@runeya/runeya 2.0.21 → 2.0.24

package/agent/index.js

@@ -39,7 +39,6 @@ var t = initTRPC.context().create({
   }
 });
 var router = t.router;
-var publicProcedure = t.procedure;
 var authMiddleware = t.middleware(({ ctx, next }) => {
   const { authorization } = ctx;
   if (!authorization) {
@@ -1432,6 +1431,13 @@ var ResolvedEnvironmentSchema = z15.object({
     resolvedFrom: z15.object({
       environmentId: z15.string().max(128),
       environmentName: z15.string().max(200)
+    }).optional(),
+    // Set when a machine-local override was applied to this variable, pointing
+    // at the environment that carries the winning override. Distinct from
+    // `overridden`, which also covers "shadows an inherited variable".
+    overriddenBy: z15.object({
+      environmentId: z15.string().max(128),
+      environmentName: z15.string().max(200)
     }).optional()
   })).refine((obj) => Object.keys(obj).length <= 500, { message: "Max 500 source entries" })
 });
@@ -1457,9 +1463,12 @@ var UpdateEnvironmentSchema = EnvironmentSchema.partial().required({ id: true })
 
 // ../../packages/shared/src/schemas/environment-overrides.schema.ts
 import { z as z16 } from "zod";
+var VariableOverrideSchema = z16.object({
+  value: VariableSlotSchema
+});
 var EnvironmentOverridesSchema = z16.record(
   z16.string().max(128),
-  VariableSchema
+  VariableOverrideSchema
 ).refine(
   (obj) => Object.keys(obj).length <= 5e3,
   { message: "Max 5000 overrides" }
@@ -1498,8 +1507,15 @@ var ApiKeySchema = z17.object({
   createdAt: z17.string().max(64),
   isPublic: z17.boolean().default(false)
 });
+var PersistedApiKeySchema = ApiKeySchema.extend({
+  key: z17.string().min(1).max(4096)
+});
 var ApiKeysFileSchema = z17.object({
-  keys: z17.array(ApiKeySchema).max(100)
+  keys: z17.array(PersistedApiKeySchema).max(100)
+});
+var MaskedApiKeySchema = ApiKeySchema.omit({ key: true }).extend({
+  /** Last 4 characters of the secret, for recognising a key in a list. */
+  keyPreview: z17.string().max(8)
 });
 
 // ../../packages/shared/src/schemas/image.schema.ts
@@ -1529,13 +1545,35 @@ var ImageMetaSchema = z18.object({
 
 // ../../packages/shared/src/schemas/kanban.schema.ts
 import { z as z19 } from "zod";
+var KanbanAttachmentSchema = z19.object({
+  /** Server-issued id, also the storage key. */
+  id: z19.string().max(128),
+  name: z19.string().max(255),
+  size: z19.number().int().nonnegative(),
+  contentType: z19.string().max(128)
+});
 var KanbanCardEventSchema = z19.object({
   type: z19.enum(["created", "edited", "moved", "image_added", "image_removed", "title_changed", "conversation_started", "scenario_started", "comment"]),
   timestamp: z19.string(),
   /** Extra context: old/new column name, old/new title, comment text, etc. */
   detail: z19.string().max(5e3).optional(),
+  /**
+   * Stable identity of the event, used to tell an edit from an insertion when a
+   * whole history is written back. Absent on events recorded before the field
+   * existed; those fall back to (type, timestamp).
+   */
+  id: z19.string().max(128).optional(),
   /** Who authored this event — 'ai' or 'user'. Only set for comment events. */
   author: z19.enum(["ai", "user"]).optional(),
+  /**
+   * The human behind a comment, stamped by the server. This is what makes
+   * "my own comment" answerable; `author` only separates AI from human.
+   */
+  authorUser: z19.object({ id: z19.string().max(128), name: z19.string().max(200) }).optional(),
+  /** Set when the author amended their comment, so the UI can say so. */
+  editedAt: z19.string().optional(),
+  /** Files attached to a comment — same storage as a card's own attachments. */
+  attachments: z19.array(KanbanAttachmentSchema).max(20).optional(),
   /** Conversation that produced this event (comments only). Used to navigate back to the conversation. */
   conversationId: z19.string().optional()
 });
@@ -1543,12 +1581,29 @@ var KanbanCardSchema = z19.object({
   id: z19.string(),
   title: z19.string().min(1).max(500),
   markdown: z19.string().max(1e5).default(""),
-  /** Base64-encoded image data URIs attached to the card */
+  /**
+   * Legacy inline images, kept so boards written before object storage still
+   * render. New uploads go to `attachments` instead.
+   */
   images: z19.array(z19.string()).default([]),
+  /** Files attached to the card — stored out of band, referenced here. */
+  attachments: z19.array(KanbanAttachmentSchema).max(50).default([]),
   order: z19.number().int(),
   history: z19.array(KanbanCardEventSchema).default([]),
   createdAt: z19.string(),
-  updatedAt: z19.string()
+  updatedAt: z19.string(),
+  /**
+   * People assigned to the card. Names are denormalized for display; the server
+   * keeps only members of the owning organization, and notifies newcomers.
+   */
+  assignees: z19.array(z19.object({ id: z19.string().max(128), name: z19.string().max(200) })).max(20).default([]),
+  /**
+   * Who first created the card. Stamped by the server the first time a card id
+   * appears in a board write, never taken from the client — a member could
+   * otherwise claim any authorship. Absent on cards created before this field
+   * existed, so readers must treat it as unknown rather than assume.
+   */
+  createdBy: z19.object({ id: z19.string().max(128), name: z19.string().max(200) }).optional()
 });
 var KanbanColumnSchema = z19.object({
   id: z19.string(),
@@ -1583,6 +1638,8 @@ import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypt
 // ../../packages/shared/src/js-log-parser.ts
 import vm from "vm";
 var VALID_LEVELS = /* @__PURE__ */ new Set(["debug", "info", "warn", "error", "fatal"]);
+var PARSE_TIMEOUT_MS = 50;
+var MAX_CONSECUTIVE_TIMEOUTS = 10;
 var JSLogParser = class {
   parsers = [];
   constructor(definitions = []) {
@@ -1620,6 +1677,16 @@ var JSLogParser = class {
     }
     return this.sanitize(current);
   }
+  /**
+   * Compile le code utilisateur en une fonction bornée en temps.
+   *
+   * Le `timeout` de `runInNewContext` ne couvre que l'évaluation de la factory :
+   * la closure retournée s'exécutait ensuite ligne par ligne directement sur
+   * l'event loop, sans aucune borne. Une regex à backtracking exponentiel
+   * fournie par l'utilisateur figeait donc l'agent entier — logs, statuts et
+   * métriques de *tous* les services. Chaque invocation repasse maintenant par
+   * la vm, avec son propre budget.
+   */
   compileParser(def) {
     const forbidden = ["require(", "import ", "eval("];
     for (const pat of forbidden) {
@@ -1644,17 +1711,44 @@ var JSLogParser = class {
     } catch (err) {
       throw new Error(`Compilation failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    const context = vm.createContext({ ...sandbox, __line: null, __result: null });
     let parserFn;
     try {
-      parserFn = script.runInNewContext(sandbox, { timeout: 100 });
+      parserFn = script.runInContext(context, { timeout: 100 });
     } catch (err) {
       throw new Error(`Execution failed: ${err instanceof Error ? err.message : String(err)}`);
     }
     if (typeof parserFn !== "function") {
       throw new Error("Parser code must export a function");
     }
+    context["__parserFn"] = parserFn;
+    const callScript = new vm.Script("__result = __parserFn(__line);", {
+      filename: `parser-${def.id}-call.js`
+    });
+    let consecutiveTimeouts = 0;
+    let disabled = false;
     return (line) => {
-      const result = parserFn(line);
+      if (disabled) return line;
+      const ctx = context;
+      ctx["__line"] = line;
+      ctx["__result"] = null;
+      try {
+        callScript.runInContext(context, { timeout: PARSE_TIMEOUT_MS });
+        consecutiveTimeouts = 0;
+      } catch (err) {
+        const e = err;
+        const timedOut = !!e && (e.code === "ERR_SCRIPT_EXECUTION_TIMEOUT" || typeof e.message === "string" && /execution timed out/i.test(e.message));
+        if (!timedOut) throw err;
+        consecutiveTimeouts += 1;
+        if (consecutiveTimeouts >= MAX_CONSECUTIVE_TIMEOUTS) {
+          disabled = true;
+          console.warn(
+            `[js-log-parser] Parser "${def.name}" (${def.id}) disabled after ${MAX_CONSECUTIVE_TIMEOUTS} consecutive timeouts`
+          );
+        }
+        return line;
+      }
+      const result = ctx["__result"];
       if (result === null || result === void 0 || typeof result !== "object") {
         return line;
       }
@@ -2584,7 +2678,7 @@ async function getDockerStats(containerName) {
         }
         try {
           const data = JSON.parse(stdout.trim());
-          const cpu = Number.parseFloat(data.CPUPerc.replace("%", ""));
+          const cpu = Number.parseFloat(data.CPUPerc);
           const memStr = data.MemUsage.split("/")[0].trim();
           const memory = parseMemBytes(memStr);
           resolve({ cpu: Number.isNaN(cpu) ? 0 : cpu, memory });
@@ -5490,7 +5584,7 @@ async function writeContextFiles(sessionId, files) {
 }
 
 // src/services/ai-paste-image.ts
-import { mkdir as mkdir5, writeFile as writeFile5, unlink as unlink2 } from "fs/promises";
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
 import path2 from "path";
 import os3 from "os";
 import { randomUUID as randomUUID6 } from "crypto";