@playcraft/cli 0.1.15 → 0.1.17

package/dist/workspace-runtime/server/connectivity.js

@@ -0,0 +1,201 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, modelConnectivityPath, platformEndpoint, } from '@playcraft/common/cloud-workspace/runtime';
+const PROBE_TIMEOUT_MS = 4_000;
+const CACHE_MS = 15_000;
+const CREDENTIAL_RENEW_BEFORE_MS = 30_000;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const credentialSchema = z.object({
+    token: z.string().min(1), expiresAt: z.string().datetime(),
+    configId: z.string().uuid(), model: z.string().min(1).max(128),
+    claims: z.object({
+        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
+        generation: z.number().int(), runtimeEpoch: z.number().int(),
+    }),
+});
+const caches = new WeakMap();
+const ready = () => ({ status: 'ready' });
+const unavailable = (reason) => ({ status: 'unavailable', reason });
+function snapshot(state, workspaceId) {
+    let nativeReady = false;
+    try {
+        nativeReady = Boolean(state.native?.ready());
+    }
+    catch { /* A failed adapter stays unavailable. */ }
+    const { publicBaseUrl, controlToken, environment, userId, runtimeId, generation } = state.config;
+    return { publicBaseUrl, controlToken, environment, userId, runtimeId, generation,
+        runtimeEpoch: state.runtimeEpoch, workspaceId, nativeReady, destroyed: state.journal.destroyed(),
+        registered: state.config.workspaceMode !== 'multi' || Boolean(state.journal.getWorkspace(workspaceId)) };
+}
+function safeEndpoint(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || /[%\\]/.test(url.pathname)
+        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('insecure_endpoint');
+    }
+    return url;
+}
+async function responseJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('invalid_probe_response');
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new Error('invalid_probe_response');
+            chunks.push(item.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+async function requestProbe(target, init, credentials = false) {
+    const signal = AbortSignal.timeout(PROBE_TIMEOUT_MS);
+    try {
+        const response = await fetch(target, { ...init, redirect: 'error', signal });
+        if (!response.ok) {
+            const offline = response.headers.has('ngrok-error-code');
+            const rejected = response.status === 401 || response.status === 403;
+            let reason = rejected ? 'endpoint_rejected' : offline ? 'endpoint_offline' : 'endpoint_unreachable';
+            if (credentials && !offline && !rejected) {
+                const body = await responseJson(response).catch(() => undefined);
+                if (signal.aborted)
+                    return { state: unavailable('endpoint_timeout') };
+                if (body && typeof body === 'object' && 'reason' in body && body.reason === 'model_config_required')
+                    reason = 'model_config_required';
+            }
+            else
+                await response.body?.cancel().catch(() => undefined);
+            return { state: unavailable(reason) };
+        }
+        let body;
+        try {
+            body = await responseJson(response);
+        }
+        catch {
+            return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'invalid_probe_response') };
+        }
+        return { state: ready(), body };
+    }
+    catch {
+        return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'endpoint_unreachable') };
+    }
+}
+function echoMatches(body, expected) {
+    return Boolean(body && typeof body === 'object' && !Array.isArray(body)
+        && Object.entries(expected).every(([key, value]) => body[key] === value));
+}
+function scope(config) {
+    return { runtimeId: config.runtimeId, environment: config.environment, workspaceId: config.workspaceId,
+        generation: config.generation, runtimeEpoch: config.runtimeEpoch };
+}
+function entrance(config, route) {
+    return safeEndpoint(platformEndpoint(config.publicBaseUrl, route));
+}
+async function callbackProbe(config) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let endpoint;
+    try {
+        endpoint = entrance(config, PLATFORM_ROUTES.eventsProbe);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    const nonce = randomUUID();
+    const response = await requestProbe(endpoint, {
+        method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+        body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
+            runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId, nonce }),
+    });
+    if (response.state.status !== 'ready')
+        return response.state;
+    return echoMatches(response.body, { service: 'playcraft-runtime', ...scope(config), nonce }) ? ready() : unavailable('invalid_probe_response');
+}
+async function modelProxyProbe(config, entry) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let credentialEndpoint;
+    try {
+        credentialEndpoint = entrance(config, PLATFORM_ROUTES.modelCredentials);
+        entrance(config, PLATFORM_ROUTES.modelProxy);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    if (entry.credential && Date.parse(entry.credential.expiresAt) <= Date.now() + CREDENTIAL_RENEW_BEFORE_MS)
+        entry.credential = undefined;
+    if (!entry.credential) {
+        const response = await requestProbe(credentialEndpoint, {
+            method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId }),
+        }, true);
+        if (response.state.status !== 'ready')
+            return response.state;
+        const parsed = credentialSchema.safeParse(response.body);
+        if (!parsed.success || !echoMatches(parsed.data.claims, { ...scope(config), userId: config.userId })
+            || Date.parse(parsed.data.expiresAt) <= Date.now() + 1_000)
+            return unavailable('invalid_probe_response');
+        entry.credential = parsed.data;
+    }
+    const credential = entry.credential;
+    const nonce = randomUUID();
+    const target = new URL(platformEndpoint(config.publicBaseUrl, modelConnectivityPath(credential.configId)));
+    target.searchParams.set('nonce', nonce);
+    const result = await requestProbe(target, { method: 'GET', headers: { authorization: `Bearer ${credential.token}`, 'playcraft-env': config.environment } });
+    if (result.state.reason === 'endpoint_rejected')
+        entry.credential = undefined;
+    if (result.state.status !== 'ready')
+        return result.state;
+    return echoMatches(result.body, { service: 'playcraft-model-proxy', ...scope(config), configId: credential.configId, nonce })
+        ? ready() : unavailable('invalid_probe_response');
+}
+async function probe(config, entry) {
+    if (config.destroyed || !config.registered) {
+        const state = unavailable(config.destroyed ? 'runtime_destroyed' : 'workspace_not_registered');
+        return { ...scope(config), checkedAt: new Date().toISOString(), callback: state, modelProxy: state, conversation: state };
+    }
+    const [callback, modelProxy] = await Promise.all([callbackProbe(config), modelProxyProbe(config, entry)]);
+    const conversation = !config.nativeReady ? unavailable('adapter_not_started')
+        : callback.status !== 'ready' ? unavailable('callback_unavailable')
+            : modelProxy.status !== 'ready' ? unavailable('model_proxy_unavailable') : ready();
+    return { ...scope(config), checkedAt: new Date().toISOString(), callback, modelProxy, conversation };
+}
+/** Check the configured services without starting a thread or generating a model response. */
+export function probeRuntimeConnectivity(state, workspaceId) {
+    const config = snapshot(state, workspaceId);
+    const key = JSON.stringify(config);
+    let cache = caches.get(state);
+    if (!cache) {
+        cache = new Map();
+        caches.set(state, cache);
+    }
+    const previous = cache.get(workspaceId);
+    if (previous?.key === key) {
+        if (previous.pending)
+            return previous.pending;
+        if (previous.value && previous.expiresAt > Date.now())
+            return Promise.resolve(previous.value);
+    }
+    const entry = previous?.key === key ? previous : { key, expiresAt: 0 };
+    cache.set(workspaceId, entry);
+    if (cache.size > 256)
+        cache.delete(cache.keys().next().value);
+    entry.pending = probe(config, entry).then((value) => {
+        if (JSON.stringify(snapshot(state, workspaceId)) !== key)
+            return probeRuntimeConnectivity(state, workspaceId);
+        entry.value = value;
+        entry.expiresAt = Date.now() + CACHE_MS;
+        return value;
+    }).finally(() => { entry.pending = undefined; });
+    return entry.pending;
+}

package/dist/workspace-runtime/server/dispatch.js

@@ -2,7 +2,8 @@ import { withObservedFile } from '../workspaces/revisions.js';
 import { revisionScope, workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { checkpointRecordSchema, fileWritePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, parameterPatchPayloadSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, workspaceSkillsUpdatePayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, platformEndpoint, checkpointRecordSchema, fileWritePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, parameterPatchPayloadSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, workspaceSkillsUpdatePayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { closeCliCredentials } from '../workspaces/cli-credentials.js';
 import { resolveWorkspaceAttachments } from '../workspaces/attachments.js';
 import { readWorkspaceSkillSnapshot, readWorkspaceSkills } from '../workspaces/skills.js';
@@ -123,7 +124,7 @@ async function executeScopedOperation(state, scopeKey, operation, payload) {
     }
     try {
         if (operation.kind === 'session.create') {
-            return executeCreate(state, scopeKey, current);
+            return executeCreate(state, scopeKey, current, payload);
         }
         if (operation.kind === 'session.turn') {
             return executeTurn(state, scopeKey, current, payload);
@@ -171,13 +172,17 @@ async function executeSkillsUpdate(state, scopeKey, operation, payload) {
         }));
     }
 }
-async function executeCreate(state, scopeKey, operation) {
+async function executeCreate(state, scopeKey, operation, payload) {
     const sessionId = required(operation.sessionId, 'sessionId');
+    const selected = z.string().uuid().optional().safeParse(asRecord(payload).modelConfigId);
+    if (!selected.success)
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'model_config_denied' }));
     let started;
     try {
         started = await native(state).startThread({
             sessionId,
             cwd: await workspaceRoot(state, operation.workspaceId),
+            modelConfigId: selected.data,
         });
     }
     catch (error) {
@@ -195,10 +200,12 @@ async function executeCreate(state, scopeKey, operation) {
         threadId: started.threadId,
         cwd: await workspaceRoot(state, operation.workspaceId),
         recoverability: 'native',
+        modelConfigId: started.modelConfigId,
     });
     const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted', {
         nativeRequestId: `thread/start:${sessionId}`,
         nativeThreadId: started.threadId,
+        modelConfigId: started.modelConfigId,
     }));
     await recordNativeEvents(state, accepted, [
         { type: 'session.created', payload: { sessionId, threadId: started.threadId }, occurredAt: new Date().toISOString() },
@@ -218,6 +225,9 @@ async function executeTurn(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'turn_already_active' }));
     }
     const body = asRecord(payload);
+    const selected = z.string().uuid().optional().safeParse(body.modelConfigId);
+    if (!selected.success)
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'model_config_denied' }));
     let attachments;
     try {
         attachments = await resolveWorkspaceAttachments(await workspaceRoot(state, operation.workspaceId), body.attachmentIds);
@@ -233,15 +243,17 @@ async function executeTurn(state, scopeKey, operation, payload) {
         text: String(body.text ?? '') + attachmentText,
         images: attachments.filter((file) => file.mimeType.startsWith('image/')).map((file) => file.path),
         clientRequestId: operation.clientRequestId,
+        modelConfigId: selected.data ?? binding.modelConfigId,
         simulateLostReceipt: body.simulateLostReceipt === true,
-        persistReservation: async ({ nativeRequestId }) => {
+        persistReservation: async ({ nativeRequestId, modelConfigId }) => {
             await persist(state, scopeKey, {
                 ...operation,
                 nativeRequestId,
                 nativeThreadId: binding.threadId,
+                modelConfigId,
                 updatedAt: new Date().toISOString(),
             });
-            await state.journal.putSession({ ...binding, turnStatus: 'starting' });
+            await state.journal.putSession({ ...binding, modelConfigId, turnStatus: 'starting' });
         },
     });
     const reserved = state.journal.getOperation(scopeKey) ?? operation;
@@ -354,6 +366,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
         const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
             sessionId: item.sessionId,
             nativeThreadId: item.threadId,
+            modelConfigId: item.modelConfigId,
             recoverability: 'history_only',
         }));
         const checkpoint = checkpointRecordSchema.parse({
@@ -385,7 +398,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
         git: standalone ? 'full' : 'local',
     });
     // Transcripts only matter where another instance can read them back.
-    const transcripts = state.config.fileObjectStoreUrl ? await captureTranscripts(state, operation.workspaceId) : [];
+    const transcripts = state.config.checkpointObjects ? await captureTranscripts(state, operation.workspaceId) : [];
     const digest = liveTreeDigest(tree, transcripts);
     if (!requested && tree.status === 'complete') {
         const stillActive = await activeManagedWrites(state, workspaceId);
@@ -396,14 +409,14 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
                 return finishUnchanged(state, scopeKey, operation, previous);
         }
     }
-    if (state.config.fileObjectStoreUrl) {
+    if (state.config.checkpointObjects) {
         const stillActive = await activeManagedWrites(state, workspaceId);
         if (stillActive.length > 0) {
             return finishBestEffort(state, scopeKey, operation, checkpointId, workspaceId, createdAt, stillActive.map((item) => item.source));
         }
         try {
             published = await publishFileSnapshot({
-                baseUrl: state.config.fileObjectStoreUrl,
+                baseUrl: platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.checkpointStore),
                 snapshotId: checkpointId,
                 workspaceId,
                 generation: state.config.generation,
@@ -411,7 +424,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
                 native: transcripts,
                 uploaded: workspaceSaves(state, workspaceId).uploaded,
                 uploadedTranscripts: workspaceSaves(state, workspaceId).transcripts,
-                headers: objectStoreHeaders(state, state.config.fileObjectStoreUrl),
+                headers: objectStoreHeaders(state),
             });
         }
         catch {
@@ -421,6 +434,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
             const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 recoverability: 'history_only',
             }));
             const checkpoint = checkpointRecordSchema.parse({
@@ -513,13 +527,14 @@ async function executeRestore(state, scopeKey, operation, payload) {
         if (!checkpoint.nativeRecoverable || threadReplaced) {
             return {
                 ...item,
+                modelConfigId: snap.modelConfigId ?? item.modelConfigId,
                 threadId,
                 recoverability: restarted ? 'history_only' : item.recoverability,
             };
         }
         if (restarted)
-            return { ...item, threadId, recoverability: 'history_only' };
-        return { ...item, threadId: snap.nativeThreadId ?? item.threadId, recoverability: 'native' };
+            return { ...item, modelConfigId: snap.modelConfigId ?? item.modelConfigId, threadId, recoverability: 'history_only' };
+        return { ...item, modelConfigId: snap.modelConfigId ?? item.modelConfigId, threadId: snap.nativeThreadId ?? item.threadId, recoverability: 'native' };
     });
     for (const snap of checkpoint.sessions) {
         if (!next.some((item) => item.sessionId === snap.sessionId)) {
@@ -527,6 +542,7 @@ async function executeRestore(state, scopeKey, operation, payload) {
                 sessionId: snap.sessionId,
                 workspaceId: operation.workspaceId,
                 threadId: snap.nativeThreadId ?? `thread_${snap.sessionId}`,
+                modelConfigId: snap.modelConfigId,
                 cwd,
                 recoverability: checkpoint.nativeRecoverable && !restarted ? 'native' : 'history_only',
             });
@@ -545,6 +561,7 @@ async function executeRestore(state, scopeKey, operation, payload) {
                 threadId,
                 sessionId: snap.sessionId,
                 cwd: found.cwd,
+                modelConfigId: found.modelConfigId,
             });
             if (!continued || found.threadId !== threadId)
                 continue;
@@ -944,12 +961,14 @@ async function captureNativeSessions(state, workspaceId) {
             ? {
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 nativeDurableTurnId: durable,
                 recoverability: 'native',
             }
             : {
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 recoverability: 'history_only',
             });
     }
@@ -984,6 +1003,7 @@ async function finishBestEffort(state, scopeKey, operation, checkpointId, worksp
     const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
         sessionId: item.sessionId,
         nativeThreadId: item.threadId,
+        modelConfigId: item.modelConfigId,
         recoverability: 'history_only',
     }));
     const checkpoint = checkpointRecordSchema.parse({
@@ -1074,7 +1094,7 @@ function nativeIds(params) {
     };
 }
 async function notifyCallback(state, events) {
-    await fetch(state.config.callbackUrl, {
+    await fetch(platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.events), {
         method: 'POST',
         headers: {
             authorization: `Bearer ${state.config.controlToken}`,

package/dist/workspace-runtime/server/endpoints.js

@@ -1,10 +1,10 @@
 import { chmod, rename, writeFile } from 'node:fs/promises';
 import { applySandboxEndpointPatch } from '@playcraft/common/cloud-workspace/runtime';
-/** Persist the new addresses, then publish them to the running process. A restart is not required. */
+/** Persist the new public entrance, then publish it to the running process. A restart is not required. */
 export async function applyRuntimeEndpointPatch(state, patch) {
     const next = applySandboxEndpointPatch(state.config, patch);
-    const changed = next.callbackUrl !== state.config.callbackUrl || next.modelProxyUrl !== state.config.modelProxyUrl;
-    const result = { changed, callbackUrl: next.callbackUrl, modelProxyUrl: next.modelProxyUrl };
+    const changed = next.publicBaseUrl !== state.config.publicBaseUrl;
+    const result = { changed, publicBaseUrl: next.publicBaseUrl };
     if (!changed)
         return result;
     if (!state.configPath) {

package/dist/workspace-runtime/server/http.js

@@ -1,7 +1,7 @@
 import { readObservedFile, withObservedFile } from '../workspaces/revisions.js';
 import { registerWorkspace, revisionScope, workspaceRoot, WorkspaceContextError } from '../workspaces/registry.js';
 import { randomUUID } from 'node:crypto';
-import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
 import { applyRuntimeEndpointPatch } from './endpoints.js';
 import { canExecuteKind, executeOperation } from './dispatch.js';
@@ -17,6 +17,7 @@ import { readWorkspaceSkills } from '../workspaces/skills.js';
 import { loadWorkspaceSkillArtifact } from '../workspaces/skill-artifact-loader.js';
 import { join } from 'node:path';
 import { terminalHost } from './terminal-host.js';
+import { probeRuntimeConnectivity } from './connectivity.js';
 export async function handleRuntimeRequest(state, request, response) {
     const url = new URL(request.url ?? '/', 'http://127.0.0.1');
     const access = authorizeRuntime(state, request);
@@ -33,6 +34,19 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, 200, { status: 'ok', handshake: handshake(state) });
             return;
         }
+        if (request.method === 'GET' && url.pathname === '/runtime/connectivity') {
+            if (writeDestroyed(state, response))
+                return;
+            const parsed = runtimeConnectivityDocumentSchema.shape.workspaceId.safeParse(url.searchParams.get('workspaceId'));
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const workspaceId = parsed.data;
+            await workspaceRoot(state, workspaceId);
+            writeJson(response, 200, await probeRuntimeConnectivity(state, workspaceId));
+            return;
+        }
         if (request.method === 'GET' && url.pathname === '/runtime/identity') {
             const { runtimeId, userId, environment, generation } = state.config;
             writeJson(response, 200, {

package/dist/workspace-runtime/workspaces/checkpoint-saves.js

@@ -58,17 +58,8 @@ export async function rememberFileCheckpoint(state, workspaceId, saved) {
         await rm(join(state.config.stateDir, 'file-checkpoints', checkpointId), { recursive: true, force: true }).catch(() => undefined);
     }
 }
-/**
- * The control credential goes only to Runtime's own object endpoint, never to another store.
- */
-export function objectStoreHeaders(state, storeUrl) {
-    try {
-        if (new URL(storeUrl).origin !== new URL(state.config.callbackUrl).origin)
-            return {};
-    }
-    catch {
-        return {};
-    }
+/** Checkpoint uploads always go to this deployment, so they always carry the control credential. */
+export function objectStoreHeaders(state) {
     return {
         authorization: `Bearer ${state.config.controlToken}`,
         'playcraft-env': state.config.environment,

package/dist/workspace-runtime/workspaces/cli-credentials.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { z } from 'zod';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const responseSchema = z.object({
     token: z.string().min(1),
     apiUrl: z.string().url(),
@@ -36,11 +37,7 @@ export async function ensureCliCredentials(state) {
 async function renew(state, entry) {
     const config = state.config;
     const epoch = state.runtimeEpoch;
-    const endpoint = new URL('/runtime/internal/cli-credentials', config.callbackUrl);
-    if (endpoint.protocol !== 'https:' &&
-        !(endpoint.protocol === 'http:' &&
-            ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-        throw new Error('cli_callback_insecure');
+    const endpoint = platformEndpoint(config.publicBaseUrl, PLATFORM_ROUTES.cliCredentials);
     try {
         const response = await fetch(endpoint, {
             method: 'POST',

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -8,6 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceGitDirectStore } from './git-direct-store.js';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const exec = promisify(execFile);
 /** Only this control process sees the callback credential. Development processes use the local socket. */
 export class WorkspaceGitCredentialBroker {
@@ -164,9 +165,7 @@ export class WorkspaceGitCredentialBroker {
         await this.direct.sweep(true);
     }
     async refresh(binding, key) {
-        const endpoint = new URL('/runtime/internal/git-credentials', this.state.config.callbackUrl);
-        if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-            throw new Error('git_broker_unavailable');
+        const endpoint = platformEndpoint(this.state.config.publicBaseUrl, PLATFORM_ROUTES.gitCredentials);
         const epoch = this.state.runtimeEpoch;
         const response = await fetch(endpoint, {
             method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),

package/dist/workspace-runtime/workspaces/skill-artifact-loader.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { workspaceRoot } from './registry.js';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const MAX_ARTIFACT_BYTES = 80 * 1024 * 1024;
 /** Requests an exact locked artifact using control identity; no storage credentials reach Codex. */
 export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
@@ -7,9 +8,7 @@ export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
     const epoch = state.runtimeEpoch;
     if (state.journal.destroyed())
         throw new Error('workspace_skills_unavailable');
-    const endpoint = new URL('/runtime/internal/skill-artifacts', state.config.callbackUrl);
-    if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-        throw new Error('workspace_skills_callback_insecure');
+    const endpoint = platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.skillArtifacts);
     const response = await fetch(endpoint, {
         method: 'POST', redirect: 'error', signal: AbortSignal.timeout(30_000),
         headers: { authorization: `Bearer ${state.config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': state.config.environment },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "private": false,
   "type": "module",
   "engines": {
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.15",
-    "@playcraft/common": "^0.1.15",
+    "@playcraft/build": "^0.1.17",
+    "@playcraft/common": "^0.1.17",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",