@playcraft/cli 0.1.28 → 0.1.29

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -1,155 +0,0 @@
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { join, resolve, sep } from 'node:path';
-import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema, workspaceDirectoryNameSchema, sameWorkspaceRegistration } from '@playcraft/common/cloud-workspace/runtime';
-/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
-export class WorkspaceGitDirectStore {
-    state;
-    mutation = Promise.resolve();
-    constructor(state) {
-        this.state = state;
-    }
-    exclusive(action) {
-        const result = this.mutation.then(action);
-        this.mutation = result.catch(() => undefined);
-        return result;
-    }
-    identity() {
-        const c = this.state.config;
-        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
-    }
-    name(id, directoryName = 'basic') {
-        if (!/^[a-f0-9-]{36}$/.test(id))
-            throw new Error('git_access_denied');
-        workspaceDirectoryNameSchema.parse(directoryName);
-        return `${id}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`;
-    }
-    async directory(create, action) {
-        const stateDir = resolve(this.state.config.stateDir);
-        const directory = join(stateDir, 'direct-git');
-        if (!create && !(await lstat(directory).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        })))
-            return undefined;
-        const root = await realpath(this.state.config.workspaceRoot);
-        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
-            throw new Error('git_control_directory_rejected');
-        }
-        for (const path of [stateDir, directory]) {
-            if (path === directory && create)
-                await mkdir(path, { mode: 0o700 }).catch(error => {
-                    if (error.code !== 'EEXIST')
-                        throw error;
-                });
-            const stat = await lstat(path);
-            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
-                throw new Error('git_control_directory_rejected');
-            }
-        }
-        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-        try {
-            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
-            return await action(pinned);
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async read(path) {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!handle)
-            return undefined;
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
-                throw new Error('git_credential_file_rejected');
-            }
-            return JSON.parse(await handle.readFile('utf8'));
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async get(binding, directoryName = 'basic') {
-        return this.directory(false, async (path) => {
-            const stored = await this.read(join(path, this.name(binding.workspaceId, directoryName)));
-            if (!stored)
-                return undefined;
-            if (stored.identity !== this.identity() || !sameWorkspaceRegistration(stored.binding, binding)
-                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                throw new Error('git_access_denied');
-            if (stored.access !== null) {
-                const access = workspaceGitDirectAccessSchema.parse(stored.access);
-                if (access.repositoryUrl !== binding.repositoryUrl)
-                    throw new Error('git_access_denied');
-            }
-            return stored;
-        });
-    }
-    async put(binding, access, rejectedPassword, directoryName = 'basic') {
-        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
-            throw new Error('git_access_denied');
-        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
-            throw new Error('git_access_denied');
-        await this.exclusive(() => this.directory(true, async (path) => {
-            const target = join(path, this.name(binding.workspaceId, directoryName));
-            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
-            const old = await this.read(target);
-            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
-                return;
-            const temporary = join(path, `${randomUUID()}.tmp`);
-            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-            try {
-                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
-                await handle.sync();
-                await handle.close();
-                if (this.state.journal.destroyed())
-                    throw new Error('git_access_denied');
-                await rename(temporary, target);
-                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
-                try {
-                    await dir.sync();
-                }
-                finally {
-                    await dir.close();
-                }
-            }
-            finally {
-                await handle.close();
-                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
-                    throw error; });
-            }
-        }));
-    }
-    async remove(workspaceId, directoryName = 'basic') {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            const target = join(path, this.name(workspaceId, directoryName));
-            await this.read(target);
-            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
-                throw error; });
-        }));
-    }
-    async sweep(destroy = false) {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            for (const name of await readdir(path)) {
-                if (!/^[a-f0-9-]{36}(?:--remix-[a-z0-9][a-z0-9-]{3,63})?\.(json|tmp)$/.test(name))
-                    throw new Error('git_credential_file_rejected');
-                const target = join(path, name);
-                if (name.endsWith('.tmp')) {
-                    await unlink(target);
-                    continue;
-                }
-                const stored = await this.read(target);
-                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                    await unlink(target);
-            }
-        }));
-    }
-}

package/dist/workspace-runtime/workspaces/git.js

@@ -1,517 +0,0 @@
-import { spawn } from 'node:child_process';
-import { excludeFromGit } from './dependencies.js';
-import { lstat, readFile, realpath, stat, unlink } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { basename, dirname, join, relative, resolve, sep } from 'node:path';
-import { WORKSPACE_FILE_CONTENT_MAX, gitDiffSchema, gitFileContentSchema, gitGraphSchema, gitStatusSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
-const GIT_DIFF_MAX_BYTES = 1024 * 1024;
-const GIT_PREFIX = [
-    '-c',
-    'core.hooksPath=/dev/null',
-    '-c',
-    'commit.gpgsign=false',
-    '-c',
-    'safe.directory=*',
-];
-export class GitWorkspaceError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.code = code;
-        this.name = 'GitWorkspaceError';
-    }
-}
-export async function probeGitBinary() {
-    try {
-        const result = await runGitProcess(tmpdir(), ['--version'], 4000);
-        return result.code === 0;
-    }
-    catch (error) {
-        return error instanceof GitWorkspaceError && error.code === 'git_binary_missing' ? false : false;
-    }
-}
-export async function readWorkspaceGitStatus(root) {
-    const rootReal = await ensureWorkspaceGit(root);
-    const branchResult = await gitAllowFail(rootReal, ['symbolic-ref', '--short', 'HEAD']);
-    const branch = branchResult.code === 0 ? branchResult.stdout.trim() || 'HEAD' : 'HEAD';
-    const upstream = await gitAllowFail(rootReal, ['rev-list', '--left-right', '--count', '@{upstream}...HEAD']);
-    let ahead = 0;
-    let behind = 0;
-    if (upstream.code === 0) {
-        const [left, right] = upstream.stdout.trim().split(/\s+/);
-        behind = Number.parseInt(left ?? '0', 10) || 0;
-        ahead = Number.parseInt(right ?? '0', 10) || 0;
-    }
-    const porcelain = await git(rootReal, ['status', '--porcelain=v1', '--untracked-files=all', '-z']);
-    // Line counts are a convenience; a repository without commits still lists its files.
-    const [staged, unstaged] = await Promise.all([
-        gitAllowFail(rootReal, ['diff', '--cached', '--numstat', '-z']),
-        gitAllowFail(rootReal, ['diff', '--numstat', '-z']),
-    ]);
-    const stagedCounts = staged.code === 0 ? parseNumstat(staged.stdout) : new Map();
-    const unstagedCounts = unstaged.code === 0 ? parseNumstat(unstaged.stdout) : new Map();
-    return gitStatusSchema.parse({
-        initialized: true,
-        branch,
-        ahead,
-        behind,
-        hasUpstream: upstream.code === 0,
-        files: parsePorcelain(porcelain).map((entry) => ({
-            ...entry,
-            ...(stagedCounts.has(entry.path) ? { staged: stagedCounts.get(entry.path) } : {}),
-            ...(unstagedCounts.has(entry.path) ? { unstaged: unstagedCounts.get(entry.path) } : {}),
-        })),
-    });
-}
-/**
- * One file as stored in the last commit or in the index. Reads the blob as is, without filters,
- * so the browser compares exactly what Git holds.
- */
-export async function readWorkspaceGitFile(root, path, ref) {
-    const rootReal = await ensureWorkspaceGit(root);
-    assertWorkspacePaths([path]);
-    const object = ref === 'HEAD' ? `HEAD:${path}` : `:${path}`;
-    const absent = gitFileContentSchema.parse({ path, ref, exists: false, binary: false, content: '' });
-    const size = await gitAllowFail(rootReal, ['cat-file', '-s', object]);
-    if (size.code !== 0)
-        return absent;
-    if (Number.parseInt(size.stdout.trim(), 10) > WORKSPACE_FILE_CONTENT_MAX) {
-        throw new GitWorkspaceError('git_file_too_large', path);
-    }
-    const blob = await gitAllowFail(rootReal, ['cat-file', 'blob', object]);
-    if (blob.code !== 0)
-        return absent;
-    // Git treats a NUL byte as the mark of binary content; so does the diff view.
-    const binary = blob.stdout.includes('\0');
-    return gitFileContentSchema.parse({ path, ref, exists: true, binary, content: binary ? '' : blob.stdout });
-}
-/** Adds the paths to the index, including deletions. */
-export async function stageWorkspaceGit(root, payload) {
-    const rootReal = await ensureWorkspaceGit(root);
-    assertWorkspacePaths(payload.paths);
-    await git(rootReal, ['--literal-pathspecs', 'add', '-A', '--', ...payload.paths]);
-}
-/** Returns the paths' index entries to the last commit, leaving the work tree alone. */
-export async function unstageWorkspaceGit(root, payload) {
-    const rootReal = await ensureWorkspaceGit(root);
-    assertWorkspacePaths(payload.paths);
-    const head = await gitAllowFail(rootReal, ['rev-parse', '--verify', '--quiet', 'HEAD']);
-    if (head.code === 0) {
-        await git(rootReal, ['--literal-pathspecs', 'restore', '--staged', '--', ...payload.paths]);
-    }
-    else {
-        // Before the first commit there is nothing to restore from; the entries are simply removed.
-        await git(rootReal, ['--literal-pathspecs', 'rm', '--cached', '-r', '-q', '--ignore-unmatch', '--', ...payload.paths]);
-    }
-}
-/**
- * Throws away work-tree changes: tracked files return to their staged content, untracked files are
- * deleted. Staged content is never touched, so a staged change survives a discard.
- */
-export async function discardWorkspaceGit(root, payload) {
-    const rootReal = await ensureWorkspaceGit(root);
-    assertWorkspacePaths(payload.paths);
-    const others = await git(rootReal, ['--literal-pathspecs', 'ls-files', '--others', '--exclude-standard', '-z', '--', ...payload.paths]);
-    const untracked = new Set(others.split('\0').filter((path) => path.length > 0));
-    const tracked = payload.paths.filter((path) => !untracked.has(path));
-    if (tracked.length > 0) {
-        await git(rootReal, ['--literal-pathspecs', 'restore', '--worktree', '--', ...tracked]);
-    }
-    for (const path of untracked) {
-        const target = resolve(rootReal, path);
-        // The parent must resolve inside the workspace, so a symlinked directory cannot redirect the delete.
-        assertInsideRoot(rootReal, join(await realpath(dirname(target)), basename(target)));
-        if ((await lstat(target)).isDirectory())
-            throw new GitWorkspaceError('invalid_workspace_path', path);
-        await unlink(target);
-    }
-}
-function assertWorkspacePaths(paths) {
-    for (const relativePath of paths) {
-        if (!workspaceRelativePathSchema.safeParse(relativePath).success) {
-            throw new GitWorkspaceError('invalid_workspace_path', relativePath);
-        }
-    }
-}
-export async function readWorkspaceGitDiff(root) {
-    const rootReal = await ensureWorkspaceGit(root);
-    const vsHead = await gitAllowFail(rootReal, ['diff', '--no-color', 'HEAD']);
-    const patch = vsHead.code === 0
-        ? vsHead.stdout
-        : `${(await gitAllowFail(rootReal, ['diff', '--no-color'])).stdout}${(await gitAllowFail(rootReal, ['diff', '--no-color', '--cached'])).stdout}`;
-    if (Buffer.byteLength(patch, 'utf8') > GIT_DIFF_MAX_BYTES) {
-        throw new GitWorkspaceError('git_diff_too_large', '1MiB');
-    }
-    return gitDiffSchema.parse({ patch });
-}
-export async function readWorkspaceGitGraph(root) {
-    const rootReal = await ensureWorkspaceGit(root);
-    const log = await gitAllowFail(rootReal, ['log', '-n', '20', '--format=%H%x09%s%x09%cI']);
-    if (log.code !== 0)
-        return gitGraphSchema.parse({ commits: [] });
-    const commits = log.stdout
-        .split('\n')
-        .map((line) => line.trimEnd())
-        .filter((line) => line.length > 0)
-        .map((line) => {
-        const [sha, subject, committedAt] = splitLogLine(line);
-        return {
-            sha,
-            subject: subject.length > 0 ? subject : '(empty)',
-            committedAt: committedAt.length > 0 ? committedAt : new Date(0).toISOString(),
-        };
-    });
-    return gitGraphSchema.parse({ commits });
-}
-function splitLogLine(line) {
-    const first = line.indexOf('\t');
-    if (first < 0)
-        return [line, '', ''];
-    const second = line.indexOf('\t', first + 1);
-    if (second < 0)
-        return [line.slice(0, first), line.slice(first + 1), ''];
-    return [line.slice(0, first), line.slice(first + 1, second), line.slice(second + 1)];
-}
-/**
- * Commit and push stay on the branch the workspace is bound to. A switch made in a shell or by an
- * agent is reported, never followed, so work cannot land on another Remix.
- */
-async function assertBoundBranch(rootReal, boundBranch) {
-    if (!boundBranch)
-        return;
-    const current = await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD']);
-    const branch = current.code === 0 ? current.stdout.trim() : '';
-    if (branch !== boundBranch) {
-        throw new GitWorkspaceError('workspace_branch_mismatch', branch || 'detached HEAD');
-    }
-}
-/**
- * A push the remote refused for this ref is a definite outcome, unlike a lost response. Porcelain
- * output marks the ref with "!" and says whether the remote has commits this checkout lacks.
- */
-/**
- * The gateway or the host refused the push over HTTP before any ref changed: no write access, the
- * gateway's writes switched off, or no such repository. Like a protected-branch refusal, nothing
- * was pushed and the commit is kept.
- */
-function httpRefusal(stderr) {
-    return /returned error: (?:401|403|404)\b|Authentication failed|Access denied|could not read Username|repository '[^']*' not found/i.test(stderr)
-        ? 'git_push_rejected'
-        : undefined;
-}
-function pushRejection(stdout) {
-    const line = stdout.split('\n').find((item) => item.startsWith('!\t'));
-    if (!line)
-        return undefined;
-    if (/\[rejected\] \((?:non-fast-forward|fetch first)\)/.test(line))
-        return 'git_push_remote_ahead';
-    return 'git_push_rejected';
-}
-export async function commitWorkspaceGit(root, payload, boundBranch) {
-    const rootReal = await ensureWorkspaceGit(root);
-    await assertBoundBranch(rootReal, boundBranch);
-    if (payload.stagedOnly) {
-        // The index is the commit; nothing is added.
-    }
-    else if (payload.paths && payload.paths.length > 0) {
-        assertWorkspacePaths(payload.paths);
-        await git(rootReal, ['add', '--', ...payload.paths]);
-    }
-    else {
-        await git(rootReal, ['add', '-A']);
-    }
-    const cached = await gitAllowFail(rootReal, ['diff', '--cached', '--quiet']);
-    if (cached.code === 0) {
-        throw new GitWorkspaceError('nothing_to_commit', payload.message);
-    }
-    await git(rootReal, ['commit', '-m', payload.message], 20000);
-    return (await git(rootReal, ['rev-parse', 'HEAD'])).trim();
-}
-export async function pushWorkspaceGit(root, boundBranch) {
-    const rootReal = await ensureWorkspaceGit(root);
-    await assertBoundBranch(rootReal, boundBranch);
-    const origin = await gitAllowFail(rootReal, ['remote', 'get-url', 'origin']);
-    if (origin.code !== 0) {
-        throw new GitWorkspaceError('remote_not_configured', 'origin');
-    }
-    const ref = (await git(rootReal, ['symbolic-ref', '--quiet', 'HEAD'])).trim();
-    if (!ref.startsWith('refs/heads/'))
-        throw new GitWorkspaceError('git_command_failed', 'git_branch_required');
-    const commit = (await git(rootReal, ['rev-parse', '--verify', 'HEAD^{commit}'])).trim();
-    let pushed;
-    try {
-        pushed = await gitAllowFail(rootReal, ['push', '--porcelain', 'origin', `${commit}:${ref}`], 90000);
-    }
-    catch { /* A lost response does not prove the remote rejected the update. */ }
-    if (pushed?.code === 0)
-        return;
-    const rejected = pushed ? pushRejection(pushed.stdout) ?? httpRefusal(pushed.stderr) : undefined;
-    if (rejected)
-        throw new GitWorkspaceError(rejected, rejected);
-    try {
-        const remote = await gitAllowFail(rootReal, ['ls-remote', '--refs', 'origin', ref], 20000);
-        if (remote.code === 0 && remote.stdout.trim() === `${commit}\t${ref}`)
-            return;
-    }
-    catch { /* Preserve uncertainty; never replay a write automatically. */ }
-    throw new GitWorkspaceError('git_push_outcome_unknown', 'git_push_outcome_unknown');
-}
-/**
- * Credential files a save never commits, even when `.gitignore` misses them: env files (their
- * `.example` / `.sample` / `.template` stay), SSH keys, netrc and Git credential stores, and key
- * or certificate bundles.
- */
-const CREDENTIAL_FILE = /^(?:\.env(?:\.(?!(?:example|sample|template)$)[^/]+)?|id_(?:rsa|dsa|ecdsa|ed25519)|\.netrc|\.git-credentials|[^/]*\.(?:pem|key|p12|pfx))$/i;
-export function isCredentialFile(path) {
-    return CREDENTIAL_FILE.test(path.split('/').pop() ?? '');
-}
-/**
- * Commits every change in the work tree (`git add -A`, credential files aside) and, when asked,
- * pushes the branch. A save with nothing new commits nothing and pushes only what the remote
- * lacks, so a commit whose push failed goes out with the next save.
- */
-export async function saveWorkspaceGit(root, input) {
-    const rootReal = await ensureWorkspaceGit(root);
-    await assertBoundBranch(rootReal, input.boundBranch);
-    await git(rootReal, ['add', '-A'], 60000);
-    const staged = (await git(rootReal, ['diff', '--cached', '--name-only', '-z'], 60000)).split('\0').filter(Boolean);
-    const withheld = staged.filter(isCredentialFile);
-    await unstage(rootReal, withheld);
-    const cached = await gitAllowFail(rootReal, ['diff', '--cached', '--quiet'], 60000);
-    if (cached.code !== 0 && cached.code !== 1) {
-        throw new GitWorkspaceError('git_command_failed', cached.stderr.trim() || 'git_diff_failed');
-    }
-    let commit;
-    if (cached.code === 1) {
-        await git(rootReal, [...(await commitIdentity(rootReal)), 'commit', '-q', '-m', input.message], 60000);
-        commit = (await git(rootReal, ['rev-parse', 'HEAD'])).trim();
-    }
-    if (!input.push || (await remoteHasHead(rootReal)))
-        return { ...(commit ? { commit } : {}), pushed: false, withheld };
-    await pushWorkspaceGit(rootReal, input.boundBranch);
-    await recordPushedHead(rootReal);
-    return { ...(commit ? { commit } : {}), pushed: true, withheld };
-}
-/**
- * Connects a standalone checkout to the repository it was just given, keeping all its history and
- * uncommitted work. The new repository holds one empty commit on `branch`; it becomes the base of an
- * unborn checkout, or is merged into existing history, so the next push is a plain fast-forward.
- * Credentials come from the workspace's configured helper and never enter the remote URL.
- * Safe to run again after a failure part way.
- */
-export async function attachWorkspaceRemote(root, repositoryUrl, branch) {
-    const rootReal = await ensureWorkspaceGit(root);
-    const origin = await gitAllowFail(rootReal, ['remote', 'get-url', 'origin']);
-    if (origin.code !== 0)
-        await git(rootReal, ['remote', 'add', 'origin', repositoryUrl]);
-    else if (origin.stdout.trim() !== repositoryUrl)
-        throw new GitWorkspaceError('remote_not_configured', 'origin_mismatch');
-    const remoteRef = `refs/remotes/origin/${branch}`;
-    const fetched = await gitAllowFail(rootReal, ['fetch', '--no-tags', 'origin', `+refs/heads/${branch}:${remoteRef}`], 90000);
-    if (fetched.code !== 0)
-        throw new GitWorkspaceError(httpRefusal(fetched.stderr) ?? 'git_command_failed', 'git_fetch_failed');
-    const current = (await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD'])).stdout.trim();
-    const born = (await gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD^{commit}'])).code === 0;
-    if (current !== branch) {
-        await git(rootReal, born ? ['branch', '-M', branch] : ['symbolic-ref', 'HEAD', `refs/heads/${branch}`]);
-    }
-    if (!born) {
-        // Nothing committed yet: start the branch at the remote commit; the files stay as changes.
-        await git(rootReal, ['update-ref', `refs/heads/${branch}`, remoteRef]);
-    }
-    else if ((await gitAllowFail(rootReal, ['merge-base', '--is-ancestor', remoteRef, 'HEAD'])).code !== 0) {
-        const merged = await gitAllowFail(rootReal, [...(await commitIdentity(rootReal)), 'merge', '--allow-unrelated-histories', '--no-edit', remoteRef], 60000);
-        if (merged.code !== 0) {
-            await gitAllowFail(rootReal, ['merge', '--abort']);
-            throw new GitWorkspaceError('git_command_failed', merged.stderr.trim() || 'git_merge_failed');
-        }
-    }
-    await git(rootReal, ['branch', `--set-upstream-to=origin/${branch}`, branch]);
-}
-async function unstage(rootReal, paths) {
-    if (paths.length === 0)
-        return;
-    const born = (await gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD'])).code === 0;
-    for (let start = 0; start < paths.length; start += 100) {
-        const chunk = paths.slice(start, start + 100);
-        // Before the first commit there is no HEAD to reset to; dropping the entries does the same.
-        await git(rootReal, born ? ['reset', '-q', '--', ...chunk] : ['rm', '-q', '--cached', '--', ...chunk]);
-    }
-}
-/** A clone carries no committer; the sandbox image sets none either. */
-async function commitIdentity(rootReal) {
-    const email = await gitAllowFail(rootReal, ['config', 'user.email']);
-    if (email.code === 0 && email.stdout.trim())
-        return [];
-    return ['-c', 'user.name=PlayCraft Workspace', '-c', 'user.email=workspace@playcraft.local'];
-}
-/**
- * The remote-tracking ref of the current branch. A fork clone has no fetch refspec for its own
- * branch, so the ref is written here after a confirmed push.
- */
-async function trackingRef(rootReal) {
-    const branch = (await gitAllowFail(rootReal, ['symbolic-ref', '--quiet', '--short', 'HEAD'])).stdout.trim();
-    return branch ? `refs/remotes/origin/${branch}` : undefined;
-}
-async function remoteHasHead(rootReal) {
-    const ref = await trackingRef(rootReal);
-    if (!ref)
-        return false;
-    const [head, tracked] = await Promise.all([
-        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', 'HEAD^{commit}']),
-        gitAllowFail(rootReal, ['rev-parse', '-q', '--verify', `${ref}^{commit}`]),
-    ]);
-    return head.code === 0 && tracked.code === 0 && head.stdout.trim() === tracked.stdout.trim();
-}
-async function recordPushedHead(rootReal) {
-    const ref = await trackingRef(rootReal);
-    if (ref)
-        await gitAllowFail(rootReal, ['update-ref', ref, 'HEAD']);
-}
-export async function ensureWorkspaceGit(root) {
-    const rootReal = await realpath(root);
-    if (!(await gitMarkerExists(rootReal))) {
-        const init = await gitAllowFail(rootReal, ['init']);
-        if (init.code !== 0) {
-            throw new GitWorkspaceError('git_command_failed', init.stderr.trim() || 'git_init_failed');
-        }
-        await git(rootReal, ['config', 'user.name', 'PlayCraft Workspace']);
-        await git(rootReal, ['config', 'user.email', 'workspace@playcraft.local']);
-    }
-    await assertWorkspaceGitRoot(rootReal);
-    await excludeFromGit(rootReal, '/.tmp/user_uploads/');
-    return rootReal;
-}
-async function gitMarkerExists(rootReal) {
-    try {
-        await stat(join(rootReal, '.git'));
-        return true;
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    }
-}
-async function assertWorkspaceGitRoot(rootReal) {
-    const marker = join(rootReal, '.git');
-    const info = await stat(marker);
-    if (info.isDirectory()) {
-        assertInsideRoot(rootReal, await realpath(marker));
-        return;
-    }
-    if (info.isFile()) {
-        const text = await readFile(marker, 'utf8');
-        const match = /^gitdir:\s*(.+)$/m.exec(text);
-        if (!match)
-            throw new GitWorkspaceError('git_root_escape', 'invalid_gitdir');
-        const target = resolve(rootReal, match[1].trim());
-        assertInsideRoot(rootReal, await realpath(target));
-        return;
-    }
-    throw new GitWorkspaceError('git_root_escape', marker);
-}
-function assertInsideRoot(rootReal, target) {
-    const rel = relative(rootReal, target);
-    if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || rel.startsWith('..')) {
-        throw new GitWorkspaceError('git_root_escape', target);
-    }
-}
-function parsePorcelain(raw) {
-    const parts = raw.split('\0').filter((part) => part.length > 0);
-    const files = [];
-    for (let i = 0; i < parts.length; i += 1) {
-        const entry = parts[i] ?? '';
-        if (entry.length < 3)
-            continue;
-        const indexStatus = entry[0] ?? ' ';
-        const worktreeStatus = entry[1] ?? ' ';
-        const pathPart = entry.slice(3);
-        if (indexStatus === 'R' || indexStatus === 'C' || worktreeStatus === 'R' || worktreeStatus === 'C') {
-            const dest = parts[i + 1] ?? pathPart;
-            i += 1;
-            files.push({ path: dest, indexStatus, worktreeStatus });
-            continue;
-        }
-        files.push({ path: pathPart, indexStatus, worktreeStatus });
-    }
-    return files;
-}
-/**
- * `diff --numstat -z`: `added<TAB>removed<TAB>path<NUL>`, or for a rename an empty path followed by
- * `old<NUL>new<NUL>`. Binary files report `-` and are left out.
- */
-function parseNumstat(raw) {
-    const counts = new Map();
-    const parts = raw.split('\0');
-    for (let index = 0; index < parts.length; index += 1) {
-        const match = /^(\d+|-)\t(\d+|-)\t(.*)$/s.exec(parts[index] ?? '');
-        if (!match)
-            continue;
-        let path = match[3];
-        if (path === '') {
-            path = parts[index + 2] ?? '';
-            index += 2;
-        }
-        if (match[1] === '-' || !path)
-            continue;
-        counts.set(path, { added: Number(match[1]), removed: Number(match[2]) });
-    }
-    return counts;
-}
-async function git(root, args, timeoutMs = 15000) {
-    const result = await gitAllowFail(root, args, timeoutMs);
-    if (result.code !== 0) {
-        throw new GitWorkspaceError('git_command_failed', result.stderr.trim() || `git_exit_${result.code}`);
-    }
-    return result.stdout;
-}
-async function gitAllowFail(root, args, timeoutMs = 15000) {
-    return runGitProcess(root, [...GIT_PREFIX, `--git-dir=${join(root, '.git')}`, `--work-tree=${root}`, ...args], timeoutMs);
-}
-function gitEnv() {
-    const env = { ...process.env };
-    delete env.GIT_DIR;
-    delete env.GIT_WORK_TREE;
-    delete env.GIT_COMMON_DIR;
-    delete env.GIT_INDEX_FILE;
-    delete env.GIT_OBJECT_DIRECTORY;
-    delete env.GIT_ALTERNATE_OBJECT_DIRECTORIES;
-    env.GIT_OPTIONAL_LOCKS = '0';
-    env.GIT_TERMINAL_PROMPT = '0';
-    return env;
-}
-function runGitProcess(cwd, args, timeoutMs) {
-    return new Promise((resolve, reject) => {
-        const child = spawn('git', args, { cwd, env: gitEnv(), windowsHide: true });
-        // Chunks are decoded together; a character split across two chunks would otherwise be corrupted.
-        const stdout = [];
-        const stderr = [];
-        const timer = setTimeout(() => {
-            child.kill('SIGKILL');
-            reject(new GitWorkspaceError('git_command_failed', 'timeout'));
-        }, timeoutMs);
-        child.stdout.on('data', (chunk) => {
-            stdout.push(Buffer.from(chunk));
-        });
-        child.stderr.on('data', (chunk) => {
-            stderr.push(Buffer.from(chunk));
-        });
-        child.on('error', (error) => {
-            clearTimeout(timer);
-            if (error.code === 'ENOENT') {
-                reject(new GitWorkspaceError('git_binary_missing', 'git'));
-                return;
-            }
-            reject(error);
-        });
-        child.on('close', (code) => {
-            clearTimeout(timer);
-            resolve({
-                stdout: Buffer.concat(stdout).toString('utf8'),
-                stderr: Buffer.concat(stderr).toString('utf8'),
-                code: code ?? 1,
-            });
-        });
-    });
-}