@runeya/runeya 2.0.58 → 2.0.60

package/index.js

@@ -270,7 +270,7 @@ function listenWithRetry(server, port, host, wss, maxRetries = 20, delay = 500)
   });
 }
 async function main() {
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-V3J62F6F.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-FYMPMNWX.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.58",
+  "version": "2.0.60",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-V3J62F6F.js → src-FYMPMNWX.js}

@@ -70,6 +70,7 @@ import {
   machineRoot,
   markVaultLocked,
   nativeParsers,
+  orgIdOfRoot,
   orgVaultRoot,
   projectKey,
   projectVaultRoot,
@@ -95,7 +96,7 @@ import {
   vaultFor,
   vaultIdOfRoot,
   writeEntity
-} from "./chunk-NLVDO4EC.js";
+} from "./chunk-WI4NXXWA.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -231,6 +232,7 @@ var ApiKeyStore = class {
   async load() {
     if (this.loaded) return;
     this.loaded = true;
+    this.unreadable.clear();
     const owners = [null, ...await listOrgVaults()];
     for (const owner of owners) {
       await this.loadFile(await this.filePath(true, owner), owner);
@@ -537,8 +539,8 @@ import { TRPCError as TRPCError2 } from "@trpc/server";
 // ../server/src/services/project-store.ts
 import { randomUUID as randomUUID2 } from "crypto";
 import { EventEmitter } from "events";
-import { readFile as readFile2, writeFile as writeFile3, rename as rename2, mkdir as mkdir2, chmod as chmod2, rm } from "fs/promises";
-import { join as join3 } from "path";
+import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3, rm } from "fs/promises";
+import { join as join4 } from "path";
 
 // ../server/src/utils/ensure-data-gitignore.ts
 import { writeFile as writeFile2 } from "fs/promises";
@@ -583,8 +585,108 @@ async function ensureDataGitignore(dataDir) {
   await writeFile2(gitignorePath, GITIGNORE_CONTENT, "utf-8");
 }
 
+// ../server/src/services/project-path-store.ts
+import { readFile as readFile2, writeFile as writeFile3, rename as rename2, mkdir as mkdir2, chmod as chmod2, stat } from "fs/promises";
+import { isAbsolute, join as join3, resolve } from "path";
+var FILENAME = "project-paths.json";
+var ProjectPathStore = class {
+  paths = null;
+  async load() {
+    if (this.paths) return this.paths;
+    try {
+      const raw = await readFile2(machineFilePath(FILENAME), "utf-8");
+      const parsed = JSON.parse(raw);
+      this.paths = isPathMap(parsed) ? parsed : {};
+    } catch {
+      this.paths = {};
+    }
+    return this.paths;
+  }
+  async persist() {
+    await mkdir2(machineRoot(), { recursive: true });
+    const filePath = machineFilePath(FILENAME);
+    const tmpPath = `${filePath}.tmp`;
+    await writeFile3(tmpPath, JSON.stringify(this.paths ?? {}, null, 2), "utf-8");
+    await rename2(tmpPath, filePath);
+    await chmod2(filePath, 384);
+  }
+  /** The directory chosen for this project, or null while it has none. */
+  async get(ref) {
+    const paths = await this.load();
+    return paths[projectKey(ref)] ?? paths[ref.id] ?? null;
+  }
+  async all() {
+    return { ...await this.load() };
+  }
+  /**
+   * The project already placed in this directory, if any other one is.
+   *
+   * Answers with the key as stored — the couple, or the bare id for an entry an
+   * older version wrote — which is enough to say "taken" and to name it.
+   */
+  async projectAt(path, exclude) {
+    const target = resolve(path);
+    const excluded = exclude ? [projectKey(exclude), exclude.id] : [];
+    for (const [key, dir] of Object.entries(await this.load())) {
+      if (!excluded.includes(key) && resolve(dir) === target) return key;
+    }
+    return null;
+  }
+  async set(ref, path) {
+    if (!isAbsolute(path)) throw new Error("Le chemin du projet doit \xEAtre absolu");
+    const paths = await this.load();
+    delete paths[ref.id];
+    paths[projectKey(ref)] = resolve(path);
+    await this.persist();
+  }
+  /**
+   * Faire suivre le répertoire quand un projet change d'organisation.
+   *
+   * La clé est le couple `(organisation, projet)` : publier un projet local le
+   * fait passer de `local:<id>` à `<org>:<id>`, et l'entrée d'avant cesse alors
+   * de répondre — `get` ne retombe que sur l'identifiant nu, forme héritée, pas
+   * sur `local:<id>`. Le projet se retrouvait donc sans emplacement connu juste
+   * après avoir été publié, alors que ses sources n'avaient pas bougé d'un
+   * octet.
+   */
+  async relocate(from, to) {
+    const paths = await this.load();
+    const previous = paths[projectKey(from)] ?? paths[from.id];
+    if (!previous) return;
+    delete paths[projectKey(from)];
+    delete paths[from.id];
+    paths[projectKey(to)] = previous;
+    await this.persist();
+  }
+  async clear(ref) {
+    const paths = await this.load();
+    const keys = [projectKey(ref), ref.id].filter((k) => k in paths);
+    if (keys.length === 0) return;
+    for (const key of keys) delete paths[key];
+    await this.persist();
+  }
+  /** Test seam: forget what was read from disk. */
+  reset() {
+    this.paths = null;
+  }
+};
+function isPathMap(value) {
+  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
+}
+async function holdsRuneyaProject(path) {
+  for (const candidate of ["project.json", "projects.json"]) {
+    try {
+      await stat(join3(path, ".runeya", candidate));
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+var projectPathStore = new ProjectPathStore();
+
 // ../server/src/services/project-store.ts
-var FILENAME = "project.json";
+var FILENAME2 = "project.json";
 var LEGACY_FILENAME = "projects.json";
 function toDiskForm(project) {
   const { activeEnvironmentId: _runtimeOnly, ...rest } = project;
@@ -594,14 +696,14 @@ async function readLocalProject() {
   const root = localVaultRoot();
   let current = null;
   try {
-    const raw = await readFile2(join3(root, FILENAME), "utf-8");
+    const raw = await readFile3(join4(root, FILENAME2), "utf-8");
     const parsed = ProjectSchema.safeParse(JSON.parse(raw));
     if (parsed.success) current = parsed.data;
   } catch {
   }
   let legacy;
   try {
-    legacy = JSON.parse(await readFile2(join3(root, LEGACY_FILENAME), "utf-8"));
+    legacy = JSON.parse(await readFile3(join4(root, LEGACY_FILENAME), "utf-8"));
   } catch {
     return { local: current, strayCloud: [] };
   }
@@ -611,7 +713,7 @@ async function readLocalProject() {
   if (locals.length > 1) {
     const names = locals.map((p) => `"${p.name}" (${p.id})`).join(", ");
     throw new Error(
-      `${join3(root, LEGACY_FILENAME)} holds ${locals.length} local projects: ${names}. A directory now holds a single local project \u2014 move the others to their own directory, or into an organization, then start again.`
+      `${join4(root, LEGACY_FILENAME)} holds ${locals.length} local projects: ${names}. A directory now holds a single local project \u2014 move the others to their own directory, or into an organization, then start again.`
     );
   }
   return { local: locals[0] ?? null, strayCloud };
@@ -620,7 +722,7 @@ async function readCloudProjects() {
   const found = [];
   for (const { orgId, projectId, root } of await listCloudVaults()) {
     try {
-      const raw = await readFile2(join3(root, FILENAME), "utf-8");
+      const raw = await readFile3(join4(root, FILENAME2), "utf-8");
       const parsed = ProjectSchema.safeParse({ ...JSON.parse(raw), id: projectId, orgId });
       if (parsed.success) found.push({ project: parsed.data, root });
     } catch {
@@ -650,13 +752,13 @@ var ProjectStore = class {
   /** Emits `'saved'` after every persisted mutation, for the cloud sync bridge. */
   events = new EventEmitter();
   getFilePath(root = localVaultRoot()) {
-    return join3(root, FILENAME);
+    return join4(root, FILENAME2);
   }
   async writeAtomic(filePath, data) {
     const tmpPath = filePath + ".tmp";
-    await writeFile3(tmpPath, data, "utf-8");
-    await rename2(tmpPath, filePath);
-    await chmod2(filePath, 384);
+    await writeFile4(tmpPath, data, "utf-8");
+    await rename3(tmpPath, filePath);
+    await chmod3(filePath, 384);
   }
   /** Adopt a project read from disk, remembering which vault it came from. */
   async absorb(p, root) {
@@ -731,10 +833,10 @@ var ProjectStore = class {
       await rm(this.getFilePath(), { force: true }).catch(() => {
       });
     }
-    await rename2(join3(localVaultRoot(), LEGACY_FILENAME), join3(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
+    await rename3(join4(localVaultRoot(), LEGACY_FILENAME), join4(localVaultRoot(), LEGACY_FILENAME + ".bak")).catch(() => {
     });
     for (const { project, root } of cloud) {
-      await mkdir2(root, { recursive: true });
+      await mkdir3(root, { recursive: true });
       await this.writeAtomic(this.getFilePath(root), JSON.stringify(toDiskForm(project), null, 2));
       setProjectVault(project, root);
     }
@@ -862,6 +964,7 @@ var ProjectStore = class {
     this.projects.delete(key);
     await this.save();
     await this.discardVault(project);
+    await projectPathStore.clear(project);
     return true;
   }
   /**
@@ -895,6 +998,7 @@ var ProjectStore = class {
     forgetProject(project);
     await serviceStore.forgetLocally(project.serviceIds ?? []);
     await environmentStore.forgetByProject(project.id);
+    await projectPathStore.clear(project);
   }
   /** All projects linked to a given organization (for the sync bridge). */
   async listByOrg(orgId) {
@@ -1023,9 +1127,9 @@ var projectStore = new ProjectStore();
 registerProjectLoader(() => projectStore.list().then(() => void 0));
 
 // ../server/src/services/environment-overrides-store.ts
-import { readFile as readFile3, writeFile as writeFile4, rename as rename3, mkdir as mkdir3, chmod as chmod3 } from "fs/promises";
-import { dirname as dirname2, join as join4 } from "path";
-var FILENAME2 = "environment-overrides.json";
+import { readFile as readFile4, writeFile as writeFile5, rename as rename4, mkdir as mkdir4, chmod as chmod4 } from "fs/promises";
+import { dirname as dirname2, join as join5 } from "path";
+var FILENAME3 = "environment-overrides.json";
 var EnvironmentOverridesStore = class {
   data = {};
   loaded = false;
@@ -1057,11 +1161,11 @@ var EnvironmentOverridesStore = class {
   async rootFor(variableId) {
     const root = await environmentStore.rootOfVariable(variableId);
     if (root) return root;
-    return this.roots.get(variableId) ?? dirname2(await keyedFilePath(FILENAME2));
+    return this.roots.get(variableId) ?? dirname2(await keyedFilePath(FILENAME3));
   }
   /** Where earlier versions kept them: read once, rewritten to their vaults. */
   getLegacyFilePath() {
-    return legacyMachineFilePath(FILENAME2);
+    return legacyMachineFilePath(FILENAME3);
   }
   /**
    * Read every vault, then the places older versions used.
@@ -1077,13 +1181,13 @@ var EnvironmentOverridesStore = class {
     const roots = await allVaultRoots();
     const sources = [
       this.getLegacyFilePath(),
-      await keyedFilePath(FILENAME2),
-      ...roots.map((root) => join4(root, FILENAME2))
+      await keyedFilePath(FILENAME3),
+      ...roots.map((root) => join5(root, FILENAME3))
     ];
     for (const path of sources) {
       let parsed;
       try {
-        parsed = JSON.parse(await readFile3(path, "utf-8"));
+        parsed = JSON.parse(await readFile4(path, "utf-8"));
       } catch {
         continue;
       }
@@ -1134,12 +1238,12 @@ var EnvironmentOverridesStore = class {
         this.diskEncryptedSlots,
         extractEncryptedVariableSlots(encrypted)
       );
-      await mkdir3(root, { recursive: true });
-      const path = join4(root, FILENAME2);
+      await mkdir4(root, { recursive: true });
+      const path = join5(root, FILENAME3);
       const tmpPath = path + ".tmp";
-      await writeFile4(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
-      await rename3(tmpPath, path);
-      await chmod3(path, 384);
+      await writeFile5(tmpPath, JSON.stringify(encrypted, null, 2), "utf-8");
+      await rename4(tmpPath, path);
+      await chmod4(path, 384);
     }
   }
   /**
@@ -1571,7 +1675,7 @@ var EnvironmentResolver = class {
 var environmentResolver = new EnvironmentResolver();
 
 // ../server/src/services/audit-service.ts
-import { appendFile, readFile as readFile4, stat, rename as rename4, unlink, readdir, mkdir as mkdir4 } from "fs/promises";
+import { appendFile, readFile as readFile5, stat as stat2, rename as rename5, unlink, readdir, mkdir as mkdir5 } from "fs/promises";
 var AUDIT_FILENAME = "audit.log";
 var MAX_FILE_SIZE = 10 * 1024 * 1024;
 var MAX_AGE_DAYS = 30;
@@ -1591,7 +1695,7 @@ var AuditService = class {
     const line = JSON.stringify(record) + "\n";
     const filepath = this.getFilePath();
     try {
-      await mkdir4(machineRoot(), { recursive: true });
+      await mkdir5(machineRoot(), { recursive: true });
       await appendFile(filepath, line, "utf-8");
       await this.rotateIfNeeded();
     } catch (err) {
@@ -1604,7 +1708,7 @@ var AuditService = class {
     const filepath = this.getFilePath();
     let lines;
     try {
-      const content = await readFile4(filepath, "utf-8");
+      const content = await readFile5(filepath, "utf-8");
       lines = content.trim().split("\n").filter(Boolean);
     } catch {
       return { entries: [], total: 0 };
@@ -1635,9 +1739,9 @@ var AuditService = class {
   async rotateIfNeeded() {
     const filepath = this.getFilePath();
     try {
-      const stats = await stat(filepath);
+      const stats = await stat2(filepath);
       if (stats.size > MAX_FILE_SIZE) {
-        await rename4(filepath, this.getRotatedPath());
+        await rename5(filepath, this.getRotatedPath());
       }
     } catch {
     }
@@ -1662,87 +1766,6 @@ var AuditService = class {
 };
 var auditService = new AuditService();
 
-// ../server/src/services/project-path-store.ts
-import { readFile as readFile5, writeFile as writeFile5, rename as rename5, mkdir as mkdir5, chmod as chmod4, stat as stat2 } from "fs/promises";
-import { isAbsolute, join as join5, resolve } from "path";
-var FILENAME3 = "project-paths.json";
-var ProjectPathStore = class {
-  paths = null;
-  async load() {
-    if (this.paths) return this.paths;
-    try {
-      const raw = await readFile5(machineFilePath(FILENAME3), "utf-8");
-      const parsed = JSON.parse(raw);
-      this.paths = isPathMap(parsed) ? parsed : {};
-    } catch {
-      this.paths = {};
-    }
-    return this.paths;
-  }
-  async persist() {
-    await mkdir5(machineRoot(), { recursive: true });
-    const filePath = machineFilePath(FILENAME3);
-    const tmpPath = `${filePath}.tmp`;
-    await writeFile5(tmpPath, JSON.stringify(this.paths ?? {}, null, 2), "utf-8");
-    await rename5(tmpPath, filePath);
-    await chmod4(filePath, 384);
-  }
-  /** The directory chosen for this project, or null while it has none. */
-  async get(ref) {
-    const paths = await this.load();
-    return paths[projectKey(ref)] ?? paths[ref.id] ?? null;
-  }
-  async all() {
-    return { ...await this.load() };
-  }
-  /**
-   * The project already placed in this directory, if any other one is.
-   *
-   * Answers with the key as stored — the couple, or the bare id for an entry an
-   * older version wrote — which is enough to say "taken" and to name it.
-   */
-  async projectAt(path, exclude) {
-    const target = resolve(path);
-    const excluded = exclude ? [projectKey(exclude), exclude.id] : [];
-    for (const [key, dir] of Object.entries(await this.load())) {
-      if (!excluded.includes(key) && resolve(dir) === target) return key;
-    }
-    return null;
-  }
-  async set(ref, path) {
-    if (!isAbsolute(path)) throw new Error("Le chemin du projet doit \xEAtre absolu");
-    const paths = await this.load();
-    delete paths[ref.id];
-    paths[projectKey(ref)] = resolve(path);
-    await this.persist();
-  }
-  async clear(ref) {
-    const paths = await this.load();
-    const keys = [projectKey(ref), ref.id].filter((k) => k in paths);
-    if (keys.length === 0) return;
-    for (const key of keys) delete paths[key];
-    await this.persist();
-  }
-  /** Test seam: forget what was read from disk. */
-  reset() {
-    this.paths = null;
-  }
-};
-function isPathMap(value) {
-  return !!value && typeof value === "object" && !Array.isArray(value) && Object.values(value).every((v) => typeof v === "string");
-}
-async function holdsRuneyaProject(path) {
-  for (const candidate of ["project.json", "projects.json"]) {
-    try {
-      await stat2(join5(path, ".runeya", candidate));
-      return true;
-    } catch {
-    }
-  }
-  return false;
-}
-var projectPathStore = new ProjectPathStore();
-
 // ../server/src/services/org-keys.ts
 import { mkdir as mkdir6 } from "fs/promises";
 
@@ -1967,9 +1990,7 @@ async function installOrgKey(orgId, key, masterPassword) {
 }
 var OrgVaultUnreadableError = class extends Error {
   constructor(orgId) {
-    super(
-      "Cette organisation est chiffr\xE9e par une cl\xE9 que cette machine n'a pas. Demandez la cl\xE9 \xE0 un membre et adoptez-la avant d'ouvrir ses projets."
-    );
+    super("ORG_VAULT_UNREADABLE");
     this.orgId = orgId;
     this.name = "OrgVaultUnreadableError";
   }
@@ -3503,6 +3524,30 @@ var ConversationStore = class {
     const json = decryptValue(encrypted, vault);
     return JSON.parse(json);
   }
+  /**
+   * Refuser d'écrire dans le coffre d'une organisation sans nommer sa clé.
+   *
+   * `getEncryptionKey(undefined)` rend la clé machine, et c'est le bon défaut
+   * pour le coffre local. Appliqué à un fichier rangé sous `orgs/<org>/`, il
+   * produit un chiffré que ce coffre n'emploie pas — lisible par personne à la
+   * relecture, et impossible à distinguer d'une corruption.
+   *
+   * Le cas a été observé plusieurs fois sans qu'on parvienne à nommer le
+   * chemin fautif : les garde-fous en place traitent le coffre fermé, le
+   * coffre mal résolu et la copie périmée, aucun ne couvrait « coffre non
+   * précisé ». Ces écritures-là n'ont jamais fonctionné — elles échouaient en
+   * silence, ce qui est pire. On les saute désormais en le disant, avec la
+   * pile d'appels qui manquait pour remonter au chemin fautif.
+   */
+  isVaultNamed(root, vault) {
+    const orgId = orgIdOfRoot(root);
+    if (!orgId || vault) return true;
+    console.error(
+      `[conversation-store] \xC9criture ignor\xE9e dans le coffre de l'organisation ${orgId} (${root}) : aucune cl\xE9 d'organisation nomm\xE9e, le contenu serait chiffr\xE9 par la cl\xE9 machine et illisible \xE0 la relecture.
+${new Error("trace").stack}`
+    );
+    return false;
+  }
   toDisk(conv, vault) {
     return {
       id: conv.id,
@@ -3558,6 +3603,7 @@ var ConversationStore = class {
       return;
     }
     this.loaded = true;
+    this.unreadable.clear();
     await ensureProjectsLoaded();
     const vaults = await allVaultRoots();
     const legacyPaths = [this.getLegacyFilePath(), await keyedFilePath(FILENAME5)];
@@ -3633,7 +3679,9 @@ var ConversationStore = class {
       const root = await this.rootFor(conv);
       this.roots.set(conv.id, root);
       const bucket = byRoot.get(root) ?? [];
-      bucket.push(this.toDisk(conv, vaultIdOfRoot(root)));
+      const vault = vaultIdOfRoot(root);
+      if (!this.isVaultNamed(root, vault)) continue;
+      bucket.push(this.toDisk(conv, vault));
       byRoot.set(root, bucket);
     }
     for (const [root, items] of this.unreadable) {
@@ -3907,6 +3955,26 @@ var setupRouter = router({
       }))
     };
   }),
+  /**
+   * Éprouver une clé contre le canari du coffre, sans passer par le cloud.
+   *
+   * `cloudSync.checkOrgKey` interroge le canari publié par l'organisation :
+   * il prouve « cette clé est celle de l'organisation », mais il exige que le
+   * cloud réponde et que l'organisation y existe encore. Un poste hors ligne —
+   * ou qui reprend un coffre dont l'organisation a disparu côté cloud — n'avait
+   * alors plus aucun moyen de vérifier une clé avant de l'adopter.
+   *
+   * Le coffre porte pourtant son propre canari, écrit en même temps que sa clé.
+   * Il répond à la question qui compte ici : cette clé ouvre-t-elle CE coffre ?
+   */
+  checkOrgKeyLocal: protectedProcedure.input(z7.object({
+    orgId: z7.string().min(1).max(128),
+    keyHex: z7.string().length(64).regex(/^[0-9a-f]+$/i, "Invalid hex format")
+  })).query(async ({ input }) => {
+    const canary = await readVerifyFile(orgVaultRoot(input.orgId));
+    if (!canary) return { matches: false, hasCanary: false };
+    return { matches: matchesCanary(canary, Buffer.from(input.keyHex, "hex")), hasCanary: true };
+  }),
   /**
    * Submit and validate encryption key.
    * Attempts to decrypt existing data to validate the key.
@@ -7715,7 +7783,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-EDFP4VXP.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-NJMLCIVW.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -8368,7 +8436,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-EDFP4VXP.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-NJMLCIVW.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -13536,18 +13604,27 @@ async function orgsToSync() {
 
 // ../server/src/services/org-canary.ts
 var CanaryUnavailableError = class extends Error {
-  code = "CANARY_UNAVAILABLE";
-  constructor(message) {
-    super(message);
+  /** `detail` reste pour les journaux ; le message est le code, pour l'interface. */
+  constructor(detail) {
+    super("CANARY_UNAVAILABLE");
+    this.detail = detail;
     this.name = "CanaryUnavailableError";
   }
+  code = "CANARY_UNAVAILABLE";
 };
 var OrgKeyMismatchError = class extends Error {
   code = "ORG_KEY_MISMATCH";
+  /**
+   * Le message EST le code, comme partout ailleurs sur ces routes.
+   *
+   * Une phrase écrite ici traverse le serveur telle quelle et s'affiche dans
+   * l'interface sans passer par la traduction : une interface en français
+   * annonçait donc l'échec en anglais, et le texte ne pouvait renvoyer nulle
+   * part puisque le serveur ignore où se trouve l'écran qui répare. Le client
+   * traduit `serverErrors.ORG_KEY_MISMATCH` et nomme le chemin.
+   */
   constructor() {
-    super(
-      "This organization uses a different encryption key. Ask a member for the key already in use, then set it up on this machine before syncing."
-    );
+    super("ORG_KEY_MISMATCH");
     this.name = "OrgKeyMismatchError";
   }
 };
@@ -14341,8 +14418,10 @@ var CloudSyncBridge = class {
       }
       console.warn(
         "[cloud-sync] org %s: could not check the organization key (%s) \u2014 syncing anyway.",
+        // Le message porte désormais le code, destiné à l'interface ; le détail
+        // lisible reste sur l'erreur, et c'est lui qui a sa place dans un log.
         link.orgId,
-        err.message
+        err.detail ?? err.message
       );
     }
     this.keyMismatch.delete(link.orgId);
@@ -14619,6 +14698,10 @@ var cloudSyncRouter = router({
       await cloudSyncBridge.connect({ orgId: input.orgId, cloudUrl: input.cloudUrl });
     }
     await projectStore.moveToOrg(input.projectId, input.orgId);
+    await projectPathStore.relocate(
+      { id: input.projectId, orgId: null },
+      { id: input.projectId, orgId: input.orgId }
+    );
     await conversationStore.relocateAll();
     try {
       await cloudSyncBridge.followProject(input.orgId, input.projectId);
@@ -17193,4 +17276,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-V3J62F6F.js.map
+//# sourceMappingURL=src-FYMPMNWX.js.map