@playcraft/cli 0.1.12 → 0.1.13

package/dist/workspace-runtime/server/desktop-host.js

@@ -2,6 +2,7 @@ import { connect as connectTcp } from 'node:net';
 import { WebSocket, WebSocketServer } from 'ws';
 import { desktopHealthSchema, desktopResourceName, runtimeError, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
+import { createRfbWatchGate } from './rfb-watch-gate.js';
 /**
  * A takeover holds the desktop for this long, whether or not a page is watching, and ends on its
  * own unless the user renews it.
@@ -190,6 +191,7 @@ export class DesktopHost {
         }
         else if (this.upstream) {
             const upstream = new WebSocket(`ws://127.0.0.1:${this.upstream.port}/`);
+            const watch = createRfbWatchGate();
             viewer.upstream = upstream;
             viewer.detach = () => upstream.close();
             upstream.on('error', () => {
@@ -204,12 +206,34 @@ export class DesktopHost {
                     return;
                 }
                 const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                watch.observeServer(chunk);
+                if (watch.failed) {
+                    ws.close(1008, 'desktop_protocol_error');
+                    upstream.close();
+                    return;
+                }
                 send(chunk, isBinary);
             });
             upstream.on('close', () => {
                 if (ws.readyState === WebSocket.OPEN)
                     ws.close();
             });
+            ws.on('message', (data, isBinary) => {
+                if (this.generation !== generation)
+                    return;
+                const chunk = Buffer.isBuffer(data) ? data : Buffer.from(data);
+                if (viewer.upstream?.readyState !== WebSocket.OPEN)
+                    return;
+                const outgoing = watch.clientBytes(chunk, this.holder === 'human');
+                if (watch.failed) {
+                    ws.close(1008, 'desktop_protocol_error');
+                    upstream.close();
+                    return;
+                }
+                for (const message of outgoing) {
+                    viewer.upstream.send(message, { binary: isBinary });
+                }
+            });
         }
         this.viewers.add(viewer);
         let closed = false;
@@ -223,12 +247,6 @@ export class DesktopHost {
         };
         ws.on('close', close);
         ws.on('error', close);
-        ws.on('message', (data, isBinary) => {
-            if (this.holder !== 'human' || this.generation !== generation)
-                return;
-            if (viewer.upstream?.readyState === WebSocket.OPEN)
-                viewer.upstream.send(data, { binary: isBinary });
-        });
     }
     rejectPlainConnect(response, url) {
         if (this.currentStatus() !== 'ready') {

package/dist/workspace-runtime/server/rfb-watch-gate.js

@@ -0,0 +1,168 @@
+/**
+ * RFB (Remote Framebuffer, 远程帧缓冲) viewing needs a handshake and picture requests.
+ * This gate supports the sandbox's version 3.8 / None security negotiation.
+ * Input requires a hold for the entire message; unsupported framing closes the stream.
+ */
+const INPUT_TYPES = new Set([4, 5, 6, 250, 251, 255]);
+const VERSION = Buffer.from('RFB 003.008\n');
+const MAX_CLIPBOARD_BYTES = 1_000_000;
+export function createRfbWatchGate() {
+    let server = Buffer.alloc(0);
+    let client = Buffer.alloc(0);
+    let phase = 'server-version';
+    let messageInputAllowed = false;
+    const fail = () => {
+        phase = 'failed';
+        server = Buffer.alloc(0);
+        client = Buffer.alloc(0);
+    };
+    const observeServer = (chunk) => {
+        if (phase === 'ready' || phase === 'failed')
+            return;
+        let offset = 0;
+        while (offset < chunk.length) {
+            let size = serverMessageSize(server, phase);
+            if (size === 'invalid') {
+                fail();
+                return;
+            }
+            const count = Math.min(size - server.length, chunk.length - offset);
+            server = Buffer.concat([server, chunk.subarray(offset, offset + count)]);
+            offset += count;
+            size = serverMessageSize(server, phase);
+            if (size === 'invalid') {
+                fail();
+                return;
+            }
+            if (server.length < size)
+                continue;
+            if (phase === 'server-version' && server.equals(VERSION))
+                phase = 'client-version';
+            else if (phase === 'server-types' && server.subarray(1).includes(1))
+                phase = 'client-security';
+            else if (phase === 'server-result' && server.readUInt32BE(0) === 0)
+                phase = 'client-init';
+            else if (phase === 'server-init')
+                phase = 'ready';
+            else {
+                fail();
+                return;
+            }
+            server = Buffer.alloc(0);
+            // The first picture can share the ServerInit chunk; it needs no buffering.
+            if (phase === 'ready')
+                return;
+        }
+    };
+    const clientBytes = (chunk, allowInput) => {
+        if (phase === 'failed')
+            return [];
+        const outgoing = [];
+        let offset = 0;
+        if (client.length > 0)
+            messageInputAllowed &&= allowInput;
+        while (offset < chunk.length) {
+            if (client.length === 0)
+                messageInputAllowed = allowInput;
+            let size = phase === 'client-version' ? 12
+                : phase === 'client-security' || phase === 'client-init' ? 1
+                    : phase === 'server-init' || phase === 'ready' ? clientMessageSize(client)
+                        : 'invalid';
+            if (size === 'invalid') {
+                fail();
+                return [];
+            }
+            const count = Math.min(size - client.length, chunk.length - offset);
+            client = Buffer.concat([client, chunk.subarray(offset, offset + count)]);
+            offset += count;
+            if (phase === 'server-init' || phase === 'ready')
+                size = clientMessageSize(client);
+            if (size === 'invalid') {
+                fail();
+                return [];
+            }
+            if (client.length < size)
+                continue;
+            if (phase === 'client-version' && client.equals(VERSION))
+                phase = 'server-types';
+            else if (phase === 'client-security' && client[0] === 1)
+                phase = 'server-result';
+            else if (phase === 'client-init' && client[0] <= 1)
+                phase = 'server-init';
+            else if (phase !== 'server-init' && phase !== 'ready') {
+                fail();
+                return [];
+            }
+            else if (INPUT_TYPES.has(client[0]) && !messageInputAllowed) {
+                client = Buffer.alloc(0);
+                continue;
+            }
+            outgoing.push(client);
+            client = Buffer.alloc(0);
+        }
+        return outgoing;
+    };
+    return { get failed() { return phase === 'failed'; }, observeServer, clientBytes };
+}
+function serverMessageSize(buffer, phase) {
+    if (phase === 'server-version')
+        return 12;
+    if (phase === 'server-types') {
+        if (buffer.length < 1)
+            return 1;
+        return buffer[0] === 0 ? 'invalid' : 1 + buffer[0];
+    }
+    if (phase === 'server-result')
+        return 4;
+    if (phase === 'server-init') {
+        if (buffer.length < 24)
+            return 24;
+        const length = buffer.readUInt32BE(20);
+        return length > 4096 ? 'invalid' : 24 + length;
+    }
+    return 'invalid';
+}
+function clientMessageSize(buffer) {
+    if (buffer.length === 0)
+        return 1;
+    const type = buffer[0];
+    if (type === 0)
+        return 20;
+    if (type === 3 || type === 150)
+        return 10;
+    if (type === 4)
+        return 8;
+    if (type === 5)
+        return 6;
+    if (type === 250)
+        return 4;
+    if (type === 2) {
+        if (buffer.length < 4)
+            return 4;
+        const count = buffer.readUInt16BE(2);
+        return count > 64 ? 'invalid' : 4 + count * 4;
+    }
+    if (type === 6) {
+        if (buffer.length < 8)
+            return 8;
+        // Extended clipboard messages encode their payload size as a negative length.
+        const length = Math.abs(buffer.readInt32BE(4));
+        return length > MAX_CLIPBOARD_BYTES ? 'invalid' : 8 + length;
+    }
+    if (type === 248) {
+        if (buffer.length < 9)
+            return 9;
+        return buffer[8] > 64 ? 'invalid' : 9 + buffer[8];
+    }
+    if (type === 251) {
+        if (buffer.length < 8)
+            return 8;
+        return buffer[6] > 16 ? 'invalid' : 8 + buffer[6] * 16;
+    }
+    if (type === 255) {
+        if (buffer.length < 2)
+            return 2;
+        return buffer[1] === 0 ? 12 : 'invalid';
+    }
+    return 'invalid';
+}

package/dist/workspace-runtime/workspaces/prepare.js

@@ -2,7 +2,7 @@ import { spawn } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
 import { lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, sameWorkspaceRegistration, workspacePreparationSchema, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceContextError } from './context-error.js';
 import { scaffoldEmptyWorkspace } from './empty-template.js';
 /** The caller holds the Workspace lock. Only an absent, never-published directory may be prepared. */
@@ -29,7 +29,11 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
         throw new WorkspaceContextError('workspace_recovery_required');
     if (await exists(target))
         throw new WorkspaceContextError('workspace_checkout_conflict');
-    const receipt = previous ?? {
+    // An unfinished checkout recorded before the fork instructions were known must be cloned again.
+    const forkMatches = !previous || samePendingFork(previous.binding, binding);
+    if (previous && !forkMatches)
+        await rm(join(parent, previous.stagingName), { recursive: true, force: true });
+    const receipt = previous && forkMatches ? previous : {
         binding,
         stagingName: `.prepare-${binding.workspaceId}-${randomUUID()}`,
         status: 'cloning',
@@ -172,11 +176,15 @@ async function exists(path) {
         throw error;
     }
 }
+function samePendingFork(left, right) {
+    const fork = (value) => value.targetKind === 'standalone' ? undefined : value.pendingFork;
+    return JSON.stringify(fork(left) ?? null) === JSON.stringify(fork(right) ?? null);
+}
 async function readReceipt(path, binding) {
     try {
         const value = JSON.parse(await readFile(path, 'utf8'));
         const parsed = workspaceRegistrationSchema.parse(value.binding);
-        if (JSON.stringify(parsed) !== JSON.stringify(binding) ||
+        if (!sameWorkspaceRegistration(parsed, binding) ||
             !['cloning', 'ready', 'published'].includes(value.status) ||
             !new RegExp(`^\\.prepare-${binding.workspaceId}-[0-9a-f-]{36}$`).test(value.stagingName))
             throw new Error();

package/dist/workspace-runtime/workspaces/registry.js

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import { lstat, realpath } from 'node:fs/promises';
 import { join, relative } from 'node:path';
 import { promisify } from 'node:util';
-import { isLocalWorkspaceGitAuthMode, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { isLocalWorkspaceGitAuthMode, sameWorkspaceRegistration, workspaceRegistrationSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { prepareWorkspaceCheckout } from './prepare.js';
 import { WorkspaceContextError } from './context-error.js';
 import { scheduleDependencyInstall } from './dependencies.js';
@@ -64,7 +64,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
         state.acceptedLeaseFence = leaseFence;
         await state.journal.setAcceptedLeaseFence(leaseFence);
         const existing = state.journal.getWorkspace(binding.workspaceId);
-        if (existing && JSON.stringify(existing) !== JSON.stringify(binding))
+        if (existing && !sameWorkspaceRegistration(existing, binding))
             throw new WorkspaceContextError('workspace_binding_conflict');
         let root;
         try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "private": false,
   "type": "module",
   "engines": {
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.12",
-    "@playcraft/common": "^0.1.12",
+    "@playcraft/build": "^0.1.13",
+    "@playcraft/common": "^0.1.13",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",