@playcraft/cli 0.1.54 → 0.1.55-beta

package/dist/workspace-runtime/batch/source-capture.js

@@ -0,0 +1,146 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative } from 'node:path';
+import { gzip, gunzip } from 'node:zlib';
+import { promisify } from 'node:util';
+import { excludeFromGit } from '../workspaces/dependencies.js';
+import { gitRead, gitWrite } from './git.js';
+const compress = promisify(gzip);
+const decompress = promisify(gunzip);
+const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
+    '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
+    'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
+function included(path) {
+    return !path.split('/').some(name => privateNames.has(name) || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name))
+        && !path.startsWith('.playcraft/skills/');
+}
+/** Git keeps only the executable bit, so the digest must not depend on umask or group-write bits. */
+function snapshotMode(mode) {
+    return mode & 0o111 ? 0o755 : 0o644;
+}
+function inside(root, path) {
+    const rel = relative(root, path);
+    return rel !== '..' && !rel.startsWith('../') && !isAbsolute(rel);
+}
+export function digestFiles(files) {
+    const hash = createHash('sha256');
+    for (const [path, file] of files)
+        hash.update(path).update('\0').update(String(file.mode)).update('\0').update(file.body).update('\0');
+    return hash.digest('hex');
+}
+/** Files Git will accept. Credentials, caches and node_modules are left out. */
+export async function readSourceFiles(root) {
+    const source = await realpath(root);
+    const paths = new Set((await gitRead(source, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'])).split('\0').filter(Boolean));
+    const files = new Map();
+    for (const path of [...paths].sort()) {
+        if (!included(path))
+            continue;
+        const full = join(source, path);
+        const stat = await lstat(full).catch(error => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (!stat)
+            continue;
+        if (!stat.isFile() || stat.isSymbolicLink() || !inside(source, await realpath(full)))
+            throw new Error('batch_source_path_invalid');
+        const handle = await open(full, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            files.set(path, { body: await handle.readFile(), mode: snapshotMode(stat.mode) });
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    return files;
+}
+/**
+ * Drops paths whose bytes change between two reads. A managed writer that could not be stopped
+ * does not become part of the frozen input.
+ */
+export async function filterUnstableFiles(root, files) {
+    const again = await readSourceFiles(root);
+    const stable = new Map();
+    for (const [path, file] of files) {
+        const next = again.get(path);
+        if (next && next.body.equals(file.body) && next.mode === file.mode)
+            stable.set(path, file);
+    }
+    return stable;
+}
+/** Independent root commit. The source branch, index and config are never written. */
+export async function captureIndependentSource(source, destination) {
+    const root = await realpath(source);
+    if (await lstat(destination).catch(() => undefined))
+        throw new Error('batch_source_destination_exists');
+    const headBefore = await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => '');
+    let files = await readSourceFiles(root);
+    files = await filterUnstableFiles(root, files);
+    const contentDigest = digestFiles(files);
+    const staging = join(dirname(destination), `.batch-source-${randomUUID()}`);
+    try {
+        await mkdir(staging, { recursive: true });
+        await gitWrite(staging, ['init', '--initial-branch', 'source']);
+        await gitWrite(staging, ['config', 'user.name', 'PlayCraft']);
+        await gitWrite(staging, ['config', 'user.email', 'playcraft@localhost']);
+        for (const [path, file] of files) {
+            const full = join(staging, path);
+            await mkdir(dirname(full), { recursive: true });
+            await writeFile(full, file.body, { mode: file.mode, flag: 'wx' });
+        }
+        if (headBefore !== await gitRead(root, ['rev-parse', '--verify', 'HEAD']).catch(() => ''))
+            throw new Error('batch_source_changed');
+        const after = await filterUnstableFiles(root, await readSourceFiles(root));
+        if (digestFiles(after) !== contentDigest)
+            throw new Error('batch_source_changed');
+        await excludeFromGit(staging);
+        await excludeFromGit(staging, '/.env*');
+        for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skills/', '/.playcraft-temp/'])
+            await excludeFromGit(staging, entry);
+        await gitWrite(staging, ['add', '-A', '.']);
+        await gitWrite(staging, ['commit', '--allow-empty', '-m', 'Freeze batch source']);
+        const commitHash = (await gitWrite(staging, ['rev-parse', 'HEAD'])).trim();
+        await rename(staging, destination);
+        return { commitHash, digest: commitHash };
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+export async function archiveSource(root, meta) {
+    const bundle = join(dirname(root), `.bundle-${randomUUID()}`);
+    try {
+        await gitWrite(root, ['bundle', 'create', bundle, 'HEAD']);
+        const body = JSON.stringify({ version: 1, ...meta, bundle: (await readFile(bundle)).toString('base64') });
+        return await compress(Buffer.from(body));
+    }
+    finally {
+        await rm(bundle, { force: true });
+    }
+}
+export async function restoreArchive(body, destination, expectedDigest) {
+    const archive = JSON.parse((await decompress(body, { maxOutputLength: 512 * 1024 * 1024 })).toString());
+    if (archive.version !== 1 || archive.digest !== expectedDigest || !archive.commitHash || !archive.bundle)
+        throw new Error('batch_snapshot_mismatch');
+    const temporary = join(dirname(destination), `.bundle-${randomUUID()}`);
+    await mkdir(temporary, { recursive: true });
+    try {
+        const bundle = join(temporary, 'source.bundle');
+        await writeFile(bundle, Buffer.from(archive.bundle, 'base64'), { mode: 0o600 });
+        await gitWrite(temporary, ['clone', '--no-checkout', '--', bundle, destination]);
+        await gitWrite(destination, ['checkout', '--detach', archive.commitHash]);
+        if ((await gitRead(destination, ['rev-parse', 'HEAD'])).trim() !== archive.commitHash)
+            throw new Error('batch_snapshot_mismatch');
+        return { commitHash: archive.commitHash };
+    }
+    catch (error) {
+        await rm(destination, { recursive: true, force: true });
+        throw error;
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+}

package/dist/workspace-runtime/batch/source-failure.js

@@ -0,0 +1,43 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+export class BatchSourceFreezeError extends Error {
+    failure;
+    constructor(failure) {
+        super(failure.code);
+        this.failure = failure;
+        this.name = 'BatchSourceFreezeError';
+    }
+}
+/** Diagnostics keep the upstream reason without command arguments, authentication or remote addresses. */
+function redactedReason(error) {
+    const detail = error;
+    const text = typeof detail?.stderr === 'string' || typeof detail?.stdout === 'string'
+        ? `${typeof detail.stderr === 'string' ? detail.stderr : ''}\n${typeof detail.stdout === 'string' ? detail.stdout : ''}`
+        : typeof detail?.message === 'string' ? detail.message : 'unknown';
+    return text
+        .replace(/https?:\/\/[^\s<>"']+/gi, '<remote>')
+        .replace(/\b(Bearer|Basic)\s+[^\s,;"']+/gi, '$1 <redacted>')
+        .replace(/((?:password|token|secret|authorization|credential)\s*[:=]\s*)[^\s,;"']+/gi, '$1<redacted>')
+        .replace(/\b(?:gh[pousr]_|github_pat_|glpat-)[A-Za-z0-9_-]+/g, '<redacted>')
+        .slice(0, 16_384);
+}
+export async function sourceFreezeError(state, batchId, failure, cause) {
+    if (cause === undefined)
+        return new BatchSourceFreezeError(failure);
+    const diagnosticId = randomUUID();
+    const directory = join(state.config.stateDir, 'batch-source-diagnostics');
+    const detail = cause;
+    try {
+        await mkdir(directory, { recursive: true, mode: 0o700 });
+        await writeFile(join(directory, `${diagnosticId}.json`), JSON.stringify({
+            diagnosticId, batchId, ...failure, recordedAt: new Date().toISOString(), reason: redactedReason(cause),
+            exitCode: typeof detail?.code === 'number' ? detail.code : undefined,
+            signal: typeof detail?.signal === 'string' && /^SIG[A-Z]+$/.test(detail.signal) ? detail.signal : undefined,
+        }), { mode: 0o600, flag: 'wx' });
+        return new BatchSourceFreezeError({ ...failure, diagnosticId });
+    }
+    catch {
+        return new BatchSourceFreezeError(failure);
+    }
+}

package/dist/workspace-runtime/batch/source-publish.js

@@ -0,0 +1,130 @@
+import { lstat, mkdir, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { copyCredentialHelpers, gitRead, gitWrite } from './git.js';
+import { archiveSource, restoreArchive } from './source-capture.js';
+import { sourceCacheDir } from './records.js';
+import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
+async function reject(state, candidate, code, stage, retryable, outcome, cause) {
+    throw await sourceFreezeError(state, candidate.snapshot.batchId, { code, stage, retryable, outcome }, cause);
+}
+async function verifyCache(cache, candidate) {
+    return (await gitRead(cache, ['rev-parse', '--verify', 'HEAD']).catch(() => '')).trim() === candidate.snapshot.commitHash;
+}
+function pushFailureCode(error) {
+    const detail = error;
+    return /not support[^\n]*(?:ref|push)|unsupported[^\n]*(?:ref|namespace)/i.test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`)
+        ? 'batch_source_ref_unsupported' : 'batch_source_push_failed';
+}
+function definitelyRejected(error) {
+    const detail = error;
+    return /remote rejected|\[rejected\]|authentication failed|access denied|permission denied|not allowed|not support|hook declined|protected|returned error: (?:401|403)/i
+        .test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`);
+}
+async function publishRemote(state, candidate, source) {
+    const { snapshot, repositoryUrl: remote } = candidate;
+    const cache = sourceCacheDir(state, snapshot.batchId);
+    if (!remote || !snapshot.remoteRef)
+        return reject(state, candidate, 'batch_source_push_failed', 'publish', false, 'not_published');
+    await mkdir(cache, { recursive: true, mode: 0o700 });
+    if (!await lstat(join(cache, '.git')).catch(() => undefined))
+        await gitWrite(cache, ['init', '--initial-branch', 'source']);
+    await copyCredentialHelpers(source, cache);
+    // All remote operations share the copied authentication, including read-only verification.
+    const remoteHash = async () => {
+        const output = await gitWrite(cache, ['ls-remote', '--refs', remote, snapshot.remoteRef]);
+        const rows = output.trim().split('\n').filter(Boolean).map(line => line.split(/\s+/));
+        if (rows.some(([hash, ref]) => !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(hash) || ref !== snapshot.remoteRef) || rows.length > 1) {
+            throw new Error('batch_source_remote_response_invalid');
+        }
+        return rows[0]?.[0];
+    };
+    let found;
+    try {
+        found = await remoteHash();
+    }
+    catch (error) {
+        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+    }
+    if (found && found !== snapshot.commitHash)
+        return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown');
+    if (!found) {
+        if (!await verifyCache(cache, candidate))
+            return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'not_published');
+        let pushError;
+        try {
+            await gitWrite(cache, ['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
+        }
+        catch (error) {
+            pushError = error;
+        }
+        try {
+            found = await remoteHash();
+        }
+        catch (error) {
+            const unsupported = pushError !== undefined && pushFailureCode(pushError) === 'batch_source_ref_unsupported';
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', pushError ?? error);
+        }
+        if (found && found !== snapshot.commitHash)
+            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', pushError);
+        if (!found) {
+            const rejected = pushError !== undefined && definitelyRejected(pushError);
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', pushError);
+        }
+    }
+    if (!await verifyCache(cache, candidate)) {
+        try {
+            await gitWrite(cache, ['fetch', '--no-tags', remote, snapshot.remoteRef]);
+            if ((await gitRead(cache, ['rev-parse', 'FETCH_HEAD^{commit}'])).trim() !== snapshot.commitHash) {
+                return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
+            }
+            await gitWrite(cache, ['checkout', '--detach', snapshot.commitHash]);
+        }
+        catch (error) {
+            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+        }
+        if (!await verifyCache(cache, candidate))
+            return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
+    }
+    await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
+}
+async function publishArtifact(state, candidate, store) {
+    const { snapshot } = candidate;
+    const cache = sourceCacheDir(state, snapshot.batchId);
+    if (!snapshot.artifactKey)
+        return reject(state, candidate, 'batch_source_snapshot_mismatch', 'capture', false, 'not_published');
+    if (!await verifyCache(cache, candidate)) {
+        // A lost cache can only be restored from this candidate's already published archive.
+        try {
+            const archive = await store.get(snapshot.artifactKey);
+            await rm(cache, { recursive: true, force: true });
+            const restored = await restoreArchive(archive, cache, snapshot.digest);
+            if (restored.commitHash !== snapshot.commitHash)
+                return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
+        }
+        catch (error) {
+            return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'unknown', error);
+        }
+    }
+    else {
+        try {
+            await store.put(snapshot.artifactKey, await archiveSource(cache, snapshot));
+        }
+        catch (error) {
+            return reject(state, candidate, 'batch_source_upload_failed', 'publish', true, 'unknown', error);
+        }
+    }
+    await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
+}
+export async function publishSourceCandidate(state, candidate, source, store) {
+    try {
+        if (candidate.persist === 'remote_ref')
+            await publishRemote(state, candidate, source);
+        else
+            await publishArtifact(state, candidate, store);
+    }
+    catch (error) {
+        if (error instanceof BatchSourceFreezeError)
+            throw error;
+        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
+    }
+}