release: @johanleroy/git-arboretum 1.4.1

Première version avec le tarball autonome (shared inliné dans dist/_shared).
Le 1.4.0 du registre a pu être publié sans @arboretum/shared embarqué
(bundleDependencies d'un workspace instable en CI/root) ; 1.4.1 garantit un
paquet installable et démarrable par n'importe quel consommateur.

.github/workflows/ci.yml

@@ -41,20 +41,26 @@ jobs:
           cache: npm
       - run: npm ci
       - run: npm run build
-      # @arboretum/shared (dépendance runtime non publiée) est embarquée dans le tarball
-      # via bundleDependencies (matérialisée au prepack). On packe donc UN SEUL tarball
-      # et on l'installe seul, comme un vrai consommateur depuis le registre.
+      # @arboretum/shared (paquet workspace NON publié) est INLINÉ dans dist/_shared au prepack
+      # (scripts/inline-shared.mjs) : le tarball est 100 % autonome — aucun node_modules embarqué,
+      # aucune bundleDependency, aucun symlink. On packe en mode workspace (-w), EXACTEMENT comme
+      # le fait « npm publish » dans release.yml, puis on l'installe seul comme un vrai consommateur.
       - name: Pack tarball
         run: |
-          mkdir -p /tmp/tarballs
+          rm -rf /tmp/tarballs && mkdir -p /tmp/tarballs
           npm pack -w @johanleroy/git-arboretum --pack-destination /tmp/tarballs
           ls -l /tmp/tarballs
-      - name: Assert @arboretum/shared is bundled in the tarball
+      - name: Assert the package is self-contained (@arboretum/shared inlined)
         run: |
           tgz=$(ls /tmp/tarballs/*.tgz)
-          tar -tzf "$tgz" | grep -q 'node_modules/@arboretum/shared/dist/index.js' \
-            || { echo "ERREUR: @arboretum/shared non embarqué dans $tgz"; exit 1; }
-          echo "OK: bundleDependency @arboretum/shared présente dans $tgz"
+          rm -rf /tmp/inspect && mkdir -p /tmp/inspect && tar -xzf "$tgz" -C /tmp/inspect
+          test -f /tmp/inspect/package/dist/_shared/index.js \
+            || { echo "ERREUR: dist/_shared/index.js absent de $tgz — inline-shared n'a pas tourné ?"; exit 1; }
+          if grep -rq '@arboretum/shared' /tmp/inspect/package/dist; then
+            echo "ERREUR: import bare '@arboretum/shared' encore présent dans le JS publié"
+            grep -rn '@arboretum/shared' /tmp/inspect/package/dist; exit 1
+          fi
+          echo "OK: paquet autonome — shared inliné dans dist/_shared, aucun import externe"
       - name: Install tarball in an empty project
         run: |
           mkdir /tmp/smoke

.github/workflows/release.yml

@@ -35,8 +35,39 @@ jobs:
             exit 1
           fi
           echo "OK: tag $tag == version $pkg"
-      - run: npm publish -w @johanleroy/git-arboretum
+      # Publication idempotente : le signal faisant autorité d'une version déjà présente est le
+      # 409 « already exists » renvoyé par npm publish lui-même (npm view est non fiable contre le
+      # registre npm de Gitea — faux négatif masqué par >/dev/null). On tente toujours le publish ;
+      # un 409 = succès idempotent, tout autre échec reste fatal. Le shell Actions tourne en
+      # `bash -eo pipefail` : on isole l'échec attendu dans la condition d'un `if` pour ne pas
+      # déclencher `set -e`. Le secret du registre est mappé sur NODE_AUTH_TOKEN lu par le .npmrc
+      # de setup-node.
+      - name: Publish (idempotent — tolère un 409 « already exists »)
+        run: |
+          if out="$(npm publish -w @johanleroy/git-arboretum 2>&1)"; then
+            printf '%s\n' "$out"
+            echo "Publication réussie."
+          else
+            code=$?
+            printf '%s\n' "$out"
+            if printf '%s' "$out" | grep -qiE 'E409|409 Conflict|already exists'; then
+              echo "::notice::Version déjà présente sur le registre (409) — publication idempotente, étape ignorée."
+            else
+              echo "::error::Échec de la publication (code $code)."
+              exit "$code"
+            fi
+          fi
         env:
-          # Mapper le secret du registre (PAT Gitea write:package, ou le token auto
-          # GITEA_TOKEN s'il a ce scope) sur NODE_AUTH_TOKEN lu par le .npmrc de setup-node.
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      # SBOM (transparence supply-chain entreprise) : généré pour le paquet publié et exposé en
+      # artefact. C'est un bonus : un échec de génération/upload ne doit jamais faire rougir une
+      # release dont le publish a réussi → continue-on-error.
+      # upload-artifact@v3 : Gitea Actions (GHES-like) ne supporte pas @v4 (@actions/artifact v2+).
+      - name: Generate SBOM (CycloneDX)
+        continue-on-error: true
+        run: npx --yes @cyclonedx/cyclonedx-npm --omit dev --output-format JSON --output-file sbom.json -w @johanleroy/git-arboretum || npx --yes @cyclonedx/cyclonedx-npm --omit dev --output-format JSON --output-file sbom.json
+      - uses: actions/upload-artifact@v3
+        continue-on-error: true
+        with:
+          name: sbom
+          path: sbom.json

README.fr.md

@@ -209,9 +209,13 @@ Un terminal web, c'est de l'exécution de code à distance *par conception*. Les
 - Se bind sur `127.0.0.1` par défaut ; refuse les binds non-loopback sans flag explicite.
 - Authentifie **chaque** requête `/api/**` **et** chaque upgrade `/ws` avec des tokens révocables, et applique un **check `Origin` strict** (le cookie `SameSite=Strict` ne couvre pas les upgrades WebSocket — c'est le garde-fou anti cross-site hijacking).
 - Les tokens sont stockés **hashés** (sha256) et comparés en temps constant ; le bootstrap token n'est affiché qu'une seule fois. Le cookie de session est un payload signé HMAC, `HttpOnly` et `SameSite=Strict`, et reçoit automatiquement le flag `Secure` quand la requête arrive en HTTPS (p. ex. derrière Tailscale Serve). Le login est rate-limité avec backoff exponentiel.
+- Envoie des en-têtes HTTP durcis (CSP, `X-Frame-Options`, `nosniff`, `Referrer-Policy`, HSTS conditionnel, `no-store` sur l'API), restreint le dossier de données à `0o700` et la base à `0o600`, et **chiffre les secrets sensibles au repos** (AES-256-GCM).
+- Tient un **journal d'audit** des opérations sensibles et offre l'**export/effacement RGPD** des données (Réglages → Sécurité & conformité).
 
 Tailscale Serve est **la** façon d'atteindre Arboretum depuis d'autres appareils — pas seulement une recommandation : HTTPS valide, identité tailnet, aucun port ouvert. Le flag `--i-know-this-exposes-a-terminal` est une trappe de secours, pas un mode de déploiement ; n'exposez jamais Arboretum directement sur internet.
 
+Voir [`SECURITY.md`](SECURITY.md) pour le modèle de menace complet et [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md) pour le durcissement en environnement réglementé.
+
 ## Ce qui le distingue
 
 | | Arboretum | GitKraken Agent Mode / Conductor / Nimbalyst | Happy / CloudCLI | Anthropic Remote Control |
@@ -251,6 +255,12 @@ node packages/server/scripts/acceptance-p4.mjs   # Web Push + commande WS `answe
 node packages/server/scripts/acceptance-p5.mjs   # groupes de travail : CRUD + broadcast WS + CASCADE
 ```
 
+## Soutenir le projet
+
+Arboretum est un projet personnel libre et auto-financé. S'il vous fait gagner du temps, vous pouvez soutenir son développement :
+
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-johanleroy-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/johanleroy)
+
 ## Licence
 
 MIT — voir [LICENSE](LICENSE).

README.md

@@ -209,9 +209,13 @@ A web terminal is remote code execution *by design*. Arboretum's guardrails are
 - Binds to `127.0.0.1` by default; refuses non-loopback binds without an explicit flag.
 - Authenticates **every** `/api/**` request **and** every `/ws` upgrade with revocable tokens, and applies a **strict `Origin` check** (the `SameSite=Strict` cookie does not cover WebSocket upgrades — this is the anti cross-site hijacking guard).
 - Tokens are stored **hashed** (sha256) and compared in constant time; the bootstrap token is shown only once. The session cookie is an HMAC-signed payload, `HttpOnly` and `SameSite=Strict`, and it automatically gains the `Secure` flag when the request arrives over HTTPS (e.g. behind Tailscale Serve). Login is rate-limited with exponential backoff.
+- Sends hardened HTTP headers (CSP, `X-Frame-Options`, `nosniff`, `Referrer-Policy`, conditional HSTS, `no-store` on the API), restricts the data directory to `0o700` and the database to `0o600`, and **encrypts sensitive secrets at rest** (AES-256-GCM).
+- Keeps an **audit log** of sensitive operations and offers **GDPR** data export/erasure (Settings → Security & compliance).
 
 Tailscale Serve is **the** way to reach Arboretum from other devices — not just a recommendation: valid HTTPS, tailnet identity, no open ports. The `--i-know-this-exposes-a-terminal` flag is an escape hatch, not a deployment mode; never expose Arboretum directly to the internet.
 
+See [`SECURITY.md`](SECURITY.md) for the full threat model and [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md) for hardening in regulated environments.
+
 ## What makes it different
 
 | | Arboretum | GitKraken Agent Mode / Conductor / Nimbalyst | Happy / CloudCLI | Anthropic Remote Control |
@@ -251,6 +255,12 @@ node packages/server/scripts/acceptance-p4.mjs   # Web Push + WS `answer` comman
 node packages/server/scripts/acceptance-p5.mjs   # work groups: CRUD + WS broadcast + CASCADE
 ```
 
+## Support
+
+Arboretum is a free, self-funded side project. If it saves you time, you can support its development:
+
+[![Buy Me a Coffee](https://img.shields.io/badge/Buy%20Me%20a%20Coffee-johanleroy-FFDD00?logo=buymeacoffee&logoColor=black)](https://buymeacoffee.com/johanleroy)
+
 ## License
 
 MIT — see [LICENSE](LICENSE).

SECURITY.md

@@ -0,0 +1,61 @@
+# Security Policy
+
+Arboretum is a self-hosted daemon that serves a web dashboard to drive git worktrees and the
+Claude Code sessions running on them. **A web terminal is remote code execution by design** — that
+is the product, not a bug. Arboretum's security model is therefore built on *structural* guards
+(loopback-only binding, authenticated access, strict Origin checks) far more than on cryptography
+alone.
+
+This document describes the threat model, the controls that are implemented, the deliberate
+trade-offs, and how to report a vulnerability. For hardening a deployment in a regulated
+environment, see [`docs/ENTERPRISE_DEPLOYMENT.md`](docs/ENTERPRISE_DEPLOYMENT.md).
+
+## Threat model
+
+- **Single-user by design.** Arboretum runs on the owner's machine and is meant for one operator.
+  There is no multi-tenant isolation and no RBAC — and none is claimed.
+- **Loopback by default.** The server binds `127.0.0.1`; `config.ts` *refuses* any non-loopback bind
+  unless you pass `--i-know-this-exposes-a-terminal`. Remote access is expected via **Tailscale Serve**
+  (TLS + tailnet identity), never by opening a port.
+- **The terminal is RCE.** Anyone who can authenticate can run code. The controls below exist to make
+  sure only the authenticated operator reaches it, and that the surrounding surface (cookies, headers,
+  data at rest) is hardened.
+
+## Implemented controls
+
+| Area | Control | Where |
+| --- | --- | --- |
+| Network | Loopback-only default; non-loopback refused without explicit flag | `packages/server/src/config.ts` |
+| AuthN | Global guard on **all** `/api/**` and `/ws` (only login is public, and rate-limited) | `packages/server/src/app.ts` |
+| AuthN | Tokens stored **hashed** (SHA-256), compared in constant time; bootstrap token shown once | `packages/server/src/auth/service.ts` |
+| Sessions | Cookie is an HMAC-SHA256 signed payload, `HttpOnly` + `SameSite=Strict`, `Secure` when HTTPS | `packages/server/src/routes/auth.ts` |
+| CSRF / WS | Strict `Origin` check on every `/api/**` and `/ws` request (anti cross-site WS hijacking) | `packages/server/src/app.ts` |
+| CSRF | Mutations carrying a body must be `application/json` | `packages/server/src/app.ts` |
+| Rate limit | Global login rate limit with exponential backoff (not per-IP — Tailscale fronts everything as 127.0.0.1) | `packages/server/src/auth/service.ts` |
+| HTTP headers | CSP, `X-Frame-Options: DENY`, `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`, conditional HSTS, `Cache-Control: no-store` on API; `Server` header stripped | `packages/server/src/app.ts` |
+| Injection | All SQL is parameterized; all git calls use `execFile` (no shell); path-traversal guards | `packages/server/src/**` |
+| Data at rest | DB file/dir forced to `0o600`/`0o700`; sensitive secrets (server secret, VAPID private key) encrypted with AES-256-GCM | `packages/server/src/db/index.ts`, `core/secret-box.ts` |
+| Audit | Persistent audit log of sensitive mutations (tokens, settings, secrets, push, groups) | `packages/server/src/core/audit-log.ts` |
+| Privacy | GDPR export (`/api/v1/data/export`) and erasure (`/api/v1/data/delete-my-data`) | `packages/server/src/routes/data.ts` |
+| Install | Runs as a **user** service (systemd user unit / launchd LaunchAgent), never root | `packages/server/src/cli/install.ts` |
+
+## Deliberate trade-offs
+
+- **Long-lived API tokens.** Tokens do not expire by age (CLI automation stability) but can be revoked
+  instantly, and `last_used_at` is tracked. Review and rotate tokens periodically.
+- **Encryption-at-rest key management.** With no `ARBORETUM_SECRET_KEY` set, the encryption key lives in
+  `dataDir/secret.key` (`0o600`) next to the database — this protects a leaked database *copy* (backup,
+  WAL) but not a full `dataDir` compromise. For strong protection, set `ARBORETUM_SECRET_KEY` and store it
+  separately from database backups. Full-DB SQLCipher is intentionally avoided (it breaks the `npx`
+  prebuilt portability).
+- **No multi-user model.** If you need multiple operators with isolation, Arboretum is not the right tool.
+
+## Reporting a vulnerability
+
+Please report security issues **privately** — do not open a public issue.
+
+- Email: **security@johanleroy.fr** (or `contact@johanleroy.fr`).
+- Include a description, affected version, and reproduction steps.
+- Expect an acknowledgement within **7 days** and a coordinated disclosure window of up to **90 days**.
+
+Thank you for helping keep Arboretum users safe.

docs/ENTERPRISE_DEPLOYMENT.md

@@ -0,0 +1,95 @@
+# Enterprise deployment guide
+
+This guide complements [`../SECURITY.md`](../SECURITY.md) with the operational steps a regulated or
+security-conscious organization needs to deploy Arboretum with confidence.
+
+## 1. Remote access: Tailscale Serve (recommended)
+
+Never open a public port. Keep the default `127.0.0.1` bind and put Arboretum behind Tailscale Serve:
+
+```bash
+# on the host running arboretum (default bind 127.0.0.1:7317)
+tailscale serve --bg 7317
+```
+
+This gives you TLS, a stable `*.ts.net` hostname, and tailnet identity. Then add that origin to the
+allow-list so the strict Origin check accepts it:
+
+```bash
+arboretum --allow-origin https://my-host.tailnet.ts.net
+```
+
+The `--i-know-this-exposes-a-terminal` flag exists only as an escape hatch for non-loopback binds; it
+is **never** a deployment mode and is never injected automatically by `arboretum install`.
+
+## 2. Encryption at rest
+
+Sensitive secrets (the HMAC server secret and the VAPID private key) are encrypted with AES-256-GCM
+before being stored in SQLite. Token values are never stored — only their SHA-256 hashes.
+
+For **strong** protection (key not co-located with the database), provide a passphrase via the
+environment instead of the on-disk key file:
+
+```bash
+ARBORETUM_SECRET_KEY='<a long random passphrase from your secrets manager>' arboretum
+```
+
+- Store this passphrase in your secrets manager / KMS, **separately** from database backups.
+- Without it, the key is auto-generated in `dataDir/secret.key` (`0o600`). This still protects a leaked
+  database copy, but not a full `dataDir` compromise.
+- Rotating the passphrase requires re-encrypting existing values; the simplest path is to revoke and
+  recreate the bootstrap token after rotation.
+
+## 3. Filesystem permissions
+
+On startup Arboretum forces `dataDir` to `0o700` and the database files (`*.db`, `-wal`, `-shm`) to
+`0o600`. Verify after first run:
+
+```bash
+stat -c '%a %n' ~/.local/share/arboretum ~/.local/share/arboretum/*.db
+# expect: 700 …/arboretum   and   600 …/arboretum.db
+```
+
+Keep `$HOME` private (standard `0o700`). If you relocate data with `--db` or `XDG_DATA_HOME`, make sure
+the target directory is not world-readable.
+
+## 4. Audit logging
+
+All sensitive mutations are recorded in an append-only `audit_logs` table: token create/revoke, login
+success/failure, settings changes, secret generation, push subscribe/unsubscribe, group CRUD, and data
+erasure. Query it via the API (paginated):
+
+```bash
+curl -s -H "Authorization: Bearer $TOKEN" \
+  'http://127.0.0.1:7317/api/v1/audit-logs?limit=100'
+```
+
+The audit log never contains secret values — only non-sensitive metadata (ids, labels, counters). It is
+also visible in the dashboard under **Settings → Security & compliance**.
+
+## 5. GDPR (data subject requests)
+
+- **Export**: `GET /api/v1/data/export` returns every record tied to the authenticated token (token
+  metadata, push subscriptions, session history, settings) as JSON. Also available as a one-click
+  download in **Settings → Security & compliance**.
+- **Erasure**: `POST /api/v1/data/delete-my-data` is a two-step call — the first response returns a
+  `confirm` code that must be POSTed back to execute. It purges the token's push subscriptions and
+  revokes the token (unless it is the last active one).
+
+## 6. Backups & retention
+
+- Back up the SQLite database (`arboretum.db`) with the WAL checkpointed. Treat backups as sensitive.
+- If you use `ARBORETUM_SECRET_KEY`, back the key up **separately** — a database backup is useless (and
+  safe) without it, which is the point.
+- Session history is retained until the database is reset. To start clean, stop the service and remove
+  the database file.
+
+## 7. Logging hygiene
+
+The log level is controlled by `ARBORETUM_LOG` (default `info`). Do **not** run `debug`/`trace` in
+production: verbose levels may log request metadata. Keep `info` or higher.
+
+## 8. Supply chain
+
+Each published release ships with a CycloneDX SBOM (`sbom.json`) generated in CI, so you can scan the
+dependency tree for known vulnerabilities before deploying.

package-lock.json

@@ -720,9 +720,9 @@
       }
     },
     "node_modules/@fastify/static": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-8.3.0.tgz",
-      "integrity": "sha512-yKxviR5PH1OKNnisIzZKmgZSus0r2OZb8qCSbqmw34aolT4g3UlzYfeBRym+HJ1J471CR8e2ldNub4PubD1coA==",
+      "version": "9.1.3",
+      "resolved": "https://registry.npmjs.org/@fastify/static/-/static-9.1.3.tgz",
+      "integrity": "sha512-aXrYtsiryLhRxRNaxNqsn7FUISeb7rB9q4eHUPIot5aeQBLNahnz1m6thzm7JWC1poSGXS9XrX8DvuMivp2hkQ==",
       "funding": [
         {
           "type": "github",
@@ -737,10 +737,10 @@
       "dependencies": {
         "@fastify/accept-negotiator": "^2.0.0",
         "@fastify/send": "^4.0.0",
-        "content-disposition": "^0.5.4",
+        "content-disposition": "^1.0.1",
         "fastify-plugin": "^5.0.0",
         "fastq": "^1.17.1",
-        "glob": "^11.0.0"
+        "glob": "^13.0.0"
       }
     },
     "node_modules/@fastify/websocket": {
@@ -839,15 +839,6 @@
         "url": "https://github.com/sponsors/kazupon"
       }
     },
-    "node_modules/@isaacs/cliui": {
-      "version": "9.0.0",
-      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-9.0.0.tgz",
-      "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
-      "license": "BlueOak-1.0.0",
-      "engines": {
-        "node": ">=18"
-      }
-    },
     "node_modules/@johanleroy/git-arboretum": {
       "resolved": "packages/server",
       "link": true
@@ -2551,15 +2542,16 @@
       "peer": true
     },
     "node_modules/content-disposition": {
-      "version": "0.5.4",
-      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
-      "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-1.1.0.tgz",
+      "integrity": "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g==",
       "license": "MIT",
-      "dependencies": {
-        "safe-buffer": "5.2.1"
-      },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie": {
@@ -2590,20 +2582,6 @@
         "url": "https://github.com/sponsors/mesqueeb"
       }
     },
-    "node_modules/cross-spawn": {
-      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
-      "license": "MIT",
-      "dependencies": {
-        "path-key": "^3.1.0",
-        "shebang-command": "^2.0.0",
-        "which": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/csstype": {
       "version": "3.2.3",
       "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
@@ -2979,22 +2957,6 @@
         "node": ">=20"
       }
     },
-    "node_modules/foreground-child": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
-      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
-      "license": "ISC",
-      "dependencies": {
-        "cross-spawn": "^7.0.6",
-        "signal-exit": "^4.0.1"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/fs-constants": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
@@ -3023,24 +2985,17 @@
       "license": "MIT"
     },
     "node_modules/glob": {
-      "version": "11.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-11.1.0.tgz",
-      "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "foreground-child": "^3.3.1",
-        "jackspeak": "^4.1.1",
-        "minimatch": "^10.1.1",
-        "minipass": "^7.1.2",
-        "package-json-from-dist": "^1.0.0",
-        "path-scurry": "^2.0.0"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
       },
       "engines": {
-        "node": "20 || >=22"
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -3154,27 +3109,6 @@
         "url": "https://github.com/sponsors/mesqueeb"
       }
     },
-    "node_modules/isexe": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
-      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
-      "license": "ISC"
-    },
-    "node_modules/jackspeak": {
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.2.3.tgz",
-      "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
-      "license": "BlueOak-1.0.0",
-      "dependencies": {
-        "@isaacs/cliui": "^9.0.0"
-      },
-      "engines": {
-        "node": "20 || >=22"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/jiti": {
       "version": "2.7.0",
       "resolved": "https://registry.npmjs.org/jiti/-/jiti-2.7.0.tgz",
@@ -3720,12 +3654,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/package-json-from-dist": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
-      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
-      "license": "BlueOak-1.0.0"
-    },
     "node_modules/path-browserify": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-1.0.1.tgz",
@@ -3733,15 +3661,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/path-key": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
-      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/path-scurry": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
@@ -4193,27 +4112,6 @@
       "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw==",
       "license": "ISC"
     },
-    "node_modules/shebang-command": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
-      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
-      "license": "MIT",
-      "dependencies": {
-        "shebang-regex": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/shebang-regex": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
-      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=8"
-      }
-    },
     "node_modules/siginfo": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
@@ -4221,18 +4119,6 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/signal-exit": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
-      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
-      "license": "ISC",
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
     "node_modules/simple-concat": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/simple-concat/-/simple-concat-1.0.1.tgz",
@@ -4908,21 +4794,6 @@
         "node": ">= 16"
       }
     },
-    "node_modules/which": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
-      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
-      "license": "ISC",
-      "dependencies": {
-        "isexe": "^2.0.0"
-      },
-      "bin": {
-        "node-which": "bin/node-which"
-      },
-      "engines": {
-        "node": ">= 8"
-      }
-    },
     "node_modules/why-is-node-running": {
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
@@ -4969,15 +4840,11 @@
     },
     "packages/server": {
       "name": "@johanleroy/git-arboretum",
-      "version": "1.2.0",
-      "bundleDependencies": [
-        "@arboretum/shared"
-      ],
+      "version": "1.4.1",
       "license": "MIT",
       "dependencies": {
-        "@arboretum/shared": "0.1.0",
         "@fastify/cookie": "^11.0.0",
-        "@fastify/static": "^8.0.0",
+        "@fastify/static": "^9.0.0",
         "@fastify/websocket": "^11.0.0",
         "@homebridge/node-pty-prebuilt-multiarch": "^0.13.0",
         "@xterm/headless": "^6.0.0",
@@ -4988,11 +4855,16 @@
         "arboretum": "dist/index.js"
       },
       "devDependencies": {
+        "@arboretum/shared": "0.1.0",
         "@types/web-push": "^3.6.4",
         "@types/ws": "^8.5.0"
       },
       "engines": {
         "node": ">=22.16"
+      },
+      "funding": {
+        "type": "buymeacoffee",
+        "url": "https://buymeacoffee.com/johanleroy"
       }
     },
     "packages/shared": {

packages/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@johanleroy/git-arboretum",
-  "version": "1.2.0",
+  "version": "1.4.1",
   "description": "Self-hosted web dashboard for git worktrees and the Claude Code sessions running on them",
   "license": "MIT",
   "type": "module",
@@ -14,6 +14,10 @@
   "bugs": {
     "url": "https://git.lidge.fr/johanleroy/arboretum/issues"
   },
+  "funding": {
+    "type": "buymeacoffee",
+    "url": "https://buymeacoffee.com/johanleroy"
+  },
   "keywords": [
     "git",
     "worktree",
@@ -44,16 +48,12 @@
   "scripts": {
     "build": "tsc -b",
     "dev": "tsc -b --watch & node --watch dist/index.js",
-    "prepack": "node scripts/copy-web.mjs && node scripts/vendor-shared.mjs && node scripts/copy-meta.mjs",
+    "prepack": "node scripts/copy-web.mjs && node scripts/inline-shared.mjs && node scripts/copy-meta.mjs",
     "test": "vitest run"
   },
-  "bundleDependencies": [
-    "@arboretum/shared"
-  ],
   "dependencies": {
-    "@arboretum/shared": "0.1.0",
     "@fastify/cookie": "^11.0.0",
-    "@fastify/static": "^8.0.0",
+    "@fastify/static": "^9.0.0",
     "@fastify/websocket": "^11.0.0",
     "@homebridge/node-pty-prebuilt-multiarch": "^0.13.0",
     "@xterm/headless": "^6.0.0",
@@ -61,6 +61,7 @@
     "web-push": "^3.6.7"
   },
   "devDependencies": {
+    "@arboretum/shared": "0.1.0",
     "@types/web-push": "^3.6.4",
     "@types/ws": "^8.5.0"
   }

packages/server/scripts/acceptance-p1.mjs

@@ -23,7 +23,7 @@ const check = (name, ok, detail = '') => {
 };
 
 const tmp = mkdtempSync(join(tmpdir(), 'arb-accept-'));
-const srv = spawn('node', [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db')], {
+const srv = spawn('node', [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--no-discover'], {
   env: { ...process.env, ARBORETUM_LOG: 'warn' },
   stdio: ['ignore', 'pipe', 'pipe'],
 });

packages/server/scripts/acceptance-p2.mjs

@@ -62,7 +62,7 @@ writeFileSync(
 
 const srv = spawn(
   'node',
-  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', claudeHome],
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', claudeHome, '--no-discover'],
   { env: { ...process.env, ARBORETUM_LOG: 'warn', PATH: `${fakeBin}:${process.env.PATH}` }, stdio: ['ignore', 'pipe', 'pipe'] },
 );
 let srvOut = '';

packages/server/scripts/acceptance-p3.mjs

@@ -36,7 +36,7 @@ git('commit', '-m', 'init');
 
 const srv = spawn(
   'node',
-  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude')],
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude'), '--no-discover'],
   { env: { ...process.env, ARBORETUM_LOG: 'warn' }, stdio: ['ignore', 'pipe', 'pipe'] },
 );
 let srvOut = '';

packages/server/scripts/acceptance-p4.mjs

@@ -27,7 +27,7 @@ const tmp = mkdtempSync(join(tmpdir(), 'arb-accept-p4-'));
 
 const srv = spawn(
   'node',
-  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude')],
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude'), '--no-discover'],
   { env: { ...process.env, ARBORETUM_LOG: 'warn' }, stdio: ['ignore', 'pipe', 'pipe'] },
 );
 let srvOut = '';

packages/server/scripts/acceptance-p5.mjs

@@ -36,7 +36,7 @@ git('commit', '-m', 'init');
 
 const srv = spawn(
   'node',
-  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude')],
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', join(tmp, 'claude'), '--no-discover'],
   { env: { ...process.env, ARBORETUM_LOG: 'warn' }, stdio: ['ignore', 'pipe', 'pipe'] },
 );
 let srvOut = '';

packages/server/scripts/inline-shared.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+// Inline @arboretum/shared (paquet workspace NON publié) directement dans le dist du serveur,
+// pour que le tarball npm soit 100 % autonome. Branché sur le hook "prepack".
+//
+// Pourquoi PAS bundleDependencies : embarquer une dépendance qui est aussi un *workspace* via
+// bundleDependencies est instable selon l'environnement npm (mode -w, exécution en root sur un
+// runner CI, version d'arborist) — npm voit le nœud comme un lien workspace et n'embarque parfois
+// AUCUN fichier ("bundled files: 0"), produisant un paquet cassé chez le consommateur. On élimine
+// donc toute magie de bundling : on copie le JS compilé de shared dans dist/_shared et on réécrit
+// l'import bare '@arboretum/shared' du serveur vers ce chemin relatif. Zéro node_modules embarqué,
+// zéro symlink, résultat identique partout.
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, dirname, relative, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const serverDir = join(dirname(fileURLToPath(import.meta.url)), '..');
+const serverDist = join(serverDir, 'dist');
+const sharedDist = join(serverDir, '..', 'shared', 'dist');
+const inlineDir = join(serverDist, '_shared');
+
+for (const [label, p] of [['dist serveur', serverDist], ['dist shared', sharedDist]]) {
+  if (!existsSync(p)) {
+    console.error(`inline-shared: ${label} introuvable (${p}) — lance "npm run build" avant le pack.`);
+    process.exit(1);
+  }
+}
+
+// 1) Copier le JS compilé de shared dans dist/_shared (uniquement *.js : seul le runtime compte ;
+//    les .d.ts/.map ne sont de toute façon pas publiés via le glob `files`). index.js réexporte
+//    ./protocol.js et ./api.js en relatif → la copie complète préserve la résolution interne.
+rmSync(inlineDir, { recursive: true, force: true });
+mkdirSync(inlineDir, { recursive: true });
+let copied = 0;
+for (const name of readdirSync(sharedDist)) {
+  if (name.endsWith('.js')) {
+    cpSync(join(sharedDist, name), join(inlineDir, name));
+    copied++;
+  }
+}
+if (copied === 0) {
+  console.error(`inline-shared: aucun .js dans ${sharedDist} — shared n'est pas compilé.`);
+  process.exit(1);
+}
+
+// 2) Réécrire l'import bare '@arboretum/shared' de chaque .js du serveur vers le chemin relatif
+//    (POSIX) pointant sur dist/_shared/index.js, calculé par fichier (profondeur variable).
+const walk = (dir) =>
+  readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
+    const p = join(dir, e.name);
+    if (e.isDirectory()) return p === inlineDir ? [] : walk(p); // ne pas se réécrire soi-même
+    return e.name.endsWith('.js') ? [p] : [];
+  });
+
+let rewritten = 0;
+for (const file of walk(serverDist)) {
+  const src = readFileSync(file, 'utf8');
+  if (!src.includes('@arboretum/shared')) continue;
+  let rel = relative(dirname(file), join(inlineDir, 'index.js')).split(sep).join('/');
+  if (!rel.startsWith('.')) rel = `./${rel}`;
+  const out = src.replaceAll(`'@arboretum/shared'`, `'${rel}'`).replaceAll(`"@arboretum/shared"`, `"${rel}"`);
+  if (out !== src) {
+    writeFileSync(file, out);
+    rewritten++;
+  }
+}
+if (rewritten === 0) {
+  console.error(`inline-shared: aucun import '@arboretum/shared' réécrit dans ${serverDist} — build manquant ?`);
+  process.exit(1);
+}
+
+console.log(`inline-shared: ${copied} fichier(s) shared -> dist/_shared, import réécrit dans ${rewritten} fichier(s) serveur`);

packages/server/scripts/vendor-shared.mjs

@@ -1,43 +0,0 @@
-#!/usr/bin/env node
-// Embarque @arboretum/shared (dépendance runtime non publiée) DANS le tarball npm.
-// Branché sur le hook "prepack", aux côtés de bundleDependencies dans package.json.
-//
-// Pourquoi un vrai dossier et pas le symlink workspace : sous npm workspaces, shared
-// est seulement symlinké dans le node_modules racine ; `npm pack` n'embarque une
-// bundleDependency que si elle existe comme VRAI dossier dans le node_modules du
-// paquet packé (packages/server/node_modules/@arboretum/shared). On le matérialise ici.
-import { cpSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const serverDir = join(dirname(fileURLToPath(import.meta.url)), '..');
-const sharedDir = join(serverDir, '..', 'shared');
-const sharedDist = join(sharedDir, 'dist');
-const target = join(serverDir, 'node_modules', '@arboretum', 'shared');
-
-if (!existsSync(sharedDist)) {
-  console.error(
-    `vendor-shared: ${sharedDist} introuvable — lance "npm run build" (shared doit être compilé) avant le pack.`,
-  );
-  process.exit(1);
-}
-
-// package.json minimal et déterministe : on reprend les champs de résolution réels de
-// shared (version incluse, pour rester synchro), sans scripts ni files inutiles au runtime.
-const shared = JSON.parse(readFileSync(join(sharedDir, 'package.json'), 'utf8'));
-const minimal = {
-  name: shared.name,
-  version: shared.version,
-  type: shared.type,
-  main: shared.main,
-  types: shared.types,
-  exports: shared.exports,
-};
-
-// Idempotent : on repart d'un dossier propre à chaque pack.
-rmSync(target, { recursive: true, force: true });
-mkdirSync(target, { recursive: true });
-writeFileSync(join(target, 'package.json'), JSON.stringify(minimal, null, 2) + '\n');
-cpSync(sharedDist, join(target, 'dist'), { recursive: true });
-
-console.log(`vendor-shared: embarqué ${shared.name}@${shared.version} -> ${target}`);

packages/server/src/app.ts

@@ -1,4 +1,4 @@
-import Fastify, { type FastifyInstance, type FastifyRequest } from 'fastify';
+import Fastify, { type FastifyError, type FastifyInstance, type FastifyRequest } from 'fastify';
 import fastifyCookie from '@fastify/cookie';
 import fastifyWebsocket from '@fastify/websocket';
 import fastifyStatic from '@fastify/static';
@@ -11,16 +11,49 @@ import { AuthService, LoginRateLimiter, type AuthContext } from './auth/service.
 import { PtyManager } from './core/pty-manager.js';
 import { DiscoveryService } from './core/discovery-service.js';
 import { WorktreeManager } from './core/worktree-manager.js';
+import { RepoDiscoveryService } from './core/repo-discovery.js';
 import { GroupManager } from './core/group-manager.js';
 import { PushService } from './core/push-service.js';
+import { loadSecretBox } from './core/secret-box.js';
 import { registerAuthRoutes } from './routes/auth.js';
 import { registerSessionRoutes } from './routes/sessions.js';
 import { registerRepoRoutes } from './routes/repos.js';
 import { registerGroupRoutes } from './routes/groups.js';
 import { registerWorktreeRoutes } from './routes/worktrees.js';
 import { registerPushRoutes } from './routes/push.js';
+import { registerSettingsRoutes } from './routes/settings.js';
 import { registerFsRoutes } from './routes/fs.js';
+import { registerAuditRoutes } from './routes/audit.js';
+import { registerDataRoutes } from './routes/data.js';
 import { registerWsGateway } from './ws/gateway.js';
+import { isHttpsRequest } from './routes/auth.js';
+
+// En-têtes de sécurité posés sur TOUTES les réponses (defense-in-depth + conformité scanners
+// entreprise). Le terminal web reste du RCE par conception : ces en-têtes durcissent la SPA et
+// le transport, ils ne remplacent pas le modèle loopback + auth + Origin.
+const SECURITY_HEADERS: Record<string, string> = {
+  'X-Content-Type-Options': 'nosniff',
+  'X-Frame-Options': 'DENY',
+  'Referrer-Policy': 'no-referrer',
+  'Cross-Origin-Opener-Policy': 'same-origin',
+  'Permissions-Policy': 'geolocation=(), microphone=(), camera=(), payment=()',
+  // CSP calibrée pour la SPA : Tailwind/xterm injectent du style inline ; le WebSocket impose
+  // ws:/wss: en connect-src ; le service worker push impose worker-src 'self'.
+  'Content-Security-Policy': [
+    "default-src 'self'",
+    "script-src 'self'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "font-src 'self' data:",
+    "connect-src 'self' ws: wss:",
+    "worker-src 'self'",
+    "manifest-src 'self'",
+    "frame-ancestors 'none'",
+    "base-uri 'self'",
+    "object-src 'none'",
+    "form-action 'self'",
+  ].join('; '),
+};
 
 declare module 'fastify' {
   interface FastifyRequest {
@@ -36,6 +69,7 @@ export interface AppBundle {
   auth: AuthService;
   manager: PtyManager;
   discovery: DiscoveryService;
+  repoDiscovery: RepoDiscoveryService;
   worktrees: WorktreeManager;
   groups: GroupManager;
   push: PushService;
@@ -43,9 +77,11 @@ export interface AppBundle {
 
 export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
   const app = Fastify({ logger: { level: process.env.ARBORETUM_LOG ?? 'info' } });
-  const auth = new AuthService(db);
+  // Chiffrement au repos des secrets (server_secret, clé privée VAPID) dans la base.
+  const box = loadSecretBox(config.dataDir);
+  const auth = new AuthService(db, box);
   const limiter = new LoginRateLimiter();
-  const push = new PushService(db, config.vapidContact);
+  const push = new PushService(db, config.vapidContact, undefined, box);
   const manager = new PtyManager(db, config.claudeSessionsDir, push);
   const discovery = new DiscoveryService({
     ptyManager: manager,
@@ -53,8 +89,47 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
     sessionsDir: config.claudeSessionsDir,
   });
   const worktrees = new WorktreeManager(db, manager, discovery);
+  // Démarré dans runDaemon() (jamais ici) → le scan ne tourne pas pendant les tests qui appellent buildApp.
+  const repoDiscovery = new RepoDiscoveryService(db, worktrees);
   const groups = new GroupManager(db);
 
+  // En-têtes de sécurité sur toute réponse + no-store sur les réponses sensibles (API/WS).
+  // onSend DOIT retourner le payload (sinon Fastify vide la réponse).
+  app.addHook('onSend', async (req, reply, payload) => {
+    reply.removeHeader('Server'); // anti-fingerprinting (no-op si absent)
+    for (const [k, v] of Object.entries(SECURITY_HEADERS)) reply.header(k, v);
+    if (isHttpsRequest(req)) {
+      reply.header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+    }
+    if (req.url.startsWith('/api/') || req.url.startsWith('/ws')) {
+      reply.header('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0');
+    }
+    return payload;
+  });
+
+  // Garde CSRF defense-in-depth : une mutation porteuse d'un corps DOIT être en application/json
+  // (bloque les soumissions de formulaire cross-site en text/plain, que Fastify parserait sinon).
+  app.addHook('preHandler', async (req, reply) => {
+    if (!['POST', 'PATCH', 'PUT', 'DELETE'].includes(req.method)) return;
+    const len = req.headers['content-length'];
+    if (!len || len === '0') return; // pas de corps : rien à valider
+    const ct = (req.headers['content-type'] ?? '').toLowerCase();
+    if (!ct.startsWith('application/json')) {
+      return reply.status(415).send({ error: { code: 'UNSUPPORTED_MEDIA_TYPE', message: 'Content-Type must be application/json' } });
+    }
+  });
+
+  // Handler d'erreur : ne jamais fuiter de stack/chemin au client ; détail complet côté logs.
+  app.setErrorHandler((err: FastifyError, req, reply) => {
+    const status = err.statusCode && err.statusCode >= 400 && err.statusCode < 600 ? err.statusCode : 500;
+    if (status >= 500) {
+      req.log.error({ err }, 'unhandled error');
+      return reply.status(status).send({ error: { code: 'INTERNAL', message: 'Internal Server Error' } });
+    }
+    // erreurs client (4xx) : code générique, message court non sensible.
+    return reply.status(status).send({ error: { code: err.code ?? 'BAD_REQUEST', message: err.message } });
+  });
+
   void app.register(fastifyCookie);
   void app.register(fastifyWebsocket, {
     options: { maxPayload: 1024 * 1024 },
@@ -92,13 +167,16 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
     }
   });
 
-  registerAuthRoutes(app, auth, limiter, serverVersion);
+  registerAuthRoutes(app, auth, limiter, serverVersion, db);
   registerSessionRoutes(app, manager, discovery);
-  registerRepoRoutes(app, worktrees);
-  registerGroupRoutes(app, groups);
+  registerRepoRoutes(app, worktrees, db);
+  registerGroupRoutes(app, groups, db);
   registerWorktreeRoutes(app, worktrees);
-  registerPushRoutes(app, push);
+  registerPushRoutes(app, push, db);
+  registerSettingsRoutes(app, db, config, serverVersion, push);
   registerFsRoutes(app);
+  registerAuditRoutes(app, db);
+  registerDataRoutes(app, db, auth);
   // La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
   // encapsulé) — sinon le handler reçoit la signature REST (request, reply).
   void app.register(async (scoped) => {
@@ -117,5 +195,5 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
     });
   }
 
-  return { app, auth, manager, discovery, worktrees, groups, push };
+  return { app, auth, manager, discovery, repoDiscovery, worktrees, groups, push };
 }

packages/server/src/auth/service.ts

@@ -1,5 +1,7 @@
 import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';
 import { type Db, getSetting, setSetting } from '../db/index.js';
+import type { SecretBox } from '../core/secret-box.js';
+import { recordAudit } from '../core/audit-log.js';
 
 const COOKIE_NAME = 'arb_session';
 const COOKIE_TTL_MS = 30 * 24 * 3600 * 1000;
@@ -12,11 +14,21 @@ export interface AuthContext {
 export class AuthService {
   private readonly secret: Buffer;
 
-  constructor(private readonly db: Db) {
-    let secretHex = getSetting(db, 'server_secret');
-    if (!secretHex) {
+  constructor(
+    private readonly db: Db,
+    box?: SecretBox,
+  ) {
+    // server_secret chiffré au repos quand un SecretBox est fourni (prod). Migration douce :
+    // une valeur en clair pré-existante est re-chiffrée à la lecture.
+    const stored = getSetting(db, 'server_secret');
+    let secretHex: string;
+    if (!stored) {
       secretHex = randomBytes(32).toString('hex');
-      setSetting(db, 'server_secret', secretHex);
+      setSetting(db, 'server_secret', box ? box.encrypt(secretHex) : secretHex);
+      recordAudit(db, { actor: 'system', action: 'secret.generate', resourceId: 'server_secret' });
+    } else {
+      secretHex = box ? box.decrypt(stored) : stored;
+      if (box && !box.isEncrypted(stored)) setSetting(db, 'server_secret', box.encrypt(secretHex));
     }
     this.secret = Buffer.from(secretHex, 'hex');
   }
@@ -35,11 +47,60 @@ export class AuthService {
   }
 
   createToken(label: string): string {
+    return this.createTokenRecord(label).token;
+  }
+
+  /** Comme createToken mais renvoie aussi l'id (pour l'API de gestion des tokens). */
+  createTokenRecord(label: string): { id: string; token: string } {
+    const id = randomUUID();
     const raw = `arb_${randomBytes(24).toString('hex')}`;
     this.db
       .prepare('INSERT INTO auth_tokens (id, label, token_hash, created_at) VALUES (?, ?, ?, ?)')
-      .run(randomUUID(), label, sha256(raw), new Date().toISOString());
-    return raw;
+      .run(id, label, sha256(raw), new Date().toISOString());
+    return { id, token: raw };
+  }
+
+  /** Tokens actifs (non révoqués), du plus ancien au plus récent. Ne renvoie JAMAIS le hash. */
+  listTokens(): Array<{ id: string; label: string; createdAt: string; lastUsedAt: string | null }> {
+    return this.db
+      .prepare(
+        'SELECT id, label, created_at AS createdAt, last_used_at AS lastUsedAt FROM auth_tokens WHERE revoked_at IS NULL ORDER BY created_at',
+      )
+      .all() as Array<{ id: string; label: string; createdAt: string; lastUsedAt: string | null }>;
+  }
+
+  /** Nombre de tokens actifs (non révoqués). */
+  countActiveTokens(): number {
+    return (this.db.prepare('SELECT COUNT(*) AS n FROM auth_tokens WHERE revoked_at IS NULL').get() as { n: number }).n;
+  }
+
+  /**
+   * Révoque un token. Refuse de révoquer le DERNIER token actif (sinon lock-out total) → 'last'.
+   * 'ok' = révoqué ; 'not_found' = id inconnu ou déjà révoqué.
+   */
+  revokeToken(id: string): 'ok' | 'last' | 'not_found' {
+    // Transaction : le check « dernier token » et l'UPDATE doivent être atomiques (garde
+    // anti lock-out robuste, même si un refactor futur introduisait de la concurrence).
+    this.db.exec('BEGIN IMMEDIATE');
+    try {
+      const row = this.db.prepare('SELECT id FROM auth_tokens WHERE id = ? AND revoked_at IS NULL').get(id) as
+        | { id: string }
+        | undefined;
+      let result: 'ok' | 'last' | 'not_found';
+      if (!row) {
+        result = 'not_found';
+      } else if (this.countActiveTokens() <= 1) {
+        result = 'last';
+      } else {
+        this.db.prepare('UPDATE auth_tokens SET revoked_at = ? WHERE id = ?').run(new Date().toISOString(), id);
+        result = 'ok';
+      }
+      this.db.exec('COMMIT');
+      return result;
+    } catch (err) {
+      this.db.exec('ROLLBACK');
+      throw err;
+    }
   }
 
   verifyRawToken(raw: string): AuthContext | null {

packages/server/src/config.ts

@@ -1,7 +1,7 @@
 import { parseArgs } from 'node:util';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
-import { mkdirSync } from 'node:fs';
+import { chmodSync, mkdirSync } from 'node:fs';
 
 export interface Config {
   port: number;
@@ -17,6 +17,8 @@ export interface Config {
   claudeSessionsDir: string;
   /** sujet VAPID des notifications Web Push (mailto: ou URL). */
   vapidContact: string;
+  /** découverte auto des repos au démarrage + périodique (désactivable via --no-discover). */
+  autoDiscover: boolean;
 }
 
 export function loadConfig(argv = process.argv.slice(2)): Config {
@@ -33,6 +35,8 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
       'claude-home': { type: 'string' },
       // sujet VAPID des notifications push (contact requis par la spec Web Push).
       'vapid-contact': { type: 'string' },
+      // désactive la découverte auto des repos (boot + périodique) — utilisé par les tests d'acceptation.
+      'no-discover': { type: 'boolean', default: false },
     },
     strict: true,
   });
@@ -49,6 +53,14 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
 
   const dataDir = join(process.env.XDG_DATA_HOME ?? join(homedir(), '.local', 'share'), 'arboretum');
   mkdirSync(dataDir, { recursive: true });
+  // La DB contient des secrets (server_secret, clé privée VAPID, hashs de tokens) : le dossier de
+  // données ne doit jamais être lisible par d'autres utilisateurs du système. chmod best-effort
+  // (peut échouer sur certains FS Windows/montés ; le démarrage avertit alors sans bloquer).
+  try {
+    chmodSync(dataDir, 0o700);
+  } catch {
+    /* FS sans permissions POSIX : ignoré, cf. avertissement dans db.openDb */
+  }
   const claudeHome = values['claude-home'] ?? join(homedir(), '.claude');
   return {
     port: Number(values.port),
@@ -60,5 +72,6 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
     claudeProjectsDir: join(claudeHome, 'projects'),
     claudeSessionsDir: join(claudeHome, 'sessions'),
     vapidContact: values['vapid-contact'] ?? 'mailto:arboretum@localhost',
+    autoDiscover: !(values['no-discover'] ?? false),
   };
 }

packages/server/src/core/audit-log.ts

@@ -0,0 +1,65 @@
+// Journal d'audit : trace persistante des opérations sensibles (création/révocation de tokens,
+// changements de réglages, génération de secrets, abonnements push, CRUD groupes). Exigence de
+// conformité entreprise (GDPR/SOX/ISO 27001). Règle ABSOLUE : ne JAMAIS journaliser un secret en
+// clair — `details` ne contient que des métadonnées non sensibles (ids, labels, compteurs).
+import { randomUUID } from 'node:crypto';
+import type { AuditLogEntry } from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+
+export type AuditResult = 'ok' | 'denied' | 'error';
+
+export interface AuditEntry {
+  /** tokenId de l'acteur, ou 'system' (opérations automatiques), ou 'anonymous' (avant auth). */
+  actor: string;
+  /** verbe.objet, ex. 'token.create', 'settings.update', 'login.failure'. */
+  action: string;
+  resourceId?: string | null;
+  details?: Record<string, unknown> | null;
+  result?: AuditResult;
+}
+
+/** Enregistre une entrée d'audit. Best-effort : une erreur d'écriture ne casse jamais l'opération métier. */
+export function recordAudit(db: Db, e: AuditEntry): void {
+  try {
+    db.prepare(
+      'INSERT INTO audit_logs (id, ts, actor, action, resource_id, details, result) VALUES (?, ?, ?, ?, ?, ?, ?)',
+    ).run(
+      randomUUID(),
+      new Date().toISOString(),
+      e.actor,
+      e.action,
+      e.resourceId ?? null,
+      e.details ? JSON.stringify(e.details) : null,
+      e.result ?? 'ok',
+    );
+  } catch {
+    /* l'audit ne doit jamais faire échouer l'action auditée */
+  }
+}
+
+/** Liste paginée par date décroissante (curseur `before` = ts strictement inférieur). */
+export function listAudit(db: Db, opts: { limit: number; before?: string | null }): AuditLogEntry[] {
+  const limit = Math.min(Math.max(Math.trunc(opts.limit) || 50, 1), 200);
+  const rows = (
+    opts.before
+      ? db
+          .prepare(
+            'SELECT id, ts, actor, action, resource_id AS resourceId, details, result FROM audit_logs WHERE ts < ? ORDER BY ts DESC LIMIT ?',
+          )
+          .all(opts.before, limit)
+      : db
+          .prepare(
+            'SELECT id, ts, actor, action, resource_id AS resourceId, details, result FROM audit_logs ORDER BY ts DESC LIMIT ?',
+          )
+          .all(limit)
+  ) as Array<{ id: string; ts: string; actor: string; action: string; resourceId: string | null; details: string | null; result: string }>;
+  return rows.map((r) => ({ ...r, details: r.details ? safeParse(r.details) : null }));
+}
+
+function safeParse(s: string): unknown {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return s;
+  }
+}

packages/server/src/core/push-service.ts

@@ -4,6 +4,8 @@
 import { randomUUID } from 'node:crypto';
 import { createRequire } from 'node:module';
 import { type Db, getSetting, setSetting } from '../db/index.js';
+import type { SecretBox } from './secret-box.js';
+import { recordAudit } from './audit-log.js';
 
 // web-push est publié en CommonJS : on le charge via require (verbatimModuleSyntax + NodeNext),
 // typé par l'import type — même pattern que @xterm/headless dans screen-reader.ts.
@@ -47,16 +49,22 @@ export class PushService {
     private readonly db: Db,
     private readonly contact: string = 'mailto:arboretum@localhost',
     sender?: PushSender,
+    box?: SecretBox,
   ) {
     this.send = sender ?? ((sub, payload, options) => webpush.sendNotification(sub, payload, options as Parameters<typeof webpush.sendNotification>[2]));
-    let pub = getSetting(db, 'vapid_public');
-    let priv = getSetting(db, 'vapid_private');
+    let pub = getSetting(db, 'vapid_public'); // clé publique : jamais chiffrée (sûre à exposer)
+    const storedPriv = getSetting(db, 'vapid_private');
+    let priv = storedPriv ? (box ? box.decrypt(storedPriv) : storedPriv) : null;
     if (!pub || !priv) {
       const keys = webpush.generateVAPIDKeys();
       pub = keys.publicKey;
       priv = keys.privateKey;
       setSetting(db, 'vapid_public', pub);
-      setSetting(db, 'vapid_private', priv);
+      setSetting(db, 'vapid_private', box ? box.encrypt(priv) : priv);
+      recordAudit(db, { actor: 'system', action: 'secret.generate', resourceId: 'vapid' });
+    } else if (box && storedPriv && !box.isEncrypted(storedPriv)) {
+      // migration douce : clé privée pré-existante en clair → re-chiffrée.
+      setSetting(db, 'vapid_private', box.encrypt(priv));
     }
     this.vapidPublic = pub;
     this.vapidPrivate = priv;

packages/server/src/core/repo-discovery.ts

@@ -0,0 +1,42 @@
+// Planificateur de la découverte auto des repos : scan au démarrage + re-scan périodique.
+// Calqué sur DiscoveryService (sessions) — start()/stop() avec timer .unref(). Démarré depuis
+// runDaemon() UNIQUEMENT (jamais buildApp), ce qui isole naturellement les tests vitest du scan.
+// Lui-même sans état : il lit les racines/l'intervalle dans `settings` et délègue à WorktreeManager.
+import type { Db } from '../db/index.js';
+import type { WorktreeManager } from './worktree-manager.js';
+import { readScanIntervalMin, readScanRoots } from './scan-settings.js';
+
+export class RepoDiscoveryService {
+  private timer: NodeJS.Timeout | null = null;
+
+  constructor(
+    private readonly db: Db,
+    private readonly worktrees: WorktreeManager,
+  ) {}
+
+  start(): void {
+    if (this.timer) return;
+    void this.refresh(); // scan initial asynchrone : ne bloque pas le boot
+    const intervalMin = readScanIntervalMin(this.db);
+    if (intervalMin > 0) {
+      this.timer = setInterval(() => void this.refresh(), intervalMin * 60_000);
+      this.timer.unref(); // ne maintient pas le process en vie
+    }
+  }
+
+  stop(): void {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+
+  /** Relit les racines (changement effectif sans redémarrage) et lance un scan. Ne lève jamais. */
+  private async refresh(): Promise<void> {
+    try {
+      await this.worktrees.discoverRepos({ roots: readScanRoots(this.db) });
+    } catch {
+      /* scan tolérant : une erreur ne doit pas tuer le timer */
+    }
+  }
+}

packages/server/src/core/repo-scanner.ts

@@ -0,0 +1,97 @@
+// Découverte auto des dépôts git : marche bornée du système de fichiers à la recherche de `.git`.
+// Fonction PURE et tolérante (ne lève jamais) — testable isolément comme parseWorktreePorcelain.
+// N'appelle JAMAIS git (détection par présence de `.git`) : la validation réelle (isRepo) et la
+// résolution de default_branch se font paresseusement à l'enregistrement, pas par dépôt scanné.
+import { readdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface ScanLimits {
+  /** profondeur maximale de descente sous chaque racine (la racine = 0). */
+  maxDepth: number;
+  /** nombre maximal de repos retournés (garde-fou anti-explosion d'un FS pathologique). */
+  maxRepos: number;
+  /** noms de dossiers à ne jamais ouvrir (en plus des dotdirs, toujours exclus). */
+  excludeDirs?: Set<string>;
+}
+
+/** Dossiers jamais explorés : grosses arborescences sans repos racine, ou bruit de build. */
+export const DEFAULT_EXCLUDE_DIRS = new Set<string>([
+  'node_modules',
+  'vendor',
+  'target',
+  'dist',
+  'build',
+  '.cache',
+  'venv',
+  '.venv',
+  '__pycache__',
+]);
+
+interface Frame {
+  dir: string;
+  depth: number;
+}
+
+/**
+ * Parcours itératif (pile explicite, jamais de récursion non bornée) des `roots`.
+ * Règles :
+ *  - un dossier contenant `.git` (fichier OU dossier → couvre les worktrees liés) est un repo :
+ *    on l'enregistre ; en profondeur on NE descend PAS dedans (sous-modules/worktrees imbriqués
+ *    ignorés). EXCEPTION : une racine fournie (depth 0) qui est elle-même un repo est aussi un
+ *    conteneur — on l'enregistre ET on continue de descendre pour trouver les repos internes ;
+ *  - on n'empile que les vrais sous-dossiers (`d.isDirectory()`), donc les symlinks ne sont PAS
+ *    suivis (anti-cycle + anti-sortie de racine), et on saute dotdirs + excludeDirs ;
+ *  - bornes : `maxDepth`, `maxRepos`, et un éventuel `signal` (timeout global) ;
+ *  - tolérance : un `readdir` qui échoue (EACCES/ENOENT) est ignoré, le scan continue ;
+ *  - racine inexistante/illisible : ignorée silencieusement.
+ * Retourne les chemins absolus dédupliqués des racines de repos, et `truncated` si une borne a coupé.
+ */
+export async function scanForRepos(
+  roots: string[],
+  limits: ScanLimits,
+  signal?: AbortSignal,
+): Promise<{ paths: string[]; truncated: boolean }> {
+  const excludes = limits.excludeDirs ?? DEFAULT_EXCLUDE_DIRS;
+  const found = new Set<string>();
+  const seen = new Set<string>(); // ceinture-bretelles anti-cycle (chemins déjà visités)
+  let truncated = false;
+
+  // pile partagée entre toutes les racines : un seul plafond global maxRepos.
+  const stack: Frame[] = [];
+  for (const root of roots) stack.push({ dir: root, depth: 0 });
+
+  while (stack.length > 0) {
+    if (signal?.aborted || found.size >= limits.maxRepos) {
+      truncated = true;
+      break;
+    }
+    const { dir, depth } = stack.pop() as Frame;
+    if (seen.has(dir)) continue;
+    seen.add(dir);
+
+    // Un dossier avec `.git` est un repo. En PROFONDEUR (depth > 0) c'est une feuille : on
+    // l'enregistre sans descendre (on n'ouvre pas les sous-modules/worktrees imbriqués). Mais une
+    // RACINE fournie explicitement (depth 0) est un CONTENEUR de scan : si elle est elle-même un
+    // repo on l'enregistre, puis on CONTINUE de descendre pour découvrir les dépôts qu'elle contient.
+    if (existsSync(join(dir, '.git'))) {
+      found.add(dir);
+      if (depth > 0) continue;
+    }
+    if (depth >= limits.maxDepth) continue;
+
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      continue; // EACCES/ENOENT/… : dossier ignoré, on poursuit
+    }
+    for (const e of entries) {
+      if (!e.isDirectory()) continue; // symlinks non suivis (isDirectory() est false pour un lien)
+      if (e.name.startsWith('.') || excludes.has(e.name)) continue;
+      stack.push({ dir: join(dir, e.name), depth: depth + 1 });
+    }
+  }
+
+  return { paths: [...found], truncated };
+}

packages/server/src/core/scan-settings.ts

@@ -0,0 +1,66 @@
+// Réglages de la découverte auto des repos, persistés dans la table `settings` (clé/valeur).
+// Frontière de sécurité : ces clés sont NON sensibles et n'entrent dans l'allow-list du PATCH
+// /api/v1/settings que via les validateurs ci-dessous. Aucun secret ne transite par ici.
+import { getSetting } from '../db/index.js';
+import type { Db } from '../db/index.js';
+import { isSafeAbsolutePath } from './git.js';
+
+export const SCAN_ROOTS_KEY = 'scan_roots';
+export const SCAN_INTERVAL_KEY = 'scan_interval_min';
+
+/** Intervalle par défaut du re-scan périodique (minutes). 0 = désactivé. */
+export const DEFAULT_SCAN_INTERVAL_MIN = 5;
+/** Borne haute de l'intervalle (24 h) et nombre maximal de racines. */
+export const MAX_SCAN_INTERVAL_MIN = 1440;
+export const MAX_SCAN_ROOTS = 16;
+
+/**
+ * Racines à scanner. Défaut : AUCUNE racine → aucun scan (clean install).
+ * L'utilisateur ajoute ses racines via Réglages → Découverte. Lecture tolérante (JSON malformé → []).
+ */
+export function readScanRoots(db: Db): string[] {
+  const raw = getSetting(db, SCAN_ROOTS_KEY);
+  if (!raw) return [];
+  return normalizeScanRoots(safeParse(raw)) ?? [];
+}
+
+/** Intervalle périodique en minutes (0 = désactivé). Défaut DEFAULT_SCAN_INTERVAL_MIN. */
+export function readScanIntervalMin(db: Db): number {
+  const raw = getSetting(db, SCAN_INTERVAL_KEY);
+  if (raw === null) return DEFAULT_SCAN_INTERVAL_MIN;
+  const n = Number(raw);
+  return Number.isInteger(n) && n >= 0 && n <= MAX_SCAN_INTERVAL_MIN ? n : DEFAULT_SCAN_INTERVAL_MIN;
+}
+
+/**
+ * Valide/normalise une liste de racines : tableau de chemins absolus normalisés (isSafeAbsolutePath),
+ * jamais `/` (scan catastrophique), dédupliqués, ≤ MAX_SCAN_ROOTS. Retourne null si invalide (⇒ 400).
+ * Une liste vide est valide (revient au défaut côté lecture).
+ */
+export function normalizeScanRoots(raw: unknown): string[] | null {
+  if (!Array.isArray(raw)) return null;
+  if (raw.length > MAX_SCAN_ROOTS) return null;
+  const out: string[] = [];
+  for (const item of raw) {
+    if (typeof item !== 'string') return null;
+    const p = item.trim();
+    if (!isSafeAbsolutePath(p) || p === '/') return null;
+    if (!out.includes(p)) out.push(p);
+  }
+  return out;
+}
+
+/** Valide un intervalle (entier 0–MAX_SCAN_INTERVAL_MIN). Retourne null si invalide. */
+export function normalizeScanIntervalMin(raw: unknown): number | null {
+  if (typeof raw !== 'number' || !Number.isInteger(raw)) return null;
+  if (raw < 0 || raw > MAX_SCAN_INTERVAL_MIN) return null;
+  return raw;
+}
+
+function safeParse(raw: string): unknown {
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}

packages/server/src/core/secret-box.ts

@@ -0,0 +1,69 @@
+// Chiffrement au repos des secrets applicatifs (server_secret HMAC, clé privée VAPID) stockés dans
+// la table `settings`. node:sqlite (DatabaseSync) ne supporte pas sqlcipher → on chiffre au niveau
+// applicatif les VALEURS sensibles, en AES-256-GCM (authentifié), avant insertion.
+//
+// Gestion de clé (par ordre de priorité) :
+//   1. ARBORETUM_SECRET_KEY (variable d'env) → vraie protection : la clé ne vit pas sur le disque,
+//      donc une fuite de la base seule (backup, WAL) ne révèle pas les secrets ;
+//   2. sinon, fichier clé `dataDir/secret.key` (0o600), généré au 1er démarrage. Protection partielle :
+//      couvre la fuite de la base seule, PAS celle du dossier de données complet (clé + base ensemble).
+// Compromis assumé et documenté (docs/ENTERPRISE_DEPLOYMENT.md) : pour une protection forte, fournir
+// ARBORETUM_SECRET_KEY et sauvegarder cette clé séparément des backups de la base.
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const PREFIX = 'v1:'; // versionne le format ; absence de préfixe = valeur en clair (legacy → migration douce)
+const SCRYPT_SALT = 'arboretum-secret-box-v1'; // sel fixe : l'entropie vient de la passphrase fournie
+
+export class SecretBox {
+  constructor(private readonly key: Buffer) {}
+
+  /** Chiffre en `v1:<iv>:<tag>:<ciphertext>` (hex). */
+  encrypt(plaintext: string): string {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', this.key, iv);
+    const ct = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${PREFIX}${iv.toString('hex')}:${tag.toString('hex')}:${ct.toString('hex')}`;
+  }
+
+  /** Déchiffre une valeur `v1:` ; une valeur sans préfixe est retournée telle quelle (clair legacy). */
+  decrypt(stored: string): string {
+    if (!this.isEncrypted(stored)) return stored;
+    const [, ivHex, tagHex, ctHex] = stored.split(':');
+    if (!ivHex || !tagHex || !ctHex) throw new Error('secret-box: format chiffré invalide');
+    const decipher = createDecipheriv('aes-256-gcm', this.key, Buffer.from(ivHex, 'hex'));
+    decipher.setAuthTag(Buffer.from(tagHex, 'hex'));
+    return Buffer.concat([decipher.update(Buffer.from(ctHex, 'hex')), decipher.final()]).toString('utf8');
+  }
+
+  isEncrypted(stored: string): boolean {
+    return stored.startsWith(PREFIX);
+  }
+}
+
+/**
+ * Construit le SecretBox de production : clé dérivée d'ARBORETUM_SECRET_KEY si fournie, sinon
+ * d'un fichier clé `dataDir/secret.key` (0o600) généré au besoin.
+ */
+export function loadSecretBox(dataDir: string): SecretBox {
+  const passphrase = process.env.ARBORETUM_SECRET_KEY;
+  if (passphrase && passphrase.length > 0) {
+    return new SecretBox(scryptSync(passphrase, SCRYPT_SALT, 32));
+  }
+  const keyPath = join(dataDir, 'secret.key');
+  let keyHex: string;
+  if (existsSync(keyPath)) {
+    keyHex = readFileSync(keyPath, 'utf8').trim();
+  } else {
+    keyHex = randomBytes(32).toString('hex');
+    writeFileSync(keyPath, keyHex + '\n', { mode: 0o600 });
+  }
+  try {
+    chmodSync(keyPath, 0o600);
+  } catch {
+    /* FS sans permissions POSIX : ignoré */
+  }
+  return new SecretBox(Buffer.from(keyHex, 'hex'));
+}

packages/server/src/core/worktree-manager.ts

@@ -7,6 +7,7 @@ import { randomUUID } from 'node:crypto';
 import { basename, dirname, join, resolve } from 'node:path';
 import { existsSync } from 'node:fs';
 import type {
+  DiscoverReposResponse,
   HookRunResult,
   PostCreateHook,
   RepoSummary,
@@ -17,6 +18,7 @@ import type {
 import type { Db } from '../db/index.js';
 import type { PtyManager } from './pty-manager.js';
 import { DiscoveryService, mergeSessions } from './discovery-service.js';
+import { scanForRepos } from './repo-scanner.js';
 import { preTrustProject } from './claude-trust.js';
 import {
   addWorktree,
@@ -35,6 +37,10 @@ import {
 const FACTS_TTL_MS = 2500;
 const HOOK_TIMEOUT_MS = 5 * 60_000;
 const HOOK_OUTPUT_MAX = 64 * 1024;
+// Bornes du scan de découverte (anti-explosion sur un home volumineux).
+const SCAN_MAX_DEPTH = 6;
+const SCAN_MAX_REPOS = 2000;
+const SCAN_TIMEOUT_MS = 30_000;
 
 interface RepoRow {
   id: string;
@@ -44,6 +50,7 @@ interface RepoRow {
   post_create_hooks: string;
   pre_trust: number;
   created_at: string;
+  hidden: number;
 }
 
 export interface WorktreeManagerEvents {
@@ -96,6 +103,8 @@ function runHook(cwd: string, hook: PostCreateHook): Promise<HookRunResult> {
 export class WorktreeManager extends EventEmitter<WorktreeManagerEvents> {
   private readonly factsCache = new Map<string, { facts: Array<{ w: ParsedWorktree; status: WorktreeGitStatus }>; at: number }>();
   private readonly locks = new Map<string, Promise<unknown>>();
+  /** Scan de découverte en cours : coalesce boot + bouton + périodique sur un seul scan. */
+  private scanInFlight: Promise<DiscoverReposResponse> | null = null;
 
   constructor(
     private readonly db: Db,
@@ -121,6 +130,7 @@ export class WorktreeManager extends EventEmitter<WorktreeManagerEvents> {
       preTrust: row.pre_trust === 1,
       createdAt: row.created_at,
       valid: await isRepo(row.path),
+      hidden: row.hidden === 1,
     };
   }
 
@@ -143,24 +153,35 @@ export class WorktreeManager extends EventEmitter<WorktreeManagerEvents> {
       post_create_hooks: JSON.stringify(opts.postCreateHooks ?? []),
       pre_trust: opts.preTrust ? 1 : 0,
       created_at: new Date().toISOString(),
+      hidden: 0,
     };
-    this.db
-      .prepare('INSERT INTO repos (id, path, label, default_branch, post_create_hooks, pre_trust, created_at) VALUES (?, ?, ?, ?, ?, ?, ?)')
-      .run(row.id, row.path, row.label, row.default_branch, row.post_create_hooks, row.pre_trust, row.created_at);
+    try {
+      this.db
+        .prepare('INSERT INTO repos (id, path, label, default_branch, post_create_hooks, pre_trust, created_at, hidden) VALUES (?, ?, ?, ?, ?, ?, ?, ?)')
+        .run(row.id, row.path, row.label, row.default_branch, row.post_create_hooks, row.pre_trust, row.created_at, row.hidden);
+    } catch (err) {
+      // Course possible avec un scan concurrent qui aurait inséré le même path entre le SELECT
+      // d'unicité et cet INSERT (contrainte UNIQUE sur path) → on rend le même 409 explicite.
+      if (String((err as { code?: string }).code).includes('CONSTRAINT')) {
+        throw httpError(409, 'ALREADY_REGISTERED', 'This repository is already registered');
+      }
+      throw err;
+    }
     const summary = await this.rowToSummary(row);
     this.emit('repo_update', summary);
     return summary;
   }
 
-  async updateRepo(id: string, patch: { label?: string; postCreateHooks?: PostCreateHook[]; preTrust?: boolean }): Promise<RepoSummary> {
+  async updateRepo(id: string, patch: { label?: string; postCreateHooks?: PostCreateHook[]; preTrust?: boolean; hidden?: boolean }): Promise<RepoSummary> {
     const row = this.getRepoRow(id);
     if (!row) throw httpError(404, 'NOT_FOUND', 'No repo with this id');
     if (patch.label !== undefined) row.label = patch.label.trim() || row.label;
     if (patch.postCreateHooks !== undefined) row.post_create_hooks = JSON.stringify(patch.postCreateHooks);
     if (patch.preTrust !== undefined) row.pre_trust = patch.preTrust ? 1 : 0;
+    if (patch.hidden !== undefined) row.hidden = patch.hidden ? 1 : 0;
     this.db
-      .prepare('UPDATE repos SET label = ?, post_create_hooks = ?, pre_trust = ? WHERE id = ?')
-      .run(row.label, row.post_create_hooks, row.pre_trust, id);
+      .prepare('UPDATE repos SET label = ?, post_create_hooks = ?, pre_trust = ?, hidden = ? WHERE id = ?')
+      .run(row.label, row.post_create_hooks, row.pre_trust, row.hidden, id);
     const summary = await this.rowToSummary(row);
     this.emit('repo_update', summary);
     return summary;
@@ -174,6 +195,53 @@ export class WorktreeManager extends EventEmitter<WorktreeManagerEvents> {
     return true;
   }
 
+  /**
+   * Découvre les repos git sous `roots` et auto-enregistre les NOUVEAUX (path absent de la DB).
+   * Idempotent et anti-résurrection : un path déjà présent — visible OU masqué — n'est jamais
+   * réécrit (INSERT ... ON CONFLICT DO NOTHING). Les scans concurrents sont coalescés. Tolérant :
+   * ne lève pas (le scanner avale les erreurs FS). N'appelle aucun git pendant le scan
+   * (default_branch=NULL, résolu paresseusement par rowToSummary à l'affichage).
+   */
+  discoverRepos(opts: { roots: string[]; maxDepth?: number; maxRepos?: number }): Promise<DiscoverReposResponse> {
+    if (this.scanInFlight) return this.scanInFlight;
+    this.scanInFlight = this.runDiscovery(opts).finally(() => {
+      this.scanInFlight = null;
+    });
+    return this.scanInFlight;
+  }
+
+  private async runDiscovery(opts: { roots: string[]; maxDepth?: number; maxRepos?: number }): Promise<DiscoverReposResponse> {
+    const t0 = Date.now();
+    const { paths, truncated } = await scanForRepos(
+      opts.roots,
+      { maxDepth: opts.maxDepth ?? SCAN_MAX_DEPTH, maxRepos: opts.maxRepos ?? SCAN_MAX_REPOS },
+      AbortSignal.timeout(SCAN_TIMEOUT_MS),
+    );
+    const insert = this.db.prepare(
+      `INSERT INTO repos (id, path, label, default_branch, post_create_hooks, pre_trust, created_at, hidden)
+       VALUES (?, ?, ?, NULL, '[]', 0, ?, 0) ON CONFLICT(path) DO NOTHING`,
+    );
+    let added = 0;
+    for (const path of paths) {
+      const row: RepoRow = {
+        id: randomUUID(),
+        path,
+        label: basename(path),
+        default_branch: null,
+        post_create_hooks: '[]',
+        pre_trust: 0,
+        created_at: new Date().toISOString(),
+        hidden: 0,
+      };
+      const res = insert.run(row.id, row.path, row.label, row.created_at);
+      if (res.changes === 1) {
+        added++;
+        this.emit('repo_update', await this.rowToSummary(row)); // nouveaux uniquement
+      }
+    }
+    return { scanned: paths.length, added, durationMs: Date.now() - t0, truncated };
+  }
+
   // ---- worktrees ----
 
   /** Sessions (managées + découvertes) dont le cwd correspond à ce chemin de worktree. */
@@ -214,8 +282,13 @@ export class WorktreeManager extends EventEmitter<WorktreeManagerEvents> {
   }
 
   async listAllWorktrees(): Promise<WorktreeSummary[]> {
-    const rows = this.db.prepare('SELECT id FROM repos ORDER BY created_at ASC').all() as Array<{ id: string }>;
-    const lists = await Promise.all(rows.map((r) => this.listRepoWorktrees(r.id)));
+    // Les repos masqués sont exclus du dashboard : inutile de calculer leurs worktrees (sous-process
+    // git par repo). Le front charge paresseusement ceux d'un repo masqué via listRepoWorktrees
+    // quand l'utilisateur active « afficher les masqués ».
+    const rows = this.db.prepare('SELECT id FROM repos WHERE hidden = 0 ORDER BY created_at ASC').all() as Array<{ id: string }>;
+    // Tolérance par repo : avec la découverte auto, un repo douteux (git en échec, chemin disparu,
+    // permission) ne doit JAMAIS faire planter tout l'endpoint — il ne contribue alors aucun worktree.
+    const lists = await Promise.all(rows.map((r) => this.listRepoWorktrees(r.id).catch(() => [])));
     return lists.flat();
   }
 

packages/server/src/db/index.ts

@@ -1,4 +1,5 @@
 import { DatabaseSync } from 'node:sqlite';
+import { chmodSync, existsSync } from 'node:fs';
 
 const MIGRATIONS: Array<{ id: number; sql: string }> = [
   {
@@ -93,6 +94,30 @@ const MIGRATIONS: Array<{ id: number; sql: string }> = [
       CREATE INDEX idx_group_repos_repo ON group_repos(repo_id);
     `,
   },
+  {
+    // Découverte auto : un repo masqué reste en DB (exclu du dashboard) pour qu'un
+    // re-scan ne le ressuscite pas. hidden=1 = masqué.
+    id: 6,
+    sql: `ALTER TABLE repos ADD COLUMN hidden INTEGER NOT NULL DEFAULT 0;`,
+  },
+  {
+    // Journal d'audit (conformité entreprise : GDPR/SOX/ISO 27001). Trace les mutations
+    // sensibles (tokens, réglages, secrets, abonnements push, groupes). Ne contient JAMAIS
+    // de secret en clair — `details` est un JSON de métadonnées non sensibles.
+    id: 7,
+    sql: `
+      CREATE TABLE audit_logs (
+        id          TEXT PRIMARY KEY,
+        ts          TEXT NOT NULL,
+        actor       TEXT NOT NULL,
+        action      TEXT NOT NULL,
+        resource_id TEXT,
+        details     TEXT,
+        result      TEXT NOT NULL
+      );
+      CREATE INDEX idx_audit_ts ON audit_logs(ts);
+    `,
+  },
 ];
 
 export type Db = DatabaseSync;
@@ -101,10 +126,27 @@ export function openDb(path: string): Db {
   const db = new DatabaseSync(path);
   db.exec('PRAGMA journal_mode = WAL');
   db.exec('PRAGMA foreign_keys = ON');
+  hardenDbPermissions(path);
   migrate(db);
   return db;
 }
 
+/**
+ * Restreint la base (et ses fichiers WAL/SHM) à 0o600 — proprio uniquement. La base contient des
+ * secrets (server_secret, clé privée VAPID, hashs de tokens) : elle ne doit jamais être lisible par
+ * d'autres utilisateurs du système. Best-effort : ignoré sur les FS sans permissions POSIX.
+ */
+function hardenDbPermissions(path: string): void {
+  if (path === ':memory:') return;
+  for (const p of [path, `${path}-wal`, `${path}-shm`]) {
+    try {
+      if (existsSync(p)) chmodSync(p, 0o600);
+    } catch {
+      /* FS sans permissions POSIX (Windows / montage) : ignoré */
+    }
+  }
+}
+
 function migrate(db: DatabaseSync): void {
   db.exec('CREATE TABLE IF NOT EXISTS schema_migrations (id INTEGER PRIMARY KEY, applied_at TEXT NOT NULL)');
   const applied = new Set(

packages/server/src/index.ts

@@ -14,11 +14,12 @@ const pkg = JSON.parse(
 /** Démarre le daemon : écoute HTTP, scan des sessions, drain propre au SIGTERM/SIGINT. */
 export async function runDaemon(config: Config): Promise<void> {
   const db = openDb(config.dbPath);
-  const { app, auth, manager, discovery } = buildApp(config, db, pkg.version);
+  const { app, auth, manager, discovery, repoDiscovery } = buildApp(config, db, pkg.version);
 
   const bootstrapToken = auth.ensureBootstrapToken();
   await app.listen({ port: config.port, host: config.bind });
   discovery.start(); // scan initial + rafraîchissement périodique des sessions découvertes
+  if (config.autoDiscover) repoDiscovery.start(); // découverte auto des repos : scan au boot + re-scan périodique
 
   const url = `http://${config.bind === '0.0.0.0' ? '127.0.0.1' : config.bind}:${config.port}`;
   app.log.info(`Arboretum v${pkg.version} — ${url}`);
@@ -35,6 +36,7 @@ export async function runDaemon(config: Config): Promise<void> {
     shuttingDown = true;
     app.log.info(`${signal} received — draining sessions then exiting`);
     discovery.stop();
+    repoDiscovery.stop();
     manager.shutdown();
     setTimeout(() => {
       void app.close().then(() => process.exit(0));

packages/server/src/routes/audit.ts

@@ -0,0 +1,17 @@
+// Consultation du journal d'audit (onglet Réglages / outils de conformité). Lecture seule, sous
+// l'auth globale. Pagination par curseur `before` (ts décroissant).
+import type { FastifyInstance } from 'fastify';
+import type { AuditLogsResponse } from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+import { listAudit } from '../core/audit-log.js';
+
+export function registerAuditRoutes(app: FastifyInstance, db: Db): void {
+  app.get('/api/v1/audit-logs', async (req): Promise<AuditLogsResponse> => {
+    const q = req.query as { limit?: string; before?: string };
+    const limit = Math.min(Math.max(Math.trunc(Number(q.limit) || 50), 1), 200);
+    const entries = listAudit(db, { limit, before: q.before ?? null });
+    // s'il reste potentiellement des entrées (page pleine), expose le curseur suivant.
+    const nextBefore = entries.length === limit ? entries[entries.length - 1]!.ts : null;
+    return { entries, nextBefore };
+  });
+}

packages/server/src/routes/auth.ts

@@ -1,11 +1,20 @@
 import type { FastifyInstance, FastifyRequest } from 'fastify';
-import type { LoginRequest, LoginResponse, MeResponse } from '@arboretum/shared';
+import type {
+  CreateTokenRequest,
+  CreateTokenResponse,
+  LoginRequest,
+  LoginResponse,
+  MeResponse,
+  TokensListResponse,
+} from '@arboretum/shared';
 import type { AuthService, LoginRateLimiter } from '../auth/service.js';
+import type { Db } from '../db/index.js';
+import { recordAudit } from '../core/audit-log.js';
 
 // Tailscale Serve / un reverse-proxy TLS posent x-forwarded-proto. On ne sert jamais
 // en TLS direct : `secure` n'est posé que derrière un front HTTPS, jamais en localhost http
 // (sinon le navigateur refuserait le cookie sur http://127.0.0.1 et le login local casserait).
-function isHttpsRequest(req: FastifyRequest): boolean {
+export function isHttpsRequest(req: FastifyRequest): boolean {
   const xfp = req.headers['x-forwarded-proto'];
   const proto = (Array.isArray(xfp) ? xfp[0] : xfp)?.split(',')[0]?.trim();
   return proto === 'https';
@@ -16,6 +25,7 @@ export function registerAuthRoutes(
   auth: AuthService,
   limiter: LoginRateLimiter,
   serverVersion: string,
+  db: Db,
 ): void {
   app.post('/api/v1/auth/login', { config: { public: true } }, async (req, reply) => {
     const wait = limiter.check();
@@ -26,9 +36,11 @@ export function registerAuthRoutes(
     const ctx = typeof body?.token === 'string' ? auth.verifyRawToken(body.token) : null;
     if (!ctx) {
       limiter.recordFailure();
+      recordAudit(db, { actor: 'anonymous', action: 'login.failure', result: 'denied' });
       return reply.status(401).send({ error: { code: 'BAD_TOKEN', message: 'Invalid token' } });
     }
     limiter.recordSuccess();
+    recordAudit(db, { actor: ctx.tokenId, action: 'login.success' });
     void reply.setCookie(auth.cookieName, auth.issueCookie(ctx), {
       path: '/',
       httpOnly: true,
@@ -41,7 +53,12 @@ export function registerAuthRoutes(
   });
 
   app.get('/api/v1/auth/me', async (req, reply) => {
-    const res: MeResponse = { ok: true, tokenLabel: req.authContext?.label ?? 'unknown', serverVersion };
+    const res: MeResponse = {
+      ok: true,
+      tokenId: req.authContext?.tokenId ?? '',
+      tokenLabel: req.authContext?.label ?? 'unknown',
+      serverVersion,
+    };
     return reply.send(res);
   });
 
@@ -50,4 +67,39 @@ export function registerAuthRoutes(
     void reply.clearCookie(auth.cookieName, { path: '/', secure: isHttpsRequest(req) });
     return reply.send({ ok: true });
   });
+
+  // ---- Gestion des tokens d'accès (onglet Réglages) ----
+  // Sous l'auth globale (preValidation). On ne renvoie jamais le hash ; la valeur en clair
+  // d'un nouveau token n'est exposée qu'une seule fois, à la création.
+  app.get('/api/v1/auth/tokens', async (req): Promise<TokensListResponse> => {
+    const current = req.authContext?.tokenId;
+    return { tokens: auth.listTokens().map((t) => ({ ...t, current: t.id === current })) };
+  });
+
+  app.post('/api/v1/auth/tokens', async (req, reply) => {
+    const body = req.body as Partial<CreateTokenRequest> | null;
+    const label = typeof body?.label === 'string' ? body.label.trim() : '';
+    if (label.length < 1 || label.length > 64) {
+      return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'label must be 1–64 characters' } });
+    }
+    const { id, token } = auth.createTokenRecord(label);
+    recordAudit(db, { actor: req.authContext?.tokenId ?? 'unknown', action: 'token.create', resourceId: id, details: { label } });
+    return reply.status(201).send({ id, label, token } satisfies CreateTokenResponse);
+  });
+
+  app.delete('/api/v1/auth/tokens/:id', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const result = auth.revokeToken(id);
+    const actor = req.authContext?.tokenId ?? 'unknown';
+    if (result === 'not_found') {
+      return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No active token with this id' } });
+    }
+    if (result === 'last') {
+      recordAudit(db, { actor, action: 'token.revoke', resourceId: id, result: 'denied', details: { reason: 'last_active_token' } });
+      return reply.status(409).send({ error: { code: 'LAST_TOKEN', message: 'Cannot revoke the last active token' } });
+    }
+    recordAudit(db, { actor, action: 'token.revoke', resourceId: id });
+    // 200 + corps JSON (pas 204) : le mini-client REST du front parse toujours la réponse.
+    return reply.send({ ok: true });
+  });
 }

packages/server/src/routes/data.ts

@@ -0,0 +1,54 @@
+// RGPD (droits d'accès & d'effacement) : export et suppression des données rattachées au token
+// authentifié. Modèle mono-utilisateur → le détenteur du token EST le sujet des données. Sous l'auth
+// globale. La suppression se fait en deux temps (code de confirmation) pour éviter les clics accidentels.
+import { createHash } from 'node:crypto';
+import type { FastifyInstance } from 'fastify';
+import type { DataExportResponse, DeleteMyDataRequest, DeleteMyDataResponse } from '@arboretum/shared';
+import type { Db } from '../db/index.js';
+import type { AuthService } from '../auth/service.js';
+import { readScanIntervalMin, readScanRoots } from '../core/scan-settings.js';
+import { recordAudit } from '../core/audit-log.js';
+
+export function registerDataRoutes(app: FastifyInstance, db: Db, auth: AuthService): void {
+  app.get('/api/v1/data/export', async (req): Promise<DataExportResponse> => {
+    const current = req.authContext!.tokenId;
+    const tokens = auth.listTokens().map((t) => ({ ...t, current: t.id === current }));
+    const pushSubscriptions = db
+      .prepare(
+        'SELECT endpoint, user_agent AS userAgent, created_at AS createdAt, last_ok_at AS lastOkAt FROM push_subscriptions WHERE token_id = ?',
+      )
+      .all(current) as DataExportResponse['pushSubscriptions'];
+    const sessions = db
+      .prepare(
+        'SELECT id, cwd, command, title, created_at AS createdAt, ended_at AS endedAt, exit_code AS exitCode FROM sessions ORDER BY created_at',
+      )
+      .all() as DataExportResponse['sessions'];
+    return {
+      exportedAt: new Date().toISOString(),
+      tokens,
+      pushSubscriptions,
+      sessions,
+      settings: { scanRoots: readScanRoots(db), scanIntervalMin: readScanIntervalMin(db) },
+    };
+  });
+
+  app.post('/api/v1/data/delete-my-data', async (req, reply) => {
+    const current = req.authContext!.tokenId;
+    // code déterministe lié au token (sans état serveur) : renvoyé au 1er appel, exigé au 2nd.
+    const code = createHash('sha256').update(`delete:${current}`).digest('hex').slice(0, 12);
+    const body = (req.body as DeleteMyDataRequest | null) ?? {};
+    const subsCount = (db.prepare('SELECT COUNT(*) AS n FROM push_subscriptions WHERE token_id = ?').get(current) as { n: number }).n;
+
+    if (body.confirm !== code) {
+      const res: DeleteMyDataResponse = { status: 'pending', confirm: code, summary: { pushSubscriptions: subsCount, tokenRevoked: false } };
+      return reply.send(res);
+    }
+
+    db.prepare('DELETE FROM push_subscriptions WHERE token_id = ?').run(current);
+    // révoque le token courant (sauf si c'est le dernier actif → garde anti lock-out conservée).
+    const revoked = auth.revokeToken(current) === 'ok';
+    recordAudit(db, { actor: current, action: 'data.delete', details: { pushSubscriptions: subsCount, tokenRevoked: revoked } });
+    const res: DeleteMyDataResponse = { status: 'done', summary: { pushSubscriptions: subsCount, tokenRevoked: revoked } };
+    return reply.send(res);
+  });
+}

packages/server/src/routes/groups.ts

@@ -7,9 +7,11 @@ import type {
   UpdateGroupRequest,
 } from '@arboretum/shared';
 import type { GroupManager } from '../core/group-manager.js';
+import type { Db } from '../db/index.js';
+import { recordAudit } from '../core/audit-log.js';
 import { sendManagerError } from './repos.js';
 
-export function registerGroupRoutes(app: FastifyInstance, gm: GroupManager): void {
+export function registerGroupRoutes(app: FastifyInstance, gm: GroupManager, db: Db): void {
   app.get('/api/v1/groups', async (): Promise<GroupsListResponse> => ({ groups: gm.listGroups() }));
 
   app.get('/api/v1/groups/:id', async (req, reply) => {
@@ -33,6 +35,7 @@ export function registerGroupRoutes(app: FastifyInstance, gm: GroupManager): voi
         ...(body.color !== undefined ? { color: body.color } : {}),
         ...(Array.isArray(body.repoIds) ? { repoIds: body.repoIds } : {}),
       });
+      recordAudit(db, { actor: req.authContext?.tokenId ?? 'unknown', action: 'group.create', resourceId: group.id, details: { label: group.label } });
       return reply.status(201).send({ group } satisfies GroupResponse);
     } catch (err) {
       return sendManagerError(reply, err);
@@ -48,6 +51,7 @@ export function registerGroupRoutes(app: FastifyInstance, gm: GroupManager): voi
         ...(body.description !== undefined ? { description: body.description } : {}),
         ...(body.color !== undefined ? { color: body.color } : {}),
       });
+      recordAudit(db, { actor: req.authContext?.tokenId ?? 'unknown', action: 'group.update', resourceId: id });
       return reply.send({ group } satisfies GroupResponse);
     } catch (err) {
       return sendManagerError(reply, err);
@@ -59,6 +63,7 @@ export function registerGroupRoutes(app: FastifyInstance, gm: GroupManager): voi
     if (!gm.deleteGroup(id)) {
       return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No group with this id' } });
     }
+    recordAudit(db, { actor: req.authContext?.tokenId ?? 'unknown', action: 'group.delete', resourceId: id });
     return reply.send({ ok: true });
   });
 

packages/server/src/routes/push.ts

@@ -3,8 +3,10 @@
 import type { FastifyInstance } from 'fastify';
 import type { PushSubscribeRequest, PushUnsubscribeRequest, VapidKeyResponse } from '@arboretum/shared';
 import type { PushService } from '../core/push-service.js';
+import type { Db } from '../db/index.js';
+import { recordAudit } from '../core/audit-log.js';
 
-export function registerPushRoutes(app: FastifyInstance, push: PushService): void {
+export function registerPushRoutes(app: FastifyInstance, push: PushService, db: Db): void {
   app.get('/api/v1/push/vapid-public-key', async (): Promise<VapidKeyResponse> => ({ key: push.publicKey() }));
 
   app.post('/api/v1/push/subscribe', async (req, reply) => {
@@ -15,6 +17,7 @@ export function registerPushRoutes(app: FastifyInstance, push: PushService): voi
     // garanti non-null : la route est protégée par le preValidation global.
     const tokenId = req.authContext!.tokenId;
     push.subscribe(tokenId, { endpoint: body.endpoint, keys: { p256dh: body.keys.p256dh, auth: body.keys.auth } }, req.headers['user-agent'] ?? null);
+    recordAudit(db, { actor: tokenId, action: 'push.subscribe' });
     return reply.status(201).send({ ok: true });
   });
 
@@ -24,6 +27,7 @@ export function registerPushRoutes(app: FastifyInstance, push: PushService): voi
       return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'endpoint is required' } });
     }
     push.unsubscribe(body.endpoint);
+    recordAudit(db, { actor: req.authContext?.tokenId ?? 'unknown', action: 'push.unsubscribe' });
     return reply.send({ ok: true });
   });
 

packages/server/src/routes/repos.ts

@@ -1,6 +1,8 @@
 import type { FastifyInstance, FastifyReply } from 'fastify';
-import type { CreateRepoRequest, RepoResponse, ReposListResponse, UpdateRepoRequest } from '@arboretum/shared';
+import type { CreateRepoRequest, DiscoverReposResponse, RepoResponse, ReposListResponse, UpdateRepoRequest } from '@arboretum/shared';
 import type { WorktreeManager } from '../core/worktree-manager.js';
+import type { Db } from '../db/index.js';
+import { readScanRoots } from '../core/scan-settings.js';
 
 /** Mappe une erreur du manager (statusCode + code) vers une réponse REST normalisée. */
 export function sendManagerError(reply: FastifyReply, err: unknown): FastifyReply {
@@ -8,9 +10,19 @@ export function sendManagerError(reply: FastifyReply, err: unknown): FastifyRepl
   return reply.status(e.statusCode ?? 500).send({ error: { code: e.code ?? 'INTERNAL', message: e.message ?? 'Internal error' } });
 }
 
-export function registerRepoRoutes(app: FastifyInstance, wt: WorktreeManager): void {
+export function registerRepoRoutes(app: FastifyInstance, wt: WorktreeManager, db: Db): void {
   app.get('/api/v1/repos', async (): Promise<ReposListResponse> => ({ repos: await wt.listRepos() }));
 
+  // Scan manuel : découvre et auto-enregistre les repos sous les racines configurées (settings).
+  app.post('/api/v1/repos/discover', async (_req, reply) => {
+    try {
+      const res: DiscoverReposResponse = await wt.discoverRepos({ roots: readScanRoots(db) });
+      return reply.send(res);
+    } catch (err) {
+      return sendManagerError(reply, err);
+    }
+  });
+
   app.post('/api/v1/repos', async (req, reply) => {
     const body = req.body as Partial<CreateRepoRequest> | null;
     if (!body || typeof body.path !== 'string') {
@@ -38,6 +50,7 @@ export function registerRepoRoutes(app: FastifyInstance, wt: WorktreeManager): v
         ...(body.label !== undefined ? { label: body.label } : {}),
         ...(body.postCreateHooks !== undefined ? { postCreateHooks: body.postCreateHooks } : {}),
         ...(body.preTrust !== undefined ? { preTrust: body.preTrust } : {}),
+        ...(typeof body.hidden === 'boolean' ? { hidden: body.hidden } : {}),
       });
       const res: RepoResponse = { repo };
       return reply.send(res);

packages/server/src/routes/settings.ts

@@ -0,0 +1,69 @@
+// Réglages exposés à l'UI (onglet Réglages). Frontière de sécurité CENTRALE : la table `settings`
+// contient aussi des SECRETS (server_secret, vapid_private). Ces routes n'exposent QUE des champs
+// non sensibles et n'écrivent QUE des clés explicitement allow-listées — jamais les secrets.
+import type { FastifyInstance } from 'fastify';
+import type { ServerInfo, SettingsResponse, UpdateSettingsRequest } from '@arboretum/shared';
+import type { Config } from '../config.js';
+import { type Db, setSetting } from '../db/index.js';
+import type { PushService } from '../core/push-service.js';
+import { recordAudit } from '../core/audit-log.js';
+import {
+  SCAN_INTERVAL_KEY,
+  SCAN_ROOTS_KEY,
+  normalizeScanIntervalMin,
+  normalizeScanRoots,
+  readScanIntervalMin,
+  readScanRoots,
+} from '../core/scan-settings.js';
+
+// Réglages modifiables via l'API (allow-list stricte). Les secrets ne figurent JAMAIS ici.
+export function registerSettingsRoutes(
+  app: FastifyInstance,
+  db: Db,
+  config: Config,
+  serverVersion: string,
+  push: PushService,
+): void {
+  const serverInfo = (): ServerInfo => ({
+    version: serverVersion,
+    port: config.port,
+    bind: config.bind,
+    allowedOrigins: config.allowedOrigins,
+    dataDir: config.dataDir,
+    vapidPublicKey: push.publicKey() || null,
+    vapidContact: config.vapidContact,
+  });
+  const snapshot = (): SettingsResponse => ({
+    settings: {
+      scanRoots: readScanRoots(db),
+      scanIntervalMin: readScanIntervalMin(db),
+    },
+    server: serverInfo(),
+  });
+
+  app.get('/api/v1/settings', async (): Promise<SettingsResponse> => snapshot());
+
+  app.patch('/api/v1/settings', async (req, reply) => {
+    const body = (req.body as Partial<UpdateSettingsRequest> | null) ?? {};
+    if ('scanRoots' in body) {
+      const roots = normalizeScanRoots(body.scanRoots);
+      if (!roots) {
+        return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'scanRoots must be an array of ≤16 absolute, normalized paths (never "/")' } });
+      }
+      setSetting(db, SCAN_ROOTS_KEY, JSON.stringify(roots));
+    }
+    if ('scanIntervalMin' in body) {
+      const interval = normalizeScanIntervalMin(body.scanIntervalMin);
+      if (interval === null) {
+        return reply.status(400).send({ error: { code: 'BAD_REQUEST', message: 'scanIntervalMin must be an integer between 0 and 1440' } });
+      }
+      setSetting(db, SCAN_INTERVAL_KEY, String(interval));
+    }
+    recordAudit(db, {
+      actor: req.authContext?.tokenId ?? 'unknown',
+      action: 'settings.update',
+      details: { keys: Object.keys(body) },
+    });
+    return reply.send(snapshot());
+  });
+}

packages/server/test/app.e2e.test.ts

@@ -7,6 +7,7 @@ import { openDb, type Db } from '../src/db/index.js';
 import { munge } from '../src/core/jsonl-discovery.js';
 import { readProcStart } from '../src/core/session-registry.js';
 import type { Config } from '../src/config.js';
+import type { DiscoverReposResponse, RepoResponse, ReposListResponse } from '@arboretum/shared';
 
 // resolveClaudeBin() fait `which claude` : on le stub pour ne pas dépendre d'un claude réel en PATH.
 vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
@@ -127,7 +128,8 @@ describe('app e2e — auth, origin et sessions', () => {
       cookies: { arb_session: cookieValue },
     });
     expect(me.statusCode).toBe(200);
-    expect(me.json()).toEqual({ ok: true, tokenLabel: 'initial', serverVersion: '0.0.0-test' });
+    expect(me.json()).toMatchObject({ ok: true, tokenLabel: 'initial', serverVersion: '0.0.0-test' });
+    expect(typeof (me.json() as { tokenId: string }).tokenId).toBe('string');
   });
 
   it('cookie altéré → 401', async () => {
@@ -353,3 +355,59 @@ describe('app e2e — découverte, resume & fork (P2)', () => {
     expect(fork.statusCode).toBe(201);
   });
 });
+
+describe('app e2e — découverte auto des repos & masquage', () => {
+  let t: TestApp;
+  let scanRoot: string;
+  const bearer = (): Record<string, string> => ({ authorization: `Bearer ${t.token}` });
+
+  beforeAll(() => {
+    t = makeApp('repos-discover');
+    // un « repo » côté scanner = un dossier avec .git (le scanner ne lance pas git).
+    scanRoot = join(dir, 'scan-root');
+    mkdirSync(join(scanRoot, 'alpha', '.git'), { recursive: true });
+    mkdirSync(join(scanRoot, 'beta', '.git'), { recursive: true });
+  });
+
+  it('POST /repos/discover enregistre les repos sous les racines configurées', async () => {
+    // configure la racine de scan via l'allow-list settings, désactive le périodique
+    const patch = await t.bundle.app.inject({
+      method: 'PATCH',
+      url: '/api/v1/settings',
+      headers: bearer(),
+      payload: { scanRoots: [scanRoot], scanIntervalMin: 0 },
+    });
+    expect(patch.statusCode).toBe(200);
+
+    const disc = await t.bundle.app.inject({ method: 'POST', url: '/api/v1/repos/discover', headers: bearer() });
+    expect(disc.statusCode).toBe(200);
+    const body = disc.json() as DiscoverReposResponse;
+    expect(body.added).toBe(2);
+    expect(body.scanned).toBe(2);
+
+    const list = await t.bundle.app.inject({ method: 'GET', url: '/api/v1/repos', headers: bearer() });
+    const repos = (list.json() as ReposListResponse).repos;
+    expect(repos.map((r) => r.label).sort()).toEqual(['alpha', 'beta']);
+    expect(repos.every((r) => r.hidden === false)).toBe(true);
+
+    // re-scan : idempotent (aucun nouveau)
+    const disc2 = await t.bundle.app.inject({ method: 'POST', url: '/api/v1/repos/discover', headers: bearer() });
+    expect((disc2.json() as DiscoverReposResponse).added).toBe(0);
+  });
+
+  it('PATCH /repos/:id { hidden } masque le repo', async () => {
+    const list = await t.bundle.app.inject({ method: 'GET', url: '/api/v1/repos', headers: bearer() });
+    const repo = (list.json() as ReposListResponse).repos[0];
+    const patch = await t.bundle.app.inject({
+      method: 'PATCH',
+      url: `/api/v1/repos/${repo.id}`,
+      headers: bearer(),
+      payload: { hidden: true },
+    });
+    expect(patch.statusCode).toBe(200);
+    expect((patch.json() as RepoResponse).repo.hidden).toBe(true);
+    // toujours listé (les masqués restent récupérables) mais avec hidden=true
+    const after = await t.bundle.app.inject({ method: 'GET', url: '/api/v1/repos', headers: bearer() });
+    expect((after.json() as ReposListResponse).repos.find((r) => r.id === repo.id)?.hidden).toBe(true);
+  });
+});

packages/server/test/audit-data-routes.test.ts

@@ -0,0 +1,164 @@
+// Lot 5 — sécurité enterprise : en-têtes de sécurité, journal d'audit, RGPD (export/suppression),
+// garde Content-Type. Vérifie le câblage de bout en bout via buildApp + token bootstrap.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { buildApp, type AppBundle } from '../src/app.js';
+import { openDb, type Db } from '../src/db/index.js';
+import type { Config } from '../src/config.js';
+import type { AuditLogsResponse, DataExportResponse, DeleteMyDataResponse } from '@arboretum/shared';
+
+vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
+vi.mock('@homebridge/node-pty-prebuilt-multiarch', () => {
+  class FakePty {
+    pid = 424242;
+    write = vi.fn();
+    resize = vi.fn();
+    pause = vi.fn();
+    resume = vi.fn();
+    kill = vi.fn();
+    onData(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+    onExit(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+  }
+  return { default: { spawn: (): FakePty => new FakePty() } };
+});
+
+process.env.ARBORETUM_LOG = 'silent';
+
+let dir: string;
+let bundle: AppBundle;
+let db: Db;
+let token: string;
+const auth = (): { authorization: string } => ({ authorization: `Bearer ${token}` });
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'arboretum-audit-'));
+  const dbPath = join(dir, 'audit.db');
+  db = openDb(dbPath);
+  const config: Config = {
+    port: 9998,
+    bind: '127.0.0.1',
+    dbPath,
+    dataDir: dir,
+    allowedOrigins: ['https://host.tailnet.ts.net'],
+    printToken: false,
+    claudeProjectsDir: join(dir, 'claude', 'projects'),
+    claudeSessionsDir: join(dir, 'claude', 'sessions'),
+    vapidContact: 'mailto:test@localhost',
+    autoDiscover: false,
+  };
+  bundle = buildApp(config, db, '1.2.3-test');
+  const t = bundle.auth.ensureBootstrapToken();
+  if (!t) throw new Error('bootstrap token attendu');
+  token = t;
+});
+
+afterAll(async () => {
+  await bundle.app.close();
+  db.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('En-têtes de sécurité', () => {
+  it('pose les en-têtes durs + no-store sur /api, sans header Server', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    expect(res.headers['x-content-type-options']).toBe('nosniff');
+    expect(res.headers['x-frame-options']).toBe('DENY');
+    expect(res.headers['referrer-policy']).toBe('no-referrer');
+    expect(res.headers['content-security-policy']).toContain("default-src 'self'");
+    expect(res.headers['content-security-policy']).toContain("frame-ancestors 'none'");
+    expect(String(res.headers['cache-control'])).toContain('no-store');
+    expect(res.headers['server']).toBeUndefined();
+  });
+
+  it('pose HSTS uniquement derrière HTTPS (x-forwarded-proto)', async () => {
+    const http = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth() });
+    expect(http.headers['strict-transport-security']).toBeUndefined();
+    const https = await bundle.app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+      headers: { ...auth(), 'x-forwarded-proto': 'https' },
+    });
+    expect(String(https.headers['strict-transport-security'])).toContain('max-age=');
+  });
+
+  it('rejette une mutation avec corps non-JSON (415)', async () => {
+    const res = await bundle.app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/tokens',
+      headers: { ...auth(), 'content-type': 'text/plain' },
+      payload: 'label=pwned',
+    });
+    expect(res.statusCode).toBe(415);
+  });
+});
+
+describe('Journal d’audit', () => {
+  it('journalise la création de token et l’expose via GET /audit-logs', async () => {
+    const create = await bundle.app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/tokens',
+      headers: auth(),
+      payload: { label: 'ci-extra' },
+    });
+    expect(create.statusCode).toBe(201);
+
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/audit-logs', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as AuditLogsResponse;
+    const actions = body.entries.map((e) => e.action);
+    expect(actions).toContain('token.create');
+    expect(actions).toContain('secret.generate'); // généré au bootstrap (system)
+    // aucune VALEUR secrète en clair : pas de chaîne hex de 64 caractères (server_secret / clé).
+    // (les ids sont des UUID avec tirets → non concernés ; 'server_secret' est un nom de ressource.)
+    expect(res.body).not.toMatch(/[a-f0-9]{64}/i);
+  });
+
+  it('journalise les échecs de login (actor anonymous)', async () => {
+    await bundle.app.inject({ method: 'POST', url: '/api/v1/auth/login', payload: { token: 'arb_invalid_xxx' } });
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/audit-logs?limit=200', headers: auth() });
+    const body = res.json() as AuditLogsResponse;
+    expect(body.entries.some((e) => e.action === 'login.failure' && e.actor === 'anonymous')).toBe(true);
+  });
+});
+
+describe('RGPD', () => {
+  it('exporte les données du token authentifié', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/data/export', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as DataExportResponse;
+    expect(Array.isArray(body.tokens)).toBe(true);
+    expect(body.tokens.some((t) => t.current)).toBe(true);
+    expect(Array.isArray(body.pushSubscriptions)).toBe(true);
+    expect(Array.isArray(body.sessions)).toBe(true);
+    expect(body.settings).toHaveProperty('scanRoots');
+  });
+
+  it('supprime en deux temps (pending → confirm → done) et révoque le token', async () => {
+    const pending = await bundle.app.inject({ method: 'POST', url: '/api/v1/data/delete-my-data', headers: auth(), payload: {} });
+    const p = pending.json() as DeleteMyDataResponse;
+    expect(p.status).toBe('pending');
+    expect(p.confirm).toBeTruthy();
+
+    // un 2e token existe (créé plus haut) → révoquer le token courant est autorisé.
+    const done = await bundle.app.inject({
+      method: 'POST',
+      url: '/api/v1/data/delete-my-data',
+      headers: auth(),
+      payload: { confirm: p.confirm },
+    });
+    const d = done.json() as DeleteMyDataResponse;
+    expect(d.status).toBe('done');
+    expect(d.summary.tokenRevoked).toBe(true);
+
+    // le token courant est désormais révoqué → 401.
+    const after = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth() });
+    expect(after.statusCode).toBe(401);
+  });
+});

packages/server/test/auth-tokens.test.ts

@@ -0,0 +1,143 @@
+// Gestion des tokens d'accès via l'API REST (onglet Réglages) : create → list → revoke,
+// flag « courant », jamais de hash exposé, garde anti lock-out sur le dernier token.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { buildApp, type AppBundle } from '../src/app.js';
+import { openDb, type Db } from '../src/db/index.js';
+import type { Config } from '../src/config.js';
+import type { CreateTokenResponse, MeResponse, TokensListResponse } from '@arboretum/shared';
+
+// Mêmes stubs que les autres tests de routes : pas de vrai claude ni de vrai PTY.
+vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
+vi.mock('@homebridge/node-pty-prebuilt-multiarch', () => {
+  class FakePty {
+    pid = 424242;
+    write = vi.fn();
+    resize = vi.fn();
+    pause = vi.fn();
+    resume = vi.fn();
+    kill = vi.fn();
+    onData(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+    onExit(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+  }
+  return { default: { spawn: (): FakePty => new FakePty() } };
+});
+
+process.env.ARBORETUM_LOG = 'silent';
+
+let dir: string;
+let bundle: AppBundle;
+let db: Db;
+let token: string;
+
+const auth = (): { authorization: string } => ({ authorization: `Bearer ${token}` });
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'arboretum-tokens-'));
+  const dbPath = join(dir, 'tokens.db');
+  db = openDb(dbPath);
+  const config: Config = {
+    port: 7317,
+    bind: '127.0.0.1',
+    dbPath,
+    dataDir: dir,
+    allowedOrigins: [],
+    printToken: false,
+    claudeProjectsDir: join(dir, 'claude', 'projects'),
+    claudeSessionsDir: join(dir, 'claude', 'sessions'),
+    vapidContact: 'mailto:test@localhost',
+  };
+  bundle = buildApp(config, db, '0.0.0-test');
+  const t = bundle.auth.ensureBootstrapToken();
+  if (!t) throw new Error('bootstrap token attendu sur une base vierge');
+  token = t;
+});
+
+afterAll(async () => {
+  await bundle.app.close();
+  db.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('routes de gestion des tokens', () => {
+  it('GET /auth/me expose le tokenId courant', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/me', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    const me = res.json() as MeResponse;
+    expect(typeof me.tokenId).toBe('string');
+    expect(me.tokenId.length).toBeGreaterThan(0);
+  });
+
+  it('liste le token initial et le marque « courant », sans jamais exposer de hash', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/tokens', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as TokensListResponse;
+    expect(body.tokens).toHaveLength(1);
+    expect(body.tokens[0]?.label).toBe('initial');
+    expect(body.tokens[0]?.current).toBe(true);
+    // aucune fuite de hash / valeur en clair
+    expect(JSON.stringify(body)).not.toMatch(/token_hash|tokenHash/);
+  });
+
+  it('crée un token (valeur en clair renvoyée une fois), puis utilisable pour s’authentifier', async () => {
+    const res = await bundle.app.inject({
+      method: 'POST',
+      url: '/api/v1/auth/tokens',
+      headers: auth(),
+      payload: { label: 'laptop' },
+    });
+    expect(res.statusCode).toBe(201);
+    const created = res.json() as CreateTokenResponse;
+    expect(created.label).toBe('laptop');
+    expect(created.token).toMatch(/^arb_[0-9a-f]{48}$/);
+
+    // le nouveau token authentifie réellement
+    const me = await bundle.app.inject({
+      method: 'GET',
+      url: '/api/v1/auth/me',
+      headers: { authorization: `Bearer ${created.token}` },
+    });
+    expect((me.json() as MeResponse).tokenLabel).toBe('laptop');
+  });
+
+  it('rejette un label vide ou trop long (400)', async () => {
+    const empty = await bundle.app.inject({ method: 'POST', url: '/api/v1/auth/tokens', headers: auth(), payload: { label: '  ' } });
+    expect(empty.statusCode).toBe(400);
+    const tooLong = await bundle.app.inject({ method: 'POST', url: '/api/v1/auth/tokens', headers: auth(), payload: { label: 'x'.repeat(65) } });
+    expect(tooLong.statusCode).toBe(400);
+  });
+
+  it('révoque un token non courant (204), qui disparaît de la liste et n’authentifie plus', async () => {
+    const before = (await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/tokens', headers: auth() })).json() as TokensListResponse;
+    const victim = before.tokens.find((t) => !t.current);
+    expect(victim).toBeDefined();
+    const del = await bundle.app.inject({ method: 'DELETE', url: `/api/v1/auth/tokens/${victim!.id}`, headers: auth() });
+    expect(del.statusCode).toBe(200);
+    const after = (await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/tokens', headers: auth() })).json() as TokensListResponse;
+    expect(after.tokens.find((t) => t.id === victim!.id)).toBeUndefined();
+  });
+
+  it('404 sur un id inconnu', async () => {
+    const res = await bundle.app.inject({ method: 'DELETE', url: '/api/v1/auth/tokens/nope-xyz', headers: auth() });
+    expect(res.statusCode).toBe(404);
+  });
+
+  it('409 LAST_TOKEN : refuse de révoquer le dernier token actif', async () => {
+    const list = (await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/tokens', headers: auth() })).json() as TokensListResponse;
+    expect(list.tokens).toHaveLength(1); // seul le token courant subsiste
+    const res = await bundle.app.inject({ method: 'DELETE', url: `/api/v1/auth/tokens/${list.tokens[0]!.id}`, headers: auth() });
+    expect(res.statusCode).toBe(409);
+    expect(res.json()).toMatchObject({ error: { code: 'LAST_TOKEN' } });
+  });
+
+  it('sans authentification → 401', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/auth/tokens' });
+    expect(res.statusCode).toBe(401);
+  });
+});

packages/server/test/fixtures/dialogs/ask2.raw

@@ -19,7 +19,7 @@
 ClaudeCode'llbeabletoread,edit,andexecutefileshere.
 
 
-
+
 ]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;
 
 
@@ -321,13 +321,13 @@
 [?25h[?2026l[?2026h[?25l
 Simrin(2s · thinking with xhigh effort)
 
-
+
 
 
 
 
 [?25h[?2026l[?2026h[?25l
-thinking with xhigh effort
+thinking with xhigh effort
 
 
 
@@ -343,7 +343,7 @@
 
 
 [?25h[?2026l[?2026h[?25l
-thinking with xhigh effort
+thinking with xhigh effort
 
 
 
@@ -359,7 +359,7 @@
 
 
 [?25h[?2026l[?2026h[?25l
-57thinking with xhigh effort
+57thinking with xhigh effort
 
 
 
@@ -566,7 +566,7 @@
 
 esctointerruptYou'veused96%ofyoursessionlimit·resets7pm(America/Lima)·/usage-creditstorequestmore
 
-[?25h[?2026l[?2026h[?25l
+[?25h[?2026l[?2026h[?25l
 nn
-
+
 

packages/server/test/fixtures/dialogs/deny-esc2.raw

@@ -19,7 +19,7 @@
 ClaudeCode'llbeabletoread,edit,andexecutefileshere.
 
 
-
+
 ]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;
 
 
@@ -475,7 +475,7 @@
 4thought for 1s)
 
 
-
+
 
 
 

packages/server/test/fixtures/dialogs/perm-bash2.raw

@@ -19,7 +19,7 @@
 ClaudeCode'llbeabletoread,edit,andexecutefileshere.
 
 
-
+
 ]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;
 
 

packages/server/test/fixtures/dialogs/perm-write2.raw

@@ -19,7 +19,7 @@
 ClaudeCode'llbeabletoread,edit,andexecutefileshere.
 
 
-
+
 ]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;
 
 
@@ -218,13 +218,13 @@
 
 
 
-[?25h[?2026l[?2026h[?25l
+[?25h[?2026l[?2026h[?25l
 ✻
 
 
 
 
-
+
 
 [?25h[?2026l[?2026h[?25l
 ✽
@@ -242,7 +242,7 @@
 
 
 
-[?25h[?2026l[?2026h[?25l
+[?25h[?2026l[?2026h[?25l
 (1s · thinking with xhigh effort)
 
 
@@ -251,7 +251,7 @@
 
 
 [?25h[?2026l[?2026h[?25l
-on2thinking with xhigh effort
+on2thinking with xhigh effort
 
 
 
@@ -416,7 +416,7 @@
 ❯ 
 
 ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
-
+
 esctointerruptYou'veused91%ofyoursessionlimit·resets7pm(America/Lima)·/usage-creditstorequestmore
 
 [?25h[?2026l[?2026h[?25l
@@ -430,16 +430,16 @@
 [?25h[?2026l[?2026h[?25l
 *ng
 
-
+
 
 
-
+
 
 [?25h[?2026l[?2026h[?25l
 …
 
 
-
+
 
 
 

packages/server/test/fixtures/dialogs/trust.raw

@@ -19,7 +19,7 @@
 ClaudeCode'llbeabletoread,edit,andexecutefileshere.
 
 
-
+
 ]8;id=zaxmda;https://code.claude.com/docs/en/securitySecurity guide]8;;
 
 

packages/server/test/jsonl-discovery.test.ts

@@ -13,7 +13,7 @@ function writeJsonl(projectsDir: string, cwd: string, sid: string, lines: object
 describe('munge', () => {
   it('reproduit le nom de dossier ~/.claude/projects', () => {
     expect(munge('/home/x/My Project!')).toBe('-home-x-My-Project-');
-    expect(munge('/home/johan/WebstormProjects/arboretum')).toBe('-home-johan-WebstormProjects-arboretum');
+    expect(munge('/home/user/projects/demo')).toBe('-home-user-projects-demo');
   });
 });
 

packages/server/test/repo-scanner.test.ts

@@ -0,0 +1,104 @@
+import { describe, expect, it, afterEach } from 'vitest';
+import { mkdtempSync, mkdirSync, rmSync, symlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { scanForRepos } from '../src/core/repo-scanner.js';
+
+const dirs: string[] = [];
+afterEach(() => {
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
+});
+
+function tmpRoot(): string {
+  const d = mkdtempSync(join(tmpdir(), 'arb-scan-'));
+  dirs.push(d);
+  return d;
+}
+// un « repo » pour le scanner = un dossier contenant `.git` (le scanner ne lance jamais git).
+function makeRepo(...segs: string[]): void {
+  mkdirSync(join(...segs, '.git'), { recursive: true });
+}
+
+const limits = { maxDepth: 6, maxRepos: 2000 };
+
+describe('scanForRepos', () => {
+  it('trouve un repo simple', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'proj');
+    const { paths, truncated } = await scanForRepos([root], limits);
+    expect(paths).toEqual([join(root, 'proj')]);
+    expect(truncated).toBe(false);
+  });
+
+  it('ne descend pas dans un repo trouvé (sous-repo ignoré)', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'a');
+    makeRepo(root, 'a', 'sub'); // imbriqué : doit être ignoré
+    const { paths } = await scanForRepos([root], limits);
+    expect(paths).toEqual([join(root, 'a')]);
+  });
+
+  it('descend dans une racine qui est elle-même un repo (workspace + sous-repos)', async () => {
+    const root = tmpRoot();
+    makeRepo(root); // la racine fournie contient elle-même un .git (cas WebstormProjects)
+    makeRepo(root, 'a');
+    makeRepo(root, 'b');
+    const { paths } = await scanForRepos([root], limits);
+    // la racine ET ses dépôts internes sont découverts (la racine n'arrête pas le scan)
+    expect([...paths].sort()).toEqual([root, join(root, 'a'), join(root, 'b')].sort());
+  });
+
+  it('ignore node_modules et les dotdirs', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'node_modules', 'pkg');
+    makeRepo(root, '.hidden', 'x');
+    makeRepo(root, 'real');
+    const { paths } = await scanForRepos([root], limits);
+    expect(paths).toEqual([join(root, 'real')]);
+  });
+
+  it('respecte maxDepth', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'a', 'b', 'c', 'deep'); // repo à profondeur 4
+    const shallow = await scanForRepos([root], { maxDepth: 2, maxRepos: 2000 });
+    expect(shallow.paths).toEqual([]);
+    const deep = await scanForRepos([root], { maxDepth: 4, maxRepos: 2000 });
+    expect(deep.paths).toEqual([join(root, 'a', 'b', 'c', 'deep')]);
+  });
+
+  it('ne suit pas les symlinks (cycle terminé, pas de doublon)', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'proj');
+    try {
+      symlinkSync(root, join(root, 'loop')); // cycle vers la racine
+    } catch {
+      /* symlink non autorisé sous certains CI : le test reste valide sans le lien */
+    }
+    const { paths } = await scanForRepos([root], limits);
+    expect(paths).toEqual([join(root, 'proj')]);
+  });
+
+  it('tronque à maxRepos', async () => {
+    const root = tmpRoot();
+    makeRepo(root, 'r1');
+    makeRepo(root, 'r2');
+    makeRepo(root, 'r3');
+    const { paths, truncated } = await scanForRepos([root], { maxDepth: 6, maxRepos: 2 });
+    expect(truncated).toBe(true);
+    expect(paths.length).toBeLessThanOrEqual(2);
+  });
+
+  it('ignore une racine inexistante sans lever', async () => {
+    const { paths } = await scanForRepos(['/nope/does/not/exist'], limits);
+    expect(paths).toEqual([]);
+  });
+
+  it('scanne plusieurs racines', async () => {
+    const r1 = tmpRoot();
+    const r2 = tmpRoot();
+    makeRepo(r1, 'one');
+    makeRepo(r2, 'two');
+    const { paths } = await scanForRepos([r1, r2], limits);
+    expect([...paths].sort()).toEqual([join(r1, 'one'), join(r2, 'two')].sort());
+  });
+});

packages/server/test/secret-box.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest';
+import { randomBytes } from 'node:crypto';
+import { SecretBox } from '../src/core/secret-box.js';
+
+const box = (): SecretBox => new SecretBox(randomBytes(32));
+
+describe('SecretBox', () => {
+  it('chiffre puis déchiffre (round-trip)', () => {
+    const b = box();
+    const secret = 'deadbeef'.repeat(8);
+    const enc = b.encrypt(secret);
+    expect(enc.startsWith('v1:')).toBe(true);
+    expect(enc).not.toContain(secret); // le clair n'apparaît pas
+    expect(b.decrypt(enc)).toBe(secret);
+  });
+
+  it('produit un chiffré différent à chaque fois (IV aléatoire)', () => {
+    const b = box();
+    expect(b.encrypt('x')).not.toBe(b.encrypt('x'));
+  });
+
+  it('retourne tel quel une valeur en clair (legacy) et la détecte', () => {
+    const b = box();
+    expect(b.isEncrypted('plain-secret')).toBe(false);
+    expect(b.decrypt('plain-secret')).toBe('plain-secret');
+    expect(b.isEncrypted(b.encrypt('x'))).toBe(true);
+  });
+
+  it('échoue si la clé ne correspond pas (GCM authentifié)', () => {
+    const enc = box().encrypt('secret');
+    expect(() => box().decrypt(enc)).toThrow();
+  });
+
+  it('échoue sur un format chiffré corrompu', () => {
+    expect(() => box().decrypt('v1:zzz')).toThrow();
+  });
+});

packages/server/test/settings-routes.test.ts

@@ -0,0 +1,139 @@
+// Routes Réglages : GET expose la config non sensible (jamais les secrets), PATCH n'écrit que
+// l'allow-list (découverte des dépôts) et ignore toute clé hors allow-list.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import { buildApp, type AppBundle } from '../src/app.js';
+import { getSetting, openDb, type Db } from '../src/db/index.js';
+import type { Config } from '../src/config.js';
+import type { SettingsResponse } from '@arboretum/shared';
+
+vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
+vi.mock('@homebridge/node-pty-prebuilt-multiarch', () => {
+  class FakePty {
+    pid = 424242;
+    write = vi.fn();
+    resize = vi.fn();
+    pause = vi.fn();
+    resume = vi.fn();
+    kill = vi.fn();
+    onData(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+    onExit(): { dispose: () => void } {
+      return { dispose: () => {} };
+    }
+  }
+  return { default: { spawn: (): FakePty => new FakePty() } };
+});
+
+process.env.ARBORETUM_LOG = 'silent';
+
+let dir: string;
+let bundle: AppBundle;
+let db: Db;
+let token: string;
+
+const auth = (): { authorization: string } => ({ authorization: `Bearer ${token}` });
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'arboretum-settings-'));
+  const dbPath = join(dir, 'settings.db');
+  db = openDb(dbPath);
+  const config: Config = {
+    port: 9999,
+    bind: '127.0.0.1',
+    dbPath,
+    dataDir: dir,
+    allowedOrigins: ['https://host.tailnet.ts.net'],
+    printToken: false,
+    claudeProjectsDir: join(dir, 'claude', 'projects'),
+    claudeSessionsDir: join(dir, 'claude', 'sessions'),
+    vapidContact: 'mailto:test@localhost',
+  };
+  bundle = buildApp(config, db, '1.2.3-test');
+  const t = bundle.auth.ensureBootstrapToken();
+  if (!t) throw new Error('bootstrap token attendu');
+  token = t;
+});
+
+afterAll(async () => {
+  await bundle.app.close();
+  db.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('GET /api/v1/settings', () => {
+  it('renvoie la config serveur non sensible et aucune racine de scan par défaut', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/settings', headers: auth() });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as SettingsResponse;
+    expect(body.server.version).toBe('1.2.3-test');
+    expect(body.server.port).toBe(9999);
+    expect(body.server.bind).toBe('127.0.0.1');
+    expect(body.server.allowedOrigins).toEqual(['https://host.tailnet.ts.net']);
+    expect(body.server.vapidPublicKey).toBeTruthy(); // clé publique = sûre à exposer
+    // défauts de découverte : AUCUNE racine (clean install → pas de scan) + intervalle 5 min
+    expect(body.settings.scanRoots).toEqual([]);
+    expect(body.settings.scanIntervalMin).toBe(5);
+  });
+
+  it('n’expose AUCUN secret (server_secret, clé privée VAPID)', async () => {
+    const res = await bundle.app.inject({ method: 'GET', url: '/api/v1/settings', headers: auth() });
+    const raw = res.body;
+    const secret = getSetting(db, 'server_secret');
+    const vapidPrivate = getSetting(db, 'vapid_private');
+    expect(secret).toBeTruthy();
+    expect(raw).not.toContain(secret as string);
+    expect(raw).not.toContain(vapidPrivate as string);
+    expect(raw).not.toMatch(/server_secret|vapid_private|privateKey/);
+  });
+});
+
+describe('PATCH /api/v1/settings — sécurité', () => {
+  it('ignore toute clé hors allow-list (ne touche pas aux secrets)', async () => {
+    const before = getSetting(db, 'server_secret');
+    await bundle.app.inject({ method: 'PATCH', url: '/api/v1/settings', headers: auth(), payload: { server_secret: 'pwned', vapid_private: 'pwned' } });
+    expect(getSetting(db, 'server_secret')).toBe(before); // inchangé
+    expect(getSetting(db, 'vapid_private')).not.toBe('pwned');
+  });
+
+  it('sans authentification → 401', async () => {
+    const res = await bundle.app.inject({ method: 'PATCH', url: '/api/v1/settings', payload: { scanRoots: ['/home/u/work'] } });
+    expect(res.statusCode).toBe(401);
+  });
+});
+
+describe('PATCH /api/v1/settings — découverte des dépôts', () => {
+  it('enregistre des scanRoots et un intervalle valides et les renvoie', async () => {
+    const res = await bundle.app.inject({
+      method: 'PATCH',
+      url: '/api/v1/settings',
+      headers: auth(),
+      payload: { scanRoots: ['/home/u/work', '/srv/code'], scanIntervalMin: 10 },
+    });
+    expect(res.statusCode).toBe(200);
+    const body = res.json() as SettingsResponse;
+    expect(body.settings.scanRoots).toEqual(['/home/u/work', '/srv/code']);
+    expect(body.settings.scanIntervalMin).toBe(10);
+    // persisté
+    const get = await bundle.app.inject({ method: 'GET', url: '/api/v1/settings', headers: auth() });
+    expect((get.json() as SettingsResponse).settings.scanRoots).toEqual(['/home/u/work', '/srv/code']);
+  });
+
+  it('rejette des racines non absolues, "/", avec ".." ou en surnombre (400)', async () => {
+    const bads: unknown[] = [['relative/path'], ['/'], ['/a/../b'], Array.from({ length: 17 }, (_, i) => `/r${i}`)];
+    for (const scanRoots of bads) {
+      const res = await bundle.app.inject({ method: 'PATCH', url: '/api/v1/settings', headers: auth(), payload: { scanRoots } });
+      expect(res.statusCode).toBe(400);
+    }
+  });
+
+  it('rejette un intervalle hors borne (400)', async () => {
+    const res = await bundle.app.inject({ method: 'PATCH', url: '/api/v1/settings', headers: auth(), payload: { scanIntervalMin: 5000 } });
+    expect(res.statusCode).toBe(400);
+    const neg = await bundle.app.inject({ method: 'PATCH', url: '/api/v1/settings', headers: auth(), payload: { scanIntervalMin: -1 } });
+    expect(neg.statusCode).toBe(400);
+  });
+});

packages/server/test/worktree-manager.test.ts

@@ -1,9 +1,9 @@
 import { describe, expect, it, beforeEach, afterEach, vi } from 'vitest';
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, writeFileSync, rmSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync, existsSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, basename, dirname, resolve } from 'node:path';
-import type { WorktreeSummary } from '@arboretum/shared';
+import type { RepoSummary, WorktreeSummary } from '@arboretum/shared';
 import { WorktreeManager } from '../src/core/worktree-manager.js';
 import { PtyManager } from '../src/core/pty-manager.js';
 import { DiscoveryService } from '../src/core/discovery-service.js';
@@ -34,9 +34,7 @@ afterEach(() => {
   for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true });
 });
 
-function makeTmpRepo(): string {
-  const dir = mkdtempSync(join(tmpdir(), 'arb-wtm-'));
-  dirs.push(dir);
+function gitInit(dir: string): void {
   const run = (...args: string[]): void => void execFileSync('git', args, { cwd: dir, stdio: 'pipe' });
   run('init', '-b', 'main');
   run('config', 'user.email', 'test@arboretum.dev');
@@ -44,9 +42,21 @@ function makeTmpRepo(): string {
   writeFileSync(join(dir, 'README.md'), '# test\n');
   run('add', '-A');
   run('commit', '-m', 'init');
+}
+
+function makeTmpRepo(): string {
+  const dir = mkdtempSync(join(tmpdir(), 'arb-wtm-'));
+  dirs.push(dir);
+  gitInit(dir);
   return dir;
 }
 
+/** Crée un vrai repo git à un chemin donné (sous une racine de scan contrôlée). */
+function makeRepoAt(path: string): void {
+  mkdirSync(path, { recursive: true });
+  gitInit(path);
+}
+
 describe('WorktreeManager', () => {
   let db: Db;
   let pty: PtyManager;
@@ -144,4 +154,79 @@ describe('WorktreeManager', () => {
     pty.spawn({ cwd: wtPath, command: 'bash' });
     await expect(wt.deleteWorktree(r.id, wtPath, false)).rejects.toMatchObject({ statusCode: 409, code: 'SESSION_LIVE_IN_WORKTREE' });
   });
+
+  it('addRepo renvoie hidden:false ; updateRepo({hidden}) bascule et émet repo_update', async () => {
+    const repo = makeTmpRepo();
+    const r = await wt.addRepo({ path: repo });
+    expect(r.hidden).toBe(false);
+    const updates: RepoSummary[] = [];
+    wt.on('repo_update', (s) => updates.push(s));
+    const u = await wt.updateRepo(r.id, { hidden: true });
+    expect(u.hidden).toBe(true);
+    expect(updates.some((s) => s.id === r.id && s.hidden)).toBe(true);
+  });
+
+  it('listAllWorktrees exclut les repos masqués', async () => {
+    const repo = makeTmpRepo();
+    const r = await wt.addRepo({ path: repo });
+    expect((await wt.listAllWorktrees()).length).toBeGreaterThan(0); // main worktree présent
+    await wt.updateRepo(r.id, { hidden: true });
+    expect(await wt.listAllWorktrees()).toHaveLength(0);
+  });
+
+  it('discoverRepos : auto-ajoute les nouveaux, idempotent, masqué non ressuscité, supprimé re-découvrable', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'arb-scan-'));
+    dirs.push(root);
+    makeRepoAt(join(root, 'a'));
+    makeRepoAt(join(root, 'b'));
+
+    const updates: RepoSummary[] = [];
+    wt.on('repo_update', (s) => updates.push(s));
+
+    const res = await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(res.added).toBe(2);
+    expect(res.scanned).toBe(2);
+    expect(await wt.listRepos()).toHaveLength(2);
+    expect(updates).toHaveLength(2); // un repo_update par nouveau
+
+    // re-scan : idempotent (aucun ajout, aucune émission)
+    updates.length = 0;
+    const res2 = await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(res2.added).toBe(0);
+    expect(updates).toHaveLength(0);
+    expect(await wt.listRepos()).toHaveLength(2);
+
+    // masquer 'a' puis re-scan : reste masqué, jamais ré-ajouté (invariant central)
+    const repoA = (await wt.listRepos()).find((r) => resolve(r.path) === resolve(join(root, 'a')));
+    await wt.updateRepo(repoA!.id, { hidden: true });
+    updates.length = 0;
+    const res3 = await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(res3.added).toBe(0);
+    expect((await wt.listRepos()).find((r) => r.id === repoA!.id)?.hidden).toBe(true);
+
+    // supprimer 'b' puis re-scan : re-découvert (volontaire)
+    const repoB = (await wt.listRepos()).find((r) => resolve(r.path) === resolve(join(root, 'b')));
+    wt.removeRepo(repoB!.id);
+    expect(await wt.listRepos()).toHaveLength(1);
+    const res4 = await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(res4.added).toBe(1);
+    expect(await wt.listRepos()).toHaveLength(2);
+  });
+
+  it('discoverRepos : repo disparu du disque conservé en DB (valid=false), non re-trouvé', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'arb-scan-'));
+    dirs.push(root);
+    makeRepoAt(join(root, 'gone'));
+    await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(await wt.listRepos()).toHaveLength(1);
+
+    rmSync(join(root, 'gone'), { recursive: true, force: true }); // disparaît du disque
+    const res = await wt.discoverRepos({ roots: [root], maxDepth: 2 });
+    expect(res.added).toBe(0); // plus trouvé par le scan
+    const repos = await wt.listRepos();
+    expect(repos).toHaveLength(1); // mais la ligne est conservée (pas de suppression auto)
+    expect(repos[0].valid).toBe(false);
+    // robustesse : un repo dont le chemin a disparu ne fait pas planter /worktrees (git échoue → [])
+    await expect(wt.listAllWorktrees()).resolves.toEqual([]);
+  });
 });

packages/shared/src/api.ts

@@ -14,10 +14,34 @@ export interface LoginResponse {
 }
 export interface MeResponse {
   ok: true;
+  /** id du token de la session courante — sert à marquer « courant » dans la liste des tokens. */
+  tokenId: string;
   tokenLabel: string;
   serverVersion: string;
 }
 
+// ---- Gestion des tokens d'accès (onglet Réglages) ----
+export interface TokenInfo {
+  id: string;
+  label: string;
+  createdAt: string;
+  lastUsedAt: string | null;
+  /** true pour le token de la session courante. */
+  current: boolean;
+}
+export interface TokensListResponse {
+  tokens: TokenInfo[];
+}
+export interface CreateTokenRequest {
+  label: string;
+}
+export interface CreateTokenResponse {
+  id: string;
+  label: string;
+  /** valeur en clair — affichée une seule fois, jamais re-récupérable. */
+  token: string;
+}
+
 export interface CreateSessionRequest {
   cwd: string;
   /** binaire à lancer — défaut "claude" ; "bash" sert aux tests d'acceptation sans quota */
@@ -52,6 +76,19 @@ export interface UpdateRepoRequest {
   label?: string;
   postCreateHooks?: PostCreateHook[];
   preTrust?: boolean;
+  /** true = masquer le repo (exclu du dashboard, conservé en DB) ; false = ré-afficher. */
+  hidden?: boolean;
+}
+
+/** Résultat d'un scan de découverte (POST /api/v1/repos/discover). */
+export interface DiscoverReposResponse {
+  /** dossiers-repos trouvés sur disque. */
+  scanned: number;
+  /** repos réellement insérés (nouveaux, non déjà enregistrés). */
+  added: number;
+  durationMs: number;
+  /** true si la limite (maxRepos / timeout) a été atteinte avant la fin du scan. */
+  truncated: boolean;
 }
 
 export interface WorktreesListResponse {
@@ -146,3 +183,72 @@ export interface PushSubscribeRequest {
 export interface PushUnsubscribeRequest {
   endpoint: string;
 }
+
+// ---- Réglages & info serveur (onglet Réglages) ----
+/** Config runtime non sensible du daemon — lecture seule (changée via flags CLI + redémarrage). */
+export interface ServerInfo {
+  version: string;
+  port: number;
+  bind: string;
+  allowedOrigins: string[];
+  dataDir: string;
+  /** clé publique VAPID (sûre à exposer) ; null si push indisponible. */
+  vapidPublicKey: string | null;
+  vapidContact: string;
+}
+export interface SettingsResponse {
+  /** réglages modifiables à chaud (allow-list serveur — jamais les secrets). */
+  settings: {
+    /** racines absolues scannées pour la découverte auto des repos (défaut : aucune → pas de scan). */
+    scanRoots: string[];
+    /** intervalle du re-scan périodique en minutes ; 0 = périodique désactivé. */
+    scanIntervalMin: number;
+  };
+  server: ServerInfo;
+}
+export interface UpdateSettingsRequest {
+  /** racines absolues à scanner (chemins normalisés, ≤ 16) ; remplace la liste. */
+  scanRoots?: string[];
+  /** intervalle du re-scan périodique en minutes (0–1440 ; 0 désactive). */
+  scanIntervalMin?: number;
+}
+
+// ---- Journal d'audit (conformité entreprise) ----
+export interface AuditLogEntry {
+  id: string;
+  /** horodatage ISO 8601 */
+  ts: string;
+  /** tokenId de l'acteur, 'system' (auto) ou 'anonymous' (avant auth) */
+  actor: string;
+  /** verbe.objet, ex. 'token.create', 'settings.update' */
+  action: string;
+  resourceId: string | null;
+  /** métadonnées non sensibles (jamais de secret) */
+  details: unknown;
+  result: string;
+}
+export interface AuditLogsResponse {
+  entries: AuditLogEntry[];
+  /** curseur de pagination (ts à passer en `before`) ; null si fin de liste. */
+  nextBefore: string | null;
+}
+
+// ---- RGPD : export / suppression des données liées au token authentifié ----
+export interface DataExportResponse {
+  exportedAt: string;
+  tokens: Array<{ id: string; label: string; createdAt: string; lastUsedAt: string | null; current: boolean }>;
+  pushSubscriptions: Array<{ endpoint: string; userAgent: string | null; createdAt: string; lastOkAt: string | null }>;
+  sessions: Array<{ id: string; cwd: string; command: string; title: string | null; createdAt: string; endedAt: string | null; exitCode: number | null }>;
+  settings: { scanRoots: string[]; scanIntervalMin: number };
+}
+export interface DeleteMyDataRequest {
+  /** code de confirmation renvoyé par un premier appel sans `confirm` ; doit être renvoyé pour exécuter. */
+  confirm?: string;
+}
+export interface DeleteMyDataResponse {
+  /** 'pending' = confirmation requise (renvoie `confirm`) ; 'done' = suppression effectuée. */
+  status: 'pending' | 'done';
+  confirm?: string;
+  /** récapitulatif de ce qui sera/a été supprimé. */
+  summary: { pushSubscriptions: number; tokenRevoked: boolean };
+}

packages/shared/src/protocol.ts

@@ -136,6 +136,8 @@ export interface RepoSummary {
   createdAt: string;
   /** false si le chemin n'est plus un repo git accessible. */
   valid: boolean;
+  /** true = masqué du dashboard (conservé en DB → non ré-ajouté au re-scan). */
+  hidden: boolean;
 }
 
 export interface WorktreeGitStatus {

packages/web/src/components/RepoSection.vue

@@ -7,6 +7,13 @@
       <div class="ml-auto flex items-center gap-2">
         <BaseButton size="sm" :icon="Plus" @click="creating = !creating">{{ t('worktrees.new') }}</BaseButton>
         <BaseButton size="sm" :icon="Scissors" :loading="busy" @click="onPrune">{{ t('worktrees.prune') }}</BaseButton>
+        <BaseButton
+          size="sm"
+          icon-only
+          :icon="repo.hidden ? Eye : EyeOff"
+          :aria-label="repo.hidden ? t('repos.show') : t('repos.hide')"
+          @click="onToggleHidden"
+        />
         <BaseButton variant="danger" size="sm" icon-only :icon="Trash2" :aria-label="t('repos.remove')" @click="onRemove" />
       </div>
     </header>
@@ -41,7 +48,7 @@
 <script setup lang="ts">
 import { computed, ref } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { Plus, Scissors, Trash2 } from '@lucide/vue';
+import { Eye, EyeOff, Plus, Scissors, Trash2 } from '@lucide/vue';
 import type { RepoSummary } from '@arboretum/shared';
 import { useWorktreesStore } from '../stores/worktrees';
 import { useWorktreeView } from '../composables/useWorktreeView';
@@ -101,4 +108,12 @@ async function onRemove(): Promise<void> {
     toasts.error(err);
   }
 }
+
+async function onToggleHidden(): Promise<void> {
+  try {
+    await store.setHidden(props.repo.id, !props.repo.hidden);
+  } catch (err) {
+    toasts.error(err);
+  }
+}
 </script>

packages/web/src/components/layout/AppShell.vue

@@ -23,6 +23,7 @@ import { onMounted, onUnmounted } from 'vue';
 import { useSessionsStore } from '../../stores/sessions';
 import { useWorktreesStore } from '../../stores/worktrees';
 import { useGroupsStore } from '../../stores/groups';
+import { useSettingsStore } from '../../stores/settings';
 import AppSidebar from './AppSidebar.vue';
 import MobileTabBar from './MobileTabBar.vue';
 
@@ -31,11 +32,14 @@ defineProps<{ fullbleed?: boolean }>();
 const sessions = useSessionsStore();
 const worktrees = useWorktreesStore();
 const groups = useGroupsStore();
+const settings = useSettingsStore();
 
 onMounted(() => {
   void worktrees.fetchAll();
   void sessions.fetchSessions();
   void groups.fetchGroups();
+  void settings.fetch(); // alimente l'icône de nav Gitea et la vue Réglages
+
   worktrees.startRealtime();
   sessions.startRealtime();
   groups.startRealtime();

packages/web/src/components/layout/AppSidebar.vue

@@ -15,7 +15,7 @@
     </button>
     <nav class="flex flex-1 flex-col gap-1 px-2">
       <NavItem
-        v-for="item in items"
+        v-for="item in primary"
         :key="item.key"
         :to="item.to"
         :icon="item.icon"
@@ -25,6 +25,19 @@
         orientation="row"
       />
     </nav>
+    <nav class="flex flex-col gap-1 px-2 pb-1">
+      <NavItem
+        v-for="item in secondary"
+        :key="item.key"
+        :to="item.to"
+        :href="item.href"
+        :icon="item.icon"
+        :label="item.label"
+        :badge="item.badge"
+        :active="isActive(item.match)"
+        orientation="row"
+      />
+    </nav>
     <div class="border-t border-zinc-800/80 p-3">
       <AppShellFooter />
     </div>
@@ -40,6 +53,6 @@ import NavItem from './NavItem.vue';
 import AppShellFooter from './AppShellFooter.vue';
 
 const { t } = useI18n();
-const { items, isActive } = useNav();
+const { primary, secondary, isActive } = useNav();
 const palette = useCommandPalette();
 </script>

packages/web/src/components/layout/MobileTabBar.vue

@@ -4,7 +4,7 @@
     style="padding-bottom: env(safe-area-inset-bottom)"
   >
     <NavItem
-      v-for="item in items"
+      v-for="item in primary"
       :key="item.key"
       :to="item.to"
       :icon="item.icon"
@@ -17,24 +17,27 @@
     <button
       type="button"
       class="flex flex-1 flex-col items-center gap-0.5 py-2 text-zinc-500 transition-colors hover:text-zinc-300 focus-visible:outline-none"
+      :class="moreActive ? 'text-emerald-400' : ''"
       @click="showMore = true"
     >
-      <Settings :size="20" :stroke-width="1.75" />
-      <span class="text-[10px]">{{ t('nav.settings') }}</span>
+      <Menu :size="20" :stroke-width="1.75" />
+      <span class="text-[10px]">{{ t('nav.more') }}</span>
     </button>
     <MoreSheet v-if="showMore" @close="showMore = false" />
   </nav>
 </template>
 
 <script setup lang="ts">
-import { ref } from 'vue';
+import { computed, ref } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { Settings } from '@lucide/vue';
+import { Menu } from '@lucide/vue';
 import { useNav } from '../../composables/useNav';
 import NavItem from './NavItem.vue';
 import MoreSheet from './MoreSheet.vue';
 
 const { t } = useI18n();
-const { items, isActive } = useNav();
+const { primary, secondary, isActive } = useNav();
 const showMore = ref(false);
+// « More » est actif quand la route courante appartient aux items secondaires (Réglages/Aide).
+const moreActive = computed(() => secondary.value.some((i) => isActive(i.match)));
 </script>

packages/web/src/components/layout/MoreSheet.vue

@@ -7,7 +7,22 @@
         style="padding-bottom: calc(1rem + env(safe-area-inset-bottom))"
       >
         <div class="mx-auto mb-3 h-1 w-10 rounded-full bg-zinc-700" />
-        <AppShellFooter />
+        <nav class="mb-3 flex flex-col gap-1">
+          <NavItem
+            v-for="item in secondary"
+            :key="item.key"
+            :to="item.to"
+            :href="item.href"
+            :icon="item.icon"
+            :label="item.label"
+            :active="isActive(item.match)"
+            orientation="row"
+            @click="emit('close')"
+          />
+        </nav>
+        <div class="border-t border-zinc-800/80 pt-3">
+          <AppShellFooter />
+        </div>
         <BaseButton class="mt-3 w-full" @click="emit('close')">{{ t('common.close') }}</BaseButton>
       </div>
     </div>
@@ -16,9 +31,12 @@
 
 <script setup lang="ts">
 import { useI18n } from 'vue-i18n';
+import { useNav } from '../../composables/useNav';
+import NavItem from './NavItem.vue';
 import AppShellFooter from './AppShellFooter.vue';
 import BaseButton from '../ui/BaseButton.vue';
 
 const { t } = useI18n();
+const { secondary, isActive } = useNav();
 const emit = defineEmits<{ close: [] }>();
 </script>

packages/web/src/components/layout/NavItem.vue

@@ -1,7 +1,12 @@
 <template>
-  <RouterLink
-    :to="to"
-    :aria-current="active ? 'page' : undefined"
+  <!-- RouterLink pour une route interne ; <a target=_blank> pour un lien externe (ex. Gitea). -->
+  <component
+    :is="href ? 'a' : RouterLink"
+    :to="href ? undefined : to"
+    :href="href"
+    :target="href ? '_blank' : undefined"
+    :rel="href ? 'noopener noreferrer' : undefined"
+    :aria-current="!href && active ? 'page' : undefined"
     :class="orientation === 'col' ? colClass : rowClass"
   >
     <span class="relative">
@@ -20,16 +25,19 @@
     >
       {{ badge }}
     </span>
-  </RouterLink>
+  </component>
 </template>
 
 <script setup lang="ts">
 import { computed, type Component } from 'vue';
-import type { RouteLocationRaw } from 'vue-router';
+import { RouterLink, type RouteLocationRaw } from 'vue-router';
 
 const props = withDefaults(
   defineProps<{
-    to: RouteLocationRaw;
+    // `| undefined` requis par exactOptionalPropertyTypes : les items de nav passent `to`/`href`
+    // potentiellement undefined (l'un ou l'autre selon route interne vs lien externe).
+    to?: RouteLocationRaw | undefined;
+    href?: string | undefined;
     icon: Component;
     label: string;
     badge?: number;

packages/web/src/components/settings/ServerRow.vue

@@ -0,0 +1,33 @@
+<template>
+  <!-- Ligne de config serveur en lecture seule : label + valeur (+ flag CLI) + copier. -->
+  <div class="flex flex-wrap items-center gap-x-3 gap-y-0.5 py-2">
+    <dt class="w-40 shrink-0 text-sm text-zinc-400">{{ label }}</dt>
+    <dd class="flex min-w-0 flex-1 items-center gap-2">
+      <span :class="['min-w-0 flex-1 break-all text-sm text-zinc-200', mono ? 'font-mono text-xs' : '']">{{ value }}</span>
+      <span v-if="flag" class="hidden shrink-0 font-mono text-[11px] text-zinc-600 sm:inline" :title="t('settings.flagHint', { flag })">{{ flag }}</span>
+      <BaseButton size="sm" variant="ghost" icon-only :icon="copied ? Check : Copy" :aria-label="t('settings.copy')" @click="copy" />
+    </dd>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { Check, Copy } from '@lucide/vue';
+import BaseButton from '../ui/BaseButton.vue';
+
+const props = defineProps<{ label: string; value: string; flag?: string; mono?: boolean }>();
+const { t } = useI18n();
+
+const copied = ref(false);
+// Auto-contenu : on ne confirme (✓) qu'après la résolution réelle de l'écriture presse-papiers.
+async function copy(): Promise<void> {
+  try {
+    await navigator.clipboard.writeText(props.value);
+    copied.value = true;
+    setTimeout(() => (copied.value = false), 1500);
+  } catch {
+    /* presse-papiers indisponible (http non sécurisé) : silencieux */
+  }
+}
+</script>

packages/web/src/components/ui/GiteaIcon.vue

@@ -0,0 +1,31 @@
+<template>
+  <!-- Lucide n'a pas d'icône Gitea : motif « tasse de thé fumante » (git + tea), trait cohérent
+       avec les icônes Lucide (currentColor, coins arrondis). stroke-width hérité via fallthrough. -->
+  <svg
+    :width="size"
+    :height="size"
+    viewBox="0 0 24 24"
+    fill="none"
+    stroke="currentColor"
+    stroke-width="1.75"
+    stroke-linecap="round"
+    stroke-linejoin="round"
+    aria-hidden="true"
+  >
+    <!-- vapeur = mini-branche git -->
+    <path d="M9 5.5V4" />
+    <path d="M13 5.5V3" />
+    <circle cx="9" cy="3" r="0.6" fill="currentColor" stroke="none" />
+    <circle cx="13" cy="2.5" r="0.6" fill="currentColor" stroke="none" />
+    <!-- tasse -->
+    <path d="M4 8h12v4a5 5 0 0 1-5 5H9a5 5 0 0 1-5-5z" />
+    <!-- anse -->
+    <path d="M16 9h1.5a2.5 2.5 0 0 1 0 5H16" />
+    <!-- soucoupe -->
+    <path d="M5 20h10" />
+  </svg>
+</template>
+
+<script setup lang="ts">
+withDefaults(defineProps<{ size?: number }>(), { size: 18 });
+</script>

packages/web/src/composables/useNav.ts

@@ -1,12 +1,17 @@
 import { computed, type Component } from 'vue';
 import { useRoute, type RouteLocationRaw } from 'vue-router';
 import { useI18n } from 'vue-i18n';
-import { GitBranch, TerminalSquare, Boxes } from '@lucide/vue';
+import { Boxes, Coffee, GitBranch, LifeBuoy, Settings, TerminalSquare } from '@lucide/vue';
 import { useSessionsStore } from '../stores/sessions';
+import GiteaIcon from '../components/ui/GiteaIcon.vue';
+import { BUYMEACOFFEE_URL, REPO_SOURCE_URL } from '../lib/constants';
 
 export interface NavEntry {
   key: string;
-  to: RouteLocationRaw;
+  /** route interne (exclusif avec `href`). */
+  to?: RouteLocationRaw;
+  /** lien externe ouvert dans un nouvel onglet (exclusif avec `to`). */
+  href?: string;
   icon: Component;
   label: string;
   match: string[]; // noms de routes considérés actifs pour cet item
@@ -24,13 +29,22 @@ export function useNav() {
     () => sessions.sessions.filter((s) => s.live && s.activity === 'waiting').length,
   );
 
-  const items = computed<NavEntry[]>(() => [
+  // Onglets principaux : barre du bas mobile + haut de sidebar.
+  const primary = computed<NavEntry[]>(() => [
     { key: 'worktrees', to: { name: 'dashboard' }, icon: GitBranch, label: t('nav.worktrees'), match: ['dashboard'], badge: 0 },
     { key: 'sessions', to: { name: 'sessions' }, icon: TerminalSquare, label: t('nav.sessions'), match: ['sessions', 'session'], badge: waitingCount.value },
     { key: 'groups', to: { name: 'groups' }, icon: Boxes, label: t('nav.groups'), match: ['groups', 'group'], badge: 0 },
   ]);
 
+  // Onglets secondaires : réglages, aide, et lien externe « Code source » (en dur, toujours présent).
+  const secondary = computed<NavEntry[]>(() => [
+    { key: 'settings', to: { name: 'settings' }, icon: Settings, label: t('nav.settings'), match: ['settings'], badge: 0 },
+    { key: 'help', to: { name: 'help' }, icon: LifeBuoy, label: t('nav.help'), match: ['help'], badge: 0 },
+    { key: 'gitea', href: REPO_SOURCE_URL, icon: GiteaIcon, label: t('nav.gitea'), match: [], badge: 0 },
+    { key: 'buymeacoffee', href: BUYMEACOFFEE_URL, icon: Coffee, label: t('nav.buymeacoffee'), match: [], badge: 0 },
+  ]);
+
   const isActive = (match: string[]): boolean => match.includes(String(route.name));
 
-  return { items, isActive, waitingCount };
+  return { primary, secondary, isActive, waitingCount };
 }

packages/web/src/i18n/en.ts

@@ -122,8 +122,13 @@ export default {
     remove: 'Remove',
     pathLabel: 'Repository path',
     pathPlaceholder: '/absolute/path/to/repo',
-    empty: 'No repository registered yet — add one above.',
+    empty: 'No repository registered yet — add one above, or scan for repos.',
     invalid: 'unavailable',
+    scan: 'Scan',
+    scanResult: 'No new repository found | 1 new repository added | {n} new repositories added',
+    hide: 'Hide',
+    show: 'Show',
+    showHidden: 'Show hidden ({n})',
   },
   worktrees: {
     new: 'New worktree',
@@ -174,6 +179,10 @@ export default {
     sessions: 'Sessions',
     groups: 'Groups',
     settings: 'Settings',
+    help: 'Help',
+    more: 'More',
+    gitea: 'Source code',
+    buymeacoffee: 'Buy me a coffee',
     waiting: 'waiting',
   },
   controls: {
@@ -292,4 +301,79 @@ export default {
     count: 'no session waiting | 1 session waiting | {n} sessions waiting',
     empty: 'Nothing waiting',
   },
+  settings: {
+    title: 'Settings',
+    // Préférences
+    preferences: 'Preferences',
+    preferencesHint: 'These apply to this browser only.',
+    language: 'Language',
+    notifications: 'Notifications',
+    notificationsEnabled: 'Enabled — you will be notified when a session needs input.',
+    notificationsDisabled: 'Disabled.',
+    enableNotifications: 'Enable notifications',
+    disableNotifications: 'Disable notifications',
+    testNotification: 'Send a test',
+    testSent: 'Test notification sent',
+    pushUnsupported: 'Push needs HTTPS (e.g. Tailscale Serve); on iOS, install the app to your home screen first.',
+    // Accès & sécurité
+    security: 'Access & security',
+    securityHint: 'Tokens grant full access to this server. Create one per device and revoke any you no longer use.',
+    tokens: 'Access tokens',
+    newTokenLabel: 'Label',
+    newTokenPlaceholder: 'e.g. phone, laptop',
+    createToken: 'Create token',
+    tokenCreated: 'Token created',
+    copyTokenHint: 'Copy this token now — for security it will never be shown again.',
+    copy: 'Copy',
+    copied: 'Copied',
+    current: 'current',
+    created: 'Created {date}',
+    lastUsed: 'last used {date}',
+    neverUsed: 'never used',
+    revoke: 'Revoke',
+    confirmRevoke: 'Confirm revoke',
+    tokenRevoked: 'Token revoked',
+    lastTokenError: 'You cannot revoke the last active token — create another one first.',
+    save: 'Save',
+    saved: 'Saved',
+    // Sécurité & conformité
+    compliance: 'Security & compliance',
+    complianceHint: 'Export or erase the data tied to your token (GDPR), and review the audit log of sensitive operations.',
+    exportData: 'Export my data',
+    refreshAudit: 'Audit log',
+    deleteData: 'Erase my data',
+    deleteConfirm: 'Erase the data tied to your token (push subscriptions) and revoke this token? This cannot be undone.',
+    deleteDone: 'Your data has been erased.',
+    // Découverte des dépôts
+    discovery: 'Repository discovery',
+    discoveryHint: 'Arboretum scans these folders for git repositories and registers them automatically. Hidden repos are kept and never re-added.',
+    scanRoots: 'Scan folders',
+    scanRootsEmpty: 'No folder configured — your home directory is used by default.',
+    addRoot: 'Add folder',
+    removeRoot: 'Remove',
+    scanInterval: 'Re-scan interval (minutes)',
+    scanIntervalHint: '0 disables periodic scanning. Changes apply on the next daemon restart.',
+    // Serveur (lecture seule)
+    server: 'Server',
+    serverHint: 'Set at startup via CLI flags — changing them requires restarting the daemon.',
+    version: 'Version',
+    port: 'Port',
+    bind: 'Bind address',
+    allowedOrigins: 'Allowed origins',
+    dataDir: 'Data directory',
+    vapidPublicKey: 'VAPID public key',
+    vapidContact: 'VAPID contact',
+    none: 'none',
+    flagHint: 'CLI flag: {flag}',
+    // Support
+    support: 'Support',
+    supportHint: 'Arboretum is a free, self-funded side project. If it saves you time, you can support its development.',
+    supportCta: 'Buy me a coffee',
+  },
+  help: {
+    title: 'Help',
+    intro: 'Everything Arboretum can do, and how to use it.',
+    searchPlaceholder: 'Search help…',
+    noMatch: 'No matching topic',
+  },
 };

packages/web/src/i18n/fr.ts

@@ -124,8 +124,13 @@ const fr: typeof en = {
     remove: 'Retirer',
     pathLabel: 'Chemin du dépôt',
     pathPlaceholder: '/chemin/absolu/du/repo',
-    empty: 'Aucun dépôt enregistré — ajoutez-en un ci-dessus.',
+    empty: 'Aucun dépôt enregistré — ajoutez-en un ci-dessus, ou lancez un scan.',
     invalid: 'indisponible',
+    scan: 'Scanner',
+    scanResult: 'Aucun nouveau dépôt trouvé | 1 nouveau dépôt ajouté | {n} nouveaux dépôts ajoutés',
+    hide: 'Masquer',
+    show: 'Afficher',
+    showHidden: 'Afficher les masqués ({n})',
   },
   worktrees: {
     new: 'Nouveau worktree',
@@ -177,6 +182,10 @@ const fr: typeof en = {
     sessions: 'Sessions',
     groups: 'Groupes',
     settings: 'Réglages',
+    help: 'Aide',
+    more: 'Plus',
+    gitea: 'Code source',
+    buymeacoffee: 'Offrez-moi un café',
     waiting: 'en attente',
   },
   controls: {
@@ -295,6 +304,81 @@ const fr: typeof en = {
     count: 'aucune session en attente | 1 session en attente | {n} sessions en attente',
     empty: 'Rien à traiter',
   },
+  settings: {
+    title: 'Réglages',
+    // Préférences
+    preferences: 'Préférences',
+    preferencesHint: 'Ces réglages ne s’appliquent qu’à ce navigateur.',
+    language: 'Langue',
+    notifications: 'Notifications',
+    notificationsEnabled: 'Activées — vous serez notifié lorsqu’une session attend une réponse.',
+    notificationsDisabled: 'Désactivées.',
+    enableNotifications: 'Activer les notifications',
+    disableNotifications: 'Désactiver les notifications',
+    testNotification: 'Envoyer un test',
+    testSent: 'Notification de test envoyée',
+    pushUnsupported: 'Le push exige HTTPS (ex. Tailscale Serve) ; sur iOS, installez d’abord l’app sur l’écran d’accueil.',
+    // Accès & sécurité
+    security: 'Accès & sécurité',
+    securityHint: 'Les jetons donnent un accès complet à ce serveur. Créez-en un par appareil et révoquez ceux que vous n’utilisez plus.',
+    tokens: 'Jetons d’accès',
+    newTokenLabel: 'Libellé',
+    newTokenPlaceholder: 'ex. téléphone, portable',
+    createToken: 'Créer un jeton',
+    tokenCreated: 'Jeton créé',
+    copyTokenHint: 'Copiez ce jeton maintenant — par sécurité il ne sera plus jamais affiché.',
+    copy: 'Copier',
+    copied: 'Copié',
+    current: 'courant',
+    created: 'Créé le {date}',
+    lastUsed: 'utilisé le {date}',
+    neverUsed: 'jamais utilisé',
+    revoke: 'Révoquer',
+    confirmRevoke: 'Confirmer la révocation',
+    tokenRevoked: 'Jeton révoqué',
+    lastTokenError: 'Impossible de révoquer le dernier jeton actif — créez-en un autre d’abord.',
+    save: 'Enregistrer',
+    saved: 'Enregistré',
+    // Sécurité & conformité
+    compliance: 'Sécurité & conformité',
+    complianceHint: 'Exportez ou effacez les données liées à votre jeton (RGPD), et consultez le journal d’audit des opérations sensibles.',
+    exportData: 'Exporter mes données',
+    refreshAudit: 'Journal d’audit',
+    deleteData: 'Effacer mes données',
+    deleteConfirm: 'Effacer les données liées à votre jeton (abonnements push) et révoquer ce jeton ? Action irréversible.',
+    deleteDone: 'Vos données ont été effacées.',
+    // Découverte des dépôts
+    discovery: 'Découverte des dépôts',
+    discoveryHint: 'Arboretum scanne ces dossiers à la recherche de dépôts git et les enregistre automatiquement. Les dépôts masqués sont conservés et jamais ré-ajoutés.',
+    scanRoots: 'Dossiers à scanner',
+    scanRootsEmpty: 'Aucun dossier configuré — votre dossier personnel est utilisé par défaut.',
+    addRoot: 'Ajouter un dossier',
+    removeRoot: 'Retirer',
+    scanInterval: 'Intervalle de re-scan (minutes)',
+    scanIntervalHint: '0 désactive le scan périodique. Les changements prennent effet au prochain redémarrage du daemon.',
+    // Serveur (lecture seule)
+    server: 'Serveur',
+    serverHint: 'Définis au démarrage via des flags CLI — les modifier nécessite de redémarrer le daemon.',
+    version: 'Version',
+    port: 'Port',
+    bind: 'Adresse de liaison',
+    allowedOrigins: 'Origines autorisées',
+    dataDir: 'Répertoire de données',
+    vapidPublicKey: 'Clé publique VAPID',
+    vapidContact: 'Contact VAPID',
+    none: 'aucune',
+    flagHint: 'Flag CLI : {flag}',
+    // Soutien
+    support: 'Soutenir le projet',
+    supportHint: 'Arboretum est un projet personnel libre et auto-financé. S’il vous fait gagner du temps, vous pouvez soutenir son développement.',
+    supportCta: 'Offrez-moi un café',
+  },
+  help: {
+    title: 'Aide',
+    intro: 'Tout ce qu’Arboretum sait faire, et comment l’utiliser.',
+    searchPlaceholder: 'Rechercher dans l’aide…',
+    noMatch: 'Aucun sujet correspondant',
+  },
 };
 
 export default fr;

packages/web/src/lib/constants.ts

@@ -0,0 +1,14 @@
+// Constantes globales du front.
+
+/**
+ * Lien « Code source » affiché en permanence dans la navigation secondaire.
+ * En dur (pas un réglage) : pointe vers le dépôt source d'Arboretum, identique pour
+ * tous les utilisateurs de la solution.
+ */
+export const REPO_SOURCE_URL = 'https://git.lidge.fr/johanleroy/arboretum';
+
+/**
+ * Lien « Buy me a coffee » affiché dans la navigation et la page Réglages.
+ * En dur (pas un réglage) : page de don personnelle, identique pour tous.
+ */
+export const BUYMEACOFFEE_URL = 'https://buymeacoffee.com/johanleroy';

packages/web/src/router/index.ts

@@ -18,6 +18,8 @@ export const router = createRouter({
     { path: '/sessions/:id', name: 'session', component: () => import('../views/SessionView.vue'), meta: { layout: 'fullbleed' } },
     { path: '/groups', name: 'groups', component: () => import('../views/GroupsListView.vue'), meta: { layout: 'shell' } },
     { path: '/groups/:id', name: 'group', component: () => import('../views/GroupView.vue'), meta: { layout: 'shell' } },
+    { path: '/settings', name: 'settings', component: () => import('../views/SettingsView.vue'), meta: { layout: 'shell' } },
+    { path: '/help', name: 'help', component: () => import('../views/HelpView.vue'), meta: { layout: 'shell' } },
     { path: '/:pathMatch(.*)*', redirect: '/' },
   ],
 });

packages/web/src/stores/settings.ts

@@ -0,0 +1,36 @@
+import { defineStore } from 'pinia';
+import { ref } from 'vue';
+import type { ServerInfo, SettingsResponse, UpdateSettingsRequest } from '@arboretum/shared';
+import { api } from '../lib/api';
+
+// Réglages serveur (découverte des dépôts, infos serveur).
+// Les préférences purement client (langue) restent gérées par l'i18n/localStorage.
+export const useSettingsStore = defineStore('settings', () => {
+  const server = ref<ServerInfo | null>(null);
+  const scanRoots = ref<string[]>([]);
+  const scanIntervalMin = ref(0);
+  const loaded = ref(false);
+  const saving = ref(false);
+
+  function apply(res: SettingsResponse): void {
+    server.value = res.server;
+    scanRoots.value = res.settings.scanRoots;
+    scanIntervalMin.value = res.settings.scanIntervalMin;
+    loaded.value = true;
+  }
+
+  async function fetch(): Promise<void> {
+    apply(await api.get<SettingsResponse>('/api/v1/settings'));
+  }
+
+  async function save(patch: UpdateSettingsRequest): Promise<void> {
+    saving.value = true;
+    try {
+      apply(await api.patch<SettingsResponse>('/api/v1/settings', patch));
+    } finally {
+      saving.value = false;
+    }
+  }
+
+  return { server, scanRoots, scanIntervalMin, loaded, saving, fetch, save };
+});

packages/web/src/stores/worktrees.ts

@@ -3,6 +3,7 @@ import { ref } from 'vue';
 import type {
   CreateWorktreeRequest,
   CreateWorktreeResponse,
+  DiscoverReposResponse,
   RepoResponse,
   ReposListResponse,
   RepoSummary,
@@ -84,6 +85,19 @@ export const useWorktreesStore = defineStore('worktrees', () => {
     removeRepoLocal(id);
   }
 
+  /** Masque/ré-affiche un repo (persiste `hidden` côté serveur ; émis aussi par WS). */
+  async function setHidden(id: string, hidden: boolean): Promise<void> {
+    const res = await api.patch<RepoResponse>(`/api/v1/repos/${id}`, { hidden });
+    upsertRepo(res.repo);
+  }
+
+  /** Lance un scan de découverte ; les nouveaux repos arrivent par WS, on resynchronise par sûreté. */
+  async function discover(): Promise<DiscoverReposResponse> {
+    const res = await api.post<DiscoverReposResponse>('/api/v1/repos/discover');
+    await fetchAll();
+    return res;
+  }
+
   async function createWorktree(repoId: string, req: CreateWorktreeRequest): Promise<CreateWorktreeResponse> {
     const res = await api.post<CreateWorktreeResponse>(`/api/v1/repos/${repoId}/worktrees`, req);
     upsertWorktree(res.worktree);
@@ -117,6 +131,9 @@ export const useWorktreesStore = defineStore('worktrees', () => {
     fetchAll,
     addRepo,
     removeRepo,
+    setHidden,
+    discover,
+    refreshRepoWorktrees,
     createWorktree,
     deleteWorktree,
     prune,

packages/web/src/style.css

@@ -18,6 +18,15 @@ body {
   -webkit-font-smoothing: antialiased;
 }
 
+@layer base {
+  /* Tailwind v4 ne met plus cursor:pointer sur les boutons → on le rétablit
+     (sauf désactivés, qui gardent le curseur par défaut / not-allowed). */
+  button:not(:disabled),
+  [role='button']:not([aria-disabled='true']) {
+    cursor: pointer;
+  }
+}
+
 @layer components {
   /* Champs : rayon unifié + anneau de focus visible (absent auparavant). */
   .input {

packages/web/src/views/DashboardView.vue

@@ -1,5 +1,8 @@
 <template>
   <PageHeader :title="t('nav.worktrees')">
+    <BaseButton variant="ghost" size="sm" :icon="ScanSearch" :loading="scanning" @click="onDiscover">
+      {{ t('repos.scan') }}
+    </BaseButton>
     <BaseButton variant="ghost" size="sm" :icon="RefreshCw" :loading="store.loading" @click="refresh">
       {{ t('common.refresh') }}
     </BaseButton>
@@ -33,6 +36,9 @@
   <template v-else>
     <!-- une seule toolbar pilote le tri/filtre des worktrees de toutes les sections -->
     <ListToolbar :controls="view" search-placeholder-key="controls.searchPlaceholder" />
+    <label v-if="hiddenCount > 0" class="flex items-center gap-2 px-1 text-xs text-zinc-400">
+      <input v-model="showHidden" type="checkbox" /> {{ t('repos.showHidden', { n: hiddenCount }) }}
+    </label>
     <EmptyState v-if="visibleRepos.length === 0" :icon="Search" :title="t('controls.results', 0)" />
     <RepoSection v-for="repo in pagedRepos" :key="repo.id" :repo="repo" />
     <Pagination
@@ -50,7 +56,7 @@
 <script setup lang="ts">
 import { computed, ref, watch } from 'vue';
 import { useI18n } from 'vue-i18n';
-import { GitBranch, RefreshCw, FolderOpen, Plus, Search } from '@lucide/vue';
+import { GitBranch, RefreshCw, FolderOpen, Plus, Search, ScanSearch } from '@lucide/vue';
 import { useWorktreesStore } from '../stores/worktrees';
 import { useToastsStore } from '../stores/toasts';
 import { useWorktreeView } from '../composables/useWorktreeView';
@@ -72,15 +78,29 @@ const view = useWorktreeView();
 const newPath = ref('');
 const showPicker = ref(false);
 const adding = ref(false);
+const scanning = ref(false);
+const showHidden = ref(false);
 
-// repos triés par libellé ; masqués quand un filtre/recherche worktree actif ne laisse rien dans le repo.
-const sortedRepos = computed(() => [...store.repos].sort((a, b) => a.label.localeCompare(b.label)));
+const hiddenCount = computed(() => store.repos.filter((r) => r.hidden).length);
+
+// repos visibles : les masqués sont exclus sauf si « afficher les masqués » est coché. Triés par libellé ;
+// puis masqués quand un filtre/recherche worktree actif ne laisse rien dans le repo.
+const sortedRepos = computed(() =>
+  [...store.repos]
+    .filter((r) => showHidden.value || !r.hidden)
+    .sort((a, b) => a.label.localeCompare(b.label)),
+);
 const visibleRepos = computed(() =>
   view.isActive()
     ? sortedRepos.value.filter((r) => view.apply(store.worktreesForRepo(r.id)).length > 0)
     : sortedRepos.value,
 );
 
+// GET /worktrees exclut les repos masqués (perf) → charger paresseusement leurs worktrees au dévoilement.
+watch(showHidden, (on) => {
+  if (on) for (const r of store.repos.filter((x) => x.hidden)) void store.refreshRepoWorktrees(r.id);
+});
+
 // pagination des repos (rarement nombreux → masquée par défaut).
 const repoPage = ref(1);
 const repoPageSize = ref(10);
@@ -110,6 +130,18 @@ function refresh(): void {
   void store.fetchAll();
 }
 
+async function onDiscover(): Promise<void> {
+  scanning.value = true;
+  try {
+    const res = await store.discover();
+    toasts.success(t('repos.scanResult', res.added));
+  } catch (err) {
+    toasts.error(err);
+  } finally {
+    scanning.value = false;
+  }
+}
+
 async function onAddRepo(): Promise<void> {
   adding.value = true;
   try {

packages/web/src/views/HelpView.vue

@@ -0,0 +1,68 @@
+<template>
+  <div class="flex flex-col gap-4">
+    <PageHeader :title="t('help.title')">
+      <template #search>
+        <div class="relative">
+          <Search :size="15" class="pointer-events-none absolute left-2.5 top-1/2 -translate-y-1/2 text-zinc-500" />
+          <input v-model="query" class="input pl-8" :placeholder="t('help.searchPlaceholder')" />
+        </div>
+      </template>
+    </PageHeader>
+    <p class="text-sm text-zinc-400">{{ t('help.intro') }}</p>
+
+    <section v-for="section in filtered" :key="section.id" class="card flex flex-col gap-3">
+      <header class="flex items-center gap-2">
+        <component :is="iconFor(section.id)" :size="18" class="text-emerald-400" :stroke-width="1.75" />
+        <h2 class="text-sm font-semibold text-zinc-100">{{ section.title }}</h2>
+      </header>
+      <p class="text-xs text-zinc-500">{{ section.blurb }}</p>
+      <dl class="flex flex-col gap-2">
+        <div v-for="(item, i) in section.items" :key="i" class="card-inset">
+          <dt class="text-sm font-medium text-zinc-200">{{ item.title }}</dt>
+          <dd class="mt-0.5 text-sm leading-relaxed text-zinc-400">{{ item.body }}</dd>
+        </div>
+      </dl>
+    </section>
+
+    <EmptyState v-if="!filtered.length" :icon="SearchX" :title="t('help.noMatch')" />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, type Component } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { Boxes, Command, GitBranch, KeyRound, Puzzle, Search, SearchX, Settings, Smartphone, TerminalSquare } from '@lucide/vue';
+import type { AppLocale } from '../i18n';
+import { helpSections, type HelpSection } from './help-content';
+import PageHeader from '../components/layout/PageHeader.vue';
+import EmptyState from '../components/ui/EmptyState.vue';
+
+const { t, locale } = useI18n();
+const query = ref('');
+
+const ICONS: Record<string, Component> = {
+  gettingStarted: KeyRound,
+  worktrees: GitBranch,
+  sessions: TerminalSquare,
+  mobile: Smartphone,
+  groups: Boxes,
+  productivity: Command,
+  settings: Settings,
+  integrations: Puzzle,
+};
+const iconFor = (id: string): Component => ICONS[id] ?? KeyRound;
+
+const sections = computed<HelpSection[]>(() => helpSections[locale.value as AppLocale] ?? helpSections.en);
+
+const filtered = computed<HelpSection[]>(() => {
+  const q = query.value.trim().toLowerCase();
+  if (!q) return sections.value;
+  return sections.value
+    .map((s) => {
+      const sectionMatches = (s.title + ' ' + s.blurb).toLowerCase().includes(q);
+      const items = sectionMatches ? s.items : s.items.filter((it) => (it.title + ' ' + it.body).toLowerCase().includes(q));
+      return items.length ? { ...s, items } : null;
+    })
+    .filter((s): s is HelpSection => s !== null);
+});
+</script>

packages/web/src/views/SettingsView.vue

@@ -0,0 +1,383 @@
+<template>
+  <div class="flex flex-col gap-4">
+    <PageHeader :title="t('settings.title')" />
+
+    <!-- Préférences (client) -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <SlidersHorizontal :size="16" /> {{ t('settings.preferences') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.preferencesHint') }}</p>
+
+      <div class="flex items-center justify-between gap-3">
+        <span class="text-sm text-zinc-300">{{ t('settings.language') }}</span>
+        <LanguageSwitcher />
+      </div>
+
+      <div class="flex flex-col gap-2 border-t border-zinc-800/80 pt-3">
+        <div class="flex items-center justify-between gap-3">
+          <div class="min-w-0">
+            <p class="text-sm text-zinc-300">{{ t('settings.notifications') }}</p>
+            <p class="text-xs text-zinc-500">
+              {{ push.supported ? (push.enabled ? t('settings.notificationsEnabled') : t('settings.notificationsDisabled')) : t('settings.pushUnsupported') }}
+            </p>
+          </div>
+          <BaseButton
+            v-if="push.supported"
+            :variant="push.enabled ? 'secondary' : 'primary'"
+            size="sm"
+            :icon="push.enabled ? BellOff : Bell"
+            :loading="push.busy"
+            @click="push.toggle()"
+          >
+            {{ push.enabled ? t('settings.disableNotifications') : t('settings.enableNotifications') }}
+          </BaseButton>
+        </div>
+        <div v-if="push.enabled">
+          <BaseButton variant="ghost" size="sm" :icon="Send" :loading="testing" @click="sendTest">
+            {{ t('settings.testNotification') }}
+          </BaseButton>
+        </div>
+      </div>
+    </section>
+
+    <!-- Accès & sécurité : tokens -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <Shield :size="16" /> {{ t('settings.security') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.securityHint') }}</p>
+
+      <!-- Création -->
+      <form class="flex flex-wrap items-end gap-2" @submit.prevent="createToken">
+        <label class="flex min-w-40 flex-1 flex-col gap-1">
+          <span class="text-xs text-zinc-400">{{ t('settings.newTokenLabel') }}</span>
+          <input v-model="newLabel" class="input" :placeholder="t('settings.newTokenPlaceholder')" maxlength="64" />
+        </label>
+        <BaseButton type="submit" variant="primary" :icon="Plus" :loading="creating" :disabled="!newLabel.trim()">
+          {{ t('settings.createToken') }}
+        </BaseButton>
+      </form>
+
+      <!-- Valeur en clair (une seule fois) -->
+      <div v-if="createdToken" class="card-inset flex flex-col gap-2 border-emerald-800/60 bg-emerald-950/20">
+        <p class="text-xs text-emerald-300">{{ t('settings.copyTokenHint') }}</p>
+        <div class="flex items-center gap-2">
+          <code class="min-w-0 flex-1 truncate rounded bg-zinc-950 px-2 py-1 font-mono text-xs text-zinc-100">{{ createdToken.token }}</code>
+          <BaseButton size="sm" :icon="copiedNew ? Check : Copy" @click="copy(createdToken.token, 'new')">
+            {{ copiedNew ? t('settings.copied') : t('settings.copy') }}
+          </BaseButton>
+          <BaseButton size="sm" variant="ghost" icon-only :icon="X" :aria-label="t('common.close')" @click="createdToken = null" />
+        </div>
+      </div>
+
+      <!-- Liste -->
+      <ul class="flex flex-col gap-2">
+        <li
+          v-for="tok in tokens"
+          :key="tok.id"
+          class="card-inset flex flex-wrap items-center gap-x-3 gap-y-1"
+        >
+          <KeyRound :size="15" class="shrink-0 text-zinc-500" />
+          <div class="min-w-0 flex-1">
+            <p class="flex items-center gap-2 truncate text-sm text-zinc-200">
+              {{ tok.label }}
+              <span v-if="tok.current" class="badge bg-emerald-500/15 text-emerald-300">{{ t('settings.current') }}</span>
+            </p>
+            <p class="text-[11px] text-zinc-500">
+              {{ t('settings.created', { date: fmt(tok.createdAt) }) }} ·
+              {{ tok.lastUsedAt ? t('settings.lastUsed', { date: fmt(tok.lastUsedAt) }) : t('settings.neverUsed') }}
+            </p>
+          </div>
+          <BaseButton
+            v-if="!tok.current"
+            size="sm"
+            :variant="confirmId === tok.id ? 'danger' : 'ghost'"
+            :icon="Trash2"
+            @click="revoke(tok)"
+          >
+            {{ confirmId === tok.id ? t('settings.confirmRevoke') : t('settings.revoke') }}
+          </BaseButton>
+        </li>
+      </ul>
+    </section>
+
+    <!-- Découverte des dépôts -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <ScanSearch :size="16" /> {{ t('settings.discovery') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.discoveryHint') }}</p>
+
+      <div class="flex flex-col gap-2">
+        <span class="text-xs text-zinc-400">{{ t('settings.scanRoots') }}</span>
+        <p v-if="rootsDraft.length === 0" class="text-xs text-zinc-600">{{ t('settings.scanRootsEmpty') }}</p>
+        <ul v-else class="flex flex-col gap-1">
+          <li v-for="(root, i) in rootsDraft" :key="root" class="card-inset flex items-center gap-2">
+            <span class="min-w-0 flex-1 truncate font-mono text-xs text-zinc-200" :title="root">{{ root }}</span>
+            <BaseButton size="sm" variant="ghost" icon-only :icon="X" :aria-label="t('settings.removeRoot')" @click="rootsDraft.splice(i, 1)" />
+          </li>
+        </ul>
+        <div>
+          <BaseButton size="sm" :icon="FolderOpen" @click="showRootPicker = !showRootPicker">{{ t('settings.addRoot') }}</BaseButton>
+        </div>
+        <DirectoryPicker v-if="showRootPicker" mode="dir" @select="onAddRoot" @close="showRootPicker = false" />
+      </div>
+
+      <label class="flex flex-col gap-1">
+        <span class="text-xs text-zinc-400">{{ t('settings.scanInterval') }}</span>
+        <input v-model.number="intervalDraft" type="number" min="0" max="1440" class="input w-32" />
+        <span class="text-xs text-zinc-500">{{ t('settings.scanIntervalHint') }}</span>
+      </label>
+
+      <div>
+        <BaseButton variant="primary" :loading="settings.saving" :disabled="!discoveryDirty" @click="saveDiscovery">
+          {{ t('settings.save') }}
+        </BaseButton>
+      </div>
+    </section>
+
+    <!-- Sécurité & conformité -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <Shield :size="16" /> {{ t('settings.compliance') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.complianceHint') }}</p>
+      <div class="flex flex-wrap gap-2">
+        <BaseButton size="sm" :icon="Download" :loading="exporting" @click="exportData">{{ t('settings.exportData') }}</BaseButton>
+        <BaseButton variant="ghost" size="sm" :icon="RefreshCw" :loading="auditing" @click="loadAudit">{{ t('settings.refreshAudit') }}</BaseButton>
+        <BaseButton variant="ghost" size="sm" :icon="Trash2" @click="deleteMyData">{{ t('settings.deleteData') }}</BaseButton>
+      </div>
+      <ul v-if="audit.length" class="flex flex-col divide-y divide-zinc-800/80 text-xs">
+        <li v-for="e in audit" :key="e.id" class="flex items-center justify-between gap-3 py-1.5">
+          <span class="font-mono text-zinc-300">{{ e.action }}</span>
+          <span class="truncate text-zinc-500">{{ e.actor }}</span>
+          <span class="shrink-0 text-zinc-600">{{ new Date(e.ts).toLocaleString() }}</span>
+        </li>
+      </ul>
+    </section>
+
+    <!-- Serveur (lecture seule) -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <Server :size="16" /> {{ t('settings.server') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.serverHint') }}</p>
+      <dl v-if="settings.server" class="flex flex-col divide-y divide-zinc-800/80">
+        <ServerRow :label="t('settings.version')" :value="settings.server.version" />
+        <ServerRow :label="t('settings.port')" :value="String(settings.server.port)" flag="--port" />
+        <ServerRow :label="t('settings.bind')" :value="settings.server.bind" flag="--bind" />
+        <ServerRow
+          :label="t('settings.allowedOrigins')"
+          :value="settings.server.allowedOrigins.length ? settings.server.allowedOrigins.join(', ') : t('settings.none')"
+          flag="--allow-origin"
+        />
+        <ServerRow :label="t('settings.dataDir')" :value="settings.server.dataDir" />
+        <ServerRow :label="t('settings.vapidContact')" :value="settings.server.vapidContact" flag="--vapid-contact" />
+        <ServerRow :label="t('settings.vapidPublicKey')" :value="settings.server.vapidPublicKey ?? t('settings.none')" mono />
+      </dl>
+      <SkeletonRow v-else />
+    </section>
+
+    <!-- Support -->
+    <section class="card flex flex-col gap-3">
+      <h2 class="flex items-center gap-2 text-sm font-semibold text-zinc-100">
+        <Coffee :size="16" /> {{ t('settings.support') }}
+      </h2>
+      <p class="text-xs text-zinc-500">{{ t('settings.supportHint') }}</p>
+      <div>
+        <a
+          :href="BUYMEACOFFEE_URL"
+          target="_blank"
+          rel="noopener noreferrer"
+          class="inline-flex h-9 items-center justify-center gap-1.5 rounded-lg border border-zinc-700 bg-zinc-800 px-3 text-sm font-medium text-zinc-200 transition-colors hover:bg-zinc-700 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-emerald-500/70 focus-visible:ring-offset-2 focus-visible:ring-offset-zinc-950"
+        >
+          <Coffee :size="16" /> {{ t('settings.supportCta') }}
+        </a>
+      </div>
+    </section>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, onMounted, ref } from 'vue';
+import { useI18n } from 'vue-i18n';
+import { Bell, BellOff, Check, Coffee, Copy, Download, FolderOpen, KeyRound, Plus, RefreshCw, ScanSearch, Send, Server, Shield, SlidersHorizontal, Trash2, X } from '@lucide/vue';
+import type {
+  AuditLogEntry,
+  AuditLogsResponse,
+  CreateTokenResponse,
+  DataExportResponse,
+  DeleteMyDataResponse,
+  TokenInfo,
+  TokensListResponse,
+} from '@arboretum/shared';
+import { api, ApiError } from '../lib/api';
+import { BUYMEACOFFEE_URL } from '../lib/constants';
+import { useSettingsStore } from '../stores/settings';
+import { usePushStore } from '../stores/push';
+import { useToastsStore } from '../stores/toasts';
+import PageHeader from '../components/layout/PageHeader.vue';
+import LanguageSwitcher from '../components/LanguageSwitcher.vue';
+import BaseButton from '../components/ui/BaseButton.vue';
+import SkeletonRow from '../components/ui/SkeletonRow.vue';
+import ServerRow from '../components/settings/ServerRow.vue';
+import DirectoryPicker from '../components/DirectoryPicker.vue';
+
+const { t, locale } = useI18n();
+const settings = useSettingsStore();
+const push = usePushStore();
+const toasts = useToastsStore();
+
+// ---- Préférences ----
+const testing = ref(false);
+async function sendTest(): Promise<void> {
+  testing.value = true;
+  try {
+    await api.post('/api/v1/push/test');
+    toasts.success(t('settings.testSent'));
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    testing.value = false;
+  }
+}
+
+// ---- Tokens ----
+const tokens = ref<TokenInfo[]>([]);
+const newLabel = ref('');
+const creating = ref(false);
+const createdToken = ref<CreateTokenResponse | null>(null);
+const confirmId = ref<string | null>(null);
+const copiedNew = ref(false);
+
+const fmt = (iso: string): string => new Date(iso).toLocaleString(locale.value);
+
+async function loadTokens(): Promise<void> {
+  tokens.value = (await api.get<TokensListResponse>('/api/v1/auth/tokens')).tokens;
+}
+
+async function createToken(): Promise<void> {
+  const label = newLabel.value.trim();
+  if (!label) return;
+  creating.value = true;
+  try {
+    createdToken.value = await api.post<CreateTokenResponse>('/api/v1/auth/tokens', { label });
+    newLabel.value = '';
+    toasts.success(t('settings.tokenCreated'));
+    await loadTokens();
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    creating.value = false;
+  }
+}
+
+async function revoke(tok: TokenInfo): Promise<void> {
+  if (confirmId.value !== tok.id) {
+    confirmId.value = tok.id;
+    return;
+  }
+  confirmId.value = null;
+  try {
+    await api.delete(`/api/v1/auth/tokens/${tok.id}`);
+    toasts.success(t('settings.tokenRevoked'));
+    await loadTokens();
+  } catch (e) {
+    toasts.error(e instanceof ApiError && e.code === 'LAST_TOKEN' ? t('settings.lastTokenError') : e);
+  }
+}
+
+async function copy(text: string, target?: 'new'): Promise<void> {
+  try {
+    await navigator.clipboard.writeText(text);
+    if (target === 'new') {
+      copiedNew.value = true;
+      setTimeout(() => (copiedNew.value = false), 1500);
+    }
+  } catch {
+    /* presse-papiers indisponible (http non sécurisé) : silencieux */
+  }
+}
+
+// ---- Découverte des dépôts ----
+const rootsDraft = ref<string[]>([]);
+const intervalDraft = ref(0);
+const showRootPicker = ref(false);
+const discoveryDirty = computed(
+  () =>
+    intervalDraft.value !== settings.scanIntervalMin ||
+    rootsDraft.value.length !== settings.scanRoots.length ||
+    rootsDraft.value.some((r, i) => r !== settings.scanRoots[i]),
+);
+function syncDiscoveryDraft(): void {
+  rootsDraft.value = [...settings.scanRoots];
+  intervalDraft.value = settings.scanIntervalMin;
+}
+function onAddRoot(path: string): void {
+  if (!rootsDraft.value.includes(path)) rootsDraft.value.push(path);
+  showRootPicker.value = false;
+}
+async function saveDiscovery(): Promise<void> {
+  try {
+    await settings.save({ scanRoots: rootsDraft.value, scanIntervalMin: intervalDraft.value });
+    syncDiscoveryDraft();
+    toasts.success(t('settings.saved'));
+  } catch (e) {
+    toasts.error(e);
+  }
+}
+
+// ---- Sécurité & conformité (audit / RGPD) ----
+const audit = ref<AuditLogEntry[]>([]);
+const auditing = ref(false);
+const exporting = ref(false);
+
+async function loadAudit(): Promise<void> {
+  auditing.value = true;
+  try {
+    audit.value = (await api.get<AuditLogsResponse>('/api/v1/audit-logs?limit=20')).entries;
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    auditing.value = false;
+  }
+}
+
+async function exportData(): Promise<void> {
+  exporting.value = true;
+  try {
+    const data = await api.get<DataExportResponse>('/api/v1/data/export');
+    const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
+    const url = URL.createObjectURL(blob);
+    const a = document.createElement('a');
+    a.href = url;
+    a.download = 'arboretum-data-export.json';
+    a.click();
+    URL.revokeObjectURL(url);
+  } catch (e) {
+    toasts.error(e);
+  } finally {
+    exporting.value = false;
+  }
+}
+
+async function deleteMyData(): Promise<void> {
+  if (!window.confirm(t('settings.deleteConfirm'))) return;
+  try {
+    const pending = await api.post<DeleteMyDataResponse>('/api/v1/data/delete-my-data', {});
+    if (pending.status !== 'pending' || !pending.confirm) return;
+    const done = await api.post<DeleteMyDataResponse>('/api/v1/data/delete-my-data', { confirm: pending.confirm });
+    toasts.success(t('settings.deleteDone'));
+    if (done.summary.tokenRevoked) window.location.reload(); // token courant révoqué → re-login
+  } catch (e) {
+    toasts.error(e);
+  }
+}
+
+onMounted(async () => {
+  await Promise.all([loadTokens(), settings.loaded ? Promise.resolve() : settings.fetch()]);
+  syncDiscoveryDraft();
+  void push.refresh();
+});
+</script>

packages/web/src/views/help-content.ts

@@ -0,0 +1,352 @@
+// Contenu de l'onglet Aide, bilingue. Texte long-format → gardé hors des fichiers i18n
+// (en.ts/fr.ts) pour ne pas les alourdir. HelpView mappe chaque `id` vers une icône Lucide.
+import type { AppLocale } from '../i18n';
+
+export interface HelpItem {
+  title: string;
+  body: string;
+}
+export interface HelpSection {
+  id: string;
+  title: string;
+  blurb: string;
+  items: HelpItem[];
+}
+
+const en: HelpSection[] = [
+  {
+    id: 'gettingStarted',
+    title: 'Getting started & access',
+    blurb:
+      'Arboretum is a single daemon that serves this dashboard to drive your git worktrees and the Claude Code sessions running on them, from any device.',
+    items: [
+      {
+        title: 'Sign in with a token',
+        body: 'On first start the daemon prints a one-time access token. Paste it on the login screen. You can create extra tokens (one per device) and revoke old ones in Settings → Access & security.',
+      },
+      {
+        title: 'Remote access via Tailscale Serve',
+        body: 'The daemon binds to 127.0.0.1. To reach it from your phone, run tailscale serve --bg 7317 and start Arboretum with --allow-origin https://<machine>.<tailnet>.ts.net. The HTTPS that Tailscale provides is also what makes Web Push work.',
+      },
+      {
+        title: 'Install as an app (PWA)',
+        body: 'On mobile, open Arboretum and choose Add to Home Screen. On iOS this install step is required before notifications can work.',
+      },
+    ],
+  },
+  {
+    id: 'worktrees',
+    title: 'Repositories & worktrees',
+    blurb: 'Register your git repos, then spin up an isolated worktree per branch — each can auto-start a session.',
+    items: [
+      {
+        title: 'Add a repository',
+        body: 'On the Worktrees page, type or browse to the absolute path of a git repo and add it. Per-repo post-create hooks (e.g. npm ci) run automatically on new worktrees.',
+      },
+      {
+        title: 'Create a worktree',
+        body: 'In a repo section, click New worktree, enter a branch (optionally create it), and optionally start a claude or bash session in it. Hooks run automatically.',
+      },
+      {
+        title: 'Read worktree state',
+        body: 'Each card shows the branch, ahead/behind counts, dirty file count and flags (main, locked, prunable), plus the live state of any linked session.',
+      },
+      {
+        title: 'Delete & prune',
+        body: 'Delete a worktree from its card (force-delete if dirty or locked), or prune all orphaned worktrees at the repo level.',
+      },
+    ],
+  },
+  {
+    id: 'sessions',
+    title: 'Sessions & the web terminal',
+    blurb: 'Run, observe, resume and answer Claude Code (or bash) sessions in a full xterm terminal, right in the browser.',
+    items: [
+      {
+        title: 'Start a session',
+        body: 'On the Sessions page, set a working directory and a command (claude or bash) and launch. Open it to get an interactive terminal.',
+      },
+      {
+        title: 'Discovered sessions',
+        body: 'Sessions you start in your own terminal are detected automatically and tagged as discovered. Observe them read-only, or resume/fork them once stopped.',
+      },
+      {
+        title: 'Resume & fork',
+        body: 'Resume restarts a stopped session in its original working directory, with full scrollback replayed. Fork creates a fresh independent copy with the same command and cwd.',
+      },
+      {
+        title: 'Observe vs interact',
+        body: 'Anyone opening a live session can type; open it as an observer for read-only monitoring that never slows the session down.',
+      },
+      {
+        title: 'Fine-grained state',
+        body: 'Managed Claude sessions report waiting / busy / idle in real time. Waiting sessions are surfaced first and can trigger notifications.',
+      },
+      {
+        title: 'Kill a session',
+        body: 'Kill a live session from its row (confirm to avoid accidents); it receives SIGTERM, then SIGKILL after a short grace delay.',
+      },
+    ],
+  },
+  {
+    id: 'mobile',
+    title: 'Mobile supervision',
+    blurb: 'Keep sessions moving from your phone, without opening a terminal.',
+    items: [
+      {
+        title: 'Needs attention',
+        body: 'A banner at the top of the dashboard lists every session blocked on a dialog, with inline answer buttons.',
+      },
+      {
+        title: 'Answer dialogs',
+        body: 'When Claude asks for trust, a permission or a choice, pick an option (or Deny) right from the card — no terminal needed.',
+      },
+      {
+        title: 'Web Push notifications',
+        body: 'Enable notifications in Settings (or the footer bell). You get a push when a session starts waiting; tap it to answer. Requires HTTPS; on iOS, install the app first.',
+      },
+    ],
+  },
+  {
+    id: 'groups',
+    title: 'Work groups',
+    blurb: 'Bundle related repos (API, web, shared lib…) and operate on them together.',
+    items: [
+      {
+        title: 'Create a group',
+        body: 'On the Groups page, name a group and pick its repos. Membership is lightweight and editable anytime.',
+      },
+      {
+        title: 'List vs terminal grid',
+        body: 'A group view shows all its repos worktrees and sessions as a list, or switch to the terminal grid to watch several live sessions side by side.',
+      },
+      {
+        title: 'Cross-repo feature',
+        body: 'Create the same worktree (and an optional session) across every repo of the group in one action; partial failures can be retried per repo.',
+      },
+    ],
+  },
+  {
+    id: 'productivity',
+    title: 'Productivity',
+    blurb: 'Find anything fast and tailor each list.',
+    items: [
+      {
+        title: 'Command palette',
+        body: 'Press ⌘K (or Ctrl+K) to fuzzy-jump to any repo, worktree, session or group, or to run a quick action.',
+      },
+      {
+        title: 'Sort, filter & search',
+        body: 'Every list has a toolbar to sort, filter (state, command, source, flags…) and search. Your choices persist in the URL, so links are shareable.',
+      },
+      {
+        title: 'Pagination',
+        body: 'Long lists are paginated with a configurable page size; choose All to show everything at once.',
+      },
+      {
+        title: 'Language',
+        body: 'Switch the interface between English and French anytime, from Settings or the footer.',
+      },
+    ],
+  },
+  {
+    id: 'settings',
+    title: 'Settings & security',
+    blurb: 'Configure the app and manage who can reach the daemon.',
+    items: [
+      {
+        title: 'Notifications',
+        body: 'Enable or disable Web Push and send a test notification from Settings → Preferences.',
+      },
+      {
+        title: 'Access tokens',
+        body: 'Create a token per device and revoke any you no longer trust. A new token value is shown only once — copy it immediately. The last active token cannot be revoked, to avoid locking yourself out.',
+      },
+      {
+        title: 'Server info',
+        body: 'Settings → Server shows the running version and the startup configuration (port, bind, allowed origins, data directory, VAPID). These are set via CLI flags and need a daemon restart to change.',
+      },
+    ],
+  },
+  {
+    id: 'integrations',
+    title: 'Integrations',
+    blurb: 'Shortcuts to the tools around your repos.',
+    items: [
+      {
+        title: 'Source code',
+        body: 'The “Source code” icon in the navigation always links to the Arboretum source repository on Gitea.',
+      },
+    ],
+  },
+];
+
+const fr: HelpSection[] = [
+  {
+    id: 'gettingStarted',
+    title: 'Prise en main & accès',
+    blurb:
+      'Arboretum est un daemon unique qui sert ce dashboard pour piloter vos worktrees git et les sessions Claude Code qui tournent dessus, depuis n’importe quel appareil.',
+    items: [
+      {
+        title: 'Se connecter avec un jeton',
+        body: 'Au premier démarrage, le daemon affiche un jeton d’accès à usage unique. Collez-le sur l’écran de connexion. Vous pouvez créer des jetons supplémentaires (un par appareil) et révoquer les anciens dans Réglages → Accès & sécurité.',
+      },
+      {
+        title: 'Accès distant via Tailscale Serve',
+        body: 'Le daemon écoute sur 127.0.0.1. Pour y accéder depuis votre téléphone, lancez tailscale serve --bg 7317 et démarrez Arboretum avec --allow-origin https://<machine>.<tailnet>.ts.net. Le HTTPS fourni par Tailscale est aussi ce qui permet au Web Push de fonctionner.',
+      },
+      {
+        title: 'Installer comme une app (PWA)',
+        body: 'Sur mobile, ouvrez Arboretum et choisissez Ajouter à l’écran d’accueil. Sur iOS, cette installation est requise avant que les notifications puissent fonctionner.',
+      },
+    ],
+  },
+  {
+    id: 'worktrees',
+    title: 'Dépôts & worktrees',
+    blurb: 'Enregistrez vos dépôts git, puis créez un worktree isolé par branche — chacun peut démarrer une session automatiquement.',
+    items: [
+      {
+        title: 'Ajouter un dépôt',
+        body: 'Sur la page Worktrees, saisissez (ou parcourez) le chemin absolu d’un dépôt git et ajoutez-le. Les hooks post-création par dépôt (ex. npm ci) s’exécutent automatiquement sur les nouveaux worktrees.',
+      },
+      {
+        title: 'Créer un worktree',
+        body: 'Dans une section de dépôt, cliquez sur Nouveau worktree, saisissez une branche (à créer éventuellement) et démarrez si besoin une session claude ou bash. Les hooks s’exécutent automatiquement.',
+      },
+      {
+        title: 'Lire l’état d’un worktree',
+        body: 'Chaque carte affiche la branche, l’avance/le retard, le nombre de fichiers modifiés et des indicateurs (main, verrouillé, élagable), ainsi que l’état en direct de la session liée.',
+      },
+      {
+        title: 'Supprimer & élaguer',
+        body: 'Supprimez un worktree depuis sa carte (suppression forcée s’il est sale ou verrouillé), ou élaguez tous les worktrees orphelins au niveau du dépôt.',
+      },
+    ],
+  },
+  {
+    id: 'sessions',
+    title: 'Sessions & terminal web',
+    blurb: 'Lancez, observez, reprenez et répondez aux sessions Claude Code (ou bash) dans un vrai terminal xterm, directement dans le navigateur.',
+    items: [
+      {
+        title: 'Démarrer une session',
+        body: 'Sur la page Sessions, indiquez un répertoire de travail et une commande (claude ou bash) puis lancez. Ouvrez-la pour obtenir un terminal interactif.',
+      },
+      {
+        title: 'Sessions découvertes',
+        body: 'Les sessions lancées dans votre propre terminal sont détectées automatiquement et marquées « découvertes ». Observez-les en lecture seule, ou reprenez/forkez-les une fois arrêtées.',
+      },
+      {
+        title: 'Reprendre & forker',
+        body: 'Reprendre relance une session arrêtée dans son répertoire d’origine, avec tout l’historique rejoué. Forker crée une copie indépendante neuve avec la même commande et le même cwd.',
+      },
+      {
+        title: 'Observer ou interagir',
+        body: 'Quiconque ouvre une session vivante peut écrire ; ouvrez-la en observateur pour une supervision en lecture seule qui ne ralentit jamais la session.',
+      },
+      {
+        title: 'États fins',
+        body: 'Les sessions Claude gérées rapportent en temps réel les états en attente / occupé / inactif. Les sessions en attente sont remontées en premier et peuvent déclencher des notifications.',
+      },
+      {
+        title: 'Arrêter une session',
+        body: 'Arrêtez une session vivante depuis sa ligne (confirmation pour éviter les accidents) ; elle reçoit SIGTERM, puis SIGKILL après un court délai de grâce.',
+      },
+    ],
+  },
+  {
+    id: 'mobile',
+    title: 'Supervision mobile',
+    blurb: 'Faites avancer vos sessions depuis votre téléphone, sans ouvrir de terminal.',
+    items: [
+      {
+        title: 'À traiter',
+        body: 'Une bannière en haut du dashboard liste toutes les sessions bloquées sur un dialogue, avec des boutons de réponse en ligne.',
+      },
+      {
+        title: 'Répondre aux dialogues',
+        body: 'Quand Claude demande une confiance, une permission ou un choix, sélectionnez une option (ou Refuser) directement depuis la carte — sans terminal.',
+      },
+      {
+        title: 'Notifications Web Push',
+        body: 'Activez les notifications dans Réglages (ou via la cloche du pied de page). Vous recevez un push quand une session passe en attente ; touchez-le pour répondre. Exige HTTPS ; sur iOS, installez d’abord l’app.',
+      },
+    ],
+  },
+  {
+    id: 'groups',
+    title: 'Groupes de travail',
+    blurb: 'Regroupez des dépôts liés (API, web, lib partagée…) et agissez dessus ensemble.',
+    items: [
+      {
+        title: 'Créer un groupe',
+        body: 'Sur la page Groupes, nommez un groupe et choisissez ses dépôts. L’appartenance est légère et modifiable à tout moment.',
+      },
+      {
+        title: 'Liste ou grille de terminaux',
+        body: 'La vue d’un groupe affiche les worktrees et sessions de tous ses dépôts en liste, ou basculez sur la grille de terminaux pour suivre plusieurs sessions vivantes côte à côte.',
+      },
+      {
+        title: 'Feature cross-repo',
+        body: 'Créez le même worktree (et une session optionnelle) dans chaque dépôt du groupe en une seule action ; les échecs partiels sont rejouables dépôt par dépôt.',
+      },
+    ],
+  },
+  {
+    id: 'productivity',
+    title: 'Productivité',
+    blurb: 'Trouvez tout rapidement et adaptez chaque liste.',
+    items: [
+      {
+        title: 'Palette de commandes',
+        body: 'Appuyez sur ⌘K (ou Ctrl+K) pour sauter en recherche floue vers n’importe quel dépôt, worktree, session ou groupe, ou lancer une action rapide.',
+      },
+      {
+        title: 'Trier, filtrer & rechercher',
+        body: 'Chaque liste a une barre d’outils pour trier, filtrer (état, commande, source, indicateurs…) et rechercher. Vos choix persistent dans l’URL, donc les liens sont partageables.',
+      },
+      {
+        title: 'Pagination',
+        body: 'Les longues listes sont paginées avec une taille de page configurable ; choisissez Tout pour afficher l’ensemble.',
+      },
+      {
+        title: 'Langue',
+        body: 'Basculez l’interface entre l’anglais et le français à tout moment, depuis les Réglages ou le pied de page.',
+      },
+    ],
+  },
+  {
+    id: 'settings',
+    title: 'Réglages & sécurité',
+    blurb: 'Configurez l’application et gérez qui peut atteindre le daemon.',
+    items: [
+      {
+        title: 'Notifications',
+        body: 'Activez ou désactivez le Web Push et envoyez une notification de test depuis Réglages → Préférences.',
+      },
+      {
+        title: 'Jetons d’accès',
+        body: 'Créez un jeton par appareil et révoquez ceux en lesquels vous n’avez plus confiance. La valeur d’un nouveau jeton n’est affichée qu’une seule fois — copiez-la immédiatement. Le dernier jeton actif ne peut pas être révoqué, pour éviter de vous verrouiller dehors.',
+      },
+      {
+        title: 'Infos serveur',
+        body: 'Réglages → Serveur affiche la version en cours et la configuration de démarrage (port, bind, origines autorisées, répertoire de données, VAPID). Ces valeurs se définissent via des flags CLI et nécessitent un redémarrage du daemon.',
+      },
+    ],
+  },
+  {
+    id: 'integrations',
+    title: 'Intégrations',
+    blurb: 'Des raccourcis vers les outils autour de vos dépôts.',
+    items: [
+      {
+        title: 'Code source',
+        body: 'L’icône « Code source » de la navigation pointe toujours vers le dépôt source d’Arboretum sur Gitea.',
+      },
+    ],
+  },
+];
+
+export const helpSections: Record<AppLocale, HelpSection[]> = { en, fr };

spikes/s4-discovery/VERDICT.md

@@ -1,6 +1,6 @@
 # Spike S4 — Découverte JSONL + registre — VERDICT : ✅ GO
 
-Exécuté le 2026-06-11 sur la machine de Johan (CLI 2.1.170/2.1.173 actifs, transcripts 2.1.139 → 2.1.173). Script : `scan.mjs`, résultats bruts : `result.json`.
+Exécuté sur un poste de dev (CLI 2.1.170/2.1.173 actifs, transcripts 2.1.139 → 2.1.173). Script : `scan.mjs`.
 
 ## Critères Go
 

spikes/s4-discovery/result.json

@@ -1,141 +0,0 @@
-{
- "scan": {
-  "files": 1318,
-  "bytes": 470368918,
-  "ok": 1316,
-  "noCwd": 2,
-  "noSessionId": 0,
-  "empty": 0,
-  "errors": 0,
-  "mb": "449",
-  "scanMs": "1368",
-  "okPct": "99.8 %"
- },
- "mungeValidation": {
-  "mungeMatch": 1316,
-  "mungeMismatch": 0,
-  "mismatchSamples": []
- },
- "lineTypes": {
-  "user": 1315,
-  "last-prompt": 1313,
-  "attachment": 1308,
-  "assistant": 1204,
-  "queue-operation": 1001,
-  "ai-title": 470,
-  "file-history-snapshot": 431,
-  "system": 398,
-  "permission-mode": 387,
-  "agent-name": 228,
-  "mode": 219,
-  "bridge-session": 6
- },
- "versions": {
-  "2.1.139": 16,
-  "2.1.140": 86,
-  "2.1.142": 19,
-  "2.1.143": 113,
-  "2.1.144": 58,
-  "2.1.145": 81,
-  "2.1.146": 43,
-  "2.1.150": 137,
-  "2.1.152": 59,
-  "2.1.153": 18,
-  "2.1.156": 80,
-  "2.1.159": 77,
-  "2.1.160": 58,
-  "2.1.161": 102,
-  "2.1.162": 60,
-  "2.1.163": 3,
-  "2.1.165": 20,
-  "2.1.166": 6,
-  "2.1.168": 83,
-  "2.1.169": 74,
-  "2.1.170": 90,
-  "2.1.173": 33
- },
- "registry": {
-  "count": 3,
-  "entries": [
-   {
-    "file": "1061541.json",
-    "pid": 1061541,
-    "sessionId": "026cc229-c1cd-4327-9c53-68406794e870",
-    "cwd": "/home/johan/WebstormProjects",
-    "status": "busy",
-    "waitingFor": null,
-    "kind": "interactive",
-    "version": "2.1.170",
-    "peerProtocol": 1,
-    "updatedAt": 1781192047718,
-    "alive": true,
-    "procStartOk": true
-   },
-   {
-    "file": "1701999.json",
-    "pid": 1701999,
-    "sessionId": "8733906c-832a-4e74-aab7-7d8b2f5eb9d2",
-    "cwd": "/home/johan/WebstormProjects",
-    "status": "idle",
-    "waitingFor": null,
-    "kind": "interactive",
-    "version": "2.1.173",
-    "peerProtocol": 1,
-    "updatedAt": 1781191339305,
-    "alive": true,
-    "procStartOk": true
-   },
-   {
-    "file": "597768.json",
-    "pid": 597768,
-    "sessionId": "95f8eaf3-feeb-4fbe-8848-fa7a994c8d7f",
-    "cwd": "/home/johan/WebstormProjects",
-    "status": "busy",
-    "waitingFor": null,
-    "kind": "interactive",
-    "version": "2.1.170",
-    "peerProtocol": 1,
-    "updatedAt": 1781192263383,
-    "alive": true,
-    "procStartOk": true
-   }
-  ]
- },
- "attachment": {
-  "inWebstormProjects": 573,
-  "outside": 743,
-  "topDirs": {
-   "(racine)": 323,
-   "beehelp_prospect": 133,
-   "techos_web": 31,
-   "beehelp_api": 27,
-   "techos_api": 23,
-   "beehelp_web": 15,
-   "teknoroot-simulator-web": 5,
-   "beehelp_claude_marketplace": 3,
-   "beehelp_lambdas": 2,
-   "teknoroot-simulator-api": 2,
-   "Beehelp_iac": 1,
-   "Techos_V1_outdated": 1,
-   "bee-tiptap-resolver": 1,
-   "beehelp_api-wt-qualiobee-docs": 1,
-   "beehelp_api-wt": 1
-  }
- },
- "failuresSample": [
-  {
-   "fp": "/home/johan/.claude/projects/-home-johan-WebstormProjects-beehelp-api/0811ca37-c488-45aa-8a9e-5ecd6c87dfeb.jsonl",
-   "why": "pas de cwd",
-   "types": [
-    "queue-operation"
-   ]
-  },
-  {
-   "fp": "/home/johan/.claude/projects/-tmp/59e9a9f8-a5f2-4773-b1f6-72fa8b9514a9.jsonl",
-   "why": "pas de cwd",
-   "types": [
-    "queue-operation"
-   ]
-  }
- ]
-}