@runeya/runeya 2.0.44 → 2.0.46

package/{src-7CJJBMY3.js → src-5QPLS5TQ.js}

@@ -2,6 +2,7 @@ import {
   AGENT_LONG_FETCH_TIMEOUT,
   AGENT_STOP_FETCH_TIMEOUT,
   AIProviderSchema,
+  AmbiguousProjectError,
   ApiKeyScopeSchema,
   ApiKeysFileSchema,
   CreateEnvironmentSchema,
@@ -35,11 +36,14 @@ import {
   clearEncryptionKey,
   clearPendingLegacyKey,
   decryptValue,
+  decryptValueWith,
   decryptVariableSlots,
   encryptValue,
+  encryptValueWith,
   encryptVariableSlots,
   ensureEncryptionKey,
   ensureLocalVault,
+  ensureProjectsLoaded,
   env,
   environmentStore,
   extractEncryptedVariableSlots,
@@ -54,6 +58,7 @@ import {
   keyRoot,
   keyedFilePath,
   legacyMachineFilePath,
+  legacyVaultRoot,
   listCloudVaults,
   loadFromEnv,
   localVaultRoot,
@@ -61,10 +66,13 @@ import {
   machineRoot,
   nativeParsers,
   orgVaultRoot,
+  projectKey,
   projectVaultRoot,
   readEntity,
+  readOrgClouds,
+  refOfProjectAmong,
   registerProjectLoader,
-  rootOfProject,
+  rootOfProjectAmong,
   serviceStore,
   setEncryptionKey,
   setEncryptionKeyInMemory,
@@ -72,16 +80,17 @@ import {
   setProjectServices,
   setProjectVault,
   stableEncryptValue,
+  stampOrgCloud,
   traefikManager,
   vaultFor,
   writeEntity
-} from "./chunk-NJJMESIY.js";
+} from "./chunk-5PRQBES2.js";
 
 // ../server/src/create-server.ts
 import express from "express";
 import cors from "cors";
 import { createServer } from "http";
-import { resolve as resolve5 } from "path";
+import { resolve as resolve6 } from "path";
 import { WebSocketServer } from "ws";
 import { createExpressMiddleware } from "@trpc/server/adapters/express";
 import { applyWSSHandler } from "@trpc/server/adapters/ws";
@@ -542,6 +551,12 @@ var LocalProjectExistsError = class extends Error {
   code = "LOCAL_PROJECT_EXISTS";
 };
 var ProjectStore = class {
+  /**
+   * Keyed by the (organization, project) couple, never by the project id alone:
+   * the same id can name a different project in each organization, and keying
+   * by id let the second one read from disk overwrite the first — then `save()`
+   * wrote that survivor back into both vaults.
+   */
   projects = /* @__PURE__ */ new Map();
   loaded = false;
   /** Emits `'saved'` after every persisted mutation, for the cloud sync bridge. */
@@ -559,15 +574,15 @@ var ProjectStore = class {
   async absorb(p, root) {
     const projectEnvs = await environmentStore.getByProjectId(p.id).catch(() => []);
     const defaultEnv = projectEnvs.find((e) => e.default);
-    this.projects.set(p.id, {
+    this.projects.set(projectKey(p), {
       ...p,
       environmentIds: p.environmentIds ?? [],
       groupOrder: p.groupOrder ?? [],
       // Prefer the env marked default, fall back to first env
       activeEnvironmentId: defaultEnv?.id ?? p.environmentIds?.[0]
     });
-    setProjectVault(p.id, root);
-    setProjectServices(p.id, p.serviceIds ?? []);
+    setProjectVault(p, root);
+    setProjectServices(p, p.serviceIds ?? []);
   }
   /**
    * Read every vault: the launch directory, then each organization's projects.
@@ -633,17 +648,40 @@ var ProjectStore = class {
     for (const { project, root } of cloud) {
       await mkdir2(root, { recursive: true });
       await this.writeAtomic(this.getFilePath(root), JSON.stringify(toDiskForm(project), null, 2));
-      setProjectVault(project.id, root);
+      setProjectVault(project, root);
     }
     this.events.emit("saved");
   }
+  /**
+   * The project a caller means, from a couple or from a bare id.
+   *
+   * A ref carrying its `orgId` — even an explicit `null` for a local project —
+   * names exactly one project and is looked up directly. A bare id is what a
+   * contained entity (an environment, a conversation) still carries, and it is
+   * resolved only while it answers for a single project: electing one of two
+   * would write into the wrong organization's vault.
+   */
+  resolveKey(target) {
+    if (typeof target !== "string" && target.orgId !== void 0) return projectKey(target);
+    const id = typeof target === "string" ? target : target.id;
+    const matches = Array.from(this.projects.values()).filter((p) => p.id === id);
+    if (matches.length > 1) {
+      throw new AmbiguousProjectError(id, matches.map((p) => p.orgId ?? null));
+    }
+    return matches[0] ? projectKey(matches[0]) : null;
+  }
+  find(target) {
+    const key = this.resolveKey(target);
+    const project = key ? this.projects.get(key) : void 0;
+    return key && project ? { key, project } : null;
+  }
   async list() {
     await this.load();
     return Array.from(this.projects.values());
   }
-  async get(id) {
+  async get(target) {
     await this.load();
-    return this.projects.get(id) ?? null;
+    return this.find(target)?.project ?? null;
   }
   async create(input) {
     await this.load();
@@ -663,16 +701,22 @@ var ProjectStore = class {
       activeEnvironmentId: input.activeEnvironmentId,
       groupOrder: input.groupOrder ?? []
     };
-    this.projects.set(project.id, project);
-    setProjectVault(project.id, vaultFor(project).root);
-    setProjectServices(project.id, project.serviceIds);
+    this.projects.set(projectKey(project), project);
+    setProjectVault(project, vaultFor(project).root);
+    setProjectServices(project, project.serviceIds);
     await this.save();
     return project;
   }
+  /**
+   * `input.orgId` names which project is being updated, it does not move it:
+   * a project is born local or in an organization and stays there, so treating
+   * it as a new value would silently relocate a vault instead of editing it.
+   */
   async update(input) {
     await this.load();
-    const existing = this.projects.get(input.id);
-    if (!existing) return null;
+    const found = this.find(input);
+    if (!found) return null;
+    const { key, project: existing } = found;
     const updated = {
       ...existing,
       ...input.name !== void 0 && { name: input.name },
@@ -680,20 +724,20 @@ var ProjectStore = class {
       ...input.serviceIds !== void 0 && { serviceIds: input.serviceIds },
       ...input.environmentIds !== void 0 && { environmentIds: input.environmentIds },
       ...input.activeEnvironmentId !== void 0 && { activeEnvironmentId: input.activeEnvironmentId },
-      ...input.orgId !== void 0 && { orgId: input.orgId },
       ...input.groupOrder !== void 0 && { groupOrder: input.groupOrder }
     };
-    this.projects.set(input.id, updated);
-    setProjectVault(updated.id, vaultFor(updated).root);
-    setProjectServices(updated.id, updated.serviceIds);
+    this.projects.set(key, updated);
+    setProjectVault(updated, vaultFor(updated).root);
+    setProjectServices(updated, updated.serviceIds);
     await this.save();
     return updated;
   }
-  async delete(id) {
+  async delete(target) {
     await this.load();
-    const project = this.projects.get(id);
-    if (!project) return false;
-    this.projects.delete(id);
+    const found = this.find(target);
+    if (!found) return false;
+    const { key, project } = found;
+    this.projects.delete(key);
     await this.save();
     await this.discardVault(project);
     return true;
@@ -707,7 +751,7 @@ var ProjectStore = class {
    * are only removed from the list.
    */
   async discardVault(project) {
-    forgetProject(project.id);
+    forgetProject(project);
     if (!project.orgId) return;
     await rm(vaultFor(project).root, { recursive: true, force: true }).catch(() => {
     });
@@ -720,14 +764,15 @@ var ProjectStore = class {
    * back on the next save — and, its project being unknown by then, into the
    * local vault.
    */
-  async forgetLocally(projectId) {
+  async forgetLocally(target) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return;
-    this.projects.delete(projectId);
-    forgetProject(projectId);
+    const found = this.find(target);
+    if (!found) return;
+    const { key, project } = found;
+    this.projects.delete(key);
+    forgetProject(project);
     await serviceStore.forgetLocally(project.serviceIds ?? []);
-    await environmentStore.forgetByProject(projectId);
+    await environmentStore.forgetByProject(project.id);
   }
   /** All projects linked to a given organization (for the sync bridge). */
   async listByOrg(orgId) {
@@ -756,92 +801,99 @@ var ProjectStore = class {
       return null;
     }
     const incoming = toDiskForm(parsed.data);
-    const existing = this.projects.get(id);
+    const key = projectKey(parsed.data);
+    const existing = this.projects.get(key);
     if (existing) {
       if (JSON.stringify(toDiskForm(existing)) === JSON.stringify(incoming)) {
         return { project: existing, created: false };
       }
       const updated = { ...incoming, activeEnvironmentId: existing.activeEnvironmentId };
-      this.projects.set(id, updated);
-      setProjectVault(id, vaultFor(updated).root);
-      setProjectServices(id, updated.serviceIds);
+      this.projects.set(key, updated);
+      setProjectVault(updated, vaultFor(updated).root);
+      setProjectServices(updated, updated.serviceIds);
       await this.save();
       return { project: updated, created: false };
     }
     const project = { ...incoming, activeEnvironmentId: void 0 };
-    this.projects.set(id, project);
-    setProjectVault(id, vaultFor(project).root);
-    setProjectServices(id, project.serviceIds);
+    this.projects.set(key, project);
+    setProjectVault(project, vaultFor(project).root);
+    setProjectServices(project, project.serviceIds);
     await this.save();
     return { project, created: true };
   }
   /** Delete a project that was removed on another peer. */
-  async applyRemoteDelete(id) {
+  async applyRemoteDelete(target) {
     await this.load();
-    const project = this.projects.get(id);
-    if (!project) return false;
-    this.projects.delete(id);
+    const found = this.find(target);
+    if (!found) return false;
+    const { key, project } = found;
+    this.projects.delete(key);
     await this.save();
     await this.discardVault(project);
     return true;
   }
-  async addService(projectId, serviceId) {
+  async addService(target, serviceId) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return null;
+    const found = this.find(target);
+    if (!found) return null;
+    const { key, project } = found;
     if (project.serviceIds.includes(serviceId)) return project;
     const updated = { ...project, serviceIds: [...project.serviceIds, serviceId] };
-    this.projects.set(projectId, updated);
-    setProjectServices(projectId, updated.serviceIds);
+    this.projects.set(key, updated);
+    setProjectServices(updated, updated.serviceIds);
     await this.save();
     return updated;
   }
-  async removeService(projectId, serviceId) {
+  async removeService(target, serviceId) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return null;
+    const found = this.find(target);
+    if (!found) return null;
+    const { key, project } = found;
     const updated = { ...project, serviceIds: project.serviceIds.filter((id) => id !== serviceId) };
-    this.projects.set(projectId, updated);
-    setProjectServices(projectId, updated.serviceIds);
+    this.projects.set(key, updated);
+    setProjectServices(updated, updated.serviceIds);
     await this.save();
     return updated;
   }
-  async addEnvironment(projectId, environmentId) {
+  async addEnvironment(target, environmentId) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return null;
+    const found = this.find(target);
+    if (!found) return null;
+    const { key, project } = found;
     if (project.environmentIds?.includes(environmentId)) return project;
     const updated = {
       ...project,
       environmentIds: [...project.environmentIds ?? [], environmentId]
     };
-    this.projects.set(projectId, updated);
+    this.projects.set(key, updated);
     await this.save();
     return updated;
   }
-  async removeEnvironment(projectId, environmentId) {
+  async removeEnvironment(target, environmentId) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return null;
+    const found = this.find(target);
+    if (!found) return null;
+    const { key, project } = found;
     const updated = {
       ...project,
       environmentIds: (project.environmentIds ?? []).filter((id) => id !== environmentId),
       // Clear activeEnvironmentId if it was the removed environment
       ...project.activeEnvironmentId === environmentId && { activeEnvironmentId: void 0 }
     };
-    this.projects.set(projectId, updated);
+    this.projects.set(key, updated);
     await this.save();
     return updated;
   }
-  async setActiveEnvironment(projectId, environmentId) {
+  async setActiveEnvironment(target, environmentId) {
     await this.load();
-    const project = this.projects.get(projectId);
-    if (!project) return null;
+    const found = this.find(target);
+    if (!found) return null;
+    const { key, project } = found;
     const updated = {
       ...project,
       activeEnvironmentId: environmentId
     };
-    this.projects.set(projectId, updated);
+    this.projects.set(key, updated);
     return updated;
   }
 };
@@ -873,8 +925,8 @@ var EnvironmentOverridesStore = class {
    * may simply not be loaded yet.
    */
   async rootFor(variableId) {
-    const projectId = await environmentStore.projectIdOfVariable(variableId);
-    if (projectId) return rootOfProject(projectId);
+    const root = await environmentStore.rootOfVariable(variableId);
+    if (root) return root;
     return this.roots.get(variableId) ?? dirname2(await keyedFilePath(FILENAME2));
   }
   /** Where earlier versions kept them: read once, rewritten to their vaults. */
@@ -891,6 +943,7 @@ var EnvironmentOverridesStore = class {
     if (this.loaded) return;
     if (!getEncryptionKey()) return;
     this.loaded = true;
+    await ensureProjectsLoaded();
     const roots = await allVaultRoots();
     const sources = [
       this.getLegacyFilePath(),
@@ -1456,13 +1509,98 @@ var AuditService = class {
 };
 var auditService = new AuditService();
 
+// ../server/src/services/project-path-store.ts
+import { readFile as readFile5, writeFile as writeFile5, rename as rename5, mkdir as mkdir5, chmod as chmod4, stat as stat2 } from "fs/promises";
+import { isAbsolute, join as join4, resolve } from "path";
+var FILENAME3 = "project-paths.json";
+var ProjectPathStore = class {
+  paths = null;
+  async load() {
+    if (this.paths) return this.paths;
+    try {
+      const raw = await readFile5(machineFilePath(FILENAME3), "utf-8");
+      const parsed = JSON.parse(raw);
+      this.paths = isPathMap(parsed) ? parsed : {};
+    } catch {
+      this.paths = {};
+    }
+    return this.paths;
+  }
+  async persist() {
+    await mkdir5(machineRoot(), { recursive: true });
+    const filePath = machineFilePath(FILENAME3);
+    const tmpPath = `${filePath}.tmp`;
+    await writeFile5(tmpPath, JSON.stringify(this.paths ?? {}, null, 2), "utf-8");
+    await rename5(tmpPath, filePath);
+    await chmod4(filePath, 384);
+  }
+  /** The directory chosen for this project, or null while it has none. */
+  async get(ref) {
+    const paths = await this.load();
+    return paths[projectKey(ref)] ?? paths[ref.id] ?? null;
+  }
+  async all() {
+    return { ...await this.load() };
+  }
+  /**
+   * The project already placed in this directory, if any other one is.
+   *
+   * Answers with the key as stored — the couple, or the bare id for an entry an
+   * older version wrote — which is enough to say "taken" and to name it.
+   */
+  async projectAt(path, exclude) {
+    const target = resolve(path);
+    const excluded = exclude ? [projectKey(exclude), exclude.id] : [];
+    for (const [key, dir] of Object.entries(await this.load())) {
+      if (!excluded.includes(key) && resolve(dir) === target) return key;
+    }
+    return null;
+  }
+  async set(ref, path) {
+    if (!isAbsolute(path)) throw new Error("Le chemin du projet doit \xEAtre absolu");
+    const paths = await this.load();
+    delete paths[ref.id];
+    paths[projectKey(ref)] = resolve(path);
+    await this.persist();
+  }
+  async clear(ref) {
+    const paths = await this.load();
+    const keys = [projectKey(ref), ref.id].filter((k) => k in paths);
+    if (keys.length === 0) return;
+    for (const key of keys) delete paths[key];
+    await this.persist();
+  }
+  /** Test seam: forget what was read from disk. */
+  reset() {
+    this.paths = null;
+  }
+};
+function isPathMap(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+async function holdsRuneyaProject(path) {
+  for (const candidate of ["project.json", "projects.json"]) {
+    try {
+      await stat2(join4(path, ".runeya", candidate));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var projectPathStore = new ProjectPathStore();
+
 // ../server/src/trpc/routers/project.ts
 var projectRouter = router({
   list: protectedProcedure.query(async () => {
     return projectStore.list();
   }),
-  get: protectedProcedure.input(z2.object({ id: z2.string().max(128) })).query(async ({ input }) => {
-    const project = await projectStore.get(input.id);
+  /**
+   * `orgId` names which project — the same id can exist in several
+   * organizations. Left out, the id must answer for exactly one project.
+   */
+  get: protectedProcedure.input(z2.object({ id: z2.string().max(128), orgId: z2.string().max(128).nullable().optional() })).query(async ({ input }) => {
+    const project = await projectStore.get(input);
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
@@ -1474,8 +1612,8 @@ var projectRouter = router({
    * Environments are intentionally excluded — they carry secret values that
    * stay local.
    */
-  export: protectedProcedure.input(z2.object({ id: z2.string().max(128) })).query(async ({ input }) => {
-    const project = await projectStore.get(input.id);
+  export: protectedProcedure.input(z2.object({ id: z2.string().max(128), orgId: z2.string().max(128).nullable().optional() })).query(async ({ input }) => {
+    const project = await projectStore.get(input);
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
@@ -1510,9 +1648,10 @@ var projectRouter = router({
       description: "Default local environment (immutable)",
       parentIds: [],
       immutable: true
-    });
+    }, project.orgId);
     const result = await projectStore.update({
       id: project.id,
+      orgId: project.orgId,
       environmentIds: [localEnv.id],
       activeEnvironmentId: localEnv.id
     });
@@ -1536,22 +1675,27 @@ var projectRouter = router({
     await auditService.log({ userId: "local", action: "update", entityType: "project", entityId: input.id });
     return project;
   }),
-  delete: protectedProcedure.input(z2.object({ id: z2.string().max(128) })).mutation(async ({ input }) => {
-    const deleted = await projectStore.delete(input.id);
+  delete: protectedProcedure.input(z2.object({ id: z2.string().max(128), orgId: z2.string().max(128).nullable().optional() })).mutation(async ({ input }) => {
+    const deleted = await projectStore.delete(input);
     if (!deleted) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.id} not found` });
     }
     await auditService.log({ userId: "local", action: "delete", entityType: "project", entityId: input.id });
     return { success: true };
   }),
-  addService: protectedProcedure.input(z2.object({ projectId: z2.string().max(128), serviceId: z2.string().max(128) })).mutation(async ({ input }) => {
-    const project = await projectStore.addService(input.projectId, input.serviceId);
+  addService: protectedProcedure.input(z2.object({
+    projectId: z2.string().max(128),
+    orgId: z2.string().max(128).nullable().optional(),
+    serviceId: z2.string().max(128)
+  })).mutation(async ({ input }) => {
+    const target = { id: input.projectId, orgId: input.orgId };
+    const project = await projectStore.addService(target, input.serviceId);
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
     const service = await serviceStore.get(input.serviceId);
     if (service) {
-      const globalEnvs = await environmentStore.listByScope(input.projectId, "global");
+      const globalEnvs = await environmentStore.listByScope(input.projectId, "global", input.orgId);
       for (const globalEnv of globalEnvs) {
         const svcEnv = await environmentStore.create({
           projectId: input.projectId,
@@ -1561,8 +1705,8 @@ var projectRouter = router({
           activateOn: globalEnv.id,
           parentIds: [globalEnv.id],
           variables: {}
-        });
-        await projectStore.addEnvironment(input.projectId, svcEnv.id);
+        }, input.orgId);
+        await projectStore.addEnvironment(target, svcEnv.id);
       }
     }
     await auditService.log({
@@ -1574,8 +1718,15 @@ var projectRouter = router({
     });
     return project;
   }),
-  removeService: protectedProcedure.input(z2.object({ projectId: z2.string().max(128), serviceId: z2.string().max(128) })).mutation(async ({ input }) => {
-    const project = await projectStore.removeService(input.projectId, input.serviceId);
+  removeService: protectedProcedure.input(z2.object({
+    projectId: z2.string().max(128),
+    orgId: z2.string().max(128).nullable().optional(),
+    serviceId: z2.string().max(128)
+  })).mutation(async ({ input }) => {
+    const project = await projectStore.removeService(
+      { id: input.projectId, orgId: input.orgId },
+      input.serviceId
+    );
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
@@ -1588,8 +1739,12 @@ var projectRouter = router({
     });
     return project;
   }),
-  setActiveEnvironment: protectedProcedure.input(z2.object({ projectId: z2.string().max(128), environmentId: z2.string().max(128) })).mutation(async ({ input }) => {
-    const project = await projectStore.get(input.projectId);
+  setActiveEnvironment: protectedProcedure.input(z2.object({
+    projectId: z2.string().max(128),
+    orgId: z2.string().max(128).nullable().optional(),
+    environmentId: z2.string().max(128)
+  })).mutation(async ({ input }) => {
+    const project = await projectStore.get({ id: input.projectId, orgId: input.orgId });
     if (!project) {
       throw new TRPCError2({ code: "NOT_FOUND", message: `Project ${input.projectId} not found` });
     }
@@ -1618,7 +1773,10 @@ var projectRouter = router({
       } catch {
       }
     }
-    const updated = await projectStore.setActiveEnvironment(input.projectId, input.environmentId);
+    const updated = await projectStore.setActiveEnvironment(
+      { id: input.projectId, orgId: input.orgId },
+      input.environmentId
+    );
     if (!updated) {
       throw new TRPCError2({ code: "INTERNAL_SERVER_ERROR", message: "Failed to set active environment" });
     }
@@ -1653,6 +1811,53 @@ var projectRouter = router({
       }
     }
     return updated;
+  }),
+  /**
+   * Where this project lives on this machine, for every project at once.
+   *
+   * Machine-local by design: a directory of mine means nothing on a teammate's
+   * machine, and the cloud sync pushes projects wholesale — a path stored on the
+   * project itself would travel with it.
+   */
+  localPaths: protectedProcedure.query(async () => {
+    return projectPathStore.all();
+  }),
+  getLocalPath: protectedProcedure.input(z2.object({
+    id: z2.string().min(1).max(128),
+    orgId: z2.string().max(128).nullable().optional()
+  })).query(async ({ input }) => {
+    return { path: await projectPathStore.get(input) };
+  }),
+  /**
+   * Place a project in a directory of this machine.
+   *
+   * Refuses a directory that already holds a Runeya project, or one another
+   * project was already placed in: two projects sharing a directory is what
+   * makes services run against the wrong code.
+   */
+  setLocalPath: protectedProcedure.input(z2.object({
+    id: z2.string().min(1).max(128),
+    orgId: z2.string().max(128).nullable().optional(),
+    path: z2.string().min(1).max(4096)
+  })).mutation(async ({ input }) => {
+    const project = await projectStore.get(input);
+    if (!project) throw new TRPCError2({ code: "NOT_FOUND", message: "Projet introuvable" });
+    if (await holdsRuneyaProject(input.path)) {
+      throw new TRPCError2({
+        code: "CONFLICT",
+        message: "Ce r\xE9pertoire contient d\xE9j\xE0 un projet Runeya"
+      });
+    }
+    const taken = await projectPathStore.projectAt(input.path, project);
+    if (taken) {
+      throw new TRPCError2({
+        code: "CONFLICT",
+        message: "Un autre projet est d\xE9j\xE0 rattach\xE9 \xE0 ce r\xE9pertoire"
+      });
+    }
+    await projectPathStore.set(project, input.path);
+    await auditService.log("local", "update", "project", input.id, { localPath: input.path });
+    return { path: input.path };
   })
 });
 
@@ -1661,7 +1866,7 @@ import { z as z3 } from "zod";
 import { TRPCError as TRPCError3 } from "@trpc/server";
 
 // ../server/src/services/settings-manager.ts
-import { readFile as readFile5, writeFile as writeFile5, rename as rename5, mkdir as mkdir5, chmod as chmod4 } from "fs/promises";
+import { readFile as readFile6, writeFile as writeFile6, rename as rename6, mkdir as mkdir6, chmod as chmod5 } from "fs/promises";
 var SETTINGS_FILE = "settings.json";
 var SETTINGS_PRIVATE_FILE = "settings.private.json";
 var SCHEMA_VERSION_FILE = "schema-version.json";
@@ -1671,21 +1876,21 @@ var SettingsManager = class {
   settingsPrivate = null;
   schemaVersion = null;
   async ensureDir() {
-    await mkdir5(machineRoot(), { recursive: true });
+    await mkdir6(machineRoot(), { recursive: true });
   }
   async atomicWrite(filename, data) {
     await this.ensureDir();
     const filePath = machineFilePath(filename);
     const tmpPath = filePath + ".tmp";
-    await writeFile5(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-    await rename5(tmpPath, filePath);
-    await chmod4(filePath, 384);
+    await writeFile6(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+    await rename6(tmpPath, filePath);
+    await chmod5(filePath, 384);
   }
   /** Read the machine file, falling back to the launch directory of old. */
   async readJson(filename) {
     for (const path of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
       try {
-        return JSON.parse(await readFile5(path, "utf-8"));
+        return JSON.parse(await readFile6(path, "utf-8"));
       } catch {
       }
     }
@@ -1748,6 +1953,62 @@ var SettingsManager = class {
 };
 var settingsManager = new SettingsManager();
 
+// ../server/src/trpc/routers/service.ts
+import { isAbsolute as isAbsolute3 } from "path";
+
+// ../server/src/services/workspace-cwd.ts
+import { isAbsolute as isAbsolute2, join as join5, dirname as dirname3 } from "path";
+async function projectRoot(ref) {
+  const project = await projectStore.get(ref);
+  if (!project?.orgId) return null;
+  return projectPathStore.get(project);
+}
+async function resolveWorkspaceCwd(target) {
+  const launchDir = localVaultRootParent();
+  if (target.serviceId) {
+    const service = await serviceStore.get(target.serviceId);
+    if (service) {
+      const raw = (target.override ?? service.cwd ?? "").trim();
+      const projects = await projectStore.list();
+      const owner = projects.find((p) => p.serviceIds.includes(service.id));
+      const root = owner ? await projectRoot(owner) : null;
+      return root ? anchor(root, raw) : raw || ".";
+    }
+  }
+  if (target.projectId) {
+    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
+    const raw = (target.override ?? "").trim();
+    return root ? anchor(root, raw) : raw || launchDir;
+  }
+  return anchor(launchDir, (target.override ?? "").trim());
+}
+function anchor(base, raw) {
+  if (!raw || raw === ".") return base;
+  if (raw.startsWith("~") || raw.startsWith("$") || isAbsolute2(raw)) return raw;
+  return join5(base, raw);
+}
+function localVaultRootParent() {
+  return dirname3(localVaultRoot());
+}
+async function resolveAgentCwd(target) {
+  if (target.serviceId) {
+    const service = await serviceStore.get(target.serviceId);
+    if (service) {
+      const projects = await projectStore.list();
+      const owner = projects.find((p) => p.serviceIds.includes(service.id));
+      const root = owner ? await projectRoot(owner) : null;
+      if (!root) return void 0;
+      return anchor(root, (target.override ?? service.cwd ?? "").trim());
+    }
+  }
+  if (target.projectId) {
+    const root = await projectRoot({ id: target.projectId, orgId: target.orgId });
+    if (!root) return void 0;
+    return anchor(root, (target.override ?? "").trim());
+  }
+  return void 0;
+}
+
 // ../server/src/trpc/routers/service.ts
 async function resolveEffectiveAgentId(service) {
   if (service.agentId) return service.agentId;
@@ -1761,6 +2022,10 @@ async function resolveServiceVariables(service) {
   const projects = await projectStore.list();
   const project = projects.find((p) => p.serviceIds.includes(service.id));
   let resolvedService = service;
+  const anchored = await resolveWorkspaceCwd({ serviceId: service.id });
+  if (anchored !== (service.cwd ?? "").trim() && isAbsolute3(anchored)) {
+    resolvedService = { ...resolvedService, resolvedCwd: anchored };
+  }
   try {
     if (service.parserIds && service.parserIds.length > 0) {
       const settings = await settingsManager.getSettings();
@@ -1972,17 +2237,19 @@ var serviceRouter = router({
       throw new TRPCError3({ code: "BAD_REQUEST", message: "No agent configured for this service" });
     }
     const agentResult = await agentManager.agentQuery(effectiveAgentId, "git.checkCwd", {
-      cwd: service.cwd || ".",
+      // Anchored on the project, so the check answers about the directory the
+      // service will actually run in.
+      cwd: await resolveWorkspaceCwd({ serviceId: service.id }),
       remote: service.git?.remote,
       checkReachability: input.checkReachability
     });
-    const { exists, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
+    const { exists: exists2, actualRemote, unreachable, resolvedCwd, unresolvedVars } = agentResult;
     if (unresolvedVars.length > 0) {
       return { exists: false, canClone: false, unresolvedVars, resolvedCwd, gitMismatch: null };
     }
-    const canClone = !!service.git?.remote && (!exists || actualRemote === null);
+    const canClone = !!service.git?.remote && (!exists2 || actualRemote === null);
     let gitMismatch = null;
-    if (exists && service.git?.remote && !canClone) {
+    if (exists2 && service.git?.remote && !canClone) {
       if (actualRemote === null) {
         gitMismatch = { actual: null, configured: service.git.remote };
       } else if (actualRemote !== service.git.remote) {
@@ -1991,7 +2258,7 @@ var serviceRouter = router({
         gitMismatch = { actual: actualRemote, configured: service.git.remote, unreachable: true };
       }
     }
-    return { exists, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
+    return { exists: exists2, canClone, unresolvedVars: [], resolvedCwd, gitMismatch };
   }),
   cloneRepository: protectedProcedure.input(z3.object({ id: z3.string().max(128) })).mutation(async ({ input }) => {
     const service = await serviceStore.get(input.id);
@@ -2007,7 +2274,9 @@ var serviceRouter = router({
     }
     await agentManager.agentMutation(effectiveAgentId, "git.clone", {
       remote: service.git.remote,
-      cwd: service.cwd || "."
+      // Clones WRITE: landing this in the launch directory instead of the
+      // project's is how a repository ends up in the wrong place.
+      cwd: await resolveWorkspaceCwd({ serviceId: service.id })
     }, 5 * 60 * 1e3);
     return { success: true };
   })
@@ -2141,13 +2410,13 @@ var agentRouter = router({
       yield { agentId: agent.config.id, status: agent.status };
     }
     const queue = [];
-    let resolve6 = null;
+    let resolve7 = null;
     const handler = (event) => {
       if (queue.length >= SUBSCRIPTION_QUEUE_MAX) queue.shift();
       queue.push(event);
-      if (resolve6) {
-        resolve6();
-        resolve6 = null;
+      if (resolve7) {
+        resolve7();
+        resolve7 = null;
       }
     };
     agentManager.on("status", handler);
@@ -2157,7 +2426,7 @@ var agentRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve6 = r;
+            resolve7 = r;
           });
         }
       }
@@ -2173,14 +2442,14 @@ import { TRPCError as TRPCError5 } from "@trpc/server";
 var SUBSCRIPTION_QUEUE_MAX2 = LOG_BUFFER_SIZE;
 async function* forwardEvents(eventName, filter) {
   const queue = [];
-  let resolve6 = null;
+  let resolve7 = null;
   const handler = (data) => {
     if (filter && !filter(data)) return;
     if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
     queue.push(data);
-    if (resolve6) {
-      resolve6();
-      resolve6 = null;
+    if (resolve7) {
+      resolve7();
+      resolve7 = null;
     }
   };
   agentManager.on(eventName, handler);
@@ -2190,7 +2459,7 @@ async function* forwardEvents(eventName, filter) {
         yield queue.shift();
       } else {
         await new Promise((r) => {
-          resolve6 = r;
+          resolve7 = r;
         });
       }
     }
@@ -2200,7 +2469,7 @@ async function* forwardEvents(eventName, filter) {
 }
 async function* forwardLogBatches(agentId, processId) {
   const queue = [];
-  let resolve6 = null;
+  let resolve7 = null;
   const handler = (data) => {
     if (data.agentId !== agentId) return;
     const batch = data.batch;
@@ -2209,9 +2478,9 @@ async function* forwardLogBatches(agentId, processId) {
     if (filtered.length === 0) return;
     if (queue.length >= SUBSCRIPTION_QUEUE_MAX2) queue.shift();
     queue.push(filtered);
-    if (resolve6) {
-      resolve6();
-      resolve6 = null;
+    if (resolve7) {
+      resolve7();
+      resolve7 = null;
     }
   };
   agentManager.on("process:log", handler);
@@ -2221,7 +2490,7 @@ async function* forwardLogBatches(agentId, processId) {
         yield queue.shift();
       } else {
         await new Promise((r) => {
-          resolve6 = r;
+          resolve7 = r;
         });
       }
     }
@@ -2402,7 +2671,14 @@ var processRouter = router({
     const result = await agentManager.agentMutation(
       input.agentId,
       "process.executeAdHocCommand",
-      { id: input.processId, command: input.command, cwd: input.cwd, commandId: input.commandId },
+      {
+        id: input.processId,
+        command: input.command,
+        // An explicit cwd wins; otherwise the service's directory, anchored on
+        // its project rather than on the server's launch directory.
+        cwd: input.cwd ?? await resolveAgentCwd({ serviceId: input.processId }),
+        commandId: input.commandId
+      },
       AGENT_LONG_FETCH_TIMEOUT
     );
     await auditService.log({
@@ -2579,25 +2855,36 @@ var setupRouter = router({
 import { z as z8 } from "zod";
 import { TRPCError as TRPCError6 } from "@trpc/server";
 var environmentRouter = router({
-  list: protectedProcedure.input(z8.object({ projectId: z8.string().max(128) })).query(async ({ input }) => {
-    return await environmentStore.list(input.projectId);
+  list: protectedProcedure.input(z8.object({
+    projectId: z8.string().max(128),
+    orgId: z8.string().max(128).nullable().optional()
+  })).query(async ({ input }) => {
+    return await environmentStore.list(input.projectId, input.orgId);
   }),
   get: protectedProcedure.input(z8.object({ id: z8.string().max(128) })).query(async ({ input }) => {
     const env2 = await environmentStore.get(input.id);
     if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     return env2;
   }),
-  listByScope: protectedProcedure.input(z8.object({ projectId: z8.string().max(128), scope: z8.enum(["global", "service"]) })).query(async ({ input }) => {
-    return await environmentStore.listByScope(input.projectId, input.scope);
+  listByScope: protectedProcedure.input(z8.object({
+    projectId: z8.string().max(128),
+    orgId: z8.string().max(128).nullable().optional(),
+    scope: z8.enum(["global", "service"])
+  })).query(async ({ input }) => {
+    return await environmentStore.listByScope(input.projectId, input.scope, input.orgId);
   }),
   findServiceEnvironment: protectedProcedure.input(z8.object({ serviceId: z8.string().max(128), globalEnvId: z8.string().max(128) })).query(async ({ input }) => {
     return await environmentStore.findServiceEnvironment(input.serviceId, input.globalEnvId);
   }),
-  create: protectedProcedure.input(CreateEnvironmentSchema).mutation(async ({ input }) => {
-    const env2 = await environmentStore.create(input);
-    const project = await projectStore.get(input.projectId);
+  create: protectedProcedure.input(CreateEnvironmentSchema.extend({
+    orgId: z8.string().max(128).nullable().optional()
+  })).mutation(async ({ input }) => {
+    const { orgId, ...environment } = input;
+    const target = { id: input.projectId, orgId };
+    const env2 = await environmentStore.create(environment, orgId);
+    const project = await projectStore.get(target);
     if (project && !project.environmentIds?.includes(env2.id)) {
-      await projectStore.addEnvironment(input.projectId, env2.id);
+      await projectStore.addEnvironment(target, env2.id);
     }
     if (env2.scope === "global" && project) {
       for (const serviceId of project.serviceIds) {
@@ -2618,8 +2905,8 @@ var environmentRouter = router({
           activateOn: env2.id,
           parentIds: [env2.id, ...parentServiceEnvIds],
           variables: {}
-        });
-        await projectStore.addEnvironment(input.projectId, svcEnv.id);
+        }, orgId);
+        await projectStore.addEnvironment(target, svcEnv.id);
       }
     }
     return env2;
@@ -2630,7 +2917,7 @@ var environmentRouter = router({
     const env2 = await environmentStore.update(input);
     if (!env2) throw new TRPCError6({ code: "NOT_FOUND", message: `Environment ${input.id} not found` });
     if (env2.scope === "global" && input.name && input.name !== existing.name) {
-      const project = await projectStore.get(env2.projectId);
+      const project = await projectStore.get(environmentStore.projectRefOf(env2) ?? env2.projectId);
       if (project) {
         const serviceNames = /* @__PURE__ */ new Map();
         for (const serviceId of project.serviceIds) {
@@ -2653,7 +2940,7 @@ var environmentRouter = router({
     }
     const deleted = await environmentStore.delete(input.id);
     if (!deleted) throw new TRPCError6({ code: "INTERNAL_SERVER_ERROR", message: "Failed to delete environment" });
-    await projectStore.removeEnvironment(env2.projectId, input.id);
+    await projectStore.removeEnvironment(environmentStore.projectRefOf(env2) ?? env2.projectId, input.id);
     return { success: true };
   }),
   resolve: protectedProcedure.input(z8.object({ environmentId: z8.string().max(128) })).query(async ({ input, ctx }) => {
@@ -2728,11 +3015,12 @@ var environmentRouter = router({
    */
   keyUsages: protectedProcedure.input(z8.object({
     projectId: z8.string().max(128),
+    orgId: z8.string().max(128).nullable().optional(),
     key: z8.string().min(1).max(256),
     /** Environment holding the variable about to be edited — enables inherited-impact detection */
     environmentId: z8.string().max(128).optional()
   })).query(async ({ input }) => {
-    const environments = await environmentStore.list(input.projectId);
+    const environments = await environmentStore.list(input.projectId, input.orgId);
     const services = await serviceStore.list();
     const serviceName = (id) => services.find((s) => s.id === id)?.name;
     const escaped = input.key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -2801,7 +3089,6 @@ var environmentRouter = router({
 
 // ../server/src/trpc/routers/settings.ts
 import { promises as dns } from "dns";
-import { resolve } from "path";
 import { z as z9 } from "zod";
 import { TRPCError as TRPCError7 } from "@trpc/server";
 var NotificationPreferencesPatchSchema = NotificationPreferencesSchema.partial().strict();
@@ -2821,9 +3108,12 @@ var settingsRouter = router({
    * Paths the server is running from (working directory + data directory).
    * Read-only, purely informational for the settings UI.
    */
-  getPaths: protectedProcedure.query(() => ({
-    cwd: process.cwd(),
-    dataDir: resolve(env.DATA_DIR),
+  getPaths: protectedProcedure.query(async () => ({
+    // The launch directory, not the process's current one — they are the same
+    // today only because nothing calls chdir, which is exactly what must not be
+    // relied on.
+    cwd: await resolveWorkspaceCwd({}),
+    dataDir: env.DATA_DIR,
     // Where cloud projects live: their vaults belong to the machine, not to
     // whichever directory the server happened to be started in.
     machineDir: machineRoot()
@@ -3187,7 +3477,7 @@ var settingsRouter = router({
         }
       } catch {
       }
-      await new Promise((resolve6) => setTimeout(resolve6, 500));
+      await new Promise((resolve7) => setTimeout(resolve7, 500));
     }
   }),
   /**
@@ -3373,16 +3663,16 @@ var settingsRouter = router({
 import { z as z11 } from "zod";
 import { TRPCError as TRPCError8 } from "@trpc/server";
 import { execFile as execFile2, spawn } from "child_process";
-import { stat as stat2 } from "fs/promises";
-import { resolve as resolve2, join as join5 } from "path";
+import { stat as stat3 } from "fs/promises";
+import { resolve as resolve2, join as join7 } from "path";
 import { homedir as homedir2 } from "os";
 
 // ../server/src/services/user-config-manager.ts
-import { readFile as readFile6, writeFile as writeFile6, rename as rename6, mkdir as mkdir6, chmod as chmod5 } from "fs/promises";
-import { join as join4 } from "path";
+import { readFile as readFile7, writeFile as writeFile7, rename as rename7, mkdir as mkdir7, chmod as chmod6 } from "fs/promises";
+import { join as join6 } from "path";
 import { homedir } from "os";
 import { z as z10 } from "zod";
-var CONFIG_DIR = join4(homedir(), ".runeya");
+var CONFIG_DIR = join6(homedir(), ".runeya");
 var CONFIG_FILE = "runeya.conf";
 var EditorPreferencesSchema = z10.object({
   default: z10.string().max(64).optional()
@@ -3396,23 +3686,26 @@ var UserConfigSchema = z10.record(
   z10.string().max(128),
   ProjectSettingsSchema
 ).refine((obj) => Object.keys(obj).length <= 100, "Too many projects in config");
+function configKey(ref) {
+  return projectKey(ref);
+}
 var UserConfigManager = class {
   config = null;
   async ensureDir() {
-    await mkdir6(CONFIG_DIR, { recursive: true });
+    await mkdir7(CONFIG_DIR, { recursive: true });
   }
   async atomicWrite(data) {
     await this.ensureDir();
-    const filePath = join4(CONFIG_DIR, CONFIG_FILE);
+    const filePath = join6(CONFIG_DIR, CONFIG_FILE);
     const tmpPath = filePath + ".tmp";
-    await writeFile6(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-    await rename6(tmpPath, filePath);
-    await chmod5(filePath, 384);
+    await writeFile7(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+    await rename7(tmpPath, filePath);
+    await chmod6(filePath, 384);
   }
   async getConfig() {
     if (!this.config) {
       try {
-        const raw = await readFile6(join4(CONFIG_DIR, CONFIG_FILE), "utf-8");
+        const raw = await readFile7(join6(CONFIG_DIR, CONFIG_FILE), "utf-8");
         const parsed = UserConfigSchema.safeParse(JSON.parse(raw));
         this.config = parsed.success ? parsed.data : {};
       } catch {
@@ -3425,21 +3718,22 @@ var UserConfigManager = class {
     this.config = config;
     await this.atomicWrite(config);
   }
-  async getEditorPreferences(projectId) {
+  async getEditorPreferences(ref) {
     const config = await this.getConfig();
-    return config[projectId]?.settings?.editors ?? {};
+    return config[configKey(ref)]?.settings?.editors ?? config[ref.id]?.settings?.editors ?? {};
   }
-  async setEditorPreference(projectId, target, editorKey) {
+  async setEditorPreference(ref, target, editorKey) {
     const config = await this.getConfig();
-    if (!config[projectId]) config[projectId] = {};
-    if (!config[projectId].settings) config[projectId].settings = {};
-    if (!config[projectId].settings.editors) config[projectId].settings.editors = {};
-    config[projectId].settings.editors[target] = editorKey;
+    const key = configKey(ref);
+    if (!config[key]) config[key] = { settings: config[ref.id]?.settings };
+    if (!config[key].settings) config[key].settings = {};
+    if (!config[key].settings.editors) config[key].settings.editors = {};
+    config[key].settings.editors[target] = editorKey;
     await this.saveConfig(config);
   }
-  async removeEditorPreference(projectId, target) {
+  async removeEditorPreference(ref, target) {
     const config = await this.getConfig();
-    const editors = config[projectId]?.settings?.editors;
+    const editors = config[configKey(ref)]?.settings?.editors;
     if (editors && target in editors) {
       delete editors[target];
       await this.saveConfig(config);
@@ -3462,13 +3756,12 @@ async function getServiceCwd(serviceId) {
   if (!service) {
     throw new TRPCError8({ code: "NOT_FOUND", message: "Service not found" });
   }
-  const rawCwd = service.cwd?.trim() || ".";
-  return resolveCwd(rawCwd);
+  return resolveCwd(await resolveWorkspaceCwd({ serviceId }));
 }
 async function isCommandAvailable(command) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     execFile2("which", [command], { timeout: 5e3 }, (err) => {
-      resolve6(!err);
+      resolve7(!err);
     });
   });
 }
@@ -3482,35 +3775,52 @@ var editorRouter = router({
     );
     return results;
   }),
-  getPreferences: protectedProcedure.input(z11.object({ projectId: z11.string().max(128) })).query(async ({ input }) => {
-    return userConfigManager.getEditorPreferences(input.projectId);
+  getPreferences: protectedProcedure.input(z11.object({
+    projectId: z11.string().max(128),
+    orgId: z11.string().max(128).nullable().optional()
+  })).query(async ({ input }) => {
+    return userConfigManager.getEditorPreferences({ id: input.projectId, orgId: input.orgId });
   }),
   setDefault: protectedProcedure.input(z11.object({
     projectId: z11.string().max(128),
+    orgId: z11.string().max(128).nullable().optional(),
     editorKey: z11.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
-    await userConfigManager.setEditorPreference(input.projectId, "default", input.editorKey);
+    await userConfigManager.setEditorPreference(
+      { id: input.projectId, orgId: input.orgId },
+      "default",
+      input.editorKey
+    );
     return { success: true };
   }),
   setServiceEditor: protectedProcedure.input(z11.object({
     projectId: z11.string().max(128),
+    orgId: z11.string().max(128).nullable().optional(),
     serviceId: z11.string().max(128),
     editorKey: z11.string().max(64)
   })).mutation(async ({ input }) => {
     if (!EDITOR_BY_KEY.has(input.editorKey)) {
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
-    await userConfigManager.setEditorPreference(input.projectId, input.serviceId, input.editorKey);
+    await userConfigManager.setEditorPreference(
+      { id: input.projectId, orgId: input.orgId },
+      input.serviceId,
+      input.editorKey
+    );
     return { success: true };
   }),
   removeServiceEditor: protectedProcedure.input(z11.object({
     projectId: z11.string().max(128),
+    orgId: z11.string().max(128).nullable().optional(),
     serviceId: z11.string().max(128)
   })).mutation(async ({ input }) => {
-    await userConfigManager.removeEditorPreference(input.projectId, input.serviceId);
+    await userConfigManager.removeEditorPreference(
+      { id: input.projectId, orgId: input.orgId },
+      input.serviceId
+    );
     return { success: true };
   }),
   open: protectedProcedure.input(z11.object({
@@ -3524,7 +3834,7 @@ var editorRouter = router({
     const expanded = input.path.replace(/^~(\/|$)/, `${process.env["HOME"] ?? "/tmp"}$1`).replace(/\$\{(\w+)\}|\$(\w+)/g, (_, a, b) => process.env[a || b] ?? "");
     const resolvedPath = resolve2(expanded || ".");
     try {
-      await stat2(resolvedPath);
+      await stat3(resolvedPath);
     } catch (err) {
       if (err instanceof TRPCError8) throw err;
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Path does not exist: ${resolvedPath}` });
@@ -3548,12 +3858,12 @@ var editorRouter = router({
       throw new TRPCError8({ code: "BAD_REQUEST", message: `Unknown editor: ${input.editorKey}` });
     }
     const cwd = await getServiceCwd(input.serviceId);
-    const filePath = join5(cwd, input.relativePath);
+    const filePath = join7(cwd, input.relativePath);
     if (!filePath.startsWith(cwd)) {
       throw new TRPCError8({ code: "BAD_REQUEST", message: "Path traversal not allowed" });
     }
     try {
-      await stat2(filePath);
+      await stat3(filePath);
     } catch {
       throw new TRPCError8({ code: "BAD_REQUEST", message: `File does not exist: ${filePath}` });
     }
@@ -3571,8 +3881,8 @@ var editorRouter = router({
 // ../server/src/trpc/routers/api-keys.ts
 import { z as z12 } from "zod";
 import { TRPCError as TRPCError9 } from "@trpc/server";
-import { mkdir as mkdir7, writeFile as writeFile7 } from "fs/promises";
-import { join as join6, dirname as dirname3 } from "path";
+import { mkdir as mkdir8, writeFile as writeFile8 } from "fs/promises";
+import { join as join8, dirname as dirname4 } from "path";
 var ALLOWED_SKILL_PATHS = /* @__PURE__ */ new Set([
   ".claude/skills/runeya/SKILL.md",
   ".cursor/rules/runeya.mdc",
@@ -3619,9 +3929,9 @@ var apiKeysRouter = router({
     if (!ALLOWED_SKILL_PATHS.has(input.relativePath)) {
       throw new TRPCError9({ code: "BAD_REQUEST", message: "Chemin non autoris\xE9" });
     }
-    const abs = join6(process.cwd(), input.relativePath);
-    await mkdir7(dirname3(abs), { recursive: true });
-    await writeFile7(abs, input.content, { encoding: "utf-8", mode: 420 });
+    const abs = join8(await resolveWorkspaceCwd({}), input.relativePath);
+    await mkdir8(dirname4(abs), { recursive: true });
+    await writeFile8(abs, input.content, { encoding: "utf-8", mode: 420 });
     return { path: input.relativePath };
   })
 });
@@ -3947,17 +4257,17 @@ function buildApiDocs(apiBaseUrl, apiToken) {
 }
 
 // ../server/src/services/claude-transcript-sync.ts
-import { readdir as readdir2, access, readFile as readFile8 } from "fs/promises";
+import { readdir as readdir2, access, readFile as readFile9 } from "fs/promises";
 import { watch } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 
 // ../server/src/services/conversation-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { readFile as readFile7, writeFile as writeFile8, rename as rename7, mkdir as mkdir8, chmod as chmod6 } from "fs/promises";
-import { dirname as dirname4, join as join7 } from "path";
+import { readFile as readFile8, writeFile as writeFile9, rename as rename8, mkdir as mkdir9, chmod as chmod7 } from "fs/promises";
+import { dirname as dirname5, join as join9 } from "path";
 import { EventEmitter as EventEmitter2 } from "events";
-var FILENAME3 = "conversations.private.json";
+var FILENAME4 = "conversations.private.json";
 async function localProjectId() {
   const projects = await projectStore.list().catch(() => []);
   return projects.find((p) => !p.orgId)?.id ?? null;
@@ -3977,11 +4287,11 @@ var ConversationStore = class {
    * root, but a launch directory owning its own key keeps both together.
    */
   getFilePath() {
-    return keyedFilePath(FILENAME3);
+    return keyedFilePath(FILENAME4);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME3);
+    return legacyMachineFilePath(FILENAME4);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -3991,13 +4301,13 @@ var ConversationStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile7(await this.getFilePath(), "utf-8");
+      return await readFile8(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile7(this.getLegacyFilePath(), "utf-8");
+      return readFile8(this.getLegacyFilePath(), "utf-8");
     }
   }
   async ensureDir() {
-    await mkdir8(dirname4(await this.getFilePath()), { recursive: true });
+    await mkdir9(dirname5(await this.getFilePath()), { recursive: true });
   }
   encryptMessages(messages) {
     return encryptValue(JSON.stringify(messages));
@@ -4061,16 +4371,17 @@ var ConversationStore = class {
       return;
     }
     this.loaded = true;
+    await ensureProjectsLoaded();
     const vaults = await allVaultRoots();
-    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME3)];
+    const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME4)];
     const sources = [
       ...legacyPaths.map((path) => ({ path, legacy: true })),
-      ...vaults.map((root) => ({ path: join7(root, FILENAME3), legacy: false }))
+      ...vaults.map((root) => ({ path: join9(root, FILENAME4), legacy: false }))
     ];
     for (const { path, legacy } of sources) {
       let data;
       try {
-        data = JSON.parse(await readFile7(path, "utf-8"));
+        data = JSON.parse(await readFile8(path, "utf-8"));
       } catch {
         continue;
       }
@@ -4080,7 +4391,7 @@ var ConversationStore = class {
           const conv = this.fromDisk(item);
           if (!conv.projectId && inherited) conv.projectId = inherited;
           this.conversations.set(item.id, conv);
-          this.roots.set(item.id, dirname4(path));
+          this.roots.set(item.id, dirname5(path));
         } catch {
         }
       }
@@ -4105,12 +4416,12 @@ var ConversationStore = class {
       byRoot.set(root, bucket);
     }
     for (const [root, data] of byRoot) {
-      await mkdir8(root, { recursive: true });
-      const filePath = join7(root, FILENAME3);
+      await mkdir9(root, { recursive: true });
+      const filePath = join9(root, FILENAME4);
       const tmpPath = `${filePath}.tmp`;
-      await writeFile8(tmpPath, JSON.stringify(data, null, 2), "utf-8");
-      await rename7(tmpPath, filePath);
-      await chmod6(filePath, 384);
+      await writeFile9(tmpPath, JSON.stringify(data, null, 2), "utf-8");
+      await rename8(tmpPath, filePath);
+      await chmod7(filePath, 384);
     }
   }
   /**
@@ -4120,8 +4431,22 @@ var ConversationStore = class {
    * key's own directory — never lost for want of an owner.
    */
   async rootFor(conv) {
-    if (conv.projectId) return rootOfProject(conv.projectId);
-    return this.roots.get(conv.id) ?? dirname4(await keyedFilePath(FILENAME3));
+    const known = this.roots.get(conv.id) ?? null;
+    if (conv.projectId) return rootOfProjectAmong(conv.projectId, known);
+    return known ?? dirname5(await keyedFilePath(FILENAME4));
+  }
+  /**
+   * Le projet d'une conversation, organisation comprise.
+   *
+   * Ce que la conversation ne dit pas d'elle-même : elle ne nomme que l'id.
+   * Le coffre d'où elle vient fournit l'organisation, et c'est ce couple qu'il
+   * faut pour retrouver le répertoire de travail du projet.
+   */
+  async projectRefOf(conv) {
+    if (!conv.projectId) return null;
+    const known = this.roots.get(conv.id) ?? null;
+    const ref = refOfProjectAmong(conv.projectId, known);
+    return { id: ref.id, orgId: ref.orgId ?? null };
   }
   async save() {
     const write = this.saveQueue.then(() => this.saveInternal());
@@ -4137,7 +4462,7 @@ var ConversationStore = class {
     await this.load();
     return this.conversations.get(id) ?? null;
   }
-  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId, projectId) {
+  async create(title, isCli = false, workflowId, workflowType, runner, kanbanBoardId, kanbanCardId, providerId, projectId, orgId) {
     await this.load();
     const now = Date.now();
     const conv = {
@@ -4156,6 +4481,9 @@ var ConversationStore = class {
       updatedAt: now
     };
     this.conversations.set(conv.id, conv);
+    if (projectId && orgId !== void 0) {
+      this.roots.set(conv.id, vaultFor({ id: projectId, orgId }).root);
+    }
     await this.save();
     this.events.emit("changed", { type: "created", conversation: this.snapshotConversation(conv) });
     return conv;
@@ -4218,7 +4546,7 @@ var ConversationStore = class {
 var conversationStore = new ConversationStore();
 
 // ../server/src/services/claude-transcript-sync.ts
-var PROJECTS_DIR = join8(homedir3(), ".claude", "projects");
+var PROJECTS_DIR = join10(homedir3(), ".claude", "projects");
 var DEFAULT_TITLES = /* @__PURE__ */ new Set(["", "New conversation", "Nouvelle conversation"]);
 async function findClaudeSessionFile(sessionId) {
   let entries;
@@ -4229,7 +4557,7 @@ async function findClaudeSessionFile(sessionId) {
   }
   const filename = `${sessionId}.jsonl`;
   for (const dir of entries) {
-    const candidate = join8(PROJECTS_DIR, dir, filename);
+    const candidate = join10(PROJECTS_DIR, dir, filename);
     try {
       await access(candidate);
       return candidate;
@@ -4244,7 +4572,7 @@ async function claudeSessionExists(sessionId) {
 async function readClaudeTranscript(sessionId) {
   const path = await findClaudeSessionFile(sessionId);
   if (!path) return { found: false, path: null, entries: [] };
-  const raw = await readFile8(path, "utf-8");
+  const raw = await readFile9(path, "utf-8");
   const entries = [];
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
@@ -4392,7 +4720,7 @@ async function startClaudeTranscriptWatcher() {
   }
   for (const dir of topLevel) {
     try {
-      const w = watch(join8(PROJECTS_DIR, dir), (_event, filename) => {
+      const w = watch(join10(PROJECTS_DIR, dir), (_event, filename) => {
         handleFsEvent(filename ? filename.toString() : null);
       });
       w.on("error", () => {
@@ -4418,8 +4746,8 @@ function stopClaudeTranscriptWatcher() {
 // ../server/src/services/codex-sessions.ts
 import { readdir as readdir3 } from "fs/promises";
 import { homedir as homedir4 } from "os";
-import { join as join9 } from "path";
-var SESSIONS_DIR = join9(homedir4(), ".codex", "sessions");
+import { join as join11 } from "path";
+var SESSIONS_DIR = join11(homedir4(), ".codex", "sessions");
 async function findCodexSessionFile(sessionId) {
   const suffix = `-${sessionId}.jsonl`;
   async function walk(dir) {
@@ -4430,7 +4758,7 @@ async function findCodexSessionFile(sessionId) {
       return null;
     }
     for (const entry of entries) {
-      const full = join9(dir, entry.name);
+      const full = join11(dir, entry.name);
       if (entry.isDirectory()) {
         const found = await walk(full);
         if (found) return found;
@@ -4805,7 +5133,7 @@ function parse(text) {
   return result;
 }
 function getClaudeUsage() {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     const env2 = { ...process.env };
     delete env2["CLAUDECODE"];
     let claudeBin = "claude";
@@ -4836,7 +5164,7 @@ function getClaudeUsage() {
       clearTimeout(hardTimeout);
       term?.kill();
       const clean = buffer.replaceAll(/\x1b\[[0-9;]*X/g, "\n").replaceAll(/\x1b\[[0-9;]*[mGKHFABCDJsu]/g, "").replaceAll(/\x1b[^a-zA-Z]*[a-zA-Z]/g, "").replaceAll("\r", "");
-      resolve6(parse(clean));
+      resolve7(parse(clean));
     }
     const hardTimeout = setTimeout(() => {
       if (!done) finish();
@@ -4970,7 +5298,7 @@ function parseCodexStatusText(text) {
   return entries;
 }
 function getCodexUsageEntries() {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let term = null;
     try {
       term = pty2.spawn("codex", [], {
@@ -5000,7 +5328,7 @@ function getCodexUsageEntries() {
         const debugClean = stripAnsi(buffer).slice(-6e3);
         process.stdout.write("[codex-usage] raw tail:\n" + debugClean + "\n");
       }
-      resolve6(parseCodexStatusText(buffer));
+      resolve7(parseCodexStatusText(buffer));
     };
     const hardTimeout = setTimeout(() => {
       finish();
@@ -5390,12 +5718,12 @@ var ScenarioStore = class {
 var scenarioStore = new ScenarioStore();
 
 // ../server/src/services/scenario-run-store.ts
-import { mkdir as mkdir10, rm as rm2, readFile as readFile10 } from "fs/promises";
-import { join as join10 } from "path";
+import { mkdir as mkdir11, rm as rm2, readFile as readFile11 } from "fs/promises";
+import { join as join12 } from "path";
 
 // ../server/src/services/run-store-utils.ts
-import { chmod as chmod7, mkdir as mkdir9, rename as rename8, writeFile as writeFile9, readFile as readFile9 } from "fs/promises";
-import { dirname as dirname5, resolve as resolve3, sep } from "path";
+import { chmod as chmod8, mkdir as mkdir10, rename as rename9, writeFile as writeFile10, readFile as readFile10 } from "fs/promises";
+import { dirname as dirname6, resolve as resolve3, sep } from "path";
 var SAFE_PATH_SEGMENT_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
 function resolveConversationRunDir(rootDirName, conversationId) {
   if (!SAFE_PATH_SEGMENT_RE.test(conversationId)) {
@@ -5409,18 +5737,18 @@ function resolveConversationRunDir(rootDirName, conversationId) {
   return dir;
 }
 async function atomicWriteSecure(filePath, content) {
-  await mkdir9(dirname5(filePath), { recursive: true });
+  await mkdir10(dirname6(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  await writeFile9(tmpPath, content, "utf-8");
-  await rename8(tmpPath, filePath);
-  await chmod7(filePath, 384);
+  await writeFile10(tmpPath, content, "utf-8");
+  await rename9(tmpPath, filePath);
+  await chmod8(filePath, 384);
 }
 async function atomicWriteJsonSecure(filePath, data, pretty = false) {
   await atomicWriteSecure(filePath, JSON.stringify(data, null, pretty ? 2 : 0));
 }
 async function readJsonFileSafe(filePath) {
   try {
-    const raw = await readFile9(filePath, "utf-8");
+    const raw = await readFile10(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -5443,7 +5771,7 @@ var ScenarioRunStore = class _ScenarioRunStore {
   }
   async initializeConversationWorkspace(conversationId, scenario, userInput) {
     const dir = this.getRunDir(conversationId);
-    await mkdir10(dir, { recursive: true });
+    await mkdir11(dir, { recursive: true });
     await this.saveScenarioSnapshot(conversationId, scenario);
     const nodesById = new Map(scenario.nodes.map((p) => [p.id, p]));
     const teamMap = new Map(scenario.groups.map((t2) => [t2.id, t2.name]));
@@ -5468,8 +5796,8 @@ var ScenarioRunStore = class _ScenarioRunStore {
       "- Use read-only references from linked upstream files as context.",
       ""
     ].join("\n");
-    await atomicWriteSecure(join10(dir, "README.md"), overview);
-    await atomicWriteSecure(join10(dir, "USER_REQUEST.md"), `# User request
+    await atomicWriteSecure(join12(dir, "README.md"), overview);
+    await atomicWriteSecure(join12(dir, "USER_REQUEST.md"), `# User request
 
 ${userInput.trim() || "(empty)"}
 `);
@@ -5495,7 +5823,7 @@ ${userInput.trim() || "(empty)"}
         "- Waiting for assignment.",
         ""
       ].join("\n");
-      await atomicWriteSecure(join10(dir, fileName), content);
+      await atomicWriteSecure(join12(dir, fileName), content);
     }
   }
   async deleteRunDir(conversationId) {
@@ -5555,7 +5883,7 @@ ${userInput.trim() || "(empty)"}
     if (!runState) return;
     try {
       const dir = this.getRunDir(conversationId);
-      await mkdir10(dir, { recursive: true });
+      await mkdir11(dir, { recursive: true });
       const data = {
         nodeStates: { ...runState.nodeStates },
         nodeOutputs: { ...runState.nodeOutputs },
@@ -5563,18 +5891,18 @@ ${userInput.trim() || "(empty)"}
         ...Object.keys(runState.nodeAgentIds).length > 0 ? { nodeAgentIds: { ...runState.nodeAgentIds } } : {},
         ...Object.keys(runState.waitingInputs).length > 0 ? { waitingInputs: { ...runState.waitingInputs } } : {}
       };
-      await atomicWriteJsonSecure(join10(dir, "run-state.json"), data);
+      await atomicWriteJsonSecure(join12(dir, "run-state.json"), data);
     } catch {
     }
   }
   async loadPersistedRunState(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join10(dir, "run-state.json"));
+    return readJsonFileSafe(join12(dir, "run-state.json"));
   }
   async readUserRequest(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      const content = await readFile10(join10(dir, "USER_REQUEST.md"), "utf-8");
+      const content = await readFile11(join12(dir, "USER_REQUEST.md"), "utf-8");
       return content.replace(/^#\s*User request\s*\n+/, "").trim() || null;
     } catch {
       return null;
@@ -5583,23 +5911,23 @@ ${userInput.trim() || "(empty)"}
   async readReadme(conversationId) {
     try {
       const dir = this.getRunDir(conversationId);
-      return await readFile10(join10(dir, "README.md"), "utf-8");
+      return await readFile11(join12(dir, "README.md"), "utf-8");
     } catch {
       return null;
     }
   }
   async saveScenarioSnapshot(conversationId, scenario) {
     const dir = this.getRunDir(conversationId);
-    await mkdir10(dir, { recursive: true });
+    await mkdir11(dir, { recursive: true });
     await atomicWriteJsonSecure(
-      join10(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
+      join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE),
       scenario,
       true
     );
   }
   async loadScenarioSnapshot(conversationId) {
     const dir = this.getRunDir(conversationId);
-    return readJsonFileSafe(join10(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
+    return readJsonFileSafe(join12(dir, _ScenarioRunStore.SCENARIO_SNAPSHOT_FILE));
   }
 };
 var scenarioRunStore = new ScenarioRunStore();
@@ -5645,9 +5973,9 @@ async function fetchProviderModels(provider, plaintextKey) {
 
 // ../server/src/services/image-storage.service.ts
 import { randomUUID as randomUUID4 } from "crypto";
-import { mkdir as mkdir11, writeFile as writeFile10, readFile as readFile11, unlink as unlink2, readdir as readdir4 } from "fs/promises";
+import { mkdir as mkdir12, writeFile as writeFile11, readFile as readFile12, unlink as unlink2, readdir as readdir4 } from "fs/promises";
 import { existsSync } from "fs";
-import { join as join11, extname, resolve as resolve4, sep as sep2 } from "path";
+import { join as join13, extname, resolve as resolve4, sep as sep2 } from "path";
 var ALLOWED_MIME_TYPES = /* @__PURE__ */ new Set([
   "image/png",
   "image/jpeg",
@@ -5664,7 +5992,7 @@ var ImageStorageService = class {
     this.dir = dir;
   }
   async ensureTmpDir() {
-    await mkdir11(this.dir, { recursive: true, mode: 448 });
+    await mkdir12(this.dir, { recursive: true, mode: 448 });
   }
   async saveImage(buffer, originalName, mimeType, contextId) {
     if (!ALLOWED_MIME_TYPES.has(mimeType)) {
@@ -5684,15 +6012,15 @@ var ImageStorageService = class {
     const imageId = randomUUID4();
     const safeExt = ext.replace(/[^a-z.]/g, "");
     const fileName = `${imageId}${safeExt}`;
-    const filePath = join11(this.dir, fileName);
+    const filePath = join13(this.dir, fileName);
     const resolvedPath = resolve4(filePath);
     const resolvedDir = resolve4(this.dir);
     if (resolvedPath !== resolvedDir && !resolvedPath.startsWith(resolvedDir + sep2)) {
       throw new Error("Invalid file path");
     }
-    await writeFile10(filePath, buffer, { mode: 384 });
+    await writeFile11(filePath, buffer, { mode: 384 });
     const meta = { imageId, filePath, mimeType, originalName, createdAt: Date.now(), contextId };
-    await writeFile10(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
+    await writeFile11(`${filePath}.meta.json`, JSON.stringify(meta), { encoding: "utf-8", mode: 384 });
     return meta;
   }
   /**
@@ -5710,7 +6038,7 @@ var ImageStorageService = class {
       const files = await readdir4(this.dir);
       const metaFile = files.find((f) => f.startsWith(imageId) && f.endsWith(".meta.json"));
       if (!metaFile) return null;
-      const raw = JSON.parse(await readFile11(join11(this.dir, metaFile), "utf-8"));
+      const raw = JSON.parse(await readFile12(join13(this.dir, metaFile), "utf-8"));
       if (expectedContextId !== void 0 && raw.contextId !== expectedContextId) return null;
       if (!existsSync(raw.filePath)) return null;
       return { filePath: raw.filePath, mimeType: raw.mimeType, contextId: raw.contextId };
@@ -5736,7 +6064,7 @@ var ImageStorageService = class {
     await Promise.all(
       files.filter((f) => f.endsWith(".meta.json")).map(async (file) => {
         try {
-          const raw = JSON.parse(await readFile11(join11(this.dir, file), "utf-8"));
+          const raw = JSON.parse(await readFile12(join13(this.dir, file), "utf-8"));
           if (raw.contextId === contextId) {
             await unlink2(raw.filePath).catch(() => {
             });
@@ -5751,7 +6079,7 @@ var ImageStorageService = class {
   async readImageAsBase64(imageId, expectedContextId) {
     const result = await this.getImagePath(imageId, expectedContextId);
     if (!result) return null;
-    const buffer = await readFile11(result.filePath);
+    const buffer = await readFile12(result.filePath);
     return { base64: buffer.toString("base64"), mimeType: result.mimeType };
   }
   async listExpiredImages(ttlMs = IMAGE_TTL_MS) {
@@ -5766,7 +6094,7 @@ var ImageStorageService = class {
     for (const file of files) {
       if (!file.endsWith(".meta.json")) continue;
       try {
-        const raw = JSON.parse(await readFile11(join11(this.dir, file), "utf-8"));
+        const raw = JSON.parse(await readFile12(join13(this.dir, file), "utf-8"));
         if (now - raw.createdAt > ttlMs) expired.push(raw);
       } catch {
       }
@@ -5838,10 +6166,10 @@ import { basename } from "path";
 import { TRPCError as TRPCError10 } from "@trpc/server";
 
 // ../server/src/services/cloud-session-store.ts
-import { readFile as readFile12, writeFile as writeFile11, rename as rename9, mkdir as mkdir12, chmod as chmod8, unlink as unlink3 } from "fs/promises";
-import { dirname as dirname6 } from "path";
+import { readFile as readFile13, writeFile as writeFile12, rename as rename10, mkdir as mkdir13, chmod as chmod9, unlink as unlink3 } from "fs/promises";
+import { dirname as dirname7 } from "path";
 import { randomBytes as randomBytes3, timingSafeEqual as timingSafeEqual2 } from "crypto";
-var FILENAME4 = "cloud-session.json";
+var FILENAME5 = "cloud-session.json";
 var STATE_TTL_MS = 5 * 60 * 1e3;
 var CloudSessionStore = class {
   session = null;
@@ -5853,11 +6181,11 @@ var CloudSessionStore = class {
    * root, but a launch directory owning its own key keeps both together.
    */
   getFilePath() {
-    return keyedFilePath(FILENAME4);
+    return keyedFilePath(FILENAME5);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME4);
+    return legacyMachineFilePath(FILENAME5);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -5867,9 +6195,9 @@ var CloudSessionStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile12(await this.getFilePath(), "utf-8");
+      return await readFile13(await this.getFilePath(), "utf-8");
     } catch {
-      return readFile12(this.getLegacyFilePath(), "utf-8");
+      return readFile13(this.getLegacyFilePath(), "utf-8");
     }
   }
   async load() {
@@ -5916,12 +6244,12 @@ var CloudSessionStore = class {
     }
   }
   async save() {
-    await mkdir12(dirname6(await this.getFilePath()), { recursive: true });
+    await mkdir13(dirname7(await this.getFilePath()), { recursive: true });
     const filePath = await this.getFilePath();
     const tmpPath = filePath + ".tmp";
-    await writeFile11(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
-    await rename9(tmpPath, filePath);
-    await chmod8(filePath, 384);
+    await writeFile12(tmpPath, JSON.stringify(this.session, null, 2), "utf-8");
+    await rename10(tmpPath, filePath);
+    await chmod9(filePath, 384);
   }
   /** Store the session token obtained from the one-time-token exchange. */
   async set(cloudUrl, token) {
@@ -5939,6 +6267,18 @@ var CloudSessionStore = class {
       return null;
     }
   }
+  /**
+   * The cloud this machine is signed into, or null when not linked.
+   *
+   * Needed to tell "an org I am not a member of" apart from "an org of another
+   * cloud instance entirely" — the ids of two clouds share no namespace, so
+   * comparing them without this would call every foreign-cloud project a
+   * permission problem.
+   */
+  async getCloudUrl() {
+    await this.load();
+    return this.session?.cloudUrl ?? null;
+  }
   async isLinked() {
     return await this.getToken() !== null;
   }
@@ -6014,9 +6354,10 @@ var cloudAuthRouter = router({
     const url = `${getCloudAppUrl()}/link-local?callback=${encodeURIComponent(callback)}&state=${encodeURIComponent(state)}`;
     return { url };
   }),
-  /** Whether this machine holds a cloud session. */
+  /** Whether this machine holds a cloud session, and against which cloud. */
   status: protectedProcedure.query(async () => {
-    return { linked: await cloudSessionStore.isLinked() };
+    const linked = await cloudSessionStore.isLinked();
+    return { linked, cloudUrl: linked ? await cloudSessionStore.getCloudUrl() : null };
   }),
   /** The cloud session (user + org), fetched with the stored token. */
   session: protectedProcedure.query(async () => {
@@ -6566,12 +6907,12 @@ function tailTranscript(opts) {
       const poll = setInterval(() => {
         void readMore();
       }, 500);
-      await new Promise((resolve6) => {
+      await new Promise((resolve7) => {
         const tick = setInterval(() => {
           if (stopped) {
             clearInterval(tick);
             clearInterval(poll);
-            resolve6();
+            resolve7();
           }
         }, 100);
       });
@@ -6590,7 +6931,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-JJYZDLNB.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -6603,7 +6944,7 @@ ${apiDocs}` : systemContext;
   const systemPrompt = skipTokenInstructions ? fullSystemContext : `${fullSystemContext}
 
 ${TOKEN_INSTRUCTIONS}`;
-  const mcpArgs = mcpConfig && !opts.excludeMcp ? ["--mcp-config", mcpConfig] : [];
+  const mcpArgs = mcpConfig && !opts.excludeMcp ? ["--mcp-config", mcpConfig, "--strict-mcp-config"] : [];
   const args = [
     ...sessionArg,
     "--dangerously-skip-permissions",
@@ -6669,7 +7010,7 @@ async function runClaudeViaPty(params) {
     return a;
   });
   params.onCommand?.(`claude ${displayArgs.join(" ")}`);
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let settled = false;
     let spawnId = null;
     const state = { assistantText: "", tools: /* @__PURE__ */ new Map() };
@@ -6692,7 +7033,7 @@ async function runClaudeViaPty(params) {
       settled = true;
       cleanup();
       void killSpawn();
-      resolve6(result);
+      resolve7(result);
     };
     const fail = (err) => {
       if (settled) return;
@@ -6897,7 +7238,7 @@ ${apiDocs}` : systemContext;
 
 ${TOKEN_INSTRUCTIONS}`;
   const inputArgs = hasImages ? ["--input-format", "stream-json"] : ["-p", prompt];
-  const mcpArgs = mcpConfig && !opts?.excludeMcp ? ["--mcp-config", mcpConfig] : [];
+  const mcpArgs = mcpConfig && !opts?.excludeMcp ? ["--mcp-config", mcpConfig, "--strict-mcp-config"] : [];
   const args = [
     ...sessionArg,
     "--output-format",
@@ -6996,7 +7337,7 @@ var ClaudeCodeRunner = class {
   runLocal(params) {
     const { signal, skipTokenInstructions } = params;
     const { args, env: env2, stdinData, sessionArg, hasImages: _hasImages } = buildClaudeSpawnConfig(params);
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const totalArgSize = args.reduce((s, a) => s + a.length + 1, 0);
       console.log(`[claude-code-runner] arg size: ${totalArgSize} bytes (${(totalArgSize / 1024 / 1024).toFixed(2)} MB), session: ${sessionArg.join(" ")}, images: ${params.images?.length ?? 0}`);
       const displayArgs = args.map((a) => {
@@ -7038,7 +7379,7 @@ var ClaudeCodeRunner = class {
       });
       proc.on("close", (code) => {
         if (ctx.earlyResult) {
-          resolve6({ ...ctx.earlyResult, actualSessionId: streamState.actualSessionId });
+          resolve7({ ...ctx.earlyResult, actualSessionId: streamState.actualSessionId });
           return;
         }
         signal.removeEventListener("abort", onAbort);
@@ -7055,7 +7396,7 @@ var ClaudeCodeRunner = class {
           return;
         }
         const { status, message, branchChoice } = skipTokenInstructions ? { status: "none", message: "", branchChoice: void 0 } : parseEndToken(streamState.fullContent);
-        resolve6({ output: streamState.fullContent, tokenStatus: status, tokenMessage: message, branchChoice, actualSessionId: streamState.actualSessionId });
+        resolve7({ output: streamState.fullContent, tokenStatus: status, tokenMessage: message, branchChoice, actualSessionId: streamState.actualSessionId });
       });
       proc.on("error", (err) => {
         if (ctx.settled) return;
@@ -7111,12 +7452,12 @@ var CodexAppServerClient = class extends EventEmitter3 {
     if (forceId !== void 0 && forceId >= this.nextId) {
       this.nextId = forceId + 1;
     }
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       const timer = setTimeout(() => {
         this.pending.delete(id);
         reject(new Error(`Request ${method} (id=${id}) timed out after ${this.requestTimeoutMs}ms`));
       }, this.requestTimeoutMs);
-      this.pending.set(id, { resolve: resolve6, reject, timer });
+      this.pending.set(id, { resolve: resolve7, reject, timer });
       this.writeLine({ jsonrpc: "2.0", method, id, params: params ?? {} });
     });
   }
@@ -7148,8 +7489,8 @@ var CodexAppServerClient = class extends EventEmitter3 {
     this.rl = null;
     const proc = this.proc;
     this.proc = null;
-    return new Promise((resolve6) => {
-      proc.on("exit", () => resolve6());
+    return new Promise((resolve7) => {
+      proc.on("exit", () => resolve7());
       proc.kill("SIGTERM");
       const forceTimer = setTimeout(() => {
         proc.kill("SIGKILL");
@@ -7243,7 +7584,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-2I47P7CA.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-JJYZDLNB.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -7332,7 +7673,7 @@ var CodexRunner = class {
         method: "thread/start",
         params: {
           model: model || void 0,
-          cwd: process.cwd(),
+          cwd: params.cwd ?? process.cwd(),
           approvalPolicy: "never",
           sandbox: "danger-full-access"
         },
@@ -7358,7 +7699,7 @@ ${prompt}`;
     }
     input.push({ type: "text", text: fullPrompt });
     const turnRef = { id: null };
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       let settled = false;
       let fullContent = "";
       let thinkingEmitted = false;
@@ -7407,7 +7748,7 @@ ${prompt}`;
               params.onDelta(delta);
               const { status, message, branchChoice } = parseEndToken(fullContent);
               if (status !== "none") {
-                settle(() => resolve6({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
+                settle(() => resolve7({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
               }
             }
           } else if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") {
@@ -7481,7 +7822,7 @@ ${prompt}`;
               return;
             }
             const { status, message, branchChoice } = parseEndToken(fullContent);
-            settle(() => resolve6({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
+            settle(() => resolve7({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
           } else if (method === "turn/errored") {
             const error = p["error"];
             const msg = typeof error?.["message"] === "string" ? error["message"] : "Codex turn errored";
@@ -7524,7 +7865,7 @@ ${prompt}`;
     } else {
       const res = await client.sendRequest("thread/start", {
         model: model || void 0,
-        cwd: process.cwd(),
+        cwd: params.cwd ?? process.cwd(),
         approvalPolicy: "never",
         sandbox: "danger-full-access"
       });
@@ -7556,7 +7897,7 @@ ${prompt}`;
       sandboxPolicy: { type: "dangerFullAccess" }
     });
     const turnId = turnRes.turn.id;
-    return new Promise((resolve6, reject) => {
+    return new Promise((resolve7, reject) => {
       let settled = false;
       let fullContent = "";
       let thinkingEmitted = false;
@@ -7582,7 +7923,7 @@ ${prompt}`;
             params.onDelta(delta);
             const { status, message, branchChoice } = parseEndToken(fullContent);
             if (status !== "none") {
-              settle(() => resolve6({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
+              settle(() => resolve7({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
             }
           }
         } else if (method === "item/reasoning/summaryTextDelta" || method === "item/reasoning/textDelta") {
@@ -7656,7 +7997,7 @@ ${prompt}`;
             return;
           }
           const { status, message, branchChoice } = parseEndToken(fullContent);
-          settle(() => resolve6({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
+          settle(() => resolve7({ output: fullContent, tokenStatus: status, tokenMessage: message, branchChoice }));
         } else if (method === "turn/errored") {
           const error = p["error"];
           const msg = typeof error?.["message"] === "string" ? error["message"] : "Codex turn errored";
@@ -7982,6 +8323,8 @@ async function startClaudeCodeSession(convId, prompt, opts = {}) {
   const injectedEnv = await resolveInjectedEnv(opts.environmentId);
   const done = new ClaudeCodeRunner().run({
     agentId: resolvedAgentId ?? void 0,
+    // The conversation's project, not the server's launch directory.
+    cwd: await conversationCwd(conv),
     sessionId: conv.id,
     prompt,
     isResume,
@@ -8044,6 +8387,7 @@ async function startCodexSession(convId, prompt, opts = {}) {
   const injectedEnv = await resolveInjectedEnv(opts.environmentId);
   const done = new CodexRunner().run({
     agentId: resolvedAgentId ?? void 0,
+    cwd: await conversationCwd(conv),
     sessionId: conv.codexThreadId ?? "",
     prompt,
     isResume,
@@ -8094,19 +8438,24 @@ var StoredMessageSchema = z15.object({
   content: z15.string().max(1e5),
   parts: z15.array(MessagePartSchema).max(200).optional()
 });
+async function conversationCwd(conv) {
+  const ref = await conversationStore.projectRefOf(conv);
+  if (!ref) return resolveAgentCwd({});
+  return resolveAgentCwd({ projectId: ref.id, orgId: ref.orgId });
+}
 var chatRouter = router({
   conversations: router({
     onChanged: protectedProcedure.subscription(async function* () {
       const initial = await conversationStore.list();
       yield { type: "initial", conversations: initial };
       const queue = [];
-      let resolve6 = null;
+      let resolve7 = null;
       const handler = (event) => {
         if (queue.length >= 500) queue.shift();
         queue.push(event);
-        if (resolve6) {
-          resolve6();
-          resolve6 = null;
+        if (resolve7) {
+          resolve7();
+          resolve7 = null;
         }
       };
       conversationStore.onChanged(handler);
@@ -8116,7 +8465,7 @@ var chatRouter = router({
             yield queue.shift();
           } else {
             await new Promise((r) => {
-              resolve6 = r;
+              resolve7 = r;
             });
           }
         }
@@ -8154,7 +8503,8 @@ var chatRouter = router({
       kanbanCardId: Id128Schema.optional(),
       // The project the conversation is about: only the caller knows which
       // one it is looking at.
-      projectId: Id128Schema.optional()
+      projectId: Id128Schema.optional(),
+      orgId: z15.string().max(128).nullable().optional()
     })).mutation(async ({ input }) => {
       let scenario = null;
       if (input.scenarioId) {
@@ -8170,7 +8520,8 @@ var chatRouter = router({
         input.kanbanBoardId,
         input.kanbanCardId,
         input.providerId,
-        input.projectId
+        input.projectId,
+        input.orgId
       );
       if (scenario) {
         await scenarioRunStore.initializeConversationWorkspace(
@@ -8397,6 +8748,7 @@ ${imagePaths.map((p) => `Image: ${p}`).join("\n")}` : cliPrompt;
     const injectedEnv = await resolveInjectedEnv(input.environmentId);
     new ClaudeCodeRunner().run({
       agentId: resolvedAgentId ?? void 0,
+      cwd: await conversationCwd(conv),
       sessionId: conv.id,
       prompt: promptWithImages,
       isResume,
@@ -8497,6 +8849,7 @@ ${input.prompt}` : input.prompt;
     const injectedEnv = await resolveInjectedEnv(input.environmentId);
     new CodexRunner().run({
       agentId: resolvedAgentId ?? void 0,
+      cwd: await conversationCwd(conv),
       sessionId: conv.codexThreadId ?? "",
       prompt: cliPrompt,
       isResume,
@@ -8664,6 +9017,10 @@ ${input.prompt}` : input.prompt;
       resume: z15.boolean().default(false),
       model: z15.string().max(128).optional(),
       cwd: z15.string().max(4096).optional(),
+      /** Anchors the session when no explicit cwd is given. */
+      serviceId: z15.string().max(128).optional(),
+      projectId: Id128Schema.optional(),
+      orgId: z15.string().max(128).nullable().optional(),
       cols: z15.number().int().min(1).max(1e3).default(120),
       rows: z15.number().int().min(1).max(1e3).default(30),
       enableMcp: z15.boolean().default(false),
@@ -8674,6 +9031,10 @@ ${input.prompt}` : input.prompt;
         text: z15.string().max(1e6)
       })).max(20).optional()
     })).mutation(async ({ input, ctx }) => {
+      const t0 = Date.now();
+      const lap = (label) => {
+        if (process.env.RUNEYA_DEBUG) console.log("[chat.pty.start] %s +%dms", label, Date.now() - t0);
+      };
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError11({ code: "PRECONDITION_FAILED", message: "No agent available" });
       if (input.sessionId) {
@@ -8690,11 +9051,13 @@ ${input.prompt}` : input.prompt;
               rows: input.rows
             }).catch(() => {
             });
+            lap("reattached to existing pty");
             return { spawnId: existing.spawnId, agentId, reattached: true };
           }
         } catch {
         }
       }
+      lap("findPtyBySession (no reattach)");
       const isCodex = input.runner === "codex";
       const cli = isCodex ? "codex" : "claude";
       const args = [];
@@ -8734,8 +9097,10 @@ ${apiDocs}` : systemContext;
         } catch (err) {
           console.warn("[chat.pty.start] buildCliSystemContext failed:", err.message);
         }
+        lap("buildCliSystemContext");
       }
       const injectedEnv = await resolveInjectedEnv(input.environmentId);
+      lap("resolveInjectedEnv");
       const res = await agentManager.agentMutation(
         agentId,
         "ai.spawnPty",
@@ -8743,7 +9108,13 @@ ${apiDocs}` : systemContext;
           cli,
           args,
           env: injectedEnv,
-          cwd: input.cwd,
+          // An explicit cwd wins; otherwise the service's directory, then the
+          // project's — never the directory the server was launched in.
+          cwd: input.cwd ?? await resolveAgentCwd({
+            serviceId: input.serviceId,
+            projectId: input.projectId,
+            orgId: input.orgId
+          }),
           cols: input.cols,
           rows: input.rows,
           sessionId: input.sessionId,
@@ -8752,6 +9123,7 @@ ${apiDocs}` : systemContext;
           mcpApiToken: jwt
         }
       );
+      lap("agent ai.spawnPty");
       const contexts = input.attachedContexts ?? [];
       if (contexts.length > 0) {
         const body = contexts.map((c) => `### ${c.label}
@@ -8818,25 +9190,31 @@ Context:
     })).subscription(async function* ({ input, signal }) {
       const agentId = input.agentId ?? agentManager.getDefaultAgentId();
       if (!agentId) throw new TRPCError11({ code: "PRECONDITION_FAILED", message: "No agent available" });
+      const tSub = Date.now();
+      let firstChunk = true;
       const queue = [];
-      let resolve6 = null;
+      let resolve7 = null;
       let stopped = false;
       const unsub = agentManager.agentSubscribe(
         agentId,
         "ai.stream",
         { spawnId: input.spawnId, fromOffset: input.fromOffset },
         (data) => {
+          if (firstChunk) {
+            firstChunk = false;
+            if (process.env.RUNEYA_DEBUG) console.log("[chat.pty.stream] first chunk +%dms", Date.now() - tSub);
+          }
           queue.push(data);
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         },
         () => {
           stopped = true;
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         }
       );
@@ -8852,7 +9230,7 @@ Context:
           }
           if (stopped) break;
           await new Promise((r) => {
-            resolve6 = r;
+            resolve7 = r;
           });
         }
       } finally {
@@ -9003,7 +9381,9 @@ Context:
         {
           cli: "node",
           args: [scriptPath],
-          cwd: process.cwd(),
+          // Was `process.cwd()` — the SERVER's directory, handed to an agent
+          // that may not even run on this machine.
+          cwd: await resolveWorkspaceCwd({}),
           cols: input.cols,
           rows: input.rows,
           sessionId: stressSessionId,
@@ -9050,11 +9430,15 @@ async function resolveServiceContext(serviceId) {
   if (!agentId) {
     throw new TRPCError12({ code: "BAD_REQUEST", message: "No agent configured for this service" });
   }
-  return { agentId, cwd: service.cwd || "." };
+  return { agentId, cwd: await resolveWorkspaceCwd({ serviceId }) };
 }
 var gitTargetShape = {
   serviceId: SERVICE_ID_SCHEMA.optional(),
-  agentId: z16.string().max(128).optional()
+  agentId: z16.string().max(128).optional(),
+  /** Anchors on a project when no service is targeted (e.g. from the AI chat). */
+  projectId: z16.string().max(128).optional(),
+  /** Son organisation : un id de projet seul peut en nommer un par organisation. */
+  orgId: z16.string().max(128).nullable().optional()
 };
 async function resolveGitContext(input) {
   if (input.serviceId) return resolveServiceContext(input.serviceId);
@@ -9062,7 +9446,8 @@ async function resolveGitContext(input) {
   if (!agentId) {
     throw new TRPCError12({ code: "BAD_REQUEST", message: "No agent available" });
   }
-  return { agentId, cwd: "." };
+  const cwd = await resolveAgentCwd({ projectId: input.projectId, orgId: input.orgId }) ?? ".";
+  return { agentId, cwd };
 }
 var gitRouter = router({
   /** Get full git status */
@@ -9223,7 +9608,7 @@ Rules:
   onStatusChange: protectedProcedure.input(z16.object({ ...gitTargetShape })).subscription(async function* ({ input }) {
     const { agentId, cwd } = await resolveGitContext(input);
     const queue = [];
-    let resolve6 = null;
+    let resolve7 = null;
     let done = false;
     let unsubscribe;
     try {
@@ -9233,16 +9618,16 @@ Rules:
         { cwd },
         (data) => {
           queue.push(data);
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         },
         () => {
           done = true;
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         }
       );
@@ -9258,7 +9643,7 @@ Rules:
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve6 = r;
+            resolve7 = r;
           });
         }
       }
@@ -9390,9 +9775,9 @@ async function* streamWithActiveProvider(opts) {
 }
 
 // ../server/src/services/scenario-runner.ts
-import { mkdir as mkdir13 } from "fs/promises";
+import { mkdir as mkdir14 } from "fs/promises";
 import { randomUUID as randomUUID7 } from "crypto";
-import { join as join12 } from "path";
+import { join as join14 } from "path";
 
 // ../server/src/services/scenario-presets.ts
 var BUILT_IN_PRESETS = [
@@ -9606,21 +9991,21 @@ async function* tapBus(conversationId, signal) {
     }
     if (bus.done) return;
     if (signal.aborted) return;
-    await new Promise((resolve6) => {
+    await new Promise((resolve7) => {
       const onAbort = () => {
         bus.listeners.delete(notify);
-        resolve6();
+        resolve7();
       };
       const notify = () => {
         signal.removeEventListener("abort", onAbort);
-        resolve6();
+        resolve7();
       };
       bus.listeners.add(notify);
       signal.addEventListener("abort", onAbort, { once: true });
       if (cursor < bus.baseIndex + bus.buffer.length || bus.done || signal.aborted) {
         bus.listeners.delete(notify);
         signal.removeEventListener("abort", onAbort);
-        resolve6();
+        resolve7();
       }
     });
   }
@@ -10088,6 +10473,10 @@ async function runNodeCall(conversationId, node, systemContext, userMessage, run
     const turnStart = Date.now();
     const result = await state.runner.run({
       agentId: runOverrides?.agentId ?? agentManager.getDefaultAgentId() ?? void 0,
+      // Without this the CLI would run wherever the server was launched, whatever
+      // project the scenario belongs to. No project: left unset, so the runner
+      // keeps its own default rather than being sent to this machine's path.
+      cwd: await resolveAgentCwd({ projectId: runOverrides?.projectId, orgId: runOverrides?.orgId }),
       sessionId: state.sessionId,
       prompt: currentPrompt,
       isResume: state.isResume,
@@ -10124,9 +10513,9 @@ async function runNodeCall(conversationId, node, systemContext, userMessage, run
       publish2({ type: "node_waiting_input", nodeId: node.id, question: result.tokenMessage });
       await readme?.(`- \u2753 [${formatTs()}] **${node.label}** \u2014 waiting for user input
 `);
-      const answer = await new Promise((resolve6, reject) => {
+      const answer = await new Promise((resolve7, reject) => {
         const key = pendingNodeKey(conversationId, node.id);
-        pendingNodeInputs.set(key, resolve6);
+        pendingNodeInputs.set(key, resolve7);
         signal.addEventListener("abort", () => {
           pendingNodeInputs.delete(key);
           reject(new Error("Aborted"));
@@ -10166,7 +10555,7 @@ async function appendNodeOutput(conversationId, node, output) {
   if (!dir) return;
   const slug = node.label.toLowerCase().replace(/[^a-z0-9]+/g, "-").slice(0, 60) || "member";
   const safeId = node.id.replace(/[^a-z0-9_-]/gi, "-").slice(0, 80);
-  const filePath = join12(dir, `${slug}_${safeId}.md`);
+  const filePath = join14(dir, `${slug}_${safeId}.md`);
   const content = `## Output
 
 ${output}
@@ -10179,9 +10568,9 @@ async function appendToReadme(conversationId, bus, text) {
   const line = `${text}
 `;
   try {
-    await mkdir13(dir, { recursive: true });
+    await mkdir14(dir, { recursive: true });
     const { appendFile: appendFile2 } = await import("fs/promises");
-    await appendFile2(join12(dir, "README.md"), line, "utf-8");
+    await appendFile2(join14(dir, "README.md"), line, "utf-8");
   } catch {
   }
   publishToBus(bus, { type: "readme_append", text: line });
@@ -10201,7 +10590,7 @@ async function writeFinalMd(conversationId, bus, userRequest, content) {
 
 ${content}
 `;
-  const filePath = join12(dir, "FINAL.md");
+  const filePath = join14(dir, "FINAL.md");
   await atomicWriteSecure(filePath, fullContent);
   await appendToReadme(
     conversationId,
@@ -10531,9 +10920,9 @@ ${outputs.get(node.id) ?? ""}`.trim();
         publish2({ type: "node_waiting_input", nodeId: node.id, question });
         await readme(`- \u2753 [${ts()}] **${node.label || node.id}** \u2014 waiting for user input
 `);
-        const answer = await new Promise((resolve6, reject) => {
+        const answer = await new Promise((resolve7, reject) => {
           const key = pendingNodeKey(conversationId, node.id);
-          pendingNodeInputs.set(key, resolve6);
+          pendingNodeInputs.set(key, resolve7);
           signal.addEventListener("abort", () => {
             pendingNodeInputs.delete(key);
             reject(new Error("Aborted"));
@@ -10932,6 +11321,10 @@ var scenarioRouter = router({
     runnerOverride: z17.enum(["claude-code", "codex"]).optional(),
     modelOverride: Id128Schema.optional(),
     agentId: Id128Schema.optional(),
+    /** Anchors the run's working directory on the project it belongs to. */
+    projectId: Id128Schema.optional(),
+    /** Son organisation : sans elle, un id partagé désignerait un projet au hasard. */
+    orgId: z17.string().max(128).nullable().optional(),
     resume: z17.boolean().optional()
   })).subscription(async function* ({ input, signal }) {
     const scenario = await scenarioStore.get(input.scenarioId);
@@ -10945,7 +11338,9 @@ var scenarioRouter = router({
       void runScenario(input.conversationId, input.scenarioId, userRequest, {
         runnerOverride: input.runnerOverride,
         modelOverride: input.modelOverride,
-        agentId: input.agentId
+        agentId: input.agentId,
+        projectId: input.projectId,
+        orgId: input.orgId
       }, !!input.resume);
       await new Promise((r) => setTimeout(r, 10));
     }
@@ -11066,21 +11461,21 @@ async function* tapJob(job, signal) {
       yield evt;
     }
     if (job.done || signal.aborted) return;
-    await new Promise((resolve6) => {
+    await new Promise((resolve7) => {
       const onAbort = () => {
         job.listeners.delete(notify);
-        resolve6();
+        resolve7();
       };
       const notify = () => {
         signal.removeEventListener("abort", onAbort);
-        resolve6();
+        resolve7();
       };
       job.listeners.add(notify);
       signal.addEventListener("abort", onAbort, { once: true });
       if (cursor < job.baseIndex + job.buffer.length || job.done || signal.aborted) {
         job.listeners.delete(notify);
         signal.removeEventListener("abort", onAbort);
-        resolve6();
+        resolve7();
       }
     });
   }
@@ -11352,13 +11747,13 @@ var kanbanQueueRouter = router({
   }),
   onChanged: protectedProcedure.subscription(async function* () {
     const queue = [];
-    let resolve6 = null;
+    let resolve7 = null;
     const handler = () => {
       if (queue.length >= 50) queue.shift();
       queue.push(kanbanQueue.getState());
-      if (resolve6) {
-        resolve6();
-        resolve6 = null;
+      if (resolve7) {
+        resolve7();
+        resolve7 = null;
       }
     };
     kanbanQueue.on("changed", handler);
@@ -11369,7 +11764,7 @@ var kanbanQueueRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve6 = r;
+            resolve7 = r;
           });
         }
       }
@@ -11380,10 +11775,10 @@ var kanbanQueueRouter = router({
 });
 
 // ../server/src/trpc/routers/kanban.ts
-import { mkdir as mkdir14, readdir as readdir5, rm as rm3, stat as stat3, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir15, readdir as readdir5, rm as rm3, stat as stat4, writeFile as writeFile13 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir } from "os";
-import { join as join13 } from "path";
+import { join as join15 } from "path";
 import { z as z20 } from "zod";
 import { TRPCError as TRPCError17 } from "@trpc/server";
 function summarizeCard(card, boardId, columnTitle) {
@@ -11434,30 +11829,30 @@ function safeDecode(value) {
 }
 var MAX_ATTACHMENT_BYTES = 55 * 1024 * 1024;
 function attachmentCacheDir() {
-  return join13(tmpdir(), "runeya-kanban-attachments");
+  return join15(tmpdir(), "runeya-kanban-attachments");
 }
 var ATTACHMENT_CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
 async function purgeStaleAttachments(dir, ttlMs = ATTACHMENT_CACHE_TTL_MS) {
   try {
     const cutoff = Date.now() - ttlMs;
     for (const name of await readdir5(dir)) {
-      const path = join13(dir, name);
-      const info = await stat3(path).catch(() => null);
+      const path = join15(dir, name);
+      const info = await stat4(path).catch(() => null);
       if (info && info.mtimeMs < cutoff) await rm3(path, { force: true });
     }
   } catch {
   }
 }
 function attachmentCacheDirs() {
-  return [attachmentCacheDir(), join13(machineRoot(), "kanban-attachments")];
+  return [attachmentCacheDir(), join15(machineRoot(), "kanban-attachments")];
 }
 async function storeAttachment(id, name, body, dirs = attachmentCacheDirs()) {
   const refusals = [];
   for (const dir of dirs) {
     try {
-      await mkdir14(dir, { recursive: true });
-      const path = join13(dir, safeLocalName(id, name));
-      await writeFile12(path, body);
+      await mkdir15(dir, { recursive: true });
+      const path = join15(dir, safeLocalName(id, name));
+      await writeFile13(path, body);
       void purgeStaleAttachments(dir);
       return path;
     } catch (err) {
@@ -11644,13 +12039,28 @@ var terminalRouter = router({
   create: protectedProcedure.input(z21.object({
     agentId: z21.string().max(128),
     cwd: z21.string().max(512).optional(),
+    /** Anchors the terminal when no explicit cwd is given. */
+    serviceId: z21.string().max(128).optional(),
+    projectId: z21.string().max(128).optional(),
+    /** L'organisation du projet : un id seul peut en nommer un par organisation. */
+    orgId: z21.string().max(128).nullable().optional(),
     cols: z21.number().int().min(1).max(512).optional(),
     rows: z21.number().int().min(1).max(256).optional()
   })).mutation(async ({ input }) => {
     const result = await agentManager.agentMutation(
       input.agentId,
       "terminal.create",
-      { cwd: input.cwd, cols: input.cols, rows: input.rows }
+      {
+        // An explicit cwd wins; otherwise the service's directory, then the
+        // project's — never the directory the server was launched in.
+        cwd: input.cwd ?? await resolveAgentCwd({
+          serviceId: input.serviceId,
+          projectId: input.projectId,
+          orgId: input.orgId
+        }),
+        cols: input.cols,
+        rows: input.rows
+      }
     );
     return result;
   }),
@@ -11699,7 +12109,7 @@ var terminalRouter = router({
     sessionId: z21.string().max(128)
   })).subscription(async function* ({ input }) {
     const queue = [];
-    let resolve6 = null;
+    let resolve7 = null;
     let done = false;
     let unsubscribe;
     try {
@@ -11709,16 +12119,16 @@ var terminalRouter = router({
         { sessionId: input.sessionId },
         (data) => {
           if (typeof data === "string") queue.push(data);
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         },
         () => {
           done = true;
-          if (resolve6) {
-            resolve6();
-            resolve6 = null;
+          if (resolve7) {
+            resolve7();
+            resolve7 = null;
           }
         }
       );
@@ -11734,7 +12144,7 @@ var terminalRouter = router({
           yield queue.shift();
         } else {
           await new Promise((r) => {
-            resolve6 = r;
+            resolve7 = r;
           });
         }
       }
@@ -11751,7 +12161,7 @@ var utilityRouter = router({
   wait: protectedProcedure.input(z22.object({
     ms: z22.number().int().min(0).max(MAX_WAIT_MS)
   })).mutation(async ({ input }) => {
-    await new Promise((resolve6) => setTimeout(resolve6, input.ms));
+    await new Promise((resolve7) => setTimeout(resolve7, input.ms));
     return { waited: input.ms };
   })
 });
@@ -11759,8 +12169,8 @@ var utilityRouter = router({
 // ../server/src/trpc/routers/wiki.ts
 import { z as z23 } from "zod";
 import { TRPCError as TRPCError19 } from "@trpc/server";
-import { readFile as readFile13, readdir as readdir6, stat as stat4, realpath, writeFile as writeFile13, mkdir as mkdir15, rename as rename10, rm as rm4 } from "fs/promises";
-import { resolve as resolvePath, join as join14, relative, sep as sep3, dirname as dirname7 } from "path";
+import { readFile as readFile14, readdir as readdir6, stat as stat5, realpath, writeFile as writeFile14, mkdir as mkdir16, rename as rename11, rm as rm4 } from "fs/promises";
+import { resolve as resolvePath, join as join16, relative, sep as sep3, dirname as dirname8 } from "path";
 var SCOPE_SCHEMA = z23.union([
   z23.literal("global"),
   z23.string().regex(/^service:[A-Za-z0-9_-]{1,128}$/, "Invalid service scope")
@@ -11797,13 +12207,13 @@ async function resolveScope(scope) {
       throw new TRPCError19({ code: "BAD_REQUEST", message: "Sous-chemin invalide" });
     }
     const dataDirAbs = resolvePath(env.DATA_DIR);
-    await mkdir15(dataDirAbs, { recursive: true });
-    const base = dirname7(await realpath(dataDirAbs));
+    await mkdir16(dataDirAbs, { recursive: true });
+    const base = dirname8(await realpath(dataDirAbs));
     const target = resolvePath(base, sub);
     if (target !== base && !(target + sep3).startsWith(base + sep3)) {
       throw new TRPCError19({ code: "FORBIDDEN", message: "Hors du dossier de donn\xE9es du serveur" });
     }
-    await mkdir15(target, { recursive: true });
+    await mkdir16(target, { recursive: true });
     const root = await realpath(target);
     if (root !== base && !(root + sep3).startsWith(base + sep3)) {
       throw new TRPCError19({ code: "FORBIDDEN", message: "Le dossier wiki r\xE9sout hors du dossier de donn\xE9es" });
@@ -11815,7 +12225,7 @@ async function resolveScope(scope) {
   if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
   const agentId = await resolveEffectiveAgentId(service);
   if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9 pour ce service" });
-  const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
+  const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
   return { mode: "agent", agentId, cwd };
 }
 async function walkLocal(root, dir, depth, counter) {
@@ -11830,7 +12240,7 @@ async function walkLocal(root, dir, depth, counter) {
   for (const e of entries) {
     if (counter.n >= MAX_FILES) break;
     if (e.name.startsWith(".") && e.name !== ".") continue;
-    const abs = join14(dir, e.name);
+    const abs = join16(dir, e.name);
     const rel = relative(root, abs).split(sep3).join("/");
     if (e.isDirectory()) {
       if (IGNORED_DIRS.has(e.name)) continue;
@@ -11864,7 +12274,7 @@ async function resolveSafeLocal(root, relPath, requireExist) {
     }
     return real;
   }
-  const parent = dirname7(target);
+  const parent = dirname8(target);
   let realParent;
   try {
     realParent = await realpath(parent);
@@ -11895,10 +12305,10 @@ var wikiRouter = router({
       return agentManager.agentQuery(target.agentId, "wiki.readRepoMarkdown", { cwd: target.cwd, path: input.path });
     }
     const file = await resolveSafeLocal(target.root, input.path, true);
-    const s = await stat4(file);
+    const s = await stat5(file);
     if (!s.isFile()) throw new TRPCError19({ code: "BAD_REQUEST", message: "Pas un fichier" });
     if (s.size > MAX_FILE_BYTES) throw new TRPCError19({ code: "PAYLOAD_TOO_LARGE", message: "Fichier trop volumineux" });
-    const content = await readFile13(file, "utf-8");
+    const content = await readFile14(file, "utf-8");
     return { path: input.path, content };
   }),
   write: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA, content: z23.string().max(5e6) })).mutation(async ({ input }) => {
@@ -11910,8 +12320,8 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.writeMarkdown", { cwd: target.cwd, path: input.path, content: input.content });
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir15(dirname7(file), { recursive: true });
-    await writeFile13(file, input.content, "utf-8");
+    await mkdir16(dirname8(file), { recursive: true });
+    await writeFile14(file, input.content, "utf-8");
     return { path: input.path, ok: true };
   }),
   createFile: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11924,13 +12334,13 @@ var wikiRouter = router({
     }
     const file = await resolveSafeLocal(target.root, input.path, false);
     try {
-      await stat4(file);
+      await stat5(file);
       throw new TRPCError19({ code: "CONFLICT", message: "Fichier d\xE9j\xE0 existant" });
     } catch (err) {
       if (err instanceof TRPCError19) throw err;
     }
-    await mkdir15(dirname7(file), { recursive: true });
-    await writeFile13(file, "", "utf-8");
+    await mkdir16(dirname8(file), { recursive: true });
+    await writeFile14(file, "", "utf-8");
     return { path: input.path, ok: true };
   }),
   createDir: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11939,7 +12349,7 @@ var wikiRouter = router({
       return agentManager.agentMutation(target.agentId, "wiki.createDir", { cwd: target.cwd, path: input.path });
     }
     const dir = await resolveSafeLocal(target.root, input.path, false);
-    await mkdir15(dir, { recursive: true });
+    await mkdir16(dir, { recursive: true });
     return { path: input.path, ok: true };
   }),
   rename: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, fromPath: REL_PATH_SCHEMA, toPath: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11950,13 +12360,13 @@ var wikiRouter = router({
     const from = await resolveSafeLocal(target.root, input.fromPath, true);
     const to = await resolveSafeLocal(target.root, input.toPath, false);
     try {
-      await stat4(to);
+      await stat5(to);
       throw new TRPCError19({ code: "CONFLICT", message: "La cible existe d\xE9j\xE0" });
     } catch (err) {
       if (err instanceof TRPCError19) throw err;
     }
-    await mkdir15(dirname7(to), { recursive: true });
-    await rename10(from, to);
+    await mkdir16(dirname8(to), { recursive: true });
+    await rename11(from, to);
     return { fromPath: input.fromPath, toPath: input.toPath, ok: true };
   }),
   ensureRoot: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA })).mutation(async ({ input }) => {
@@ -11969,7 +12379,7 @@ var wikiRouter = router({
     if (!service) throw new TRPCError19({ code: "NOT_FOUND", message: "Service introuvable" });
     const agentId = await resolveEffectiveAgentId(service);
     if (!agentId) throw new TRPCError19({ code: "BAD_REQUEST", message: "Aucun agent configur\xE9" });
-    const cwd = (service.docsPath?.trim() || service.cwd || ".").toString();
+    const cwd = await resolveWorkspaceCwd({ serviceId, override: service.docsPath?.trim() || void 0 });
     return agentManager.agentMutation(agentId, "wiki.ensureRoot", { cwd });
   }),
   delete: protectedProcedure.input(z23.object({ scope: SCOPE_SCHEMA, path: REL_PATH_SCHEMA })).mutation(async ({ input }) => {
@@ -11997,18 +12407,18 @@ import { z as z24 } from "zod";
 import { TRPCError as TRPCError20 } from "@trpc/server";
 
 // ../server/src/services/cloud-sync-store.ts
-import { readFile as readFile14, writeFile as writeFile14, rename as rename11, mkdir as mkdir16, chmod as chmod9 } from "fs/promises";
-var FILENAME5 = "cloud-sync.json";
+import { readFile as readFile15, writeFile as writeFile15, rename as rename12, mkdir as mkdir17, chmod as chmod10 } from "fs/promises";
+var FILENAME6 = "cloud-sync.json";
 var CloudSyncStore = class {
   links = /* @__PURE__ */ new Map();
   loaded = false;
   /** Machine-wide: this describes the machine, not any one project. */
   getFilePath() {
-    return machineFilePath(FILENAME5);
+    return machineFilePath(FILENAME6);
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME5);
+    return legacyMachineFilePath(FILENAME6);
   }
   /**
    * Read the machine file, falling back to the launch directory of old.
@@ -12018,9 +12428,9 @@ var CloudSyncStore = class {
    */
   async readFromDisk() {
     try {
-      return await readFile14(this.getFilePath(), "utf-8");
+      return await readFile15(this.getFilePath(), "utf-8");
     } catch {
-      return readFile14(this.getLegacyFilePath(), "utf-8");
+      return readFile15(this.getLegacyFilePath(), "utf-8");
     }
   }
   async load() {
@@ -12030,24 +12440,26 @@ var CloudSyncStore = class {
       const data = JSON.parse(raw);
       for (const l of data) {
         this.links.set(l.orgId, { orgId: l.orgId, cloudUrl: l.cloudUrl });
+        void stampOrgCloud(l.orgId, l.cloudUrl);
       }
     } catch {
     }
     this.loaded = true;
   }
   async save() {
-    await mkdir16(machineRoot(), { recursive: true });
+    await mkdir17(machineRoot(), { recursive: true });
     const filePath = this.getFilePath();
     const tmpPath = filePath + ".tmp";
     const data = JSON.stringify(Array.from(this.links.values()), null, 2);
-    await writeFile14(tmpPath, data, "utf-8");
-    await rename11(tmpPath, filePath);
-    await chmod9(filePath, 384);
+    await writeFile15(tmpPath, data, "utf-8");
+    await rename12(tmpPath, filePath);
+    await chmod10(filePath, 384);
   }
   /** Store (or replace) the sync link for an organization. */
   async upsert(orgId, cloudUrl) {
     await this.load();
     this.links.set(orgId, { orgId, cloudUrl });
+    await stampOrgCloud(orgId, cloudUrl);
     await this.save();
   }
   async remove(orgId) {
@@ -12068,16 +12480,16 @@ var cloudSyncStore = new CloudSyncStore();
 
 // ../server/src/services/cloud-sync-bridge.ts
 import { randomUUID as randomUUID11 } from "crypto";
-import { mkdir as mkdir18, rm as rm5 } from "fs/promises";
+import { mkdir as mkdir19, rm as rm5 } from "fs/promises";
 import * as Y from "yjs";
 
 // ../server/src/services/org-lock.ts
-import { open as open2, readFile as readFile15, unlink as unlink4, mkdir as mkdir17 } from "fs/promises";
+import { open as open2, readFile as readFile16, unlink as unlink4, mkdir as mkdir18 } from "fs/promises";
 import { readFileSync, unlinkSync } from "fs";
-import { join as join15 } from "path";
+import { join as join17 } from "path";
 var held = /* @__PURE__ */ new Set();
 function lockPath(orgId) {
-  return join15(orgVaultRoot(orgId), "org.lock");
+  return join17(orgVaultRoot(orgId), "org.lock");
 }
 function isRunning(pid) {
   if (!Number.isInteger(pid) || pid <= 0) return false;
@@ -12090,7 +12502,7 @@ function isRunning(pid) {
 }
 async function readLock(path) {
   try {
-    const parsed = JSON.parse(await readFile15(path, "utf-8"));
+    const parsed = JSON.parse(await readFile16(path, "utf-8"));
     return typeof parsed?.pid === "number" ? parsed : null;
   } catch {
     return null;
@@ -12098,7 +12510,7 @@ async function readLock(path) {
 }
 async function acquireOrgLock(orgId) {
   const path = lockPath(orgId);
-  await mkdir17(orgVaultRoot(orgId), { recursive: true });
+  await mkdir18(orgVaultRoot(orgId), { recursive: true });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
       const handle = await open2(path, "wx");
@@ -12165,6 +12577,17 @@ var SyncOutdatedError = class extends Error {
     this.lastIncompatibleVersion = lastIncompatibleVersion;
   }
 };
+var ProjectHeldElsewhereError = class extends Error {
+  constructor(projectId, heldByOrgId) {
+    super(
+      `Project ${projectId} is already held here for ${heldByOrgId ? `organization ${heldByOrgId}` : "this directory"}. Two copies of one project share every entity id \u2014 stop following the other one first.`
+    );
+    this.projectId = projectId;
+    this.heldByOrgId = heldByOrgId;
+    this.name = "ProjectHeldElsewhereError";
+  }
+  code = "PROJECT_HELD_ELSEWHERE";
+};
 var OrgSyncConnection = class {
   doc = new Y.Doc();
   projects = getCollection(this.doc, "projects");
@@ -12481,18 +12904,24 @@ var OrgSyncConnection = class {
    */
   async followProject(projectId) {
     const inDoc = readEntity(this.collection("projects"), projectId) !== null;
-    const existing = await projectStore.get(projectId);
+    const existing = await projectStore.get({ id: projectId, orgId: this.link.orgId }) ?? await projectStore.get({ id: projectId, orgId: null });
     if (existing && !existing.orgId) {
       console.error(
         "[cloud-sync] project %s is already a local project here \u2014 not following it for org %s",
         projectId,
         this.link.orgId
       );
-      return false;
+      throw new ProjectHeldElsewhereError(projectId, null);
+    }
+    const heldBy = await projectStore.list().then((all) => all.find(
+      (p) => p.id === projectId && p.orgId && p.orgId !== this.link.orgId
+    ));
+    if (heldBy?.orgId) {
+      throw new ProjectHeldElsewhereError(projectId, heldBy.orgId);
     }
     const isLocal = existing?.orgId === this.link.orgId;
     if (!inDoc && !isLocal) return false;
-    await mkdir18(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
+    await mkdir19(projectVaultRoot(this.link.orgId, projectId), { recursive: true });
     this.tracked.add(projectId);
     if (inDoc) await this.pullFromDoc([projectId]);
     else await this.reconcileLocalToDoc();
@@ -12507,7 +12936,7 @@ var OrgSyncConnection = class {
    */
   async unfollowProject(projectId) {
     this.tracked.delete(projectId);
-    await projectStore.forgetLocally(projectId);
+    await projectStore.forgetLocally({ id: projectId, orgId: this.link.orgId });
     await rm5(projectVaultRoot(this.link.orgId, projectId), { recursive: true, force: true }).catch(() => {
     });
   }
@@ -12589,9 +13018,33 @@ var OrgSyncConnection = class {
     if (result?.created) await this.bootstrapEnvironment(id);
   }
   async deleteLocally(name, id) {
-    if (name === "services") await serviceStore.applyRemoteDelete(id);
-    else if (name === "environments") await environmentStore.applyRemoteDelete(id);
-    else await projectStore.applyRemoteDelete(id);
+    if (name === "services") {
+      await serviceStore.applyRemoteDelete(id);
+      return;
+    }
+    if (name === "environments") {
+      await environmentStore.applyRemoteDelete(id);
+      return;
+    }
+    const refusal = this.refusalFor(id);
+    if (refusal) {
+      console.error(
+        "[cloud-sync] project %s refused by the cloud for org %s (%s) \u2014 kept on disk, no longer pushed",
+        id,
+        this.link.orgId,
+        refusal
+      );
+      this.tracked.delete(id);
+      return;
+    }
+    await projectStore.applyRemoteDelete({ id, orgId: this.link.orgId });
+  }
+  /** Le motif du refus du cloud pour ce projet, s'il en a écrit un. */
+  refusalFor(projectId) {
+    const entry = this.doc.getMap("projectRefusals").get(projectId);
+    if (!entry || typeof entry !== "object") return null;
+    const reason = entry.reason;
+    return typeof reason === "string" ? reason : "refused";
   }
   async bootstrapEnvironment(projectId) {
     try {
@@ -12603,8 +13056,8 @@ var OrgSyncConnection = class {
         description: "Default local environment (immutable)",
         parentIds: [],
         immutable: true
-      });
-      await projectStore.addEnvironment(projectId, localEnv.id);
+      }, this.link.orgId);
+      await projectStore.addEnvironment({ id: projectId, orgId: this.link.orgId }, localEnv.id);
     } catch (err) {
       console.error("[cloud-sync] env bootstrap failed for project %s:", projectId, err.message);
     }
@@ -12627,7 +13080,7 @@ var OrgSyncConnection = class {
    */
   async reconcileLocalToDoc() {
     if (this.stopped || this.pulling) return;
-    const projects = await projectStore.listDiskFormByOrg(this.link.orgId);
+    const projects = (await projectStore.listDiskFormByOrg(this.link.orgId)).filter((p) => !this.refusalFor(p.id));
     const projectIds = projects.map((p) => p.id);
     const serviceIds = [...new Set(projects.flatMap((p) => p.serviceIds ?? []))];
     const [services, environments] = await Promise.all([
@@ -12777,8 +13230,8 @@ var cloudSyncBridge = new CloudSyncBridge();
 
 // ../server/src/services/master-password.ts
 import { randomBytes as randomBytes4, createCipheriv, createDecipheriv } from "crypto";
-import { readFile as readFile16, writeFile as writeFile15, chmod as chmod10, stat as stat5, rename as rename12 } from "fs/promises";
-import { join as join16 } from "path";
+import { readFile as readFile17, writeFile as writeFile16, chmod as chmod11, stat as stat6, rename as rename13 } from "fs/promises";
+import { join as join18 } from "path";
 import { Entry } from "@napi-rs/keyring";
 import { hashRaw as argon2HashRaw } from "@node-rs/argon2";
 var KEYRING_SERVICE = "runeya";
@@ -12790,9 +13243,9 @@ var CANARY_PLAINTEXT = "runeya:v1:key-verification";
 var MAX_KEY_FILE_SIZE = 1024;
 var ARGON2_OPTIONS = { memoryCost: 65536, timeCost: 3, parallelism: 4, outputLen: 32 };
 async function readKeyFile(filePath) {
-  const s = await stat5(filePath);
+  const s = await stat6(filePath);
   if (s.size > MAX_KEY_FILE_SIZE) throw new Error(`Fichier suspect : ${filePath} (${s.size} octets)`);
-  return readFile16(filePath);
+  return readFile17(filePath);
 }
 function aesEncrypt(key, plaintext) {
   const iv = randomBytes4(12);
@@ -12811,7 +13264,7 @@ function aesDecrypt(key, data) {
 }
 async function getPepperFromFile(dataDir) {
   try {
-    const raw = await readKeyFile(join16(dataDir, PEPPER_FILENAME));
+    const raw = await readKeyFile(join18(dataDir, PEPPER_FILENAME));
     const hex = raw.toString("utf-8").trim();
     if (/^[0-9a-f]{64}$/i.test(hex)) return Buffer.from(hex, "hex");
   } catch {
@@ -12819,11 +13272,11 @@ async function getPepperFromFile(dataDir) {
   return null;
 }
 async function writePepperToFile(dataDir, pepper) {
-  const filePath = join16(dataDir, PEPPER_FILENAME);
+  const filePath = join18(dataDir, PEPPER_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile15(tmpPath, pepper.toString("hex"), "utf-8");
-  await chmod10(tmpPath, 384);
-  await rename12(tmpPath, filePath);
+  await writeFile16(tmpPath, pepper.toString("hex"), "utf-8");
+  await chmod11(tmpPath, 384);
+  await rename13(tmpPath, filePath);
 }
 function tryKeyringGet() {
   try {
@@ -12870,14 +13323,14 @@ async function writeEncryptedKey(dataDir, masterPassword, encryptionKey) {
   const payload = aesEncrypt(derivedKey, encryptionKey);
   const fileContent = Buffer.concat([salt, payload]);
   const encoded = fileContent.toString("base64");
-  const filePath = join16(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile15(tmpPath, encoded, "utf-8");
-  await chmod10(tmpPath, 384);
-  await rename12(tmpPath, filePath);
+  await writeFile16(tmpPath, encoded, "utf-8");
+  await chmod11(tmpPath, 384);
+  await rename13(tmpPath, filePath);
 }
 async function readEncryptedKey(dataDir, masterPassword) {
-  const filePath = join16(dataDir, ENCRYPTED_KEY_FILENAME);
+  const filePath = join18(dataDir, ENCRYPTED_KEY_FILENAME);
   const raw = await readKeyFile(filePath);
   const fileContent = Buffer.from(raw.toString("utf-8").trim(), "base64");
   const salt = fileContent.subarray(0, 16);
@@ -12897,13 +13350,13 @@ async function getPepperFromKeychain(dataDir) {
 }
 async function writeVerifyFile(dataDir, encryptionKey) {
   const payload = aesEncrypt(encryptionKey, Buffer.from(CANARY_PLAINTEXT, "utf-8"));
-  const filePath = join16(dataDir, VERIFY_FILENAME);
+  const filePath = join18(dataDir, VERIFY_FILENAME);
   const tmpPath = filePath + ".tmp";
-  await writeFile15(tmpPath, payload.toString("base64"), "utf-8");
-  await rename12(tmpPath, filePath);
+  await writeFile16(tmpPath, payload.toString("base64"), "utf-8");
+  await rename13(tmpPath, filePath);
 }
 async function verifyEncryptionKey(dataDir, encryptionKey) {
-  const filePath = join16(dataDir, VERIFY_FILENAME);
+  const filePath = join18(dataDir, VERIFY_FILENAME);
   const raw = await readKeyFile(filePath);
   if (!matchesCanary(raw.toString("utf-8"), encryptionKey)) {
     throw new Error("Cl\xE9 d'encryption incorrecte");
@@ -12919,14 +13372,14 @@ function matchesCanary(canaryBase64, encryptionKey) {
 }
 async function readVerifyFile(dataDir) {
   try {
-    return (await readKeyFile(join16(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
+    return (await readKeyFile(join18(dataDir, VERIFY_FILENAME))).toString("utf-8").trim();
   } catch {
     return null;
   }
 }
 async function hasVerifyFile(dataDir) {
   try {
-    await stat5(join16(dataDir, VERIFY_FILENAME));
+    await stat6(join18(dataDir, VERIFY_FILENAME));
     return true;
   } catch {
     return false;
@@ -12934,7 +13387,7 @@ async function hasVerifyFile(dataDir) {
 }
 async function hasEncryptedKeyFile(dataDir) {
   try {
-    await stat5(join16(dataDir, ENCRYPTED_KEY_FILENAME));
+    await stat6(join18(dataDir, ENCRYPTED_KEY_FILENAME));
     return true;
   } catch {
     return false;
@@ -12942,6 +13395,20 @@ async function hasEncryptedKeyFile(dataDir) {
 }
 
 // ../server/src/trpc/routers/cloud-sync.ts
+async function cloudMessage(res) {
+  try {
+    const body = await res.text();
+    if (!body) return "";
+    try {
+      const parsed = JSON.parse(body);
+      if (typeof parsed.message === "string") return parsed.message;
+    } catch {
+    }
+    return body.slice(0, 300);
+  } catch {
+    return "";
+  }
+}
 async function reconcileOrgCanary(orgId) {
   const key = getEncryptionKey();
   if (!key) {
@@ -13016,8 +13483,15 @@ var cloudSyncRouter = router({
       const link = await cloudSyncStore.get(input.orgId);
       if (link) await cloudSyncBridge.connect(link);
     }
-    const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
-    return { pulled, state: syncState(input.orgId) };
+    try {
+      const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
+      return { pulled, state: syncState(input.orgId) };
+    } catch (err) {
+      if (err instanceof ProjectHeldElsewhereError) {
+        throw new TRPCError20({ code: "CONFLICT", message: err.code, cause: err });
+      }
+      throw err;
+    }
   }),
   /**
    * Stop materializing one project of an org on this machine.
@@ -13034,6 +13508,47 @@ var cloudSyncRouter = router({
     await cloudSyncBridge.unfollowProject(input.orgId, input.projectId);
     return { success: true };
   }),
+  /**
+   * Retirer un projet de l'organisation — pour tous ses membres.
+   *
+   * À ne pas confondre avec `untrackProject`, qui ne concerne que cette
+   * machine. Ici le projet quitte l'organisation : il disparaît pour chaque
+   * membre, et le cloud rend son identifiant. La suppression locale n'est pas
+   * faite ici : elle arrive par la synchronisation, comme pour tout autre
+   * membre, ce qui évite d'effacer les fichiers si le cloud a refusé l'ordre.
+   */
+  deleteProjectFromOrg: protectedProcedure.input(
+    z24.object({
+      orgId: z24.string().min(1).max(128),
+      projectId: z24.string().min(1).max(128)
+    })
+  ).mutation(async ({ input }) => {
+    let res;
+    try {
+      res = await cloudFetch("/api/auth/project/delete", {
+        method: "POST",
+        body: { organizationId: input.orgId, projectId: input.projectId }
+      });
+    } catch (err) {
+      if (err instanceof TRPCError20 && err.code === "PRECONDITION_FAILED") {
+        throw new TRPCError20({ code: "PRECONDITION_FAILED", message: "CLOUD_NOT_LINKED" });
+      }
+      throw err;
+    }
+    if (res.ok) return { success: true };
+    const detail = await cloudMessage(res);
+    if (res.status === 403) {
+      const code = /not a member/i.test(detail) ? "PROJECT_NOT_MEMBER" : "PROJECT_DELETE_FORBIDDEN";
+      throw new TRPCError20({ code: "FORBIDDEN", message: code, cause: new Error(detail) });
+    }
+    if (res.status === 404) {
+      throw new TRPCError20({ code: "NOT_FOUND", message: "PROJECT_NOT_IN_ORG", cause: new Error(detail) });
+    }
+    throw new TRPCError20({
+      code: "BAD_GATEWAY",
+      message: detail || `PROJECT_DELETE_FAILED (${res.status})`
+    });
+  }),
   /** Stop syncing an org and forget its token. */
   unlink: protectedProcedure.input(z24.object({ orgId: z24.string().min(1).max(128) })).mutation(async ({ input }) => {
     cloudSyncBridge.disconnect(input.orgId);
@@ -13056,6 +13571,104 @@ var cloudSyncRouter = router({
       // borne est exclusive — il faut strictement plus récent que ce numéro.
       lastIncompatibleVersion: states.get(l.orgId)?.lastIncompatibleVersion ?? null
     }));
+  }),
+  /**
+   * The cloud instance behind every org vault on this machine.
+   *
+   * Wider than `list`, which only sees the links of the directory this server
+   * was launched in: org vaults are shared machine-wide, so a project can very
+   * well belong to an org linked from another directory — or from another cloud
+   * entirely.
+   */
+  orgClouds: protectedProcedure.query(async () => {
+    const clouds = await readOrgClouds();
+    for (const l of await cloudSyncStore.list()) clouds[l.orgId] = l.cloudUrl;
+    return clouds;
+  })
+});
+
+// ../server/src/trpc/routers/filesystem.ts
+import { readdir as readdir7, stat as stat7 } from "fs/promises";
+import { homedir as homedir5 } from "os";
+import { isAbsolute as isAbsolute4, join as join19, resolve as resolve5, dirname as dirname9, basename as basename2 } from "path";
+import { z as z25 } from "zod";
+var MAX_ENTRIES = 500;
+var PATH_SCHEMA = z25.string().min(1).max(4096);
+function safeResolve(input) {
+  if (input.includes("\0")) throw new Error("Chemin invalide");
+  const expanded = input.startsWith("~") ? join19(homedir5(), input.slice(1)) : input;
+  if (!isAbsolute4(expanded)) throw new Error("Le chemin doit \xEAtre absolu");
+  return resolve5(expanded);
+}
+var filesystemRouter = router({
+  /** Where a picker should open when the user has chosen nothing yet. */
+  suggestedRoots: protectedProcedure.query(async () => {
+    const roots = [
+      { label: "home", path: homedir5() },
+      // The launch directory, taken from the vault rather than the process.
+      { label: "cwd", path: await resolveWorkspaceCwd({}) }
+    ];
+    const seen = /* @__PURE__ */ new Set();
+    return roots.filter((r) => !seen.has(r.path) && seen.add(r.path));
+  }),
+  /**
+   * The sub-directories of one directory.
+   *
+   * Hidden entries are skipped: they are noise for choosing a workspace, and
+   * `.runeya` itself would invite placing a project inside another's data.
+   */
+  listDirectories: protectedProcedure.input(z25.object({ path: PATH_SCHEMA })).query(async ({ input }) => {
+    const dir = safeResolve(input.path);
+    const info = await stat7(dir).catch(() => null);
+    if (!info?.isDirectory()) {
+      throw new Error(`Ce n'est pas un r\xE9pertoire : ${dir}`);
+    }
+    let names;
+    try {
+      names = (await readdir7(dir, { withFileTypes: true })).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name).sort((a, b) => a.localeCompare(b));
+    } catch {
+      throw new Error(`R\xE9pertoire illisible : ${dir}`);
+    }
+    const truncated = names.length > MAX_ENTRIES;
+    const entries = [];
+    for (const name of names.slice(0, MAX_ENTRIES)) {
+      const path = join19(dir, name);
+      entries.push({ name, path, hasRuneyaProject: await holdsRuneyaProject(path) });
+    }
+    return {
+      path: dir,
+      // Null at the filesystem root, which is what stops "up" from looping.
+      parent: dirname9(dir) === dir ? null : dirname9(dir),
+      name: basename2(dir) || dir,
+      entries,
+      truncated,
+      hasRuneyaProject: await holdsRuneyaProject(dir)
+    };
+  }),
+  /**
+   * Whether a directory can receive this project.
+   *
+   * Two projects in one directory is what makes services run against the wrong
+   * code, so a directory that already holds one is refused outright.
+   */
+  checkProjectTarget: protectedProcedure.input(z25.object({
+    path: PATH_SCHEMA,
+    projectId: z25.string().min(1).max(128),
+    orgId: z25.string().max(128).nullable().optional()
+  })).query(async ({ input }) => {
+    const dir = safeResolve(input.path);
+    const info = await stat7(dir).catch(() => null);
+    if (!info?.isDirectory()) {
+      return { ok: false, reason: "missing", path: dir, otherProjectId: null };
+    }
+    if (await holdsRuneyaProject(dir)) {
+      return { ok: false, reason: "has-runeya-project", path: dir, otherProjectId: null };
+    }
+    const otherProjectId = await projectPathStore.projectAt(dir, { id: input.projectId, orgId: input.orgId });
+    if (otherProjectId) {
+      return { ok: false, reason: "taken", path: dir, otherProjectId };
+    }
+    return { ok: true, reason: null, path: dir, otherProjectId: null };
   })
 });
 
@@ -13083,7 +13696,8 @@ var appRouter = router({
   wiki: wikiRouter,
   config: configRouter,
   cloudSync: cloudSyncRouter,
-  cloudAuth: cloudAuthRouter
+  cloudAuth: cloudAuthRouter,
+  filesystem: filesystemRouter
 });
 
 // ../server/src/middleware/error-handler.ts
@@ -13118,7 +13732,7 @@ var MigrationEngine = class {
 var migrationEngine = new MigrationEngine();
 
 // ../server/src/services/file-security.ts
-import { chmod as chmod11, stat as stat6 } from "fs/promises";
+import { chmod as chmod12, stat as stat8 } from "fs/promises";
 var SENSITIVE_FILES = [
   "agents.json",
   "settings.json",
@@ -13132,11 +13746,11 @@ async function ensureFilePermissions() {
   for (const filename of SENSITIVE_FILES) {
     for (const filepath of [machineFilePath(filename), legacyMachineFilePath(filename)]) {
       try {
-        const stats = await stat6(filepath);
+        const stats = await stat8(filepath);
         const mode = stats.mode & 511;
         if (mode !== SECURE_MODE) {
           console.warn("[security] File", filepath, "has mode", mode.toString(8) + ", fixing to 600");
-          await chmod11(filepath, SECURE_MODE);
+          await chmod12(filepath, SECURE_MODE);
         }
       } catch (err) {
         if (err.code !== "ENOENT") {
@@ -13147,19 +13761,129 @@ async function ensureFilePermissions() {
   }
 }
 
+// ../server/src/services/vault-migration.ts
+import { readdir as readdir8, readFile as readFile18, writeFile as writeFile17, mkdir as mkdir20, copyFile, unlink as unlink5, rename as rename14, stat as stat9 } from "fs/promises";
+import { join as join20 } from "path";
+var KEY_FILES = [".encryption.key.enc", ".runeya-verify"];
+var MACHINE_FILES = [
+  "agents.json",
+  "cloud-session.json",
+  "conversations.private.json",
+  "api-keys.json",
+  "api-keys.private.json",
+  "settings.private.json"
+];
+function rekeyValue(value, from, to, counter) {
+  if (typeof value === "string") {
+    if (!isEncryptedValue(value)) return value;
+    let plaintext;
+    try {
+      plaintext = decryptValueWith(from, value);
+    } catch {
+      return value;
+    }
+    counter.n += 1;
+    return encryptValueWith(to, plaintext);
+  }
+  if (Array.isArray(value)) return value.map((v) => rekeyValue(v, from, to, counter));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = rekeyValue(v, from, to, counter);
+    }
+    return out;
+  }
+  return value;
+}
+async function vaultJsonFiles(root) {
+  const entries = await readdir8(root, { withFileTypes: true });
+  return entries.filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => e.name);
+}
+async function exists(path) {
+  try {
+    await stat9(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function openLegacyVault(legacyRoot, masterPassword) {
+  const key = await readEncryptedKey(legacyRoot, masterPassword);
+  await verifyEncryptionKey(legacyRoot, key);
+  return key;
+}
+async function migrateLegacyVault(legacyRoot, machineRootDir, legacyKey, machineKey, now) {
+  const stamp = now.toISOString().replace(/[:.]/g, "-").substring(0, 19);
+  const backupDir = join20(legacyRoot, `backup-${stamp}`);
+  await mkdir20(backupDir, { recursive: true });
+  const jsonFiles = await vaultJsonFiles(legacyRoot);
+  for (const name of [...jsonFiles, ...KEY_FILES]) {
+    if (await exists(join20(legacyRoot, name))) {
+      await copyFile(join20(legacyRoot, name), join20(backupDir, name));
+    }
+  }
+  const rekeyed = [];
+  for (const name of jsonFiles) {
+    const raw = await readFile18(join20(legacyRoot, name), "utf-8");
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const counter = { n: 0 };
+    const converted = rekeyValue(parsed, legacyKey, machineKey, counter);
+    if (counter.n === 0) continue;
+    const tmp = join20(legacyRoot, `${name}.tmp`);
+    await writeFile17(tmp, JSON.stringify(converted, null, 2), "utf-8");
+    await rename14(tmp, join20(legacyRoot, name));
+    rekeyed.push({ file: name, values: counter.n });
+  }
+  for (const { file, values } of rekeyed) {
+    const parsed = JSON.parse(await readFile18(join20(legacyRoot, file), "utf-8"));
+    const check = { n: 0 };
+    rekeyValue(parsed, machineKey, machineKey, check);
+    if (check.n !== values) {
+      throw new Error(
+        `V\xE9rification \xE9chou\xE9e pour ${file} : ${check.n} valeur(s) relisible(s) avec la cl\xE9 machine, ${values} attendue(s)`
+      );
+    }
+  }
+  await mkdir20(machineRootDir, { recursive: true });
+  const moved = [];
+  const skipped = [];
+  for (const name of MACHINE_FILES) {
+    const from = join20(legacyRoot, name);
+    if (!await exists(from)) continue;
+    const to = join20(machineRootDir, name);
+    if (await exists(to)) {
+      skipped.push(name);
+      continue;
+    }
+    await copyFile(from, to);
+    await unlink5(from);
+    moved.push(name);
+  }
+  for (const name of KEY_FILES) {
+    const path = join20(legacyRoot, name);
+    if (await exists(path)) await unlink5(path);
+  }
+  return { backupDir, rekeyed, moved, skipped };
+}
+
 // ../server/src/migrations/migrate-from-legacy.ts
 import { createRequire } from "module";
 import { randomBytes as randomBytes5, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
 import { randomUUID as randomUUID12 } from "crypto";
 import {
-  readFile as readFile17,
-  writeFile as writeFile16,
-  rename as rename13,
-  mkdir as mkdir19,
+  readFile as readFile19,
+  writeFile as writeFile18,
+  rename as rename15,
+  mkdir as mkdir21,
   access as access2,
-  readdir as readdir7
+  readdir as readdir9
 } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join21, dirname as dirname10 } from "path";
 var _require = createRequire(import.meta.url);
 var PARSER_ID_MAP = {
   "stack-monitor-parser-jsons": "native:json",
@@ -13268,7 +13992,7 @@ async function getSodium() {
   return _sodium;
 }
 async function decryptLegacyFile(filePath, key, sodium) {
-  const raw = (await readFile17(filePath, "utf-8")).trim();
+  const raw = (await readFile19(filePath, "utf-8")).trim();
   if (!raw || raw === "[]" || raw === "{}") {
     try {
       return JSON.parse(raw);
@@ -13288,14 +14012,12 @@ async function decryptLegacyFile(filePath, key, sodium) {
 }
 async function atomicWrite(path, data) {
   const tmp = path + ".tmp";
-  await writeFile16(tmp, JSON.stringify(data, null, 2), "utf-8");
-  await rename13(tmp, path);
+  await writeFile18(tmp, JSON.stringify(data, null, 2), "utf-8");
+  await rename15(tmp, path);
 }
 async function runLegacyMigration(dataDir) {
-  const { resolve: resolve6 } = await import("path");
-  const abCwd = resolve6(process.cwd());
-  const legacyRoot = join17(abCwd, env.DATA_DIR);
-  const legacyKeyPath = join17(legacyRoot, "dbs", "encryption-key.json");
+  const legacyRoot = env.DATA_DIR;
+  const legacyKeyPath = join21(legacyRoot, "dbs", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
   } catch {
@@ -13303,20 +14025,20 @@ async function runLegacyMigration(dataDir) {
   }
   console.log("[legacy-migration] Legacy Runeya data detected, starting migration\u2026");
   const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-").substring(0, 19);
-  const legacyTmp = join17(abCwd, ".runeya-tmp");
-  await rename13(legacyRoot, legacyTmp);
-  await mkdir19(dataDir, { recursive: true });
-  const legacyOld = join17(dataDir, `backup-${timestamp}`);
-  await rename13(legacyTmp, legacyOld);
+  const legacyTmp = join21(abCwd, ".runeya-tmp");
+  await rename15(legacyRoot, legacyTmp);
+  await mkdir21(dataDir, { recursive: true });
+  const legacyOld = join21(dataDir, `backup-${timestamp}`);
+  await rename15(legacyTmp, legacyOld);
   console.log(`[legacy-migration] Legacy data backed up to ${legacyOld}`);
-  const keyJson = JSON.parse(await readFile17(join17(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
+  const keyJson = JSON.parse(await readFile19(join21(legacyOld, "dbs", "encryption-key.json"), "utf-8"));
   const sodium = await getSodium();
   const sodiumKey = sodium.from_base64(keyJson.encryptionKey);
   const keyBuffer = Buffer.from(sodiumKey);
   const runyeaKeyHex = keyBuffer.toString("hex");
   await setEncryptionKey(runyeaKeyHex);
   console.log("[legacy-migration] Encryption key loaded in memory (temporary)");
-  const dbsDir = join17(legacyOld, "dbs");
+  const dbsDir = join21(legacyOld, "dbs");
   async function readEncrypted(filePath) {
     try {
       return await decryptLegacyFile(filePath, sodiumKey, sodium);
@@ -13325,29 +14047,29 @@ async function runLegacyMigration(dataDir) {
       return null;
     }
   }
-  const envsDir = join17(dbsDir, "envs");
-  const envFiles = (await readdir7(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const envsDir = join21(dbsDir, "envs");
+  const envFiles = (await readdir9(envsDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyEnvs = {};
   for (const file of envFiles) {
     const name = file.replace(".encrypted.json", "");
-    legacyEnvs[name] = await readEncrypted(join17(envsDir, file));
+    legacyEnvs[name] = await readEncrypted(join21(envsDir, file));
   }
-  const servicesDir = join17(dbsDir, "services");
-  const serviceFiles = (await readdir7(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const servicesDir = join21(dbsDir, "services");
+  const serviceFiles = (await readdir9(servicesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServices = {};
   for (const file of serviceFiles) {
     const name = file.replace(".encrypted.json", "");
     if (!name) continue;
-    const data = await readEncrypted(join17(servicesDir, file));
+    const data = await readEncrypted(join21(servicesDir, file));
     if (data?.label) legacyServices[name] = data;
   }
-  const overridesDir = join17(dbsDir, "overrides");
-  const overrideFiles = (await readdir7(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const overridesDir = join21(dbsDir, "overrides");
+  const overrideFiles = (await readdir9(overridesDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyServiceOverrides = {};
   const legacyEnvOverrides = {};
   for (const file of overrideFiles) {
     const baseName = file.replace(".encrypted.json", "");
-    const data = await readEncrypted(join17(overridesDir, file));
+    const data = await readEncrypted(join21(overridesDir, file));
     if (!data) continue;
     if (baseName.endsWith("-envs")) {
       legacyServiceOverrides[baseName.slice(0, -5)] = data;
@@ -13355,11 +14077,11 @@ async function runLegacyMigration(dataDir) {
       legacyEnvOverrides[baseName.slice(0, -12)] = data;
     }
   }
-  const parsersDir = join17(dbsDir, "parsers");
-  const parserFiles = (await readdir7(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
+  const parsersDir = join21(dbsDir, "parsers");
+  const parserFiles = (await readdir9(parsersDir).catch(() => [])).filter((f) => f.endsWith(".encrypted.json"));
   const legacyParsers = [];
   for (const file of parserFiles) {
-    const data = await readEncrypted(join17(parsersDir, file));
+    const data = await readEncrypted(join21(parsersDir, file));
     if (data?.id) legacyParsers.push(data);
   }
   const projectMonoId = randomUUID12();
@@ -13700,7 +14422,7 @@ async function runLegacyMigration(dataDir) {
   }
   let existingSettings = {};
   try {
-    existingSettings = JSON.parse(await readFile17(join17(dataDir, "settings.json"), "utf-8"));
+    existingSettings = JSON.parse(await readFile19(join21(dataDir, "settings.json"), "utf-8"));
   } catch {
   }
   const migratedParsers = legacyParsers.map((p) => ({
@@ -13721,11 +14443,11 @@ ${p.transform ?? ""}`,
       ...migratedParsers
     ]
   };
-  await atomicWrite(join17(dataDir, "projects.json"), runeProjects);
-  await atomicWrite(join17(dataDir, "services.json"), runeServices);
-  await atomicWrite(join17(dataDir, "environments.json"), runeEnvs);
-  await atomicWrite(join17(dataDir, "environment-overrides.json"), flatOverrides);
-  await atomicWrite(join17(dataDir, "settings.json"), newSettings);
+  await atomicWrite(join21(dataDir, "projects.json"), runeProjects);
+  await atomicWrite(join21(dataDir, "services.json"), runeServices);
+  await atomicWrite(join21(dataDir, "environments.json"), runeEnvs);
+  await atomicWrite(join21(dataDir, "environment-overrides.json"), flatOverrides);
+  await atomicWrite(join21(dataDir, "settings.json"), newSettings);
   const svcEnvCount = runeEnvs.filter((e) => e.scope === "service").length;
   console.log(`[legacy-migration] Written: ${runeProjects.length} projects, ${runeServices.length} services, ${runeEnvs.length} environments (${svcEnvCount} service-scoped)`);
   console.log(`[legacy-migration] Overrides: ${Object.keys(flatOverrides).length}, custom parsers: ${migratedParsers.length} (all disabled \u2014 rewrite required)`);
@@ -13736,12 +14458,12 @@ ${p.transform ?? ""}`,
 }
 async function findLegacyKeyInBackup(dataDir) {
   try {
-    const entries = await readdir7(dataDir);
+    const entries = await readdir9(dataDir);
     const backupDirs = entries.filter((e) => e.startsWith("backup-")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0).reverse();
     for (const dir of backupDirs) {
-      const keyJsonPath = join17(dataDir, dir, "dbs", "encryption-key.json");
+      const keyJsonPath = join21(dataDir, dir, "dbs", "encryption-key.json");
       try {
-        const raw = await readFile17(keyJsonPath, "utf-8");
+        const raw = await readFile19(keyJsonPath, "utf-8");
         const parsed = JSON.parse(raw);
         if (!parsed.encryptionKey) continue;
         const sodium = await getSodium();
@@ -13759,18 +14481,17 @@ async function findLegacyKeyInBackup(dataDir) {
   return null;
 }
 async function runOverrideOnlyMigration(dataDir) {
-  const { resolve: resolve6 } = await import("path");
-  const abDataDir = resolve6(dataDir);
-  const abCwd = resolve6(process.cwd());
+  const { resolve: resolve7 } = await import("path");
+  const abDataDir = resolve7(dataDir);
   const candidateDirs = [
-    join17(abCwd, ".runeya", "dbs", "overrides"),
-    join17(abDataDir, "dbs", "overrides")
+    join21(dirname10(env.DATA_DIR), ".runeya", "dbs", "overrides"),
+    join21(abDataDir, "dbs", "overrides")
   ];
   let overridesDir = null;
   let overrideFiles = [];
   for (const dir of candidateDirs) {
     try {
-      const files = (await readdir7(dir)).filter((f) => f.endsWith(".encrypted.json"));
+      const files = (await readdir9(dir)).filter((f) => f.endsWith(".encrypted.json"));
       if (files.length > 0) {
         overridesDir = dir;
         overrideFiles = files;
@@ -13780,7 +14501,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (!overridesDir || overrideFiles.length === 0) return false;
-  const legacyKeyPath = join17(overridesDir, "..", "encryption-key.json");
+  const legacyKeyPath = join21(overridesDir, "..", "encryption-key.json");
   try {
     await access2(legacyKeyPath);
     return false;
@@ -13798,7 +14519,7 @@ async function runOverrideOnlyMigration(dataDir) {
   const envNameToId = {};
   let envsRaw;
   try {
-    envsRaw = JSON.parse(await readFile17(join17(abDataDir, "environments.json"), "utf-8"));
+    envsRaw = JSON.parse(await readFile19(join21(abDataDir, "environments.json"), "utf-8"));
     for (const _env of envsRaw) {
       const env2 = _env;
       if (env2["name"] && env2["id"]) {
@@ -13817,7 +14538,7 @@ async function runOverrideOnlyMigration(dataDir) {
   let servicesRaw = [];
   const serviceNameToId = {};
   try {
-    servicesRaw = JSON.parse(await readFile17(join17(abDataDir, "services.json"), "utf-8"));
+    servicesRaw = JSON.parse(await readFile19(join21(abDataDir, "services.json"), "utf-8"));
     for (const _svc of servicesRaw) {
       const svc = _svc;
       if (svc["name"] && svc["id"]) serviceNameToId[svc["name"]] = svc["id"];
@@ -13834,7 +14555,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const envName = baseName.slice(0, -"-environment".length);
     let data;
     try {
-      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13861,7 +14582,7 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (Object.keys(flatOverrides).length > 0) {
-    await atomicWrite(join17(abDataDir, "environment-overrides.json"), flatOverrides);
+    await atomicWrite(join21(abDataDir, "environment-overrides.json"), flatOverrides);
     console.log(`[override-migration] Written ${Object.keys(flatOverrides).length} override(s) to environment-overrides.json`);
   }
   let envsModified = false;
@@ -13871,7 +14592,7 @@ async function runOverrideOnlyMigration(dataDir) {
     const serviceName = baseName.slice(0, -"-envs".length);
     let data;
     try {
-      data = await decryptLegacyFile(join17(overridesDir, file), sodiumKey, sodium);
+      data = await decryptLegacyFile(join21(overridesDir, file), sodiumKey, sodium);
     } catch (err) {
       console.warn(`[override-migration] Failed to decrypt ${file}: ${err.message}`);
       continue;
@@ -13930,12 +14651,12 @@ async function runOverrideOnlyMigration(dataDir) {
     }
   }
   if (envsModified) {
-    await atomicWrite(join17(abDataDir, "environments.json"), envsRaw);
+    await atomicWrite(join21(abDataDir, "environments.json"), envsRaw);
     console.log("[override-migration] Merged service overrides into environments.json");
   }
   const migratedDir = overridesDir.replace(/overrides$/, "overrides-migrated");
   try {
-    await rename13(overridesDir, migratedDir);
+    await rename15(overridesDir, migratedDir);
     console.log(`[override-migration] Moved overrides/ \u2192 overrides-migrated/`);
   } catch (err) {
     console.warn(`[override-migration] Could not rename overrides dir: ${err.message}`);
@@ -13945,8 +14666,8 @@ async function runOverrideOnlyMigration(dataDir) {
 }
 
 // ../server/src/services/server-state.ts
-import { join as join18 } from "path";
-import { stat as stat7 } from "fs/promises";
+import { join as join22 } from "path";
+import { stat as stat10 } from "fs/promises";
 var ENCRYPTED_KEY_FILENAME2 = ".encryption.key.enc";
 var VERIFY_FILENAME2 = ".runeya-verify";
 async function getServerState() {
@@ -13955,36 +14676,43 @@ async function getServerState() {
   let hasVerify = false;
   let hasData = false;
   try {
-    await stat7(join18(dataDir, ENCRYPTED_KEY_FILENAME2));
+    await stat10(join22(dataDir, ENCRYPTED_KEY_FILENAME2));
     hasEncFile = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, VERIFY_FILENAME2));
+    await stat10(join22(dataDir, VERIFY_FILENAME2));
     hasVerify = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, "projects.json"));
+    await stat10(join22(dataDir, "projects.json"));
     hasData = true;
   } catch {
   }
   try {
-    await stat7(join18(dataDir, "project.json"));
+    await stat10(join22(dataDir, "project.json"));
     hasData = true;
   } catch {
   }
   if (hasEncryptionKey()) {
-    return { state: "unlocked", hasVerifyFile: false, isLegacyMigration: false, hasExistingData: hasData };
+    return {
+      state: "unlocked",
+      hasVerifyFile: false,
+      isLegacyMigration: false,
+      hasExistingData: hasData,
+      legacyVault: await legacyVaultRoot()
+    };
   }
   if (hasEncFile) {
-    return { state: "locked", hasVerifyFile: hasVerify, isLegacyMigration: false, hasExistingData: hasData };
+    return { state: "locked", hasVerifyFile: hasVerify, isLegacyMigration: false, hasExistingData: hasData, legacyVault: null };
   }
   return {
     state: "setup",
     hasVerifyFile: hasVerify,
     isLegacyMigration: hasPendingLegacyKey(),
-    hasExistingData: hasData
+    hasExistingData: hasData,
+    legacyVault: null
   };
 }
 
@@ -14368,7 +15096,7 @@ async function createLocalServer() {
       console.log("[server] Premier lancement \u2014 setup requis");
     }
   }
-  const absoluteDataDir = resolve5(env.DATA_DIR);
+  const absoluteDataDir = resolve6(env.DATA_DIR);
   console.log(`[server] Local project directory: ${absoluteDataDir}`);
   console.log(`[server] Machine directory: ${machineRoot()}`);
   if (existsSync2(env.DATA_DIR)) {
@@ -14416,9 +15144,10 @@ async function createLocalServer() {
           parentIds: [],
           color: "#22c55e",
           immutable: true
-        });
+        }, project.orgId);
         await projectStore.update({
           id: project.id,
+          orgId: project.orgId,
           environmentIds: [localEnv.id],
           activeEnvironmentId: localEnv.id
         });
@@ -14730,6 +15459,48 @@ async function createLocalServer() {
       }
     }
   });
+  app.post("/api/migrate-vault", authLimiter, csrfMiddleware, express.json({ limit: "10kb" }), async (req, res) => {
+    try {
+      const jwt = typeof req.headers.authorization === "string" && req.headers.authorization.startsWith("Bearer ") ? req.headers.authorization.slice(7) : "";
+      if (!isCiMode()) {
+        try {
+          await verifyJwt(jwt);
+        } catch {
+          res.status(401).json({ error: "Session invalide" });
+          return;
+        }
+      }
+      const machineKey = getEncryptionKey();
+      if (!machineKey) {
+        res.status(409).json({ error: "Serveur verrouill\xE9" });
+        return;
+      }
+      const legacyRoot = await legacyVaultRoot();
+      if (!legacyRoot) {
+        res.status(409).json({ error: "Aucun coffre \xE0 migrer dans ce r\xE9pertoire" });
+        return;
+      }
+      const body = req.body;
+      const masterPassword = body.masterPassword;
+      if (typeof masterPassword !== "string" || masterPassword.length < 1 || masterPassword.length > 1024) {
+        res.status(400).json({ error: "masterPassword invalide" });
+        return;
+      }
+      let legacyKey;
+      try {
+        legacyKey = await openLegacyVault(legacyRoot, masterPassword);
+      } catch {
+        res.status(401).json({ error: "Ancien master password incorrect" });
+        return;
+      }
+      const report = await migrateLegacyVault(legacyRoot, machineRoot(), legacyKey, machineKey, /* @__PURE__ */ new Date());
+      console.log(`[vault-migration] ${legacyRoot} migr\xE9 \u2014 sauvegarde : ${report.backupDir}`);
+      res.json(report);
+    } catch (err) {
+      console.error("[server] Vault migration error:", err);
+      res.status(500).json({ error: err instanceof Error ? err.message : "Erreur interne" });
+    }
+  });
   app.get("/:apikey/llms.txt", llmsLimiter, async (req, res) => {
     const apikey = Array.isArray(req.params["apikey"]) ? req.params["apikey"][0] : req.params["apikey"];
     if (!apikey || !/^[0-9a-f]{64}$/i.test(apikey)) {
@@ -14964,12 +15735,12 @@ async function createLocalServer() {
     ]);
     server.closeAllConnections();
     await Promise.race([
-      new Promise((resolve6) => wss.close(() => resolve6())),
-      new Promise((resolve6) => setTimeout(resolve6, 2e3))
+      new Promise((resolve7) => wss.close(() => resolve7())),
+      new Promise((resolve7) => setTimeout(resolve7, 2e3))
     ]);
     await Promise.race([
-      new Promise((resolve6) => server.close(() => resolve6())),
-      new Promise((resolve6) => setTimeout(resolve6, 2e3))
+      new Promise((resolve7) => server.close(() => resolve7())),
+      new Promise((resolve7) => setTimeout(resolve7, 2e3))
     ]);
     console.log("[server] Shutdown complete");
   };
@@ -14990,7 +15761,7 @@ var PullEnvError = class extends Error {
 };
 async function promptPassword() {
   process.stderr.write("Master password: ");
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     const stdin = process.stdin;
     const wasRaw = stdin.isRaw;
     if (stdin.isTTY) stdin.setRawMode(true);
@@ -15003,7 +15774,7 @@ async function promptPassword() {
         stdin.pause();
         stdin.removeListener("data", onData);
         process.stderr.write("\n");
-        resolve6(input);
+        resolve7(input);
       } else if (ch === "") {
         process.exit(1);
       } else if (ch === "\x7F" || ch === "\b") {
@@ -15066,7 +15837,7 @@ if (process.env["RUNEYA_DATA_DIR"]) {
   console.log(`[server] Working directory: ${resolved} (from RUNEYA_DATA_DIR)`);
 }
 function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500) {
-  return new Promise((resolve6, reject) => {
+  return new Promise((resolve7, reject) => {
     let attempts = 0;
     const wssErrorHandler = () => {
     };
@@ -15087,7 +15858,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
       server.listen(port, host, () => {
         server.removeListener("error", onError);
         wss?.removeListener("error", wssErrorHandler);
-        resolve6();
+        resolve7();
       });
     };
     tryListen();
@@ -15134,4 +15905,4 @@ export {
   createLocalServer,
   pullEnv
 };
-//# sourceMappingURL=src-7CJJBMY3.js.map
+//# sourceMappingURL=src-5QPLS5TQ.js.map