@playcraft/cli 0.1.68 → 0.1.69

package/dist/workspace-runtime/batch/publication.js

@@ -0,0 +1,96 @@
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, sameWorkspaceRegistration, } from '@playcraft/common/cloud-workspace/runtime';
+import { markRemoteAttachPending } from '../workspaces/remote-attach-marker.js';
+/** The control plane may promote a standalone binding, but may not substitute another checkout. */
+export function publicationBinding(state, workspaceId, directoryName, publication) {
+    const existing = state.journal.getWorkspace(workspaceId);
+    if (!publication)
+        return existing;
+    const binding = publication.binding;
+    if (publication.identity.runtimeId !== state.config.runtimeId || publication.identity.generation !== state.config.generation
+        || publication.identity.runtimeEpoch !== state.runtimeEpoch || state.journal.destroyed())
+        throw new Error('batch_source_identity_mismatch');
+    const promotion = existing?.targetKind === 'standalone' && binding.targetKind === 'main';
+    if (!existing || binding.workspaceId !== workspaceId || binding.targetKind === 'standalone'
+        || (!promotion && !sameWorkspaceRegistration(existing, binding)))
+        throw new Error('batch_source_identity_mismatch');
+    if (directoryName !== 'basic') {
+        const local = existing.directories?.find(item => item.directoryName === directoryName);
+        const trusted = binding.directories?.find(item => item.directoryName === directoryName);
+        if (!local || !trusted || local.workspaceId !== workspaceId || trusted.workspaceId !== workspaceId
+            || local.remixId !== trusted.remixId || local.branchName !== trusted.branchName
+            || local.status === 'reclaimed' || trusted.status === 'reclaimed')
+            throw new Error('batch_source_identity_mismatch');
+    }
+    return binding;
+}
+/** Adopt trusted identity after publication without changing the captured source checkout. */
+export async function adoptPublicationBinding(state, workspaceId, directoryName, publication, leaseFence) {
+    await state.journal.exclusive(`workspace:${workspaceId}`, async () => {
+        if (state.journal.destroyed())
+            throw new Error('runtime_destroyed');
+        if (leaseFence < state.acceptedLeaseFence)
+            throw new Error('stale_lease');
+        const binding = publicationBinding(state, workspaceId, directoryName, publication);
+        const current = state.journal.getWorkspace(workspaceId);
+        const directories = [...(current.directories ?? [])];
+        for (const incoming of binding.directories ?? []) {
+            const index = directories.findIndex(item => item.directoryName === incoming.directoryName);
+            if (index < 0) {
+                directories.push(incoming);
+                continue;
+            }
+            const previous = directories[index];
+            if (previous.workspaceId !== incoming.workspaceId || previous.remixId !== incoming.remixId
+                || previous.branchName !== incoming.branchName || (previous.sourceCommit && incoming.sourceCommit
+                && previous.sourceCommit !== incoming.sourceCommit))
+                throw new Error('batch_source_identity_mismatch');
+            directories[index] = { ...incoming,
+                ...(previous.status === 'ready' && incoming.status === 'pending' ? { status: 'ready' } : {}),
+                ...(incoming.sourceCommit ?? previous.sourceCommit ? { sourceCommit: incoming.sourceCommit ?? previous.sourceCommit } : {}) };
+        }
+        if (current.targetKind === 'standalone' && binding.targetKind === 'main' && !binding.preserveLocalBasic) {
+            await markRemoteAttachPending(state, workspaceId, binding.repositoryUrl, binding.branchName);
+        }
+        await state.journal.putWorkspace({ ...binding, directories });
+    });
+}
+/** Supply scoped credentials to Git only through the child process environment, never the checkout. */
+export function publicationGitOptions(state, publication) {
+    const { binding, preparation } = publication;
+    if (binding.targetKind === 'standalone' || preparation.mode !== 'clone')
+        throw new Error('batch_source_identity_mismatch');
+    let source;
+    try {
+        source = new URL(binding.repositoryUrl);
+        if (source.username || source.password || source.search || source.hash || (source.protocol !== 'https:'
+            && !(source.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(source.hostname))))
+            throw new Error();
+    }
+    catch {
+        throw new Error('workspace_git_gateway_unavailable');
+    }
+    const direct = isLocalWorkspaceGitAuthMode(preparation.authMode);
+    if (direct && (!isLocalWorkspaceGitEnvironment(state.config.environment) || !preparation.directAccess
+        || preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
+        throw new Error('workspace_git_gateway_unavailable');
+    const transport = preparation.transport;
+    if (transport) {
+        const match = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (transport.kind !== 'git-gateway-v2' || !match.ok || match.requestId !== `v2/${binding.workspaceId}` || !preparation.gitAccess)
+            throw new Error('workspace_git_gateway_unavailable');
+    }
+    const access = preparation.gitAccess;
+    const now = Date.now();
+    if (access && (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000))
+        throw new Error('workspace_git_access_expired');
+    const credential = preparation.directAccess ?? access;
+    const entries = [['credential.helper', ''], ['http.followRedirects', 'false']];
+    if (credential)
+        entries.push([`http.${transport?.cloneUrl ?? source.href}.extraHeader`,
+            `Authorization: Basic ${Buffer.from(`${credential.username}:${credential.password}`).toString('base64')}`]);
+    if (transport)
+        entries.push([`url.${transport.cloneUrl}.insteadOf`, binding.repositoryUrl]);
+    const env = { GIT_ALLOW_PROTOCOL: 'http:https', GIT_CONFIG_COUNT: String(entries.length) };
+    entries.forEach(([key, value], index) => { env[`GIT_CONFIG_KEY_${index}`] = key; env[`GIT_CONFIG_VALUE_${index}`] = value; });
+    return { env, deadline: Math.min(now + 90_000, access ? Date.parse(access.expiresAt) : Infinity) };
+}

package/dist/workspace-runtime/batch/source-candidate.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { batchSourceSnapshotRefSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { publicationBinding } from './publication.js';
 export function sourceCandidateFile(state, batchId) {
     return join(state.config.stateDir, 'batch-source-candidates', `${batchId}.json`);
 }
@@ -72,7 +73,7 @@ export async function writeSourceCandidate(state, candidate) {
     }
 }
 export function assertSourceIdentity(state, request, snapshot, candidate) {
-    const binding = state.journal.getWorkspace(request.workspaceId);
+    const binding = publicationBinding(state, request.workspaceId, request.sourceDirectoryName, request.publication);
     const branchName = request.sourceDirectoryName === 'basic' ? binding?.branchName
         : binding?.directories?.find(directory => directory.directoryName === request.sourceDirectoryName)?.branchName;
     if (snapshot.batchId !== request.batchId || snapshot.sourceWorkspaceId !== request.workspaceId

package/dist/workspace-runtime/batch/source-publish.js

@@ -1,9 +1,10 @@
 import { lstat, mkdir, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { copyCredentialHelpers, gitRead, gitWrite } from './git.js';
+import { clearCredentialHelpers, copyCredentialHelpers, gitRead, gitWrite } from './git.js';
 import { archiveSource, restoreArchive } from './source-capture.js';
 import { sourceCacheDir } from './records.js';
 import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
+import { publicationGitOptions } from './publication.js';
 async function reject(state, candidate, code, stage, retryable, outcome, cause) {
     throw await sourceFreezeError(state, candidate.snapshot.batchId, { code, stage, retryable, outcome }, cause);
 }
@@ -20,7 +21,7 @@ function definitelyRejected(error) {
     return /remote rejected|\[rejected\]|authentication failed|access denied|permission denied|not allowed|not support|hook declined|protected|returned error: (?:401|403)/i
         .test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`);
 }
-async function publishRemote(state, candidate, source) {
+async function publishRemote(state, candidate, source, publication) {
     const { snapshot, repositoryUrl: remote } = candidate;
     const cache = sourceCacheDir(state, snapshot.batchId);
     if (!remote || !snapshot.remoteRef)
@@ -29,10 +30,20 @@ async function publishRemote(state, candidate, source) {
     await mkdir(cache, { recursive: true, mode: 0o700 });
     if (!await lstat(join(cache, '.git')).catch(() => undefined))
         await gitWrite(cache, ['init', '--initial-branch', 'source']);
-    await copyCredentialHelpers(source, cache);
-    // All remote operations share the copied authentication, including read-only verification.
+    if (publication)
+        await clearCredentialHelpers(cache);
+    else
+        await copyCredentialHelpers(source, cache);
+    const options = publication ? publicationGitOptions(state, publication) : undefined;
+    const remoteGit = (args) => {
+        const timeout = options ? Math.min(90_000, options.deadline - Date.now()) : 90_000;
+        if (timeout <= 0)
+            throw new Error('workspace_git_access_expired');
+        return gitWrite(cache, args, options ? { env: options.env, timeout } : undefined);
+    };
+    // For trusted publication, all remote commands use only ephemeral, scoped credentials.
     const remoteHash = async () => {
-        const output = await gitWrite(cache, ['ls-remote', '--refs', remote, snapshot.remoteRef]);
+        const output = await remoteGit(['ls-remote', '--refs', remote, snapshot.remoteRef]);
         const rows = output.trim().split('\n').filter(Boolean).map(line => line.split(/\s+/));
         if (rows.some(([hash, ref]) => !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(hash) || ref !== snapshot.remoteRef) || rows.length > 1) {
             throw new Error('batch_source_remote_response_invalid');
@@ -44,7 +55,7 @@ async function publishRemote(state, candidate, source) {
         found = await remoteHash();
     }
     catch (error) {
-        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', publication ? undefined : error);
     }
     if (found && found !== snapshot.commitHash)
         return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown');
@@ -53,7 +64,7 @@ async function publishRemote(state, candidate, source) {
             return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'not_published');
         let pushError;
         try {
-            await gitWrite(cache, ['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
+            await remoteGit(['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
         }
         catch (error) {
             pushError = error;
@@ -63,25 +74,25 @@ async function publishRemote(state, candidate, source) {
         }
         catch (error) {
             const unsupported = pushError !== undefined && pushFailureCode(pushError) === 'batch_source_ref_unsupported';
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', pushError ?? error);
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', publication ? undefined : pushError ?? error);
         }
         if (found && found !== snapshot.commitHash)
-            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', pushError);
+            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', publication ? undefined : pushError);
         if (!found) {
             const rejected = pushError !== undefined && definitelyRejected(pushError);
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', pushError);
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', publication ? undefined : pushError);
         }
     }
     if (!await verifyCache(cache, candidate)) {
         try {
-            await gitWrite(cache, ['fetch', '--no-tags', remote, snapshot.remoteRef]);
+            await remoteGit(['fetch', '--no-tags', remote, snapshot.remoteRef]);
             if ((await gitRead(cache, ['rev-parse', 'FETCH_HEAD^{commit}'])).trim() !== snapshot.commitHash) {
                 return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
             }
             await gitWrite(cache, ['checkout', '--detach', snapshot.commitHash]);
         }
         catch (error) {
-            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', publication ? undefined : error);
         }
         if (!await verifyCache(cache, candidate))
             return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
@@ -118,16 +129,16 @@ async function publishArtifact(state, candidate, store) {
     // private
     await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
 }
-export async function publishSourceCandidate(state, candidate, source, store) {
+export async function publishSourceCandidate(state, candidate, source, store, publication) {
     try {
         if (candidate.persist === 'remote_ref')
-            await publishRemote(state, candidate, source);
+            await publishRemote(state, candidate, source, publication);
         else
             await publishArtifact(state, candidate, store);
     }
     catch (error) {
         if (error instanceof BatchSourceFreezeError)
             throw error;
-        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
+        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, publication ? undefined : error);
     }
 }

package/dist/workspace-runtime/persistence/sqlite-worker.js

@@ -14,7 +14,7 @@ import { parentPort } from 'node:worker_threads';
 import Database from 'better-sqlite3-pinned';
 import { clearPendingNativeFollowups, learnNativeSubagents, nativeEventOwner, nativeSubagentThreads } from './native-subagents.js';
 import { settleStoppedExecution, stoppedExecutionEpochs } from './stopped-execution.js';
-import { hashOperationPayload, operationRecordSchema, pendingSourceEventSchema, terminalRecordSchema, workspaceRegistrationSchema, transitionOperation, canTransitionTurn, } from '@playcraft/common/cloud-workspace/runtime';
+import { hashOperationPayload, nativeTurnFailureMessage, operationRecordSchema, pendingSourceEventSchema, terminalRecordSchema, workspaceRegistrationSchema, transitionOperation, canTransitionTurn, } from '@playcraft/common/cloud-workspace/runtime';
 const SCHEMA_VERSION = 1;
 const MIN_SQLITE = [3, 51, 3];
 const BINDING = 'better-sqlite3@13.0.3';
@@ -726,6 +726,7 @@ function applyNativeToState(database, input, payload) {
         putOperation(database, input.operation.scopeKey, transitionOperation(ownedOperation, terminal, {
             nativeTurnId: input.turnId ?? ownedOperation.nativeTurnId,
             nativeThreadId: input.threadId ?? ownedOperation.nativeThreadId,
+            error: terminal === 'failed' ? nativeTurnFailureMessage(payload) : undefined,
         }));
     }
 }

package/dist/workspace-runtime/serve.js

@@ -25,6 +25,7 @@ import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.j
 import { workspaceContextFromRoot, workspaceRoot } from './workspaces/registry.js';
 import { recoverInterruptedLibraryImports } from './workspaces/asset-library-import.js';
 import { recoverAssetTransfers } from './workspaces/asset-transfer-publish.js';
+import { readWorkspaceAssetProvenance, WORKSPACE_ASSET_PROVENANCE_PATH } from '../asset-library/provenance.js';
 import { recoverWorkspaceDirectoryMutation } from './workspaces/directory-mutations.js';
 import { observeWorkspaceDirectories } from './workspaces/directory-revisions.js';
 import { observeWorkspaceBinaryFile } from './workspaces/binary-write.js';
@@ -116,6 +117,54 @@ export async function startWorkspaceRuntime(config, options = {}) {
         }
         else
             await recoverLibraryImports(config.workspaceRoot);
+        // Model-library imports share the existing multi-file transfer journal. Recover it before settling either operation kind.
+        const recoveredBundles = new Map();
+        const transferScopes = new Set();
+        for (const { operation } of journal.listOperations()) {
+            if (!['asset.bundle.save', 'asset.library.import'].includes(operation.kind))
+                continue;
+            const directoryName = operation.directoryName ?? 'basic';
+            const key = `${operation.workspaceId ?? ''}:${directoryName}`;
+            if (transferScopes.has(key))
+                continue;
+            transferScopes.add(key);
+            const root = await workspaceRoot(state, operation.workspaceId, directoryName).catch(() => undefined);
+            if (!root)
+                continue;
+            const recovered = await recoverAssetTransfers(root, { environment: config.environment, userId: config.userId,
+                workspaceId: operation.workspaceId ?? '', directoryName }).catch(() => []);
+            for (const item of recovered)
+                recoveredBundles.set(item.operationId, item);
+        }
+        for (const { operation } of journal.listOperations()) {
+            if (operation.kind !== 'asset.library.import' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
+                continue;
+            const recovered = recoveredBundles.get(operation.operationId);
+            if (!recovered?.receipt.files.some(file => file.path === WORKSPACE_ASSET_PROVENANCE_PATH))
+                continue;
+            const root = await workspaceRoot(state, operation.workspaceId, operation.directoryName).catch(() => undefined);
+            if (!root)
+                continue;
+            const sources = await readWorkspaceAssetProvenance(root).catch(() => undefined);
+            if (!sources)
+                continue;
+            const files = new Map(recovered.receipt.files.map(file => [file.path, file.contentHash]));
+            const models = sources.assets.filter(asset => files.get(asset.path) === asset.provenance.modelSha256);
+            if (!models.length || models.length !== recovered.receipt.files.filter(file => file.path.toLowerCase().endsWith('.glb')).length)
+                continue;
+            let unchanged = true;
+            for (const file of recovered.receipt.files) {
+                if ((await observeWorkspaceBinaryFile(root, file.path).catch(() => undefined))?.contentHash !== file.contentHash) {
+                    unchanged = false;
+                    break;
+                }
+            }
+            if (!unchanged)
+                continue;
+            const previous = recoveredImports.get(operation.operationId) ?? { paths: [], assetIds: [] };
+            recoveredImports.set(operation.operationId, { paths: [...new Set([...previous.paths, ...files.keys()])],
+                assetIds: [...new Set([...previous.assetIds, ...models.map(model => model.provenance.assetId)])], receipt: recovered.receipt });
+        }
         for (const { scopeKey, operation } of journal.listOperations()) {
             if (operation.kind !== 'asset.library.import' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
                 continue;
@@ -125,6 +174,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
             const result = operation.result && 'paths' in operation.result ? { ...operation.result,
                 paths: [...new Set([...operation.result.paths, ...(published?.paths ?? [])])],
                 failures: operation.result.failures.filter(failure => !published?.assetIds.includes(failure.assetId)),
+                ...(published?.receipt ? { bundleReceipt: published.receipt } : {}),
             } : undefined;
             const root = await workspaceRoot(state, operation.workspaceId, operation.directoryName).catch(() => undefined);
             if (root && result)
@@ -151,24 +201,6 @@ export async function startWorkspaceRuntime(config, options = {}) {
                 recoveredChanges.push({ workspaceId: operation.workspaceId,
                     directoryName: operation.directoryName ?? 'basic', paths: result.paths });
         }
-        const recoveredBundles = new Map();
-        const transferScopes = new Set();
-        for (const { operation } of journal.listOperations()) {
-            if (operation.kind !== 'asset.bundle.save')
-                continue;
-            const directoryName = operation.directoryName ?? 'basic';
-            const key = `${operation.workspaceId ?? ''}:${directoryName}`;
-            if (transferScopes.has(key))
-                continue;
-            transferScopes.add(key);
-            const root = await workspaceRoot(state, operation.workspaceId, directoryName).catch(() => undefined);
-            if (!root)
-                continue;
-            const recovered = await recoverAssetTransfers(root, { environment: config.environment, userId: config.userId,
-                workspaceId: operation.workspaceId ?? '', directoryName }).catch(() => []);
-            for (const item of recovered)
-                recoveredBundles.set(item.operationId, item);
-        }
         for (const { scopeKey, operation } of journal.listOperations()) {
             if (operation.kind !== 'asset.bundle.save' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
                 continue;

package/dist/workspace-runtime/server/dispatch.js

@@ -5,6 +5,7 @@ import { revisionScope, sessionWorkspaceRoot, workspaceRoot, workspaceSessions,
 import { preflightSkillExecution } from '../workspaces/skill-execution-context.js';
 import { abandonTurnChanges, beginTurnChanges, finishTurnChanges, } from '../workspaces/turn-changes.js';
 import { shareWorkspaceGit } from '../workspaces/shared-git.js';
+import { remoteAttachPending } from '../workspaces/remote-attach-marker.js';
 import { cancelPendingDirectoryAccess, holdDirectoryAccess, withOperationDirectoryAccess, } from './directory-access.js';
 import { join } from 'node:path';
 import { z } from 'zod';
@@ -1127,8 +1128,11 @@ async function executeAssetLibraryImport(state, scopeKey, operation, payload) {
         await assertCurrent();
         const result = await importWorkspaceLibraryAssets(root, input?.selection, input?.snapshot, assertCurrent, {
             operationId: operation.operationId,
+            scope: { environment: state.config.environment, userId: state.config.userId,
+                workspaceId: operation.workspaceId ?? '', directoryName: operation.directoryName ?? 'basic' },
             onProgress: async (result) => { await state.journal.putOperation(scopeKey, { ...operation, result }); },
         });
+        await assertCurrent();
         const scope = revisionScope(state, operation.workspaceId, operation.directoryName);
         for (const path of result.paths) {
             const file = await observeWorkspaceBinaryFile(root, path);
@@ -1146,10 +1150,14 @@ async function executeAssetLibraryImport(state, scopeKey, operation, payload) {
                         kind: 'discovered', tool: 'asset.library.import', operationId: operation.operationId,
                     } }).catch(() => undefined);
         }
-        return persist(state, scopeKey, transitionOperation(accepted, 'completed', { result }));
+        await assertCurrent();
+        return persist(state, scopeKey, transitionOperation(accepted, result.failures.length ? 'failed' : 'completed', {
+            result, ...(result.failures.length ? { error: 'asset_library_import_failed' } : {}),
+        }));
     }
     catch (error) {
-        return persist(state, scopeKey, transitionOperation(operation, 'failed', {
+        const current = state.journal.getOperation(scopeKey) ?? operation;
+        return persist(state, scopeKey, transitionOperation(current, 'failed', {
             error: error instanceof Error && ['stale_lease', 'batch_workspace_readonly'].includes(error.message)
                 ? error.message : 'invalid_library_import',
         }));
@@ -1383,6 +1391,17 @@ async function executeGitCommit(state, scopeKey, operation, payload) {
  * accepts it. A standalone workspace has no remote, so its saves stay local; its project
  * directories have their own branch.
  */
+async function withBasicBindingLock(state, operation, action) {
+    if (state.config.workspaceMode !== 'multi' || !operation.workspaceId || (operation.directoryName ?? 'basic') !== 'basic')
+        return action();
+    return state.journal.exclusive(`workspace:${operation.workspaceId}`, action);
+}
+/** A published batch may have adopted project metadata while basic still has a local checkout. */
+async function basicRemotePending(state, operation) {
+    if (state.config.workspaceMode !== 'multi' || !operation.workspaceId || (operation.directoryName ?? 'basic') !== 'basic')
+        return false;
+    return remoteAttachPending(state, operation.workspaceId);
+}
 export function savePushesBranch(targetKind, directoryName) {
     return targetKind === 'main' || targetKind === 'remix' || Boolean(directoryName && directoryName !== 'basic');
 }
@@ -1391,13 +1410,19 @@ async function executeWorkspaceSave(state, scopeKey, operation, payload) {
     if (!parsed.success) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_workspace_save' }));
     }
-    const binding = operation.workspaceId ? state.journal.getWorkspace(operation.workspaceId) : undefined;
     try {
         // Saves share the directory, and a deferred one runs outside the workspace queue; commit one at a time.
-        const saved = await state.journal.exclusive(`workspace-save:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, async () => saveWorkspaceGit(await gitWorkspaceRoot(state, operation), {
-            message: parsed.data.trigger === 'auto' ? 'Autosave workspace' : 'Save workspace',
-            push: savePushesBranch(binding?.targetKind, operation.directoryName),
-            boundBranch: boundBranch(state, operation),
+        const saved = await state.journal.exclusive(`workspace-save:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, () => withBasicBindingLock(state, operation, async () => {
+            const binding = operation.workspaceId ? state.journal.getWorkspace(operation.workspaceId) : undefined;
+            const localOnly = await basicRemotePending(state, operation);
+            const saved = await saveWorkspaceGit(await gitWorkspaceRoot(state, operation), {
+                message: parsed.data.trigger === 'auto' ? 'Autosave workspace' : 'Save workspace',
+                push: !localOnly && savePushesBranch(binding?.targetKind, operation.directoryName),
+                boundBranch: localOnly ? undefined : boundBranch(state, operation),
+            });
+            if (localOnly)
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            return saved;
         }));
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [
@@ -1419,7 +1444,11 @@ async function executeGitPush(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'remote_not_configurable' }));
     }
     try {
-        await pushWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        await withBasicBindingLock(state, operation, async () => {
+            if (await basicRemotePending(state, operation))
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            await pushWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        });
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [
             {
@@ -1440,7 +1469,11 @@ async function executeGitPull(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'remote_not_configurable' }));
     }
     try {
-        const pulled = await pullWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        const pulled = await withBasicBindingLock(state, operation, async () => {
+            if (await basicRemotePending(state, operation))
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            return pullWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        });
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [{
                 type: 'git.pulled',

package/dist/workspace-runtime/server/http.js

@@ -44,6 +44,7 @@ import { acceptOperationCore, observeLevelEditorTransaction } from './accept-ope
 import { workspaceArtifactContentQuerySchema } from '@playcraft/common/cloud-workspace/runtime';
 import { searchWorkspaceFiles } from '../workspaces/files-search.js';
 import { serveWorkspaceArchive } from '../workspaces/archive.js';
+import { verifyRuntimeAssetProvenance } from '../workspaces/asset-provenance-verifier.js';
 import { handleWorkspaceTransfer } from './workspace-transfer.js';
 import { handleWorkspaceStorage } from './workspace-storage.js';
 import { serveSessionImage } from '../workspaces/session-image.js';
@@ -199,6 +200,7 @@ async function dispatchRuntimeRequest(state, request, response) {
                 levelEditorRetryVersion: 1,
                 remixReferencesVersion: 1,
                 batchSourceFreezeRevision: 2,
+                batchSourcePublicationVersion: 1,
                 ...(state.native?.workspaceUi ? { workspaceUiVersion: 1 } : {}),
                 ...(state.native?.startReview && state.native?.steer ? { turnControlVersion: 1 } : {}),
                 ...(state.native?.startCompact ? { compactionVersion: 1 } : {}),
@@ -685,8 +687,16 @@ async function dispatchRuntimeRequest(state, request, response) {
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/archive') {
             if (writeDestroyed(state, response))
                 return;
-            const root = await sessionWorkspaceRoot(state, url.searchParams.get('workspaceId') ?? undefined, directoryName);
-            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir] });
+            const archiveWorkspaceId = url.searchParams.get('workspaceId') ?? undefined;
+            const root = await sessionWorkspaceRoot(state, archiveWorkspaceId, directoryName);
+            const expectedModelPaths = state.journal.listOperations().map(({ operation }) => operation).filter(operation => operation.kind === 'asset.library.import'
+                && (state.config.workspaceMode !== 'multi' || operation.workspaceId === archiveWorkspaceId)
+                && (operation.directoryName ?? 'basic') === directoryName)
+                .flatMap(operation => operation.result && 'bundleReceipt' in operation.result ? operation.result.bundleReceipt?.files ?? [] : [])
+                .map(file => file.path).filter(path => path.toLowerCase().endsWith('.glb'));
+            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir],
+                expectedModelPaths: [...new Set(expectedModelPaths)],
+                verifyProvenance: provenance => verifyRuntimeAssetProvenance(state, provenance) });
             return;
         }
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/file-content') {

package/dist/workspace-runtime/verify-artifact.js

@@ -47,6 +47,7 @@ export async function verifyRuntimeArtifact(expectedVersion) {
         const identity = await response.json();
         assert.equal(identity.runtimeId, config.runtimeId);
         assert.equal(identity.batchSourceFreezeRevision, 2, 'built runtime lacks the required batch source freeze implementation');
+        assert.equal(identity.batchSourcePublicationVersion, 1, 'built runtime lacks trusted batch source publication');
     }
     finally {
         await runtime?.close();
@@ -55,5 +56,5 @@ export async function verifyRuntimeArtifact(expectedVersion) {
 }
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
     await verifyRuntimeArtifact(process.argv[2] ?? '');
-    console.log('Runtime artifact verified: batchSourceFreezeRevision=2');
+    console.log('Runtime artifact verified: batchSourceFreezeRevision=2, batchSourcePublicationVersion=1');
 }

package/dist/workspace-runtime/workspaces/archive.js

@@ -1,13 +1,21 @@
 import { constants } from 'node:fs';
+import { createHash } from 'node:crypto';
 import { lstat, open, opendir, realpath } from 'node:fs/promises';
 import { join, relative, sep } from 'node:path';
 import { Readable, Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { createDeflateRaw } from 'node:zlib';
 import { isCredentialFile } from './git.js';
-const EXCLUDED_NAMES = new Set(['.git', 'node_modules', '.playcraft.json', '.playcraft-workspace.json']);
+import { verifyWorkspaceAssetProvenance, WORKSPACE_ASSET_PROVENANCE_PATH } from '../../asset-library/provenance.js';
+import { workspaceAssetProvenanceDocumentSchema } from '@playcraft/common/cloud-workspace/runtime';
+const EXCLUDED_NAMES = new Set(['.git', 'node_modules', '.playcraft-temp', '.playcraft.json', '.playcraft-workspace.json']);
 const MAX_SOURCE_BYTES = 2 * 1024 * 1024 * 1024;
 const MAX_ENTRIES = 50_000;
+const PUBLIC_ARCHIVE_ERRORS = new Set(['workspace_archive_changed', 'workspace_archive_too_large', 'workspace_archive_invalid_path',
+    'workspace_archive_failed', 'asset_provenance_authority_required', 'asset_provenance_authority_unavailable',
+    'asset_provenance_authority_mismatch', 'asset_provenance_authority_response_bound', 'asset_provenance_model_changed',
+    'asset_provenance_license_changed', 'asset_provenance_record_missing', 'asset_provenance_license_path_mismatch',
+    'asset_provenance_too_large', 'asset_provenance_changed', 'asset_provenance_notice_conflict', 'asset_provenance_expected_path_invalid']);
 const UTF8_DESCRIPTOR_FLAGS = 0x0808;
 const CRC_TABLE = Uint32Array.from({ length: 256 }, (_, value) => {
     let crc = value;
@@ -18,6 +26,13 @@ const CRC_TABLE = Uint32Array.from({ length: 256 }, (_, value) => {
 /** Exports working files, including ignored deliverables, without following symbolic links. */
 export async function createWorkspaceArchive(root, options = {}) {
     const rootReal = await realpath(root);
+    const provenance = await verifyWorkspaceAssetProvenance(rootReal, { verify: options.verifyProvenance,
+        expectedModelPaths: options.expectedModelPaths });
+    const expectedHashes = new Map();
+    for (const asset of provenance?.assets ?? []) {
+        expectedHashes.set(asset.path, asset.provenance.modelSha256);
+        expectedHashes.set(asset.licensePath, createHash('sha256').update(asset.provenance.licenseText).digest('hex'));
+    }
     const excludedRoots = await Promise.all((options.excludedRoots ?? []).map(path => realpath(path).catch(() => path)));
     const entries = [];
     let bytes = 0;
@@ -52,7 +67,8 @@ export async function createWorkspaceArchive(root, options = {}) {
             bytes += info.size;
             if (bytes > (options.maxSourceBytes ?? MAX_SOURCE_BYTES) || entries.length >= (options.maxEntries ?? MAX_ENTRIES))
                 throw new Error('workspace_archive_too_large');
-            entries.push({ path, target, info });
+            entries.push({ path, target, info, expectedHash: expectedHashes.get(path),
+                ...(path === WORKSPACE_ASSET_PROVENANCE_PATH && provenance ? { expectedProvenance: JSON.stringify(provenance) } : {}) });
         }
     };
     await walk(rootReal);
@@ -89,6 +105,8 @@ async function* zipFiles(root, entries, signal) {
             let crc = 0xffffffff;
             let size = 0;
             let compressedSize = 0;
+            const hash = entry.expectedHash ? createHash('sha256') : undefined;
+            const sourceChunks = [];
             const checksum = new Transform({ transform(chunk, _encoding, done) {
                     size += chunk.length;
                     if (size > info.size) {
@@ -97,6 +115,9 @@ async function* zipFiles(root, entries, signal) {
                     }
                     for (const byte of chunk)
                         crc = CRC_TABLE[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+                    hash?.update(chunk);
+                    if (entry.expectedProvenance)
+                        sourceChunks.push(chunk);
                     done(null, chunk);
                 } });
             const compressed = createDeflateRaw();
@@ -118,6 +139,10 @@ async function* zipFiles(root, entries, signal) {
             }
             if (size !== info.size)
                 throw new Error('workspace_archive_changed');
+            if (hash && hash.digest('hex') !== entry.expectedHash)
+                throw new Error('asset_provenance_model_changed');
+            if (entry.expectedProvenance && JSON.stringify(workspaceAssetProvenanceDocumentSchema.parse(JSON.parse(Buffer.concat(sourceChunks).toString('utf8')))) !== entry.expectedProvenance)
+                throw new Error('asset_provenance_changed');
             const after = await handle.stat();
             if (after.size !== info.size || after.mtimeMs !== info.mtimeMs || after.ctimeMs !== info.ctimeMs)
                 throw new Error('workspace_archive_changed');
@@ -188,7 +213,7 @@ export async function serveWorkspaceArchive(root, request, response, options = {
         else if (!controller.signal.aborted) {
             const reason = error instanceof Error ? error.message : 'workspace_archive_failed';
             response.writeHead(reason === 'workspace_archive_too_large' ? 413 : 409, { 'content-type': 'application/json', 'cache-control': 'private, no-store' });
-            response.end(JSON.stringify({ error: reason.startsWith('workspace_archive_') ? reason : 'workspace_archive_failed' }));
+            response.end(JSON.stringify({ error: PUBLIC_ARCHIVE_ERRORS.has(reason) ? reason : 'workspace_archive_failed' }));
         }
     }
     finally {