@playcraft/cli 0.1.49-beta → 0.1.51

package/dist/workspace-runtime/batch/deliver.js

@@ -1,173 +0,0 @@
-import { constants } from 'node:fs';
-import { lstat, open } from 'node:fs/promises';
-import { join } from 'node:path';
-import { hashOperationPayload, sandboxBatchMemberDeliverSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { workspaceRoot } from '../workspaces/registry.js';
-import { groupExited, runProcessGroup, stopProcessGroup } from './processes.js';
-import { memberStatus, readMember, readStopMarker, serializeRun, writeMember, } from './records.js';
-/** Base build writes dist/index.html. Channel packaging stays on export playable (`--mode full`). */
-function buildCommand() {
-    return (process.env.PLAYCRAFT_BATCH_BUILD_COMMAND ?? 'CI=1 playcraft build --mode base --output dist .');
-}
-async function readBuiltHtml(root) {
-    const htmlPath = join(root, 'dist', 'index.html');
-    const info = await lstat(htmlPath).catch(() => undefined);
-    if (!info?.isFile() || info.isSymbolicLink())
-        throw new Error('batch_build_failed');
-    const handle = await open(htmlPath, constants.O_RDONLY | constants.O_NOFOLLOW).catch(() => {
-        throw new Error('batch_build_failed');
-    });
-    await handle.close();
-}
-async function prove(record) {
-    let stopped = true;
-    for (const process of record.processes) {
-        if (!(process.stopped || groupExited(process.pid))) {
-            process.stopped = await stopProcessGroup(process);
-            if (!process.stopped)
-                stopped = false;
-        }
-        else
-            process.stopped = true;
-    }
-    return stopped;
-}
-export async function deliverBatchMember(state, body) {
-    if (!body ||
-        typeof body !== 'object' ||
-        !('occupancyId' in body) ||
-        !body.occupancyId)
-        throw new Error('occupancy_required');
-    const parsed = sandboxBatchMemberDeliverSchema.safeParse(body);
-    if (!parsed.success)
-        throw new Error('invalid_batch_request');
-    const command = parsed.data;
-    const hash = hashOperationPayload(command);
-    return serializeRun(command.runId, async () => {
-        const existing = await readMember(state, command.runId);
-        if (existing && command.ownerFence < existing.ownerFence)
-            throw new Error('stale_owner');
-        if (existing?.state === 'completed' &&
-            existing.phase === 'deliver' &&
-            existing.evidence &&
-            existing.commandHash?.deliver === hash &&
-            existing.ownerFence === command.ownerFence) {
-            return memberStatus(existing);
-        }
-        if ((await readStopMarker(state, command.runId)) &&
-            existing?.state === 'completed' &&
-            existing.evidence)
-            return memberStatus(existing);
-        if (await readStopMarker(state, command.runId))
-            return memberStatus(await markStopped(state, command, existing));
-        if (existing &&
-            existing.ownerFence === command.ownerFence &&
-            existing.commandHash?.deliver &&
-            existing.commandHash.deliver !== hash &&
-            existing.state === 'completed') {
-            throw new Error('batch_command_conflict');
-        }
-        const root = await workspaceRoot(state, command.workspaceId, command.directoryName);
-        let record = await writeMember(state, {
-            runId: command.runId,
-            ownerFence: command.ownerFence,
-            occupancyId: command.occupancyId,
-            workspaceId: command.workspaceId,
-            directoryName: command.directoryName,
-            phase: 'deliver',
-            state: 'running',
-            writersStopped: false,
-            holding: true,
-            stopRequested: false,
-            processes: existing?.processes ?? [],
-            sessionId: existing?.sessionId,
-            operationId: existing?.operationId,
-            commandHash: { ...existing?.commandHash, deliver: hash },
-            snapshotDigest: existing?.snapshotDigest,
-            branchName: existing?.branchName,
-            updatedAt: new Date().toISOString(),
-            sourceCommit: existing?.sourceCommit ??
-                state.journal
-                    .getWorkspace(command.workspaceId)
-                    ?.directories?.find((directory) => directory.directoryName === command.directoryName)
-                    ?.sourceCommit,
-            beforeTree: existing?.beforeTree,
-        });
-        try {
-            if (await readStopMarker(state, command.runId))
-                return memberStatus(await markStopped(state, command, record));
-            const built = await runProcessGroup(root, buildCommand(), 'build', async (process) => {
-                record = await writeMember(state, { ...record, processes: [...record.processes, process] });
-            });
-            record = await writeMember(state, {
-                ...record,
-                processes: record.processes.map((process) => process.pid === built.process.pid ? built.process : process),
-            });
-            if (await readStopMarker(state, command.runId))
-                return memberStatus(await markStopped(state, command, record));
-            if (built.code !== 0)
-                throw new Error('batch_build_failed');
-            await readBuiltHtml(root);
-            const writersStopped = await prove(record);
-            if (!writersStopped)
-                return memberStatus(await writeMember(state, {
-                    ...record,
-                    state: 'stopping',
-                    writersStopped: false,
-                    holding: true,
-                }));
-            if (await readStopMarker(state, command.runId))
-                return memberStatus(await markStopped(state, command, record));
-            record = await writeMember(state, {
-                ...record,
-                state: 'completed',
-                writersStopped: true,
-                holding: false,
-                error: undefined,
-                evidence: { verified: true },
-            });
-            return memberStatus(record);
-        }
-        catch (error) {
-            const code = error instanceof Error && /^[a-z0-9_]+$/.test(error.message)
-                ? error.message
-                : 'batch_deliver_failed';
-            const writersStopped = await prove(record);
-            record = await writeMember(state, {
-                ...record,
-                state: writersStopped ? 'failed' : 'stopping',
-                writersStopped,
-                holding: !writersStopped,
-                error: code,
-            });
-            return memberStatus(record);
-        }
-    });
-}
-async function markStopped(state, command, existing) {
-    if (existing)
-        await prove(existing);
-    return writeMember(state, {
-        runId: command.runId,
-        ownerFence: command.ownerFence,
-        occupancyId: existing?.occupancyId ?? command.occupancyId,
-        workspaceId: command.workspaceId,
-        directoryName: command.directoryName,
-        phase: 'deliver',
-        state: 'stopped',
-        writersStopped: true,
-        holding: false,
-        stopRequested: true,
-        processes: existing?.processes ?? [],
-        sessionId: existing?.sessionId,
-        operationId: existing?.operationId,
-        headCommit: existing?.headCommit,
-        evidence: existing?.evidence,
-        commandHash: existing?.commandHash,
-        snapshotDigest: existing?.snapshotDigest,
-        branchName: existing?.branchName,
-        updatedAt: new Date().toISOString(),
-        sourceCommit: existing?.sourceCommit,
-        beforeTree: existing?.beforeTree,
-    });
-}

package/dist/workspace-runtime/batch/freeze.js

@@ -1,101 +0,0 @@
-import { rm, writeFile } from 'node:fs/promises';
-import { statfs } from 'node:fs/promises';
-import { batchSourceFreezeResultSchema, batchSourceRemoteRef, sandboxBatchSourceFreezeRequestSchema, workspaceDiskAdmission, } from '@playcraft/common/cloud-workspace/runtime';
-import { stopBackgroundWriter } from '../processes/managed-writes.js';
-import { workspaceRoot } from '../workspaces/registry.js';
-import { gitRead } from './git.js';
-import { captureIndependentSource } from './source-capture.js';
-import { filesystemObjectStore, readSnapshot, serializeFreeze, sourceCacheDir, writeSnapshot, } from './records.js';
-import { assertSourceIdentity, readSourceCandidate, writeSourceCandidate } from './source-candidate.js';
-import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
-import { publishSourceCandidate } from './source-publish.js';
-async function usagePercent(path) {
-    const disk = await statfs(path);
-    if (disk.blocks <= 0)
-        throw new Error('disk_usage_unavailable');
-    return ((disk.blocks - disk.bfree) / disk.blocks) * 100;
-}
-/** Dependency installs are keyed `workspaceId:directoryName`. A bare workspace id is not this directory. */
-async function stopManagedWriters(state, workspaceId, directoryName) {
-    const scope = `${workspaceId}:${directoryName}`;
-    for (const write of state.journal.listManagedWrites()) {
-        if (write.stoppedAt || write.workspaceId !== scope)
-            continue;
-        if (write.pid !== undefined) {
-            const stopped = await stopBackgroundWriter(write.pid);
-            if (!stopped)
-                continue;
-        }
-        await state.journal.putManagedWrite({ ...write, stoppedAt: new Date().toISOString() });
-    }
-}
-export async function freezeBatchSource(state, body, options) {
-    const parsed = sandboxBatchSourceFreezeRequestSchema.safeParse(body);
-    if (!parsed.success)
-        throw new Error('invalid_batch_request');
-    const request = parsed.data;
-    return serializeFreeze(async () => {
-        let candidate;
-        let source;
-        try {
-            const pending = await readSourceCandidate(state, request.batchId);
-            const existing = await readSnapshot(state, request.batchId);
-            if (existing) {
-                assertSourceIdentity(state, request, existing, pending);
-                return batchSourceFreezeResultSchema.parse({ status: 'frozen', snapshot: existing });
-            }
-            if (!pending && 'resumeOnly' in request && request.resumeOnly === true) {
-                throw await sourceFreezeError(state, request.batchId, { code: 'batch_source_candidate_lost', stage: 'capture', retryable: false, outcome: 'unknown' });
-            }
-            if (pending)
-                assertSourceIdentity(state, request, pending.snapshot, pending);
-            source = await workspaceRoot(state, request.workspaceId, request.sourceDirectoryName);
-            if (pending)
-                candidate = pending;
-            else {
-                const percent = Math.min(100, Math.max(0, options?.usagePercent ?? await usagePercent(source)));
-                if (workspaceDiskAdmission(percent) === 'paused')
-                    throw new Error('disk_admission_paused');
-                await stopManagedWriters(state, request.workspaceId, request.sourceDirectoryName);
-                const cache = sourceCacheDir(state, request.batchId);
-                await rm(cache, { recursive: true, force: true });
-                const captured = await captureIndependentSource(source, cache);
-                await writeFile(`${cache}.digest`, captured.digest, { mode: 0o600 });
-                const binding = state.journal.getWorkspace(request.workspaceId);
-                const snapshot = {
-                    batchId: request.batchId, commitHash: captured.commitHash, digest: captured.digest,
-                    sourceWorkspaceId: request.workspaceId, sourceDirectoryName: request.sourceDirectoryName,
-                    frozenAt: new Date((await gitRead(cache, ['show', '-s', '--format=%cI', 'HEAD'])).trim()).toISOString(),
-                    ...(request.persist === 'remote_ref' ? { remoteRef: batchSourceRemoteRef(request.batchId) }
-                        : { artifactKey: `workspaces/${request.workspaceId}/batches/${request.batchId}/source/${captured.digest}.json.gz` }),
-                };
-                candidate = {
-                    version: 1, persist: request.persist, repositoryUrl: binding?.repositoryUrl ?? undefined, projectId: binding?.projectId,
-                    branchName: request.sourceDirectoryName === 'basic' ? binding?.branchName ?? undefined
-                        : binding?.directories?.find(directory => directory.directoryName === request.sourceDirectoryName)?.branchName ?? undefined,
-                    snapshot,
-                };
-                await writeSourceCandidate(state, candidate);
-            }
-        }
-        catch (error) {
-            if (error instanceof BatchSourceFreezeError)
-                throw error;
-            const known = new Set(['disk_admission_paused', 'disk_usage_unavailable', 'batch_source_changed', 'batch_source_path_invalid',
-                'workspace_not_registered', 'batch_source_identity_mismatch', 'batch_source_snapshot_mismatch']);
-            const code = error instanceof Error && known.has(error.message) ? error.message : 'batch_source_capture_failed';
-            throw await sourceFreezeError(state, request.batchId, {
-                code, stage: 'capture', retryable: !['batch_source_path_invalid', 'batch_source_identity_mismatch', 'batch_source_snapshot_mismatch'].includes(code),
-                outcome: code === 'batch_source_identity_mismatch' || code === 'batch_source_snapshot_mismatch' ? 'unknown' : 'not_published',
-            }, error);
-        }
-        await publishSourceCandidate(state, candidate, source, options?.objectStore ?? filesystemObjectStore(state));
-        try {
-            await writeSnapshot(state, candidate.snapshot);
-        }
-        catch (error) {
-            throw await sourceFreezeError(state, request.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
-        }
-        return batchSourceFreezeResultSchema.parse({ status: 'frozen', snapshot: candidate.snapshot });
-    });
-}

package/dist/workspace-runtime/batch/generate.js

@@ -1,249 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { setTimeout as delay } from 'node:timers/promises';
-import { hashOperationPayload, operationScopeKey, sandboxBatchMemberGenerateSchema, } from '@playcraft/common/cloud-workspace/runtime';
-import { attachNativeCollector, executeOperation } from '../server/dispatch.js';
-import { workspaceRoot } from '../workspaces/registry.js';
-import { snapshotWorkspaceTree } from '../workspaces/git.js';
-import { requireBatchContentChanges } from './content-changes.js';
-import { bindMemberPolicy, memberExecutionPolicy } from './policy.js';
-import { groupExited, stopProcessGroup } from './processes.js';
-import { memberStatus, readMember, readStopMarker, serializeRun, writeMember } from './records.js';
-function hashCommand(value) {
-    return hashOperationPayload(value);
-}
-function operation(state, input) {
-    const now = new Date().toISOString();
-    const record = {
-        operationId: randomUUID(), environment: state.config.environment, userId: state.config.userId,
-        clientRequestId: input.clientRequestId, kind: input.kind, status: 'queued', payloadHash: hashOperationPayload(input.payload),
-        workspaceId: input.workspaceId, directoryName: input.directoryName, sessionId: input.sessionId,
-        generation: state.config.generation, runtimeEpoch: state.runtimeEpoch, leaseFence: state.acceptedLeaseFence,
-        createdAt: now, updatedAt: now,
-    };
-    return { scopeKey: operationScopeKey(record), record };
-}
-function turnTerminal(event) {
-    if (event.kind === 'approval_request')
-        return 'needs_user';
-    if (event.method !== 'turn/completed' && event.method !== 'turn.completed' && event.method !== 'turn.failed' && event.method !== 'turn.interrupted')
-        return undefined;
-    const turn = event.params && typeof event.params === 'object' ? event.params.turn : undefined;
-    if (event.method === 'turn.failed' || turn?.status === 'failed')
-        return 'failed';
-    if (event.method === 'turn.interrupted' || turn?.status === 'interrupted')
-        return 'interrupted';
-    return 'completed';
-}
-function threadIdOf(event) {
-    const params = event.params && typeof event.params === 'object' ? event.params : undefined;
-    return typeof params?.threadId === 'string' ? params.threadId : undefined;
-}
-async function proveStopped(record) {
-    let stopped = true;
-    for (const process of record.processes) {
-        if (process.stopped || groupExited(process.pid))
-            process.stopped = true;
-        else {
-            const did = await stopProcessGroup(process);
-            process.stopped = did;
-            if (!did)
-                stopped = false;
-        }
-    }
-    return stopped;
-}
-export async function generateBatchMember(state, body) {
-    if (!body || typeof body !== 'object' || !('occupancyId' in body) || !body.occupancyId)
-        throw new Error('occupancy_required');
-    const parsed = sandboxBatchMemberGenerateSchema.safeParse(body);
-    if (!parsed.success)
-        throw new Error('invalid_batch_request');
-    const command = parsed.data;
-    const hash = hashCommand(command);
-    return serializeRun(command.runId, async () => {
-        attachNativeCollector(state);
-        const existing = await readMember(state, command.runId);
-        if (existing && command.ownerFence < existing.ownerFence)
-            throw new Error('stale_owner');
-        if (await readStopMarker(state, command.runId))
-            return memberStatus(await stoppedRecord(state, command, existing));
-        if (existing && existing.ownerFence === command.ownerFence && existing.commandHash?.generate === hash && existing.phase === 'generate' && existing.state !== 'running') {
-            return memberStatus(await reconcileGenerate(state, existing));
-        }
-        if (existing && existing.ownerFence === command.ownerFence && existing.commandHash?.generate && existing.commandHash.generate !== hash)
-            throw new Error('batch_command_conflict');
-        const root = await workspaceRoot(state, command.workspaceId, command.directoryName);
-        const sessionId = command.sessionId ?? existing?.sessionId ?? `member-${command.runId}`;
-        const tempDir = join(state.config.stateDir, 'batch-temp', command.runId);
-        await mkdir(tempDir, { recursive: true, mode: 0o700 });
-        const policy = memberExecutionPolicy(root, tempDir);
-        await bindMemberPolicy(state, sessionId, policy);
-        const modelConfigId = command.model && /^[0-9a-f-]{36}$/i.test(command.model) ? command.model : undefined;
-        const turnPayload = { text: command.prompt, permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) };
-        const turnKey = operation(state, { kind: 'session.turn', clientRequestId: `batch-turn:${command.runId}`, sessionId, workspaceId: command.workspaceId, directoryName: command.directoryName, payload: turnPayload });
-        const prior = state.journal.getOperation(turnKey.scopeKey);
-        if (prior && prior.payloadHash !== turnKey.record.payloadHash)
-            throw new Error('batch_command_conflict');
-        const sourceCommit = existing?.sourceCommit ?? state.journal.getWorkspace(command.workspaceId)?.directories?.find(directory => directory.directoryName === command.directoryName)?.sourceCommit;
-        const beforeTree = existing?.beforeTree ?? (prior ? sourceCommit : await snapshotWorkspaceTree(root));
-        let record = await writeMember(state, {
-            runId: command.runId, ownerFence: command.ownerFence, occupancyId: command.occupancyId, workspaceId: command.workspaceId,
-            directoryName: command.directoryName, phase: 'generate', state: prior ? (prior.status === 'uncertain' ? 'unknown' : prior.status === 'completed' ? 'completed' : 'running') : 'running',
-            writersStopped: false, holding: true, stopRequested: false, processes: existing?.processes ?? [], sessionId,
-            operationId: prior?.operationId, commandHash: { ...existing?.commandHash, generate: hash },
-            snapshotDigest: existing?.snapshotDigest, branchName: existing?.branchName, headCommit: existing?.headCommit,
-            sourceCommit, beforeTree,
-            updatedAt: new Date().toISOString(),
-        });
-        if (prior)
-            return memberStatus(await finishGenerate(state, record, prior, root));
-        if (!state.native?.ready()) {
-            record = await writeMember(state, { ...record, state: 'failed', writersStopped: true, holding: false, error: 'capability_unavailable' });
-            return memberStatus(record);
-        }
-        const terminals = new Map();
-        const unsubscribe = state.native.onCollected?.((event) => {
-            const threadId = threadIdOf(event);
-            const terminal = turnTerminal(event);
-            if (!threadId || !terminal)
-                return;
-            if (terminals.get(threadId) === 'needs_user')
-                return;
-            terminals.set(threadId, terminal);
-        });
-        try {
-            if (!state.journal.getSession(sessionId)) {
-                const created = operation(state, { kind: 'session.create', clientRequestId: `batch-create:${command.runId}`, sessionId, workspaceId: command.workspaceId, directoryName: command.directoryName, payload: { permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) } });
-                if (!state.journal.getOperation(created.scopeKey))
-                    await executeOperation(state, created.scopeKey, created.record, { permissionMode: 'auto', ...(modelConfigId ? { modelConfigId } : {}) });
-            }
-            if (await readStopMarker(state, command.runId))
-                return memberStatus(await stoppedRecord(state, command, record));
-            const started = await executeOperation(state, turnKey.scopeKey, turnKey.record, turnPayload);
-            record = await writeMember(state, { ...record, operationId: started.operationId, sessionId });
-            return memberStatus(await finishGenerate(state, record, started, root, () => {
-                const threadId = state.journal.getSession(sessionId)?.threadId;
-                return threadId ? terminals.get(threadId) : undefined;
-            }));
-        }
-        finally {
-            unsubscribe?.();
-        }
-    });
-}
-async function finishGenerate(state, record, started, root, early) {
-    if (await readStopMarker(state, record.runId))
-        return stoppedRecord(state, { ...record, occupancyId: record.occupancyId }, record);
-    const sessionId = record.sessionId;
-    let terminal = early?.();
-    if (!terminal && (started.status === 'uncertain' || started.error === 'native_receipt_lost')) {
-        return writeMember(state, { ...record, state: 'unknown', writersStopped: false, holding: true, operationId: started.operationId, error: 'native_receipt_lost' });
-    }
-    if (!terminal && started.status === 'failed') {
-        const writersStopped = await proveStopped(record);
-        return writeMember(state, { ...record, state: writersStopped ? 'failed' : 'stopping', writersStopped, holding: !writersStopped, operationId: started.operationId, error: started.error ?? 'batch_turn_failed' });
-    }
-    const deadline = Date.now() + 5_000;
-    while (!terminal && Date.now() < deadline) {
-        terminal = early?.();
-        const session = state.journal.getSession(sessionId);
-        if (session?.turnStatus === 'waiting_for_user')
-            terminal = 'needs_user';
-        else if (session?.turnStatus === 'completed')
-            terminal = 'completed';
-        else if (session?.turnStatus === 'failed')
-            terminal = 'failed';
-        else if (session?.turnStatus === 'interrupted')
-            terminal = 'interrupted';
-        if (!terminal)
-            await delay(15);
-    }
-    if (terminal === 'needs_user') {
-        const session = state.journal.getSession(sessionId);
-        if (session?.threadId)
-            await state.native?.interrupt?.({ sessionId, threadId: session.threadId }).catch(() => undefined);
-        const writersStopped = await proveStopped(record);
-        if (await readStopMarker(state, record.runId))
-            return stoppedRecord(state, record, record);
-        return writeMember(state, {
-            ...record, state: writersStopped ? 'needs_user' : 'stopping', writersStopped, holding: writersStopped ? false : true,
-            operationId: started.operationId, error: writersStopped ? 'needs_user' : undefined,
-        });
-    }
-    if (terminal === 'completed') {
-        const writersStopped = await proveStopped(record);
-        if (!writersStopped)
-            return writeMember(state, { ...record, state: 'stopping', writersStopped: false, holding: true, operationId: started.operationId });
-        if (await readStopMarker(state, record.runId))
-            return stoppedRecord(state, record, record);
-        return completeGeneration(state, { ...record, operationId: started.operationId }, root);
-    }
-    if (!terminal) {
-        return writeMember(state, {
-            ...record, state: 'running', writersStopped: false, holding: true, operationId: started.operationId, error: undefined,
-        });
-    }
-    const writersStopped = await proveStopped(record);
-    return writeMember(state, {
-        ...record, state: writersStopped ? (terminal === 'interrupted' ? 'stopped' : 'failed') : 'unknown',
-        writersStopped, holding: !writersStopped, operationId: started.operationId,
-        error: writersStopped ? (terminal === 'interrupted' ? undefined : 'batch_turn_failed') : 'native_receipt_lost',
-    });
-}
-/** A later status read finishes a generate turn that was still running when dispatch returned. */
-export async function settleObservedGenerate(state, record) {
-    if (record.phase !== 'generate' || record.state !== 'running' || record.stopRequested)
-        return record;
-    const session = record.sessionId ? state.journal.getSession(record.sessionId) : undefined;
-    if (!session || session.turnBlock === 'uncertain' || session.turnStatus === 'starting' || session.turnStatus === 'running')
-        return record;
-    const terminal = session.turnStatus === 'completed' ? 'completed'
-        : session.turnStatus === 'failed' ? 'failed'
-            : session.turnStatus === 'interrupted' ? 'interrupted'
-                : session.turnStatus === 'waiting_for_user' ? 'needs_user'
-                    : undefined;
-    if (!terminal)
-        return record;
-    const root = await workspaceRoot(state, record.workspaceId, record.directoryName);
-    return finishGenerate(state, record, { operationId: record.operationId, status: 'accepted' }, root, () => terminal);
-}
-async function reconcileGenerate(state, record) {
-    const session = record.sessionId ? state.journal.getSession(record.sessionId) : undefined;
-    if (record.state === 'unknown' && session?.turnStatus === 'completed') {
-        const writersStopped = await proveStopped(record);
-        if (writersStopped && !await readStopMarker(state, record.runId)) {
-            const root = await workspaceRoot(state, record.workspaceId, record.directoryName);
-            return completeGeneration(state, record, root);
-        }
-    }
-    return record;
-}
-async function completeGeneration(state, record, root) {
-    try {
-        const afterTree = await snapshotWorkspaceTree(root);
-        await requireBatchContentChanges(root, record.beforeTree ?? '', afterTree);
-        await requireBatchContentChanges(root, record.sourceCommit ?? '', afterTree);
-    }
-    catch (error) {
-        const code = error instanceof Error && /^[a-z0-9_]+$/.test(error.message) ? error.message : 'batch_generation_failed';
-        return writeMember(state, { ...record, state: 'failed', writersStopped: true, holding: false, error: code });
-    }
-    if (await readStopMarker(state, record.runId))
-        return stoppedRecord(state, record, record);
-    const head = await import('./git.js').then(git => git.gitRead(root, ['rev-parse', 'HEAD'])).then(value => value.trim()).catch(() => record.headCommit);
-    return writeMember(state, { ...record, state: 'completed', writersStopped: true, holding: true, headCommit: head, error: undefined });
-}
-async function stoppedRecord(state, command, existing) {
-    if (existing)
-        await proveStopped(existing);
-    return writeMember(state, {
-        runId: command.runId, ownerFence: command.ownerFence, occupancyId: command.occupancyId, workspaceId: command.workspaceId,
-        directoryName: command.directoryName, phase: existing?.phase ?? 'generate', state: 'stopped', writersStopped: true, holding: false,
-        stopRequested: true, processes: existing?.processes ?? [], sessionId: existing?.sessionId, operationId: existing?.operationId,
-        headCommit: existing?.headCommit, evidence: existing?.evidence, commandHash: existing?.commandHash, snapshotDigest: existing?.snapshotDigest,
-        branchName: existing?.branchName, updatedAt: new Date().toISOString(),
-        sourceCommit: existing?.sourceCommit, beforeTree: existing?.beforeTree,
-    });
-}

package/dist/workspace-runtime/batch/git.js

@@ -1,40 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { dirname } from 'node:path';
-const execute = promisify(execFile);
-/** Read-only git. An empty credential helper keeps the source checkout from authenticating or writing. */
-export async function gitRead(root, args) {
-    return runGit(root, ['-c', 'credential.helper=', ...args]);
-}
-/** Push and fetch. Local credential helpers copied onto this repo stay in effect. */
-export async function gitWrite(root, args) {
-    return runGit(root, args);
-}
-async function runGit(root, args) {
-    const { stdout } = await execute('git', [
-        '-c', 'core.hooksPath=/dev/null', '-c', 'init.templateDir=', '-c', 'core.fsmonitor=false', '-C', root, ...args,
-    ], {
-        timeout: 90_000, maxBuffer: 64 * 1024 * 1024,
-        env: {
-            PATH: process.env.PATH, HOME: dirname(root), GIT_OPTIONAL_LOCKS: '0',
-            GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0',
-        },
-    });
-    return stdout;
-}
-/** Copies URL credential helpers onto a snapshot repo without reading or writing the source config. */
-export async function copyCredentialHelpers(sourceRoot, destinationRoot) {
-    const listed = await gitRead(sourceRoot, ['config', '--local', '--get-regexp', '^(credential\\.|http\\.|url\\.)']).catch(() => '');
-    for (const line of listed.split('\n')) {
-        if (!line)
-            continue;
-        const space = line.indexOf(' ');
-        if (space < 1)
-            continue;
-        const key = line.slice(0, space);
-        const value = line.slice(space + 1);
-        if (!/^(credential\.|http\.|url\.)/.test(key) || /[\r\n]/.test(value))
-            continue;
-        await gitWrite(destinationRoot, ['config', '--local', key, value]);
-    }
-}

package/dist/workspace-runtime/batch/occupancy.js

@@ -1,8 +0,0 @@
-import { listMembers } from './records.js';
-/** True while a member Run still holds the directory. Other sandbox write entries must refuse it. */
-export async function batchDirectoryHeld(state, workspaceId, directoryName = 'basic') {
-    if (!workspaceId)
-        return false;
-    const members = await listMembers(state);
-    return members.some(record => record.holding && record.workspaceId === workspaceId && record.directoryName === directoryName);
-}

package/dist/workspace-runtime/batch/policy.js

@@ -1,70 +0,0 @@
-import { readFileSync, mkdirSync, writeFileSync, renameSync } from 'node:fs';
-import { randomUUID } from 'node:crypto';
-import { dirname, join } from 'node:path';
-const memory = new WeakMap();
-/** Unattended member execution: workspace-write to the member directory and one controlled temp dir. */
-export function memberExecutionPolicy(cwd, tempDir) {
-    return {
-        cwd,
-        approvalPolicy: 'never',
-        sandboxPolicy: {
-            type: 'workspaceWrite',
-            writableRoots: [cwd, tempDir],
-            networkAccess: true,
-            excludeTmpdirEnvVar: true,
-            excludeSlashTmp: true,
-        },
-    };
-}
-function policyPath(state, sessionId) {
-    return join(state.config.stateDir, 'batch-sessions', `${sessionId.replace(/[^a-zA-Z0-9._-]/g, '_')}.json`);
-}
-function parsePolicy(raw) {
-    const value = JSON.parse(raw);
-    if (value?.approvalPolicy !== 'never' || value.sandboxPolicy?.type !== 'workspaceWrite')
-        return undefined;
-    if (!value.cwd || !Array.isArray(value.sandboxPolicy.writableRoots) || value.sandboxPolicy.writableRoots.length === 0)
-        return undefined;
-    if (!value.sandboxPolicy.excludeSlashTmp || !value.sandboxPolicy.excludeTmpdirEnvVar)
-        return undefined;
-    return value;
-}
-export async function bindMemberPolicy(state, sessionId, policy) {
-    const path = policyPath(state, sessionId);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    const temporary = `${path}.${randomUUID()}.tmp`;
-    writeFileSync(temporary, JSON.stringify(policy), { mode: 0o600 });
-    renameSync(temporary, path);
-    const map = memory.get(state) ?? new Map();
-    map.set(sessionId, policy);
-    memory.set(state, map);
-}
-/** Synchronous: the shared session adapter reapplies this on every thread start and resume. */
-export function trustedMemberPolicy(state, sessionId) {
-    const cached = memory.get(state)?.get(sessionId);
-    if (cached)
-        return cached;
-    try {
-        const parsed = parsePolicy(readFileSync(policyPath(state, sessionId), 'utf8'));
-        if (!parsed) {
-            return {
-                cwd: state.config.workspaceRoot,
-                approvalPolicy: 'never',
-                sandboxPolicy: { type: 'readOnly', networkAccess: false },
-            };
-        }
-        const map = memory.get(state) ?? new Map();
-        map.set(sessionId, parsed);
-        memory.set(state, map);
-        return parsed;
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return undefined;
-        return {
-            cwd: state.config.workspaceRoot,
-            approvalPolicy: 'never',
-            sandboxPolicy: { type: 'readOnly', networkAccess: false },
-        };
-    }
-}