@playcraft/cli 0.1.48-beta → 0.1.50-beta

package/dist/workspace-runtime/server/http.js

@@ -1,22 +1,24 @@
 import { readObservedFile, withObservedFile } from '../workspaces/revisions.js';
+import { observeWorkspaceDirectories } from '../workspaces/directory-revisions.js';
 import { registerWorkspace, revisionScope, sessionWorkspaceRoot, workspaceRoot, WorkspaceContextError } from '../workspaces/registry.js';
-import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { access as accessDirectory, stat } from 'node:fs/promises';
-import { workspaceRegistrationRequestSchema, workspaceFileSearchQuerySchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, hashOperationPayload, isLostThreadError, sourceAckSchema, operationAcceptRequestSchema, operationKindSchema, operationScopeKey, productionSessionAttemptId, isWorkspaceMutation, resolveIdempotentAccept, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, workspaceUiResultSchema, workspaceRemixReferenceImportRequestSchema, WORKSPACE_REMIX_REFERENCE_BODY_MAX_BYTES, WORKSPACE_ASSET_LIBRARY_IMPORT_BODY_MAX_BYTES, workspaceSessionRestoreRequestSchema, workspaceSessionRestoreResponseSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { workspaceRegistrationRequestSchema, workspaceFileSearchQuerySchema, HTTP_STATUS_BY_ERROR, assertLeaseFence, buildHandshakeDocument, capability, findUntrustedRuntimeFields, gitFileRefSchema, sourceAckSchema, operationAcceptRequestSchema, operationLogSchema, operationKindSchema, operationScopeKey, productionSessionAttemptId, isWorkspaceMutation, nativeHistoryReadSchema, runtimeError, runtimeConnectivityDocumentSchema, unavailableRuntimeCapabilities, workspaceUiResultSchema, workspaceRemixReferenceImportRequestSchema, WORKSPACE_REMIX_REFERENCE_BODY_MAX_BYTES, WORKSPACE_ASSET_LIBRARY_IMPORT_BODY_MAX_BYTES, workspaceSessionRestoreRequestSchema, workspaceSessionRestoreResponseSchema, deliveryValidatePayloadSchema, deliveryBuildListQuerySchema, deliveryBuildListSchema, deliveryBuildDetailSchema, deliveryBuildLogSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { controlTokenMatches, extractControlToken } from './auth.js';
 import { applyRuntimeEndpointPatch } from './endpoints.js';
 import { wakeSourceEventUploader } from './source-uploader.js';
-import { canExecuteKind, executeOperation } from './dispatch.js';
-import { InvalidWorkspacePathError, listWorkspaceFiles, } from '../workspaces/files.js';
+import { InvalidWorkspacePathError, } from '../workspaces/files.js';
 import { GitWorkspaceError, readWorkspaceGitDiff, readWorkspaceGitFile, readWorkspaceGitGraph, readWorkspaceGitStatus, } from '../workspaces/git.js';
 import { readWorkspaceParameters } from '../workspaces/parameters.js';
+import { listParameterAgentTasks } from '../workspaces/parameter-agent.js';
 import { readDependencies } from '../workspaces/dependencies.js';
 import { desktopHost, desktopRoute } from './desktop-host.js';
 import { ensureCliCredentials } from '../workspaces/cli-credentials.js';
 import { readAttachmentUpload, uploadWorkspaceAttachment, uploadWorkspaceVideoAttachment } from '../workspaces/attachments.js';
 import { serveWorkspaceAttachment } from '../workspaces/attachment-content.js';
 import { serveWorkspaceFileContent } from '../workspaces/file-content.js';
+import { validateDeliveryArtifact, DeliveryValidationError } from '../workspaces/delivery.js';
+import { DeliveryStore } from '../workspaces/delivery-store.js';
 import { importWorkspaceLibraryAttachment, listWorkspaceLibraryAttachments, listWorkspaceLibraryImportReceipts, readLibraryAttachmentUpload } from '../workspaces/library-attachments.js';
 import { beginWorkspaceDirectoryAttachment, uploadWorkspaceDirectoryFile, completeWorkspaceDirectoryAttachment, cancelWorkspaceDirectoryAttachment } from '../workspaces/directory-attachments.js';
 import { readWorkspaceSkills } from '../workspaces/skills.js';
@@ -32,12 +34,15 @@ import { readWorkspaceDirectoryStats } from '../workspaces/directory-stats.js';
 import { probeRuntimeConnectivity } from './connectivity.js';
 import { refreshWorkspaceArtifacts } from '../workspaces/artifact-events.js';
 import { WorkspaceArtifactStore } from '../workspaces/artifacts.js';
+import { OperationLogStore } from '../workspaces/operation-log.js';
+import { acceptOperationCore } from './accept-operation.js';
 import { workspaceArtifactContentQuerySchema } from '@playcraft/common/cloud-workspace/runtime';
 import { searchWorkspaceFiles } from '../workspaces/files-search.js';
 import { serveWorkspaceArchive } from '../workspaces/archive.js';
 import { handleWorkspaceTransfer } from './workspace-transfer.js';
 import { serveSessionImage } from '../workspaces/session-image.js';
 import { restoreNativeSession, SessionRestoreError } from './session-restore.js';
+import { handleAssetTransferRequest } from './asset-transfers.js';
 export async function handleRuntimeRequest(state, request, response) {
     const url = new URL(request.url ?? '/', 'http://127.0.0.1');
     const directoryName = url.searchParams.get('directoryName') ?? 'basic';
@@ -51,6 +56,11 @@ export async function handleRuntimeRequest(state, request, response) {
         return;
     }
     try {
+        const transfer = await handleAssetTransferRequest(state, request, url);
+        if (transfer) {
+            writeJson(response, transfer.status, transfer.body);
+            return;
+        }
         const batch = await dispatchBatchRoute(state, request, url);
         if (batch) {
             writeJson(response, batch.status, batch.body);
@@ -92,6 +102,7 @@ export async function handleRuntimeRequest(state, request, response) {
                 instanceToken: state.instanceToken,
                 permissionsVersion: 1,
                 composerContextVersion: 1,
+                parameterAgentVersion: 1,
                 remixReferencesVersion: 1,
                 batchSourceFreezeRevision: 2,
                 ...(state.native?.workspaceUi ? { workspaceUiVersion: 1 } : {}),
@@ -360,6 +371,82 @@ export async function handleRuntimeRequest(state, request, response) {
             await serveWorkspaceAttachment(root, url.searchParams.get('attachmentId') ?? '', request, response, url.searchParams.get('filePath') ?? undefined);
             return;
         }
+        if (request.method === 'POST' && url.pathname === '/runtime/deliveries/validate') {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId || directoryName === 'root') {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const parsed = deliveryValidatePayloadSchema.safeParse(await readJson(request, 64 * 1024));
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_delivery_validate' });
+                return;
+            }
+            const root = await workspaceRoot(state, workspaceId, directoryName);
+            try {
+                writeJson(response, 200, await validateDeliveryArtifact(root, parsed.data));
+            }
+            catch (error) {
+                const code = error instanceof DeliveryValidationError ? error.code : 'delivery_validation_failed';
+                writeJson(response, code === 'delivery_validation_failed' ? 500 : 400, { error: code });
+            }
+            return;
+        }
+        if (request.method === 'GET' && url.pathname === '/runtime/deliveries') {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId || directoryName === 'root') {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const parsed = deliveryBuildListQuerySchema.safeParse({
+                ...(url.searchParams.has('channel') ? { channel: url.searchParams.get('channel') } : {}),
+                ...(url.searchParams.has('limit') ? { limit: url.searchParams.get('limit') } : {}),
+            });
+            if (!parsed.success) {
+                writeJson(response, 400, { error: 'invalid_delivery_query' });
+                return;
+            }
+            await workspaceRoot(state, workspaceId, directoryName);
+            const items = await new DeliveryStore(state.config.stateDir, workspaceId)
+                .list(directoryName, parsed.data.channel, parsed.data.limit);
+            writeJson(response, 200, deliveryBuildListSchema.parse({ items, scannedAt: new Date().toISOString() }));
+            return;
+        }
+        const deliveryBuild = /^\/runtime\/deliveries\/([a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12})(?:\/(log))?$/.exec(url.pathname);
+        if (request.method === 'GET' && deliveryBuild) {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            await workspaceRoot(state, workspaceId, directoryName);
+            const store = new DeliveryStore(state.config.stateDir, workspaceId);
+            const buildId = deliveryBuild[1];
+            const record = await store.read(buildId);
+            if (!record || record.directoryName !== directoryName) {
+                writeJson(response, 404, { error: 'delivery_build_not_found' });
+                return;
+            }
+            if (deliveryBuild[2] === 'log') {
+                const offset = Number(url.searchParams.get('offset') ?? 0);
+                if (!Number.isInteger(offset) || offset < 0) {
+                    writeJson(response, 400, { error: 'invalid_delivery_offset' });
+                    return;
+                }
+                const log = await store.readLog(buildId, offset);
+                writeJson(response, 200, deliveryBuildLogSchema.parse({ ...log, offset }));
+                return;
+            }
+            const report = await store.readReport(buildId);
+            writeJson(response, 200, deliveryBuildDetailSchema.parse({ record, ...(report ? { report } : {}) }));
+            return;
+        }
         if (request.method === 'GET' && url.pathname === '/runtime/artifacts') {
             if (writeDestroyed(state, response))
                 return;
@@ -427,7 +514,8 @@ export async function handleRuntimeRequest(state, request, response) {
                 return;
             const workspaceId = url.searchParams.get('workspaceId') ?? undefined;
             const root = await workspaceRoot(state, workspaceId, directoryName);
-            const listed = await listWorkspaceFiles(root, state.journal.fileRevisions(revisionScope(state, workspaceId, directoryName)));
+            const scope = revisionScope(state, workspaceId, directoryName);
+            const listed = await state.journal.exclusive(`workspace:${scope ?? 'single'}`, () => observeWorkspaceDirectories(root, state.journal, scope));
             console.log(`[workspace-files] GET /runtime/files workspaceId=${workspaceId ?? '-'} root=${root} files=${listed.files.length}`);
             writeJson(response, 200, listed);
             return;
@@ -561,6 +649,18 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, 200, await readObservedParameters(state, url.searchParams.get('workspaceId') ?? undefined, directoryName));
             return;
         }
+        if (request.method === 'GET' && url.pathname === '/runtime/parameter-tasks') {
+            if (writeDestroyed(state, response))
+                return;
+            if (directoryName === 'root') {
+                writeJson(response, 400, { error: 'invalid_workspace_directory' });
+                return;
+            }
+            const workspaceId = url.searchParams.get('workspaceId') ?? undefined;
+            const root = await workspaceRoot(state, workspaceId, directoryName);
+            writeJson(response, 200, { tasks: await listParameterAgentTasks(state, workspaceId, directoryName, root) });
+            return;
+        }
         if (request.method === 'GET' && url.pathname === '/runtime/terminals') {
             if (writeDestroyed(state, response))
                 return;
@@ -596,6 +696,30 @@ export async function handleRuntimeRequest(state, request, response) {
             writeJson(response, operation ? 200 : 404, operation ?? { error: 'operation_not_found' });
             return;
         }
+        const operationLog = /^\/runtime\/operations\/([0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12})\/log$/.exec(url.pathname);
+        if (request.method === 'GET' && operationLog) {
+            if (writeDestroyed(state, response))
+                return;
+            const workspaceId = url.searchParams.get('workspaceId') ?? '';
+            if (!workspaceId) {
+                writeJson(response, 400, { error: 'invalid_workspace' });
+                return;
+            }
+            const operation = state.journal.getOperationById(operationLog[1]);
+            if (!operation || operation.workspaceId !== workspaceId
+                || (operation.directoryName ?? 'basic') !== directoryName) {
+                writeJson(response, 404, { error: 'operation_not_found' });
+                return;
+            }
+            const offset = Number(url.searchParams.get('offset') ?? 0);
+            if (!Number.isInteger(offset) || offset < 0) {
+                writeJson(response, 400, { error: 'invalid_operation_log_offset' });
+                return;
+            }
+            const log = await new OperationLogStore(state.config.stateDir).read(operationLog[1], offset);
+            writeJson(response, 200, operationLogSchema.parse({ ...log, offset }));
+            return;
+        }
         if (request.method === 'GET' && url.pathname.startsWith('/runtime/operations/')) {
             const operationId = url.pathname.slice('/runtime/operations/'.length);
             const operation = state.journal.getOperationById(operationId);
@@ -758,135 +882,65 @@ async function acceptOperation(state, request, response) {
         writeJson(response, 409, { error: 'batch_workspace_readonly' });
         return;
     }
-    const payloadHash = hashOperationPayload(parsed.data.payload);
-    const scopeKey = operationScopeKey({
-        environment: state.config.environment,
-        userId: state.config.userId,
-        kind: parsed.data.kind,
-        clientRequestId: parsed.data.clientRequestId,
-        workspaceId: parsed.data.workspaceId,
-        directoryName: parsed.data.directoryName,
-        sessionId: parsed.data.sessionId,
-    });
-    const accept = () => state.journal.exclusive(scopeKey, async () => {
-        // Recheck after a concurrent dispatcher may have advanced the fence while this request waited.
-        if (assertLeaseFence(incomingFence, state.acceptedLeaseFence) !== 'ok') {
-            writeError(response, runtimeError('stale_lease', 'leaseFence is behind the accepted dispatcher'));
-            return;
-        }
-        const existing = state.journal.getOperation(scopeKey);
-        const decision = resolveIdempotentAccept(existing, payloadHash);
-        if (decision.action === 'conflict') {
-            writeError(response, runtimeError('idempotency_conflict', 'clientRequestId reused with a different payload', {
-                operationId: decision.operation.operationId,
-            }));
-            return;
-        }
-        // A turn refused for a lost thread never reached Codex. Sent again with the conversation, it
-        // runs afresh under the same request, so the message is shown and answered only once.
-        const retryWithRecovery = decision.action === 'reuse' && parsed.data.kind === 'session.turn'
-            && Boolean(parsed.data.sessionRecovery) && decision.operation.status === 'failed'
-            && isLostThreadError(decision.operation.error);
-        if (decision.action === 'reuse' && !retryWithRecovery) {
-            if (decision.operation.status === 'uncertain') {
-                writeError(response, runtimeError('uncertain_operation', decision.operation.error ?? 'native_receipt_lost', {
-                    operationId: decision.operation.operationId,
-                }));
-                return;
-            }
-            writeJson(response, 200, decision.operation);
-            return;
-        }
-        if (parsed.data.kind.startsWith('session.') && parsed.data.sessionId && productionSessionAttemptId(parsed.data.sessionId)) {
-            writeError(response, runtimeError('capability_unavailable', 'production_session_readonly'));
+    const executionPayload = parsed.data.kind === 'workspace.references.import'
+        ? { snapshot: parsed.data.remixReferenceSnapshot }
+        : parsed.data.kind === 'asset.library.import'
+            ? { selection: parsed.data.payload, snapshot: parsed.data.libraryAssetImports }
+            : parsed.data.payload;
+    const accept = async () => {
+        const result = await acceptOperationCore(state, parsed.data, {
+            leaseFence: incomingFence,
+            executionPayload,
+            validate: async (scopeKey) => {
+                if (parsed.data.kind.startsWith('session.') && parsed.data.sessionId && productionSessionAttemptId(parsed.data.sessionId)) {
+                    return { status: 409, body: runtimeError('capability_unavailable', 'production_session_readonly') };
+                }
+                if (parsed.data.kind === 'session.create') {
+                    const creation = state.journal.findSessionCreation(parsed.data.sessionId);
+                    const session = state.journal.getSession(parsed.data.sessionId);
+                    if (creation || session)
+                        return { status: 409, body: { error: 'session_already_bound' } };
+                }
+                else if (parsed.data.kind === 'terminal.create') {
+                    const payload = asRecord(parsed.data.payload);
+                    const terminalId = typeof payload.terminalId === 'string' ? payload.terminalId.trim() : '';
+                    if (!terminalId)
+                        return { status: 400, body: { error: 'invalid_operation', reason: 'terminalId_required' } };
+                    const creation = state.journal.findTerminalCreation(terminalId);
+                    const terminal = state.journal.getTerminal(terminalId);
+                    if (creation && operationScopeKey(creation) !== scopeKey) {
+                        return { status: 409, body: { error: 'terminal_already_bound' } };
+                    }
+                    if (terminal && !creation)
+                        return { status: 409, body: { error: 'terminal_already_bound' } };
+                }
+                else if (parsed.data.kind.startsWith('session.') && state.config.workspaceMode === 'multi') {
+                    const session = state.journal.getSession(parsed.data.sessionId);
+                    // A replaced sandbox has no binding yet; the recovering turn creates it.
+                    const rebinding = !session && parsed.data.kind === 'session.turn' && parsed.data.sessionRecovery;
+                    if (!rebinding && (!session || session.workspaceId !== parsed.data.workspaceId
+                        || (session.directoryName ?? 'basic') !== (parsed.data.directoryName ?? 'basic'))) {
+                        return { status: 409, body: { error: 'session_workspace_mismatch' } };
+                    }
+                }
+                if (parsed.data.kind === 'workspace.references.import' && !parsed.data.remixReferenceSnapshot) {
+                    return { status: 400, body: { error: 'remix_reference_snapshot_required' } };
+                }
+                if (parsed.data.kind === 'asset.library.import' && !parsed.data.libraryAssetImports) {
+                    return { status: 400, body: { error: 'library_asset_snapshot_required' } };
+                }
+                return undefined;
+            },
+        });
+        if (result.rejected) {
+            writeJson(response, result.refusal.status, result.refusal.body);
             return;
         }
-        if (parsed.data.kind === 'session.create') {
-            const creation = state.journal.findSessionCreation(parsed.data.sessionId);
-            const session = state.journal.getSession(parsed.data.sessionId);
-            if (creation || session) {
-                writeJson(response, 409, { error: 'session_already_bound' });
-                return;
-            }
-        }
-        else if (parsed.data.kind === 'terminal.create') {
-            const payload = asRecord(parsed.data.payload);
-            const terminalId = typeof payload.terminalId === 'string' ? payload.terminalId.trim() : '';
-            if (!terminalId) {
-                writeJson(response, 400, { error: 'invalid_operation', reason: 'terminalId_required' });
-                return;
-            }
-            const creation = state.journal.findTerminalCreation(terminalId);
-            const terminal = state.journal.getTerminal(terminalId);
-            if (creation && operationScopeKey(creation) !== scopeKey) {
-                writeJson(response, 409, { error: 'terminal_already_bound' });
-                return;
-            }
-            if (terminal && !creation) {
-                writeJson(response, 409, { error: 'terminal_already_bound' });
-                return;
-            }
-        }
-        else if (parsed.data.kind.startsWith('session.') && state.config.workspaceMode === 'multi') {
-            const session = state.journal.getSession(parsed.data.sessionId);
-            // A replaced sandbox has no binding yet; the recovering turn creates it.
-            const rebinding = !session && parsed.data.kind === 'session.turn' && parsed.data.sessionRecovery;
-            if (!rebinding && (!session || session.workspaceId !== parsed.data.workspaceId
-                || (session.directoryName ?? 'basic') !== (parsed.data.directoryName ?? 'basic'))) {
-                writeJson(response, 409, { error: 'session_workspace_mismatch' });
-                return;
-            }
-        }
-        if (parsed.data.kind === 'workspace.references.import' && !parsed.data.remixReferenceSnapshot) {
-            writeJson(response, 400, { error: 'remix_reference_snapshot_required' });
-            return;
-        }
-        if (parsed.data.kind === 'asset.library.import' && !parsed.data.libraryAssetImports) {
-            writeJson(response, 400, { error: 'library_asset_snapshot_required' });
-            return;
-        }
-        const now = new Date().toISOString();
-        const executable = canExecuteKind(state, parsed.data.kind);
-        const payloadRecord = asRecord(parsed.data.payload);
-        const operation = {
-            operationId: randomUUID(),
-            environment: state.config.environment,
-            userId: state.config.userId,
-            clientRequestId: parsed.data.clientRequestId,
-            kind: parsed.data.kind,
-            status: executable ? 'queued' : 'failed',
-            payloadHash,
-            workspaceId: parsed.data.workspaceId,
-            directoryName: parsed.data.directoryName,
-            sessionId: parsed.data.sessionId,
-            expectedRevision: parsed.data.expectedRevision,
-            generation: state.config.generation,
-            runtimeEpoch: state.runtimeEpoch,
-            leaseFence: incomingFence,
-            terminalId: parsed.data.kind === 'terminal.create' && typeof payloadRecord.terminalId === 'string'
-                ? payloadRecord.terminalId.trim()
-                : undefined,
-            cwd: parsed.data.kind === 'terminal.create' && typeof payloadRecord.cwd === 'string'
-                ? payloadRecord.cwd
-                : undefined,
-            error: executable ? undefined : 'capability_unavailable',
-            createdAt: now,
-            updatedAt: now,
-        };
-        if (!executable) {
-            const saved = await state.journal.putOperation(scopeKey, operation);
-            writeError(response, runtimeError('capability_unavailable', unavailableReason(state, parsed.data.kind), {
-                operationId: saved.operationId,
-            }));
+        if (result.reused) {
+            writeJson(response, 200, result.operation);
             return;
         }
-        state.acceptedLeaseFence = Math.max(state.acceptedLeaseFence, incomingFence);
-        await state.journal.setAcceptedLeaseFence(state.acceptedLeaseFence);
-        const queued = await state.journal.putOperation(scopeKey, operation);
-        const executionPayload = parsed.data.kind === 'workspace.references.import'
-            ? { snapshot: parsed.data.remixReferenceSnapshot } : parsed.data.kind === 'asset.library.import'
-            ? { selection: parsed.data.payload, snapshot: parsed.data.libraryAssetImports } : parsed.data.payload;
-        const executed = await executeOperation(state, scopeKey, queued, executionPayload, parsed.data.sessionRecovery);
+        const executed = result.executed;
         if (executed.status === 'uncertain') {
             writeError(response, runtimeError('uncertain_operation', executed.error ?? 'native_receipt_lost', {
                 operationId: executed.operationId,
@@ -894,7 +948,7 @@ async function acceptOperation(state, request, response) {
             return;
         }
         writeJson(response, executed.status === 'failed' ? 409 : 202, executed);
-    });
+    };
     const acceptBound = async () => {
         if (occupiesDirectory && await batchDirectoryHeld(state, parsed.data.workspaceId, parsed.data.directoryName)) {
             writeJson(response, 409, { error: 'batch_workspace_readonly' });
@@ -1073,12 +1127,14 @@ async function handleSessionHistory(state, response, workspaceId, sessionId) {
 async function readObservedParameters(state, workspaceId, directoryName = 'basic') {
     const root = await workspaceRoot(state, workspaceId, directoryName);
     const scope = revisionScope(state, workspaceId, directoryName);
-    const first = await readWorkspaceParameters(root, state.journal.fileRevisions(scope));
-    for (const path of [first.schemaPath, first.dataPath]) {
-        if (path)
-            await withObservedFile(state, workspaceId, path, async () => undefined, directoryName);
-    }
-    return readWorkspaceParameters(root, state.journal.fileRevisions(scope));
+    return state.journal.exclusive(`workspace:${scope ?? 'single'}`, async () => {
+        const first = await readWorkspaceParameters(root, state.journal.fileRevisions(scope));
+        for (const path of [first.schemaPath, first.dataPath]) {
+            if (path)
+                await withObservedFile(state, workspaceId, path, async () => undefined, directoryName);
+        }
+        return readWorkspaceParameters(root, state.journal.fileRevisions(scope));
+    });
 }
 function writeError(response, error) {
     writeJson(response, HTTP_STATUS_BY_ERROR[error.code], error);

package/dist/workspace-runtime/server/operation-record.js

@@ -0,0 +1,33 @@
+import { randomUUID } from 'node:crypto';
+/** One construction point for operation records so HTTP and in-sandbox callers cannot drift. */
+export function buildOperationRecord(state, parsed, payloadHash, leaseFence, executable = true) {
+    const now = new Date().toISOString();
+    const payload = parsed.payload && typeof parsed.payload === 'object' && !Array.isArray(parsed.payload)
+        ? parsed.payload
+        : {};
+    return {
+        operationId: randomUUID(),
+        environment: state.config.environment,
+        userId: state.config.userId,
+        clientRequestId: parsed.clientRequestId,
+        kind: parsed.kind,
+        status: executable ? 'queued' : 'failed',
+        payloadHash,
+        workspaceId: parsed.workspaceId,
+        directoryName: parsed.directoryName,
+        sessionId: parsed.sessionId,
+        expectedRevision: parsed.expectedRevision,
+        generation: state.config.generation,
+        runtimeEpoch: state.runtimeEpoch,
+        leaseFence,
+        terminalId: parsed.kind === 'terminal.create' && typeof payload.terminalId === 'string'
+            ? payload.terminalId.trim()
+            : undefined,
+        cwd: parsed.kind === 'terminal.create' && typeof payload.cwd === 'string'
+            ? payload.cwd
+            : undefined,
+        error: executable ? undefined : 'capability_unavailable',
+        createdAt: now,
+        updatedAt: now,
+    };
+}

package/dist/workspace-runtime/server/submit-operation.js

@@ -0,0 +1,41 @@
+import { operationAcceptRequestSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { batchDirectoryHeld } from '../batch/occupancy.js';
+import { acceptOperationCore } from './accept-operation.js';
+export class SubmitOperationError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'SubmitOperationError';
+    }
+}
+/**
+ * Accepts an operation from a trusted in-sandbox caller (an Agent tool or a future runtime
+ * feature) with the same idempotency and lease semantics as the HTTP control plane.
+ */
+export async function submitTrustedOperation(state, input) {
+    const directoryName = input.directoryName ?? 'basic';
+    if (directoryName === 'root')
+        throw new SubmitOperationError('invalid_workspace_directory');
+    const parsed = operationAcceptRequestSchema.safeParse({
+        clientRequestId: input.clientRequestId,
+        kind: input.kind,
+        workspaceId: input.workspaceId,
+        directoryName,
+        ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+        ...(input.expectedRevision !== undefined ? { expectedRevision: input.expectedRevision } : {}),
+        payload: input.payload,
+    });
+    if (!parsed.success)
+        throw new SubmitOperationError('invalid_operation');
+    if (await batchDirectoryHeld(state, input.workspaceId, directoryName)) {
+        throw new SubmitOperationError('batch_workspace_readonly');
+    }
+    const result = await acceptOperationCore(state, parsed.data, {
+        leaseFence: state.acceptedLeaseFence,
+        executionPayload: parsed.data.payload,
+    });
+    if (result.rejected)
+        throw new SubmitOperationError(String(result.refusal.body.error ?? 'operation_failed'));
+    return result.reused ? result.operation : result.executed;
+}

package/dist/workspace-runtime/workspaces/append-only-log.js

@@ -0,0 +1,62 @@
+import { randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { mkdir, open, readFile, rename, rm, stat, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+/**
+ * One append-only log file with a hard byte cap. When the cap is crossed the file is atomically
+ * replaced with a truncation notice plus the newest bytes, so readers never see a half write.
+ */
+export class AppendOnlyLog {
+    path;
+    maxBytes;
+    truncatedNotice;
+    constructor(path, maxBytes, truncatedNotice = '[playcraft] log truncated; showing the tail\n') {
+        this.path = path;
+        this.maxBytes = maxBytes;
+        this.truncatedNotice = truncatedNotice;
+    }
+    async append(chunk) {
+        if (!chunk)
+            return;
+        await mkdir(dirname(this.path), { recursive: true, mode: 0o700 });
+        const handle = await open(this.path, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW, 0o600);
+        try {
+            await handle.write(Buffer.from(chunk));
+        }
+        finally {
+            await handle.close();
+        }
+        const info = await stat(this.path);
+        if (info.size <= this.maxBytes)
+            return;
+        const content = await readFile(this.path);
+        const notice = Buffer.from(this.truncatedNotice);
+        const tail = content.subarray(Math.max(0, content.length - (this.maxBytes - notice.length)));
+        const temporary = `${this.path}.${randomUUID()}.tmp`;
+        try {
+            await writeFile(temporary, Buffer.concat([notice, tail]), { mode: 0o600 });
+            await rename(temporary, this.path);
+        }
+        catch (error) {
+            await rm(temporary, { force: true }).catch(() => undefined);
+            throw error;
+        }
+    }
+    async read(offset = 0) {
+        let content;
+        try {
+            content = await readFile(this.path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return { text: '', size: 0, offset: 0 };
+            throw error;
+        }
+        const start = Math.min(Math.max(0, offset), content.length);
+        return { text: content.subarray(start).toString('utf8'), size: content.length, offset: start };
+    }
+    async size() {
+        const info = await stat(this.path).catch(() => undefined);
+        return info?.isFile() ? info.size : 0;
+    }
+}

package/dist/workspace-runtime/workspaces/asset-transfer-dependencies.js

@@ -0,0 +1,81 @@
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { extname, join, posix } from 'node:path';
+import { AssetTransferError, safeAssetTransferDirectory } from './asset-transfer-storage.js';
+const METADATA_MAX_BYTES = 8 * 1024 * 1024;
+/** Parse only bounded model metadata; all external dependencies must be explicit package members. */
+export async function validateAssetTransferDependencies(transfer) {
+    const paths = new Set(transfer.record.manifest.files.map(file => file.path));
+    for (const [index, file] of transfer.record.manifest.files.entries()) {
+        const extension = extname(file.path).toLowerCase();
+        if (extension !== '.gltf' && extension !== '.glb')
+            continue;
+        await safeAssetTransferDirectory(transfer.directory, 'incoming');
+        const handle = await open(join(transfer.directory, 'incoming', String(index)), constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            let start = 0, size = file.size;
+            if (extension === '.glb') {
+                const header = Buffer.alloc(20);
+                const read = await handle.read(header, 0, header.length, 0);
+                if (read.bytesRead !== 20 || header.readUInt32LE(0) !== 0x46546c67 || header.readUInt32LE(4) !== 2
+                    || header.readUInt32LE(8) !== file.size || header.readUInt32LE(16) !== 0x4e4f534a)
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                size = header.readUInt32LE(12);
+                start = 20;
+            }
+            if (size > METADATA_MAX_BYTES)
+                throw new AssetTransferError('asset_transfer_metadata_too_large', 413);
+            if (size < 2 || size + start > file.size)
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            const bytes = Buffer.alloc(size);
+            let offset = 0;
+            while (offset < size) {
+                const read = await handle.read(bytes, offset, size - offset, start + offset);
+                if (!read.bytesRead)
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                offset += read.bytesRead;
+            }
+            let body;
+            try {
+                body = JSON.parse(bytes.toString('utf8'));
+            }
+            catch {
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            }
+            if (!body || typeof body !== 'object' || Array.isArray(body)
+                || !Array.isArray(body.buffers ?? []) || !Array.isArray(body.images ?? []))
+                throw new AssetTransferError('asset_transfer_invalid_model');
+            for (const resource of [...(body.buffers ?? []), ...(body.images ?? [])]) {
+                if (!resource || typeof resource !== 'object' || Array.isArray(resource))
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                if (resource.uri === undefined)
+                    continue;
+                if (typeof resource.uri !== 'string')
+                    throw new AssetTransferError('asset_transfer_invalid_model');
+                const target = assetTransferDependencyPath(file, resource.uri);
+                if (target && !paths.has(target))
+                    throw new AssetTransferError('asset_transfer_missing_dependency');
+            }
+        }
+        finally {
+            await handle.close();
+        }
+    }
+}
+function assetTransferDependencyPath(file, uri) {
+    if (/^data:/i.test(uri))
+        return undefined;
+    let decoded;
+    try {
+        decoded = decodeURIComponent(uri);
+    }
+    catch {
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    }
+    if (!decoded || /^[a-z][a-z\d+.-]*:/i.test(decoded) || /^[\/\\]/.test(decoded) || /[\\:\x00-\x1f\x7f?#]/.test(decoded))
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    const target = posix.normalize(posix.join(posix.dirname(file.path), decoded));
+    if (target === '..' || target.startsWith('../'))
+        throw new AssetTransferError('asset_transfer_invalid_dependency');
+    return target;
+}