@playcraft/cli 0.1.15 → 0.1.16

package/dist/commands/login.js

@@ -1,7 +1,7 @@
 import http from 'http';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import crypto from 'crypto';
-import { saveGlobalConfig, loadGlobalConfig } from '../config.js';
+import { loadGlobalConfig, normalizeEnvironmentBaseUrl, readEnvironmentProfile, saveEnvironmentProfile } from '../config.js';
 import { activateAccount } from '../auth/account-activation.js';
 /** 默认云端 Portal（Next.js `/cli-auth` 与 API 同源时的基址；可通过 --url 或 PLAYCRAFT_URL 覆盖） */
 export const DEFAULT_PLAYCRAFT_CLOUD_BASE = 'https://playcraft.aix.intlgame.com';
@@ -19,10 +19,11 @@ function openBrowser(url) {
     const cmd = process.platform === 'darwin'
         ? 'open'
         : process.platform === 'win32'
-            ? 'start'
+            ? 'rundll32'
             : 'xdg-open';
     try {
-        exec(`${cmd} "${url}"`, (err, _stdout, stderr) => {
+        const arguments_ = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+        execFile(cmd, arguments_, (err, _stdout, stderr) => {
             if (err) {
                 console.error('Failed to open browser automatically:', err.message);
                 if (stderr?.trim()) {
@@ -45,21 +46,18 @@ function resolveLoginBaseUrl(options) {
         globalConfig.url ||
         globalConfig.backendUrl ||
         DEFAULT_PLAYCRAFT_CLOUD_BASE;
-    return raw.replace(/\/+$/, '');
+    const base = normalizeEnvironmentBaseUrl(raw);
+    if (!base)
+        throw new Error('Invalid environment address');
+    return base;
 }
 function normalizeLoginEnvironmentUrl(raw) {
-    try {
-        const url = new URL(raw);
-        url.hash = '';
-        url.search = '';
-        url.pathname = url.pathname.replace(/\/+$/, '');
-        return url.toString().replace(/\/+$/, '');
-    }
-    catch {
-        return undefined;
-    }
+    return normalizeEnvironmentBaseUrl(raw);
 }
 export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
+    const profile = readEnvironmentProfile(globalConfig, backendUrl);
+    if (profile)
+        return profile.token;
     const token = typeof globalConfig.token === 'string' ? globalConfig.token : undefined;
     const storedBackendUrl = typeof globalConfig.backendUrl === 'string'
         ? globalConfig.backendUrl
@@ -75,9 +73,17 @@ export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
         : undefined;
 }
 export function buildCliAuthUrl(options) {
-    const url = new URL('/cli-auth', options.backendUrl);
+    const base = normalizeEnvironmentBaseUrl(options.backendUrl);
+    if (!base)
+        throw new Error('Invalid environment address');
+    const url = new URL(`${base}/cli-auth`);
+    url.searchParams.set('callbackUrl', options.callbackUrl);
     url.searchParams.set('callback', options.callbackUrl);
     url.searchParams.set('state', options.state);
+    if (options.codeChallenge) {
+        url.searchParams.set('codeChallenge', options.codeChallenge);
+        url.searchParams.set('codeChallengeMethod', 'S256');
+    }
     return url.toString();
 }
 export async function renewExistingToken(options) {
@@ -88,12 +94,20 @@ export async function renewExistingToken(options) {
     try {
         const res = await fetchFn(`${options.backendUrl}/api/settings/personal-access-tokens/current/renew`, {
             method: 'PATCH',
+            redirect: 'error',
+            signal: AbortSignal.timeout(10_000),
             headers: {
                 Authorization: `Bearer ${options.token}`,
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({ expiresIn: '365d' }),
         });
+        if (res.ok && res.json && options.onRenewed) {
+            const result = await res.json();
+            if (typeof result.expiresAt === 'string' && Date.parse(result.expiresAt) > Date.now()) {
+                options.onRenewed(result.expiresAt);
+            }
+        }
         return res.ok;
     }
     catch {
@@ -110,24 +124,34 @@ export async function loginCommand(options) {
     const globalConfig = loadGlobalConfig();
     const existingToken = resolveExistingTokenForLoginTarget(globalConfig, backendUrl);
     if (existingToken) {
-        const renewed = await renewExistingToken({ backendUrl, token: existingToken });
+        let expiresAt;
+        const renewed = await renewExistingToken({ backendUrl, token: existingToken,
+            onRenewed: (value) => { expiresAt = value; } });
         if (renewed) {
-            saveGlobalConfig({
-                token: existingToken,
-                url: backendUrl,
-                backendUrl,
-            });
+            const previous = readEnvironmentProfile(globalConfig, backendUrl);
+            saveEnvironmentProfile(backendUrl, { token: existingToken,
+                ...(previous?.identity ? { identity: previous.identity } : {}),
+                ...(expiresAt ? { expiresAt } : {}) });
             console.log('Existing CLI token renewed. Token saved to ~/.playcraft/config.json');
             return;
         }
     }
     const state = crypto.randomBytes(16).toString('hex');
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+    let callbackUrl = '';
+    let exchanging = false;
     return new Promise((resolve, reject) => {
         let timeout;
         const server = http.createServer((req, res) => {
-            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Origin', new URL(backendUrl).origin);
             res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            if (req.headers.origin && req.headers.origin !== new URL(backendUrl).origin) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
             if (req.method === 'OPTIONS') {
                 res.writeHead(204);
                 res.end();
@@ -135,8 +159,9 @@ export async function loginCommand(options) {
             }
             if (req.url === '/callback' && req.method === 'POST') {
                 let body = '';
-                req.on('data', (chunk) => (body += chunk));
-                req.on('end', () => {
+                req.on('data', (chunk) => { body += chunk; if (body.length > 16_384)
+                    req.destroy(); });
+                req.on('end', async () => {
                     try {
                         const data = JSON.parse(body);
                         if (data.state !== state) {
@@ -144,22 +169,36 @@ export async function loginCommand(options) {
                                 'Content-Type': 'text/html',
                                 Connection: 'close',
                             });
-                            res.end('<html><body><h1>Invalid state</h1></body></html>', () => {
-                                closeServer(() => {
-                                    reject(new Error('State mismatch - possible CSRF attack'));
-                                });
-                            });
+                            res.end('<html><body><h1>Invalid state</h1></body></html>');
                             return;
                         }
-                        const callbackToken = typeof data.token === 'string' ? data.token : undefined;
-                        if (!callbackToken) {
-                            throw new Error('Login callback did not include a token');
+                        if (exchanging) {
+                            res.writeHead(409);
+                            res.end();
+                            return;
+                        }
+                        if (typeof data.code !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(data.code)) {
+                            throw new Error('Login callback did not include an authorization code');
                         }
-                        saveGlobalConfig({
-                            token: callbackToken,
-                            url: backendUrl,
-                            backendUrl,
+                        exchanging = true;
+                        const base = normalizeEnvironmentBaseUrl(backendUrl);
+                        if (!base)
+                            throw new Error('Invalid environment address');
+                        const exchange = await fetch(`${base}/api/cloud-environments/exchange`, {
+                            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ code: data.code, state, callbackUrl, codeVerifier }),
                         });
+                        if (!exchange.ok)
+                            throw new Error('Authorization code exchange failed');
+                        const credential = await exchange.json();
+                        if (!credential.token || !/^playcraft_pat_[A-Za-z0-9_-]{32}$/.test(credential.token)
+                            || !credential.identity?.userId || !Array.isArray(credential.identity.identities)
+                            || !credential.expiresAt || Date.parse(credential.expiresAt) <= Date.now()) {
+                            throw new Error('Invalid environment credential response');
+                        }
+                        saveEnvironmentProfile(base, { token: credential.token,
+                            identity: credential.identity, expiresAt: credential.expiresAt });
                         res.writeHead(200, {
                             'Content-Type': 'text/html',
                             Connection: 'close',
@@ -179,9 +218,6 @@ export async function loginCommand(options) {
                     catch (err) {
                         const cause = err instanceof Error ? err : new Error(String(err));
                         console.error('[playcraft login] Callback handling failed:', cause.message);
-                        if (cause.stack) {
-                            console.error(cause.stack);
-                        }
                         const userFacing = cause instanceof SyntaxError
                             ? 'Invalid JSON in login callback.'
                             : `Login callback failed: ${cause.message}`;
@@ -226,14 +262,15 @@ export async function loginCommand(options) {
             });
         });
         try {
-            server.listen(callbackPort, () => {
+            server.listen(callbackPort, '127.0.0.1', () => {
                 const address = server.address();
                 const listeningPort = typeof address === 'object' && address ? address.port : callbackPort;
-                const callbackUrl = `http://localhost:${listeningPort}/callback`;
+                callbackUrl = `http://127.0.0.1:${listeningPort}/callback`;
                 const authUrl = buildCliAuthUrl({
                     backendUrl,
                     callbackUrl,
                     state,
+                    codeChallenge,
                 });
                 console.log('Opening browser for login...');
                 console.log(`If the browser does not open, visit this URL manually:\n  ${authUrl}\n`);

package/dist/config.js

@@ -2,7 +2,8 @@ import { cosmiconfig } from 'cosmiconfig';
 import { z } from 'zod';
 import path from 'path';
 import { homedir } from 'os';
-import { mkdirSync, writeFileSync, readFileSync } from 'fs';
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync, readFileSync } from 'fs';
+import { randomUUID } from 'node:crypto';
 import 'dotenv/config';
 export const ConfigSchema = z.object({
     projectId: z.string().optional(),
@@ -18,6 +19,33 @@ const explorer = cosmiconfig('playcraft', {
 });
 const GLOBAL_CONFIG_DIR = path.join(homedir(), '.playcraft');
 const GLOBAL_CONFIG_FILE = path.join(GLOBAL_CONFIG_DIR, 'config.json');
+export function normalizeEnvironmentBaseUrl(raw) {
+    try {
+        const url = new URL(raw);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password)
+            return undefined;
+        url.hash = '';
+        url.search = '';
+        url.pathname = url.pathname.replace(/\/+$/, '').replace(/\/api$/, '');
+        return url.toString().replace(/\/+$/, '');
+    }
+    catch {
+        return undefined;
+    }
+}
+export function readEnvironmentProfile(config, baseUrl) {
+    const key = normalizeEnvironmentBaseUrl(baseUrl);
+    const profiles = config.environmentProfiles;
+    if (!key || !profiles || typeof profiles !== 'object' || Array.isArray(profiles))
+        return undefined;
+    const profile = profiles[key];
+    if (!profile || typeof profile !== 'object' || Array.isArray(profile))
+        return undefined;
+    const value = profile;
+    if (typeof value.token !== 'string' || !value.token || normalizeEnvironmentBaseUrl(value.backendUrl) !== key)
+        return undefined;
+    return value;
+}
 export function loadGlobalConfig() {
     try {
         const content = readFileSync(GLOBAL_CONFIG_FILE, 'utf-8');
@@ -28,7 +56,8 @@ export function loadGlobalConfig() {
     }
 }
 export function saveGlobalConfig(partial) {
-    mkdirSync(GLOBAL_CONFIG_DIR, { recursive: true });
+    mkdirSync(GLOBAL_CONFIG_DIR, { recursive: true, mode: 0o700 });
+    chmodSync(GLOBAL_CONFIG_DIR, 0o700);
     let existing = {};
     try {
         existing = JSON.parse(readFileSync(GLOBAL_CONFIG_FILE, 'utf-8'));
@@ -37,7 +66,25 @@ export function saveGlobalConfig(partial) {
         // ignore
     }
     const merged = { ...existing, ...partial };
-    writeFileSync(GLOBAL_CONFIG_FILE, JSON.stringify(merged, null, 2), 'utf-8');
+    const temporary = path.join(GLOBAL_CONFIG_DIR, `.config-${randomUUID()}.tmp`);
+    try {
+        writeFileSync(temporary, JSON.stringify(merged, null, 2), { encoding: 'utf-8', flag: 'wx', mode: 0o600 });
+        renameSync(temporary, GLOBAL_CONFIG_FILE);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function saveEnvironmentProfile(baseUrl, profile) {
+    const key = normalizeEnvironmentBaseUrl(baseUrl);
+    if (!key)
+        throw new Error('Invalid environment address');
+    const current = loadGlobalConfig();
+    const profiles = current.environmentProfiles && typeof current.environmentProfiles === 'object'
+        && !Array.isArray(current.environmentProfiles) ? current.environmentProfiles : {};
+    saveGlobalConfig({ environmentProfiles: { ...profiles,
+            [key]: { ...profile, backendUrl: key, updatedAt: new Date().toISOString() } },
+        token: profile.token, url: key, backendUrl: key });
 }
 export async function loadConfig(cliOptions) {
     const result = await explorer.search(cliOptions.dir || process.cwd());
@@ -46,12 +93,20 @@ export async function loadConfig(cliOptions) {
         ? (fileConfig.agent || {})
         : fileConfig;
     const globalConfig = loadGlobalConfig();
+    const explicitTarget = cliOptions.url || process.env.PLAYCRAFT_URL || agentConfig.url;
+    const targetUrl = explicitTarget || globalConfig.url;
+    const profile = typeof targetUrl === 'string' ? readEnvironmentProfile(globalConfig, targetUrl) : undefined;
+    const legacyTarget = typeof globalConfig.backendUrl === 'string' ? globalConfig.backendUrl
+        : typeof globalConfig.url === 'string' ? globalConfig.url : undefined;
+    const legacyToken = !explicitTarget || (legacyTarget && normalizeEnvironmentBaseUrl(String(targetUrl)) === normalizeEnvironmentBaseUrl(legacyTarget))
+        ? globalConfig.token : undefined;
     const config = ConfigSchema.parse({
         ...globalConfig,
         ...agentConfig,
         ...cliOptions,
         projectId: cliOptions.projectId || process.env.PLAYCRAFT_PROJECT_ID || agentConfig.projectId || globalConfig.projectId,
-        token: cliOptions.token || process.env.PLAYCRAFT_TOKEN || agentConfig.token || globalConfig.token,
+        url: targetUrl,
+        token: cliOptions.token || process.env.PLAYCRAFT_TOKEN || agentConfig.token || profile?.token || legacyToken,
         port: cliOptions.port || (process.env.PLAYCRAFT_PORT ? parseInt(process.env.PLAYCRAFT_PORT) : undefined) || agentConfig.port || globalConfig.port,
         mode: cliOptions.mode || process.env.PLAYCRAFT_MODE || agentConfig.mode || globalConfig.mode,
         skillsDir: cliOptions.skillsDir || process.env.AGENT_SKILLS_DIR || agentConfig.skillsDir || globalConfig.skillsDir,

package/dist/utils/agent-api-client.js

@@ -5,6 +5,7 @@ import { loadGlobalConfig } from '../config.js';
 import { DEFAULT_PLAYCRAFT_CLOUD_BASE } from '../commands/login.js';
 import { AGENT_TOOL_OPERATION_PROTOCOL, AGENT_TOOL_OPERATION_HEADERS, AGENT_TOOL_OPERATION_CAPABILITIES_PATH, } from '@playcraft/common/agent-tools';
 import { beginToolOperation } from './tool-operation-journal.js';
+import { businessEndpoint } from './environment-endpoints.js';
 import { AccountActivationError, parseErrorPayload, pendingAccountActivationError, } from '../auth/account-activation.js';
 /**
  * 判断 token 是否为用户 PAT（Personal Access Token）。
@@ -71,10 +72,10 @@ export class AgentApiClient {
         }
         return headers;
     }
-    /** Absolute pathname under /api/agent/tools (path may omit leading slash). */
+    /** Deployment-relative pathname under /api/agent/tools (path may omit leading slash). */
     toolsRequestUrl(path) {
         const p = path.startsWith('/') ? path : `/${path}`;
-        return new URL(`/api/agent/tools${p}`, this.apiUrl);
+        return businessEndpoint(this.apiUrl, `/api/agent/tools${p}`);
     }
     async post(path, body, options) {
         const url = this.toolsRequestUrl(path);

package/dist/utils/environment-endpoints.js

@@ -0,0 +1,26 @@
+function publicBase(value) {
+    const base = new URL(value);
+    if (!['http:', 'https:'].includes(base.protocol) || base.username || base.password || base.search || base.hash) {
+        throw new Error('invalid_environment_endpoint');
+    }
+    base.pathname = base.pathname.replace(/\/+$/, '');
+    return base;
+}
+function append(base, path) {
+    return new URL(`${base.toString().replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`);
+}
+/** Keep the deployment prefix when deriving a control endpoint from its callback address. */
+export function runtimeCallbackEndpoint(callbackUrl, path) {
+    const base = publicBase(callbackUrl);
+    base.pathname = base.pathname.replace(/\/runtime\/(?:callbacks|internal\/events)$/, '');
+    // Older local runtimes used a root-level events callback.
+    if (base.pathname === '/events')
+        base.pathname = '';
+    return append(base, path);
+}
+/** Accept either a public deployment base or its /api endpoint, without duplicating /api. */
+export function businessEndpoint(apiUrl, path) {
+    const base = publicBase(apiUrl);
+    base.pathname = base.pathname.replace(/\/api$/, '');
+    return append(base, path);
+}

package/dist/workspace-runtime/codex/model-broker.js

@@ -5,6 +5,7 @@ import { pipeline } from 'node:stream/promises';
 import { basename } from 'node:path';
 import { z } from 'zod';
 import { workspaceRoot } from '../workspaces/registry.js';
+import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
 const credentialSchema = z.object({
     token: z.string().min(1), expiresAt: z.string().datetime(),
     configId: z.string().uuid(), model: z.string().min(1).max(128),
@@ -81,7 +82,7 @@ export class WorkspaceModelBroker {
     }
     async renew(entry) {
         const config = this.state.config;
-        const endpoint = new URL('/runtime/internal/model-credentials', config.callbackUrl);
+        const endpoint = runtimeCallbackEndpoint(config.callbackUrl, '/runtime/internal/model-credentials');
         if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:'
             && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
             throw new Error('model_callback_insecure');

package/dist/workspace-runtime/previews/publish.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
+import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
 import { constants } from 'node:fs';
 import { lstat, open, readdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
@@ -222,7 +223,7 @@ function git(cwd, args) {
     });
 }
 async function postControl(state, path, body) {
-    const endpoint = new URL(path, state.config.callbackUrl);
+    const endpoint = runtimeCallbackEndpoint(state.config.callbackUrl, path);
     const local = endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname);
     if (endpoint.protocol !== 'https:' && !local)
         throw new PreviewFailure('preview_upload_failed');

package/dist/workspace-runtime/workspaces/cli-credentials.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { z } from 'zod';
+import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
 const responseSchema = z.object({
     token: z.string().min(1),
     apiUrl: z.string().url(),
@@ -36,7 +37,7 @@ export async function ensureCliCredentials(state) {
 async function renew(state, entry) {
     const config = state.config;
     const epoch = state.runtimeEpoch;
-    const endpoint = new URL('/runtime/internal/cli-credentials', config.callbackUrl);
+    const endpoint = runtimeCallbackEndpoint(config.callbackUrl, '/runtime/internal/cli-credentials');
     if (endpoint.protocol !== 'https:' &&
         !(endpoint.protocol === 'http:' &&
             ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceGitDirectStore } from './git-direct-store.js';
+import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
 const exec = promisify(execFile);
 /** Only this control process sees the callback credential. Development processes use the local socket. */
 export class WorkspaceGitCredentialBroker {
@@ -164,7 +165,7 @@ export class WorkspaceGitCredentialBroker {
         await this.direct.sweep(true);
     }
     async refresh(binding, key) {
-        const endpoint = new URL('/runtime/internal/git-credentials', this.state.config.callbackUrl);
+        const endpoint = runtimeCallbackEndpoint(this.state.config.callbackUrl, '/runtime/internal/git-credentials');
         if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
             throw new Error('git_broker_unavailable');
         const epoch = this.state.runtimeEpoch;

package/dist/workspace-runtime/workspaces/skill-artifact-loader.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { workspaceRoot } from './registry.js';
+import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
 const MAX_ARTIFACT_BYTES = 80 * 1024 * 1024;
 /** Requests an exact locked artifact using control identity; no storage credentials reach Codex. */
 export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
@@ -7,7 +8,7 @@ export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
     const epoch = state.runtimeEpoch;
     if (state.journal.destroyed())
         throw new Error('workspace_skills_unavailable');
-    const endpoint = new URL('/runtime/internal/skill-artifacts', state.config.callbackUrl);
+    const endpoint = runtimeCallbackEndpoint(state.config.callbackUrl, '/runtime/internal/skill-artifacts');
     if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
         throw new Error('workspace_skills_callback_insecure');
     const response = await fetch(endpoint, {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "private": false,
   "type": "module",
   "engines": {
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.15",
-    "@playcraft/common": "^0.1.15",
+    "@playcraft/build": "^0.1.16",
+    "@playcraft/common": "^0.1.16",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",