@playcraft/cli 0.1.38-beta → 0.1.39-prod

package/dist/workspace-runtime/serve.js

@@ -1,214 +0,0 @@
-import { closeCliCredentials } from './workspaces/cli-credentials.js';
-import { randomUUID } from 'node:crypto';
-import { mkdir } from 'node:fs/promises';
-import { createServer } from 'node:http';
-import { INCOMPATIBLE_EXIT_CODE, negotiateProtocol, } from '@playcraft/common/cloud-workspace/runtime';
-import { RuntimeJournal } from './persistence/journal.js';
-import { createCodexAppServerAdapter } from './codex/app-server.js';
-import { createLoopbackNativeAdapter } from './codex/loopback.js';
-import { attachNativeCollector } from './server/dispatch.js';
-import { handleRuntimeRequest } from './server/http.js';
-import { desktopHost, disposeDesktopHost } from './server/desktop-host.js';
-import { disposeTerminalHost, terminalHost } from './server/terminal-host.js';
-import { handleExecutionGroupCrash } from './server/execution-group.js';
-import { RuntimeProcessLock } from './server/lock.js';
-import { probeGitBinary } from './workspaces/git.js';
-import { WorkspaceGitCredentialBroker } from './workspaces/git-credential-broker.js';
-import { WorkspaceModelBroker } from './codex/model-broker.js';
-import { recoverInterruptedPreviews } from './previews/publish.js';
-import { recoverInterruptedInstalls } from './workspaces/dependencies.js';
-import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.js';
-import { workspaceContextFromRoot } from './workspaces/registry.js';
-import { observeWorkspaceArtifacts } from './workspaces/artifact-events.js';
-import { loadWorkspaceMcpConfig } from './codex/mcp-config.js';
-import { startSourceEventUploader, stopSourceEventUploader } from './server/source-uploader.js';
-export async function startWorkspaceRuntime(config, options = {}) {
-    process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
-    const negotiated = negotiateProtocol(config);
-    if (!negotiated.ok) {
-        const error = Object.assign(new Error('protocol_incompatible'), {
-            code: 'protocol_incompatible',
-            exitCode: INCOMPATIBLE_EXIT_CODE,
-        });
-        throw error;
-    }
-    const lock = new RuntimeProcessLock(config.stateDir);
-    lock.acquire();
-    let journal;
-    let gitCredentials;
-    let runtimeState;
-    try {
-        journal = new RuntimeJournal(config.stateDir);
-        await journal.load();
-        const previousEpoch = journal.storedRuntimeEpoch();
-        const previousGroup = journal.executionGroup();
-        const previousIdentityMatches = journal.epochsSnapshot().some((epoch) => epoch.runtime_id === config.runtimeId && epoch.generation === config.generation && epoch.runtime_epoch === previousEpoch);
-        await recoverInterruptedInstalls(journal);
-        await recoverInterruptedPreviews(journal);
-        await mkdir(config.workspaceRoot, { recursive: true, mode: 0o700 });
-        const state = runtimeState = {
-            config: { ...config, protocolMinor: negotiated.protocolMinor },
-            configPath: options.configPath,
-            journal,
-            acceptedLeaseFence: journal.acceptedLeaseFence(),
-            gitAvailable: await probeGitBinary(),
-            native: options.nativeAdapter,
-            runtimeEpoch: Math.max(config.runtimeEpoch, journal.storedRuntimeEpoch() ?? 0),
-            executionQueue: Promise.resolve(),
-            instanceToken: randomUUID(),
-        };
-        const native = state.native ??= defaultNativeAdapter(state);
-        await journal.bindRuntime({
-            runtimeId: config.runtimeId,
-            generation: config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-        });
-        startSourceEventUploader(state);
-        if (config.workspaceMode === 'multi') {
-            gitCredentials = state.gitCredentials = new WorkspaceGitCredentialBroker(state);
-            await gitCredentials.start();
-        }
-        const stopArtifactObserver = observeWorkspaceArtifacts(state);
-        attachNativeCollector(state);
-        native?.onUnexpectedExit?.((event) => {
-            void handleExecutionGroupCrash(state, event.pid);
-        });
-        try {
-            await native?.start?.();
-            const group = native?.executionProcess?.();
-            if (group) {
-                let previousStopped = false;
-                if (previousGroup.pid && previousGroup.pid !== group.pid) {
-                    try {
-                        process.kill(previousGroup.pid, 0);
-                    }
-                    catch (error) {
-                        previousStopped = error.code === 'ESRCH';
-                    }
-                }
-                // The supervisor advances the trusted config epoch only after stopping the old
-                // native group. Reconfirm its recorded PID before publishing that replacement.
-                if (previousIdentityMatches && previousEpoch !== undefined && config.runtimeEpoch > previousEpoch && previousStopped) {
-                    await journal.writeExecutionEpoch({
-                        runtimeEpoch: state.runtimeEpoch, ...group, previousPid: previousGroup.pid, previousRuntimeEpoch: previousEpoch, stopConfirmed: true,
-                    });
-                    await journal.replaceSessions(journal.listSessions().map((session) => ({ ...session, recoverability: 'history_only' })));
-                }
-                else {
-                    await journal.noteExecutionGroup(group);
-                }
-            }
-        }
-        catch (error) {
-            const code = error instanceof Error ? error.message : '';
-            state.nativeError = code === 'codex_model_catalog_unavailable' ? code : 'codex_start_failed';
-            console.error(`[workspace-runtime] ${state.nativeError}`);
-        }
-        const server = createServer((request, response) => {
-            void handleRuntimeRequest(state, request, response);
-        });
-        server.on('upgrade', (request, socket, head) => {
-            const pathname = new URL(request.url ?? '/', 'http://127.0.0.1').pathname;
-            if (/^\/runtime\/terminals\/[^/]+\/connect$/.test(pathname)) {
-                void terminalHost(state).handleUpgrade(request, socket, head);
-                return;
-            }
-            if (pathname === '/runtime/desktop/connect') {
-                desktopHost(state).handleUpgrade(request, socket, head);
-                return;
-            }
-            socket.destroy();
-        });
-        const port = await listenOn(server, config.listen.host, config.listen.port);
-        return {
-            config: state.config,
-            state,
-            url: `http://${formatHost(config.listen.host)}:${port}`,
-            async close() {
-                const serverClosed = closeServer(server);
-                await closeCliCredentials(state);
-                await gitCredentials?.close();
-                try {
-                    await disposeDesktopHost(state);
-                }
-                finally {
-                    disposeTerminalHost(state);
-                    try {
-                        await native?.close?.();
-                    }
-                    catch {
-                        /* adapter shutdown is best-effort */
-                    }
-                    await serverClosed;
-                    await stopArtifactObserver();
-                    stopSourceEventUploader(state);
-                    await journal?.close();
-                    lock.release();
-                }
-            },
-        };
-    }
-    catch (error) {
-        if (runtimeState)
-            stopSourceEventUploader(runtimeState);
-        await gitCredentials?.close().catch(() => undefined);
-        await journal?.close().catch(() => undefined);
-        lock.release();
-        throw error;
-    }
-}
-function listenOn(server, host, port) {
-    return new Promise((resolve, reject) => {
-        const onError = (error) => reject(error);
-        server.once('error', onError);
-        server.listen(port, host, () => {
-            server.removeListener('error', onError);
-            const address = server.address();
-            if (!address || typeof address === 'string') {
-                reject(new Error('listen_failed'));
-                return;
-            }
-            resolve(address.port);
-        });
-    });
-}
-function closeServer(server) {
-    return new Promise((resolve, reject) => {
-        server.close((error) => {
-            if (error)
-                reject(error);
-            else
-                resolve();
-        });
-    });
-}
-function formatHost(host) {
-    return host.includes(':') ? `[${host}]` : host;
-}
-function defaultNativeAdapter(state) {
-    const config = state.config;
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'loopback')
-        return createLoopbackNativeAdapter();
-    const hasLauncher = Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
-    const multi = config.workspaceMode === 'multi';
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' && !multi && !hasLauncher) {
-        throw new Error('codex_requires_managed_launcher');
-    }
-    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' || (multi && hasLauncher)) {
-        return createCodexAppServerAdapter({
-            config,
-            workspaceUi: true,
-            ...(multi ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
-            ...(multi ? { loadMcpConfig: async (cwd) => {
-                    const { workspaceId } = await workspaceContextFromRoot(state, cwd);
-                    return loadWorkspaceMcpConfig(state, workspaceId);
-                } } : {}),
-            loadSkillArtifact: async (cwd, entry) => {
-                const { workspaceId, directoryName } = await workspaceContextFromRoot(state, cwd);
-                return loadWorkspaceSkillArtifact(state, workspaceId, entry, directoryName === 'root' ? 'basic' : directoryName);
-            },
-            onSkillProcessRestart: process => state.journal.noteExecutionGroup(process),
-        });
-    }
-    return undefined;
-}

package/dist/workspace-runtime/server/auth.js

@@ -1,21 +0,0 @@
-import { timingSafeEqual } from 'node:crypto';
-export function extractControlToken(headers) {
-    const authorization = headerValue(headers.authorization);
-    if (authorization?.startsWith('Bearer ')) {
-        return authorization.slice('Bearer '.length).trim() || null;
-    }
-    const dedicated = headerValue(headers['x-playcraft-control-token']);
-    return dedicated?.trim() || null;
-}
-export function controlTokenMatches(expected, actual) {
-    if (!actual)
-        return false;
-    const left = Buffer.from(expected);
-    const right = Buffer.from(actual);
-    if (left.length !== right.length)
-        return false;
-    return timingSafeEqual(left, right);
-}
-function headerValue(value) {
-    return Array.isArray(value) ? value[0] : value;
-}

package/dist/workspace-runtime/server/connectivity.js

@@ -1,201 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { z } from 'zod';
-import { PLATFORM_ROUTES, modelConnectivityPath, platformEndpoint, } from '@playcraft/common/cloud-workspace/runtime';
-const PROBE_TIMEOUT_MS = 4_000;
-const CACHE_MS = 15_000;
-const CREDENTIAL_RENEW_BEFORE_MS = 30_000;
-const MAX_RESPONSE_BYTES = 16 * 1024;
-const credentialSchema = z.object({
-    token: z.string().min(1), expiresAt: z.string().datetime(),
-    configId: z.string().uuid(), model: z.string().min(1).max(128),
-    claims: z.object({
-        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
-        generation: z.number().int(), runtimeEpoch: z.number().int(),
-    }),
-});
-const caches = new WeakMap();
-const ready = () => ({ status: 'ready' });
-const unavailable = (reason) => ({ status: 'unavailable', reason });
-function snapshot(state, workspaceId) {
-    let nativeReady = false;
-    try {
-        nativeReady = Boolean(state.native?.ready());
-    }
-    catch { /* A failed adapter stays unavailable. */ }
-    const { publicBaseUrl, controlToken, environment, userId, runtimeId, generation } = state.config;
-    return { publicBaseUrl, controlToken, environment, userId, runtimeId, generation,
-        runtimeEpoch: state.runtimeEpoch, workspaceId, nativeReady, destroyed: state.journal.destroyed(),
-        registered: state.config.workspaceMode !== 'multi' || Boolean(state.journal.getWorkspace(workspaceId)) };
-}
-function safeEndpoint(value) {
-    const url = new URL(value);
-    if (url.username || url.password || url.search || url.hash || /[%\\]/.test(url.pathname)
-        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
-        throw new Error('insecure_endpoint');
-    }
-    return url;
-}
-async function responseJson(response) {
-    const reader = response.body?.getReader();
-    if (!reader)
-        throw new Error('invalid_probe_response');
-    const chunks = [];
-    let size = 0;
-    try {
-        while (true) {
-            const item = await reader.read();
-            if (item.done)
-                break;
-            size += item.value.byteLength;
-            if (size > MAX_RESPONSE_BYTES)
-                throw new Error('invalid_probe_response');
-            chunks.push(item.value);
-        }
-        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
-    }
-    finally {
-        await reader.cancel().catch(() => undefined);
-        reader.releaseLock();
-    }
-}
-async function requestProbe(target, init, credentials = false) {
-    const signal = AbortSignal.timeout(PROBE_TIMEOUT_MS);
-    try {
-        const response = await fetch(target, { ...init, redirect: 'error', signal });
-        if (!response.ok) {
-            const offline = response.headers.has('ngrok-error-code');
-            const rejected = response.status === 401 || response.status === 403;
-            let reason = rejected ? 'endpoint_rejected' : offline ? 'endpoint_offline' : 'endpoint_unreachable';
-            if (credentials && !offline && !rejected) {
-                const body = await responseJson(response).catch(() => undefined);
-                if (signal.aborted)
-                    return { state: unavailable('endpoint_timeout') };
-                if (body && typeof body === 'object' && 'reason' in body && body.reason === 'model_config_required')
-                    reason = 'model_config_required';
-            }
-            else
-                await response.body?.cancel().catch(() => undefined);
-            return { state: unavailable(reason) };
-        }
-        let body;
-        try {
-            body = await responseJson(response);
-        }
-        catch {
-            return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'invalid_probe_response') };
-        }
-        return { state: ready(), body };
-    }
-    catch {
-        return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'endpoint_unreachable') };
-    }
-}
-function echoMatches(body, expected) {
-    return Boolean(body && typeof body === 'object' && !Array.isArray(body)
-        && Object.entries(expected).every(([key, value]) => body[key] === value));
-}
-function scope(config) {
-    return { runtimeId: config.runtimeId, environment: config.environment, workspaceId: config.workspaceId,
-        generation: config.generation, runtimeEpoch: config.runtimeEpoch };
-}
-function entrance(config, route) {
-    return safeEndpoint(platformEndpoint(config.publicBaseUrl, route));
-}
-async function callbackProbe(config) {
-    if (!config.publicBaseUrl)
-        return unavailable('endpoint_not_configured');
-    let endpoint;
-    try {
-        endpoint = entrance(config, PLATFORM_ROUTES.eventsProbe);
-    }
-    catch {
-        return unavailable('insecure_endpoint');
-    }
-    const nonce = randomUUID();
-    const response = await requestProbe(endpoint, {
-        method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
-        body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
-            runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId, nonce }),
-    });
-    if (response.state.status !== 'ready')
-        return response.state;
-    return echoMatches(response.body, { service: 'playcraft-runtime', ...scope(config), nonce }) ? ready() : unavailable('invalid_probe_response');
-}
-async function modelProxyProbe(config, entry) {
-    if (!config.publicBaseUrl)
-        return unavailable('endpoint_not_configured');
-    let credentialEndpoint;
-    try {
-        credentialEndpoint = entrance(config, PLATFORM_ROUTES.modelCredentials);
-        entrance(config, PLATFORM_ROUTES.modelProxy);
-    }
-    catch {
-        return unavailable('insecure_endpoint');
-    }
-    if (entry.credential && Date.parse(entry.credential.expiresAt) <= Date.now() + CREDENTIAL_RENEW_BEFORE_MS)
-        entry.credential = undefined;
-    if (!entry.credential) {
-        const response = await requestProbe(credentialEndpoint, {
-            method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
-            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId }),
-        }, true);
-        if (response.state.status !== 'ready')
-            return response.state;
-        const parsed = credentialSchema.safeParse(response.body);
-        if (!parsed.success || !echoMatches(parsed.data.claims, { ...scope(config), userId: config.userId })
-            || Date.parse(parsed.data.expiresAt) <= Date.now() + 1_000)
-            return unavailable('invalid_probe_response');
-        entry.credential = parsed.data;
-    }
-    const credential = entry.credential;
-    const nonce = randomUUID();
-    const target = new URL(platformEndpoint(config.publicBaseUrl, modelConnectivityPath(credential.configId)));
-    target.searchParams.set('nonce', nonce);
-    const result = await requestProbe(target, { method: 'GET', headers: { authorization: `Bearer ${credential.token}`, 'playcraft-env': config.environment } });
-    if (result.state.reason === 'endpoint_rejected')
-        entry.credential = undefined;
-    if (result.state.status !== 'ready')
-        return result.state;
-    return echoMatches(result.body, { service: 'playcraft-model-proxy', ...scope(config), configId: credential.configId, nonce })
-        ? ready() : unavailable('invalid_probe_response');
-}
-async function probe(config, entry) {
-    if (config.destroyed || !config.registered) {
-        const state = unavailable(config.destroyed ? 'runtime_destroyed' : 'workspace_not_registered');
-        return { ...scope(config), checkedAt: new Date().toISOString(), callback: state, modelProxy: state, conversation: state };
-    }
-    const [callback, modelProxy] = await Promise.all([callbackProbe(config), modelProxyProbe(config, entry)]);
-    const conversation = !config.nativeReady ? unavailable('adapter_not_started')
-        : callback.status !== 'ready' ? unavailable('callback_unavailable')
-            : modelProxy.status !== 'ready' ? unavailable('model_proxy_unavailable') : ready();
-    return { ...scope(config), checkedAt: new Date().toISOString(), callback, modelProxy, conversation };
-}
-/** Check the configured services without starting a thread or generating a model response. */
-export function probeRuntimeConnectivity(state, workspaceId) {
-    const config = snapshot(state, workspaceId);
-    const key = JSON.stringify(config);
-    let cache = caches.get(state);
-    if (!cache) {
-        cache = new Map();
-        caches.set(state, cache);
-    }
-    const previous = cache.get(workspaceId);
-    if (previous?.key === key) {
-        if (previous.pending)
-            return previous.pending;
-        if (previous.value && previous.expiresAt > Date.now())
-            return Promise.resolve(previous.value);
-    }
-    const entry = previous?.key === key ? previous : { key, expiresAt: 0 };
-    cache.set(workspaceId, entry);
-    if (cache.size > 256)
-        cache.delete(cache.keys().next().value);
-    entry.pending = probe(config, entry).then((value) => {
-        if (JSON.stringify(snapshot(state, workspaceId)) !== key)
-            return probeRuntimeConnectivity(state, workspaceId);
-        entry.value = value;
-        entry.expiresAt = Date.now() + CACHE_MS;
-        return value;
-    }).finally(() => { entry.pending = undefined; });
-    return entry.pending;
-}