@playcraft/cli 0.1.29 → 0.1.30

package/dist/commands/login.js

@@ -1,7 +1,8 @@
 import http from 'http';
-import { exec } from 'child_process';
+import { execFile } from 'child_process';
 import crypto from 'crypto';
-import { saveGlobalConfig, loadGlobalConfig } from '../config.js';
+import { loadGlobalConfig, normalizeEnvironmentBaseUrl, readEnvironmentProfile, saveEnvironmentProfile } from '../config.js';
+import { activateAccount } from '../auth/account-activation.js';
 /** 默认云端 Portal（Next.js `/cli-auth` 与 API 同源时的基址；可通过 --url 或 PLAYCRAFT_URL 覆盖） */
 export const DEFAULT_PLAYCRAFT_CLOUD_BASE = 'https://playcraft.aix.intlgame.com';
 const CALLBACK_PORT = 3456;
@@ -18,10 +19,11 @@ function openBrowser(url) {
     const cmd = process.platform === 'darwin'
         ? 'open'
         : process.platform === 'win32'
-            ? 'start'
+            ? 'rundll32'
             : 'xdg-open';
     try {
-        exec(`${cmd} "${url}"`, (err, _stdout, stderr) => {
+        const arguments_ = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+        execFile(cmd, arguments_, (err, _stdout, stderr) => {
             if (err) {
                 console.error('Failed to open browser automatically:', err.message);
                 if (stderr?.trim()) {
@@ -44,21 +46,18 @@ function resolveLoginBaseUrl(options) {
         globalConfig.url ||
         globalConfig.backendUrl ||
         DEFAULT_PLAYCRAFT_CLOUD_BASE;
-    return raw.replace(/\/+$/, '');
+    const base = normalizeEnvironmentBaseUrl(raw);
+    if (!base)
+        throw new Error('Invalid environment address');
+    return base;
 }
 function normalizeLoginEnvironmentUrl(raw) {
-    try {
-        const url = new URL(raw);
-        url.hash = '';
-        url.search = '';
-        url.pathname = url.pathname.replace(/\/+$/, '');
-        return url.toString().replace(/\/+$/, '');
-    }
-    catch {
-        return undefined;
-    }
+    return normalizeEnvironmentBaseUrl(raw);
 }
 export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
+    const profile = readEnvironmentProfile(globalConfig, backendUrl);
+    if (profile)
+        return profile.token;
     const token = typeof globalConfig.token === 'string' ? globalConfig.token : undefined;
     const storedBackendUrl = typeof globalConfig.backendUrl === 'string'
         ? globalConfig.backendUrl
@@ -74,9 +73,17 @@ export function resolveExistingTokenForLoginTarget(globalConfig, backendUrl) {
         : undefined;
 }
 export function buildCliAuthUrl(options) {
-    const url = new URL('/cli-auth', options.backendUrl);
+    const base = normalizeEnvironmentBaseUrl(options.backendUrl);
+    if (!base)
+        throw new Error('Invalid environment address');
+    const url = new URL(`${base}/cli-auth`);
+    url.searchParams.set('callbackUrl', options.callbackUrl);
     url.searchParams.set('callback', options.callbackUrl);
     url.searchParams.set('state', options.state);
+    if (options.codeChallenge) {
+        url.searchParams.set('codeChallenge', options.codeChallenge);
+        url.searchParams.set('codeChallengeMethod', 'S256');
+    }
     return url.toString();
 }
 export async function renewExistingToken(options) {
@@ -87,12 +94,20 @@ export async function renewExistingToken(options) {
     try {
         const res = await fetchFn(`${options.backendUrl}/api/settings/personal-access-tokens/current/renew`, {
             method: 'PATCH',
+            redirect: 'error',
+            signal: AbortSignal.timeout(10_000),
             headers: {
                 Authorization: `Bearer ${options.token}`,
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({ expiresIn: '365d' }),
         });
+        if (res.ok && res.json && options.onRenewed) {
+            const result = await res.json();
+            if (typeof result.expiresAt === 'string' && Date.parse(result.expiresAt) > Date.now()) {
+                options.onRenewed(result.expiresAt);
+            }
+        }
         return res.ok;
     }
     catch {
@@ -100,29 +115,43 @@ export async function renewExistingToken(options) {
     }
 }
 export async function loginCommand(options) {
+    if (options.activate) {
+        await activateAccount(options, DEFAULT_PLAYCRAFT_CLOUD_BASE);
+        return;
+    }
     const backendUrl = resolveLoginBaseUrl(options);
     const callbackPort = options.callbackPort ?? CALLBACK_PORT;
     const globalConfig = loadGlobalConfig();
     const existingToken = resolveExistingTokenForLoginTarget(globalConfig, backendUrl);
     if (existingToken) {
-        const renewed = await renewExistingToken({ backendUrl, token: existingToken });
+        let expiresAt;
+        const renewed = await renewExistingToken({ backendUrl, token: existingToken,
+            onRenewed: (value) => { expiresAt = value; } });
         if (renewed) {
-            saveGlobalConfig({
-                token: existingToken,
-                url: backendUrl,
-                backendUrl,
-            });
+            const previous = readEnvironmentProfile(globalConfig, backendUrl);
+            saveEnvironmentProfile(backendUrl, { token: existingToken,
+                ...(previous?.identity ? { identity: previous.identity } : {}),
+                ...(expiresAt ? { expiresAt } : {}) });
             console.log('Existing CLI token renewed. Token saved to ~/.playcraft/config.json');
             return;
         }
     }
     const state = crypto.randomBytes(16).toString('hex');
+    const codeVerifier = crypto.randomBytes(32).toString('base64url');
+    const codeChallenge = crypto.createHash('sha256').update(codeVerifier).digest('base64url');
+    let callbackUrl = '';
+    let exchanging = false;
     return new Promise((resolve, reject) => {
         let timeout;
         const server = http.createServer((req, res) => {
-            res.setHeader('Access-Control-Allow-Origin', '*');
+            res.setHeader('Access-Control-Allow-Origin', new URL(backendUrl).origin);
             res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
             res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+            if (req.headers.origin && req.headers.origin !== new URL(backendUrl).origin) {
+                res.writeHead(403);
+                res.end();
+                return;
+            }
             if (req.method === 'OPTIONS') {
                 res.writeHead(204);
                 res.end();
@@ -130,8 +159,9 @@ export async function loginCommand(options) {
             }
             if (req.url === '/callback' && req.method === 'POST') {
                 let body = '';
-                req.on('data', (chunk) => (body += chunk));
-                req.on('end', () => {
+                req.on('data', (chunk) => { body += chunk; if (body.length > 16_384)
+                    req.destroy(); });
+                req.on('end', async () => {
                     try {
                         const data = JSON.parse(body);
                         if (data.state !== state) {
@@ -139,22 +169,36 @@ export async function loginCommand(options) {
                                 'Content-Type': 'text/html',
                                 Connection: 'close',
                             });
-                            res.end('<html><body><h1>Invalid state</h1></body></html>', () => {
-                                closeServer(() => {
-                                    reject(new Error('State mismatch - possible CSRF attack'));
-                                });
-                            });
+                            res.end('<html><body><h1>Invalid state</h1></body></html>');
                             return;
                         }
-                        const callbackToken = typeof data.token === 'string' ? data.token : undefined;
-                        if (!callbackToken) {
-                            throw new Error('Login callback did not include a token');
+                        if (exchanging) {
+                            res.writeHead(409);
+                            res.end();
+                            return;
+                        }
+                        if (typeof data.code !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(data.code)) {
+                            throw new Error('Login callback did not include an authorization code');
                         }
-                        saveGlobalConfig({
-                            token: callbackToken,
-                            url: backendUrl,
-                            backendUrl,
+                        exchanging = true;
+                        const base = normalizeEnvironmentBaseUrl(backendUrl);
+                        if (!base)
+                            throw new Error('Invalid environment address');
+                        const exchange = await fetch(`${base}/api/cloud-environments/exchange`, {
+                            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ code: data.code, state, callbackUrl, codeVerifier }),
                         });
+                        if (!exchange.ok)
+                            throw new Error('Authorization code exchange failed');
+                        const credential = await exchange.json();
+                        if (!credential.token || !/^playcraft_pat_[A-Za-z0-9_-]{32}$/.test(credential.token)
+                            || !credential.identity?.userId || !Array.isArray(credential.identity.identities)
+                            || !credential.expiresAt || Date.parse(credential.expiresAt) <= Date.now()) {
+                            throw new Error('Invalid environment credential response');
+                        }
+                        saveEnvironmentProfile(base, { token: credential.token,
+                            identity: credential.identity, expiresAt: credential.expiresAt });
                         res.writeHead(200, {
                             'Content-Type': 'text/html',
                             Connection: 'close',
@@ -174,9 +218,6 @@ export async function loginCommand(options) {
                     catch (err) {
                         const cause = err instanceof Error ? err : new Error(String(err));
                         console.error('[playcraft login] Callback handling failed:', cause.message);
-                        if (cause.stack) {
-                            console.error(cause.stack);
-                        }
                         const userFacing = cause instanceof SyntaxError
                             ? 'Invalid JSON in login callback.'
                             : `Login callback failed: ${cause.message}`;
@@ -221,14 +262,15 @@ export async function loginCommand(options) {
             });
         });
         try {
-            server.listen(callbackPort, () => {
+            server.listen(callbackPort, '127.0.0.1', () => {
                 const address = server.address();
                 const listeningPort = typeof address === 'object' && address ? address.port : callbackPort;
-                const callbackUrl = `http://localhost:${listeningPort}/callback`;
+                callbackUrl = `http://127.0.0.1:${listeningPort}/callback`;
                 const authUrl = buildCliAuthUrl({
                     backendUrl,
                     callbackUrl,
                     state,
+                    codeChallenge,
                 });
                 console.log('Opening browser for login...');
                 console.log(`If the browser does not open, visit this URL manually:\n  ${authUrl}\n`);

package/dist/commands/platform-skills.generated.js

@@ -0,0 +1,19 @@
+// 此文件由 scripts/generate-platform-skills.mjs 生成，请勿手改。
+// 重新生成：pnpm --filter @playcraft/cli generate:platform-skills
+/** `@playcraft/skills/playcraft-skills/` 下的 Platform Skill 目录名。 */
+export const PLATFORM_SKILL_DIRS = [
+    'playcraft-3d-flip-sprite',
+    'playcraft-asset-management',
+    'playcraft-build',
+    'playcraft-code-editor',
+    'playcraft-create-remix',
+    'playcraft-deploy',
+    'playcraft-iteration-methodology',
+    'playcraft-platform-intro',
+    'playcraft-prefab',
+    'playcraft-project-management',
+    'playcraft-remix-workflow',
+    'playcraft-save',
+    'playcraft-template-upgrade-merge',
+    'sound-effects',
+];

package/dist/commands/playable.js

@@ -0,0 +1,53 @@
+import { recordPlayable } from '../recording/recorder.js';
+import { RecordingError, recordingMessage as t } from '../recording/messages.js';
+import { dirname, join } from 'node:path';
+import { captureGeneratedArtifact } from '../workspace-runtime/workspaces/artifact-receipts.js';
+export async function runPlayableRecord(options) {
+    const interrupted = new AbortController();
+    const deadline = new AbortController();
+    const onInterrupt = () => interrupted.abort(new DOMException('Interrupted', 'AbortError'));
+    process.once('SIGINT', onInterrupt);
+    let timer;
+    try {
+        const seconds = options.timeout === undefined ? 1200 : Number(options.timeout);
+        if (!Number.isFinite(seconds) || seconds <= 0 || seconds > 1800)
+            throw new RecordingError('invalidArguments', 64);
+        timer = setTimeout(() => deadline.abort(new DOMException('Timed out', 'TimeoutError')), seconds * 1000);
+        const result = await recordPlayable(options, AbortSignal.any([interrupted.signal, deadline.signal]));
+        const metadata = result.envelope.result;
+        const output = result.envelope.artifacts;
+        if (result.envelope.ok && metadata && output?.candidate) {
+            const artifacts = [metadata.candidate, ...metadata.controls];
+            const paths = [output.candidate, ...(output.controls ?? [])];
+            for (let index = 0; index < artifacts.length; index++) {
+                const artifact = artifacts[index], path = paths[index];
+                if (!path)
+                    continue;
+                const thumbnail = artifact.screenshots?.[0]?.path;
+                await captureGeneratedArtifact(path, 'playable record', {
+                    width: artifact.video.source.width, height: artifact.video.source.height,
+                    duration: artifact.video.source.durationMs / 1000,
+                    ...(thumbnail ? { thumbnailPath: join(dirname(output.metadata), thumbnail) } : {}),
+                });
+            }
+        }
+        process.stdout.write(`${JSON.stringify(result.envelope)}\n`);
+        process.exitCode = result.exitCode;
+    }
+    catch (error) {
+        const code = error instanceof RecordingError ? error.code : 'recordingFailed';
+        process.stdout.write(`${JSON.stringify({ schemaVersion: 'playcraft.video-cli.v1', command: 'playable record', state: 'failed', ok: false, error: { code, message: t(code) } })}\n`);
+        process.exitCode = error instanceof RecordingError ? error.exitCode : 4;
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        process.removeListener('SIGINT', onInterrupt);
+    }
+}
+export function registerPlayableCommands(program) {
+    program.command('playable').description(t('topic')).command('record').description(t('record'))
+        .option('--url <url>', t('url')).option('--scenario <file>', t('scenario')).option('--out <directory>', t('out'))
+        .option('--browser-path <path>', t('browser')).option('--timeout <seconds>', t('timeout'))
+        .action(runPlayableRecord);
+}

package/dist/commands/skills.js

@@ -18,6 +18,7 @@
  *   3. <cwd>/node_modules/@playcraft/skills/playcraft-skills（兼容旧路径 skills）
  *   4. <CLI 自身>/../../skills/playcraft-skills（monorepo 开发时，兼容旧路径 skills）
  */
+import { registerProjectSkillsCommands } from '../project-skills/commands.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { getFusionHintsForGameplayAtoms, } from '../atom-tree/fusion-hints.js';
@@ -1430,6 +1431,7 @@ export function registerSkillsCommands(program) {
     const skills = program
         .command('skills')
         .description('开发时 Skill 发现与脚手架工具（按 engine/intent 推荐 skill 集合，或将 ref 文件复制到项目）');
+    registerProjectSkillsCommands(skills);
     // 公共选项：skills 目录
     const addSkillsDirOption = (cmd) => cmd.option('--skills-dir <path>', '指定 skills 目录路径（默认自动发现）');
     // ── list ──────────────────────────────────────────────────────────────────

package/dist/commands/tools-3d.js

@@ -2,6 +2,7 @@ import { writeFileSync, mkdirSync, readFileSync } from 'fs';
 import { dirname } from 'path';
 import { AgentApiClient } from '../utils/agent-api-client.js';
 import { mimeTypeForImagePath, handleError } from './tools-utils.js';
+import { captureGeneratedArtifact } from '../workspace-runtime/workspaces/artifact-receipts.js';
 const AVATAR_TEMPLATES = [
     'basketball', 'badminton', 'pingpong', 'gymnastics', 'pilidance',
     'tennis', 'athletics', 'footballboykicking1', 'footballboykicking2',
@@ -148,6 +149,9 @@ export function register3DCommands(tools) {
                 writeFileSync(opts.savePreview, previewBuf);
                 console.log(`  Preview saved: ${opts.savePreview}`);
             }
+            await captureGeneratedArtifact(opts.output, 'generate-3d', {
+                ...(opts.savePreview && result.previewImageBase64 ? { thumbnailPath: opts.savePreview } : {}),
+            });
             console.log(`\nNext steps:`);
             console.log(`  Inspect:        playcraft 3d info ${opts.output}`);
             console.log(`  Apply texture:  playcraft tools generate-texture --model-url <url> --reference-image <img> --output out.glb`);
@@ -209,6 +213,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'generate-texture');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nTextured model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
             if (result.resultUrl)
@@ -253,6 +258,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'retopology');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nRetopologized model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -289,6 +295,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'uv-unwrap');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nUV-unwrapped model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -324,6 +331,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'convert-3d');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nConverted model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
             console.log(`  Format: ${result.format.toUpperCase()}`);
@@ -359,6 +367,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'generate-3d-parts');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\n3D parts model saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -402,6 +411,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'generate-motion');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\nMotion FBX saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }
@@ -463,6 +473,7 @@ export function register3DCommands(tools) {
             const outDir = dirname(opts.output);
             mkdirSync(outDir, { recursive: true });
             writeFileSync(opts.output, buf);
+            await captureGeneratedArtifact(opts.output, 'generate-avatar');
             const sizeMB = (buf.length / 1024 / 1024).toFixed(2);
             console.log(`\n3D avatar saved: ${opts.output} (${sizeMB}MB, ${elapsed}s)`);
         }

package/dist/commands/tools-batch.js

@@ -0,0 +1,87 @@
+import { readFile } from 'node:fs/promises';
+import { batchCreateSchema, batchPromptCreateSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { AgentApiClient } from '../utils/agent-api-client.js';
+import { handleError } from './tools-utils.js';
+const messages = {
+    en: {
+        create: 'Create and automatically run independent Remix variants from one prompt',
+        input: 'Path to the batch draft JSON (JavaScript Object Notation, 数据交换格式) file',
+        status: 'Read a batch and its generation status',
+        id: 'Batch identifier',
+        created: 'Batch created',
+        prompt: 'The complete batch generation request', workspace: 'Source workspace identifier',
+        directory: 'Source engineering directory; defaults to basic', request: 'Stable batch creation identity for retries',
+        team: 'Team identifier for a standalone workspace', invalidMode: 'Provide either --prompt with --workspace-id or --input, exclusively.',
+        requestRequired: 'Prompt creation requires a stable --client-request-id; reuse it when retrying the same request.',
+        help: '\nUse --prompt with --workspace-id and a stable --client-request-id. The platform plans and generates independent Remix directories while preserving the source. An omitted count defaults to 3; maximum 10. --input also accepts existing structured drafts.\n',
+        confirmation: 'Generation is queued. Read the batch status to track its results.',
+        review: 'This existing draft requires baseline approval in the browser.',
+    },
+    zh: {
+        create: '用一个 prompt 创建并自动生成独立 Remix 变体',
+        input: '批次草案 JSON (JavaScript Object Notation, 数据交换格式) 文件路径',
+        status: '查询批次及生成状态',
+        id: '批次标识',
+        created: '批次已创建',
+        prompt: '完整的批量生成需求', workspace: '来源 workspace 标识',
+        directory: '来源工程目录，默认 basic', request: '用于重试的稳定批次创建标识',
+        team: '独立工作区所属团队标识', invalidMode: '请选择 --prompt 配合 --workspace-id，或 --input，两种方式不能同时使用。',
+        requestRequired: '使用 prompt 创建时必须提供稳定的 --client-request-id，重试同一请求时复用该标识。',
+        help: '\n使用 --prompt、--workspace-id 和稳定的 --client-request-id。平台自动规划，在副本中生成独立 Remix，保持来源不变。未指定数量默认 3 个，最多 10 个。--input 也兼容现有结构化草案。\n',
+        confirmation: '生成已排队，可查询批次状态追踪各项成果。',
+        review: '此历史草案需要在浏览器确认基准。',
+    },
+};
+const language = () => /^zh/i.test(process.env.PLAYCRAFT_LANG ?? process.env.LANG ?? '') ? messages.zh : messages.en;
+export async function createBatchDraft(path, client = new AgentApiClient()) {
+    const draft = batchCreateSchema.parse(JSON.parse(await readFile(path, 'utf8')));
+    return client.post('/create-batch', draft);
+}
+export async function createPromptBatch(input, client = new AgentApiClient()) {
+    return client.post('/create-batch', batchPromptCreateSchema.parse(input));
+}
+export function registerBatchCommands(tools) {
+    const t = language();
+    tools.command('create-batch')
+        .description(t.create)
+        .option('--input <path>', t.input)
+        .option('--prompt <text>', t.prompt)
+        .option('--workspace-id <id>', t.workspace)
+        .option('--source-directory <name>', t.directory, 'basic')
+        .option('--client-request-id <id>', t.request)
+        .option('--team-id <id>', t.team)
+        .option('--json', 'JSON (JavaScript Object Notation, 数据交换格式)')
+        .addHelpText('after', t.help)
+        .action(async (opts) => {
+        try {
+            if (Boolean(opts.input) === Boolean(opts.prompt))
+                throw new Error(t.invalidMode);
+            if (opts.prompt && !opts.workspaceId)
+                throw new Error(t.invalidMode);
+            if (opts.prompt && !opts.clientRequestId)
+                throw new Error(t.requestRequired);
+            const result = opts.input ? await createBatchDraft(opts.input) : await createPromptBatch({
+                clientRequestId: opts.clientRequestId, prompt: opts.prompt,
+                sourceWorkspaceId: opts.workspaceId, sourceDirectoryName: opts.sourceDirectory,
+                ...(opts.teamId ? { teamId: opts.teamId } : {}),
+            });
+            console.log(opts.json ? JSON.stringify(result, null, 2) : `${t.created}: ${result.batchId}\n${result.manifest.autoStart ? t.confirmation : t.review}`);
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    tools.command('get-batch')
+        .description(t.status)
+        .requiredOption('--batch-id <id>', t.id)
+        .action(async (opts) => {
+        try {
+            const client = new AgentApiClient();
+            const result = await client.get('/get-batch', { batchId: opts.batchId });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+}