    * afficher. Le nom est donc recopié dans le tampon du coffre au passage, là
    * où il est déjà lu au démarrage suivant.
    */
+  /**
+   * Retenir à quel compte appartient chaque organisation.
+   *
+   * Poussé par l'interface avec ce que le cloud vient de répondre : une
+   * organisation appartient au compte qui la LISTE. Le poste ne peut pas le
+   * déduire — il l'a tenté, et il a rangé sous un compte les organisations
+   * d'un autre. Même forme que `rememberOrgNames`, et pour la même raison :
+   * ce que seul le cloud sait, on le recopie quand il le dit.
+   */
+  rememberOrgAccounts: protectedProcedure.input(z23.object({
+    orgs: z23.array(z23.object({
+      orgId: z23.string().min(1).max(128),
+      accountId: z23.string().min(1).max(64)
+    })).max(200)
+  })).mutation(async ({ input }) => {
+    const candidates = /* @__PURE__ */ new Map();
+    for (const { orgId, accountId } of input.orgs) {
+      candidates.set(orgId, [...candidates.get(orgId) ?? [], accountId]);
+    }
+    const current2 = await readOrgAccounts();
+    let remembered = 0;
+    for (const [orgId, accountIds] of candidates) {
+      const kept = current2[orgId];
+      if (kept && accountIds.includes(kept)) continue;
+      await rememberOrgAccount(orgId, accountIds[0]);
+      remembered++;
+    }
+    return { remembered };
+  }),
   rememberOrgNames: protectedProcedure.input(z23.object({
     orgs: z23.array(z23.object({
       orgId: z23.string().min(1).max(128),
@@ -9568,7 +9660,12 @@ async function createLocalServer() {
         res.status(502).send("The cloud did not return a session token.");
         return;
       }
-      await cloudSessionStore.set(getCloudApiUrl(), sessionToken);
+      const identity = await readCloudIdentity(getCloudApiUrl(), sessionToken);
+      if (!identity) {
+        res.status(502).send("The cloud did not say who this session belongs to.");
+        return;
+      }
+      await cloudSessionStore.add(getCloudApiUrl(), sessionToken, identity);
       void cloudSyncBridge.resumeAll();
       res.redirect(`${returnTo}?cloud=linked`);
     } catch {
@@ -9589,16 +9686,18 @@ async function createLocalServer() {
         res.status(400).end();
         return;
       }
-      const token = await cloudSessionStore.getToken();
-      if (!token) {
+      const accountId = await accountForOrg(organizationId);
+      const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
+      if (!accountId || !token) {
         res.status(401).end();
         return;
       }
+      const streamBase = await orgCloudUrl(organizationId);
       const upstreamAbort = new AbortController();
       req.on("close", () => upstreamAbort.abort());
       try {
         const upstream = await fetch(
-          `${getCloudApiUrl()}${upstreamPath}?organizationId=${encodeURIComponent(organizationId)}`,
+          `${streamBase.replace(/\/+$/, "")}${upstreamPath}?organizationId=${encodeURIComponent(organizationId)}`,
           {
             headers: {
               Authorization: `Bearer ${token}`,
@@ -9647,16 +9746,18 @@ async function createLocalServer() {
         res.status(400).end();
         return;
       }
-      const token = await cloudSessionStore.getToken();
-      if (!token) {
+      const accountId = await accountForOrg(organizationId);
+      const token = accountId ? await cloudSessionStore.getToken(accountId) : null;
+      if (!accountId || !token) {
         res.status(401).end();
         return;
       }
+      const streamBase = await orgCloudUrl(organizationId);
       const upstreamQuery = new URLSearchParams({ organizationId });
       if (typeof req.query["name"] === "string") upstreamQuery.set("name", req.query["name"]);
       try {
         const upstream = await fetch(
-          `${getCloudApiUrl()}/api/kanban/image?${upstreamQuery.toString()}`,
+          `${streamBase.replace(/\/+$/, "")}/api/kanban/image?${upstreamQuery.toString()}`,
           {
             method: "POST",
             headers: {
@@ -9683,14 +9784,16 @@ async function createLocalServer() {
       res.status(401).end();
       return;
     }
-    const token = await cloudSessionStore.getToken();
+    const fileOrgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const fileAccountId = fileOrgId ? await accountForOrg(fileOrgId) : null;
+    const token = await cloudSessionStore.getToken(fileAccountId ?? void 0);
     if (!token) {
       res.status(401).end();
       return;
     }
     try {
       const upstream = await fetch(
-        `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${fileOrgId ? await orgCloudUrl(fileOrgId) : await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           method: "DELETE",
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
@@ -9710,14 +9813,16 @@ async function createLocalServer() {
       res.status(401).end();
       return;
     }
-    const token = await cloudSessionStore.getToken();
+    const fileOrgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const fileAccountId = fileOrgId ? await accountForOrg(fileOrgId) : null;
+    const token = await cloudSessionStore.getToken(fileAccountId ?? void 0);
     if (!token) {
       res.status(401).end();
       return;
     }
     try {
       const upstream = await fetch(
-        `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${fileOrgId ? await orgCloudUrl(fileOrgId) : await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
           signal: AbortSignal.timeout(3e5)
@@ -9737,6 +9842,33 @@ async function createLocalServer() {
       res.status(502).end();
     }
   });
+  app.get("/api/cloud/avatar/:userId", async (req, res) => {
+    const userId = req.params.userId;
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(userId)) {
+      res.status(400).end();
+      return;
+    }
+    const orgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const accountId = typeof req.query["accountId"] === "string" ? req.query["accountId"] : "";
+    try {
+      const base = orgId ? await orgCloudUrl(orgId) : await cloudSessionStore.getCloudUrl(accountId || void 0) ?? getCloudApiUrl();
+      const upstream = await fetch(`${base}/api/avatar/${encodeURIComponent(userId)}`, {
+        headers: { [APP_VERSION_HEADER]: appVersion },
+        signal: AbortSignal.timeout(15e3)
+      });
+      if (!upstream.ok) {
+        res.status(upstream.status).end();
+        return;
+      }
+      res.set("Content-Type", upstream.headers.get("content-type") ?? "application/octet-stream");
+      res.set("X-Content-Type-Options", "nosniff");
+      res.set("Content-Security-Policy", "default-src 'none'; sandbox");
+      res.set("Cache-Control", "public, max-age=300");
+      res.send(Buffer.from(await upstream.arrayBuffer()));
+    } catch {
+      res.status(502).end();
+    }
+  });
   proxyCloudStream("/api/cloud/chat/stream", "/api/chat/stream");
   proxyCloudStream("/api/cloud/kanban/stream", "/api/kanban/stream");
   app.post("/api/unlock", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
@@ -10117,7 +10249,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-7AFRBUQI.js");
+  const { initCompanion } = await import("./companion-EPINTIC7.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10564,4 +10696,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-US4EBM64.js.map
+//# sourceMappingURL=src-LONZKLMU.js.map