@playcraft/cli 0.1.0 → 0.1.1

package/dist/workspace-runtime/codex/loopback.js

@@ -1,3 +1,4 @@
+import { projectNativeThread } from '@playcraft/common/cloud-workspace/runtime';
 import { collectedEvent } from './native-adapter.js';
 /** In-process Codex stand-in. Not the App Server; used to prove the operation/event loop. */
 export function createLoopbackNativeAdapter() {
@@ -22,7 +23,7 @@ export function createLoopbackNativeAdapter() {
         },
         async startThread(input) {
             const threadId = `thread_${input.sessionId}`;
-            threads.set(threadId, { sessionId: input.sessionId });
+            threads.set(threadId, { sessionId: input.sessionId, items: [] });
             return { threadId };
         },
         async startTurn(input) {
@@ -40,6 +41,18 @@ export function createLoopbackNativeAdapter() {
             turnStarts += 1;
             const turnId = `turn_${input.sessionId}_${input.clientRequestId}`;
             thread.turnId = turnId;
+            thread.items.push({
+                type: 'userMessage',
+                id: `user_${turnId}`,
+                content: [{ type: 'text', text: input.text }],
+            });
+            if (!input.text.includes('[approval]')) {
+                thread.items.push({
+                    type: 'agentMessage',
+                    id: `agent_${turnId}`,
+                    text: `loopback:${input.text}`,
+                });
+            }
             queueMicrotask(() => {
                 emit(collectedEvent('notification', 'item/agentMessage/delta', {
                     threadId: input.threadId,
@@ -104,7 +117,24 @@ export function createLoopbackNativeAdapter() {
                     turn: { id: thread?.[1].turnId, status: 'completed' },
                 }));
             });
-            return { outcome: 'accepted', approvalId: input.approvalId, turnId: thread?.[1].turnId };
+            const found = thread?.[1];
+            if (found) {
+                found.items.push({
+                    type: 'agentMessage',
+                    id: `agent_${found.turnId ?? input.approvalId}`,
+                    text: 'after-approval',
+                });
+            }
+            return { outcome: 'accepted', approvalId: input.approvalId, turnId: found?.turnId };
+        },
+        async readThread(input) {
+            const thread = threads.get(input.threadId);
+            if (!thread || thread.sessionId !== input.sessionId)
+                return undefined;
+            return projectNativeThread(input.threadId, {
+                id: input.threadId,
+                turns: [{ items: thread.items }],
+            });
         },
     };
 }

package/dist/workspace-runtime/serve.js

@@ -12,6 +12,7 @@ import { disposeTerminalHost, terminalHost } from './server/terminal-host.js';
 import { handleExecutionGroupCrash } from './server/execution-group.js';
 import { RuntimeProcessLock } from './server/lock.js';
 import { probeGitBinary } from './workspaces/git.js';
+import { WorkspaceGitCredentialBroker } from './workspaces/git-credential-broker.js';
 export async function startWorkspaceRuntime(config, options = {}) {
     process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
     const negotiated = negotiateProtocol(config);
@@ -25,6 +26,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
     const lock = new RuntimeProcessLock(config.stateDir);
     lock.acquire();
     let journal;
+    let gitCredentials;
     try {
         journal = new RuntimeJournal(config.stateDir);
         await journal.load();
@@ -45,6 +47,10 @@ export async function startWorkspaceRuntime(config, options = {}) {
             generation: config.generation,
             runtimeEpoch: state.runtimeEpoch,
         });
+        if (config.workspaceMode === 'multi') {
+            gitCredentials = state.gitCredentials = new WorkspaceGitCredentialBroker(state);
+            await gitCredentials.start();
+        }
         attachNativeCollector(state);
         native?.onUnexpectedExit?.((event) => {
             void handleExecutionGroupCrash(state, event.pid);
@@ -79,6 +85,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
             state,
             url: `http://${formatHost(config.listen.host)}:${port}`,
             async close() {
+                await gitCredentials?.close();
                 disposeDesktopHost(state);
                 disposeTerminalHost(state);
                 await closeServer(server);
@@ -94,6 +101,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
         };
     }
     catch (error) {
+        await gitCredentials?.close().catch(() => undefined);
         await journal?.close().catch(() => undefined);
         lock.release();
         throw error;

package/dist/workspace-runtime/server/dispatch.js

@@ -469,6 +469,7 @@ async function executeRestore(state, scopeKey, operation, payload) {
 }
 async function executeDestroy(state, scopeKey, operation) {
     await state.journal.markDestroyed();
+    await state.gitCredentials?.destroy();
     disposeTerminalHost(state);
     try {
         await state.native?.close?.();

package/dist/workspace-runtime/server/http.js

@@ -1,7 +1,7 @@
 import { readObservedFile, withObservedFile } from '../workspaces/revisions.js';
 import { registerWorkspace, revisionScope, workspaceRoot, WorkspaceContextError } from '../workspaces/registry.js';
 import { randomUUID } from 'node:crypto';
-import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, runtimeError, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
 import { canExecuteKind, executeOperation } from './dispatch.js';
 import { InvalidWorkspacePathError, listWorkspaceFiles, } from '../workspaces/files.js';
@@ -64,6 +64,11 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, 200, handshake(state));
             return;
         }
+        const historyPath = sessionHistoryPath(url.pathname);
+        if (request.method === 'GET' && historyPath) {
+            await handleSessionHistory(state, response, historyPath.workspaceId, historyPath.sessionId);
+            return;
+        }
         if (isUnimplementedWorkbenchPath(url.pathname)) {
             if (writeDestroyed(state, response))
                 return;
@@ -540,9 +545,67 @@ function unavailableReason(state, kind) {
         return 'capability_not_implemented';
     return 'adapter_not_started';
 }
+function sessionHistoryPath(pathname) {
+    const match = pathname.match(/^\/runtime\/workspaces\/([^/]+)\/sessions\/([^/]+)\/history$/);
+    if (!match?.[1] || !match[2])
+        return undefined;
+    try {
+        return {
+            workspaceId: decodeURIComponent(match[1]),
+            sessionId: decodeURIComponent(match[2]),
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
 function isUnimplementedWorkbenchPath(pathname) {
     const parts = pathname.split('/').filter(Boolean);
-    return parts[0] === 'runtime' && (parts.includes('previews') || parts.includes('history'));
+    return parts[0] === 'runtime' && parts.includes('previews');
+}
+async function handleSessionHistory(state, response, workspaceId, sessionId) {
+    if (writeDestroyed(state, response))
+        return;
+    const session = state.journal.getSession(sessionId);
+    if (!session || (session.workspaceId && session.workspaceId !== workspaceId)) {
+        writeJson(response, 404, { error: 'session_not_found' });
+        return;
+    }
+    if (state.config.workspaceMode === 'multi' && session.workspaceId !== workspaceId) {
+        writeJson(response, 404, { error: 'session_not_found' });
+        return;
+    }
+    const readThread = state.native?.readThread;
+    if (!readThread) {
+        writeError(response, runtimeError('capability_unavailable', 'native_history_unavailable'));
+        return;
+    }
+    let read;
+    try {
+        read = await readThread({ threadId: session.threadId, sessionId });
+    }
+    catch {
+        writeError(response, runtimeError('capability_unavailable', 'native_history_unavailable'));
+        return;
+    }
+    if (!read || read.threadId !== session.threadId) {
+        writeError(response, runtimeError('capability_unavailable', 'native_history_unavailable'));
+        return;
+    }
+    const body = nativeHistoryReadSchema.safeParse({
+        source: 'native',
+        sessionId,
+        workspaceId,
+        threadId: read.threadId,
+        ...(read.threadName ? { threadName: read.threadName } : {}),
+        truncated: read.truncated,
+        items: read.items,
+    });
+    if (!body.success) {
+        writeError(response, runtimeError('capability_unavailable', 'native_history_unavailable'));
+        return;
+    }
+    writeJson(response, 200, body.data);
 }
 async function readObservedParameters(state, workspaceId) {
     const root = await workspaceRoot(state, workspaceId);

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -0,0 +1,276 @@
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { chmod, chown, lstat, unlink, open, mkdir, mkdtemp, writeFile, readFile, rename, rm } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { promisify } from 'node:util';
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { WorkspaceGitDirectStore } from './git-direct-store.js';
+const exec = promisify(execFile);
+/** Only this control process sees the callback credential. Development processes use the local socket. */
+export class WorkspaceGitCredentialBroker {
+    state;
+    socketPath;
+    server;
+    closed = false;
+    ready = false;
+    cache = new Map();
+    pending = new Map();
+    direct;
+    constructor(state) {
+        this.state = state;
+        this.direct = new WorkspaceGitDirectStore(state);
+        const id = createHash('sha256').update(state.config.stateDir).digest('hex').slice(0, 24);
+        this.socketPath = `/tmp/playcraft-git-${id}.sock`;
+    }
+    async start() {
+        await this.direct.sweep(this.state.journal.destroyed());
+        const old = await lstat(this.socketPath).catch(error => {
+            if (error.code !== 'ENOENT')
+                throw error;
+            return undefined;
+        });
+        if (old) {
+            if (!old.isSocket() || old.uid !== process.getuid?.())
+                throw new Error('git_broker_socket_conflict');
+            await unlink(this.socketPath);
+        }
+        const server = this.server = createServer({ maxHeaderSize: 2048, requestTimeout: 10_000 }, async (request, response) => {
+            try {
+                if (request.method !== 'POST' || request.url !== '/credential')
+                    throw new Error();
+                const chunks = [];
+                let size = 0;
+                for await (const chunk of request) {
+                    size += chunk.length;
+                    if (size > 16_384)
+                        throw new Error();
+                    chunks.push(Buffer.from(chunk));
+                }
+                const result = await this.credential(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+                response.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+                response.end(JSON.stringify(result));
+            }
+            catch {
+                response.writeHead(403, { 'cache-control': 'no-store', connection: 'close' });
+                response.end();
+            }
+        });
+        server.maxConnections = 32;
+        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(this.socketPath, resolve); });
+        // The workspace group is the image's development group; other system users cannot connect.
+        const directory = await lstat(this.state.config.workspaceRoot);
+        await chown(this.socketPath, process.getuid(), directory.gid);
+        await chmod(this.socketPath, 0o660);
+        this.ready = true;
+    }
+    async close() {
+        this.closed = true;
+        this.cache.clear();
+        if (this.server?.listening) {
+            this.server.closeAllConnections();
+            await new Promise(resolve => this.server.close(() => resolve()));
+            await unlink(this.socketPath).catch(() => undefined);
+        }
+    }
+    async configure(binding, preparation) {
+        preparation = workspacePreparationSchema.parse(preparation);
+        const transport = preparation.transport;
+        const isDirect = isLocalWorkspaceGitAuthMode(preparation.authMode);
+        if (!isDirect && transport?.kind !== 'git-gateway-v2')
+            return;
+        if (isDirect) {
+            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || (preparation.directAccess && preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
+                throw new Error('git_access_denied');
+        }
+        else {
+            const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+            if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
+                throw new Error('workspace_git_gateway_unavailable');
+        }
+        // Revocation and switching to gateway invalidate first; direct rotation keeps the old file until rename.
+        if (!isDirect)
+            await this.direct.remove(binding.workspaceId);
+        else if (preparation.directAccess === null)
+            await this.direct.put(binding, null);
+        this.cache.delete(binding.workspaceId);
+        const cloneUrl = isDirect ? binding.repositoryUrl : transport.cloneUrl;
+        const root = join(this.state.config.workspaceRoot, binding.workspaceId);
+        const helper = `!${quote(process.execPath)} ${quote(fileURLToPath(new URL('./git-credential-helper.js', import.meta.url)))} ${quote(this.socketPath)} ${quote(binding.workspaceId)}`;
+        await configureGitFile(root, this.state.config.stateDir, [
+            ...(!isDirect ? [['--replace-all', `url.${cloneUrl}.insteadOf`, binding.repositoryUrl]] : []),
+            ['--replace-all', `credential.${cloneUrl}.useHttpPath`, 'true'],
+            ['--replace-all', `credential.${cloneUrl}.helper`, ''],
+            ['--add', `credential.${cloneUrl}.helper`, helper],
+            ['--replace-all', `http.${cloneUrl}.followRedirects`, 'false'],
+            ['--replace-all', 'playcraft.gitAuthUrl', cloneUrl],
+        ], binding.repositoryUrl);
+        if (isDirect)
+            await this.direct.put(binding, preparation.directAccess);
+        this.cache.delete(binding.workspaceId);
+    }
+    async credential(input) {
+        if (!this.ready || this.closed || this.state.journal.destroyed() || !input || !['get', 'erase'].includes(input.action)
+            || typeof input.workspaceId !== 'string' || !/^[a-f0-9-]{36}$/.test(input.workspaceId)
+            || !['http', 'https'].includes(input.protocol) || typeof input.host !== 'string'
+            || typeof input.path !== 'string')
+            throw new Error('git_access_denied');
+        const binding = this.state.journal.getWorkspace(input.workspaceId);
+        if (!binding)
+            throw new Error('git_access_denied');
+        const cloneUrl = `${input.protocol}://${input.host}/${input.path}`;
+        const direct = await this.direct.get(binding);
+        if (direct) {
+            if (!direct.access || cloneUrl !== binding.repositoryUrl)
+                throw new Error('git_access_denied');
+            if (input.action === 'erase') {
+                if (input.password === direct.access.password)
+                    await this.direct.put(binding, null, input.password);
+                return {};
+            }
+            return { username: direct.access.username, password: direct.access.password };
+        }
+        const matched = matchWorkspaceGitGatewayCloneUrl(cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
+            throw new Error('git_access_denied');
+        if (input.action === 'erase') {
+            if (this.cache.get(input.workspaceId)?.preparation.gitAccess?.password === input.password)
+                this.cache.delete(input.workspaceId);
+            return {};
+        }
+        const key = JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]);
+        const cached = this.cache.get(input.workspaceId);
+        let preparation = cached?.key === key && Date.parse(cached.preparation.gitAccess.expiresAt) > Date.now() + 60_000
+            ? cached.preparation : undefined;
+        if (!preparation) {
+            const pendingKey = `${input.workspaceId}:${key}`;
+            let pending = this.pending.get(pendingKey);
+            if (!pending) {
+                pending = this.refresh(binding, key).finally(() => this.pending.delete(pendingKey));
+                this.pending.set(pendingKey, pending);
+            }
+            preparation = await pending;
+        }
+        if (await this.direct.get(binding) || preparation.transport?.cloneUrl !== cloneUrl || !preparation.gitAccess)
+            throw new Error('git_access_denied');
+        return { username: preparation.gitAccess.username, password: preparation.gitAccess.password };
+    }
+    async destroy() {
+        await this.close();
+        await this.direct.sweep(true);
+    }
+    async refresh(binding, key) {
+        const endpoint = new URL('/runtime/internal/git-credentials', this.state.config.callbackUrl);
+        if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
+            throw new Error('git_broker_unavailable');
+        const epoch = this.state.runtimeEpoch;
+        const response = await fetch(endpoint, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+            headers: { authorization: `Bearer ${this.state.config.controlToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ runtimeId: this.state.config.runtimeId, generation: this.state.config.generation,
+                runtimeEpoch: epoch, workspaceId: binding.workspaceId }),
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error('git_broker_unavailable');
+        }
+        const preparation = workspacePreparationSchema.parse(await response.json());
+        const matched = preparation.transport && matchWorkspaceGitGatewayCloneUrl(preparation.transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (this.closed || this.state.journal.destroyed() || this.state.runtimeEpoch !== epoch
+            || JSON.stringify(this.state.journal.getWorkspace(binding.workspaceId)) !== JSON.stringify(binding)
+            || preparation.transport?.kind !== 'git-gateway-v2' || !matched?.ok || matched.requestId !== `v2/${binding.workspaceId}`
+            || !preparation.gitAccess || Date.parse(preparation.gitAccess.issuedAt) > Date.now()
+            || Date.parse(preparation.gitAccess.expiresAt) <= Date.now() + 10_000)
+            throw new Error('git_access_denied');
+        if (this.cache.size >= 128)
+            this.cache.clear();
+        this.cache.set(binding.workspaceId, { key, preparation });
+        return preparation;
+    }
+}
+function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
+/** Pin directories in Linux sandboxes and replace config atomically without following user-owned symlinks. */
+async function configureGitFile(root, stateDir, commands, repositoryUrl) {
+    const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+    const directory = await open(root, directoryFlags);
+    const pinnedRoot = process.platform === 'linux' ? `/proc/self/fd/${directory.fd}` : root;
+    let gitDirectory;
+    let lock;
+    let temporary;
+    let lockPath;
+    try {
+        gitDirectory = await open(join(pinnedRoot, '.git'), directoryFlags);
+        const gitPath = process.platform === 'linux' ? `/proc/self/fd/${gitDirectory.fd}` : join(root, '.git');
+        const configPath = join(gitPath, 'config');
+        lock = await open(join(gitPath, 'config.lock'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o640);
+        lockPath = join(gitPath, 'config.lock');
+        const source = await open(configPath, constants.O_RDONLY | constants.O_NOFOLLOW);
+        let content;
+        try {
+            const stat = await source.stat();
+            if (!stat.isFile() || stat.size > 1024 * 1024 || stat.nlink !== 1)
+                throw new Error('invalid_git_config');
+            content = await source.readFile('utf8');
+            await lock.chmod(stat.mode & 0o666);
+        }
+        finally {
+            await source.close();
+        }
+        await mkdir(stateDir, { recursive: true, mode: 0o700 });
+        temporary = await mkdtemp(join(stateDir, 'git-config-'));
+        const staging = join(temporary, 'config');
+        await writeFile(staging, content, { mode: 0o600 });
+        await clearManagedGitConfig(staging, repositoryUrl);
+        for (const args of commands)
+            await exec('git', ['config', '--file', staging, '--no-includes', ...args], {
+                timeout: 5000, maxBuffer: 8192, env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+            });
+        await lock.writeFile(await readFile(staging));
+        await lock.sync();
+        await lock.close();
+        lock = undefined;
+        await rename(lockPath, configPath);
+        lockPath = undefined;
+    }
+    finally {
+        await lock?.close();
+        if (lockPath)
+            await unlink(lockPath).catch(() => undefined);
+        if (temporary)
+            await rm(temporary, { recursive: true, force: true });
+        await gitDirectory?.close();
+        await directory.close();
+    }
+}
+/** Only remove authentication/routing for this binding and previous PlayCraft endpoints. */
+async function clearManagedGitConfig(file, repositoryUrl) {
+    const run = (...args) => exec('git', ['config', '--file', file, '--no-includes', ...args], {
+        timeout: 5000, maxBuffer: 1024 * 1024,
+        env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
+    });
+    const entries = (await run('--null', '--list')).stdout.split('\0').filter(Boolean).map(entry => {
+        const newline = entry.indexOf('\n');
+        return [entry.slice(0, newline), entry.slice(newline + 1)];
+    });
+    const urls = new Set([repositoryUrl]);
+    const remove = new Set();
+    for (const [key, value] of entries) {
+        if (key === 'playcraft.gitauthurl')
+            urls.add(value);
+        const rewrite = /^url\.(.+)\.(?:insteadof|pushinsteadof)$/.exec(key);
+        if (rewrite && value === repositoryUrl) {
+            urls.add(rewrite[1]);
+            remove.add(key);
+        }
+    }
+    for (const [key] of entries) {
+        for (const url of urls) {
+            if (key.startsWith(`credential.${url}.`) || key.startsWith(`http.${url}.`))
+                remove.add(key);
+        }
+    }
+    for (const key of remove)
+        await run('--unset-all', key);
+}

package/dist/workspace-runtime/workspaces/git-credential-helper.js

@@ -0,0 +1,66 @@
+import { request } from 'node:http';
+// Git invokes this executable directly. Keep standard output exclusively for the credential protocol.
+const [socketPath, workspaceId, action] = process.argv.slice(2);
+try {
+    if (action === 'get' || action === 'erase') {
+        const fields = {};
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            size += chunk.length;
+            if (size > 16_384)
+                throw new Error();
+            chunks.push(Buffer.from(chunk));
+        }
+        for (const line of Buffer.concat(chunks).toString('utf8').split('\n')) {
+            if (!line)
+                break;
+            const separator = line.indexOf('=');
+            if (separator < 1)
+                throw new Error();
+            const key = line.slice(0, separator);
+            // Git may repeat extension fields such as capability[] and wwwauth[].
+            if (!['protocol', 'host', 'path', 'password'].includes(key))
+                continue;
+            if (key in fields)
+                throw new Error();
+            fields[key] = line.slice(separator + 1);
+        }
+        const credential = await new Promise((resolve, reject) => {
+            const client = request({ socketPath, path: '/credential', method: 'POST',
+                headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(12_000) }, async (response) => {
+                try {
+                    if (response.statusCode !== 200) {
+                        response.resume();
+                        throw new Error();
+                    }
+                    const parts = [];
+                    let length = 0;
+                    for await (const chunk of response) {
+                        length += chunk.length;
+                        if (length > 16_384)
+                            throw new Error();
+                        parts.push(Buffer.from(chunk));
+                    }
+                    resolve(JSON.parse(Buffer.concat(parts).toString('utf8')));
+                }
+                catch {
+                    reject(new Error());
+                }
+            });
+            client.once('error', reject);
+            client.end(JSON.stringify({ workspaceId, action, protocol: fields.protocol, host: fields.host,
+                path: fields.path, ...(action === 'erase' ? { password: fields.password } : {}) }));
+        });
+        if (action === 'get') {
+            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
+                throw new Error();
+            process.stdout.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
+        }
+    }
+}
+catch {
+    if (action === 'get')
+        process.stdout.write('quit=true\n\n');
+    process.exitCode = 1;
+}