@runeya/runeya 2.0.121 → 2.0.123

package/{src-JIS3X4OU.js → src-DN2IGASI.js}

@@ -17,7 +17,6 @@ import {
   apiKeyStore,
   appVersion,
   applyPersistedLanMode,
-  atomicWriteSecure,
   auditService,
   canEnvAction,
   chatRouter,
@@ -51,7 +50,6 @@ import {
   requireServiceAction,
   resolveAgentCwd,
   resolveConversationCwd,
-  resolveConversationRunDir,
   resolveEffectiveAgentId,
   resolveServiceVariables,
   resolveWorkspaceCwd,
@@ -64,7 +62,7 @@ import {
   soleAccountScope,
   startCliSession,
   vaultOfProject
-} from "./chunk-HJUFIZ7H.js";
+} from "./chunk-DUHCY3JU.js";
 import {
   resolveCliInvocation,
   whichCommand
@@ -87,7 +85,7 @@ import {
   stopClaudeTranscriptWatcher,
   stopCodexTranscriptWatcher,
   verifyJwt
-} from "./chunk-OVV52N5F.js";
+} from "./chunk-TNJFDWJX.js";
 import "./chunk-MD3VW4HQ.js";
 import {
   agentManager,
@@ -125,11 +123,15 @@ import {
   stableEncryptValue,
   traefikManager,
   unregisterInstance
-} from "./chunk-CNTL6NVU.js";
+} from "./chunk-MSLFR2EN.js";
 import {
   settingsManager
-} from "./chunk-3N55WR7F.js";
-import "./chunk-YZU5FNXR.js";
+} from "./chunk-N3ZI35SC.js";
+import {
+  atomicWriteSecure,
+  resolveConversationRunDir,
+  sweepStaleTempFiles
+} from "./chunk-HK5QNU6P.js";
 import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
@@ -165,6 +167,7 @@ import {
   writeEntity
 } from "./chunk-T2BV5WZE.js";
 import {
+  allVaultRoots,
   env,
   forgetOrgLogo,
   keyRoot,
@@ -6579,11 +6582,62 @@ async function reconcileOrgCanary(orgId) {
 }
 
 // ../server/src/services/cloud-sync-bridge.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 import { mkdir as mkdir7, rm as rm3 } from "fs/promises";
+import * as Y2 from "yjs";
+
+// ../server/src/services/sync-doc-cache.ts
+import { readFileSync, renameSync, rmSync, writeFileSync, mkdirSync } from "fs";
+import { readFile as readFile4 } from "fs/promises";
+import { dirname as dirname4, join as join10 } from "path";
+import { randomUUID as randomUUID5 } from "crypto";
 import * as Y from "yjs";
+var FILE = "sync-doc.bin";
+function cachePath(orgId) {
+  return join10(orgVaultRoot(orgId), FILE);
+}
+async function readSyncDoc(orgId) {
+  try {
+    return new Uint8Array(await readFile4(cachePath(orgId)));
+  } catch {
+    return null;
+  }
+}
+function mergeWith(existing, state) {
+  if (!existing) return state;
+  try {
+    return Y.mergeUpdates([existing, state]);
+  } catch {
+    return state;
+  }
+}
+async function writeSyncDoc(orgId, state) {
+  await atomicWriteSecure(cachePath(orgId), mergeWith(await readSyncDoc(orgId), state));
+}
+function writeSyncDocSync(orgId, state) {
+  const path = cachePath(orgId);
+  let existing = null;
+  try {
+    existing = new Uint8Array(readFileSync(path));
+  } catch {
+  }
+  mkdirSync(dirname4(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomUUID5()}.tmp`;
+  try {
+    writeFileSync(tmp, mergeWith(existing, state), { mode: 384 });
+    renameSync(tmp, path);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+// ../server/src/services/cloud-sync-bridge.ts
 var LOCAL_ORIGIN = "local-bridge";
 var REMOTE_ORIGIN = "remote";
+var CACHE_ORIGIN = "cache";
+var RESTORED_PROJECTS = "projectRestores";
+var PERSIST_DEBOUNCE_MS = 1e3;
 var RECONNECT_DELAY_MS = 3e3;
 var UNAUTHENTICATED_RETRY_MS = 5 * 6e4;
 var OUTDATED_RETRY_MS = 30 * 6e4;
@@ -6616,12 +6670,12 @@ var ProjectHeldElsewhereError = class extends Error {
   code = "PROJECT_HELD_ELSEWHERE";
 };
 var OrgSyncConnection = class {
-  doc = new Y.Doc();
+  doc = new Y2.Doc();
   projects = getCollection(this.doc, "projects");
   services = getCollection(this.doc, "services");
   environments = getCollection(this.doc, "environments");
   logParsers = getCollection(this.doc, PARSERS);
-  conn = randomUUID5();
+  conn = randomUUID6();
   link;
   stopped = false;
   initializing = true;
@@ -6657,6 +6711,39 @@ var OrgSyncConnection = class {
    * creating a project sees it appear on their teammates' machines.
    */
   initialDocApplied = false;
+  /**
+   * Whether local state has been written into the doc.
+   *
+   * Never before the doc holds the known history — reloaded from disk, or
+   * received from the cloud. Written into an empty doc, local state is
+   * concurrent with every past write and loses to some of them at random: an
+   * offline edit reverted, a service on disk erased by an older deletion.
+   */
+  seeded = false;
+  markOpened;
+  /**
+   * Réglée quand le document tient l'état d'ouverture du cloud — ou quand il ne
+   * l'aura pas : session refusée, app trop ancienne, connexion arrêtée.
+   */
+  opened = new Promise((resolve4) => {
+    this.markOpened = resolve4;
+  });
+  /** Store applications started by remote events and not finished yet. */
+  applying = /* @__PURE__ */ new Set();
+  /**
+   * When each entity was last changed by a remote update (`collection:id` → tick).
+   *
+   * Reconciliation reads the stores, waits, then writes what it read. A remote
+   * change landing in between makes that read stale, and writing it would erase
+   * the value that just arrived — for every member. Entities touched since the
+   * read began are left alone: their application brings the disk up to date,
+   * and the reconciliation it triggers starts from there.
+   */
+  remoteTouch = /* @__PURE__ */ new Map();
+  remoteClock = 0;
+  persistTimer = null;
+  /** The cache write under way, so stopping can wait for it to land. */
+  persisting = Promise.resolve();
   unsubscribes = [];
   onSaved = () => void this.reconcileLocalToDoc();
   constructor(link) {
@@ -6686,29 +6773,81 @@ var OrgSyncConnection = class {
         if (txn.origin !== REMOTE_ORIGIN) return;
         const isInitial = !this.initialDocApplied;
         if (name === "projects") this.initialDocApplied = true;
-        void this.applyDocEventsToStore(name, events, isInitial);
+        this.track(this.applyDocEventsToStore(name, events, isInitial));
       });
     }
     this.logParsers.observeDeep((events, txn) => {
       if (txn.origin !== REMOTE_ORIGIN) return;
-      void this.applyParserEventsToStore(events);
+      this.track(this.applyParserEventsToStore(events));
     });
     projectStore.events.on("saved", this.onSaved);
     this.unsubscribes.push(serviceStore.onChange(this.onSaved));
     this.unsubscribes.push(environmentStore.onChange(this.onSaved));
     this.unsubscribes.push(logParserStore.onLocalChange(this.onSaved));
+    const cached = await readSyncDoc(this.link.orgId);
+    let cacheLoaded = false;
+    if (cached) {
+      try {
+        Y2.applyUpdate(this.doc, cached, CACHE_ORIGIN);
+        cacheLoaded = true;
+      } catch (err) {
+        console.error("[cloud-sync] unreadable sync cache for org %s, ignored:", this.link.orgId, err.message);
+      }
+    }
+    this.doc.on("update", () => this.schedulePersist());
+    if (cacheLoaded) await this.seed();
+    void this.streamLoop();
+  }
+  /** Write local state on top of the known history, then owe it to the cloud. */
+  async seed() {
+    this.seeded = true;
     await this.reconcileLocalToDoc();
     this.initializing = false;
     this.needsPush = true;
-    void this.streamLoop();
   }
+  track(work) {
+    this.applying.add(work);
+    void work.finally(() => this.applying.delete(work));
+  }
+  async settleApplying() {
+    while (this.applying.size > 0) await Promise.allSettled(this.applying);
+  }
+  schedulePersist() {
+    if (this.stopped || this.persistTimer) return;
+    this.persistTimer = setTimeout(() => {
+      this.persistTimer = null;
+      this.persisting = this.persisting.then(() => this.persist());
+    }, PERSIST_DEBOUNCE_MS);
+  }
+  async persist() {
+    if (this.stopped) return;
+    try {
+      await writeSyncDoc(this.link.orgId, Y2.encodeStateAsUpdate(this.doc));
+    } catch (err) {
+      console.error("[cloud-sync] could not save sync cache for org %s:", this.link.orgId, err.message);
+    }
+  }
+  /** Resolves once any cache write already under way has landed. */
   stop() {
     this.stopped = true;
+    this.markOpened();
     this.state = "stopped";
     projectStore.events.off("saved", this.onSaved);
     for (const off of this.unsubscribes.splice(0)) off();
     this.abort?.abort();
+    if (this.persistTimer) {
+      clearTimeout(this.persistTimer);
+      this.persistTimer = null;
+    }
+    if (this.seeded) {
+      try {
+        writeSyncDocSync(this.link.orgId, Y2.encodeStateAsUpdate(this.doc));
+      } catch (err) {
+        console.error("[cloud-sync] could not save sync cache for org %s:", this.link.orgId, err.message);
+      }
+    }
     this.doc.destroy();
+    return this.persisting;
   }
   // ---- Transport -------------------------------------------------------
   /**
@@ -6745,6 +6884,7 @@ var OrgSyncConnection = class {
   }
   /** Remember the floor and stop pretending sync will resume on its own. */
   markOutdated(err) {
+    this.markOpened();
     const alreadyReported = this.state === "outdated";
     this.state = "outdated";
     this.lastIncompatibleVersion = err.lastIncompatibleVersion;
@@ -6757,6 +6897,7 @@ var OrgSyncConnection = class {
    * every slow retry: the point of retrying is to recover quietly.
    */
   markUnauthenticated(err) {
+    this.markOpened();
     const alreadyReported = this.state === "unauthenticated";
     this.state = "unauthenticated";
     this.needsPush = true;
@@ -6786,7 +6927,7 @@ var OrgSyncConnection = class {
       if (!svRes.ok) return;
       const { sv } = await svRes.json();
       const cloudSv = new Uint8Array(Buffer.from(sv, "base64"));
-      const diff = Y.encodeStateAsUpdate(this.doc, cloudSv);
+      const diff = Y2.encodeStateAsUpdate(this.doc, cloudSv);
       await this.pushUpdate(diff);
     } catch (err) {
       if (err instanceof SyncAuthError || err instanceof SyncOutdatedError) throw err;
@@ -6848,7 +6989,7 @@ var OrgSyncConnection = class {
   }
   async streamOnce() {
     this.abort = new AbortController();
-    const since = Buffer.from(Y.encodeStateVector(this.doc)).toString("base64");
+    const since = Buffer.from(Y2.encodeStateVector(this.doc)).toString("base64");
     const res = await fetch(this.url(`/stream?conn=${this.conn}&since=${encodeURIComponent(since)}`), {
       headers: { Authorization: await this.authHeader(), [APP_VERSION_HEADER]: appVersion },
       signal: this.abort.signal
@@ -6872,8 +7013,18 @@ var OrgSyncConnection = class {
         try {
           const payload = JSON.parse(line.slice(6));
           const update = new Uint8Array(Buffer.from(payload.update, "base64"));
-          Y.applyUpdate(this.doc, update, REMOTE_ORIGIN);
+          Y2.applyUpdate(this.doc, update, REMOTE_ORIGIN);
         } catch {
+          continue;
+        }
+        this.initialDocApplied = true;
+        this.markOpened();
+        if (!this.seeded) {
+          await this.settleApplying();
+          if (this.stopped) return;
+          await this.seed();
+          await this.initialPush();
+          this.needsPush = false;
         }
       }
     }
@@ -6996,6 +7147,7 @@ var OrgSyncConnection = class {
       this.pulling = false;
     }
     await serviceStore.relocateAll();
+    await environmentStore.relocateAll();
     await this.reconcileLocalToDoc();
   }
   // ---- Local ↔ Doc reconciliation --------------------------------------
@@ -7018,6 +7170,7 @@ var OrgSyncConnection = class {
         if (typeof topKey === "string") affected.add(topKey);
       }
     }
+    for (const id of [...deleted, ...affected]) this.remoteTouch.set(`${name}:${id}`, ++this.remoteClock);
     for (const id of deleted) {
       if (!this.isTrackedForDeletion(name, id)) continue;
       await this.deleteLocally(name, id);
@@ -7025,6 +7178,7 @@ var OrgSyncConnection = class {
     if (name === "projects" && !isInitial) {
       for (const id of added) {
         if (deleted.has(id) || this.tracked.has(id)) continue;
+        if (this.doc.getMap(RESTORED_PROJECTS).has(id)) continue;
         try {
           await this.followProject(id);
         } catch (err) {
@@ -7170,7 +7324,9 @@ var OrgSyncConnection = class {
    * propagate — otherwise a service could never be removed.
    */
   async reconcileLocalToDoc() {
-    if (this.stopped || this.pulling) return;
+    if (this.stopped || this.pulling || !this.seeded) return;
+    const readAt = this.remoteClock;
+    const touchedSinceRead = (name, id) => (this.remoteTouch.get(`${name}:${id}`) ?? 0) > readAt;
     const projects = (await projectStore.listDiskFormByOrg(this.link.orgId)).filter((p) => !this.refusalFor(p.id));
     const projectIds = projects.map((p) => p.id);
     const serviceIds = [...new Set(projects.flatMap((p) => p.serviceIds ?? []))];
@@ -7188,10 +7344,12 @@ var OrgSyncConnection = class {
         const collection = this.collection(name);
         const entities = local[name];
         const ids = new Set(entities.map((e) => e.id));
-        for (const entity of entities) writeEntity(collection, entity.id, entity);
+        for (const entity of entities) {
+          if (!touchedSinceRead(name, entity.id)) writeEntity(collection, entity.id, entity);
+        }
         if (name === "projects") continue;
         for (const id of Array.from(collection.keys())) {
-          if (ids.has(id)) continue;
+          if (ids.has(id) || touchedSinceRead(name, id)) continue;
           if (this.belongsToOwnedProject(name, id, ownedProjectIds)) collection.delete(id);
         }
       }
@@ -7380,21 +7538,43 @@ var CloudSyncBridge = class {
   disconnect(orgId) {
     const existing = this.connections.get(orgId);
     if (existing) {
-      existing.stop();
+      void existing.stop();
       this.connections.delete(orgId);
     }
   }
+  /**
+   * Attendre que le document d'une organisation tienne l'état du cloud.
+   *
+   * Suivre un projet juste après avoir ouvert la connexion ne trouvait rien : la
+   * trame d'ouverture n'était pas arrivée, et l'app concluait à un échec. Rend la
+   * main au plus tard après `timeoutMs` — l'appelant lit alors l'état.
+   */
+  async whenOpened(orgId, timeoutMs) {
+    const conn = this.connections.get(orgId);
+    if (!conn) return;
+    let timer;
+    await Promise.race([
+      conn.opened,
+      new Promise((resolve4) => {
+        timer = setTimeout(resolve4, timeoutMs);
+      })
+    ]);
+    clearTimeout(timer);
+  }
+  /** Stops at once; the promise only says when pending cache writes have landed. */
   stopAll() {
-    for (const conn of this.connections.values()) conn.stop();
+    const stopping = [...this.connections.values()].map((conn) => conn.stop());
     this.connections.clear();
     this.keyMismatch.clear();
+    return Promise.all(stopping).then(() => {
+    });
   }
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/key-adoption.ts
-import { readdir as readdir3, readFile as readFile4, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
-import { join as join10 } from "path";
+import { readdir as readdir3, readFile as readFile5, writeFile as writeFile6, mkdir as mkdir8, copyFile, rename as rename4, stat as stat5 } from "fs/promises";
+import { join as join11 } from "path";
 import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2 } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 function isAgentTriplet(value) {
@@ -7474,10 +7654,10 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const touchedRoots = /* @__PURE__ */ new Set();
   for (const vaultRoot of await rootsOfOrg(orgId)) {
     for (const name of await jsonFilesIn(vaultRoot)) {
-      const path = join10(vaultRoot, name);
+      const path = join11(vaultRoot, name);
       let parsed;
       try {
-        parsed = JSON.parse(await readFile4(path, "utf-8"));
+        parsed = JSON.parse(await readFile5(path, "utf-8"));
       } catch {
         continue;
       }
@@ -7491,14 +7671,14 @@ async function adoptOrgKey(orgId, newKey, masterPassword, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
   const backups = [];
   for (const vaultRoot of touchedRoots) {
-    const backupDir = join10(vaultRoot, `backup-key-${stamp}`);
+    const backupDir = join11(vaultRoot, `backup-key-${stamp}`);
     await mkdir8(backupDir, { recursive: true });
     for (const name of await jsonFilesIn(vaultRoot)) {
-      await copyFile(join10(vaultRoot, name), join10(backupDir, name));
+      await copyFile(join11(vaultRoot, name), join11(backupDir, name));
     }
     for (const name of [".encryption.key.enc", ".runeya-verify"]) {
-      if (await exists(join10(vaultRoot, name))) {
-        await copyFile(join10(vaultRoot, name), join10(backupDir, name));
+      if (await exists(join11(vaultRoot, name))) {
+        await copyFile(join11(vaultRoot, name), join11(backupDir, name));
       }
     }
     backups.push(backupDir);
@@ -7536,6 +7716,7 @@ async function accountScope(orgId) {
   const accountId = await accountForOrg(orgId);
   return accountId ? { accountId } : {};
 }
+var OPENING_TIMEOUT_MS = 1e4;
 async function assertOrgReadable(orgId) {
   try {
     await assertOrgVaultReadable(orgId);
@@ -7594,6 +7775,7 @@ var cloudSyncRouter = router({
     } else if (input.accountId) {
       await stampOrgCloud(input.orgId, input.cloudUrl, void 0, input.accountId);
     }
+    await cloudSyncBridge.whenOpened(input.orgId, OPENING_TIMEOUT_MS);
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
       return { pulled, state: syncState(input.orgId) };
@@ -7963,13 +8145,13 @@ var cloudSyncRouter = router({
 // ../server/src/trpc/routers/filesystem.ts
 import { readdir as readdir4, stat as stat6 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { isAbsolute, join as join11, resolve as resolve2, dirname as dirname4, basename } from "path";
+import { isAbsolute, join as join12, resolve as resolve2, dirname as dirname5, basename } from "path";
 import { z as z24 } from "zod";
 var MAX_ENTRIES2 = 500;
 var PATH_SCHEMA = z24.string().min(1).max(4096);
 function safeResolve(input) {
   if (input.includes("\0")) throw new Error("Chemin invalide");
-  const expanded = input.startsWith("~") ? join11(homedir3(), input.slice(1)) : input;
+  const expanded = input.startsWith("~") ? join12(homedir3(), input.slice(1)) : input;
   if (!isAbsolute(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
   return resolve2(expanded);
 }
@@ -8005,13 +8187,13 @@ var filesystemRouter = router({
     const truncated = names.length > MAX_ENTRIES2;
     const entries2 = [];
     for (const name of names.slice(0, MAX_ENTRIES2)) {
-      const path = join11(dir, name);
+      const path = join12(dir, name);
       entries2.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
     }
     return {
       path: dir,
       // Null at the filesystem root, which is what stops "up" from looping.
-      parent: dirname4(dir) === dir ? null : dirname4(dir),
+      parent: dirname5(dir) === dir ? null : dirname5(dir),
       name: basename(dir) || dir,
       entries: entries2,
       truncated,
@@ -8266,8 +8448,8 @@ async function ensureFilePermissions() {
 }
 
 // ../server/src/services/vault-migration.ts
-import { readdir as readdir5, readFile as readFile5, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename5, stat as stat8 } from "fs/promises";
-import { join as join12 } from "path";
+import { readdir as readdir5, readFile as readFile6, writeFile as writeFile7, mkdir as mkdir9, copyFile as copyFile2, unlink, rename as rename5, stat as stat8 } from "fs/promises";
+import { join as join13 } from "path";
 var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
 var MACHINE_FILES = [
   "agents.json",
@@ -8297,17 +8479,17 @@ async function openLegacyVault(legacyRoot, masterPassword) {
 }
 async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
   const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const backupDir = join12(legacyRoot, `backup-${stamp}`);
+  const backupDir = join13(legacyRoot, `backup-${stamp}`);
   await mkdir9(backupDir, { recursive: true });
   const jsonFiles = await vaultJsonFiles(legacyRoot);
   for (const name of [...jsonFiles, ...KEY_FILES]) {
-    if (await exists2(join12(legacyRoot, name))) {
-      await copyFile2(join12(legacyRoot, name), join12(backupDir, name));
+    if (await exists2(join13(legacyRoot, name))) {
+      await copyFile2(join13(legacyRoot, name), join13(backupDir, name));
     }
   }
   const rekeyed = [];
   for (const name of jsonFiles) {
-    const raw = await readFile5(join12(legacyRoot, name), "utf-8");
+    const raw = await readFile6(join13(legacyRoot, name), "utf-8");
     let parsed;
     try {
       parsed = JSON.parse(raw);
@@ -8317,13 +8499,13 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     const counter = { n: 0 };
     const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
     if (counter.n === 0) continue;
-    const tmp = join12(legacyRoot, `${name}.tmp`);
+    const tmp = join13(legacyRoot, `${name}.tmp`);
     await writeFile7(tmp, JSON.stringify(converted, null, 2), "utf-8");
-    await rename5(tmp, join12(legacyRoot, name));
+    await rename5(tmp, join13(legacyRoot, name));
     rekeyed.push({ file: name, values: counter.n });
   }
   for (const { file, values } of rekeyed) {
-    const parsed = JSON.parse(await readFile5(join12(legacyRoot, file), "utf-8"));
+    const parsed = JSON.parse(await readFile6(join13(legacyRoot, file), "utf-8"));
     const check = { n: 0 };
     rekeyValue(parsed, machineKey, machineKey, check);
     if (check.n !== values) {
@@ -8336,9 +8518,9 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
   const moved = [];
   const skipped = [];
   for (const name of MACHINE_FILES) {
-    const from = join12(legacyRoot, name);
+    const from = join13(legacyRoot, name);
     if (!await exists2(from)) continue;
-    const to = join12(machineRootDir, name);
+    const to = join13(machineRootDir, name);
     if (await exists2(to)) {
       skipped.push(name);
       continue;
@@ -8348,15 +8530,15 @@ async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machine
     moved.push(name);
   }
   for (const name of KEY_FILES) {
-    const path = join12(legacyRoot, name);
+    const path = join13(legacyRoot, name);
     if (await exists2(path)) await unlink(path);
   }
   return { backupDir, rekeyed, moved, skipped };
 }
 
 // ../server/src/services/settings-migration.ts
-import { readFile as readFile6, writeFile as writeFile8, rename as rename6, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
-import { join as join13 } from "path";
+import { readFile as readFile7, writeFile as writeFile8, rename as rename6, unlink as unlink2, mkdir as mkdir10, chmod as chmod4, stat as stat9 } from "fs/promises";
+import { join as join14 } from "path";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 async function exists3(path) {
@@ -8370,8 +8552,8 @@ async function legacySource(filename) {
 }
 async function moveInto(root, filename, from) {
   await mkdir10(root, { recursive: true });
-  const to = join13(root, filename);
-  const contents = await readFile6(from, "utf-8");
+  const to = join14(root, filename);
+  const contents = await readFile7(from, "utf-8");
   const tmp = to + ".tmp";
   await writeFile8(tmp, contents, "utf-8");
   await rename6(tmp, to);
@@ -8395,7 +8577,7 @@ async function migrateSettingsIntoVaults() {
   const orgId = orgs[0];
   const root = orgVaultRoot(orgId);
   for (const { filename, from } of sources) {
-    if (await exists3(join13(root, filename))) continue;
+    if (await exists3(join14(root, filename))) continue;
     await moveInto(root, filename, from);
     report.files.push(filename);
   }
@@ -8409,16 +8591,16 @@ async function migrateSettingsIntoVaults() {
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes3, createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3 } from "crypto";
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 import {
-  readFile as readFile7,
+  readFile as readFile8,
   writeFile as writeFile9,
   rename as rename7,
   mkdir as mkdir11,
   access as access2,
   readdir as readdir6
 } from "fs/promises";
-import { join as join14, dirname as dirname5 } from "path";
+import { join as join15, dirname as dirname6 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -8535,7 +8717,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile7(filePath, "utf-8")).trim();
+  const raw = (await readFile8(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -8560,7 +8742,7 @@ async function atomicWrite(path, data) {
 }
 async function runLegacyMigration(dataDir) {
   const legacyRoot = env.DATA_DIR;
-  const legacyKeyPath = join14(legacyRoot, "dbs", "encryption-key.json");
+  const legacyKeyPath = join15(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -8571,17 +8753,17 @@ async function runLegacyMigration(dataDir) {
   const legacyTmp = `${legacyRoot}-tmp`;
   await rename7(legacyRoot, legacyTmp);
   await mkdir11(dataDir, { recursive: true });
-  const legacyOld = join14(dataDir, `backup-${timestamp}`);
+  const legacyOld = join15(dataDir, `backup-${timestamp}`);
   await rename7(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile7(join14(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile8(join15(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join14(legacyOld, "dbs");
+  const dbsDir = join15(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -8590,29 +8772,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join14(dbsDir, "envs");
+  const envsDir = join15(dbsDir, "envs");
   const envFiles = (await readdir6(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join14(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join15(envsDir, file));
   }
-  const servicesDir = join14(dbsDir, "services");
+  const servicesDir = join15(dbsDir, "services");
   const serviceFiles = (await readdir6(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join14(servicesDir, file));
+    const data = await readEncrypted(join15(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join14(dbsDir, "overrides");
+  const overridesDir = join15(dbsDir, "overrides");
   const overrideFiles = (await readdir6(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join14(overridesDir, file));
+    const data = await readEncrypted(join15(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -8620,18 +8802,18 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join14(dbsDir, "parsers");
+  const parsersDir = join15(dbsDir, "parsers");
   const parserFiles = (await readdir6(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join14(parsersDir, file));
+    const data = await readEncrypted(join15(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
-  const projectMonoId = randomUUID6();
+  const projectMonoId = randomUUID7();
   const envIdMap = {};
   const labelToKey = {};
   for (const [name, legacyEnv] of Object.entries(legacyEnvs)) {
-    envIdMap[name] = randomUUID6();
+    envIdMap[name] = randomUUID7();
     if (legacyEnv?.label) labelToKey[legacyEnv.label] = name;
   }
   const runeEnvs = [];
@@ -8656,7 +8838,7 @@ async function runLegacyMigration(dataDir) {
         if (hasInvalidInterpolation(value)) continue;
         const cleaned = cleanVarKey(key);
         if (inheritedVars[cleaned] === value) continue;
-        const varId = randomUUID6();
+        const varId = randomUUID7();
         variables[varId] = makeVariable(cleaned, value);
         varIdLookup.set(`${envIdMap[name]}:${cleaned}`, varId);
       }
@@ -8677,7 +8859,7 @@ async function runLegacyMigration(dataDir) {
   const serviceIdMap = {};
   const runeServices = [];
   for (const [name, legacy] of Object.entries(legacyServices)) {
-    const id = randomUUID6();
+    const id = randomUUID7();
     serviceIdMap[name] = id;
     const rootPath = legacy.rootPath || "";
     const rootPathCwd = rootPath && rootPath !== "." ? rootPath : "";
@@ -8686,7 +8868,7 @@ async function runLegacyMigration(dataDir) {
       const parts = [cmd.spawnCmd, ...cmd.spawnArgs || []].filter(Boolean);
       if (!parts.length) continue;
       commands.push({
-        id: cmd.id || randomUUID6(),
+        id: cmd.id || randomUUID7(),
         label: "Launch",
         command: parts.join(" "),
         cwd: cmd.spawnOptions?.cwd || "",
@@ -8747,7 +8929,7 @@ async function runLegacyMigration(dataDir) {
       const legacyBootstrapCmds = container.bootstrap?.commands || [];
       if (legacyBootstrapCmds.length > 0) {
         dockerConfig.bootstrapCommands = legacyBootstrapCmds.filter((bs) => bs.cmd || bs.entrypoint).map((bs, idx) => ({
-          id: bs.id || randomUUID6(),
+          id: bs.id || randomUUID7(),
           label: bs.label || `Bootstrap ${idx + 1}`,
           command: bs.cmd || "",
           ...bs.entrypoint ? { entrypoint: bs.entrypoint } : {},
@@ -8795,7 +8977,7 @@ async function runLegacyMigration(dataDir) {
       cwd: serviceCwd,
       runner: dockerConfig ? "docker" : "native",
       shortcuts: (legacy.shortcuts || []).filter((s) => s.spawnCmd || s.label).map((s) => ({
-        id: s.id || randomUUID6(),
+        id: s.id || randomUUID7(),
         label: s.label || s.spawnCmd || "",
         command: [s.spawnCmd, ...s.spawnArgs || []].filter(Boolean).join(" "),
         ...s.spawnOptions?.cwd ? { cwd: s.spawnOptions.cwd } : {}
@@ -8835,7 +9017,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: projectMonoId,
           name: `${service?.name || name} (${globalEnv.name})`,
           scope: "service",
@@ -8859,7 +9041,7 @@ async function runLegacyMigration(dataDir) {
         const varPost = typeof varData === "object" ? String(varData.suffix ?? "") : "";
         if (!varKey || existingKeys.has(cleanVarKey(varKey))) continue;
         const cleaned = cleanVarKey(varKey);
-        const varId = randomUUID6();
+        const varId = randomUUID7();
         svcScopedEnv.variables[varId] = makeVariable(cleaned, varValue, varPre, varPost);
         existingKeys.add(cleaned);
       }
@@ -8879,7 +9061,7 @@ async function runLegacyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: projectMonoId,
           name: `${service?.name || serviceName} (${globalEnv.name})`,
           scope: "service",
@@ -8900,7 +9082,7 @@ async function runLegacyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv.variables).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID6();
+          varId = randomUUID7();
           svcScopedEnv.variables[varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -8930,13 +9112,13 @@ async function runLegacyMigration(dataDir) {
             flatOverrides[varId] = makeVariable(cleaned, value);
           }
         } else {
-          flatOverrides[randomUUID6()] = makeVariable(cleaned, value);
+          flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
         }
       } else {
         const cleaned = cleanVarKey(key);
         const existingVarId = Object.entries(env2.variables).find(([, v]) => v.key === cleaned)?.[0];
         if (!existingVarId) {
-          const varId = randomUUID6();
+          const varId = randomUUID7();
           env2.variables[varId] = makeVariable(cleaned, value);
           varIdLookup.set(`${envId}:${cleaned}`, varId);
         }
@@ -8965,7 +9147,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile7(join14(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile8(join15(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -8986,11 +9168,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join14(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join14(dataDir, "services.json"), runeServices);
-  await atomicWrite(join14(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join14(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join14(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join15(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join15(dataDir, "services.json"), runeServices);
+  await atomicWrite(join15(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join15(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join15(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -9004,9 +9186,9 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries2 = await readdir6(dataDir);
     const backupDirs = entries2.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join14(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join15(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile7(keyJsonPath, "utf-8");
+        const raw = await readFile8(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -9027,8 +9209,8 @@ async function runOverrideOnlyMigration(dataDir) {
   const { resolve: resolve4 } = await import("path");
   const abDataDir = resolve4(dataDir);
   const candidateDirs = [
-    join14(dirname5(env.DATA_DIR), ".runeya", "dbs", "overrides"),
-    join14(abDataDir, "dbs", "overrides")
+    join15(dirname6(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join15(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -9044,7 +9226,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join14(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join15(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -9062,7 +9244,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile7(join14(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile8(join15(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -9081,7 +9263,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile7(join14(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile8(join15(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -9098,7 +9280,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join14(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9120,12 +9302,12 @@ async function runOverrideOnlyMigration(dataDir) {
         if (isSameAsBase(value, baseVar)) continue;
         flatOverrides[varId] = makeVariable(cleaned, value);
       } else {
-        flatOverrides[randomUUID6()] = makeVariable(cleaned, value);
+        flatOverrides[randomUUID7()] = makeVariable(cleaned, value);
       }
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join14(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join15(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -9135,7 +9317,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join14(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join15(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -9157,7 +9339,7 @@ async function runOverrideOnlyMigration(dataDir) {
       );
       if (!svcScopedEnv) {
         svcScopedEnv = {
-          id: randomUUID6(),
+          id: randomUUID7(),
           projectId: globalEnv["projectId"],
           name: `${service?.["name"] || serviceName} (${globalEnv["name"]})`,
           scope: "service",
@@ -9179,7 +9361,7 @@ async function runOverrideOnlyMigration(dataDir) {
         const baseEntry = Object.entries(svcScopedEnv["variables"]).find(([, v]) => v.key === cleaned);
         let varId = baseEntry?.[0];
         if (!varId) {
-          varId = randomUUID6();
+          varId = randomUUID7();
           svcScopedEnv["variables"][varId] = {
             key: cleaned,
             value: { value: "", pre: "", post: "", isSecret: false, shareWithAi: false, injectIntoAi: false, required: false, overrideOnly: false, description: "" }
@@ -9194,7 +9376,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join14(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join15(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -9209,7 +9391,7 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import { stat as stat10 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
@@ -9219,22 +9401,22 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat10(join15(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat10(join16(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat10(join15(dataDir, VERIFY_FILENAME2));
+    await stat10(join16(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat10(join15(dataDir, "projects.json"));
+    await stat10(join16(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat10(join15(dataDir, "project.json"));
+    await stat10(join16(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -9754,6 +9936,11 @@ async function createLocalServer() {
     await serviceStore.list().catch((err) => {
       console.warn("[server] Failed to preload services:", err);
     });
+    void (async () => {
+      const orgRoots = (await listOrgVaults()).map((orgId) => orgVaultRoot(orgId));
+      const removed = await sweepStaleTempFiles([machineRoot(), ...orgRoots, ...await allVaultRoots()]);
+      if (removed > 0) console.log(`[server] ${removed} fichier(s) temporaire(s) orphelin(s) retir\xE9(s)`);
+    })().catch((err) => console.warn("[server] Temp file sweep failed:", err));
     cloudSyncBridge.start().catch((err) => {
       console.warn("[server] Failed to start cloud sync bridge:", err);
     });
@@ -10369,7 +10556,7 @@ async function createLocalServer() {
     stopClaudeTranscriptWatcher();
     stopCodexTranscriptWatcher();
     imageCleanupService.stop();
-    cloudSyncBridge.stopAll();
+    void cloudSyncBridge.stopAll();
     await Promise.all([
       unregisterInstance(),
       agentSpawner.shutdown(),
@@ -10386,7 +10573,7 @@ async function createLocalServer() {
     ]);
     console.log("[server] Shutdown complete");
   };
-  const { initCompanion } = await import("./companion-AUMA6RGX.js");
+  const { initCompanion } = await import("./companion-7VOV4W3T.js");
   initCompanion();
   return { app, server, wss, shutdown };
 }
@@ -10517,7 +10704,7 @@ function onTrayServicesChanged(listener) {
 
 // ../server/src/services/tray-icon.ts
 import { mkdir as mkdir12, writeFile as writeFile10, rename as rename8 } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 
 // ../server/src/services/png-to-ico.ts
 function isPng(bytes) {
@@ -10677,7 +10864,7 @@ var FETCH_TIMEOUT_MS = 3e3;
 var CACHE_TTL_MS = 10 * 6e4;
 var cache2 = /* @__PURE__ */ new Map();
 function trayIconDir() {
-  return join16(machineRoot(), "tray-icons");
+  return join17(machineRoot(), "tray-icons");
 }
 async function resolveTrayIcon(platform = process.platform) {
   const orgId = getCurrentProject()?.orgId;
@@ -10706,7 +10893,7 @@ async function renderThemedIcon(platform) {
 async function writeTrayIcon(stem, png, platform) {
   const dir = trayIconDir();
   await mkdir12(dir, { recursive: true });
-  const path = join16(dir, stem);
+  const path = join17(dir, stem);
   if (platform === "win32") {
     const ico = pngToIco(png);
     return ico ? writeAtomic(`${path}.ico`, ico) : null;
@@ -10833,4 +11020,4 @@ export {
   startProcess,
   stopProcess
 };
-//# sourceMappingURL=src-JIS3X4OU.js.map
+//# sourceMappingURL=src-DN2IGASI.js.map