@runeya/runeya 2.0.39 → 2.0.41

package/{src-A3WSWXEY.js → src-BCBD4MPB.js}

@@ -31,6 +31,7 @@ import {
   agentManager,
   agentSpawner,
   agentStore,
+  allVaultRoots,
   clearEncryptionKey,
   clearPendingLegacyKey,
   decryptValue,
@@ -38,9 +39,11 @@ import {
   encryptValue,
   encryptVariableSlots,
   ensureEncryptionKey,
+  ensureLocalVault,
   env,
   environmentStore,
   extractEncryptedVariableSlots,
+  forgetProject,
   getCollection,
   getEncryptionKey,
   getPendingLegacyKey,
@@ -48,17 +51,31 @@ import {
   hasPendingLegacyKey,
   isCiMode,
   isEncryptedValue,
+  keyRoot,
+  keyedFilePath,
+  legacyMachineFilePath,
+  listCloudVaults,
   loadFromEnv,
+  localVaultRoot,
+  machineFilePath,
+  machineRoot,
   nativeParsers,
+  orgVaultRoot,
+  projectVaultRoot,
   readEntity,
+  registerProjectLoader,
+  rootOfProject,
   serviceStore,
   setEncryptionKey,
   setEncryptionKeyInMemory,
   setPendingLegacyKey,
+  setProjectServices,
+  setProjectVault,
   stableEncryptValue,
   traefikManager,
+  vaultFor,
   writeEntity
-} from "./chunk-PW6A3BLD.js";
+} from "./chunk-NJJMESIY.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -101,7 +118,7 @@ async function verifyJwt(token) {
 // ../server/src/services/api-key-store.ts
 import { randomBytes as randomBytes2, randomUUID, timingSafeEqual } from "crypto";
 import { readFile, writeFile, rename, mkdir, chmod } from "fs/promises";
-import { join } from "path";
+import { dirname } from "path";
 function maskApiKey(apiKey) {
   const { key, ...rest } = apiKey;
   return { ...rest, keyPreview: key.slice(-4) };
@@ -111,15 +128,19 @@ var FILE_PRIVATE = "api-keys.private.json";
 var ApiKeyStore = class {
   keys = /* @__PURE__ */ new Map();
   loaded = false;
+  /**
+   * Encrypted at rest, so the file sits beside the key that opens it — read
+   * under a different key it would decrypt to blanks, then be saved back blank.
+   */
   filePath(isPublic) {
-    return join(env.DATA_DIR, isPublic ? FILE_PUBLIC : FILE_PRIVATE);
+    return keyedFilePath(isPublic ? FILE_PUBLIC : FILE_PRIVATE);
   }
   async ensureDir() {
-    await mkdir(env.DATA_DIR, { recursive: true });
+    await mkdir(dirname(await this.filePath(true)), { recursive: true });
   }
   async persistFile(isPublic) {
     await this.ensureDir();
-    const path = this.filePath(isPublic);
+    const path = await this.filePath(isPublic);
     const keys = Array.from(this.keys.values()).filter((k) => k.isPublic === isPublic).map((k) => ({ ...k, key: encryptValue(k.key) }));
     const tmp = path + ".tmp";
     await writeFile(tmp, JSON.stringify({ keys }, null, 2), "utf-8");
@@ -145,8 +166,8 @@ var ApiKeyStore = class {
   async load() {
     if (this.loaded) return;
     this.loaded = true;
-    await this.loadFile(this.filePath(true));
-    await this.loadFile(this.filePath(false));
+    await this.loadFile(await this.filePath(true));
+    await this.loadFile(await this.filePath(false));
   }
   /**
    * Keys as exposed to callers — secrets stripped. Use `reveal` to obtain one
@@ -419,53 +440,201 @@ import { TRPCError as TRPCError2 } from "@trpc/server";
 // ../server/src/services/project-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { EventEmitter } from "events";
-import { readFile as readFile2, writeFile as writeFile2, rename as rename2, mkdir as mkdir2, chmod as chmod2 } from "fs/promises";
+import { readFile as readFile2, writeFile as writeFile3, rename as rename2, mkdir as mkdir2, chmod as chmod2, rm } from "fs/promises";
 import { join as join2 } from "path";
-var FILENAME = "projects.json";
+
+// ../server/src/utils/ensure-data-gitignore.ts
+import { writeFile as writeFile2 } from "fs/promises";
+import { join } from "path";
+var GITIGNORE_CONTENT = `
+#################
+# Do not edit this file #
+#################
+
+
+# Encryption key (contains secrets \u2014 never commit)
+.encryption.key
+.encryption.key.enc
+
+
+# Key verification canary \u2014 MUST be committed so new team members can validate their encryption key
+!.runeya-verify
+
+# This machine's cloud session token (encrypted, and specific to this install)
+cloud-session.json
+
+# Backup in local only
+backup-*
+
+# Per-user environment overrides (never commit \u2014 each dev has their own)
+environment-overrides.json
+
+# Private user data (conversations, personal state \u2014 never commit)
+*.private
+*.private.json*
+conversations/
+conversations.private.json
+
+
+
+# Runtime logs
+*.log
+*.log.*
+`;
+async function ensureDataGitignore(dataDir) {
+  const gitignorePath = join(dataDir, ".gitignore");
+  await writeFile2(gitignorePath, GITIGNORE_CONTENT, "utf-8");
+}
+
+// ../server/src/services/project-store.ts
+var FILENAME = "project.json";
+var LEGACY_FILENAME = "projects.json";
 function toDiskForm(project) {
   const { activeEnvironmentId: _runtimeOnly, ...rest } = project;
   return rest;
 }
+async function readLocalProject() {
+  const root = localVaultRoot();
+  let current = null;
+  try {
+    const raw = await readFile2(join2(root, FILENAME), "utf-8");
+    const parsed = ProjectSchema.safeParse(JSON.parse(raw));
+    if (parsed.success) current = parsed.data;
+  } catch {
+  }
+  let legacy;
+  try {
+    legacy = JSON.parse(await readFile2(join2(root, LEGACY_FILENAME), "utf-8"));
+  } catch {
+    return { local: current, strayCloud: [] };
+  }
+  const strayCloud = legacy.filter((p) => p.orgId);
+  if (current) return { local: current, strayCloud };
+  const locals = legacy.filter((p) => !p.orgId);
+  if (locals.length > 1) {
+    const names = locals.map((p) => `"${p.name}" (${p.id})`).join(", ");
+    throw new Error(
+      `${join2(root, LEGACY_FILENAME)} holds ${locals.length} local projects: ${names}. A directory now holds a single local project \u2014 move the others to their own directory, or into an organization, then start again.`
+    );
+  }
+  return { local: locals[0] ?? null, strayCloud };
+}
+async function readCloudProjects() {
+  const found = [];
+  for (const { orgId, projectId, root } of await listCloudVaults()) {
+    try {
+      const raw = await readFile2(join2(root, FILENAME), "utf-8");
+      const parsed = ProjectSchema.safeParse({ ...JSON.parse(raw), id: projectId, orgId });
+      if (parsed.success) found.push({ project: parsed.data, root });
+    } catch {
+    }
+  }
+  return found;
+}
+var LocalProjectExistsError = class extends Error {
+  constructor(projectName) {
+    super(
+      `This directory already holds the local project "${projectName}". A directory holds one local project: use another directory, or create the project in an organization.`
+    );
+    this.projectName = projectName;
+    this.name = "LocalProjectExistsError";
+  }
+  code = "LOCAL_PROJECT_EXISTS";
+};
 var ProjectStore = class {
   projects = /* @__PURE__ */ new Map();
   loaded = false;
   /** Emits `'saved'` after every persisted mutation, for the cloud sync bridge. */
   events = new EventEmitter();
-  getFilePath() {
-    return join2(env.DATA_DIR, FILENAME);
+  getFilePath(root = localVaultRoot()) {
+    return join2(root, FILENAME);
   }
-  async ensureDir() {
-    await mkdir2(env.DATA_DIR, { recursive: true });
+  async writeAtomic(filePath, data) {
+    const tmpPath = filePath + ".tmp";
+    await writeFile3(tmpPath, data, "utf-8");
+    await rename2(tmpPath, filePath);
+    await chmod2(filePath, 384);
+  }
+  /** Adopt a project read from disk, remembering which vault it came from. */
+  async absorb(p, root) {
+    const projectEnvs = await environmentStore.getByProjectId(p.id).catch(() => []);
+    const defaultEnv = projectEnvs.find((e) => e.default);
+    this.projects.set(p.id, {
+      ...p,
+      environmentIds: p.environmentIds ?? [],
+      groupOrder: p.groupOrder ?? [],
+      // Prefer the env marked default, fall back to first env
+      activeEnvironmentId: defaultEnv?.id ?? p.environmentIds?.[0]
+    });
+    setProjectVault(p.id, root);
+    setProjectServices(p.id, p.serviceIds ?? []);
   }
+  /**
+   * Read every vault: the launch directory, then each organization's projects.
+   *
+   * Cloud vaults are discovered by walking `~/.runeya/orgs/*/projects/*` rather
+   * than from an index. An index is one more thing that can disagree with the
+   * disk — and a project present on disk but missing from it is exactly the
+   * "already here, still shown as downloadable" bug.
+   */
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await readFile2(this.getFilePath(), "utf-8");
-      const data = JSON.parse(raw);
-      for (const p of data) {
-        const projectEnvs = await environmentStore.getByProjectId(p.id).catch(() => []);
-        const defaultEnv = projectEnvs.find((e) => e.default);
-        this.projects.set(p.id, {
-          ...p,
-          environmentIds: p.environmentIds ?? [],
-          groupOrder: p.groupOrder ?? [],
-          // Prefer the env marked default, fall back to first env
-          activeEnvironmentId: defaultEnv?.id ?? p.environmentIds?.[0]
-        });
+    this.loaded = true;
+    const { local, strayCloud } = await readLocalProject();
+    if (local) await this.absorb(local, localVaultRoot());
+    let migrated = false;
+    for (const project of strayCloud) {
+      try {
+        await this.absorb(project, vaultFor(project).root);
+        migrated = true;
+      } catch {
       }
-    } catch {
     }
-    this.loaded = true;
+    for (const { project, root } of await readCloudProjects()) {
+      await this.absorb(project, root);
+    }
+    if (migrated) {
+      await this.save();
+      await serviceStore.relocateAll();
+      await environmentStore.relocateAll();
+    }
   }
+  /**
+   * Persist every vault this store knows about.
+   *
+   * Writing all of them rather than only the one that changed keeps a project
+   * that moved between vaults — a local project adopted by an org, a cloud
+   * project pulled for the first time — from lingering in the vault it left.
+   */
   async save() {
-    await this.ensureDir();
-    const filePath = this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const projectsToSave = Array.from(this.projects.values()).map(toDiskForm);
-    const data = JSON.stringify(projectsToSave, null, 2);
-    await writeFile2(tmpPath, data, "utf-8");
-    await rename2(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    const locals = [];
+    const cloud = [];
+    for (const project of this.projects.values()) {
+      if (!project.orgId) locals.push(project);
+      else cloud.push({ project, root: vaultFor(project).root });
+    }
+    if (locals.length > 1) {
+      const names = locals.map((p) => `"${p.name}" (${p.id})`).join(", ");
+      throw new Error(
+        `Refusing to save ${locals.length} local projects in one directory: ${names}. A directory holds a single local project.`
+      );
+    }
+    const [local] = locals;
+    if (local) {
+      await ensureLocalVault();
+      await ensureDataGitignore(localVaultRoot());
+      await this.writeAtomic(this.getFilePath(), JSON.stringify(toDiskForm(local), null, 2));
+    } else {
+      await rm(this.getFilePath(), { force: true }).catch(() => {
+      });
+    }
+    await rename2(join2(localVaultRoot(), LEGACY_FILENAME), join2(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
+    });
+    for (const { project, root } of cloud) {
+      await mkdir2(root, { recursive: true });
+      await this.writeAtomic(this.getFilePath(root), JSON.stringify(toDiskForm(project), null, 2));
+      setProjectVault(project.id, root);
+    }
     this.events.emit("saved");
   }
   async list() {
@@ -478,6 +647,12 @@ var ProjectStore = class {
   }
   async create(input) {
     await this.load();
+    if (!input.orgId) {
+      const existing = Array.from(this.projects.values()).find((p) => !p.orgId);
+      if (existing) {
+        throw new LocalProjectExistsError(existing.name);
+      }
+    }
     const project = {
       id: randomUUID2(),
       orgId: input.orgId ?? null,
@@ -489,6 +664,8 @@ var ProjectStore = class {
       groupOrder: input.groupOrder ?? []
     };
     this.projects.set(project.id, project);
+    setProjectVault(project.id, vaultFor(project).root);
+    setProjectServices(project.id, project.serviceIds);
     await this.save();
     return project;
   }
@@ -507,16 +684,51 @@ var ProjectStore = class {
       ...input.groupOrder !== void 0 && { groupOrder: input.groupOrder }
     };
     this.projects.set(input.id, updated);
+    setProjectVault(updated.id, vaultFor(updated).root);
+    setProjectServices(updated.id, updated.serviceIds);
     await this.save();
     return updated;
   }
   async delete(id) {
     await this.load();
-    if (!this.projects.has(id)) return false;
+    const project = this.projects.get(id);
+    if (!project) return false;
     this.projects.delete(id);
     await this.save();
+    await this.discardVault(project);
     return true;
   }
+  /**
+   * Remove what a deleted cloud project left behind.
+   *
+   * Its vault is a directory of its own, so dropping the project means dropping
+   * the directory — otherwise `readCloudVaults` would resurrect it on the next
+   * load. Local projects share their vault with the directory's own files and
+   * are only removed from the list.
+   */
+  async discardVault(project) {
+    forgetProject(project.id);
+    if (!project.orgId) return;
+    await rm(vaultFor(project).root, { recursive: true, force: true }).catch(() => {
+    });
+  }
+  /**
+   * Stop holding a project on this machine, leaving the doc alone.
+   *
+   * Memory only: the caller removes the vault itself. Its contents are dropped
+   * too, because a service or environment surviving in memory would be written
+   * back on the next save — and, its project being unknown by then, into the
+   * local vault.
+   */
+  async forgetLocally(projectId) {
+    await this.load();
+    const project = this.projects.get(projectId);
+    if (!project) return;
+    this.projects.delete(projectId);
+    forgetProject(projectId);
+    await serviceStore.forgetLocally(project.serviceIds ?? []);
+    await environmentStore.forgetByProject(projectId);
+  }
   /** All projects linked to a given organization (for the sync bridge). */
   async listByOrg(orgId) {
     await this.load();
@@ -551,20 +763,26 @@ var ProjectStore = class {
       }
       const updated = { ...incoming, activeEnvironmentId: existing.activeEnvironmentId };
       this.projects.set(id, updated);
+      setProjectVault(id, vaultFor(updated).root);
+      setProjectServices(id, updated.serviceIds);
       await this.save();
       return { project: updated, created: false };
     }
     const project = { ...incoming, activeEnvironmentId: void 0 };
     this.projects.set(id, project);
+    setProjectVault(id, vaultFor(project).root);
+    setProjectServices(id, project.serviceIds);
     await this.save();
     return { project, created: true };
   }
   /** Delete a project that was removed on another peer. */
   async applyRemoteDelete(id) {
     await this.load();
-    if (!this.projects.has(id)) return false;
+    const project = this.projects.get(id);
+    if (!project) return false;
     this.projects.delete(id);
     await this.save();
+    await this.discardVault(project);
     return true;
   }
   async addService(projectId, serviceId) {
@@ -574,6 +792,7 @@ var ProjectStore = class {
     if (project.serviceIds.includes(serviceId)) return project;
     const updated = { ...project, serviceIds: [...project.serviceIds, serviceId] };
     this.projects.set(projectId, updated);
+    setProjectServices(projectId, updated.serviceIds);
     await this.save();
     return updated;
   }
@@ -583,6 +802,7 @@ var ProjectStore = class {
     if (!project) return null;
     const updated = { ...project, serviceIds: project.serviceIds.filter((id) => id !== serviceId) };
     this.projects.set(projectId, updated);
+    setProjectServices(projectId, updated.serviceIds);
     await this.save();
     return updated;
   }
@@ -626,64 +846,115 @@ var ProjectStore = class {
   }
 };
 var projectStore = new ProjectStore();
+registerProjectLoader(() => projectStore.list().then(() => void 0));
 
 // ../server/src/services/environment-overrides-store.ts
-import { readFile as readFile3, writeFile as writeFile3, rename as rename3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
-import { join as join3 } from "path";
+import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
+import { dirname as dirname2, join as join3 } from "path";
 var FILENAME2 = "environment-overrides.json";
 var EnvironmentOverridesStore = class {
   data = {};
   loaded = false;
   diskEncryptedSlots = {};
   saveQueue = Promise.resolve();
-  getFilePath() {
-    return join3(env.DATA_DIR, FILENAME2);
+  /** Which vault each override was read from, until its project is known. */
+  roots = /* @__PURE__ */ new Map();
+  /**
+   * An override belongs to the project whose variable it answers.
+   *
+   * Nothing in an override says so — they are keyed by variable id alone — so
+   * the owning project is resolved through the environment that defines the
+   * variable. Overrides are never synced: they stay in the project's vault on
+   * this machine, and no other machine sees them.
+   *
+   * An override whose variable no longer exists (a deleted environment, a row
+   * left behind) has no project to belong to. It stays wherever it was read,
+   * falling back to the key's own directory — never dropped, since the variable
+   * may simply not be loaded yet.
+   */
+  async rootFor(variableId) {
+    const projectId = await environmentStore.projectIdOfVariable(variableId);
+    if (projectId) return rootOfProject(projectId);
+    return this.roots.get(variableId) ?? dirname2(await keyedFilePath(FILENAME2));
   }
-  async ensureDir() {
-    await mkdir3(env.DATA_DIR, { recursive: true });
+  /** Where earlier versions kept them: read once, rewritten to their vaults. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME2);
   }
+  /**
+   * Read every vault, then the places older versions used.
+   *
+   * Variable ids are unique, so merging the files cannot collide; a vault read
+   * later simply wins over a legacy copy of the same override.
+   */
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await readFile3(this.getFilePath(), "utf-8");
-      const parsed = JSON.parse(raw);
-      if (!getEncryptionKey()) {
-        return;
+    if (!getEncryptionKey()) return;
+    this.loaded = true;
+    const roots = await allVaultRoots();
+    const sources = [
+      this.getLegacyFilePath(),
+      await keyedFilePath(FILENAME2),
+      ...roots.map((root) => join3(root, FILENAME2))
+    ];
+    for (const path of sources) {
+      let parsed;
+      try {
+        parsed = JSON.parse(await readFile3(path, "utf-8"));
+      } catch {
+        continue;
       }
-      this.diskEncryptedSlots = extractEncryptedVariableSlots(
-        parsed
+      Object.assign(
+        this.diskEncryptedSlots,
+        extractEncryptedVariableSlots(parsed)
       );
       const decrypted = decryptVariableSlots(
         parsed,
         "environment-overrides"
       );
-      this.data = Object.fromEntries(
-        Object.entries(decrypted).map(([id, override]) => [id, { value: override.value }])
-      );
-    } catch {
-      this.data = {};
+      for (const [id, override] of Object.entries(decrypted)) {
+        this.data[id] = { value: override.value };
+        this.roots.set(id, dirname2(path));
+      }
     }
-    this.loaded = true;
   }
   save() {
     this.saveQueue = this.saveQueue.then(() => this.doSave()).catch(() => this.doSave());
     return this.saveQueue;
   }
+  /**
+   * Write each vault that holds — or held — an override.
+   *
+   * A vault emptied by this save is still written, as an empty object: an
+   * override that moved to its project's vault must not survive in the one it
+   * came from.
+   */
   async doSave() {
-    await this.ensureDir();
-    const filePath = this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const encrypted = encryptVariableSlots(
-      this.data,
-      this.diskEncryptedSlots
-    );
-    this.diskEncryptedSlots = extractEncryptedVariableSlots(
-      encrypted
-    );
-    const json = JSON.stringify(encrypted, null, 2);
-    await writeFile3(tmpPath, json, "utf-8");
-    await rename3(tmpPath, filePath);
-    await chmod3(filePath, 384);
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, {});
+    for (const [variableId, override] of Object.entries(this.data)) {
+      const root = await this.rootFor(variableId);
+      this.roots.set(variableId, root);
+      const bucket = byRoot.get(root) ?? {};
+      bucket[variableId] = override;
+      byRoot.set(root, bucket);
+    }
+    for (const [root, overrides] of byRoot) {
+      const encrypted = encryptVariableSlots(
+        overrides,
+        this.diskEncryptedSlots
+      );
+      Object.assign(
+        this.diskEncryptedSlots,
+        extractEncryptedVariableSlots(encrypted)
+      );
+      await mkdir3(root, { recursive: true });
+      const path = join3(root, FILENAME2);
+      const tmpPath = path + ".tmp";
+      await writeFile4(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
+      await rename3(tmpPath, path);
+      await chmod3(path, 384);
+    }
   }
   async getOverride(variableId) {
     await this.load();
@@ -1095,16 +1366,15 @@ var environmentResolver = new EnvironmentResolver();
 
 // ../server/src/services/audit-service.ts
 import { appendFile, readFile as readFile4, stat, rename as rename4, unlink, readdir, mkdir as mkdir4 } from "fs/promises";
-import { join as join4 } from "path";
 var AUDIT_FILENAME = "audit.log";
 var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_AGE_DAYS = 30;
 var AuditService = class {
   getFilePath() {
-    return join4(env.DATA_DIR, AUDIT_FILENAME);
+    return machineFilePath(AUDIT_FILENAME);
   }
   getRotatedPath() {
-    return join4(env.DATA_DIR, `audit.log.${Date.now()}.bak`);
+    return machineFilePath(`audit.log.${Date.now()}.bak`);
   }
   /** Append an audit entry (newline-delimited JSON) */
   async log(entry) {
@@ -1115,7 +1385,7 @@ var AuditService = class {
     const line = JSON.stringify(record) + "\n";
     const filepath = this.getFilePath();
     try {
-      await mkdir4(env.DATA_DIR, { recursive: true });
+      await mkdir4(machineRoot(), { recursive: true });
       await appendFile(filepath, line, "utf-8");
       await this.rotateIfNeeded();
     } catch (err) {
@@ -1168,7 +1438,7 @@ var AuditService = class {
   }
   /** Clean up old rotated logs (older than MAX_AGE_DAYS) */
   async cleanup() {
-    const files = await readdir(env.DATA_DIR);
+    const files = await readdir(machineRoot());
     const cutoff = Date.now() - MAX_AGE_DAYS * 24 * 60 * 60 * 1e3;
     for (const file of files) {
       if (file.startsWith("audit.log.") && file.endsWith(".bak")) {
@@ -1176,7 +1446,7 @@ var AuditService = class {
         const ts = Number.parseInt(tsStr, 10);
         if (!Number.isNaN(ts) && ts < cutoff) {
           try {
-            await unlink(join4(env.DATA_DIR, file));
+            await unlink(machineFilePath(file));
           } catch {
           }
         }
@@ -1220,12 +1490,20 @@ var projectRouter = router({
       serviceIds: z2.array(z2.string().max(128)).max(1e4).optional()
     })
   ).mutation(async ({ input }) => {
-    const project = await projectStore.create({
-      ...input,
-      description: input.description ?? "",
-      serviceIds: input.serviceIds ?? [],
-      environmentIds: []
-    });
+    let project;
+    try {
+      project = await projectStore.create({
+        ...input,
+        description: input.description ?? "",
+        serviceIds: input.serviceIds ?? [],
+        environmentIds: []
+      });
+    } catch (err) {
+      if (err instanceof LocalProjectExistsError) {
+        throw new TRPCError2({ code: "CONFLICT", message: err.code, cause: err });
+      }
+      throw new TRPCError2({ code: "CONFLICT", message: err.message });
+    }
     const localEnv = await environmentStore.create({
       projectId: project.id,
       name: "local",
@@ -1383,8 +1661,7 @@ import { z as z3 } from "zod";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/settings-manager.ts
-import { readFile as readFile5, writeFile as writeFile4, rename as rename5, mkdir as mkdir5, chmod as chmod4 } from "fs/promises";
-import { join as join5 } from "path";
+import { readFile as readFile5, writeFile as writeFile5, rename as rename5, mkdir as mkdir5, chmod as chmod4 } from "fs/promises";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 var SCHEMA_VERSION_FILE = "schema-version.json";
@@ -1394,23 +1671,25 @@ var SettingsManager = class {
   settingsPrivate = null;
   schemaVersion = null;
   async ensureDir() {
-    await mkdir5(env.DATA_DIR, { recursive: true });
+    await mkdir5(machineRoot(), { recursive: true });
   }
   async atomicWrite(filename, data) {
     await this.ensureDir();
-    const filePath = join5(env.DATA_DIR, filename);
+    const filePath = machineFilePath(filename);
     const tmpPath = filePath + ".tmp";
-    await writeFile4(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+    await writeFile5(tmpPath, JSON.stringify(data, null, 2), "utf-8");
     await rename5(tmpPath, filePath);
     await chmod4(filePath, 384);
   }
+  /** Read the machine file, falling back to the launch directory of old. */
   async readJson(filename) {
-    try {
-      const raw = await readFile5(join5(env.DATA_DIR, filename), "utf-8");
-      return JSON.parse(raw);
-    } catch {
-      return null;
+    for (const path of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
+      try {
+        return JSON.parse(await readFile5(path, "utf-8"));
+      } catch {
+      }
     }
+    return null;
   }
   async getSettings() {
     if (!this.settings) {
@@ -2544,7 +2823,10 @@ var settingsRouter = router({
    */
   getPaths: protectedProcedure.query(() => ({
     cwd: process.cwd(),
-    dataDir: resolve(env.DATA_DIR)
+    dataDir: resolve(env.DATA_DIR),
+    // Where cloud projects live: their vaults belong to the machine, not to
+    // whichever directory the server happened to be started in.
+    machineDir: machineRoot()
   })),
   /**
    * Update settings (mode, cloudUrl)
@@ -3092,15 +3374,15 @@ import { z as z11 } from "zod";
 import { TRPCError as TRPCError8 } from "@trpc/server";
 import { execFile as execFile2, spawn } from "child_process";
 import { stat as stat2 } from "fs/promises";
-import { resolve as resolve2, join as join7 } from "path";
+import { resolve as resolve2, join as join5 } from "path";
 import { homedir as homedir2 } from "os";
 
 // ../server/src/services/user-config-manager.ts
-import { readFile as readFile6, writeFile as writeFile5, rename as rename6, mkdir as mkdir6, chmod as chmod5 } from "fs/promises";
-import { join as join6 } from "path";
+import { readFile as readFile6, writeFile as writeFile6, rename as rename6, mkdir as mkdir6, chmod as chmod5 } from "fs/promises";
+import { join as join4 } from "path";
 import { homedir } from "os";
 import { z as z10 } from "zod";
-var CONFIG_DIR = join6(homedir(), ".runeya");
+var CONFIG_DIR = join4(homedir(), ".runeya");
 var CONFIG_FILE = "runeya.conf";
 var EditorPreferencesSchema = z10.object({
   default: z10.string().max(64).optional()
@@ -3121,16 +3403,16 @@ var UserConfigManager = class {
   }
   async atomicWrite(data) {
     await this.ensureDir();
-    const filePath = join6(CONFIG_DIR, CONFIG_FILE);
+    const filePath = join4(CONFIG_DIR, CONFIG_FILE);
     const tmpPath = filePath + ".tmp";
-    await writeFile5(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+    await writeFile6(tmpPath, JSON.stringify(data, null, 2), "utf-8");
     await rename6(tmpPath, filePath);
     await chmod5(filePath, 384);
   }
   async getConfig() {
     if (!this.config) {
       try {
-        const raw = await readFile6(join6(CONFIG_DIR, CONFIG_FILE), "utf-8");
+        const raw = await readFile6(join4(CONFIG_DIR, CONFIG_FILE), "utf-8");
         const parsed = UserConfigSchema.safeParse(JSON.parse(raw));
         this.config = parsed.success ? parsed.data : {};
       } catch {
@@ -3266,7 +3548,7 @@ var editorRouter = router({
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const cwd = await getServiceCwd(input.serviceId);
-    const filePath = join7(cwd, input.relativePath);
+    const filePath = join5(cwd, input.relativePath);
     if (!filePath.startsWith(cwd)) {
       throw new TRPCError8({ code: "BAD_REQUEST", message: "Path traversal not allowed" });
     }
@@ -3289,8 +3571,8 @@ var editorRouter = router({
 // ../server/src/trpc/routers/api-keys.ts
 import { z as z12 } from "zod";
 import { TRPCError as TRPCError9 } from "@trpc/server";
-import { mkdir as mkdir7, writeFile as writeFile6 } from "fs/promises";
-import { join as join8, dirname } from "path";
+import { mkdir as mkdir7, writeFile as writeFile7 } from "fs/promises";
+import { join as join6, dirname as dirname3 } from "path";
 var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
   ".claude/skills/runeya/SKILL.md",
   ".cursor/rules/runeya.mdc",
@@ -3337,9 +3619,9 @@ var apiKeysRouter = router({
     if (!ALLOWED_SKILL_PATHS.has(input.relativePath)) {
       throw new TRPCError9({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
     }
-    const abs = join8(process.cwd(), input.relativePath);
-    await mkdir7(dirname(abs), { recursive: true });
-    await writeFile6(abs, input.content, { encoding: "utf-8", mode: 420 });
+    const abs = join6(process.cwd(), input.relativePath);
+    await mkdir7(dirname3(abs), { recursive: true });
+    await writeFile7(abs, input.content, { encoding: "utf-8", mode: 420 });
     return { path: input.relativePath };
   })
 });
@@ -3668,27 +3950,54 @@ function buildApiDocs(apiBaseUrl, apiToken) {
 import { readdir as readdir2, access, readFile as readFile8 } from "fs/promises";
 import { watch } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join10 } from "path";
+import { join as join8 } from "path";
 
 // ../server/src/services/conversation-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile7, writeFile as writeFile7, rename as rename7, mkdir as mkdir8, chmod as chmod6 } from "fs/promises";
-import { join as join9 } from "path";
+import { readFile as readFile7, writeFile as writeFile8, rename as rename7, mkdir as mkdir8, chmod as chmod6 } from "fs/promises";
+import { dirname as dirname4, join as join7 } from "path";
 import { EventEmitter as EventEmitter2 } from "events";
 var FILENAME3 = "conversations.private.json";
+async function localProjectId() {
+  const projects = await projectStore.list().catch(() => []);
+  return projects.find((p) => !p.orgId)?.id ?? null;
+}
 var ConversationStore = class {
   conversations = /* @__PURE__ */ new Map();
+  /** Which vault each conversation was read from, until its project is known. */
+  roots = /* @__PURE__ */ new Map();
   loaded = false;
   events = new EventEmitter2().setMaxListeners(0);
   saveQueue = Promise.resolve();
   snapshotConversation(conv) {
     return structuredClone(conv);
   }
+  /**
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
+   */
   getFilePath() {
-    return join9(env.DATA_DIR, FILENAME3);
+    return keyedFilePath(FILENAME3);
+  }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME3);
+  }
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile7(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile7(this.getLegacyFilePath(), "utf-8");
+    }
   }
   async ensureDir() {
-    await mkdir8(env.DATA_DIR, { recursive: true });
+    await mkdir8(dirname4(await this.getFilePath()), { recursive: true });
   }
   encryptMessages(messages) {
     return encryptValue(JSON.stringify(messages));
@@ -3700,6 +4009,7 @@ var ConversationStore = class {
   toDisk(conv) {
     return {
       id: conv.id,
+      projectId: conv.projectId,
       title: conv.title,
       encryptedMessages: this.encryptMessages(conv.messages),
       isCli: conv.isCli,
@@ -3720,6 +4030,7 @@ var ConversationStore = class {
     const workflowType = (disk.workflowType === "scenario" ? "scenario" : void 0) ?? (disk.scenarioId ? "scenario" : void 0);
     return {
       id: disk.id,
+      projectId: disk.projectId,
       title: disk.title,
       messages: this.decryptMessages(disk.encryptedMessages),
       isCli: disk.isCli ?? disk.isClaudeCode ?? false,
@@ -3736,33 +4047,81 @@ var ConversationStore = class {
       updatedAt: disk.updatedAt
     };
   }
+  /**
+   * Read every project vault, then the homes older versions used.
+   *
+   * A conversation found in a legacy file is attributed to the local project of
+   * that directory — which is what it was about, back when one directory meant
+   * one project. With no local project to point at, it is left unattributed
+   * rather than filed under a project picked at random.
+   */
   async load() {
     if (this.loaded) return;
     if (!getEncryptionKey()) {
       return;
     }
-    try {
-      const raw = await readFile7(this.getFilePath(), "utf-8");
-      const data = JSON.parse(raw);
+    this.loaded = true;
+    const vaults = await allVaultRoots();
+    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME3)];
+    const sources = [
+      ...legacyPaths.map((path) => ({ path, legacy: true })),
+      ...vaults.map((root) => ({ path: join7(root, FILENAME3), legacy: false }))
+    ];
+    for (const { path, legacy } of sources) {
+      let data;
+      try {
+        data = JSON.parse(await readFile7(path, "utf-8"));
+      } catch {
+        continue;
+      }
+      const inherited = legacy ? await localProjectId() : null;
       for (const item of data) {
         try {
-          this.conversations.set(item.id, this.fromDisk(item));
+          const conv = this.fromDisk(item);
+          if (!conv.projectId && inherited) conv.projectId = inherited;
+          this.conversations.set(item.id, conv);
+          this.roots.set(item.id, dirname4(path));
         } catch {
         }
       }
-    } catch {
     }
-    this.loaded = true;
   }
+  /**
+   * Write each vault that holds — or held — a conversation.
+   *
+   * A vault emptied by this save is still written, as an empty list: a
+   * conversation that found its project must not survive in the file it was
+   * read from.
+   */
   async saveInternal() {
-    await this.ensureDir();
     if (!getEncryptionKey()) return;
-    const data = Array.from(this.conversations.values()).map((c) => this.toDisk(c));
-    const filePath = this.getFilePath();
-    const tmpPath = `${filePath}.tmp`;
-    await writeFile7(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-    await rename7(tmpPath, filePath);
-    await chmod6(filePath, 384);
+    const byRoot = /* @__PURE__ */ new Map();
+    for (const root of this.roots.values()) byRoot.set(root, []);
+    for (const conv of this.conversations.values()) {
+      const root = await this.rootFor(conv);
+      this.roots.set(conv.id, root);
+      const bucket = byRoot.get(root) ?? [];
+      bucket.push(this.toDisk(conv));
+      byRoot.set(root, bucket);
+    }
+    for (const [root, data] of byRoot) {
+      await mkdir8(root, { recursive: true });
+      const filePath = join7(root, FILENAME3);
+      const tmpPath = `${filePath}.tmp`;
+      await writeFile8(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+      await rename7(tmpPath, filePath);
+      await chmod6(filePath, 384);
+    }
+  }
+  /**
+   * The vault a conversation is written to: its project's.
+   *
+   * One that names no project stays where it was read, falling back to the
+   * key's own directory — never lost for want of an owner.
+   */
+  async rootFor(conv) {
+    if (conv.projectId) return rootOfProject(conv.projectId);
+    return this.roots.get(conv.id) ?? dirname4(await keyedFilePath(FILENAME3));
   }
   async save() {
     const write = this.saveQueue.then(() => this.saveInternal());
@@ -3778,11 +4137,12 @@ var ConversationStore = class {
     await this.load();
     return this.conversations.get(id) ?? null;
   }
-  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId) {
+  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId, projectId) {
     await this.load();
     const now = Date.now();
     const conv = {
       id: randomUUID3(),
+      projectId,
       title: title ?? "New conversation",
       messages: [],
       isCli,
@@ -3858,7 +4218,7 @@ var ConversationStore = class {
 var conversationStore = new ConversationStore();
 
 // ../server/src/services/claude-transcript-sync.ts
-var PROJECTS_DIR = join10(homedir3(), ".claude", "projects");
+var PROJECTS_DIR = join8(homedir3(), ".claude", "projects");
 var DEFAULT_TITLES = /* @__PURE__ */ new Set(["", "New conversation", "Nouvelle conversation"]);
 async function findClaudeSessionFile(sessionId) {
   let entries;
@@ -3869,7 +4229,7 @@ async function findClaudeSessionFile(sessionId) {
   }
   const filename = `${sessionId}.jsonl`;
   for (const dir of entries) {
-    const candidate = join10(PROJECTS_DIR, dir, filename);
+    const candidate = join8(PROJECTS_DIR, dir, filename);
     try {
       await access(candidate);
       return candidate;
@@ -4032,7 +4392,7 @@ async function startClaudeTranscriptWatcher() {
   }
   for (const dir of topLevel) {
     try {
-      const w = watch(join10(PROJECTS_DIR, dir), (_event, filename) => {
+      const w = watch(join8(PROJECTS_DIR, dir), (_event, filename) => {
         handleFsEvent(filename ? filename.toString() : null);
       });
       w.on("error", () => {
@@ -4058,8 +4418,8 @@ function stopClaudeTranscriptWatcher() {
 // ../server/src/services/codex-sessions.ts
 import { readdir as readdir3 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join11 } from "path";
-var SESSIONS_DIR = join11(homedir4(), ".codex", "sessions");
+import { join as join9 } from "path";
+var SESSIONS_DIR = join9(homedir4(), ".codex", "sessions");
 async function findCodexSessionFile(sessionId) {
   const suffix = `-${sessionId}.jsonl`;
   async function walk(dir) {
@@ -4070,7 +4430,7 @@ async function findCodexSessionFile(sessionId) {
       return null;
     }
     for (const entry of entries) {
-      const full = join11(dir, entry.name);
+      const full = join9(dir, entry.name);
       if (entry.isDirectory()) {
         const found = await walk(full);
         if (found) return found;
@@ -5030,19 +5390,18 @@ var ScenarioStore = class {
 var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
-import { mkdir as mkdir10, rm, readFile as readFile10 } from "fs/promises";
-import { join as join12 } from "path";
+import { mkdir as mkdir10, rm as rm2, readFile as readFile10 } from "fs/promises";
+import { join as join10 } from "path";
 
 // ../server/src/services/run-store-utils.ts
-import { chmod as chmod7, mkdir as mkdir9, rename as rename8, writeFile as writeFile8 } from "fs/promises";
-import { dirname as dirname2, resolve as resolve3, sep } from "path";
-import { readFile as readFile9 } from "fs/promises";
+import { chmod as chmod7, mkdir as mkdir9, rename as rename8, writeFile as writeFile9, readFile as readFile9 } from "fs/promises";
+import { dirname as dirname5, resolve as resolve3, sep } from "path";
 var SAFE_PATH_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
 function resolveConversationRunDir(rootDirName, conversationId) {
   if (!SAFE_PATH_SEGMENT_RE.test(conversationId)) {
     throw new Error("Invalid conversationId");
   }
-  const base = resolve3(env.DATA_DIR, rootDirName);
+  const base = resolve3(machineRoot(), rootDirName);
   const dir = resolve3(base, conversationId);
   if (!dir.startsWith(base + sep)) {
     throw new Error("Invalid conversationId");
@@ -5050,9 +5409,9 @@ function resolveConversationRunDir(rootDirName, conversationId) {
   return dir;
 }
 async function atomicWriteSecure(filePath, content) {
-  await mkdir9(dirname2(filePath), { recursive: true });
+  await mkdir9(dirname5(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  await writeFile8(tmpPath, content, "utf-8");
+  await writeFile9(tmpPath, content, "utf-8");
   await rename8(tmpPath, filePath);
   await chmod7(filePath, 384);
 }
@@ -5109,8 +5468,8 @@ var ScenarioRunStore = class _ScenarioRunStore {
       "- Use read-only references from linked upstream files as context.",
       ""
     ].join("\n");
-    await atomicWriteSecure(join12(dir, "README.md"), overview);
-    await atomicWriteSecure(join12(dir, "USER_REQUEST.md"), `# User request
+    await atomicWriteSecure(join10(dir, "README.md"), overview);
+    await atomicWriteSecure(join10(dir, "USER_REQUEST.md"), `# User request
 
 ${userInput.trim() || "(empty)"}
 `);
@@ -5136,11 +5495,11 @@ ${userInput.trim() || "(empty)"}
         "- Waiting for assignment.",
         ""
       ].join("\n");
-      await atomicWriteSecure(join12(dir, fileName), content);
+      await atomicWriteSecure(join10(dir, fileName), content);
     }
   }
   async deleteRunDir(conversationId) {
-    await rm(this.getRunDir(conversationId), { recursive: true, force: true });
+    await rm2(this.getRunDir(conversationId), { recursive: true, force: true });
     this.activeRuns.delete(conversationId);
   }
   ensureRunState(conversationId) {
@@ -5204,18 +5563,18 @@ ${userInput.trim() || "(empty)"}
         ...Object.keys(runState.nodeAgentIds).length > 0 ? { nodeAgentIds: { ...runState.nodeAgentIds } } : {},
         ...Object.keys(runState.waitingInputs).length > 0 ? { waitingInputs: { ...runState.waitingInputs } } : {}
       };
-      await atomicWriteJsonSecure(join12(dir, "run-state.json"), data);
+      await atomicWriteJsonSecure(join10(dir, "run-state.json"), data);
     } catch {
     }
   }
   async loadPersistedRunState(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join12(dir, "run-state.json"));
+    return readJsonFileSafe(join10(dir, "run-state.json"));
   }
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile10(join12(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile10(join10(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -5224,7 +5583,7 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile10(join12(dir, "README.md"), "utf-8");
+      return await readFile10(join10(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
@@ -5233,14 +5592,14 @@ ${userInput.trim() || "(empty)"}
     const dir = this.getRunDir(conversationId);
     await mkdir10(dir, { recursive: true });
     await atomicWriteJsonSecure(
-      join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
+      join10(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
       true
     );
   }
   async loadScenarioSnapshot(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
+    return readJsonFileSafe(join10(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
   }
 };
 var scenarioRunStore = new ScenarioRunStore();
@@ -5286,9 +5645,9 @@ async function fetchProviderModels(provider, plaintextKey) {
 
 // ../server/src/services/image-storage.service.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir11, writeFile as writeFile9, readFile as readFile11, unlink as unlink2, readdir as readdir4 } from "fs/promises";
+import { mkdir as mkdir11, writeFile as writeFile10, readFile as readFile11, unlink as unlink2, readdir as readdir4 } from "fs/promises";
 import { existsSync } from "fs";
-import { join as join13, extname, resolve as resolve4, sep as sep2 } from "path";
+import { join as join11, extname, resolve as resolve4, sep as sep2 } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/jpeg",
@@ -5325,15 +5684,15 @@ var ImageStorageService = class {
     const imageId = randomUUID4();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
-    const filePath = join13(this.dir, fileName);
+    const filePath = join11(this.dir, fileName);
     const resolvedPath = resolve4(filePath);
     const resolvedDir = resolve4(this.dir);
     if (resolvedPath !== resolvedDir && !resolvedPath.startsWith(resolvedDir + sep2)) {
       throw new Error("Invalid file path");
     }
-    await writeFile9(filePath, buffer, { mode: 384 });
+    await writeFile10(filePath, buffer, { mode: 384 });
     const meta = { imageId, filePath, mimeType, originalName, createdAt: Date.now(), contextId };
-    await writeFile9(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
+    await writeFile10(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
     return meta;
   }
   /**
@@ -5351,7 +5710,7 @@ var ImageStorageService = class {
       const files = await readdir4(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile11(join13(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile11(join11(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -5377,7 +5736,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile11(join13(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile11(join11(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -5407,7 +5766,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile11(join13(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile11(join11(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -5418,8 +5777,7 @@ var ImageStorageService = class {
 var _singleton;
 function getSingleton() {
   if (!_singleton) {
-    const dataDir = process.env["RUNEYA_DATA_DIR"] ?? ".runeya";
-    _singleton = new ImageStorageService(resolve4(dataDir, "images"));
+    _singleton = new ImageStorageService(resolve4(machineRoot(), "images"));
   }
   return _singleton;
 }
@@ -5480,9 +5838,9 @@ import { basename } from "path";
 import { TRPCError as TRPCError10 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
-import { readFile as readFile12, writeFile as writeFile10, rename as rename9, mkdir as mkdir12, chmod as chmod8, unlink as unlink3 } from "fs/promises";
+import { readFile as readFile12, writeFile as writeFile11, rename as rename9, mkdir as mkdir12, chmod as chmod8, unlink as unlink3 } from "fs/promises";
+import { dirname as dirname6 } from "path";
 import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
-import { join as join14 } from "path";
 var FILENAME4 = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
 var CloudSessionStore = class {
@@ -5490,13 +5848,34 @@ var CloudSessionStore = class {
   loaded = false;
   /** Pending login states (CSRF binding between `start` and the callback). */
   pending = /* @__PURE__ */ new Map();
+  /**
+   * Encrypted, so it lives beside the key that opens it — usually the machine
+   * root, but a launch directory owning its own key keeps both together.
+   */
   getFilePath() {
-    return join14(env.DATA_DIR, FILENAME4);
+    return keyedFilePath(FILENAME4);
+  }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME4);
+  }
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile12(await this.getFilePath(), "utf-8");
+    } catch {
+      return readFile12(this.getLegacyFilePath(), "utf-8");
+    }
   }
   async load() {
     if (this.loaded) return;
     try {
-      const raw = await readFile12(this.getFilePath(), "utf-8");
+      const raw = await this.readFromDisk();
       this.session = JSON.parse(raw);
     } catch {
     }
@@ -5537,10 +5916,10 @@ var CloudSessionStore = class {
     }
   }
   async save() {
-    await mkdir12(env.DATA_DIR, { recursive: true });
-    const filePath = this.getFilePath();
+    await mkdir12(dirname6(await this.getFilePath()), { recursive: true });
+    const filePath = await this.getFilePath();
     const tmpPath = filePath + ".tmp";
-    await writeFile10(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await writeFile11(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
     await rename9(tmpPath, filePath);
     await chmod8(filePath, 384);
   }
@@ -5569,7 +5948,7 @@ var CloudSessionStore = class {
     this.session = null;
     this.pending.clear();
     try {
-      await unlink3(this.getFilePath());
+      await unlink3(await this.getFilePath());
     } catch {
     }
   }
@@ -6211,7 +6590,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-U3HLZ6QZ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -6864,7 +7243,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-U3HLZ6QZ.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7745,7 +8124,20 @@ var chatRouter = router({
         conversationStore.offChanged(handler);
       }
     }),
-    list: protectedProcedure.query(() => conversationStore.list()),
+    /**
+     * Conversations of one project.
+     *
+     * A conversation belongs to the project it was opened from, so the caller
+     * says which one it is looking at. Ones that name no project — written
+     * before the field existed, or that a migration could not attribute — are
+     * returned whatever the project: hiding them would make them unreachable.
+     */
+    list: protectedProcedure.input(z15.object({ projectId: Id128Schema.optional() }).optional()).query(async ({ input }) => {
+      const all = await conversationStore.list();
+      const projectId = input?.projectId;
+      if (!projectId) return all;
+      return all.filter((c) => !c.projectId || c.projectId === projectId);
+    }),
     get: protectedProcedure.input(z15.object({ id: Id128Schema })).query(async ({ input }) => {
       const conv = await conversationStore.get(input.id);
       if (!conv) throw new TRPCError11({ code: "NOT_FOUND", message: "Conversation not found" });
@@ -7759,7 +8151,10 @@ var chatRouter = router({
       scenarioId: Id128Schema.optional(),
       scenarioInput: z15.string().max(1e5).optional(),
       kanbanBoardId: Id128Schema.optional(),
-      kanbanCardId: Id128Schema.optional()
+      kanbanCardId: Id128Schema.optional(),
+      // The project the conversation is about: only the caller knows which
+      // one it is looking at.
+      projectId: Id128Schema.optional()
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
@@ -7774,7 +8169,8 @@ var chatRouter = router({
         input.runner,
         input.kanbanBoardId,
         input.kanbanCardId,
-        input.providerId
+        input.providerId,
+        input.projectId
       );
       if (scenario) {
         await scenarioRunStore.initializeConversationWorkspace(
@@ -8996,7 +9392,7 @@ async function* streamWithActiveProvider(opts) {
 // ../server/src/services/scenario-runner.ts
 import { mkdir as mkdir13 } from "fs/promises";
 import { randomUUID as randomUUID7 } from "crypto";
-import { join as join15 } from "path";
+import { join as join12 } from "path";
 
 // ../server/src/services/scenario-presets.ts
 var BUILT_IN_PRESETS = [
@@ -9770,7 +10166,7 @@ async function appendNodeOutput(conversationId, node, output) {
   if (!dir) return;
   const slug = node.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 60) || "member";
   const safeId = node.id.replace(/[^a-z0-9_-]/gi, "-").slice(0, 80);
-  const filePath = join15(dir, `${slug}_${safeId}.md`);
+  const filePath = join12(dir, `${slug}_${safeId}.md`);
   const content = `## Output
 
 ${output}
@@ -9785,7 +10181,7 @@ async function appendToReadme(conversationId, bus, text) {
   try {
     await mkdir13(dir, { recursive: true });
     const { appendFile: appendFile2 } = await import("fs/promises");
-    await appendFile2(join15(dir, "README.md"), line, "utf-8");
+    await appendFile2(join12(dir, "README.md"), line, "utf-8");
   } catch {
   }
   publishToBus(bus, { type: "readme_append", text: line });
@@ -9805,7 +10201,7 @@ async function writeFinalMd(conversationId, bus, userRequest, content) {
 
 ${content}
 `;
-  const filePath = join15(dir, "FINAL.md");
+  const filePath = join12(dir, "FINAL.md");
   await atomicWriteSecure(filePath, fullContent);
   await appendToReadme(
     conversationId,
@@ -10984,10 +11380,10 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
-import { mkdir as mkdir14, readdir as readdir5, rm as rm2, stat as stat3, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir14, readdir as readdir5, rm as rm3, stat as stat3, writeFile as writeFile12 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { join as join16 } from "path";
+import { join as join13 } from "path";
 import { z as z20 } from "zod";
 import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
@@ -11038,30 +11434,30 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join16(tmpdir(), "runeya-kanban-attachments");
+  return join13(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
     for (const name of await readdir5(dir)) {
-      const path = join16(dir, name);
+      const path = join13(dir, name);
       const info = await stat3(path).catch(() => null);
-      if (info && info.mtimeMs < cutoff) await rm2(path, { force: true });
+      if (info && info.mtimeMs < cutoff) await rm3(path, { force: true });
     }
   } catch {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join16(env.DATA_DIR, "kanban-attachments")];
+  return [attachmentCacheDir(), join13(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
       await mkdir14(dir, { recursive: true });
-      const path = join16(dir, safeLocalName(id, name));
-      await writeFile11(path, body);
+      const path = join13(dir, safeLocalName(id, name));
+      await writeFile12(path, body);
       void purgeStaleAttachments(dir);
       return path;
     } catch (err) {
@@ -11363,8 +11759,8 @@ var utilityRouter = router({
 // ../server/src/trpc/routers/wiki.ts
 import { z as z23 } from "zod";
 import { TRPCError as TRPCError19 } from "@trpc/server";
-import { readFile as readFile13, readdir as readdir6, stat as stat4, realpath, writeFile as writeFile12, mkdir as mkdir15, rename as rename10, rm as rm3 } from "fs/promises";
-import { resolve as resolvePath, join as join17, relative, sep as sep3, dirname as dirname3 } from "path";
+import { readFile as readFile13, readdir as readdir6, stat as stat4, realpath, writeFile as writeFile13, mkdir as mkdir15, rename as rename10, rm as rm4 } from "fs/promises";
+import { resolve as resolvePath, join as join14, relative, sep as sep3, dirname as dirname7 } from "path";
 var SCOPE_SCHEMA = z23.union([
   z23.literal("global"),
   z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
@@ -11402,7 +11798,7 @@ async function resolveScope(scope) {
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
     await mkdir15(dataDirAbs, { recursive: true });
-    const base = dirname3(await realpath(dataDirAbs));
+    const base = dirname7(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
       throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
@@ -11434,7 +11830,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join17(dir, e.name);
+    const abs = join14(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -11468,7 +11864,7 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     }
     return real;
   }
-  const parent = dirname3(target);
+  const parent = dirname7(target);
   let realParent;
   try {
     realParent = await realpath(parent);
@@ -11514,8 +11910,8 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir15(dirname3(file), { recursive: true });
-    await writeFile12(file, input.content, "utf-8");
+    await mkdir15(dirname7(file), { recursive: true });
+    await writeFile13(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
   createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11533,8 +11929,8 @@ var wikiRouter = router({
     } catch (err) {
       if (err instanceof TRPCError19) throw err;
     }
-    await mkdir15(dirname3(file), { recursive: true });
-    await writeFile12(file, "", "utf-8");
+    await mkdir15(dirname7(file), { recursive: true });
+    await writeFile13(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
   createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11559,7 +11955,7 @@ var wikiRouter = router({
     } catch (err) {
       if (err instanceof TRPCError19) throw err;
     }
-    await mkdir15(dirname3(to), { recursive: true });
+    await mkdir15(dirname7(to), { recursive: true });
     await rename10(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
@@ -11583,7 +11979,7 @@ var wikiRouter = router({
     }
     const fp = await resolveSafeLocal(target.root, input.path, true);
     if (fp === target.root) throw new TRPCError19({ code: "FORBIDDEN", message: "Impossible de supprimer la racine" });
-    await rm3(fp, { recursive: true, force: true });
+    await rm4(fp, { recursive: true, force: true });
     return { path: input.path, ok: true };
   })
 });
@@ -11601,31 +11997,50 @@ import { z as z24 } from "zod";
 import { TRPCError as TRPCError20 } from "@trpc/server";
 
 // ../server/src/services/cloud-sync-store.ts
-import { readFile as readFile14, writeFile as writeFile13, rename as rename11, mkdir as mkdir16, chmod as chmod9 } from "fs/promises";
-import { join as join18 } from "path";
+import { readFile as readFile14, writeFile as writeFile14, rename as rename11, mkdir as mkdir16, chmod as chmod9 } from "fs/promises";
 var FILENAME5 = "cloud-sync.json";
 var CloudSyncStore = class {
   links = /* @__PURE__ */ new Map();
   loaded = false;
+  /** Machine-wide: this describes the machine, not any one project. */
   getFilePath() {
-    return join18(env.DATA_DIR, FILENAME5);
+    return machineFilePath(FILENAME5);
+  }
+  /** Where older versions kept it — read only, so an older Runeya keeps working. */
+  getLegacyFilePath() {
+    return legacyMachineFilePath(FILENAME5);
+  }
+  /**
+   * Read the machine file, falling back to the launch directory of old.
+   *
+   * The legacy file is left in place: the next save writes the new location,
+   * and a directory still opened by an older Runeya keeps working meanwhile.
+   */
+  async readFromDisk() {
+    try {
+      return await readFile14(this.getFilePath(), "utf-8");
+    } catch {
+      return readFile14(this.getLegacyFilePath(), "utf-8");
+    }
   }
   async load() {
     if (this.loaded) return;
     try {
-      const raw = await readFile14(this.getFilePath(), "utf-8");
+      const raw = await this.readFromDisk();
       const data = JSON.parse(raw);
-      for (const l of data) this.links.set(l.orgId, { orgId: l.orgId, cloudUrl: l.cloudUrl });
+      for (const l of data) {
+        this.links.set(l.orgId, { orgId: l.orgId, cloudUrl: l.cloudUrl });
+      }
     } catch {
     }
     this.loaded = true;
   }
   async save() {
-    await mkdir16(env.DATA_DIR, { recursive: true });
+    await mkdir16(machineRoot(), { recursive: true });
     const filePath = this.getFilePath();
     const tmpPath = filePath + ".tmp";
     const data = JSON.stringify(Array.from(this.links.values()), null, 2);
-    await writeFile13(tmpPath, data, "utf-8");
+    await writeFile14(tmpPath, data, "utf-8");
     await rename11(tmpPath, filePath);
     await chmod9(filePath, 384);
   }
@@ -11653,7 +12068,82 @@ var cloudSyncStore = new CloudSyncStore();
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID11 } from "crypto";
+import { mkdir as mkdir18, rm as rm5 } from "fs/promises";
 import * as Y from "yjs";
+
+// ../server/src/services/org-lock.ts
+import { open as open2, readFile as readFile15, unlink as unlink4, mkdir as mkdir17 } from "fs/promises";
+import { readFileSync, unlinkSync } from "fs";
+import { join as join15 } from "path";
+var held = /* @__PURE__ */ new Set();
+function lockPath(orgId) {
+  return join15(orgVaultRoot(orgId), "org.lock");
+}
+function isRunning(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function readLock(path) {
+  try {
+    const parsed = JSON.parse(await readFile15(path, "utf-8"));
+    return typeof parsed?.pid === "number" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+async function acquireOrgLock(orgId) {
+  const path = lockPath(orgId);
+  await mkdir17(orgVaultRoot(orgId), { recursive: true });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      const handle = await open2(path, "wx");
+      try {
+        const contents = { pid: process.pid, startedAt: (/* @__PURE__ */ new Date()).toISOString() };
+        await handle.writeFile(JSON.stringify(contents), "utf-8");
+      } finally {
+        await handle.close();
+      }
+      held.add(orgId);
+      return { acquired: true };
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+    }
+    const holder2 = await readLock(path);
+    if (holder2 && holder2.pid !== process.pid && isRunning(holder2.pid)) {
+      return { acquired: false, heldBy: holder2.pid };
+    }
+    await unlink4(path).catch(() => {
+    });
+  }
+  const holder = await readLock(path);
+  return holder ? { acquired: false, heldBy: holder.pid } : { acquired: true };
+}
+async function releaseOrgLock(orgId) {
+  held.delete(orgId);
+  const path = lockPath(orgId);
+  const holder = await readLock(path);
+  if (holder && holder.pid !== process.pid) return;
+  await unlink4(path).catch(() => {
+  });
+}
+function releaseAllOrgLocksSync() {
+  for (const orgId of held) {
+    const path = lockPath(orgId);
+    try {
+      const holder = JSON.parse(readFileSync(path, "utf-8"));
+      if (holder.pid === process.pid) unlinkSync(path);
+    } catch {
+    }
+  }
+  held.clear();
+}
+
+// ../server/src/services/cloud-sync-bridge.ts
 var LOCAL_ORIGIN = "local-bridge";
 var REMOTE_ORIGIN = "remote";
 var RECONNECT_DELAY_MS = 3e3;
@@ -11690,6 +12180,32 @@ var OrgSyncConnection = class {
   lastIncompatibleVersion = null;
   /** Local state still owed to the cloud (initial sync, or a rejected episode). */
   needsPush = false;
+  /**
+   * Set while a newly followed project is being materialized.
+   *
+   * Reconciliation reads "absent locally" as "removed from the project", which
+   * is true for an edit and catastrophically false mid-pull: a project whose
+   * files have not landed yet would have its services and environments wiped
+   * from the doc — for every member of the org, not just here.
+   */
+  pulling = false;
+  /**
+   * Projects of this org materialized on this machine — the ones whose vault
+   * exists. Refreshed from disk rather than held in a saved list: a list is one
+   * more thing that can disagree with what is actually there, and a project on
+   * disk but missing from it is the "already here, still offered as a download"
+   * bug this replaces.
+   */
+  tracked = /* @__PURE__ */ new Set();
+  /**
+   * Whether the doc's opening state has been applied.
+   *
+   * It separates "the org already had these projects" from "someone just
+   * created one". The first must not land here — joining a fifty-project org
+   * would drop all fifty on the disk — while the second should, so a colleague
+   * creating a project sees it appear on their teammates' machines.
+   */
+  initialDocApplied = false;
   unsubscribes = [];
   onSaved = () => void this.reconcileLocalToDoc();
   constructor(link) {
@@ -11709,6 +12225,7 @@ var OrgSyncConnection = class {
     return this.link;
   }
   async start() {
+    await this.refreshTracked();
     this.doc.on("update", (update, origin) => {
       if (this.stopped || this.initializing) return;
       if (origin === LOCAL_ORIGIN) void this.pushUpdate(update);
@@ -11716,7 +12233,9 @@ var OrgSyncConnection = class {
     for (const name of COLLECTIONS) {
       this.collection(name).observeDeep((events, txn) => {
         if (txn.origin !== REMOTE_ORIGIN) return;
-        void this.applyDocEventsToStore(name, events);
+        const isInitial = !this.initialDocApplied;
+        if (name === "projects") this.initialDocApplied = true;
+        void this.applyDocEventsToStore(name, events, isInitial);
       });
     }
     projectStore.events.on("saved", this.onSaved);
@@ -11903,25 +12422,152 @@ var OrgSyncConnection = class {
       }
     }
   }
+  // ---- Project selection ------------------------------------------------
+  /**
+   * Whether a doc entity is one this machine holds.
+   *
+   * The org is the unit of transport — the doc carries every project a member
+   * can see — but not the unit of storage: a machine materializes only the
+   * projects its user opened. Without this filter, opening one project of a
+   * fifty-project org would drop the other forty-nine onto this disk.
+   *
+   * Having a vault is what "followed" means. Opening a project creates its
+   * directory, dropping it removes the directory, and nothing else has to be
+   * kept in agreement with the disk.
+   */
+  isTracked(name, id) {
+    if (name === "projects") return this.tracked.has(id);
+    const fields = readEntity(this.collection(name), id);
+    if (!fields) return false;
+    if (name === "environments") {
+      const projectId = fields["projectId"];
+      return typeof projectId === "string" && this.tracked.has(projectId);
+    }
+    const projects = this.collection("projects");
+    for (const projectId of this.tracked) {
+      const project = readEntity(projects, projectId);
+      const serviceIds = project?.["serviceIds"];
+      if (Array.isArray(serviceIds) && serviceIds.includes(id)) return true;
+    }
+    return false;
+  }
+  /** Re-read which projects of this org have a vault on this machine. */
+  async refreshTracked() {
+    const vaults = await listCloudVaults();
+    this.tracked = new Set(
+      vaults.filter((v) => v.orgId === this.link.orgId).map((v) => v.projectId)
+    );
+  }
+  /**
+   * Whether a *removal* announced by the doc concerns this machine.
+   *
+   * Deletions cannot go through `isTracked`: the entity is already gone from
+   * the doc, so there is nothing left to read its `projectId` from. Projects
+   * still answer from the selection; for their contents we lean on
+   * `deleteLocally` being a no-op for anything this machine never pulled, which
+   * is precisely the untracked case.
+   */
+  isTrackedForDeletion(name, id) {
+    if (name === "projects") return this.tracked.has(id);
+    return true;
+  }
+  /**
+   * Follow a project: give it a vault, then fill it from the doc.
+   *
+   * Idempotent on purpose. Widening a selection is not the only way a project
+   * comes to be missing — a first pull can fail on a rejected session, or land
+   * before the doc arrived — and re-opening the project has to be able to retry
+   * it. Returns whether the doc actually held the project.
+   */
+  async followProject(projectId) {
+    const inDoc = readEntity(this.collection("projects"), projectId) !== null;
+    const existing = await projectStore.get(projectId);
+    if (existing && !existing.orgId) {
+      console.error(
+        "[cloud-sync] project %s is already a local project here \u2014 not following it for org %s",
+        projectId,
+        this.link.orgId
+      );
+      return false;
+    }
+    const isLocal = existing?.orgId === this.link.orgId;
+    if (!inDoc && !isLocal) return false;
+    await mkdir18(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    this.tracked.add(projectId);
+    if (inDoc) await this.pullFromDoc([projectId]);
+    else await this.reconcileLocalToDoc();
+    return true;
+  }
+  /**
+   * Stop following a project on this machine.
+   *
+   * Its vault goes with it — the directory *is* the selection — but the doc is
+   * left untouched: the user stops following the project here, they do not ask
+   * for it to be deleted for the whole organization.
+   */
+  async unfollowProject(projectId) {
+    this.tracked.delete(projectId);
+    await projectStore.forgetLocally(projectId);
+    await rm5(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
+    });
+  }
+  /**
+   * Materialize locally everything the doc holds for these projects.
+   *
+   * Contents land before their project, so that the moment the project becomes
+   * local — and therefore "owned" by reconciliation — its services and
+   * environments are already on disk. The guard covers the rest of the window,
+   * including the saves this very method triggers.
+   */
+  async pullFromDoc(projectIds) {
+    this.pulling = true;
+    try {
+      for (const name of ["services", "environments", "projects"]) {
+        const collection = this.collection(name);
+        for (const id of Array.from(collection.keys())) {
+          if (name === "projects" ? !projectIds.includes(id) : !this.isTracked(name, id)) continue;
+          const fields = readEntity(collection, id);
+          if (fields) await this.upsertLocally(name, id, fields);
+        }
+      }
+    } finally {
+      this.pulling = false;
+    }
+    await this.reconcileLocalToDoc();
+  }
   // ---- Local ↔ Doc reconciliation --------------------------------------
-  async applyDocEventsToStore(name, events) {
+  async applyDocEventsToStore(name, events, isInitial = false) {
     const collection = this.collection(name);
     const deleted = /* @__PURE__ */ new Set();
     const affected = /* @__PURE__ */ new Set();
+    const added = /* @__PURE__ */ new Set();
     for (const event of events) {
       if (event.target === collection) {
         for (const [key, change] of event.changes.keys) {
           if (change.action === "delete") deleted.add(key);
-          else affected.add(key);
+          else {
+            affected.add(key);
+            if (change.action === "add") added.add(key);
+          }
         }
       } else {
         const topKey = event.path[0];
         if (typeof topKey === "string") affected.add(topKey);
       }
     }
-    for (const id of deleted) await this.deleteLocally(name, id);
+    for (const id of deleted) {
+      if (!this.isTrackedForDeletion(name, id)) continue;
+      await this.deleteLocally(name, id);
+    }
+    if (name === "projects" && !isInitial) {
+      for (const id of added) {
+        if (deleted.has(id) || this.tracked.has(id)) continue;
+        await this.followProject(id);
+      }
+    }
     for (const id of affected) {
       if (deleted.has(id)) continue;
+      if (!this.isTracked(name, id)) continue;
       const fields = readEntity(collection, id);
       if (!fields) continue;
       await this.upsertLocally(name, id, fields);
@@ -11936,7 +12582,10 @@ var OrgSyncConnection = class {
       await environmentStore.applyRemoteUpsert(id, fields);
       return;
     }
-    const result = await projectStore.applyRemoteUpsert(id, fields);
+    const result = await projectStore.applyRemoteUpsert(id, {
+      ...fields,
+      orgId: this.link.orgId
+    });
     if (result?.created) await this.bootstrapEnvironment(id);
   }
   async deleteLocally(name, id) {
@@ -11977,7 +12626,7 @@ var OrgSyncConnection = class {
    * propagate — otherwise a service could never be removed.
    */
   async reconcileLocalToDoc() {
-    if (this.stopped) return;
+    if (this.stopped || this.pulling) return;
     const projects = await projectStore.listDiskFormByOrg(this.link.orgId);
     const projectIds = projects.map((p) => p.id);
     const serviceIds = [...new Set(projects.flatMap((p) => p.serviceIds ?? []))];
@@ -12025,6 +12674,8 @@ var OrgSyncConnection = class {
 };
 var CloudSyncBridge = class {
   connections = /* @__PURE__ */ new Map();
+  /** Orgs another instance holds the lock on — reported, not retried blindly. */
+  locked = /* @__PURE__ */ new Set();
   started = false;
   /** Start syncing every organization already linked on disk. */
   async start() {
@@ -12050,15 +12701,55 @@ var CloudSyncBridge = class {
   }
   /** Per-org sync state, for the UI. */
   states() {
-    return Array.from(this.connections.entries()).map(([orgId, conn]) => ({
+    const live = Array.from(this.connections.entries()).map(([orgId, conn]) => ({
       orgId,
       state: conn.getState(),
       lastIncompatibleVersion: conn.getLastIncompatibleVersion()
     }));
+    const locked = Array.from(this.locked).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({ orgId, state: "locked", lastIncompatibleVersion: null }));
+    return [...live, ...locked];
   }
-  /** Begin (or restart) syncing a single organization. */
+  /**
+   * Follow one project of an org on this machine, pulling it now.
+   *
+   * Returns false when the org is not connected or the doc does not hold the
+   * project — both mean "not on this machine yet", and the caller reports the
+   * sync state rather than a bare timeout.
+   */
+  async followProject(orgId, projectId) {
+    const conn = this.connections.get(orgId);
+    if (!conn) return false;
+    return conn.followProject(projectId);
+  }
+  /** Stop following one project of an org on this machine. */
+  async unfollowProject(orgId, projectId) {
+    await this.connections.get(orgId)?.unfollowProject(projectId);
+  }
+  /**
+   * Begin (or restart) syncing a single organization.
+   *
+   * Takes the org's lock first. An org's vaults are shared by every Runeya on
+   * this machine, so a second instance syncing the same org would write the
+   * same files from its own copy of the doc — silently overwriting the first.
+   * Refusing to sync is the safe answer: the instance keeps running, that org
+   * simply does not sync here.
+   */
   async connect(link) {
     this.disconnect(link.orgId);
+    const lock = await acquireOrgLock(link.orgId).catch((err) => {
+      console.error("[cloud-sync] could not take the lock for org %s:", link.orgId, err.message);
+      return { acquired: false, heldBy: 0 };
+    });
+    if (!lock.acquired) {
+      console.error(
+        "[cloud-sync] org %s is already being synced by another Runeya (pid %d) \u2014 not syncing it here",
+        link.orgId,
+        lock.heldBy
+      );
+      this.locked.add(link.orgId);
+      return;
+    }
+    this.locked.delete(link.orgId);
     const conn = new OrgSyncConnection(link);
     this.connections.set(link.orgId, conn);
     try {
@@ -12072,19 +12763,22 @@ var CloudSyncBridge = class {
     if (existing) {
       existing.stop();
       this.connections.delete(orgId);
+      void releaseOrgLock(orgId);
     }
   }
   stopAll() {
     for (const conn of this.connections.values()) conn.stop();
     this.connections.clear();
+    this.locked.clear();
+    releaseAllOrgLocksSync();
   }
 };
 var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/master-password.ts
 import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile15, writeFile as writeFile14, chmod as chmod10, stat as stat5, rename as rename12 } from "fs/promises";
-import { join as join19 } from "path";
+import { readFile as readFile16, writeFile as writeFile15, chmod as chmod10, stat as stat5, rename as rename12 } from "fs/promises";
+import { join as join16 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
 var KEYRING_SERVICE = "runeya";
@@ -12098,7 +12792,7 @@ var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen
 async function readKeyFile(filePath) {
   const s = await stat5(filePath);
   if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
-  return readFile15(filePath);
+  return readFile16(filePath);
 }
 function aesEncrypt(key, plaintext) {
   const iv = randomBytes4(12);
@@ -12117,7 +12811,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join19(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join16(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -12125,9 +12819,9 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join19(dataDir, PEPPER_FILENAME);
+  const filePath = join16(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile14(tmpPath, pepper.toString("hex"), "utf-8");
+  await writeFile15(tmpPath, pepper.toString("hex"), "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
@@ -12176,14 +12870,14 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join16(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile14(tmpPath, encoded, "utf-8");
+  await writeFile15(tmpPath, encoded, "utf-8");
   await chmod10(tmpPath, 384);
   await rename12(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join19(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join16(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
@@ -12203,13 +12897,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join19(dataDir, VERIFY_FILENAME);
+  const filePath = join16(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile14(tmpPath, payload.toString("base64"), "utf-8");
+  await writeFile15(tmpPath, payload.toString("base64"), "utf-8");
   await rename12(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join19(dataDir, VERIFY_FILENAME);
+  const filePath = join16(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
     throw new Error("Cl\xE9 d'encryption incorrecte");
@@ -12225,14 +12919,14 @@ function matchesCanary(canaryBase64, encryptionKey) {
 }
 async function readVerifyFile(dataDir) {
   try {
-    return (await readKeyFile(join19(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+    return (await readKeyFile(join16(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
   } catch {
     return null;
   }
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat5(join19(dataDir, VERIFY_FILENAME));
+    await stat5(join16(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -12240,7 +12934,7 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat5(join19(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat5(join16(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
@@ -12253,7 +12947,7 @@ async function reconcileOrgCanary(orgId) {
   if (!key) {
     throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "Encryption key not loaded." });
   }
-  const local = await readVerifyFile(env.DATA_DIR);
+  const local = await readVerifyFile(await keyRoot());
   if (!local) {
     throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "This machine has no key canary yet." });
   }
@@ -12275,6 +12969,9 @@ async function reconcileOrgCanary(orgId) {
     });
   }
 }
+function syncState(orgId) {
+  return cloudSyncBridge.states().find((s) => s.orgId === orgId)?.state ?? "stopped";
+}
 var cloudSyncRouter = router({
   /**
    * Register/replace a sync link for an org and start syncing immediately.
@@ -12285,12 +12982,56 @@ var cloudSyncRouter = router({
   link: protectedProcedure.input(
     z24.object({
       orgId: z24.string().min(1).max(128),
-      cloudUrl: z24.string().url().max(2048)
+      cloudUrl: z24.string().url().max(2048),
+      // No project selection: which projects this machine materializes is
+      // read from the vaults on disk, so linking an org never re-downloads
+      // projects the user had dropped.
+      projectIds: z24.array(z24.string().min(1).max(128)).max(500).optional()
     })
   ).mutation(async ({ input }) => {
     await reconcileOrgCanary(input.orgId);
     await cloudSyncStore.upsert(input.orgId, input.cloudUrl);
-    await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
+    const link = await cloudSyncStore.get(input.orgId);
+    await cloudSyncBridge.connect(link ?? { orgId: input.orgId, cloudUrl: input.cloudUrl });
+    return { success: true };
+  }),
+  /**
+   * Follow one more project of an org, and pull it now.
+   *
+   * This is what opening a project in the switcher calls. It links the org on
+   * first use, so the UI never has to know whether a link already exists —
+   * "open this project" is the whole gesture.
+   */
+  trackProject: protectedProcedure.input(
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      cloudUrl: z24.string().url().max(2048),
+      projectId: z24.string().min(1).max(128)
+    })
+  ).mutation(async ({ input }) => {
+    const existing = await cloudSyncStore.get(input.orgId);
+    if (!existing) {
+      await reconcileOrgCanary(input.orgId);
+      await cloudSyncStore.upsert(input.orgId, input.cloudUrl);
+      const link = await cloudSyncStore.get(input.orgId);
+      if (link) await cloudSyncBridge.connect(link);
+    }
+    const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
+    return { pulled, state: syncState(input.orgId) };
+  }),
+  /**
+   * Stop materializing one project of an org on this machine.
+   *
+   * Removes its vault, and nothing else: the project stays in the org, for
+   * every other member and for this one on another machine.
+   */
+  untrackProject: protectedProcedure.input(
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      projectId: z24.string().min(1).max(128)
+    })
+  ).mutation(async ({ input }) => {
+    await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
     return { success: true };
   }),
   /** Stop syncing an org and forget its token. */
@@ -12378,7 +13119,6 @@ var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
 import { chmod as chmod11, stat as stat6 } from "fs/promises";
-import { join as join20 } from "path";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -12390,78 +13130,36 @@ var SENSITIVE_FILES = [
 var SECURE_MODE = 384;
 async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
-    const filepath = join20(env.DATA_DIR, filename);
-    try {
-      const stats = await stat6(filepath);
-      const mode = stats.mode & 511;
-      if (mode !== SECURE_MODE) {
-        console.warn("[security] File", filename, "has mode", mode.toString(8) + ", fixing to 600");
-        await chmod11(filepath, SECURE_MODE);
-      }
-    } catch (err) {
-      if (err.code !== "ENOENT") {
-        console.warn("[security] Cannot check permissions for", filename + ":", err instanceof Error ? err.message : String(err));
+    for (const filepath of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
+      try {
+        const stats = await stat6(filepath);
+        const mode = stats.mode & 511;
+        if (mode !== SECURE_MODE) {
+          console.warn("[security] File", filepath, "has mode", mode.toString(8) + ", fixing to 600");
+          await chmod11(filepath, SECURE_MODE);
+        }
+      } catch (err) {
+        if (err.code !== "ENOENT") {
+          console.warn("[security] Cannot check permissions for", filepath + ":", err instanceof Error ? err.message : String(err));
+        }
       }
     }
   }
 }
 
-// ../server/src/utils/ensure-data-gitignore.ts
-import { writeFile as writeFile15 } from "fs/promises";
-import { join as join21 } from "path";
-var GITIGNORE_CONTENT = `
-#################
-# Do not edit this file #
-#################
-
-
-# Encryption key (contains secrets \u2014 never commit)
-.encryption.key
-.encryption.key.enc
-
-
-# Key verification canary \u2014 MUST be committed so new team members can validate their encryption key
-!.runeya-verify
-
-# This machine's cloud session token (encrypted, and specific to this install)
-cloud-session.json
-
-# Backup in local only
-backup-*
-
-# Per-user environment overrides (never commit \u2014 each dev has their own)
-environment-overrides.json
-
-# Private user data (conversations, personal state \u2014 never commit)
-*.private
-*.private.json*
-conversations/
-conversations.private.json
-
-
-
-# Runtime logs
-*.log
-*.log.*
-`;
-async function ensureDataGitignore(dataDir) {
-  const gitignorePath = join21(dataDir, ".gitignore");
-  await writeFile15(gitignorePath, GITIGNORE_CONTENT, "utf-8");
-}
-
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile16,
+  readFile as readFile17,
   writeFile as writeFile16,
   rename as rename13,
-  mkdir as mkdir17,
+  mkdir as mkdir19,
   access as access2,
   readdir as readdir7
 } from "fs/promises";
-import { join as join22 } from "path";
+import { join as join17 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -12570,7 +13268,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile16(filePath, "utf-8")).trim();
+  const raw = (await readFile17(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -12596,8 +13294,8 @@ async function atomicWrite(path, data) {
 async function runLegacyMigration(dataDir) {
   const { resolve: resolve6 } = await import("path");
   const abCwd = resolve6(process.cwd());
-  const legacyRoot = join22(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join22(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = join17(abCwd, env.DATA_DIR);
+  const legacyKeyPath = join17(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -12605,20 +13303,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join22(abCwd, ".runeya-tmp");
+  const legacyTmp = join17(abCwd, ".runeya-tmp");
   await rename13(legacyRoot, legacyTmp);
-  await mkdir17(dataDir, { recursive: true });
-  const legacyOld = join22(dataDir, `backup-${timestamp}`);
+  await mkdir19(dataDir, { recursive: true });
+  const legacyOld = join17(dataDir, `backup-${timestamp}`);
   await rename13(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile16(join22(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile17(join17(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join22(legacyOld, "dbs");
+  const dbsDir = join17(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -12627,29 +13325,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join22(dbsDir, "envs");
+  const envsDir = join17(dbsDir, "envs");
   const envFiles = (await readdir7(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join22(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join17(envsDir, file));
   }
-  const servicesDir = join22(dbsDir, "services");
+  const servicesDir = join17(dbsDir, "services");
   const serviceFiles = (await readdir7(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join22(servicesDir, file));
+    const data = await readEncrypted(join17(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join22(dbsDir, "overrides");
+  const overridesDir = join17(dbsDir, "overrides");
   const overrideFiles = (await readdir7(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join22(overridesDir, file));
+    const data = await readEncrypted(join17(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -12657,11 +13355,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join22(dbsDir, "parsers");
+  const parsersDir = join17(dbsDir, "parsers");
   const parserFiles = (await readdir7(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join22(parsersDir, file));
+    const data = await readEncrypted(join17(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -13002,7 +13700,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile16(join22(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile17(join17(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -13023,11 +13721,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join22(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join22(dataDir, "services.json"), runeServices);
-  await atomicWrite(join22(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join22(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join22(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join17(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join17(dataDir, "services.json"), runeServices);
+  await atomicWrite(join17(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join17(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join17(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -13041,9 +13739,9 @@ async function findLegacyKeyInBackup(dataDir) {
     const entries = await readdir7(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join22(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join17(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile16(keyJsonPath, "utf-8");
+        const raw = await readFile17(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -13065,8 +13763,8 @@ async function runOverrideOnlyMigration(dataDir) {
   const abDataDir = resolve6(dataDir);
   const abCwd = resolve6(process.cwd());
   const candidateDirs = [
-    join22(abCwd, ".runeya", "dbs", "overrides"),
-    join22(abDataDir, "dbs", "overrides")
+    join17(abCwd, ".runeya", "dbs", "overrides"),
+    join17(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
@@ -13082,7 +13780,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join22(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join17(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -13100,7 +13798,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile16(join22(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile17(join17(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -13119,7 +13817,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile16(join22(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile17(join17(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -13136,7 +13834,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13163,7 +13861,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join22(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join17(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -13173,7 +13871,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join22(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13232,7 +13930,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join22(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join17(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
@@ -13247,27 +13945,32 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join23 } from "path";
+import { join as join18 } from "path";
 import { stat as stat7 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
 async function getServerState() {
-  const dataDir = env.DATA_DIR;
+  const dataDir = await keyRoot();
   let hasEncFile = false;
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat7(join23(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat7(join18(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat7(join23(dataDir, VERIFY_FILENAME2));
+    await stat7(join18(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat7(join23(dataDir, "projects.json"));
+    await stat7(join18(dataDir, "projects.json"));
+    hasData = true;
+  } catch {
+  }
+  try {
+    await stat7(join18(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
@@ -13559,7 +14262,6 @@ function getOpenApiDocument() {
 // ../server/src/create-server.ts
 import rateLimit from "express-rate-limit";
 import { existsSync as existsSync2, createReadStream } from "fs";
-import { mkdir as mkdir18 } from "fs/promises";
 import multer from "multer";
 
 // ../server/src/services/image-cleanup.service.ts
@@ -13650,7 +14352,8 @@ async function createLocalServer() {
   generateJwtSecret();
   const ciMode = await loadFromEnv();
   await runLegacyMigration(env.DATA_DIR);
-  if (!ciMode && !hasPendingLegacyKey() && !await hasEncryptedKeyFile(env.DATA_DIR) && !await hasVerifyFile(env.DATA_DIR)) {
+  const keyDir = await keyRoot();
+  if (!ciMode && !hasPendingLegacyKey() && !await hasEncryptedKeyFile(keyDir) && !await hasVerifyFile(keyDir)) {
     const recoveredKey = await findLegacyKeyInBackup(env.DATA_DIR);
     if (recoveredKey) {
       setPendingLegacyKey(recoveredKey);
@@ -13665,10 +14368,12 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  if (!existsSync2(env.DATA_DIR)) await mkdir18(env.DATA_DIR);
   const absoluteDataDir = resolve5(env.DATA_DIR);
-  console.log(`[server] Data directory: ${absoluteDataDir}`);
-  await ensureDataGitignore(env.DATA_DIR);
+  console.log(`[server] Local project directory: ${absoluteDataDir}`);
+  console.log(`[server] Machine directory: ${machineRoot()}`);
+  if (existsSync2(env.DATA_DIR)) {
+    await ensureDataGitignore(env.DATA_DIR);
+  }
   await settingsManager.getSettings();
   await migrationEngine.run();
   await ensureFilePermissions();
@@ -13947,7 +14652,7 @@ async function createLocalServer() {
         res.status(400).json({ error: "masterPassword invalide" });
         return;
       }
-      const encKey = await readEncryptedKey(env.DATA_DIR, masterPassword);
+      const encKey = await readEncryptedKey(await keyRoot(), masterPassword);
       setEncryptionKeyInMemory(encKey);
       await runPostUnlock();
       const token = await signJwt();
@@ -13985,7 +14690,7 @@ async function createLocalServer() {
           return;
         }
         encKey = Buffer.from(encryptionKeyHex, "hex");
-        await verifyEncryptionKey(env.DATA_DIR, encKey);
+        await verifyEncryptionKey(await keyRoot(), encKey);
       } else {
         if (body.encryptionKey !== void 0) {
           const encryptionKeyHex = body.encryptionKey;
@@ -13999,14 +14704,14 @@ async function createLocalServer() {
           encKey = randomBytes6(32);
         }
       }
-      await writeEncryptedKey(env.DATA_DIR, masterPassword, encKey);
-      const readBack = await readEncryptedKey(env.DATA_DIR, masterPassword);
+      await writeEncryptedKey(await keyRoot(), masterPassword, encKey);
+      const readBack = await readEncryptedKey(await keyRoot(), masterPassword);
       if (!readBack.equals(encKey)) {
         res.status(500).json({ error: "Erreur de v\xE9rification round-trip \u2014 op\xE9ration annul\xE9e" });
         return;
       }
       if (!hasVerify) {
-        await writeVerifyFile(env.DATA_DIR, encKey);
+        await writeVerifyFile(await keyRoot(), encKey);
       }
       setEncryptionKeyInMemory(encKey);
       if (isLegacyMigration) {
@@ -14429,4 +15134,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-A3WSWXEY.js.map
+//# sourceMappingURL=src-BCBD4MPB.js.map