@playcraft/cli 0.1.48-beta → 0.1.49-beta

package/dist/workspace-runtime/server/dispatch.js

@@ -4,7 +4,7 @@ import { abandonTurnChanges, beginTurnChanges, finishTurnChanges } from '../work
 import { shareWorkspaceGit } from '../workspaces/shared-git.js';
 import { join } from 'node:path';
 import { z } from 'zod';
-import { fileWritePayloadSchema, fileBinaryWritePayloadSchema, directoryCreatePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, gitPullPayloadSchema, gitMergeAbortPayloadSchema, parameterPatchPayloadSchema, productionSessionAttemptId, reasoningEffortSchema, workspacePermissionModeSchema, workspaceComposerSelectionSchema, workspaceReviewPayloadSchema, workspaceCompactPayloadSchema, workspaceSteerPayloadSchema, workspaceApprovalResponseSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, recoverUncertainOperation, workspaceSavePayloadSchema, workspaceSkillsUpdatePayloadSchema, workspaceRemixReferenceImportPayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { fileWritePayloadSchema, fileBinaryWritePayloadSchema, directoryCreatePayloadSchema, gitCommitPayloadSchema, gitPathsPayloadSchema, gitPushPayloadSchema, gitPullPayloadSchema, gitMergeAbortPayloadSchema, parameterPatchPayloadSchema, productionSessionAttemptId, reasoningEffortSchema, workspacePermissionModeSchema, workspaceComposerSelectionSchema, workspaceReviewPayloadSchema, workspaceCompactPayloadSchema, workspaceSteerPayloadSchema, workspaceApprovalResponseSchema, terminalCreatePayloadSchema, terminalProcessIdentity, transitionOperation, recoverUncertainOperation, workspaceSavePayloadSchema, workspaceSkillsUpdatePayloadSchema, workspaceRemixReferenceImportPayloadSchema, deliveryBuildPayloadSchema, deliveryCancelPayloadSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { closeCliCredentials, ensureCliCredentials } from '../workspaces/cli-credentials.js';
 import { artifactFormat } from '../workspaces/artifact-files.js';
 import { refreshWorkspaceArtifacts } from '../workspaces/artifact-events.js';
@@ -31,6 +31,7 @@ import { batchDirectoryHeld } from '../batch/occupancy.js';
 import { BinaryWorkspaceWriteError, observeWorkspaceBinaryFile, writeWorkspaceBinaryFile } from '../workspaces/binary-write.js';
 import { importWorkspaceLibraryAssets } from '../workspaces/asset-library-import.js';
 import { createWorkspaceDirectory, WorkspaceDirectoryCreateError } from '../workspaces/directory-create.js';
+import { runDeliveryBuild, cancelDeliveryBuild, trackDeliveryBuild, DeliveryBuildError } from '../workspaces/delivery-build.js';
 const CONVERSATION_KINDS = new Set([
     'session.create',
     'session.turn',
@@ -59,6 +60,8 @@ const LOCAL_KINDS = new Set([
     'terminal.create',
     'parameter.patch',
     'preview.publish',
+    'delivery.build',
+    'delivery.cancel',
     'skills.update',
 ]);
 export function canExecuteKind(state, kind) {
@@ -75,7 +78,7 @@ export async function executeOperation(state, scopeKey, operation, payload, reco
         }
         return executeScopedOperation(state, scopeKey, operation, payload, recovery);
     };
-    if (['runtime.destroy', 'session.interrupt', 'session.approval.respond', 'session.steer', 'preview.publish'].includes(operation.kind)) {
+    if (['runtime.destroy', 'session.interrupt', 'session.approval.respond', 'session.steer', 'preview.publish', 'delivery.build', 'delivery.cancel'].includes(operation.kind)) {
         return run();
     }
     return state.journal.exclusive(`workspace:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, run);
@@ -140,6 +143,12 @@ async function executeScopedOperation(state, scopeKey, operation, payload, recov
     if (operation.kind === 'preview.publish') {
         return executePreviewPublish(state, scopeKey, current);
     }
+    if (operation.kind === 'delivery.build') {
+        return executeDeliveryBuild(state, scopeKey, current, payload);
+    }
+    if (operation.kind === 'delivery.cancel') {
+        return executeDeliveryCancel(state, scopeKey, current, payload);
+    }
     if (!state.native?.ready()) {
         return persist(state, scopeKey, transitionOperation(current, 'failed', { error: 'capability_unavailable' }));
     }
@@ -1165,6 +1174,42 @@ async function executePreviewPublish(state, scopeKey, operation) {
     }).catch(() => undefined));
     return accepted;
 }
+async function executeDeliveryBuild(state, scopeKey, operation, payload) {
+    const parsed = deliveryBuildPayloadSchema.safeParse(payload);
+    if (!parsed.success) {
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_delivery_build' }));
+    }
+    if (!operation.workspaceId) {
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_workspace' }));
+    }
+    const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
+    const task = runDeliveryBuild(state, {
+        buildId: operation.operationId,
+        workspaceId: operation.workspaceId,
+        directoryName: operation.directoryName ?? 'basic',
+        payload: parsed.data,
+        actor: parsed.data.actor ?? 'user',
+    }).then(async (result) => {
+        const error = result.record.error
+            ?? (result.record.status === 'succeeded' ? undefined : 'delivery_build_failed');
+        await persist(state, scopeKey, transitionOperation(accepted, result.record.status === 'succeeded' ? 'completed' : 'failed', error ? { error } : {}));
+    }, async (error) => {
+        await persist(state, scopeKey, transitionOperation(accepted, 'failed', {
+            error: error instanceof DeliveryBuildError ? error.code : 'delivery_build_failed',
+        }));
+    }).catch(() => undefined);
+    trackDeliveryBuild(state, task);
+    return accepted;
+}
+async function executeDeliveryCancel(state, scopeKey, operation, payload) {
+    const parsed = deliveryCancelPayloadSchema.safeParse(payload);
+    if (!parsed.success || !operation.workspaceId) {
+        return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_delivery_cancel' }));
+    }
+    const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
+    const canceled = await cancelDeliveryBuild(state, operation.workspaceId, operation.directoryName ?? 'basic', parsed.data.buildId);
+    return persist(state, scopeKey, transitionOperation(accepted, canceled ? 'completed' : 'failed', canceled ? {} : { error: 'delivery_build_not_found' }));
+}
 async function executeTerminalCreate(state, scopeKey, operation, payload) {
     const parsed = terminalCreatePayloadSchema.safeParse(payload ?? {});
     if (!parsed.success) {

package/dist/workspace-runtime/server/http.js

@@ -1,13 +1,11 @@
 import { readObservedFile, withObservedFile } from '../workspaces/revisions.js';
 import { registerWorkspace, revisionScope, sessionWorkspaceRoot, workspaceRoot, WorkspaceContextError } from '../workspaces/registry.js';
-import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { access as accessDirectory, stat } from 'node:fs/promises';
-import { workspaceRegistrationRequestSchema, workspaceFileSearchQuerySchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, isLostThreadError, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, productionSessionAttemptId, isWorkspaceMutation, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, workspaceUiResultSchema, workspaceRemixReferenceImportRequestSchema, WORKSPACE_REMIX_REFERENCE_BODY_MAX_BYTES, WORKSPACE_ASSET_LIBRARY_IMPORT_BODY_MAX_BYTES, workspaceSessionRestoreRequestSchema, workspaceSessionRestoreResponseSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRegistrationRequestSchema, workspaceFileSearchQuerySchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, sourceAckSchema, operationAcceptRequestSchema, operationLogSchema, operationKindSchema, operationScopeKey, productionSessionAttemptId, isWorkspaceMutation, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, workspaceUiResultSchema, workspaceRemixReferenceImportRequestSchema, WORKSPACE_REMIX_REFERENCE_BODY_MAX_BYTES, WORKSPACE_ASSET_LIBRARY_IMPORT_BODY_MAX_BYTES, workspaceSessionRestoreRequestSchema, workspaceSessionRestoreResponseSchema, deliveryValidatePayloadSchema, deliveryBuildListQuerySchema, deliveryBuildListSchema, deliveryBuildDetailSchema, deliveryBuildLogSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
 import { applyRuntimeEndpointPatch } from './endpoints.js';
 import { wakeSourceEventUploader } from './source-uploader.js';
-import { canExecuteKind, executeOperation } from './dispatch.js';
 import { InvalidWorkspacePathError, listWorkspaceFiles, } from '../workspaces/files.js';
 import { GitWorkspaceError, readWorkspaceGitDiff, readWorkspaceGitFile, readWorkspaceGitGraph, readWorkspaceGitStatus, } from '../workspaces/git.js';
 import { readWorkspaceParameters } from '../workspaces/parameters.js';
@@ -17,6 +15,8 @@ import { ensureCliCredentials } from '../workspaces/cli-credentials.js';
 import { readAttachmentUpload, uploadWorkspaceAttachment, uploadWorkspaceVideoAttachment } from '../workspaces/attachments.js';
 import { serveWorkspaceAttachment } from '../workspaces/attachment-content.js';
 import { serveWorkspaceFileContent } from '../workspaces/file-content.js';
+import { validateDeliveryArtifact, DeliveryValidationError } from '../workspaces/delivery.js';
+import { DeliveryStore } from '../workspaces/delivery-store.js';
 import { importWorkspaceLibraryAttachment, listWorkspaceLibraryAttachments, listWorkspaceLibraryImportReceipts, readLibraryAttachmentUpload } from '../workspaces/library-attachments.js';
 import { beginWorkspaceDirectoryAttachment, uploadWorkspaceDirectoryFile, completeWorkspaceDirectoryAttachment, cancelWorkspaceDirectoryAttachment } from '../workspaces/directory-attachments.js';
 import { readWorkspaceSkills } from '../workspaces/skills.js';
@@ -32,6 +32,8 @@ import { readWorkspaceDirectoryStats } from '../workspaces/directory-stats.js';
 import { probeRuntimeConnectivity } from './connectivity.js';
 import { refreshWorkspaceArtifacts } from '../workspaces/artifact-events.js';
 import { WorkspaceArtifactStore } from '../workspaces/artifacts.js';
+import { OperationLogStore } from '../workspaces/operation-log.js';
+import { acceptOperationCore } from './accept-operation.js';
 import { workspaceArtifactContentQuerySchema } from '@playcraft/common/cloud-workspace/runtime';
 import { searchWorkspaceFiles } from '../workspaces/files-search.js';
 import { serveWorkspaceArchive } from '../workspaces/archive.js';
@@ -360,6 +362,82 @@ export async function handleRuntimeRequest(state, request, response) {
             await serveWorkspaceAttachment(root, url.searchParams.get('attachmentId') ?? '', request, response, url.searchParams.get('filePath') ?? undefined);
             return;
         }
+        if (request.method === 'POST' && url.pathname === '/runtime/deliveries/validate') {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId || directoryName === 'root') {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const parsed = deliveryValidatePayloadSchema.safeParse(await readJson(request, 64 * 1024));
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_delivery_validate' });
+                return;
+            }
+            const root = await workspaceRoot(state, workspaceId, directoryName);
+            try {
+                writeJson(response, 200, await validateDeliveryArtifact(root, parsed.data));
+            }
+            catch (error) {
+                const code = error instanceof DeliveryValidationError ? error.code : 'delivery_validation_failed';
+                writeJson(response, code === 'delivery_validation_failed' ? 500 : 400, { error: code });
+            }
+            return;
+        }
+        if (request.method === 'GET' && url.pathname === '/runtime/deliveries') {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId || directoryName === 'root') {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const parsed = deliveryBuildListQuerySchema.safeParse({
+                ...(url.searchParams.has('channel') ? { channel: url.searchParams.get('channel') } : {}),
+                ...(url.searchParams.has('limit') ? { limit: url.searchParams.get('limit') } : {}),
+            });
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_delivery_query' });
+                return;
+            }
+            await workspaceRoot(state, workspaceId, directoryName);
+            const items = await new DeliveryStore(state.config.stateDir, workspaceId)
+                .list(directoryName, parsed.data.channel, parsed.data.limit);
+            writeJson(response, 200, deliveryBuildListSchema.parse({ items, scannedAt: new Date().toISOString() }));
+            return;
+        }
+        const deliveryBuild = /^\/runtime\/deliveries\/([a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})(?:\/(log))?$/.exec(url.pathname);
+        if (request.method === 'GET' && deliveryBuild) {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            await workspaceRoot(state, workspaceId, directoryName);
+            const store = new DeliveryStore(state.config.stateDir, workspaceId);
+            const buildId = deliveryBuild[1];
+            const record = await store.read(buildId);
+            if (!record || record.directoryName !== directoryName) {
+                writeJson(response, 404, { error: 'delivery_build_not_found' });
+                return;
+            }
+            if (deliveryBuild[2] === 'log') {
+                const offset = Number(url.searchParams.get('offset') ?? 0);
+                if (!Number.isInteger(offset) || offset < 0) {
+                    writeJson(response, 400, { error: 'invalid_delivery_offset' });
+                    return;
+                }
+                const log = await store.readLog(buildId, offset);
+                writeJson(response, 200, deliveryBuildLogSchema.parse({ ...log, offset }));
+                return;
+            }
+            const report = await store.readReport(buildId);
+            writeJson(response, 200, deliveryBuildDetailSchema.parse({ record, ...(report ? { report } : {}) }));
+            return;
+        }
         if (request.method === 'GET' && url.pathname === '/runtime/artifacts') {
             if (writeDestroyed(state, response))
                 return;
@@ -596,6 +674,30 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, operation ? 200 : 404, operation ?? { error: 'operation_not_found' });
             return;
         }
+        const operationLog = /^\/runtime\/operations\/([0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})\/log$/.exec(url.pathname);
+        if (request.method === 'GET' && operationLog) {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const operation = state.journal.getOperationById(operationLog[1]);
+            if (!operation || operation.workspaceId !== workspaceId
+                || (operation.directoryName ?? 'basic') !== directoryName) {
+                writeJson(response, 404, { error: 'operation_not_found' });
+                return;
+            }
+            const offset = Number(url.searchParams.get('offset') ?? 0);
+            if (!Number.isInteger(offset) || offset < 0) {
+                writeJson(response, 400, { error: 'invalid_operation_log_offset' });
+                return;
+            }
+            const log = await new OperationLogStore(state.config.stateDir).read(operationLog[1], offset);
+            writeJson(response, 200, operationLogSchema.parse({ ...log, offset }));
+            return;
+        }
         if (request.method === 'GET' && url.pathname.startsWith('/runtime/operations/')) {
             const operationId = url.pathname.slice('/runtime/operations/'.length);
             const operation = state.journal.getOperationById(operationId);
@@ -758,135 +860,65 @@ async function acceptOperation(state, request, response) {
         writeJson(response, 409, { error: 'batch_workspace_readonly' });
         return;
     }
-    const payloadHash = hashOperationPayload(parsed.data.payload);
-    const scopeKey = operationScopeKey({
-        environment: state.config.environment,
-        userId: state.config.userId,
-        kind: parsed.data.kind,
-        clientRequestId: parsed.data.clientRequestId,
-        workspaceId: parsed.data.workspaceId,
-        directoryName: parsed.data.directoryName,
-        sessionId: parsed.data.sessionId,
-    });
-    const accept = () => state.journal.exclusive(scopeKey, async () => {
-        // Recheck after a concurrent dispatcher may have advanced the fence while this request waited.
-        if (assertLeaseFence(incomingFence, state.acceptedLeaseFence) !== 'ok') {
-            writeError(response, runtimeError('stale_lease', 'leaseFence is behind the accepted dispatcher'));
-            return;
-        }
-        const existing = state.journal.getOperation(scopeKey);
-        const decision = resolveIdempotentAccept(existing, payloadHash);
-        if (decision.action === 'conflict') {
-            writeError(response, runtimeError('idempotency_conflict', 'clientRequestId reused with a different payload', {
-                operationId: decision.operation.operationId,
-            }));
-            return;
-        }
-        // A turn refused for a lost thread never reached Codex. Sent again with the conversation, it
-        // runs afresh under the same request, so the message is shown and answered only once.
-        const retryWithRecovery = decision.action === 'reuse' && parsed.data.kind === 'session.turn'
-            && Boolean(parsed.data.sessionRecovery) && decision.operation.status === 'failed'
-            && isLostThreadError(decision.operation.error);
-        if (decision.action === 'reuse' && !retryWithRecovery) {
-            if (decision.operation.status === 'uncertain') {
-                writeError(response, runtimeError('uncertain_operation', decision.operation.error ?? 'native_receipt_lost', {
-                    operationId: decision.operation.operationId,
-                }));
-                return;
-            }
-            writeJson(response, 200, decision.operation);
-            return;
-        }
-        if (parsed.data.kind.startsWith('session.') && parsed.data.sessionId && productionSessionAttemptId(parsed.data.sessionId)) {
-            writeError(response, runtimeError('capability_unavailable', 'production_session_readonly'));
+    const executionPayload = parsed.data.kind === 'workspace.references.import'
+        ? { snapshot: parsed.data.remixReferenceSnapshot }
+        : parsed.data.kind === 'asset.library.import'
+            ? { selection: parsed.data.payload, snapshot: parsed.data.libraryAssetImports }
+            : parsed.data.payload;
+    const accept = async () => {
+        const result = await acceptOperationCore(state, parsed.data, {
+            leaseFence: incomingFence,
+            executionPayload,
+            validate: async (scopeKey) => {
+                if (parsed.data.kind.startsWith('session.') && parsed.data.sessionId && productionSessionAttemptId(parsed.data.sessionId)) {
+                    return { status: 409, body: runtimeError('capability_unavailable', 'production_session_readonly') };
+                }
+                if (parsed.data.kind === 'session.create') {
+                    const creation = state.journal.findSessionCreation(parsed.data.sessionId);
+                    const session = state.journal.getSession(parsed.data.sessionId);
+                    if (creation || session)
+                        return { status: 409, body: { error: 'session_already_bound' } };
+                }
+                else if (parsed.data.kind === 'terminal.create') {
+                    const payload = asRecord(parsed.data.payload);
+                    const terminalId = typeof payload.terminalId === 'string' ? payload.terminalId.trim() : '';
+                    if (!terminalId)
+                        return { status: 400, body: { error: 'invalid_operation', reason: 'terminalId_required' } };
+                    const creation = state.journal.findTerminalCreation(terminalId);
+                    const terminal = state.journal.getTerminal(terminalId);
+                    if (creation && operationScopeKey(creation) !== scopeKey) {
+                        return { status: 409, body: { error: 'terminal_already_bound' } };
+                    }
+                    if (terminal && !creation)
+                        return { status: 409, body: { error: 'terminal_already_bound' } };
+                }
+                else if (parsed.data.kind.startsWith('session.') && state.config.workspaceMode === 'multi') {
+                    const session = state.journal.getSession(parsed.data.sessionId);
+                    // A replaced sandbox has no binding yet; the recovering turn creates it.
+                    const rebinding = !session && parsed.data.kind === 'session.turn' && parsed.data.sessionRecovery;
+                    if (!rebinding && (!session || session.workspaceId !== parsed.data.workspaceId
+                        || (session.directoryName ?? 'basic') !== (parsed.data.directoryName ?? 'basic'))) {
+                        return { status: 409, body: { error: 'session_workspace_mismatch' } };
+                    }
+                }
+                if (parsed.data.kind === 'workspace.references.import' && !parsed.data.remixReferenceSnapshot) {
+                    return { status: 400, body: { error: 'remix_reference_snapshot_required' } };
+                }
+                if (parsed.data.kind === 'asset.library.import' && !parsed.data.libraryAssetImports) {
+                    return { status: 400, body: { error: 'library_asset_snapshot_required' } };
+                }
+                return undefined;
+            },
+        });
+        if (result.rejected) {
+            writeJson(response, result.refusal.status, result.refusal.body);
             return;
         }
-        if (parsed.data.kind === 'session.create') {
-            const creation = state.journal.findSessionCreation(parsed.data.sessionId);
-            const session = state.journal.getSession(parsed.data.sessionId);
-            if (creation || session) {
-                writeJson(response, 409, { error: 'session_already_bound' });
-                return;
-            }
-        }
-        else if (parsed.data.kind === 'terminal.create') {
-            const payload = asRecord(parsed.data.payload);
-            const terminalId = typeof payload.terminalId === 'string' ? payload.terminalId.trim() : '';
-            if (!terminalId) {
-                writeJson(response, 400, { error: 'invalid_operation', reason: 'terminalId_required' });
-                return;
-            }
-            const creation = state.journal.findTerminalCreation(terminalId);
-            const terminal = state.journal.getTerminal(terminalId);
-            if (creation && operationScopeKey(creation) !== scopeKey) {
-                writeJson(response, 409, { error: 'terminal_already_bound' });
-                return;
-            }
-            if (terminal && !creation) {
-                writeJson(response, 409, { error: 'terminal_already_bound' });
-                return;
-            }
-        }
-        else if (parsed.data.kind.startsWith('session.') && state.config.workspaceMode === 'multi') {
-            const session = state.journal.getSession(parsed.data.sessionId);
-            // A replaced sandbox has no binding yet; the recovering turn creates it.
-            const rebinding = !session && parsed.data.kind === 'session.turn' && parsed.data.sessionRecovery;
-            if (!rebinding && (!session || session.workspaceId !== parsed.data.workspaceId
-                || (session.directoryName ?? 'basic') !== (parsed.data.directoryName ?? 'basic'))) {
-                writeJson(response, 409, { error: 'session_workspace_mismatch' });
-                return;
-            }
-        }
-        if (parsed.data.kind === 'workspace.references.import' && !parsed.data.remixReferenceSnapshot) {
-            writeJson(response, 400, { error: 'remix_reference_snapshot_required' });
-            return;
-        }
-        if (parsed.data.kind === 'asset.library.import' && !parsed.data.libraryAssetImports) {
-            writeJson(response, 400, { error: 'library_asset_snapshot_required' });
-            return;
-        }
-        const now = new Date().toISOString();
-        const executable = canExecuteKind(state, parsed.data.kind);
-        const payloadRecord = asRecord(parsed.data.payload);
-        const operation = {
-            operationId: randomUUID(),
-            environment: state.config.environment,
-            userId: state.config.userId,
-            clientRequestId: parsed.data.clientRequestId,
-            kind: parsed.data.kind,
-            status: executable ? 'queued' : 'failed',
-            payloadHash,
-            workspaceId: parsed.data.workspaceId,
-            directoryName: parsed.data.directoryName,
-            sessionId: parsed.data.sessionId,
-            expectedRevision: parsed.data.expectedRevision,
-            generation: state.config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-            leaseFence: incomingFence,
-            terminalId: parsed.data.kind === 'terminal.create' && typeof payloadRecord.terminalId === 'string'
-                ? payloadRecord.terminalId.trim()
-                : undefined,
-            cwd: parsed.data.kind === 'terminal.create' && typeof payloadRecord.cwd === 'string'
-                ? payloadRecord.cwd
-                : undefined,
-            error: executable ? undefined : 'capability_unavailable',
-            createdAt: now,
-            updatedAt: now,
-        };
-        if (!executable) {
-            const saved = await state.journal.putOperation(scopeKey, operation);
-            writeError(response, runtimeError('capability_unavailable', unavailableReason(state, parsed.data.kind), {
-                operationId: saved.operationId,
-            }));
+        if (result.reused) {
+            writeJson(response, 200, result.operation);
             return;
         }
-        state.acceptedLeaseFence = Math.max(state.acceptedLeaseFence, incomingFence);
-        await state.journal.setAcceptedLeaseFence(state.acceptedLeaseFence);
-        const queued = await state.journal.putOperation(scopeKey, operation);
-        const executionPayload = parsed.data.kind === 'workspace.references.import'
-            ? { snapshot: parsed.data.remixReferenceSnapshot } : parsed.data.kind === 'asset.library.import'
-            ? { selection: parsed.data.payload, snapshot: parsed.data.libraryAssetImports } : parsed.data.payload;
-        const executed = await executeOperation(state, scopeKey, queued, executionPayload, parsed.data.sessionRecovery);
+        const executed = result.executed;
         if (executed.status === 'uncertain') {
             writeError(response, runtimeError('uncertain_operation', executed.error ?? 'native_receipt_lost', {
                 operationId: executed.operationId,
@@ -894,7 +926,7 @@ async function acceptOperation(state, request, response) {
             return;
         }
         writeJson(response, executed.status === 'failed' ? 409 : 202, executed);
-    });
+    };
     const acceptBound = async () => {
         if (occupiesDirectory && await batchDirectoryHeld(state, parsed.data.workspaceId, parsed.data.directoryName)) {
             writeJson(response, 409, { error: 'batch_workspace_readonly' });

package/dist/workspace-runtime/server/operation-record.js

@@ -0,0 +1,33 @@
+import { randomUUID } from 'node:crypto';
+/** One construction point for operation records so HTTP and in-sandbox callers cannot drift. */
+export function buildOperationRecord(state, parsed, payloadHash, leaseFence, executable = true) {
+    const now = new Date().toISOString();
+    const payload = parsed.payload && typeof parsed.payload === 'object' && !Array.isArray(parsed.payload)
+        ? parsed.payload
+        : {};
+    return {
+        operationId: randomUUID(),
+        environment: state.config.environment,
+        userId: state.config.userId,
+        clientRequestId: parsed.clientRequestId,
+        kind: parsed.kind,
+        status: executable ? 'queued' : 'failed',
+        payloadHash,
+        workspaceId: parsed.workspaceId,
+        directoryName: parsed.directoryName,
+        sessionId: parsed.sessionId,
+        expectedRevision: parsed.expectedRevision,
+        generation: state.config.generation,
+        runtimeEpoch: state.runtimeEpoch,
+        leaseFence,
+        terminalId: parsed.kind === 'terminal.create' && typeof payload.terminalId === 'string'
+            ? payload.terminalId.trim()
+            : undefined,
+        cwd: parsed.kind === 'terminal.create' && typeof payload.cwd === 'string'
+            ? payload.cwd
+            : undefined,
+        error: executable ? undefined : 'capability_unavailable',
+        createdAt: now,
+        updatedAt: now,
+    };
+}

package/dist/workspace-runtime/server/submit-operation.js

@@ -0,0 +1,41 @@
+import { operationAcceptRequestSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { batchDirectoryHeld } from '../batch/occupancy.js';
+import { acceptOperationCore } from './accept-operation.js';
+export class SubmitOperationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'SubmitOperationError';
+    }
+}
+/**
+ * Accepts an operation from a trusted in-sandbox caller (an Agent tool or a future runtime
+ * feature) with the same idempotency and lease semantics as the HTTP control plane.
+ */
+export async function submitTrustedOperation(state, input) {
+    const directoryName = input.directoryName ?? 'basic';
+    if (directoryName === 'root')
+        throw new SubmitOperationError('invalid_workspace_directory');
+    const parsed = operationAcceptRequestSchema.safeParse({
+        clientRequestId: input.clientRequestId,
+        kind: input.kind,
+        workspaceId: input.workspaceId,
+        directoryName,
+        ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+        ...(input.expectedRevision !== undefined ? { expectedRevision: input.expectedRevision } : {}),
+        payload: input.payload,
+    });
+    if (!parsed.success)
+        throw new SubmitOperationError('invalid_operation');
+    if (await batchDirectoryHeld(state, input.workspaceId, directoryName)) {
+        throw new SubmitOperationError('batch_workspace_readonly');
+    }
+    const result = await acceptOperationCore(state, parsed.data, {
+        leaseFence: state.acceptedLeaseFence,
+        executionPayload: parsed.data.payload,
+    });
+    if (result.rejected)
+        throw new SubmitOperationError(String(result.refusal.body.error ?? 'operation_failed'));
+    return result.reused ? result.operation : result.executed;
+}

package/dist/workspace-runtime/workspaces/append-only-log.js

@@ -0,0 +1,62 @@
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+/**
+ * One append-only log file with a hard byte cap. When the cap is crossed the file is atomically
+ * replaced with a truncation notice plus the newest bytes, so readers never see a half write.
+ */
+export class AppendOnlyLog {
+    path;
+    maxBytes;
+    truncatedNotice;
+    constructor(path, maxBytes, truncatedNotice = '[playcraft] log truncated; showing the tail\n') {
+        this.path = path;
+        this.maxBytes = maxBytes;
+        this.truncatedNotice = truncatedNotice;
+    }
+    async append(chunk) {
+        if (!chunk)
+            return;
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        const handle = await open(this.path, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW, 0o600);
+        try {
+            await handle.write(Buffer.from(chunk));
+        }
+        finally {
+            await handle.close();
+        }
+        const info = await stat(this.path);
+        if (info.size <= this.maxBytes)
+            return;
+        const content = await readFile(this.path);
+        const notice = Buffer.from(this.truncatedNotice);
+        const tail = content.subarray(Math.max(0, content.length - (this.maxBytes - notice.length)));
+        const temporary = `${this.path}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, Buffer.concat([notice, tail]), { mode: 0o600 });
+            await rename(temporary, this.path);
+        }
+        catch (error) {
+            await rm(temporary, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    }
+    async read(offset = 0) {
+        let content;
+        try {
+            content = await readFile(this.path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { text: '', size: 0, offset: 0 };
+            throw error;
+        }
+        const start = Math.min(Math.max(0, offset), content.length);
+        return { text: content.subarray(start).toString('utf8'), size: content.length, offset: start };
+    }
+    async size() {
+        const info = await stat(this.path).catch(() => undefined);
+        return info?.isFile() ? info.size : 0;
+    }
+}