@playcraft/cli 0.1.40-beta → 0.1.42

package/dist/workspace-runtime/workspaces/files.js

@@ -1,138 +0,0 @@
-import { lstat, mkdir, readdir, readFile, realpath, writeFile } from 'node:fs/promises';
-import { dirname, join, relative, resolve, sep } from 'node:path';
-import { hashWorkspaceFileContent, workspaceFileContentSchema, workspaceFileListSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { sampleDiskFile } from './disk-snapshot.js';
-const SKIP_DIRECTORY_NAMES = new Set(['.git', 'node_modules', '.playcraft-temp']);
-const LARGE_FILE_STREAM_THRESHOLD = 8 * 1024 * 1024;
-export class InvalidWorkspacePathError extends Error {
-    code = 'invalid_workspace_path';
-    constructor(path) {
-        super(path);
-        this.name = 'InvalidWorkspacePathError';
-    }
-}
-export async function ensureWorkspaceRoot(root) {
-    await mkdir(root, { recursive: true, mode: 0o700 });
-    return realpath(root);
-}
-export async function resolveWorkspaceFile(root, relativePath) {
-    const parsed = workspaceRelativePathSchema.safeParse(relativePath);
-    if (!parsed.success)
-        throw new InvalidWorkspacePathError(relativePath);
-    const rootReal = await ensureWorkspaceRoot(root);
-    const target = resolve(rootReal, ...parsed.data.split('/'));
-    assertInsideRoot(rootReal, target);
-    try {
-        const existing = await realpath(target);
-        assertInsideRoot(rootReal, existing);
-        return existing;
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-        await assertParentInsideRoot(rootReal, dirname(target));
-        return target;
-    }
-}
-export async function writeWorkspaceFile(root, relativePath, content) {
-    const target = await resolveWorkspaceFile(root, relativePath);
-    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
-    const bytes = Buffer.from(content, 'utf8');
-    await writeFile(target, bytes, { mode: 0o600 });
-    return { path: relativePath, contentHash: hashWorkspaceFileContent(content), size: bytes.byteLength };
-}
-export async function readWorkspaceFile(root, relativePath, revisions) {
-    const target = await resolveWorkspaceFile(root, relativePath);
-    const content = await readFile(target, 'utf8');
-    const contentHash = hashWorkspaceFileContent(content);
-    return workspaceFileContentSchema.parse({
-        path: relativePath,
-        revision: revisions[relativePath]?.revision ?? 0,
-        contentHash,
-        content,
-    });
-}
-export async function listWorkspaceFiles(root, revisions) {
-    const rootReal = await ensureWorkspaceRoot(root);
-    const files = [];
-    const unreadablePaths = new Set();
-    for (const relativePath of await walkWorkspaceFiles(rootReal, rootReal, unreadablePaths)) {
-        const target = join(rootReal, ...relativePath.split('/'));
-        try {
-            if ((await lstat(target)).size > LARGE_FILE_STREAM_THRESHOLD) {
-                const sampled = await sampleDiskFile(target);
-                files.push({ path: relativePath, revision: revisions[relativePath]?.revision ?? 0, contentHash: sampled.hash, size: sampled.size });
-                continue;
-            }
-            const content = await readFile(target, 'utf8');
-            files.push({
-                path: relativePath,
-                revision: revisions[relativePath]?.revision ?? 0,
-                contentHash: hashWorkspaceFileContent(content),
-                size: Buffer.byteLength(content, 'utf8'),
-            });
-        }
-        catch (error) {
-            if (!isPermissionDenied(error))
-                throw error;
-            unreadablePaths.add(relativePath);
-        }
-    }
-    files.sort((left, right) => left.path.localeCompare(right.path));
-    return workspaceFileListSchema.parse({ files, ...(unreadablePaths.size ? { unreadablePaths: [...unreadablePaths].sort() } : {}) });
-}
-async function walkWorkspaceFiles(rootReal, current, unreadablePaths) {
-    const entries = await readdir(current, { withFileTypes: true });
-    const paths = [];
-    for (const entry of entries) {
-        const child = join(current, entry.name);
-        try {
-            if (entry.isDirectory()) {
-                if (SKIP_DIRECTORY_NAMES.has(entry.name) || entry.name === '.' || entry.name === '..')
-                    continue;
-                const childReal = await realpath(child);
-                assertInsideRoot(rootReal, childReal);
-                paths.push(...(await walkWorkspaceFiles(rootReal, childReal, unreadablePaths)));
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            const childReal = await realpath(child);
-            assertInsideRoot(rootReal, childReal);
-            paths.push(toPosixRelative(rootReal, childReal));
-        }
-        catch (error) {
-            if (!isPermissionDenied(error))
-                throw error;
-            unreadablePaths.add(toPosixRelative(rootReal, child));
-        }
-    }
-    return paths;
-}
-function isPermissionDenied(error) {
-    return ['EACCES', 'EPERM'].includes(String(error?.code));
-}
-async function assertParentInsideRoot(rootReal, parent) {
-    if (parent === rootReal)
-        return;
-    try {
-        const parentReal = await realpath(parent);
-        assertInsideRoot(rootReal, parentReal);
-    }
-    catch (error) {
-        if (error.code !== 'ENOENT')
-            throw error;
-        await mkdir(parent, { recursive: true, mode: 0o700 });
-        const parentReal = await realpath(parent);
-        assertInsideRoot(rootReal, parentReal);
-    }
-}
-function assertInsideRoot(rootReal, target) {
-    const rel = relative(rootReal, target);
-    if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || rel.startsWith('..')) {
-        throw new InvalidWorkspacePathError(target);
-    }
-}
-function toPosixRelative(rootReal, target) {
-    return relative(rootReal, target).split(sep).join('/');
-}

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -1,312 +0,0 @@
-import { createHash } from 'node:crypto';
-import { execFile } from 'node:child_process';
-import { chmod, chown, lstat, unlink, open, mkdir, mkdtemp, writeFile, readFile, rename, rm } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import { createServer } from 'node:http';
-import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { promisify } from 'node:util';
-import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, workspacePreparationSchema, workspaceDirectoryNameSchema } from '@playcraft/common/cloud-workspace/runtime';
-import { WorkspaceGitDirectStore } from './git-direct-store.js';
-import { PLATFORM_ROUTES, platformEndpoint } from '@playcraft/common/cloud-workspace/runtime';
-const exec = promisify(execFile);
-/** Only this control process sees the callback credential. Development processes use the local socket. */
-export class WorkspaceGitCredentialBroker {
-    state;
-    socketPath;
-    server;
-    closed = false;
-    ready = false;
-    cache = new Map();
-    pending = new Map();
-    direct;
-    constructor(state) {
-        this.state = state;
-        this.direct = new WorkspaceGitDirectStore(state);
-        const id = createHash('sha256').update(state.config.stateDir).digest('hex').slice(0, 24);
-        this.socketPath = `/tmp/playcraft-git-${id}.sock`;
-    }
-    async start() {
-        await this.direct.sweep(this.state.journal.destroyed());
-        const old = await lstat(this.socketPath).catch(error => {
-            if (error.code !== 'ENOENT')
-                throw error;
-            return undefined;
-        });
-        if (old) {
-            if (!old.isSocket() || old.uid !== process.getuid?.())
-                throw new Error('git_broker_socket_conflict');
-            await unlink(this.socketPath);
-        }
-        const server = this.server = createServer({ maxHeaderSize: 2048, requestTimeout: 10_000 }, async (request, response) => {
-            try {
-                if (request.method !== 'POST' || request.url !== '/credential')
-                    throw new Error();
-                const chunks = [];
-                let size = 0;
-                for await (const chunk of request) {
-                    size += chunk.length;
-                    if (size > 16_384)
-                        throw new Error();
-                    chunks.push(Buffer.from(chunk));
-                }
-                const result = await this.credential(JSON.parse(Buffer.concat(chunks).toString('utf8')));
-                response.writeHead(200, { 'content-type': 'application/json', 'cache-control': 'no-store' });
-                response.end(JSON.stringify(result));
-            }
-            catch {
-                response.writeHead(403, { 'cache-control': 'no-store', connection: 'close' });
-                response.end();
-            }
-        });
-        server.maxConnections = 32;
-        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(this.socketPath, resolve); });
-        // The workspace group is the image's development group; other system users cannot connect.
-        const directory = await lstat(this.state.config.workspaceRoot);
-        await chown(this.socketPath, process.getuid(), directory.gid);
-        await chmod(this.socketPath, 0o660);
-        this.ready = true;
-    }
-    async close() {
-        this.closed = true;
-        this.cache.clear();
-        if (this.server?.listening) {
-            this.server.closeAllConnections();
-            await new Promise(resolve => this.server.close(() => resolve()));
-            await unlink(this.socketPath).catch(() => undefined);
-        }
-    }
-    async configure(binding, preparation, directoryName = 'basic') {
-        workspaceDirectoryNameSchema.parse(directoryName);
-        if (binding.targetKind === 'standalone')
-            throw new Error('git_access_denied');
-        if (directoryName !== 'basic')
-            binding = this.binding(binding.workspaceId, directoryName);
-        const { directories: _directories, ...stableBinding } = binding;
-        binding = stableBinding;
-        const scope = `${binding.workspaceId}:${directoryName}`;
-        preparation = workspacePreparationSchema.parse(preparation);
-        if (preparation.mode !== 'clone')
-            throw new Error('git_access_denied');
-        const transport = preparation.transport;
-        const isDirect = isLocalWorkspaceGitAuthMode(preparation.authMode);
-        if (!isDirect && transport?.kind !== 'git-gateway-v2')
-            return;
-        if (isDirect) {
-            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || (preparation.directAccess && preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
-                throw new Error('git_access_denied');
-        }
-        else {
-            const matched = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-            if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
-                throw new Error('workspace_git_gateway_unavailable');
-        }
-        // Revocation and switching to gateway invalidate first; direct rotation keeps the old file until rename.
-        if (!isDirect)
-            await this.direct.remove(binding.workspaceId, directoryName);
-        else if (preparation.directAccess === null)
-            await this.direct.put(binding, null, undefined, directoryName);
-        this.cache.delete(scope);
-        const cloneUrl = isDirect ? binding.repositoryUrl : transport.cloneUrl;
-        const root = join(this.state.config.workspaceRoot, binding.workspaceId, directoryName);
-        const helper = `!${quote(process.execPath)} ${quote(fileURLToPath(new URL('./git-credential-helper.js', import.meta.url)))} ${quote(this.socketPath)} ${quote(binding.workspaceId)} ${quote(directoryName)}`;
-        await configureGitFile(root, this.state.config.stateDir, [
-            ...(!isDirect ? [['--replace-all', `url.${cloneUrl}.insteadOf`, binding.repositoryUrl]] : []),
-            ['--replace-all', `credential.${cloneUrl}.useHttpPath`, 'true'],
-            ['--replace-all', `credential.${cloneUrl}.helper`, ''],
-            ['--add', `credential.${cloneUrl}.helper`, helper],
-            ['--replace-all', `http.${cloneUrl}.followRedirects`, 'false'],
-            ['--replace-all', 'playcraft.gitAuthUrl', cloneUrl],
-        ], binding.repositoryUrl);
-        if (isDirect)
-            await this.direct.put(binding, preparation.directAccess, undefined, directoryName);
-        this.cache.delete(scope);
-    }
-    async credential(input) {
-        if (!this.ready || this.closed || this.state.journal.destroyed() || !input || !['get', 'erase'].includes(input.action)
-            || typeof input.workspaceId !== 'string' || !/^[a-f0-9-]{36}$/.test(input.workspaceId)
-            || !['http', 'https'].includes(input.protocol) || typeof input.host !== 'string'
-            || typeof input.path !== 'string')
-            throw new Error('git_access_denied');
-        const directoryName = workspaceDirectoryNameSchema.parse(input.directoryName ?? 'basic');
-        const binding = this.binding(input.workspaceId, directoryName);
-        const scope = `${input.workspaceId}:${directoryName}`;
-        const cloneUrl = `${input.protocol}://${input.host}/${input.path}`;
-        const direct = await this.direct.get(binding, directoryName);
-        if (direct) {
-            if (!direct.access || cloneUrl !== binding.repositoryUrl)
-                throw new Error('git_access_denied');
-            if (input.action === 'erase') {
-                if (input.password === direct.access.password)
-                    await this.direct.put(binding, null, input.password, directoryName);
-                return {};
-            }
-            return { username: direct.access.username, password: direct.access.password };
-        }
-        const matched = matchWorkspaceGitGatewayCloneUrl(cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-        if (!matched.ok || matched.requestId !== `v2/${binding.workspaceId}`)
-            throw new Error('git_access_denied');
-        if (input.action === 'erase') {
-            if (this.cache.get(scope)?.preparation.gitAccess?.password === input.password)
-                this.cache.delete(scope);
-            return {};
-        }
-        const key = JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]);
-        const cached = this.cache.get(scope);
-        let preparation = cached?.key === key && Date.parse(cached.preparation.gitAccess.expiresAt) > Date.now() + 60_000
-            ? cached.preparation : undefined;
-        if (!preparation) {
-            const pendingKey = `${scope}:${key}`;
-            let pending = this.pending.get(pendingKey);
-            if (!pending) {
-                pending = this.refresh(binding, key, directoryName).finally(() => this.pending.delete(pendingKey));
-                this.pending.set(pendingKey, pending);
-            }
-            preparation = await pending;
-        }
-        if (await this.direct.get(binding, directoryName) || preparation.transport?.cloneUrl !== cloneUrl || !preparation.gitAccess)
-            throw new Error('git_access_denied');
-        return { username: preparation.gitAccess.username, password: preparation.gitAccess.password };
-    }
-    async prepareDirectory(workspaceId, directoryName = 'basic') {
-        const binding = this.binding(workspaceId, directoryName, true);
-        return this.refresh(binding, JSON.stringify([binding, this.state.config.generation, this.state.runtimeEpoch]), directoryName);
-    }
-    binding(workspaceId, directoryName, recovering = false) {
-        workspaceDirectoryNameSchema.parse(directoryName);
-        const binding = this.state.journal.getWorkspace(workspaceId);
-        if (!binding || binding.targetKind === 'standalone')
-            throw new Error('git_access_denied');
-        const { directories: _directories, ...base } = binding;
-        if (directoryName === 'basic')
-            return base;
-        const directory = binding.directories?.find(item => item.directoryName === directoryName && (recovering || item.status !== 'reclaimed'));
-        if (!directory?.remixId)
-            throw new Error('git_access_denied');
-        return { ...base, targetKind: 'remix', remixId: directory.remixId, branchName: directory.branchName };
-    }
-    async destroy() {
-        await this.close();
-        await this.direct.sweep(true);
-    }
-    async refresh(binding, key, directoryName) {
-        const scope = `${binding.workspaceId}:${directoryName}`;
-        const endpoint = platformEndpoint(this.state.config.publicBaseUrl, PLATFORM_ROUTES.gitCredentials);
-        const epoch = this.state.runtimeEpoch;
-        const response = await fetch(endpoint, {
-            method: 'POST', redirect: 'error', signal: AbortSignal.timeout(10_000),
-            headers: { authorization: `Bearer ${this.state.config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': this.state.config.environment },
-            body: JSON.stringify({ runtimeId: this.state.config.runtimeId, generation: this.state.config.generation,
-                runtimeEpoch: epoch, workspaceId: binding.workspaceId, directoryName }),
-        });
-        if (!response.ok) {
-            await response.body?.cancel();
-            throw new Error('git_broker_unavailable');
-        }
-        const preparation = workspacePreparationSchema.parse(await response.json());
-        if (preparation.mode !== 'clone')
-            throw new Error('git_access_denied');
-        const matched = preparation.transport && matchWorkspaceGitGatewayCloneUrl(preparation.transport.cloneUrl, this.state.config.gitGatewayOrigins, binding.repositoryUrl);
-        if (this.closed || this.state.journal.destroyed() || this.state.runtimeEpoch !== epoch
-            || JSON.stringify(this.binding(binding.workspaceId, directoryName, true)) !== JSON.stringify(binding))
-            throw new Error('git_access_denied');
-        if (isLocalWorkspaceGitAuthMode(preparation.authMode)) {
-            if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || !preparation.directAccess || preparation.directAccess.repositoryUrl !== binding.repositoryUrl)
-                throw new Error('git_access_denied');
-        }
-        else {
-            if (preparation.transport?.kind !== 'git-gateway-v2' || !matched?.ok || matched.requestId !== `v2/${binding.workspaceId}`
-                || !preparation.gitAccess || Date.parse(preparation.gitAccess.issuedAt) > Date.now()
-                || Date.parse(preparation.gitAccess.expiresAt) <= Date.now() + 10_000)
-                throw new Error('git_access_denied');
-            if (this.cache.size >= 128)
-                this.cache.clear();
-            this.cache.set(scope, { key, preparation });
-        }
-        return preparation;
-    }
-}
-function quote(value) { return `'${value.replaceAll("'", "'\\''")}'`; }
-/** Pin directories in Linux sandboxes and replace config atomically without following user-owned symlinks. */
-async function configureGitFile(root, stateDir, commands, repositoryUrl) {
-    const directoryFlags = constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW;
-    const directory = await open(root, directoryFlags);
-    const pinnedRoot = process.platform === 'linux' ? `/proc/self/fd/${directory.fd}` : root;
-    let gitDirectory;
-    let lock;
-    let temporary;
-    let lockPath;
-    try {
-        gitDirectory = await open(join(pinnedRoot, '.git'), directoryFlags);
-        const gitPath = process.platform === 'linux' ? `/proc/self/fd/${gitDirectory.fd}` : join(root, '.git');
-        const configPath = join(gitPath, 'config');
-        lock = await open(join(gitPath, 'config.lock'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o640);
-        lockPath = join(gitPath, 'config.lock');
-        const source = await open(configPath, constants.O_RDONLY | constants.O_NOFOLLOW);
-        let content;
-        try {
-            const stat = await source.stat();
-            if (!stat.isFile() || stat.size > 1024 * 1024 || stat.nlink !== 1)
-                throw new Error('invalid_git_config');
-            content = await source.readFile('utf8');
-            await lock.chmod(stat.mode & 0o666);
-        }
-        finally {
-            await source.close();
-        }
-        await mkdir(stateDir, { recursive: true, mode: 0o700 });
-        temporary = await mkdtemp(join(stateDir, 'git-config-'));
-        const staging = join(temporary, 'config');
-        await writeFile(staging, content, { mode: 0o600 });
-        await clearManagedGitConfig(staging, repositoryUrl);
-        for (const args of commands)
-            await exec('git', ['config', '--file', staging, '--no-includes', ...args], {
-                timeout: 5000, maxBuffer: 8192, env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
-            });
-        await lock.writeFile(await readFile(staging));
-        await lock.sync();
-        await lock.close();
-        lock = undefined;
-        await rename(lockPath, configPath);
-        lockPath = undefined;
-    }
-    finally {
-        await lock?.close();
-        if (lockPath)
-            await unlink(lockPath).catch(() => undefined);
-        if (temporary)
-            await rm(temporary, { recursive: true, force: true });
-        await gitDirectory?.close();
-        await directory.close();
-    }
-}
-/** Only remove authentication/routing for this binding and previous PlayCraft endpoints. */
-async function clearManagedGitConfig(file, repositoryUrl) {
-    const run = (...args) => exec('git', ['config', '--file', file, '--no-includes', ...args], {
-        timeout: 5000, maxBuffer: 1024 * 1024,
-        env: { PATH: process.env.PATH, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null' },
-    });
-    const entries = (await run('--null', '--list')).stdout.split('\0').filter(Boolean).map(entry => {
-        const newline = entry.indexOf('\n');
-        return [entry.slice(0, newline), entry.slice(newline + 1)];
-    });
-    const urls = new Set([repositoryUrl]);
-    const remove = new Set();
-    for (const [key, value] of entries) {
-        if (key === 'playcraft.gitauthurl')
-            urls.add(value);
-        const rewrite = /^url\.(.+)\.(?:insteadof|pushinsteadof)$/.exec(key);
-        if (rewrite && value === repositoryUrl) {
-            urls.add(rewrite[1]);
-            remove.add(key);
-        }
-    }
-    for (const [key] of entries) {
-        for (const url of urls) {
-            if (key.startsWith(`credential.${url}.`) || key.startsWith(`http.${url}.`))
-                remove.add(key);
-        }
-    }
-    for (const key of remove)
-        await run('--unset-all', key);
-}

package/dist/workspace-runtime/workspaces/git-credential-helper.js

@@ -1,68 +0,0 @@
-import { request } from 'node:http';
-// Git invokes this executable directly. Keep standard output exclusively for the credential protocol.
-const [socketPath, workspaceId, third, fourth] = process.argv.slice(2);
-const directoryName = fourth === undefined ? 'basic' : third;
-const action = fourth ?? third;
-try {
-    if (action === 'get' || action === 'erase') {
-        const fields = {};
-        const chunks = [];
-        let size = 0;
-        for await (const chunk of process.stdin) {
-            size += chunk.length;
-            if (size > 16_384)
-                throw new Error();
-            chunks.push(Buffer.from(chunk));
-        }
-        for (const line of Buffer.concat(chunks).toString('utf8').split('\n')) {
-            if (!line)
-                break;
-            const separator = line.indexOf('=');
-            if (separator < 1)
-                throw new Error();
-            const key = line.slice(0, separator);
-            // Git may repeat extension fields such as capability[] and wwwauth[].
-            if (!['protocol', 'host', 'path', 'password'].includes(key))
-                continue;
-            if (key in fields)
-                throw new Error();
-            fields[key] = line.slice(separator + 1);
-        }
-        const credential = await new Promise((resolve, reject) => {
-            const client = request({ socketPath, path: '/credential', method: 'POST',
-                headers: { 'content-type': 'application/json' }, signal: AbortSignal.timeout(12_000) }, async (response) => {
-                try {
-                    if (response.statusCode !== 200) {
-                        response.resume();
-                        throw new Error();
-                    }
-                    const parts = [];
-                    let length = 0;
-                    for await (const chunk of response) {
-                        length += chunk.length;
-                        if (length > 16_384)
-                            throw new Error();
-                        parts.push(Buffer.from(chunk));
-                    }
-                    resolve(JSON.parse(Buffer.concat(parts).toString('utf8')));
-                }
-                catch {
-                    reject(new Error());
-                }
-            });
-            client.once('error', reject);
-            client.end(JSON.stringify({ workspaceId, directoryName, action, protocol: fields.protocol, host: fields.host,
-                path: fields.path, ...(action === 'erase' ? { password: fields.password } : {}) }));
-        });
-        if (action === 'get') {
-            if (!credential.username || !credential.password || /[\r\n\0]/.test(credential.username + credential.password))
-                throw new Error();
-            process.stdout.write(`username=${credential.username}\npassword=${credential.password}\n\n`);
-        }
-    }
-}
-catch {
-    if (action === 'get')
-        process.stdout.write('quit=true\n\n');
-    process.exitCode = 1;
-}

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -1,155 +0,0 @@
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, realpath, readdir, rename, unlink } from 'node:fs/promises';
-import { randomUUID } from 'node:crypto';
-import { join, resolve, sep } from 'node:path';
-import { isLocalWorkspaceGitEnvironment, workspaceGitDirectAccessSchema, workspaceDirectoryNameSchema, sameWorkspaceRegistration } from '@playcraft/common/cloud-workspace/runtime';
-/** Control-owned files only. Same-user processes are not an operating-system isolation boundary. */
-export class WorkspaceGitDirectStore {
-    state;
-    mutation = Promise.resolve();
-    constructor(state) {
-        this.state = state;
-    }
-    exclusive(action) {
-        const result = this.mutation.then(action);
-        this.mutation = result.catch(() => undefined);
-        return result;
-    }
-    identity() {
-        const c = this.state.config;
-        return JSON.stringify([c.environment, c.userId, c.runtimeId, c.generation]);
-    }
-    name(id, directoryName = 'basic') {
-        if (!/^[a-f0-9-]{36}$/.test(id))
-            throw new Error('git_access_denied');
-        workspaceDirectoryNameSchema.parse(directoryName);
-        return `${id}${directoryName === 'basic' ? '' : `--${directoryName}`}.json`;
-    }
-    async directory(create, action) {
-        const stateDir = resolve(this.state.config.stateDir);
-        const directory = join(stateDir, 'direct-git');
-        if (!create && !(await lstat(directory).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        })))
-            return undefined;
-        const root = await realpath(this.state.config.workspaceRoot);
-        if (this.state.config.stateDir !== stateDir || await realpath(stateDir) !== stateDir || stateDir === root || stateDir.startsWith(`${root}${sep}`)) {
-            throw new Error('git_control_directory_rejected');
-        }
-        for (const path of [stateDir, directory]) {
-            if (path === directory && create)
-                await mkdir(path, { mode: 0o700 }).catch(error => {
-                    if (error.code !== 'EEXIST')
-                        throw error;
-                });
-            const stat = await lstat(path);
-            if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.() || (stat.mode & 0o077) !== 0) {
-                throw new Error('git_control_directory_rejected');
-            }
-        }
-        const handle = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-        try {
-            const pinned = process.platform === 'linux' ? `/proc/self/fd/${handle.fd}` : directory;
-            return await action(pinned);
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async read(path) {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!handle)
-            return undefined;
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile() || stat.uid !== process.getuid?.() || (stat.mode & 0o777) !== 0o600 || stat.nlink !== 1 || stat.size > 16384) {
-                throw new Error('git_credential_file_rejected');
-            }
-            return JSON.parse(await handle.readFile('utf8'));
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    async get(binding, directoryName = 'basic') {
-        return this.directory(false, async (path) => {
-            const stored = await this.read(join(path, this.name(binding.workspaceId, directoryName)));
-            if (!stored)
-                return undefined;
-            if (stored.identity !== this.identity() || !sameWorkspaceRegistration(stored.binding, binding)
-                || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                throw new Error('git_access_denied');
-            if (stored.access !== null) {
-                const access = workspaceGitDirectAccessSchema.parse(stored.access);
-                if (access.repositoryUrl !== binding.repositoryUrl)
-                    throw new Error('git_access_denied');
-            }
-            return stored;
-        });
-    }
-    async put(binding, access, rejectedPassword, directoryName = 'basic') {
-        if (!isLocalWorkspaceGitEnvironment(this.state.config.environment) || this.state.journal.destroyed())
-            throw new Error('git_access_denied');
-        if (access && (workspaceGitDirectAccessSchema.parse(access).repositoryUrl !== binding.repositoryUrl))
-            throw new Error('git_access_denied');
-        await this.exclusive(() => this.directory(true, async (path) => {
-            const target = join(path, this.name(binding.workspaceId, directoryName));
-            // Refuse symlink/hardlink/permissive old files even though rename would replace them.
-            const old = await this.read(target);
-            if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
-                return;
-            const temporary = join(path, `${randomUUID()}.tmp`);
-            const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
-            try {
-                await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));
-                await handle.sync();
-                await handle.close();
-                if (this.state.journal.destroyed())
-                    throw new Error('git_access_denied');
-                await rename(temporary, target);
-                const dir = await open(path, constants.O_RDONLY | constants.O_DIRECTORY);
-                try {
-                    await dir.sync();
-                }
-                finally {
-                    await dir.close();
-                }
-            }
-            finally {
-                await handle.close();
-                await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
-                    throw error; });
-            }
-        }));
-    }
-    async remove(workspaceId, directoryName = 'basic') {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            const target = join(path, this.name(workspaceId, directoryName));
-            await this.read(target);
-            await unlink(target).catch(error => { if (error.code !== 'ENOENT')
-                throw error; });
-        }));
-    }
-    async sweep(destroy = false) {
-        await this.exclusive(() => this.directory(false, async (path) => {
-            for (const name of await readdir(path)) {
-                if (!/^[a-f0-9-]{36}(?:--remix-[a-z0-9][a-z0-9-]{3,63})?\.(json|tmp)$/.test(name))
-                    throw new Error('git_credential_file_rejected');
-                const target = join(path, name);
-                if (name.endsWith('.tmp')) {
-                    await unlink(target);
-                    continue;
-                }
-                const stored = await this.read(target);
-                if (destroy || stored?.identity !== this.identity() || !isLocalWorkspaceGitEnvironment(this.state.config.environment))
-                    await unlink(target);
-            }
-        }));
-    }
-}