@playcraft/cli 0.1.57-beta → 0.1.59-beta

package/dist/workspace-runtime/workspaces/artifacts.js

@@ -6,6 +6,7 @@ import sharp from 'sharp';
 import { WORKSPACE_ARTIFACT_OUTPUT_DIRECTORY, isWorkspaceArtifactOutputPath, isWorkspaceArtifactOutputVersion, workspaceArtifactContentQuerySchema, workspaceArtifactListSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { artifactBundleDigest, artifactDirectory, artifactFormat, artifactPath, artifactResources, snapshotArtifactBundle, snapshotArtifactFile } from './artifact-files.js';
 import { ARTIFACT_RECEIPTS_DIRECTORY, readArtifactReceipt } from './artifact-receipts.js';
+import { ensureSharedDirectory } from './shared-write.js';
 import { validateWorkspacePlayable } from '../previews/finalize.js';
 import { PREVIEW_HTML_MAX_BYTES, WORKSPACE_PLAYABLE_OUTPUT_PATH } from '@playcraft/common/cloud-workspace/runtime';
 const serial = new Map();
@@ -35,6 +36,7 @@ export class WorkspaceArtifactStore {
     }
     get scopeId() { return this.directoryName === 'basic' ? this.workspaceId : `${this.workspaceId}:${this.directoryName}`; }
     async directory() {
+        // private
         await mkdir(this.stateDir, { recursive: true, mode: 0o700 });
         return artifactDirectory(this.stateDir, `artifacts/${digest(this.scopeId)}`);
     }
@@ -64,6 +66,7 @@ export class WorkspaceArtifactStore {
     }
     async write(directory, catalog) {
         const temporary = join(directory, `${randomUUID()}.tmp`);
+        // private
         const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         try {
             await handle.writeFile(JSON.stringify(catalog));
@@ -281,7 +284,7 @@ export class WorkspaceArtifactStore {
             const target = join(root, ARTIFACT_RECEIPTS_DIRECTORY);
             if (!(await lstat(target)).isDirectory())
                 return [];
-            directory = await artifactDirectory(root, ARTIFACT_RECEIPTS_DIRECTORY);
+            directory = await ensureSharedDirectory(root, target);
         }
         catch {
             return [];

package/dist/workspace-runtime/workspaces/asset-library-import.js

@@ -5,6 +5,7 @@ import { basename, dirname, extname, join, relative } from 'node:path';
 import { BINARY_WORKSPACE_FILE_MAX_BYTES, WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES, WORKSPACE_LIBRARY_ATTACHMENT_MAX_FILES, workspaceAssetLibraryImportPayloadSchema, workspaceAssetLibraryImportResultSchema, workspaceAssetLibraryImportTransportSchema, workspaceRelativePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { observeWorkspaceBinaryFile, writeWorkspaceBinaryFile } from './binary-write.js';
 import { shareWorkspaceAssetDirectory } from './asset-publication-access.js';
+import { ensureSharedDirectory } from './shared-write.js';
 const RESERVED = new Set(['.git', 'node_modules', '.playcraft-temp', '.tmp']);
 const digest = (value) => createHash('sha256').update(value).digest('hex');
 const missing = (error) => error?.code === 'ENOENT';
@@ -23,6 +24,7 @@ async function safeDirectory(root, path, create = false) {
     let current = root;
     for (const part of path.split('/').filter(Boolean)) {
         current = join(current, part);
+        // private
         if (create)
             await mkdir(current, { mode: 0o700 }).catch((error) => {
                 if (error.code !== 'EEXIST')
@@ -47,8 +49,7 @@ async function createPublicDirectory(root, path) {
             if (!missing(error))
                 throw error;
             await safeDirectory(root, parent);
-            await mkdir(join(root, current), { mode: 0o700 });
-            await shareWorkspaceAssetDirectory(root, join(root, current));
+            await ensureSharedDirectory(root, join(root, current));
             await safeDirectory(root, current);
         }
     }
@@ -127,6 +128,7 @@ async function syncDirectory(path) {
 async function saveTransaction(root, transaction, value) {
     await safeDirectory(root, relative(root, transaction));
     const temporary = join(transaction, 'manifest.next');
+    // private
     const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_TRUNC | constants.O_NOFOLLOW, 0o600);
     try {
         await handle.writeFile(JSON.stringify(value));
@@ -181,6 +183,8 @@ export async function recoverInterruptedLibraryImports(root) {
             return result;
         throw error;
     }
+    // The shared scratch root is where both identities create their own private transactions.
+    await ensureSharedDirectory(rootReal, scratch);
     for (const entry of await readdir(scratch, { withFileTypes: true })) {
         if (!entry.isDirectory() || !entry.name.startsWith('library-import-'))
             continue;
@@ -239,9 +243,10 @@ async function publishBundle(root, target, asset, replace, assertCurrent, operat
     if (previous && (!replace || !previous.isDirectory() || previous.isSymbolicLink()))
         throw new AssetLibraryImportError('content_conflict');
     const originalHash = previous ? await directorySnapshot(join(root, target)) : undefined;
-    const scratch = await safeDirectory(root, '.playcraft-temp', true);
+    const scratch = await ensureSharedDirectory(root, join(root, '.playcraft-temp'));
     const transaction = await mkdtemp(join(scratch, 'library-import-'));
     const staged = join(transaction, 'incoming'), backup = join(transaction, 'previous');
+    // private
     await mkdir(staged, { mode: 0o700 });
     let moved = false, published = false, preserve = false;
     let reservation;
@@ -271,7 +276,7 @@ async function publishBundle(root, target, asset, replace, assertCurrent, operat
         }
         else if (current)
             throw new AssetLibraryImportError('content_conflict');
-        await mkdir(join(root, target), { mode: 0o700 });
+        await ensureSharedDirectory(root, join(root, target));
         reservation = await lstat(join(root, target));
         await saveTransaction(root, transaction, { ...manifest, phase: 'reserved', reservation: { dev: reservation.dev, ino: reservation.ino } });
         await assertCurrent();

package/dist/workspace-runtime/workspaces/asset-publication-access.js

@@ -1,19 +1,17 @@
 import { constants } from 'node:fs';
 import { lstat, open } from 'node:fs/promises';
+import { SHARED_DIRECTORY_MODE, SHARED_FILE_MODE, shareHandleWithGroup, } from './shared-write.js';
+/**
+ * Published workspace assets belong to the development group so both identities can read and edit
+ * them. Private transfers, chunks, transaction records and backups never use these helpers.
+ */
 async function shareWithWorkspaceGroup(root, handle, directory) {
     const workspace = await lstat(root), target = await handle.stat();
     if (!workspace.isDirectory() || workspace.isSymbolicLink()
         || (directory ? !target.isDirectory() : !target.isFile() || target.nlink !== 1))
         throw new Error('invalid_workspace_asset');
-    const shared = directory ? 0o2770 : 0o660;
-    // Already shared: the other identity owns this entry and cannot re-shape it from here.
-    if (target.gid === workspace.gid && (target.mode & 0o7777) === shared)
-        return;
-    if (target.gid !== workspace.gid)
-        await handle.chown(target.uid, workspace.gid);
-    // Match directory-access.ts: the development group can read and edit public project files.
-    // Private transfers, chunks, transaction records and backups never use these helpers.
-    await handle.chmod(shared);
+    // Already shared or owned by the other identity: shaping is a no-op, never a cross-owner EPERM.
+    await shareHandleWithGroup(handle, workspace.gid, directory ? SHARED_DIRECTORY_MODE : SHARED_FILE_MODE);
 }
 export async function shareWorkspaceAssetFile(root, handle) {
     await shareWithWorkspaceGroup(root, handle, false);

package/dist/workspace-runtime/workspaces/asset-transfer-publish.js

@@ -40,6 +40,7 @@ async function assemble(transfer) {
     const staged = [];
     for (const [index, file] of transfer.record.manifest.files.entries()) {
         const destination = join(transfer.directory, 'incoming', String(index));
+        // private
         const output = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         const hash = createHash('sha256');
         try {
@@ -120,6 +121,7 @@ async function createDirectories(transfer, path) {
             if (!assetTransferMissing(error))
                 throw error;
             await safeAssetTransferDirectory(transfer.root, dirname(directory) === '.' ? '' : dirname(directory));
+            // private
             await mkdir(join(transfer.root, directory), { mode: 0o700 });
             await shareWorkspaceAssetDirectory(transfer.root, join(transfer.root, directory));
             const stat = await lstat(await safeAssetTransferDirectory(transfer.root, directory));
@@ -146,6 +148,7 @@ async function ensureDirectoryMarkers(transfer) {
         const parent = await safeAssetTransferDirectory(transfer.root, path);
         const marker = join(parent, '.gitkeep');
         try {
+            // private
             const handle = await open(marker, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
             try {
                 await shareWorkspaceAssetFile(transfer.root, handle);

package/dist/workspace-runtime/workspaces/asset-transfer-storage.js

@@ -1,8 +1,9 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
 import { link, lstat, mkdir, open, readdir, realpath, rename, rm, unlink } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { ASSET_TRANSFER_BODY_MAX_BYTES, ASSET_TRANSFER_CHUNK_BYTES, ASSET_TRANSFER_FILE_MAX_BYTES, assetBundleReceiptSchema, assetTransferChunkSchema, assetTransferManifestSchema, assetTransferStatusSchema, hashAssetTransferManifest, isAssetBundleReceiptForManifest, } from '@playcraft/common/cloud-workspace/runtime';
+import { ensureSharedDirectory } from './shared-write.js';
 export class AssetTransferError extends Error {
     code;
     status;
@@ -27,9 +28,19 @@ export async function safeAssetTransferDirectory(root, path = '', create = false
         if (part === '.' || part === '..' || /[\\:\x00-\x1f\x7f]/.test(part))
             failPath();
         current = join(current, part);
-        if (create)
+        // The scratch root is shared by both identities; each transaction below it stays private.
+        if (create && relative(root, current) === '.playcraft-temp') {
+            await ensureSharedDirectory(root, current).catch(error => {
+                if (error.message === 'invalid_shared_directory')
+                    failPath();
+                throw error;
+            });
+        }
+        else if (create) {
+            // private
             await mkdir(current, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
                 throw error; });
+        }
         const stat = await lstat(current);
         if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(current) !== current)
             failPath();
@@ -93,6 +104,7 @@ export async function hashAssetTransferFile(path, limit = ASSET_TRANSFER_FILE_MA
 export async function saveAssetTransfer(transfer) {
     await safeAssetTransferDirectory(transfer.directory);
     const temporary = join(transfer.directory, `record-${randomUUID()}.tmp`);
+    // private
     const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     try {
         await handle.writeFile(JSON.stringify(transfer.record));
@@ -194,6 +206,7 @@ export async function withAssetTransfer(root, scope, id, action) {
 }
 async function saveProgress(transfer, files) {
     const temporary = join(transfer.directory, `progress-${randomUUID()}.tmp`);
+    // private
     const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     try {
         await handle.writeFile(JSON.stringify(files));
@@ -292,6 +305,7 @@ async function createAssetTransferUnlocked(root, scope, input) {
     const directory = await safeAssetTransferDirectory(rootReal, `.playcraft-temp/asset-transfers/${manifest.transferId}`, true);
     const record = { version: 1, createdAt: Date.now(), scope, manifest, manifestHash: hashAssetTransferManifest(manifest), status: 'uploading' };
     const temporary = join(directory, `create-${randomUUID()}.tmp`);
+    // private
     const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
     try {
         await handle.writeFile(JSON.stringify(record));
@@ -366,6 +380,7 @@ export async function putAssetTransferChunk(root, scope, id, input) {
                 throw error;
         }
         const temporary = join(directory, `chunk-${randomUUID()}.tmp`);
+        // private
         const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         try {
             await handle.writeFile(bytes);

package/dist/workspace-runtime/workspaces/attachments.js

@@ -13,6 +13,7 @@ async function attachmentRoot(root) {
     let directory = root;
     for (const part of WORKSPACE_USER_UPLOADS_DIRECTORY.split('/')) {
         directory = join(directory, part);
+        // shared
         await mkdir(directory, { mode: 0o755 }).catch((error) => {
             if (error.code !== 'EEXIST')
                 throw error;
@@ -62,6 +63,7 @@ export async function uploadWorkspaceAttachment(root, body) {
     const uploads = await attachmentRoot(root);
     const directory = join(uploads, attachment.id);
     const metadataDirectory = join(uploads, '.metadata');
+    // shared
     await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => {
         if (error.code !== 'EEXIST')
             throw error;
@@ -69,8 +71,11 @@ export async function uploadWorkspaceAttachment(root, body) {
     if (!(await lstat(metadataDirectory)).isDirectory())
         throw new Error('invalid_attachment');
     // Codex can run as a different user from the sandbox control process.
+    // shared
     await mkdir(directory, { mode: 0o755 });
+    // shared
     await writeFile(join(directory, attachment.name), bytes, { flag: 'wx', mode: 0o644 });
+    // shared
     await writeFile(join(metadataDirectory, `${attachment.id}.json`), JSON.stringify(attachment), {
         flag: 'wx',
         mode: 0o644,
@@ -88,11 +93,14 @@ export async function uploadWorkspaceVideoAttachment(root, request, query) {
     await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
     const uploads = await attachmentRoot(root);
     const id = randomUUID(), directory = join(uploads, id), metadataDirectory = join(uploads, '.metadata');
+    // shared
     await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => { if (error.code !== 'EEXIST')
         throw error; });
     if (!(await lstat(metadataDirectory)).isDirectory())
         throw new Error('invalid_attachment');
+    // shared
     await mkdir(directory, { mode: 0o755 });
+    // shared
     const handle = await open(join(directory, name), constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o644);
     try {
         let size = 0;
@@ -112,6 +120,7 @@ export async function uploadWorkspaceVideoAttachment(root, request, query) {
         if (contentType !== media.mimeType && !(contentType === 'video/quicktime' && media.mimeType === 'video/mp4'))
             throw new Error('invalid_attachment');
         const attachment = { id, name, size, ...media, sha256: await hashAttachment(handle) };
+        // shared
         await writeFile(join(metadataDirectory, `${id}.json`), JSON.stringify(attachment), { flag: 'wx', mode: 0o644 });
         return attachment;
     }

package/dist/workspace-runtime/workspaces/batch-commit.js

@@ -1,11 +1,12 @@
 import { execFile } from 'node:child_process';
 import { constants } from 'node:fs';
 import { createHash } from 'node:crypto';
-import { lstat, mkdir, open, realpath, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, open, realpath, rm } from 'node:fs/promises';
 import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { promisify } from 'node:util';
 import { batchCommitSourceVersion } from '@playcraft/common/cloud-workspace/runtime';
 import { validateProjectSkillsSnapshot } from '@playcraft/common/project-skills';
+import { ensureSharedDirectory, writeSharedFile } from './shared-write.js';
 const execute = promisify(execFile);
 const ID = /^[A-Za-z0-9_-]{1,128}$/;
 const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
@@ -131,8 +132,9 @@ export async function checkoutBatchCommit(input) {
             if (await lstat(target).catch(() => undefined))
                 continue;
             const body = await readArtifact(root, path);
-            await mkdir(dirname(target), { recursive: true });
-            await writeFile(target, body, { flag: 'wx', mode: 0o600 });
+            // The checkout is handed to the development identity, so its archives must be group readable.
+            await ensureSharedDirectory(input.destination, dirname(target));
+            await writeSharedFile(input.destination, target, body);
         }
     }
     catch (cause) {

package/dist/workspace-runtime/workspaces/binary-write.js

@@ -1,12 +1,13 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { link, lstat, mkdir, open, realpath, rename, unlink } from 'node:fs/promises';
+import { link, lstat, open, realpath, rename, unlink } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { fileBinaryWritePayloadSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { artifactPath } from './artifact-files.js';
 import { sampleDiskFile } from './disk-snapshot.js';
 import { InvalidWorkspacePathError } from './files.js';
-import { shareWorkspaceAssetDirectory, shareWorkspaceAssetFile } from './asset-publication-access.js';
+import { shareWorkspaceAssetFile } from './asset-publication-access.js';
+import { ensureSharedDirectory } from './shared-write.js';
 export class BinaryWorkspaceWriteError extends Error {
     code;
     constructor(code) {
@@ -45,14 +46,17 @@ export async function writeWorkspaceBinaryFile(root, input) {
         throw new InvalidWorkspacePathError(payload.path);
     for (const part of parts.slice(0, -1)) {
         parent = join(parent, part);
-        let created = false;
-        await mkdir(parent, { mode: 0o700 }).then(() => { created = true; }).catch(error => { if (error.code !== 'EEXIST')
-            throw error; });
+        const existing = await lstat(parent).catch((error) => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        // Only new parents are shared; an existing directory keeps whatever access its owner chose.
+        if (!existing)
+            await ensureSharedDirectory(rootReal, parent);
         const stat = await lstat(parent);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             throw new InvalidWorkspacePathError(payload.path);
-        if (created)
-            await shareWorkspaceAssetDirectory(rootReal, parent);
     }
     const parentStat = await lstat(parent);
     const target = join(parent, basename(payload.path));
@@ -61,6 +65,7 @@ export async function writeWorkspaceBinaryFile(root, input) {
     let staged = false;
     try {
         await verifyPreconditions(rootReal, payload);
+        // shared
         const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
         staged = true;
         try {

package/dist/workspace-runtime/workspaces/cli-context.js

@@ -5,6 +5,7 @@ import { excludeFromGit } from './dependencies.js';
 /** Non-secret routing hint; the business service still authorizes the selected workspace. */
 export async function writeWorkspaceCliContext(root, workspaceId) {
     const management = join(root, '.playcraft');
+    // shared
     await mkdir(management, { mode: 0o755 }).catch(error => { if (error.code !== 'EEXIST')
         throw error; });
     const stat = await lstat(management);
@@ -12,6 +13,7 @@ export async function writeWorkspaceCliContext(root, workspaceId) {
         throw new Error('workspace_skills_invalid');
     const temporary = join(management, `workspace-context.${randomUUID()}.tmp`);
     try {
+        // shared
         await writeFile(temporary, `${JSON.stringify({ schemaVersion: 'playcraft.workspace-context.v1', workspaceId })}\n`, { flag: 'wx', mode: 0o644 });
         await rename(temporary, join(management, 'workspace-context.json'));
         await excludeFromGit(root, '/.playcraft/workspace-context.json');

package/dist/workspace-runtime/workspaces/cli-credentials.js

@@ -76,6 +76,7 @@ async function renew(state, entry) {
         await mkdir(config.workspaceRoot, { recursive: true });
         const temporary = join(config.workspaceRoot, `.playcraft-credential-${randomUUID()}.tmp`);
         try {
+            // private
             await writeFile(temporary, JSON.stringify({
                 apiUrl: credential.apiUrl,
                 token: credential.token,

package/dist/workspace-runtime/workspaces/delivery-build.js

@@ -1,15 +1,17 @@
 import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { copyFile, cp, chmod, lstat, mkdir, mkdtemp, readdir, readlink, rename, rm, stat, symlink } from 'node:fs/promises';
+import { copyFile, cp, lstat, mkdir, mkdtemp, readdir, readlink, rename, rm, stat, symlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join, relative, sep } from 'node:path';
 import { createPlatformAdapter, getChannelRuleProfile, } from '@playcraft/build';
 import { DELIVERY_QUEUE_LIMIT, isWorkspaceArtifactOutputPath, } from '@playcraft/common/cloud-workspace/runtime';
-import { workspaceRoot } from './registry.js';
+import { revisionScope, workspaceRoot } from './registry.js';
 import { excludeFromGit, ensureWorkspaceDependencies } from './dependencies.js';
 import { listWorkspaceBuildInputs } from './git.js';
 import { runDeveloperCommand } from './developer-command.js';
 import { openScratchToDevelopment } from './directory-access.js';
+import { ensureSharedDirectory } from './shared-write.js';
+import { driftScope, permissionDriftFromOutput, repairWorkspaceShares } from './workspace-shares.js';
 import { DeliveryStore } from './delivery-store.js';
 import { DeliveryValidationError, validateDeliveryArtifact } from './delivery.js';
 export const DELIVERY_BUILD_TIMEOUT_MS = 10 * 60_000;
@@ -196,7 +198,7 @@ async function copyToDist(root, staging, channel, format) {
             throw new DeliveryBuildError('delivery_output_missing');
         const target = join(root, relative);
         const directory = dirname(target);
-        await mkdir(directory, { recursive: true });
+        await ensureSharedDirectory(root, directory);
         const temporary = join(directory, `.${basename(file)}.${randomUUID()}.tmp`);
         try {
             await copyFile(join(staging, file), temporary);
@@ -249,9 +251,8 @@ async function copyInput(root, destination, path) {
  * caches, logs and local outputs stay behind. Without a repository the whole tree is copied.
  */
 export async function isolateWorkspaceForBuild(root, destination) {
-    await mkdir(destination, { recursive: true });
     // The build runs as the development identity and writes its scratch folder inside this copy.
-    await chmod(destination, 0o2770);
+    await ensureSharedDirectory(root, destination);
     const modules = join(root, 'node_modules');
     const modulesEntry = await lstat(modules).catch(() => undefined);
     if (modulesEntry?.isDirectory() || modulesEntry?.isSymbolicLink()) {
@@ -319,11 +320,10 @@ async function executeBuild(state, input, controller) {
         await openScratchToDevelopment(scratch, (await lstat(root)).gid);
         staging = join(scratch, 'output');
         const project = join(scratch, 'project');
-        await mkdir(staging, { recursive: true });
-        await chmod(staging, 0o2770);
+        await ensureSharedDirectory(root, staging);
         await excludeFromGit(root, `/${STAGING_DIRECTORY}/`);
         await excludeFromGit(root, '/dist/');
-        const dependencies = await ensureWorkspaceDependencies(state, input.workspaceId, root);
+        const dependencies = await ensureWorkspaceDependencies(state, revisionScope(state, input.workspaceId, input.directoryName) ?? input.workspaceId, root);
         if (!dependencies.ok) {
             if (dependencies.logTail) {
                 await store.appendLog(input.buildId, `\n${dependencies.logTail}\n`);
@@ -338,7 +338,8 @@ async function executeBuild(state, input, controller) {
         }
         const planned = process.env.PLAYCRAFT_DELIVERY_BUILD_COMMAND || 'playcraft build';
         const command = `umask 002 && NO_COLOR=1 CI=1 ${planned} . --platform ${input.payload.channel} --format ${input.payload.format} --output ${shellQuote(staging)} --mode full`;
-        const outcome = await runDeveloperCommand(state, {
+        let outputTail = '';
+        const runBuild = () => runDeveloperCommand(state, {
             processId: `delivery-${input.buildId}`,
             cwd: project,
             command,
@@ -348,10 +349,28 @@ async function executeBuild(state, input, controller) {
                 const text = String(chunk);
                 if (!text)
                     return;
+                outputTail = (outputTail + text).slice(-64 * 1024);
                 logChain = logChain.then(() => store.appendLog(input.buildId, text)).catch(() => undefined);
             },
         });
-        if (outcome.canceled) {
+        let outcome = await runBuild();
+        let permissionDrift = false;
+        if (outcome.code !== 0 && !outcome.canceled && !outcome.timedOut) {
+            // The build runs as the development identity; an entry only that identity owns repairs its
+            // own shared subtree, then the build is retried exactly once.
+            const drift = permissionDriftFromOutput(outputTail);
+            if (drift) {
+                permissionDrift = true;
+                await repairWorkspaceShares(state, root, await driftScope(root, drift.path)).catch(() => undefined);
+                outcome = await runBuild();
+                permissionDrift = outcome.code !== 0;
+            }
+        }
+        if (outcome.code === undefined) {
+            status = 'failed';
+            error = 'delivery_process_unknown';
+        }
+        else if (outcome.canceled) {
             status = 'canceled';
             error = 'delivery_canceled';
         }
@@ -361,7 +380,7 @@ async function executeBuild(state, input, controller) {
         }
         else if (outcome.code !== 0) {
             status = 'failed';
-            error = 'delivery_build_failed';
+            error = permissionDrift ? 'workspace_permission_drift' : 'delivery_build_failed';
         }
         else {
             const output = await copyToDist(root, staging, input.payload.channel, input.payload.format);

package/dist/workspace-runtime/workspaces/delivery-store.js

@@ -24,6 +24,7 @@ export class DeliveryStore {
         this.directory = workspaceDirectory(stateDir, workspaceId);
     }
     async ready() {
+        // private
         await mkdir(this.directory, { recursive: true, mode: 0o700 });
         return this.directory;
     }
@@ -42,6 +43,7 @@ export class DeliveryStore {
     async writeJson(path, value) {
         const temporary = `${path}.${randomUUID()}.tmp`;
         try {
+            // private
             await writeFile(temporary, JSON.stringify(value), { mode: 0o600 });
             await rename(temporary, path);
         }