@runeya/runeya 2.0.52 → 2.0.53

package/agent-manager-RGDHYM64.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-EL75GG7O.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-RGDHYM64.js.map

package/{chunk-IHUELGIB.js → chunk-EL75GG7O.js}

@@ -89,6 +89,15 @@ function projectVaultRoot(orgId, projectId) {
   assertSafeId("project", projectId);
   return join(orgVaultRoot(orgId), "projects", projectId);
 }
+function orgIdOfRoot(root) {
+  const marker = join(machineRoot(), "orgs") + sep;
+  if (!root.startsWith(marker)) return null;
+  const [orgId] = root.slice(marker.length).split(sep);
+  return orgId && SAFE_ID.test(orgId) ? orgId : null;
+}
+function vaultIdOfRoot(root) {
+  return orgIdOfRoot(root) ?? void 0;
+}
 function vaultFor(target) {
   if (!target.orgId) return { root: localVaultRoot() };
   return { root: projectVaultRoot(target.orgId, target.id) };
@@ -195,6 +204,7 @@ import { createHash } from "crypto";
 var KEY_SIZE_BYTES = 32;
 var DEFAULT_VAULT = "\0default";
 var keyring = /* @__PURE__ */ new Map();
+var lockedVaults = /* @__PURE__ */ new Set();
 var _ciMode = false;
 var _pendingLegacyKey = null;
 function isCiMode() {
@@ -231,16 +241,31 @@ function hasPendingLegacyKey() {
 function setEncryptionKeyInMemory(key, vault = DEFAULT_VAULT) {
   if (key.length !== KEY_SIZE_BYTES) throw new Error("Taille de cl\xE9 invalide");
   keyring.set(vault, key);
+  lockedVaults.delete(vault);
 }
 function clearEncryptionKey(vault) {
-  if (vault === void 0) keyring.clear();
-  else keyring.delete(vault);
+  if (vault === void 0) {
+    keyring.clear();
+    lockedVaults.clear();
+  } else {
+    keyring.delete(vault);
+  }
 }
 function hasEncryptionKey(vault = DEFAULT_VAULT) {
   return keyring.has(vault);
 }
 function getEncryptionKey(vault = DEFAULT_VAULT) {
-  return keyring.get(vault) ?? null;
+  const own = keyring.get(vault);
+  if (own) return own;
+  if (vault === DEFAULT_VAULT || lockedVaults.has(vault)) return null;
+  return keyring.get(DEFAULT_VAULT) ?? null;
+}
+function markVaultLocked(vault) {
+  lockedVaults.add(vault);
+  keyring.delete(vault);
+}
+function clearVaultLock(vault) {
+  lockedVaults.delete(vault);
 }
 function deriveStableSecret(purpose, vault = DEFAULT_VAULT) {
   const key = getEncryptionKey(vault);
@@ -258,8 +283,8 @@ async function setEncryptionKey(keyHex) {
 // ../server/src/services/agent-store.ts
 var FILENAME = "agents.json";
 var ALGORITHM = "aes-256-gcm";
-function encrypt(plaintext) {
-  const maybeKey = getEncryptionKey();
+function encrypt(plaintext, vault) {
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -271,11 +296,11 @@ function encrypt(plaintext) {
   const authTag = cipher.getAuthTag().toString("hex");
   return { encrypted: enc, iv: iv.toString("hex"), authTag };
 }
-function decrypt(encrypted, ivHex, authTagHex) {
+function decrypt(encrypted, ivHex, authTagHex, vault) {
   if (!/^[0-9a-f]+$/i.test(encrypted) || !/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex)) {
     throw new Error("Invalid hex string in encrypted agent data");
   }
-  const maybeKey = getEncryptionKey();
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -310,6 +335,10 @@ var AgentStore = class {
    * blanc. Pour une organisation, c'est son coffre — la clé, elle, répond
    * toujours pour toute la machine.
    */
+  /** L'identifiant de clé d'un agent : son organisation, ou la machine. */
+  vaultOf(id) {
+    return this.owners.get(id) ?? void 0;
+  }
   filePathFor(owner) {
     if (owner === null) return keyedFilePath(FILENAME);
     return Promise.resolve(join2(orgVaultRoot(owner), FILENAME));
@@ -407,7 +436,9 @@ var AgentStore = class {
       id: stored.id,
       name: stored.name,
       url: stored.url,
-      passphrase: decrypt(stored.encrypted, stored.iv, stored.authTag),
+      // La passphrase est chiffrée par la clé du coffre où l'agent est rangé :
+      // celle de son organisation, ou celle de la machine.
+      passphrase: decrypt(stored.encrypted, stored.iv, stored.authTag, this.vaultOf(stored.id)),
       passthroughEnv: this.passthroughEnv[stored.id] ?? []
     };
   }
@@ -430,7 +461,8 @@ var AgentStore = class {
   async register(name, url, passphrase, owner = null) {
     await this.load();
     const existing = Array.from(this.agents.values()).find((a) => a.url === url);
-    const { encrypted, iv, authTag } = encrypt(passphrase);
+    const vault = existing ? this.vaultOf(existing.id) : owner ?? void 0;
+    const { encrypted, iv, authTag } = encrypt(passphrase, vault);
     if (existing) {
       existing.name = name;
       existing.encrypted = encrypted;
@@ -480,7 +512,7 @@ var AgentStore = class {
     if (fields.name !== void 0) stored.name = fields.name;
     if (fields.url !== void 0) stored.url = fields.url;
     if (fields.passphrase !== void 0) {
-      const { encrypted, iv, authTag } = encrypt(fields.passphrase);
+      const { encrypted, iv, authTag } = encrypt(fields.passphrase, this.vaultOf(id));
       stored.encrypted = encrypted;
       stored.iv = iv;
       stored.authTag = authTag;
@@ -642,8 +674,8 @@ function decryptValueWith(key, encrypted) {
   dec += decipher.final("utf-8");
   return dec;
 }
-function encryptValue(plaintext) {
-  const maybeKey = getEncryptionKey();
+function encryptValue(plaintext, vault) {
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -655,14 +687,14 @@ function encryptValue(plaintext) {
   const authTag = cipher.getAuthTag().toString("hex");
   return `${iv.toString("hex")}:${authTag}:${enc}`;
 }
-function decryptValue(encrypted) {
+function decryptValue(encrypted, vault) {
   const parts = encrypted.split(":");
   if (parts.length !== 3) throw new Error("Invalid encrypted value format \u2014 expected iv:authTag:ciphertext");
   const [ivHex, authTagHex, ciphertext] = parts;
   if (!/^[0-9a-f]+$/i.test(ivHex) || !/^[0-9a-f]+$/i.test(authTagHex) || ciphertext !== "" && !/^[0-9a-f]+$/i.test(ciphertext)) {
     throw new Error("Invalid hex in encrypted value \u2014 possible data corruption");
   }
-  const maybeKey = getEncryptionKey();
+  const maybeKey = getEncryptionKey(vault);
   if (!maybeKey) {
     throw new Error("Encryption key not loaded \u2014 please provide the key via setup UI");
   }
@@ -674,34 +706,34 @@ function decryptValue(encrypted) {
   dec += decipher.final("utf-8");
   return dec;
 }
-function stableEncryptValue(plaintext, existingEncrypted) {
+function stableEncryptValue(plaintext, existingEncrypted, vault) {
   if (existingEncrypted) {
     try {
-      if (decryptValue(existingEncrypted) === plaintext) return existingEncrypted;
+      if (decryptValue(existingEncrypted, vault) === plaintext) return existingEncrypted;
     } catch {
     }
   }
-  return encryptValue(plaintext);
+  return encryptValue(plaintext, vault);
 }
-function encryptVariableSlots(variables, existingEncrypted) {
+function encryptVariableSlots(variables, existingEncrypted, vault) {
   const result = {};
   for (const [key, variable] of Object.entries(variables)) {
     const slot = variable.value;
     if (slot.isSecret && slot.value) {
-      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key]) } };
+      result[key] = { ...variable, value: { ...slot, value: stableEncryptValue(slot.value, existingEncrypted?.[key], vault) } };
     } else {
       result[key] = { ...variable, value: { ...slot } };
     }
   }
   return result;
 }
-function decryptVariableSlots(variables, contextLabel, onFailure) {
+function decryptVariableSlots(variables, contextLabel, onFailure, vault) {
   const result = {};
   for (const [key, variable] of Object.entries(variables)) {
     const slot = variable.value;
     if (slot.isSecret && slot.value) {
       try {
-        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value) } };
+        result[key] = { ...variable, value: { ...slot, value: decryptValue(slot.value, vault) } };
       } catch (err) {
         console.error(`[crypto-helpers] Failed to decrypt variable "${key}" for ${contextLabel}: ${err.message} \u2014 la valeur chiffr\xE9e est conserv\xE9e telle quelle sur le disque`);
         onFailure?.(key);
@@ -2010,6 +2042,8 @@ var EnvironmentStore = class {
    * belongs even before its project has been loaded.
    */
   roots = /* @__PURE__ */ new Map();
+  /** L'organisation d'où vient un environnement reçu du cloud — voir `vaultOf`. */
+  remoteOrgs = /* @__PURE__ */ new Map();
   getFilePath(root) {
     return join3(root, FILENAME2);
   }
@@ -2024,6 +2058,17 @@ var EnvironmentStore = class {
    * environment whose project is unknown belongs to the launch directory, which
    * is where it lived before vaults existed.
    */
+  /**
+   * La clé sous laquelle chiffrer cet environnement.
+   *
+   * La provenance l'emporte sur le coffre tant que le projet n'est pas local :
+   * un environnement reçu du cloud arrive avant lui, et `rootFor` désignerait
+   * alors le répertoire de lancement — donc la clé de la machine plutôt que
+   * celle de l'organisation qui a chiffré ces secrets.
+   */
+  vaultOf(environment) {
+    return this.remoteOrgs.get(environment.id) ?? vaultIdOfRoot(this.rootFor(environment));
+  }
   rootFor(environment) {
     const known = this.roots.get(environment.id) ?? null;
     const projectRoot = environment.projectId ? rootOfProjectAmong(environment.projectId, known) : null;
@@ -2060,13 +2105,22 @@ var EnvironmentStore = class {
     );
     return { envSlots };
   }
-  encryptEnvironment(environment) {
+  /**
+   * `vault` est fourni quand l'appelant sait à qui appartient l'environnement
+   * mieux que le disque : à l'arrivée d'une entité distante, son projet n'est
+   * pas encore local, et le coffre déduit serait celui du répertoire de
+   * lancement — donc la mauvaise clé.
+   */
+  encryptEnvironment(environment, vault) {
     const cache = this.diskEncryptedSlots.get(environment.id);
     let encryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
       encryptedVars = encryptVariableSlots(
         environment.variables,
-        cache?.envSlots
+        cache?.envSlots,
+        // La clé est celle du coffre où l'environnement sera écrit : les
+        // secrets d'une organisation sont chiffrés par la sienne.
+        vault ?? this.vaultOf(environment)
       );
     }
     return { ...environment, variables: this.keepUnreadableSecrets(environment.id, encryptedVars) };
@@ -2100,14 +2154,15 @@ var EnvironmentStore = class {
     }
     return result;
   }
-  decryptEnvironment(environment) {
+  decryptEnvironment(environment, vault) {
     let decryptedVars = environment.variables;
     if (environment.variables && Object.keys(environment.variables).length > 0) {
       const failed = /* @__PURE__ */ new Set();
       decryptedVars = decryptVariableSlots(
         environment.variables,
         `environment ${environment.id}`,
-        (variableId) => failed.add(variableId)
+        (variableId) => failed.add(variableId),
+        vault ?? this.vaultOf(environment)
       );
       if (failed.size > 0) this.unreadableSecrets.set(environment.id, failed);
       else this.unreadableSecrets.delete(environment.id);
@@ -2220,6 +2275,7 @@ var EnvironmentStore = class {
       this.diskEncryptedSlots.delete(id);
       this.unreadableSecrets.delete(id);
       this.roots.delete(id);
+      this.remoteOrgs.delete(id);
     }
     this.notify();
   }
@@ -2432,8 +2488,9 @@ var EnvironmentStore = class {
    * Validated rather than trusted, and diff-guarded against the on-disk form so
    * re-applying an identical environment neither saves nor notifies (loop-safe).
    */
-  async applyRemoteUpsert(id, fields) {
+  async applyRemoteUpsert(id, fields, vault) {
     await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
     const parsed = EnvironmentSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
       console.error("[environment-store] Rejected remote environment %s:", id, parsed.error.message);
@@ -2441,11 +2498,11 @@ var EnvironmentStore = class {
     }
     const incoming = parsed.data;
     const existing = this.environments.get(id);
-    if (existing && JSON.stringify(this.encryptEnvironment(existing)) === JSON.stringify(incoming)) {
+    if (existing && JSON.stringify(this.encryptEnvironment(existing, vault)) === JSON.stringify(incoming)) {
       return { created: false };
     }
     this.diskEncryptedSlots.set(id, this.extractEncryptedCache(incoming));
-    this.environments.set(id, this.decryptEnvironment(incoming));
+    this.environments.set(id, this.decryptEnvironment(incoming, vault));
     await this.save();
     return { created: !existing };
   }
@@ -2456,6 +2513,7 @@ var EnvironmentStore = class {
     this.environments.delete(id);
     this.diskEncryptedSlots.delete(id);
     this.unreadableSecrets.delete(id);
+    this.remoteOrgs.delete(id);
     await this.save();
     return true;
   }
@@ -2464,25 +2522,27 @@ var environmentStore = new EnvironmentStore();
 
 // ../server/src/services/service-store.ts
 var FILENAME3 = "services.json";
-function encryptLogSources(logSources, previous) {
+function encryptLogSources(logSources, previous, vault) {
   return logSources.map((src, i) => {
     const prev = previous?.[i];
     if (src.type === "mongo") {
+      if (isEncryptedValue(src.connectionString)) return src;
       const was = prev?.type === "mongo" ? prev.connectionString : void 0;
-      return { ...src, connectionString: stableEncryptValue(src.connectionString, was) };
+      return { ...src, connectionString: stableEncryptValue(src.connectionString, was, vault) };
     }
     if (src.type === "mysql" && src.password) {
+      if (isEncryptedValue(src.password)) return src;
       const was = prev?.type === "mysql" ? prev.password : void 0;
-      return { ...src, password: stableEncryptValue(src.password, was) };
+      return { ...src, password: stableEncryptValue(src.password, was, vault) };
     }
     return src;
   });
 }
-function decryptLogSources(logSources) {
+function decryptLogSources(logSources, vault) {
   return logSources.map((src) => {
     if (src.type === "mongo" && isEncryptedValue(src.connectionString)) {
       try {
-        return { ...src, connectionString: decryptValue(src.connectionString) };
+        return { ...src, connectionString: decryptValue(src.connectionString, vault) };
       } catch {
         console.error("[service-store] Failed to decrypt mongo connectionString");
         return src;
@@ -2490,7 +2550,7 @@ function decryptLogSources(logSources) {
     }
     if (src.type === "mysql" && src.password && isEncryptedValue(src.password)) {
       try {
-        return { ...src, password: decryptValue(src.password) };
+        return { ...src, password: decryptValue(src.password, vault) };
       } catch {
         console.error("[service-store] Failed to decrypt mysql password");
         return src;
@@ -2499,14 +2559,14 @@ function decryptLogSources(logSources) {
     return src;
   });
 }
-function prepareForDisk(service, previous) {
+function prepareForDisk(service, previous, vault) {
   return {
     ...service,
     env: {},
     envSecrets: [],
     resolvedLogParsers: void 0,
     resolvedCwd: void 0,
-    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources)
+    logSources: encryptLogSources(service.logSources ?? [], previous?.logSources, vault)
   };
 }
 var ServiceStore = class {
@@ -2527,6 +2587,16 @@ var ServiceStore = class {
   }
   /** Which vault each service was read from, used until its project is known. */
   roots = /* @__PURE__ */ new Map();
+  /**
+   * L'organisation d'où vient un service reçu du cloud.
+   *
+   * Le coffre ne peut pas encore répondre : les contenus arrivent avant leur
+   * projet, donc `rootFor` désignerait le répertoire de lancement et
+   * chiffrerait les secrets de l'organisation avec la clé de la machine. Cette
+   * provenance tient le temps que le projet devienne local — après quoi elle
+   * dit la même chose que le coffre.
+   */
+  remoteOrgs = /* @__PURE__ */ new Map();
   getFilePath(root) {
     return join4(root, FILENAME3);
   }
@@ -2537,6 +2607,10 @@ var ServiceStore = class {
    * so the registry answers, falling back to where the service was read and
    * finally to the local vault.
    */
+  /** La clé sous laquelle chiffrer ce service : son organisation, ou son coffre. */
+  vaultOf(serviceId) {
+    return this.remoteOrgs.get(serviceId) ?? vaultIdOfRoot(this.rootFor(serviceId));
+  }
   rootFor(serviceId) {
     return rootOfService(serviceId, this.roots.get(serviceId) ?? null) ?? localVaultRoot();
   }
@@ -2569,7 +2643,7 @@ var ServiceStore = class {
           this.diskForm.set(s.id, s);
           this.services.set(s.id, {
             ...s,
-            logSources: decryptLogSources(s.logSources ?? [])
+            logSources: decryptLogSources(s.logSources ?? [], vaultIdOfRoot(root))
           });
           this.roots.set(s.id, root);
         }
@@ -2592,7 +2666,7 @@ var ServiceStore = class {
     byRoot.set(localVaultRoot(), byRoot.get(localVaultRoot()) ?? []);
     for (const service of this.services.values()) {
       const root = this.rootFor(service.id);
-      const prepared = prepareForDisk(service, this.diskForm.get(service.id));
+      const prepared = prepareForDisk(service, this.diskForm.get(service.id), this.vaultOf(service.id));
       this.diskForm.set(prepared.id, prepared);
       this.roots.set(service.id, root);
       if (isVaultConflicted(root)) continue;
@@ -2627,6 +2701,7 @@ var ServiceStore = class {
       this.services.delete(id);
       this.diskForm.delete(id);
       this.roots.delete(id);
+      this.remoteOrgs.delete(id);
     }
     this.notify();
   }
@@ -2675,7 +2750,7 @@ var ServiceStore = class {
   async getSanitized(id) {
     await this.load();
     const service = this.services.get(id);
-    return service ? prepareForDisk(service, this.diskForm.get(id)) : null;
+    return service ? prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)) : null;
   }
   async create(input) {
     await this.load();
@@ -2763,7 +2838,7 @@ var ServiceStore = class {
     const out = [];
     for (const id of ids) {
       const service = this.services.get(id);
-      if (service) out.push(prepareForDisk(service, this.diskForm.get(id)));
+      if (service) out.push(prepareForDisk(service, this.diskForm.get(id), this.vaultOf(id)));
     }
     return out;
   }
@@ -2775,8 +2850,9 @@ var ServiceStore = class {
    * `services.json`. Diff-guarded against the on-disk form so re-applying an
    * identical service neither saves nor notifies (loop-safe).
    */
-  async applyRemoteUpsert(id, fields) {
+  async applyRemoteUpsert(id, fields, vault) {
     await this.load();
+    if (vault) this.remoteOrgs.set(id, vault);
     const parsed = ServiceConfigSchema.safeParse({ ...fields, id });
     if (!parsed.success) {
       console.error("[service-store] Rejected remote service %s:", id, parsed.error.message);
@@ -2785,7 +2861,7 @@ var ServiceStore = class {
     const incoming = parsed.data;
     const existing = this.services.get(id);
     if (existing) {
-      const currentDisk = prepareForDisk(existing, this.diskForm.get(id));
+      const currentDisk = prepareForDisk(existing, this.diskForm.get(id), vault ?? this.vaultOf(id));
       if (JSON.stringify(currentDisk) === JSON.stringify(incoming)) return { created: false };
     }
     this.diskForm.set(id, incoming);
@@ -2793,7 +2869,7 @@ var ServiceStore = class {
       ...incoming,
       // The doc carries the on-disk form, where credentials are ciphertext;
       // in memory they are expected in the clear, as `load()` keeps them.
-      logSources: decryptLogSources(incoming.logSources ?? [])
+      logSources: decryptLogSources(incoming.logSources ?? [], vault ?? this.vaultOf(id))
     });
     await this.save();
     this.notify();
@@ -3810,12 +3886,15 @@ export {
   clearEncryptionKey,
   hasEncryptionKey,
   getEncryptionKey,
+  markVaultLocked,
+  clearVaultLock,
   ensureEncryptionKey,
   setEncryptionKey,
   machineRoot,
   localVaultRoot,
   orgVaultRoot,
   projectVaultRoot,
+  vaultIdOfRoot,
   vaultFor,
   stampOrgCloud,
   readOrgClouds,
@@ -3877,6 +3956,8 @@ export {
   setProjectVault,
   forgetProject,
   setProjectServices,
+  rootOfProjectRef,
+  refsOfProjectId,
   rootOfProjectAmong,
   refOfProjectAmong,
   environmentStore,
@@ -3886,4 +3967,4 @@ export {
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-IHUELGIB.js.map
+//# sourceMappingURL=chunk-EL75GG7O.js.map