@playcraft/cli 0.1.49-beta → 0.1.51

package/dist/workspace-runtime/batch/source-capture.js

@@ -1,146 +0,0 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { constants } from 'node:fs';
-import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
-import { dirname, isAbsolute, join, relative } from 'node:path';
-import { gzip, gunzip } from 'node:zlib';
-import { promisify } from 'node:util';
-import { excludeFromGit } from '../workspaces/dependencies.js';
-import { gitRead, gitWrite } from './git.js';
-const compress = promisify(gzip);
-const decompress = promisify(gunzip);
-const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
-    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
-    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
-function included(path) {
-    return !path.split('/').some(name => privateNames.has(name) || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name))
-        && !path.startsWith('.playcraft/skills/');
-}
-/** Git keeps only the executable bit, so the digest must not depend on umask or group-write bits. */
-function snapshotMode(mode) {
-    return mode & 0o111 ? 0o755 : 0o644;
-}
-function inside(root, path) {
-    const rel = relative(root, path);
-    return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel);
-}
-export function digestFiles(files) {
-    const hash = createHash('sha256');
-    for (const [path, file] of files)
-        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
-    return hash.digest('hex');
-}
-/** Files Git will accept. Credentials, caches and node_modules are left out. */
-export async function readSourceFiles(root) {
-    const source = await realpath(root);
-    const paths = new Set((await gitRead(source, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'])).split('\0').filter(Boolean));
-    const files = new Map();
-    for (const path of [...paths].sort()) {
-        if (!included(path))
-            continue;
-        const full = join(source, path);
-        const stat = await lstat(full).catch(error => {
-            if (error.code === 'ENOENT')
-                return undefined;
-            throw error;
-        });
-        if (!stat)
-            continue;
-        if (!stat.isFile() || stat.isSymbolicLink() || !inside(source, await realpath(full)))
-            throw new Error('batch_source_path_invalid');
-        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            files.set(path, { body: await handle.readFile(), mode: snapshotMode(stat.mode) });
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    return files;
-}
-/**
- * Drops paths whose bytes change between two reads. A managed writer that could not be stopped
- * does not become part of the frozen input.
- */
-export async function filterUnstableFiles(root, files) {
-    const again = await readSourceFiles(root);
-    const stable = new Map();
-    for (const [path, file] of files) {
-        const next = again.get(path);
-        if (next && next.body.equals(file.body) && next.mode === file.mode)
-            stable.set(path, file);
-    }
-    return stable;
-}
-/** Independent root commit. The source branch, index and config are never written. */
-export async function captureIndependentSource(source, destination) {
-    const root = await realpath(source);
-    if (await lstat(destination).catch(() => undefined))
-        throw new Error('batch_source_destination_exists');
-    const headBefore = await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => '');
-    let files = await readSourceFiles(root);
-    files = await filterUnstableFiles(root, files);
-    const contentDigest = digestFiles(files);
-    const staging = join(dirname(destination), `.batch-source-${randomUUID()}`);
-    try {
-        await mkdir(staging, { recursive: true });
-        await gitWrite(staging, ['init', '--initial-branch', 'source']);
-        await gitWrite(staging, ['config', 'user.name', 'PlayCraft']);
-        await gitWrite(staging, ['config', 'user.email', 'playcraft@localhost']);
-        for (const [path, file] of files) {
-            const full = join(staging, path);
-            await mkdir(dirname(full), { recursive: true });
-            await writeFile(full, file.body, { mode: file.mode, flag: 'wx' });
-        }
-        if (headBefore !== await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => ''))
-            throw new Error('batch_source_changed');
-        const after = await filterUnstableFiles(root, await readSourceFiles(root));
-        if (digestFiles(after) !== contentDigest)
-            throw new Error('batch_source_changed');
-        await excludeFromGit(staging);
-        await excludeFromGit(staging, '/.env*');
-        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skills/', '/.playcraft-temp/'])
-            await excludeFromGit(staging, entry);
-        await gitWrite(staging, ['add', '-A', '.']);
-        await gitWrite(staging, ['commit', '--allow-empty', '-m', 'Freeze batch source']);
-        const commitHash = (await gitWrite(staging, ['rev-parse', 'HEAD'])).trim();
-        await rename(staging, destination);
-        return { commitHash, digest: commitHash };
-    }
-    finally {
-        await rm(staging, { recursive: true, force: true });
-    }
-}
-export async function archiveSource(root, meta) {
-    const bundle = join(dirname(root), `.bundle-${randomUUID()}`);
-    try {
-        await gitWrite(root, ['bundle', 'create', bundle, 'HEAD']);
-        const body = JSON.stringify({ version: 1, ...meta, bundle: (await readFile(bundle)).toString('base64') });
-        return await compress(Buffer.from(body));
-    }
-    finally {
-        await rm(bundle, { force: true });
-    }
-}
-export async function restoreArchive(body, destination, expectedDigest) {
-    const archive = JSON.parse((await decompress(body, { maxOutputLength: 512 * 1024 * 1024 })).toString());
-    if (archive.version !== 1 || archive.digest !== expectedDigest || !archive.commitHash || !archive.bundle)
-        throw new Error('batch_snapshot_mismatch');
-    const temporary = join(dirname(destination), `.bundle-${randomUUID()}`);
-    await mkdir(temporary, { recursive: true });
-    try {
-        const bundle = join(temporary, 'source.bundle');
-        await writeFile(bundle, Buffer.from(archive.bundle, 'base64'), { mode: 0o600 });
-        await gitWrite(temporary, ['clone', '--no-checkout', '--', bundle, destination]);
-        await gitWrite(destination, ['checkout', '--detach', archive.commitHash]);
-        if ((await gitRead(destination, ['rev-parse', 'HEAD'])).trim() !== archive.commitHash)
-            throw new Error('batch_snapshot_mismatch');
-        return { commitHash: archive.commitHash };
-    }
-    catch (error) {
-        await rm(destination, { recursive: true, force: true });
-        throw error;
-    }
-    finally {
-        await rm(temporary, { recursive: true, force: true });
-    }
-}

package/dist/workspace-runtime/batch/source-failure.js

@@ -1,43 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { mkdir, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-export class BatchSourceFreezeError extends Error {
-    failure;
-    constructor(failure) {
-        super(failure.code);
-        this.failure = failure;
-        this.name = 'BatchSourceFreezeError';
-    }
-}
-/** Diagnostics keep the upstream reason without command arguments, authentication or remote addresses. */
-function redactedReason(error) {
-    const detail = error;
-    const text = typeof detail?.stderr === 'string' || typeof detail?.stdout === 'string'
-        ? `${typeof detail.stderr === 'string' ? detail.stderr : ''}\n${typeof detail.stdout === 'string' ? detail.stdout : ''}`
-        : typeof detail?.message === 'string' ? detail.message : 'unknown';
-    return text
-        .replace(/https?:\/\/[^\s<>"']+/gi, '<remote>')
-        .replace(/\b(Bearer|Basic)\s+[^\s,;"']+/gi, '$1 <redacted>')
-        .replace(/((?:password|token|secret|authorization|credential)\s*[:=]\s*)[^\s,;"']+/gi, '$1<redacted>')
-        .replace(/\b(?:gh[pousr]_|github_pat_|glpat-)[A-Za-z0-9_-]+/g, '<redacted>')
-        .slice(0, 16_384);
-}
-export async function sourceFreezeError(state, batchId, failure, cause) {
-    if (cause === undefined)
-        return new BatchSourceFreezeError(failure);
-    const diagnosticId = randomUUID();
-    const directory = join(state.config.stateDir, 'batch-source-diagnostics');
-    const detail = cause;
-    try {
-        await mkdir(directory, { recursive: true, mode: 0o700 });
-        await writeFile(join(directory, `${diagnosticId}.json`), JSON.stringify({
-            diagnosticId, batchId, ...failure, recordedAt: new Date().toISOString(), reason: redactedReason(cause),
-            exitCode: typeof detail?.code === 'number' ? detail.code : undefined,
-            signal: typeof detail?.signal === 'string' && /^SIG[A-Z]+$/.test(detail.signal) ? detail.signal : undefined,
-        }), { mode: 0o600, flag: 'wx' });
-        return new BatchSourceFreezeError({ ...failure, diagnosticId });
-    }
-    catch {
-        return new BatchSourceFreezeError(failure);
-    }
-}

package/dist/workspace-runtime/batch/source-publish.js

@@ -1,130 +0,0 @@
-import { lstat, mkdir, rm, writeFile } from 'node:fs/promises';
-import { join } from 'node:path';
-import { copyCredentialHelpers, gitRead, gitWrite } from './git.js';
-import { archiveSource, restoreArchive } from './source-capture.js';
-import { sourceCacheDir } from './records.js';
-import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
-async function reject(state, candidate, code, stage, retryable, outcome, cause) {
-    throw await sourceFreezeError(state, candidate.snapshot.batchId, { code, stage, retryable, outcome }, cause);
-}
-async function verifyCache(cache, candidate) {
-    return (await gitRead(cache, ['rev-parse', '--verify', 'HEAD']).catch(() => '')).trim() === candidate.snapshot.commitHash;
-}
-function pushFailureCode(error) {
-    const detail = error;
-    return /not support[^\n]*(?:ref|push)|unsupported[^\n]*(?:ref|namespace)/i.test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`)
-        ? 'batch_source_ref_unsupported' : 'batch_source_push_failed';
-}
-function definitelyRejected(error) {
-    const detail = error;
-    return /remote rejected|\[rejected\]|authentication failed|access denied|permission denied|not allowed|not support|hook declined|protected|returned error: (?:401|403)/i
-        .test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`);
-}
-async function publishRemote(state, candidate, source) {
-    const { snapshot, repositoryUrl: remote } = candidate;
-    const cache = sourceCacheDir(state, snapshot.batchId);
-    if (!remote || !snapshot.remoteRef)
-        return reject(state, candidate, 'batch_source_push_failed', 'publish', false, 'not_published');
-    await mkdir(cache, { recursive: true, mode: 0o700 });
-    if (!await lstat(join(cache, '.git')).catch(() => undefined))
-        await gitWrite(cache, ['init', '--initial-branch', 'source']);
-    await copyCredentialHelpers(source, cache);
-    // All remote operations share the copied authentication, including read-only verification.
-    const remoteHash = async () => {
-        const output = await gitWrite(cache, ['ls-remote', '--refs', remote, snapshot.remoteRef]);
-        const rows = output.trim().split('\n').filter(Boolean).map(line => line.split(/\s+/));
-        if (rows.some(([hash, ref]) => !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(hash) || ref !== snapshot.remoteRef) || rows.length > 1) {
-            throw new Error('batch_source_remote_response_invalid');
-        }
-        return rows[0]?.[0];
-    };
-    let found;
-    try {
-        found = await remoteHash();
-    }
-    catch (error) {
-        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
-    }
-    if (found && found !== snapshot.commitHash)
-        return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown');
-    if (!found) {
-        if (!await verifyCache(cache, candidate))
-            return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'not_published');
-        let pushError;
-        try {
-            await gitWrite(cache, ['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
-        }
-        catch (error) {
-            pushError = error;
-        }
-        try {
-            found = await remoteHash();
-        }
-        catch (error) {
-            const unsupported = pushError !== undefined && pushFailureCode(pushError) === 'batch_source_ref_unsupported';
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', pushError ?? error);
-        }
-        if (found && found !== snapshot.commitHash)
-            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', pushError);
-        if (!found) {
-            const rejected = pushError !== undefined && definitelyRejected(pushError);
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', pushError);
-        }
-    }
-    if (!await verifyCache(cache, candidate)) {
-        try {
-            await gitWrite(cache, ['fetch', '--no-tags', remote, snapshot.remoteRef]);
-            if ((await gitRead(cache, ['rev-parse', 'FETCH_HEAD^{commit}'])).trim() !== snapshot.commitHash) {
-                return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
-            }
-            await gitWrite(cache, ['checkout', '--detach', snapshot.commitHash]);
-        }
-        catch (error) {
-            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
-        }
-        if (!await verifyCache(cache, candidate))
-            return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
-    }
-    await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
-}
-async function publishArtifact(state, candidate, store) {
-    const { snapshot } = candidate;
-    const cache = sourceCacheDir(state, snapshot.batchId);
-    if (!snapshot.artifactKey)
-        return reject(state, candidate, 'batch_source_snapshot_mismatch', 'capture', false, 'not_published');
-    if (!await verifyCache(cache, candidate)) {
-        // A lost cache can only be restored from this candidate's already published archive.
-        try {
-            const archive = await store.get(snapshot.artifactKey);
-            await rm(cache, { recursive: true, force: true });
-            const restored = await restoreArchive(archive, cache, snapshot.digest);
-            if (restored.commitHash !== snapshot.commitHash)
-                return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
-        }
-        catch (error) {
-            return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'unknown', error);
-        }
-    }
-    else {
-        try {
-            await store.put(snapshot.artifactKey, await archiveSource(cache, snapshot));
-        }
-        catch (error) {
-            return reject(state, candidate, 'batch_source_upload_failed', 'publish', true, 'unknown', error);
-        }
-    }
-    await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
-}
-export async function publishSourceCandidate(state, candidate, source, store) {
-    try {
-        if (candidate.persist === 'remote_ref')
-            await publishRemote(state, candidate, source);
-        else
-            await publishArtifact(state, candidate, store);
-    }
-    catch (error) {
-        if (error instanceof BatchSourceFreezeError)
-            throw error;
-        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
-    }
-}