@playcraft/cli 0.1.23 → 0.1.24

package/dist/workspace-runtime/production/native.js

@@ -1,70 +0,0 @@
-import { join } from 'node:path';
-import { createCodexAppServerAdapter } from '../codex/app-server.js';
-import { verifyProductionLease } from './storage.js';
-import { processBirth, stopProductionGroup } from './processes.js';
-export async function runProductionNative(state, input, root, record, track) {
-    if (!input.model)
-        throw new Error('production_model_configuration_required');
-    const groups = [];
-    const adapter = createCodexAppServerAdapter({ config: { ...state.config, workspaceMode: 'single', workspaceRoot: root },
-        command: process.env.PLAYCRAFT_PRODUCTION_CODEX_COMMAND,
-        homeDir: process.env.PLAYCRAFT_LAUNCHER_SOCKET
-            ? `/var/lib/playcraft/codex/production-${input.task.attemptId}` : join(state.config.stateDir, 'production-native', input.task.attemptId),
-        model: input.model.model, processGroup: true,
-        fixedThreadConfig: { model: input.model.model, modelProvider: 'playcraft_production', config: {
-                approval_policy: 'never', sandbox_mode: 'danger-full-access',
-                'model_providers.playcraft_production': { name: 'PlayCraft Production', base_url: input.model.endpoint,
-                    wire_api: 'responses', requires_openai_auth: false, http_headers: { Authorization: `Bearer ${input.model.token}` } },
-            } },
-        onSkillProcessRestart: async (process) => {
-            const group = { pid: process.pid, birth: await processBirth(process.pid), stopped: false };
-            groups.push(group);
-            await record(group);
-        },
-    });
-    track(() => adapter.close());
-    const sessionId = `production-${input.task.attemptId}`;
-    let completion;
-    const done = new Promise(resolve => { completion = resolve; });
-    const unsubscribe = adapter.onCollected?.(event => {
-        if (event.kind === 'process_exit')
-            completion('unknown');
-        if (event.method === 'turn/completed') {
-            const value = event.params;
-            completion(value.turn?.status === 'completed' ? 'completed' : 'failed');
-        }
-    });
-    try {
-        await adapter.start();
-        const process = adapter.executionProcess?.();
-        if (!process)
-            throw new Error('production_process_not_started');
-        const group = { pid: process.pid, birth: await processBirth(process.pid), stopped: false };
-        groups.push(group);
-        await record(group);
-        const thread = await adapter.startThread({ sessionId, cwd: root });
-        const turn = await adapter.startTurn({ sessionId, threadId: thread.threadId, text: String(input.payload.prompt ?? ''),
-            clientRequestId: `${input.task.attemptId}:generate`, persistReservation: async () => undefined });
-        if (turn.outcome !== 'accepted')
-            throw new Error('production_native_start_unknown');
-        const timeout = setTimeout(() => completion('unknown'), 30 * 60_000);
-        let checking = false;
-        const leaseCheck = setInterval(() => {
-            if (checking)
-                return;
-            checking = true;
-            void verifyProductionLease(input).catch(async () => { completion('unknown'); await adapter.close?.().catch(() => undefined); }).finally(() => { checking = false; });
-        }, 5000);
-        const status = await done;
-        clearInterval(leaseCheck);
-        clearTimeout(timeout);
-        if (status !== 'completed')
-            throw new Error(status === 'failed' ? 'production_native_failed' : 'production_native_unknown');
-    }
-    finally {
-        unsubscribe?.();
-        await adapter.close?.().catch(() => undefined);
-        for (const group of groups)
-            await record({ ...group, stopped: await stopProductionGroup(group) });
-    }
-}

package/dist/workspace-runtime/production/processes.js

@@ -1,86 +0,0 @@
-import { spawn, execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { readFile } from 'node:fs/promises';
-import { setTimeout as delay } from 'node:timers/promises';
-import { startLauncherProcess } from '../codex/launcher-client.js';
-export async function processBirth(pid) {
-    if (process.platform !== 'linux') {
-        return promisify(execFile)('ps', ['-p', String(pid), '-o', 'lstart='], { timeout: 2000 }).then(value => value.stdout.trim() || undefined, () => undefined);
-    }
-    try {
-        const stat = await readFile(`/proc/${pid}/stat`, 'utf8');
-        return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
-    }
-    catch {
-        return undefined;
-    }
-}
-export function groupExited(pid) {
-    try {
-        process.kill(-pid, 0);
-        return false;
-    }
-    catch (error) {
-        return error.code === 'ESRCH';
-    }
-}
-export async function stopProductionGroup(record) {
-    if (record.stopped || groupExited(record.pid))
-        return true;
-    if (record.birth && await processBirth(record.pid) !== record.birth)
-        return false;
-    for (const signal of ['SIGTERM', 'SIGKILL']) {
-        try {
-            process.kill(-record.pid, signal);
-        }
-        catch { /* Recheck whether the whole group exited. */ }
-        const deadline = Date.now() + 2000;
-        while (Date.now() < deadline) {
-            if (groupExited(record.pid))
-                return true;
-            await delay(25);
-        }
-    }
-    return groupExited(record.pid);
-}
-/** Only the save stage receives repository credentials; build and install receive none. */
-export async function runProductionCommand(state, input) {
-    const launcher = !input.trusted ? process.env.PLAYCRAFT_LAUNCHER_SOCKET : undefined;
-    const launched = launcher ? await startLauncherProcess({ socketPath: launcher, processId: input.processId,
-        runtimeEpoch: state.runtimeEpoch, argv: ['/usr/bin/bash', '-lc', input.command], cwd: input.cwd, env: input.env ?? {} }) : undefined;
-    const local = launched ? undefined : spawn('bash', ['-lc', input.command], { cwd: input.cwd,
-        env: { PATH: process.env.PATH, HOME: state.config.stateDir, ...input.env }, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
-    const pid = launched?.pid ?? local?.pid;
-    if (!pid)
-        throw new Error('production_process_not_started');
-    const record = { pid, birth: await processBirth(pid), stopped: false };
-    try {
-        await input.record(record);
-    }
-    catch (error) {
-        await stopProductionGroup(record);
-        throw error;
-    }
-    let output = '';
-    const collect = (chunk) => { output = (output + String(chunk)).slice(-64 * 1024); };
-    (launched?.stdout ?? local.stdout).on('data', collect);
-    (launched?.stderr ?? local.stderr).on('data', collect);
-    launched?.stdin?.end();
-    let timedOut = false;
-    const code = await new Promise((resolve) => {
-        const timeout = setTimeout(() => {
-            timedOut = true;
-            void (launched ? launched.stop() : stopProductionGroup(record)).catch(() => undefined).finally(() => resolve(undefined));
-        }, input.timeoutMs);
-        const finish = (code) => { clearTimeout(timeout); resolve(code); };
-        if (launched)
-            launched.onExit(finish);
-        else {
-            local.once('error', () => finish(undefined));
-            local.once('close', finish);
-        }
-    });
-    const stopped = await stopProductionGroup(record);
-    await input.record({ ...record, stopped });
-    return { code: timedOut ? undefined : code, output, stopped };
-}

package/dist/workspace-runtime/production/save-command.js

@@ -1,20 +0,0 @@
-export function productionSaveCommand() {
-    return `set -eu
-status=0
-remote=$(git -c protocol.version=0 -c core.hooksPath=/dev/null ls-remote --exit-code --heads "$PRODUCTION_REPOSITORY" "refs/heads/$PRODUCTION_BRANCH") || status=$?
-if [ "$status" != 0 ] && [ "$status" != 2 ]; then exit "$status"; fi
-if [ "\${PRODUCTION_EXPECTED_PARENT+x}" = x ]; then
-  actual=$(printf '%s' "$remote" | cut -f1)
-  test "$actual" = "$PRODUCTION_EXPECTED_PARENT" || { printf 'production_git_parent_changed\\n' >&2; exit 1; }
-fi
-if [ -n "$remote" ]; then
-  parent=$(printf '%s' "$remote" | cut -f1)
-  git -c protocol.version=0 -c core.hooksPath=/dev/null fetch --no-tags --no-recurse-submodules "$PRODUCTION_REPOSITORY" "refs/heads/$PRODUCTION_BRANCH"
-  test "$(git rev-parse FETCH_HEAD)" = "$parent"
-  git -c core.hooksPath=/dev/null -c core.fsmonitor=false reset --soft FETCH_HEAD
-fi
-git -c core.hooksPath=/dev/null -c core.fsmonitor=false add -A .
-git diff --cached --quiet || git -c core.hooksPath=/dev/null commit -m "Save generated engineering"
-git -c protocol.version=0 -c core.hooksPath=/dev/null push "$PRODUCTION_REPOSITORY" HEAD:"refs/heads/$PRODUCTION_BRANCH"
-git rev-parse HEAD`;
-}

package/dist/workspace-runtime/production/stages.js

@@ -1,175 +0,0 @@
-import { execFile } from 'node:child_process';
-import { createHash } from 'node:crypto';
-import { lstat, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
-import { promisify } from 'node:util';
-import { batchBaselineSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
-import { checkoutBatchCommit, freezeBatchCommit } from '../workspaces/batch-commit.js';
-import { openDirectoryToDevelopment } from '../workspaces/directory-access.js';
-import { registerWorkspaceDirectory } from '../workspaces/directories.js';
-import { workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
-import { excludeFromGit, settleDependencyInstalls } from '../workspaces/dependencies.js';
-import { resolveProductionDependencies, verifyProductionDependencyLocks } from './dependencies.js';
-import { productionSaveCommand } from './save-command.js';
-import { productionOutputStore, verifyProductionLease } from './storage.js';
-import { runProductionCommand } from './processes.js';
-import { runProductionNative } from './native.js';
-import { classifyPreviewOutput, findExternalLocalReferences } from '../previews/single-file.js';
-const execute = promisify(execFile);
-const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
-const hash = (body) => createHash('sha256').update(body).digest('hex');
-const record = (value) => value && typeof value === 'object' ? value : {};
-export async function executeProductionStage(state, input, processRecord, track) {
-    await verifyProductionLease(input);
-    const store = productionOutputStore(input);
-    const stage = input.stage;
-    const workspaceId = input.task.workspaceId;
-    const resultId = String(input.payload.resultVersionId ?? input.task.payload.resultVersionId ?? input.task.attemptId);
-    const previous = (name) => input.stages?.find(value => value.stage === name && value.status === 'completed')?.result;
-    const run = async (cwd, command, env, trusted = false) => {
-        const outcome = await runProductionCommand(state, { processId: `production-${input.task.attemptId}-${stage}`, cwd, command, env, trusted,
-            timeoutMs: 10 * 60_000, record: processRecord });
-        if (!outcome.stopped || outcome.code === undefined)
-            throw new Error('production_process_unknown');
-        if (outcome.code !== 0)
-            throw new Error(`production_${stage}_failed`);
-        return outcome.output;
-    };
-    const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root, ...args], {
-        timeout: 20_000, maxBuffer: 1024 * 1024, env: { PATH: process.env.PATH, HOME: state.config.stateDir, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' },
-    })).stdout.trim();
-    if (stage === 'prepare' && input.directoryName !== 'basic') {
-        const baseline = record(input.payload.baseline ?? input.task.payload.baseline);
-        const authority = record(input.payload.workspace);
-        const sourceCommit = baseline.commitHash;
-        if (typeof sourceCommit !== 'string')
-            throw new Error('production_approved_commit_required');
-        const directory = { workspaceId, directoryName: input.directoryName,
-            remixId: String(authority.remixId), branchName: String(authority.branchName), sourceCommit };
-        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence);
-    }
-    const root = await workspaceRoot(state, workspaceId, input.directoryName);
-    if (stage === 'capture-source') {
-        if (input.directoryName !== 'basic')
-            throw new Error('production_source_directory_mismatch');
-        if (workspaceSessions(state, workspaceId, 'basic').some(session => session.turnBlock === 'uncertain' || ['starting', 'running', 'waiting_for_user'].includes(session.turnStatus ?? '')))
-            throw new Error('production_source_busy');
-        await settleDependencyInstalls(state);
-        await resolveProductionDependencies(root);
-        await excludeFromGit(root);
-        await excludeFromGit(root, '/.env*');
-        await git(root, 'config', 'user.name', 'PlayCraft');
-        await git(root, 'config', 'user.email', 'playcraft@localhost');
-        await run(root, 'git -c core.hooksPath=/dev/null add -A . && (git diff --cached --quiet || git -c core.hooksPath=/dev/null commit -m "Preserve basic before common repair")', undefined, true);
-        const commitHash = await git(root, 'rev-parse', 'HEAD');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash, snapshotId: `${input.task.attemptId}-capture-source` });
-        return { sourceSnapshot: snapshot, commitHash };
-    }
-    if (stage === 'prepare') {
-        await settleDependencyInstalls(state);
-        const policy = await resolveProductionDependencies(root);
-        await run(root, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
-        await verifyProductionDependencyLocks(root, policy);
-        return { prepared: true, directoryName: input.directoryName };
-    }
-    if (stage === 'generate') {
-        await runProductionNative(state, input, root, processRecord, track);
-        await resolveProductionDependencies(root);
-        return { generated: true };
-    }
-    if (stage === 'save') {
-        if (!input.git)
-            throw new Error('production_git_scope_required');
-        const binding = state.journal.getWorkspace(workspaceId);
-        const branch = input.directoryName === 'basic' ? binding.branchName : binding.directories?.find(value => value.directoryName === input.directoryName)?.branchName;
-        if (input.git.branchName !== branch || await git(root, 'symbolic-ref', '--short', 'HEAD') !== branch)
-            throw new Error('production_git_binding_mismatch');
-        await excludeFromGit(root);
-        await excludeFromGit(root, '/.env*');
-        await excludeFromGit(root, '/.playcraft-temp/');
-        await excludeFromGit(root, '/.playcraft-preview-out/');
-        await git(root, 'config', 'user.name', 'PlayCraft');
-        await git(root, 'config', 'user.email', 'playcraft@localhost');
-        const env = { PRODUCTION_REPOSITORY: input.git.repositoryUrl, PRODUCTION_BRANCH: input.git.branchName,
-            GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
-        if (input.git.username && input.git.password)
-            Object.assign(env, { GIT_CONFIG_COUNT: '1',
-                GIT_CONFIG_KEY_0: `http.${input.git.repositoryUrl}.extraHeader`,
-                GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from(`${input.git.username}:${input.git.password}`).toString('base64')}` });
-        if (typeof input.payload.expectedParent === 'string')
-            env.PRODUCTION_EXPECTED_PARENT = input.payload.expectedParent;
-        await run(root, productionSaveCommand(), env, true);
-        const commitHash = await git(root, 'rev-parse', 'HEAD');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash, snapshotId: `${input.task.attemptId}-save` });
-        return { snapshot, saved: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId, sourceDigest: snapshot.checksum, commitHash, pushedCommitHash: commitHash } };
-    }
-    if (stage === 'freeze') {
-        const saved = record(previous('save')?.saved);
-        if (typeof saved.commitHash !== 'string')
-            throw new Error('production_saved_commit_required');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash: saved.commitHash, snapshotId: `${input.task.attemptId}-freeze` });
-        const baseline = batchBaselineSnapshotSchema.parse({ batchId: input.task.batchId, projectId: String(input.payload.projectId ?? input.task.payload.projectId),
-            snapshotId: snapshot.snapshotId, sourceWorkspaceId: snapshot.sourceWorkspaceId, commitHash: snapshot.commitHash, checksum: snapshot.checksum,
-            sourceVersion: snapshot.sourceVersion, engine: String(input.payload.engine ?? input.task.payload.engine), skillLockDigest: snapshot.skillLockDigest, frozenAt: snapshot.frozenAt });
-        return { snapshot, baseline };
-    }
-    if (stage === 'build') {
-        const saved = record(input.payload.saved ?? previous('save')?.saved);
-        const snapshot = (previous('freeze')?.snapshot ?? previous('save')?.snapshot);
-        if (!snapshot || snapshot.commitHash !== saved.commitHash || snapshot.checksum !== saved.sourceDigest)
-            throw new Error('production_saved_snapshot_mismatch');
-        const destination = join(root, '.playcraft-temp', `production-${input.task.attemptId}`);
-        await excludeFromGit(root, '/.playcraft-temp/');
-        await rm(destination, { recursive: true, force: true });
-        try {
-            await checkoutBatchCommit({ source: { workspaceId, root }, frozen: snapshot, destination });
-            await openDirectoryToDevelopment(destination, (await lstat(state.config.workspaceRoot)).gid);
-            const policy = await resolveProductionDependencies(destination);
-            await run(destination, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
-            await verifyProductionDependencyLocks(destination, policy);
-            const output = join(destination, '.production-html');
-            const command = process.env.PLAYCRAFT_PRODUCTION_BUILD_COMMAND ?? 'playcraft build --mode full --platform playcraft --format html';
-            await run(destination, `${command} --output ${quote(output)} .`);
-            await verifyProductionDependencyLocks(destination, policy);
-            const entries = await readdir(output, { withFileTypes: true });
-            const single = classifyPreviewOutput(entries.map(entry => ({ name: entry.name, kind: entry.isFile() ? 'file' : entry.isDirectory() ? 'dir' : 'symlink' })));
-            if (!single.ok)
-                throw new Error('production_preview_not_single_file');
-            const path = join(output, single.entry);
-            if (!(await lstat(path)).isFile())
-                throw new Error('production_preview_invalid');
-            const body = await readFile(path);
-            if (findExternalLocalReferences(body.toString()).length)
-                throw new Error('production_preview_external_reference');
-            const outputDigest = hash(body), outputKey = `workspaces/${workspaceId}/production/${input.task.attemptId}/${outputDigest}.html`;
-            await store.put(outputKey, body);
-            return { outputKey, outputDigest, build: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId,
-                    sourceDigest: snapshot.checksum, commitHash: snapshot.commitHash, buildId: `${input.task.attemptId}-build`, succeeded: true } };
-        }
-        finally {
-            await rm(destination, { recursive: true, force: true });
-        }
-    }
-    if (stage === 'preview') {
-        const built = previous('build');
-        if (typeof built?.outputKey !== 'string' || typeof built.outputDigest !== 'string')
-            throw new Error('production_build_required');
-        const body = await store.get(built.outputKey);
-        if (hash(body) !== built.outputDigest)
-            throw new Error('production_preview_digest_mismatch');
-        const previewPath = join(root, '.playcraft-temp', `${input.task.attemptId}.html`);
-        await mkdir(dirname(previewPath), { recursive: true });
-        await writeFile(previewPath, body);
-        try {
-            const browser = process.env.PLAYCRAFT_PRODUCTION_PREVIEW_COMMAND ?? 'chromium --headless --no-sandbox --disable-gpu --virtual-time-budget=1000 --dump-dom';
-            const opened = await run(root, `${browser} ${quote(`file://${previewPath}`)}`);
-            if (!/<html[\s>]/i.test(opened))
-                throw new Error('production_preview_not_opened');
-            return { opened: true, outputDigest: built.outputDigest };
-        }
-        finally {
-            await rm(previewPath, { force: true });
-        }
-    }
-    throw new Error('invalid_production_stage');
-}

package/dist/workspace-runtime/production/storage.js

@@ -1,32 +0,0 @@
-const taskUrl = (input) => `${input.callbackUrl.replace(/\/+$/, '')}/internal/cloud-production/tasks/${input.task.taskId}`;
-/** Build output travels through the Runtime that leased the task; engineering files travel through Git. */
-export function productionOutputStore(input) {
-    const object = (key) => `${taskUrl(input)}/objects/${encodeURIComponent(key)}`;
-    const headers = { authorization: `Bearer ${input.runnerToken}`, 'x-playcraft-object-client': 'cli' };
-    return {
-        async get(key) {
-            const response = await fetch(object(key), { headers, redirect: 'error', signal: AbortSignal.timeout(60_000) });
-            if (response.status === 404)
-                throw new Error('object_missing');
-            if (!response.ok)
-                throw new Error('object_get_failed');
-            return Buffer.from(await response.arrayBuffer());
-        },
-        async put(key, body) {
-            const response = await fetch(object(key), { method: 'PUT', body: new Uint8Array(body), redirect: 'error', signal: AbortSignal.timeout(60_000),
-                headers: { ...headers, 'content-type': 'application/octet-stream' } });
-            if (!response.ok)
-                throw new Error(response.status === 409 ? 'object_conflict' : 'object_put_failed');
-        },
-    };
-}
-export async function verifyProductionLease(input) {
-    const response = await fetch(`${taskUrl(input)}/runner`, {
-        headers: { authorization: `Bearer ${input.runnerToken}` }, redirect: 'error', signal: AbortSignal.timeout(10_000),
-    });
-    if (!response.ok)
-        throw new Error('production_lease_unavailable');
-    const { task } = await response.json();
-    if (!task || task.taskId !== input.task.taskId || task.attemptId !== input.task.attemptId || task.leaseOwner !== input.lease.owner || task.leaseFence !== input.lease.fence || task.status !== 'running' || task.cancelRequested)
-        throw new Error('production_lease_unavailable');
-}

package/dist/workspace-runtime/serve.js

@@ -1,199 +0,0 @@
-import { closeCliCredentials } from './workspaces/cli-credentials.js';
-import { randomUUID } from 'node:crypto';
-import { mkdir } from 'node:fs/promises';
-import { createServer } from 'node:http';
-import { INCOMPATIBLE_EXIT_CODE, negotiateProtocol, } from '@playcraft/common/cloud-workspace/runtime';
-import { RuntimeJournal } from './persistence/journal.js';
-import { createCodexAppServerAdapter } from './codex/app-server.js';
-import { createLoopbackNativeAdapter } from './codex/loopback.js';
-import { attachNativeCollector } from './server/dispatch.js';
-import { handleRuntimeRequest } from './server/http.js';
-import { desktopHost, disposeDesktopHost } from './server/desktop-host.js';
-import { disposeTerminalHost, terminalHost } from './server/terminal-host.js';
-import { handleExecutionGroupCrash } from './server/execution-group.js';
-import { RuntimeProcessLock } from './server/lock.js';
-import { probeGitBinary } from './workspaces/git.js';
-import { WorkspaceGitCredentialBroker } from './workspaces/git-credential-broker.js';
-import { WorkspaceModelBroker } from './codex/model-broker.js';
-import { recoverInterruptedPreviews } from './previews/publish.js';
-import { recoverInterruptedInstalls } from './workspaces/dependencies.js';
-import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.js';
-import { workspaceContextFromRoot } from './workspaces/registry.js';
-export async function startWorkspaceRuntime(config, options = {}) {
-    process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
-    const negotiated = negotiateProtocol(config);
-    if (!negotiated.ok) {
-        const error = Object.assign(new Error('protocol_incompatible'), {
-            code: 'protocol_incompatible',
-            exitCode: INCOMPATIBLE_EXIT_CODE,
-        });
-        throw error;
-    }
-    const lock = new RuntimeProcessLock(config.stateDir);
-    lock.acquire();
-    let journal;
-    let gitCredentials;
-    try {
-        journal = new RuntimeJournal(config.stateDir);
-        await journal.load();
-        const previousEpoch = journal.storedRuntimeEpoch();
-        const previousGroup = journal.executionGroup();
-        const previousIdentityMatches = journal.epochsSnapshot().some((epoch) => epoch.runtime_id === config.runtimeId && epoch.generation === config.generation && epoch.runtime_epoch === previousEpoch);
-        await recoverInterruptedInstalls(journal);
-        await recoverInterruptedPreviews(journal);
-        await mkdir(config.workspaceRoot, { recursive: true, mode: 0o700 });
-        const state = {
-            config: { ...config, protocolMinor: negotiated.protocolMinor },
-            configPath: options.configPath,
-            journal,
-            acceptedLeaseFence: journal.acceptedLeaseFence(),
-            gitAvailable: await probeGitBinary(),
-            native: options.nativeAdapter,
-            runtimeEpoch: Math.max(config.runtimeEpoch, journal.storedRuntimeEpoch() ?? 0),
-            executionQueue: Promise.resolve(),
-            instanceToken: randomUUID(),
-        };
-        const native = state.native ??= defaultNativeAdapter(state);
-        await journal.bindRuntime({
-            runtimeId: config.runtimeId,
-            generation: config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-        });
-        if (config.workspaceMode === 'multi') {
-            gitCredentials = state.gitCredentials = new WorkspaceGitCredentialBroker(state);
-            await gitCredentials.start();
-        }
-        attachNativeCollector(state);
-        native?.onUnexpectedExit?.((event) => {
-            void handleExecutionGroupCrash(state, event.pid);
-        });
-        try {
-            await native?.start?.();
-            const group = native?.executionProcess?.();
-            if (group) {
-                let previousStopped = false;
-                if (previousGroup.pid && previousGroup.pid !== group.pid) {
-                    try {
-                        process.kill(previousGroup.pid, 0);
-                    }
-                    catch (error) {
-                        previousStopped = error.code === 'ESRCH';
-                    }
-                }
-                // The supervisor advances the trusted config epoch only after stopping the old
-                // native group. Reconfirm its recorded PID before publishing that replacement.
-                if (previousIdentityMatches && previousEpoch !== undefined && config.runtimeEpoch > previousEpoch && previousStopped) {
-                    await journal.writeExecutionEpoch({
-                        runtimeEpoch: state.runtimeEpoch, ...group, previousPid: previousGroup.pid, stopConfirmed: true,
-                    });
-                    await journal.replaceSessions(journal.listSessions().map((session) => ({ ...session, recoverability: 'history_only' })));
-                }
-                else {
-                    await journal.noteExecutionGroup(group);
-                }
-            }
-        }
-        catch (error) {
-            const code = error instanceof Error ? error.message : '';
-            state.nativeError = code === 'codex_model_catalog_unavailable' ? code : 'codex_start_failed';
-            console.error(`[workspace-runtime] ${state.nativeError}`);
-        }
-        const server = createServer((request, response) => {
-            void handleRuntimeRequest(state, request, response);
-        });
-        server.on('upgrade', (request, socket, head) => {
-            const pathname = new URL(request.url ?? '/', 'http://127.0.0.1').pathname;
-            if (/^\/runtime\/terminals\/[^/]+\/connect$/.test(pathname)) {
-                void terminalHost(state).handleUpgrade(request, socket, head);
-                return;
-            }
-            if (pathname === '/runtime/desktop/connect') {
-                desktopHost(state).handleUpgrade(request, socket, head);
-                return;
-            }
-            socket.destroy();
-        });
-        const port = await listenOn(server, config.listen.host, config.listen.port);
-        return {
-            config: state.config,
-            state,
-            url: `http://${formatHost(config.listen.host)}:${port}`,
-            async close() {
-                const serverClosed = closeServer(server);
-                await closeCliCredentials(state);
-                await gitCredentials?.close();
-                try {
-                    await disposeDesktopHost(state);
-                }
-                finally {
-                    disposeTerminalHost(state);
-                    try {
-                        await native?.close?.();
-                    }
-                    catch {
-                        /* adapter shutdown is best-effort */
-                    }
-                    await serverClosed;
-                    await journal?.close();
-                    lock.release();
-                }
-            },
-        };
-    }
-    catch (error) {
-        await gitCredentials?.close().catch(() => undefined);
-        await journal?.close().catch(() => undefined);
-        lock.release();
-        throw error;
-    }
-}
-function listenOn(server, host, port) {
-    return new Promise((resolve, reject) => {
-        const onError = (error) => reject(error);
-        server.once('error', onError);
-        server.listen(port, host, () => {
-            server.removeListener('error', onError);
-            const address = server.address();
-            if (!address || typeof address === 'string') {
-                reject(new Error('listen_failed'));
-                return;
-            }
-            resolve(address.port);
-        });
-    });
-}
-function closeServer(server) {
-    return new Promise((resolve, reject) => {
-        server.close((error) => {
-            if (error)
-                reject(error);
-            else
-                resolve();
-        });
-    });
-}
-function formatHost(host) {
-    return host.includes(':') ? `[${host}]` : host;
-}
-function defaultNativeAdapter(state) {
-    const config = state.config;
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'loopback')
-        return createLoopbackNativeAdapter();
-    const hasLauncher = Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
-    const multi = config.workspaceMode === 'multi';
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' && !multi && !hasLauncher) {
-        throw new Error('codex_requires_managed_launcher');
-    }
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' || (multi && hasLauncher)) {
-        return createCodexAppServerAdapter({
-            config,
-            ...(multi ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
-            loadSkillArtifact: async (cwd, entry) => {
-                const { workspaceId, directoryName } = await workspaceContextFromRoot(state, cwd);
-                return loadWorkspaceSkillArtifact(state, workspaceId, entry, directoryName === 'root' ? 'basic' : directoryName);
-            },
-            onSkillProcessRestart: process => state.journal.noteExecutionGroup(process),
-        });
-    }
-    return undefined;
-}

package/dist/workspace-runtime/server/auth.js

@@ -1,21 +0,0 @@
-import { timingSafeEqual } from 'node:crypto';
-export function extractControlToken(headers) {
-    const authorization = headerValue(headers.authorization);
-    if (authorization?.startsWith('Bearer ')) {
-        return authorization.slice('Bearer '.length).trim() || null;
-    }
-    const dedicated = headerValue(headers['x-playcraft-control-token']);
-    return dedicated?.trim() || null;
-}
-export function controlTokenMatches(expected, actual) {
-    if (!actual)
-        return false;
-    const left = Buffer.from(expected);
-    const right = Buffer.from(actual);
-    if (left.length !== right.length)
-        return false;
-    return timingSafeEqual(left, right);
-}
-function headerValue(value) {
-    return Array.isArray(value) ? value[0] : value;
-}