@runeya/runeya 2.0.71 → 2.0.72

package/agent-manager-YDLSYZE3.js

@@ -0,0 +1,7 @@
+import {
+  agentManager
+} from "./chunk-HPYBAUAH.js";
+export {
+  agentManager
+};
+//# sourceMappingURL=agent-manager-YDLSYZE3.js.map

package/{chunk-Z3KAXI7V.js → chunk-HPYBAUAH.js}

@@ -1,7 +1,7 @@
 // ../server/src/services/agent-manager.ts
 import { EventEmitter as EventEmitter2 } from "events";
 import WebSocket2 from "ws";
-import { z as z22 } from "zod";
+import { z as z23 } from "zod";
 
 // ../server/src/services/agent-store.ts
 import { randomUUID, randomBytes, createCipheriv, createDecipheriv } from "crypto";
@@ -1758,6 +1758,49 @@ var KanbanCardRefSchema = z20.object({
   commentCount: z20.number().int().nonnegative().default(0)
 });
 
+// ../../packages/shared/src/schemas/cloud-api-key.schema.ts
+import { z as z21 } from "zod";
+var CloudApiScopeSchema = z21.enum(["kanban:read", "kanban:write", "kanban:comment"]);
+var CloudApiKeySecretSchema = z21.string().regex(/^rk_[0-9a-f]{64}$/);
+var CloudApiKeySchema = z21.object({
+  id: z21.string().max(128),
+  organizationId: z21.string().max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  /**
+   * Les tableaux que la clé peut atteindre, ou `null` pour « tous ceux de
+   * l'organisation ».
+   *
+   * `null` et `[]` ne sont pas la même chose : la liste vide n'ouvre rien, et
+   * c'est délibéré — un tableau supprimé ne doit pas élargir une clé qui ne le
+   * nommait plus que lui.
+   */
+  boards: z21.array(z21.string().max(64)).max(200).nullable(),
+  createdAt: z21.string().max(64),
+  /** Dernier usage constaté, pour reconnaître une clé oubliée. */
+  lastUsedAt: z21.string().max(64).nullable(),
+  /** Qui l'a émise — une clé sans visage ne se révoque jamais sereinement. */
+  createdBy: z21.object({ id: z21.string().max(128), name: z21.string().max(200) }),
+  /** Les 4 derniers caractères du secret, pour reconnaître une clé dans une liste. */
+  keyPreview: z21.string().max(8)
+});
+var CreatedCloudApiKeySchema = z21.object({
+  key: CloudApiKeySchema,
+  secret: CloudApiKeySecretSchema
+});
+var CreateCloudApiKeyInput = z21.object({
+  organizationId: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().default(null)
+});
+var UpdateCloudApiKeyInput = z21.object({
+  id: z21.string().min(1).max(128),
+  name: z21.string().min(1).max(200).optional(),
+  scopes: z21.array(CloudApiScopeSchema).min(1).max(10).optional(),
+  boards: z21.array(z21.string().max(64)).max(200).nullable().optional()
+});
+
 // ../../packages/shared/src/utils/crypto.ts
 import { createCipheriv as createCipheriv3, createDecipheriv as createDecipheriv3, randomBytes as randomBytes3, pbkdf2Sync } from "crypto";
 
@@ -3092,7 +3135,7 @@ var ServiceStore = class {
 var serviceStore = new ServiceStore();
 
 // ../server/src/services/agent-spawner.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { createInterface } from "readline";
 import { watch } from "fs";
 import { dirname as dirname2, join as join6 } from "path";
@@ -3100,10 +3143,13 @@ import { fileURLToPath } from "url";
 
 // ../server/src/services/instance-registry.ts
 import { mkdir as mkdir5, readdir as readdir2, readFile as readFile5, writeFile as writeFile5, rm as rm3 } from "fs/promises";
+import { readFileSync } from "fs";
+import dotenv from "dotenv";
+import { spawn } from "child_process";
 import { join as join5 } from "path";
-import { z as z21 } from "zod";
-var InstanceFileSchema = z21.object({
-  pid: z21.number().int().positive(),
+import { z as z22 } from "zod";
+var InstanceFileSchema = z22.object({
+  pid: z22.number().int().positive(),
   /**
    * The agent this server spawned, when it has one.
    *
@@ -3111,14 +3157,37 @@ var InstanceFileSchema = z21.object({
    * it, and because the agent may not be up yet — or at all, when the
    * encryption key is missing. Absent means « unknown », never « none ».
    */
-  agentPid: z21.number().int().positive().optional(),
-  port: z21.number().int().min(1).max(65535),
-  agentPort: z21.number().int().min(1).max(65535),
-  cwd: z21.string().max(4096),
-  dataDir: z21.string().max(4096),
-  version: z21.string().max(64),
-  fromDesktop: z21.boolean(),
-  startedAt: z21.number().int().nonnegative()
+  agentPid: z22.number().int().positive().optional(),
+  port: z22.number().int().min(1).max(65535),
+  agentPort: z22.number().int().min(1).max(65535),
+  cwd: z22.string().max(4096),
+  dataDir: z22.string().max(4096),
+  version: z22.string().max(64),
+  fromDesktop: z22.boolean(),
+  startedAt: z22.number().int().nonnegative(),
+  /**
+   * De quoi relancer ce lancement à l'identique : l'exécutable, ses arguments,
+   * et les `RUNEYA_*` de son environnement. Le `cwd` ci-dessus complète le
+   * tableau.
+   *
+   * Optionnels, comme `agentPid` : une instance antérieure à ce champ ne les
+   * écrit pas. Elle reste listée et arrêtable, simplement pas redémarrable —
+   * un redémarrage approximatif serait pire qu'un bouton absent.
+   */
+  execPath: z22.string().max(4096).optional(),
+  argv: z22.array(z22.string().max(4096)).max(128).optional(),
+  env: z22.record(z22.string().max(64), z22.string().max(4096)).optional(),
+  /**
+   * L'instance tient un secret (`RUNEYA_ENCRYPTION_KEY`,
+   * `RUNEYA_MASTER_PASSWORD`) que le relancement ne retrouverait pas. Le
+   * drapeau, jamais la valeur : le registre est un fichier lisible, et ces
+   * deux-là n'ont délibérément pas de flag CLI parce qu'`argv` se lit dans
+   * `ps`.
+   *
+   * Un secret posé dans le `.env` de la pile ne compte pas : `dotenv` le relit
+   * au démarrage depuis le même répertoire. Voir `secretsAreReproducible()`.
+   */
+  needsSecretEnv: z22.boolean().optional()
 });
 function registryDir() {
   return join5(machineRoot(), "instances");
@@ -3127,6 +3196,29 @@ function fileFor(pid) {
   return join5(registryDir(), `${pid}.json`);
 }
 var published = null;
+var SECRET_ENV_KEYS = ["RUNEYA_ENCRYPTION_KEY", "RUNEYA_MASTER_PASSWORD"];
+function isSecretEnvKey(key) {
+  return SECRET_ENV_KEYS.includes(key);
+}
+function runeyaEnv() {
+  const out = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (!key.startsWith("RUNEYA_") || isSecretEnvKey(key)) continue;
+    if (typeof value === "string" && value.length <= 4096) out[key] = value;
+  }
+  return out;
+}
+function secretsAreReproducible() {
+  const present = SECRET_ENV_KEYS.filter((key) => Boolean(process.env[key]));
+  if (present.length === 0) return true;
+  let fromFile;
+  try {
+    fromFile = dotenv.parse(readFileSync(join5(process.cwd(), ".env")));
+  } catch {
+    return false;
+  }
+  return present.every((key) => fromFile[key] === process.env[key]);
+}
 function selfRecord() {
   return {
     pid: process.pid,
@@ -3136,7 +3228,13 @@ function selfRecord() {
     dataDir: env.DATA_DIR,
     version: process.env["RUNEYA_VERSION"] ?? "unknown",
     fromDesktop: env.FROM_DESKTOP,
-    startedAt: Date.now()
+    startedAt: Date.now(),
+    execPath: process.execPath,
+    // argv[0] est l'exécutable, déjà repris par `execPath` ; le reste est le
+    // script suivi de ses arguments, c'est-à-dire ce qu'il faut repasser à spawn.
+    argv: process.argv.slice(1),
+    env: runeyaEnv(),
+    needsSecretEnv: !secretsAreReproducible()
   };
 }
 async function registerInstance() {
@@ -3214,14 +3312,18 @@ async function listInstances() {
         });
         return null;
       }
+      const current = record.pid === process.pid;
+      const blocker = restartBlockerFor(record);
       return {
         ...record,
         // Trust the live answer over the file: the file was written at boot
         // and an upgraded instance would keep claiming its old version.
         version: version ?? record.version,
         reachable: true,
-        current: record.pid === process.pid,
-        uptimeMs
+        current,
+        uptimeMs,
+        restartable: blocker === null,
+        restartBlockedBy: blocker
       };
     })
   );
@@ -3237,6 +3339,11 @@ function dedupeByPort(instances) {
   }
   return [...byPort.values()];
 }
+function restartBlockerFor(record) {
+  if (record.needsSecretEnv) return "secrets";
+  if (!record.execPath || !record.argv) return "legacy";
+  return null;
+}
 var GRACE_MS = 5e3;
 var POLL_MS = 100;
 async function terminate(pid) {
@@ -3274,6 +3381,103 @@ async function killInstance(pid) {
   }
   return { agent, server };
 }
+function launchOf(record) {
+  if (!record.execPath || !record.argv) throw new Error("instance-not-restartable:legacy");
+  const env2 = {};
+  for (const [key, value] of Object.entries(process.env)) {
+    if (typeof value === "string" && !key.startsWith("RUNEYA_")) env2[key] = value;
+  }
+  return {
+    execPath: record.execPath,
+    argv: record.argv,
+    cwd: record.cwd,
+    env: { ...env2, ...record.env ?? {} }
+  };
+}
+var PORT_RELEASE_TIMEOUT_MS = 15e3;
+async function waitForPortRelease(port) {
+  const deadline = Date.now() + PORT_RELEASE_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const { ok } = await probe(port);
+    if (!ok) return true;
+    await new Promise((resolve) => setTimeout(resolve, POLL_MS));
+  }
+  return false;
+}
+async function restartInstance(pid) {
+  const target = (await listInstances()).find((i) => i.pid === pid);
+  if (!target) throw new Error("instance-not-found");
+  if (target.restartBlockedBy) throw new Error(`instance-not-restartable:${target.restartBlockedBy}`);
+  if (target.current) throw new Error("instance-is-current");
+  const stop = await killInstance(pid);
+  if (stop.server !== "terminated" && stop.server !== "killed") {
+    throw new Error(`instance-stop-${stop.server}`);
+  }
+  const portReleased = await waitForPortRelease(target.port);
+  const launch = launchOf(target);
+  const child = spawn(launch.execPath, launch.argv, {
+    cwd: launch.cwd,
+    env: launch.env,
+    detached: true,
+    stdio: "ignore"
+  });
+  child.on("error", (err) => {
+    console.log(`[instances] Relance du pid ${pid} impossible :`, err.message);
+  });
+  child.unref();
+  if (typeof child.pid !== "number") throw new Error("instance-restart-failed");
+  return { stop, pid: child.pid, portReleased };
+}
+var RELAUNCHER = `
+  const p = JSON.parse(process.env.RUNEYA_RELAUNCH_PAYLOAD);
+  const deadline = Date.now() + p.timeoutMs;
+  const held = async () => {
+    try {
+      const res = await fetch('http://127.0.0.1:' + p.port + '/api/trpc/health.check', {
+        signal: AbortSignal.timeout(500),
+      });
+      return res.ok;
+    } catch { return false; }
+  };
+  (async () => {
+    while (Date.now() < deadline && await held()) {
+      await new Promise((r) => setTimeout(r, ${POLL_MS}));
+    }
+    require('node:child_process')
+      .spawn(p.execPath, p.argv, { cwd: p.cwd, env: p.env, detached: true, stdio: 'ignore' })
+      .unref();
+  })();
+`;
+var SELF_RESTART_DELAY_MS = 250;
+function spawnRelauncher(record) {
+  const blocker = restartBlockerFor(record);
+  if (blocker) throw new Error(`instance-not-restartable:${blocker}`);
+  const launch = launchOf(record);
+  const relauncher = spawn(process.execPath, ["-e", RELAUNCHER], {
+    cwd: launch.cwd,
+    env: {
+      ...launch.env,
+      RUNEYA_RELAUNCH_PAYLOAD: JSON.stringify({ ...launch, port: record.port, timeoutMs: PORT_RELEASE_TIMEOUT_MS })
+    },
+    detached: true,
+    stdio: "ignore"
+  });
+  relauncher.on("error", (err) => {
+    console.log("[instances] Relanceur impossible \xE0 lancer :", err.message);
+  });
+  relauncher.unref();
+  if (typeof relauncher.pid !== "number") throw new Error("instance-restart-failed");
+  return relauncher.pid;
+}
+async function scheduleSelfRestart() {
+  const record = published ?? selfRecord();
+  const relauncherPid = spawnRelauncher(record);
+  setTimeout(() => {
+    console.log("[instances] Red\xE9marrage demand\xE9 : arr\xEAt de cette instance.");
+    process.kill(process.pid, "SIGTERM");
+  }, SELF_RESTART_DELAY_MS);
+  return { relauncherPid, port: record.port };
+}
 
 // ../server/src/services/agent-spawner.ts
 var POSIX_SAFE_KEYS = [
@@ -3392,7 +3596,7 @@ var AgentSpawner = class {
     console.log(`[agent-spawner] Spawning local agent on ${agentUrl}...`);
     const isDev = process.env.NODE_ENV === "development";
     this.agentDistPath = env.AGENT_BINARY_PATH || join6(dirname2(fileURLToPath(import.meta.url)), "..", "..", "agent", "dist", "index.js");
-    this.agentProcess = spawn("node", [this.agentDistPath], {
+    this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3529,7 +3733,7 @@ var AgentSpawner = class {
     }
     const agentUrl = `http://${env.RUNEYA_AGENT_HOST}:${env.RUNEYA_AGENT_PORT}`;
     const isDev = process.env.NODE_ENV === "development";
-    this.agentProcess = spawn("node", [this.agentDistPath], {
+    this.agentProcess = spawn2("node", [this.agentDistPath], {
       env: agentEnv,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3805,13 +4009,13 @@ var AgentWSBridge = class extends EventEmitter {
 };
 
 // ../server/src/services/agent-manager.ts
-var HealthMessageSchema = z22.object({
-  status: z22.string(),
-  uptime: z22.number(),
-  runnersAvailable: z22.array(z22.enum(["native", "docker"])),
-  processCount: z22.number(),
-  runningCount: z22.number(),
-  lanIp: z22.string().optional()
+var HealthMessageSchema = z23.object({
+  status: z23.string(),
+  uptime: z23.number(),
+  runnersAvailable: z23.array(z23.enum(["native", "docker"])),
+  processCount: z23.number(),
+  runningCount: z23.number(),
+  lanIp: z23.string().optional()
 });
 var MIN_RECONNECT_DELAY = WS_RECONNECT_MIN;
 var MAX_RECONNECT_DELAY = WS_RECONNECT_MAX;
@@ -4197,9 +4401,9 @@ var AgentManager = class extends EventEmitter2 {
       if (spawns.length > 0) {
         const summary = spawns.map((s) => `${s.spawnId} (${s.cli}, ${s.status}, buf:${s.bufferLength})`).join(", ");
         console.log("[agent-manager] Agent %s has %d AI spawn(s): %s", agentId, spawns.length, summary);
-        for (const spawn2 of spawns) {
-          if (spawn2.status !== "running") {
-            this.agentMutation(agentId, "ai.ack", { spawnId: spawn2.spawnId }).catch(() => {
+        for (const spawn3 of spawns) {
+          if (spawn3.status !== "running") {
+            this.agentMutation(agentId, "ai.ack", { spawnId: spawn3.spawnId }).catch(() => {
             });
           }
         }
@@ -4369,8 +4573,10 @@ export {
   unregisterInstance,
   listInstances,
   killInstance,
+  restartInstance,
+  scheduleSelfRestart,
   agentSpawner,
   traefikManager,
   agentManager
 };
-//# sourceMappingURL=chunk-Z3KAXI7V.js.map
+//# sourceMappingURL=chunk-HPYBAUAH.js.map