@runeya/runeya 2.0.120 → 2.0.122

package/{src-NRKK27F3.js → src-YUVA6WCM.js}

@@ -17,7 +17,6 @@ import {
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
-  atomicWriteSecure,
   auditService,
   canEnvAction,
   chatRouter,
@@ -51,7 +50,6 @@ import {
   requireServiceAction,
   resolveAgentCwd,
   resolveConversationCwd,
-  resolveConversationRunDir,
   resolveEffectiveAgentId,
   resolveServiceVariables,
   resolveWorkspaceCwd,
@@ -64,7 +62,7 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-22RJM654.js";
+} from "./chunk-BVBK2WII.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -87,7 +85,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-NYKFDU76.js";
+} from "./chunk-VNLIA5PV.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -98,7 +96,6 @@ import {
   clearVaultLock,
   decryptValue,
   decryptValueWith,
-  describeInstance,
   encryptValue,
   encryptValueWith,
   ensureEncryptionKey,
@@ -126,10 +123,14 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-2WXQIUVC.js";
+} from "./chunk-XTLQOYLT.js";
 import {
   settingsManager
-} from "./chunk-GIHR3BGT.js";
+} from "./chunk-NIU3CN5A.js";
+import {
+  atomicWriteSecure,
+  resolveConversationRunDir
+} from "./chunk-GL7WA5K3.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -163,7 +164,7 @@ import {
   readEntity,
   serviceSlug,
   writeEntity
-} from "./chunk-H6VIS4OY.js";
+} from "./chunk-T2BV5WZE.js";
 import {
   env,
   forgetOrgLogo,
@@ -1167,6 +1168,63 @@ var projectRouter = router({
     await projectPathStore.set(project, input.path);
     await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id, metadata: { localPath: input.path } });
     return { path: input.path };
+  }),
+  /**
+   * Ce qui a changé dans les stores, à mesure que ça change.
+   *
+   * Un projet, un service ou un environnement n'arrive pas toujours de
+   * l'utilisateur assis devant : il descend du cloud quand un collègue le
+   * pousse, ou d'une autre Runeya de cette machine. Les stores étaient déjà
+   * prévenus — la synchronisation s'appuie sur les mêmes signaux — mais rien ne
+   * portait l'information jusqu'à l'écran, qui gardait donc ce qu'il avait
+   * chargé à l'ouverture de la vue.
+   *
+   * Ce flux annonce les collections touchées, pas leur contenu. Chacune a déjà
+   * sa route, avec ses règles — un service ne sort jamais d'ici sans être
+   * expurgé de ses secrets — et les redire ici en ferait une seconde version à
+   * tenir d'accord avec la première.
+   *
+   * Les réveils sont groupés : une synchronisation qui descend un projet touche
+   * ses trois collections coup sur coup, et trois annonces feraient trois
+   * rechargements là où un seul suffit.
+   */
+  onDataChanged: protectedProcedure.subscription(async function* ({ signal }) {
+    const touched = /* @__PURE__ */ new Set();
+    let wake = null;
+    const mark = (collection) => () => {
+      touched.add(collection);
+      if (wake) {
+        wake();
+        wake = null;
+      }
+    };
+    const onProjects = mark("projects");
+    projectStore.events.on("saved", onProjects);
+    const offs = [serviceStore.onChange(mark("services")), environmentStore.onChange(mark("environments"))];
+    const onAbort = () => {
+      if (wake) {
+        wake();
+        wake = null;
+      }
+    };
+    signal?.addEventListener("abort", onAbort);
+    try {
+      while (!signal?.aborted) {
+        if (touched.size > 0) {
+          const collections = Array.from(touched);
+          touched.clear();
+          yield { collections };
+        } else {
+          await new Promise((resolve4) => {
+            wake = resolve4;
+          });
+        }
+      }
+    } finally {
+      projectStore.events.off("saved", onProjects);
+      for (const off of offs) off();
+      signal?.removeEventListener("abort", onAbort);
+    }
   })
 });
 
@@ -6522,85 +6580,61 @@ async function reconcileOrgCanary(orgId) {
 }
 
 // ../server/src/services/cloud-sync-bridge.ts
+import { randomUUID as randomUUID6 } from "crypto";
+import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
+import * as Y2 from "yjs";
+
+// ../server/src/services/sync-doc-cache.ts
+import { readFileSync, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
+import { readFile as readFile4 } from "fs/promises";
+import { dirname as dirname4, join as join10 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
-import { mkdir as mkdir8, rm as rm3 } from "fs/promises";
 import * as Y from "yjs";
-
-// ../server/src/services/org-lock.ts
-import { open, readFile as readFile4, unlink, mkdir as mkdir7 } from "fs/promises";
-import { readFileSync, unlinkSync } from "fs";
-import { join as join10 } from "path";
-var held = /* @__PURE__ */ new Set();
-function lockPath(orgId) {
-  return join10(orgVaultRoot(orgId), "org.lock");
-}
-function isRunning(pid) {
-  if (!Number.isInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (err) {
-    return err.code === "EPERM";
-  }
+var FILE = "sync-doc.bin";
+function cachePath(orgId) {
+  return join10(orgVaultRoot(orgId), FILE);
 }
-async function readLock(path) {
+async function readSyncDoc(orgId) {
   try {
-    const parsed = JSON.parse(await readFile4(path, "utf-8"));
-    return typeof parsed?.pid === "number" ? parsed : null;
+    return new Uint8Array(await readFile4(cachePath(orgId)));
   } catch {
     return null;
   }
 }
-async function acquireOrgLock(orgId) {
-  const path = lockPath(orgId);
-  await mkdir7(orgVaultRoot(orgId), { recursive: true });
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      const handle = await open(path, "wx");
-      try {
-        const contents = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
-        await handle.writeFile(JSON.stringify(contents), "utf-8");
-      } finally {
-        await handle.close();
-      }
-      held.add(orgId);
-      return { acquired: true };
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-    }
-    const holder2 = await readLock(path);
-    if (holder2 && holder2.pid !== process.pid && isRunning(holder2.pid)) {
-      return { acquired: false, heldBy: holder2.pid };
-    }
-    await unlink(path).catch(() => {
-    });
+function mergeWith(existing, state) {
+  if (!existing) return state;
+  try {
+    return Y.mergeUpdates([existing, state]);
+  } catch {
+    return state;
   }
-  const holder = await readLock(path);
-  return holder ? { acquired: false, heldBy: holder.pid } : { acquired: true };
 }
-async function releaseOrgLock(orgId) {
-  held.delete(orgId);
-  const path = lockPath(orgId);
-  const holder = await readLock(path);
-  if (holder && holder.pid !== process.pid) return;
-  await unlink(path).catch(() => {
-  });
+async function writeSyncDoc(orgId, state) {
+  await atomicWriteSecure(cachePath(orgId), mergeWith(await readSyncDoc(orgId), state));
 }
-function releaseAllOrgLocksSync() {
-  for (const orgId of held) {
-    const path = lockPath(orgId);
-    try {
-      const holder = JSON.parse(readFileSync(path, "utf-8"));
-      if (holder.pid === process.pid) unlinkSync(path);
-    } catch {
-    }
+function writeSyncDocSync(orgId, state) {
+  const path = cachePath(orgId);
+  let existing = null;
+  try {
+    existing = new Uint8Array(readFileSync(path));
+  } catch {
+  }
+  mkdirSync(dirname4(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  try {
+    writeFileSync(tmp, mergeWith(existing, state), { mode: 384 });
+    renameSync(tmp, path);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
   }
-  held.clear();
 }
 
 // ../server/src/services/cloud-sync-bridge.ts
 var LOCAL_ORIGIN = "local-bridge";
 var REMOTE_ORIGIN = "remote";
+var CACHE_ORIGIN = "cache";
+var PERSIST_DEBOUNCE_MS = 1e3;
 var RECONNECT_DELAY_MS = 3e3;
 var UNAUTHENTICATED_RETRY_MS = 5 * 6e4;
 var OUTDATED_RETRY_MS = 30 * 6e4;
@@ -6633,12 +6667,12 @@ var ProjectHeldElsewhereError = class extends Error {
   code = "PROJECT_HELD_ELSEWHERE";
 };
 var OrgSyncConnection = class {
-  doc = new Y.Doc();
+  doc = new Y2.Doc();
   projects = getCollection(this.doc, "projects");
   services = getCollection(this.doc, "services");
   environments = getCollection(this.doc, "environments");
   logParsers = getCollection(this.doc, PARSERS);
-  conn = randomUUID5();
+  conn = randomUUID6();
   link;
   stopped = false;
   initializing = true;
@@ -6674,6 +6708,31 @@ var OrgSyncConnection = class {
    * creating a project sees it appear on their teammates' machines.
    */
   initialDocApplied = false;
+  /**
+   * Whether local state has been written into the doc.
+   *
+   * Never before the doc holds the known history — reloaded from disk, or
+   * received from the cloud. Written into an empty doc, local state is
+   * concurrent with every past write and loses to some of them at random: an
+   * offline edit reverted, a service on disk erased by an older deletion.
+   */
+  seeded = false;
+  /** Store applications started by remote events and not finished yet. */
+  applying = /* @__PURE__ */ new Set();
+  /**
+   * When each entity was last changed by a remote update (`collection:id` → tick).
+   *
+   * Reconciliation reads the stores, waits, then writes what it read. A remote
+   * change landing in between makes that read stale, and writing it would erase
+   * the value that just arrived — for every member. Entities touched since the
+   * read began are left alone: their application brings the disk up to date,
+   * and the reconciliation it triggers starts from there.
+   */
+  remoteTouch = /* @__PURE__ */ new Map();
+  remoteClock = 0;
+  persistTimer = null;
+  /** The cache write under way, so stopping can wait for it to land. */
+  persisting = Promise.resolve();
   unsubscribes = [];
   onSaved = () => void this.reconcileLocalToDoc();
   constructor(link) {
@@ -6703,29 +6762,79 @@ var OrgSyncConnection = class {
         if (txn.origin !== REMOTE_ORIGIN) return;
         const isInitial = !this.initialDocApplied;
         if (name === "projects") this.initialDocApplied = true;
-        void this.applyDocEventsToStore(name, events, isInitial);
+        this.track(this.applyDocEventsToStore(name, events, isInitial));
       });
     }
     this.logParsers.observeDeep((events, txn) => {
       if (txn.origin !== REMOTE_ORIGIN) return;
-      void this.applyParserEventsToStore(events);
+      this.track(this.applyParserEventsToStore(events));
     });
     projectStore.events.on("saved", this.onSaved);
     this.unsubscribes.push(serviceStore.onChange(this.onSaved));
     this.unsubscribes.push(environmentStore.onChange(this.onSaved));
     this.unsubscribes.push(logParserStore.onLocalChange(this.onSaved));
+    const cached = await readSyncDoc(this.link.orgId);
+    if (cached) {
+      try {
+        Y2.applyUpdate(this.doc, cached, CACHE_ORIGIN);
+        this.initialDocApplied = true;
+      } catch (err) {
+        console.error("[cloud-sync] unreadable sync cache for org %s, ignored:", this.link.orgId, err.message);
+      }
+    }
+    this.doc.on("update", () => this.schedulePersist());
+    if (cached && this.initialDocApplied) await this.seed();
+    void this.streamLoop();
+  }
+  /** Write local state on top of the known history, then owe it to the cloud. */
+  async seed() {
+    this.seeded = true;
     await this.reconcileLocalToDoc();
     this.initializing = false;
     this.needsPush = true;
-    void this.streamLoop();
   }
+  track(work) {
+    this.applying.add(work);
+    void work.finally(() => this.applying.delete(work));
+  }
+  async settleApplying() {
+    while (this.applying.size > 0) await Promise.allSettled(this.applying);
+  }
+  schedulePersist() {
+    if (this.stopped || this.persistTimer) return;
+    this.persistTimer = setTimeout(() => {
+      this.persistTimer = null;
+      this.persisting = this.persisting.then(() => this.persist());
+    }, PERSIST_DEBOUNCE_MS);
+  }
+  async persist() {
+    if (this.stopped) return;
+    try {
+      await writeSyncDoc(this.link.orgId, Y2.encodeStateAsUpdate(this.doc));
+    } catch (err) {
+      console.error("[cloud-sync] could not save sync cache for org %s:", this.link.orgId, err.message);
+    }
+  }
+  /** Resolves once any cache write already under way has landed. */
   stop() {
     this.stopped = true;
     this.state = "stopped";
     projectStore.events.off("saved", this.onSaved);
     for (const off of this.unsubscribes.splice(0)) off();
     this.abort?.abort();
+    if (this.persistTimer) {
+      clearTimeout(this.persistTimer);
+      this.persistTimer = null;
+    }
+    if (this.seeded) {
+      try {
+        writeSyncDocSync(this.link.orgId, Y2.encodeStateAsUpdate(this.doc));
+      } catch (err) {
+        console.error("[cloud-sync] could not save sync cache for org %s:", this.link.orgId, err.message);
+      }
+    }
     this.doc.destroy();
+    return this.persisting;
   }
   // ---- Transport -------------------------------------------------------
   /**
@@ -6803,7 +6912,7 @@ var OrgSyncConnection = class {
       if (!svRes.ok) return;
       const { sv } = await svRes.json();
       const cloudSv = new Uint8Array(Buffer.from(sv, "base64"));
-      const diff = Y.encodeStateAsUpdate(this.doc, cloudSv);
+      const diff = Y2.encodeStateAsUpdate(this.doc, cloudSv);
       await this.pushUpdate(diff);
     } catch (err) {
       if (err instanceof SyncAuthError || err instanceof SyncOutdatedError) throw err;
@@ -6865,7 +6974,7 @@ var OrgSyncConnection = class {
   }
   async streamOnce() {
     this.abort = new AbortController();
-    const since = Buffer.from(Y.encodeStateVector(this.doc)).toString("base64");
+    const since = Buffer.from(Y2.encodeStateVector(this.doc)).toString("base64");
     const res = await fetch(this.url(`/stream?conn=${this.conn}&since=${encodeURIComponent(since)}`), {
       headers: { Authorization: await this.authHeader(), [APP_VERSION_HEADER]: appVersion },
       signal: this.abort.signal
@@ -6889,8 +6998,17 @@ var OrgSyncConnection = class {
         try {
           const payload = JSON.parse(line.slice(6));
           const update = new Uint8Array(Buffer.from(payload.update, "base64"));
-          Y.applyUpdate(this.doc, update, REMOTE_ORIGIN);
+          Y2.applyUpdate(this.doc, update, REMOTE_ORIGIN);
         } catch {
+          continue;
+        }
+        if (!this.seeded) {
+          this.initialDocApplied = true;
+          await this.settleApplying();
+          if (this.stopped) return;
+          await this.seed();
+          await this.initialPush();
+          this.needsPush = false;
         }
       }
     }
@@ -6971,7 +7089,7 @@ var OrgSyncConnection = class {
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir8(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir7(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -7012,6 +7130,7 @@ var OrgSyncConnection = class {
     } finally {
       this.pulling = false;
     }
+    await serviceStore.relocateAll();
     await this.reconcileLocalToDoc();
   }
   // ---- Local ↔ Doc reconciliation --------------------------------------
@@ -7034,6 +7153,7 @@ var OrgSyncConnection = class {
         if (typeof topKey === "string") affected.add(topKey);
       }
     }
+    for (const id of [...deleted, ...affected]) this.remoteTouch.set(`${name}:${id}`, ++this.remoteClock);
     for (const id of deleted) {
       if (!this.isTrackedForDeletion(name, id)) continue;
       await this.deleteLocally(name, id);
@@ -7186,7 +7306,9 @@ var OrgSyncConnection = class {
    * propagate — otherwise a service could never be removed.
    */
   async reconcileLocalToDoc() {
-    if (this.stopped || this.pulling) return;
+    if (this.stopped || this.pulling || !this.seeded) return;
+    const readAt = this.remoteClock;
+    const touchedSinceRead = (name, id) => (this.remoteTouch.get(`${name}:${id}`) ?? 0) > readAt;
     const projects = (await projectStore.listDiskFormByOrg(this.link.orgId)).filter((p) => !this.refusalFor(p.id));
     const projectIds = projects.map((p) => p.id);
     const serviceIds = [...new Set(projects.flatMap((p) => p.serviceIds ?? []))];
@@ -7204,10 +7326,12 @@ var OrgSyncConnection = class {
         const collection = this.collection(name);
         const entities = local[name];
         const ids = new Set(entities.map((e) => e.id));
-        for (const entity of entities) writeEntity(collection, entity.id, entity);
+        for (const entity of entities) {
+          if (!touchedSinceRead(name, entity.id)) writeEntity(collection, entity.id, entity);
+        }
         if (name === "projects") continue;
         for (const id of Array.from(collection.keys())) {
-          if (ids.has(id)) continue;
+          if (ids.has(id) || touchedSinceRead(name, id)) continue;
           if (this.belongsToOwnedProject(name, id, ownedProjectIds)) collection.delete(id);
         }
       }
@@ -7243,21 +7367,12 @@ var OrgSyncConnection = class {
 };
 var CloudSyncBridge = class {
   connections = /* @__PURE__ */ new Map();
-  /**
-   * Orgs another instance holds the lock on — reported, not retried blindly.
-   *
-   * Le pid du détenteur, et non un simple drapeau : « un autre Runeya de cette
-   * machine » ne dit pas lequel fermer, et l'utilisateur en a souvent trois.
-   * Le port se déduit du pid par le registre d'instances, au moment de rendre
-   * l'état — jamais mémorisé ici, où il vieillirait.
-   */
-  locked = /* @__PURE__ */ new Map();
   /**
    * Orgs whose key this machine does not have.
    *
-   * Held here for the same reason as `locked`: the connection is never opened,
-   * so there is nothing to ask for its state — and an org that cannot sync
-   * until a human supplies a key must not read as merely "stopped".
+   * Tenues à part : la connexion n'est jamais ouverte, donc il n'y a rien à qui
+   * demander son état — et une organisation qui ne peut pas synchroniser tant
+   * qu'un humain n'a pas fourni de clé ne doit pas se lire « arrêtée ».
    */
   keyMismatch = /* @__PURE__ */ new Set();
   started = false;
@@ -7341,22 +7456,14 @@ var CloudSyncBridge = class {
     const live = Array.from(this.connections.entries()).map(([orgId, conn]) => ({
       orgId,
       state: conn.getState(),
-      lastIncompatibleVersion: conn.getLastIncompatibleVersion(),
-      heldByPid: null
-    }));
-    const locked = Array.from(this.locked).filter(([orgId]) => !this.connections.has(orgId)).map(([orgId, pid]) => ({
-      orgId,
-      state: "locked",
-      lastIncompatibleVersion: null,
-      heldByPid: pid
+      lastIncompatibleVersion: conn.getLastIncompatibleVersion()
     }));
     const mismatched = Array.from(this.keyMismatch).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({
       orgId,
       state: "key-mismatch",
-      lastIncompatibleVersion: null,
-      heldByPid: null
+      lastIncompatibleVersion: null
     }));
-    return [...live, ...locked, ...mismatched];
+    return [...live, ...mismatched];
   }
   /**
    * Follow one project of an org on this machine, pulling it now.
@@ -7402,20 +7509,6 @@ var CloudSyncBridge = class {
       );
     }
     this.keyMismatch.delete(link.orgId);
-    const lock = await acquireOrgLock(link.orgId).catch((err) => {
-      console.error("[cloud-sync] could not take the lock for org %s:", link.orgId, err.message);
-      return { acquired: false, heldBy: 0 };
-    });
-    if (!lock.acquired) {
-      console.error(
-        "[cloud-sync] org %s is already being synced by another Runeya (pid %d) \u2014 not syncing it here",
-        link.orgId,
-        lock.heldBy
-      );
-      this.locked.set(link.orgId, lock.heldBy);
-      return;
-    }
-    this.locked.delete(link.orgId);
     const conn = new OrgSyncConnection(link);
     this.connections.set(link.orgId, conn);
     try {
@@ -7427,23 +7520,23 @@ var CloudSyncBridge = class {
   disconnect(orgId) {
     const existing = this.connections.get(orgId);
     if (existing) {
-      existing.stop();
+      void existing.stop();
       this.connections.delete(orgId);
-      void releaseOrgLock(orgId);
     }
   }
+  /** Stops at once; the promise only says when pending cache writes have landed. */
   stopAll() {
-    for (const conn of this.connections.values()) conn.stop();
+    const stopping = [...this.connections.values()].map((conn) => conn.stop());
     this.connections.clear();
-    this.locked.clear();
     this.keyMismatch.clear();
-    releaseAllOrgLocksSync();
+    return Promise.all(stopping).then(() => {
+    });
   }
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir9, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
 import { join as join11 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
@@ -7542,7 +7635,7 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const backups = [];
   for (const vaultRoot of touchedRoots) {
     const backupDir = join11(vaultRoot, `backup-key-${stamp}`);
-    await mkdir9(backupDir, { recursive: true });
+    await mkdir8(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
       await copyFile(join11(vaultRoot, name), join11(backupDir, name));
     }
@@ -7612,10 +7705,6 @@ async function assertOrgKey(orgId) {
 function syncState(orgId) {
   return cloudSyncBridge.states().find((s) => s.orgId === orgId)?.state ?? "stopped";
 }
-async function syncLockHolder(orgId) {
-  const pid = cloudSyncBridge.states().find((s) => s.orgId === orgId)?.heldByPid;
-  return pid ? describeInstance(pid) : null;
-}
 var cloudSyncRouter = router({
   /**
    * Follow one more project of an org, and pull it now.
@@ -7650,7 +7739,7 @@ var cloudSyncRouter = router({
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
-      return { pulled, state: syncState(input.orgId), heldBy: await syncLockHolder(input.orgId) };
+      return { pulled, state: syncState(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
         throw new TRPCError19({ code: "CONFLICT", message: err.code, cause: err });
@@ -7987,9 +8076,8 @@ var cloudSyncRouter = router({
   list: protectedProcedure.query(async () => {
     const links = await orgsToSync();
     const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s]));
-    return Promise.all(links.map(async (l) => {
+    return links.map((l) => {
       const found = states.get(l.orgId);
-      const heldBy = found?.heldByPid ? await describeInstance(found.heldByPid) : null;
       return {
         orgId: l.orgId,
         cloudUrl: l.cloudUrl,
@@ -7997,10 +8085,9 @@ var cloudSyncRouter = router({
         // Renseigné seulement quand le cloud a refusé cette app comme trop
         // ancienne : c'est lui qui publie le plancher, on ne le devine pas. La
         // borne est exclusive — il faut strictement plus récent que ce numéro.
-        lastIncompatibleVersion: found?.lastIncompatibleVersion ?? null,
-        heldBy
+        lastIncompatibleVersion: found?.lastIncompatibleVersion ?? null
       };
-    }));
+    });
   }),
   /**
    * The cloud instance behind every org vault on this machine.
@@ -8019,7 +8106,7 @@ var cloudSyncRouter = router({
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute, join as join12, resolve as resolve2, dirname as dirname4, basename } from "path";
+import { isAbsolute, join as join12, resolve as resolve2, dirname as dirname5, basename } from "path";
 import { z as z24 } from "zod";
 var MAX_ENTRIES2 = 500;
 var PATH_SCHEMA = z24.string().min(1).max(4096);
@@ -8067,7 +8154,7 @@ var filesystemRouter = router({
     return {
       path: dir,
       // Null at the filesystem root, which is what stops "up" from looping.
-      parent: dirname4(dir) === dir ? null : dirname4(dir),
+      parent: dirname5(dir) === dir ? null : dirname5(dir),
       name: basename(dir) || dir,
       entries: entries2,
       truncated,
@@ -8322,7 +8409,7 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir10, copyFile as copyFile2, unlink as unlink2, rename as rename5, stat as stat8 } from "fs/promises";
+import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename5, stat as stat8 } from "fs/promises";
 import { join as join13 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
@@ -8354,7 +8441,7 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backupDir = join13(legacyRoot, `backup-${stamp}`);
-  await mkdir10(backupDir, { recursive: true });
+  await mkdir9(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
     if (await exists2(join13(legacyRoot, name))) {
@@ -8388,7 +8475,7 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       );
     }
   }
-  await mkdir10(machineRootDir, { recursive: true });
+  await mkdir9(machineRootDir, { recursive: true });
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
@@ -8400,18 +8487,18 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
       continue;
     }
     await copyFile2(from, to);
-    await unlink2(from);
+    await unlink(from);
     moved.push(name);
   }
   for (const name of KEY_FILES) {
     const path = join13(legacyRoot, name);
-    if (await exists2(path)) await unlink2(path);
+    if (await exists2(path)) await unlink(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile7, writeFile as writeFile8, rename as rename6, unlink as unlink3, mkdir as mkdir11, chmod as chmod4, stat as stat9 } from "fs/promises";
+import { readFile as readFile7, writeFile as writeFile8, rename as rename6, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
 import { join as join14 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
@@ -8425,14 +8512,14 @@ async function legacySource(filename) {
   return null;
 }
 async function moveInto(root, filename, from) {
-  await mkdir11(root, { recursive: true });
+  await mkdir10(root, { recursive: true });
   const to = join14(root, filename);
   const contents = await readFile7(from, "utf-8");
   const tmp = to + ".tmp";
   await writeFile8(tmp, contents, "utf-8");
   await rename6(tmp, to);
   await chmod4(to, 384);
-  await unlink3(from);
+  await unlink2(from);
 }
 async function migrateSettingsIntoVaults() {
   const report = { movedTo: null, files: [], ambiguous: [] };
@@ -8465,16 +8552,16 @@ async function migrateSettingsIntoVaults() {
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes3, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import {
   readFile as readFile8,
   writeFile as writeFile9,
   rename as rename7,
-  mkdir as mkdir12,
+  mkdir as mkdir11,
   access as access2,
   readdir as readdir6
 } from "fs/promises";
-import { join as join15, dirname as dirname5 } from "path";
+import { join as join15, dirname as dirname6 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -8626,7 +8713,7 @@ async function runLegacyMigration(dataDir) {
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const legacyTmp = `${legacyRoot}-tmp`;
   await rename7(legacyRoot, legacyTmp);
-  await mkdir12(dataDir, { recursive: true });
+  await mkdir11(dataDir, { recursive: true });
   const legacyOld = join15(dataDir, `backup-${timestamp}`);
   await rename7(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
@@ -8683,11 +8770,11 @@ async function runLegacyMigration(dataDir) {
     const data = await readEncrypted(join15(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
-  const projectMonoId = randomUUID6();
+  const projectMonoId = randomUUID7();
   const envIdMap = {};
   const labelToKey = {};
   for (const [name, legacyEnv] of Object.entries(legacyEnvs)) {
-    envIdMap[name] = randomUUID6();
+    envIdMap[name] = randomUUID7();
     if (legacyEnv?.label) labelToKey[legacyEnv.label] = name;
   }
   const runeEnvs = [];
@@ -8712,7 +8799,7 @@ async function runLegacyMigration(dataDir) {
         if (hasInvalidInterpolation(value)) continue;
         const cleaned = cleanVarKey(key);
         if (inheritedVars[cleaned] === value) continue;
-        const varId = randomUUID6();
+        const varId = randomUUID7();
         variables[varId] = makeVariable(cleaned, value);
         varIdLookup.set(`${envIdMap[name]}:${cleaned}`, varId);
       }
@@ -8733,7 +8820,7 @@ async function runLegacyMigration(dataDir) {
   const serviceIdMap = {};
   const runeServices = [];
   for (const [name, legacy] of Object.entries(legacyServices)) {
-    const id = randomUUID6();
+    const id = randomUUID7();
     serviceIdMap[name] = id;
     const rootPath = legacy.rootPath || "";
     const rootPathCwd = rootPath && rootPath !== "." ? rootPath : "";
@@ -8742,7 +8829,7 @@ async function runLegacyMigration(dataDir) {
       const parts = [cmd.spawnCmd, ...cmd.spawnArgs || []].filter(Boolean);
       if (!parts.length) continue;
       commands.push({
-        id: cmd.id || randomUUID6(),
+        id: cmd.id || randomUUID7(),
         label: "Launch",
         command: parts.join(" "),
         cwd: cmd.spawnOptions?.cwd || "",
@@ -8803,7 +8890,7 @@ async function runLegacyMigration(dataDir) {
       const legacyBootstrapCmds = container.bootstrap?.commands || [];
       if (legacyBootstrapCmds.length > 0) {
         dockerConfig.bootstrapCommands = legacyBootstrapCmds.filter((bs) => bs.cmd || bs.entrypoint).map((bs, idx) => ({
-          id: bs.id || randomUUID6(),
+          id: bs.id || randomUUID7(),
           label: bs.label || `Bootstrap ${idx + 1}`,
           command: bs.cmd || "",
           ...bs.entrypoint ? { entrypoint: bs.entrypoint } : {},
@@ -8851,7 +8938,7 @@ async function runLegacyMigration(dataDir) {
       cwd: serviceCwd,
       runner: dockerConfig ? "docker" : "native",
       shortcuts: (legacy.shortcuts || []).filter((s) => s.spawnCmd || s.label).map((s) => ({
-        id: s.id || randomUUID6(),
+        id: s.id || randomUUID7(),
         label: s.label || s.spawnCmd || "",
         command: [s.spawnCmd, ...s.spawnArgs || []].filter(Boolean).join(" "),
         ...s.spawnOptions?.cwd ? { cwd: s.spawnOptions.cwd } : {}
@@ -8891,7 +8978,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: projectMonoId,
           name: `${service?.name || name} (${globalEnv.name})`,
           scope: "service",
@@ -8915,7 +9002,7 @@ async function runLegacyMigration(dataDir) {
         const varPost = typeof varData === "object" ? String(varData.suffix ?? "") : "";
         if (!varKey || existingKeys.has(cleanVarKey(varKey))) continue;
         const cleaned = cleanVarKey(varKey);
-        const varId = randomUUID6();
+        const varId = randomUUID7();
         svcScopedEnv.variables[varId] = makeVariable(cleaned, varValue, varPre, varPost);
         existingKeys.add(cleaned);
       }
@@ -8935,7 +9022,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: projectMonoId,
           name: `${service?.name || serviceName} (${globalEnv.name})`,
           scope: "service",
@@ -8956,7 +9043,7 @@ async function runLegacyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv.variables).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID6();
+          varId = randomUUID7();
           svcScopedEnv.variables[varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -8986,13 +9073,13 @@ async function runLegacyMigration(dataDir) {
             flatOverrides[varId] = makeVariable(cleaned, value);
           }
         } else {
-          flatOverrides[randomUUID6()] = makeVariable(cleaned, value);
+          flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
         }
       } else {
         const cleaned = cleanVarKey(key);
         const existingVarId = Object.entries(env2.variables).find(([, v]) => v.key === cleaned)?.[0];
         if (!existingVarId) {
-          const varId = randomUUID6();
+          const varId = randomUUID7();
           env2.variables[varId] = makeVariable(cleaned, value);
           varIdLookup.set(`${envId}:${cleaned}`, varId);
         }
@@ -9083,7 +9170,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve4 } = await import("path");
   const abDataDir = resolve4(dataDir);
   const candidateDirs = [
-    join15(dirname5(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join15(dirname6(env.DATA_DIR), ".runeya", "dbs", "overrides"),
     join15(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
@@ -9176,7 +9263,7 @@ async function runOverrideOnlyMigration(dataDir) {
         if (isSameAsBase(value, baseVar)) continue;
         flatOverrides[varId] = makeVariable(cleaned, value);
       } else {
-        flatOverrides[randomUUID6()] = makeVariable(cleaned, value);
+        flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
       }
     }
   }
@@ -9213,7 +9300,7 @@ async function runOverrideOnlyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: globalEnv["projectId"],
           name: `${service?.["name"] || serviceName} (${globalEnv["name"]})`,
           scope: "service",
@@ -9235,7 +9322,7 @@ async function runOverrideOnlyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv["variables"]).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID6();
+          varId = randomUUID7();
           svcScopedEnv["variables"][varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -10425,7 +10512,7 @@ async function createLocalServer() {
     stopClaudeTranscriptWatcher();
     stopCodexTranscriptWatcher();
     imageCleanupService.stop();
-    cloudSyncBridge.stopAll();
+    void cloudSyncBridge.stopAll();
     await Promise.all([
       unregisterInstance(),
       agentSpawner.shutdown(),
@@ -10442,7 +10529,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-4RQ3AMOL.js");
+  const { initCompanion } = await import("./companion-HEJHC3UR.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10572,7 +10659,7 @@ function onTrayServicesChanged(listener) {
 }
 
 // ../server/src/services/tray-icon.ts
-import { mkdir as mkdir13, writeFile as writeFile10, rename as rename8 } from "fs/promises";
+import { mkdir as mkdir12, writeFile as writeFile10, rename as rename8 } from "fs/promises";
 import { join as join17 } from "path";
 
 // ../server/src/services/png-to-ico.ts
@@ -10761,7 +10848,7 @@ async function renderThemedIcon(platform) {
 }
 async function writeTrayIcon(stem, png, platform) {
   const dir = trayIconDir();
-  await mkdir13(dir, { recursive: true });
+  await mkdir12(dir, { recursive: true });
   const path = join17(dir, stem);
   if (platform === "win32") {
     const ico = pngToIco(png);
@@ -10889,4 +10976,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-NRKK27F3.js.map
+//# sourceMappingURL=src-YUVA6WCM.js.map