@runeya/runeya 2.0.51 → 2.0.53

package/{chunk-NVKGIBJN.js → chunk-EL75GG7O.js}

@@ -6,7 +6,7 @@ import { z as z21 } from "zod";
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
 import { readFile as readFile2, writeFile as writeFile2, rename, mkdir as mkdir2, chmod } from "fs/promises";
-import { dirname } from "path";
+import { dirname, join as join2 } from "path";
 
 // ../server/src/services/vault-resolver.ts
 import { join, sep } from "path";
@@ -89,6 +89,15 @@ function projectVaultRoot(orgId, projectId) {
   assertSafeId("project", projectId);
   return join(orgVaultRoot(orgId), "projects", projectId);
 }
+function orgIdOfRoot(root) {
+  const marker = join(machineRoot(), "orgs") + sep;
+  if (!root.startsWith(marker)) return null;
+  const [orgId] = root.slice(marker.length).split(sep);
+  return orgId && SAFE_ID.test(orgId) ? orgId : null;
+}
+function vaultIdOfRoot(root) {
+  return orgIdOfRoot(root) ?? void 0;
+}
 function vaultFor(target) {
   if (!target.orgId) return { root: localVaultRoot() };
   return { root: projectVaultRoot(target.orgId, target.id) };
@@ -118,6 +127,14 @@ async function readOrgClouds() {
   }
   return out;
 }
+async function listOrgVaults() {
+  const orgsDir = join(machineRoot(), "orgs");
+  try {
+    return (await readdir(orgsDir, { withFileTypes: true })).filter((e) => e.isDirectory() && SAFE_ID.test(e.name)).map((e) => e.name);
+  } catch {
+    return [];
+  }
+}
 async function listCloudVaults() {
   const orgsDir = join(machineRoot(), "orgs");
   const found = [];
@@ -187,6 +204,7 @@ import { createHash } from "crypto";
 var KEY_SIZE_BYTES = 32;
 var DEFAULT_VAULT = "\0default";
 var keyring = /* @__PURE__ */ new Map();
+var lockedVaults = /* @__PURE__ */ new Set();
 var _ciMode = false;
 var _pendingLegacyKey = null;
 function isCiMode() {
@@ -223,16 +241,31 @@ function hasPendingLegacyKey() {
 function setEncryptionKeyInMemory(key, vault = DEFAULT_VAULT) {
   if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
   keyring.set(vault, key);
+  lockedVaults.delete(vault);
 }
 function clearEncryptionKey(vault) {
-  if (vault === void 0) keyring.clear();
-  else keyring.delete(vault);
+  if (vault === void 0) {
+    keyring.clear();
+    lockedVaults.clear();
+  } else {
+    keyring.delete(vault);
+  }
 }
 function hasEncryptionKey(vault = DEFAULT_VAULT) {
   return keyring.has(vault);
 }
 function getEncryptionKey(vault = DEFAULT_VAULT) {
-  return keyring.get(vault) ?? null;
+  const own = keyring.get(vault);
+  if (own) return own;
+  if (vault === DEFAULT_VAULT || lockedVaults.has(vault)) return null;
+  return keyring.get(DEFAULT_VAULT) ?? null;
+}
+function markVaultLocked(vault) {
+  lockedVaults.add(vault);
+  keyring.delete(vault);
+}
+function clearVaultLock(vault) {
+  lockedVaults.delete(vault);
 }
 function deriveStableSecret(purpose, vault = DEFAULT_VAULT) {
   const key = getEncryptionKey(vault);
@@ -250,8 +283,8 @@ async function setEncryptionKey(keyHex) {
 // ../server/src/services/agent-store.ts
 var FILENAME = "agents.json";
 var ALGORITHM = "aes-256-gcm";
-function encrypt(plaintext) {
-  const maybeKey = getEncryptionKey();
+function encrypt(plaintext, vault) {
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -263,11 +296,11 @@ function encrypt(plaintext) {
   const authTag = cipher.getAuthTag().toString("hex");
   return { encrypted: enc, iv: iv.toString("hex"), authTag };
 }
-function decrypt(encrypted, ivHex, authTagHex) {
+function decrypt(encrypted, ivHex, authTagHex, vault) {
   if (!/^[0-9a-f]+$/i.test(encrypted) || !/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex)) {
     throw new Error("Invalid hex string in encrypted agent data");
   }
-  const maybeKey = getEncryptionKey();
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -283,71 +316,129 @@ var AgentStore = class {
   agents = /* @__PURE__ */ new Map();
   passthroughEnv = {};
   traefikConfigs = {};
+  /** Le propriétaire de chaque agent, d'après le coffre où il a été lu. */
+  owners = /* @__PURE__ */ new Map();
+  /**
+   * Tous les coffres rencontrés, y compris ceux devenus vides.
+   *
+   * Déduire cette liste des agents encore présents laisserait le dernier agent
+   * d'une organisation dans son fichier après suppression : plus personne pour
+   * désigner ce coffre, donc plus personne pour le réécrire.
+   */
+  knownOwners = /* @__PURE__ */ new Set([null]);
   loaded = false;
   /**
-   * Encrypted, so it lives beside the key that opens it — usually the machine
-   * root, but a launch directory owning its own key keeps both together.
+   * Le fichier d'un propriétaire donné.
+   *
+   * Pour la machine, il reste à côté de la clé qui l'ouvre (`keyedFilePath`) :
+   * lu sous une autre clé il se déchiffrerait en blancs, puis serait réécrit
+   * blanc. Pour une organisation, c'est son coffre — la clé, elle, répond
+   * toujours pour toute la machine.
    */
-  getFilePath() {
-    return keyedFilePath(FILENAME);
+  /** L'identifiant de clé d'un agent : son organisation, ou la machine. */
+  vaultOf(id) {
+    return this.owners.get(id) ?? void 0;
+  }
+  filePathFor(owner) {
+    if (owner === null) return keyedFilePath(FILENAME);
+    return Promise.resolve(join2(orgVaultRoot(owner), FILENAME));
   }
   /** Where older versions kept it — read only, so an older Runeya keeps working. */
   getLegacyFilePath() {
     return legacyMachineFilePath(FILENAME);
   }
+  /** Ce qu'un fichier de coffre contient, ou null s'il n'y en a pas. */
+  async readOwnerFile(owner) {
+    const paths = owner === null ? [await this.filePathFor(null), this.getLegacyFilePath()] : [await this.filePathFor(owner)];
+    for (const path of paths) {
+      let raw;
+      try {
+        raw = await readFile2(path, "utf-8");
+      } catch {
+        continue;
+      }
+      try {
+        const data = JSON.parse(raw);
+        if (Array.isArray(data)) {
+          return { agents: data, passthroughEnv: {}, traefikConfigs: {} };
+        }
+        const fileData = data;
+        return {
+          agents: fileData.agents ?? [],
+          passthroughEnv: fileData.passthroughEnv ?? {},
+          traefikConfigs: fileData.traefikConfigs ?? {}
+        };
+      } catch {
+      }
+    }
+    return null;
+  }
   /**
-   * Read the machine file, falling back to the launch directory of old.
+   * Lire la machine puis chaque organisation présente sur ce disque.
    *
-   * The legacy file is left in place: the next save writes the new location,
-   * and a directory still opened by an older Runeya keeps working meanwhile.
+   * Les organisations sont relues du disque et non d'une liste tenue à part :
+   * un coffre qui existe est une organisation dont les agents comptent, et
+   * c'est déjà comme ça que la synchronisation décide de sa portée.
    */
-  async readFromDisk() {
-    try {
-      return await readFile2(await this.getFilePath(), "utf-8");
-    } catch {
-      return readFile2(this.getLegacyFilePath(), "utf-8");
-    }
-  }
-  async ensureDir() {
-    await mkdir2(dirname(await this.getFilePath()), { recursive: true });
-  }
   async load() {
     if (this.loaded) return;
-    try {
-      const raw = await this.readFromDisk();
-      const data = JSON.parse(raw);
-      if (Array.isArray(data)) {
-        for (const a of data) this.agents.set(a.id, a);
-        this.passthroughEnv = {};
-      } else {
-        const fileData = data;
-        for (const a of fileData.agents) this.agents.set(a.id, a);
-        this.passthroughEnv = fileData.passthroughEnv ?? {};
-        this.traefikConfigs = fileData.traefikConfigs ?? {};
+    const owners = [null, ...await listOrgVaults()];
+    for (const owner of owners) {
+      const data = await this.readOwnerFile(owner);
+      if (!data) continue;
+      this.knownOwners.add(owner);
+      for (const a of data.agents) {
+        this.agents.set(a.id, a);
+        this.owners.set(a.id, owner);
       }
-    } catch {
+      Object.assign(this.passthroughEnv, data.passthroughEnv);
+      Object.assign(this.traefikConfigs, data.traefikConfigs);
     }
     this.loaded = true;
   }
+  /**
+   * Réécrire chaque coffre concerné.
+   *
+   * Un agent emporte son `passthroughEnv` et sa configuration Traefik dans le
+   * fichier de son propriétaire : les laisser côté machine rendrait la portée
+   * mensongère — l'organisation partirait en laissant ses miettes derrière.
+   * Tous les coffres sont réécrits, y compris ceux devenus vides, sinon un
+   * agent déplacé subsisterait dans les deux.
+   */
   async save() {
-    await this.ensureDir();
-    const filePath = await this.getFilePath();
-    const tmpPath = filePath + ".tmp";
-    const fileData = {
-      agents: Array.from(this.agents.values()),
-      passthroughEnv: this.passthroughEnv,
-      traefikConfigs: this.traefikConfigs
-    };
-    await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
-    await rename(tmpPath, filePath);
-    await chmod(filePath, 384);
+    const byOwner = /* @__PURE__ */ new Map();
+    for (const owner of this.knownOwners) byOwner.set(owner, []);
+    for (const agent of this.agents.values()) {
+      const owner = this.owners.get(agent.id) ?? null;
+      byOwner.set(owner, [...byOwner.get(owner) ?? [], agent]);
+    }
+    for (const [owner, agents] of byOwner) {
+      const ids = new Set(agents.map((a) => a.id));
+      const fileData = {
+        agents,
+        passthroughEnv: Object.fromEntries(
+          Object.entries(this.passthroughEnv).filter(([id]) => ids.has(id))
+        ),
+        traefikConfigs: Object.fromEntries(
+          Object.entries(this.traefikConfigs).filter(([id]) => ids.has(id))
+        )
+      };
+      const filePath = await this.filePathFor(owner);
+      await mkdir2(dirname(filePath), { recursive: true });
+      const tmpPath = filePath + ".tmp";
+      await writeFile2(tmpPath, JSON.stringify(fileData, null, 2), "utf-8");
+      await rename(tmpPath, filePath);
+      await chmod(filePath, 384);
+    }
   }
   toAgentConfig(stored) {
     return {
       id: stored.id,
       name: stored.name,
       url: stored.url,
-      passphrase: decrypt(stored.encrypted, stored.iv, stored.authTag),
+      // La passphrase est chiffrée par la clé du coffre où l'agent est rangé :
+      // celle de son organisation, ou celle de la machine.
+      passphrase: decrypt(stored.encrypted, stored.iv, stored.authTag, this.vaultOf(stored.id)),
       passthroughEnv: this.passthroughEnv[stored.id] ?? []
     };
   }
@@ -367,10 +458,11 @@ var AgentStore = class {
     if (!stored) return null;
     return this.toAgentConfig(stored);
   }
-  async register(name, url, passphrase) {
+  async register(name, url, passphrase, owner = null) {
     await this.load();
     const existing = Array.from(this.agents.values()).find((a) => a.url === url);
-    const { encrypted, iv, authTag } = encrypt(passphrase);
+    const vault = existing ? this.vaultOf(existing.id) : owner ?? void 0;
+    const { encrypted, iv, authTag } = encrypt(passphrase, vault);
     if (existing) {
       existing.name = name;
       existing.encrypted = encrypted;
@@ -382,6 +474,8 @@ var AgentStore = class {
     const id = randomUUID();
     const stored = { id, name, url, encrypted, iv, authTag };
     this.agents.set(id, stored);
+    this.owners.set(id, owner);
+    this.knownOwners.add(owner);
     await this.save();
     return { id, name, url, passphrase, passthroughEnv: [] };
   }
@@ -389,6 +483,7 @@ var AgentStore = class {
     await this.load();
     if (!this.agents.has(id)) return false;
     this.agents.delete(id);
+    this.owners.delete(id);
     delete this.passthroughEnv[id];
     delete this.traefikConfigs[id];
     await this.save();
@@ -417,7 +512,7 @@ var AgentStore = class {
     if (fields.name !== void 0) stored.name = fields.name;
     if (fields.url !== void 0) stored.url = fields.url;
     if (fields.passphrase !== void 0) {
-      const { encrypted, iv, authTag } = encrypt(fields.passphrase);
+      const { encrypted, iv, authTag } = encrypt(fields.passphrase, this.vaultOf(id));
       stored.encrypted = encrypted;
       stored.iv = iv;
       stored.authTag = authTag;
@@ -440,7 +535,7 @@ var agentStore = new AgentStore();
 // ../server/src/services/service-store.ts
 import { randomUUID as randomUUID3 } from "crypto";
 import { readFile as readFile4, writeFile as writeFile4, rename as rename3, mkdir as mkdir4, chmod as chmod3, rm as rm2 } from "fs/promises";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 
 // ../server/src/services/project-key.ts
 function projectKey(ref) {
@@ -553,7 +648,7 @@ function isVaultConflicted(root) {
 // ../server/src/services/environment-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { readFile as readFile3, writeFile as writeFile3, rename as rename2, mkdir as mkdir3, chmod as chmod2, rm } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // ../server/src/services/crypto-helpers.ts
 import { randomBytes as randomBytes2, createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2 } from "crypto";
@@ -579,8 +674,8 @@ function decryptValueWith(key, encrypted) {
   dec += decipher.final("utf-8");
   return dec;
 }
-function encryptValue(plaintext) {
-  const maybeKey = getEncryptionKey();
+function encryptValue(plaintext, vault) {
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -592,14 +687,14 @@ function encryptValue(plaintext) {
   const authTag = cipher.getAuthTag().toString("hex");
   return `${iv.toString("hex")}:${authTag}:${enc}`;
 }
-function decryptValue(encrypted) {
+function decryptValue(encrypted, vault) {
   const parts = encrypted.split(":");
   if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
   const [ivHex, authTagHex, ciphertext] = parts;
   if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
     throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
   }
-  const maybeKey = getEncryptionKey();
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -611,34 +706,34 @@ function decryptValue(encrypted) {
   dec += decipher.final("utf-8");
   return dec;
 }
-function stableEncryptValue(plaintext, existingEncrypted) {
+function stableEncryptValue(plaintext, existingEncrypted, vault) {
   if (existingEncrypted) {
     try {
-      if (decryptValue(existingEncrypted) === plaintext) return existingEncrypted;
+      if (decryptValue(existingEncrypted, vault) === plaintext) return existingEncrypted;
     } catch {
     }
   }
-  return encryptValue(plaintext);
+  return encryptValue(plaintext, vault);
 }
-function encryptVariableSlots(variables, existingEncrypted) {
+function encryptVariableSlots(variables, existingEncrypted, vault) {
   const result = {};
   for (const [key, variable] of Object.entries(variables)) {
     const slot = variable.value;
     if (slot.isSecret && slot.value) {
-      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) } };
+      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key], vault) } };
     } else {
       result[key] = { ...variable, value: { ...slot } };
     }
   }
   return result;
 }
-function decryptVariableSlots(variables, contextLabel, onFailure) {
+function decryptVariableSlots(variables, contextLabel, onFailure, vault) {
   const result = {};
   for (const [key, variable] of Object.entries(variables)) {
     const slot = variable.value;
     if (slot.isSecret && slot.value) {
       try {
-        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };
+        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value, vault) } };
       } catch (err) {
         console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message} \u2014 la valeur chiffr\xE9e est conserv\xE9e telle quelle sur le disque`);
         onFailure?.(key);
@@ -1947,8 +2042,10 @@ var EnvironmentStore = class {
    * belongs even before its project has been loaded.
    */
   roots = /* @__PURE__ */ new Map();
+  /** L'organisation d'où vient un environnement reçu du cloud — voir `vaultOf`. */
+  remoteOrgs = /* @__PURE__ */ new Map();
   getFilePath(root) {
-    return join2(root, FILENAME2);
+    return join3(root, FILENAME2);
   }
   /**
    * The vault an environment must be written to: its project's.
@@ -1961,6 +2058,17 @@ var EnvironmentStore = class {
    * environment whose project is unknown belongs to the launch directory, which
    * is where it lived before vaults existed.
    */
+  /**
+   * La clé sous laquelle chiffrer cet environnement.
+   *
+   * La provenance l'emporte sur le coffre tant que le projet n'est pas local :
+   * un environnement reçu du cloud arrive avant lui, et `rootFor` désignerait
+   * alors le répertoire de lancement — donc la clé de la machine plutôt que
+   * celle de l'organisation qui a chiffré ces secrets.
+   */
+  vaultOf(environment) {
+    return this.remoteOrgs.get(environment.id) ?? vaultIdOfRoot(this.rootFor(environment));
+  }
   rootFor(environment) {
     const known = this.roots.get(environment.id) ?? null;
     const projectRoot = environment.projectId ? rootOfProjectAmong(environment.projectId, known) : null;
@@ -1997,13 +2105,22 @@ var EnvironmentStore = class {
     );
     return { envSlots };
   }
-  encryptEnvironment(environment) {
+  /**
+   * `vault` est fourni quand l'appelant sait à qui appartient l'environnement
+   * mieux que le disque : à l'arrivée d'une entité distante, son projet n'est
+   * pas encore local, et le coffre déduit serait celui du répertoire de
+   * lancement — donc la mauvaise clé.
+   */
+  encryptEnvironment(environment, vault) {
     const cache = this.diskEncryptedSlots.get(environment.id);
     let encryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
       encryptedVars = encryptVariableSlots(
         environment.variables,
-        cache?.envSlots
+        cache?.envSlots,
+        // La clé est celle du coffre où l'environnement sera écrit : les
+        // secrets d'une organisation sont chiffrés par la sienne.
+        vault ?? this.vaultOf(environment)
       );
     }
     return { ...environment, variables: this.keepUnreadableSecrets(environment.id, encryptedVars) };
@@ -2037,14 +2154,15 @@ var EnvironmentStore = class {
     }
     return result;
   }
-  decryptEnvironment(environment) {
+  decryptEnvironment(environment, vault) {
     let decryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
       const failed = /* @__PURE__ */ new Set();
       decryptedVars = decryptVariableSlots(
         environment.variables,
         `environment ${environment.id}`,
-        (variableId) => failed.add(variableId)
+        (variableId) => failed.add(variableId),
+        vault ?? this.vaultOf(environment)
       );
       if (failed.size > 0) this.unreadableSecrets.set(environment.id, failed);
       else this.unreadableSecrets.delete(environment.id);
@@ -2157,6 +2275,7 @@ var EnvironmentStore = class {
       this.diskEncryptedSlots.delete(id);
       this.unreadableSecrets.delete(id);
       this.roots.delete(id);
+      this.remoteOrgs.delete(id);
     }
     this.notify();
   }
@@ -2369,8 +2488,9 @@ var EnvironmentStore = class {
    * Validated rather than trusted, and diff-guarded against the on-disk form so
    * re-applying an identical environment neither saves nor notifies (loop-safe).
    */
-  async applyRemoteUpsert(id, fields) {
+  async applyRemoteUpsert(id, fields, vault) {
     await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
     const parsed = EnvironmentSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
       console.error("[environment-store] Rejected remote environment %s:", id, parsed.error.message);
@@ -2378,11 +2498,11 @@ var EnvironmentStore = class {
     }
     const incoming = parsed.data;
     const existing = this.environments.get(id);
-    if (existing && JSON.stringify(this.encryptEnvironment(existing)) === JSON.stringify(incoming)) {
+    if (existing && JSON.stringify(this.encryptEnvironment(existing, vault)) === JSON.stringify(incoming)) {
       return { created: false };
     }
     this.diskEncryptedSlots.set(id, this.extractEncryptedCache(incoming));
-    this.environments.set(id, this.decryptEnvironment(incoming));
+    this.environments.set(id, this.decryptEnvironment(incoming, vault));
     await this.save();
     return { created: !existing };
   }
@@ -2393,6 +2513,7 @@ var EnvironmentStore = class {
     this.environments.delete(id);
     this.diskEncryptedSlots.delete(id);
     this.unreadableSecrets.delete(id);
+    this.remoteOrgs.delete(id);
     await this.save();
     return true;
   }
@@ -2401,25 +2522,27 @@ var environmentStore = new EnvironmentStore();
 
 // ../server/src/services/service-store.ts
 var FILENAME3 = "services.json";
-function encryptLogSources(logSources, previous) {
+function encryptLogSources(logSources, previous, vault) {
   return logSources.map((src, i) => {
     const prev = previous?.[i];
     if (src.type === "mongo") {
+      if (isEncryptedValue(src.connectionString)) return src;
       const was = prev?.type === "mongo" ? prev.connectionString : void 0;
-      return { ...src, connectionString: stableEncryptValue(src.connectionString, was) };
+      return { ...src, connectionString: stableEncryptValue(src.connectionString, was, vault) };
     }
     if (src.type === "mysql" && src.password) {
+      if (isEncryptedValue(src.password)) return src;
       const was = prev?.type === "mysql" ? prev.password : void 0;
-      return { ...src, password: stableEncryptValue(src.password, was) };
+      return { ...src, password: stableEncryptValue(src.password, was, vault) };
     }
     return src;
   });
 }
-function decryptLogSources(logSources) {
+function decryptLogSources(logSources, vault) {
   return logSources.map((src) => {
     if (src.type === "mongo" && isEncryptedValue(src.connectionString)) {
       try {
-        return { ...src, connectionString: decryptValue(src.connectionString) };
+        return { ...src, connectionString: decryptValue(src.connectionString, vault) };
       } catch {
         console.error("[service-store] Failed to decrypt mongo connectionString");
         return src;
@@ -2427,7 +2550,7 @@ function decryptLogSources(logSources) {
     }
     if (src.type === "mysql" && src.password && isEncryptedValue(src.password)) {
       try {
-        return { ...src, password: decryptValue(src.password) };
+        return { ...src, password: decryptValue(src.password, vault) };
       } catch {
         console.error("[service-store] Failed to decrypt mysql password");
         return src;
@@ -2436,14 +2559,14 @@ function decryptLogSources(logSources) {
     return src;
   });
 }
-function prepareForDisk(service, previous) {
+function prepareForDisk(service, previous, vault) {
   return {
     ...service,
     env: {},
     envSecrets: [],
     resolvedLogParsers: void 0,
     resolvedCwd: void 0,
-    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources)
+    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources, vault)
   };
 }
 var ServiceStore = class {
@@ -2464,8 +2587,18 @@ var ServiceStore = class {
   }
   /** Which vault each service was read from, used until its project is known. */
   roots = /* @__PURE__ */ new Map();
+  /**
+   * L'organisation d'où vient un service reçu du cloud.
+   *
+   * Le coffre ne peut pas encore répondre : les contenus arrivent avant leur
+   * projet, donc `rootFor` désignerait le répertoire de lancement et
+   * chiffrerait les secrets de l'organisation avec la clé de la machine. Cette
+   * provenance tient le temps que le projet devienne local — après quoi elle
+   * dit la même chose que le coffre.
+   */
+  remoteOrgs = /* @__PURE__ */ new Map();
   getFilePath(root) {
-    return join3(root, FILENAME3);
+    return join4(root, FILENAME3);
   }
   /**
    * The vault a service must be written to: the one of the project owning it.
@@ -2474,6 +2607,10 @@ var ServiceStore = class {
    * so the registry answers, falling back to where the service was read and
    * finally to the local vault.
    */
+  /** La clé sous laquelle chiffrer ce service : son organisation, ou son coffre. */
+  vaultOf(serviceId) {
+    return this.remoteOrgs.get(serviceId) ?? vaultIdOfRoot(this.rootFor(serviceId));
+  }
   rootFor(serviceId) {
     return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();
   }
@@ -2506,7 +2643,7 @@ var ServiceStore = class {
           this.diskForm.set(s.id, s);
           this.services.set(s.id, {
             ...s,
-            logSources: decryptLogSources(s.logSources ?? [])
+            logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root))
           });
           this.roots.set(s.id, root);
         }
@@ -2529,7 +2666,7 @@ var ServiceStore = class {
     byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
     for (const service of this.services.values()) {
       const root = this.rootFor(service.id);
-      const prepared = prepareForDisk(service, this.diskForm.get(service.id));
+      const prepared = prepareForDisk(service, this.diskForm.get(service.id), this.vaultOf(service.id));
       this.diskForm.set(prepared.id, prepared);
       this.roots.set(service.id, root);
       if (isVaultConflicted(root)) continue;
@@ -2564,6 +2701,7 @@ var ServiceStore = class {
       this.services.delete(id);
       this.diskForm.delete(id);
       this.roots.delete(id);
+      this.remoteOrgs.delete(id);
     }
     this.notify();
   }
@@ -2578,6 +2716,24 @@ var ServiceStore = class {
     await this.load();
     await this.save();
   }
+  /**
+   * Réattribuer l'organisation de services dont le projet vient de changer de
+   * coffre.
+   *
+   * Un service porte son `orgId` en propre : laissé à `null` après le passage
+   * du projet dans une organisation, il partirait dans le doc en se disant
+   * local. La sauvegarde qui suit les écrit dans leur nouveau coffre et les
+   * retire de l'ancien, le registre ayant déjà été mis à jour par le projet.
+   */
+  async reassignOrg(serviceIds, orgId) {
+    await this.load();
+    for (const id of serviceIds) {
+      const service = this.services.get(id);
+      if (service) this.services.set(id, { ...service, orgId });
+    }
+    await this.save();
+    this.notify();
+  }
   async list() {
     await this.load();
     return Array.from(this.services.values());
@@ -2594,7 +2750,7 @@ var ServiceStore = class {
   async getSanitized(id) {
     await this.load();
     const service = this.services.get(id);
-    return service ? prepareForDisk(service, this.diskForm.get(id)) : null;
+    return service ? prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)) : null;
   }
   async create(input) {
     await this.load();
@@ -2682,7 +2838,7 @@ var ServiceStore = class {
     const out = [];
     for (const id of ids) {
       const service = this.services.get(id);
-      if (service) out.push(prepareForDisk(service, this.diskForm.get(id)));
+      if (service) out.push(prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)));
     }
     return out;
   }
@@ -2694,8 +2850,9 @@ var ServiceStore = class {
    * `services.json`. Diff-guarded against the on-disk form so re-applying an
    * identical service neither saves nor notifies (loop-safe).
    */
-  async applyRemoteUpsert(id, fields) {
+  async applyRemoteUpsert(id, fields, vault) {
     await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
     const parsed = ServiceConfigSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
       console.error("[service-store] Rejected remote service %s:", id, parsed.error.message);
@@ -2704,7 +2861,7 @@ var ServiceStore = class {
     const incoming = parsed.data;
     const existing = this.services.get(id);
     if (existing) {
-      const currentDisk = prepareForDisk(existing, this.diskForm.get(id));
+      const currentDisk = prepareForDisk(existing, this.diskForm.get(id), vault ?? this.vaultOf(id));
       if (JSON.stringify(currentDisk) === JSON.stringify(incoming)) return { created: false };
     }
     this.diskForm.set(id, incoming);
@@ -2712,7 +2869,7 @@ var ServiceStore = class {
       ...incoming,
       // The doc carries the on-disk form, where credentials are ciphertext;
       // in memory they are expected in the clear, as `load()` keeps them.
-      logSources: decryptLogSources(incoming.logSources ?? [])
+      logSources: decryptLogSources(incoming.logSources ?? [], vault ?? this.vaultOf(id))
     });
     await this.save();
     this.notify();
@@ -2736,28 +2893,81 @@ var serviceStore = new ServiceStore();
 import { spawn } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { fileURLToPath } from "url";
+var POSIX_SAFE_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "SHELL",
+  "LANG",
+  "TERM",
+  "NODE_ENV",
+  "TMPDIR",
+  "TZ",
+  "DBUS_SESSION_BUS_ADDRESS",
+  "XDG_RUNTIME_DIR",
+  // Needed so the agent can talk to the user's clipboard for the chat image-paste flow
+  // (xclip needs DISPLAY/XAUTHORITY, wl-copy needs WAYLAND_DISPLAY).
+  "DISPLAY",
+  "XAUTHORITY",
+  "WAYLAND_DISPLAY",
+  "XDG_SESSION_TYPE"
+];
+var WINDOWS_SAFE_KEYS = [
+  "PATH",
+  "PATHEXT",
+  "NODE_ENV",
+  "TZ",
+  "TERM",
+  // Interpreter + OS roots
+  "ComSpec",
+  "SystemRoot",
+  "SystemDrive",
+  "windir",
+  "OS",
+  "PSModulePath",
+  // User profile & app data (git config, credential helpers, npm/scoop shims)
+  "USERPROFILE",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "USERNAME",
+  "USERDOMAIN",
+  "USERDOMAIN_ROAMINGPROFILE",
+  "LOGONSERVER",
+  "APPDATA",
+  "LOCALAPPDATA",
+  // Machine-wide install roots
+  "ProgramData",
+  "ProgramFiles",
+  "ProgramFiles(x86)",
+  "ProgramW6432",
+  "CommonProgramFiles",
+  "CommonProgramFiles(x86)",
+  "CommonProgramW6432",
+  "ALLUSERSPROFILE",
+  "PUBLIC",
+  "DriverData",
+  // Temp
+  "TEMP",
+  "TMP",
+  // Architecture / CPU (used by installers and native module loaders)
+  "PROCESSOR_ARCHITECTURE",
+  "PROCESSOR_ARCHITEW6432",
+  "PROCESSOR_IDENTIFIER",
+  "PROCESSOR_LEVEL",
+  "PROCESSOR_REVISION",
+  "NUMBER_OF_PROCESSORS",
+  // Session / terminal
+  "SESSIONNAME",
+  "COMPUTERNAME",
+  "FPS_BROWSER_APP_PROFILE_STRING",
+  "FPS_BROWSER_USER_PROFILE_STRING",
+  "WT_SESSION",
+  "WT_PROFILE_ID"
+];
 function buildAgentEnv() {
-  const safeKeys = [
-    "PATH",
-    "HOME",
-    "USER",
-    "SHELL",
-    "LANG",
-    "TERM",
-    "NODE_ENV",
-    "TMPDIR",
-    "TZ",
-    "DBUS_SESSION_BUS_ADDRESS",
-    "XDG_RUNTIME_DIR",
-    // Needed so the agent can talk to the user's clipboard for the chat image-paste flow
-    // (xclip needs DISPLAY/XAUTHORITY, wl-copy needs WAYLAND_DISPLAY).
-    "DISPLAY",
-    "XAUTHORITY",
-    "WAYLAND_DISPLAY",
-    "XDG_SESSION_TYPE"
-  ];
+  const safeKeys = process.platform === "win32" ? WINDOWS_SAFE_KEYS : POSIX_SAFE_KEYS;
   const agentEnv = {
     RUNEYA_AGENT_PORT: String(env.RUNEYA_AGENT_PORT),
     RUNEYA_AGENT_HOST: env.RUNEYA_AGENT_HOST
@@ -2769,9 +2979,10 @@ function buildAgentEnv() {
     }
     agentEnv.PASSPHRASE_OVERRIDE = passphrase;
   }
-  for (const key of safeKeys) {
-    if (process.env[key]) {
-      agentEnv[key] = process.env[key];
+  const wanted = new Set(safeKeys.map((k) => k.toLowerCase()));
+  for (const [key, value] of Object.entries(process.env)) {
+    if (value && wanted.has(key.toLowerCase())) {
+      agentEnv[key] = value;
     }
   }
   return agentEnv;
@@ -2794,7 +3005,7 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join4(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentDistPath = env.AGENT_BINARY_PATH || join5(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
     this.agentProcess = spawn("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
@@ -2897,7 +3108,7 @@ var AgentSpawner = class {
       this.fileWatcher.close();
     }
     console.log("[agent-spawner] \u{1F50D} Watching agent dist for changes (hot reload enabled)");
-    const distDir = join4(this.agentDistPath, "..");
+    const distDir = join5(this.agentDistPath, "..");
     this.fileWatcher = watch(distDir, { persistent: false }, (eventType, filename) => {
       if ((eventType === "change" || eventType === "rename") && filename === "index.js" && !this.isRestarting) {
         this.isRestarting = true;
@@ -3328,8 +3539,12 @@ var AgentManager = class extends EventEmitter2 {
       this.connectAgent(agent);
     }
   }
-  async register(name, url, passphrase) {
-    const config = await agentStore.register(name, url, passphrase);
+  /**
+   * `owner` dit à quelle organisation l'agent appartient, ou `null` pour la
+   * machine — l'agent local, qui n'exécute des processus que sur ce poste.
+   */
+  async register(name, url, passphrase, owner = null) {
+    const config = await agentStore.register(name, url, passphrase, owner);
     const isReRegistration = this.connections.has(config.id);
     if (isReRegistration) {
       console.log(`[agent-manager] Re-registering agent ${config.name} (${config.id})`);
@@ -3671,15 +3886,19 @@ export {
   clearEncryptionKey,
   hasEncryptionKey,
   getEncryptionKey,
+  markVaultLocked,
+  clearVaultLock,
   ensureEncryptionKey,
   setEncryptionKey,
   machineRoot,
   localVaultRoot,
   orgVaultRoot,
   projectVaultRoot,
+  vaultIdOfRoot,
   vaultFor,
   stampOrgCloud,
   readOrgClouds,
+  listOrgVaults,
   listCloudVaults,
   allVaultRoots,
   machineFilePath,
@@ -3737,6 +3956,8 @@ export {
   setProjectVault,
   forgetProject,
   setProjectServices,
+  rootOfProjectRef,
+  refsOfProjectId,
   rootOfProjectAmong,
   refOfProjectAmong,
   environmentStore,
@@ -3746,4 +3967,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-NVKGIBJN.js.map
+//# sourceMappingURL=chunk-EL75GG7O.js.map