@playcraft/cli 0.1.23 → 0.1.25

package/dist/workspace-runtime/workspaces/artifacts.js

@@ -0,0 +1,260 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, rename, unlink } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+import sharp from 'sharp';
+import { workspaceArtifactContentQuerySchema, workspaceArtifactListSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { artifactBundleDigest, artifactDirectory, artifactFormat, artifactPath, artifactResources, snapshotArtifactBundle, snapshotArtifactFile } from './artifact-files.js';
+import { ARTIFACT_RECEIPTS_DIRECTORY, readArtifactReceipt } from './artifact-receipts.js';
+const skippedDirectories = new Set(['node_modules', 'dist', 'build', 'coverage', 'vendor', 'tmp', 'temp', 'cache']);
+const serial = new Map();
+function digest(text) { return createHash('sha256').update(text).digest('hex'); }
+function artifactId(workspaceId, path) { return `artifact_${digest(`${workspaceId}\0${path}`).slice(0, 40)}`; }
+/** Catalogs and immutable bytes are control-owned, outside the mutable checkout. */
+export class WorkspaceArtifactStore {
+    stateDir;
+    workspaceId;
+    constructor(stateDir, workspaceId) {
+        this.stateDir = stateDir;
+        this.workspaceId = workspaceId;
+    }
+    async directory() {
+        await mkdir(this.stateDir, { recursive: true, mode: 0o700 });
+        return artifactDirectory(this.stateDir, `artifacts/${digest(this.workspaceId)}`);
+    }
+    async read(directory) {
+        const handle = await open(join(directory, 'catalog.json'), constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!handle)
+            return { artifacts: [], scannedAt: new Date().toISOString(), receipts: [], observations: {} };
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.size > 32 * 1024 * 1024)
+                throw new Error('artifact_catalog_invalid');
+            const { receipts, observations = {}, ...body } = JSON.parse(await handle.readFile('utf8'));
+            if (!Array.isArray(receipts) || receipts.some(id => typeof id !== 'string'))
+                throw new Error('artifact_catalog_invalid');
+            return { ...workspaceArtifactListSchema.parse(body), receipts, observations };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    async write(directory, catalog) {
+        const temporary = join(directory, `${randomUUID()}.tmp`);
+        const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        try {
+            await handle.writeFile(JSON.stringify(catalog));
+            await handle.sync();
+            await handle.close();
+            await rename(temporary, join(directory, 'catalog.json'));
+        }
+        finally {
+            await handle.close();
+            await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+                throw error; });
+        }
+    }
+    async discover(root, source = { kind: 'discovered' }, sourcePaths = []) {
+        const key = `${this.stateDir}\0${this.workspaceId}`;
+        const previous = serial.get(key) ?? Promise.resolve();
+        const task = previous.catch(() => undefined).then(() => this.scan(root, source, sourcePaths));
+        serial.set(key, task);
+        try {
+            return await task;
+        }
+        finally {
+            if (serial.get(key) === task)
+                serial.delete(key);
+        }
+    }
+    async list() {
+        const catalog = await this.read(await this.directory());
+        return workspaceArtifactListSchema.parse({ artifacts: catalog.artifacts, scannedAt: catalog.scannedAt });
+    }
+    async scan(root, source, sourcePaths) {
+        const directory = await this.directory();
+        const objects = await artifactDirectory(directory, 'objects');
+        const catalog = await this.read(directory);
+        const original = JSON.stringify(catalog.artifacts);
+        const receipts = await this.receipts(root, catalog);
+        for (const receipt of receipts) {
+            try {
+                for (const file of receipt.files) {
+                    const copied = await snapshotArtifactFile(root, `${ARTIFACT_RECEIPTS_DIRECTORY}/objects/${file.sha256}`, objects);
+                    if (copied.sha256 !== file.sha256 || copied.size !== file.size)
+                        throw new Error('artifact_receipt_digest_mismatch');
+                }
+                const primary = receipt.files.find(file => file.role === 'primary' && file.path === receipt.path);
+                if (!primary || !artifactFormat(receipt.path))
+                    continue;
+                const version = {
+                    id: `version_${receipt.id}`, createdAt: receipt.source.generatedAt ?? new Date().toISOString(),
+                    path: receipt.path, mimeType: primary.mimeType, size: primary.size, sha256: primary.sha256,
+                    files: receipt.files, source: receipt.source,
+                    ...(receipt.width ? { width: receipt.width } : {}), ...(receipt.height ? { height: receipt.height } : {}),
+                    ...(receipt.duration !== undefined ? { duration: receipt.duration } : {}),
+                };
+                this.add(catalog, version);
+                catalog.receipts.push(receipt.id);
+            }
+            catch { /* An incomplete receipt stays pending; the next scan retries its original bytes. */ }
+        }
+        const candidates = await discoverPaths(root);
+        // Models are inspected before images so their explicitly referenced textures stay under the model.
+        candidates.sort((a, b) => Number(artifactFormat(b)?.[0] === 'model') - Number(artifactFormat(a)?.[0] === 'model') || a.localeCompare(b));
+        const members = new Set(catalog.artifacts.flatMap(artifact => artifact.versions.flatMap(version => version.files.filter(file => file.role !== 'primary').map(file => file.path))));
+        for (const path of candidates) {
+            if (members.has(path))
+                continue;
+            try {
+                const current = catalog.artifacts.find(artifact => artifact.id === artifactId(this.workspaceId, path));
+                const version = current?.versions.find(entry => entry.id === current.currentVersionId);
+                const knownWrite = sourcePaths.includes(path) && Boolean(source.operationId) && version?.source.operationId !== source.operationId;
+                const observation = catalog.observations[path];
+                if (!knownWrite && version && observation?.versionId === version.id && observation.signature === await fileSignature(root, version.files.map(file => file.path)))
+                    continue;
+                const thumbnail = version?.files.find(file => file.role === 'thumbnail');
+                const thumbnailPath = thumbnail && await lstat(join(root, thumbnail.path)).then(stat => stat.isFile(), () => false) ? thumbnail.path : undefined;
+                const paths = [path, ...await artifactResources(root, path), ...(thumbnailPath ? [thumbnailPath] : [])];
+                const signature = await fileSignature(root, paths);
+                const files = await snapshotArtifactBundle(root, path, objects, thumbnailPath);
+                if (signature !== await fileSignature(root, files.map(file => file.path)))
+                    continue;
+                for (const file of files)
+                    if (file.role !== 'primary')
+                        members.add(file.path);
+                if (!knownWrite && version && artifactBundleDigest(version.files) === artifactBundleDigest(files)) {
+                    catalog.observations[path] = { signature, versionId: version.id };
+                    continue;
+                }
+                const primary = files[0];
+                const next = {
+                    id: `version_${knownWrite ? source.operationId : randomUUID()}`, createdAt: new Date().toISOString(),
+                    path, mimeType: primary.mimeType, size: primary.size, sha256: primary.sha256, files,
+                    source: sourcePaths.includes(path) ? source : { kind: 'discovered' },
+                    ...await this.dimensions(objects, primary),
+                };
+                this.add(catalog, next);
+                catalog.observations[path] = { signature, versionId: next.id };
+            }
+            catch { /* Files being written or temporarily missing are retried, never published as complete. */ }
+        }
+        catalog.artifacts = catalog.artifacts.filter(artifact => {
+            const current = artifact.versions.find(version => version.id === artifact.currentVersionId);
+            return current.source.kind !== 'discovered' || !members.has(current.path);
+        });
+        catalog.artifacts.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt) || a.id.localeCompare(b.id));
+        catalog.scannedAt = new Date().toISOString();
+        const list = workspaceArtifactListSchema.parse({ artifacts: catalog.artifacts, scannedAt: catalog.scannedAt });
+        await this.write(directory, catalog);
+        return { list, changed: original !== JSON.stringify(catalog.artifacts) };
+    }
+    add(catalog, version) {
+        const id = artifactId(this.workspaceId, version.path);
+        let artifact = catalog.artifacts.find(item => item.id === id);
+        if (!artifact) {
+            artifact = { id, kind: artifactFormat(version.path)[0], name: basename(version.path), currentVersionId: version.id, updatedAt: version.createdAt, versions: [] };
+            catalog.artifacts.push(artifact);
+        }
+        if (!artifact.versions.some(item => item.id === version.id)) {
+            // Display ordering is monotonic; the original generation time stays in source.generatedAt.
+            const latest = Math.max(0, ...artifact.versions.map(item => Date.parse(item.createdAt)));
+            version.createdAt = new Date(Math.max(Date.parse(version.createdAt), latest + 1)).toISOString();
+            artifact.versions.unshift(version);
+        }
+        artifact.currentVersionId = version.id;
+        artifact.updatedAt = version.createdAt;
+    }
+    async receipts(root, catalog) {
+        let directory;
+        try {
+            const target = join(root, ARTIFACT_RECEIPTS_DIRECTORY);
+            if (!(await lstat(target)).isDirectory())
+                return [];
+            directory = await artifactDirectory(root, ARTIFACT_RECEIPTS_DIRECTORY);
+        }
+        catch {
+            return [];
+        }
+        const seen = new Set(catalog.receipts), receipts = [];
+        for (const name of await readdir(directory)) {
+            if (!/^[a-f0-9-]{36}\.json$/.test(name) || seen.has(name.slice(0, -5)))
+                continue;
+            try {
+                const receipt = await readArtifactReceipt(join(directory, name));
+                if (receipt.workspaceId === this.workspaceId && `${receipt.id}.json` === name)
+                    receipts.push(receipt);
+            }
+            catch { /* Malformed output metadata is never trusted as a completed artifact. */ }
+        }
+        return receipts.sort((a, b) => (a.source.generatedAt ?? '').localeCompare(b.source.generatedAt ?? '') || a.id.localeCompare(b.id));
+    }
+    async dimensions(objects, file) {
+        if (!file.mimeType.startsWith('image/') || file.mimeType === 'image/svg+xml')
+            return {};
+        try {
+            const metadata = await sharp(join(objects, file.sha256), { limitInputPixels: 100_000_000 }).metadata();
+            return { ...(metadata.width ? { width: metadata.width } : {}), ...(metadata.height ? { height: metadata.height } : {}) };
+        }
+        catch {
+            return {};
+        }
+    }
+    async content(input) {
+        const query = workspaceArtifactContentQuerySchema.parse(input);
+        const directory = await this.directory(), catalog = await this.read(directory);
+        const artifact = catalog.artifacts.find(item => item.id === query.artifactId);
+        const version = artifact?.versions.find(item => item.id === query.versionId);
+        const file = version?.files.find(item => item.path === (query.path ?? version.path));
+        if (!file)
+            throw new Error('artifact_not_found');
+        if (query.offset > file.size)
+            throw new Error('artifact_range_invalid');
+        const handle = await open(join(directory, 'objects', file.sha256), constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const stat = await handle.stat();
+            if (!stat.isFile() || stat.nlink !== 1 || stat.size !== file.size)
+                throw new Error('artifact_snapshot_invalid');
+            const bytes = Buffer.alloc(Math.min(query.length, file.size - query.offset));
+            let read = 0;
+            while (read < bytes.length) {
+                const part = await handle.read(bytes, read, bytes.length - read, query.offset + read);
+                if (!part.bytesRead)
+                    throw new Error('artifact_snapshot_invalid');
+                read += part.bytesRead;
+            }
+            return { content: bytes.toString('base64'), mimeType: file.mimeType, totalBytes: file.size, offset: query.offset, sha256: file.sha256 };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+async function fileSignature(root, paths) {
+    const records = [];
+    for (const path of [...new Set(paths)].sort()) {
+        const stat = await lstat(await artifactPath(root, path));
+        if (!stat.isFile() || stat.nlink !== 1)
+            throw new Error('artifact_file_unavailable');
+        records.push([path, stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs]);
+    }
+    return JSON.stringify(records);
+}
+async function discoverPaths(root, directory = '', result = []) {
+    for (const entry of await readdir(join(root, directory), { withFileTypes: true })) {
+        if (entry.name.startsWith('.') || entry.isSymbolicLink())
+            continue;
+        const path = directory ? `${directory}/${entry.name}` : entry.name;
+        if (entry.isDirectory()) {
+            if (!skippedDirectories.has(entry.name))
+                await discoverPaths(root, path, result);
+        }
+        else if (entry.isFile() && artifactFormat(path))
+            result.push(path);
+    }
+    return result;
+}

package/dist/workspace-runtime/workspaces/attachments.js

@@ -1,10 +1,11 @@
 import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, open, readFile, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { WORKSPACE_USER_UPLOADS_DIRECTORY, attachmentIdsSchema, attachmentUploadSchema, WORKSPACE_ATTACHMENT_MAX_BYTES, } from '@playcraft/common/cloud-workspace/runtime';
+import { WORKSPACE_USER_UPLOADS_DIRECTORY, attachmentIdsSchema, attachmentUploadSchema, WORKSPACE_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MIME_TYPES, workspaceVideoAttachmentQuerySchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { NativePreparationError } from '../codex/native-adapter.js';
 import { excludeFromGit } from './dependencies.js';
+import { hashAttachment, probeAttachmentVideo } from './video-attachments.js';
 async function attachmentRoot(root) {
     // Reject redirected upload directories, including symlinks that stay inside the workspace.
     let directory = root;
@@ -74,6 +75,52 @@ export async function uploadWorkspaceAttachment(root, body) {
     });
     return attachment;
 }
+/** Video bodies are streamed into an unpublished attachment and never decoded as base64. */
+export async function uploadWorkspaceVideoAttachment(root, request, query) {
+    const { name } = workspaceVideoAttachmentQuerySchema.parse(query);
+    const contentType = String(request.headers['content-type'] ?? '').split(';')[0].trim().toLowerCase();
+    const declaredSize = request.headers['content-length'];
+    if (!WORKSPACE_VIDEO_ATTACHMENT_MIME_TYPES.includes(contentType)
+        || (declaredSize !== undefined && (!/^\d+$/.test(declaredSize) || Number(declaredSize) > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)))
+        throw new Error('invalid_attachment');
+    await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
+    const uploads = await attachmentRoot(root);
+    const id = randomUUID(), directory = join(uploads, id), metadataDirectory = join(uploads, '.metadata');
+    await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => { if (error.code !== 'EEXIST')
+        throw error; });
+    if (!(await lstat(metadataDirectory)).isDirectory())
+        throw new Error('invalid_attachment');
+    await mkdir(directory, { mode: 0o755 });
+    const handle = await open(join(directory, name), constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o644);
+    try {
+        let size = 0;
+        for await (const data of request) {
+            const bytes = Buffer.isBuffer(data) ? data : Buffer.from(data);
+            size += bytes.length;
+            if (size > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
+                throw new Error('invalid_attachment');
+            let offset = 0;
+            while (offset < bytes.length)
+                offset += (await handle.write(bytes, offset, bytes.length - offset, size - bytes.length + offset)).bytesWritten;
+        }
+        if (!size || (declaredSize !== undefined && Number(declaredSize) !== size))
+            throw new Error('invalid_attachment');
+        await handle.sync();
+        const media = await probeAttachmentVideo(handle);
+        if (contentType !== media.mimeType && !(contentType === 'video/quicktime' && media.mimeType === 'video/mp4'))
+            throw new Error('invalid_attachment');
+        const attachment = { id, name, size, ...media, sha256: await hashAttachment(handle) };
+        await writeFile(join(metadataDirectory, `${id}.json`), JSON.stringify(attachment), { flag: 'wx', mode: 0o644 });
+        return attachment;
+    }
+    catch (error) {
+        await rm(directory, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        await handle.close();
+    }
+}
 export async function resolveWorkspaceAttachments(root, input) {
     try {
         const ids = attachmentIdsSchema.parse(input ?? []);
@@ -85,7 +132,17 @@ export async function resolveWorkspaceAttachments(root, input) {
             await chmod(directory, 0o755);
             if (!(await lstat(join(uploads, '.metadata'))).isDirectory())
                 throw new Error('invalid_attachment');
-            const metadata = JSON.parse(await readFile(join(uploads, '.metadata', `${id}.json`), 'utf8'));
+            const metadataHandle = await open(join(uploads, '.metadata', `${id}.json`), constants.O_RDONLY | constants.O_NOFOLLOW);
+            let metadata;
+            try {
+                const stat = await metadataHandle.stat();
+                if (!stat.isFile() || stat.nlink !== 1 || stat.size > 8192)
+                    throw new Error('invalid_attachment');
+                metadata = JSON.parse(await metadataHandle.readFile('utf8'));
+            }
+            finally {
+                await metadataHandle.close();
+            }
             attachmentUploadSchema.shape.name.parse(metadata.name);
             if (metadata.id !== id)
                 throw new Error('invalid_attachment');
@@ -93,8 +150,17 @@ export async function resolveWorkspaceAttachments(root, input) {
             const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
             try {
                 const stat = await handle.stat();
-                if (!stat.isFile() || stat.size > WORKSPACE_ATTACHMENT_MAX_BYTES)
+                const video = metadata.mimeType?.startsWith('video/');
+                if (!stat.isFile() || stat.nlink !== 1 || stat.size !== metadata.size || stat.size > (video ? WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES : WORKSPACE_ATTACHMENT_MAX_BYTES))
                     throw new Error('invalid_attachment');
+                if (video) {
+                    const media = await probeAttachmentVideo(handle);
+                    const sha256 = await hashAttachment(handle);
+                    if (sha256 !== metadata.sha256 || media.mimeType !== metadata.mimeType || media.durationMs !== metadata.durationMs
+                        || media.width !== metadata.width || media.height !== metadata.height)
+                        throw new Error('invalid_attachment');
+                    return { ...metadata, ...media, path };
+                }
                 const bytes = await handle.readFile();
                 return { ...metadata, size: bytes.length, mimeType: imageMime(bytes), path };
             }

package/dist/workspace-runtime/workspaces/batch-commit.js

@@ -12,7 +12,7 @@ const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
 const PRIVATE_NAMES = new Set([
     '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store', '.config',
     '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json',
-    'credentials', 'secrets', 'id_rsa', 'id_ed25519', 'settings.local.json',
+    'credentials', 'secrets', 'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json',
 ]);
 const DEPENDENCY_LOCKS = ['pnpm-lock.yaml', 'package-lock.json', 'npm-shrinkwrap.json', 'yarn.lock', 'bun.lock', 'bun.lockb'];
 const SKILLS_DECLARATION = '.playcraft/skills.json';

package/dist/workspace-runtime/workspaces/cli-context.js

@@ -0,0 +1,23 @@
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { excludeFromGit } from './dependencies.js';
+/** Non-secret routing hint; the business service still authorizes the selected workspace. */
+export async function writeWorkspaceCliContext(root, workspaceId) {
+    const management = join(root, '.playcraft');
+    await mkdir(management, { mode: 0o755 }).catch(error => { if (error.code !== 'EEXIST')
+        throw error; });
+    const stat = await lstat(management);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('workspace_skills_invalid');
+    const temporary = join(management, `workspace-context.${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, `${JSON.stringify({ schemaVersion: 'playcraft.workspace-context.v1', workspaceId })}\n`, { flag: 'wx', mode: 0o644 });
+        await rename(temporary, join(management, 'workspace-context.json'));
+        await excludeFromGit(root, '/.playcraft/workspace-context.json');
+        await excludeFromGit(root, '/.playcraft/video-replication/');
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+}

package/dist/workspace-runtime/workspaces/directories.js

@@ -10,9 +10,10 @@ import { prepareWorkspaceCheckout } from './prepare.js';
 import { readDependencies, scheduleDependencyInstall } from './dependencies.js';
 import { revisionScope } from './registry.js';
 import { ensureWorkspaceSkills } from './skills.js';
+import { checkoutBatchCommit, freezeBatchCommit } from './batch-commit.js';
 const execute = promisify(execFile);
 /** Trusted Runtime registration clones an immutable local commit; it never follows basic's current branch head. */
-export async function registerWorkspaceDirectory(state, input, leaseFence) {
+export async function registerWorkspaceDirectory(state, input, leaseFence, sourceDirectoryName) {
     const directory = workspaceDirectoryRegistrationSchema.parse(input);
     if (directory.directoryName === 'basic')
         throw new WorkspaceContextError('workspace_directory_binding_conflict');
@@ -43,11 +44,17 @@ export async function registerWorkspaceDirectory(state, input, leaseFence) {
                 throw new WorkspaceContextError('workspace_recovery_required');
             if (!directory.sourceCommit)
                 throw new WorkspaceContextError('workspace_directory_source_commit_required');
-            const source = await workspaceRoot(state, directory.workspaceId, 'basic');
+            const source = await workspaceRoot(state, directory.workspaceId, sourceDirectoryName ?? 'basic');
             await git(source, 'cat-file', '-e', `${directory.sourceCommit}^{commit}`);
             const staging = join(parent, `.directory-${randomUUID()}`);
             try {
-                await execute('git', ['-c', 'core.hooksPath=/dev/null', 'clone', '--local', '--no-hardlinks', '--no-checkout', '--', source, staging], { timeout: 90_000, maxBuffer: 1024 * 1024 });
+                if (sourceDirectoryName !== undefined) {
+                    const frozen = await freezeBatchCommit({ source: { workspaceId: directory.workspaceId, root: source },
+                        commitHash: directory.sourceCommit, snapshotId: `directory-${directory.remixId}` });
+                    await checkoutBatchCommit({ source: { workspaceId: directory.workspaceId, root: source }, frozen, destination: staging });
+                }
+                else
+                    await execute('git', ['-c', 'core.hooksPath=/dev/null', 'clone', '--local', '--no-hardlinks', '--no-checkout', '--', source, staging], { timeout: 90_000, maxBuffer: 1024 * 1024 });
                 await git(staging, 'checkout', '-b', directory.branchName, directory.sourceCommit);
                 await git(staging, 'remote', 'set-url', 'origin', binding.repositoryUrl);
                 await git(staging, 'config', 'user.name', 'PlayCraft');

package/dist/workspace-runtime/workspaces/directory-access.js

@@ -1,5 +1,14 @@
 import { chmod, chown, lstat, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
+/** Grant development-group traversal of the workspace container without touching source checkouts. */
+export async function grantWorkspaceTraversal(root, groupId) {
+    const stat = await lstat(root);
+    if (!stat.isDirectory() || stat.isSymbolicLink())
+        throw new Error('invalid_workspace_directory');
+    if (stat.gid !== groupId)
+        await chown(root, stat.uid, groupId);
+    await chmod(root, (stat.mode & 0o777) | 0o2010);
+}
 /** The sandbox development group can edit engine directories. Symlinks never grant access outside the tree. */
 export async function openDirectoryToDevelopment(root, groupId) {
     const visit = async (path) => {

package/dist/workspace-runtime/workspaces/disk-snapshot.js

@@ -0,0 +1,31 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES } from '@playcraft/common/cloud-workspace/runtime';
+export async function sampleDiskFile(path) {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
+            throw new Error('snapshot_body_missing');
+        const digest = createHash('sha256');
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        for (;;) {
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+            if (!bytesRead)
+                break;
+            digest.update(chunk.subarray(0, bytesRead));
+            position += bytesRead;
+            if (position > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
+                throw new Error('snapshot_body_missing');
+        }
+        const after = await handle.stat();
+        if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || position !== before.size)
+            throw new Error('snapshot_body_missing');
+        return { hash: digest.digest('hex'), size: position, mode: before.mode & 0o777 };
+    }
+    finally {
+        await handle.close();
+    }
+}

package/dist/workspace-runtime/workspaces/empty-template.js

@@ -1,16 +1,22 @@
 import { cp, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { resolveCliPackageRoot } from '../../scaffold/compose.js';
+import { importBuiltinProjectSkills, selectPlatformSkillSnapshot } from '../../project-skills/builtin-import.js';
+import { createHash } from 'node:crypto';
+import { canonicalProjectSkillsJson } from '@playcraft/common/project-skills';
 import { syncLocalProjectSkills } from '../../project-skills/local-store.js';
-export const EMPTY_WORKSPACE_DEFAULT_SKILLS = [
+export const EMPTY_WORKSPACE_REPOSITORY_SKILLS = [
     'playcraft-skill-recommender',
     'playcraft-image-generation',
     'playcraft-audio-generation',
     'playcraft-image-processing',
     'playcraft-build-optimizer',
 ];
+export const EMPTY_WORKSPACE_PLATFORM_SKILLS = ['playcraft-video-understanding', 'playcraft-replica-validation'];
+export const EMPTY_WORKSPACE_DEFAULT_SKILLS = [...EMPTY_WORKSPACE_REPOSITORY_SKILLS, ...EMPTY_WORKSPACE_PLATFORM_SKILLS];
 /** Only called in a new, unpublished staging directory; existing workspaces are never scaffolded. */
-export async function scaffoldEmptyWorkspace(root, skillCache) {
+export async function scaffoldEmptyWorkspace(root, skillCache, access) {
+    const selected = await selectPlatformSkillSnapshot([...EMPTY_WORKSPACE_PLATFORM_SKILLS], access);
     const cliRoot = resolveCliPackageRoot();
     const template = join(cliRoot, 'project-templates', 'empty');
     for (const [source, target] of [
@@ -21,12 +27,14 @@ export async function scaffoldEmptyWorkspace(root, skillCache) {
     }
     const skills = join(root, '.agents', 'skills');
     await mkdir(skills, { recursive: true });
-    for (const name of EMPTY_WORKSPACE_DEFAULT_SKILLS) {
+    for (const name of EMPTY_WORKSPACE_REPOSITORY_SKILLS) {
         await cp(join(cliRoot, 'project-template', '.claude', 'skills', name), join(skills, name), {
             recursive: true,
             force: false,
             errorOnExist: true,
         });
     }
-    await syncLocalProjectSkills(root, skillCache);
+    const snapshot = await syncLocalProjectSkills(root, skillCache);
+    await importBuiltinProjectSkills(root, { names: [...EMPTY_WORKSPACE_PLATFORM_SKILLS], expectedDeclarationHash: snapshot.lock.declarationHash,
+        expectedLockHash: createHash('sha256').update(canonicalProjectSkillsJson(snapshot.lock)).digest('hex') }, skillCache, access, selected, true);
 }

package/dist/workspace-runtime/workspaces/files.js

@@ -1,7 +1,9 @@
-import { mkdir, readdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, readdir, readFile, realpath, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { hashWorkspaceFileContent, workspaceFileContentSchema, workspaceFileListSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { sampleDiskFile } from './disk-snapshot.js';
 const SKIP_DIRECTORY_NAMES = new Set(['.git', 'node_modules']);
+const LARGE_FILE_STREAM_THRESHOLD = 8 * 1024 * 1024;
 export class InvalidWorkspacePathError extends Error {
     code = 'invalid_workspace_path';
     constructor(path) {
@@ -55,6 +57,11 @@ export async function listWorkspaceFiles(root, revisions) {
     const files = [];
     for (const relativePath of await walkWorkspaceFiles(rootReal, rootReal)) {
         const target = join(rootReal, ...relativePath.split('/'));
+        if ((await lstat(target)).size > LARGE_FILE_STREAM_THRESHOLD) {
+            const sampled = await sampleDiskFile(target);
+            files.push({ path: relativePath, revision: revisions[relativePath]?.revision ?? 0, contentHash: sampled.hash, size: sampled.size });
+            continue;
+        }
         const content = await readFile(target, 'utf8');
         files.push({
             path: relativePath,

package/dist/workspace-runtime/workspaces/prepare.js

@@ -4,6 +4,7 @@ import { lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs
 import { join } from 'node:path';
 import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, sameWorkspaceRegistration, workspacePreparationSchema, workspaceRegistrationSchema, workspaceDirectoryNameSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { WorkspaceContextError } from './context-error.js';
+import { workspacePlatformSkillAccess } from './skill-artifact-loader.js';
 import { scaffoldEmptyWorkspace } from './empty-template.js';
 /** The caller holds the Workspace lock. Only an absent, never-published directory may be prepared. */
 export async function prepareWorkspaceCheckout(state, binding, input, leaseFence, directoryName = 'basic', recovery = false) {
@@ -96,7 +97,7 @@ export async function prepareWorkspaceCheckout(state, binding, input, leaseFence
         try {
             if (standalone) {
                 await runGit(['init', '--initial-branch=main', staging], env, deadline);
-                await scaffoldEmptyWorkspace(staging, join(state.config.stateDir, 'skill-artifacts'));
+                await scaffoldEmptyWorkspace(staging, join(state.config.stateDir, 'skill-artifacts'), workspacePlatformSkillAccess(state, binding.workspaceId));
             }
             else {
                 const fork = binding.pendingFork;

package/dist/workspace-runtime/workspaces/registry.js

@@ -7,7 +7,8 @@ import { prepareWorkspaceCheckout } from './prepare.js';
 import { WorkspaceContextError } from './context-error.js';
 import { scheduleDependencyInstall } from './dependencies.js';
 import { ensureWorkspaceSkills, readWorkspaceSkills } from './skills.js';
-import { loadWorkspaceSkillArtifact } from './skill-artifact-loader.js';
+import { loadWorkspaceSkillArtifact, workspacePlatformSkillAccess } from './skill-artifact-loader.js';
+import { writeWorkspaceCliContext } from './cli-context.js';
 export { WorkspaceContextError } from './context-error.js';
 const exec = promisify(execFile);
 export function revisionScope(state, workspaceId, directoryName = 'basic') {
@@ -88,7 +89,7 @@ export async function workspaceContextFromRoot(state, cwd) {
         throw new WorkspaceContextError('workspace_not_registered');
     return { workspaceId, directoryName };
 }
-export async function registerWorkspace(state, input, leaseFence, preparation) {
+export async function registerWorkspace(state, input, leaseFence, preparation, readOnlyBasic = false) {
     if (state.config.workspaceMode !== 'multi')
         throw new WorkspaceContextError('multi_workspace_unavailable');
     const parsed = workspaceRegistrationSchema.safeParse(input);
@@ -103,7 +104,9 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
         state.acceptedLeaseFence = leaseFence;
         await state.journal.setAcceptedLeaseFence(leaseFence);
         const existing = state.journal.getWorkspace(binding.workspaceId);
-        if (existing && !sameWorkspaceRegistration(existing, binding))
+        const preservedLocalBasic = binding.targetKind !== 'standalone' && binding.preserveLocalBasic === true;
+        const localUpgrade = preservedLocalBasic && binding.targetKind === 'main' && existing?.targetKind === 'standalone';
+        if (existing && !sameWorkspaceRegistration(existing, binding) && !localUpgrade)
             throw new WorkspaceContextError('workspace_binding_conflict');
         const directories = binding.directories ?? existing?.directories;
         if (directories?.some(directory => directory.directoryName === 'basic' && directory.status === 'reclaimed')) {
@@ -141,7 +144,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
         })).stdout.trim();
         try {
             let checkoutMatches;
-            if (binding.targetKind === 'standalone') {
+            if (binding.targetKind === 'standalone' || preservedLocalBasic) {
                 const gitDirectory = await lstat(join(root, '.git'));
                 checkoutMatches = gitDirectory.isDirectory() && !gitDirectory.isSymbolicLink()
                     && (await git('rev-parse', '--absolute-git-dir')) === join(root, '.git')
@@ -164,6 +167,10 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
             throw new WorkspaceContextError('runtime_destroyed');
         if (leaseFence < state.acceptedLeaseFence)
             throw new WorkspaceContextError('stale_lease');
+        if (readOnlyBasic || preservedLocalBasic) {
+            await state.journal.putWorkspace({ ...binding, directories });
+            return binding;
+        }
         if (preparation?.mode === 'clone' && (preparation.transport?.kind === 'git-gateway-v2' || isLocalWorkspaceGitAuthMode(preparation.authMode))) {
             if (!state.gitCredentials)
                 throw new WorkspaceContextError('workspace_git_gateway_unavailable');
@@ -175,11 +182,12 @@ export async function registerWorkspace(state, input, leaseFence, preparation) {
             }
         }
         try {
-            await ensureWorkspaceSkills(root, join(state.config.stateDir, 'skill-artifacts'));
+            await ensureWorkspaceSkills(root, join(state.config.stateDir, 'skill-artifacts'), workspacePlatformSkillAccess(state, binding.workspaceId));
         }
         catch {
             throw new WorkspaceContextError('workspace_skills_unavailable');
         }
+        await writeWorkspaceCliContext(root, binding.workspaceId);
         await state.journal.putWorkspace({ ...binding, directories });
         try {
             await readWorkspaceSkills(root, join(state.config.stateDir, 'skill-artifacts'), entry => loadWorkspaceSkillArtifact(state, binding.workspaceId, entry));