@runeya/runeya 2.0.70 → 2.0.72

package/agent-manager-YDLSYZE3.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-HPYBAUAH.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-YDLSYZE3.js.map

package/{chunk-YSJ6OJGN.js → chunk-HPYBAUAH.js}

@@ -1,7 +1,7 @@
 // ../server/src/services/agent-manager.ts
 import { EventEmitter as EventEmitter2 } from "events";
 import WebSocket2 from "ws";
-import { z as z21 } from "zod";
+import { z as z23 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
@@ -1758,6 +1758,49 @@ var KanbanCardRefSchema = z20.object({
   commentCount: z20.number().int().nonnegative().default(0)
 });
 
+// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
+import { z as z21 } from "zod";
+var CloudApiScopeSchema = z21.enum(["kanban:read", "kanban:write", "kanban:comment"]);
+var CloudApiKeySecretSchema = z21.string().regex(/^rk_[0-9a-f]{64}$/);
+var CloudApiKeySchema = z21.object({
+  id: z21.string().max(128),
+  organizationId: z21.string().max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  /**
+   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
+   * l'organisation ».
+   *
+   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
+   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
+   * nommait plus que lui.
+   */
+  boards: z21.array(z21.string().max(64)).max(200).nullable(),
+  createdAt: z21.string().max(64),
+  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
+  lastUsedAt: z21.string().max(64).nullable(),
+  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
+  createdBy: z21.object({ id: z21.string().max(128), name: z21.string().max(200) }),
+  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
+  keyPreview: z21.string().max(8)
+});
+var CreatedCloudApiKeySchema = z21.object({
+  key: CloudApiKeySchema,
+  secret: CloudApiKeySecretSchema
+});
+var CreateCloudApiKeyInput = z21.object({
+  organizationId: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().default(null)
+});
+var UpdateCloudApiKeyInput = z21.object({
+  id: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200).optional(),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10).optional(),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().optional()
+});
+
 // ../../packages/shared/src/utils/crypto.ts
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3, pbkdf2Sync } from "crypto";
 
@@ -3092,11 +3135,351 @@ var ServiceStore = class {
 var serviceStore = new ServiceStore();
 
 // ../server/src/services/agent-spawner.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
-import { dirname as dirname2, join as join5 } from "path";
+import { dirname as dirname2, join as join6 } from "path";
 import { fileURLToPath } from "url";
+
+// ../server/src/services/instance-registry.ts
+import { mkdir as mkdir5, readdir as readdir2, readFile as readFile5, writeFile as writeFile5, rm as rm3 } from "fs/promises";
+import { readFileSync } from "fs";
+import dotenv from "dotenv";
+import { spawn } from "child_process";
+import { join as join5 } from "path";
+import { z as z22 } from "zod";
+var InstanceFileSchema = z22.object({
+  pid: z22.number().int().positive(),
+  /**
+   * The agent this server spawned, when it has one.
+   *
+   * Optional because an instance started before this field existed never wrote
+   * it, and because the agent may not be up yet — or at all, when the
+   * encryption key is missing. Absent means « unknown », never « none ».
+   */
+  agentPid: z22.number().int().positive().optional(),
+  port: z22.number().int().min(1).max(65535),
+  agentPort: z22.number().int().min(1).max(65535),
+  cwd: z22.string().max(4096),
+  dataDir: z22.string().max(4096),
+  version: z22.string().max(64),
+  fromDesktop: z22.boolean(),
+  startedAt: z22.number().int().nonnegative(),
+  /**
+   * De quoi relancer ce lancement à l'identique : l'exécutable, ses arguments,
+   * et les `RUNEYA_*` de son environnement. Le `cwd` ci-dessus complète le
+   * tableau.
+   *
+   * Optionnels, comme `agentPid` : une instance antérieure à ce champ ne les
+   * écrit pas. Elle reste listée et arrêtable, simplement pas redémarrable —
+   * un redémarrage approximatif serait pire qu'un bouton absent.
+   */
+  execPath: z22.string().max(4096).optional(),
+  argv: z22.array(z22.string().max(4096)).max(128).optional(),
+  env: z22.record(z22.string().max(64), z22.string().max(4096)).optional(),
+  /**
+   * L'instance tient un secret (`RUNEYA_ENCRYPTION_KEY`,
+   * `RUNEYA_MASTER_PASSWORD`) que le relancement ne retrouverait pas. Le
+   * drapeau, jamais la valeur : le registre est un fichier lisible, et ces
+   * deux-là n'ont délibérément pas de flag CLI parce qu'`argv` se lit dans
+   * `ps`.
+   *
+   * Un secret posé dans le `.env` de la pile ne compte pas : `dotenv` le relit
+   * au démarrage depuis le même répertoire. Voir `secretsAreReproducible()`.
+   */
+  needsSecretEnv: z22.boolean().optional()
+});
+function registryDir() {
+  return join5(machineRoot(), "instances");
+}
+function fileFor(pid) {
+  return join5(registryDir(), `${pid}.json`);
+}
+var published = null;
+var SECRET_ENV_KEYS = ["RUNEYA_ENCRYPTION_KEY", "RUNEYA_MASTER_PASSWORD"];
+function isSecretEnvKey(key) {
+  return SECRET_ENV_KEYS.includes(key);
+}
+function runeyaEnv() {
+  const out = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith("RUNEYA_") || isSecretEnvKey(key)) continue;
+    if (typeof value === "string" && value.length <= 4096) out[key] = value;
+  }
+  return out;
+}
+function secretsAreReproducible() {
+  const present = SECRET_ENV_KEYS.filter((key) => Boolean(process.env[key]));
+  if (present.length === 0) return true;
+  let fromFile;
+  try {
+    fromFile = dotenv.parse(readFileSync(join5(process.cwd(), ".env")));
+  } catch {
+    return false;
+  }
+  return present.every((key) => fromFile[key] === process.env[key]);
+}
+function selfRecord() {
+  return {
+    pid: process.pid,
+    port: env.PORT,
+    agentPort: env.RUNEYA_AGENT_PORT,
+    cwd: process.cwd(),
+    dataDir: env.DATA_DIR,
+    version: process.env["RUNEYA_VERSION"] ?? "unknown",
+    fromDesktop: env.FROM_DESKTOP,
+    startedAt: Date.now(),
+    execPath: process.execPath,
+    // argv[0] est l'exécutable, déjà repris par `execPath` ; le reste est le
+    // script suivi de ses arguments, c'est-à-dire ce qu'il faut repasser à spawn.
+    argv: process.argv.slice(1),
+    env: runeyaEnv(),
+    needsSecretEnv: !secretsAreReproducible()
+  };
+}
+async function registerInstance() {
+  try {
+    await mkdir5(registryDir(), { recursive: true });
+    published = selfRecord();
+    await writeFile5(fileFor(process.pid), JSON.stringify(published, null, 2));
+  } catch (err) {
+    console.log("[instances] Could not register this instance:", err.message);
+  }
+}
+async function unregisterInstance() {
+  await rm3(fileFor(process.pid), { force: true }).catch(() => {
+  });
+}
+async function setInstanceAgentPid(agentPid) {
+  if (!published) return;
+  published = { ...published, agentPid: agentPid ?? void 0 };
+  try {
+    await writeFile5(fileFor(process.pid), JSON.stringify(published, null, 2));
+  } catch {
+  }
+}
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+async function probe(port) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/api/trpc/health.check`, {
+      signal: AbortSignal.timeout(1500)
+    });
+    if (!res.ok) return { ok: false, uptimeMs: null, version: null };
+    const body = await res.json();
+    const data = body.result?.data;
+    return { ok: true, uptimeMs: data?.uptime ?? null, version: data?.version ?? null };
+  } catch {
+    return { ok: false, uptimeMs: null, version: null };
+  }
+}
+async function listInstances() {
+  let files;
+  try {
+    files = await readdir2(registryDir());
+  } catch {
+    return [];
+  }
+  const found = await Promise.all(
+    files.filter((f) => f.endsWith(".json")).map(async (name) => {
+      const path = join5(registryDir(), name);
+      let record;
+      try {
+        const parsed = InstanceFileSchema.safeParse(JSON.parse(await readFile5(path, "utf8")));
+        if (!parsed.success) {
+          await rm3(path, { force: true }).catch(() => {
+          });
+          return null;
+        }
+        record = parsed.data;
+      } catch {
+        return null;
+      }
+      if (!isProcessAlive(record.pid)) {
+        await rm3(path, { force: true }).catch(() => {
+        });
+        return null;
+      }
+      const { ok, uptimeMs, version } = await probe(record.port);
+      if (!ok) {
+        await rm3(path, { force: true }).catch(() => {
+        });
+        return null;
+      }
+      const current = record.pid === process.pid;
+      const blocker = restartBlockerFor(record);
+      return {
+        ...record,
+        // Trust the live answer over the file: the file was written at boot
+        // and an upgraded instance would keep claiming its old version.
+        version: version ?? record.version,
+        reachable: true,
+        current,
+        uptimeMs,
+        restartable: blocker === null,
+        restartBlockedBy: blocker
+      };
+    })
+  );
+  return dedupeByPort(found.filter((i) => i !== null)).sort((a, b) => Number(b.current) - Number(a.current) || a.port - b.port);
+}
+function dedupeByPort(instances) {
+  const byPort = /* @__PURE__ */ new Map();
+  for (const instance of instances) {
+    const kept = byPort.get(instance.port);
+    if (!kept || instance.current || !kept.current && instance.startedAt > kept.startedAt) {
+      byPort.set(instance.port, instance);
+    }
+  }
+  return [...byPort.values()];
+}
+function restartBlockerFor(record) {
+  if (record.needsSecretEnv) return "secrets";
+  if (!record.execPath || !record.argv) return "legacy";
+  return null;
+}
+var GRACE_MS = 5e3;
+var POLL_MS = 100;
+async function terminate(pid) {
+  if (!isProcessAlive(pid)) return "absent";
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch (err) {
+    const code = err.code;
+    if (code === "ESRCH") return "absent";
+    if (code === "EPERM") return "denied";
+    return "failed";
+  }
+  const deadline = Date.now() + GRACE_MS;
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+    if (!isProcessAlive(pid)) return "terminated";
+  }
+  try {
+    process.kill(pid, "SIGKILL");
+  } catch (err) {
+    return err.code === "ESRCH" ? "terminated" : "failed";
+  }
+  await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+  return isProcessAlive(pid) ? "failed" : "killed";
+}
+async function killInstance(pid) {
+  const target = (await listInstances()).find((i) => i.pid === pid);
+  if (!target) throw new Error("instance-not-found");
+  if (target.current) throw new Error("instance-is-current");
+  const agent = target.agentPid ? await terminate(target.agentPid) : "absent";
+  const server = await terminate(pid);
+  if (server === "terminated" || server === "killed") {
+    await rm3(fileFor(pid), { force: true }).catch(() => {
+    });
+  }
+  return { agent, server };
+}
+function launchOf(record) {
+  if (!record.execPath || !record.argv) throw new Error("instance-not-restartable:legacy");
+  const env2 = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (typeof value === "string" && !key.startsWith("RUNEYA_")) env2[key] = value;
+  }
+  return {
+    execPath: record.execPath,
+    argv: record.argv,
+    cwd: record.cwd,
+    env: { ...env2, ...record.env ?? {} }
+  };
+}
+var PORT_RELEASE_TIMEOUT_MS = 15e3;
+async function waitForPortRelease(port) {
+  const deadline = Date.now() + PORT_RELEASE_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const { ok } = await probe(port);
+    if (!ok) return true;
+    await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+  }
+  return false;
+}
+async function restartInstance(pid) {
+  const target = (await listInstances()).find((i) => i.pid === pid);
+  if (!target) throw new Error("instance-not-found");
+  if (target.restartBlockedBy) throw new Error(`instance-not-restartable:${target.restartBlockedBy}`);
+  if (target.current) throw new Error("instance-is-current");
+  const stop = await killInstance(pid);
+  if (stop.server !== "terminated" && stop.server !== "killed") {
+    throw new Error(`instance-stop-${stop.server}`);
+  }
+  const portReleased = await waitForPortRelease(target.port);
+  const launch = launchOf(target);
+  const child = spawn(launch.execPath, launch.argv, {
+    cwd: launch.cwd,
+    env: launch.env,
+    detached: true,
+    stdio: "ignore"
+  });
+  child.on("error", (err) => {
+    console.log(`[instances] Relance du pid ${pid} impossible :`, err.message);
+  });
+  child.unref();
+  if (typeof child.pid !== "number") throw new Error("instance-restart-failed");
+  return { stop, pid: child.pid, portReleased };
+}
+var RELAUNCHER = `
+  const p = JSON.parse(process.env.RUNEYA_RELAUNCH_PAYLOAD);
+  const deadline = Date.now() + p.timeoutMs;
+  const held = async () => {
+    try {
+      const res = await fetch('http://127.0.0.1:' + p.port + '/api/trpc/health.check', {
+        signal: AbortSignal.timeout(500),
+      });
+      return res.ok;
+    } catch { return false; }
+  };
+  (async () => {
+    while (Date.now() < deadline && await held()) {
+      await new Promise((r) => setTimeout(r, ${POLL_MS}));
+    }
+    require('node:child_process')
+      .spawn(p.execPath, p.argv, { cwd: p.cwd, env: p.env, detached: true, stdio: 'ignore' })
+      .unref();
+  })();
+`;
+var SELF_RESTART_DELAY_MS = 250;
+function spawnRelauncher(record) {
+  const blocker = restartBlockerFor(record);
+  if (blocker) throw new Error(`instance-not-restartable:${blocker}`);
+  const launch = launchOf(record);
+  const relauncher = spawn(process.execPath, ["-e", RELAUNCHER], {
+    cwd: launch.cwd,
+    env: {
+      ...launch.env,
+      RUNEYA_RELAUNCH_PAYLOAD: JSON.stringify({ ...launch, port: record.port, timeoutMs: PORT_RELEASE_TIMEOUT_MS })
+    },
+    detached: true,
+    stdio: "ignore"
+  });
+  relauncher.on("error", (err) => {
+    console.log("[instances] Relanceur impossible \xE0 lancer :", err.message);
+  });
+  relauncher.unref();
+  if (typeof relauncher.pid !== "number") throw new Error("instance-restart-failed");
+  return relauncher.pid;
+}
+async function scheduleSelfRestart() {
+  const record = published ?? selfRecord();
+  const relauncherPid = spawnRelauncher(record);
+  setTimeout(() => {
+    console.log("[instances] Red\xE9marrage demand\xE9 : arr\xEAt de cette instance.");
+    process.kill(process.pid, "SIGTERM");
+  }, SELF_RESTART_DELAY_MS);
+  return { relauncherPid, port: record.port };
+}
+
+// ../server/src/services/agent-spawner.ts
 var POSIX_SAFE_KEYS = [
   "PATH",
   "HOME",
@@ -3212,11 +3595,12 @@ var AgentSpawner = class {
     }
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
-    this.agentDistPath = env.AGENT_BINARY_PATH || join5(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
-    this.agentProcess = spawn("node", [this.agentDistPath], {
+    this.agentDistPath = env.AGENT_BINARY_PATH || join6(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
+    this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
     });
+    void setInstanceAgentPid(this.agentProcess.pid ?? null);
     if (isDev) {
       this.setupFileWatcher();
     }
@@ -3299,6 +3683,7 @@ var AgentSpawner = class {
         setTimeout(resolve, 2e3);
       });
       this.agentProcess = null;
+      void setInstanceAgentPid(null);
     }
   }
   getLocalAgentId() {
@@ -3315,7 +3700,7 @@ var AgentSpawner = class {
       this.fileWatcher.close();
     }
     console.log("[agent-spawner] \u{1F50D} Watching agent dist for changes (hot reload enabled)");
-    const distDir = join5(this.agentDistPath, "..");
+    const distDir = join6(this.agentDistPath, "..");
     this.fileWatcher = watch(distDir, { persistent: false }, (eventType, filename) => {
       if ((eventType === "change" || eventType === "rename") && filename === "index.js" && !this.isRestarting) {
         this.isRestarting = true;
@@ -3348,7 +3733,7 @@ var AgentSpawner = class {
     }
     const agentUrl = `http://${env.RUNEYA_AGENT_HOST}:${env.RUNEYA_AGENT_PORT}`;
     const isDev = process.env.NODE_ENV === "development";
-    this.agentProcess = spawn("node", [this.agentDistPath], {
+    this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3624,13 +4009,13 @@ var AgentWSBridge = class extends EventEmitter {
 };
 
 // ../server/src/services/agent-manager.ts
-var HealthMessageSchema = z21.object({
-  status: z21.string(),
-  uptime: z21.number(),
-  runnersAvailable: z21.array(z21.enum(["native", "docker"])),
-  processCount: z21.number(),
-  runningCount: z21.number(),
-  lanIp: z21.string().optional()
+var HealthMessageSchema = z23.object({
+  status: z23.string(),
+  uptime: z23.number(),
+  runnersAvailable: z23.array(z23.enum(["native", "docker"])),
+  processCount: z23.number(),
+  runningCount: z23.number(),
+  lanIp: z23.string().optional()
 });
 var MIN_RECONNECT_DELAY = WS_RECONNECT_MIN;
 var MAX_RECONNECT_DELAY = WS_RECONNECT_MAX;
@@ -4016,9 +4401,9 @@ var AgentManager = class extends EventEmitter2 {
       if (spawns.length > 0) {
         const summary = spawns.map((s) => `${s.spawnId} (${s.cli}, ${s.status}, buf:${s.bufferLength})`).join(", ");
         console.log("[agent-manager] Agent %s has %d AI spawn(s): %s", agentId, spawns.length, summary);
-        for (const spawn2 of spawns) {
-          if (spawn2.status !== "running") {
-            this.agentMutation(agentId, "ai.ack", { spawnId: spawn2.spawnId }).catch(() => {
+        for (const spawn3 of spawns) {
+          if (spawn3.status !== "running") {
+            this.agentMutation(agentId, "ai.ack", { spawnId: spawn3.spawnId }).catch(() => {
             });
           }
         }
@@ -4184,8 +4569,14 @@ export {
   environmentStore,
   serviceStore,
   agentStore,
+  registerInstance,
+  unregisterInstance,
+  listInstances,
+  killInstance,
+  restartInstance,
+  scheduleSelfRestart,
   agentSpawner,
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-YSJ6OJGN.js.map
+//# sourceMappingURL=chunk-HPYBAUAH.js.map