@playcraft/cli 0.1.33 → 0.1.35-prod

package/dist/workspace-runtime/workspaces/parameters.js

@@ -1,272 +0,0 @@
-import { readdir, readFile, realpath } from 'node:fs/promises';
-import { relative, resolve, sep } from 'node:path';
-import JSON5 from 'json5';
-import { parameterDocumentSchema, parameterPatchPayloadSchema, workspaceRelativePathSchema, WORKSPACE_FILE_CONTENT_MAX, } from '@playcraft/common/cloud-workspace/runtime';
-import { InvalidWorkspacePathError, writeWorkspaceFile, } from './files.js';
-import { ParameterEditError, replaceJson5Path } from './json5-edit.js';
-const MANIFEST_PATH = '.playcraft/workspace.json';
-const DEFAULT_SCHEMA_PATH = 'src/theme/theme.schema.json5';
-const THEME_INDEX_PATH = 'src/theme/index.ts';
-const THEME_ROOT = 'src/theme';
-export async function readWorkspaceParameters(root, revisions) {
-    const located = await locateParameterFiles(root);
-    if (located.errors.some((item) => item.reason === 'parameter_manifest_invalid')) {
-        return parameterDocumentSchema.parse({ status: 'invalid', errors: located.errors });
-    }
-    if (!located.schemaPath) {
-        return parameterDocumentSchema.parse({
-            status: 'missing',
-            ...(located.errors.length > 0 ? { errors: located.errors } : {}),
-        });
-    }
-    const schemaFile = await readOptionalJson5(root, located.schemaPath);
-    if (schemaFile.status === 'missing') {
-        return parameterDocumentSchema.parse({
-            status: 'missing',
-            schemaPath: located.schemaPath,
-            themeId: located.themeId,
-        });
-    }
-    if (schemaFile.status === 'invalid') {
-        return parameterDocumentSchema.parse({
-            status: 'invalid',
-            schemaPath: located.schemaPath,
-            themeId: located.themeId,
-            errors: [{ path: located.schemaPath, reason: schemaFile.reason }],
-        });
-    }
-    if (!located.dataPath) {
-        return parameterDocumentSchema.parse({
-            status: 'schema_only',
-            schemaPath: located.schemaPath,
-            themeId: located.themeId,
-            schema: schemaFile.value,
-            schemaRevision: revisions[located.schemaPath]?.revision ?? 0,
-            ...(located.errors.length > 0 ? { errors: located.errors } : {}),
-        });
-    }
-    const dataFile = await readOptionalJson5(root, located.dataPath);
-    if (dataFile.status === 'missing') {
-        return parameterDocumentSchema.parse({
-            status: 'schema_only',
-            schemaPath: located.schemaPath,
-            dataPath: located.dataPath,
-            themeId: located.themeId,
-            schema: schemaFile.value,
-            schemaRevision: revisions[located.schemaPath]?.revision ?? 0,
-        });
-    }
-    if (dataFile.status === 'invalid') {
-        return parameterDocumentSchema.parse({
-            status: 'invalid',
-            schemaPath: located.schemaPath,
-            dataPath: located.dataPath,
-            themeId: located.themeId,
-            schema: schemaFile.value,
-            schemaRevision: revisions[located.schemaPath]?.revision ?? 0,
-            errors: [{ path: located.dataPath, reason: dataFile.reason }],
-        });
-    }
-    return parameterDocumentSchema.parse({
-        status: 'ready',
-        schemaPath: located.schemaPath,
-        dataPath: located.dataPath,
-        themeId: located.themeId,
-        schema: schemaFile.value,
-        data: dataFile.value,
-        schemaRevision: revisions[located.schemaPath]?.revision ?? 0,
-        dataRevision: revisions[located.dataPath]?.revision ?? 0,
-    });
-}
-export async function patchWorkspaceParameters(root, revisions, payload) {
-    const parsed = parameterPatchPayloadSchema.parse(payload);
-    const document = await readWorkspaceParameters(root, revisions);
-    if (document.status === 'missing' || document.status === 'schema_only' || !document.dataPath) {
-        throw new ParameterEditError('parameter_data_missing');
-    }
-    if (document.status === 'invalid')
-        throw new ParameterEditError('parameter_document_invalid');
-    const typeError = validateAgainstSchema(document.schema, parsed.fieldPath, parsed.value);
-    if (typeError)
-        throw new ParameterEditError(typeError);
-    const source = await readOptionalText(root, document.dataPath);
-    if (source === undefined)
-        throw new ParameterEditError('parameter_data_missing');
-    const next = replaceJson5Path(source, parsed.fieldPath, parsed.value);
-    JSON5.parse(next);
-    return writeWorkspaceFile(root, document.dataPath, next);
-}
-async function locateParameterFiles(root) {
-    const manifest = await readOptionalJson5(root, MANIFEST_PATH);
-    if (manifest.status === 'invalid') {
-        return { errors: [{ path: MANIFEST_PATH, reason: 'parameter_manifest_invalid' }] };
-    }
-    if (manifest.status === 'ok') {
-        const declared = declaredPaths(manifest.value);
-        if (!declared) {
-            return { errors: [{ path: MANIFEST_PATH, reason: 'parameter_manifest_invalid' }] };
-        }
-        if (declared.schemaPath || declared.dataPath)
-            return { ...declared, errors: [] };
-        if (declared.themeId) {
-            return {
-                schemaPath: DEFAULT_SCHEMA_PATH,
-                dataPath: `${THEME_ROOT}/${declared.themeId}/theme.data.json5`,
-                themeId: declared.themeId,
-                errors: [],
-            };
-        }
-    }
-    const schemaExists = (await readOptionalJson5(root, DEFAULT_SCHEMA_PATH)).status !== 'missing';
-    const theme = await readDeclaredTheme(root);
-    const dataPath = theme
-        ? `${THEME_ROOT}/${theme}/theme.data.json5`
-        : await uniqueThemeDataPath(root);
-    if (!schemaExists) {
-        return { themeId: theme, errors: [] };
-    }
-    if (!theme && (await listThemeDataFiles(root)).length > 1) {
-        return {
-            schemaPath: DEFAULT_SCHEMA_PATH,
-            errors: [{ path: THEME_INDEX_PATH, reason: 'theme_data_ambiguous' }],
-        };
-    }
-    return {
-        schemaPath: DEFAULT_SCHEMA_PATH,
-        dataPath,
-        themeId: theme,
-        errors: [],
-    };
-}
-function declaredPaths(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return undefined;
-    const parameters = value.parameters;
-    if (parameters === undefined)
-        return {};
-    if (!parameters || typeof parameters !== 'object' || Array.isArray(parameters))
-        return undefined;
-    const record = parameters;
-    if (Object.keys(record).some((key) => !['schemaPath', 'dataPath', 'themeId'].includes(key))) {
-        return undefined;
-    }
-    const schemaPath = record.schemaPath === undefined ? undefined : workspaceRelativePathSchema.safeParse(record.schemaPath);
-    const dataPath = record.dataPath === undefined ? undefined : workspaceRelativePathSchema.safeParse(record.dataPath);
-    const themeId = record.themeId === undefined
-        ? undefined
-        : typeof record.themeId === 'string' && record.themeId.trim() && record.themeId.length <= 128
-            ? record.themeId.trim()
-            : undefined;
-    if (record.schemaPath !== undefined && !schemaPath?.success)
-        return undefined;
-    if (record.dataPath !== undefined && !dataPath?.success)
-        return undefined;
-    if (record.themeId !== undefined && !themeId)
-        return undefined;
-    return {
-        schemaPath: schemaPath?.success ? schemaPath.data : undefined,
-        dataPath: dataPath?.success ? dataPath.data : undefined,
-        themeId,
-    };
-}
-async function readDeclaredTheme(root) {
-    const contents = await readOptionalText(root, THEME_INDEX_PATH);
-    if (!contents)
-        return undefined;
-    const text = contents.replace(/\/\*[\s\S]*?\*\//g, '').replace(/^\s*\/\/.*$/gm, '');
-    const match = text.match(/export\s+\{\s*default\s*\}\s+from\s+['"]\.\/([^'"]+)['"]/);
-    const themeId = match?.[1]?.trim();
-    return themeId && workspaceRelativePathSchema.safeParse(`${THEME_ROOT}/${themeId}/theme.data.json5`).success
-        ? themeId
-        : undefined;
-}
-async function uniqueThemeDataPath(root) {
-    const files = await listThemeDataFiles(root);
-    return files.length === 1 ? files[0] : undefined;
-}
-async function listThemeDataFiles(root) {
-    try {
-        const rootReal = await realpath(root);
-        const themeRoot = resolve(rootReal, ...THEME_ROOT.split('/'));
-        const entries = await readdir(themeRoot, { withFileTypes: true });
-        const files = [];
-        for (const entry of entries) {
-            if (!entry.isDirectory() || entry.name.startsWith('.'))
-                continue;
-            const relativePath = `${THEME_ROOT}/${entry.name}/theme.data.json5`;
-            if ((await readOptionalText(root, relativePath)) !== undefined)
-                files.push(relativePath);
-        }
-        return files;
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return [];
-        throw error;
-    }
-}
-async function readOptionalJson5(root, relativePath) {
-    const text = await readOptionalText(root, relativePath);
-    if (text === undefined)
-        return { status: 'missing' };
-    try {
-        return { status: 'ok', value: JSON5.parse(text) };
-    }
-    catch {
-        return { status: 'invalid', reason: 'parameter_document_invalid' };
-    }
-}
-async function readOptionalText(root, relativePath) {
-    const parsed = workspaceRelativePathSchema.safeParse(relativePath);
-    if (!parsed.success)
-        return undefined;
-    try {
-        const rootReal = await realpath(root);
-        const target = resolve(rootReal, ...parsed.data.split('/'));
-        const text = await readFile(target, 'utf8');
-        const existing = await realpath(target);
-        const rel = relative(rootReal, existing);
-        if (rel === '' || rel === '..' || rel.startsWith(`..${sep}`) || rel.startsWith('..')) {
-            throw new InvalidWorkspacePathError(relativePath);
-        }
-        if (Buffer.byteLength(text, 'utf8') > WORKSPACE_FILE_CONTENT_MAX) {
-            throw new ParameterEditError('parameter_document_invalid');
-        }
-        return text;
-    }
-    catch (error) {
-        if (error instanceof ParameterEditError || error instanceof InvalidWorkspacePathError)
-            throw error;
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw error;
-    }
-}
-function validateAgainstSchema(schema, fieldPath, value) {
-    let node = schema;
-    for (const key of fieldPath) {
-        if (!node || typeof node !== 'object' || Array.isArray(node))
-            return 'parameter_value_invalid';
-        const properties = node.properties;
-        if (!properties || typeof properties !== 'object' || Array.isArray(properties))
-            return 'parameter_value_invalid';
-        node = properties[key];
-        if (node === undefined)
-            return undefined;
-    }
-    if (!node || typeof node !== 'object' || Array.isArray(node))
-        return undefined;
-    const type = node.type;
-    if (type === 'string')
-        return typeof value === 'string' ? undefined : 'parameter_value_invalid';
-    if (type === 'boolean')
-        return typeof value === 'boolean' ? undefined : 'parameter_value_invalid';
-    if (type === 'integer')
-        return Number.isInteger(value) ? undefined : 'parameter_value_invalid';
-    if (type === 'number') {
-        return typeof value === 'number' && Number.isFinite(value) ? undefined : 'parameter_value_invalid';
-    }
-    if (type === 'null')
-        return value === null ? undefined : 'parameter_value_invalid';
-    return undefined;
-}

package/dist/workspace-runtime/workspaces/prepare.js

@@ -1,264 +0,0 @@
-import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
-import { lstat, mkdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, sameWorkspaceRegistration, workspacePreparationSchema, workspaceRegistrationSchema, workspaceDirectoryNameSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { WorkspaceContextError } from './context-error.js';
-import { workspacePlatformSkillAccess } from './skill-artifact-loader.js';
-import { scaffoldEmptyWorkspace } from './empty-template.js';
-/** The caller holds the Workspace lock. Only an absent, never-published directory may be prepared. */
-export async function prepareWorkspaceCheckout(state, binding, input, leaseFence, directoryName = 'basic', recovery = false) {
-    const preparation = workspacePreparationSchema.safeParse(input);
-    if (!preparation.success)
-        throw new WorkspaceContextError('invalid_workspace_preparation');
-    const standalone = binding.targetKind === 'standalone';
-    if (standalone !== (preparation.data.mode === 'empty'))
-        throw new WorkspaceContextError('invalid_workspace_preparation');
-    const clone = preparation.data.mode === 'clone' ? preparation.data : undefined;
-    const source = binding.repositoryUrl ? parseCloneSource(binding.repositoryUrl) : undefined;
-    const direct = isLocalWorkspaceGitAuthMode(clone?.authMode);
-    if (direct && (!isLocalWorkspaceGitEnvironment(state.config.environment) || !clone?.directAccess
-        || clone.directAccess.repositoryUrl !== binding.repositoryUrl))
-        throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-    const parent = await realpath(state.config.workspaceRoot);
-    const workspace = join(parent, binding.workspaceId);
-    workspaceDirectoryNameSchema.parse(directoryName);
-    const target = join(workspace, directoryName);
-    const receiptDir = join(state.config.stateDir, 'workspace-preparations');
-    await mkdir(receiptDir, { recursive: true, mode: 0o700 });
-    const receiptPath = join(receiptDir, `${binding.workspaceId}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`);
-    let previous = await readReceipt(receiptPath, binding);
-    if (recovery && previous?.status === 'published')
-        previous = undefined;
-    if (previous?.status === 'published')
-        throw new WorkspaceContextError('workspace_recovery_required');
-    if (await exists(target))
-        throw new WorkspaceContextError('workspace_checkout_conflict');
-    if (await exists(workspace)) {
-        const stat = await lstat(workspace);
-        if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(workspace) !== workspace)
-            throw new WorkspaceContextError('invalid_workspace_directory');
-    }
-    // An unfinished checkout recorded before the fork instructions were known must be cloned again.
-    const forkMatches = !previous || samePendingFork(previous.binding, binding);
-    if (previous && !forkMatches)
-        await rm(join(parent, previous.stagingName), { recursive: true, force: true });
-    const receipt = previous && forkMatches ? previous : {
-        binding,
-        stagingName: `.prepare-${binding.workspaceId}-${randomUUID()}`,
-        status: 'cloning',
-    };
-    const staging = join(parent, receipt.stagingName);
-    const assertCurrent = () => {
-        if (state.journal.destroyed())
-            throw new WorkspaceContextError('runtime_destroyed');
-        if (leaseFence < state.acceptedLeaseFence)
-            throw new WorkspaceContextError('stale_lease');
-    };
-    assertCurrent();
-    if (receipt.status === 'cloning') {
-        // Persist ownership before creating/removing a staging directory, so a crash can be retried.
-        await writeReceipt(receiptPath, receipt);
-        await rm(staging, { recursive: true, force: true });
-        await mkdir(staging, { mode: 0o700 });
-        const access = clone?.gitAccess;
-        const credential = clone?.directAccess ?? access;
-        const now = Date.now();
-        if (access &&
-            (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000)) {
-            await rm(staging, { recursive: true, force: true });
-            throw new WorkspaceContextError('workspace_git_access_expired');
-        }
-        const transport = clone?.transport;
-        if (transport && !matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, binding.repositoryUrl).ok) {
-            await rm(staging, { recursive: true, force: true });
-            throw new WorkspaceContextError('workspace_git_gateway_unavailable');
-        }
-        const deadline = Math.min(now + 90_000, access ? Date.parse(access.expiresAt) : Infinity);
-        const env = {
-            PATH: process.env.PATH,
-            HOME: state.config.stateDir,
-            GIT_CONFIG_NOSYSTEM: '1',
-            GIT_CONFIG_GLOBAL: '/dev/null',
-            GIT_TERMINAL_PROMPT: '0',
-            GIT_ALLOW_PROTOCOL: 'http:https',
-        };
-        // The authenticated registration already carries this operation's scoped credential.
-        // No publisher ledger is mounted in the sandbox; secrets exist only in this child environment.
-        if (credential) {
-            env.GIT_CONFIG_COUNT = transport ? '2' : '1';
-            env.GIT_CONFIG_KEY_0 = `http.${transport?.cloneUrl ?? source.href}.extraHeader`;
-            env.GIT_CONFIG_VALUE_0 = `Authorization: Basic ${Buffer.from(`${credential.username}:${credential.password}`).toString('base64')}`;
-            if (transport) {
-                env.GIT_CONFIG_KEY_1 = `url.${transport.cloneUrl}.insteadOf`;
-                env.GIT_CONFIG_VALUE_1 = binding.repositoryUrl;
-            }
-        }
-        try {
-            if (standalone) {
-                await runGit(['init', '--initial-branch=main', staging], env, deadline);
-                await scaffoldEmptyWorkspace(staging, join(state.config.stateDir, 'skill-artifacts'), workspacePlatformSkillAccess(state, binding.workspaceId));
-            }
-            else {
-                const fork = binding.pendingFork;
-                const cloneBranch = fork?.sourceBranchName ?? binding.branchName;
-                await runGit(['check-ref-format', '--branch', binding.branchName], env, deadline);
-                await runGit(['check-ref-format', '--branch', cloneBranch], env, deadline);
-                await runGit([
-                    'clone',
-                    '--no-checkout',
-                    '--single-branch',
-                    '--branch',
-                    cloneBranch,
-                    '--',
-                    binding.repositoryUrl,
-                    staging,
-                ], env, deadline);
-                // Checkout never receives the temporary credential and never invokes repository hooks or global filters.
-                clearCloneSecrets(env);
-                if (fork) {
-                    await runGit(['-C', staging, 'checkout', '-b', binding.branchName, fork.sourceCommit], env, deadline);
-                }
-                else {
-                    await runGit(['-C', staging, 'checkout', '--force', binding.branchName], env, deadline);
-                }
-            }
-            assertCurrent();
-            receipt.status = 'ready';
-            await writeReceipt(receiptPath, receipt);
-        }
-        catch (error) {
-            await rm(staging, { recursive: true, force: true });
-            if (error instanceof WorkspaceContextError)
-                throw error;
-            throw new WorkspaceContextError('workspace_clone_failed');
-        }
-        finally {
-            clearCloneSecrets(env);
-        }
-    }
-    const stat = await lstat(staging).catch(() => undefined);
-    if (!stat?.isDirectory() || stat.isSymbolicLink())
-        throw new WorkspaceContextError('workspace_recovery_required');
-    assertCurrent();
-    if (await exists(target))
-        throw new WorkspaceContextError('workspace_checkout_conflict');
-    if (await exists(workspace)) {
-        const stat = await lstat(workspace);
-        if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(workspace) !== workspace)
-            throw new WorkspaceContextError('invalid_workspace_directory');
-    }
-    await mkdir(workspace, { recursive: true, mode: 0o700 });
-    await rename(staging, target);
-    receipt.status = 'published';
-    await writeReceipt(receiptPath, receipt);
-}
-function clearCloneSecrets(env) {
-    for (const key of [
-        'GIT_CONFIG_COUNT',
-        'GIT_CONFIG_KEY_0',
-        'GIT_CONFIG_VALUE_0',
-        'GIT_CONFIG_KEY_1',
-        'GIT_CONFIG_VALUE_1',
-    ]) {
-        delete env[key];
-    }
-}
-function parseCloneSource(value) {
-    try {
-        const source = new URL(value);
-        if ((source.protocol !== 'https:' &&
-            !(source.protocol === 'http:' &&
-                ['127.0.0.1', '[::1]', 'localhost'].includes(source.hostname))) ||
-            source.username ||
-            source.password ||
-            source.search ||
-            source.hash)
-            throw new Error();
-        return source;
-    }
-    catch {
-        throw new WorkspaceContextError('workspace_clone_transport_unavailable');
-    }
-}
-async function exists(path) {
-    try {
-        await lstat(path);
-        return true;
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    }
-}
-function samePendingFork(left, right) {
-    const fork = (value) => value.targetKind === 'standalone' ? undefined : value.pendingFork;
-    return JSON.stringify(fork(left) ?? null) === JSON.stringify(fork(right) ?? null);
-}
-async function readReceipt(path, binding) {
-    try {
-        const value = JSON.parse(await readFile(path, 'utf8'));
-        const parsed = workspaceRegistrationSchema.parse(value.binding);
-        if (!sameWorkspaceRegistration(parsed, binding) ||
-            !['cloning', 'ready', 'published'].includes(value.status) ||
-            !new RegExp(`^\\.prepare-${binding.workspaceId}-[0-9a-f-]{36}$`).test(value.stagingName))
-            throw new Error();
-        return { binding: parsed, stagingName: value.stagingName, status: value.status };
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        throw new WorkspaceContextError('workspace_preparation_receipt_invalid');
-    }
-}
-async function writeReceipt(path, value) {
-    const temp = `${path}.tmp`;
-    await writeFile(temp, `${JSON.stringify(value)}\n`, { mode: 0o600 });
-    await rename(temp, path);
-}
-function runGit(args, env, deadline) {
-    return new Promise((resolve, reject) => {
-        let timedOut = false;
-        const child = spawn('git', [
-            '-c',
-            'core.hooksPath=/dev/null',
-            '-c',
-            'credential.helper=',
-            '-c',
-            'http.followRedirects=false',
-            '-c',
-            'init.templateDir=',
-            ...args,
-        ], {
-            env,
-            detached: process.platform !== 'win32',
-            stdio: 'ignore',
-        });
-        const timer = setTimeout(() => {
-            timedOut = true;
-            try {
-                if (process.platform !== 'win32' && child.pid)
-                    process.kill(-child.pid, 'SIGKILL');
-                else
-                    child.kill('SIGKILL');
-            }
-            catch {
-                /* The process may have already exited. */
-            }
-        }, Math.max(1, deadline - Date.now()));
-        child.once('error', () => {
-            clearTimeout(timer);
-            reject(new WorkspaceContextError('workspace_clone_failed'));
-        });
-        child.once('exit', (code) => {
-            clearTimeout(timer);
-            if (timedOut)
-                reject(new WorkspaceContextError('workspace_clone_timeout'));
-            else if (code === 0)
-                resolve();
-            else
-                reject(new WorkspaceContextError('workspace_clone_failed'));
-        });
-    });
-}