@playcraft/cli 0.1.33 → 0.1.35-prod

package/dist/workspace-runtime/workspaces/disk-snapshot.js

@@ -1,31 +0,0 @@
-import { createHash } from 'node:crypto';
-import { constants } from 'node:fs';
-import { open } from 'node:fs/promises';
-import { WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES } from '@playcraft/common/cloud-workspace/runtime';
-export async function sampleDiskFile(path) {
-    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-    try {
-        const before = await handle.stat();
-        if (!before.isFile() || before.size > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
-            throw new Error('snapshot_body_missing');
-        const digest = createHash('sha256');
-        const chunk = Buffer.allocUnsafe(64 * 1024);
-        let position = 0;
-        for (;;) {
-            const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
-            if (!bytesRead)
-                break;
-            digest.update(chunk.subarray(0, bytesRead));
-            position += bytesRead;
-            if (position > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
-                throw new Error('snapshot_body_missing');
-        }
-        const after = await handle.stat();
-        if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || position !== before.size)
-            throw new Error('snapshot_body_missing');
-        return { hash: digest.digest('hex'), size: position, mode: before.mode & 0o777 };
-    }
-    finally {
-        await handle.close();
-    }
-}

package/dist/workspace-runtime/workspaces/empty-template.js

@@ -1,40 +0,0 @@
-import { cp, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { resolveCliPackageRoot } from '../../scaffold/compose.js';
-import { importBuiltinProjectSkills, selectPlatformSkillSnapshot } from '../../project-skills/builtin-import.js';
-import { createHash } from 'node:crypto';
-import { canonicalProjectSkillsJson } from '@playcraft/common/project-skills';
-import { syncLocalProjectSkills } from '../../project-skills/local-store.js';
-export const EMPTY_WORKSPACE_REPOSITORY_SKILLS = [
-    'playcraft-skill-recommender',
-    'playcraft-image-generation',
-    'playcraft-audio-generation',
-    'playcraft-image-processing',
-    'playcraft-build-optimizer',
-];
-export const EMPTY_WORKSPACE_PLATFORM_SKILLS = ['playcraft-video-understanding', 'playcraft-replica-validation'];
-export const EMPTY_WORKSPACE_DEFAULT_SKILLS = [...EMPTY_WORKSPACE_REPOSITORY_SKILLS, ...EMPTY_WORKSPACE_PLATFORM_SKILLS];
-/** Only called in a new, unpublished staging directory; existing workspaces are never scaffolded. */
-export async function scaffoldEmptyWorkspace(root, skillCache, access) {
-    const selected = await selectPlatformSkillSnapshot([...EMPTY_WORKSPACE_PLATFORM_SKILLS], access);
-    const cliRoot = resolveCliPackageRoot();
-    const template = join(cliRoot, 'project-templates', 'empty');
-    for (const [source, target] of [
-        ['gitignore', '.gitignore'],
-        ['AGENTS.md', 'AGENTS.md'],
-    ]) {
-        await cp(join(template, source), join(root, target), { force: false, errorOnExist: true });
-    }
-    const skills = join(root, '.agents', 'skills');
-    await mkdir(skills, { recursive: true });
-    for (const name of EMPTY_WORKSPACE_REPOSITORY_SKILLS) {
-        await cp(join(cliRoot, 'project-template', '.claude', 'skills', name), join(skills, name), {
-            recursive: true,
-            force: false,
-            errorOnExist: true,
-        });
-    }
-    const snapshot = await syncLocalProjectSkills(root, skillCache);
-    await importBuiltinProjectSkills(root, { names: [...EMPTY_WORKSPACE_PLATFORM_SKILLS], expectedDeclarationHash: snapshot.lock.declarationHash,
-        expectedLockHash: createHash('sha256').update(canonicalProjectSkillsJson(snapshot.lock)).digest('hex') }, skillCache, access, selected, true);
-}

package/dist/workspace-runtime/workspaces/files-search.js

@@ -1,116 +0,0 @@
-import { createHash } from 'node:crypto';
-import { lstat, opendir, realpath } from 'node:fs/promises';
-import { join, relative, sep } from 'node:path';
-import { workspaceFileSearchQuerySchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
-const SKIP_DIRECTORIES = new Set(['.git', 'node_modules', '.playcraft', '.next', 'dist', 'build', 'coverage', '.turbo']);
-const SCAN_PAGE_ENTRIES = 1000;
-export class InvalidWorkspaceSearchError extends Error {
-    code;
-    constructor(code = 'invalid_workspace_search') {
-        super(code);
-        this.code = code;
-        this.name = 'InvalidWorkspaceSearchError';
-    }
-}
-/** Enumerates names only. The cursor is scoped to the resolved checkout and query, never to a caller supplied path. */
-export async function searchWorkspaceFiles(root, query, options = {}) {
-    const parsed = workspaceFileSearchQuerySchema.safeParse(query);
-    if (!parsed.success)
-        throw new InvalidWorkspaceSearchError();
-    options.signal?.throwIfAborted();
-    const rootReal = await realpath(root);
-    const needle = parsed.data.query.toLocaleLowerCase();
-    const scope = createHash('sha256').update(rootReal).update('\0').update(needle).digest('hex');
-    const start = decodeCursor(parsed.data.cursor, scope);
-    const files = [];
-    let offset = 0;
-    for await (const path of walk(rootReal, rootReal, options.signal)) {
-        options.signal?.throwIfAborted();
-        offset += 1;
-        if (offset <= start)
-            continue;
-        if (path && path.toLocaleLowerCase().includes(needle)) {
-            const target = join(rootReal, ...path.split('/'));
-            const info = await lstat(target).catch(ignoreUnavailable);
-            const targetReal = info?.isFile() && !info.isSymbolicLink() ? await realpath(target).catch(ignoreUnavailable) : undefined;
-            if (targetReal && inside(rootReal, targetReal))
-                files.push({ path });
-        }
-        if (files.length >= parsed.data.limit || offset - start >= SCAN_PAGE_ENTRIES) {
-            return { files, truncated: true, nextCursor: encodeCursor(scope, offset) };
-        }
-    }
-    return { files, truncated: false };
-}
-async function* walk(root, current, signal) {
-    signal?.throwIfAborted();
-    const currentInfo = await lstat(current).catch(ignoreUnavailable);
-    if (!currentInfo?.isDirectory() || currentInfo.isSymbolicLink())
-        return;
-    const resolved = await realpath(current).catch(ignoreUnavailable);
-    if (!resolved || !inside(root, resolved))
-        return;
-    const directory = await opendir(resolved).catch(ignoreUnavailable);
-    if (!directory)
-        return;
-    // Recheck after opening: a concurrently replaced directory must not reveal another checkout's paths.
-    const openedPath = await realpath(current).catch(ignoreUnavailable);
-    if (openedPath !== resolved || !inside(root, openedPath)) {
-        await directory.close();
-        return;
-    }
-    for await (const entry of directory) {
-        signal?.throwIfAborted();
-        if (['.git', 'node_modules', '.playcraft'].includes(entry.name)) {
-            yield undefined;
-            continue;
-        }
-        const child = join(resolved, entry.name);
-        const path = relative(root, child).split(sep).join('/');
-        if (!workspaceRelativePathSchema.safeParse(path).success) {
-            yield undefined;
-            continue;
-        }
-        if (entry.isDirectory()) {
-            yield undefined;
-            if (!SKIP_DIRECTORIES.has(entry.name))
-                yield* walk(root, child, signal);
-            continue;
-        }
-        if (!entry.isFile()) {
-            yield undefined;
-            continue;
-        }
-        yield path;
-    }
-}
-function inside(root, path) {
-    const value = relative(root, path);
-    return value === '' || (value !== '..' && !value.startsWith(`..${sep}`) && !value.startsWith(sep));
-}
-function ignoreUnavailable(error) {
-    if (['ENOENT', 'ENOTDIR', 'EACCES'].includes(error.code ?? ''))
-        return undefined;
-    throw error;
-}
-function encodeCursor(scope, offset) {
-    return Buffer.from(JSON.stringify({ v: 1, scope, offset })).toString('base64url');
-}
-function decodeCursor(cursor, scope) {
-    if (!cursor)
-        return 0;
-    try {
-        if (!/^[A-Za-z0-9_-]+$/.test(cursor))
-            throw new Error();
-        const value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
-        if (typeof value !== 'object' || value === null)
-            throw new Error();
-        const { v, scope: suppliedScope, offset } = value;
-        if (v !== 1 || suppliedScope !== scope || typeof offset !== 'number' || !Number.isSafeInteger(offset) || offset < 0)
-            throw new Error();
-        return offset;
-    }
-    catch {
-        throw new InvalidWorkspaceSearchError('invalid_workspace_search_cursor');
-    }
-}

package/dist/workspace-runtime/workspaces/files.js

@@ -1,120 +0,0 @@
-import { lstat, mkdir, readdir, readFile, realpath, writeFile } from 'node:fs/promises';
-import { dirname, join, relative, resolve, sep } from 'node:path';
-import { hashWorkspaceFileContent, workspaceFileContentSchema, workspaceFileListSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { sampleDiskFile } from './disk-snapshot.js';
-const SKIP_DIRECTORY_NAMES = new Set(['.git', 'node_modules']);
-const LARGE_FILE_STREAM_THRESHOLD = 8 * 1024 * 1024;
-export class InvalidWorkspacePathError extends Error {
-    code = 'invalid_workspace_path';
-    constructor(path) {
-        super(path);
-        this.name = 'InvalidWorkspacePathError';
-    }
-}
-export async function ensureWorkspaceRoot(root) {
-    await mkdir(root, { recursive: true, mode: 0o700 });
-    return realpath(root);
-}
-export async function resolveWorkspaceFile(root, relativePath) {
-    const parsed = workspaceRelativePathSchema.safeParse(relativePath);
-    if (!parsed.success)
-        throw new InvalidWorkspacePathError(relativePath);
-    const rootReal = await ensureWorkspaceRoot(root);
-    const target = resolve(rootReal, ...parsed.data.split('/'));
-    assertInsideRoot(rootReal, target);
-    try {
-        const existing = await realpath(target);
-        assertInsideRoot(rootReal, existing);
-        return existing;
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-        await assertParentInsideRoot(rootReal, dirname(target));
-        return target;
-    }
-}
-export async function writeWorkspaceFile(root, relativePath, content) {
-    const target = await resolveWorkspaceFile(root, relativePath);
-    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
-    const bytes = Buffer.from(content, 'utf8');
-    await writeFile(target, bytes, { mode: 0o600 });
-    return { path: relativePath, contentHash: hashWorkspaceFileContent(content), size: bytes.byteLength };
-}
-export async function readWorkspaceFile(root, relativePath, revisions) {
-    const target = await resolveWorkspaceFile(root, relativePath);
-    const content = await readFile(target, 'utf8');
-    const contentHash = hashWorkspaceFileContent(content);
-    return workspaceFileContentSchema.parse({
-        path: relativePath,
-        revision: revisions[relativePath]?.revision ?? 0,
-        contentHash,
-        content,
-    });
-}
-export async function listWorkspaceFiles(root, revisions) {
-    const rootReal = await ensureWorkspaceRoot(root);
-    const files = [];
-    for (const relativePath of await walkWorkspaceFiles(rootReal, rootReal)) {
-        const target = join(rootReal, ...relativePath.split('/'));
-        if ((await lstat(target)).size > LARGE_FILE_STREAM_THRESHOLD) {
-            const sampled = await sampleDiskFile(target);
-            files.push({ path: relativePath, revision: revisions[relativePath]?.revision ?? 0, contentHash: sampled.hash, size: sampled.size });
-            continue;
-        }
-        const content = await readFile(target, 'utf8');
-        files.push({
-            path: relativePath,
-            revision: revisions[relativePath]?.revision ?? 0,
-            contentHash: hashWorkspaceFileContent(content),
-            size: Buffer.byteLength(content, 'utf8'),
-        });
-    }
-    files.sort((left, right) => left.path.localeCompare(right.path));
-    return workspaceFileListSchema.parse({ files });
-}
-async function walkWorkspaceFiles(rootReal, current) {
-    const entries = await readdir(current, { withFileTypes: true });
-    const paths = [];
-    for (const entry of entries) {
-        if (entry.isDirectory()) {
-            if (SKIP_DIRECTORY_NAMES.has(entry.name) || entry.name === '.' || entry.name === '..')
-                continue;
-            const child = join(current, entry.name);
-            const childReal = await realpath(child);
-            assertInsideRoot(rootReal, childReal);
-            paths.push(...(await walkWorkspaceFiles(rootReal, childReal)));
-            continue;
-        }
-        if (!entry.isFile())
-            continue;
-        const childReal = await realpath(join(current, entry.name));
-        assertInsideRoot(rootReal, childReal);
-        paths.push(toPosixRelative(rootReal, childReal));
-    }
-    return paths;
-}
-async function assertParentInsideRoot(rootReal, parent) {
-    if (parent === rootReal)
-        return;
-    try {
-        const parentReal = await realpath(parent);
-        assertInsideRoot(rootReal, parentReal);
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-        await mkdir(parent, { recursive: true, mode: 0o700 });
-        const parentReal = await realpath(parent);
-        assertInsideRoot(rootReal, parentReal);
-    }
-}
-function assertInsideRoot(rootReal, target) {
-    const rel = relative(rootReal, target);
-    if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || rel.startsWith('..')) {
-        throw new InvalidWorkspacePathError(target);
-    }
-}
-function toPosixRelative(rootReal, target) {
-    return relative(rootReal, target).split(sep).join('/');
-}

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -1,312 +0,0 @@
-import { createHash } from 'node:crypto';
-import { execFile } from 'node:child_process';
-import { chmod, chown, lstat, unlink, open, mkdir, mkdtemp, writeFile, readFile, rename, rm } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import { createServer } from 'node:http';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema, workspaceDirectoryNameSchema } from '@playcraft/common/cloud-workspace/runtime';
-import { WorkspaceGitDirectStore } from './git-direct-store.js';
-import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
-const exec = promisify(execFile);
-/** Only this control process sees the callback credential. Development processes use the local socket. */
-export class WorkspaceGitCredentialBroker {
-    state;
-    socketPath;
-    server;
-    closed = false;
-    ready = false;
-    cache = new Map();
-    pending = new Map();
-    direct;
-    constructor(state) {
-        this.state = state;
-        this.direct = new WorkspaceGitDirectStore(state);
-        const id = createHash('sha256').update(state.config.stateDir).digest('hex').slice(0, 24);
-        this.socketPath = `/tmp/playcraft-git-${id}.sock`;
-    }
-    async start() {
-        await this.direct.sweep(this.state.journal.destroyed());
-        const old = await lstat(this.socketPath).catch(error => {
-            if (error.code !== 'ENOENT')
-                throw error;
-            return undefined;
-        });
-        if (old) {
-            if (!old.isSocket() || old.uid !== process.getuid?.())
-                throw new Error('git_broker_socket_conflict');
-            await unlink(this.socketPath);
-        }
-        const server = this.server = createServer({ maxHeaderSize: 2048, requestTimeout: 10_000 }, async (request, response) => {
-            try {
-                if (request.method !== 'POST' || request.url !== '/credential')
-                    throw new Error();
-                const chunks = [];
-                let size = 0;
-                for await (const chunk of request) {
-                    size += chunk.length;
-                    if (size > 16_384)
-                        throw new Error();
-                    chunks.push(Buffer.from(chunk));
-                }
-                const result = await this.credential(JSON.parse(Buffer.concat(chunks).toString('utf8')));
-                response.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-                response.end(JSON.stringify(result));
-            }
-            catch {
-                response.writeHead(403, { 'cache-control': 'no-store', connection: 'close' });
-                response.end();
-            }
-        });
-        server.maxConnections = 32;
-        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(this.socketPath, resolve); });
-        // The workspace group is the image's development group; other system users cannot connect.
-        const directory = await lstat(this.state.config.workspaceRoot);
-        await chown(this.socketPath, process.getuid(), directory.gid);
-        await chmod(this.socketPath, 0o660);
-        this.ready = true;
-    }
-    async close() {
-        this.closed = true;
-        this.cache.clear();
-        if (this.server?.listening) {
-            this.server.closeAllConnections();
-            await new Promise(resolve => this.server.close(() => resolve()));
-            await unlink(this.socketPath).catch(() => undefined);
-        }
-    }
-    async configure(binding, preparation, directoryName = 'basic') {
-        workspaceDirectoryNameSchema.parse(directoryName);
-        if (binding.targetKind === 'standalone')
-            throw new Error('git_access_denied');
-        if (directoryName !== 'basic')
-            binding = this.binding(binding.workspaceId, directoryName);
-        const { directories: _directories, ...stableBinding } = binding;
-        binding = stableBinding;
-        const scope = `${binding.workspaceId}:${directoryName}`;
-        preparation = workspacePreparationSchema.parse(preparation);
-        if (preparation.mode !== 'clone')
-            throw new Error('git_access_denied');
-        const transport = preparation.transport;
-        const isDirect = isLocalWorkspaceGitAuthMode(preparation.authMode);
-        if (!isDirect && transport?.kind !== 'git-gateway-v2')
-            return;
-        if (isDirect) {
-            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || (preparation.directAccess && preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
-                throw new Error('git_access_denied');
-        }
-        else {
-            const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-            if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
-                throw new Error('workspace_git_gateway_unavailable');
-        }
-        // Revocation and switching to gateway invalidate first; direct rotation keeps the old file until rename.
-        if (!isDirect)
-            await this.direct.remove(binding.workspaceId, directoryName);
-        else if (preparation.directAccess === null)
-            await this.direct.put(binding, null, undefined, directoryName);
-        this.cache.delete(scope);
-        const cloneUrl = isDirect ? binding.repositoryUrl : transport.cloneUrl;
-        const root = join(this.state.config.workspaceRoot, binding.workspaceId, directoryName);
-        const helper = `!${quote(process.execPath)} ${quote(fileURLToPath(new URL('./git-credential-helper.js', import.meta.url)))} ${quote(this.socketPath)} ${quote(binding.workspaceId)} ${quote(directoryName)}`;
-        await configureGitFile(root, this.state.config.stateDir, [
-            ...(!isDirect ? [['--replace-all', `url.${cloneUrl}.insteadOf`, binding.repositoryUrl]] : []),
-            ['--replace-all', `credential.${cloneUrl}.useHttpPath`, 'true'],
-            ['--replace-all', `credential.${cloneUrl}.helper`, ''],
-            ['--add', `credential.${cloneUrl}.helper`, helper],
-            ['--replace-all', `http.${cloneUrl}.followRedirects`, 'false'],
-            ['--replace-all', 'playcraft.gitAuthUrl', cloneUrl],
-        ], binding.repositoryUrl);
-        if (isDirect)
-            await this.direct.put(binding, preparation.directAccess, undefined, directoryName);
-        this.cache.delete(scope);
-    }
-    async credential(input) {
-        if (!this.ready || this.closed || this.state.journal.destroyed() || !input || !['get', 'erase'].includes(input.action)
-            || typeof input.workspaceId !== 'string' || !/^[a-f0-9-]{36}$/.test(input.workspaceId)
-            || !['http', 'https'].includes(input.protocol) || typeof input.host !== 'string'
-            || typeof input.path !== 'string')
-            throw new Error('git_access_denied');
-        const directoryName = workspaceDirectoryNameSchema.parse(input.directoryName ?? 'basic');
-        const binding = this.binding(input.workspaceId, directoryName);
-        const scope = `${input.workspaceId}:${directoryName}`;
-        const cloneUrl = `${input.protocol}://${input.host}/${input.path}`;
-        const direct = await this.direct.get(binding, directoryName);
-        if (direct) {
-            if (!direct.access || cloneUrl !== binding.repositoryUrl)
-                throw new Error('git_access_denied');
-            if (input.action === 'erase') {
-                if (input.password === direct.access.password)
-                    await this.direct.put(binding, null, input.password, directoryName);
-                return {};
-            }
-            return { username: direct.access.username, password: direct.access.password };
-        }
-        const matched = matchWorkspaceGitGatewayCloneUrl(cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-        if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
-            throw new Error('git_access_denied');
-        if (input.action === 'erase') {
-            if (this.cache.get(scope)?.preparation.gitAccess?.password === input.password)
-                this.cache.delete(scope);
-            return {};
-        }
-        const key = JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]);
-        const cached = this.cache.get(scope);
-        let preparation = cached?.key === key && Date.parse(cached.preparation.gitAccess.expiresAt) > Date.now() + 60_000
-            ? cached.preparation : undefined;
-        if (!preparation) {
-            const pendingKey = `${scope}:${key}`;
-            let pending = this.pending.get(pendingKey);
-            if (!pending) {
-                pending = this.refresh(binding, key, directoryName).finally(() => this.pending.delete(pendingKey));
-                this.pending.set(pendingKey, pending);
-            }
-            preparation = await pending;
-        }
-        if (await this.direct.get(binding, directoryName) || preparation.transport?.cloneUrl !== cloneUrl || !preparation.gitAccess)
-            throw new Error('git_access_denied');
-        return { username: preparation.gitAccess.username, password: preparation.gitAccess.password };
-    }
-    async prepareDirectory(workspaceId, directoryName = 'basic') {
-        const binding = this.binding(workspaceId, directoryName, true);
-        return this.refresh(binding, JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]), directoryName);
-    }
-    binding(workspaceId, directoryName, recovering = false) {
-        workspaceDirectoryNameSchema.parse(directoryName);
-        const binding = this.state.journal.getWorkspace(workspaceId);
-        if (!binding || binding.targetKind === 'standalone')
-            throw new Error('git_access_denied');
-        const { directories: _directories, ...base } = binding;
-        if (directoryName === 'basic')
-            return base;
-        const directory = binding.directories?.find(item => item.directoryName === directoryName && (recovering || item.status !== 'reclaimed'));
-        if (!directory?.remixId)
-            throw new Error('git_access_denied');
-        return { ...base, targetKind: 'remix', remixId: directory.remixId, branchName: directory.branchName };
-    }
-    async destroy() {
-        await this.close();
-        await this.direct.sweep(true);
-    }
-    async refresh(binding, key, directoryName) {
-        const scope = `${binding.workspaceId}:${directoryName}`;
-        const endpoint = platformEndpoint(this.state.config.publicBaseUrl, PLATFORM_ROUTES.gitCredentials);
-        const epoch = this.state.runtimeEpoch;
-        const response = await fetch(endpoint, {
-            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
-            headers: { authorization: `Bearer ${this.state.config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': this.state.config.environment },
-            body: JSON.stringify({ runtimeId: this.state.config.runtimeId, generation: this.state.config.generation,
-                runtimeEpoch: epoch, workspaceId: binding.workspaceId, directoryName }),
-        });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new Error('git_broker_unavailable');
-        }
-        const preparation = workspacePreparationSchema.parse(await response.json());
-        if (preparation.mode !== 'clone')
-            throw new Error('git_access_denied');
-        const matched = preparation.transport && matchWorkspaceGitGatewayCloneUrl(preparation.transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-        if (this.closed || this.state.journal.destroyed() || this.state.runtimeEpoch !== epoch
-            || JSON.stringify(this.binding(binding.workspaceId, directoryName, true)) !== JSON.stringify(binding))
-            throw new Error('git_access_denied');
-        if (isLocalWorkspaceGitAuthMode(preparation.authMode)) {
-            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || !preparation.directAccess || preparation.directAccess.repositoryUrl !== binding.repositoryUrl)
-                throw new Error('git_access_denied');
-        }
-        else {
-            if (preparation.transport?.kind !== 'git-gateway-v2' || !matched?.ok || matched.requestId !== `v2/${binding.workspaceId}`
-                || !preparation.gitAccess || Date.parse(preparation.gitAccess.issuedAt) > Date.now()
-                || Date.parse(preparation.gitAccess.expiresAt) <= Date.now() + 10_000)
-                throw new Error('git_access_denied');
-            if (this.cache.size >= 128)
-                this.cache.clear();
-            this.cache.set(scope, { key, preparation });
-        }
-        return preparation;
-    }
-}
-function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
-/** Pin directories in Linux sandboxes and replace config atomically without following user-owned symlinks. */
-async function configureGitFile(root, stateDir, commands, repositoryUrl) {
-    const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
-    const directory = await open(root, directoryFlags);
-    const pinnedRoot = process.platform === 'linux' ? `/proc/self/fd/${directory.fd}` : root;
-    let gitDirectory;
-    let lock;
-    let temporary;
-    let lockPath;
-    try {
-        gitDirectory = await open(join(pinnedRoot, '.git'), directoryFlags);
-        const gitPath = process.platform === 'linux' ? `/proc/self/fd/${gitDirectory.fd}` : join(root, '.git');
-        const configPath = join(gitPath, 'config');
-        lock = await open(join(gitPath, 'config.lock'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o640);
-        lockPath = join(gitPath, 'config.lock');
-        const source = await open(configPath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        let content;
-        try {
-            const stat = await source.stat();
-            if (!stat.isFile() || stat.size > 1024 * 1024 || stat.nlink !== 1)
-                throw new Error('invalid_git_config');
-            content = await source.readFile('utf8');
-            await lock.chmod(stat.mode & 0o666);
-        }
-        finally {
-            await source.close();
-        }
-        await mkdir(stateDir, { recursive: true, mode: 0o700 });
-        temporary = await mkdtemp(join(stateDir, 'git-config-'));
-        const staging = join(temporary, 'config');
-        await writeFile(staging, content, { mode: 0o600 });
-        await clearManagedGitConfig(staging, repositoryUrl);
-        for (const args of commands)
-            await exec('git', ['config', '--file', staging, '--no-includes', ...args], {
-                timeout: 5000, maxBuffer: 8192, env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
-            });
-        await lock.writeFile(await readFile(staging));
-        await lock.sync();
-        await lock.close();
-        lock = undefined;
-        await rename(lockPath, configPath);
-        lockPath = undefined;
-    }
-    finally {
-        await lock?.close();
-        if (lockPath)
-            await unlink(lockPath).catch(() => undefined);
-        if (temporary)
-            await rm(temporary, { recursive: true, force: true });
-        await gitDirectory?.close();
-        await directory.close();
-    }
-}
-/** Only remove authentication/routing for this binding and previous PlayCraft endpoints. */
-async function clearManagedGitConfig(file, repositoryUrl) {
-    const run = (...args) => exec('git', ['config', '--file', file, '--no-includes', ...args], {
-        timeout: 5000, maxBuffer: 1024 * 1024,
-        env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
-    });
-    const entries = (await run('--null', '--list')).stdout.split('\0').filter(Boolean).map(entry => {
-        const newline = entry.indexOf('\n');
-        return [entry.slice(0, newline), entry.slice(newline + 1)];
-    });
-    const urls = new Set([repositoryUrl]);
-    const remove = new Set();
-    for (const [key, value] of entries) {
-        if (key === 'playcraft.gitauthurl')
-            urls.add(value);
-        const rewrite = /^url\.(.+)\.(?:insteadof|pushinsteadof)$/.exec(key);
-        if (rewrite && value === repositoryUrl) {
-            urls.add(rewrite[1]);
-            remove.add(key);
-        }
-    }
-    for (const [key] of entries) {
-        for (const url of urls) {
-            if (key.startsWith(`credential.${url}.`) || key.startsWith(`http.${url}.`))
-                remove.add(key);
-        }
-    }
-    for (const key of remove)
-        await run('--unset-all', key);
-}