@runeya/runeya 2.0.107 → 2.0.108

package/{chunk-ZDHLWTHW.js → chunk-D2PF2FYU.js}

@@ -9,7 +9,7 @@ import {
   machineFilePath,
   machineRoot,
   orgVaultRoot
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/services/settings-manager.ts
 import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
@@ -151,4 +151,4 @@ var settingsManager = new SettingsManager();
 export {
   settingsManager
 };
-//# sourceMappingURL=chunk-ZDHLWTHW.js.map
+//# sourceMappingURL=chunk-D2PF2FYU.js.map

package/{chunk-TE57T5GO.js → chunk-DS66SEYH.js}

@@ -24,7 +24,7 @@ import {
   setProjectServices,
   setProjectVault,
   wasRead
-} from "./chunk-ELI2TELD.js";
+} from "./chunk-RIITTBK3.js";
 import {
   COMPANION_RELAY_CLOSE,
   COMPANION_RELAY_OPEN,
@@ -43,7 +43,7 @@ import {
   orgIdOfRoot,
   vaultFor,
   vaultIdOfRoot
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/services/companion.ts
 import { EventEmitter as EventEmitter4 } from "events";
@@ -1881,7 +1881,7 @@ async function runCompanionForTurn(conversationId) {
   if (!hasNew) {
     return trace(conversationId, `rien de neuf \xE0 relire (${messageCount} messages)`);
   }
-  const { startCliSession } = await import("./chat-O7ZXCCKV.js");
+  const { startCliSession } = await import("./chat-WMT34BXJ.js");
   const companionConv = await ensureCompanionConversation(conv);
   const isFirstTurn = (companionConv.messages?.length ?? 0) === 0;
   const exchange = formatExchange(conv.messages, from);
@@ -1975,7 +1975,7 @@ async function deliverToMainConversation(conv, message) {
 async function attemptDelivery(conv, message) {
   if (await writeToLivePty(conv.id, message)) return "pty";
   try {
-    const { startCliSession } = await import("./chat-O7ZXCCKV.js");
+    const { startCliSession } = await import("./chat-WMT34BXJ.js");
     await startCliSession(conv.runner, conv.id, message, { jwt: await signJwt() });
     return "headless";
   } catch (err) {
@@ -1998,7 +1998,7 @@ async function writeToLivePty(conversationId, message) {
 }
 async function companionSettings() {
   try {
-    const { settingsManager } = await import("./settings-manager-Q4PZ3UD5.js");
+    const { settingsManager } = await import("./settings-manager-YSH7ZCLP.js");
     const settings = await settingsManager.getSettings();
     return settings.companion ?? { enabledByDefault: false };
   } catch {
@@ -2117,4 +2117,4 @@ export {
   companionSettings,
   initCompanion
 };
-//# sourceMappingURL=chunk-TE57T5GO.js.map
+//# sourceMappingURL=chunk-DS66SEYH.js.map

package/{chunk-ELI2TELD.js → chunk-RIITTBK3.js}

@@ -20,7 +20,7 @@ import {
   orgVaultRoot,
   vaultFor,
   vaultIdOfRoot
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/services/agent-manager.ts
 import { EventEmitter as EventEmitter2 } from "events";
@@ -3024,4 +3024,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-ELI2TELD.js.map
+//# sourceMappingURL=chunk-RIITTBK3.js.map

package/{chunk-J3NAI636.js → chunk-ZFELQG4B.js}

@@ -111,21 +111,17 @@ async function stampOrgCloud(orgId, cloudUrl, name, accountId) {
   };
   await writeFile(join(root, ORG_CLOUD_FILE), JSON.stringify(stamp, null, 2), "utf-8");
 }
-async function adoptUnstampedOrgs(accountId) {
-  const adopted = [];
-  for (const orgId of await listOrgVaults()) {
-    const file = join(orgVaultRoot(orgId), ORG_CLOUD_FILE);
-    let stamp;
-    try {
-      stamp = JSON.parse(await readFile(file, "utf-8"));
-    } catch {
-      continue;
-    }
-    if (typeof stamp["accountId"] === "string" && stamp["accountId"]) continue;
-    await writeFile(file, JSON.stringify({ ...stamp, accountId }, null, 2), "utf-8");
-    adopted.push(orgId);
+async function rememberOrgAccount(orgId, accountId) {
+  const root = orgVaultRoot(orgId);
+  if (!existsSync(root)) return;
+  const file = join(root, ORG_CLOUD_FILE);
+  let stamp = {};
+  try {
+    stamp = JSON.parse(await readFile(file, "utf-8"));
+  } catch {
   }
-  return adopted;
+  if (stamp["accountId"] === accountId) return;
+  await writeFile(file, JSON.stringify({ ...stamp, accountId }, null, 2), "utf-8");
 }
 async function renameOrgAccount(oldId, newId) {
   if (oldId === newId) return;
@@ -317,7 +313,7 @@ export {
   vaultIdOfRoot,
   vaultFor,
   stampOrgCloud,
-  adoptUnstampedOrgs,
+  rememberOrgAccount,
   renameOrgAccount,
   readOrgAccounts,
   rememberOrgName,
@@ -338,4 +334,4 @@ export {
   legacyVaultRoot,
   resetKeyRoot
 };
-//# sourceMappingURL=chunk-J3NAI636.js.map
+//# sourceMappingURL=chunk-ZFELQG4B.js.map

package/chunk-ZFELQG4B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../server/src/services/vault-resolver.ts","../../server/src/config/env.ts"],"sourcesContent":["import { join, sep } from 'node:path';\nimport { homedir } from 'node:os';\nimport { readdir, mkdir, access, readFile, writeFile, unlink } from 'node:fs/promises';\nimport { existsSync } from 'node:fs';\nimport { env } from '../config/env.js';\n\n/**\n * Where a project's files live, and which key protects them.\n *\n * Runeya holds two kinds of projects, and they do not belong in the same place.\n * A local project *is* a directory on this machine: its data belongs next to\n * the code, in `<cwd>/.runeya`. A cloud project belongs to an organization and\n * is materialized from the doc; tying it to whichever directory happened to\n * launch the server is what made the same project look \"already here\" in one\n * folder and \"to download\" in another. Cloud projects therefore live under the\n * user's home, prefixed by organization and by project.\n *\n * A vault holds a project's own data — project.json, services, environments.\n * It does NOT hold the key that protects it: one key answers for the whole\n * machine (see `keyRoot` at the bottom of this file), which is what the cloud's\n * org-wide canary already assumes.\n */\n\nexport interface Vault {\n  /** Directory holding this project's own files. */\n  root: string;\n}\n\n/** Identifies a project well enough to place it — the stored shape, or the doc's. */\nexport interface VaultTarget {\n  id: string;\n  orgId?: string | null;\n}\n\n/**\n * Ids reach us from the cloud, and they end up in filesystem paths. Anything\n * outside this alphabet — a separator, a `..`, a NUL — could walk out of the\n * home directory, so it is rejected rather than sanitized: a mangled id would\n * silently point at the wrong vault.\n */\nconst SAFE_ID = /^[A-Za-z0-9._-]{1,128}$/;\n\nfunction assertSafeId(kind: 'organization' | 'project', id: string): void {\n  if (!SAFE_ID.test(id) || id === '.' || id === '..') {\n    throw new Error(`Invalid ${kind} id for a vault path: ${JSON.stringify(id)}`);\n  }\n}\n\n/**\n * Everything that belongs to this machine rather than to a project.\n *\n * Read from `process.env` rather than the parsed config: tests that mock\n * `config/env.js` would otherwise lose the override and write cloud vaults into\n * the developer's real home directory.\n */\nexport function machineRoot(): string {\n  const override = process.env['RUNEYA_HOME'];\n  return join(override && override.length > 0 ? override : homedir(), '.runeya');\n}\n\n/**\n * The local vault: the `.runeya` of the directory the server was launched in.\n *\n * Kept on `env.DATA_DIR` so `--data-dir` and the tests keep working. That value\n * is already absolute, resolved once at boot — re-resolving it here would make\n * the vault follow the process's cwd, which is exactly what it must not do.\n */\nexport function localVaultRoot(): string {\n  return env.DATA_DIR;\n}\n\n/** The vault of an organization: its projects, and its lock. */\nexport function orgVaultRoot(orgId: string): string {\n  assertSafeId('organization', orgId);\n  return join(machineRoot(), 'orgs', orgId);\n}\n\n/** The vault of one cloud project, under its organization. */\nexport function projectVaultRoot(orgId: string, projectId: string): string {\n  assertSafeId('project', projectId);\n  return join(orgVaultRoot(orgId), 'projects', projectId);\n}\n\n/**\n * The organization a vault path belongs to, or null for the local vault.\n *\n * The layout is the authority on ownership — `~/.runeya/orgs/<org>/projects/<id>`\n * says both which project and which organization — so an entity read from a\n * vault carries its couple in the path it came from, even though its own file\n * only ever names its project.\n */\nexport function orgIdOfRoot(root: string): string | null {\n  const marker = join(machineRoot(), 'orgs') + sep;\n  if (!root.startsWith(marker)) return null;\n  const [orgId] = root.slice(marker.length).split(sep);\n  return orgId && SAFE_ID.test(orgId) ? orgId : null;\n}\n\n/**\n * La clé sous laquelle une donnée de ce coffre est chiffrée.\n *\n * L'identifiant d'organisation quand le coffre lui appartient, `undefined` pour\n * la clé machine. Le rangement décide donc du chiffrement, sans qu'aucune\n * entité ait à porter un champ de plus : le coffre où on l'écrit dit déjà à qui\n * elle est.\n */\nexport function vaultIdOfRoot(root: string): string | undefined {\n  return orgIdOfRoot(root) ?? undefined;\n}\n\n/** Where to read and write a given project. */\nexport function vaultFor(target: VaultTarget): Vault {\n  if (!target.orgId) return { root: localVaultRoot() };\n  return { root: projectVaultRoot(target.orgId, target.id) };\n}\n\n/**\n * Which cloud instance an organization's vault came from.\n *\n * `~/.runeya/orgs/` is machine-global, so a machine that has ever synced against\n * two clouds (a self-hosted or local one and the hosted one) ends up with org\n * ids from both, indistinguishable. Stamping the instance next to the vault is\n * what lets a reader tell \"an org I am not a member of\" from \"an org of a cloud\n * I am simply not signed into\" — and what keeps the sync from offering one\n * cloud's organizations to another.\n */\nconst ORG_CLOUD_FILE = 'cloud.json';\n\nexport async function stampOrgCloud(\n  orgId: string,\n  cloudUrl: string,\n  name?: string,\n  accountId?: string,\n): Promise<void> {\n  const root = orgVaultRoot(orgId);\n  // Not best-effort any more: the stamp is now what tells a later boot which\n  // cloud an org's vault came from, and syncing follows those vaults. A stamp\n  // silently skipped would leave the org to be claimed by whatever cloud is\n  // configured then — so a failure here has to stop the pull it precedes.\n  await mkdir(root, { recursive: true });\n  // Le nom rejoint le tampon plutôt qu'un fichier à lui : il se connaît au même\n  // instant, et une organisation sans nom local n'a plus qu'un hash à montrer\n  // dès que la session cloud est éteinte.\n  const known = name ?? (await readOrgNames())[orgId];\n  // Le compte rejoint le tampon pour la même raison que le cloud : il n'y en a\n  // plus un seul sur le poste, et sans lui une organisation serait interrogée\n  // avec le token du dernier utilisateur connecté — au mieux un 403, au pire\n  // les données d'un homonyme. Un `accountId` omis laisse en place celui qui y\n  // était : les appelants qui ne savent pas de quel compte ils parlent ne\n  // doivent pas effacer ce que la liaison, elle, savait.\n  const kept = accountId ?? (await readOrgAccounts())[orgId];\n  const stamp = {\n    cloudUrl,\n    ...(known ? { name: known } : {}),\n    ...(kept ? { accountId: kept } : {}),\n  };\n  await writeFile(join(root, ORG_CLOUD_FILE), JSON.stringify(stamp, null, 2), 'utf-8');\n}\n\n/**\n * Retenir le compte auquel une organisation appartient.\n *\n * Appelé avec ce que le cloud vient de répondre : une organisation appartient\n * au compte qui la LISTE, et c'est la seule source qui le sache. Le poste, lui,\n * ne peut que deviner — il l'a fait, et il a rangé sous un compte les\n * organisations d'un autre, y compris celles d'un tout autre cloud.\n *\n * Écrase donc le compte déjà tamponné : cette réponse-ci fait autorité, la\n * précédente pouvait être une supposition.\n */\nexport async function rememberOrgAccount(orgId: string, accountId: string): Promise<void> {\n  const root = orgVaultRoot(orgId);\n  // Aucun coffre : cette organisation n'a rien ici, et lui en créer un pour un\n  // simple rattachement rangerait un répertoire vide sous un compte.\n  if (!existsSync(root)) return;\n  const file = join(root, ORG_CLOUD_FILE);\n  let stamp: Record<string, unknown> = {};\n  try {\n    stamp = JSON.parse(await readFile(file, 'utf-8')) as Record<string, unknown>;\n  } catch {\n    // Pas de tampon : le rattachement en fonde un.\n  }\n  if (stamp['accountId'] === accountId) return;\n  await writeFile(file, JSON.stringify({ ...stamp, accountId }, null, 2), 'utf-8');\n}\n\n/**\n * Suivre un compte qui change d'identifiant.\n *\n * Un compte lié avant le multicompte n'a pas d'identité : son identifiant est\n * provisoire, fondé sur son seul cloud, et devient définitif au premier appel\n * qui apprend qui il est. Les tampons posés entre-temps nomment l'ancien — et\n * un tampon qui désigne un compte inexistant rend son organisation muette dès\n * qu'il y a plus d'un compte, c'est-à-dire exactement quand on en a besoin.\n */\nexport async function renameOrgAccount(oldId: string, newId: string): Promise<void> {\n  if (oldId === newId) return;\n  for (const orgId of await listOrgVaults()) {\n    const file = join(orgVaultRoot(orgId), ORG_CLOUD_FILE);\n    let stamp: Record<string, unknown>;\n    try {\n      stamp = JSON.parse(await readFile(file, 'utf-8')) as Record<string, unknown>;\n    } catch {\n      continue;\n    }\n    if (stamp['accountId'] !== oldId) continue;\n    await writeFile(file, JSON.stringify({ ...stamp, accountId: newId }, null, 2), 'utf-8');\n  }\n}\n\n/**\n * Le compte dont chaque organisation relève, lu sur le disque.\n *\n * Pendant exact de `readOrgClouds` : le cloud dit *où* frapper, le compte dit\n * *au nom de qui*. Une organisation sans compte tamponné est celle d'un coffre\n * écrit avant le multicompte ; elle retombe sur le compte unique du poste, ce\n * qui est précisément la situation qu'elle décrivait.\n */\nexport async function readOrgAccounts(): Promise<Record<string, string>> {\n  const out: Record<string, string> = {};\n  for (const orgId of await listOrgVaults()) {\n    try {\n      const raw = await readFile(join(orgVaultRoot(orgId), ORG_CLOUD_FILE), 'utf-8');\n      const id = (JSON.parse(raw) as { accountId?: unknown }).accountId;\n      if (typeof id === 'string' && id) out[orgId] = id;\n    } catch {\n      // Pas de tampon, ou pas de compte : le poste tranchera avec ce qu'il a.\n    }\n  }\n  return out;\n}\n\n/**\n * Retenir le nom d'une organisation déjà présente ici.\n *\n * Appelé quand le cloud vient de le dire, pour qu'il survive à la déconnexion.\n * Aucun COFFRE n'est créé : une organisation dont ce poste n'a rien n'a pas à\n * recevoir un répertoire pour un simple nom.\n *\n * Le tampon, lui, est écrit même s'il manque — c'est la nuance qui manquait.\n * Tous les coffres ne naissent pas d'une synchronisation : un simple\n * `settingsManager.getSettings(orgId)` crée le répertoire sans passer par\n * `stampOrgCloud`. Renoncer faute de fichier condamnait ces coffres-là à\n * n'afficher qu'un hash pour toujours, quel que soit le nombre de fois où le\n * cloud redit leur nom.\n *\n * Le tampon posé ici ne porte pas de `cloudUrl` : personne ici ne sait de quel\n * cloud vient le coffre, et l'inventer rangerait l'organisation sous le mauvais.\n * Un tampon sans cloud se lit exactement comme l'absence de tampon.\n */\nexport async function rememberOrgName(orgId: string, name: string): Promise<void> {\n  const root = orgVaultRoot(orgId);\n  if (!existsSync(root)) return;\n  const file = join(root, ORG_CLOUD_FILE);\n  let stamp: Record<string, unknown> = {};\n  try {\n    stamp = JSON.parse(await readFile(file, 'utf-8')) as Record<string, unknown>;\n  } catch {\n    // Pas de tampon, ou illisible : le nom en fonde un.\n  }\n  if (stamp['name'] === name) return;\n  await writeFile(file, JSON.stringify({ ...stamp, name }, null, 2), 'utf-8');\n}\n\n/** Le nom de chaque organisation dont le tampon en porte un. */\nexport async function readOrgNames(): Promise<Record<string, string>> {\n  const out: Record<string, string> = {};\n  for (const orgId of await listOrgVaults()) {\n    try {\n      const raw = await readFile(join(orgVaultRoot(orgId), ORG_CLOUD_FILE), 'utf-8');\n      const name = (JSON.parse(raw) as { name?: unknown }).name;\n      if (typeof name === 'string' && name) out[orgId] = name;\n    } catch {\n      // Pas de tampon, ou pas encore de nom : l'id fera l'affaire.\n    }\n  }\n  return out;\n}\n\n/**\n * Le logo d'une organisation, gardé à côté de son nom.\n *\n * Même raison d'être que le nom recopié dans le tampon : ce que le poste sait\n * de ses organisations ne doit dépendre ni d'une session cloud ni du réseau.\n * Le nom tient dans le tampon ; les octets, eux, méritent leur propre fichier —\n * `cloud.json` est relu et réécrit à chaque pull, et y mêler 40 Ko de base64\n * ferait payer l'image à des lectures qui n'en veulent pas.\n */\nconst ORG_LOGO_FILE = 'logo.json';\n\ninterface StoredLogo {\n  contentType: string;\n  base64: string;\n  fetchedAt: string;\n}\n\n/** Formats matriciels inertes, la même liste que celle acceptée par le cloud. */\nconst LOGO_TYPES = new Set(['image/png', 'image/jpeg', 'image/webp', 'image/gif']);\n\n/** Garder (ou remplacer) le logo d'une organisation présente ici. */\nexport async function rememberOrgLogo(orgId: string, contentType: string, base64: string): Promise<void> {\n  if (!LOGO_TYPES.has(contentType)) return;\n  const root = orgVaultRoot(orgId);\n  const stored: StoredLogo = { contentType, base64, fetchedAt: new Date().toISOString() };\n  await mkdir(root, { recursive: true });\n  await writeFile(join(root, ORG_LOGO_FILE), JSON.stringify(stored), 'utf-8');\n}\n\n/** Oublier le logo d'une organisation — elle n'en a plus. */\nexport async function forgetOrgLogo(orgId: string): Promise<void> {\n  try {\n    await unlink(join(orgVaultRoot(orgId), ORG_LOGO_FILE));\n  } catch {\n    // Il n'y en avait pas : c'est le résultat voulu.\n  }\n}\n\n/**\n * Le logo retenu d'une organisation : ses octets et leur type.\n *\n * Le type est revalidé à la lecture — un fichier trafiqué sur le disque ne doit\n * pas pouvoir faire servir un `image/svg+xml`, donc du script, à l'interface.\n */\nexport async function readOrgLogo(orgId: string): Promise<{ contentType: string; bytes: Uint8Array } | null> {\n  try {\n    const raw = await readFile(join(orgVaultRoot(orgId), ORG_LOGO_FILE), 'utf-8');\n    const { contentType, base64 } = JSON.parse(raw) as Partial<StoredLogo>;\n    if (typeof contentType !== 'string' || !LOGO_TYPES.has(contentType)) return null;\n    if (typeof base64 !== 'string' || !base64) return null;\n    return { contentType, bytes: new Uint8Array(Buffer.from(base64, 'base64')) };\n  } catch {\n    // Pas de logo retenu, ou fichier illisible.\n    return null;\n  }\n}\n\n/**\n * Les logos retenus, en data URL, prêts pour un `src`.\n *\n * Le type est revalidé à la lecture : un fichier trafiqué sur le disque ne doit\n * pas pouvoir faire servir un `image/svg+xml` — donc du script — à l'interface.\n */\nexport async function readOrgLogos(): Promise<Record<string, string>> {\n  const out: Record<string, string> = {};\n  for (const orgId of await listOrgVaults()) {\n    const logo = await readOrgLogo(orgId);\n    // Pas de logo retenu : l'initiale fera l'affaire.\n    if (logo) out[orgId] = `data:${logo.contentType};base64,${Buffer.from(logo.bytes).toString('base64')}`;\n  }\n  return out;\n}\n\n/** The cloud instance of every org vault that carries a stamp. */\nexport async function readOrgClouds(): Promise<Record<string, string>> {\n  const orgsDir = join(machineRoot(), 'orgs');\n  const out: Record<string, string> = {};\n  let orgIds: string[];\n  try {\n    orgIds = (await readdir(orgsDir, { withFileTypes: true }))\n      .filter((e) => e.isDirectory() && SAFE_ID.test(e.name))\n      .map((e) => e.name);\n  } catch {\n    return out;\n  }\n  for (const orgId of orgIds) {\n    try {\n      const raw = await readFile(join(orgsDir, orgId, ORG_CLOUD_FILE), 'utf-8');\n      const url = (JSON.parse(raw) as { cloudUrl?: unknown }).cloudUrl;\n      if (typeof url === 'string' && url) out[orgId] = url;\n    } catch {\n      // No stamp (older vault, or never linked here) — simply unknown.\n    }\n  }\n  return out;\n}\n\n/**\n * Les organisations présentes sur ce disque, projets ou non.\n *\n * Distinct de `listCloudVaults`, qui ne voit une organisation qu'à travers ses\n * projets matérialisés : une organisation peut porter des données à elle —\n * agents, clés d'API — sans qu'aucun projet n'ait encore été ouvert ici, et\n * l'ignorer alors reviendrait à les perdre au prochain démarrage.\n */\nexport async function listOrgVaults(): Promise<string[]> {\n  const orgsDir = join(machineRoot(), 'orgs');\n  try {\n    return (await readdir(orgsDir, { withFileTypes: true }))\n      .filter((e) => e.isDirectory() && SAFE_ID.test(e.name))\n      .map((e) => e.name);\n  } catch {\n    return [];\n  }\n}\n\n/** One cloud project vault found on disk. */\nexport interface CloudVault {\n  orgId: string;\n  projectId: string;\n  root: string;\n}\n\n/**\n * Every cloud project vault present on this machine, by walking\n * `~/.runeya/orgs/<orgId>/projects/<projectId>`.\n *\n * Discovery reads the disk rather than an index on purpose: an index is one\n * more thing that can disagree with what is actually there, and a project\n * present on disk but missing from it is precisely the \"already here, still\n * offered as a download\" bug. Unreadable or foreign directories are skipped in\n * silence — a half-written pull must not take a whole load down.\n */\nexport async function listCloudVaults(): Promise<CloudVault[]> {\n  const orgsDir = join(machineRoot(), 'orgs');\n  const found: CloudVault[] = [];\n\n  let orgIds: string[];\n  try {\n    orgIds = (await readdir(orgsDir, { withFileTypes: true }))\n      .filter((e) => e.isDirectory() && SAFE_ID.test(e.name))\n      .map((e) => e.name);\n  } catch {\n    return found;\n  }\n\n  for (const orgId of orgIds) {\n    const projectsDir = join(orgsDir, orgId, 'projects');\n    try {\n      for (const entry of await readdir(projectsDir, { withFileTypes: true })) {\n        if (!entry.isDirectory() || !SAFE_ID.test(entry.name)) continue;\n        const root = join(projectsDir, entry.name);\n        // Un répertoire n'est pas un projet : il faut qu'il en porte la fiche.\n        //\n        // Tout ce qui traînait ici était pris pour un coffre — une copie de\n        // sauvegarde, un dossier oublié — et les stores le lisaient, le\n        // comptaient, pouvaient le réécrire. Une sauvegarde déposée à côté\n        // d'un projet s'est ainsi retrouvée annoncée comme dix-neuf\n        // conversations illisibles appartenant à l'organisation.\n        //\n        // `project.json` est déjà ce qui fait foi ailleurs (`isMaterialized`\n        // dans org-sync-scope) : la même règle vaut ici, pour tout le monde.\n        if (!(await access(join(root, 'project.json')).then(() => true, () => false))) continue;\n        found.push({ orgId, projectId: entry.name, root });\n      }\n    } catch {\n      // Org directory without materialized projects yet.\n    }\n  }\n  return found;\n}\n\n/**\n * Every vault holding data, local first — what stores must read to see it all.\n *\n * Derived from the disk, so it needs no store to have loaded beforehand: a\n * content store can resolve where to read without waiting on the project store.\n */\nexport async function allVaultRoots(): Promise<string[]> {\n  const cloud = await listCloudVaults();\n  return [localVaultRoot(), ...cloud.map((v) => v.root)];\n}\n\n/**\n * A file belonging to the machine rather than to any project.\n *\n * Settings, the audit log, caches: none of them describe a project, and keeping\n * them in the launch directory forced a `.runeya` to exist for someone working\n * only on cloud projects — the very thing vaults remove.\n *\n * For anything ENCRYPTED, use `keyedFilePath` instead.\n */\nexport function machineFilePath(filename: string): string {\n  return join(machineRoot(), filename);\n}\n\n/**\n * A machine file whose contents are encrypted.\n *\n * It lives beside the key that opens it, never merely beside the machine. The\n * two are usually the same directory — but a launch directory that owns its own\n * key keeps it (see `keyRoot`), and a file encrypted under that key read from\n * elsewhere would decrypt to blanks, then be saved back blank. Tying the file to\n * its key is what makes that impossible.\n */\nexport async function keyedFilePath(filename: string): Promise<string> {\n  return join(await keyRoot(), filename);\n}\n\n/**\n * Where such a file was kept by earlier versions: in the launch directory.\n *\n * Read as a fallback and never written, so a directory shared with an older\n * Runeya keeps working.\n */\nexport function legacyMachineFilePath(filename: string): string {\n  return join(localVaultRoot(), filename);\n}\n\n/**\n * Create the local vault, on the way to writing a local project into it.\n *\n * The directory is created here and nowhere else. Runeya no longer makes a\n * `.runeya` just because it was started somewhere: a machine used only for\n * cloud projects should leave the directories it visits untouched, and a\n * `.runeya` appearing in a repository should mean \"there is a local project\n * here\" rather than \"Runeya ran here once\".\n */\nexport async function ensureLocalVault(): Promise<string> {\n  const root = localVaultRoot();\n  await mkdir(root, { recursive: true });\n  return root;\n}\n\n/** Files that mark a directory as already holding an encryption key. */\nconst KEY_FILES = ['.encryption.key.enc', '.runeya-verify'];\n\nlet keyRootPromise: Promise<string> | null = null;\n\n/** True when a directory already holds an encryption key of its own. */\nasync function holdsKey(root: string): Promise<boolean> {\n  for (const filename of KEY_FILES) {\n    try {\n      await access(join(root, filename));\n      return true;\n    } catch {\n      // Not here — keep looking.\n    }\n  }\n  return false;\n}\n\n/**\n * Where this machine's encryption key and its canary live.\n *\n * The key protects everything on the machine — agents, sessions, and the\n * environments of every vault — so there is one, not one per vault, and the\n * machine root is its home.\n *\n * Earlier versions let a launch directory keep a key of its own, which is how a\n * machine ended up with several master passwords and several cloud identities.\n * Such a directory is no longer promoted: the machine key answers as soon as it\n * exists, and the leftover local key is surfaced by `legacyVaultRoot()` so it\n * can be migrated rather than silently obeyed. A machine that has never had a\n * machine key still falls back to the local one, so an un-migrated install\n * keeps opening exactly as before.\n *\n * Resolved once per process: the answer must not change under a running server,\n * and a key written mid-session would otherwise move its own home.\n */\nexport function keyRoot(): Promise<string> {\n  keyRootPromise ??= (async () => {\n    if (await holdsKey(machineRoot())) return machineRoot();\n    return (await holdsKey(localVaultRoot())) ? localVaultRoot() : machineRoot();\n  })();\n  return keyRootPromise;\n}\n\n/**\n * The launch directory's own key, when the machine key is what we opened.\n *\n * Its presence is the whole trigger for the migration page: this directory\n * holds data encrypted under a key nothing reads any more. Null once migrated,\n * and null too when the local key IS the one in use — there is nothing to\n * migrate then.\n */\nexport async function legacyVaultRoot(): Promise<string | null> {\n  const local = localVaultRoot();\n  if ((await keyRoot()) === local) return null;\n  return (await holdsKey(local)) ? local : null;\n}\n\n/** Test seam: forget the resolved key home. */\nexport function resetKeyRoot(): void {\n  keyRootPromise = null;\n}\n","import { z } from 'zod';\nimport { resolve as resolvePath } from 'node:path';\n\n/**\n * Every variable Runeya reads from the process environment is prefixed with\n * `RUNEYA_`. Generic names (PORT, HOST, MODE, DATA_DIR…) are deliberately NOT\n * read: Runeya loads the `.env` of the stack it manages, where those names very\n * often belong to the user's own services.\n *\n * The resolved object keeps short field names (`env.PORT`, `env.HOST`, …) —\n * only the environment keys are prefixed.\n */\n\n// Server port, used to derive the default agent port\nconst serverPort = z.coerce.number().int().min(1).max(65535).default(4000).parse(process.env.RUNEYA_HTTP_PORT);\n\nconst defaultAgentPort = process.env.RUNEYA_AGENT_PORT\n  ? z.coerce.number().int().min(1).max(65535).parse(process.env.RUNEYA_AGENT_PORT)\n  : serverPort + 1;\n\nconst EnvSchema = z.object({\n  RUNEYA_HTTP_PORT: z.coerce.number().int().min(1).max(65535).default(4000),\n  RUNEYA_HOST: z.string().default('127.0.0.1'),\n  RUNEYA_AGENT_PORT: z.coerce.number().int().min(1).max(65535).default(defaultAgentPort),\n  RUNEYA_AGENT_HOST: z.string().default('127.0.0.1'),\n  RUNEYA_AGENT_BINARY_PATH: z.string().nullable().default(null),\n  RUNEYA_DATA_DIR: z.preprocess((v) => (typeof v === 'string' && v.length > 0 ? v : undefined), z.string().default('.runeya')),\n  // Home holding the cloud vaults (`<home>/.runeya/orgs/...`). Defaults to the\n  // user's home directory; overridden by tests so they never write to the real\n  // one, and usable to relocate the vaults on a shared machine.\n  RUNEYA_HOME: z.preprocess((v) => (typeof v === 'string' && v.length > 0 ? v : undefined), z.string().nullable().default(null)),\n  RUNEYA_CLOUD_URL: z.string().url().nullable().default(null),\n  // Cloud front-end (landing) URL — used by the web app for the registration /\n  // onboarding flow. Configured on the server at launch; the web fetches it.\n  RUNEYA_CLOUD_APP_URL: z.string().url().nullable().default(null),\n  RUNEYA_MODE: z.enum(['local-simple', 'cloud']).default('local-simple'),\n  RUNEYA_CORS_ORIGIN: z.string().nullable().default(null),\n  RUNEYA_LAN_PROXY: z.preprocess((v) => v === 'true' || v === '1', z.boolean()).default(false),\n  // Set by the CLI when it was started from a desktop launcher rather than a\n  // terminal. The web app surfaces it so the user knows which Runeya they are\n  // looking at when several are running.\n  RUNEYA_FROM_DESKTOP: z.preprocess((v) => v === 'true' || v === '1', z.boolean()).default(false),\n  // Label shown for this machine in the cloud's \"linked machines\" screen.\n  // Defaults to the hostname (see `getDeviceName`); set it explicitly when a\n  // single host runs several instances and you want to tell them apart.\n  RUNEYA_DEVICE_NAME: z.preprocess(\n    (v) => (typeof v === 'string' && v.trim().length > 0 ? v.trim() : undefined),\n    z.string().max(64).nullable().default(null),\n  ),\n}).transform((data) => ({\n  ...data,\n  // Short aliases used throughout the server code\n  PORT: data.RUNEYA_HTTP_PORT,\n  HOST: data.RUNEYA_HOST,\n  MODE: data.RUNEYA_MODE,\n  /**\n   * Absolute from the start, resolved once against the launch directory.\n   *\n   * It defaults to a relative `.runeya`, and every caller used to re-resolve it\n   * against whatever the process's cwd happened to be. A vault that moves when\n   * the process changes directory is a vault that can be silently written to the\n   * wrong place — so the answer is fixed here, at boot, and never recomputed.\n   */\n  DATA_DIR: resolvePath(data.RUNEYA_DATA_DIR),\n  HOME_DIR: data.RUNEYA_HOME,\n  CLOUD_URL: data.RUNEYA_CLOUD_URL,\n  CLOUD_APP_URL: data.RUNEYA_CLOUD_APP_URL,\n  CORS_ORIGIN: data.RUNEYA_CORS_ORIGIN,\n  AGENT_BINARY_PATH: data.RUNEYA_AGENT_BINARY_PATH,\n  DEVICE_NAME: data.RUNEYA_DEVICE_NAME,\n  FROM_DESKTOP: data.RUNEYA_FROM_DESKTOP,\n}));\n\nexport type Env = z.infer<typeof EnvSchema>;\n\nexport const env = EnvSchema.parse(process.env);\n"],"mappings":";AAAA,SAAS,MAAM,WAAW;AAC1B,SAAS,eAAe;AACxB,SAAS,SAAS,OAAO,QAAQ,UAAU,WAAW,cAAc;AACpE,SAAS,kBAAkB;;;ACH3B,SAAS,SAAS;AAClB,SAAS,WAAW,mBAAmB;AAavC,IAAM,aAAa,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI,EAAE,MAAM,QAAQ,IAAI,gBAAgB;AAE7G,IAAM,mBAAmB,QAAQ,IAAI,oBACjC,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,MAAM,QAAQ,IAAI,iBAAiB,IAC7E,aAAa;AAEjB,IAAM,YAAY,EAAE,OAAO;AAAA,EACzB,kBAAkB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,GAAI;AAAA,EACxE,aAAa,EAAE,OAAO,EAAE,QAAQ,WAAW;AAAA,EAC3C,mBAAmB,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,KAAK,EAAE,QAAQ,gBAAgB;AAAA,EACrF,mBAAmB,EAAE,OAAO,EAAE,QAAQ,WAAW;AAAA,EACjD,0BAA0B,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5D,iBAAiB,EAAE,WAAW,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI,IAAI,QAAY,EAAE,OAAO,EAAE,QAAQ,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA,EAI3H,aAAa,EAAE,WAAW,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,SAAS,IAAI,IAAI,QAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7H,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA;AAAA;AAAA,EAG1D,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC9D,aAAa,EAAE,KAAK,CAAC,gBAAgB,OAAO,CAAC,EAAE,QAAQ,cAAc;AAAA,EACrE,oBAAoB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACtD,kBAAkB,EAAE,WAAW,CAAC,MAAM,MAAM,UAAU,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI3F,qBAAqB,EAAE,WAAW,CAAC,MAAM,MAAM,UAAU,MAAM,KAAK,EAAE,QAAQ,CAAC,EAAE,QAAQ,KAAK;AAAA;AAAA;AAAA;AAAA,EAI9F,oBAAoB,EAAE;AAAA,IACpB,CAAC,MAAO,OAAO,MAAM,YAAY,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,KAAK,IAAI;AAAA,IAClE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC5C;AACF,CAAC,EAAE,UAAU,CAAC,UAAU;AAAA,EACtB,GAAG;AAAA;AAAA,EAEH,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASX,UAAU,YAAY,KAAK,eAAe;AAAA,EAC1C,UAAU,KAAK;AAAA,EACf,WAAW,KAAK;AAAA,EAChB,eAAe,KAAK;AAAA,EACpB,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AACrB,EAAE;AAIK,IAAM,MAAM,UAAU,MAAM,QAAQ,GAAG;;;ADnC9C,IAAM,UAAU;AAEhB,SAAS,aAAa,MAAkC,IAAkB;AACxE,MAAI,CAAC,QAAQ,KAAK,EAAE,KAAK,OAAO,OAAO,OAAO,MAAM;AAClD,UAAM,IAAI,MAAM,WAAW,IAAI,yBAAyB,KAAK,UAAU,EAAE,CAAC,EAAE;AAAA,EAC9E;AACF;AASO,SAAS,cAAsB;AACpC,QAAM,WAAW,QAAQ,IAAI,aAAa;AAC1C,SAAO,KAAK,YAAY,SAAS,SAAS,IAAI,WAAW,QAAQ,GAAG,SAAS;AAC/E;AASO,SAAS,iBAAyB;AACvC,SAAO,IAAI;AACb;AAGO,SAAS,aAAa,OAAuB;AAClD,eAAa,gBAAgB,KAAK;AAClC,SAAO,KAAK,YAAY,GAAG,QAAQ,KAAK;AAC1C;AAGO,SAAS,iBAAiB,OAAe,WAA2B;AACzE,eAAa,WAAW,SAAS;AACjC,SAAO,KAAK,aAAa,KAAK,GAAG,YAAY,SAAS;AACxD;AAUO,SAAS,YAAY,MAA6B;AACvD,QAAM,SAAS,KAAK,YAAY,GAAG,MAAM,IAAI;AAC7C,MAAI,CAAC,KAAK,WAAW,MAAM,EAAG,QAAO;AACrC,QAAM,CAAC,KAAK,IAAI,KAAK,MAAM,OAAO,MAAM,EAAE,MAAM,GAAG;AACnD,SAAO,SAAS,QAAQ,KAAK,KAAK,IAAI,QAAQ;AAChD;AAUO,SAAS,cAAc,MAAkC;AAC9D,SAAO,YAAY,IAAI,KAAK;AAC9B;AAGO,SAAS,SAAS,QAA4B;AACnD,MAAI,CAAC,OAAO,MAAO,QAAO,EAAE,MAAM,eAAe,EAAE;AACnD,SAAO,EAAE,MAAM,iBAAiB,OAAO,OAAO,OAAO,EAAE,EAAE;AAC3D;AAYA,IAAM,iBAAiB;AAEvB,eAAsB,cACpB,OACA,UACA,MACA,WACe;AACf,QAAM,OAAO,aAAa,KAAK;AAK/B,QAAM,MAAM,MAAM,EAAE,WAAW,KAAK,CAAC;AAIrC,QAAM,QAAQ,SAAS,MAAM,aAAa,GAAG,KAAK;AAOlD,QAAM,OAAO,cAAc,MAAM,gBAAgB,GAAG,KAAK;AACzD,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,GAAI,QAAQ,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IAC/B,GAAI,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,EACpC;AACA,QAAM,UAAU,KAAK,MAAM,cAAc,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,OAAO;AACrF;AAaA,eAAsB,mBAAmB,OAAe,WAAkC;AACxF,QAAM,OAAO,aAAa,KAAK;AAG/B,MAAI,CAAC,WAAW,IAAI,EAAG;AACvB,QAAM,OAAO,KAAK,MAAM,cAAc;AACtC,MAAI,QAAiC,CAAC;AACtC,MAAI;AACF,YAAQ,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,EAClD,QAAQ;AAAA,EAER;AACA,MAAI,MAAM,WAAW,MAAM,UAAW;AACtC,QAAM,UAAU,MAAM,KAAK,UAAU,EAAE,GAAG,OAAO,UAAU,GAAG,MAAM,CAAC,GAAG,OAAO;AACjF;AAWA,eAAsB,iBAAiB,OAAe,OAA8B;AAClF,MAAI,UAAU,MAAO;AACrB,aAAW,SAAS,MAAM,cAAc,GAAG;AACzC,UAAM,OAAO,KAAK,aAAa,KAAK,GAAG,cAAc;AACrD,QAAI;AACJ,QAAI;AACF,cAAQ,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACA,QAAI,MAAM,WAAW,MAAM,MAAO;AAClC,UAAM,UAAU,MAAM,KAAK,UAAU,EAAE,GAAG,OAAO,WAAW,MAAM,GAAG,MAAM,CAAC,GAAG,OAAO;AAAA,EACxF;AACF;AAUA,eAAsB,kBAAmD;AACvE,QAAM,MAA8B,CAAC;AACrC,aAAW,SAAS,MAAM,cAAc,GAAG;AACzC,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,aAAa,KAAK,GAAG,cAAc,GAAG,OAAO;AAC7E,YAAM,KAAM,KAAK,MAAM,GAAG,EAA8B;AACxD,UAAI,OAAO,OAAO,YAAY,GAAI,KAAI,KAAK,IAAI;AAAA,IACjD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAoBA,eAAsB,gBAAgB,OAAe,MAA6B;AAChF,QAAM,OAAO,aAAa,KAAK;AAC/B,MAAI,CAAC,WAAW,IAAI,EAAG;AACvB,QAAM,OAAO,KAAK,MAAM,cAAc;AACtC,MAAI,QAAiC,CAAC;AACtC,MAAI;AACF,YAAQ,KAAK,MAAM,MAAM,SAAS,MAAM,OAAO,CAAC;AAAA,EAClD,QAAQ;AAAA,EAER;AACA,MAAI,MAAM,MAAM,MAAM,KAAM;AAC5B,QAAM,UAAU,MAAM,KAAK,UAAU,EAAE,GAAG,OAAO,KAAK,GAAG,MAAM,CAAC,GAAG,OAAO;AAC5E;AAGA,eAAsB,eAAgD;AACpE,QAAM,MAA8B,CAAC;AACrC,aAAW,SAAS,MAAM,cAAc,GAAG;AACzC,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,aAAa,KAAK,GAAG,cAAc,GAAG,OAAO;AAC7E,YAAM,OAAQ,KAAK,MAAM,GAAG,EAAyB;AACrD,UAAI,OAAO,SAAS,YAAY,KAAM,KAAI,KAAK,IAAI;AAAA,IACrD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAWA,IAAM,gBAAgB;AAStB,IAAM,aAAa,oBAAI,IAAI,CAAC,aAAa,cAAc,cAAc,WAAW,CAAC;AAGjF,eAAsB,gBAAgB,OAAe,aAAqB,QAA+B;AACvG,MAAI,CAAC,WAAW,IAAI,WAAW,EAAG;AAClC,QAAM,OAAO,aAAa,KAAK;AAC/B,QAAM,SAAqB,EAAE,aAAa,QAAQ,YAAW,oBAAI,KAAK,GAAE,YAAY,EAAE;AACtF,QAAM,MAAM,MAAM,EAAE,WAAW,KAAK,CAAC;AACrC,QAAM,UAAU,KAAK,MAAM,aAAa,GAAG,KAAK,UAAU,MAAM,GAAG,OAAO;AAC5E;AAGA,eAAsB,cAAc,OAA8B;AAChE,MAAI;AACF,UAAM,OAAO,KAAK,aAAa,KAAK,GAAG,aAAa,CAAC;AAAA,EACvD,QAAQ;AAAA,EAER;AACF;AAQA,eAAsB,YAAY,OAA2E;AAC3G,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,KAAK,aAAa,KAAK,GAAG,aAAa,GAAG,OAAO;AAC5E,UAAM,EAAE,aAAa,OAAO,IAAI,KAAK,MAAM,GAAG;AAC9C,QAAI,OAAO,gBAAgB,YAAY,CAAC,WAAW,IAAI,WAAW,EAAG,QAAO;AAC5E,QAAI,OAAO,WAAW,YAAY,CAAC,OAAQ,QAAO;AAClD,WAAO,EAAE,aAAa,OAAO,IAAI,WAAW,OAAO,KAAK,QAAQ,QAAQ,CAAC,EAAE;AAAA,EAC7E,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,eAAgD;AACpE,QAAM,MAA8B,CAAC;AACrC,aAAW,SAAS,MAAM,cAAc,GAAG;AACzC,UAAM,OAAO,MAAM,YAAY,KAAK;AAEpC,QAAI,KAAM,KAAI,KAAK,IAAI,QAAQ,KAAK,WAAW,WAAW,OAAO,KAAK,KAAK,KAAK,EAAE,SAAS,QAAQ,CAAC;AAAA,EACtG;AACA,SAAO;AACT;AAGA,eAAsB,gBAAiD;AACrE,QAAM,UAAU,KAAK,YAAY,GAAG,MAAM;AAC1C,QAAM,MAA8B,CAAC;AACrC,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,GACrD,OAAO,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,KAAK,EAAE,IAAI,CAAC,EACrD,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACA,aAAW,SAAS,QAAQ;AAC1B,QAAI;AACF,YAAM,MAAM,MAAM,SAAS,KAAK,SAAS,OAAO,cAAc,GAAG,OAAO;AACxE,YAAM,MAAO,KAAK,MAAM,GAAG,EAA6B;AACxD,UAAI,OAAO,QAAQ,YAAY,IAAK,KAAI,KAAK,IAAI;AAAA,IACnD,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAUA,eAAsB,gBAAmC;AACvD,QAAM,UAAU,KAAK,YAAY,GAAG,MAAM;AAC1C,MAAI;AACF,YAAQ,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,GACnD,OAAO,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,KAAK,EAAE,IAAI,CAAC,EACrD,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAmBA,eAAsB,kBAAyC;AAC7D,QAAM,UAAU,KAAK,YAAY,GAAG,MAAM;AAC1C,QAAM,QAAsB,CAAC;AAE7B,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,QAAQ,SAAS,EAAE,eAAe,KAAK,CAAC,GACrD,OAAO,CAAC,MAAM,EAAE,YAAY,KAAK,QAAQ,KAAK,EAAE,IAAI,CAAC,EACrD,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,aAAW,SAAS,QAAQ;AAC1B,UAAM,cAAc,KAAK,SAAS,OAAO,UAAU;AACnD,QAAI;AACF,iBAAW,SAAS,MAAM,QAAQ,aAAa,EAAE,eAAe,KAAK,CAAC,GAAG;AACvE,YAAI,CAAC,MAAM,YAAY,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,EAAG;AACvD,cAAM,OAAO,KAAK,aAAa,MAAM,IAAI;AAWzC,YAAI,CAAE,MAAM,OAAO,KAAK,MAAM,cAAc,CAAC,EAAE,KAAK,MAAM,MAAM,MAAM,KAAK,EAAI;AAC/E,cAAM,KAAK,EAAE,OAAO,WAAW,MAAM,MAAM,KAAK,CAAC;AAAA,MACnD;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAQA,eAAsB,gBAAmC;AACvD,QAAM,QAAQ,MAAM,gBAAgB;AACpC,SAAO,CAAC,eAAe,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACvD;AAWO,SAAS,gBAAgB,UAA0B;AACxD,SAAO,KAAK,YAAY,GAAG,QAAQ;AACrC;AAWA,eAAsB,cAAc,UAAmC;AACrE,SAAO,KAAK,MAAM,QAAQ,GAAG,QAAQ;AACvC;AAQO,SAAS,sBAAsB,UAA0B;AAC9D,SAAO,KAAK,eAAe,GAAG,QAAQ;AACxC;AAWA,eAAsB,mBAAoC;AACxD,QAAM,OAAO,eAAe;AAC5B,QAAM,MAAM,MAAM,EAAE,WAAW,KAAK,CAAC;AACrC,SAAO;AACT;AAGA,IAAM,YAAY,CAAC,uBAAuB,gBAAgB;AAE1D,IAAI,iBAAyC;AAG7C,eAAe,SAAS,MAAgC;AACtD,aAAW,YAAY,WAAW;AAChC,QAAI;AACF,YAAM,OAAO,KAAK,MAAM,QAAQ,CAAC;AACjC,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAoBO,SAAS,UAA2B;AACzC,sBAAoB,YAAY;AAC9B,QAAI,MAAM,SAAS,YAAY,CAAC,EAAG,QAAO,YAAY;AACtD,WAAQ,MAAM,SAAS,eAAe,CAAC,IAAK,eAAe,IAAI,YAAY;AAAA,EAC7E,GAAG;AACH,SAAO;AACT;AAUA,eAAsB,kBAA0C;AAC9D,QAAM,QAAQ,eAAe;AAC7B,MAAK,MAAM,QAAQ,MAAO,MAAO,QAAO;AACxC,SAAQ,MAAM,SAAS,KAAK,IAAK,QAAQ;AAC3C;AAGO,SAAS,eAAqB;AACnC,mBAAiB;AACnB;","names":[]}

package/{companion-NZU7FNID.js → companion-EPINTIC7.js}

@@ -21,11 +21,11 @@ import {
   resetRelaunches,
   reviewWindow,
   takeRelaunchSlot
-} from "./chunk-TE57T5GO.js";
+} from "./chunk-DS66SEYH.js";
 import "./chunk-MD3VW4HQ.js";
-import "./chunk-ELI2TELD.js";
+import "./chunk-RIITTBK3.js";
 import "./chunk-QRMG6GMX.js";
-import "./chunk-J3NAI636.js";
+import "./chunk-ZFELQG4B.js";
 export {
   COMPANION_SIGNATURE,
   MAX_CONSECUTIVE_RELAUNCHES,
@@ -50,4 +50,4 @@ export {
   reviewWindow,
   takeRelaunchSlot
 };
-//# sourceMappingURL=companion-NZU7FNID.js.map
+//# sourceMappingURL=companion-EPINTIC7.js.map

package/index.js

@@ -135,7 +135,7 @@ if (subCommand === "install-desktop" || subCommand === "uninstall-desktop") {
   }
 }
 if (subCommand === "instances") {
-  const { listInstances, killInstance, restartInstance } = await import("./src-MILB2SQA.js");
+  const { listInstances, killInstance, restartInstance } = await import("./src-LONZKLMU.js");
   const { runInstancesCommand } = await import("./instances-command-KZ5UGXOR.js");
   process.exit(await runInstancesCommand(args.slice(1), {
     listInstances,
@@ -299,7 +299,7 @@ async function main() {
   ensureNodeBinOnPath();
   await ensureUserBinsOnPath();
   if (!isPullEnv) stampConsole();
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance, registerCliLocation } = await import("./src-MILB2SQA.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance, registerCliLocation } = await import("./src-LONZKLMU.js");
   registerCliLocation({ execPath: process.execPath, cliEntry: fileURLToPath(import.meta.url) });
   if (isPullEnv) {
     if (!serviceArg) {
@@ -406,7 +406,7 @@ async function main() {
       networkInfo,
       setLanMode,
       resolveTrayIcon
-    } = await import("./src-MILB2SQA.js");
+    } = await import("./src-LONZKLMU.js");
     tray = await startInstanceTray({
       info: { cwd: process.cwd(), port, version, url: appUrl },
       assetsDir: join(__dirname, "assets"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.107",
+  "version": "2.0.108",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/settings-manager-YSH7ZCLP.js

@@ -0,0 +1,9 @@
+import {
+  settingsManager
+} from "./chunk-D2PF2FYU.js";
+import "./chunk-QRMG6GMX.js";
+import "./chunk-ZFELQG4B.js";
+export {
+  settingsManager
+};
+//# sourceMappingURL=settings-manager-YSH7ZCLP.js.map

package/{src-MILB2SQA.js → src-LONZKLMU.js}

@@ -12,6 +12,8 @@ import {
   OPENAI_COMPAT_BASE_URLS,
   OptionalProviderIdSchema,
   accountForOrg,
+  accountForOrgOrThrow,
+  accountForOrgScope,
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
@@ -58,9 +60,10 @@ import {
   serviceRouter,
   setLanMode,
   shutdownCodexAppServer,
+  soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-JNI4CXJ7.js";
+} from "./chunk-4SJCPFGK.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -83,7 +86,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-TE57T5GO.js";
+} from "./chunk-DS66SEYH.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -122,10 +125,10 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-ELI2TELD.js";
+} from "./chunk-RIITTBK3.js";
 import {
   settingsManager
-} from "./chunk-ZDHLWTHW.js";
+} from "./chunk-D2PF2FYU.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -157,7 +160,6 @@ import {
   writeEntity
 } from "./chunk-QRMG6GMX.js";
 import {
-  adoptUnstampedOrgs,
   env,
   forgetOrgLogo,
   keyRoot,
@@ -174,10 +176,11 @@ import {
   readOrgLogo,
   readOrgLogos,
   readOrgNames,
+  rememberOrgAccount,
   rememberOrgLogo,
   rememberOrgName,
   stampOrgCloud
-} from "./chunk-J3NAI636.js";
+} from "./chunk-ZFELQG4B.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -5812,8 +5815,9 @@ var kanbanRouter = router({
   downloadAttachment: protectedProcedure.input(z19.object({
     attachmentId: z19.string().max(128),
     // La pièce jointe appartient à une organisation : la nommer dit sous quel
-    // compte la demander. Omise, c'est le compte unique du poste — la
-    // situation d'avant le multicompte.
+    // compte la demander. C'est le SEUL appel qui tolère de ne pas l'avoir —
+    // un agent n'a qu'un identifiant de fichier — et il échoue alors en le
+    // disant dès que ce poste a plusieurs comptes.
     orgId: z19.string().max(128).optional()
   })).mutation(async ({ input }) => {
     const id = input.attachmentId;
@@ -5822,7 +5826,7 @@ var kanbanRouter = router({
     }
     const res = await cloudFetch2(`/api/kanban/file/${id}`, {
       timeoutMs: 12e4,
-      ...input.orgId ? { orgId: input.orgId } : {}
+      accountId: input.orgId ? await accountForOrgScope(input.orgId) : await soleAccountScope()
     });
     if (res.status === 404) {
       throw new TRPCError16({ code: "NOT_FOUND", message: `Attachment ${id} not found` });
@@ -6320,7 +6324,7 @@ async function reconcileOrgCanary(orgId) {
   const res = await cloudFetch("/api/auth/organization/canary", {
     method: "POST",
     body: { organizationId: orgId, canary: local },
-    orgId
+    accountId: await accountForOrgOrThrow(orgId)
   });
   if (!res.ok) {
     throw new CanaryUnavailableError("Could not reach the organization on the cloud.");
@@ -7456,6 +7460,8 @@ var cloudSyncRouter = router({
         cloudUrl: input.cloudUrl,
         ...await accountScope(input.orgId)
       });
+    } else if (input.accountId) {
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
@@ -7508,6 +7514,8 @@ var cloudSyncRouter = router({
         cloudUrl: input.cloudUrl,
         ...await accountScope(input.orgId)
       });
+    } else if (input.accountId) {
+      await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
     }
     await projectStore.moveToOrg(input.projectId, input.orgId);
     await projectPathStore.relocate(
@@ -7539,7 +7547,7 @@ var cloudSyncRouter = router({
   })).query(async ({ input }) => {
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET", orgId: input.orgId }
+      { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) {
       throw new TRPCError19({ code: "BAD_GATEWAY", message: await cloudMessage(res) || `CANARY_READ_FAILED (${res.status})` });
@@ -7562,7 +7570,7 @@ var cloudSyncRouter = router({
     if (!key) return { status: "unknown" };
     const res = await cloudFetch2(
       `/api/auth/organization/canary?organizationId=${encodeURIComponent(input.orgId)}`,
-      { method: "GET", orgId: input.orgId }
+      { method: "GET", accountId: await accountForOrgScope(input.orgId) }
     );
     if (!res.ok) return { status: "unknown" };
     const { canary } = await res.json();
@@ -7617,7 +7625,7 @@ var cloudSyncRouter = router({
     const res = await cloudFetch2("/api/auth/organization/canary/reset", {
       method: "POST",
       body: { organizationId: input.orgId, canary },
-      orgId: input.orgId
+      accountId: await accountForOrgScope(input.orgId)
     });
     if (!res.ok) {
       const detail = await cloudMessage(res);
@@ -7665,7 +7673,9 @@ var cloudSyncRouter = router({
       res = await cloudFetch2("/api/auth/project/delete", {
         method: "POST",
         body: { organizationId: input.orgId, projectId: input.projectId },
-        orgId: input.orgId
+        // Dans le `try` : ne rien avoir à quoi rattacher l'organisation doit
+        // ressortir comme CLOUD_NOT_LINKED, pas comme une erreur interne.
+        accountId: await accountForOrgScope(input.orgId)
       });
     } catch (err) {
       if (err instanceof TRPCError19 && err.code === "PRECONDITION_FAILED") {
@@ -7702,6 +7712,35 @@ var cloudSyncRouter = router({
    * afficher. Le nom est donc recopié dans le tampon du coffre au passage, là
    * où il est déjà lu au démarrage suivant.
    */
+  /**
+   * Retenir à quel compte appartient chaque organisation.
+   *
+   * Poussé par l'interface avec ce que le cloud vient de répondre : une
+   * organisation appartient au compte qui la LISTE. Le poste ne peut pas le
+   * déduire — il l'a tenté, et il a rangé sous un compte les organisations
+   * d'un autre. Même forme que `rememberOrgNames`, et pour la même raison :
+   * ce que seul le cloud sait, on le recopie quand il le dit.
+   */
+  rememberOrgAccounts: protectedProcedure.input(z23.object({
+    orgs: z23.array(z23.object({
+      orgId: z23.string().min(1).max(128),
+      accountId: z23.string().min(1).max(64)
+    })).max(200)
+  })).mutation(async ({ input }) => {
+    const candidates = /* @__PURE__ */ new Map();
+    for (const { orgId, accountId } of input.orgs) {
+      candidates.set(orgId, [...candidates.get(orgId) ?? [], accountId]);
+    }
+    const current2 = await readOrgAccounts();
+    let remembered = 0;
+    for (const [orgId, accountIds] of candidates) {
+      const kept = current2[orgId];
+      if (kept && accountIds.includes(kept)) continue;
+      await rememberOrgAccount(orgId, accountIds[0]);
+      remembered++;
+    }
+    return { remembered };
+  }),
   rememberOrgNames: protectedProcedure.input(z23.object({
     orgs: z23.array(z23.object({
       orgId: z23.string().min(1).max(128),
@@ -9626,13 +9665,6 @@ async function createLocalServer() {
         res.status(502).send("The cloud did not say who this session belongs to.");
         return;
       }
-      const before = await cloudSessionStore.list();
-      if (before.length === 1 && before[0].userId !== identity.userId) {
-        const adopted = await adoptUnstampedOrgs(before[0].id);
-        if (adopted.length > 0) {
-          console.log(`[cloud] ${adopted.length} organisation(s) rattach\xE9e(s) au compte ${before[0].email || before[0].id}`);
-        }
-      }
       await cloudSessionStore.add(getCloudApiUrl(), sessionToken, identity);
       void cloudSyncBridge.resumeAll();
       res.redirect(`${returnTo}?cloud=linked`);
@@ -9660,7 +9692,7 @@ async function createLocalServer() {
         res.status(401).end();
         return;
       }
-      const streamBase = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
+      const streamBase = await orgCloudUrl(organizationId);
       const upstreamAbort = new AbortController();
       req.on("close", () => upstreamAbort.abort());
       try {
@@ -9720,7 +9752,7 @@ async function createLocalServer() {
         res.status(401).end();
         return;
       }
-      const streamBase = await cloudSessionStore.getCloudUrl(accountId) ?? getCloudApiUrl();
+      const streamBase = await orgCloudUrl(organizationId);
       const upstreamQuery = new URLSearchParams({ organizationId });
       if (typeof req.query["name"] === "string") upstreamQuery.set("name", req.query["name"]);
       try {
@@ -9761,7 +9793,7 @@ async function createLocalServer() {
     }
     try {
       const upstream = await fetch(
-        `${(await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()).replace(/\/+$/, "")}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${fileOrgId ? await orgCloudUrl(fileOrgId) : await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           method: "DELETE",
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
@@ -9790,7 +9822,7 @@ async function createLocalServer() {
     }
     try {
       const upstream = await fetch(
-        `${(await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()).replace(/\/+$/, "")}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
+        `${fileOrgId ? await orgCloudUrl(fileOrgId) : await cloudSessionStore.getCloudUrl(fileAccountId ?? void 0) ?? getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
         {
           headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
           signal: AbortSignal.timeout(3e5)
@@ -9810,6 +9842,33 @@ async function createLocalServer() {
       res.status(502).end();
     }
   });
+  app.get("/api/cloud/avatar/:userId", async (req, res) => {
+    const userId = req.params.userId;
+    if (!/^[A-Za-z0-9._-]{1,128}$/.test(userId)) {
+      res.status(400).end();
+      return;
+    }
+    const orgId = typeof req.query["organizationId"] === "string" ? req.query["organizationId"] : "";
+    const accountId = typeof req.query["accountId"] === "string" ? req.query["accountId"] : "";
+    try {
+      const base = orgId ? await orgCloudUrl(orgId) : await cloudSessionStore.getCloudUrl(accountId || void 0) ?? getCloudApiUrl();
+      const upstream = await fetch(`${base}/api/avatar/${encodeURIComponent(userId)}`, {
+        headers: { [APP_VERSION_HEADER]: appVersion },
+        signal: AbortSignal.timeout(15e3)
+      });
+      if (!upstream.ok) {
+        res.status(upstream.status).end();
+        return;
+      }
+      res.set("Content-Type", upstream.headers.get("content-type") ?? "application/octet-stream");
+      res.set("X-Content-Type-Options", "nosniff");
+      res.set("Content-Security-Policy", "default-src 'none'; sandbox");
+      res.set("Cache-Control", "public, max-age=300");
+      res.send(Buffer.from(await upstream.arrayBuffer()));
+    } catch {
+      res.status(502).end();
+    }
+  });
   proxyCloudStream("/api/cloud/chat/stream", "/api/chat/stream");
   proxyCloudStream("/api/cloud/kanban/stream", "/api/kanban/stream");
   app.post("/api/unlock", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
@@ -10190,7 +10249,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-NZU7FNID.js");
+  const { initCompanion } = await import("./companion-EPINTIC7.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10637,4 +10696,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-MILB2SQA.js.map
+//# sourceMappingURL=src-LONZKLMU.js.map