@playcraft/cli 0.1.42 → 0.1.44-beta

package/dist/workspace-runtime/batch/records.js

@@ -0,0 +1,113 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readFile, readdir, rename, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { batchSourceSnapshotRefSchema, sandboxBatchMemberStatusSchema, } from '@playcraft/common/cloud-workspace/runtime';
+const runs = new Map();
+let freezeChain = Promise.resolve();
+export function serializeFreeze(action) {
+    const run = freezeChain.then(action, action);
+    freezeChain = run.then(() => undefined, () => undefined);
+    return run;
+}
+export function serializeRun(runId, action) {
+    const previous = runs.get(runId) ?? Promise.resolve();
+    const run = previous.then(action, action);
+    runs.set(runId, run.then(() => undefined, () => undefined));
+    return run;
+}
+export function snapshotFile(state, batchId) {
+    return join(state.config.stateDir, 'batch-sources', `${batchId}.json`);
+}
+export function memberFile(state, runId) {
+    return join(state.config.stateDir, 'batch-members', `${runId}.json`);
+}
+export function stopMarkerFile(state, runId) {
+    return join(state.config.stateDir, 'batch-stops', `${runId}.json`);
+}
+export function sourceCacheDir(state, batchId) {
+    return join(state.config.stateDir, 'batch-source-cache', batchId);
+}
+export function objectFile(state, key) {
+    if (key.split('/').some(part => !part || part === '.' || part === '..'))
+        throw new Error('batch_object_key_invalid');
+    return join(state.config.stateDir, 'batch-objects', key);
+}
+async function writeAtomic(path, body) {
+    await mkdir(join(path, '..'), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    await writeFile(temporary, body, { mode: 0o600 });
+    await rename(temporary, path);
+}
+async function readJson(path) {
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    }
+}
+export async function readSnapshot(state, batchId) {
+    const value = await readJson(snapshotFile(state, batchId));
+    return value ? batchSourceSnapshotRefSchema.parse(value) : undefined;
+}
+export async function writeSnapshot(state, snapshot) {
+    const parsed = batchSourceSnapshotRefSchema.parse(snapshot);
+    await writeAtomic(snapshotFile(state, parsed.batchId), JSON.stringify(parsed));
+}
+export async function readMember(state, runId) {
+    return readJson(memberFile(state, runId));
+}
+export async function writeMember(state, record) {
+    const next = { ...record, updatedAt: new Date().toISOString() };
+    await writeAtomic(memberFile(state, record.runId), JSON.stringify(next));
+    return next;
+}
+export async function listMembers(state) {
+    const directory = join(state.config.stateDir, 'batch-members');
+    const names = await readdir(directory).catch(error => {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    });
+    const records = [];
+    for (const name of names) {
+        if (!name.endsWith('.json'))
+            continue;
+        const record = await readJson(join(directory, name));
+        if (record)
+            records.push(record);
+    }
+    return records;
+}
+export async function readStopMarker(state, runId) {
+    return readJson(stopMarkerFile(state, runId));
+}
+export async function writeStopMarker(state, runId, ownerFence) {
+    const path = stopMarkerFile(state, runId);
+    if (await readStopMarker(state, runId))
+        return;
+    await writeAtomic(path, JSON.stringify({ runId, ownerFence, at: new Date().toISOString() }));
+}
+export function memberStatus(record) {
+    return sandboxBatchMemberStatusSchema.parse({
+        runId: record.runId,
+        ownerFence: record.ownerFence,
+        phase: record.phase,
+        state: record.state,
+        writersStopped: record.writersStopped,
+        ...(record.sessionId ? { sessionId: record.sessionId } : {}),
+        ...(record.operationId ? { operationId: record.operationId } : {}),
+        ...(record.headCommit ? { headCommit: record.headCommit } : {}),
+        ...(record.evidence ? { evidence: record.evidence } : {}),
+        ...(record.error ? { error: record.error.slice(0, 128) } : {}),
+        updatedAt: record.updatedAt,
+    });
+}
+export function filesystemObjectStore(state) {
+    return {
+        async put(key, body) { await writeAtomic(objectFile(state, key), body); },
+        async get(key) { return readFile(objectFile(state, key)); },
+    };
+}

package/dist/workspace-runtime/batch/routes.js

@@ -0,0 +1,58 @@
+import { batchSourceFreezeResultSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { stopBatchMember, readBatchMemberStatus } from './control.js';
+import { deliverBatchMember } from './deliver.js';
+import { freezeBatchSource } from './freeze.js';
+import { generateBatchMember } from './generate.js';
+import { prepareBatchMember } from './prepare.js';
+const CLIENT_ERRORS = new Set([
+    'occupancy_required', 'invalid_batch_request', 'batch_branch_invalid', 'stale_owner', 'disk_admission_paused',
+    'batch_source_push_failed', 'batch_source_upload_failed', 'batch_source_changed', 'batch_source_path_invalid',
+    'batch_command_conflict', 'batch_snapshot_mismatch', 'batch_commit_mismatch', 'workspace_not_registered',
+    'disk_usage_unavailable', 'batch_object_key_invalid',
+]);
+async function readBody(request) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of request) {
+        size += chunk.length;
+        if (size > 1024 * 1024)
+            throw new Error('request_body_too_large');
+        chunks.push(Buffer.from(chunk));
+    }
+    if (!size)
+        return {};
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+}
+export async function dispatchBatchRoute(state, request, url) {
+    const method = request.method ?? 'GET';
+    const path = url.pathname;
+    const member = /^\/runtime\/batch-members\/([^/]+)(?:\/(stop))?$/.exec(path);
+    if (method === 'GET' && member && !member[2]) {
+        const status = await readBatchMemberStatus(state, decodeURIComponent(member[1]));
+        return status ? { status: 200, body: status } : { status: 404, body: { error: 'batch_member_not_found' } };
+    }
+    if (method !== 'POST')
+        return undefined;
+    try {
+        if (path === '/runtime/batch-sources/freeze') {
+            const result = batchSourceFreezeResultSchema.parse(await freezeBatchSource(state, await readBody(request)));
+            return { status: 200, body: result };
+        }
+        if (path === '/runtime/batch-members/prepare')
+            return { status: 200, body: await prepareBatchMember(state, await readBody(request)) };
+        if (path === '/runtime/batch-members/generate')
+            return { status: 200, body: await generateBatchMember(state, await readBody(request)) };
+        if (path === '/runtime/batch-members/deliver')
+            return { status: 200, body: await deliverBatchMember(state, await readBody(request)) };
+        if (member?.[2] === 'stop')
+            return { status: 200, body: await stopBatchMember(state, decodeURIComponent(member[1]), await readBody(request)) };
+        return undefined;
+    }
+    catch (error) {
+        const code = error instanceof Error && CLIENT_ERRORS.has(error.message) ? error.message : undefined;
+        if (!code)
+            throw error;
+        const status = code === 'occupancy_required' || code === 'invalid_batch_request' || code === 'batch_branch_invalid' ? 400 : 409;
+        return { status, body: { error: code } };
+    }
+}

package/dist/workspace-runtime/batch/source-capture.js

@@ -0,0 +1,159 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { gzip, gunzip } from 'node:zlib';
+import { promisify } from 'node:util';
+import { excludeFromGit } from '../workspaces/dependencies.js';
+import { gitRead, gitWrite } from './git.js';
+const compress = promisify(gzip);
+const decompress = promisify(gunzip);
+const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
+    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
+    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
+function included(path) {
+    return !path.split('/').some(name => privateNames.has(name) || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name))
+        && !path.startsWith('.playcraft/skills/');
+}
+/** Git keeps only the executable bit, so the digest must not depend on umask or group-write bits. */
+function snapshotMode(mode) {
+    return mode & 0o111 ? 0o755 : 0o644;
+}
+function inside(root, path) {
+    const rel = relative(root, path);
+    return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel);
+}
+export function digestFiles(files) {
+    const hash = createHash('sha256');
+    for (const [path, file] of files)
+        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
+    return hash.digest('hex');
+}
+/** Working tree plus exact skill artifacts. Credentials, caches and node_modules are left out. */
+export async function readSourceFiles(root) {
+    const source = await realpath(root);
+    const paths = new Set((await gitRead(source, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'])).split('\0').filter(Boolean));
+    const artifacts = await readdir(join(source, '.playcraft/skill-artifacts')).catch(error => {
+        if (error.code === 'ENOENT')
+            return [];
+        throw error;
+    });
+    for (const name of artifacts)
+        if (/^[a-f0-9]{64}\.tar\.gz$/.test(name))
+            paths.add(`.playcraft/skill-artifacts/${name}`);
+    const files = new Map();
+    for (const path of [...paths].sort()) {
+        if (!included(path))
+            continue;
+        const full = join(source, path);
+        const stat = await lstat(full).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!stat)
+            continue;
+        if (!stat.isFile() || stat.isSymbolicLink() || !inside(source, await realpath(full)))
+            throw new Error('batch_source_path_invalid');
+        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const body = await handle.readFile();
+            if (/^\.playcraft\/skill-artifacts\/[a-f0-9]{64}\.tar\.gz$/.test(path)
+                && createHash('sha256').update(body).digest('hex') !== path.slice(path.lastIndexOf('/') + 1, -7)) {
+                throw new Error('batch_source_path_invalid');
+            }
+            files.set(path, { body, mode: snapshotMode(stat.mode) });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return files;
+}
+/**
+ * Drops paths whose bytes change between two reads. A managed writer that could not be stopped
+ * does not become part of the frozen input.
+ */
+export async function filterUnstableFiles(root, files) {
+    const again = await readSourceFiles(root);
+    const stable = new Map();
+    for (const [path, file] of files) {
+        const next = again.get(path);
+        if (next && next.body.equals(file.body) && next.mode === file.mode)
+            stable.set(path, file);
+    }
+    return stable;
+}
+/** Independent root commit. The source branch, index and config are never written. */
+export async function captureIndependentSource(source, destination) {
+    const root = await realpath(source);
+    if (await lstat(destination).catch(() => undefined))
+        throw new Error('batch_source_destination_exists');
+    const headBefore = await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => '');
+    let files = await readSourceFiles(root);
+    files = await filterUnstableFiles(root, files);
+    const digest = digestFiles(files);
+    const staging = join(dirname(destination), `.batch-source-${randomUUID()}`);
+    try {
+        await mkdir(staging, { recursive: true });
+        await gitWrite(staging, ['init', '--initial-branch', 'source']);
+        await gitWrite(staging, ['config', 'user.name', 'PlayCraft']);
+        await gitWrite(staging, ['config', 'user.email', 'playcraft@localhost']);
+        for (const [path, file] of files) {
+            const full = join(staging, path);
+            await mkdir(dirname(full), { recursive: true });
+            await writeFile(full, file.body, { mode: file.mode, flag: 'wx' });
+        }
+        if (headBefore !== await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => ''))
+            throw new Error('batch_source_changed');
+        const after = await filterUnstableFiles(root, await readSourceFiles(root));
+        if (digestFiles(after) !== digest)
+            throw new Error('batch_source_changed');
+        await excludeFromGit(staging);
+        await excludeFromGit(staging, '/.env*');
+        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skills/', '/.playcraft-temp/'])
+            await excludeFromGit(staging, entry);
+        await gitWrite(staging, ['add', '-A', '.']);
+        await gitWrite(staging, ['commit', '--allow-empty', '-m', 'Freeze batch source']);
+        const commitHash = (await gitWrite(staging, ['rev-parse', 'HEAD'])).trim();
+        await rename(staging, destination);
+        return { commitHash, digest };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+export async function archiveSource(root, meta) {
+    const bundle = join(dirname(root), `.bundle-${randomUUID()}`);
+    try {
+        await gitWrite(root, ['bundle', 'create', bundle, 'HEAD']);
+        const body = JSON.stringify({ version: 1, ...meta, bundle: (await readFile(bundle)).toString('base64') });
+        return await compress(Buffer.from(body));
+    }
+    finally {
+        await rm(bundle, { force: true });
+    }
+}
+export async function restoreArchive(body, destination, expectedDigest) {
+    const archive = JSON.parse((await decompress(body, { maxOutputLength: 512 * 1024 * 1024 })).toString());
+    if (archive.version !== 1 || archive.digest !== expectedDigest || !archive.commitHash || !archive.bundle)
+        throw new Error('batch_snapshot_mismatch');
+    const temporary = join(dirname(destination), `.bundle-${randomUUID()}`);
+    await mkdir(temporary, { recursive: true });
+    try {
+        const bundle = join(temporary, 'source.bundle');
+        await writeFile(bundle, Buffer.from(archive.bundle, 'base64'), { mode: 0o600 });
+        await gitWrite(temporary, ['clone', '--no-checkout', '--', bundle, destination]);
+        await gitWrite(destination, ['checkout', '--detach', archive.commitHash]);
+        if (digestFiles(await readSourceFiles(destination)) !== expectedDigest)
+            throw new Error('batch_snapshot_mismatch');
+        return { commitHash: archive.commitHash };
+    }
+    catch (error) {
+        await rm(destination, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}