@runeya/runeya 2.0.29 → 2.0.32

package/index.js

@@ -201,7 +201,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
   });
 }
 async function main() {
-  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-W64XJTN5.js");
+  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-KERYXMIR.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.29",
+  "version": "2.0.32",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-W64XJTN5.js → src-KERYXMIR.js}

@@ -58,7 +58,7 @@ import {
   stableEncryptValue,
   traefikManager,
   writeEntity
-} from "./chunk-PZHVJHTC.js";
+} from "./chunk-2D3B3MC7.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -5453,6 +5453,8 @@ import { randomUUID as randomUUID5 } from "crypto";
 
 // ../server/src/trpc/routers/cloud-auth.ts
 import { z as z14 } from "zod";
+import { hostname } from "os";
+import { basename } from "path";
 import { TRPCError as TRPCError10 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
@@ -5561,10 +5563,17 @@ function getCloudApiUrl() {
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
+function getDeviceName() {
+  if (env.DEVICE_NAME) return env.DEVICE_NAME.slice(0, 64);
+  const host = hostname() || "runeya";
+  const dir = basename(env.DATA_DIR);
+  const suffix = dir && dir !== ".runeya" ? ` \xB7 ${dir}` : "";
+  return `${host}${suffix}`.slice(0, 64);
+}
 function isLocalOrigin(url) {
   try {
-    const { protocol, hostname } = new URL(url);
-    return (protocol === "http:" || protocol === "https:") && (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]");
+    const { protocol, hostname: hostname2 } = new URL(url);
+    return (protocol === "http:" || protocol === "https:") && (hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "[::1]");
   } catch {
     return false;
   }
@@ -5610,9 +5619,43 @@ var cloudAuthRouter = router({
   session: protectedProcedure.query(async () => {
     if (!await cloudSessionStore.isLinked()) return null;
     const res = await cloudFetch("/api/auth/get-session");
-    if (!res.ok) return null;
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      return null;
+    }
+    return await res.json();
+  }),
+  /**
+   * Every session of the cloud account: the machines linked to it and the
+   * browsers signed into it. No token material — the cloud only ever returns
+   * ids and labels here.
+   */
+  devices: protectedProcedure.query(async () => {
+    if (!await cloudSessionStore.isLinked()) return { devices: [] };
+    const res = await cloudFetch("/api/auth/device/list");
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      return { devices: [] };
+    }
     return await res.json();
   }),
+  /**
+   * Revoke one session of the cloud account.
+   *
+   * Revoking THIS machine is allowed and is the honest way to unlink: the cloud
+   * drops the session, and the local token is dropped here too, so nothing is
+   * left holding a dead credential.
+   */
+  revokeDevice: protectedProcedure.input(z14.object({ id: z14.string().min(1).max(128) })).mutation(async ({ input }) => {
+    const res = await cloudFetch("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      throw new TRPCError10({ code: "BAD_REQUEST", message: "Could not revoke this session." });
+    }
+    const { self } = await res.json();
+    if (self) await cloudSessionStore.clear();
+    return { success: true, self: self === true };
+  }),
   /**
    * Forward a cloud API call, authenticated with this machine's token.
    *
@@ -5645,7 +5688,13 @@ var cloudAuthRouter = router({
     if (!res.ok) return { data: null, error: { status: res.status, ...data } };
     return { data, error: null };
   }),
-  /** Drop the cloud session, both here and on the cloud. */
+  /**
+   * Unlink this machine: drop the session here and on the cloud.
+   *
+   * Since the machine holds a session of its own, this no longer touches the
+   * browser's session — signing out here leaves the web app signed in, and vice
+   * versa.
+   */
   signOut: protectedProcedure.mutation(async () => {
     if (await cloudSessionStore.isLinked()) {
       try {
@@ -5825,6 +5874,10 @@ function addCardToColumn(board, columnTitle, cardTitle, cardContent) {
     title: cardTitle,
     markdown: cardContent ?? "",
     images: [],
+    // `.default([])` on the schema makes these optional on the wire but required
+    // on the inferred type — a card built by hand has to supply them.
+    attachments: [],
+    assignees: [],
     order: col.cards.length,
     history: [{ type: "created", timestamp: now, detail: `AI \u2014 In column "${col.title}"` }],
     createdAt: now,
@@ -6131,7 +6184,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-FDIRJCET.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -6784,7 +6837,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-FDIRJCET.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -10817,7 +10870,8 @@ var KanbanQueueService = class extends EventEmitter4 {
     try {
       const model = item.model || (item.runner === "codex" ? "" : "claude-opus-4-6");
       const starter = item.runner === "codex" ? startCodexSession : startClaudeCodeSession;
-      const { done } = await starter(runItem.conversationId, cardContent, { model });
+      const jwt = await signJwt();
+      const { done } = await starter(runItem.conversationId, cardContent, { model, jwt });
       await done;
     } finally {
       this.finishItem(runItem.id);
@@ -10948,6 +11002,13 @@ function normalize(value) {
   return value.normalize("NFD").replace(new RegExp("\\p{Diacritic}", "gu"), "").toLowerCase();
 }
 var ATTACHMENT_ID_REGEX = /^[A-Za-z0-9_-]{1,128}$/;
+function safeDecode(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return "";
+  }
+}
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
   return join16(tmpdir(), "runeya-kanban-attachments");
@@ -11110,7 +11171,8 @@ var kanbanRouter = router({
     }
     const contentType = res.headers.get("content-type") ?? "application/octet-stream";
     const disposition = res.headers.get("content-disposition") ?? "";
-    const name = /filename="([^"]*)"/.exec(disposition)?.[1] || id;
+    const encoded = /filename\*=UTF-8''([^;]+)/i.exec(disposition)?.[1];
+    const name = (encoded ? safeDecode(encoded) : "") || /filename="([^"]*)"/.exec(disposition)?.[1] || id;
     const path = await storeAttachment(id, name, body);
     return { path, name, contentType, size: body.length };
   })
@@ -13563,10 +13625,10 @@ async function createLocalServer() {
       return;
     }
     try {
-      const verifyRes = await fetch(`${getCloudApiUrl()}/api/auth/one-time-token/verify`, {
+      const verifyRes = await fetch(`${getCloudApiUrl()}/api/auth/device/link`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ token }),
+        body: JSON.stringify({ token, name: getDeviceName() }),
         signal: AbortSignal.timeout(15e3)
       });
       if (!verifyRes.ok) {
@@ -14227,4 +14289,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-W64XJTN5.js.map
+//# sourceMappingURL=src-KERYXMIR.js.map