@playcraft/cli 0.1.41-prod → 0.1.43-beta

package/dist/workspace-runtime/workspaces/disk-snapshot.js

@@ -0,0 +1,31 @@
+import { createHash } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES } from '@playcraft/common/cloud-workspace/runtime';
+export async function sampleDiskFile(path) {
+    const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const before = await handle.stat();
+        if (!before.isFile() || before.size > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
+            throw new Error('snapshot_body_missing');
+        const digest = createHash('sha256');
+        const chunk = Buffer.allocUnsafe(64 * 1024);
+        let position = 0;
+        for (;;) {
+            const { bytesRead } = await handle.read(chunk, 0, chunk.length, position);
+            if (!bytesRead)
+                break;
+            digest.update(chunk.subarray(0, bytesRead));
+            position += bytesRead;
+            if (position > WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES)
+                throw new Error('snapshot_body_missing');
+        }
+        const after = await handle.stat();
+        if (before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs || position !== before.size)
+            throw new Error('snapshot_body_missing');
+        return { hash: digest.digest('hex'), size: position, mode: before.mode & 0o777, modifiedAt: before.mtime.toISOString() };
+    }
+    finally {
+        await handle.close();
+    }
+}

package/dist/workspace-runtime/workspaces/empty-template.js

@@ -0,0 +1,42 @@
+import { cp, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { resolveCliPackageRoot } from '../../scaffold/compose.js';
+import { importBuiltinProjectSkills } from '../../project-skills/builtin-import.js';
+import { createHash } from 'node:crypto';
+import { canonicalProjectSkillsJson } from '@playcraft/common/project-skills';
+import { syncLocalProjectSkills } from '../../project-skills/local-store.js';
+import { selectOptionalPlatformSkills } from './optional-platform-skills.js';
+export const EMPTY_WORKSPACE_REPOSITORY_SKILLS = [
+    'playcraft-skill-recommender',
+    'playcraft-image-generation',
+    'playcraft-audio-generation',
+    'playcraft-image-processing',
+    'playcraft-build-optimizer',
+];
+export const EMPTY_WORKSPACE_PLATFORM_SKILLS = ['playcraft-video-understanding', 'playcraft-replica-validation'];
+export const EMPTY_WORKSPACE_DEFAULT_SKILLS = [...EMPTY_WORKSPACE_REPOSITORY_SKILLS, ...EMPTY_WORKSPACE_PLATFORM_SKILLS];
+/** Only called in a new, unpublished staging directory; existing workspaces are never scaffolded. */
+export async function scaffoldEmptyWorkspace(root, skillCache, access) {
+    const selected = await selectOptionalPlatformSkills([...EMPTY_WORKSPACE_PLATFORM_SKILLS], access);
+    const cliRoot = resolveCliPackageRoot();
+    const template = join(cliRoot, 'project-templates', 'empty');
+    for (const [source, target] of [
+        ['gitignore', '.gitignore'],
+        ['AGENTS.md', 'AGENTS.md'],
+    ]) {
+        await cp(join(template, source), join(root, target), { force: false, errorOnExist: true });
+    }
+    const skills = join(root, '.agents', 'skills');
+    await mkdir(skills, { recursive: true });
+    for (const name of EMPTY_WORKSPACE_REPOSITORY_SKILLS) {
+        await cp(join(cliRoot, 'project-template', '.claude', 'skills', name), join(skills, name), {
+            recursive: true,
+            force: false,
+            errorOnExist: true,
+        });
+    }
+    const snapshot = await syncLocalProjectSkills(root, skillCache);
+    if (selected)
+        await importBuiltinProjectSkills(root, { names: [...EMPTY_WORKSPACE_PLATFORM_SKILLS], expectedDeclarationHash: snapshot.lock.declarationHash,
+            expectedLockHash: createHash('sha256').update(canonicalProjectSkillsJson(snapshot.lock)).digest('hex') }, skillCache, access, selected, true);
+}

package/dist/workspace-runtime/workspaces/file-content.js

@@ -0,0 +1,48 @@
+import { constants } from 'node:fs';
+import { lstat, open } from 'node:fs/promises';
+import { basename, extname } from 'node:path';
+import { workspaceRelativePathSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { artifactMime, artifactPath } from './artifact-files.js';
+import { serveOpenedWorkspaceContent } from './binary-content.js';
+import { InvalidWorkspacePathError, resolveWorkspaceFile } from './files.js';
+const additionalMediaTypes = {
+    '.aac': 'audio/aac', '.opus': 'audio/ogg', '.oga': 'audio/ogg', '.aif': 'audio/aiff', '.aiff': 'audio/aiff',
+    '.bmp': 'image/bmp', '.ico': 'image/vnd.microsoft.icon', '.heic': 'image/heic', '.heif': 'image/heif',
+    '.tif': 'image/tiff', '.tiff': 'image/tiff',
+};
+export async function serveWorkspaceFileContent(root, path, request, response) {
+    let handle;
+    let size;
+    try {
+        if (!workspaceRelativePathSchema.safeParse(path).success)
+            throw new InvalidWorkspacePathError(path);
+        // Check every component before resolving, so missing files cannot create parent directories.
+        await artifactPath(root, path);
+        const target = await resolveWorkspaceFile(root, path);
+        handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1)
+            throw new Error('file_not_found');
+        // Bind the open handle to the authorized file even if a parent changed during open.
+        const verified = await artifactPath(root, path);
+        const current = await lstat(verified);
+        if (!current.isFile() || current.nlink !== 1 || current.dev !== stat.dev || current.ino !== stat.ino)
+            throw new InvalidWorkspacePathError(path);
+        size = stat.size;
+    }
+    catch (error) {
+        await handle?.close();
+        const code = error?.code;
+        const invalid = error instanceof InvalidWorkspacePathError || (error instanceof Error && error.message === 'invalid_artifact_path');
+        const denied = code === 'EACCES' || code === 'EPERM';
+        response.writeHead(invalid ? 400 : denied ? 403 : 404, { 'content-type': 'application/json', 'cache-control': 'no-store' });
+        response.end(JSON.stringify({ error: invalid ? 'invalid_workspace_path' : denied ? 'workspace_permission_denied' : 'file_not_found' }));
+        return;
+    }
+    await serveOpenedWorkspaceContent({
+        handle,
+        name: basename(path),
+        mimeType: additionalMediaTypes[extname(path).toLowerCase()] ?? artifactMime(path),
+        size,
+    }, request, response);
+}

package/dist/workspace-runtime/workspaces/files-search.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import { lstat, opendir, realpath } from 'node:fs/promises';
+import { join, relative, sep } from 'node:path';
+import { workspaceFileSearchQuerySchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
+const SKIP_DIRECTORIES = new Set(['.git', 'node_modules', '.playcraft', '.next', 'dist', 'build', 'coverage', '.turbo']);
+const SCAN_PAGE_ENTRIES = 1000;
+export class InvalidWorkspaceSearchError extends Error {
+    code;
+    constructor(code = 'invalid_workspace_search') {
+        super(code);
+        this.code = code;
+        this.name = 'InvalidWorkspaceSearchError';
+    }
+}
+/** Enumerates names only. The cursor is scoped to the resolved checkout and query, never to a caller supplied path. */
+export async function searchWorkspaceFiles(root, query, options = {}) {
+    const parsed = workspaceFileSearchQuerySchema.safeParse(query);
+    if (!parsed.success)
+        throw new InvalidWorkspaceSearchError();
+    options.signal?.throwIfAborted();
+    const rootReal = await realpath(root);
+    const needle = parsed.data.query.toLocaleLowerCase();
+    const scope = createHash('sha256').update(rootReal).update('\0').update(needle).digest('hex');
+    const start = decodeCursor(parsed.data.cursor, scope);
+    const files = [];
+    let offset = 0;
+    for await (const path of walk(rootReal, rootReal, options.signal)) {
+        options.signal?.throwIfAborted();
+        offset += 1;
+        if (offset <= start)
+            continue;
+        if (path && path.toLocaleLowerCase().includes(needle)) {
+            const target = join(rootReal, ...path.split('/'));
+            const info = await lstat(target).catch(ignoreUnavailable);
+            const targetReal = info?.isFile() && !info.isSymbolicLink() ? await realpath(target).catch(ignoreUnavailable) : undefined;
+            if (targetReal && inside(rootReal, targetReal))
+                files.push({ path });
+        }
+        if (files.length >= parsed.data.limit || offset - start >= SCAN_PAGE_ENTRIES) {
+            return { files, truncated: true, nextCursor: encodeCursor(scope, offset) };
+        }
+    }
+    return { files, truncated: false };
+}
+async function* walk(root, current, signal) {
+    signal?.throwIfAborted();
+    const currentInfo = await lstat(current).catch(ignoreUnavailable);
+    if (!currentInfo?.isDirectory() || currentInfo.isSymbolicLink())
+        return;
+    const resolved = await realpath(current).catch(ignoreUnavailable);
+    if (!resolved || !inside(root, resolved))
+        return;
+    const directory = await opendir(resolved).catch(ignoreUnavailable);
+    if (!directory)
+        return;
+    // Recheck after opening: a concurrently replaced directory must not reveal another checkout's paths.
+    const openedPath = await realpath(current).catch(ignoreUnavailable);
+    if (openedPath !== resolved || !inside(root, openedPath)) {
+        await directory.close();
+        return;
+    }
+    for await (const entry of directory) {
+        signal?.throwIfAborted();
+        if (['.git', 'node_modules', '.playcraft'].includes(entry.name)) {
+            yield undefined;
+            continue;
+        }
+        const child = join(resolved, entry.name);
+        const path = relative(root, child).split(sep).join('/');
+        if (!workspaceRelativePathSchema.safeParse(path).success) {
+            yield undefined;
+            continue;
+        }
+        if (entry.isDirectory()) {
+            yield undefined;
+            if (!SKIP_DIRECTORIES.has(entry.name))
+                yield* walk(root, child, signal);
+            continue;
+        }
+        if (!entry.isFile()) {
+            yield undefined;
+            continue;
+        }
+        yield path;
+    }
+}
+function inside(root, path) {
+    const value = relative(root, path);
+    return value === '' || (value !== '..' && !value.startsWith(`..${sep}`) && !value.startsWith(sep));
+}
+function ignoreUnavailable(error) {
+    if (['ENOENT', 'ENOTDIR', 'EACCES'].includes(error.code ?? ''))
+        return undefined;
+    throw error;
+}
+function encodeCursor(scope, offset) {
+    return Buffer.from(JSON.stringify({ v: 1, scope, offset })).toString('base64url');
+}
+function decodeCursor(cursor, scope) {
+    if (!cursor)
+        return 0;
+    try {
+        if (!/^[A-Za-z0-9_-]+$/.test(cursor))
+            throw new Error();
+        const value = JSON.parse(Buffer.from(cursor, 'base64url').toString('utf8'));
+        if (typeof value !== 'object' || value === null)
+            throw new Error();
+        const { v, scope: suppliedScope, offset } = value;
+        if (v !== 1 || suppliedScope !== scope || typeof offset !== 'number' || !Number.isSafeInteger(offset) || offset < 0)
+            throw new Error();
+        return offset;
+    }
+    catch {
+        throw new InvalidWorkspaceSearchError('invalid_workspace_search_cursor');
+    }
+}

package/dist/workspace-runtime/workspaces/files.js

@@ -0,0 +1,150 @@
+import { lstat, mkdir, readdir, readFile, realpath, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { hashWorkspaceFileContent, workspaceFileContentSchema, workspaceFileListSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { sampleDiskFile } from './disk-snapshot.js';
+const SKIP_DIRECTORY_NAMES = new Set(['.git', 'node_modules', '.playcraft-temp']);
+const LARGE_FILE_STREAM_THRESHOLD = 8 * 1024 * 1024;
+export class InvalidWorkspacePathError extends Error {
+    code = 'invalid_workspace_path';
+    constructor(path) {
+        super(path);
+        this.name = 'InvalidWorkspacePathError';
+    }
+}
+export async function ensureWorkspaceRoot(root) {
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    return realpath(root);
+}
+export async function resolveWorkspaceFile(root, relativePath) {
+    const parsed = workspaceRelativePathSchema.safeParse(relativePath);
+    if (!parsed.success)
+        throw new InvalidWorkspacePathError(relativePath);
+    const rootReal = await ensureWorkspaceRoot(root);
+    const target = resolve(rootReal, ...parsed.data.split('/'));
+    assertInsideRoot(rootReal, target);
+    try {
+        const existing = await realpath(target);
+        assertInsideRoot(rootReal, existing);
+        return existing;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        await assertParentInsideRoot(rootReal, dirname(target));
+        return target;
+    }
+}
+export async function writeWorkspaceFile(root, relativePath, content) {
+    const target = await resolveWorkspaceFile(root, relativePath);
+    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+    const bytes = Buffer.from(content, 'utf8');
+    await writeFile(target, bytes, { mode: 0o600 });
+    return { path: relativePath, contentHash: hashWorkspaceFileContent(content), size: bytes.byteLength };
+}
+export async function readWorkspaceFile(root, relativePath, revisions) {
+    const target = await resolveWorkspaceFile(root, relativePath);
+    const content = await readFile(target, 'utf8');
+    const contentHash = hashWorkspaceFileContent(content);
+    return workspaceFileContentSchema.parse({
+        path: relativePath,
+        revision: revisions[relativePath]?.revision ?? 0,
+        contentHash,
+        content,
+    });
+}
+export async function listWorkspaceFiles(root, revisions) {
+    const rootReal = await ensureWorkspaceRoot(root);
+    const files = [];
+    const directories = new Set();
+    const unreadablePaths = new Set();
+    for (const relativePath of await walkWorkspaceFiles(rootReal, rootReal, unreadablePaths, directories)) {
+        const target = join(rootReal, ...relativePath.split('/'));
+        try {
+            const stat = await lstat(target);
+            if (stat.size > LARGE_FILE_STREAM_THRESHOLD) {
+                const sampled = await sampleDiskFile(target);
+                files.push({ path: relativePath, revision: revisions[relativePath]?.revision ?? 0, contentHash: sampled.hash, size: sampled.size, modifiedAt: sampled.modifiedAt });
+                continue;
+            }
+            const content = await readFile(target);
+            const after = await lstat(target);
+            if (stat.ino !== after.ino || stat.size !== after.size || stat.mtimeMs !== after.mtimeMs || stat.ctimeMs !== after.ctimeMs || content.length !== after.size) {
+                const sampled = await sampleDiskFile(target);
+                files.push({ path: relativePath, revision: revisions[relativePath]?.revision ?? 0, contentHash: sampled.hash, size: sampled.size, modifiedAt: sampled.modifiedAt });
+                continue;
+            }
+            files.push({
+                path: relativePath,
+                revision: revisions[relativePath]?.revision ?? 0,
+                contentHash: createHash('sha256').update(content).digest('hex'),
+                size: content.byteLength,
+                modifiedAt: after.mtime.toISOString(),
+            });
+        }
+        catch (error) {
+            if (!isPermissionDenied(error))
+                throw error;
+            unreadablePaths.add(relativePath);
+        }
+    }
+    files.sort((left, right) => left.path.localeCompare(right.path));
+    return workspaceFileListSchema.parse({ files, directories: [...directories].sort(), ...(unreadablePaths.size ? { unreadablePaths: [...unreadablePaths].sort() } : {}) });
+}
+async function walkWorkspaceFiles(rootReal, current, unreadablePaths, directories) {
+    const entries = await readdir(current, { withFileTypes: true });
+    const paths = [];
+    for (const entry of entries) {
+        const child = join(current, entry.name);
+        try {
+            if (entry.isDirectory()) {
+                if (SKIP_DIRECTORY_NAMES.has(entry.name) || entry.name === '.' || entry.name === '..')
+                    continue;
+                const childReal = await realpath(child);
+                assertInsideRoot(rootReal, childReal);
+                const children = await walkWorkspaceFiles(rootReal, childReal, unreadablePaths, directories);
+                directories.add(toPosixRelative(rootReal, childReal));
+                paths.push(...children);
+                continue;
+            }
+            if (!entry.isFile() || entry.name === '.gitkeep')
+                continue;
+            const childReal = await realpath(child);
+            assertInsideRoot(rootReal, childReal);
+            paths.push(toPosixRelative(rootReal, childReal));
+        }
+        catch (error) {
+            if (!isPermissionDenied(error))
+                throw error;
+            unreadablePaths.add(toPosixRelative(rootReal, child));
+        }
+    }
+    return paths;
+}
+function isPermissionDenied(error) {
+    return ['EACCES', 'EPERM'].includes(String(error?.code));
+}
+async function assertParentInsideRoot(rootReal, parent) {
+    if (parent === rootReal)
+        return;
+    try {
+        const parentReal = await realpath(parent);
+        assertInsideRoot(rootReal, parentReal);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+        await mkdir(parent, { recursive: true, mode: 0o700 });
+        const parentReal = await realpath(parent);
+        assertInsideRoot(rootReal, parentReal);
+    }
+}
+function assertInsideRoot(rootReal, target) {
+    const rel = relative(rootReal, target);
+    if (rel === '' || rel.startsWith(`..${sep}`) || rel === '..' || rel.startsWith('..')) {
+        throw new InvalidWorkspacePathError(target);
+    }
+}
+function toPosixRelative(rootReal, target) {
+    return relative(rootReal, target).split(sep).join('/');
+}