@playcraft/cli 0.1.57-beta → 0.1.59-beta

package/dist/workspace-runtime/workspaces/dependencies.js

@@ -4,6 +4,7 @@ import { constants } from 'node:fs';
 import { setTimeout as delay } from 'node:timers/promises';
 import { join } from 'node:path';
 import { launcherSocket, runDeveloperCommand } from './developer-command.js';
+import { adoptDirectoryAccess, holdDirectoryAccess, managedDirectoryScope } from '../server/directory-access.js';
 /** Long enough for a cold store on a game template; a stuck registry must not hold the write lease. */
 const INSTALL_TIMEOUT_MS = 10 * 60_000;
 const LOG_TAIL_LINES = 50;
@@ -44,17 +45,18 @@ export function scheduleDependencyInstall(state, workspaceId, root, shouldStart)
     running.set(state, inFlight);
     const existing = inFlight.get(workspaceId);
     if (existing?.root === root) {
+        void adoptDirectoryAccess(state, `managed:${existing.writeId}`).catch(() => undefined);
         if (!shouldStart)
             existing.guards = undefined;
         else
             existing.guards?.push(shouldStart);
         return existing.task;
     }
-    const scheduled = { root, task: Promise.resolve(), guards: shouldStart ? [shouldStart] : undefined };
+    const scheduled = { root, writeId: `${WRITE_PREFIX}${workspaceId}-${randomUUID()}`, task: Promise.resolve(), guards: shouldStart ? [shouldStart] : undefined };
     const begin = () => {
         if (state.journal.destroyed() || (scheduled.guards && !scheduled.guards.some((guard) => guard())))
             return;
-        return installOnce(state, workspaceId, root);
+        return installOnce(state, workspaceId, root, scheduled.writeId);
     };
     const task = (existing ? existing.task.then(begin) : begin() ?? Promise.resolve())
         .catch((error) => {
@@ -91,8 +93,8 @@ export async function ensureWorkspaceDependencies(state, workspaceId, root) {
     };
 }
 /**
- * An install cut off by a restart left no process behind (the launcher stops the group when its
- * connection closes), so its status and write lease are closed rather than left in progress.
+ * A lost controller makes the install result unknown. Keep its writer claim until a supervisor
+ * confirms that the process group stopped; a closed connection alone cannot prove that.
  */
 export async function recoverInterruptedInstalls(journal) {
     const now = new Date().toISOString();
@@ -106,81 +108,96 @@ export async function recoverInterruptedInstalls(journal) {
             finishedAt: now,
         });
     }
-    for (const write of journal.listManagedWrites()) {
-        if (write.writeId.startsWith(WRITE_PREFIX) && !write.stoppedAt) {
-            await journal.putManagedWrite({ ...write, stoppedAt: now });
-        }
-    }
 }
-async function installOnce(state, workspaceId, root) {
-    let plan;
+async function installOnce(state, workspaceId, root, writeId) {
+    const startedAt = new Date().toISOString();
+    const release = await holdDirectoryAccess(state, managedDirectoryScope(state, workspaceId), `managed:${writeId}`, 'shared');
+    let processMayRun = false;
+    let processStopped = false;
     try {
-        plan = await planInstall(root);
-    }
-    catch {
-        await state.journal.putWorkspaceDependencies({
-            workspaceId, status: 'failed', error: 'dependency_inputs_unreadable', finishedAt: new Date().toISOString(),
-        });
-        return;
-    }
-    const current = state.journal.getWorkspaceDependencies(workspaceId);
-    if (plan.kind === 'skip') {
-        if (current?.status !== 'none') {
+        if (state.journal.listManagedWrites().some(writer => writer.workspaceId === workspaceId &&
+            writer.writeId !== writeId && writer.writeId.startsWith(WRITE_PREFIX) && !writer.stoppedAt)) {
             await state.journal.putWorkspaceDependencies({
-                workspaceId,
-                status: 'none',
-                finishedAt: new Date().toISOString(),
+                workspaceId, status: 'failed', error: 'dependency_run_unconfirmed', finishedAt: new Date().toISOString(),
             });
+            return;
         }
-        return;
-    }
-    if (current?.status === 'ready' &&
-        current.lockHash === plan.lockHash &&
-        (await isDirectory(join(root, 'node_modules')))) {
-        return;
-    }
-    await excludeFromGit(root);
-    const startedAt = new Date().toISOString();
-    const writeId = `${WRITE_PREFIX}${workspaceId}-${randomUUID()}`;
-    // A checkpoint waits for this write: node_modules is half written until the install ends.
-    await state.journal.putManagedWrite({ writeId, workspaceId, source: 'background', startedAt });
-    await state.journal.putWorkspaceDependencies({
-        workspaceId,
-        status: 'installing',
-        startedAt,
-    });
-    let outcome;
-    try {
-        // Through the launcher the install runs as the development group, which cannot enter the
-        // checkout until Runtime has opened it; a local install runs as the owner and need not wait.
-        const shared = !launcherSocket(state) || (await waitUntilShared(root));
-        outcome = shared
-            ? await runInstall(state, workspaceId, root)
-            : { code: undefined, timedOut: false, log: '', error: 'workspace_not_shared' };
-    }
-    finally {
-        await state.journal.putManagedWrite({
-            writeId,
+        let plan;
+        try {
+            plan = await planInstall(root);
+        }
+        catch {
+            await state.journal.putWorkspaceDependencies({
+                workspaceId, status: 'failed', error: 'dependency_inputs_unreadable', finishedAt: new Date().toISOString(),
+            });
+            return;
+        }
+        const current = state.journal.getWorkspaceDependencies(workspaceId);
+        if (plan.kind === 'skip') {
+            if (current?.status !== 'none') {
+                await state.journal.putWorkspaceDependencies({
+                    workspaceId,
+                    status: 'none',
+                    finishedAt: new Date().toISOString(),
+                });
+            }
+            return;
+        }
+        if (current?.status === 'ready' &&
+            current.lockHash === plan.lockHash &&
+            (await isDirectory(join(root, 'node_modules')))) {
+            return;
+        }
+        await excludeFromGit(root);
+        // A checkpoint waits for this write: node_modules is half written until the install ends.
+        await state.journal.putManagedWrite({ writeId, workspaceId, source: 'background', startedAt });
+        await state.journal.putWorkspaceDependencies({
             workspaceId,
-            source: 'background',
+            status: 'installing',
             startedAt,
-            stoppedAt: new Date().toISOString(),
+        });
+        let outcome;
+        try {
+            // Through the launcher the install runs as the development group, which cannot enter the
+            // checkout until Runtime has opened it; a local install runs as the owner and need not wait.
+            const shared = !launcherSocket(state) || (await waitUntilShared(root));
+            if (shared) {
+                processMayRun = true;
+                outcome = await runInstall(state, workspaceId, root);
+                processStopped = outcome.code !== undefined;
+            }
+            else
+                outcome = { code: undefined, timedOut: false, log: '', error: 'workspace_not_shared' };
+        }
+        finally {
+            if (!processMayRun || processStopped)
+                await state.journal.putManagedWrite({
+                    writeId,
+                    workspaceId,
+                    source: 'background',
+                    startedAt,
+                    stoppedAt: new Date().toISOString(),
+                });
+        }
+        const ok = outcome.code === 0 && !outcome.timedOut;
+        await state.journal.putWorkspaceDependencies({
+            workspaceId,
+            status: ok ? 'ready' : 'failed',
+            ...(ok
+                ? { lockHash: plan.lockHash }
+                : {
+                    error: outcome.error ??
+                        (outcome.timedOut ? 'install_timeout' : `install_exit_${outcome.code ?? 'lost'}`),
+                }),
+            startedAt,
+            finishedAt: new Date().toISOString(),
+            logTail: tail(outcome.log),
         });
     }
-    const ok = outcome.code === 0 && !outcome.timedOut;
-    await state.journal.putWorkspaceDependencies({
-        workspaceId,
-        status: ok ? 'ready' : 'failed',
-        ...(ok
-            ? { lockHash: plan.lockHash }
-            : {
-                error: outcome.error ??
-                    (outcome.timedOut ? 'install_timeout' : `install_exit_${outcome.code ?? 'lost'}`),
-            }),
-        startedAt,
-        finishedAt: new Date().toISOString(),
-        logTail: tail(outcome.log),
-    });
+    finally {
+        if (!processMayRun || processStopped)
+            release();
+    }
 }
 /**
  * Runs as the development user through the launcher, so the packages belong to the same user as
@@ -190,8 +207,10 @@ async function runInstall(state, workspaceId, root) {
     // Tests replace the install; a real registry is never reached from them.
     const planned = process.env.PLAYCRAFT_DEPENDENCY_INSTALL_COMMAND || dependencyInstallCommand(state);
     const logDir = join(state.config.stateDir, 'dependency-logs');
+    // private
     await mkdir(logDir, { recursive: true, mode: 0o700 });
     const logPath = join(logDir, `${workspaceId}.log`);
+    // private
     await writeFile(logPath, `$ ${planned}\n`, { mode: 0o600 });
     let log = '';
     let pending = Promise.resolve();
@@ -254,6 +273,7 @@ export async function excludeFromGit(root, entry = '/node_modules/') {
         });
         const info = await open(join(gitPath, 'info'), flags);
         handles.push(info);
+        // shared
         file = await open(join(pinned(info, join(root, '.git/info')), 'exclude'), constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o666);
         const metadata = await file.stat();
         if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > 1024 * 1024) {

package/dist/workspace-runtime/workspaces/developer-command.js

@@ -1,5 +1,6 @@
 import { spawn } from 'node:child_process';
 import { startLauncherProcess } from '../codex/launcher-client.js';
+import { stopBackgroundWriter } from '../processes/managed-writes.js';
 export function launcherSocket(state) {
     const socketPath = process.env.PLAYCRAFT_LAUNCHER_SOCKET;
     return socketPath && state.config.workspaceMode === 'multi' ? socketPath : undefined;
@@ -94,5 +95,15 @@ export async function runDeveloperCommand(state, input) {
             local.once('close', (value) => finish(value));
         }
     });
-    return { code, timedOut, ...(canceled ? { canceled: true } : {}) };
+    let stopped = !launched && !local?.pid;
+    try {
+        if (launched) {
+            await launched.stop();
+            stopped = true;
+        }
+        else if (local?.pid)
+            stopped = await stopBackgroundWriter(local.pid);
+    }
+    catch { /* Transport loss cannot prove the process group has stopped. */ }
+    return { code: stopped ? code : undefined, timedOut, ...(canceled ? { canceled: true } : {}) };
 }

package/dist/workspace-runtime/workspaces/directory-access.js

@@ -1,5 +1,6 @@
 import { chmod, chown, lstat, readdir } from 'node:fs/promises';
 import { join } from 'node:path';
+import { SHARED_DIRECTORY_MODE, SHARED_FILE_MODE, sharePathWithGroup, } from './shared-write.js';
 /** Grant development-group traversal of the workspace container without touching source checkouts. */
 export async function grantWorkspaceTraversal(root, groupId) {
     const stat = await lstat(root);
@@ -18,9 +19,7 @@ export async function openScratchToDevelopment(path, groupId) {
     const stat = await lstat(path);
     if (!stat.isDirectory() || stat.isSymbolicLink())
         throw new Error('invalid_scratch_directory');
-    if (stat.gid !== groupId)
-        await chown(path, stat.uid, groupId);
-    await chmod(path, 0o2770);
+    await sharePathWithGroup(path, groupId, SHARED_DIRECTORY_MODE);
 }
 /** The sandbox development group can edit engine directories. Symlinks never grant access outside the tree. */
 export async function openDirectoryToDevelopment(root, groupId) {
@@ -29,22 +28,18 @@ export async function openDirectoryToDevelopment(root, groupId) {
         const stat = await lstat(path);
         if (stat.isSymbolicLink())
             return;
+        // Entries owned by the other identity cannot be re-shaped from here; the owner repairs them.
         const canModify = currentUid === undefined || currentUid === 0 || stat.uid === currentUid;
-        if (canModify && stat.gid !== groupId)
-            await chown(path, stat.uid, groupId);
-        if (stat.isDirectory()) {
-            if (canModify)
-                await chmod(path, (stat.mode & 0o777) | 0o2770);
-            const entries = await readdir(path).catch(error => {
-                if (!canModify && error.code === 'EACCES')
-                    return [];
-                throw error;
-            });
-            for (const entry of entries)
-                await visit(join(path, entry));
-        }
-        else if (stat.isFile() && canModify)
-            await chmod(path, (stat.mode & 0o777) | 0o660);
+        await sharePathWithGroup(path, groupId, stat.isDirectory() ? SHARED_DIRECTORY_MODE : SHARED_FILE_MODE, stat.isFile());
+        if (!stat.isDirectory())
+            return;
+        const entries = await readdir(path).catch(error => {
+            if (!canModify && error.code === 'EACCES')
+                return [];
+            throw error;
+        });
+        for (const entry of entries)
+            await visit(join(path, entry));
     };
     await visit(root);
 }

package/dist/workspace-runtime/workspaces/directory-attachments.js

@@ -25,6 +25,7 @@ async function safeDirectory(root, relative, create = false) {
     let directory = root;
     for (const part of relative.split('/')) {
         directory = join(directory, part);
+        // shared
         if (create)
             await mkdir(directory, { mode: 0o755 }).catch((error) => {
                 if (error.code !== 'EEXIST')
@@ -59,10 +60,14 @@ export async function beginWorkspaceDirectoryAttachment(root, body) {
     const staging = await safeDirectory(root, stagingPath, true);
     const id = randomUUID();
     const stage = join(staging, id);
+    // shared
     await mkdir(stage, { mode: 0o755 });
     try {
+        // shared
         await mkdir(join(stage, 'data'), { mode: 0o755 });
+        // shared
         await mkdir(join(stage, 'data', manifest.name), { mode: 0o755 });
+        // shared
         await writeFile(join(stage, 'manifest.json'), JSON.stringify(manifest), { flag: 'wx', mode: 0o644 });
         return { uploadId: id };
     }
@@ -84,6 +89,7 @@ export async function uploadWorkspaceDirectoryFile(root, id, path, request) {
             throw new Error('invalid_attachment');
         const relative = `${stagingPath}/${id}/data/${manifest.name}/${path}`;
         await safeDirectory(root, dirname(relative), true);
+        // shared
         const handle = await open(join(root, relative), constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o644);
         try {
             let size = 0;
@@ -164,9 +170,11 @@ export async function completeWorkspaceDirectoryAttachment(root, id) {
             path: `${WORKSPACE_USER_UPLOADS_DIRECTORY}/${id}/${manifest.name}`, files };
         workspaceAttachmentSchema.parse(attachment);
         const target = join(uploads, id);
+        // shared
         await mkdir(target, { mode: 0o755 });
         try {
             await rename(join(stage, 'data', manifest.name), join(target, manifest.name));
+            // shared
             await writeFile(join(metadata, `${id}.json`), JSON.stringify(attachment), { flag: 'wx', mode: 0o644 });
         }
         catch (error) {

package/dist/workspace-runtime/workspaces/directory-create.js

@@ -1,8 +1,9 @@
 import { constants } from 'node:fs';
-import { lstat, mkdir, open, realpath, rmdir } from 'node:fs/promises';
+import { lstat, mkdir, realpath, rmdir } from 'node:fs/promises';
 import { join } from 'node:path';
 import { directoryCreatePayloadSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { ensureWorkspaceRoot, InvalidWorkspacePathError } from './files.js';
+import { ensureSharedDirectory, openSharedFile } from './shared-write.js';
 const RESERVED_DIRECTORIES = new Set(['.git', 'node_modules', '.playcraft-temp']);
 export class WorkspaceDirectoryCreateError extends Error {
     code = 'directory_exists';
@@ -18,18 +19,29 @@ export async function createWorkspaceDirectory(root, input) {
     if (parts.some(part => RESERVED_DIRECTORIES.has(part)))
         throw new InvalidWorkspacePathError(path);
     const rootReal = await ensureWorkspaceRoot(root);
+    const share = async (path) => {
+        try {
+            await ensureSharedDirectory(rootReal, path);
+        }
+        catch (error) {
+            if (error.message === 'invalid_shared_directory')
+                throw new InvalidWorkspacePathError(path);
+            throw error;
+        }
+    };
     let parent = rootReal;
     for (const part of parts.slice(0, -1)) {
         parent = join(parent, part);
-        await mkdir(parent, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST')
-            throw error; });
+        // Created directories are visible to the development identity that runs agents and builds.
+        await share(parent);
         const stat = await lstat(parent);
         if (!stat.isDirectory() || stat.isSymbolicLink() || await realpath(parent) !== parent)
             throw new InvalidWorkspacePathError(path);
     }
     const target = join(parent, parts.at(-1));
+    // shared
     try {
-        await mkdir(target, { mode: 0o700 });
+        await mkdir(target, { mode: 0o2770 });
     }
     catch (error) {
         if (error.code !== 'EEXIST')
@@ -41,7 +53,8 @@ export async function createWorkspaceDirectory(root, input) {
     try {
         if (!(await lstat(target)).isDirectory() || await realpath(target) !== target)
             throw new InvalidWorkspacePathError(path);
-        const marker = await open(join(target, '.gitkeep'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        await share(target);
+        const marker = await openSharedFile(rootReal, join(target, '.gitkeep'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW);
         try {
             await marker.sync();
         }

package/dist/workspace-runtime/workspaces/directory-maintenance.js

@@ -6,6 +6,7 @@ import { promisify } from 'node:util';
 import { workspaceDirectoryNameSchema } from '@playcraft/common/cloud-workspace/runtime';
 import { batchDirectoryHeld } from '../batch/occupancy.js';
 import { workspaceRoot, workspaceSessions } from './registry.js';
+import { withDirectoryWrite } from '../server/directory-access.js';
 const execute = promisify(execFile);
 const git = async (state, root, ...args) => (await execute('git', ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root, ...args], {
     timeout: 30_000, maxBuffer: 1024 * 1024, env: { PATH: process.env.PATH, HOME: state.config.stateDir, GIT_CONFIG_GLOBAL: '/dev/null', GIT_CONFIG_NOSYSTEM: '1', GIT_TERMINAL_PROMPT: '0' },
@@ -39,7 +40,7 @@ export async function cleanupWorkspaceDirectories(state, workspaceId, directoryN
         const blocked = [];
         for (const directoryName of names) {
             try {
-                await state.journal.exclusive(`directory:${workspaceId}:${directoryName}`, async () => {
+                await withDirectoryWrite(state, { workspaceId, directoryName, mode: 'exclusive', wait: false }, () => state.journal.exclusive(`directory:${workspaceId}:${directoryName}`, async () => {
                     if (await workspaceDirectoryOccupied(state, workspaceId, directoryName))
                         throw new Error('workspace_directory_occupied');
                     const root = await workspaceRoot(state, workspaceId, directoryName);
@@ -51,7 +52,7 @@ export async function cleanupWorkspaceDirectories(state, workspaceId, directoryN
                     await state.journal.putWorkspace({ ...binding, directories: [...(binding.directories ?? []).filter(item => item.directoryName !== directoryName), { ...directory, status: 'reclaimed' }] });
                     await rm(root, { recursive: true });
                     cleaned.push(directoryName);
-                });
+                }));
             }
             catch (error) {
                 blocked.push({ directoryName, reason: error instanceof Error && /^[a-z0-9_]+$/.test(error.message) ? error.message : 'workspace_cleanup_failed' });
@@ -70,42 +71,52 @@ export async function syncWorkspaceDirectories(state, workspaceId, commitHash, t
     for (const directoryName of [...new Set(targetDirectoryNames.map(name => workspaceDirectoryNameSchema.parse(name)))]) {
         if (directoryName === 'basic')
             throw new Error('workspace_sync_target_invalid');
-        await state.journal.exclusive(`directory:${workspaceId}:${directoryName}`, async () => {
-            if (await workspaceDirectoryOccupied(state, workspaceId, directoryName)) {
-                skipped.push({ directoryName, reason: 'directory_busy' });
-                return;
-            }
-            const root = await workspaceRoot(state, workspaceId, directoryName);
-            const ledger = join(state.config.stateDir, 'directory-sync', workspaceId, `${directoryName}.json`);
-            const applied = await readFile(ledger, 'utf8').then(value => JSON.parse(value), () => undefined);
-            await assertCleanAndPushed(state, root, applied?.sourceCommit === commitHash ? applied.targetCommit : undefined);
-            if (applied?.sourceCommit === commitHash && await git(state, root, 'rev-parse', 'HEAD') === applied.targetCommit) {
-                synced.push(directoryName);
-                return;
-            }
-            const containing = await git(state, root, 'merge-base', '--is-ancestor', commitHash, 'HEAD').then(() => true, () => false);
-            if (containing) {
-                synced.push(directoryName);
-                return;
-            }
-            // Import the exact preserved basic commit, without fetching a moving remote branch.
-            await execute('git', ['-c', 'core.hooksPath=/dev/null', '-C', root, 'fetch', '--no-tags', '--', basic, commitHash], { timeout: 30_000, maxBuffer: 1024 * 1024 });
-            const equivalent = (await git(state, root, 'cherry', 'HEAD', commitHash)).split('\n').some(line => line === `- ${commitHash}`);
-            if (!equivalent) {
-                try {
-                    await git(state, root, '-c', 'user.name=PlayCraft', '-c', 'user.email=playcraft@localhost', 'cherry-pick', commitHash);
+        try {
+            await withDirectoryWrite(state, { workspaceId, directoryName, mode: 'exclusive', wait: false }, () => state.journal.exclusive(`directory:${workspaceId}:${directoryName}`, async () => {
+                if (await workspaceDirectoryOccupied(state, workspaceId, directoryName)) {
+                    skipped.push({ directoryName, reason: 'directory_busy' });
+                    return;
                 }
-                catch {
-                    conflicts.push(directoryName);
+                const root = await workspaceRoot(state, workspaceId, directoryName);
+                const ledger = join(state.config.stateDir, 'directory-sync', workspaceId, `${directoryName}.json`);
+                const applied = await readFile(ledger, 'utf8').then(value => JSON.parse(value), () => undefined);
+                await assertCleanAndPushed(state, root, applied?.sourceCommit === commitHash ? applied.targetCommit : undefined);
+                if (applied?.sourceCommit === commitHash && await git(state, root, 'rev-parse', 'HEAD') === applied.targetCommit) {
+                    synced.push(directoryName);
                     return;
                 }
-            }
-            await mkdir(join(state.config.stateDir, 'directory-sync', workspaceId), { recursive: true, mode: 0o700 });
-            const temporary = `${ledger}.${randomUUID()}.tmp`;
-            await writeFile(temporary, JSON.stringify({ sourceCommit: commitHash, targetCommit: await git(state, root, 'rev-parse', 'HEAD') }), { mode: 0o600 });
-            await rename(temporary, ledger);
-            synced.push(directoryName);
-        });
+                const containing = await git(state, root, 'merge-base', '--is-ancestor', commitHash, 'HEAD').then(() => true, () => false);
+                if (containing) {
+                    synced.push(directoryName);
+                    return;
+                }
+                // Import the exact preserved basic commit, without fetching a moving remote branch.
+                await execute('git', ['-c', 'core.hooksPath=/dev/null', '-C', root, 'fetch', '--no-tags', '--', basic, commitHash], { timeout: 30_000, maxBuffer: 1024 * 1024 });
+                const equivalent = (await git(state, root, 'cherry', 'HEAD', commitHash)).split('\n').some(line => line === `- ${commitHash}`);
+                if (!equivalent) {
+                    try {
+                        await git(state, root, '-c', 'user.name=PlayCraft', '-c', 'user.email=playcraft@localhost', 'cherry-pick', commitHash);
+                    }
+                    catch {
+                        conflicts.push(directoryName);
+                        return;
+                    }
+                }
+                // private
+                await mkdir(join(state.config.stateDir, 'directory-sync', workspaceId), { recursive: true, mode: 0o700 });
+                const temporary = `${ledger}.${randomUUID()}.tmp`;
+                // private
+                await writeFile(temporary, JSON.stringify({ sourceCommit: commitHash, targetCommit: await git(state, root, 'rev-parse', 'HEAD') }), { mode: 0o600 });
+                await rename(temporary, ledger);
+                synced.push(directoryName);
+            }));
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === 'directory_busy')
+                skipped.push({ directoryName, reason: 'directory_busy' });
+            else
+                throw error;
+        }
     }
     return { synced, skipped, conflicts, previewStale: true };
 }

package/dist/workspace-runtime/workspaces/directory-mutations.js

@@ -1,10 +1,11 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { lstat, mkdir, open, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { lstat, open, readdir, realpath, rename, rm } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { z } from 'zod';
 import { directoryDeletePayloadSchema, directoryRenamePayloadSchema, hashOperationPayload, isMutableWorkspaceDirectoryPath, } from '@playcraft/common/cloud-workspace/runtime';
 import { safeAssetTransferDirectory, syncAssetTransferDirectory } from './asset-transfer-storage.js';
+import { ensureSharedDirectory } from './shared-write.js';
 export class DirectoryMutationError extends Error {
     code;
     constructor(code) {
@@ -60,6 +61,7 @@ async function validateTree(root, path) {
 async function saveRecord(directory, record) {
     await safeAssetTransferDirectory(directory);
     const temporary = join(directory, `${randomUUID()}.tmp`);
+    // private
     const file = await open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
     try {
         await file.writeFile(JSON.stringify(record));
@@ -183,8 +185,11 @@ export async function mutateWorkspaceDirectory(root, kind, input, options) {
         if (newPath) {
             // Reserve an absent destination atomically; only our recorded empty placeholder may be replaced.
             if (!destinationIdentity) {
-                await mkdir(destination, { mode: 0o700 }).catch(error => { if (error.code === 'EEXIST')
-                    return fail('directory_exists'); throw error; });
+                if (await lstat(destination).catch(error => { if (missing(error))
+                    return undefined; throw error; }))
+                    return fail('directory_exists');
+                // A renamed directory is a workspace entry both identities must reach.
+                await ensureSharedDirectory(root, destination);
                 record.reservation = await identity(destination);
                 await saveRecord(directory, record);
             }

package/dist/workspace-runtime/workspaces/files.js

@@ -13,6 +13,7 @@ export class InvalidWorkspacePathError extends Error {
     }
 }
 export async function ensureWorkspaceRoot(root) {
+    // private
     await mkdir(root, { recursive: true, mode: 0o700 });
     return realpath(root);
 }
@@ -37,8 +38,10 @@ export async function resolveWorkspaceFile(root, relativePath) {
 }
 export async function writeWorkspaceFile(root, relativePath, content) {
     const target = await resolveWorkspaceFile(root, relativePath);
+    // private
     await mkdir(dirname(target), { recursive: true, mode: 0o700 });
     const bytes = Buffer.from(content, 'utf8');
+    // private
     await writeFile(target, bytes, { mode: 0o600 });
     return { path: relativePath, contentHash: hashWorkspaceFileContent(content), size: bytes.byteLength };
 }
@@ -134,6 +137,7 @@ async function assertParentInsideRoot(rootReal, parent) {
     catch (error) {
         if (error.code !== 'ENOENT')
             throw error;
+        // private
         await mkdir(parent, { recursive: true, mode: 0o700 });
         const parentReal = await realpath(parent);
         assertInsideRoot(rootReal, parentReal);

package/dist/workspace-runtime/workspaces/git-credential-broker.js

@@ -240,6 +240,7 @@ async function configureGitFile(root, stateDir, commands, repositoryUrl) {
         gitDirectory = await open(join(pinnedRoot, '.git'), directoryFlags);
         const gitPath = process.platform === 'linux' ? `/proc/self/fd/${gitDirectory.fd}` : join(root, '.git');
         const configPath = join(gitPath, 'config');
+        // private
         lock = await open(join(gitPath, 'config.lock'), constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL, 0o640);
         lockPath = join(gitPath, 'config.lock');
         const source = await open(configPath, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -254,9 +255,11 @@ async function configureGitFile(root, stateDir, commands, repositoryUrl) {
         finally {
             await source.close();
         }
+        // private
         await mkdir(stateDir, { recursive: true, mode: 0o700 });
         temporary = await mkdtemp(join(stateDir, 'git-config-'));
         const staging = join(temporary, 'config');
+        // private
         await writeFile(staging, content, { mode: 0o600 });
         await clearManagedGitConfig(staging, repositoryUrl);
         for (const args of commands)

package/dist/workspace-runtime/workspaces/git-direct-store.js

@@ -39,6 +39,7 @@ export class WorkspaceGitDirectStore {
             throw new Error('git_control_directory_rejected');
         }
         for (const path of [stateDir, directory]) {
+            // private
             if (path === directory && create)
                 await mkdir(path, { mode: 0o700 }).catch(error => {
                     if (error.code !== 'EEXIST')
@@ -105,6 +106,7 @@ export class WorkspaceGitDirectStore {
             if (rejectedPassword !== undefined && old?.access?.password !== rejectedPassword)
                 return;
             const temporary = join(path, `${randomUUID()}.tmp`);
+            // private
             const handle = await open(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
             try {
                 await handle.writeFile(JSON.stringify({ identity: this.identity(), binding, access }));