@playcraft/cli 0.1.68 → 0.1.70

package/dist/workspace-runtime/batch/prepare.js

@@ -14,6 +14,7 @@ import { processHasExited, runProcessGroup } from './processes.js';
 import { createInstallLog } from './install-log.js';
 import { stopMemberWriters } from './writer-proof.js';
 import { restoreBatchSkillArtifacts } from './skill-artifacts.js';
+import { rebindBatchRemixReferences } from '../workspaces/remix-references.js';
 import { filesystemObjectStore, memberStatus, readMember, readSnapshot, readStopMarker, serializeRun, sourceCacheDir, writeMember, } from './records.js';
 const BRANCH = /^remix\/draft-[a-f0-9]{16}$/;
 function hashCommand(value) {
@@ -191,11 +192,14 @@ export async function prepareBatchMember(state, body, options) {
                     const commit = command.resumeFromCommit ?? snapshot.commitHash;
                     await checkoutBranch(staging, command.branchName, commit, repositoryUrl);
                     await restoreBatchSkillArtifacts(sourceRoot, staging);
+                    await rebindBatchRemixReferences(staging, snapshot.sourceDirectoryName, command.directoryName, command.remixReferences ?? []);
                     const { rename } = await import('node:fs/promises');
                     await rename(staging, root);
                 }
-                else
+                else {
                     await restoreBatchSkillArtifacts(sourceRoot, root);
+                    await rebindBatchRemixReferences(root, snapshot.sourceDirectoryName, command.directoryName, command.remixReferences ?? []);
+                }
                 await registerWorkspaceDirectory(state, {
                     workspaceId: command.workspaceId,
                     directoryName: command.directoryName,

package/dist/workspace-runtime/batch/publication.js

@@ -0,0 +1,96 @@
+import { isLocalWorkspaceGitAuthMode, isLocalWorkspaceGitEnvironment, matchWorkspaceGitGatewayCloneUrl, sameWorkspaceRegistration, } from '@playcraft/common/cloud-workspace/runtime';
+import { markRemoteAttachPending } from '../workspaces/remote-attach-marker.js';
+/** The control plane may promote a standalone binding, but may not substitute another checkout. */
+export function publicationBinding(state, workspaceId, directoryName, publication) {
+    const existing = state.journal.getWorkspace(workspaceId);
+    if (!publication)
+        return existing;
+    const binding = publication.binding;
+    if (publication.identity.runtimeId !== state.config.runtimeId || publication.identity.generation !== state.config.generation
+        || publication.identity.runtimeEpoch !== state.runtimeEpoch || state.journal.destroyed())
+        throw new Error('batch_source_identity_mismatch');
+    const promotion = existing?.targetKind === 'standalone' && binding.targetKind === 'main';
+    if (!existing || binding.workspaceId !== workspaceId || binding.targetKind === 'standalone'
+        || (!promotion && !sameWorkspaceRegistration(existing, binding)))
+        throw new Error('batch_source_identity_mismatch');
+    if (directoryName !== 'basic') {
+        const local = existing.directories?.find(item => item.directoryName === directoryName);
+        const trusted = binding.directories?.find(item => item.directoryName === directoryName);
+        if (!local || !trusted || local.workspaceId !== workspaceId || trusted.workspaceId !== workspaceId
+            || local.remixId !== trusted.remixId || local.branchName !== trusted.branchName
+            || local.status === 'reclaimed' || trusted.status === 'reclaimed')
+            throw new Error('batch_source_identity_mismatch');
+    }
+    return binding;
+}
+/** Adopt trusted identity after publication without changing the captured source checkout. */
+export async function adoptPublicationBinding(state, workspaceId, directoryName, publication, leaseFence) {
+    await state.journal.exclusive(`workspace:${workspaceId}`, async () => {
+        if (state.journal.destroyed())
+            throw new Error('runtime_destroyed');
+        if (leaseFence < state.acceptedLeaseFence)
+            throw new Error('stale_lease');
+        const binding = publicationBinding(state, workspaceId, directoryName, publication);
+        const current = state.journal.getWorkspace(workspaceId);
+        const directories = [...(current.directories ?? [])];
+        for (const incoming of binding.directories ?? []) {
+            const index = directories.findIndex(item => item.directoryName === incoming.directoryName);
+            if (index < 0) {
+                directories.push(incoming);
+                continue;
+            }
+            const previous = directories[index];
+            if (previous.workspaceId !== incoming.workspaceId || previous.remixId !== incoming.remixId
+                || previous.branchName !== incoming.branchName || (previous.sourceCommit && incoming.sourceCommit
+                && previous.sourceCommit !== incoming.sourceCommit))
+                throw new Error('batch_source_identity_mismatch');
+            directories[index] = { ...incoming,
+                ...(previous.status === 'ready' && incoming.status === 'pending' ? { status: 'ready' } : {}),
+                ...(incoming.sourceCommit ?? previous.sourceCommit ? { sourceCommit: incoming.sourceCommit ?? previous.sourceCommit } : {}) };
+        }
+        if (current.targetKind === 'standalone' && binding.targetKind === 'main' && !binding.preserveLocalBasic) {
+            await markRemoteAttachPending(state, workspaceId, binding.repositoryUrl, binding.branchName);
+        }
+        await state.journal.putWorkspace({ ...binding, directories });
+    });
+}
+/** Supply scoped credentials to Git only through the child process environment, never the checkout. */
+export function publicationGitOptions(state, publication) {
+    const { binding, preparation } = publication;
+    if (binding.targetKind === 'standalone' || preparation.mode !== 'clone')
+        throw new Error('batch_source_identity_mismatch');
+    let source;
+    try {
+        source = new URL(binding.repositoryUrl);
+        if (source.username || source.password || source.search || source.hash || (source.protocol !== 'https:'
+            && !(source.protocol === 'http:' && ['127.0.0.1', 'localhost', '[::1]'].includes(source.hostname))))
+            throw new Error();
+    }
+    catch {
+        throw new Error('workspace_git_gateway_unavailable');
+    }
+    const direct = isLocalWorkspaceGitAuthMode(preparation.authMode);
+    if (direct && (!isLocalWorkspaceGitEnvironment(state.config.environment) || !preparation.directAccess
+        || preparation.directAccess.repositoryUrl !== binding.repositoryUrl))
+        throw new Error('workspace_git_gateway_unavailable');
+    const transport = preparation.transport;
+    if (transport) {
+        const match = matchWorkspaceGitGatewayCloneUrl(transport.cloneUrl, state.config.gitGatewayOrigins, binding.repositoryUrl);
+        if (transport.kind !== 'git-gateway-v2' || !match.ok || match.requestId !== `v2/${binding.workspaceId}` || !preparation.gitAccess)
+            throw new Error('workspace_git_gateway_unavailable');
+    }
+    const access = preparation.gitAccess;
+    const now = Date.now();
+    if (access && (Date.parse(access.issuedAt) > now || Date.parse(access.expiresAt) <= now + 10_000))
+        throw new Error('workspace_git_access_expired');
+    const credential = preparation.directAccess ?? access;
+    const entries = [['credential.helper', ''], ['http.followRedirects', 'false']];
+    if (credential)
+        entries.push([`http.${transport?.cloneUrl ?? source.href}.extraHeader`,
+            `Authorization: Basic ${Buffer.from(`${credential.username}:${credential.password}`).toString('base64')}`]);
+    if (transport)
+        entries.push([`url.${transport.cloneUrl}.insteadOf`, binding.repositoryUrl]);
+    const env = { GIT_ALLOW_PROTOCOL: 'http:https', GIT_CONFIG_COUNT: String(entries.length) };
+    entries.forEach(([key, value], index) => { env[`GIT_CONFIG_KEY_${index}`] = key; env[`GIT_CONFIG_VALUE_${index}`] = value; });
+    return { env, deadline: Math.min(now + 90_000, access ? Date.parse(access.expiresAt) : Infinity) };
+}

package/dist/workspace-runtime/batch/source-candidate.js

@@ -2,6 +2,7 @@ import { randomUUID } from 'node:crypto';
 import { link, mkdir, open, readFile, unlink } from 'node:fs/promises';
 import { join } from 'node:path';
 import { batchSourceSnapshotRefSchema, } from '@playcraft/common/cloud-workspace/runtime';
+import { publicationBinding } from './publication.js';
 export function sourceCandidateFile(state, batchId) {
     return join(state.config.stateDir, 'batch-source-candidates', `${batchId}.json`);
 }
@@ -72,7 +73,7 @@ export async function writeSourceCandidate(state, candidate) {
     }
 }
 export function assertSourceIdentity(state, request, snapshot, candidate) {
-    const binding = state.journal.getWorkspace(request.workspaceId);
+    const binding = publicationBinding(state, request.workspaceId, request.sourceDirectoryName, request.publication);
     const branchName = request.sourceDirectoryName === 'basic' ? binding?.branchName
         : binding?.directories?.find(directory => directory.directoryName === request.sourceDirectoryName)?.branchName;
     if (snapshot.batchId !== request.batchId || snapshot.sourceWorkspaceId !== request.workspaceId

package/dist/workspace-runtime/batch/source-capture.js

@@ -4,15 +4,19 @@ import { lstat, mkdir, open, readFile, realpath, rename, rm, writeFile } from 'n
 import { dirname, isAbsolute, join, relative } from 'node:path';
 import { gzip, gunzip } from 'node:zlib';
 import { promisify } from 'node:util';
+import { WORKSPACE_REMIX_REFERENCES_MANIFEST } from '@playcraft/common/cloud-workspace/runtime';
 import { excludeFromGit } from '../workspaces/dependencies.js';
+import { batchReferenceEnvExamples, batchReferenceMetadata } from '../workspaces/remix-references.js';
 import { gitRead, gitWrite } from './git.js';
 const compress = promisify(gzip);
 const decompress = promisify(gunzip);
 const privateNames = new Set(['.git', 'node_modules', '.ssh', '.aws', '.azure', '.gnupg', '.codex', '.npm', '.pnpm-store',
     '.config', '.npmrc', '.yarnrc', '.yarnrc.yml', '.netrc', '.git-credentials', 'credentials.json', 'credentials', 'secrets',
     'id_rsa', 'id_ed25519', 'settings.local.json', '.playcraft.json', 'playcraft.config.json', '.playcraft-temp', '.playcraft-preview-out']);
-function included(path) {
-    return !path.split('/').some(name => privateNames.has(name) || /^\.env(?:$|\.)/.test(name) || /\.(?:pem|key|p12|pfx)$/.test(name))
+function included(path, referenceExamples) {
+    const parts = path.split('/');
+    return !parts.some((name, index) => privateNames.has(name) || (/^\.env(?:$|\.)/.test(name) &&
+        !(index === parts.length - 1 && referenceExamples.has(path))) || /\.(?:pem|key|p12|pfx)$/.test(name))
         && !path.startsWith('.playcraft/skills/');
 }
 /** Git keeps only the executable bit, so the digest must not depend on umask or group-write bits. */
@@ -32,10 +36,12 @@ export function digestFiles(files) {
 /** Files Git will accept. Credentials, caches and node_modules are left out. */
 export async function readSourceFiles(root) {
     const source = await realpath(root);
+    const referenceExamples = await batchReferenceEnvExamples(source);
+    const referenceRecords = await batchReferenceMetadata(source);
     const paths = new Set((await gitRead(source, ['ls-files', '--cached', '--others', '--exclude-standard', '-z'])).split('\0').filter(Boolean));
     const files = new Map();
     for (const path of [...paths].sort()) {
-        if (!included(path))
+        if (!included(path, referenceExamples))
             continue;
         const full = join(source, path);
         const stat = await lstat(full).catch(error => {
@@ -55,6 +61,33 @@ export async function readSourceFiles(root) {
             await handle.close();
         }
     }
+    const manifestFile = files.get(WORKSPACE_REMIX_REFERENCES_MANIFEST);
+    if (manifestFile) {
+        try {
+            const manifest = JSON.parse(manifestFile.body.toString('utf8'));
+            if (manifest?.version === 1 && Array.isArray(manifest.items)) {
+                const withheld = [];
+                for (const record of referenceRecords) {
+                    for (const file of record.files) {
+                        const path = `${record.path}/${file.path}`;
+                        // A damaged reference may make an otherwise allowed example fail verification. That
+                        // is a reference-integrity error, not evidence that a protected path was withheld.
+                        const isExample = /^\.env\.(?:example|sample|template)$/i.test(path.split('/').pop() ?? '');
+                        if (paths.has(path) && !included(path, referenceExamples) &&
+                            (!isExample || !included(path, new Set([path]))) && (await lstat(join(source, path)).catch(() => undefined))?.isFile()) {
+                            withheld.push(record.referenceId);
+                            break;
+                        }
+                    }
+                }
+                delete manifest.batchPolicyWithheldReferenceIds;
+                if (withheld.length)
+                    manifest.batchPolicyWithheldReferenceIds = withheld;
+                files.set(WORKSPACE_REMIX_REFERENCES_MANIFEST, { ...manifestFile, body: Buffer.from(JSON.stringify(manifest)) });
+            }
+        }
+        catch { /* Preserve malformed legacy metadata without letting it block an unrelated batch. */ }
+    }
     return files;
 }
 /** A changing source must not silently lose files from the captured input. */
@@ -99,6 +132,12 @@ export async function captureIndependentSource(source, destination) {
         for (const entry of ['/.playcraft.json', '/playcraft.config.json', '/.playcraft/skills/', '/.playcraft-temp/'])
             await excludeFromGit(staging, entry);
         await gitWrite(staging, ['add', '-A', '.']);
+        // Imported reference files can be tracked in the source despite .gitignore. Preserve only
+        // their filtered staging paths, without changing ignore handling for other source files.
+        for (const path of ['.playcraft/remix-references.json', 'references/remixes']) {
+            if (await lstat(join(staging, path)).catch(() => undefined))
+                await gitWrite(staging, ['add', '--force', '-A', '--', path]);
+        }
         await gitWrite(staging, ['commit', '--allow-empty', '-m', 'Freeze batch source']);
         const commitHash = (await gitWrite(staging, ['rev-parse', 'HEAD'])).trim();
         await rename(staging, destination);

package/dist/workspace-runtime/batch/source-publish.js

@@ -1,9 +1,10 @@
 import { lstat, mkdir, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
-import { copyCredentialHelpers, gitRead, gitWrite } from './git.js';
+import { clearCredentialHelpers, copyCredentialHelpers, gitRead, gitWrite } from './git.js';
 import { archiveSource, restoreArchive } from './source-capture.js';
 import { sourceCacheDir } from './records.js';
 import { BatchSourceFreezeError, sourceFreezeError } from './source-failure.js';
+import { publicationGitOptions } from './publication.js';
 async function reject(state, candidate, code, stage, retryable, outcome, cause) {
     throw await sourceFreezeError(state, candidate.snapshot.batchId, { code, stage, retryable, outcome }, cause);
 }
@@ -20,7 +21,7 @@ function definitelyRejected(error) {
     return /remote rejected|\[rejected\]|authentication failed|access denied|permission denied|not allowed|not support|hook declined|protected|returned error: (?:401|403)/i
         .test(`${detail?.stderr ?? ''}\n${detail?.stdout ?? ''}`);
 }
-async function publishRemote(state, candidate, source) {
+async function publishRemote(state, candidate, source, publication) {
     const { snapshot, repositoryUrl: remote } = candidate;
     const cache = sourceCacheDir(state, snapshot.batchId);
     if (!remote || !snapshot.remoteRef)
@@ -29,10 +30,20 @@ async function publishRemote(state, candidate, source) {
     await mkdir(cache, { recursive: true, mode: 0o700 });
     if (!await lstat(join(cache, '.git')).catch(() => undefined))
         await gitWrite(cache, ['init', '--initial-branch', 'source']);
-    await copyCredentialHelpers(source, cache);
-    // All remote operations share the copied authentication, including read-only verification.
+    if (publication)
+        await clearCredentialHelpers(cache);
+    else
+        await copyCredentialHelpers(source, cache);
+    const options = publication ? publicationGitOptions(state, publication) : undefined;
+    const remoteGit = (args) => {
+        const timeout = options ? Math.min(90_000, options.deadline - Date.now()) : 90_000;
+        if (timeout <= 0)
+            throw new Error('workspace_git_access_expired');
+        return gitWrite(cache, args, options ? { env: options.env, timeout } : undefined);
+    };
+    // For trusted publication, all remote commands use only ephemeral, scoped credentials.
     const remoteHash = async () => {
-        const output = await gitWrite(cache, ['ls-remote', '--refs', remote, snapshot.remoteRef]);
+        const output = await remoteGit(['ls-remote', '--refs', remote, snapshot.remoteRef]);
         const rows = output.trim().split('\n').filter(Boolean).map(line => line.split(/\s+/));
         if (rows.some(([hash, ref]) => !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(hash) || ref !== snapshot.remoteRef) || rows.length > 1) {
             throw new Error('batch_source_remote_response_invalid');
@@ -44,7 +55,7 @@ async function publishRemote(state, candidate, source) {
         found = await remoteHash();
     }
     catch (error) {
-        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+        return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', publication ? undefined : error);
     }
     if (found && found !== snapshot.commitHash)
         return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown');
@@ -53,7 +64,7 @@ async function publishRemote(state, candidate, source) {
             return reject(state, candidate, 'batch_source_candidate_lost', 'capture', false, 'not_published');
         let pushError;
         try {
-            await gitWrite(cache, ['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
+            await remoteGit(['push', '--porcelain', remote, `${snapshot.commitHash}:${snapshot.remoteRef}`]);
         }
         catch (error) {
             pushError = error;
@@ -63,25 +74,25 @@ async function publishRemote(state, candidate, source) {
         }
         catch (error) {
             const unsupported = pushError !== undefined && pushFailureCode(pushError) === 'batch_source_ref_unsupported';
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', pushError ?? error);
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !unsupported, unsupported ? 'not_published' : 'unknown', publication ? undefined : pushError ?? error);
         }
         if (found && found !== snapshot.commitHash)
-            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', pushError);
+            return reject(state, candidate, 'batch_source_ref_conflict', 'verify', false, 'unknown', publication ? undefined : pushError);
         if (!found) {
             const rejected = pushError !== undefined && definitelyRejected(pushError);
-            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', pushError);
+            return reject(state, candidate, pushError ? pushFailureCode(pushError) : 'batch_source_verification_failed', pushError ? 'publish' : 'verify', !rejected, rejected ? 'not_published' : 'unknown', publication ? undefined : pushError);
         }
     }
     if (!await verifyCache(cache, candidate)) {
         try {
-            await gitWrite(cache, ['fetch', '--no-tags', remote, snapshot.remoteRef]);
+            await remoteGit(['fetch', '--no-tags', remote, snapshot.remoteRef]);
             if ((await gitRead(cache, ['rev-parse', 'FETCH_HEAD^{commit}'])).trim() !== snapshot.commitHash) {
                 return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
             }
             await gitWrite(cache, ['checkout', '--detach', snapshot.commitHash]);
         }
         catch (error) {
-            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', error);
+            return reject(state, candidate, 'batch_source_verification_failed', 'verify', true, 'unknown', publication ? undefined : error);
         }
         if (!await verifyCache(cache, candidate))
             return reject(state, candidate, 'batch_source_snapshot_mismatch', 'verify', false, 'unknown');
@@ -118,16 +129,16 @@ async function publishArtifact(state, candidate, store) {
     // private
     await writeFile(`${cache}.digest`, snapshot.digest, { mode: 0o600 });
 }
-export async function publishSourceCandidate(state, candidate, source, store) {
+export async function publishSourceCandidate(state, candidate, source, store, publication) {
     try {
         if (candidate.persist === 'remote_ref')
-            await publishRemote(state, candidate, source);
+            await publishRemote(state, candidate, source, publication);
         else
             await publishArtifact(state, candidate, store);
     }
     catch (error) {
         if (error instanceof BatchSourceFreezeError)
             throw error;
-        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, error);
+        throw await sourceFreezeError(state, candidate.snapshot.batchId, { code: 'batch_source_verification_failed', stage: 'verify', retryable: true, outcome: 'unknown' }, publication ? undefined : error);
     }
 }

package/dist/workspace-runtime/persistence/sqlite-worker.js

@@ -14,7 +14,7 @@ import { parentPort } from 'node:worker_threads';
 import Database from 'better-sqlite3-pinned';
 import { clearPendingNativeFollowups, learnNativeSubagents, nativeEventOwner, nativeSubagentThreads } from './native-subagents.js';
 import { settleStoppedExecution, stoppedExecutionEpochs } from './stopped-execution.js';
-import { hashOperationPayload, operationRecordSchema, pendingSourceEventSchema, terminalRecordSchema, workspaceRegistrationSchema, transitionOperation, canTransitionTurn, } from '@playcraft/common/cloud-workspace/runtime';
+import { hashOperationPayload, nativeTurnFailureMessage, operationRecordSchema, pendingSourceEventSchema, terminalRecordSchema, workspaceRegistrationSchema, transitionOperation, canTransitionTurn, } from '@playcraft/common/cloud-workspace/runtime';
 const SCHEMA_VERSION = 1;
 const MIN_SQLITE = [3, 51, 3];
 const BINDING = 'better-sqlite3@13.0.3';
@@ -726,6 +726,7 @@ function applyNativeToState(database, input, payload) {
         putOperation(database, input.operation.scopeKey, transitionOperation(ownedOperation, terminal, {
             nativeTurnId: input.turnId ?? ownedOperation.nativeTurnId,
             nativeThreadId: input.threadId ?? ownedOperation.nativeThreadId,
+            error: terminal === 'failed' ? nativeTurnFailureMessage(payload) : undefined,
         }));
     }
 }

package/dist/workspace-runtime/serve.js

@@ -25,6 +25,7 @@ import { loadWorkspaceSkillArtifact } from './workspaces/skill-artifact-loader.j
 import { workspaceContextFromRoot, workspaceRoot } from './workspaces/registry.js';
 import { recoverInterruptedLibraryImports } from './workspaces/asset-library-import.js';
 import { recoverAssetTransfers } from './workspaces/asset-transfer-publish.js';
+import { readWorkspaceAssetProvenance, WORKSPACE_ASSET_PROVENANCE_PATH } from '../asset-library/provenance.js';
 import { recoverWorkspaceDirectoryMutation } from './workspaces/directory-mutations.js';
 import { observeWorkspaceDirectories } from './workspaces/directory-revisions.js';
 import { observeWorkspaceBinaryFile } from './workspaces/binary-write.js';
@@ -116,6 +117,54 @@ export async function startWorkspaceRuntime(config, options = {}) {
         }
         else
             await recoverLibraryImports(config.workspaceRoot);
+        // Model-library imports share the existing multi-file transfer journal. Recover it before settling either operation kind.
+        const recoveredBundles = new Map();
+        const transferScopes = new Set();
+        for (const { operation } of journal.listOperations()) {
+            if (!['asset.bundle.save', 'asset.library.import'].includes(operation.kind))
+                continue;
+            const directoryName = operation.directoryName ?? 'basic';
+            const key = `${operation.workspaceId ?? ''}:${directoryName}`;
+            if (transferScopes.has(key))
+                continue;
+            transferScopes.add(key);
+            const root = await workspaceRoot(state, operation.workspaceId, directoryName).catch(() => undefined);
+            if (!root)
+                continue;
+            const recovered = await recoverAssetTransfers(root, { environment: config.environment, userId: config.userId,
+                workspaceId: operation.workspaceId ?? '', directoryName }).catch(() => []);
+            for (const item of recovered)
+                recoveredBundles.set(item.operationId, item);
+        }
+        for (const { operation } of journal.listOperations()) {
+            if (operation.kind !== 'asset.library.import' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
+                continue;
+            const recovered = recoveredBundles.get(operation.operationId);
+            if (!recovered?.receipt.files.some(file => file.path === WORKSPACE_ASSET_PROVENANCE_PATH))
+                continue;
+            const root = await workspaceRoot(state, operation.workspaceId, operation.directoryName).catch(() => undefined);
+            if (!root)
+                continue;
+            const sources = await readWorkspaceAssetProvenance(root).catch(() => undefined);
+            if (!sources)
+                continue;
+            const files = new Map(recovered.receipt.files.map(file => [file.path, file.contentHash]));
+            const models = sources.assets.filter(asset => files.get(asset.path) === asset.provenance.modelSha256);
+            if (!models.length || models.length !== recovered.receipt.files.filter(file => file.path.toLowerCase().endsWith('.glb')).length)
+                continue;
+            let unchanged = true;
+            for (const file of recovered.receipt.files) {
+                if ((await observeWorkspaceBinaryFile(root, file.path).catch(() => undefined))?.contentHash !== file.contentHash) {
+                    unchanged = false;
+                    break;
+                }
+            }
+            if (!unchanged)
+                continue;
+            const previous = recoveredImports.get(operation.operationId) ?? { paths: [], assetIds: [] };
+            recoveredImports.set(operation.operationId, { paths: [...new Set([...previous.paths, ...files.keys()])],
+                assetIds: [...new Set([...previous.assetIds, ...models.map(model => model.provenance.assetId)])], receipt: recovered.receipt });
+        }
         for (const { scopeKey, operation } of journal.listOperations()) {
             if (operation.kind !== 'asset.library.import' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
                 continue;
@@ -125,6 +174,7 @@ export async function startWorkspaceRuntime(config, options = {}) {
             const result = operation.result && 'paths' in operation.result ? { ...operation.result,
                 paths: [...new Set([...operation.result.paths, ...(published?.paths ?? [])])],
                 failures: operation.result.failures.filter(failure => !published?.assetIds.includes(failure.assetId)),
+                ...(published?.receipt ? { bundleReceipt: published.receipt } : {}),
             } : undefined;
             const root = await workspaceRoot(state, operation.workspaceId, operation.directoryName).catch(() => undefined);
             if (root && result)
@@ -151,24 +201,6 @@ export async function startWorkspaceRuntime(config, options = {}) {
                 recoveredChanges.push({ workspaceId: operation.workspaceId,
                     directoryName: operation.directoryName ?? 'basic', paths: result.paths });
         }
-        const recoveredBundles = new Map();
-        const transferScopes = new Set();
-        for (const { operation } of journal.listOperations()) {
-            if (operation.kind !== 'asset.bundle.save')
-                continue;
-            const directoryName = operation.directoryName ?? 'basic';
-            const key = `${operation.workspaceId ?? ''}:${directoryName}`;
-            if (transferScopes.has(key))
-                continue;
-            transferScopes.add(key);
-            const root = await workspaceRoot(state, operation.workspaceId, directoryName).catch(() => undefined);
-            if (!root)
-                continue;
-            const recovered = await recoverAssetTransfers(root, { environment: config.environment, userId: config.userId,
-                workspaceId: operation.workspaceId ?? '', directoryName }).catch(() => []);
-            for (const item of recovered)
-                recoveredBundles.set(item.operationId, item);
-        }
         for (const { scopeKey, operation } of journal.listOperations()) {
             if (operation.kind !== 'asset.bundle.save' || !['queued', 'dispatched', 'accepted', 'uncertain'].includes(operation.status))
                 continue;

package/dist/workspace-runtime/server/dispatch.js

@@ -5,6 +5,7 @@ import { revisionScope, sessionWorkspaceRoot, workspaceRoot, workspaceSessions,
 import { preflightSkillExecution } from '../workspaces/skill-execution-context.js';
 import { abandonTurnChanges, beginTurnChanges, finishTurnChanges, } from '../workspaces/turn-changes.js';
 import { shareWorkspaceGit } from '../workspaces/shared-git.js';
+import { remoteAttachPending } from '../workspaces/remote-attach-marker.js';
 import { cancelPendingDirectoryAccess, holdDirectoryAccess, withOperationDirectoryAccess, } from './directory-access.js';
 import { join } from 'node:path';
 import { z } from 'zod';
@@ -1127,8 +1128,11 @@ async function executeAssetLibraryImport(state, scopeKey, operation, payload) {
         await assertCurrent();
         const result = await importWorkspaceLibraryAssets(root, input?.selection, input?.snapshot, assertCurrent, {
             operationId: operation.operationId,
+            scope: { environment: state.config.environment, userId: state.config.userId,
+                workspaceId: operation.workspaceId ?? '', directoryName: operation.directoryName ?? 'basic' },
             onProgress: async (result) => { await state.journal.putOperation(scopeKey, { ...operation, result }); },
         });
+        await assertCurrent();
         const scope = revisionScope(state, operation.workspaceId, operation.directoryName);
         for (const path of result.paths) {
             const file = await observeWorkspaceBinaryFile(root, path);
@@ -1146,10 +1150,14 @@ async function executeAssetLibraryImport(state, scopeKey, operation, payload) {
                         kind: 'discovered', tool: 'asset.library.import', operationId: operation.operationId,
                     } }).catch(() => undefined);
         }
-        return persist(state, scopeKey, transitionOperation(accepted, 'completed', { result }));
+        await assertCurrent();
+        return persist(state, scopeKey, transitionOperation(accepted, result.failures.length ? 'failed' : 'completed', {
+            result, ...(result.failures.length ? { error: 'asset_library_import_failed' } : {}),
+        }));
     }
     catch (error) {
-        return persist(state, scopeKey, transitionOperation(operation, 'failed', {
+        const current = state.journal.getOperation(scopeKey) ?? operation;
+        return persist(state, scopeKey, transitionOperation(current, 'failed', {
             error: error instanceof Error && ['stale_lease', 'batch_workspace_readonly'].includes(error.message)
                 ? error.message : 'invalid_library_import',
         }));
@@ -1383,6 +1391,17 @@ async function executeGitCommit(state, scopeKey, operation, payload) {
  * accepts it. A standalone workspace has no remote, so its saves stay local; its project
  * directories have their own branch.
  */
+async function withBasicBindingLock(state, operation, action) {
+    if (state.config.workspaceMode !== 'multi' || !operation.workspaceId || (operation.directoryName ?? 'basic') !== 'basic')
+        return action();
+    return state.journal.exclusive(`workspace:${operation.workspaceId}`, action);
+}
+/** A published batch may have adopted project metadata while basic still has a local checkout. */
+async function basicRemotePending(state, operation) {
+    if (state.config.workspaceMode !== 'multi' || !operation.workspaceId || (operation.directoryName ?? 'basic') !== 'basic')
+        return false;
+    return remoteAttachPending(state, operation.workspaceId);
+}
 export function savePushesBranch(targetKind, directoryName) {
     return targetKind === 'main' || targetKind === 'remix' || Boolean(directoryName && directoryName !== 'basic');
 }
@@ -1391,13 +1410,19 @@ async function executeWorkspaceSave(state, scopeKey, operation, payload) {
     if (!parsed.success) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'invalid_workspace_save' }));
     }
-    const binding = operation.workspaceId ? state.journal.getWorkspace(operation.workspaceId) : undefined;
     try {
         // Saves share the directory, and a deferred one runs outside the workspace queue; commit one at a time.
-        const saved = await state.journal.exclusive(`workspace-save:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, async () => saveWorkspaceGit(await gitWorkspaceRoot(state, operation), {
-            message: parsed.data.trigger === 'auto' ? 'Autosave workspace' : 'Save workspace',
-            push: savePushesBranch(binding?.targetKind, operation.directoryName),
-            boundBranch: boundBranch(state, operation),
+        const saved = await state.journal.exclusive(`workspace-save:${revisionScope(state, operation.workspaceId, operation.directoryName) ?? 'single'}`, () => withBasicBindingLock(state, operation, async () => {
+            const binding = operation.workspaceId ? state.journal.getWorkspace(operation.workspaceId) : undefined;
+            const localOnly = await basicRemotePending(state, operation);
+            const saved = await saveWorkspaceGit(await gitWorkspaceRoot(state, operation), {
+                message: parsed.data.trigger === 'auto' ? 'Autosave workspace' : 'Save workspace',
+                push: !localOnly && savePushesBranch(binding?.targetKind, operation.directoryName),
+                boundBranch: localOnly ? undefined : boundBranch(state, operation),
+            });
+            if (localOnly)
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            return saved;
         }));
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [
@@ -1419,7 +1444,11 @@ async function executeGitPush(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'remote_not_configurable' }));
     }
     try {
-        await pushWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        await withBasicBindingLock(state, operation, async () => {
+            if (await basicRemotePending(state, operation))
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            await pushWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        });
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [
             {
@@ -1440,7 +1469,11 @@ async function executeGitPull(state, scopeKey, operation, payload) {
         return persist(state, scopeKey, transitionOperation(operation, 'failed', { error: 'remote_not_configurable' }));
     }
     try {
-        const pulled = await pullWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        const pulled = await withBasicBindingLock(state, operation, async () => {
+            if (await basicRemotePending(state, operation))
+                throw new GitWorkspaceError('remote_not_configured', 'origin');
+            return pullWorkspaceGit(await gitWorkspaceRoot(state, operation), boundBranch(state, operation));
+        });
         const accepted = await persist(state, scopeKey, transitionOperation(operation, 'accepted'));
         await recordNativeEvents(state, accepted, [{
                 type: 'git.pulled',

package/dist/workspace-runtime/server/http.js

@@ -44,6 +44,7 @@ import { acceptOperationCore, observeLevelEditorTransaction } from './accept-ope
 import { workspaceArtifactContentQuerySchema } from '@playcraft/common/cloud-workspace/runtime';
 import { searchWorkspaceFiles } from '../workspaces/files-search.js';
 import { serveWorkspaceArchive } from '../workspaces/archive.js';
+import { verifyRuntimeAssetProvenance } from '../workspaces/asset-provenance-verifier.js';
 import { handleWorkspaceTransfer } from './workspace-transfer.js';
 import { handleWorkspaceStorage } from './workspace-storage.js';
 import { serveSessionImage } from '../workspaces/session-image.js';
@@ -199,6 +200,8 @@ async function dispatchRuntimeRequest(state, request, response) {
                 levelEditorRetryVersion: 1,
                 remixReferencesVersion: 1,
                 batchSourceFreezeRevision: 2,
+                batchSourcePublicationVersion: 1,
+                batchReferenceContextVersion: 1,
                 ...(state.native?.workspaceUi ? { workspaceUiVersion: 1 } : {}),
                 ...(state.native?.startReview && state.native?.steer ? { turnControlVersion: 1 } : {}),
                 ...(state.native?.startCompact ? { compactionVersion: 1 } : {}),
@@ -685,8 +688,16 @@ async function dispatchRuntimeRequest(state, request, response) {
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/archive') {
             if (writeDestroyed(state, response))
                 return;
-            const root = await sessionWorkspaceRoot(state, url.searchParams.get('workspaceId') ?? undefined, directoryName);
-            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir] });
+            const archiveWorkspaceId = url.searchParams.get('workspaceId') ?? undefined;
+            const root = await sessionWorkspaceRoot(state, archiveWorkspaceId, directoryName);
+            const expectedModelPaths = state.journal.listOperations().map(({ operation }) => operation).filter(operation => operation.kind === 'asset.library.import'
+                && (state.config.workspaceMode !== 'multi' || operation.workspaceId === archiveWorkspaceId)
+                && (operation.directoryName ?? 'basic') === directoryName)
+                .flatMap(operation => operation.result && 'bundleReceipt' in operation.result ? operation.result.bundleReceipt?.files ?? [] : [])
+                .map(file => file.path).filter(path => path.toLowerCase().endsWith('.glb'));
+            await serveWorkspaceArchive(root, request, response, { excludedRoots: [state.config.stateDir],
+                expectedModelPaths: [...new Set(expectedModelPaths)],
+                verifyProvenance: provenance => verifyRuntimeAssetProvenance(state, provenance) });
             return;
         }
         if (['GET', 'HEAD'].includes(request.method ?? '') && url.pathname === '/runtime/file-content') {

package/dist/workspace-runtime/verify-artifact.js

@@ -47,6 +47,8 @@ export async function verifyRuntimeArtifact(expectedVersion) {
         const identity = await response.json();
         assert.equal(identity.runtimeId, config.runtimeId);
         assert.equal(identity.batchSourceFreezeRevision, 2, 'built runtime lacks the required batch source freeze implementation');
+        assert.equal(identity.batchSourcePublicationVersion, 1, 'built runtime lacks trusted batch source publication');
+        assert.equal(identity.batchReferenceContextVersion, 1, 'built runtime lacks batch reference context support');
     }
     finally {
         await runtime?.close();
@@ -55,5 +57,5 @@ export async function verifyRuntimeArtifact(expectedVersion) {
 }
 if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
     await verifyRuntimeArtifact(process.argv[2] ?? '');
-    console.log('Runtime artifact verified: batchSourceFreezeRevision=2');
+    console.log('Runtime artifact verified: batchSourceFreezeRevision=2, batchSourcePublicationVersion=1, batchReferenceContextVersion=1');
 }