@playcraft/cli 0.1.42 → 0.1.44-beta

package/dist/workspace-runtime/production/storage.js

@@ -0,0 +1,75 @@
+const taskUrl = (input) => `${input.callbackUrl.replace(/\/+$/, '')}/internal/cloud-production/tasks/${input.task.taskId}`;
+async function objectFailure(response, input, operation) {
+    const value = await response.json().catch(() => undefined);
+    const body = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const reason = [body.reason, body.code, body.message, body.error]
+        .find((value) => typeof value === 'string' && /^[a-z0-9_]{1,128}$/.test(value)
+        && !value.includes(input.runnerToken));
+    // Keep callback status and machine codes; never record its URL, headers, or response body.
+    try {
+        console.error(JSON.stringify({ event: 'production.object_transfer_failed', taskId: input.task.taskId,
+            attemptId: input.task.attemptId, workspaceId: input.task.workspaceId, directoryName: input.directoryName,
+            stage: input.stage, leaseFence: input.lease.fence, operation, status: response.status, reason }));
+    }
+    catch { /* Diagnostics must preserve the original failure. */ }
+    return new Error(operation === 'get'
+        ? response.status === 404 ? 'object_missing' : 'object_get_failed'
+        : response.status === 409 ? 'object_conflict' : 'object_put_failed');
+}
+/** Build output travels through the Runtime that leased the task; engineering files travel through Git. */
+export function productionOutputStore(input) {
+    const object = (key) => `${taskUrl(input)}/objects/${key.split('/').map(encodeURIComponent).join('/')}`;
+    const headers = { authorization: `Bearer ${input.runnerToken}`, 'x-playcraft-object-client': 'cli' };
+    return {
+        async get(key) {
+            const response = await fetch(object(key), { headers, redirect: 'error', signal: AbortSignal.timeout(60_000) });
+            if (!response.ok)
+                throw await objectFailure(response, input, 'get');
+            return Buffer.from(await response.arrayBuffer());
+        },
+        async put(key, body) {
+            const response = await fetch(object(key), { method: 'PUT', body: new Uint8Array(body), redirect: 'error', signal: AbortSignal.timeout(60_000),
+                headers: { ...headers, 'content-type': 'application/octet-stream' } });
+            if (!response.ok)
+                throw await objectFailure(response, input, 'put');
+        },
+    };
+}
+export async function verifyProductionLease(input) {
+    let status;
+    let reason;
+    try {
+        const response = await fetch(`${taskUrl(input)}/runner`, {
+            headers: { authorization: `Bearer ${input.runnerToken}` }, redirect: 'error', signal: AbortSignal.timeout(10_000),
+        });
+        status = response.status;
+        if (!response.ok) {
+            const value = await response.json().catch(() => undefined);
+            const body = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+            reason = [body.reason, body.code, body.message, body.error]
+                .find((value) => typeof value === 'string' && /^[a-z0-9_]{1,128}$/.test(value)
+                && !value.includes(input.runnerToken));
+            throw new Error('production_lease_unavailable');
+        }
+        reason = 'production_lease_invalid_response';
+        const { task } = await response.json();
+        if (!task || task.taskId !== input.task.taskId || task.attemptId !== input.task.attemptId || task.leaseOwner !== input.lease.owner || task.leaseFence !== input.lease.fence || task.status !== 'running' || task.cancelRequested) {
+            reason = 'production_lease_mismatch';
+            throw new Error('production_lease_unavailable');
+        }
+    }
+    catch (error) {
+        const cause = error instanceof Error ? error.cause : undefined;
+        const causeCode = cause && typeof cause === 'object' && 'code' in cause && typeof cause.code === 'string'
+            && /^[A-Za-z0-9_]{1,64}$/.test(cause.code) ? cause.code : undefined;
+        // Callback diagnostics retain machine codes only; responses and credentials stay private.
+        try {
+            console.error(JSON.stringify({ event: 'production.lease_verification_failed', taskId: input.task.taskId,
+                attemptId: input.task.attemptId, workspaceId: input.task.workspaceId, directoryName: input.directoryName,
+                stage: input.stage, leaseFence: input.lease.fence, status, reason,
+                errorType: error instanceof Error && /^[A-Za-z0-9_]{1,64}$/.test(error.name) ? error.name : 'UnknownError', causeCode }));
+        }
+        catch { /* Diagnostics must preserve the original failure. */ }
+        throw error;
+    }
+}

package/dist/workspace-runtime/serve.js

@@ -0,0 +1,283 @@
+import { closeCliCredentials } from './workspaces/cli-credentials.js';
+import { randomUUID } from 'node:crypto';
+import { mkdir, readdir } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import { INCOMPATIBLE_EXIT_CODE, negotiateProtocol, transitionOperation, } from '@playcraft/common/cloud-workspace/runtime';
+import { RuntimeJournal } from './persistence/journal.js';
+import { createCodexAppServerAdapter } from './codex/app-server.js';
+import { trustedMemberPolicy } from './batch/policy.js';
+import { createLoopbackNativeAdapter } from './codex/loopback.js';
+import { attachNativeCollector } from './server/dispatch.js';
+import { handleRuntimeRequest } from './server/http.js';
+import { desktopHost, disposeDesktopHost } from './server/desktop-host.js';
+import { disposeTerminalHost, terminalHost } from './server/terminal-host.js';
+import { handleExecutionGroupCrash } from './server/execution-group.js';
+import { RuntimeProcessLock } from './server/lock.js';
+import { probeGitBinary } from './workspaces/git.js';
+import { WorkspaceGitCredentialBroker } from './workspaces/git-credential-broker.js';
+import { WorkspaceModelBroker } from './codex/model-broker.js';
+import { recoverInterruptedPreviews } from './previews/publish.js';
+import { recoverInterruptedInstalls } from './workspaces/dependencies.js';
+import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.js';
+import { workspaceContextFromRoot, workspaceRoot } from './workspaces/registry.js';
+import { recoverInterruptedLibraryImports } from './workspaces/asset-library-import.js';
+import { observeWorkspaceBinaryFile } from './workspaces/binary-write.js';
+import { revisionScope } from './workspaces/registry.js';
+import { observeWorkspaceArtifacts } from './workspaces/artifact-events.js';
+import { loadWorkspaceMcpConfig } from './codex/mcp-config.js';
+import { startSourceEventUploader, stopSourceEventUploader } from './server/source-uploader.js';
+export async function startWorkspaceRuntime(config, options = {}) {
+    process.env.PLAYCRAFT_SKIP_UPDATE_CHECK = '1';
+    const negotiated = negotiateProtocol(config);
+    if (!negotiated.ok) {
+        const error = Object.assign(new Error('protocol_incompatible'), {
+            code: 'protocol_incompatible',
+            exitCode: INCOMPATIBLE_EXIT_CODE,
+        });
+        throw error;
+    }
+    const lock = new RuntimeProcessLock(config.stateDir);
+    lock.acquire();
+    let journal;
+    let gitCredentials;
+    let runtimeState;
+    try {
+        journal = new RuntimeJournal(config.stateDir);
+        await journal.load();
+        const previousEpoch = journal.storedRuntimeEpoch();
+        const previousGroup = journal.executionGroup();
+        const previousIdentityMatches = journal.epochsSnapshot().some((epoch) => epoch.runtime_id === config.runtimeId && epoch.generation === config.generation && epoch.runtime_epoch === previousEpoch);
+        await recoverInterruptedInstalls(journal);
+        await recoverInterruptedPreviews(journal);
+        await mkdir(config.workspaceRoot, { recursive: true, mode: 0o700 });
+        const state = runtimeState = {
+            config: { ...config, protocolMinor: negotiated.protocolMinor },
+            configPath: options.configPath,
+            journal,
+            acceptedLeaseFence: journal.acceptedLeaseFence(),
+            gitAvailable: await probeGitBinary(),
+            native: options.nativeAdapter,
+            runtimeEpoch: Math.max(config.runtimeEpoch, journal.storedRuntimeEpoch() ?? 0),
+            executionQueue: Promise.resolve(),
+            instanceToken: randomUUID(),
+        };
+        const recoveredImports = new Map();
+        const recoveredChanges = [];
+        const recoverLibraryImports = async (root) => {
+            const result = await recoverInterruptedLibraryImports(root).catch(() => undefined);
+            for (const published of result?.published ?? []) {
+                const previous = recoveredImports.get(published.operationId) ?? { paths: [], assetIds: [] };
+                recoveredImports.set(published.operationId, { paths: [...new Set([...previous.paths, ...published.paths])],
+                    assetIds: [...new Set([...previous.assetIds, published.assetId])] });
+            }
+        };
+        if (config.workspaceMode === 'multi') {
+            for (const entry of await readdir(config.workspaceRoot, { withFileTypes: true })) {
+                if (!entry.isDirectory())
+                    continue;
+                const binding = journal.getWorkspace(entry.name);
+                if (!binding)
+                    continue;
+                for (const directory of new Set(['basic', ...(binding.directories ?? []).map(item => item.directoryName)])) {
+                    const root = await workspaceRoot(state, binding.workspaceId, directory).catch(() => undefined);
+                    if (root)
+                        await recoverLibraryImports(root);
+                }
+            }
+        }
+        else
+            await recoverLibraryImports(config.workspaceRoot);
+        for (const { scopeKey, operation } of journal.listOperations()) {
+            if (operation.kind !== 'asset.library.import' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
+                continue;
+            const published = recoveredImports.get(operation.operationId);
+            const result = operation.result ? { ...operation.result,
+                paths: [...new Set([...operation.result.paths, ...(published?.paths ?? [])])],
+                failures: operation.result.failures.filter(failure => !published?.assetIds.includes(failure.assetId)),
+            } : undefined;
+            const root = await workspaceRoot(state, operation.workspaceId, operation.directoryName).catch(() => undefined);
+            if (root && result)
+                for (const path of result.paths) {
+                    const file = await observeWorkspaceBinaryFile(root, path).catch(() => undefined);
+                    if (!file)
+                        continue;
+                    const scope = revisionScope(state, operation.workspaceId, operation.directoryName);
+                    const previous = journal.fileRevisions(scope)[path];
+                    await journal.putFileRevision(path, { revision: (previous?.revision ?? 0) + 1, contentHash: file.contentHash }, scope);
+                }
+            let next = operation;
+            if (result && !result.failures.length) {
+                if (next.status === 'queued')
+                    next = transitionOperation(next, 'dispatched');
+                if (next.status === 'dispatched')
+                    next = transitionOperation(next, 'accepted');
+                next = transitionOperation(next, 'completed', { result });
+            }
+            else
+                next = transitionOperation(next, 'failed', { error: 'asset_library_import_interrupted', ...(result ? { result } : {}) });
+            await journal.putOperation(scopeKey, next);
+            if (operation.workspaceId && result?.paths.length)
+                recoveredChanges.push({ workspaceId: operation.workspaceId,
+                    directoryName: operation.directoryName ?? 'basic', paths: result.paths });
+        }
+        const native = state.native ??= defaultNativeAdapter(state);
+        await journal.bindRuntime({
+            runtimeId: config.runtimeId,
+            generation: config.generation,
+            runtimeEpoch: state.runtimeEpoch,
+        });
+        for (const change of recoveredChanges)
+            await journal.allocateSourceEvent({ runtimeId: config.runtimeId,
+                generation: config.generation, runtimeEpoch: state.runtimeEpoch, workspaceId: change.workspaceId,
+                type: 'files.changed', occurredAt: new Date().toISOString(), payload: { ...change, source: 'asset.library.import', recovered: true },
+            });
+        startSourceEventUploader(state);
+        if (config.workspaceMode === 'multi') {
+            gitCredentials = state.gitCredentials = new WorkspaceGitCredentialBroker(state);
+            await gitCredentials.start();
+        }
+        const stopArtifactObserver = observeWorkspaceArtifacts(state);
+        attachNativeCollector(state);
+        native?.onUnexpectedExit?.((event) => {
+            void handleExecutionGroupCrash(state, event.pid);
+        });
+        try {
+            await native?.start?.();
+            const group = native?.executionProcess?.();
+            if (group) {
+                let previousStopped = false;
+                if (previousGroup.pid && previousGroup.pid !== group.pid) {
+                    try {
+                        process.kill(previousGroup.pid, 0);
+                    }
+                    catch (error) {
+                        previousStopped = error.code === 'ESRCH';
+                    }
+                }
+                // The supervisor advances the trusted config epoch only after stopping the old
+                // native group. Reconfirm its recorded PID before publishing that replacement.
+                if (previousIdentityMatches && previousEpoch !== undefined && config.runtimeEpoch > previousEpoch && previousStopped) {
+                    await journal.writeExecutionEpoch({
+                        runtimeEpoch: state.runtimeEpoch, ...group, previousPid: previousGroup.pid, previousRuntimeEpoch: previousEpoch, stopConfirmed: true,
+                    });
+                    await journal.replaceSessions(journal.listSessions().map((session) => ({ ...session, recoverability: 'history_only' })));
+                }
+                else {
+                    await journal.noteExecutionGroup(group);
+                }
+            }
+        }
+        catch (error) {
+            const code = error instanceof Error ? error.message : '';
+            state.nativeError = code === 'codex_model_catalog_unavailable' ? code : 'codex_start_failed';
+            console.error(`[workspace-runtime] ${state.nativeError}`);
+        }
+        const server = createServer((request, response) => {
+            void handleRuntimeRequest(state, request, response);
+        });
+        server.on('upgrade', (request, socket, head) => {
+            const pathname = new URL(request.url ?? '/', 'http://127.0.0.1').pathname;
+            if (/^\/runtime\/terminals\/[^/]+\/connect$/.test(pathname)) {
+                void terminalHost(state).handleUpgrade(request, socket, head);
+                return;
+            }
+            if (pathname === '/runtime/desktop/connect') {
+                desktopHost(state).handleUpgrade(request, socket, head);
+                return;
+            }
+            socket.destroy();
+        });
+        const port = await listenOn(server, config.listen.host, config.listen.port);
+        return {
+            config: state.config,
+            state,
+            url: `http://${formatHost(config.listen.host)}:${port}`,
+            async close() {
+                const serverClosed = closeServer(server);
+                await closeCliCredentials(state);
+                await gitCredentials?.close();
+                try {
+                    await disposeDesktopHost(state);
+                }
+                finally {
+                    disposeTerminalHost(state);
+                    try {
+                        await native?.close?.();
+                    }
+                    catch {
+                        /* adapter shutdown is best-effort */
+                    }
+                    await serverClosed;
+                    await stopArtifactObserver();
+                    stopSourceEventUploader(state);
+                    await journal?.close();
+                    lock.release();
+                }
+            },
+        };
+    }
+    catch (error) {
+        if (runtimeState)
+            stopSourceEventUploader(runtimeState);
+        await gitCredentials?.close().catch(() => undefined);
+        await journal?.close().catch(() => undefined);
+        lock.release();
+        throw error;
+    }
+}
+function listenOn(server, host, port) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => reject(error);
+        server.once('error', onError);
+        server.listen(port, host, () => {
+            server.removeListener('error', onError);
+            const address = server.address();
+            if (!address || typeof address === 'string') {
+                reject(new Error('listen_failed'));
+                return;
+            }
+            resolve(address.port);
+        });
+    });
+}
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error)
+                reject(error);
+            else
+                resolve();
+        });
+    });
+}
+function formatHost(host) {
+    return host.includes(':') ? `[${host}]` : host;
+}
+function defaultNativeAdapter(state) {
+    const config = state.config;
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'loopback')
+        return createLoopbackNativeAdapter();
+    const hasLauncher = Boolean(process.env.PLAYCRAFT_LAUNCHER_SOCKET);
+    const multi = config.workspaceMode === 'multi';
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' && !multi && !hasLauncher) {
+        throw new Error('codex_requires_managed_launcher');
+    }
+    if (process.env.PLAYCRAFT_NATIVE_ADAPTER === 'codex' || (multi && hasLauncher)) {
+        return createCodexAppServerAdapter({
+            config,
+            workspaceUi: true,
+            ...(multi ? { modelBroker: new WorkspaceModelBroker(state) } : {}),
+            ...(multi ? { loadMcpConfig: async (cwd) => {
+                    const { workspaceId } = await workspaceContextFromRoot(state, cwd);
+                    return loadWorkspaceMcpConfig(state, workspaceId);
+                } } : {}),
+            loadSkillArtifact: async (cwd, entry) => {
+                const { workspaceId, directoryName } = await workspaceContextFromRoot(state, cwd);
+                return loadWorkspaceSkillArtifact(state, workspaceId, entry, directoryName === 'root' ? 'basic' : directoryName);
+            },
+            onSkillProcessRestart: process => state.journal.noteExecutionGroup(process),
+            trustedExecution: sessionId => trustedMemberPolicy(state, sessionId),
+        });
+    }
+    return undefined;
+}

package/dist/workspace-runtime/server/auth.js

@@ -0,0 +1,21 @@
+import { timingSafeEqual } from 'node:crypto';
+export function extractControlToken(headers) {
+    const authorization = headerValue(headers.authorization);
+    if (authorization?.startsWith('Bearer ')) {
+        return authorization.slice('Bearer '.length).trim() || null;
+    }
+    const dedicated = headerValue(headers['x-playcraft-control-token']);
+    return dedicated?.trim() || null;
+}
+export function controlTokenMatches(expected, actual) {
+    if (!actual)
+        return false;
+    const left = Buffer.from(expected);
+    const right = Buffer.from(actual);
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function headerValue(value) {
+    return Array.isArray(value) ? value[0] : value;
+}

package/dist/workspace-runtime/server/connectivity.js

@@ -0,0 +1,209 @@
+import { randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { PLATFORM_ROUTES, modelConnectivityPath, platformEndpoint, } from '@playcraft/common/cloud-workspace/runtime';
+const PROBE_TIMEOUT_MS = 4_000;
+// Issuance performs current authority reads and signing, rather than an endpoint echo.
+const CREDENTIAL_TIMEOUT_MS = 10_000;
+const CACHE_MS = 15_000;
+const CREDENTIAL_RENEW_BEFORE_MS = 30_000;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const credentialSchema = z.object({
+    token: z.string().min(1), expiresAt: z.string().datetime(),
+    configId: z.string().uuid(), model: z.string().min(1).max(128),
+    claims: z.object({
+        environment: z.string(), userId: z.string(), workspaceId: z.string(), runtimeId: z.string(),
+        generation: z.number().int(), runtimeEpoch: z.number().int(),
+    }),
+});
+const caches = new WeakMap();
+const ready = () => ({ status: 'ready' });
+const unavailable = (reason) => ({ status: 'unavailable', reason });
+function snapshot(state, workspaceId) {
+    let nativeReady = false;
+    try {
+        nativeReady = Boolean(state.native?.ready());
+    }
+    catch { /* A failed adapter stays unavailable. */ }
+    const { publicBaseUrl, controlToken, environment, userId, runtimeId, generation } = state.config;
+    return { publicBaseUrl, controlToken, environment, userId, runtimeId, generation,
+        runtimeEpoch: state.runtimeEpoch, workspaceId, nativeReady, destroyed: state.journal.destroyed(),
+        registered: state.config.workspaceMode !== 'multi' || Boolean(state.journal.getWorkspace(workspaceId)) };
+}
+function safeEndpoint(value) {
+    const url = new URL(value);
+    if (url.username || url.password || url.search || url.hash || /[%\\]/.test(url.pathname)
+        || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) {
+        throw new Error('insecure_endpoint');
+    }
+    return url;
+}
+async function responseJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error('invalid_probe_response');
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const item = await reader.read();
+            if (item.done)
+                break;
+            size += item.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new Error('invalid_probe_response');
+            chunks.push(item.value);
+        }
+        return JSON.parse(Buffer.concat(chunks).toString('utf8'));
+    }
+    finally {
+        await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+async function requestProbe(target, init, credentials = false) {
+    const signal = AbortSignal.timeout(credentials ? CREDENTIAL_TIMEOUT_MS : PROBE_TIMEOUT_MS);
+    try {
+        const response = await fetch(target, { ...init, redirect: 'error', signal });
+        if (!response.ok) {
+            const offline = response.headers.has('ngrok-error-code');
+            const rejected = response.status === 401 || response.status === 403;
+            let reason = rejected ? 'endpoint_rejected' : offline ? 'endpoint_offline' : 'endpoint_unreachable';
+            if (credentials && !offline && !rejected) {
+                const body = await responseJson(response).catch(() => undefined);
+                if (signal.aborted)
+                    return { state: unavailable('endpoint_timeout') };
+                if (body && typeof body === 'object' && 'reason' in body && body.reason === 'model_config_required')
+                    reason = 'model_config_required';
+            }
+            else
+                await response.body?.cancel().catch(() => undefined);
+            return { state: unavailable(reason) };
+        }
+        let body;
+        try {
+            body = await responseJson(response);
+        }
+        catch {
+            return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'invalid_probe_response') };
+        }
+        return { state: ready(), body };
+    }
+    catch {
+        return { state: unavailable(signal.aborted ? 'endpoint_timeout' : 'endpoint_unreachable') };
+    }
+}
+function echoMatches(body, expected) {
+    return Boolean(body && typeof body === 'object' && !Array.isArray(body)
+        && Object.entries(expected).every(([key, value]) => body[key] === value));
+}
+function scope(config) {
+    return { runtimeId: config.runtimeId, environment: config.environment, workspaceId: config.workspaceId,
+        generation: config.generation, runtimeEpoch: config.runtimeEpoch };
+}
+function entrance(config, route) {
+    return safeEndpoint(platformEndpoint(config.publicBaseUrl, route));
+}
+async function callbackProbe(config) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let endpoint;
+    try {
+        endpoint = entrance(config, PLATFORM_ROUTES.eventsProbe);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    const nonce = randomUUID();
+    const response = await requestProbe(endpoint, {
+        method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+        body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation,
+            runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId, nonce }),
+    });
+    if (response.state.status !== 'ready')
+        return response.state;
+    return echoMatches(response.body, { service: 'playcraft-runtime', ...scope(config), nonce }) ? ready() : unavailable('invalid_probe_response');
+}
+async function modelProxyProbe(config, entry) {
+    if (!config.publicBaseUrl)
+        return unavailable('endpoint_not_configured');
+    let credentialEndpoint;
+    try {
+        credentialEndpoint = entrance(config, PLATFORM_ROUTES.modelCredentials);
+        entrance(config, PLATFORM_ROUTES.modelProxy);
+    }
+    catch {
+        return unavailable('insecure_endpoint');
+    }
+    if (entry.credential && Date.parse(entry.credential.expiresAt) <= Date.now() + CREDENTIAL_RENEW_BEFORE_MS)
+        entry.credential = undefined;
+    const reusedCredential = Boolean(entry.credential);
+    if (!entry.credential) {
+        const response = await requestProbe(credentialEndpoint, {
+            method: 'POST', headers: { authorization: `Bearer ${config.controlToken}`, 'content-type': 'application/json', 'playcraft-env': config.environment },
+            body: JSON.stringify({ runtimeId: config.runtimeId, generation: config.generation, runtimeEpoch: config.runtimeEpoch, workspaceId: config.workspaceId }),
+        }, true);
+        if (response.state.status !== 'ready')
+            return response.state;
+        const parsed = credentialSchema.safeParse(response.body);
+        if (!parsed.success || !echoMatches(parsed.data.claims, { ...scope(config), userId: config.userId })
+            || Date.parse(parsed.data.expiresAt) <= Date.now() + 1_000)
+            return unavailable('invalid_probe_response');
+        entry.credential = parsed.data;
+    }
+    const credential = entry.credential;
+    const nonce = randomUUID();
+    const target = new URL(platformEndpoint(config.publicBaseUrl, modelConnectivityPath(credential.configId)));
+    target.searchParams.set('nonce', nonce);
+    const result = await requestProbe(target, { method: 'GET', headers: { authorization: `Bearer ${credential.token}`, 'playcraft-env': config.environment } });
+    if (result.state.reason === 'endpoint_rejected') {
+        entry.credential = undefined;
+        // A restore can invalidate an otherwise unexpired credential. Reissue once for this
+        // read-only echo; a fresh refusal remains a refusal. Model turns are never replayed here.
+        if (reusedCredential)
+            return modelProxyProbe(config, entry);
+    }
+    if (result.state.status !== 'ready')
+        return result.state;
+    return echoMatches(result.body, { service: 'playcraft-model-proxy', ...scope(config), configId: credential.configId, nonce })
+        ? ready() : unavailable('invalid_probe_response');
+}
+async function probe(config, entry) {
+    if (config.destroyed || !config.registered) {
+        const state = unavailable(config.destroyed ? 'runtime_destroyed' : 'workspace_not_registered');
+        return { ...scope(config), checkedAt: new Date().toISOString(), callback: state, modelProxy: state, conversation: state };
+    }
+    const [callback, modelProxy] = await Promise.all([callbackProbe(config), modelProxyProbe(config, entry)]);
+    const conversation = !config.nativeReady ? unavailable('adapter_not_started')
+        : callback.status !== 'ready' ? unavailable('callback_unavailable')
+            : modelProxy.status !== 'ready' ? unavailable('model_proxy_unavailable') : ready();
+    return { ...scope(config), checkedAt: new Date().toISOString(), callback, modelProxy, conversation };
+}
+/** Check the configured services without starting a thread or generating a model response. */
+export function probeRuntimeConnectivity(state, workspaceId) {
+    const config = snapshot(state, workspaceId);
+    const key = JSON.stringify(config);
+    let cache = caches.get(state);
+    if (!cache) {
+        cache = new Map();
+        caches.set(state, cache);
+    }
+    const previous = cache.get(workspaceId);
+    if (previous?.key === key) {
+        if (previous.pending)
+            return previous.pending;
+        if (previous.value && previous.expiresAt > Date.now())
+            return Promise.resolve(previous.value);
+    }
+    const entry = previous?.key === key ? previous : { key, expiresAt: 0 };
+    cache.set(workspaceId, entry);
+    if (cache.size > 256)
+        cache.delete(cache.keys().next().value);
+    entry.pending = probe(config, entry).then((value) => {
+        if (JSON.stringify(snapshot(state, workspaceId)) !== key)
+            return probeRuntimeConnectivity(state, workspaceId);
+        entry.value = value;
+        entry.expiresAt = Date.now() + CACHE_MS;
+        return value;
+    }).finally(() => { entry.pending = undefined; });
+    return entry.pending;
+}