@playcraft/cli 0.1.24 → 0.1.26

package/dist/workspace-runtime/production/native.js

@@ -0,0 +1,90 @@
+import { join } from 'node:path';
+import { lstat, mkdir } from 'node:fs/promises';
+import { createCodexAppServerAdapter } from '../codex/app-server.js';
+import { verifyProductionLease } from './storage.js';
+import { processBirth, stopProductionGroup } from './processes.js';
+import { openDirectoryToDevelopment } from '../workspaces/directory-access.js';
+export async function runProductionNative(state, input, root, record, track) {
+    if (!input.model)
+        throw new Error('production_model_configuration_required');
+    const temporaryRoot = join(root, '.playcraft-temp');
+    const existing = await lstat(temporaryRoot).catch(error => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    });
+    if (existing && (!existing.isDirectory() || existing.isSymbolicLink()))
+        throw new Error('production_source_path_invalid');
+    await mkdir(temporaryRoot, { recursive: true });
+    await openDirectoryToDevelopment(temporaryRoot, (await lstat(root)).gid);
+    const groups = [];
+    const adapter = createCodexAppServerAdapter({ config: { ...state.config, workspaceMode: 'single', workspaceRoot: root },
+        command: process.env.PLAYCRAFT_PRODUCTION_CODEX_COMMAND,
+        homeDir: process.env.PLAYCRAFT_LAUNCHER_SOCKET
+            ? `/var/lib/playcraft/codex/production-${input.task.attemptId}` : join(state.config.stateDir, 'production-native', input.task.attemptId),
+        model: input.model.model, processGroup: true,
+        fixedExecution: { cwd: root, approvalPolicy: 'never', sandboxPolicy: { type: 'workspaceWrite', writableRoots: [root],
+                networkAccess: true, excludeTmpdirEnvVar: true, excludeSlashTmp: true } },
+        fixedThreadConfig: { model: input.model.model, modelProvider: 'playcraft_production', config: {
+                approval_policy: 'never', sandbox_mode: 'workspace-write',
+                'sandbox_workspace_write.writable_roots': [root],
+                'sandbox_workspace_write.network_access': true,
+                'sandbox_workspace_write.exclude_tmpdir_env_var': true,
+                'sandbox_workspace_write.exclude_slash_tmp': true,
+                'shell_environment_policy.set': { PLAYCRAFT_TOOL_REQUEST_DIR: join(temporaryRoot, 'tool-requests'), PLAYCRAFT_SKIP_UPDATE_CHECK: '1',
+                    TMPDIR: temporaryRoot, npm_config_cache: join(temporaryRoot, 'npm-cache'), npm_config_store_dir: join(temporaryRoot, 'pnpm-store') },
+                'model_providers.playcraft_production': { name: 'PlayCraft Production', base_url: input.model.endpoint,
+                    wire_api: 'responses', requires_openai_auth: false, http_headers: { Authorization: `Bearer ${input.model.token}` } },
+            } },
+        onSkillProcessRestart: async (process) => {
+            const group = { pid: process.pid, birth: await processBirth(process.pid), stopped: false };
+            groups.push(group);
+            await record(group);
+        },
+    });
+    track(() => adapter.close());
+    const sessionId = `production-${input.task.attemptId}`;
+    let completion;
+    const done = new Promise(resolve => { completion = resolve; });
+    const unsubscribe = adapter.onCollected?.(event => {
+        if (event.kind === 'process_exit')
+            completion('unknown');
+        if (event.method === 'turn/completed') {
+            const value = event.params;
+            completion(value.turn?.status === 'completed' ? 'completed' : 'failed');
+        }
+    });
+    try {
+        await adapter.start();
+        const process = adapter.executionProcess?.();
+        if (!process)
+            throw new Error('production_process_not_started');
+        const group = { pid: process.pid, birth: await processBirth(process.pid), stopped: false };
+        groups.push(group);
+        await record(group);
+        const thread = await adapter.startThread({ sessionId, cwd: root });
+        const turn = await adapter.startTurn({ sessionId, threadId: thread.threadId, text: String(input.payload.prompt ?? ''),
+            clientRequestId: `${input.task.attemptId}:generate`, persistReservation: async () => undefined });
+        if (turn.outcome !== 'accepted')
+            throw new Error('production_native_start_unknown');
+        const timeout = setTimeout(() => completion('unknown'), 30 * 60_000);
+        let checking = false;
+        const leaseCheck = setInterval(() => {
+            if (checking)
+                return;
+            checking = true;
+            void verifyProductionLease(input).catch(async () => { completion('unknown'); await adapter.close?.().catch(() => undefined); }).finally(() => { checking = false; });
+        }, 5000);
+        const status = await done;
+        clearInterval(leaseCheck);
+        clearTimeout(timeout);
+        if (status !== 'completed')
+            throw new Error(status === 'failed' ? 'production_native_failed' : 'production_native_unknown');
+    }
+    finally {
+        unsubscribe?.();
+        await adapter.close?.().catch(() => undefined);
+        for (const group of groups)
+            await record({ ...group, stopped: await stopProductionGroup(group) });
+    }
+}

package/dist/workspace-runtime/production/processes.js

@@ -0,0 +1,86 @@
+import { spawn, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { readFile } from 'node:fs/promises';
+import { setTimeout as delay } from 'node:timers/promises';
+import { startLauncherProcess } from '../codex/launcher-client.js';
+export async function processBirth(pid) {
+    if (process.platform !== 'linux') {
+        return promisify(execFile)('ps', ['-p', String(pid), '-o', 'lstart='], { timeout: 2000 }).then(value => value.stdout.trim() || undefined, () => undefined);
+    }
+    try {
+        const stat = await readFile(`/proc/${pid}/stat`, 'utf8');
+        return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19];
+    }
+    catch {
+        return undefined;
+    }
+}
+export function groupExited(pid) {
+    try {
+        process.kill(-pid, 0);
+        return false;
+    }
+    catch (error) {
+        return error.code === 'ESRCH';
+    }
+}
+export async function stopProductionGroup(record) {
+    if (record.stopped || groupExited(record.pid))
+        return true;
+    if (record.birth && await processBirth(record.pid) !== record.birth)
+        return false;
+    for (const signal of ['SIGTERM', 'SIGKILL']) {
+        try {
+            process.kill(-record.pid, signal);
+        }
+        catch { /* Recheck whether the whole group exited. */ }
+        const deadline = Date.now() + 2000;
+        while (Date.now() < deadline) {
+            if (groupExited(record.pid))
+                return true;
+            await delay(25);
+        }
+    }
+    return groupExited(record.pid);
+}
+/** Only the save stage receives repository credentials; build and install receive none. */
+export async function runProductionCommand(state, input) {
+    const launcher = !input.trusted ? process.env.PLAYCRAFT_LAUNCHER_SOCKET : undefined;
+    const launched = launcher ? await startLauncherProcess({ socketPath: launcher, processId: input.processId,
+        runtimeEpoch: state.runtimeEpoch, argv: ['/usr/bin/bash', '-lc', input.command], cwd: input.cwd, env: input.env ?? {} }) : undefined;
+    const local = launched ? undefined : spawn('bash', ['-lc', input.command], { cwd: input.cwd,
+        env: { PATH: process.env.PATH, HOME: state.config.stateDir, ...input.env }, detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const pid = launched?.pid ?? local?.pid;
+    if (!pid)
+        throw new Error('production_process_not_started');
+    const record = { pid, birth: await processBirth(pid), stopped: false };
+    try {
+        await input.record(record);
+    }
+    catch (error) {
+        await stopProductionGroup(record);
+        throw error;
+    }
+    let output = '';
+    const collect = (chunk) => { output = (output + String(chunk)).slice(-64 * 1024); };
+    (launched?.stdout ?? local.stdout).on('data', collect);
+    (launched?.stderr ?? local.stderr).on('data', collect);
+    launched?.stdin?.end();
+    let timedOut = false;
+    const code = await new Promise((resolve) => {
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            void (launched ? launched.stop() : stopProductionGroup(record)).catch(() => undefined).finally(() => resolve(undefined));
+        }, input.timeoutMs);
+        const finish = (code) => { clearTimeout(timeout); resolve(code); };
+        if (launched)
+            launched.onExit(finish);
+        else {
+            local.once('error', () => finish(undefined));
+            local.once('close', finish);
+        }
+    });
+    const stopped = await stopProductionGroup(record);
+    await input.record({ ...record, stopped });
+    return { code: timedOut ? undefined : code, output, stopped };
+}

package/dist/workspace-runtime/production/save-command.js

@@ -0,0 +1,24 @@
+export function productionSaveCommand() {
+    return `set -eu
+status=0
+remote=$(git -c protocol.version=0 -c core.hooksPath=/dev/null ls-remote --exit-code --heads "$PRODUCTION_REPOSITORY" "refs/heads/$PRODUCTION_BRANCH") || status=$?
+if [ "$status" != 0 ] && [ "$status" != 2 ]; then exit "$status"; fi
+if [ "\${PRODUCTION_EXPECTED_PARENT+x}" = x ]; then
+  actual=$(printf '%s' "$remote" | cut -f1)
+  test "$actual" = "$PRODUCTION_EXPECTED_PARENT" || { printf 'production_git_parent_changed\\n' >&2; exit 1; }
+fi
+if [ -n "$remote" ]; then
+  parent=$(printf '%s' "$remote" | cut -f1)
+  git -c protocol.version=0 -c core.hooksPath=/dev/null fetch --no-tags --no-recurse-submodules "$PRODUCTION_REPOSITORY" "refs/heads/$PRODUCTION_BRANCH"
+  test "$(git rev-parse FETCH_HEAD)" = "$parent"
+  git -c core.hooksPath=/dev/null -c core.fsmonitor=false reset --soft FETCH_HEAD
+fi
+git -c core.hooksPath=/dev/null -c core.fsmonitor=false add -A .
+if [ -n "$(git ls-files -- .playcraft.json playcraft.config.json ':(glob)**/.playcraft.json' ':(glob)**/playcraft.config.json')" ]; then
+  printf 'production_git_private_path\\n' >&2
+  exit 1
+fi
+git diff --cached --quiet || git -c core.hooksPath=/dev/null commit -m "Save generated engineering"
+git -c protocol.version=0 -c core.hooksPath=/dev/null -c remote.origin.url="$PRODUCTION_REPOSITORY" -c remote.origin.pushurl="$PRODUCTION_REPOSITORY" push --set-upstream origin HEAD:"refs/heads/$PRODUCTION_BRANCH"
+git rev-parse HEAD`;
+}

package/dist/workspace-runtime/production/source-copy.js

@@ -0,0 +1,91 @@
+import { execFile } from 'node:child_process';
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { promisify } from 'node:util';
+import { excludeFromGit } from '../workspaces/dependencies.js';
+const execute = promisify(execFile);
+const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
+    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
+    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
+const engineering = (path) => !path.split('/').some(name => privateNames.has(name)
+    || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name)) && !path.startsWith('.playcraft/skills/');
+const inside = (root, path) => { const rel = relative(root, path); return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel); };
+const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'credential.helper=',
+    '-c', 'core.fsmonitor=false', '-C', root, ...args], { timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
+    env: { PATH: process.env.PATH, HOME: dirname(root), GIT_OPTIONAL_LOCKS: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' } })).stdout;
+async function sourceFiles(root) {
+    const paths = new Set((await git(root, 'ls-files', '--cached', '--others', '--exclude-standard', '-z')).split('\0').filter(Boolean));
+    const artifacts = await readdir(join(root, '.playcraft/skill-artifacts')).catch(error => {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    });
+    for (const name of artifacts)
+        if (/^[a-f0-9]{64}\.tar\.gz$/.test(name))
+            paths.add(`.playcraft/skill-artifacts/${name}`);
+    const files = new Map();
+    for (const path of [...paths].sort()) {
+        if (!engineering(path))
+            continue;
+        const full = join(root, path), stat = await lstat(full).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!stat)
+            continue;
+        if (!stat.isFile() || stat.isSymbolicLink() || !inside(root, await realpath(full)))
+            throw new Error('production_source_path_invalid');
+        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            files.set(path, { body: await handle.readFile(), mode: stat.mode & 0o777 });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return files;
+}
+function digest(files) {
+    const hash = createHash('sha256');
+    for (const [path, file] of files)
+        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
+    return hash.digest('hex');
+}
+/** Capture the selected working tree into a private branch; the source index, head and configuration are read only. */
+export async function copyProductionSource(input) {
+    const source = await realpath(input.source);
+    if (await lstat(input.destination).catch(() => undefined))
+        throw new Error('production_source_destination_exists');
+    const sourceHead = await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '');
+    const files = await sourceFiles(source), sourceDigest = digest(files);
+    const staging = join(dirname(input.destination), `.production-source-${randomUUID()}`);
+    try {
+        await mkdir(staging);
+        // An independent root commit also excludes credentials that existed only in source history.
+        await git(staging, '-c', 'init.templateDir=', 'init', '--initial-branch', input.branchName);
+        for (const [path, file] of files) {
+            await mkdir(dirname(join(staging, path)), { recursive: true });
+            await writeFile(join(staging, path), file.body, { mode: file.mode, flag: 'wx' });
+        }
+        if (sourceHead !== await git(source, 'rev-parse', '--verify', 'HEAD').catch(() => '') || sourceDigest !== digest(await sourceFiles(source)))
+            throw new Error('production_source_changed');
+        await git(staging, 'remote', 'add', 'origin', input.repositoryUrl);
+        await git(staging, 'config', 'user.name', 'PlayCraft');
+        await git(staging, 'config', 'user.email', 'playcraft@localhost');
+        await excludeFromGit(staging);
+        await excludeFromGit(staging, '/.env*');
+        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skill-artifacts/', '/.playcraft/skills/', '/.playcraft-temp/'])
+            await excludeFromGit(staging, entry);
+        await git(staging, 'add', '-A', '.');
+        await git(staging, 'commit', '--allow-empty', '-m', 'Capture batch source in independent remix');
+        const commitHash = (await git(staging, 'rev-parse', 'HEAD')).trim();
+        await rename(staging, input.destination);
+        return { commitHash, sourceDigest };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}

package/dist/workspace-runtime/production/stages.js

@@ -0,0 +1,202 @@
+import { execFile } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { promisify } from 'node:util';
+import { batchBaselineSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { checkoutBatchCommit, freezeBatchCommit } from '../workspaces/batch-commit.js';
+import { grantWorkspaceTraversal, openDirectoryToDevelopment } from '../workspaces/directory-access.js';
+import { registerWorkspaceDirectory } from '../workspaces/directories.js';
+import { workspaceContainerRoot, workspaceRoot, workspaceSessions } from '../workspaces/registry.js';
+import { excludeFromGit, settleDependencyInstalls } from '../workspaces/dependencies.js';
+import { resolveProductionDependencies, verifyProductionDependencyLocks } from './dependencies.js';
+import { productionSaveCommand } from './save-command.js';
+import { productionOutputStore, verifyProductionLease } from './storage.js';
+import { runProductionCommand } from './processes.js';
+import { runProductionNative } from './native.js';
+import { classifyPreviewOutput, findExternalLocalReferences } from '../previews/single-file.js';
+import { copyProductionSource } from './source-copy.js';
+import { workspaceDirectoryOccupied } from '../workspaces/directory-maintenance.js';
+import { ensureWorkspaceSkills } from '../workspaces/skills.js';
+const execute = promisify(execFile);
+const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+const hash = (body) => createHash('sha256').update(body).digest('hex');
+const record = (value) => value && typeof value === 'object' ? value : {};
+export async function executeProductionStage(state, input, processRecord, track) {
+    await verifyProductionLease(input);
+    const store = productionOutputStore(input);
+    const stage = input.stage;
+    const workspaceId = input.task.workspaceId;
+    const resultId = String(input.payload.resultVersionId ?? input.task.payload.resultVersionId ?? input.task.attemptId);
+    const sourceDirectoryName = String(input.payload.sourceDirectoryName ?? input.task.payload.sourceDirectoryName ?? 'basic');
+    if (input.task.payload.sourceDirectoryName !== undefined && input.payload.sourceDirectoryName !== undefined
+        && input.task.payload.sourceDirectoryName !== input.payload.sourceDirectoryName)
+        throw new Error('production_source_directory_mismatch');
+    const previous = (name) => input.stages?.find(value => value.stage === name && value.status === 'completed')?.result;
+    const run = async (cwd, command, env, trusted = false) => {
+        const outcome = await runProductionCommand(state, { processId: `production-${input.task.attemptId}-${stage}`, cwd, command, env, trusted,
+            timeoutMs: 10 * 60_000, record: processRecord });
+        if (!outcome.stopped || outcome.code === undefined)
+            throw new Error('production_process_unknown');
+        if (outcome.code !== 0)
+            throw new Error(`production_${stage}_failed`);
+        return outcome.output;
+    };
+    const git = async (root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root, ...args], {
+        timeout: 20_000, maxBuffer: 1024 * 1024, env: { PATH: process.env.PATH, HOME: state.config.stateDir, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' },
+    })).stdout.trim();
+    if (stage === 'capture-source') {
+        if (input.directoryName === 'basic' || input.directoryName === sourceDirectoryName)
+            throw new Error('production_source_directory_mismatch');
+        const authority = record(input.payload.workspace);
+        if (authority.directoryName !== input.directoryName || authority.workspaceId !== workspaceId
+            || typeof authority.remixId !== 'string' || typeof authority.branchName !== 'string' || typeof authority.repositoryUrl !== 'string')
+            throw new Error('production_source_directory_mismatch');
+        const { remixId, branchName, repositoryUrl } = authority;
+        await settleDependencyInstalls(state);
+        return state.journal.exclusive(`directory:${workspaceId}:${sourceDirectoryName}`, async () => {
+            if (await workspaceDirectoryOccupied(state, workspaceId, sourceDirectoryName)
+                || workspaceSessions(state, workspaceId, sourceDirectoryName).some(session => session.turnBlock === 'uncertain' || ['starting', 'running', 'waiting_for_user'].includes(session.turnStatus ?? '')))
+                throw new Error('production_source_busy');
+            const source = await workspaceRoot(state, workspaceId, sourceDirectoryName);
+            const container = await workspaceContainerRoot(state, workspaceId);
+            const destination = join(container, input.directoryName);
+            const developmentGroup = (await lstat(state.config.workspaceRoot)).gid;
+            const snapshot = await copyProductionSource({ source, destination, branchName, repositoryUrl });
+            await ensureWorkspaceSkills(destination, join(state.config.stateDir, 'skill-artifacts'));
+            await openDirectoryToDevelopment(destination, developmentGroup);
+            await grantWorkspaceTraversal(container, developmentGroup);
+            const binding = state.journal.getWorkspace(workspaceId);
+            await state.journal.putWorkspace({ ...binding, directories: [...(binding.directories ?? []).filter(value => value.directoryName !== input.directoryName),
+                    { workspaceId, directoryName: input.directoryName, remixId, branchName, sourceCommit: snapshot.commitHash, status: 'ready' }] });
+            return { sourceSnapshot: snapshot, commitHash: snapshot.commitHash };
+        });
+    }
+    if (stage === 'prepare' && input.directoryName !== 'basic' && (input.payload.baseline ?? input.task.payload.baseline)) {
+        const baseline = record(input.payload.baseline ?? input.task.payload.baseline);
+        const authority = record(input.payload.workspace);
+        const sourceCommit = baseline.commitHash;
+        if (typeof sourceCommit !== 'string')
+            throw new Error('production_approved_commit_required');
+        const directory = { workspaceId, directoryName: input.directoryName,
+            remixId: String(authority.remixId), branchName: String(authority.branchName), sourceCommit };
+        await registerWorkspaceDirectory(state, directory, state.acceptedLeaseFence, sourceDirectoryName);
+    }
+    const root = await workspaceRoot(state, workspaceId, input.directoryName);
+    if (stage === 'prepare') {
+        await settleDependencyInstalls(state);
+        if (!(await lstat(join(root, 'package.json')).catch(() => undefined)))
+            return { prepared: true, directoryName: input.directoryName, emptySource: true };
+        const policy = await resolveProductionDependencies(root).catch(error => {
+            if (!(input.payload.baseline ?? input.task.payload.baseline) && error instanceof Error
+                && error.message === 'production_dependency_lock_required')
+                return undefined;
+            throw error;
+        });
+        if (!policy)
+            return { prepared: true, directoryName: input.directoryName, dependencyRepairRequired: true };
+        await run(root, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
+        await verifyProductionDependencyLocks(root, policy);
+        return { prepared: true, directoryName: input.directoryName };
+    }
+    if (stage === 'generate') {
+        await runProductionNative(state, input, root, processRecord, track);
+        await resolveProductionDependencies(root);
+        return { generated: true };
+    }
+    if (stage === 'save') {
+        if (!input.git)
+            throw new Error('production_git_scope_required');
+        const binding = state.journal.getWorkspace(workspaceId);
+        const branch = input.directoryName === 'basic' ? binding.branchName : binding.directories?.find(value => value.directoryName === input.directoryName)?.branchName;
+        if (input.git.branchName !== branch || await git(root, 'symbolic-ref', '--short', 'HEAD') !== branch)
+            throw new Error('production_git_binding_mismatch');
+        await excludeFromGit(root);
+        await excludeFromGit(root, '/.env*');
+        await excludeFromGit(root, '/.playcraft-temp/');
+        await excludeFromGit(root, '/.playcraft-preview-out/');
+        await git(root, 'config', 'user.name', 'PlayCraft');
+        await git(root, 'config', 'user.email', 'playcraft@localhost');
+        const env = { PRODUCTION_REPOSITORY: input.git.repositoryUrl, PRODUCTION_BRANCH: input.git.branchName,
+            GIT_TERMINAL_PROMPT: '0', GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1' };
+        if (input.git.username && input.git.password)
+            Object.assign(env, { GIT_CONFIG_COUNT: '1',
+                GIT_CONFIG_KEY_0: `http.${input.git.repositoryUrl}.extraHeader`,
+                GIT_CONFIG_VALUE_0: `Authorization: Basic ${Buffer.from(`${input.git.username}:${input.git.password}`).toString('base64')}` });
+        if (typeof input.payload.expectedParent === 'string')
+            env.PRODUCTION_EXPECTED_PARENT = input.payload.expectedParent;
+        await run(root, productionSaveCommand(), env, true);
+        const commitHash = await git(root, 'rev-parse', 'HEAD');
+        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash, snapshotId: `${input.task.attemptId}-save` });
+        return { snapshot, saved: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId, sourceDigest: snapshot.checksum, commitHash, pushedCommitHash: commitHash } };
+    }
+    if (stage === 'freeze') {
+        const saved = record(previous('save')?.saved);
+        if (typeof saved.commitHash !== 'string')
+            throw new Error('production_saved_commit_required');
+        const snapshot = await freezeBatchCommit({ source: { workspaceId, root }, commitHash: saved.commitHash, snapshotId: `${input.task.attemptId}-freeze` });
+        const baseline = batchBaselineSnapshotSchema.parse({ batchId: input.task.batchId, projectId: String(input.payload.projectId ?? input.task.payload.projectId),
+            snapshotId: snapshot.snapshotId, sourceWorkspaceId: snapshot.sourceWorkspaceId, commitHash: snapshot.commitHash, checksum: snapshot.checksum,
+            sourceVersion: snapshot.sourceVersion, engine: String(input.payload.engine ?? input.task.payload.engine), skillLockDigest: snapshot.skillLockDigest, frozenAt: snapshot.frozenAt });
+        return { snapshot, baseline };
+    }
+    if (stage === 'build') {
+        const saved = record(input.payload.saved ?? previous('save')?.saved);
+        const snapshot = (previous('freeze')?.snapshot ?? previous('save')?.snapshot);
+        if (!snapshot || snapshot.commitHash !== saved.commitHash || snapshot.checksum !== saved.sourceDigest)
+            throw new Error('production_saved_snapshot_mismatch');
+        const destination = join(root, '.playcraft-temp', `production-${input.task.attemptId}`);
+        await excludeFromGit(root, '/.playcraft-temp/');
+        await rm(destination, { recursive: true, force: true });
+        try {
+            await checkoutBatchCommit({ source: { workspaceId, root }, frozen: snapshot, destination });
+            await openDirectoryToDevelopment(destination, (await lstat(state.config.workspaceRoot)).gid);
+            const policy = await resolveProductionDependencies(destination);
+            await run(destination, process.env.PLAYCRAFT_PRODUCTION_INSTALL_COMMAND ?? 'pnpm install --frozen-lockfile --store-dir /var/cache/playcraft/pnpm-store --ignore-scripts');
+            await verifyProductionDependencyLocks(destination, policy);
+            const output = join(destination, '.production-html');
+            const command = process.env.PLAYCRAFT_PRODUCTION_BUILD_COMMAND ?? 'playcraft build --mode full --platform playcraft --format html';
+            await run(destination, `${command} --output ${quote(output)} .`);
+            await verifyProductionDependencyLocks(destination, policy);
+            const entries = await readdir(output, { withFileTypes: true });
+            const single = classifyPreviewOutput(entries.map(entry => ({ name: entry.name, kind: entry.isFile() ? 'file' : entry.isDirectory() ? 'dir' : 'symlink' })));
+            if (!single.ok)
+                throw new Error('production_preview_not_single_file');
+            const path = join(output, single.entry);
+            if (!(await lstat(path)).isFile())
+                throw new Error('production_preview_invalid');
+            const body = await readFile(path);
+            if (findExternalLocalReferences(body.toString()).length)
+                throw new Error('production_preview_external_reference');
+            const outputDigest = hash(body), outputKey = `workspaces/${workspaceId}/production/${input.task.attemptId}/${outputDigest}.html`;
+            await store.put(outputKey, body);
+            return { outputKey, outputDigest, build: { attemptId: input.task.attemptId, resultVersionId: resultId, workspaceId,
+                    sourceDigest: snapshot.checksum, commitHash: snapshot.commitHash, buildId: `${input.task.attemptId}-build`, succeeded: true } };
+        }
+        finally {
+            await rm(destination, { recursive: true, force: true });
+        }
+    }
+    if (stage === 'preview') {
+        const built = previous('build');
+        if (typeof built?.outputKey !== 'string' || typeof built.outputDigest !== 'string')
+            throw new Error('production_build_required');
+        const body = await store.get(built.outputKey);
+        if (hash(body) !== built.outputDigest)
+            throw new Error('production_preview_digest_mismatch');
+        const previewPath = join(root, '.playcraft-temp', `${input.task.attemptId}.html`);
+        await mkdir(dirname(previewPath), { recursive: true });
+        await writeFile(previewPath, body);
+        try {
+            const browser = process.env.PLAYCRAFT_PRODUCTION_PREVIEW_COMMAND ?? 'chromium --headless --no-sandbox --disable-gpu --virtual-time-budget=1000 --dump-dom';
+            const opened = await run(root, `${browser} ${quote(`file://${previewPath}`)}`);
+            if (!/<html[\s>]/i.test(opened))
+                throw new Error('production_preview_not_opened');
+            return { opened: true, outputDigest: built.outputDigest };
+        }
+        finally {
+            await rm(previewPath, { force: true });
+        }
+    }
+    throw new Error('invalid_production_stage');
+}

package/dist/workspace-runtime/production/storage.js

@@ -0,0 +1,32 @@
+const taskUrl = (input) => `${input.callbackUrl.replace(/\/+$/, '')}/internal/cloud-production/tasks/${input.task.taskId}`;
+/** Build output travels through the Runtime that leased the task; engineering files travel through Git. */
+export function productionOutputStore(input) {
+    const object = (key) => `${taskUrl(input)}/objects/${encodeURIComponent(key)}`;
+    const headers = { authorization: `Bearer ${input.runnerToken}`, 'x-playcraft-object-client': 'cli' };
+    return {
+        async get(key) {
+            const response = await fetch(object(key), { headers, redirect: 'error', signal: AbortSignal.timeout(60_000) });
+            if (response.status === 404)
+                throw new Error('object_missing');
+            if (!response.ok)
+                throw new Error('object_get_failed');
+            return Buffer.from(await response.arrayBuffer());
+        },
+        async put(key, body) {
+            const response = await fetch(object(key), { method: 'PUT', body: new Uint8Array(body), redirect: 'error', signal: AbortSignal.timeout(60_000),
+                headers: { ...headers, 'content-type': 'application/octet-stream' } });
+            if (!response.ok)
+                throw new Error(response.status === 409 ? 'object_conflict' : 'object_put_failed');
+        },
+    };
+}
+export async function verifyProductionLease(input) {
+    const response = await fetch(`${taskUrl(input)}/runner`, {
+        headers: { authorization: `Bearer ${input.runnerToken}` }, redirect: 'error', signal: AbortSignal.timeout(10_000),
+    });
+    if (!response.ok)
+        throw new Error('production_lease_unavailable');
+    const { task } = await response.json();
+    if (!task || task.taskId !== input.task.taskId || task.attemptId !== input.task.attemptId || task.leaseOwner !== input.lease.owner || task.leaseFence !== input.lease.fence || task.status !== 'running' || task.cancelRequested)
+        throw new Error('production_lease_unavailable');
+}