@playcraft/cli 0.1.23 → 0.1.25

package/dist/recording/recorder.js

@@ -0,0 +1,293 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { createReadStream } from 'node:fs';
+import { access, appendFile, mkdir, readFile, rename, stat, writeFile } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { performance } from 'node:perf_hooks';
+import { setTimeout as delay } from 'node:timers/promises';
+import { promisify } from 'node:util';
+import { createRequire } from 'node:module';
+import { canonicalReplicaJson, replicaRecordingMetadataSchema, } from '@playcraft/common/agent-tools';
+import { prepareArtifactDirectory, writeJsonAtomic } from '../video-replication/evidence.js';
+import { probeVideo } from '../video-replication/media.js';
+import { VideoCliError } from '../video-replication/messages.js';
+import { computeProjectInputDigest } from './project-digest.js';
+import { RecordingError, recordingMessage } from './messages.js';
+import { parseRecordingScenario, recordingControls, recordingPoint, recordingUrl } from './scenario.js';
+const execute = promisify(execFile);
+const require = createRequire(import.meta.url);
+const relativeFile = (root, path) => relative(root, path).split(sep).join('/');
+const sha = (value) => createHash('sha256').update(value).digest('hex');
+const printableUrl = (value) => { try {
+    const url = new URL(value);
+    return `${url.origin}${url.pathname}`;
+}
+catch {
+    return '[unavailable]';
+} };
+export async function hashRecordingFile(path) {
+    const hash = createHash('sha256');
+    for await (const bytes of createReadStream(path))
+        hash.update(bytes);
+    return hash.digest('hex');
+}
+async function mediaCommand(tool, args, signal) {
+    const executable = process.env[tool === 'ffmpeg' ? 'FFMPEG_PATH' : 'FFPROBE_PATH'] || tool;
+    if (executable !== tool && !isAbsolute(executable))
+        throw new RecordingError('invalidArguments', 64);
+    try {
+        return (await execute(executable, args, { timeout: 60_000, maxBuffer: 1024 * 1024, encoding: 'utf8', signal })).stdout;
+    }
+    catch (error) {
+        if (signal?.aborted)
+            throw signal.reason;
+        throw new RecordingError('recordingFailed');
+    }
+}
+export async function waitUntil(origin, atMs, signal) {
+    // Timers can wake before a fractional deadline. Never dispatch input or finish a capture early.
+    for (;;) {
+        signal.throwIfAborted();
+        const remaining = origin + atMs - performance.now();
+        if (remaining <= 0)
+            return;
+        await delay(Math.ceil(remaining), undefined, { signal });
+    }
+}
+async function dispatchStep(page, session, scenario, step, origin, signal, emit) {
+    const point = recordingPoint(scenario, step.type === 'tap' ? step : step.path[0]);
+    if (step.type === 'tap') {
+        if (scenario.pointer === 'touch')
+            await page.touchscreen.tap(point.x, point.y);
+        else
+            await page.mouse.click(point.x, point.y);
+        emit(point, 'tap', step.atMs);
+        return;
+    }
+    if (scenario.pointer === 'touch')
+        await session.send('Input.dispatchTouchEvent', { type: 'touchStart', touchPoints: [{ ...point, id: 1 }] });
+    else {
+        await page.mouse.move(point.x, point.y);
+        await page.mouse.down();
+    }
+    emit(point, 'start', step.atMs);
+    let completed = false;
+    try {
+        for (const next of step.path.slice(1)) {
+            await waitUntil(origin, step.atMs + next.offsetMs, signal);
+            const actual = recordingPoint(scenario, next);
+            if (scenario.pointer === 'touch')
+                await session.send('Input.dispatchTouchEvent', { type: 'touchMove', touchPoints: [{ ...actual, id: 1 }] });
+            else
+                await page.mouse.move(actual.x, actual.y);
+            emit(actual, 'move', step.atMs + next.offsetMs);
+        }
+        completed = true;
+    }
+    finally {
+        const release = scenario.pointer === 'touch' ? session.send('Input.dispatchTouchEvent', { type: 'touchEnd', touchPoints: [] }) : page.mouse.up();
+        if (completed) {
+            await release;
+            emit(recordingPoint(scenario, step.path.at(-1)), 'end', step.atMs + step.path.at(-1).offsetMs);
+        }
+        else
+            await release.catch(() => { });
+    }
+}
+async function recordOne(browser, root, url, scenario, variant, signal) {
+    const directory = variant.kind === 'candidate' ? root : join(root, 'controls', variant.id);
+    await mkdir(join(directory, 'screenshots'), { recursive: true });
+    const eventPath = join(directory, 'events.jsonl');
+    const consolePath = join(directory, 'console.jsonl');
+    await writeFile(eventPath, '', { flag: 'wx', mode: 0o600 });
+    await writeFile(consolePath, '', { flag: 'wx', mode: 0o600 });
+    const context = await browser.newContext({
+        viewport: { width: scenario.viewport.width, height: scenario.viewport.height }, deviceScaleFactor: scenario.viewport.deviceScaleFactor,
+        hasTouch: scenario.pointer === 'touch', isMobile: scenario.pointer === 'touch', serviceWorkers: 'block',
+        acceptDownloads: false, recordVideo: { dir: join(directory, 'capture'), size: { width: scenario.viewport.width, height: scenario.viewport.height } },
+    });
+    let logs = Promise.resolve();
+    let logBytes = 0;
+    let failed;
+    const runtime = { pageErrors: 0, consoleErrors: 0, failedRequests: 0 };
+    let origin = performance.now();
+    let inputOriginMs = Date.now();
+    const log = (path, value) => {
+        const line = `${JSON.stringify(value)}\n`;
+        logBytes += Buffer.byteLength(line);
+        if (logBytes > 16 * 1024 * 1024) {
+            failed = new RecordingError('recordingFailed');
+            return;
+        }
+        logs = logs.then(() => appendFile(path, line));
+    };
+    const closeOnAbort = () => { void context.close().catch(() => { }); };
+    signal.addEventListener('abort', closeOnAbort, { once: true });
+    let closed = false;
+    try {
+        signal.throwIfAborted();
+        const page = await context.newPage();
+        const video = page.video();
+        if (!video)
+            throw new RecordingError('browserUnavailable');
+        page.on('console', message => {
+            if (message.type() === 'error')
+                runtime.consoleErrors++;
+            log(consolePath, { atMs: performance.now() - origin, kind: 'console', level: message.type(), text: message.text().slice(0, 32768) });
+        });
+        page.on('pageerror', error => { runtime.pageErrors++; log(consolePath, { atMs: performance.now() - origin, kind: 'pageerror', level: 'error', text: error.message.slice(0, 32768) }); });
+        page.on('requestfailed', request => { runtime.failedRequests++; log(consolePath, { atMs: performance.now() - origin, kind: 'requestfailed', level: 'error', url: printableUrl(request.url()), text: request.failure()?.errorText }); });
+        context.on('page', popup => { if (popup !== page) {
+            runtime.pageErrors++;
+            log(consolePath, { atMs: performance.now() - origin, kind: 'popup', level: 'error', text: 'recording.popupUnsupported' });
+            void popup.close().catch(() => { });
+        } });
+        await context.route('**/*', async (route) => {
+            if (route.request().isNavigationRequest() && new URL(route.request().url()).origin !== url.origin) {
+                failed = new RecordingError('navigationFailed');
+                await route.abort();
+            }
+            else
+                await route.continue();
+        });
+        page.on('dialog', dialog => { runtime.pageErrors++; log(consolePath, { atMs: performance.now() - origin, kind: 'dialog', level: 'error', text: dialog.message().slice(0, 32768) }); void dialog.dismiss(); });
+        const response = await page.goto(url.href, { waitUntil: 'load', timeout: 30_000 });
+        if (!response?.ok() || new URL(page.url()).origin !== url.origin || page.isClosed())
+            throw new RecordingError('navigationFailed');
+        const initial = join(directory, 'screenshots', 'initial.png');
+        await page.screenshot({ path: initial, timeout: 10_000 });
+        origin = performance.now();
+        inputOriginMs = Date.now();
+        const screenshots = [{ path: relativeFile(root, initial), sha256: await hashRecordingFile(initial), atMs: 0 }];
+        const session = await context.newCDPSession(page);
+        log(eventPath, { kind: 'recording-start', plannedAtMs: 0, actualAtMs: 0, inputOriginMs, navigationUrl: printableUrl(url.href), finalUrl: printableUrl(page.url()), device: scenario.pointer, reset: scenario.reset, seedApplied: false });
+        for (const step of scenario.steps) {
+            await waitUntil(origin, step.atMs, signal);
+            if (failed)
+                throw failed;
+            const omitted = variant.omittedStepIds.includes(step.id);
+            const points = (step.type === 'tap' ? [{ offsetMs: 0, x: step.x, y: step.y }] : step.path).map(point => ({ ...point, actual: recordingPoint(scenario, point) }));
+            if (omitted) {
+                log(eventPath, { stepId: step.id, kind: step.type, plannedAtMs: step.atMs, actualAtMs: performance.now() - origin, device: scenario.pointer, points, status: 'omitted' });
+                continue;
+            }
+            const before = join(directory, 'screenshots', `${step.id}-before.png`);
+            await page.screenshot({ path: before, timeout: 10_000 });
+            screenshots.push({ path: relativeFile(root, before), sha256: await hashRecordingFile(before), atMs: Math.round(performance.now() - origin) });
+            const started = performance.now() - origin;
+            log(eventPath, { stepId: step.id, kind: step.type, plannedAtMs: step.atMs, actualAtMs: started, device: scenario.pointer, points, status: 'started' });
+            try {
+                await dispatchStep(page, session, scenario, step, origin, signal, (point, phase, plannedAtMs) => log(eventPath, { stepId: step.id, kind: 'pointer', phase, plannedAtMs, actualAtMs: performance.now() - origin, device: scenario.pointer, actual: point, status: 'dispatched' }));
+                log(eventPath, { stepId: step.id, kind: step.type, plannedAtMs: step.atMs, actualAtMs: started, completedAtMs: performance.now() - origin, device: scenario.pointer, points, status: 'dispatched' });
+            }
+            catch (error) {
+                log(eventPath, { stepId: step.id, kind: step.type, plannedAtMs: step.atMs, actualAtMs: started, device: scenario.pointer, points, status: 'failed' });
+                throw error;
+            }
+            const after = join(directory, 'screenshots', `${step.id}-after.png`);
+            await page.screenshot({ path: after, timeout: 10_000 });
+            screenshots.push({ path: relativeFile(root, after), sha256: await hashRecordingFile(after), atMs: Math.round(performance.now() - origin) });
+        }
+        await waitUntil(origin, scenario.durationMs, signal);
+        if (failed)
+            throw failed;
+        log(eventPath, { kind: 'recording-end', plannedAtMs: scenario.durationMs, actualAtMs: performance.now() - origin, status: 'completed' });
+        const closingAt = Date.now();
+        await context.close();
+        closed = true;
+        const closedAt = Date.now();
+        await logs;
+        const raw = join(directory, 'raw-capture.webm');
+        await rename(await video.path(), raw);
+        const rawProbe = JSON.parse(await mediaCommand('ffprobe', ['-v', 'error', '-show_entries', 'format=duration:stream=avg_frame_rate,codec_type', '-of', 'json', raw], signal));
+        const rawDuration = Number(rawProbe.format.duration) * 1000;
+        const stream = rawProbe.streams.find(value => value.codec_type === 'video');
+        const rate = stream?.avg_frame_rate.split('/').map(Number);
+        const fps = rate && rate[0] > 0 && rate[1] > 0 ? rate[0] / rate[1] : 0;
+        if (!Number.isFinite(rawDuration) || rawDuration <= 0 || !fps)
+            throw new RecordingError('recordingFailed');
+        // The encoder's final frame falls inside the measured context-close interval.
+        const rawOriginMs = closingAt - rawDuration;
+        const offsetMs = Math.max(0, inputOriginMs - rawOriginMs);
+        const candidate = join(directory, 'candidate.mp4');
+        await mediaCommand('ffmpeg', ['-v', 'error', '-nostdin', '-i', raw, '-ss', (offsetMs / 1000).toFixed(6), '-t', (scenario.durationMs / 1000).toFixed(6), '-an', '-c:v', 'libx264', '-preset', 'ultrafast', '-crf', '20', '-pix_fmt', 'yuv420p', '-movflags', '+faststart', candidate], signal);
+        const probed = await probeVideo(candidate, signal);
+        const uncertaintyMs = closedAt - closingAt + 1000 / fps + Math.max(0, rawOriginMs - inputOriginMs);
+        if (probed.source.width !== scenario.viewport.width || probed.source.height !== scenario.viewport.height || probed.source.durationMs < scenario.durationMs - uncertaintyMs - 1000 / fps)
+            throw new RecordingError('recordingFailed');
+        return {
+            ...variant, video: { path: relativeFile(root, candidate), source: probed.source, fps },
+            events: { path: relativeFile(root, eventPath), sha256: await hashRecordingFile(eventPath) }, console: { path: relativeFile(root, consolePath), sha256: await hashRecordingFile(consolePath) },
+            timing: { inputOriginMs, videoOriginMs: inputOriginMs, uncertaintyMs }, runtime, screenshots,
+        };
+    }
+    finally {
+        signal.removeEventListener('abort', closeOnAbort);
+        if (!closed)
+            await context.close().catch(() => { });
+        await logs;
+    }
+}
+export async function recordPlayable(options, signal) {
+    const runId = randomUUID();
+    let out;
+    let browser;
+    let prepared = false;
+    try {
+        const url = recordingUrl(options.url);
+        if (!options.scenario || options.browserPath && !isAbsolute(options.browserPath))
+            throw new RecordingError('invalidArguments', 64);
+        const scenarioStat = await stat(options.scenario).catch(() => { throw new RecordingError('invalidArguments', 64); });
+        if (!scenarioStat.isFile() || scenarioStat.size > 1024 * 1024)
+            throw new RecordingError('invalidArguments', 64);
+        let scenario;
+        try {
+            scenario = parseRecordingScenario(JSON.parse(await readFile(options.scenario, 'utf8')));
+        }
+        catch {
+            throw new RecordingError('invalidArguments', 64);
+        }
+        const scenarioSha256 = sha(canonicalReplicaJson(scenario));
+        const configuredPath = options.browserPath || process.env.PLAYCRAFT_CHROMIUM_PATH || '/usr/bin/chromium';
+        if (!isAbsolute(configuredPath))
+            throw new RecordingError('invalidArguments', 64);
+        await access(configuredPath).catch(() => { throw new RecordingError('browserUnavailable'); });
+        out = resolve(options.out || join('.playcraft', 'video-replication', runId, 'recording'));
+        const project = await computeProjectInputDigest(process.cwd(), [out]);
+        await prepareArtifactDirectory(out, runId, false);
+        prepared = true;
+        await writeJsonAtomic(join(out, 'metadata.json'), { schemaVersion: 'playcraft.replica-recording.v1', runId, state: 'recording', scenarioSha256 });
+        const ffmpeg = (await mediaCommand('ffmpeg', ['-version'], signal)).split('\n')[0];
+        if (!process.env.PLAYWRIGHT_BROWSERS_PATH && await access('/opt/playcraft/playwright').then(() => true, () => false))
+            process.env.PLAYWRIGHT_BROWSERS_PATH = '/opt/playcraft/playwright';
+        const { chromium } = await import('playwright-core');
+        browser = await chromium.launch({ executablePath: configuredPath, headless: true, args: ['--mute-audio', '--disable-dev-shm-usage', '--enable-unsafe-swiftshader', '--use-gl=angle', '--use-angle=swiftshader', ...(process.getuid?.() === 0 ? ['--no-sandbox'] : [])] }).catch(() => { throw new RecordingError('browserUnavailable'); });
+        process.stderr.write(`[record] ${recordingMessage('recording')}\n`);
+        const candidate = await recordOne(browser, out, url, scenario, { id: 'candidate', kind: 'candidate', omittedStepIds: [] }, signal);
+        const controls = [];
+        for (const control of recordingControls(scenario))
+            controls.push(await recordOne(browser, out, url, scenario, control, signal));
+        const current = await computeProjectInputDigest(process.cwd(), [out]);
+        if (current.sha256 !== project.sha256)
+            throw new RecordingError('projectChanged', 64);
+        const metadata = replicaRecordingMetadataSchema.parse({
+            schemaVersion: 'playcraft.replica-recording.v1', runId, state: 'completed', scenario, scenarioSha256, project,
+            toolVersions: { cli: require('../../package.json').version, playwright: require('playwright-core/package.json').version, browser: browser.version(), ffmpeg },
+            conditions: { audio: 'muted', seedSupport: scenario.seed ? 'best-effort' : 'not-requested', serverStateReset: 'not-guaranteed' },
+            candidate, controls,
+        });
+        await writeJsonAtomic(join(out, 'metadata.json'), metadata);
+        return { exitCode: 0, envelope: { schemaVersion: 'playcraft.video-cli.v1', command: 'playable record', runId, state: 'completed', ok: true,
+                artifacts: { metadata: join(out, 'metadata.json'), candidate: join(out, candidate.video.path), controls: controls.map(control => join(out, control.video.path)) }, result: metadata } };
+    }
+    catch (error) {
+        const code = error instanceof RecordingError ? error.code : error instanceof VideoCliError && error.code === 'outputConflict' ? 'outputConflict' : signal.aborted ? signal.reason?.name === 'TimeoutError' ? 'timedOut' : 'interrupted' : 'recordingFailed';
+        const exitCode = error instanceof RecordingError || error instanceof VideoCliError ? error.exitCode : signal.aborted ? code === 'timedOut' ? 75 : 130 : 4;
+        if (out && prepared)
+            await writeJsonAtomic(join(out, 'metadata.json'), { schemaVersion: 'playcraft.replica-recording.v1', runId, state: 'failed', error: { code } }).catch(() => { });
+        return { exitCode, envelope: { schemaVersion: 'playcraft.video-cli.v1', command: 'playable record', runId, state: 'failed', ok: false, ...(out && prepared ? { artifacts: { metadata: join(out, 'metadata.json') } } : {}), error: { code, message: recordingMessage(code) } } };
+    }
+    finally {
+        await browser?.close().catch(() => { });
+    }
+}

package/dist/recording/scenario.js

@@ -0,0 +1,50 @@
+import { replicaScenarioSchema } from '@playcraft/common/agent-tools';
+import { RecordingError } from './messages.js';
+export function recordingUrl(value) {
+    try {
+        if (!value)
+            throw new Error();
+        const url = new URL(value);
+        if (url.protocol !== 'http:' || !['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname) || url.username || url.password || url.hash)
+            throw new Error();
+        return url;
+    }
+    catch {
+        throw new RecordingError('invalidUrl', 64);
+    }
+}
+export function parseRecordingScenario(value) {
+    const parsed = replicaScenarioSchema.safeParse(value);
+    if (!parsed.success)
+        throw new RecordingError('invalidArguments', 64);
+    const scenario = parsed.data;
+    if (scenario.draft || scenario.viewport.width % 2 || scenario.viewport.height % 2 || scenario.steps.length > 63 || scenario.steps.some(step => step.id.length > 110))
+        throw new RecordingError('invalidArguments', 64);
+    const ids = new Set();
+    let previousEnd = -1;
+    for (const step of scenario.steps) {
+        if (ids.has(step.id) || step.atMs < previousEnd)
+            throw new RecordingError('invalidArguments', 64);
+        ids.add(step.id);
+        const end = step.atMs + (step.type === 'drag' ? step.path.at(-1).offsetMs : 0);
+        if (end >= scenario.durationMs)
+            throw new RecordingError('invalidArguments', 64);
+        if (step.type === 'drag' && (step.path[0].offsetMs !== 0 || step.path.some((point, index) => index > 0 && point.offsetMs <= step.path[index - 1].offsetMs)))
+            throw new RecordingError('invalidArguments', 64);
+        previousEnd = end;
+    }
+    const required = new Set(scenario.requiredEffects.map(effect => effect.stepId));
+    if ([...required].some(id => !ids.has(id)) || (scenario.controls.noInput ? 1 : 0) + (scenario.controls.omitRequiredSteps ? required.size : 0) > 4)
+        throw new RecordingError('invalidArguments', 64);
+    return scenario;
+}
+export function recordingControls(scenario) {
+    return [
+        ...(scenario.controls.noInput ? [{ id: 'control-no-input', kind: 'no-input', omittedStepIds: scenario.steps.map(step => step.id) }] : []),
+        ...(scenario.controls.omitRequiredSteps ? [...new Set(scenario.requiredEffects.map(effect => effect.stepId))].map(id => ({ id: `control-omit-${id}`, kind: 'omit-step', omittedStepIds: [id] })) : []),
+    ];
+}
+export function recordingPoint(scenario, point) {
+    const rect = scenario.contentRect;
+    return { x: (rect.x + point.x * rect.width) * scenario.viewport.width, y: (rect.y + point.y * rect.height) * scenario.viewport.height };
+}

package/dist/utils/agent-api-client.js

@@ -90,10 +90,19 @@ export class AgentApiClient {
             `continue this request: it returns the result if the request finished, or finishes it if ` +
             `the tool can be safely redone; it never starts a second operation. Record: ${operation.file}.`;
         try {
+            try {
+                await options?.onPrepared?.({ requestId: operation.requestId, file: operation.file });
+            }
+            catch {
+                operation.reject();
+                throw new ToolRequestError('Tool request preparation failed; no operation was sent');
+            }
             const capabilityResponse = await fetch(this.toolsRequestUrl(AGENT_TOOL_OPERATION_CAPABILITIES_PATH), {
                 headers: this.authHeaders(),
                 redirect: 'error',
-                signal: AbortSignal.timeout(30_000),
+                signal: options?.signal
+                    ? AbortSignal.any([options.signal, AbortSignal.timeout(30_000)])
+                    : AbortSignal.timeout(30_000),
             });
             if (!capabilityResponse.ok) {
                 if (capabilityResponse.status === 403) {
@@ -114,7 +123,9 @@ export class AgentApiClient {
             const res = await fetch(url, {
                 method: 'POST',
                 redirect: 'error',
-                signal: AbortSignal.timeout(30 * 60_000),
+                signal: options?.signal
+                    ? AbortSignal.any([options.signal, AbortSignal.timeout(30 * 60_000)])
+                    : AbortSignal.timeout(30 * 60_000),
                 headers: {
                     'Content-Type': 'application/json',
                     ...this.authHeaders(),
@@ -180,7 +191,7 @@ export class AgentApiClient {
             operation.release();
         }
     }
-    async get(path, params) {
+    async get(path, params, options) {
         const url = this.toolsRequestUrl(path);
         if (params) {
             for (const [k, v] of Object.entries(params)) {
@@ -190,6 +201,8 @@ export class AgentApiClient {
         }
         const res = await fetch(url, {
             headers: this.authHeaders(),
+            redirect: 'error',
+            signal: options?.signal ?? AbortSignal.timeout(30_000),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => res.statusText);
@@ -200,6 +213,29 @@ export class AgentApiClient {
         }
         return res.json();
     }
+    /** Stream only to the authenticated, same-service video upload endpoint. */
+    async putVideoMedia(path, body, headers, signal) {
+        if (!/^\/video-media\/[a-f0-9-]{36}\/content\?/.test(path))
+            throw new Error('invalid_video_upload_target');
+        const url = this.toolsRequestUrl(path);
+        const keys = [...url.searchParams.keys()].sort();
+        if (keys.join(',') !== 'expires,signature,workspaceId')
+            throw new Error('invalid_video_upload_target');
+        const allowed = new Set(['content-type', 'content-md5', 'content-length']);
+        if (Object.keys(headers).some(key => !allowed.has(key.toLowerCase())))
+            throw new Error('invalid_video_upload_headers');
+        const response = await fetch(url, {
+            method: 'PUT', redirect: 'error', signal,
+            headers: { ...headers, ...this.authHeaders() },
+            body: body,
+            duplex: 'half',
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`video_upload_failed:${response.status}`);
+        }
+        await response.body?.cancel();
+    }
     /**
      * 按顺序搜索本地 .playcraft.json 文件（沙箱内或项目目录）。
      * 与全局 login 配置（~/.playcraft/config.json）不同，前者专用于沙箱 token。

package/dist/utils/video-evidence-git.js

@@ -0,0 +1,81 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, realpath } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+const ENTRY = '/.playcraft/video-replication/';
+/** Keep local analysis evidence out of a repository without changing its tracked ignore rules. */
+export async function ensureVideoEvidenceGitExcluded(directory) {
+    let root = await realpath(directory);
+    while (true) {
+        const marker = await lstat(join(root, '.git')).catch((error) => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (marker) {
+            // Cloud workspaces own a real .git directory; never follow a redirected Git metadata tree.
+            if (!marker.isDirectory() || marker.isSymbolicLink())
+                return false;
+            try {
+                await appendExclude(root);
+                return true;
+            }
+            catch (error) {
+                if (['EACCES', 'EPERM', 'EROFS'].includes(error.code ?? ''))
+                    return false;
+                throw error;
+            }
+        }
+        const parent = dirname(root);
+        if (parent === root)
+            return true;
+        root = parent;
+    }
+}
+async function appendExclude(root) {
+    const flags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
+    const handles = [];
+    let file;
+    try {
+        const directory = await open(root, flags);
+        handles.push(directory);
+        const pinned = (handle, fallback) => process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : fallback;
+        const git = await open(join(pinned(directory, root), '.git'), flags);
+        handles.push(git);
+        const gitPath = pinned(git, join(root, '.git'));
+        await mkdir(join(gitPath, 'info')).catch((error) => {
+            if (error.code !== 'EEXIST')
+                throw error;
+        });
+        const info = await open(join(gitPath, 'info'), flags);
+        handles.push(info);
+        const exclude = join(pinned(info, join(root, '.git/info')), 'exclude');
+        const readable = await open(exclude, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK)
+            .catch((error) => { if (error.code === 'ENOENT')
+            return undefined; throw error; });
+        if (readable) {
+            try {
+                const stat = await readable.stat();
+                if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024)
+                    throw new Error('invalid_git_exclude');
+                if ((await readable.readFile('utf8')).split('\n').some(line => line.trim() === ENTRY))
+                    return;
+            }
+            finally {
+                await readable.close();
+            }
+        }
+        file = await open(exclude, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o666);
+        const stat = await file.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > 1024 * 1024)
+            throw new Error('invalid_git_exclude');
+        const current = await file.readFile('utf8');
+        if (!current.split('\n').some(line => line.trim() === ENTRY)) {
+            await file.writeFile(`${current && !current.endsWith('\n') ? '\n' : ''}${ENTRY}\n`);
+        }
+    }
+    finally {
+        await file?.close();
+        for (const handle of handles.reverse())
+            await handle.close();
+    }
+}