@playcraft/cli 0.1.16 → 0.1.18

package/dist/workspace-runtime/previews/publish.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { spawn } from 'node:child_process';
-import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
+import { platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 import { constants } from 'node:fs';
 import { lstat, open, readdir, rm } from 'node:fs/promises';
 import { join } from 'node:path';
@@ -223,10 +223,7 @@ function git(cwd, args) {
     });
 }
 async function postControl(state, path, body) {
-    const endpoint = runtimeCallbackEndpoint(state.config.callbackUrl, path);
-    const local = endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname);
-    if (endpoint.protocol !== 'https:' && !local)
-        throw new PreviewFailure('preview_upload_failed');
+    const endpoint = platformEndpoint(state.config.publicBaseUrl, path);
     const response = await fetch(endpoint, {
         method: 'POST',
         redirect: 'error',

package/dist/workspace-runtime/serve.js

@@ -96,7 +96,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
         }
         catch (error) {
             const code = error instanceof Error ? error.message : '';
-            state.nativeError = code === 'model_proxy_token_missing' ? code : 'codex_start_failed';
+            state.nativeError = code === 'codex_model_catalog_unavailable' ? code : 'codex_start_failed';
             console.error(`[workspace-runtime] ${state.nativeError}`);
         }
         const server = createServer((request, response) => {
@@ -180,11 +180,15 @@ function defaultNativeAdapter(state) {
     const config = state.config;
     if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'loopback')
         return createLoopbackNativeAdapter();
-    const managed = config.workspaceMode === 'multi' && Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex'
-        || (!process.env.PLAYCRAFT_NATIVE_ADAPTER && managed)) {
-        return createCodexAppServerAdapter({ config,
-            ...(managed ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
+    const hasLauncher = Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
+    const multi = config.workspaceMode === 'multi';
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' && !multi && !hasLauncher) {
+        throw new Error('codex_requires_managed_launcher');
+    }
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' || (multi && hasLauncher)) {
+        return createCodexAppServerAdapter({
+            config,
+            ...(multi ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
             loadSkillArtifact: async (cwd, entry) => {
                 const id = basename(cwd);
                 if (await workspaceRoot(state, id) !== cwd)

package/dist/workspace-runtime/server/connectivity.js

@@ -0,0 +1,201 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, modelConnectivityPath, platformEndpoint, } from '@playcraft/common/cloud-workspace/runtime';
+const PROBE_TIMEOUT_MS = 4_000;
+const CACHE_MS = 15_000;
+const CREDENTIAL_RENEW_BEFORE_MS = 30_000;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const credentialSchema = z.object({
+    token: z.string().min(1), expiresAt: z.string().datetime(),
+    configId: z.string().uuid(), model: z.string().min(1).max(128),
+    claims: z.object({
+        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
+        generation: z.number().int(), runtimeEpoch: z.number().int(),
+    }),
+});
+const caches = new WeakMap();
+const ready = () => ({ status: 'ready' });
+const unavailable = (reason) => ({ status: 'unavailable', reason });
+function snapshot(state, workspaceId) {
+    let nativeReady = false;
+    try {
+        nativeReady = Boolean(state.native?.ready());
+    }
+    catch { /* A failed adapter stays unavailable. */ }
+    const { publicBaseUrl, controlToken, environment, userId, runtimeId, generation } = state.config;
+    return { publicBaseUrl, controlToken, environment, userId, runtimeId, generation,
+        runtimeEpoch: state.runtimeEpoch, workspaceId, nativeReady, destroyed: state.journal.destroyed(),
+        registered: state.config.workspaceMode !== 'multi' || Boolean(state.journal.getWorkspace(workspaceId)) };
+}
+function safeEndpoint(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || /[%\\]/.test(url.pathname)
+        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('insecure_endpoint');
+    }
+    return url;
+}
+async function responseJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('invalid_probe_response');
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new Error('invalid_probe_response');
+            chunks.push(item.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+async function requestProbe(target, init, credentials = false) {
+    const signal = AbortSignal.timeout(PROBE_TIMEOUT_MS);
+    try {
+        const response = await fetch(target, { ...init, redirect: 'error', signal });
+        if (!response.ok) {
+            const offline = response.headers.has('ngrok-error-code');
+            const rejected = response.status === 401 || response.status === 403;
+            let reason = rejected ? 'endpoint_rejected' : offline ? 'endpoint_offline' : 'endpoint_unreachable';
+            if (credentials && !offline && !rejected) {
+                const body = await responseJson(response).catch(() => undefined);
+                if (signal.aborted)
+                    return { state: unavailable('endpoint_timeout') };
+                if (body && typeof body === 'object' && 'reason' in body && body.reason === 'model_config_required')
+                    reason = 'model_config_required';
+            }
+            else
+                await response.body?.cancel().catch(() => undefined);
+            return { state: unavailable(reason) };
+        }
+        let body;
+        try {
+            body = await responseJson(response);
+        }
+        catch {
+            return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'invalid_probe_response') };
+        }
+        return { state: ready(), body };
+    }
+    catch {
+        return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'endpoint_unreachable') };
+    }
+}
+function echoMatches(body, expected) {
+    return Boolean(body && typeof body === 'object' && !Array.isArray(body)
+        && Object.entries(expected).every(([key, value]) => body[key] === value));
+}
+function scope(config) {
+    return { runtimeId: config.runtimeId, environment: config.environment, workspaceId: config.workspaceId,
+        generation: config.generation, runtimeEpoch: config.runtimeEpoch };
+}
+function entrance(config, route) {
+    return safeEndpoint(platformEndpoint(config.publicBaseUrl, route));
+}
+async function callbackProbe(config) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let endpoint;
+    try {
+        endpoint = entrance(config, PLATFORM_ROUTES.eventsProbe);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    const nonce = randomUUID();
+    const response = await requestProbe(endpoint, {
+        method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+        body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
+            runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId, nonce }),
+    });
+    if (response.state.status !== 'ready')
+        return response.state;
+    return echoMatches(response.body, { service: 'playcraft-runtime', ...scope(config), nonce }) ? ready() : unavailable('invalid_probe_response');
+}
+async function modelProxyProbe(config, entry) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let credentialEndpoint;
+    try {
+        credentialEndpoint = entrance(config, PLATFORM_ROUTES.modelCredentials);
+        entrance(config, PLATFORM_ROUTES.modelProxy);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    if (entry.credential && Date.parse(entry.credential.expiresAt) <= Date.now() + CREDENTIAL_RENEW_BEFORE_MS)
+        entry.credential = undefined;
+    if (!entry.credential) {
+        const response = await requestProbe(credentialEndpoint, {
+            method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId }),
+        }, true);
+        if (response.state.status !== 'ready')
+            return response.state;
+        const parsed = credentialSchema.safeParse(response.body);
+        if (!parsed.success || !echoMatches(parsed.data.claims, { ...scope(config), userId: config.userId })
+            || Date.parse(parsed.data.expiresAt) <= Date.now() + 1_000)
+            return unavailable('invalid_probe_response');
+        entry.credential = parsed.data;
+    }
+    const credential = entry.credential;
+    const nonce = randomUUID();
+    const target = new URL(platformEndpoint(config.publicBaseUrl, modelConnectivityPath(credential.configId)));
+    target.searchParams.set('nonce', nonce);
+    const result = await requestProbe(target, { method: 'GET', headers: { authorization: `Bearer ${credential.token}`, 'playcraft-env': config.environment } });
+    if (result.state.reason === 'endpoint_rejected')
+        entry.credential = undefined;
+    if (result.state.status !== 'ready')
+        return result.state;
+    return echoMatches(result.body, { service: 'playcraft-model-proxy', ...scope(config), configId: credential.configId, nonce })
+        ? ready() : unavailable('invalid_probe_response');
+}
+async function probe(config, entry) {
+    if (config.destroyed || !config.registered) {
+        const state = unavailable(config.destroyed ? 'runtime_destroyed' : 'workspace_not_registered');
+        return { ...scope(config), checkedAt: new Date().toISOString(), callback: state, modelProxy: state, conversation: state };
+    }
+    const [callback, modelProxy] = await Promise.all([callbackProbe(config), modelProxyProbe(config, entry)]);
+    const conversation = !config.nativeReady ? unavailable('adapter_not_started')
+        : callback.status !== 'ready' ? unavailable('callback_unavailable')
+            : modelProxy.status !== 'ready' ? unavailable('model_proxy_unavailable') : ready();
+    return { ...scope(config), checkedAt: new Date().toISOString(), callback, modelProxy, conversation };
+}
+/** Check the configured services without starting a thread or generating a model response. */
+export function probeRuntimeConnectivity(state, workspaceId) {
+    const config = snapshot(state, workspaceId);
+    const key = JSON.stringify(config);
+    let cache = caches.get(state);
+    if (!cache) {
+        cache = new Map();
+        caches.set(state, cache);
+    }
+    const previous = cache.get(workspaceId);
+    if (previous?.key === key) {
+        if (previous.pending)
+            return previous.pending;
+        if (previous.value && previous.expiresAt > Date.now())
+            return Promise.resolve(previous.value);
+    }
+    const entry = previous?.key === key ? previous : { key, expiresAt: 0 };
+    cache.set(workspaceId, entry);
+    if (cache.size > 256)
+        cache.delete(cache.keys().next().value);
+    entry.pending = probe(config, entry).then((value) => {
+        if (JSON.stringify(snapshot(state, workspaceId)) !== key)
+            return probeRuntimeConnectivity(state, workspaceId);
+        entry.value = value;
+        entry.expiresAt = Date.now() + CACHE_MS;
+        return value;
+    }).finally(() => { entry.pending = undefined; });
+    return entry.pending;
+}

package/dist/workspace-runtime/server/dispatch.js

@@ -2,7 +2,8 @@ import { withObservedFile } from '../workspaces/revisions.js';
 import { revisionScope, workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
-import { checkpointRecordSchema, fileWritePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, parameterPatchPayloadSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, workspaceSkillsUpdatePayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, platformEndpoint, checkpointRecordSchema, fileWritePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, parameterPatchPayloadSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, workspaceSavePayloadSchema, workspaceSkillsUpdatePayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { closeCliCredentials } from '../workspaces/cli-credentials.js';
 import { resolveWorkspaceAttachments } from '../workspaces/attachments.js';
 import { readWorkspaceSkillSnapshot, readWorkspaceSkills } from '../workspaces/skills.js';
@@ -11,10 +12,9 @@ import { enableLocalProjectSkill, syncLocalProjectSkills } from '../../project-s
 import { NativePreparationError } from '../codex/native-adapter.js';
 import { disposeTerminalHost } from './terminal-host.js';
 import { disposeDesktopHost } from './desktop-host.js';
-import { captureWorkspaceTree, liveTreeDigest, materializeSnapshot, publishFileSnapshot, } from '../workspaces/file-snapshot.js';
-import { objectStoreHeaders, oneSaveAtATime, rememberFileCheckpoint, unchangedCheckpoint, workspaceSaves, } from '../workspaces/checkpoint-saves.js';
+import { captureWorkspaceTree, materializeSnapshot, publishFileSnapshot, } from '../workspaces/file-snapshot.js';
 import { InvalidWorkspacePathError, resolveWorkspaceFile, restoreWorkspaceFiles, snapshotWorkspaceFiles, writeWorkspaceFile, } from '../workspaces/files.js';
-import { GitWorkspaceError, bundleUnpushedCommits, commitWorkspaceGit, discardWorkspaceGit, pushWorkspaceGit, stageWorkspaceGit, unstageWorkspaceGit, } from '../workspaces/git.js';
+import { GitWorkspaceError, commitWorkspaceGit, discardWorkspaceGit, pushWorkspaceGit, saveWorkspaceGit, stageWorkspaceGit, unstageWorkspaceGit, } from '../workspaces/git.js';
 import { ParameterEditError } from '../workspaces/json5-edit.js';
 import { patchWorkspaceParameters, readWorkspaceParameters } from '../workspaces/parameters.js';
 import { previewFailureCode, previewWorkspaceRoot, runPreviewPublish, trackPreviewPublish, } from '../previews/publish.js';
@@ -37,6 +37,7 @@ const LOCAL_KINDS = new Set([
     'git.stage',
     'git.unstage',
     'git.discard',
+    'workspace.save',
     'terminal.create',
     'parameter.patch',
     'preview.publish',
@@ -88,8 +89,7 @@ async function executeScopedOperation(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(current, 'failed', { error: 'workspace_not_ready' }));
     }
     if (operation.kind === 'checkpoint.create') {
-        const workspaceId = current.workspaceId ?? String(asRecord(payload).workspaceId ?? 'workspace');
-        return oneSaveAtATime(state, workspaceId, () => executeCheckpoint(state, scopeKey, current, payload));
+        return executeCheckpoint(state, scopeKey, current, payload);
     }
     if (operation.kind === 'checkpoint.restore') {
         return executeRestore(state, scopeKey, current, payload);
@@ -109,6 +109,9 @@ async function executeScopedOperation(state, scopeKey, operation, payload) {
     if (operation.kind === 'git.stage' || operation.kind === 'git.unstage' || operation.kind === 'git.discard') {
         return executeGitIndex(state, scopeKey, current, payload);
     }
+    if (operation.kind === 'workspace.save') {
+        return executeWorkspaceSave(state, scopeKey, current, payload);
+    }
     if (operation.kind === 'terminal.create') {
         return executeTerminalCreate(state, scopeKey, current, payload);
     }
@@ -123,7 +126,7 @@ async function executeScopedOperation(state, scopeKey, operation, payload) {
     }
     try {
         if (operation.kind === 'session.create') {
-            return executeCreate(state, scopeKey, current);
+            return executeCreate(state, scopeKey, current, payload);
         }
         if (operation.kind === 'session.turn') {
             return executeTurn(state, scopeKey, current, payload);
@@ -171,13 +174,17 @@ async function executeSkillsUpdate(state, scopeKey, operation, payload) {
         }));
     }
 }
-async function executeCreate(state, scopeKey, operation) {
+async function executeCreate(state, scopeKey, operation, payload) {
     const sessionId = required(operation.sessionId, 'sessionId');
+    const selected = z.string().uuid().optional().safeParse(asRecord(payload).modelConfigId);
+    if (!selected.success)
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'model_config_denied' }));
     let started;
     try {
         started = await native(state).startThread({
             sessionId,
             cwd: await workspaceRoot(state, operation.workspaceId),
+            modelConfigId: selected.data,
         });
     }
     catch (error) {
@@ -195,10 +202,12 @@ async function executeCreate(state, scopeKey, operation) {
         threadId: started.threadId,
         cwd: await workspaceRoot(state, operation.workspaceId),
         recoverability: 'native',
+        modelConfigId: started.modelConfigId,
     });
     const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted', {
         nativeRequestId: `thread/start:${sessionId}`,
         nativeThreadId: started.threadId,
+        modelConfigId: started.modelConfigId,
     }));
     await recordNativeEvents(state, accepted, [
         { type: 'session.created', payload: { sessionId, threadId: started.threadId }, occurredAt: new Date().toISOString() },
@@ -218,6 +227,9 @@ async function executeTurn(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'turn_already_active' }));
     }
     const body = asRecord(payload);
+    const selected = z.string().uuid().optional().safeParse(body.modelConfigId);
+    if (!selected.success)
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'model_config_denied' }));
     let attachments;
     try {
         attachments = await resolveWorkspaceAttachments(await workspaceRoot(state, operation.workspaceId), body.attachmentIds);
@@ -233,15 +245,17 @@ async function executeTurn(state, scopeKey, operation, payload) {
         text: String(body.text ?? '') + attachmentText,
         images: attachments.filter((file) => file.mimeType.startsWith('image/')).map((file) => file.path),
         clientRequestId: operation.clientRequestId,
+        modelConfigId: selected.data ?? binding.modelConfigId,
         simulateLostReceipt: body.simulateLostReceipt === true,
-        persistReservation: async ({ nativeRequestId }) => {
+        persistReservation: async ({ nativeRequestId, modelConfigId }) => {
             await persist(state, scopeKey, {
                 ...operation,
                 nativeRequestId,
                 nativeThreadId: binding.threadId,
+                modelConfigId,
                 updatedAt: new Date().toISOString(),
             });
-            await state.journal.putSession({ ...binding, turnStatus: 'starting' });
+            await state.journal.putSession({ ...binding, modelConfigId, turnStatus: 'starting' });
         },
     });
     const reserved = state.journal.getOperation(scopeKey) ?? operation;
@@ -341,9 +355,9 @@ async function executeApproval(state, scopeKey, operation, payload) {
 }
 async function executeCheckpoint(state, scopeKey, operation, payload) {
     const body = asRecord(payload);
-    // Only a save without a requested identity may answer with an earlier, unchanged checkpoint.
-    const requested = typeof body.checkpointId === 'string' && body.checkpointId.trim() !== '';
-    const checkpointId = requested ? String(body.checkpointId).trim() : `ckpt_${randomUUID()}`;
+    const checkpointId = typeof body.checkpointId === 'string' && body.checkpointId.trim()
+        ? body.checkpointId.trim()
+        : `ckpt_${randomUUID()}`;
     if (!/^[a-zA-Z0-9_-]{1,128}$/.test(checkpointId) || state.journal.getCheckpoint(checkpointId)) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'checkpoint_id_conflict' }));
     }
@@ -354,6 +368,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
         const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
             sessionId: item.sessionId,
             nativeThreadId: item.threadId,
+            modelConfigId: item.modelConfigId,
             recoverability: 'history_only',
         }));
         const checkpoint = checkpointRecordSchema.parse({
@@ -374,44 +389,20 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
     const revisions = state.journal.fileRevisions(revisionScope(state, operation.workspaceId));
     let files;
     let published;
-    // A standalone workspace has no remote, so all of its `.git` is kept. A project workspace's packs
-    // come back with a new clone; what the remote lacks goes into the unpushed bundle.
-    const standalone = state.journal.getWorkspace(workspaceId)?.targetKind === 'standalone';
-    if (!standalone) {
-        // Without a fresh bundle the loose objects still hold commits made since the last repack.
-        await bundleUnpushedCommits(root).catch(() => undefined);
-    }
-    const tree = await captureWorkspaceTree(root, previousFilePaths(state), revisions, undefined, {
-        git: standalone ? 'full' : 'local',
-    });
-    // Transcripts only matter where another instance can read them back.
-    const transcripts = state.config.fileObjectStoreUrl ? await captureTranscripts(state, operation.workspaceId) : [];
-    const digest = liveTreeDigest(tree, transcripts);
-    if (!requested && tree.status === 'complete') {
-        const stillActive = await activeManagedWrites(state, workspaceId);
-        if (stillActive.length === 0) {
-            const captured = await captureNativeSessions(state, operation.workspaceId);
-            const previous = unchangedCheckpoint(state, workspaceId, digest, captured.sessions);
-            if (previous)
-                return finishUnchanged(state, scopeKey, operation, previous);
-        }
-    }
-    if (state.config.fileObjectStoreUrl) {
+    if (state.config.checkpointObjects) {
+        const tree = await captureWorkspaceTree(root, previousFilePaths(state), revisions);
         const stillActive = await activeManagedWrites(state, workspaceId);
         if (stillActive.length > 0) {
             return finishBestEffort(state, scopeKey, operation, checkpointId, workspaceId, createdAt, stillActive.map((item) => item.source));
         }
         try {
             published = await publishFileSnapshot({
-                baseUrl: state.config.fileObjectStoreUrl,
+                baseUrl: platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.checkpointStore),
                 snapshotId: checkpointId,
                 workspaceId,
                 generation: state.config.generation,
                 tree,
-                native: transcripts,
-                uploaded: workspaceSaves(state, workspaceId).uploaded,
-                uploadedTranscripts: workspaceSaves(state, workspaceId).transcripts,
-                headers: objectStoreHeaders(state, state.config.fileObjectStoreUrl),
+                headers: checkpointStoreHeaders(state),
             });
         }
         catch {
@@ -421,6 +412,7 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
             const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 recoverability: 'history_only',
             }));
             const checkpoint = checkpointRecordSchema.parse({
@@ -471,26 +463,8 @@ async function executeCheckpoint(state, scopeKey, operation, payload) {
     await state.journal.setFileCheckpointId(checkpointId);
     if (nativeReady)
         await state.journal.setConsistentCheckpointId(checkpointId);
-    if (tree.status === 'complete') {
-        await rememberFileCheckpoint(state, workspaceId, { checkpointId, digest, sessions: captured.sessions });
-    }
     return finishCheckpoint(state, scopeKey, operation, checkpoint, []);
 }
-/**
- * Nothing changed since the last file checkpoint: the save reports that checkpoint again and
- * writes no new one, so periodic saves of an idle workspace cost one read of the tree.
- */
-async function finishUnchanged(state, scopeKey, operation, checkpoint) {
-    const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted', { checkpointId: checkpoint.checkpointId }));
-    return persist(state, scopeKey, transitionOperation(accepted, 'completed', {
-        checkpointId: checkpoint.checkpointId,
-        checkpointKind: checkpoint.kind,
-        checkpointConsistent: checkpoint.consistent === true,
-        ...(checkpoint.manifestKey ? { snapshotManifestKey: checkpoint.manifestKey } : {}),
-        ...(checkpoint.checksum ? { snapshotChecksum: checkpoint.checksum } : {}),
-        ...(checkpoint.snapshotStatus ? { snapshotStatus: checkpoint.snapshotStatus } : {}),
-    }));
-}
 async function executeRestore(state, scopeKey, operation, payload) {
     const body = asRecord(payload);
     const checkpointId = String(body.checkpointId ?? operation.checkpointId ?? '');
@@ -513,13 +487,14 @@ async function executeRestore(state, scopeKey, operation, payload) {
         if (!checkpoint.nativeRecoverable || threadReplaced) {
             return {
                 ...item,
+                modelConfigId: snap.modelConfigId ?? item.modelConfigId,
                 threadId,
                 recoverability: restarted ? 'history_only' : item.recoverability,
             };
         }
         if (restarted)
-            return { ...item, threadId, recoverability: 'history_only' };
-        return { ...item, threadId: snap.nativeThreadId ?? item.threadId, recoverability: 'native' };
+            return { ...item, modelConfigId: snap.modelConfigId ?? item.modelConfigId, threadId, recoverability: 'history_only' };
+        return { ...item, modelConfigId: snap.modelConfigId ?? item.modelConfigId, threadId: snap.nativeThreadId ?? item.threadId, recoverability: 'native' };
     });
     for (const snap of checkpoint.sessions) {
         if (!next.some((item) => item.sessionId === snap.sessionId)) {
@@ -527,6 +502,7 @@ async function executeRestore(state, scopeKey, operation, payload) {
                 sessionId: snap.sessionId,
                 workspaceId: operation.workspaceId,
                 threadId: snap.nativeThreadId ?? `thread_${snap.sessionId}`,
+                modelConfigId: snap.modelConfigId,
                 cwd,
                 recoverability: checkpoint.nativeRecoverable && !restarted ? 'native' : 'history_only',
             });
@@ -545,6 +521,7 @@ async function executeRestore(state, scopeKey, operation, payload) {
                 threadId,
                 sessionId: snap.sessionId,
                 cwd: found.cwd,
+                modelConfigId: found.modelConfigId,
             });
             if (!continued || found.threadId !== threadId)
                 continue;
@@ -713,6 +690,37 @@ async function executeGitCommit(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: gitErrorCode(error) }));
     }
 }
+/**
+ * Saves the workspace to Git: commit everything that changed, then push a Remix branch. A
+ * standalone workspace has no remote, and the Git gateway never lets a workspace write its
+ * project's main branch, so those two only commit.
+ */
+async function executeWorkspaceSave(state, scopeKey, operation, payload) {
+    const parsed = workspaceSavePayloadSchema.safeParse(payload ?? {});
+    if (!parsed.success) {
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_workspace_save' }));
+    }
+    const binding = operation.workspaceId ? state.journal.getWorkspace(operation.workspaceId) : undefined;
+    try {
+        const saved = await saveWorkspaceGit(await workspaceRoot(state, operation.workspaceId), {
+            message: parsed.data.trigger === 'auto' ? 'Autosave workspace' : 'Save workspace',
+            push: binding?.targetKind === 'remix',
+            boundBranch: boundBranch(state, operation),
+        });
+        const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
+        await recordNativeEvents(state, accepted, [
+            {
+                type: 'workspace.saved',
+                payload: { ...(saved.commit ? { sha: saved.commit } : {}), pushed: saved.pushed, withheld: saved.withheld },
+                occurredAt: new Date().toISOString(),
+            },
+        ]);
+        return persist(state, scopeKey, transitionOperation(accepted, 'completed'));
+    }
+    catch (error) {
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: gitErrorCode(error) }));
+    }
+}
 async function executeGitPush(state, scopeKey, operation, payload) {
     const parsed = gitPushPayloadSchema.safeParse(payload ?? {});
     if (!parsed.success) {
@@ -910,22 +918,6 @@ async function finishCheckpoint(state, scopeKey, operation, checkpoint, activeWr
         ...(checkpoint.snapshotStatus ? { snapshotStatus: checkpoint.snapshotStatus } : {}),
     }));
 }
-/** Transcripts of the workspace's resumable threads. A thread whose file cannot be read is left out. */
-async function captureTranscripts(state, workspaceId) {
-    const native = state.native;
-    if (!native?.exportThread)
-        return [];
-    const captured = [];
-    for (const session of workspaceSessions(state, workspaceId)) {
-        if (session.recoverability !== 'native')
-            continue;
-        const capturedAt = new Date().toISOString();
-        const file = await native.exportThread({ threadId: session.threadId }).catch(() => undefined);
-        if (file)
-            captured.push({ sessionId: session.sessionId, threadId: session.threadId, capturedAt, ...file });
-    }
-    return captured;
-}
 async function captureNativeSessions(state, workspaceId) {
     const live = workspaceSessions(state, workspaceId);
     const sessions = [];
@@ -944,12 +936,14 @@ async function captureNativeSessions(state, workspaceId) {
             ? {
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 nativeDurableTurnId: durable,
                 recoverability: 'native',
             }
             : {
                 sessionId: item.sessionId,
                 nativeThreadId: item.threadId,
+                modelConfigId: item.modelConfigId,
                 recoverability: 'history_only',
             });
     }
@@ -984,6 +978,7 @@ async function finishBestEffort(state, scopeKey, operation, checkpointId, worksp
     const sessions = workspaceSessions(state, operation.workspaceId).map((item) => ({
         sessionId: item.sessionId,
         nativeThreadId: item.threadId,
+        modelConfigId: item.modelConfigId,
         recoverability: 'history_only',
     }));
     const checkpoint = checkpointRecordSchema.parse({
@@ -1073,8 +1068,18 @@ function nativeIds(params) {
         itemId: typeof record.itemId === 'string' ? record.itemId : typeof record.approvalId === 'string' ? record.approvalId : undefined,
     };
 }
+/** The checkpoint route is on this deployment, so uploads carry the control credential. */
+function checkpointStoreHeaders(state) {
+    return {
+        authorization: `Bearer ${state.config.controlToken}`,
+        'playcraft-env': state.config.environment,
+        'x-playcraft-runtime-id': state.config.runtimeId,
+        'x-playcraft-generation': String(state.config.generation),
+        'x-playcraft-runtime-epoch': String(state.runtimeEpoch),
+    };
+}
 async function notifyCallback(state, events) {
-    await fetch(state.config.callbackUrl, {
+    await fetch(platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.events), {
         method: 'POST',
         headers: {
             authorization: `Bearer ${state.config.controlToken}`,

package/dist/workspace-runtime/server/endpoints.js

@@ -1,10 +1,10 @@
 import { chmod, rename, writeFile } from 'node:fs/promises';
 import { applySandboxEndpointPatch } from '@playcraft/common/cloud-workspace/runtime';
-/** Persist the new addresses, then publish them to the running process. A restart is not required. */
+/** Persist the new public entrance, then publish it to the running process. A restart is not required. */
 export async function applyRuntimeEndpointPatch(state, patch) {
     const next = applySandboxEndpointPatch(state.config, patch);
-    const changed = next.callbackUrl !== state.config.callbackUrl || next.modelProxyUrl !== state.config.modelProxyUrl;
-    const result = { changed, callbackUrl: next.callbackUrl, modelProxyUrl: next.modelProxyUrl };
+    const changed = next.publicBaseUrl !== state.config.publicBaseUrl;
+    const result = { changed, publicBaseUrl: next.publicBaseUrl };
     if (!changed)
         return result;
     if (!state.configPath) {