@playcraft/cli 0.1.16 → 0.1.18

package/dist/workspace-runtime/server/http.js

@@ -1,7 +1,7 @@
 import { readObservedFile, withObservedFile } from '../workspaces/revisions.js';
 import { registerWorkspace, revisionScope, workspaceRoot, WorkspaceContextError } from '../workspaces/registry.js';
 import { randomUUID } from 'node:crypto';
-import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRegistrationRequestSchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, instanceRebuildRequestSchema, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
 import { applyRuntimeEndpointPatch } from './endpoints.js';
 import { canExecuteKind, executeOperation } from './dispatch.js';
@@ -17,6 +17,7 @@ import { readWorkspaceSkills } from '../workspaces/skills.js';
 import { loadWorkspaceSkillArtifact } from '../workspaces/skill-artifact-loader.js';
 import { join } from 'node:path';
 import { terminalHost } from './terminal-host.js';
+import { probeRuntimeConnectivity } from './connectivity.js';
 export async function handleRuntimeRequest(state, request, response) {
     const url = new URL(request.url ?? '/', 'http://127.0.0.1');
     const access = authorizeRuntime(state, request);
@@ -33,6 +34,19 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, 200, { status: 'ok', handshake: handshake(state) });
             return;
         }
+        if (request.method === 'GET' && url.pathname === '/runtime/connectivity') {
+            if (writeDestroyed(state, response))
+                return;
+            const parsed = runtimeConnectivityDocumentSchema.shape.workspaceId.safeParse(url.searchParams.get('workspaceId'));
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const workspaceId = parsed.data;
+            await workspaceRoot(state, workspaceId);
+            writeJson(response, 200, await probeRuntimeConnectivity(state, workspaceId));
+            return;
+        }
         if (request.method === 'GET' && url.pathname === '/runtime/identity') {
             const { runtimeId, userId, environment, generation } = state.config;
             writeJson(response, 200, {

package/dist/workspace-runtime/workspaces/cli-credentials.js

@@ -2,7 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { mkdir, rename, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { z } from 'zod';
-import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const responseSchema = z.object({
     token: z.string().min(1),
     apiUrl: z.string().url(),
@@ -37,11 +37,7 @@ export async function ensureCliCredentials(state) {
 async function renew(state, entry) {
     const config = state.config;
     const epoch = state.runtimeEpoch;
-    const endpoint = runtimeCallbackEndpoint(config.callbackUrl, '/runtime/internal/cli-credentials');
-    if (endpoint.protocol !== 'https:' &&
-        !(endpoint.protocol === 'http:' &&
-            ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-        throw new Error('cli_callback_insecure');
+    const endpoint = platformEndpoint(config.publicBaseUrl, PLATFORM_ROUTES.cliCredentials);
     try {
         const response = await fetch(endpoint, {
             method: 'POST',

package/dist/workspace-runtime/workspaces/file-snapshot.js

@@ -1,77 +1,7 @@
 import { chmod, lstat, mkdir, readdir, readFile, readlink, realpath, rm, symlink, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep } from 'node:path';
-import { fileSnapshotDigest, fileSnapshotManifestKey, fileSnapshotContentKey, nativeTranscriptKey, fileSnapshotManifestSchema, hashSnapshotBytes, isDisposableBackupPath, isWorkspaceAttachmentPath, putObjectBytes, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { UNPUSHED_BUNDLE, addBundleObjects, repositoryResolves } from './git.js';
+import { fileSnapshotDigest, fileSnapshotManifestKey, fileSnapshotManifestSchema, fileSnapshotObjectKey, hashSnapshotBytes, isDisposableBackupPath, isWorkspaceAttachmentPath, putObjectBytes, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
 const SKIP_DIRECTORY_NAMES = new Set(['.git', 'node_modules']);
-/** Build output, caches and scratch folders, at any depth: regenerated, so not kept in storage. */
-const UNSTORED_DIRECTORY_NAMES = new Set([
-    'dist',
-    'dist-all',
-    'coverage',
-    '.vite',
-    '.cache',
-    '.turbo',
-    '.parcel-cache',
-    '.sass-cache',
-    '.next',
-    '.nuxt',
-    '.svelte-kit',
-    'tmp',
-    '.tmp',
-    '.temp',
-]);
-/** Scratch and cache files, at any depth. */
-const UNSTORED_FILE = /(?:\.tmp|\.log|\.tsbuildinfo|^\.eslintcache)$/;
-/**
- * At the workspace root: the preview build's output, the builder's scratch folder, and skill
- * artifacts the sandbox pulls from the registry by `.playcraft/skills.lock.json`.
- */
-const UNSTORED_ROOT_DIRECTORIES = [
-    '.playcraft-preview-out/',
-    '.playcraft-temp/',
-    '.playcraft/skills/',
-    'ta-workspace/logs/',
-];
-/**
- * Recordings, frames and reports the template's verify and record scripts write again on each run.
- * The ring JSON evidence the build gate reads stays, as do the agent-edited profile and catalogs.
- */
-const UNSTORED_RUN_OUTPUT = [
-    /^recordings\/(?:.+\.(?:mp4|webm)$|\.tmp-[^/]+\/|focus\/|clean\/)/,
-    /^validate\/(?:[^/]+\.md$|(?:ring\d+\/)?frames\/|ring\d+\/[^/]+\.mp4$)/,
-];
-/**
- * Whether a path goes to checkpoint storage. Credentials, lock files, build output, caches and
- * scratch files stay in the instance: its local copy keeps them, so restoring inside the instance
- * does not remove them.
- */
-export function keptInStorage(path) {
-    if (isWorkspaceAttachmentPath(path))
-        return true;
-    if (isDisposableBackupPath(path))
-        return false;
-    if (path.startsWith('.git/'))
-        return true;
-    if (UNSTORED_ROOT_DIRECTORIES.some((prefix) => path.startsWith(prefix)))
-        return false;
-    if (UNSTORED_RUN_OUTPUT.some((pattern) => pattern.test(path)))
-        return false;
-    const segments = path.split('/');
-    if (UNSTORED_FILE.test(segments[segments.length - 1]))
-        return false;
-    return !segments.slice(0, -1).some((segment) => UNSTORED_DIRECTORY_NAMES.has(segment));
-}
-/**
- * Under `.git/`, what a `local` capture leaves to the remote: packs and their indexes, submodule
- * repositories (`git submodule update` fetches them again), LFS objects, and template hooks.
- */
-const REMOTE_GIT_DIRECTORIES = new Set([
-    '.git/objects/pack',
-    '.git/objects/info',
-    '.git/modules',
-    '.git/lfs',
-    '.git/hooks',
-]);
 const READ_ATTEMPTS = 3;
 const realIo = {
     async readdir(path) {
@@ -83,28 +13,13 @@ const realIo = {
     readFile,
     readlink,
 };
-export async function captureWorkspaceTree(root, previousPaths, revisions, io = realIo, options = {}) {
+export async function captureWorkspaceTree(root, previousPaths, revisions, io = realIo) {
     const entries = [];
     const files = [];
     const bodies = new Map();
     const seen = new Set();
     let status = 'complete';
-    const skip = (relativePath, name, directory) => {
-        if (name === '.' || name === '..')
-            return true;
-        if (directory && name === '.git')
-            return !(options.git && relativePath === '.git');
-        // A submodule's `.git` file points into `.git/modules`, which is not kept either.
-        if (!directory && name === '.git' && relativePath !== '.git')
-            return true;
-        if (directory && SKIP_DIRECTORY_NAMES.has(name))
-            return true;
-        if (directory && options.git === 'local' && REMOTE_GIT_DIRECTORIES.has(relativePath))
-            return true;
-        // Git's own lock files only exist while a command runs and must not come back with a restore.
-        return !directory && relativePath.startsWith('.git/') && name.endsWith('.lock');
-    };
-    await walk(root, root, io, revisions, entries, files, bodies, seen, skip, () => {
+    await walk(root, root, io, revisions, entries, files, bodies, seen, () => {
         status = 'incomplete';
     });
     for (const path of [...previousPaths].sort((left, right) => left.localeCompare(right))) {
@@ -147,12 +62,6 @@ export async function materializeRemoteSnapshot(root, entries) {
         if (hashSnapshotBytes(body) !== entry.contentHash)
             throw new Error('snapshot_mismatch');
     }
-    if (applicable.some((entry) => entry.path === '.git/HEAD')) {
-        const bundle = applicable.find((entry) => entry.path === UNPUSHED_BUNDLE && entry.kind === 'file');
-        if (bundle)
-            await addBundleObjects(rootReal, Buffer.from(bundle.contentBase64 ?? '', 'base64'));
-        await clearClonedGitMetadata(rootReal);
-    }
     for (const entry of applicable) {
         const target = resolve(rootReal, ...entry.path.split('/'));
         const rel = relative(rootReal, target);
@@ -176,100 +85,50 @@ export async function materializeRemoteSnapshot(root, entries) {
         if (entry.mode !== undefined)
             await chmod(target, entry.mode);
     }
+    let repositoryReady = false;
+    try {
+        const git = await lstat(join(rootReal, '.git'));
+        repositoryReady = git.isDirectory() && !git.isSymbolicLink();
+    }
+    catch {
+        repositoryReady = false;
+    }
     return {
         skipped,
         directoryReady: true,
-        repositoryReady: await repositoryResolves(rootReal),
+        repositoryReady,
         environmentReady: false,
     };
 }
-/**
- * The snapshot's `.git` replaces the one a new clone made, objects aside: a ref the clone wrote
- * would otherwise outrank the snapshot's packed refs.
- */
-async function clearClonedGitMetadata(rootReal) {
-    const gitDir = join(rootReal, '.git');
-    const info = await lstat(gitDir).catch(() => undefined);
-    if (!info?.isDirectory())
-        return;
-    for (const name of await readdir(gitDir)) {
-        if (name !== 'objects')
-            await rm(join(gitDir, name), { recursive: true, force: true });
-    }
-}
-/**
- * Content goes to the workspace's shared objects, keyed by hash. A hash in `uploaded` was stored by
- * this process before and is not sent again; hashes stored now are added to it. The manifest still
- * lists every stored file, so each snapshot restores on its own. Paths not `keptInStorage` are left
- * out of both the objects and the manifest.
- */
 export async function publishFileSnapshot(input) {
-    const stored = new Set();
-    const entries = input.tree.entries.filter((entry) => keptInStorage(entry.path));
-    for (const entry of entries) {
+    for (const entry of input.tree.entries) {
         if (entry.kind !== 'file' || !entry.contentHash)
             continue;
-        if (input.uploaded?.has(entry.contentHash) || stored.has(entry.contentHash))
-            continue;
         const body = input.tree.bodies.get(entry.path);
         if (!body || hashSnapshotBytes(body) !== entry.contentHash)
             throw new Error('snapshot_body_missing');
-        await putObjectBytes(input.baseUrl, fileSnapshotContentKey(input.workspaceId, entry.contentHash), body, 'cli', input.headers);
-        stored.add(entry.contentHash);
-    }
-    const native = [];
-    for (const transcript of input.native ?? []) {
-        const contentHash = hashSnapshotBytes(transcript.body);
-        if (input.uploadedTranscripts?.get(transcript.path) !== contentHash) {
-            await putObjectBytes(input.baseUrl, nativeTranscriptKey(input.workspaceId, transcript.path), transcript.body, 'cli', input.headers);
-            input.uploadedTranscripts?.set(transcript.path, contentHash);
-        }
-        native.push({
-            sessionId: transcript.sessionId,
-            threadId: transcript.threadId,
-            path: transcript.path,
-            contentHash,
-            size: transcript.body.byteLength,
-            capturedAt: transcript.capturedAt,
-        });
+        await putObjectBytes(input.baseUrl, fileSnapshotObjectKey(input.workspaceId, input.generation, input.snapshotId, entry.contentHash), body, 'cli', input.headers);
     }
-    const digest = fileSnapshotDigest(entries);
+    const digest = fileSnapshotDigest(input.tree.entries);
     const manifest = fileSnapshotManifestSchema.parse({
         snapshotId: input.snapshotId,
         workspaceId: input.workspaceId,
         generation: input.generation,
         status: input.tree.status,
-        entries,
+        entries: input.tree.entries,
         digest,
-        objectLayout: 'workspace',
-        ...(native.length > 0 ? { native } : {}),
     });
     const manifestKey = fileSnapshotManifestKey(input.workspaceId, input.generation, input.snapshotId);
     await putObjectBytes(input.baseUrl, manifestKey, Buffer.from(JSON.stringify(manifest)), 'cli', input.headers);
-    for (const hash of stored)
-        input.uploaded?.add(hash);
     return { manifestKey, checksum: digest, status: input.tree.status };
 }
-/**
- * Digest of what is on disk now, without the deletions recorded against the previous snapshot.
- * Transcripts count too: a turn that only talked still changes what a restore can resume.
- */
-export function liveTreeDigest(tree, native = []) {
-    const files = fileSnapshotDigest(tree.entries.filter((entry) => entry.kind !== 'deleted'));
-    if (native.length === 0)
-        return files;
-    const transcripts = native
-        .map((item) => `${item.sessionId}:${item.threadId}:${item.path}:${hashSnapshotBytes(item.body)}`)
-        .sort();
-    return hashSnapshotBytes(Buffer.from([files, ...transcripts].join('\n')));
-}
-async function walk(rootReal, current, io, revisions, entries, files, bodies, seen, skip, markIncomplete) {
+async function walk(rootReal, current, io, revisions, entries, files, bodies, seen, markIncomplete) {
     const listed = await io.readdir(current);
     for (const entry of listed) {
+        if (entry.name === '.' || entry.name === '..' || SKIP_DIRECTORY_NAMES.has(entry.name))
+            continue;
         const child = join(current, entry.name);
         const relativePath = toPosixRelative(rootReal, child);
-        if (skip(relativePath, entry.name, entry.isDirectory()))
-            continue;
         if (!workspaceRelativePathSchema.safeParse(relativePath).success) {
             markIncomplete();
             continue;
@@ -286,7 +145,7 @@ async function walk(rootReal, current, io, revisions, entries, files, bodies, se
             continue;
         }
         if (entry.isDirectory()) {
-            await walk(rootReal, child, io, revisions, entries, files, bodies, seen, skip, markIncomplete);
+            await walk(rootReal, child, io, revisions, entries, files, bodies, seen, markIncomplete);
             continue;
         }
         if (!entry.isFile())

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { promisify } from 'node:util';
 import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceGitDirectStore } from './git-direct-store.js';
-import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const exec = promisify(execFile);
 /** Only this control process sees the callback credential. Development processes use the local socket. */
 export class WorkspaceGitCredentialBroker {
@@ -165,9 +165,7 @@ export class WorkspaceGitCredentialBroker {
         await this.direct.sweep(true);
     }
     async refresh(binding, key) {
-        const endpoint = runtimeCallbackEndpoint(this.state.config.callbackUrl, '/runtime/internal/git-credentials');
-        if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-            throw new Error('git_broker_unavailable');
+        const endpoint = platformEndpoint(this.state.config.publicBaseUrl, PLATFORM_ROUTES.gitCredentials);
         const epoch = this.state.runtimeEpoch;
         const response = await fetch(endpoint, {
             method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),

package/dist/workspace-runtime/workspaces/git.js

@@ -1,6 +1,6 @@
 import { spawn } from 'node:child_process';
 import { excludeFromGit } from './dependencies.js';
-import { lstat, mkdir, readFile, realpath, rename, rm, stat, unlink, writeFile } from 'node:fs/promises';
+import { lstat, readFile, realpath, stat, unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, resolve, sep } from 'node:path';
 import { WORKSPACE_FILE_CONTENT_MAX, gitDiffSchema, gitFileContentSchema, gitGraphSchema, gitStatusSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
@@ -246,95 +246,81 @@ export async function pushWorkspaceGit(root, boundBranch) {
     catch { /* Preserve uncertainty; never replay a write automatically. */ }
     throw new GitWorkspaceError('git_push_outcome_unknown', 'git_push_outcome_unknown');
 }
-const UNPUSHED_DIRECTORY = '.git/playcraft';
-export const UNPUSHED_BUNDLE = `${UNPUSHED_DIRECTORY}/unpushed.bundle`;
-const UNPUSHED_TIPS = `${UNPUSHED_DIRECTORY}/unpushed.tips`;
 /**
- * Keeps a bundle of the commits on local branches and the latest stash that no remote-tracking
- * branch holds, so a backup without the packs still has them. It is rewritten only when one of
- * those refs moves, and removed when nothing is unpushed. Without remote-tracking refs there is no
- * baseline, and the whole history is left out rather than bundled.
+ * Credential files a save never commits, even when `.gitignore` misses them: env files (their
+ * `.example` / `.sample` / `.template` stay), SSH keys, netrc and Git credential stores, and key
+ * or certificate bundles.
  */
-export async function bundleUnpushedCommits(root) {
-    const rootReal = await realpath(root);
-    const marker = await lstat(join(rootReal, '.git')).catch(() => undefined);
-    if (!marker?.isDirectory())
-        return;
-    const tips = await git(rootReal, [
-        'for-each-ref', '--format=%(objectname) %(refname)', 'refs/heads', 'refs/remotes', 'refs/stash',
-    ]);
-    const tipsPath = join(rootReal, UNPUSHED_TIPS);
-    if ((await readFile(tipsPath, 'utf8').catch(() => undefined)) === tips)
-        return;
-    const refs = tips.split('\n').map((line) => line.split(' ')[1]).filter((ref) => Boolean(ref));
-    const local = ['--branches', ...(refs.includes('refs/stash') ? ['refs/stash'] : [])];
-    const unpushed = refs.some((ref) => ref.startsWith('refs/remotes/'))
-        ? Number.parseInt((await git(rootReal, ['rev-list', '--count', ...local, '--not', '--remotes'], 60000)).trim(), 10)
-        : 0;
-    const bundlePath = join(rootReal, UNPUSHED_BUNDLE);
-    await mkdir(join(rootReal, UNPUSHED_DIRECTORY), { recursive: true, mode: 0o700 });
-    if (unpushed > 0) {
-        // The `.lock` name keeps a half-written bundle out of any snapshot.
-        const temp = `${bundlePath}.lock`;
-        try {
-            await git(rootReal, ['bundle', 'create', temp, ...local, '--not', '--remotes'], 120000);
-            await rename(temp, bundlePath);
-        }
-        finally {
-            await rm(temp, { force: true });
-        }
-    }
-    else {
-        await rm(bundlePath, { force: true });
-    }
-    await writeFile(tipsPath, tips, { mode: 0o600 });
+const CREDENTIAL_FILE = /^(?:\.env(?:\.(?!(?:example|sample|template)$)[^/]+)?|id_(?:rsa|dsa|ecdsa|ed25519)|\.netrc|\.git-credentials|[^/]*\.(?:pem|key|p12|pfx))$/i;
+export function isCredentialFile(path) {
+    return CREDENTIAL_FILE.test(path.split('/').pop() ?? '');
 }
 /**
- * Adds a bundle's objects to the repository. `unbundle` walks history from the current refs, so this
- * runs on the fresh clone before the snapshot's refs, which point at these very commits, replace its
- * own. It fails when the remote lost the commits the bundle was built on; `repositoryResolves` then
- * reports what is missing.
+ * Commits every change in the work tree (`git add -A`, credential files aside) and, when asked,
+ * pushes the branch. A save with nothing new commits nothing and pushes only what the remote
+ * lacks, so a commit whose push failed goes out with the next save.
  */
-export async function addBundleObjects(root, body) {
-    const rootReal = await realpath(root);
-    const marker = await lstat(join(rootReal, '.git')).catch(() => undefined);
-    if (!marker?.isDirectory())
+export async function saveWorkspaceGit(root, input) {
+    const rootReal = await ensureWorkspaceGit(root);
+    await assertBoundBranch(rootReal, input.boundBranch);
+    await git(rootReal, ['add', '-A'], 60000);
+    const staged = (await git(rootReal, ['diff', '--cached', '--name-only', '-z'], 60000)).split('\0').filter(Boolean);
+    const withheld = staged.filter(isCredentialFile);
+    await unstage(rootReal, withheld);
+    const cached = await gitAllowFail(rootReal, ['diff', '--cached', '--quiet'], 60000);
+    if (cached.code !== 0 && cached.code !== 1) {
+        throw new GitWorkspaceError('git_command_failed', cached.stderr.trim() || 'git_diff_failed');
+    }
+    let commit;
+    if (cached.code === 1) {
+        await git(rootReal, [...(await commitIdentity(rootReal)), 'commit', '-q', '-m', input.message], 60000);
+        commit = (await git(rootReal, ['rev-parse', 'HEAD'])).trim();
+    }
+    if (!input.push || (await remoteHasHead(rootReal)))
+        return { ...(commit ? { commit } : {}), pushed: false, withheld };
+    await pushWorkspaceGit(rootReal, input.boundBranch);
+    await recordPushedHead(rootReal);
+    return { ...(commit ? { commit } : {}), pushed: true, withheld };
+}
+async function unstage(rootReal, paths) {
+    if (paths.length === 0)
         return;
-    const temp = join(rootReal, '.git', 'playcraft-restore.bundle.lock');
-    try {
-        await writeFile(temp, body, { mode: 0o600 });
-        await gitAllowFail(rootReal, ['bundle', 'unbundle', temp], 120000);
-    }
-    catch {
-        /* Reported by repositoryResolves. */
-    }
-    finally {
-        await rm(temp, { force: true });
+    const born = (await gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD'])).code === 0;
+    for (let start = 0; start < paths.length; start += 100) {
+        const chunk = paths.slice(start, start + 100);
+        // Before the first commit there is no HEAD to reset to; dropping the entries does the same.
+        await git(rootReal, born ? ['reset', '-q', '--', ...chunk] : ['rm', '-q', '--cached', '--', ...chunk]);
     }
 }
-/** Whether HEAD and the index resolve to objects the repository holds. */
-export async function repositoryResolves(root) {
-    const rootReal = await realpath(root);
-    const marker = await lstat(join(rootReal, '.git')).catch(() => undefined);
-    if (!marker?.isDirectory())
-        return false;
-    try {
-        // Snapshots hold files only; Git does not recognise a repository whose refs folder is gone.
-        for (const directory of ['refs/heads', 'refs/tags', 'objects']) {
-            await mkdir(join(rootReal, '.git', directory), { recursive: true, mode: 0o755 });
-        }
-        const head = await gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD^{tree}']);
-        if (head.code === 0) {
-            const index = await gitAllowFail(rootReal, ['diff-index', '--cached', '--quiet', 'HEAD'], 60000);
-            return index.code === 0 || index.code === 1;
-        }
-        // Before the first commit there is no branch to resolve.
-        const branches = await gitAllowFail(rootReal, ['for-each-ref', '--count=1', 'refs/heads']);
-        return branches.code === 0 && branches.stdout.trim() === '';
-    }
-    catch {
+/** A clone carries no committer; the sandbox image sets none either. */
+async function commitIdentity(rootReal) {
+    const email = await gitAllowFail(rootReal, ['config', 'user.email']);
+    if (email.code === 0 && email.stdout.trim())
+        return [];
+    return ['-c', 'user.name=PlayCraft Workspace', '-c', 'user.email=workspace@playcraft.local'];
+}
+/**
+ * The remote-tracking ref of the current branch. A fork clone has no fetch refspec for its own
+ * branch, so the ref is written here after a confirmed push.
+ */
+async function trackingRef(rootReal) {
+    const branch = (await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD'])).stdout.trim();
+    return branch ? `refs/remotes/origin/${branch}` : undefined;
+}
+async function remoteHasHead(rootReal) {
+    const ref = await trackingRef(rootReal);
+    if (!ref)
         return false;
-    }
+    const [head, tracked] = await Promise.all([
+        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD^{commit}']),
+        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', `${ref}^{commit}`]),
+    ]);
+    return head.code === 0 && tracked.code === 0 && head.stdout.trim() === tracked.stdout.trim();
+}
+async function recordPushedHead(rootReal) {
+    const ref = await trackingRef(rootReal);
+    if (ref)
+        await gitAllowFail(rootReal, ['update-ref', ref, 'HEAD']);
 }
 export async function ensureWorkspaceGit(root) {
     const rootReal = await realpath(root);

package/dist/workspace-runtime/workspaces/skill-artifact-loader.js

@@ -1,6 +1,6 @@
 import { createHash } from 'node:crypto';
 import { workspaceRoot } from './registry.js';
-import { runtimeCallbackEndpoint } from '../../utils/environment-endpoints.js';
+import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
 const MAX_ARTIFACT_BYTES = 80 * 1024 * 1024;
 /** Requests an exact locked artifact using control identity; no storage credentials reach Codex. */
 export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
@@ -8,9 +8,7 @@ export async function loadWorkspaceSkillArtifact(state, workspaceId, entry) {
     const epoch = state.runtimeEpoch;
     if (state.journal.destroyed())
         throw new Error('workspace_skills_unavailable');
-    const endpoint = runtimeCallbackEndpoint(state.config.callbackUrl, '/runtime/internal/skill-artifacts');
-    if (endpoint.protocol !== 'https:' && !(endpoint.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(endpoint.hostname)))
-        throw new Error('workspace_skills_callback_insecure');
+    const endpoint = platformEndpoint(state.config.publicBaseUrl, PLATFORM_ROUTES.skillArtifacts);
     const response = await fetch(endpoint, {
         method: 'POST', redirect: 'error', signal: AbortSignal.timeout(30_000),
         headers: { authorization: `Bearer ${state.config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': state.config.environment },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.16",
+  "version": "0.1.18",
   "private": false,
   "type": "module",
   "engines": {
@@ -48,8 +48,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "^0.1.16",
-    "@playcraft/common": "^0.1.16",
+    "@playcraft/build": "^0.1.18",
+    "@playcraft/common": "^0.1.18",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",

package/dist/workspace-runtime/codex/transcripts.js

@@ -1,94 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { readdir, readFile, stat } from 'node:fs/promises';
-import { join } from 'node:path';
-import { startLauncherProcess } from './launcher-client.js';
-export const TRANSCRIPT_MAX_BYTES = 64 * 1024 * 1024;
-const THREAD_ID = /^[A-Za-z0-9_-]{1,128}$/;
-const TRANSCRIPT_PATH = /^sessions\/\d{4}\/\d{2}\/\d{2}\/rollout-[A-Za-z0-9_.-]{1,200}\.jsonl$/;
-const COMMAND_TIMEOUT_MS = 60_000;
-/**
- * Reads the transcript Codex keeps for one thread. Codex appends to it while a turn runs, so a
- * trailing partial line is dropped; what is returned always parses line by line.
- */
-export async function exportTranscript(home, threadId) {
-    if (!THREAD_ID.test(threadId))
-        return undefined;
-    const found = home.launcher
-        ? await exportAsDeveloper(home.homeDir, home.launcher, threadId)
-        : await exportDirect(home.homeDir, threadId);
-    if (!found || !transcriptPathFor(found.path, threadId))
-        return undefined;
-    const end = found.body.lastIndexOf(0x0a);
-    if (end < 0)
-        return undefined;
-    return { path: found.path, body: found.body.subarray(0, end + 1) };
-}
-function transcriptPathFor(path, threadId) {
-    return TRANSCRIPT_PATH.test(path) && path.endsWith(`-${threadId}.jsonl`);
-}
-async function exportDirect(homeDir, threadId) {
-    const suffix = `-${threadId}.jsonl`;
-    for (const year of await names(join(homeDir, 'sessions'))) {
-        for (const month of await names(join(homeDir, 'sessions', year))) {
-            for (const day of await names(join(homeDir, 'sessions', year, month))) {
-                const directory = join('sessions', year, month, day);
-                const match = (await names(join(homeDir, directory))).find((name) => name.endsWith(suffix));
-                if (!match)
-                    continue;
-                const path = `${directory}/${match}`;
-                const absolute = join(homeDir, path);
-                if ((await stat(absolute)).size > TRANSCRIPT_MAX_BYTES)
-                    return undefined;
-                return { path, body: await readFile(absolute) };
-            }
-        }
-    }
-    return undefined;
-}
-async function exportAsDeveloper(homeDir, launcher, threadId) {
-    const limitKib = TRANSCRIPT_MAX_BYTES / 1024;
-    const outcome = await runAsDeveloper(launcher, [
-        `home=${quote(homeDir)}`,
-        `f=$(find "$home/sessions" -mindepth 4 -maxdepth 4 -type f -name ${quote(`rollout-*-${threadId}.jsonl`)} -size -${limitKib}k 2>/dev/null | head -n 1)`,
-        '[ -n "$f" ] || exit 3',
-        'printf \'%s\\n\' "${f#"$home"/}"',
-        'base64 -w 0 "$f"',
-    ].join('; '));
-    if (outcome.code !== 0)
-        return undefined;
-    const text = outcome.stdout.toString('utf8');
-    const newline = text.indexOf('\n');
-    if (newline < 0)
-        return undefined;
-    return { path: text.slice(0, newline), body: Buffer.from(text.slice(newline + 1).trim(), 'base64') };
-}
-async function runAsDeveloper(launcher, command) {
-    const child = await startLauncherProcess({
-        socketPath: launcher.socketPath,
-        processId: `transcript-${randomUUID()}`,
-        runtimeEpoch: launcher.runtimeEpoch,
-        argv: ['/usr/bin/bash', '-c', `{ ${command}; } </dev/null 2>/dev/null`],
-        cwd: launcher.cwd,
-        env: {},
-    });
-    child.stdin?.end();
-    const chunks = [];
-    child.stdout?.on('data', (chunk) => chunks.push(Buffer.from(chunk)));
-    const code = await new Promise((resolve) => {
-        const timer = setTimeout(() => {
-            void child.stop().catch(() => undefined);
-            resolve(null);
-        }, COMMAND_TIMEOUT_MS);
-        child.onExit((value) => {
-            clearTimeout(timer);
-            resolve(value);
-        });
-    });
-    return { code, stdout: Buffer.concat(chunks) };
-}
-async function names(directory) {
-    return readdir(directory).then((entries) => entries.sort(), () => []);
-}
-function quote(value) {
-    return `'${value.replaceAll("'", "'\\''")}'`;
-}