@playcraft/cli 0.1.0 → 0.1.1

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -0,0 +1,154 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { join, resolve, sep } from 'node:path';
+import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema } from '@playcraft/common/cloud-workspace/runtime';
+/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
+export class WorkspaceGitDirectStore {
+    state;
+    mutation = Promise.resolve();
+    constructor(state) {
+        this.state = state;
+    }
+    exclusive(action) {
+        const result = this.mutation.then(action);
+        this.mutation = result.catch(() => undefined);
+        return result;
+    }
+    identity() {
+        const c = this.state.config;
+        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
+    }
+    name(id) {
+        if (!/^[a-f0-9-]{36}$/.test(id))
+            throw new Error('git_access_denied');
+        return `${id}.json`;
+    }
+    async directory(create, action) {
+        const stateDir = resolve(this.state.config.stateDir);
+        const directory = join(stateDir, 'direct-git');
+        if (!create && !(await lstat(directory).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        })))
+            return undefined;
+        const root = await realpath(this.state.config.workspaceRoot);
+        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
+            throw new Error('git_control_directory_rejected');
+        }
+        for (const path of [stateDir, directory]) {
+            if (path === directory && create)
+                await mkdir(path, { mode: 0o700 }).catch(error => {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                });
+            const stat = await lstat(path);
+            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
+                throw new Error('git_control_directory_rejected');
+            }
+        }
+        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+        try {
+            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
+            return await action(pinned);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async read(path) {
+        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!handle)
+            return undefined;
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
+                throw new Error('git_credential_file_rejected');
+            }
+            return JSON.parse(await handle.readFile('utf8'));
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async get(binding) {
+        return this.directory(false, async (path) => {
+            const stored = await this.read(join(path, this.name(binding.workspaceId)));
+            if (!stored)
+                return undefined;
+            if (stored.identity !== this.identity() || JSON.stringify(stored.binding) !== JSON.stringify(binding)
+                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                throw new Error('git_access_denied');
+            if (stored.access !== null) {
+                const access = workspaceGitDirectAccessSchema.parse(stored.access);
+                if (access.repositoryUrl !== binding.repositoryUrl)
+                    throw new Error('git_access_denied');
+            }
+            return stored;
+        });
+    }
+    async put(binding, access, rejectedPassword) {
+        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
+            throw new Error('git_access_denied');
+        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
+            throw new Error('git_access_denied');
+        await this.exclusive(() => this.directory(true, async (path) => {
+            const target = join(path, this.name(binding.workspaceId));
+            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
+            const old = await this.read(target);
+            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
+                return;
+            const temporary = join(path, `${randomUUID()}.tmp`);
+            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
+                await handle.sync();
+                await handle.close();
+                if (this.state.journal.destroyed())
+                    throw new Error('git_access_denied');
+                await rename(temporary, target);
+                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
+                try {
+                    await dir.sync();
+                }
+                finally {
+                    await dir.close();
+                }
+            }
+            finally {
+                await handle.close();
+                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                    throw error; });
+            }
+        }));
+    }
+    async remove(workspaceId) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            const target = join(path, this.name(workspaceId));
+            await this.read(target);
+            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
+                throw error; });
+        }));
+    }
+    async sweep(destroy = false) {
+        await this.exclusive(() => this.directory(false, async (path) => {
+            for (const name of await readdir(path)) {
+                if (!/^[a-f0-9-]{36}\.(json|tmp)$/.test(name))
+                    throw new Error('git_credential_file_rejected');
+                const target = join(path, name);
+                if (name.endsWith('.tmp')) {
+                    await unlink(target);
+                    continue;
+                }
+                const stored = await this.read(target);
+                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
+                    await unlink(target);
+            }
+        }));
+    }
+}

package/dist/workspace-runtime/workspaces/git.js

@@ -116,10 +116,23 @@ export async function pushWorkspaceGit(root) {
     if (origin.code !== 0) {
         throw new GitWorkspaceError('remote_not_configured', 'origin');
     }
-    const pushed = await gitAllowFail(rootReal, ['push', 'origin', 'HEAD'], 20000);
-    if (pushed.code !== 0) {
-        throw new GitWorkspaceError('git_command_failed', pushed.stderr.trim() || 'git_push_failed');
+    const ref = (await git(rootReal, ['symbolic-ref', '--quiet', 'HEAD'])).trim();
+    if (!ref.startsWith('refs/heads/'))
+        throw new GitWorkspaceError('git_command_failed', 'git_branch_required');
+    const commit = (await git(rootReal, ['rev-parse', '--verify', 'HEAD^{commit}'])).trim();
+    try {
+        const pushed = await gitAllowFail(rootReal, ['push', '--porcelain', 'origin', `${commit}:${ref}`], 90000);
+        if (pushed.code === 0)
+            return;
+    }
+    catch { /* A lost response does not prove the remote rejected the update. */ }
+    try {
+        const remote = await gitAllowFail(rootReal, ['ls-remote', '--refs', 'origin', ref], 20000);
+        if (remote.code === 0 && remote.stdout.trim() === `${commit}\t${ref}`)
+            return;
     }
+    catch { /* Preserve uncertainty; never replay a write automatically. */ }
+    throw new GitWorkspaceError('git_push_outcome_unknown', 'git_push_outcome_unknown');
 }
 export async function ensureWorkspaceGit(root) {
     const rootReal = await realpath(root);

package/dist/workspace-runtime/workspaces/prepare.js

@@ -1,9 +1,8 @@
 import { spawn } from 'node:child_process';
-import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { isAbsolute, join, resolve } from 'node:path';
-import { matchWorkspaceGitGatewayCloneUrl, workspaceGitAccessSchema, workspaceGitTransportSchema, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceContextError } from './context-error.js';
 /** The caller holds the Workspace lock. Only an absent, never-published checkout may be cloned. */
 export async function prepareWorkspaceCheckout(state, binding, input, leaseFence) {
@@ -11,6 +10,10 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
     if (!preparation.success)
         throw new WorkspaceContextError('invalid_workspace_preparation');
     const source = parseCloneSource(binding.repositoryUrl);
+    const direct = isLocalWorkspaceGitAuthMode(preparation.data.authMode);
+    if (direct && (!isLocalWorkspaceGitEnvironment(state.config.environment) || !preparation.data.directAccess
+        || preparation.data.directAccess.repositoryUrl !== binding.repositoryUrl))
+        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
     const parent = await realpath(state.config.workspaceRoot);
     const target = join(parent, binding.workspaceId);
     const receiptDir = join(state.config.stateDir, 'workspace-preparations');
@@ -40,19 +43,17 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
         await rm(staging, { recursive: true, force: true });
         await mkdir(staging, { mode: 0o700 });
         const access = preparation.data.gitAccess;
+        const credential = preparation.data.directAccess ?? access;
         const now = Date.now();
         if (access &&
-            (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000))
+            (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000)) {
+            await rm(staging, { recursive: true, force: true });
             throw new WorkspaceContextError('workspace_git_access_expired');
-        let gateway;
-        try {
-            gateway = access
-                ? await mountGateway(state, binding.repositoryUrl, access, preparation.data.transport)
-                : undefined;
         }
-        catch (error) {
+        const transport = preparation.data.transport;
+        if (transport && !matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, binding.repositoryUrl).ok) {
             await rm(staging, { recursive: true, force: true });
-            throw error;
+            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
         }
         const deadline = Math.min(now + 90_000, access ? Date.parse(access.expiresAt) : Infinity);
         const env = {
@@ -63,23 +64,16 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
             GIT_TERMINAL_PROMPT: '0',
             GIT_ALLOW_PROTOCOL: 'http:https',
         };
-        const cloneConfig = [];
-        if (gateway) {
-            // Rewrite only inside this process. The password is read from the mounted directory for the proxy URL.
-            env.GIT_CONFIG_COUNT = '1';
-            env.GIT_CONFIG_KEY_0 = `url.${gateway.cloneUrl}.insteadOf`;
-            env.GIT_CONFIG_VALUE_0 = binding.repositoryUrl;
-            env.PLAYCRAFT_GIT_HELPER = Buffer.from(GIT_GATEWAY_CREDENTIAL_HELPER).toString('base64');
-            env.PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY = gateway.directory;
-            env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL = gateway.cloneUrl;
-            env.PLAYCRAFT_GIT_CANONICAL_URL = binding.repositoryUrl;
-            cloneConfig.push(`credential.helper=!${shellQuote(process.execPath)} -e ${shellQuote('eval(Buffer.from(process.env.PLAYCRAFT_GIT_HELPER,"base64").toString())')}`, 'credential.useHttpPath=true');
-        }
-        else if (access) {
-            // Authentication exists only in the clone process environment; never in arguments or .git/config.
-            env.GIT_CONFIG_COUNT = '1';
-            env.GIT_CONFIG_KEY_0 = `http.${source.href}.extraHeader`;
-            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${Buffer.from(`${access.username}:${access.password}`).toString('base64')}`;
+        // The authenticated registration already carries this operation's scoped credential.
+        // No publisher ledger is mounted in the sandbox; secrets exist only in this child environment.
+        if (credential) {
+            env.GIT_CONFIG_COUNT = transport ? '2' : '1';
+            env.GIT_CONFIG_KEY_0 = `http.${transport?.cloneUrl ?? source.href}.extraHeader`;
+            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${Buffer.from(`${credential.username}:${credential.password}`).toString('base64')}`;
+            if (transport) {
+                env.GIT_CONFIG_KEY_1 = `url.${transport.cloneUrl}.insteadOf`;
+                env.GIT_CONFIG_VALUE_1 = binding.repositoryUrl;
+            }
         }
         try {
             await runGit(['check-ref-format', '--branch', binding.branchName], env, deadline);
@@ -92,7 +86,7 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
                 '--',
                 binding.repositoryUrl,
                 staging,
-            ], env, deadline, cloneConfig);
+            ], env, deadline);
             // Checkout never receives the temporary credential and never invokes repository hooks or global filters.
             clearCloneSecrets(env);
             await runGit(['-C', staging, 'checkout', '--force', binding.branchName], env, deadline);
@@ -106,6 +100,9 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
                 throw error;
             throw new WorkspaceContextError('workspace_clone_failed');
         }
+        finally {
+            clearCloneSecrets(env);
+        }
     }
     const stat = await lstat(staging).catch(() => undefined);
     if (!stat?.isDirectory() || stat.isSymbolicLink())
@@ -124,149 +121,10 @@ function clearCloneSecrets(env) {
         'GIT_CONFIG_VALUE_0',
         'GIT_CONFIG_KEY_1',
         'GIT_CONFIG_VALUE_1',
-        'PLAYCRAFT_GIT_HELPER',
-        'PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY',
-        'PLAYCRAFT_GIT_GATEWAY_CLONE_URL',
-        'PLAYCRAFT_GIT_CANONICAL_URL',
     ]) {
         delete env[key];
     }
 }
-function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
-}
-/** Read-only open of the publisher's control directory. Credentials are not copied into the checkout. */
-async function mountGateway(state, repositoryUrl, access, transport) {
-    if (!transport)
-        return undefined;
-    const directory = state.config.gitCredentialDirectory;
-    const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, repositoryUrl);
-    if (!matched.ok || !directory)
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    const parsed = workspaceGitTransportSchema.parse(transport);
-    if (parsed.cloneUrl !== transport.cloneUrl) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const entry = await readMountedEntry(directory, transport.cloneUrl, matched.requestId, repositoryUrl);
-    if (entry.username !== access.username ||
-        entry.issuedAt !== access.issuedAt ||
-        entry.expiresAt !== access.expiresAt ||
-        !sameSecret(entry.password, access.password)) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    return { directory, cloneUrl: transport.cloneUrl };
-}
-async function readMountedEntry(directory, cloneUrl, requestId, repositoryUrl) {
-    if (!isAbsolute(directory) || (await realpath(directory)) !== resolve(directory)) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const directoryStat = await lstat(directory);
-    if (!directoryStat.isDirectory() ||
-        directoryStat.isSymbolicLink() ||
-        (directoryStat.mode & 0o077) !== 0 ||
-        (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid())) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const directoryHandle = await open(directory, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_DIRECTORY);
-    await directoryHandle.close();
-    const file = await open(join(directory, 'workspace-git-credentials.json'), constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const stat = await file.stat();
-        if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > 1024 * 1024) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        const document = JSON.parse(await file.readFile('utf8'));
-        if (blocked(document).has(requestId)) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        const entries = (document.entries ?? []).filter((entry) => entry.transport &&
-            typeof entry.transport === 'object' &&
-            entry.transport.cloneUrl === cloneUrl);
-        if (entries.length !== 1)
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        const entry = entries[0];
-        if (entry.repositoryUrl !== repositoryUrl ||
-            requestIdOf(entry.command) !== requestId ||
-            requestIdOf(entry.receipt) !== requestId) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        return workspaceGitAccessSchema.parse(entry.gitAccess);
-    }
-    finally {
-        await file.close();
-    }
-}
-function requestIdOf(value) {
-    if (!value || typeof value !== 'object')
-        return undefined;
-    const id = value.requestId;
-    return typeof id === 'string' ? id : undefined;
-}
-function blocked(document) {
-    const ids = new Set();
-    for (const list of [document.retired, document.revocations]) {
-        if (list === undefined)
-            continue;
-        if (!Array.isArray(list))
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        for (const item of list) {
-            const id = requestIdOf(item);
-            if (id)
-                ids.add(id);
-        }
-    }
-    return ids;
-}
-function sameSecret(left, right) {
-    const a = Buffer.from(left);
-    const b = Buffer.from(right);
-    return a.length === b.length && timingSafeEqual(a, b);
-}
-const GIT_GATEWAY_CREDENTIAL_HELPER = `
-const fs = require('node:fs');
-const path = require('node:path');
-const action = process.argv[1];
-if (action !== 'get') process.exit(0);
-const chunks = [];
-process.stdin.on('data', (chunk) => chunks.push(chunk));
-process.stdin.on('end', () => {
-  try {
-    const fields = {};
-    for (const line of Buffer.concat(chunks).toString('utf8').split('\\n')) {
-      if (!line) continue;
-      const index = line.indexOf('=');
-      if (index > 0) fields[line.slice(0, index)] = line.slice(index + 1);
-    }
-    const cloneUrl = new URL(process.env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL);
-    const canonical = new URL(process.env.PLAYCRAFT_GIT_CANONICAL_URL);
-    if (!fields.path || !fields.protocol || !fields.host) process.exit(1);
-    const requested = new URL(fields.protocol + '://' + fields.host + '/' + String(fields.path).replace(/^\\/+/, ''));
-    if (requested.origin !== cloneUrl.origin || requested.pathname !== cloneUrl.pathname || requested.origin === canonical.origin) process.exit(1);
-    const requestId = cloneUrl.pathname.split('/').pop();
-    const directory = process.env.PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY;
-    const flags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;
-    const dir = fs.openSync(directory, flags | (fs.constants.O_DIRECTORY || 0));
-    try {
-      if (!fs.fstatSync(dir).isDirectory()) process.exit(1);
-    } finally { fs.closeSync(dir); }
-    const file = fs.openSync(path.join(directory, 'workspace-git-credentials.json'), flags);
-    try {
-      const stat = fs.fstatSync(file);
-      if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > 1024 * 1024) process.exit(1);
-      const document = JSON.parse(fs.readFileSync(file, 'utf8'));
-      const blocked = [...(document.retired || []), ...(document.revocations || [])];
-      if (blocked.some((item) => item && item.requestId === requestId)) process.exit(1);
-      const entries = (document.entries || []).filter((entry) => entry && entry.transport && entry.transport.cloneUrl === process.env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL && entry.repositoryUrl === process.env.PLAYCRAFT_GIT_CANONICAL_URL);
-      if (entries.length !== 1) process.exit(1);
-      const access = entries[0].gitAccess || {};
-      if (Date.parse(access.issuedAt) > Date.now() || Date.parse(access.expiresAt) <= Date.now() + 10000) process.exit(1);
-      if (!access.username || !access.password || /[\\r\\n\\0]/.test(access.username) || /[\\r\\n\\0]/.test(access.password)) process.exit(1);
-      process.stdout.write('username=' + access.username + '\\npassword=' + access.password + '\\n');
-      process.exit(0);
-    } finally { fs.closeSync(file); }
-  } catch { process.exit(1); }
-});
-`;
 function parseCloneSource(value) {
     try {
         const source = new URL(value);
@@ -316,7 +174,7 @@ async function writeReceipt(path, value) {
     await writeFile(temp, `${JSON.stringify(value)}\n`, { mode: 0o600 });
     await rename(temp, path);
 }
-function runGit(args, env, deadline, config = []) {
+function runGit(args, env, deadline) {
     return new Promise((resolve, reject) => {
         let timedOut = false;
         const child = spawn('git', [
@@ -324,7 +182,6 @@ function runGit(args, env, deadline, config = []) {
             'core.hooksPath=/dev/null',
             '-c',
             'credential.helper=',
-            ...config.flatMap((item) => ['-c', item]),
             '-c',
             'http.followRedirects=false',
             '-c',

package/dist/workspace-runtime/workspaces/registry.js

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import { lstat, realpath } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { promisify } from 'node:util';
-import { workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { isLocalWorkspaceGitAuthMode, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { prepareWorkspaceCheckout } from './prepare.js';
 import { WorkspaceContextError } from './context-error.js';
 export { WorkspaceContextError } from './context-error.js';
@@ -87,7 +87,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
         })).stdout.trim();
         try {
             if ((await realpath(await git('rev-parse', '--show-toplevel'))) !== root ||
-                (await git('remote', 'get-url', 'origin')) !== binding.repositoryUrl ||
+                (await git('config', '--get', 'remote.origin.url')) !== binding.repositoryUrl ||
                 (await git('symbolic-ref', '--short', 'HEAD')) !== binding.branchName) {
                 throw new WorkspaceContextError('workspace_checkout_mismatch');
             }
@@ -101,6 +101,16 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
             throw new WorkspaceContextError('runtime_destroyed');
         if (leaseFence < state.acceptedLeaseFence)
             throw new WorkspaceContextError('stale_lease');
+        if (preparation?.transport?.kind === 'git-gateway-v2' || isLocalWorkspaceGitAuthMode(preparation?.authMode)) {
+            if (!state.gitCredentials)
+                throw new WorkspaceContextError('workspace_git_gateway_unavailable');
+            try {
+                await state.gitCredentials.configure(binding, preparation);
+            }
+            catch {
+                throw new WorkspaceContextError('workspace_git_gateway_unavailable');
+            }
+        }
         await state.journal.putWorkspace(binding);
         return binding;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "private": false,
   "type": "module",
   "engines": {
@@ -24,7 +24,7 @@
     "dev": "tsc -w",
     "build": "tsc",
     "start": "node dist/index.js",
-    "test": "vitest run",
+    "test": "pnpm build && vitest run",
     "test:agent": "node scripts/run-agent-tests.mjs --list",
     "test:agent:designer": "node scripts/run-agent-tests.mjs game-designer",
     "test:agent:developer": "node scripts/run-agent-tests.mjs developer",
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.0",
-    "@playcraft/common": "^0.1.0",
+    "@playcraft/build": "^0.1.1",
+    "@playcraft/common": "^0.1.1",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",