@playcraft/cli 0.1.0 → 0.1.2

package/dist/workspace-runtime/workspaces/prepare.js

@@ -1,9 +1,8 @@
 import { spawn } from 'node:child_process';
-import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { isAbsolute, join, resolve } from 'node:path';
-import { matchWorkspaceGitGatewayCloneUrl, workspaceGitAccessSchema, workspaceGitTransportSchema, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceContextError } from './context-error.js';
 /** The caller holds the Workspace lock. Only an absent, never-published checkout may be cloned. */
 export async function prepareWorkspaceCheckout(state, binding, input, leaseFence) {
@@ -11,6 +10,10 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
     if (!preparation.success)
         throw new WorkspaceContextError('invalid_workspace_preparation');
     const source = parseCloneSource(binding.repositoryUrl);
+    const direct = isLocalWorkspaceGitAuthMode(preparation.data.authMode);
+    if (direct && (!isLocalWorkspaceGitEnvironment(state.config.environment) || !preparation.data.directAccess
+        || preparation.data.directAccess.repositoryUrl !== binding.repositoryUrl))
+        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
     const parent = await realpath(state.config.workspaceRoot);
     const target = join(parent, binding.workspaceId);
     const receiptDir = join(state.config.stateDir, 'workspace-preparations');
@@ -40,19 +43,17 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
         await rm(staging, { recursive: true, force: true });
         await mkdir(staging, { mode: 0o700 });
         const access = preparation.data.gitAccess;
+        const credential = preparation.data.directAccess ?? access;
         const now = Date.now();
         if (access &&
-            (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000))
+            (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000)) {
+            await rm(staging, { recursive: true, force: true });
             throw new WorkspaceContextError('workspace_git_access_expired');
-        let gateway;
-        try {
-            gateway = access
-                ? await mountGateway(state, binding.repositoryUrl, access, preparation.data.transport)
-                : undefined;
         }
-        catch (error) {
+        const transport = preparation.data.transport;
+        if (transport && !matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, binding.repositoryUrl).ok) {
             await rm(staging, { recursive: true, force: true });
-            throw error;
+            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
         }
         const deadline = Math.min(now + 90_000, access ? Date.parse(access.expiresAt) : Infinity);
         const env = {
@@ -63,23 +64,16 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
             GIT_TERMINAL_PROMPT: '0',
             GIT_ALLOW_PROTOCOL: 'http:https',
         };
-        const cloneConfig = [];
-        if (gateway) {
-            // Rewrite only inside this process. The password is read from the mounted directory for the proxy URL.
-            env.GIT_CONFIG_COUNT = '1';
-            env.GIT_CONFIG_KEY_0 = `url.${gateway.cloneUrl}.insteadOf`;
-            env.GIT_CONFIG_VALUE_0 = binding.repositoryUrl;
-            env.PLAYCRAFT_GIT_HELPER = Buffer.from(GIT_GATEWAY_CREDENTIAL_HELPER).toString('base64');
-            env.PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY = gateway.directory;
-            env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL = gateway.cloneUrl;
-            env.PLAYCRAFT_GIT_CANONICAL_URL = binding.repositoryUrl;
-            cloneConfig.push(`credential.helper=!${shellQuote(process.execPath)} -e ${shellQuote('eval(Buffer.from(process.env.PLAYCRAFT_GIT_HELPER,"base64").toString())')}`, 'credential.useHttpPath=true');
-        }
-        else if (access) {
-            // Authentication exists only in the clone process environment; never in arguments or .git/config.
-            env.GIT_CONFIG_COUNT = '1';
-            env.GIT_CONFIG_KEY_0 = `http.${source.href}.extraHeader`;
-            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${Buffer.from(`${access.username}:${access.password}`).toString('base64')}`;
+        // The authenticated registration already carries this operation's scoped credential.
+        // No publisher ledger is mounted in the sandbox; secrets exist only in this child environment.
+        if (credential) {
+            env.GIT_CONFIG_COUNT = transport ? '2' : '1';
+            env.GIT_CONFIG_KEY_0 = `http.${transport?.cloneUrl ?? source.href}.extraHeader`;
+            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${Buffer.from(`${credential.username}:${credential.password}`).toString('base64')}`;
+            if (transport) {
+                env.GIT_CONFIG_KEY_1 = `url.${transport.cloneUrl}.insteadOf`;
+                env.GIT_CONFIG_VALUE_1 = binding.repositoryUrl;
+            }
         }
         try {
             await runGit(['check-ref-format', '--branch', binding.branchName], env, deadline);
@@ -92,7 +86,7 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
                 '--',
                 binding.repositoryUrl,
                 staging,
-            ], env, deadline, cloneConfig);
+            ], env, deadline);
             // Checkout never receives the temporary credential and never invokes repository hooks or global filters.
             clearCloneSecrets(env);
             await runGit(['-C', staging, 'checkout', '--force', binding.branchName], env, deadline);
@@ -106,6 +100,9 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
                 throw error;
             throw new WorkspaceContextError('workspace_clone_failed');
         }
+        finally {
+            clearCloneSecrets(env);
+        }
     }
     const stat = await lstat(staging).catch(() => undefined);
     if (!stat?.isDirectory() || stat.isSymbolicLink())
@@ -124,149 +121,10 @@ function clearCloneSecrets(env) {
         'GIT_CONFIG_VALUE_0',
         'GIT_CONFIG_KEY_1',
         'GIT_CONFIG_VALUE_1',
-        'PLAYCRAFT_GIT_HELPER',
-        'PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY',
-        'PLAYCRAFT_GIT_GATEWAY_CLONE_URL',
-        'PLAYCRAFT_GIT_CANONICAL_URL',
     ]) {
         delete env[key];
     }
 }
-function shellQuote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
-}
-/** Read-only open of the publisher's control directory. Credentials are not copied into the checkout. */
-async function mountGateway(state, repositoryUrl, access, transport) {
-    if (!transport)
-        return undefined;
-    const directory = state.config.gitCredentialDirectory;
-    const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, repositoryUrl);
-    if (!matched.ok || !directory)
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    const parsed = workspaceGitTransportSchema.parse(transport);
-    if (parsed.cloneUrl !== transport.cloneUrl) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const entry = await readMountedEntry(directory, transport.cloneUrl, matched.requestId, repositoryUrl);
-    if (entry.username !== access.username ||
-        entry.issuedAt !== access.issuedAt ||
-        entry.expiresAt !== access.expiresAt ||
-        !sameSecret(entry.password, access.password)) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    return { directory, cloneUrl: transport.cloneUrl };
-}
-async function readMountedEntry(directory, cloneUrl, requestId, repositoryUrl) {
-    if (!isAbsolute(directory) || (await realpath(directory)) !== resolve(directory)) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const directoryStat = await lstat(directory);
-    if (!directoryStat.isDirectory() ||
-        directoryStat.isSymbolicLink() ||
-        (directoryStat.mode & 0o077) !== 0 ||
-        (typeof process.getuid === 'function' && directoryStat.uid !== process.getuid())) {
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    }
-    const directoryHandle = await open(directory, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_DIRECTORY);
-    await directoryHandle.close();
-    const file = await open(join(directory, 'workspace-git-credentials.json'), constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const stat = await file.stat();
-        if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > 1024 * 1024) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        const document = JSON.parse(await file.readFile('utf8'));
-        if (blocked(document).has(requestId)) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        const entries = (document.entries ?? []).filter((entry) => entry.transport &&
-            typeof entry.transport === 'object' &&
-            entry.transport.cloneUrl === cloneUrl);
-        if (entries.length !== 1)
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        const entry = entries[0];
-        if (entry.repositoryUrl !== repositoryUrl ||
-            requestIdOf(entry.command) !== requestId ||
-            requestIdOf(entry.receipt) !== requestId) {
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        return workspaceGitAccessSchema.parse(entry.gitAccess);
-    }
-    finally {
-        await file.close();
-    }
-}
-function requestIdOf(value) {
-    if (!value || typeof value !== 'object')
-        return undefined;
-    const id = value.requestId;
-    return typeof id === 'string' ? id : undefined;
-}
-function blocked(document) {
-    const ids = new Set();
-    for (const list of [document.retired, document.revocations]) {
-        if (list === undefined)
-            continue;
-        if (!Array.isArray(list))
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        for (const item of list) {
-            const id = requestIdOf(item);
-            if (id)
-                ids.add(id);
-        }
-    }
-    return ids;
-}
-function sameSecret(left, right) {
-    const a = Buffer.from(left);
-    const b = Buffer.from(right);
-    return a.length === b.length && timingSafeEqual(a, b);
-}
-const GIT_GATEWAY_CREDENTIAL_HELPER = `
-const fs = require('node:fs');
-const path = require('node:path');
-const action = process.argv[1];
-if (action !== 'get') process.exit(0);
-const chunks = [];
-process.stdin.on('data', (chunk) => chunks.push(chunk));
-process.stdin.on('end', () => {
-  try {
-    const fields = {};
-    for (const line of Buffer.concat(chunks).toString('utf8').split('\\n')) {
-      if (!line) continue;
-      const index = line.indexOf('=');
-      if (index > 0) fields[line.slice(0, index)] = line.slice(index + 1);
-    }
-    const cloneUrl = new URL(process.env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL);
-    const canonical = new URL(process.env.PLAYCRAFT_GIT_CANONICAL_URL);
-    if (!fields.path || !fields.protocol || !fields.host) process.exit(1);
-    const requested = new URL(fields.protocol + '://' + fields.host + '/' + String(fields.path).replace(/^\\/+/, ''));
-    if (requested.origin !== cloneUrl.origin || requested.pathname !== cloneUrl.pathname || requested.origin === canonical.origin) process.exit(1);
-    const requestId = cloneUrl.pathname.split('/').pop();
-    const directory = process.env.PLAYCRAFT_GIT_CREDENTIAL_DIRECTORY;
-    const flags = fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW;
-    const dir = fs.openSync(directory, flags | (fs.constants.O_DIRECTORY || 0));
-    try {
-      if (!fs.fstatSync(dir).isDirectory()) process.exit(1);
-    } finally { fs.closeSync(dir); }
-    const file = fs.openSync(path.join(directory, 'workspace-git-credentials.json'), flags);
-    try {
-      const stat = fs.fstatSync(file);
-      if (!stat.isFile() || (stat.mode & 0o077) !== 0 || stat.size > 1024 * 1024) process.exit(1);
-      const document = JSON.parse(fs.readFileSync(file, 'utf8'));
-      const blocked = [...(document.retired || []), ...(document.revocations || [])];
-      if (blocked.some((item) => item && item.requestId === requestId)) process.exit(1);
-      const entries = (document.entries || []).filter((entry) => entry && entry.transport && entry.transport.cloneUrl === process.env.PLAYCRAFT_GIT_GATEWAY_CLONE_URL && entry.repositoryUrl === process.env.PLAYCRAFT_GIT_CANONICAL_URL);
-      if (entries.length !== 1) process.exit(1);
-      const access = entries[0].gitAccess || {};
-      if (Date.parse(access.issuedAt) > Date.now() || Date.parse(access.expiresAt) <= Date.now() + 10000) process.exit(1);
-      if (!access.username || !access.password || /[\\r\\n\\0]/.test(access.username) || /[\\r\\n\\0]/.test(access.password)) process.exit(1);
-      process.stdout.write('username=' + access.username + '\\npassword=' + access.password + '\\n');
-      process.exit(0);
-    } finally { fs.closeSync(file); }
-  } catch { process.exit(1); }
-});
-`;
 function parseCloneSource(value) {
     try {
         const source = new URL(value);
@@ -316,7 +174,7 @@ async function writeReceipt(path, value) {
     await writeFile(temp, `${JSON.stringify(value)}\n`, { mode: 0o600 });
     await rename(temp, path);
 }
-function runGit(args, env, deadline, config = []) {
+function runGit(args, env, deadline) {
     return new Promise((resolve, reject) => {
         let timedOut = false;
         const child = spawn('git', [
@@ -324,7 +182,6 @@ function runGit(args, env, deadline, config = []) {
             'core.hooksPath=/dev/null',
             '-c',
             'credential.helper=',
-            ...config.flatMap((item) => ['-c', item]),
             '-c',
             'http.followRedirects=false',
             '-c',

package/dist/workspace-runtime/workspaces/registry.js

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import { lstat, realpath } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { promisify } from 'node:util';
-import { workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { isLocalWorkspaceGitAuthMode, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { prepareWorkspaceCheckout } from './prepare.js';
 import { WorkspaceContextError } from './context-error.js';
 export { WorkspaceContextError } from './context-error.js';
@@ -87,7 +87,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
         })).stdout.trim();
         try {
             if ((await realpath(await git('rev-parse', '--show-toplevel'))) !== root ||
-                (await git('remote', 'get-url', 'origin')) !== binding.repositoryUrl ||
+                (await git('config', '--get', 'remote.origin.url')) !== binding.repositoryUrl ||
                 (await git('symbolic-ref', '--short', 'HEAD')) !== binding.branchName) {
                 throw new WorkspaceContextError('workspace_checkout_mismatch');
             }
@@ -101,6 +101,16 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
             throw new WorkspaceContextError('runtime_destroyed');
         if (leaseFence < state.acceptedLeaseFence)
             throw new WorkspaceContextError('stale_lease');
+        if (preparation?.transport?.kind === 'git-gateway-v2' || isLocalWorkspaceGitAuthMode(preparation?.authMode)) {
+            if (!state.gitCredentials)
+                throw new WorkspaceContextError('workspace_git_gateway_unavailable');
+            try {
+                await state.gitCredentials.configure(binding, preparation);
+            }
+            catch {
+                throw new WorkspaceContextError('workspace_git_gateway_unavailable');
+            }
+        }
         await state.journal.putWorkspace(binding);
         return binding;
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "private": false,
   "type": "module",
   "engines": {
@@ -24,7 +24,7 @@
     "dev": "tsc -w",
     "build": "tsc",
     "start": "node dist/index.js",
-    "test": "vitest run",
+    "test": "pnpm build && vitest run",
     "test:agent": "node scripts/run-agent-tests.mjs --list",
     "test:agent:designer": "node scripts/run-agent-tests.mjs game-designer",
     "test:agent:developer": "node scripts/run-agent-tests.mjs developer",
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.0",
-    "@playcraft/common": "^0.1.0",
+    "@playcraft/build": "^0.1.2",
+    "@playcraft/common": "^0.1.2",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",