@playcraft/cli 0.1.23 → 0.1.25

package/dist/workspace-runtime/persistence/sqlite-worker.js

@@ -7,11 +7,12 @@
  * reports 3.51.2 and must not be used for this file.
  * Do not read Codex JSONL from this worker.
  */
-import { randomBytes, randomUUID } from 'node:crypto';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
 import { chmodSync, mkdirSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { parentPort } from 'node:worker_threads';
 import Database from 'better-sqlite3-pinned';
+import { clearPendingNativeFollowups, learnNativeSubagents, nativeEventOwner, nativeSubagentThreads } from './native-subagents.js';
 import { hashOperationPayload, operationRecordSchema, pendingSourceEventSchema, terminalRecordSchema, workspaceRegistrationSchema, transitionOperation, canTransitionTurn, } from '@playcraft/common/cloud-workspace/runtime';
 const SCHEMA_VERSION = 1;
 const MIN_SQLITE = [3, 51, 3];
@@ -154,6 +155,16 @@ function openDatabase(payload) {
     else {
         quarantineReservedTurns(database);
     }
+    database.exec(`
+    CREATE INDEX IF NOT EXISTS native_inbox_pending_thread
+      ON native_inbox(thread_id, ingress_sequence) WHERE converted = 0;
+    CREATE INDEX IF NOT EXISTS records_native_session_thread
+      ON records(json_extract(body_json, '$.threadId')) WHERE bucket = 'sessions';
+    CREATE INDEX IF NOT EXISTS native_inbox_pending_parent
+      ON native_inbox(COALESCE(json_extract(payload_json, '$.thread.parentThreadId'),
+        json_extract(payload_json, '$.thread.source.subAgent.thread_spawn.parent_thread_id')))
+      WHERE converted = 0 AND method = 'thread/started';
+  `);
     return {
         ...dump(database),
         imported,
@@ -391,34 +402,13 @@ function ingest(database, body) {
     const ingress = nextIngress(database);
     const kind = String(body.kind);
     const method = optionalString(body.method);
-    const session = threadId ? sessionByThread(database, threadId) : undefined;
     const hintedTurn = turnId || nativeIds(body.params).turnId;
-    const operation = hintedTurn ? operationByTurn(database, hintedTurn) : undefined;
-    const linked = canConvert(kind, threadId, hintedTurn, session, operation);
     database
         .prepare(`INSERT INTO native_inbox (
         ingress_sequence, runtime_epoch, kind, method, thread_id, turn_id, item_id, payload_json, converted, received_at
       ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, 0, ?)`)
         .run(ingress, Number(body.runtimeEpoch) || 0, kind, method ?? null, threadId ?? null, hintedTurn ?? null, itemId ?? null, JSON.stringify(body.params ?? {}), String(body.occurredAt));
-    if (!linked)
-        return { committedEvents: [] };
-    const earlier = operation
-        ? releaseInbox(database, threadId ?? '', hintedTurn ?? '', { scopeKey: operation.scopeKey, operation: operation.operation }, ingress)
-        : [];
-    const event = convertInboxRow(database, ingress, {
-        runtimeId: String(body.runtimeId),
-        generation: Number(body.generation) || 0,
-        runtimeEpoch: Number(body.runtimeEpoch) || 0,
-        kind,
-        method,
-        threadId,
-        turnId: hintedTurn,
-        itemId,
-        occurredAt: String(body.occurredAt),
-        session,
-        operation,
-    });
-    return { committedEvents: event ? [...earlier, event] : earlier };
+    return { committedEvents: releaseInbox(database, { ingress }, { runtimeId: String(body.runtimeId), generation: Number(body.generation) || 0 }) };
 }
 function bindTurn(database, body) {
     const operation = operationRecordSchema.parse(body.operation);
@@ -437,41 +427,81 @@ function bindTurn(database, body) {
     }
     const threadId = String(body.threadId);
     const turnId = String(body.turnId);
-    const released = releaseInbox(database, threadId, turnId, { scopeKey: String(body.scopeKey), operation });
+    const released = releaseInbox(database, { rootThreadId: threadId, turnId });
     applyRecordedTurn(database, threadId, turnId);
     return { committedEvents: released };
 }
-function releaseInbox(database, threadId, turnId, bound, beforeIngress) {
-    const rows = database
-        .prepare(`SELECT ingress_sequence FROM native_inbox
-       WHERE converted = 0
-         AND (? IS NULL OR ingress_sequence < ?)
-         AND (turn_id = ? OR (thread_id = ? AND turn_id IS NULL))
-       ORDER BY ingress_sequence`)
-        .all(beforeIngress ?? null, beforeIngress ?? null, turnId, threadId);
+function releaseInbox(database, selection, identity) {
     const events = [];
-    for (const row of rows) {
-        const stored = database.prepare('SELECT * FROM native_inbox WHERE ingress_sequence = ?').get(row.ingress_sequence);
-        if (stored.turn_id && stored.turn_id !== turnId)
+    const rows = [];
+    const queued = new Set();
+    const enqueue = (pending) => {
+        for (const row of pending) {
+            const ingress = Number(row.ingress_sequence);
+            if (!queued.has(ingress)) {
+                queued.add(ingress);
+                rows.push(row);
+            }
+        }
+    };
+    const enqueueChildren = (parentId) => enqueue(database.prepare(`
+    SELECT * FROM native_inbox WHERE converted = 0 AND method = 'thread/started'
+      AND COALESCE(json_extract(payload_json, '$.thread.parentThreadId'),
+        json_extract(payload_json, '$.thread.source.subAgent.thread_spawn.parent_thread_id')) = ?
+      ORDER BY ingress_sequence
+  `).all(parentId));
+    const enqueueThread = (threadId) => {
+        enqueue(database.prepare('SELECT * FROM native_inbox WHERE converted = 0 AND thread_id = ? ORDER BY ingress_sequence').all(threadId));
+        enqueueChildren(threadId);
+    };
+    if ('ingress' in selection) {
+        const current = database.prepare('SELECT * FROM native_inbox WHERE converted = 0 AND ingress_sequence = ?').get(selection.ingress);
+        if (current) {
+            const threadId = optionalString(current.thread_id), turnId = optionalString(current.turn_id);
+            if (nativeEventOwner(database, threadId, turnId)) {
+                // A receipt can bind between notifications. Drain that thread's earlier events first.
+                enqueue(database.prepare('SELECT * FROM native_inbox WHERE converted = 0 AND thread_id = ? AND (turn_id = ? OR turn_id IS NULL) AND ingress_sequence <= ? ORDER BY ingress_sequence')
+                    .all(threadId, turnId ?? null, selection.ingress));
+            }
+            else
+                enqueue([current]);
+        }
+    }
+    else {
+        enqueue(database.prepare('SELECT * FROM native_inbox WHERE converted = 0 AND thread_id = ? AND (turn_id = ? OR turn_id IS NULL) ORDER BY ingress_sequence')
+            .all(selection.rootThreadId, selection.turnId));
+        enqueueChildren(selection.rootThreadId);
+        for (const threadId of nativeSubagentThreads(database, selection.rootThreadId))
+            enqueueThread(threadId);
+    }
+    for (const stored of rows) {
+        const threadId = optionalString(stored.thread_id);
+        const turnId = optionalString(stored.turn_id);
+        const method = optionalString(stored.method);
+        const params = JSON.parse(String(stored.payload_json || '{}'));
+        if (stored.kind === 'process_exit')
+            for (const child of clearPendingNativeFollowups(database))
+                enqueueThread(child);
+        for (const child of learnNativeSubagents(database, method ?? '', params, threadId, turnId))
+            enqueueThread(child);
+        const owner = nativeEventOwner(database, threadId, turnId);
+        if (stored.kind !== 'process_exit' && !owner) {
+            queued.delete(Number(stored.ingress_sequence));
             continue;
-        const session = sessionByThread(database, threadId);
-        const operation = operationByTurn(database, turnId) ?? bound;
-        const event = convertInboxRow(database, row.ingress_sequence, {
-            runtimeId: metaString(database, 'runtime_id') || 'runtime',
-            generation: metaNumber(database, 'generation'),
-            runtimeEpoch: Number(stored.runtime_epoch) || metaNumber(database, 'runtime_epoch'),
-            kind: String(stored.kind),
-            method: optionalString(stored.method),
-            threadId,
-            turnId: optionalString(stored.turn_id) || turnId,
-            itemId: optionalString(stored.item_id),
-            occurredAt: String(stored.received_at),
-            session,
-            operation,
-            params: JSON.parse(String(stored.payload_json || '{}')),
+        }
+        const event = convertInboxRow(database, Number(stored.ingress_sequence), {
+            runtimeId: identity?.runtimeId ?? (metaString(database, 'runtime_id') || 'runtime'),
+            generation: identity?.generation ?? metaNumber(database, 'generation'),
+            runtimeEpoch: Number(stored.runtime_epoch),
+            kind: String(stored.kind), method, threadId, turnId,
+            itemId: optionalString(stored.item_id), occurredAt: String(stored.received_at),
+            session: owner?.session, operation: owner?.operation, subAgent: owner?.subAgent, params,
         });
         if (event)
             events.push(event);
+        if (!owner?.subAgent && threadId && terminalTurn(method ?? '', asRecord(params)))
+            for (const child of nativeSubagentThreads(database, threadId))
+                enqueueThread(child);
     }
     return events;
 }
@@ -480,7 +510,12 @@ function convertInboxRow(database, ingress, input) {
     if (!row || row.converted)
         return undefined;
     const params = input.params ?? JSON.parse(row.payload_json || '{}');
-    const payload = linkedPayload(params, input.session);
+    const payload = linkedPayload(params, input.session, input.subAgent);
+    const nativeApprovalId = optionalString(payload.approvalId) || optionalString(payload.itemId) || input.itemId;
+    const childApproval = input.subAgent && nativeApprovalId && input.method?.includes('requestApproval');
+    if (input.subAgent && nativeApprovalId && (childApproval || input.method === 'approval.resolved')) {
+        payload.approvalId = `subagent_${createHash('sha256').update(JSON.stringify([input.subAgent.threadId, nativeApprovalId])).digest('hex')}`;
+    }
     const type = input.kind === 'process_exit' ? 'process.exited' : input.method || input.kind;
     const allocated = allocateEvent(database, {
         runtimeId: input.runtimeId || metaString(database, 'runtime_id'),
@@ -504,20 +539,34 @@ function convertInboxRow(database, ingress, input) {
        SET converted = 1, source_sequence = ?, payload_json = '{}'
        WHERE ingress_sequence = ?`)
         .run(event.source.sourceSequence, ingress);
-    applyNativeToState(database, { ...input, operation: resolveOperation(database, input, payload) }, payload);
+    if (childApproval && input.operation?.operation.sessionId) {
+        upsertRecord(database, 'approvals', `${input.operation.operation.sessionId}:${String(payload.approvalId)}`, {
+            approvalId: payload.approvalId,
+            sessionId: input.operation.operation.sessionId,
+            runtimeEpoch: input.runtimeEpoch,
+            nativeRequestId: `approval:${nativeApprovalId}`,
+            nativeApprovalId,
+            nativeThreadId: input.subAgent.threadId,
+            status: 'pending',
+        });
+    }
+    if (!input.subAgent)
+        applyNativeToState(database, { ...input, operation: resolveOperation(database, input, payload) }, payload);
     return event;
 }
 function applyRecordedTurn(database, threadId, turnId) {
     const rows = database
         .prepare(`SELECT type, payload_json, thread_id, session_id FROM source_events
-       WHERE turn_id = ? OR payload_json LIKE ?
+       WHERE (thread_id = ? OR thread_id IS NULL) AND (turn_id = ? OR payload_json LIKE ?)
        ORDER BY source_sequence`)
-        .all(turnId, `%"${turnId}"%`);
+        .all(threadId, turnId, `%"${turnId}"%`);
     for (const row of rows) {
         if (!row.type.includes('requestApproval') && !row.type.includes('requestUserInput') && !row.type.includes('completed') && !row.type.includes('interrupted') && row.type !== 'turn.failed' && row.type !== 'approval.resolved') {
             continue;
         }
         const payload = asRecord(JSON.parse(row.payload_json));
+        if (payload.subAgent)
+            continue;
         const session = sessionByThread(database, threadId) ?? (row.session_id ? readSession(database, row.session_id) : undefined);
         applyNativeToState(database, {
             method: row.type,
@@ -525,14 +574,14 @@ function applyRecordedTurn(database, threadId, turnId) {
             threadId: optionalString(row.thread_id) || threadId,
             turnId,
             session,
-            operation: operationByTurn(database, turnId),
+            operation: operationByTurn(database, turnId, threadId),
         }, payload);
     }
 }
 function resolveOperation(database, input, payload) {
     const turnId = input.turnId || nativeIds(payload).turnId;
     if (turnId)
-        return operationByTurn(database, turnId) ?? input.operation;
+        return input.operation ?? operationByTurn(database, turnId, input.threadId ?? nativeIds(payload).threadId);
     return input.operation;
 }
 function applyNativeToState(database, input, payload) {
@@ -563,7 +612,7 @@ function applyNativeToState(database, input, payload) {
     if (!input.operation)
         return;
     let operation = input.operation.operation;
-    const approvalId = optionalString(payload.itemId) || optionalString(payload.approvalId) || input.itemId;
+    const approvalId = optionalString(payload.approvalId) || optionalString(payload.itemId) || input.itemId;
     if ((method.includes('requestApproval') || method.includes('requestUserInput')) && approvalId && operation.sessionId) {
         upsertRecord(database, 'approvals', `${operation.sessionId}:${approvalId}`, {
             approvalId,
@@ -851,10 +900,10 @@ function sessionByThread(database, threadId) {
         return undefined;
     return matches[0];
 }
-function operationByTurn(database, turnId) {
+function operationByTurn(database, turnId, threadId) {
     const row = database
-        .prepare('SELECT scope_key, operation_json FROM operation_intents WHERE turn_id = ?')
-        .get(turnId);
+        .prepare(`SELECT scope_key, operation_json FROM operation_intents WHERE turn_id = ?${threadId ? ' AND thread_id = ?' : ''}`)
+        .get(...(threadId ? [turnId, threadId] : [turnId]));
     if (!row)
         return undefined;
     const parsed = operationRecordSchema.safeParse(JSON.parse(row.operation_json));
@@ -862,24 +911,17 @@ function operationByTurn(database, turnId) {
         return undefined;
     return { scopeKey: row.scope_key, operation: parsed.data };
 }
-function canConvert(kind, threadId, turnId, session, operation) {
-    if (kind === 'process_exit')
-        return true;
-    if (turnId && !operation)
-        return false;
-    if (turnId && operation)
-        return true;
-    if (!session || !threadId)
-        return false;
-    return true;
-}
-function linkedPayload(params, session) {
-    const payload = asRecord(params);
+function linkedPayload(params, session, subAgent) {
+    const payload = { ...asRecord(params) };
     delete payload.workspaceId;
+    delete payload.sessionId;
+    delete payload.subAgent;
     if (typeof session?.workspaceId === 'string')
         payload.workspaceId = session.workspaceId;
     if (typeof session?.sessionId === 'string')
         payload.sessionId = session.sessionId;
+    if (subAgent)
+        payload.subAgent = subAgent;
     return payload;
 }
 function nativeIds(params) {
@@ -889,7 +931,7 @@ function nativeIds(params) {
     return {
         threadId: optionalString(record.threadId) || optionalString(thread.id),
         turnId: optionalString(record.turnId) || optionalString(turn.id),
-        itemId: optionalString(record.itemId) || optionalString(record.approvalId),
+        itemId: optionalString(record.itemId) || optionalString(record.approvalId) || optionalString(asRecord(record.item).id),
     };
 }
 function terminalTurn(method, payload) {

package/dist/workspace-runtime/production/native.js

@@ -1,18 +1,38 @@
 import { join } from 'node:path';
+import { lstat, mkdir } from 'node:fs/promises';
 import { createCodexAppServerAdapter } from '../codex/app-server.js';
 import { verifyProductionLease } from './storage.js';
 import { processBirth, stopProductionGroup } from './processes.js';
+import { openDirectoryToDevelopment } from '../workspaces/directory-access.js';
 export async function runProductionNative(state, input, root, record, track) {
     if (!input.model)
         throw new Error('production_model_configuration_required');
+    const temporaryRoot = join(root, '.playcraft-temp');
+    const existing = await lstat(temporaryRoot).catch(error => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    });
+    if (existing && (!existing.isDirectory() || existing.isSymbolicLink()))
+        throw new Error('production_source_path_invalid');
+    await mkdir(temporaryRoot, { recursive: true });
+    await openDirectoryToDevelopment(temporaryRoot, (await lstat(root)).gid);
     const groups = [];
     const adapter = createCodexAppServerAdapter({ config: { ...state.config, workspaceMode: 'single', workspaceRoot: root },
         command: process.env.PLAYCRAFT_PRODUCTION_CODEX_COMMAND,
         homeDir: process.env.PLAYCRAFT_LAUNCHER_SOCKET
             ? `/var/lib/playcraft/codex/production-${input.task.attemptId}` : join(state.config.stateDir, 'production-native', input.task.attemptId),
         model: input.model.model, processGroup: true,
+        fixedExecution: { cwd: root, approvalPolicy: 'never', sandboxPolicy: { type: 'workspaceWrite', writableRoots: [root],
+                networkAccess: true, excludeTmpdirEnvVar: true, excludeSlashTmp: true } },
         fixedThreadConfig: { model: input.model.model, modelProvider: 'playcraft_production', config: {
-                approval_policy: 'never', sandbox_mode: 'danger-full-access',
+                approval_policy: 'never', sandbox_mode: 'workspace-write',
+                'sandbox_workspace_write.writable_roots': [root],
+                'sandbox_workspace_write.network_access': true,
+                'sandbox_workspace_write.exclude_tmpdir_env_var': true,
+                'sandbox_workspace_write.exclude_slash_tmp': true,
+                'shell_environment_policy.set': { PLAYCRAFT_TOOL_REQUEST_DIR: join(temporaryRoot, 'tool-requests'), PLAYCRAFT_SKIP_UPDATE_CHECK: '1',
+                    TMPDIR: temporaryRoot, npm_config_cache: join(temporaryRoot, 'npm-cache'), npm_config_store_dir: join(temporaryRoot, 'pnpm-store') },
                 'model_providers.playcraft_production': { name: 'PlayCraft Production', base_url: input.model.endpoint,
                     wire_api: 'responses', requires_openai_auth: false, http_headers: { Authorization: `Bearer ${input.model.token}` } },
             } },

package/dist/workspace-runtime/production/save-command.js

@@ -14,7 +14,11 @@ if [ -n "$remote" ]; then
   git -c core.hooksPath=/dev/null -c core.fsmonitor=false reset --soft FETCH_HEAD
 fi
 git -c core.hooksPath=/dev/null -c core.fsmonitor=false add -A .
+if [ -n "$(git ls-files -- .playcraft.json playcraft.config.json ':(glob)**/.playcraft.json' ':(glob)**/playcraft.config.json')" ]; then
+  printf 'production_git_private_path\\n' >&2
+  exit 1
+fi
 git diff --cached --quiet || git -c core.hooksPath=/dev/null commit -m "Save generated engineering"
-git -c protocol.version=0 -c core.hooksPath=/dev/null push "$PRODUCTION_REPOSITORY" HEAD:"refs/heads/$PRODUCTION_BRANCH"
+git -c protocol.version=0 -c core.hooksPath=/dev/null -c remote.origin.url="$PRODUCTION_REPOSITORY" -c remote.origin.pushurl="$PRODUCTION_REPOSITORY" push --set-upstream origin HEAD:"refs/heads/$PRODUCTION_BRANCH"
 git rev-parse HEAD`;
 }

package/dist/workspace-runtime/production/source-copy.js

@@ -0,0 +1,91 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { promisify } from 'node:util';
+import { excludeFromGit } from '../workspaces/dependencies.js';
+const execute = promisify(execFile);
+const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
+    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
+    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
+const engineering = (path) => !path.split('/').some(name => privateNames.has(name)
+    || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name)) && !path.startsWith('.playcraft/skills/');
+const inside = (root, path) => { const rel = relative(root, path); return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel); };
+const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'credential.helper=',
+    '-c', 'core.fsmonitor=false', '-C', root, ...args], { timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
+    env: { PATH: process.env.PATH, HOME: dirname(root), GIT_OPTIONAL_LOCKS: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' } })).stdout;
+async function sourceFiles(root) {
+    const paths = new Set((await git(root, 'ls-files', '--cached', '--others', '--exclude-standard', '-z')).split('\0').filter(Boolean));
+    const artifacts = await readdir(join(root, '.playcraft/skill-artifacts')).catch(error => {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    });
+    for (const name of artifacts)
+        if (/^[a-f0-9]{64}\.tar\.gz$/.test(name))
+            paths.add(`.playcraft/skill-artifacts/${name}`);
+    const files = new Map();
+    for (const path of [...paths].sort()) {
+        if (!engineering(path))
+            continue;
+        const full = join(root, path), stat = await lstat(full).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!stat)
+            continue;
+        if (!stat.isFile() || stat.isSymbolicLink() || !inside(root, await realpath(full)))
+            throw new Error('production_source_path_invalid');
+        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            files.set(path, { body: await handle.readFile(), mode: stat.mode & 0o777 });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return files;
+}
+function digest(files) {
+    const hash = createHash('sha256');
+    for (const [path, file] of files)
+        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
+    return hash.digest('hex');
+}
+/** Capture the selected working tree into a private branch; the source index, head and configuration are read only. */
+export async function copyProductionSource(input) {
+    const source = await realpath(input.source);
+    if (await lstat(input.destination).catch(() => undefined))
+        throw new Error('production_source_destination_exists');
+    const sourceHead = await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '');
+    const files = await sourceFiles(source), sourceDigest = digest(files);
+    const staging = join(dirname(input.destination), `.production-source-${randomUUID()}`);
+    try {
+        await mkdir(staging);
+        // An independent root commit also excludes credentials that existed only in source history.
+        await git(staging, '-c', 'init.templateDir=', 'init', '--initial-branch', input.branchName);
+        for (const [path, file] of files) {
+            await mkdir(dirname(join(staging, path)), { recursive: true });
+            await writeFile(join(staging, path), file.body, { mode: file.mode, flag: 'wx' });
+        }
+        if (sourceHead !== await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '') || sourceDigest !== digest(await sourceFiles(source)))
+            throw new Error('production_source_changed');
+        await git(staging, 'remote', 'add', 'origin', input.repositoryUrl);
+        await git(staging, 'config', 'user.name', 'PlayCraft');
+        await git(staging, 'config', 'user.email', 'playcraft@localhost');
+        await excludeFromGit(staging);
+        await excludeFromGit(staging, '/.env*');
+        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skill-artifacts/', '/.playcraft/skills/', '/.playcraft-temp/'])
+            await excludeFromGit(staging, entry);
+        await git(staging, 'add', '-A', '.');
+        await git(staging, 'commit', '--allow-empty', '-m', 'Capture batch source in independent remix');
+        const commitHash = (await git(staging, 'rev-parse', 'HEAD')).trim();
+        await rename(staging, input.destination);
+        return { commitHash, sourceDigest };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}

package/dist/workspace-runtime/production/stages.js

@@ -5,9 +5,9 @@ import { dirname, join } from 'node:path';
 import { promisify } from 'node:util';
 import { batchBaselineSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { checkoutBatchCommit, freezeBatchCommit } from '../workspaces/batch-commit.js';
-import { openDirectoryToDevelopment } from '../workspaces/directory-access.js';
+import { grantWorkspaceTraversal, openDirectoryToDevelopment } from '../workspaces/directory-access.js';
 import { registerWorkspaceDirectory } from '../workspaces/directories.js';
-import { workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
+import { workspaceContainerRoot, workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
 import { excludeFromGit, settleDependencyInstalls } from '../workspaces/dependencies.js';
 import { resolveProductionDependencies, verifyProductionDependencyLocks } from './dependencies.js';
 import { productionSaveCommand } from './save-command.js';
@@ -15,6 +15,9 @@ import { productionOutputStore, verifyProductionLease } from './storage.js';
 import { runProductionCommand } from './processes.js';
 import { runProductionNative } from './native.js';
 import { classifyPreviewOutput, findExternalLocalReferences } from '../previews/single-file.js';
+import { copyProductionSource } from './source-copy.js';
+import { workspaceDirectoryOccupied } from '../workspaces/directory-maintenance.js';
+import { ensureWorkspaceSkills } from '../workspaces/skills.js';
 const execute = promisify(execFile);
 const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 const hash = (body) => createHash('sha256').update(body).digest('hex');
@@ -25,6 +28,10 @@ export async function executeProductionStage(state, input, processRecord, track)
     const stage = input.stage;
     const workspaceId = input.task.workspaceId;
     const resultId = String(input.payload.resultVersionId ?? input.task.payload.resultVersionId ?? input.task.attemptId);
+    const sourceDirectoryName = String(input.payload.sourceDirectoryName ?? input.task.payload.sourceDirectoryName ?? 'basic');
+    if (input.task.payload.sourceDirectoryName !== undefined && input.payload.sourceDirectoryName !== undefined
+        && input.task.payload.sourceDirectoryName !== input.payload.sourceDirectoryName)
+        throw new Error('production_source_directory_mismatch');
     const previous = (name) => input.stages?.find(value => value.stage === name && value.status === 'completed')?.result;
     const run = async (cwd, command, env, trusted = false) => {
         const outcome = await runProductionCommand(state, { processId: `production-${input.task.attemptId}-${stage}`, cwd, command, env, trusted,
@@ -38,7 +45,34 @@ export async function executeProductionStage(state, input, processRecord, track)
     const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root, ...args], {
         timeout: 20_000, maxBuffer: 1024 * 1024, env: { PATH: process.env.PATH, HOME: state.config.stateDir, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' },
     })).stdout.trim();
-    if (stage === 'prepare' && input.directoryName !== 'basic') {
+    if (stage === 'capture-source') {
+        if (input.directoryName === 'basic' || input.directoryName === sourceDirectoryName)
+            throw new Error('production_source_directory_mismatch');
+        const authority = record(input.payload.workspace);
+        if (authority.directoryName !== input.directoryName || authority.workspaceId !== workspaceId
+            || typeof authority.remixId !== 'string' || typeof authority.branchName !== 'string' || typeof authority.repositoryUrl !== 'string')
+            throw new Error('production_source_directory_mismatch');
+        const { remixId, branchName, repositoryUrl } = authority;
+        await settleDependencyInstalls(state);
+        return state.journal.exclusive(`directory:${workspaceId}:${sourceDirectoryName}`, async () => {
+            if (await workspaceDirectoryOccupied(state, workspaceId, sourceDirectoryName)
+                || workspaceSessions(state, workspaceId, sourceDirectoryName).some(session => session.turnBlock === 'uncertain' || ['starting', 'running', 'waiting_for_user'].includes(session.turnStatus ?? '')))
+                throw new Error('production_source_busy');
+            const source = await workspaceRoot(state, workspaceId, sourceDirectoryName);
+            const container = await workspaceContainerRoot(state, workspaceId);
+            const destination = join(container, input.directoryName);
+            const developmentGroup = (await lstat(state.config.workspaceRoot)).gid;
+            const snapshot = await copyProductionSource({ source, destination, branchName, repositoryUrl });
+            await ensureWorkspaceSkills(destination, join(state.config.stateDir, 'skill-artifacts'));
+            await openDirectoryToDevelopment(destination, developmentGroup);
+            await grantWorkspaceTraversal(container, developmentGroup);
+            const binding = state.journal.getWorkspace(workspaceId);
+            await state.journal.putWorkspace({ ...binding, directories: [...(binding.directories ?? []).filter(value => value.directoryName !== input.directoryName),
+                    { workspaceId, directoryName: input.directoryName, remixId, branchName, sourceCommit: snapshot.commitHash, status: 'ready' }] });
+            return { sourceSnapshot: snapshot, commitHash: snapshot.commitHash };
+        });
+    }
+    if (stage === 'prepare' && input.directoryName !== 'basic' && (input.payload.baseline ?? input.task.payload.baseline)) {
         const baseline = record(input.payload.baseline ?? input.task.payload.baseline);
         const authority = record(input.payload.workspace);
         const sourceCommit = baseline.commitHash;
@@ -46,28 +80,21 @@ export async function executeProductionStage(state, input, processRecord, track)
             throw new Error('production_approved_commit_required');
         const directory = { workspaceId, directoryName: input.directoryName,
             remixId: String(authority.remixId), branchName: String(authority.branchName), sourceCommit };
-        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence);
+        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence, sourceDirectoryName);
     }
     const root = await workspaceRoot(state, workspaceId, input.directoryName);
-    if (stage === 'capture-source') {
-        if (input.directoryName !== 'basic')
-            throw new Error('production_source_directory_mismatch');
-        if (workspaceSessions(state, workspaceId, 'basic').some(session => session.turnBlock === 'uncertain' || ['starting', 'running', 'waiting_for_user'].includes(session.turnStatus ?? '')))
-            throw new Error('production_source_busy');
-        await settleDependencyInstalls(state);
-        await resolveProductionDependencies(root);
-        await excludeFromGit(root);
-        await excludeFromGit(root, '/.env*');
-        await git(root, 'config', 'user.name', 'PlayCraft');
-        await git(root, 'config', 'user.email', 'playcraft@localhost');
-        await run(root, 'git -c core.hooksPath=/dev/null add -A . && (git diff --cached --quiet || git -c core.hooksPath=/dev/null commit -m "Preserve basic before common repair")', undefined, true);
-        const commitHash = await git(root, 'rev-parse', 'HEAD');
-        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash, snapshotId: `${input.task.attemptId}-capture-source` });
-        return { sourceSnapshot: snapshot, commitHash };
-    }
     if (stage === 'prepare') {
         await settleDependencyInstalls(state);
-        const policy = await resolveProductionDependencies(root);
+        if (!(await lstat(join(root, 'package.json')).catch(() => undefined)))
+            return { prepared: true, directoryName: input.directoryName, emptySource: true };
+        const policy = await resolveProductionDependencies(root).catch(error => {
+            if (!(input.payload.baseline ?? input.task.payload.baseline) && error instanceof Error
+                && error.message === 'production_dependency_lock_required')
+                return undefined;
+            throw error;
+        });
+        if (!policy)
+            return { prepared: true, directoryName: input.directoryName, dependencyRepairRequired: true };
         await run(root, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
         await verifyProductionDependencyLocks(root, policy);
         return { prepared: true, directoryName: input.directoryName };

package/dist/workspace-runtime/serve.js

@@ -19,6 +19,7 @@ import { recoverInterruptedPreviews } from './previews/publish.js';
 import { recoverInterruptedInstalls } from './workspaces/dependencies.js';
 import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.js';
 import { workspaceContextFromRoot } from './workspaces/registry.js';
+import { observeWorkspaceArtifacts } from './workspaces/artifact-events.js';
 export async function startWorkspaceRuntime(config, options = {}) {
     process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
     const negotiated = negotiateProtocol(config);
@@ -63,6 +64,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
             gitCredentials = state.gitCredentials = new WorkspaceGitCredentialBroker(state);
             await gitCredentials.start();
         }
+        const stopArtifactObserver = observeWorkspaceArtifacts(state);
         attachNativeCollector(state);
         native?.onUnexpectedExit?.((event) => {
             void handleExecutionGroupCrash(state, event.pid);
@@ -134,6 +136,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
                         /* adapter shutdown is best-effort */
                     }
                     await serverClosed;
+                    await stopArtifactObserver();
                     await journal?.close();
                     lock.release();
                 }