@runeya/runeya 2.0.84 → 2.0.86

package/index.js

@@ -279,7 +279,7 @@ async function main() {
   ensureNodeBinOnPath();
   await ensureUserBinsOnPath();
   if (!isPullEnv) stampConsole();
-  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-BWQ4J4D5.js");
+  const { createLocalServer, pullEnv, PullEnvError, registerInstance } = await import("./src-RPVY2K3C.js");
   if (isPullEnv) {
     if (!serviceArg) {
       console.error("Error: --service (-s) is required with --pull-env");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeya/runeya",
-  "version": "2.0.84",
+  "version": "2.0.86",
   "type": "module",
   "bin": {
     "runeya": "./index.js"

package/{src-BWQ4J4D5.js → src-RPVY2K3C.js}

@@ -40,6 +40,7 @@ import {
   decryptValue,
   decryptValueWith,
   decryptVariableSlots,
+  describeInstance,
   encryptValue,
   encryptValueWith,
   encryptVariableSlots,
@@ -110,7 +111,7 @@ import {
   wasRead,
   withDeprecatedAliases,
   writeEntity
-} from "./chunk-Y57ZDIKL.js";
+} from "./chunk-Y64ZIPNR.js";
 
 // ../server/src/create-server.ts
 import express from "express";
@@ -408,9 +409,20 @@ var authMiddleware = t.middleware(async ({ ctx, next }) => {
 });
 var protectedProcedure = t.procedure.use(authMiddleware);
 var LOOPBACK = /* @__PURE__ */ new Set(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-function requireLoopback(ctx) {
-  if (!ctx.remoteAddress || !LOOPBACK.has(ctx.remoteAddress)) {
-    throw new TRPCError({ code: "FORBIDDEN", message: "This route only answers the local machine." });
+async function requireLoopbackOrToken(ctx) {
+  if (ctx.remoteAddress && LOOPBACK.has(ctx.remoteAddress)) return;
+  if (isCiMode()) return;
+  const authorization = ctx.authorization;
+  if (!authorization?.startsWith("Bearer ")) {
+    throw new TRPCError({
+      code: "FORBIDDEN",
+      message: "This route answers the local machine, or a signed-in app."
+    });
+  }
+  try {
+    await verifyJwt(authorization.slice(7));
+  } catch {
+    throw new TRPCError({ code: "UNAUTHORIZED", message: "Invalid or expired token" });
   }
 }
 function requireServiceAction(ctx, serviceId, action) {
@@ -603,7 +615,7 @@ var appUpdateRouter = router({
       ready: z2.boolean()
     })
   ).query(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     const npmPath = resolveNpm();
     const npmVersion = await probeVersion(npmPath, ["--version"]);
     const globalPrefix = npmVersion ? await probeVersion(npmPath, ["prefix", "-g"]) : null;
@@ -630,7 +642,7 @@ var appUpdateRouter = router({
       installedVersion: z2.string().nullable()
     })
   ).mutation(async ({ ctx }) => {
-    requireLoopback(ctx);
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const npmPath = resolveNpm();
     try {
@@ -655,8 +667,8 @@ var appUpdateRouter = router({
    * quelques instants — le démarrage réessaie déjà sur EADDRINUSE, c'est ce qui
    * rend ce relais possible sans temporisation ici.
    */
-  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(({ ctx }) => {
-    requireLoopback(ctx);
+  restart: publicProcedure.output(z2.object({ restarting: z2.literal(true), version: z2.string() })).mutation(async ({ ctx }) => {
+    await requireLoopbackOrToken(ctx);
     requireDesktop();
     const child = spawn(process.execPath, process.argv.slice(1), {
       detached: true,
@@ -8514,7 +8526,7 @@ function tailTranscript(opts) {
 
 // ../server/src/services/ai-runners/claude-pty-runner.ts
 async function getAgentManager() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-SCFRRN7T.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-DDTLG24O.js");
   return agentManager2;
 }
 function buildPtyArgs(params, sessionId, opts) {
@@ -9255,7 +9267,7 @@ async function shutdownCodexAppServer() {
   }
 }
 async function getAgentManager2() {
-  const { agentManager: agentManager2 } = await import("./agent-manager-SCFRRN7T.js");
+  const { agentManager: agentManager2 } = await import("./agent-manager-DDTLG24O.js");
   return agentManager2;
 }
 function parseRuneyaCurlCommand(command) {
@@ -15215,8 +15227,15 @@ var OrgSyncConnection = class {
 };
 var CloudSyncBridge = class {
   connections = /* @__PURE__ */ new Map();
-  /** Orgs another instance holds the lock on — reported, not retried blindly. */
-  locked = /* @__PURE__ */ new Set();
+  /**
+   * Orgs another instance holds the lock on — reported, not retried blindly.
+   *
+   * Le pid du détenteur, et non un simple drapeau : « un autre Runeya de cette
+   * machine » ne dit pas lequel fermer, et l'utilisateur en a souvent trois.
+   * Le port se déduit du pid par le registre d'instances, au moment de rendre
+   * l'état — jamais mémorisé ici, où il vieillirait.
+   */
+  locked = /* @__PURE__ */ new Map();
   /**
    * Orgs whose key this machine does not have.
    *
@@ -15306,10 +15325,21 @@ var CloudSyncBridge = class {
     const live = Array.from(this.connections.entries()).map(([orgId, conn]) => ({
       orgId,
       state: conn.getState(),
-      lastIncompatibleVersion: conn.getLastIncompatibleVersion()
+      lastIncompatibleVersion: conn.getLastIncompatibleVersion(),
+      heldByPid: null
+    }));
+    const locked = Array.from(this.locked).filter(([orgId]) => !this.connections.has(orgId)).map(([orgId, pid]) => ({
+      orgId,
+      state: "locked",
+      lastIncompatibleVersion: null,
+      heldByPid: pid
+    }));
+    const mismatched = Array.from(this.keyMismatch).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({
+      orgId,
+      state: "key-mismatch",
+      lastIncompatibleVersion: null,
+      heldByPid: null
     }));
-    const locked = Array.from(this.locked).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({ orgId, state: "locked", lastIncompatibleVersion: null }));
-    const mismatched = Array.from(this.keyMismatch).filter((orgId) => !this.connections.has(orgId)).map((orgId) => ({ orgId, state: "key-mismatch", lastIncompatibleVersion: null }));
     return [...live, ...locked, ...mismatched];
   }
   /**
@@ -15366,7 +15396,7 @@ var CloudSyncBridge = class {
         link.orgId,
         lock.heldBy
       );
-      this.locked.add(link.orgId);
+      this.locked.set(link.orgId, lock.heldBy);
       return;
     }
     this.locked.delete(link.orgId);
@@ -15562,6 +15592,10 @@ async function assertOrgKey(orgId) {
 function syncState(orgId) {
   return cloudSyncBridge.states().find((s) => s.orgId === orgId)?.state ?? "stopped";
 }
+async function syncLockHolder(orgId) {
+  const pid = cloudSyncBridge.states().find((s) => s.orgId === orgId)?.heldByPid;
+  return pid ? describeInstance(pid) : null;
+}
 var cloudSyncRouter = router({
   /**
    * Follow one more project of an org, and pull it now.
@@ -15586,7 +15620,7 @@ var cloudSyncRouter = router({
     }
     try {
       const pulled = await cloudSyncBridge.followProject(input.orgId, input.projectId);
-      return { pulled, state: syncState(input.orgId) };
+      return { pulled, state: syncState(input.orgId), heldBy: await syncLockHolder(input.orgId) };
     } catch (err) {
       if (err instanceof ProjectHeldElsewhereError) {
         throw new TRPCError22({ code: "CONFLICT", message: err.code, cause: err });
@@ -15841,14 +15875,19 @@ var cloudSyncRouter = router({
   list: protectedProcedure.query(async () => {
     const links = await orgsToSync();
     const states = new Map(cloudSyncBridge.states().map((s) => [s.orgId, s]));
-    return links.map((l) => ({
-      orgId: l.orgId,
-      cloudUrl: l.cloudUrl,
-      state: states.get(l.orgId)?.state ?? "stopped",
-      // Renseigné seulement quand le cloud a refusé cette app comme trop
-      // ancienne : c'est lui qui publie le plancher, on ne le devine pas. La
-      // borne est exclusive — il faut strictement plus récent que ce numéro.
-      lastIncompatibleVersion: states.get(l.orgId)?.lastIncompatibleVersion ?? null
+    return Promise.all(links.map(async (l) => {
+      const found = states.get(l.orgId);
+      const heldBy = found?.heldByPid ? await describeInstance(found.heldByPid) : null;
+      return {
+        orgId: l.orgId,
+        cloudUrl: l.cloudUrl,
+        state: found?.state ?? "stopped",
+        // Renseigné seulement quand le cloud a refusé cette app comme trop
+        // ancienne : c'est lui qui publie le plancher, on ne le devine pas. La
+        // borne est exclusive — il faut strictement plus récent que ce numéro.
+        lastIncompatibleVersion: found?.lastIncompatibleVersion ?? null,
+        heldBy
+      };
     }));
   }),
   /**
@@ -18266,4 +18305,4 @@ export {
   pullEnv,
   registerInstance
 };
-//# sourceMappingURL=src-BWQ4J4D5.js.map
+//# sourceMappingURL=src-RPVY2K3C.js.map