@playcraft/cli 0.1.1 → 0.1.2

package/dist/workspace-runtime/codex/app-server.js

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 import { writePlaycraftCodexConfig } from './config-toml.js';
 import { createJsonRpcStdioClient } from './jsonrpc-stdio.js';
 import { projectNativeThread } from '@playcraft/common/cloud-workspace/runtime';
-import { collectedEvent } from './native-adapter.js';
+import { collectedEvent, NativePreparationError } from './native-adapter.js';
 function asRecord(value) {
     return value && typeof value === 'object' && !Array.isArray(value)
         ? value
@@ -74,8 +74,20 @@ export function createCodexAppServerAdapter(options) {
         startPromise ??= start();
         await startPromise;
     }
+    async function threadConfig(cwd) {
+        try {
+            return await options.modelBroker?.threadConfig(cwd) ?? {};
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : '';
+            throw new NativePreparationError(['model_config_required', 'model_callback_insecure',
+                'model_credential_scope_mismatch', 'workspace_not_registered'].includes(reason)
+                ? reason : 'model_credential_unavailable');
+        }
+    }
     async function start() {
-        const token = await readToken(options);
+        await options.modelBroker?.start();
+        const token = options.modelBroker ? 'workspace-broker-managed' : await readToken(options);
         const bin = options.command || process.env.PLAYCRAFT_CODEX_BIN || (launcherSocket ? '/usr/local/bin/codex' : 'codex');
         const { command, prefix } = spawnCommand(bin);
         const args = [...prefix, ...(options.args ?? ['app-server'])];
@@ -98,7 +110,9 @@ export function createCodexAppServerAdapter(options) {
                 processId: `codex-${randomUUID()}`,
                 runtimeEpoch: executionEpoch,
                 argv: [command, ...args],
-                cwd: options.config.workspaceRoot,
+                // The launcher admits the dev home, not the shared /workspaces root.
+                // Each thread supplies its registered workspace separately.
+                cwd: options.config.workspaceMode === 'multi' ? '/home/playcraft-dev' : options.config.workspaceRoot,
                 env: { CODEX_HOME: homeDir, OPENAI_API_KEY: token },
             });
         }
@@ -230,7 +244,8 @@ export function createCodexAppServerAdapter(options) {
             if (!rpc)
                 return false;
             try {
-                const result = await rpc.request('thread/resume', { threadId: input.threadId, cwd: input.cwd }, 30_000);
+                const result = await rpc.request('thread/resume', { threadId: input.threadId, cwd: input.cwd,
+                    ...await threadConfig(input.cwd ?? '') }, 30_000);
                 const resumedId = result.thread?.id ?? result.threadId;
                 if (resumedId !== input.threadId)
                     return false;
@@ -275,6 +290,7 @@ export function createCodexAppServerAdapter(options) {
             const result = await rpc.request('thread/start', {
                 cwd: input.cwd,
                 model,
+                ...await threadConfig(input.cwd),
             });
             const threadId = result.thread?.id;
             if (!threadId)
@@ -356,6 +372,7 @@ export function createCodexAppServerAdapter(options) {
                 await current.stop();
             child = undefined;
             live = undefined;
+            await options.modelBroker?.close();
         },
     };
 }

package/dist/workspace-runtime/codex/model-broker.js

@@ -0,0 +1,183 @@
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import { createServer } from 'node:http';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { basename } from 'node:path';
+import { z } from 'zod';
+import { workspaceRoot } from '../workspaces/registry.js';
+const credentialSchema = z.object({
+    token: z.string().min(1), expiresAt: z.string().datetime(),
+    configId: z.string().uuid(), model: z.string().min(1).max(128),
+    claims: z.object({
+        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
+        generation: z.number().int(), runtimeEpoch: z.number().int(),
+    }),
+});
+/** Keeps renewable execution credentials in control memory, outside Codex and project files. */
+export class WorkspaceModelBroker {
+    state;
+    server;
+    baseUrl = '';
+    entries = new Map();
+    pending = new Map();
+    requests = new Set();
+    constructor(state) {
+        this.state = state;
+    }
+    async start() {
+        if (this.server)
+            return;
+        const server = createServer({ maxHeaderSize: 8192 }, (request, response) => {
+            void this.forward(request, response);
+        });
+        await new Promise((resolve, reject) => {
+            server.once('error', reject);
+            server.listen(0, '127.0.0.1', resolve);
+        });
+        this.server = server;
+        const address = server.address();
+        if (!address || typeof address === 'string')
+            throw new Error('model_broker_unavailable');
+        this.baseUrl = `http://127.0.0.1:${address.port}`;
+    }
+    async threadConfig(cwd) {
+        const workspaceId = basename(cwd);
+        if (!this.server || await workspaceRoot(this.state, workspaceId) !== cwd)
+            throw new Error('workspace_not_registered');
+        let entry = this.entries.get(workspaceId);
+        if (!entry || entry.epoch !== this.state.runtimeEpoch) {
+            entry = { workspaceId, epoch: this.state.runtimeEpoch, capability: randomBytes(32).toString('base64url') };
+            this.entries.set(workspaceId, entry);
+        }
+        const credential = await this.credential(entry);
+        return {
+            model: credential.model,
+            modelProvider: 'playcraft_workspace',
+            config: {
+                'model_providers.playcraft_workspace': {
+                    name: 'PlayCraft Workspace', base_url: `${this.baseUrl}/${workspaceId}`,
+                    wire_api: 'responses', requires_openai_auth: false,
+                    http_headers: { Authorization: `Bearer ${entry.capability}` },
+                },
+            },
+        };
+    }
+    valid(entry) {
+        return Boolean(this.server && !this.state.journal.destroyed()
+            && this.state.runtimeEpoch === entry.epoch && this.state.journal.getWorkspace(entry.workspaceId)
+            && this.entries.get(entry.workspaceId) === entry);
+    }
+    async credential(entry) {
+        if (!this.valid(entry))
+            throw new Error('model_access_denied');
+        if (entry.credential && Date.parse(entry.credential.expiresAt) > Date.now() + 60_000)
+            return entry.credential;
+        let pending = this.pending.get(entry);
+        if (!pending) {
+            pending = this.renew(entry).finally(() => this.pending.delete(entry));
+            this.pending.set(entry, pending);
+        }
+        return pending;
+    }
+    async renew(entry) {
+        const config = this.state.config;
+        const endpoint = new URL('/runtime/internal/model-credentials', config.callbackUrl);
+        if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:'
+            && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
+            throw new Error('model_callback_insecure');
+        const response = await fetch(endpoint, {
+            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+            headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
+                runtimeEpoch: entry.epoch, workspaceId: entry.workspaceId }),
+        });
+        if (!response.ok) {
+            const error = await response.json().catch(() => ({}));
+            throw new Error(error.reason === 'model_config_required' ? 'model_config_required' : 'model_credential_unavailable');
+        }
+        const credential = credentialSchema.parse(await response.json());
+        const claims = credential.claims;
+        if (!this.valid(entry) || claims.workspaceId !== entry.workspaceId || claims.runtimeId !== config.runtimeId
+            || claims.userId !== config.userId || claims.environment !== config.environment
+            || claims.generation !== config.generation || claims.runtimeEpoch !== entry.epoch
+            || Date.parse(credential.expiresAt) <= Date.now() + 1000)
+            throw new Error('model_credential_scope_mismatch');
+        entry.credential = credential;
+        return credential;
+    }
+    async forward(request, response) {
+        const abort = new AbortController();
+        this.requests.add(abort);
+        const cancel = () => abort.abort();
+        response.once('close', cancel);
+        try {
+            const match = /^\/([0-9a-f-]{36})\/responses$/.exec(request.url ?? '');
+            const entry = match && this.entries.get(match[1]);
+            const presented = Buffer.from(request.headers.authorization ?? '');
+            const expected = Buffer.from(entry ? `Bearer ${entry.capability}` : '');
+            if (request.method !== 'POST' || !entry || !expected.length || presented.length !== expected.length
+                || !timingSafeEqual(presented, expected) || !this.valid(entry)) {
+                response.writeHead(403);
+                response.end();
+                return;
+            }
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of request) {
+                size += chunk.length;
+                if (size > 16 * 1024 * 1024) {
+                    response.writeHead(413);
+                    response.end();
+                    return;
+                }
+                chunks.push(Buffer.from(chunk));
+            }
+            const credential = await this.credential(entry);
+            if (!this.valid(entry))
+                throw new Error('model_access_denied');
+            const expires = setTimeout(cancel, Math.max(0, Date.parse(credential.expiresAt) - Date.now()));
+            try {
+                const upstream = await fetch(`${this.state.config.modelProxyUrl.replace(/\/+$/, '')}/v1/${credential.configId}/responses`, {
+                    method: 'POST', redirect: 'error', signal: abort.signal,
+                    headers: { authorization: `Bearer ${credential.token}`, 'content-type': 'application/json' },
+                    body: Buffer.concat(chunks),
+                });
+                if (upstream.status === 401 || upstream.status === 403)
+                    entry.credential = undefined;
+                response.writeHead(upstream.status, {
+                    'content-type': upstream.headers.get('content-type') ?? 'application/json', 'cache-control': 'no-store',
+                });
+                if (upstream.body)
+                    await pipeline(Readable.fromWeb(upstream.body), response);
+                else
+                    response.end();
+            }
+            finally {
+                clearTimeout(expires);
+            }
+        }
+        catch {
+            if (!response.headersSent) {
+                response.writeHead(503, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+                response.end(JSON.stringify({ error: { message: 'model_credential_unavailable', type: 'server_error' } }));
+            }
+            else
+                response.destroy();
+        }
+        finally {
+            response.off('close', cancel);
+            this.requests.delete(abort);
+        }
+    }
+    async close() {
+        const server = this.server;
+        this.server = undefined;
+        this.entries.clear();
+        for (const request of this.requests)
+            request.abort();
+        if (server) {
+            server.closeAllConnections();
+            await new Promise(resolve => server.close(() => resolve()));
+        }
+    }
+}

package/dist/workspace-runtime/codex/native-adapter.js

@@ -1,3 +1,6 @@
+/** Failure before a native request was sent; safe to report as failed instead of uncertain. */
+export class NativePreparationError extends Error {
+}
 export function nativeEvent(type, payload) {
     return { type, payload, occurredAt: new Date().toISOString() };
 }

package/dist/workspace-runtime/serve.js

@@ -13,6 +13,7 @@ import { handleExecutionGroupCrash } from './server/execution-group.js';
 import { RuntimeProcessLock } from './server/lock.js';
 import { probeGitBinary } from './workspaces/git.js';
 import { WorkspaceGitCredentialBroker } from './workspaces/git-credential-broker.js';
+import { WorkspaceModelBroker } from './codex/model-broker.js';
 export async function startWorkspaceRuntime(config, options = {}) {
     process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
     const negotiated = negotiateProtocol(config);
@@ -31,17 +32,17 @@ export async function startWorkspaceRuntime(config, options = {}) {
         journal = new RuntimeJournal(config.stateDir);
         await journal.load();
         await mkdir(config.workspaceRoot, { recursive: true, mode: 0o700 });
-        const native = options.nativeAdapter ?? defaultNativeAdapter(config);
         const state = {
             config: { ...config, protocolMinor: negotiated.protocolMinor },
             journal,
             acceptedLeaseFence: journal.acceptedLeaseFence(),
             gitAvailable: await probeGitBinary(),
-            native,
+            native: options.nativeAdapter,
             runtimeEpoch: Math.max(config.runtimeEpoch, journal.storedRuntimeEpoch() ?? 0),
             executionQueue: Promise.resolve(),
             instanceToken: randomUUID(),
         };
+        const native = state.native ??= defaultNativeAdapter(state);
         await journal.bindRuntime({
             runtimeId: config.runtimeId,
             generation: config.generation,
@@ -61,8 +62,10 @@ export async function startWorkspaceRuntime(config, options = {}) {
             if (group)
                 await journal.noteExecutionGroup(group);
         }
-        catch {
-            /* conversation stays adapter_not_started until Codex handshake succeeds */
+        catch (error) {
+            const code = error instanceof Error ? error.message : '';
+            state.nativeError = code === 'model_proxy_token_missing' ? code : 'codex_start_failed';
+            console.error(`[workspace-runtime] ${state.nativeError}`);
         }
         const server = createServer((request, response) => {
             void handleRuntimeRequest(state, request, response);
@@ -135,11 +138,16 @@ function closeServer(server) {
 function formatHost(host) {
     return host.includes(':') ? `[${host}]` : host;
 }
-function defaultNativeAdapter(config) {
+function defaultNativeAdapter(state) {
+    const config = state.config;
     if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'loopback')
         return createLoopbackNativeAdapter();
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex') {
-        return createCodexAppServerAdapter({ config });
+    const managed = config.workspaceMode === 'multi' && Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex'
+        || (!process.env.PLAYCRAFT_NATIVE_ADAPTER && managed)) {
+        return createCodexAppServerAdapter({ config,
+            ...(managed ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
+        });
     }
     return undefined;
 }

package/dist/workspace-runtime/server/dispatch.js

@@ -3,6 +3,7 @@ import { revisionScope, workspaceRoot, workspaceSessions } from '../workspaces/r
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { checkpointRecordSchema, fileWritePayloadSchema, gitCommitPayloadSchema, gitPushPayloadSchema, parameterPatchPayloadSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, } from '@playcraft/common/cloud-workspace/runtime';
+import { NativePreparationError } from '../codex/native-adapter.js';
 import { disposeTerminalHost } from './terminal-host.js';
 import { captureWorkspaceTree, materializeSnapshot, publishFileSnapshot, } from '../workspaces/file-snapshot.js';
 import { InvalidWorkspacePathError, resolveWorkspaceFile, restoreWorkspaceFiles, snapshotWorkspaceFiles, writeWorkspaceFile, } from '../workspaces/files.js';
@@ -117,10 +118,19 @@ async function executeScopedOperation(state, scopeKey, operation, payload) {
 }
 async function executeCreate(state, scopeKey, operation) {
     const sessionId = required(operation.sessionId, 'sessionId');
-    const started = await native(state).startThread({
-        sessionId,
-        cwd: await workspaceRoot(state, operation.workspaceId),
-    });
+    let started;
+    try {
+        started = await native(state).startThread({
+            sessionId,
+            cwd: await workspaceRoot(state, operation.workspaceId),
+        });
+    }
+    catch (error) {
+        if (error instanceof NativePreparationError) {
+            return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: error.message }));
+        }
+        throw error;
+    }
     if (!started.threadId) {
         return persist(state, scopeKey, transitionOperation(operation, 'uncertain', { error: 'native_receipt_lost' }));
     }

package/dist/workspace-runtime/server/http.js

@@ -211,7 +211,7 @@ function handshake(state) {
         if (item.name === 'conversation') {
             if (conversationReady)
                 return capability('conversation', true);
-            return destroyed ? capability('conversation', false, 'runtime_destroyed') : item;
+            return capability('conversation', false, destroyed ? 'runtime_destroyed' : state.nativeError ?? 'adapter_not_started');
         }
         if (item.name === 'files') {
             return filesReady
@@ -543,7 +543,7 @@ function unavailableReason(state, kind) {
         return 'runtime_destroyed';
     if (kind === 'preview.publish')
         return 'capability_not_implemented';
-    return 'adapter_not_started';
+    return state.nativeError ?? 'adapter_not_started';
 }
 function sessionHistoryPath(pathname) {
     const match = pathname.match(/^\/runtime\/workspaces\/([^/]+)\/sessions\/([^/]+)\/history$/);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "private": false,
   "type": "module",
   "engines": {
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.1",
-    "@playcraft/common": "^0.1.1",
+    "@playcraft/build": "^0.1.2",
+    "@playcraft/common": "^0.1.2",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",