@playcraft/cli 0.1.33 → 0.1.35-prod

package/dist/workspace-runtime/codex/model-broker.js

@@ -1,263 +0,0 @@
-import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
-import { createServer } from 'node:http';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
-import { basename, dirname } from 'node:path';
-import { z } from 'zod';
-import { workspaceContextFromRoot } from '../workspaces/registry.js';
-import { PLATFORM_ROUTES, modelResponsesPath, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
-const credentialSchema = z.object({
-    token: z.string().min(1), expiresAt: z.string().datetime(),
-    configId: z.string().uuid(), model: z.string().min(1).max(128),
-    supportsReasoning: z.boolean().optional(),
-    claims: z.object({
-        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
-        generation: z.number().int(), runtimeEpoch: z.number().int(),
-    }),
-});
-/** Keeps renewable execution credentials in control memory, outside Codex and project files. */
-export class WorkspaceModelBroker {
-    state;
-    server;
-    baseUrl = '';
-    entries = new Map();
-    routes = new Map();
-    pending = new Map();
-    requests = new Set();
-    sessionRequests = new Map();
-    constructor(state) {
-        this.state = state;
-    }
-    async start() {
-        if (this.server)
-            return;
-        const server = createServer({ maxHeaderSize: 8192 }, (request, response) => {
-            void this.forward(request, response);
-        });
-        await new Promise((resolve, reject) => {
-            server.once('error', reject);
-            server.listen(0, '127.0.0.1', resolve);
-        });
-        this.server = server;
-        const address = server.address();
-        if (!address || typeof address === 'string')
-            throw new Error('model_broker_unavailable');
-        this.baseUrl = `http://127.0.0.1:${address.port}`;
-    }
-    async threadConfig(cwd, modelConfigId, sessionId, reasoningEffort) {
-        const { activate, ...settings } = await this.prepareThreadConfig(cwd, modelConfigId, sessionId, reasoningEffort);
-        activate();
-        return settings;
-    }
-    async prepareThreadConfig(cwd, modelConfigId, sessionId, reasoningEffort, clientRequestId) {
-        if (!this.server)
-            throw new Error('workspace_not_registered');
-        const { workspaceId } = await workspaceContextFromRoot(this.state, cwd);
-        if (modelConfigId !== undefined && !z.string().uuid().safeParse(modelConfigId).success)
-            throw new Error('model_config_denied');
-        const routeKey = sessionId ? `${workspaceId}/${createHash('sha256').update(sessionId).digest('hex').slice(0, 32)}` : workspaceId;
-        let route = this.routes.get(routeKey);
-        const selected = modelConfigId ?? (route?.epoch === this.state.runtimeEpoch ? route.selected?.entry.modelConfigId : undefined);
-        const cacheKey = `${workspaceId}:${selected ?? 'default'}:${reasoningEffort ?? 'default'}`;
-        let entry = this.entries.get(cacheKey) ?? [...this.entries.values()].find(item => item.workspaceId === workspaceId && item.epoch === this.state.runtimeEpoch && item.modelConfigId === selected
-            && item.reasoningEffort === reasoningEffort);
-        if (!entry || entry.epoch !== this.state.runtimeEpoch) {
-            entry = { workspaceId, epoch: this.state.runtimeEpoch, cacheKey, modelConfigId: selected, reasoningEffort };
-            this.entries.set(cacheKey, entry);
-        }
-        // Resolve current model metadata and permission at every native turn boundary.
-        const credential = await this.credential(entry, true);
-        if (!route || route.epoch !== this.state.runtimeEpoch) {
-            route = { workspaceId, epoch: this.state.runtimeEpoch, capability: randomBytes(32).toString('base64url') };
-            this.routes.set(routeKey, route);
-        }
-        // Each session pins its prepared model; shared credential renewal cannot change an active turn.
-        return {
-            activate: () => {
-                if (!this.valid(entry) || this.routes.get(routeKey) !== route)
-                    throw new Error('model_access_denied');
-                route.selected = { entry, model: credential.model,
-                    ...(sessionId && clientRequestId ? { feedback: { sessionId, clientRequestId } } : {}) };
-            },
-            model: credential.model,
-            modelConfigId: credential.configId,
-            modelProvider: 'playcraft_workspace',
-            config: {
-                'model_providers.playcraft_workspace': {
-                    name: 'PlayCraft Workspace', base_url: `${this.baseUrl}/${routeKey}`,
-                    wire_api: 'responses', requires_openai_auth: false,
-                    http_headers: { Authorization: `Bearer ${route.capability}` },
-                },
-            },
-        };
-    }
-    valid(entry) {
-        return Boolean(this.server && !this.state.journal.destroyed()
-            && this.state.runtimeEpoch === entry.epoch && this.state.journal.getWorkspace(entry.workspaceId)
-            && this.entries.get(entry.cacheKey) === entry);
-    }
-    async credential(entry, refresh = false) {
-        if (!this.valid(entry))
-            throw new Error('model_access_denied');
-        if (!refresh && entry.credential && Date.parse(entry.credential.expiresAt) > Date.now() + 60_000)
-            return entry.credential;
-        let pending = this.pending.get(entry);
-        if (!pending) {
-            pending = this.renew(entry).finally(() => this.pending.delete(entry));
-            this.pending.set(entry, pending);
-        }
-        return pending;
-    }
-    async renew(entry) {
-        const config = this.state.config;
-        const endpoint = platformEndpoint(config.publicBaseUrl, PLATFORM_ROUTES.modelCredentials);
-        const response = await fetch(endpoint, {
-            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
-            headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
-            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
-                runtimeEpoch: entry.epoch, workspaceId: entry.workspaceId,
-                ...(entry.modelConfigId ? { modelConfigId: entry.modelConfigId } : {}),
-                ...(entry.reasoningEffort ? { reasoningEffort: entry.reasoningEffort } : {}) }),
-        });
-        if (!response.ok) {
-            const error = await response.json().catch(() => ({}));
-            throw new Error(['model_config_required', 'model_config_denied', 'reasoning_effort_denied', 'reasoning_effort_unsupported'].includes(error.reason ?? '') ? error.reason : 'model_credential_unavailable');
-        }
-        const credential = credentialSchema.parse(await response.json());
-        const claims = credential.claims;
-        if (!this.valid(entry) || claims.workspaceId !== entry.workspaceId || claims.runtimeId !== config.runtimeId
-            || claims.userId !== config.userId || claims.environment !== config.environment
-            || claims.generation !== config.generation || claims.runtimeEpoch !== entry.epoch
-            || (entry.modelConfigId !== undefined && credential.configId !== entry.modelConfigId)
-            || Date.parse(credential.expiresAt) <= Date.now() + 1000)
-            throw new Error('model_credential_scope_mismatch');
-        entry.modelConfigId = credential.configId;
-        entry.credential = credential;
-        return credential;
-    }
-    async forward(request, response) {
-        const abort = new AbortController();
-        this.requests.add(abort);
-        let activeRoute;
-        const cancel = () => abort.abort();
-        response.once('close', cancel);
-        try {
-            const match = /^\/([0-9a-f-]{36}(?:\/[0-9a-f]{32})?)\/responses$/.exec(request.url ?? '');
-            const route = match ? this.routes.get(match[1]) : undefined;
-            const selected = route?.selected;
-            const entry = selected?.entry;
-            const presented = Buffer.from(request.headers.authorization ?? '');
-            const expected = Buffer.from(route ? `Bearer ${route.capability}` : '');
-            if (request.method !== 'POST' || !entry || !expected.length || presented.length !== expected.length
-                || !timingSafeEqual(presented, expected) || !this.valid(entry)) {
-                response.writeHead(403);
-                response.end();
-                return;
-            }
-            activeRoute = route;
-            const active = this.sessionRequests.get(route) ?? new Set();
-            active.add(abort);
-            this.sessionRequests.set(route, active);
-            const credential = await this.credential(entry);
-            const chunks = [];
-            let size = 0;
-            for await (const chunk of request) {
-                size += chunk.length;
-                if (size > 16 * 1024 * 1024) {
-                    response.writeHead(413);
-                    response.end();
-                    return;
-                }
-                chunks.push(Buffer.from(chunk));
-            }
-            if (!this.valid(entry))
-                throw new Error('model_access_denied');
-            const body = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-            if (!body || typeof body !== 'object' || Array.isArray(body)) {
-                response.writeHead(400);
-                response.end();
-                return;
-            }
-            // The browser selects a configuration, never an arbitrary billable upstream model.
-            body.model = selected.model;
-            if (credential.supportsReasoning === false) {
-                const reasoning = body.reasoning;
-                if (reasoning && typeof reasoning === 'object' && !Array.isArray(reasoning)) {
-                    delete reasoning.effort;
-                }
-            }
-            else if (entry.reasoningEffort) {
-                const reasoning = body.reasoning;
-                const modelName = selected.model.split('/').pop() ?? selected.model;
-                const effort = entry.reasoningEffort === 'max' && /^o\d|gpt-[5-9]/i.test(modelName)
-                    ? 'xhigh' : entry.reasoningEffort;
-                body.reasoning = {
-                    ...(reasoning && typeof reasoning === 'object' && !Array.isArray(reasoning) ? reasoning : {}),
-                    effort,
-                };
-            }
-            const expires = setTimeout(cancel, Math.max(0, Date.parse(credential.expiresAt) - Date.now()));
-            try {
-                const upstream = await fetch(platformEndpoint(this.state.config.publicBaseUrl, modelResponsesPath(credential.configId)), {
-                    method: 'POST', redirect: 'error', signal: abort.signal,
-                    headers: { authorization: `Bearer ${credential.token}`, 'content-type': 'application/json',
-                        ...(selected?.feedback ? {
-                            'x-playcraft-cloud-session-id': selected.feedback.sessionId,
-                            'x-playcraft-client-request-id': selected.feedback.clientRequestId,
-                        } : {}) },
-                    body: JSON.stringify(body),
-                });
-                if (upstream.status === 401 || upstream.status === 403)
-                    entry.credential = undefined;
-                response.writeHead(upstream.status, {
-                    'content-type': upstream.headers.get('content-type') ?? 'application/json', 'cache-control': 'no-store',
-                });
-                if (upstream.body)
-                    await pipeline(Readable.fromWeb(upstream.body), response);
-                else
-                    response.end();
-            }
-            finally {
-                clearTimeout(expires);
-            }
-        }
-        catch {
-            if (!response.headersSent) {
-                response.writeHead(503, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-                response.end(JSON.stringify({ error: { message: 'model_credential_unavailable', type: 'server_error' } }));
-            }
-            else
-                response.destroy();
-        }
-        finally {
-            response.off('close', cancel);
-            this.requests.delete(abort);
-            if (activeRoute) {
-                const active = this.sessionRequests.get(activeRoute);
-                active?.delete(abort);
-                if (!active?.size)
-                    this.sessionRequests.delete(activeRoute);
-            }
-        }
-    }
-    cancelSession(cwd, sessionId) {
-        const routeKey = `${/^(basic|remix-)/.test(basename(cwd)) ? basename(dirname(cwd)) : basename(cwd)}/${createHash('sha256').update(sessionId).digest('hex').slice(0, 32)}`;
-        const route = this.routes.get(routeKey);
-        if (route)
-            for (const request of this.sessionRequests.get(route) ?? [])
-                request.abort();
-    }
-    async close() {
-        const server = this.server;
-        this.server = undefined;
-        this.entries.clear();
-        this.routes.clear();
-        this.sessionRequests.clear();
-        for (const request of this.requests)
-            request.abort();
-        if (server) {
-            server.closeAllConnections();
-            await new Promise(resolve => server.close(() => resolve()));
-        }
-    }
-}

package/dist/workspace-runtime/codex/native-adapter.js

@@ -1,9 +0,0 @@
-/** Failure before a native request was sent; safe to report as failed instead of uncertain. */
-export class NativePreparationError extends Error {
-}
-export function nativeEvent(type, payload) {
-    return { type, payload, occurredAt: new Date().toISOString() };
-}
-export function collectedEvent(kind, method, params) {
-    return { kind, method, params, occurredAt: new Date().toISOString() };
-}

package/dist/workspace-runtime/codex/permissions.js

@@ -1,70 +0,0 @@
-export const NATIVE_APPROVALS_REVIEWER = 'user';
-/** Fixed production/coordinator boundaries may only become narrower. */
-export function executionPolicy(cwd, mode, fixed) {
-    const directory = fixed?.cwd ?? cwd;
-    if (mode === 'read-only')
-        return { cwd: directory, approvalPolicy: 'never', sandboxPolicy: { type: 'readOnly', networkAccess: false } };
-    if (mode === 'auto')
-        return fixed ?? { cwd, approvalPolicy: 'never', sandboxPolicy: { type: 'dangerFullAccess' } };
-    if (fixed?.sandboxPolicy.type === 'readOnly')
-        return { ...fixed, sandboxPolicy: { type: 'readOnly', networkAccess: false } };
-    return { cwd: directory, approvalPolicy: fixed ? 'never' : 'on-request', sandboxPolicy: {
-            type: 'workspaceWrite', writableRoots: fixed?.sandboxPolicy.type === 'workspaceWrite' ? fixed.sandboxPolicy.writableRoots : [directory],
-            networkAccess: false, excludeTmpdirEnvVar: true, excludeSlashTmp: true,
-        } };
-}
-export function threadExecutionParams(execution) {
-    const sandbox = execution.sandboxPolicy.type === 'readOnly' ? 'read-only'
-        : execution.sandboxPolicy.type === 'workspaceWrite' ? 'workspace-write' : 'danger-full-access';
-    const policy = execution.sandboxPolicy;
-    return { cwd: execution.cwd, approvalPolicy: execution.approvalPolicy, approvalsReviewer: NATIVE_APPROVALS_REVIEWER, sandbox,
-        config: policy.type === 'workspaceWrite' ? {
-            'sandbox_workspace_write.writable_roots': policy.writableRoots,
-            'sandbox_workspace_write.network_access': policy.networkAccess,
-            'sandbox_workspace_write.exclude_tmpdir_env_var': policy.excludeTmpdirEnvVar,
-            'sandbox_workspace_write.exclude_slash_tmp': policy.excludeSlashTmp,
-        } : {} };
-}
-export const APPROVAL_METHODS = new Set([
-    'item/commandExecution/requestApproval', 'item/fileChange/requestApproval',
-    'item/permissions/requestApproval', 'item/tool/requestUserInput',
-]);
-function record(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
-/** Returns only the native request's permissions; a browser cannot supply new paths or network access. */
-export function nativeApprovalResponse(method, request, response, canEscalate) {
-    if (method === 'item/commandExecution/requestApproval' || method === 'item/fileChange/requestApproval') {
-        if (response.kind !== 'decision' || (response.accepted && !canEscalate))
-            return undefined;
-        const decision = response.accepted ? 'accept' : Array.isArray(request.availableDecisions)
-            && !request.availableDecisions.includes('decline') && request.availableDecisions.includes('cancel') ? 'cancel' : 'decline';
-        if (Array.isArray(request.availableDecisions) && !request.availableDecisions.includes(decision))
-            return undefined;
-        return { decision };
-    }
-    if (method === 'item/permissions/requestApproval') {
-        if (response.kind !== 'permissions' || (response.accepted && !canEscalate))
-            return undefined;
-        const requested = record(request.permissions);
-        if (!request.permissions || Object.keys(requested).some(key => !['network', 'fileSystem'].includes(key)))
-            return undefined;
-        return { permissions: response.accepted ? Object.fromEntries(Object.entries(requested).filter(([, value]) => value != null)) : {}, scope: response.scope };
-    }
-    if (method !== 'item/tool/requestUserInput' || response.kind !== 'user-input' || !Array.isArray(request.questions) || !request.questions.length)
-        return undefined;
-    const questions = request.questions.map(record);
-    const ids = questions.map(question => question.id);
-    if (ids.some(id => typeof id !== 'string' || !id) || new Set(ids).size !== ids.length
-        || Object.keys(response.answers).length !== ids.length || Object.keys(response.answers).some(id => !ids.includes(id)))
-        return undefined;
-    for (const question of questions) {
-        const answers = response.answers[question.id]?.answers;
-        if (!answers || answers.length !== 1 || !answers[0]?.trim())
-            return undefined;
-        const options = Array.isArray(question.options) ? question.options.map(record) : [];
-        if (options.length && question.isOther !== true && !options.some(option => option.label === answers[0]))
-            return undefined;
-    }
-    return { answers: response.answers };
-}

package/dist/workspace-runtime/codex/work-mode.js

@@ -1,15 +0,0 @@
-export function workModeExecution(execution, workMode) {
-    return workMode === 'plan' ? {
-        ...execution, approvalPolicy: 'never', sandboxPolicy: { type: 'readOnly', networkAccess: false },
-    } : execution;
-}
-export function nativeCollaborationMode(model, effort, workMode) {
-    return {
-        mode: workMode === 'plan' ? 'plan' : 'default',
-        settings: {
-            model,
-            reasoning_effort: effort === 'max' ? 'xhigh' : effort ?? null,
-            developer_instructions: null,
-        },
-    };
-}

package/dist/workspace-runtime/main.js

@@ -1,10 +0,0 @@
-import { runWorkspaceRuntimeServe } from '../commands/workspace-runtime.js';
-const flag = process.argv.indexOf('--config');
-const configPath = flag >= 0 ? process.argv[flag + 1] : undefined;
-if (!configPath) {
-    console.error('workspace-runtime: missing --config');
-    process.exitCode = 2;
-}
-else {
-    await runWorkspaceRuntimeServe(configPath);
-}