fix: bind sync state to active vault

internal/core/sync/client.go

@@ -77,12 +77,13 @@ func NewClient(serverURL, apiKey, deviceID, vaultRoot string) *Client {
 }
 
 // PairDevice calls POST /api/client/pair and returns device_id and device_token.
-func (c *Client) PairDevice(serverURL, username, password, deviceName, clientVersion string) (deviceID, deviceToken string, err error) {
+func (c *Client) PairDevice(serverURL, username, password, deviceName, clientVersion, vaultID string) (deviceID, deviceToken string, err error) {
 	body := map[string]string{
 		"login":          username,
 		"password":       password,
 		"device_name":    deviceName,
 		"client_version": clientVersion,
+		"vault_id":       vaultID,
 	}
 	var resp struct {
 		DeviceID    string `json:"device_id"`

internal/core/sync/client_test.go

@@ -86,3 +86,36 @@ func TestPushDoesNotRetryClientErrors(t *testing.T) {
 		t.Fatalf("attempts = %d, want 1", attempts)
 	}
 }
+
+func TestPairDeviceSendsVaultID(t *testing.T) {
+	var pairedVaultID string
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/api/client/pair" {
+			http.NotFound(w, r)
+			return
+		}
+		var request struct {
+			VaultID string `json:"vault_id"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		pairedVaultID = request.VaultID
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]string{
+			"device_id":    "device-1",
+			"device_token": "token-1",
+		})
+	}))
+	defer server.Close()
+
+	client := NewClient(server.URL, "", "", t.TempDir())
+	_, _, err := client.PairDevice(server.URL, "alice", "secret", "Desktop", "verstak-desktop/v2", "vault-123")
+	if err != nil {
+		t.Fatalf("PairDevice: %v", err)
+	}
+	if pairedVaultID != "vault-123" {
+		t.Fatalf("paired vault ID = %q, want vault-123", pairedVaultID)
+	}
+}

internal/core/sync/service.go

@@ -60,7 +60,13 @@ type Service struct {
 
 // NewService creates a sync service.
 func NewService(vaultRoot, deviceID string) *Service {
-	return &Service{vaultRoot: vaultRoot, deviceID: deviceID}
+	service := &Service{vaultRoot: vaultRoot, deviceID: deviceID}
+	if deviceID == "" {
+		if state, err := service.loadState(); err == nil {
+			service.deviceID = state.DeviceID
+		}
+	}
+	return service
 }
 
 func (s *Service) syncDir() string {
@@ -212,6 +218,9 @@ func (s *Service) SetState(serverURL, apiKey string) error {
 	}
 	st.ServerURL = serverURL
 	st.APIKey = apiKey
+	if s.deviceID != "" {
+		st.DeviceID = s.deviceID
+	}
 	return s.saveState(st)
 }
 
@@ -240,6 +249,23 @@ func (s *Service) GetDeviceID() string {
 	return s.deviceID
 }
 
+// SetDeviceID persists the device ID for this vault's sync state.
+func (s *Service) SetDeviceID(deviceID string) error {
+	if err := s.ensureDir(); err != nil {
+		return err
+	}
+	st, err := s.loadState()
+	if err != nil {
+		st = &syncState{}
+	}
+	st.DeviceID = deviceID
+	if err := s.saveState(st); err != nil {
+		return err
+	}
+	s.deviceID = deviceID
+	return nil
+}
+
 // --- file helpers ---
 
 func (s *Service) loadOps() ([]Op, error) {