@runeya/runeya 2.0.51 → 2.0.52

package/agent-manager-FD2NGRIW.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-IHUELGIB.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-FD2NGRIW.js.map

package/{chunk-NVKGIBJN.js → chunk-IHUELGIB.js}

@@ -6,7 +6,7 @@ import { z as z21 } from "zod";
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
 import { readFile as readFile2, writeFile as writeFile2, rename, mkdir as mkdir2, chmod } from "fs/promises";
-import { dirname } from "path";
+import { dirname, join as join2 } from "path";
 
 // ../server/src/services/vault-resolver.ts
 import { join, sep } from "path";
@@ -118,6 +118,14 @@ async function readOrgClouds() {
   }
   return out;
 }
+async function listOrgVaults() {
+  const orgsDir = join(machineRoot(), "orgs");
+  try {
+    return (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
 async function listCloudVaults() {
   const orgsDir = join(machineRoot(), "orgs");
   const found = [];
@@ -283,64 +291,116 @@ var AgentStore = class {
   agents = /* @__PURE__ */ new Map();
   passthroughEnv = {};
   traefikConfigs = {};
+  /** Le propriétaire de chaque agent, d'après le coffre où il a été lu. */
+  owners = /* @__PURE__ */ new Map();
+  /**
+   * Tous les coffres rencontrés, y compris ceux devenus vides.
+   *
+   * Déduire cette liste des agents encore présents laisserait le dernier agent
+   * d'une organisation dans son fichier après suppression : plus personne pour
+   * désigner ce coffre, donc plus personne pour le réécrire.
+   */
+  knownOwners = /* @__PURE__ */ new Set([null]);
   loaded = false;
   /**
-   * Encrypted, so it lives beside the key that opens it — usually the machine
-   * root, but a launch directory owning its own key keeps both together.
+   * Le fichier d'un propriétaire donné.
+   *
+   * Pour la machine, il reste à côté de la clé qui l'ouvre (`keyedFilePath`) :
+   * lu sous une autre clé il se déchiffrerait en blancs, puis serait réécrit
+   * blanc. Pour une organisation, c'est son coffre — la clé, elle, répond
+   * toujours pour toute la machine.
    */
-  getFilePath() {
-    return keyedFilePath(FILENAME);
+  filePathFor(owner) {
+    if (owner === null) return keyedFilePath(FILENAME);
+    return Promise.resolve(join2(orgVaultRoot(owner), FILENAME));
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
     return legacyMachineFilePath(FILENAME);
   }
+  /** Ce qu'un fichier de coffre contient, ou null s'il n'y en a pas. */
+  async readOwnerFile(owner) {
+    const paths = owner === null ? [await this.filePathFor(null), this.getLegacyFilePath()] : [await this.filePathFor(owner)];
+    for (const path of paths) {
+      let raw;
+      try {
+        raw = await readFile2(path, "utf-8");
+      } catch {
+        continue;
+      }
+      try {
+        const data = JSON.parse(raw);
+        if (Array.isArray(data)) {
+          return { agents: data, passthroughEnv: {}, traefikConfigs: {} };
+        }
+        const fileData = data;
+        return {
+          agents: fileData.agents ?? [],
+          passthroughEnv: fileData.passthroughEnv ?? {},
+          traefikConfigs: fileData.traefikConfigs ?? {}
+        };
+      } catch {
+      }
+    }
+    return null;
+  }
   /**
-   * Read the machine file, falling back to the launch directory of old.
+   * Lire la machine puis chaque organisation présente sur ce disque.
    *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
+   * Les organisations sont relues du disque et non d'une liste tenue à part :
+   * un coffre qui existe est une organisation dont les agents comptent, et
+   * c'est déjà comme ça que la synchronisation décide de sa portée.
    */
-  async readFromDisk() {
-    try {
-      return await readFile2(await this.getFilePath(), "utf-8");
-    } catch {
-      return readFile2(this.getLegacyFilePath(), "utf-8");
-    }
-  }
-  async ensureDir() {
-    await mkdir2(dirname(await this.getFilePath()), { recursive: true });
-  }
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await this.readFromDisk();
-      const data = JSON.parse(raw);
-      if (Array.isArray(data)) {
-        for (const a of data) this.agents.set(a.id, a);
-        this.passthroughEnv = {};
-      } else {
-        const fileData = data;
-        for (const a of fileData.agents) this.agents.set(a.id, a);
-        this.passthroughEnv = fileData.passthroughEnv ?? {};
-        this.traefikConfigs = fileData.traefikConfigs ?? {};
+    const owners = [null, ...await listOrgVaults()];
+    for (const owner of owners) {
+      const data = await this.readOwnerFile(owner);
+      if (!data) continue;
+      this.knownOwners.add(owner);
+      for (const a of data.agents) {
+        this.agents.set(a.id, a);
+        this.owners.set(a.id, owner);
       }
-    } catch {
+      Object.assign(this.passthroughEnv, data.passthroughEnv);
+      Object.assign(this.traefikConfigs, data.traefikConfigs);
     }
     this.loaded = true;
   }
+  /**
+   * Réécrire chaque coffre concerné.
+   *
+   * Un agent emporte son `passthroughEnv` et sa configuration Traefik dans le
+   * fichier de son propriétaire : les laisser côté machine rendrait la portée
+   * mensongère — l'organisation partirait en laissant ses miettes derrière.
+   * Tous les coffres sont réécrits, y compris ceux devenus vides, sinon un
+   * agent déplacé subsisterait dans les deux.
+   */
   async save() {
-    await this.ensureDir();
-    const filePath = await this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const fileData = {
-      agents: Array.from(this.agents.values()),
-      passthroughEnv: this.passthroughEnv,
-      traefikConfigs: this.traefikConfigs
-    };
-    await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
-    await rename(tmpPath, filePath);
-    await chmod(filePath, 384);
+    const byOwner = /* @__PURE__ */ new Map();
+    for (const owner of this.knownOwners) byOwner.set(owner, []);
+    for (const agent of this.agents.values()) {
+      const owner = this.owners.get(agent.id) ?? null;
+      byOwner.set(owner, [...byOwner.get(owner) ?? [], agent]);
+    }
+    for (const [owner, agents] of byOwner) {
+      const ids = new Set(agents.map((a) => a.id));
+      const fileData = {
+        agents,
+        passthroughEnv: Object.fromEntries(
+          Object.entries(this.passthroughEnv).filter(([id]) => ids.has(id))
+        ),
+        traefikConfigs: Object.fromEntries(
+          Object.entries(this.traefikConfigs).filter(([id]) => ids.has(id))
+        )
+      };
+      const filePath = await this.filePathFor(owner);
+      await mkdir2(dirname(filePath), { recursive: true });
+      const tmpPath = filePath + ".tmp";
+      await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
+      await rename(tmpPath, filePath);
+      await chmod(filePath, 384);
+    }
   }
   toAgentConfig(stored) {
     return {
@@ -367,7 +427,7 @@ var AgentStore = class {
     if (!stored) return null;
     return this.toAgentConfig(stored);
   }
-  async register(name, url, passphrase) {
+  async register(name, url, passphrase, owner = null) {
     await this.load();
     const existing = Array.from(this.agents.values()).find((a) => a.url === url);
     const { encrypted, iv, authTag } = encrypt(passphrase);
@@ -382,6 +442,8 @@ var AgentStore = class {
     const id = randomUUID();
     const stored = { id, name, url, encrypted, iv, authTag };
     this.agents.set(id, stored);
+    this.owners.set(id, owner);
+    this.knownOwners.add(owner);
     await this.save();
     return { id, name, url, passphrase, passthroughEnv: [] };
   }
@@ -389,6 +451,7 @@ var AgentStore = class {
     await this.load();
     if (!this.agents.has(id)) return false;
     this.agents.delete(id);
+    this.owners.delete(id);
     delete this.passthroughEnv[id];
     delete this.traefikConfigs[id];
     await this.save();
@@ -440,7 +503,7 @@ var agentStore = new AgentStore();
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3, rm as rm2 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // ../server/src/services/project-key.ts
 function projectKey(ref) {
@@ -553,7 +616,7 @@ function isVaultConflicted(root) {
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2, rm } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
 import { randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
@@ -1948,7 +2011,7 @@ var EnvironmentStore = class {
    */
   roots = /* @__PURE__ */ new Map();
   getFilePath(root) {
-    return join2(root, FILENAME2);
+    return join3(root, FILENAME2);
   }
   /**
    * The vault an environment must be written to: its project's.
@@ -2465,7 +2528,7 @@ var ServiceStore = class {
   /** Which vault each service was read from, used until its project is known. */
   roots = /* @__PURE__ */ new Map();
   getFilePath(root) {
-    return join3(root, FILENAME3);
+    return join4(root, FILENAME3);
   }
   /**
    * The vault a service must be written to: the one of the project owning it.
@@ -2578,6 +2641,24 @@ var ServiceStore = class {
     await this.load();
     await this.save();
   }
+  /**
+   * Réattribuer l'organisation de services dont le projet vient de changer de
+   * coffre.
+   *
+   * Un service porte son `orgId` en propre : laissé à `null` après le passage
+   * du projet dans une organisation, il partirait dans le doc en se disant
+   * local. La sauvegarde qui suit les écrit dans leur nouveau coffre et les
+   * retire de l'ancien, le registre ayant déjà été mis à jour par le projet.
+   */
+  async reassignOrg(serviceIds, orgId) {
+    await this.load();
+    for (const id of serviceIds) {
+      const service = this.services.get(id);
+      if (service) this.services.set(id, { ...service, orgId });
+    }
+    await this.save();
+    this.notify();
+  }
   async list() {
     await this.load();
     return Array.from(this.services.values());
@@ -2736,28 +2817,81 @@ var serviceStore = new ServiceStore();
 import { spawn } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
+var POSIX_SAFE_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "LANG",
+  "TERM",
+  "NODE_ENV",
+  "TMPDIR",
+  "TZ",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+  // Needed so the agent can talk to the user's clipboard for the chat image-paste flow
+  // (xclip needs DISPLAY/XAUTHORITY, wl-copy needs WAYLAND_DISPLAY).
+  "DISPLAY",
+  "XAUTHORITY",
+  "WAYLAND_DISPLAY",
+  "XDG_SESSION_TYPE"
+];
+var WINDOWS_SAFE_KEYS = [
+  "PATH",
+  "PATHEXT",
+  "NODE_ENV",
+  "TZ",
+  "TERM",
+  // Interpreter + OS roots
+  "ComSpec",
+  "SystemRoot",
+  "SystemDrive",
+  "windir",
+  "OS",
+  "PSModulePath",
+  // User profile & app data (git config, credential helpers, npm/scoop shims)
+  "USERPROFILE",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "USERNAME",
+  "USERDOMAIN",
+  "USERDOMAIN_ROAMINGPROFILE",
+  "LOGONSERVER",
+  "APPDATA",
+  "LOCALAPPDATA",
+  // Machine-wide install roots
+  "ProgramData",
+  "ProgramFiles",
+  "ProgramFiles(x86)",
+  "ProgramW6432",
+  "CommonProgramFiles",
+  "CommonProgramFiles(x86)",
+  "CommonProgramW6432",
+  "ALLUSERSPROFILE",
+  "PUBLIC",
+  "DriverData",
+  // Temp
+  "TEMP",
+  "TMP",
+  // Architecture / CPU (used by installers and native module loaders)
+  "PROCESSOR_ARCHITECTURE",
+  "PROCESSOR_ARCHITEW6432",
+  "PROCESSOR_IDENTIFIER",
+  "PROCESSOR_LEVEL",
+  "PROCESSOR_REVISION",
+  "NUMBER_OF_PROCESSORS",
+  // Session / terminal
+  "SESSIONNAME",
+  "COMPUTERNAME",
+  "FPS_BROWSER_APP_PROFILE_STRING",
+  "FPS_BROWSER_USER_PROFILE_STRING",
+  "WT_SESSION",
+  "WT_PROFILE_ID"
+];
 function buildAgentEnv() {
-  const safeKeys = [
-    "PATH",
-    "HOME",
-    "USER",
-    "SHELL",
-    "LANG",
-    "TERM",
-    "NODE_ENV",
-    "TMPDIR",
-    "TZ",
-    "DBUS_SESSION_BUS_ADDRESS",
-    "XDG_RUNTIME_DIR",
-    // Needed so the agent can talk to the user's clipboard for the chat image-paste flow
-    // (xclip needs DISPLAY/XAUTHORITY, wl-copy needs WAYLAND_DISPLAY).
-    "DISPLAY",
-    "XAUTHORITY",
-    "WAYLAND_DISPLAY",
-    "XDG_SESSION_TYPE"
-  ];
+  const safeKeys = process.platform === "win32" ? WINDOWS_SAFE_KEYS : POSIX_SAFE_KEYS;
   const agentEnv = {
     RUNEYA_AGENT_PORT: String(env.RUNEYA_AGENT_PORT),
     RUNEYA_AGENT_HOST: env.RUNEYA_AGENT_HOST
@@ -2769,9 +2903,10 @@ function buildAgentEnv() {
     }
     agentEnv.PASSPHRASE_OVERRIDE = passphrase;
   }
-  for (const key of safeKeys) {
-    if (process.env[key]) {
-      agentEnv[key] = process.env[key];
+  const wanted = new Set(safeKeys.map((k) => k.toLowerCase()));
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value && wanted.has(key.toLowerCase())) {
+      agentEnv[key] = value;
     }
   }
   return agentEnv;
@@ -2794,7 +2929,7 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join4(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentDistPath = env.AGENT_BINARY_PATH || join5(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
     this.agentProcess = spawn("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
@@ -2897,7 +3032,7 @@ var AgentSpawner = class {
       this.fileWatcher.close();
     }
     console.log("[agent-spawner] \u{1F50D} Watching agent dist for changes (hot reload enabled)");
-    const distDir = join4(this.agentDistPath, "..");
+    const distDir = join5(this.agentDistPath, "..");
     this.fileWatcher = watch(distDir, { persistent: false }, (eventType, filename) => {
       if ((eventType === "change" || eventType === "rename") && filename === "index.js" && !this.isRestarting) {
         this.isRestarting = true;
@@ -3328,8 +3463,12 @@ var AgentManager = class extends EventEmitter2 {
       this.connectAgent(agent);
     }
   }
-  async register(name, url, passphrase) {
-    const config = await agentStore.register(name, url, passphrase);
+  /**
+   * `owner` dit à quelle organisation l'agent appartient, ou `null` pour la
+   * machine — l'agent local, qui n'exécute des processus que sur ce poste.
+   */
+  async register(name, url, passphrase, owner = null) {
+    const config = await agentStore.register(name, url, passphrase, owner);
     const isReRegistration = this.connections.has(config.id);
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering agent ${config.name} (${config.id})`);
@@ -3680,6 +3819,7 @@ export {
   vaultFor,
   stampOrgCloud,
   readOrgClouds,
+  listOrgVaults,
   listCloudVaults,
   allVaultRoots,
   machineFilePath,
@@ -3746,4 +3886,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-NVKGIBJN.js.map
+//# sourceMappingURL=chunk-IHUELGIB.js.map