@playcraft/cli 0.1.58-beta → 0.1.59-beta

package/dist/workspace-runtime/workspaces/registry.js

@@ -1,6 +1,6 @@
 import { execFile } from 'node:child_process';
 import { lstat, mkdir, realpath, rm, writeFile } from 'node:fs/promises';
-import { join, relative } from 'node:path';
+import { dirname, join, relative } from 'node:path';
 import { promisify } from 'node:util';
 import { isLocalWorkspaceGitAuthMode, sameWorkspaceRegistration, workspaceRegistrationSchema, batchSourceSnapshotSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { prepareWorkspaceCheckout } from './prepare.js';
@@ -163,7 +163,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation, r
             await prepareWorkspaceCheckout(state, binding, preparation, leaseFence);
             root = await checkedDirectory(state, binding.workspaceId);
         }
-        const git = async (...args) => (await exec('git', ['-C', root, ...args], {
+        const gitIn = (cwd) => async (...args) => (await exec('git', ['-C', cwd, ...args], {
             timeout: 5000,
             maxBuffer: 64 * 1024,
             env: {
@@ -173,8 +173,14 @@ export async function registerWorkspace(state, input, leaseFence, preparation, r
                 GIT_CONFIG_GLOBAL: '/dev/null',
             },
         })).stdout.trim();
+        const git = gitIn(root);
+        // The checkout, not the journal, decides whether the remote is still missing: the state volume is
+        // per generation and forgets a standalone→main promotion, while the checkout outlives it.
+        const needsRemote = binding.targetKind === 'main' && !preservedLocalBasic
+            && (await git('remote').catch(() => undefined)) === '';
         // Unfinished if it failed part way: the marker outlives the journal entry written below.
-        if (binding.targetKind === 'main' && !preservedLocalBasic && (remoteUpgrade || await lstat(attachMarker).then(() => true, () => false))) {
+        if (binding.targetKind === 'main' && !preservedLocalBasic
+            && (needsRemote || remoteUpgrade || await lstat(attachMarker).then(() => true, () => false))) {
             if (preparation?.mode !== 'clone' || !state.gitCredentials)
                 throw new WorkspaceContextError('workspace_git_gateway_unavailable');
             // private
@@ -218,6 +224,10 @@ export async function registerWorkspace(state, input, leaseFence, preparation, r
                 throw error;
             throw new WorkspaceContextError('workspace_not_prepared');
         }
+        // Variants share basic's volume but have no registration step of their own, so a swap can leave
+        // them checked out, on the right branch, and without the remote their saves need.
+        if (!readOnlyBasic && !preservedLocalBasic)
+            await restoreDirectoryRemotes(binding, root, gitIn);
         if (state.journal.destroyed())
             throw new WorkspaceContextError('runtime_destroyed');
         if (leaseFence < state.acceptedLeaseFence)
@@ -260,3 +270,34 @@ export async function registerWorkspace(state, input, leaseFence, preparation, r
         return binding;
     });
 }
+/**
+ * Variant checkouts outlive the journal that registered them: a sandbox swap keeps the files and the
+ * branch but drops the remote. Only an already-correct branch is repaired; rebuilding another one
+ * would discard the variant's own commits, so that case stays a checkout mismatch.
+ */
+async function restoreDirectoryRemotes(binding, root, gitIn) {
+    const repositoryUrl = binding.repositoryUrl;
+    if (!repositoryUrl)
+        return;
+    for (const directory of binding.directories ?? []) {
+        if (directory.directoryName === 'basic')
+            continue;
+        const checkout = join(dirname(root), directory.directoryName);
+        const stat = await lstat(checkout).catch(() => undefined);
+        if (!stat?.isDirectory() || stat.isSymbolicLink())
+            continue;
+        const git = gitIn(checkout);
+        if ((await git('symbolic-ref', '--short', 'HEAD').catch(() => undefined)) !== directory.branchName)
+            continue;
+        const origin = await git('config', '--get', 'remote.origin.url').catch(() => undefined);
+        if (origin === repositoryUrl)
+            continue;
+        try {
+            if (origin === undefined)
+                await git('remote', 'add', 'origin', repositoryUrl);
+            else
+                await git('remote', 'set-url', 'origin', repositoryUrl);
+        }
+        catch { /* The variant still opens; its next save reports the missing remote. */ }
+    }
+}

package/dist/workspace-runtime/workspaces/storage-snapshot.js

@@ -0,0 +1,235 @@
+import { createHash } from 'node:crypto';
+import { constants, createReadStream, createWriteStream } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, open, readlink, readdir, realpath, rm, symlink, utimes } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { Readable, Transform } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { createGunzip, createGzip } from 'node:zlib';
+const MAGIC = Buffer.from('PLAYCRAFT-STORAGE-1\n');
+export const STORAGE_SNAPSHOT_MAX_BYTES = 16 * 1024 * 1024 * 1024;
+const MAX_ENTRIES = 250_000, MAX_MANIFEST_BYTES = 32 * 1024 * 1024;
+const EXCLUDED = new Set(['node_modules', '.next', '.cache', '.turbo', '.vite', '.pnpm-store', '.playcraft.json']);
+function inside(root, path) {
+    const part = relative(root, path);
+    return part === '' || (!isAbsolute(part) && part !== '..' && !part.startsWith(`..${sep}`));
+}
+function excluded(path) {
+    const parts = path.split('/');
+    return parts.some(name => EXCLUDED.has(name.toLowerCase()) || /^\.playcraft-credential-/.test(name));
+}
+function safeLink(root, parent, link) {
+    // Parent traversals may precede a target, but cannot follow a symlinkable path component.
+    // For example, `link/../outside` can escape even though its lexical path looks internal.
+    return Boolean(link) && !isAbsolute(link) && !/[\0\\]/.test(link) && /^(?:\.\.\/)*(?!.*(?:^|\/)\.\.(?:\/|$)).+$/.test(link) &&
+        inside(root, resolve(parent, link));
+}
+function same(before, after) {
+    return before.dev === after.dev && before.ino === after.ino && before.mode === after.mode && before.size === after.size &&
+        before.mtimeMs === after.mtimeMs && before.ctimeMs === after.ctimeMs;
+}
+async function scan(root, options) {
+    const entries = [], excludedRoots = await Promise.all((options.excludedRoots ?? []).map(path => realpath(path).catch(() => resolve(path))));
+    let bytes = 0;
+    async function walk(directory) {
+        options.signal?.throwIfAborted();
+        const before = await lstat(directory);
+        if (!before.isDirectory() || before.isSymbolicLink() || !inside(root, await realpath(directory)))
+            throw new Error('storage_snapshot_changed');
+        for (const name of (await readdir(directory)).sort()) {
+            const source = join(directory, name), path = relative(root, source).split(sep).join('/');
+            if (excluded(path) || excludedRoots.some(item => inside(item, source)))
+                continue;
+            if (Buffer.byteLength(path) > 65_535 || /[\0\\]/.test(path))
+                throw new Error('storage_snapshot_invalid_path');
+            const info = await lstat(source);
+            if (/(?:^|\/)\.git\/objects\/info\/alternates$/.test(path))
+                throw new Error('storage_snapshot_unsupported');
+            const type = info.isSymbolicLink() ? 'symlink' : info.isDirectory() ? 'directory' : info.isFile() ? 'file' : undefined;
+            if (!type || entries.length >= MAX_ENTRIES)
+                throw new Error('storage_snapshot_unsupported');
+            const entry = { path, source, info, type, mode: info.mode & 0o777, mtime: info.mtimeMs, size: type === 'file' ? info.size : 0 };
+            if (type === 'symlink') {
+                entry.link = await readlink(source);
+                if (!safeLink(root, dirname(source), entry.link))
+                    throw new Error('storage_snapshot_unsafe_link');
+            }
+            else if (type === 'file' && /(?:^|\/)\.git$/.test(path)) {
+                if (info.size > 4096)
+                    throw new Error('storage_snapshot_unsupported');
+                const handle = await open(source, constants.O_RDONLY | constants.O_NOFOLLOW);
+                try {
+                    const pointer = /^gitdir: ([^\r\n]+)\n?$/.exec(await handle.readFile('utf8'));
+                    if (!pointer || !inside(root, resolve(directory, pointer[1])))
+                        throw new Error('storage_snapshot_unsupported');
+                }
+                finally {
+                    await handle.close();
+                }
+            }
+            bytes += entry.size;
+            if (bytes > STORAGE_SNAPSHOT_MAX_BYTES)
+                throw new Error('storage_snapshot_too_large');
+            entries.push(entry);
+            if (type === 'directory')
+                await walk(source);
+        }
+        if (!same(before, await lstat(directory)))
+            throw new Error('storage_snapshot_changed');
+    }
+    await walk(root);
+    return entries;
+}
+export async function createStorageSnapshot(root, options = {}) {
+    const temporary = await mkdtemp(join(tmpdir(), 'playcraft-storage-'));
+    const cleanup = () => rm(temporary, { recursive: true, force: true });
+    try {
+        const canonical = await realpath(root), rootInfo = await lstat(canonical), entries = await scan(canonical, options);
+        const manifest = Buffer.from(JSON.stringify(entries.map(({ path, type, mode, mtime, size, link }) => ({ path, type, mode, mtime, size, ...(link === undefined ? {} : { link }) }))));
+        if (manifest.length > MAX_MANIFEST_BYTES)
+            throw new Error('storage_snapshot_too_large');
+        const length = Buffer.alloc(4);
+        length.writeUInt32BE(manifest.length);
+        async function* contents() {
+            yield MAGIC;
+            yield length;
+            yield manifest;
+            for (const entry of entries) {
+                options.signal?.throwIfAborted();
+                if (!same(entry.info, await lstat(entry.source)))
+                    throw new Error('storage_snapshot_changed');
+                if (entry.type !== 'file')
+                    continue;
+                const file = await open(entry.source, constants.O_RDONLY | constants.O_NOFOLLOW);
+                try {
+                    if (!same(entry.info, await file.stat()))
+                        throw new Error('storage_snapshot_changed');
+                    let bytes = 0;
+                    for await (const chunk of file.createReadStream({ autoClose: false })) {
+                        bytes += chunk.length;
+                        if (bytes > entry.size)
+                            throw new Error('storage_snapshot_changed');
+                        yield chunk;
+                    }
+                    if (bytes !== entry.size)
+                        throw new Error('storage_snapshot_changed');
+                    if (!same(entry.info, await file.stat()))
+                        throw new Error('storage_snapshot_changed');
+                }
+                finally {
+                    await file.close();
+                }
+            }
+            for (const entry of entries)
+                if (!same(entry.info, await lstat(entry.source)))
+                    throw new Error('storage_snapshot_changed');
+            if (!same(rootInfo, await lstat(canonical)))
+                throw new Error('storage_snapshot_changed');
+        }
+        const path = join(temporary, 'snapshot.gz'), hash = createHash('sha256');
+        let bytes = 0;
+        await pipeline(Readable.from(contents()), createGzip(), new Transform({ transform(chunk, _encoding, done) { bytes += chunk.length; hash.update(chunk); done(bytes > STORAGE_SNAPSHOT_MAX_BYTES ? new Error('storage_snapshot_too_large') : null, chunk); } }), 
+        // private
+        createWriteStream(path, { flags: 'wx', mode: 0o600 }), { signal: options.signal });
+        return { path, bytes, sha256: hash.digest('hex'), cleanup };
+    }
+    catch (error) {
+        await cleanup();
+        throw error;
+    }
+}
+/** Extract only a validated manifest into a newly-created private directory; create links last. */
+export async function extractStorageSnapshot(path, target, options = {}) {
+    const input = createReadStream(path), stream = input.pipe(createGunzip());
+    input.on('error', error => stream.destroy(error));
+    const iterator = stream[Symbol.asyncIterator]();
+    let chunk = Buffer.alloc(0), offset = 0, total = 0;
+    const read = async (length) => {
+        const result = Buffer.allocUnsafe(length);
+        let written = 0;
+        while (written < length) {
+            options.signal?.throwIfAborted();
+            if (offset === chunk.length) {
+                const next = await iterator.next();
+                if (next.done)
+                    throw new Error('storage_snapshot_invalid');
+                chunk = next.value;
+                offset = 0;
+                total += chunk.length;
+                if (total > STORAGE_SNAPSHOT_MAX_BYTES + MAX_MANIFEST_BYTES)
+                    throw new Error('storage_snapshot_too_large');
+            }
+            const count = Math.min(length - written, chunk.length - offset);
+            chunk.copy(result, written, offset, offset + count);
+            written += count;
+            offset += count;
+        }
+        return result;
+    };
+    try {
+        if (!(await read(MAGIC.length)).equals(MAGIC))
+            throw new Error('storage_snapshot_invalid');
+        const size = (await read(4)).readUInt32BE();
+        if (size > MAX_MANIFEST_BYTES)
+            throw new Error('storage_snapshot_too_large');
+        const entries = JSON.parse((await read(size)).toString('utf8'));
+        if (!Array.isArray(entries) || entries.length > MAX_ENTRIES)
+            throw new Error('storage_snapshot_invalid');
+        const known = new Map();
+        let bytes = 0;
+        for (const raw of entries) {
+            const entry = raw;
+            if (!entry || typeof entry.path !== 'string' || !entry.path || Buffer.byteLength(entry.path) > 65_535 || /[\0\\]/.test(entry.path) || entry.path.split('/').some(part => !part || part === '.' || part === '..') || isAbsolute(entry.path) || known.has(entry.path) ||
+                !['file', 'directory', 'symlink'].includes(entry.type) || !Number.isSafeInteger(entry.mode) || entry.mode < 0 || entry.mode > 0o777 || !Number.isFinite(entry.mtime) ||
+                !Number.isSafeInteger(entry.size) || entry.size < 0 || (entry.type !== 'file' && entry.size !== 0))
+                throw new Error('storage_snapshot_invalid');
+            const parent = dirname(entry.path);
+            if (parent !== '.' && known.get(parent)?.type !== 'directory')
+                throw new Error('storage_snapshot_invalid');
+            if (entry.type === 'symlink' && (typeof entry.link !== 'string' || !safeLink(target, join(target, parent), entry.link)))
+                throw new Error('storage_snapshot_unsafe_link');
+            bytes += entry.size;
+            if (bytes > STORAGE_SNAPSHOT_MAX_BYTES)
+                throw new Error('storage_snapshot_too_large');
+            known.set(entry.path, entry);
+        }
+        for (const entry of known.values()) {
+            const destination = join(target, entry.path);
+            // private
+            if (entry.type === 'directory')
+                await mkdir(destination, { mode: 0o700 });
+            if (entry.type !== 'file')
+                continue;
+            // private
+            const handle = await open(destination, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+            try {
+                let remaining = entry.size;
+                while (remaining > 0) {
+                    const value = await read(Math.min(64 * 1024, remaining));
+                    await handle.writeFile(value);
+                    remaining -= value.length;
+                }
+            }
+            finally {
+                await handle.close();
+            }
+            await chmod(destination, entry.mode);
+            await utimes(destination, entry.mtime / 1000, entry.mtime / 1000);
+        }
+        if (offset !== chunk.length || !(await iterator.next()).done)
+            throw new Error('storage_snapshot_invalid');
+        for (const entry of known.values())
+            if (entry.type === 'symlink')
+                await symlink(entry.link, join(target, entry.path));
+        for (const entry of [...known.values()].reverse())
+            if (entry.type === 'directory') {
+                await chmod(join(target, entry.path), entry.mode);
+                await utimes(join(target, entry.path), entry.mtime / 1000, entry.mtime / 1000);
+            }
+    }
+    finally {
+        input.destroy();
+        stream.destroy();
+        await iterator.return?.();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.58-beta",
+  "version": "0.1.59-beta",
   "private": false,
   "type": "module",
   "engines": {
@@ -53,8 +53,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "0.1.58-beta",
-    "@playcraft/common": "0.1.58-beta",
+    "@playcraft/build": "0.1.59-beta",
+    "@playcraft/common": "0.1.59-beta",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",