@runeya/runeya 2.0.31 → 2.0.33

package/index.js

@@ -201,7 +201,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
   });
 }
 async function main() {
-  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-I5LYBYA2.js");
+  const { createLocalServer, pullEnv, PullEnvError } = await import("./src-U3ECNNB6.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.31",
+  "version": "2.0.33",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-I5LYBYA2.js → src-U3ECNNB6.js}

@@ -58,7 +58,7 @@ import {
   stableEncryptValue,
   traefikManager,
   writeEntity
-} from "./chunk-PZHVJHTC.js";
+} from "./chunk-2D3B3MC7.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -303,6 +303,12 @@ import os from "os";
 import { execFile } from "child_process";
 import { promisify } from "util";
 import { z } from "zod";
+
+// ../server/src/config/app-version.ts
+var appVersion = process.env["RUNEYA_VERSION"] ?? (typeof __RUNEYA_VERSION__ !== "undefined" ? __RUNEYA_VERSION__ : "dev");
+var APP_VERSION_HEADER = "X-Runeya-Version";
+
+// ../server/src/trpc/routers/health.ts
 var execFileAsync = promisify(execFile);
 async function getDockerVersion() {
   try {
@@ -317,7 +323,6 @@ async function getDockerVersion() {
   }
 }
 var startedAt = Date.now();
-var appVersion = process.env["RUNEYA_VERSION"] ?? (typeof __RUNEYA_VERSION__ !== "undefined" ? __RUNEYA_VERSION__ : "dev");
 var NPM_LATEST_URL = "https://registry.npmjs.org/@runeya%2Fruneya/latest";
 function compareSemver(a, b) {
   const pa = a.split(".").map((n) => Number.parseInt(n, 10) || 0);
@@ -5453,6 +5458,8 @@ import { randomUUID as randomUUID5 } from "crypto";
 
 // ../server/src/trpc/routers/cloud-auth.ts
 import { z as z14 } from "zod";
+import { hostname } from "os";
+import { basename } from "path";
 import { TRPCError as TRPCError10 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
@@ -5561,10 +5568,17 @@ function getCloudApiUrl() {
 function getCloudAppUrl() {
   return (env.CLOUD_APP_URL ?? DEFAULT_CLOUD_APP_URL).replace(/\/+$/, "");
 }
+function getDeviceName() {
+  if (env.DEVICE_NAME) return env.DEVICE_NAME.slice(0, 64);
+  const host = hostname() || "runeya";
+  const dir = basename(env.DATA_DIR);
+  const suffix = dir && dir !== ".runeya" ? ` \xB7 ${dir}` : "";
+  return `${host}${suffix}`.slice(0, 64);
+}
 function isLocalOrigin(url) {
   try {
-    const { protocol, hostname } = new URL(url);
-    return (protocol === "http:" || protocol === "https:") && (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]");
+    const { protocol, hostname: hostname2 } = new URL(url);
+    return (protocol === "http:" || protocol === "https:") && (hostname2 === "localhost" || hostname2 === "127.0.0.1" || hostname2 === "[::1]");
   } catch {
     return false;
   }
@@ -5578,6 +5592,8 @@ async function cloudFetch(path, init = {}) {
     method: init.method ?? "GET",
     headers: {
       Authorization: `Bearer ${token}`,
+      // Le cloud refuse (426) les apps trop anciennes pour son schéma courant.
+      [APP_VERSION_HEADER]: appVersion,
       ...init.body !== void 0 ? { "Content-Type": "application/json" } : {}
     },
     ...init.body !== void 0 ? { body: JSON.stringify(init.body) } : {},
@@ -5610,9 +5626,43 @@ var cloudAuthRouter = router({
   session: protectedProcedure.query(async () => {
     if (!await cloudSessionStore.isLinked()) return null;
     const res = await cloudFetch("/api/auth/get-session");
-    if (!res.ok) return null;
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      return null;
+    }
     return await res.json();
   }),
+  /**
+   * Every session of the cloud account: the machines linked to it and the
+   * browsers signed into it. No token material — the cloud only ever returns
+   * ids and labels here.
+   */
+  devices: protectedProcedure.query(async () => {
+    if (!await cloudSessionStore.isLinked()) return { devices: [] };
+    const res = await cloudFetch("/api/auth/device/list");
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      return { devices: [] };
+    }
+    return await res.json();
+  }),
+  /**
+   * Revoke one session of the cloud account.
+   *
+   * Revoking THIS machine is allowed and is the honest way to unlink: the cloud
+   * drops the session, and the local token is dropped here too, so nothing is
+   * left holding a dead credential.
+   */
+  revokeDevice: protectedProcedure.input(z14.object({ id: z14.string().min(1).max(128) })).mutation(async ({ input }) => {
+    const res = await cloudFetch("/api/auth/device/revoke", { method: "POST", body: { id: input.id } });
+    if (!res.ok) {
+      if (res.status === 401) await cloudSessionStore.clear();
+      throw new TRPCError10({ code: "BAD_REQUEST", message: "Could not revoke this session." });
+    }
+    const { self } = await res.json();
+    if (self) await cloudSessionStore.clear();
+    return { success: true, self: self === true };
+  }),
   /**
    * Forward a cloud API call, authenticated with this machine's token.
    *
@@ -5645,7 +5695,13 @@ var cloudAuthRouter = router({
     if (!res.ok) return { data: null, error: { status: res.status, ...data } };
     return { data, error: null };
   }),
-  /** Drop the cloud session, both here and on the cloud. */
+  /**
+   * Unlink this machine: drop the session here and on the cloud.
+   *
+   * Since the machine holds a session of its own, this no longer touches the
+   * browser's session — signing out here leaves the web app signed in, and vice
+   * versa.
+   */
   signOut: protectedProcedure.mutation(async () => {
     if (await cloudSessionStore.isLinked()) {
       try {
@@ -5825,6 +5881,10 @@ function addCardToColumn(board, columnTitle, cardTitle, cardContent) {
     title: cardTitle,
     markdown: cardContent ?? "",
     images: [],
+    // `.default([])` on the schema makes these optional on the wire but required
+    // on the inferred type — a card built by hand has to supply them.
+    attachments: [],
+    assignees: [],
     order: col.cards.length,
     history: [{ type: "created", timestamp: now, detail: `AI \u2014 In column "${col.title}"` }],
     createdAt: now,
@@ -6131,7 +6191,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-FDIRJCET.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -6784,7 +6844,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-KGITN4AE.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-FDIRJCET.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -11543,12 +11603,23 @@ var LOCAL_ORIGIN = "local-bridge";
 var REMOTE_ORIGIN = "remote";
 var RECONNECT_DELAY_MS = 3e3;
 var UNAUTHENTICATED_RETRY_MS = 5 * 6e4;
+var OUTDATED_RETRY_MS = 30 * 6e4;
 var COLLECTIONS = ["projects", "services", "environments"];
 var SyncAuthError = class extends Error {
   constructor(status) {
     super(`cloud rejected the session (HTTP ${status})`);
   }
 };
+var SyncOutdatedError = class extends Error {
+  /** Dernière version que le cloud refuse — la borne est exclusive. */
+  lastIncompatibleVersion;
+  constructor(lastIncompatibleVersion) {
+    super(
+      `this app (${appVersion}) is too old for this cloud${lastIncompatibleVersion ? ` (needs newer than ${lastIncompatibleVersion})` : ""}`
+    );
+    this.lastIncompatibleVersion = lastIncompatibleVersion;
+  }
+};
 var OrgSyncConnection = class {
   doc = new Y.Doc();
   projects = getCollection(this.doc, "projects");
@@ -11560,6 +11631,8 @@ var OrgSyncConnection = class {
   initializing = true;
   abort = null;
   state = "connecting";
+  /** Last version the cloud refuses, as it told us when rejecting this app. */
+  lastIncompatibleVersion = null;
   /** Local state still owed to the cloud (initial sync, or a rejected episode). */
   needsPush = false;
   unsubscribes = [];
@@ -11573,6 +11646,10 @@ var OrgSyncConnection = class {
   getState() {
     return this.state;
   }
+  /** The cloud's version floor, known only once it has rejected us for it. */
+  getLastIncompatibleVersion() {
+    return this.lastIncompatibleVersion;
+  }
   getLink() {
     return this.link;
   }
@@ -11615,7 +11692,35 @@ var OrgSyncConnection = class {
     return `Bearer ${token}`;
   }
   async headers() {
-    return { Authorization: await this.authHeader(), "Content-Type": "application/json" };
+    return {
+      Authorization: await this.authHeader(),
+      [APP_VERSION_HEADER]: appVersion,
+      "Content-Type": "application/json"
+    };
+  }
+  /**
+   * Turn a 426 into a typed error, reading the floor the cloud published in the
+   * body. The body is advisory: a missing or malformed one still blocks, it just
+   * makes for a vaguer message.
+   */
+  async outdatedError(res) {
+    try {
+      const body = await res.json();
+      return new SyncOutdatedError(
+        typeof body.lastIncompatibleVersion === "string" ? body.lastIncompatibleVersion : null
+      );
+    } catch {
+      return new SyncOutdatedError(null);
+    }
+  }
+  /** Remember the floor and stop pretending sync will resume on its own. */
+  markOutdated(err) {
+    const alreadyReported = this.state === "outdated";
+    this.state = "outdated";
+    this.lastIncompatibleVersion = err.lastIncompatibleVersion;
+    this.needsPush = true;
+    if (alreadyReported) return;
+    console.error(`[cloud-sync] org ${this.link.orgId}: ${err.message} \u2014 sync paused until the app is updated.`);
   }
   /**
    * Mark this org as needing a fresh sign-in. Logged once per episode, not on
@@ -11646,6 +11751,7 @@ var OrgSyncConnection = class {
         headers: await this.headers(),
         signal: AbortSignal.timeout(15e3)
       });
+      if (svRes.status === 426) throw await this.outdatedError(svRes);
       if (svRes.status === 401 || svRes.status === 403) throw new SyncAuthError(svRes.status);
       if (!svRes.ok) return;
       const { sv } = await svRes.json();
@@ -11653,7 +11759,7 @@ var OrgSyncConnection = class {
       const diff = Y.encodeStateAsUpdate(this.doc, cloudSv);
       await this.pushUpdate(diff);
     } catch (err) {
-      if (err instanceof SyncAuthError) throw err;
+      if (err instanceof SyncAuthError || err instanceof SyncOutdatedError) throw err;
       console.error("[cloud-sync] initial push failed for org %s:", this.link.orgId, err.message);
     }
   }
@@ -11665,8 +11771,14 @@ var OrgSyncConnection = class {
         body: JSON.stringify({ update: Buffer.from(update).toString("base64"), conn: this.conn }),
         signal: AbortSignal.timeout(15e3)
       });
+      if (res.status === 426) throw await this.outdatedError(res);
       if (res.status === 401 || res.status === 403) throw new SyncAuthError(res.status);
     } catch (err) {
+      if (err instanceof SyncOutdatedError) {
+        this.markOutdated(err);
+        this.abort?.abort();
+        return;
+      }
       if (err instanceof SyncAuthError) {
         this.markUnauthenticated(err);
         this.abort?.abort();
@@ -11689,6 +11801,11 @@ var OrgSyncConnection = class {
         this.state = "connecting";
         await this.streamOnce();
       } catch (err) {
+        if (err instanceof SyncOutdatedError) {
+          this.markOutdated(err);
+          await this.delay(OUTDATED_RETRY_MS);
+          continue;
+        }
         if (err instanceof SyncAuthError) {
           this.markUnauthenticated(err);
           await this.delay(UNAUTHENTICATED_RETRY_MS);
@@ -11703,9 +11820,10 @@ var OrgSyncConnection = class {
     this.abort = new AbortController();
     const since = Buffer.from(Y.encodeStateVector(this.doc)).toString("base64");
     const res = await fetch(this.url(`/stream?conn=${this.conn}&since=${encodeURIComponent(since)}`), {
-      headers: { Authorization: await this.authHeader() },
+      headers: { Authorization: await this.authHeader(), [APP_VERSION_HEADER]: appVersion },
       signal: this.abort.signal
     });
+    if (res.status === 426) throw await this.outdatedError(res);
     if (res.status === 401 || res.status === 403) throw new SyncAuthError(res.status);
     if (!res.ok || !res.body) throw new Error(`stream HTTP ${res.status}`);
     this.state = "live";
@@ -11877,7 +11995,11 @@ var CloudSyncBridge = class {
   }
   /** Per-org sync state, for the UI. */
   states() {
-    return Array.from(this.connections.entries()).map(([orgId, conn]) => ({ orgId, state: conn.getState() }));
+    return Array.from(this.connections.entries()).map(([orgId, conn]) => ({
+      orgId,
+      state: conn.getState(),
+      lastIncompatibleVersion: conn.getLastIncompatibleVersion()
+    }));
   }
   /** Begin (or restart) syncing a single organization. */
   async connect(link) {
@@ -12128,11 +12250,15 @@ var cloudSyncRouter = router({
    */
   list: protectedProcedure.query(async () => {
     const links = await cloudSyncStore.list();
-    const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s.state]));
+    const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s]));
     return links.map((l) => ({
       orgId: l.orgId,
       cloudUrl: l.cloudUrl,
-      state: states.get(l.orgId) ?? "stopped"
+      state: states.get(l.orgId)?.state ?? "stopped",
+      // Renseigné seulement quand le cloud a refusé cette app comme trop
+      // ancienne : c'est lui qui publie le plancher, on ne le devine pas. La
+      // borne est exclusive — il faut strictement plus récent que ce numéro.
+      lastIncompatibleVersion: states.get(l.orgId)?.lastIncompatibleVersion ?? null
     }));
   })
 });
@@ -13572,10 +13698,10 @@ async function createLocalServer() {
       return;
     }
     try {
-      const verifyRes = await fetch(`${getCloudApiUrl()}/api/auth/one-time-token/verify`, {
+      const verifyRes = await fetch(`${getCloudApiUrl()}/api/auth/device/link`, {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ token }),
+        headers: { "Content-Type": "application/json", [APP_VERSION_HEADER]: appVersion },
+        body: JSON.stringify({ token, name: getDeviceName() }),
         signal: AbortSignal.timeout(15e3)
       });
       if (!verifyRes.ok) {
@@ -13619,7 +13745,11 @@ async function createLocalServer() {
         const upstream = await fetch(
           `${getCloudApiUrl()}${upstreamPath}?organizationId=${encodeURIComponent(organizationId)}`,
           {
-            headers: { Authorization: `Bearer ${token}`, Accept: "text/event-stream" },
+            headers: {
+              Authorization: `Bearer ${token}`,
+              [APP_VERSION_HEADER]: appVersion,
+              Accept: "text/event-stream"
+            },
             signal: upstreamAbort.signal
           }
         );
@@ -13676,6 +13806,7 @@ async function createLocalServer() {
             method: "POST",
             headers: {
               Authorization: `Bearer ${token}`,
+              [APP_VERSION_HEADER]: appVersion,
               "Content-Type": String(req.headers["content-type"] ?? "application/octet-stream")
             },
             body: req.body,
@@ -13705,7 +13836,11 @@ async function createLocalServer() {
     try {
       const upstream = await fetch(
         `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
-        { method: "DELETE", headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(15e3) }
+        {
+          method: "DELETE",
+          headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
+          signal: AbortSignal.timeout(15e3)
+        }
       );
       res.status(upstream.status).end();
     } catch {
@@ -13728,7 +13863,10 @@ async function createLocalServer() {
     try {
       const upstream = await fetch(
         `${getCloudApiUrl()}/api/kanban/file/${encodeURIComponent(req.params.id)}`,
-        { headers: { Authorization: `Bearer ${token}` }, signal: AbortSignal.timeout(3e5) }
+        {
+          headers: { Authorization: `Bearer ${token}`, [APP_VERSION_HEADER]: appVersion },
+          signal: AbortSignal.timeout(3e5)
+        }
       );
       if (!upstream.ok) {
         res.status(upstream.status).end();
@@ -14236,4 +14374,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-I5LYBYA2.js.map
+//# sourceMappingURL=src-U3ECNNB6.js.map