@playcraft/cli 0.1.71 → 0.1.73

package/dist/workspace-runtime/workspaces/remix-references.js

@@ -1,7 +1,7 @@
 import { execFile } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm, writeFile } from 'node:fs/promises';
+import { chmod, lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm, writeFile, } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { promisify } from 'node:util';
 import { WORKSPACE_REMIX_REFERENCE_MAX_BYTES, WORKSPACE_REMIX_REFERENCE_MAX_FILES, WORKSPACE_REMIX_REFERENCES_DIRECTORY, WORKSPACE_REMIX_REFERENCES_MANIFEST, remixReferenceContentHashInput, workspaceDirectoryNameSchema, workspaceRemixReferenceExportSchema, workspaceRemixReferenceSchema, } from '@playcraft/common/cloud-workspace/runtime';
@@ -12,24 +12,51 @@ const ATTRIBUTES = '.gitattributes';
 const SNAPSHOT_ATTRIBUTES = '* -filter -text -ident -working-tree-encoding -eol\n';
 const INERT_DIRECTORY = '_source_metadata';
 const MANIFEST_MAX_BYTES = 16 * 1024 * 1024;
-const EXCLUDED = new Set(['.git', 'node_modules', '.next', '.cache', '.tmp', '.turbo', '.pnpm-store', '.ssh', '.aws']);
-const INERT = new Set(['.agents', '.claude', '.codex', '.cursor', '.playcraft', '.gitignore', '.gitattributes',
-    '.gitmodules', 'agents.md', 'claude.md', 'gemini.md', '.cursorrules', '.mcp.json']);
+const EXCLUDED = new Set([
+    '.git',
+    'node_modules',
+    '.next',
+    '.cache',
+    '.tmp',
+    '.turbo',
+    '.pnpm-store',
+    '.ssh',
+    '.aws',
+]);
+const INERT = new Set([
+    '.agents',
+    '.claude',
+    '.codex',
+    '.cursor',
+    '.playcraft',
+    '.gitignore',
+    '.gitattributes',
+    '.gitmodules',
+    'agents.md',
+    'claude.md',
+    'gemini.md',
+    '.cursorrules',
+    '.mcp.json',
+]);
 const locks = new Map();
 const hash = (value) => createHash('sha256').update(value).digest('hex');
 export class RemixReferenceError extends Error {
-    constructor(code) { super(code); this.name = 'RemixReferenceError'; }
+    constructor(code) {
+        super(code);
+        this.name = 'RemixReferenceError';
+    }
 }
 async function safeDirectory(root, relative = '', create = false) {
     let current = root;
     for (const segment of relative.split('/').filter(Boolean)) {
         current = join(current, segment);
-        // shared
-        if (create)
+        if (create) {
+            // shared
             await mkdir(current, { mode: 0o755 }).catch((error) => {
                 if (error.code !== 'EEXIST')
                     throw error;
             });
+        }
         const info = await lstat(current);
         if (!info.isDirectory() || info.isSymbolicLink())
             throw new RemixReferenceError('remix_reference_path_conflict');
@@ -52,7 +79,10 @@ async function readFileSafely(root, path, limit) {
             length += bytesRead;
         }
         const after = await handle.stat();
-        if (length !== before.size || after.size !== before.size || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs)
+        if (length !== before.size ||
+            after.size !== before.size ||
+            after.mtimeMs !== before.mtimeMs ||
+            after.ctimeMs !== before.ctimeMs)
             throw new RemixReferenceError('remix_reference_changed');
         return data.subarray(0, length);
     }
@@ -62,20 +92,28 @@ async function readFileSafely(root, path, limit) {
 }
 function identity(snapshot) {
     const { source, contentHash } = snapshot;
-    return hash(JSON.stringify([source.environment, source.projectUuid, source.branchName, source.commit, contentHash]));
+    const sourceIdentity = 'builtinTemplate' in source ? ['builtinTemplate', source.builtinTemplate] : source.projectUuid;
+    return hash(JSON.stringify([
+        source.environment,
+        sourceIdentity,
+        source.branchName,
+        source.commit,
+        contentHash,
+    ]));
 }
 function referencePath(referenceId, commit) {
     return `${WORKSPACE_REMIX_REFERENCES_DIRECTORY}/${referenceId.slice(0, 20)}-${commit.slice(0, 12)}`;
 }
 /** Project instructions and Git filters remain readable source material without becoming active configuration. */
 function materializedPath(sourcePath) {
-    const parts = sourcePath.split('/').map(part => part.toLowerCase());
-    if (parts.some(part => EXCLUDED.has(part)) || isCredentialFile(sourcePath) ||
-        parts.some(part => ['.npmrc', '.yarnrc', '.netrc', '.git-credentials'].includes(part)))
+    const parts = sourcePath.split('/').map((part) => part.toLowerCase());
+    if (parts.some((part) => EXCLUDED.has(part)) ||
+        isCredentialFile(sourcePath) ||
+        parts.some((part) => ['.npmrc', '.yarnrc', '.netrc', '.git-credentials'].includes(part)))
         return undefined;
     if (parts[0] === INERT_DIRECTORY || parts[0] === RECEIPT)
         throw new RemixReferenceError('remix_reference_path_conflict');
-    if (parts.some(part => INERT.has(part)))
+    if (parts.some((part) => INERT.has(part)))
         return `${INERT_DIRECTORY}/${hash(sourcePath)}.txt`;
     return sourcePath;
 }
@@ -85,7 +123,7 @@ async function readManifest(root) {
         if (value?.version !== 1 || !Array.isArray(value.items) || value.items.length > 100)
             throw new RemixReferenceError('remix_reference_manifest_invalid');
         const items = value.items.map((item) => workspaceRemixReferenceSchema.parse(item));
-        if (new Set(items.map(item => item.referenceId)).size !== items.length)
+        if (new Set(items.map((item) => item.referenceId)).size !== items.length)
             throw new RemixReferenceError('remix_reference_manifest_invalid');
         return items;
     }
@@ -98,8 +136,10 @@ async function readManifest(root) {
     }
 }
 function validateRecord(record, directoryName) {
-    if (record.directoryName !== directoryName || record.referenceId !== identity(record) ||
-        record.path !== referencePath(record.referenceId, record.source.commit) || record.name !== record.source.name)
+    if (record.directoryName !== directoryName ||
+        record.referenceId !== identity(record) ||
+        record.path !== referencePath(record.referenceId, record.source.commit) ||
+        record.name !== record.source.name)
         throw new RemixReferenceError('remix_reference_manifest_invalid');
     const paths = new Set();
     for (const file of record.files) {
@@ -107,10 +147,14 @@ function validateRecord(record, directoryName) {
             throw new RemixReferenceError('remix_reference_manifest_invalid');
         paths.add(file.path.toLowerCase());
     }
-    if ((record.omittedFiles ?? []).some(file => materializedPath(file.path) !== undefined))
+    if ((record.omittedFiles ?? []).some((file) => materializedPath(file.path) !== undefined))
         throw new RemixReferenceError('remix_reference_manifest_invalid');
-    const originalFiles = [...record.files.map(file => ({ ...file, path: file.sourcePath })), ...(record.omittedFiles ?? [])];
-    if (originalFiles.length > WORKSPACE_REMIX_REFERENCE_MAX_FILES || new Set(originalFiles.map(file => file.path.toLowerCase())).size !== originalFiles.length ||
+    const originalFiles = [
+        ...record.files.map((file) => ({ ...file, path: file.sourcePath })),
+        ...(record.omittedFiles ?? []),
+    ];
+    if (originalFiles.length > WORKSPACE_REMIX_REFERENCE_MAX_FILES ||
+        new Set(originalFiles.map((file) => file.path.toLowerCase())).size !== originalFiles.length ||
         hash(remixReferenceContentHashInput(originalFiles)) !== record.contentHash ||
         originalFiles.reduce((sum, file) => sum + file.size, 0) > WORKSPACE_REMIX_REFERENCE_MAX_BYTES)
         throw new RemixReferenceError('remix_reference_manifest_invalid');
@@ -120,8 +164,10 @@ async function verifyReferenceMetadata(root, record, directoryName, alternateDir
     const target = await safeDirectory(root, record.path);
     const receipt = JSON.parse((await readFileSafely(target, RECEIPT, MANIFEST_MAX_BYTES)).toString('utf8'));
     const parsedReceipt = workspaceRemixReferenceSchema.parse(receipt);
-    if (JSON.stringify(parsedReceipt) !== JSON.stringify(record)
-        && (!alternateDirectory || JSON.stringify(parsedReceipt) !== JSON.stringify({ ...record, directoryName: alternateDirectory })))
+    if (JSON.stringify(parsedReceipt) !== JSON.stringify(record) &&
+        (!alternateDirectory ||
+            JSON.stringify(parsedReceipt) !==
+                JSON.stringify({ ...record, directoryName: alternateDirectory })))
         throw new RemixReferenceError('remix_reference_changed');
     return target;
 }
@@ -129,7 +175,7 @@ async function verifyReference(root, record, directoryName, alternateDirectory)
     const target = await verifyReferenceMetadata(root, record, directoryName, alternateDirectory);
     if ((await readFileSafely(target, ATTRIBUTES, 256)).toString('utf8') !== SNAPSHOT_ATTRIBUTES)
         throw new RemixReferenceError('remix_reference_changed');
-    const expected = new Set([RECEIPT, ATTRIBUTES, ...record.files.map(file => file.path)]);
+    const expected = new Set([RECEIPT, ATTRIBUTES, ...record.files.map((file) => file.path)]);
     const walk = async (directory, prefix = '') => {
         for (const entry of await readdir(directory, { withFileTypes: true })) {
             const path = prefix ? `${prefix}/${entry.name}` : entry.name;
@@ -165,7 +211,9 @@ export async function batchReferenceMetadata(root) {
             await verifyReferenceMetadata(root, record, record.directoryName);
             verified.push(record);
         }
-        catch { /* An unrelated invalid reference cannot block source capture. */ }
+        catch {
+            /* An unrelated invalid reference cannot block source capture. */
+        }
     }
     return verified;
 }
@@ -180,8 +228,8 @@ export async function batchReferenceEnvExamples(root) {
         return examples;
     }
     for (const record of items) {
-        const files = record.files.filter(file => /^\.env\.(?:example|sample|template)$/i.test(file.path.split('/').pop() ?? '')
-            && !isCredentialFile(file.sourcePath));
+        const files = record.files.filter((file) => /^\.env\.(?:example|sample|template)$/i.test(file.path.split('/').pop() ?? '') &&
+            !isCredentialFile(file.sourcePath));
         if (!files.length)
             continue;
         try {
@@ -189,7 +237,9 @@ export async function batchReferenceEnvExamples(root) {
             for (const file of files)
                 examples.add(`${record.path}/${file.path}`);
         }
-        catch { /* An unselected damaged reference must not stop freezing the project. */ }
+        catch {
+            /* An unselected damaged reference must not stop freezing the project. */
+        }
     }
     return examples;
 }
@@ -208,13 +258,16 @@ export async function rebindBatchRemixReferences(root, sourceDirectory, memberDi
         throw error;
     }
     for (const reference of selected) {
-        const record = items.find(item => item.referenceId === reference.referenceId);
-        if (reference.directoryName !== sourceDirectory || !record || record.contentHash !== reference.snapshotHash)
+        const record = items.find((item) => item.referenceId === reference.referenceId);
+        if (reference.directoryName !== sourceDirectory ||
+            !record ||
+            record.contentHash !== reference.snapshotHash)
             throw new RemixReferenceError('context_remix_reference_changed');
     }
     if (selected.length) {
         const manifest = JSON.parse((await readFileSafely(rootReal, WORKSPACE_REMIX_REFERENCES_MANIFEST, MANIFEST_MAX_BYTES)).toString('utf8'));
-        if (Array.isArray(manifest.batchPolicyWithheldReferenceIds) && selected.some(reference => manifest.batchPolicyWithheldReferenceIds.includes(reference.referenceId)))
+        if (Array.isArray(manifest.batchPolicyWithheldReferenceIds) &&
+            selected.some((reference) => manifest.batchPolicyWithheldReferenceIds.includes(reference.referenceId)))
             throw new RemixReferenceError('batch_reference_files_withheld');
     }
     // Selected references must be complete. Other records need only valid metadata to be rebound;
@@ -222,7 +275,7 @@ export async function rebindBatchRemixReferences(root, sourceDirectory, memberDi
     const rebound = [];
     const writable = [];
     for (const record of items) {
-        const isSelected = selected.some(reference => reference.referenceId === record.referenceId);
+        const isSelected = selected.some((reference) => reference.referenceId === record.referenceId);
         try {
             if (record.directoryName !== sourceDirectory && record.directoryName !== memberDirectory)
                 throw new RemixReferenceError('remix_reference_manifest_invalid');
@@ -274,7 +327,7 @@ export async function resolveWorkspaceRemixReference(root, directoryName, refere
     workspaceDirectoryNameSchema.parse(directoryName);
     try {
         const rootReal = await realpath(root);
-        const item = (await readManifest(rootReal)).find(item => item.referenceId === referenceId);
+        const item = (await readManifest(rootReal)).find((item) => item.referenceId === referenceId);
         if (!item)
             throw new RemixReferenceError('context_remix_reference_unavailable');
         if (item.contentHash !== snapshotHash)
@@ -289,15 +342,38 @@ export async function resolveWorkspaceRemixReference(root, directoryName, refere
     }
 }
 async function trackReference(root, record) {
-    const environment = { PATH: process.env.PATH, HOME: root, GIT_CONFIG_NOSYSTEM: '1', GIT_CONFIG_GLOBAL: '/dev/null', GIT_TERMINAL_PROMPT: '0' };
+    const environment = {
+        PATH: process.env.PATH,
+        HOME: root,
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        GIT_TERMINAL_PROMPT: '0',
+    };
     const gitOptions = ['-c', 'core.hooksPath=/dev/null', '-c', 'core.fsmonitor=false', '-C', root];
-    const paths = [WORKSPACE_REMIX_REFERENCES_MANIFEST, `${record.path}/${RECEIPT}`, `${record.path}/${ATTRIBUTES}`,
-        ...record.files.map(file => `${record.path}/${file.path}`)];
+    const paths = [
+        WORKSPACE_REMIX_REFERENCES_MANIFEST,
+        `${record.path}/${RECEIPT}`,
+        `${record.path}/${ATTRIBUTES}`,
+        ...record.files.map((file) => `${record.path}/${file.path}`),
+    ];
     // Reject higher-priority repository attributes before Git can execute a conversion filter.
     const attributes = await new Promise((resolve, reject) => {
-        const child = execFile('git', [...gitOptions, 'check-attr', '-z', '--stdin', 'filter', 'text', 'ident', 'working-tree-encoding', 'eol'], {
-            timeout: 60_000, maxBuffer: 40 * 1024 * 1024, env: environment, encoding: 'utf8',
-        }, (error, stdout) => error ? reject(error) : resolve(stdout));
+        const child = execFile('git', [
+            ...gitOptions,
+            'check-attr',
+            '-z',
+            '--stdin',
+            'filter',
+            'text',
+            'ident',
+            'working-tree-encoding',
+            'eol',
+        ], {
+            timeout: 60_000,
+            maxBuffer: 40 * 1024 * 1024,
+            env: environment,
+            encoding: 'utf8',
+        }, (error, stdout) => (error ? reject(error) : resolve(stdout)));
         child.stdin?.end(`${paths.join('\0')}\0`);
     });
     const fields = attributes.split('\0');
@@ -305,15 +381,24 @@ async function trackReference(root, record) {
         throw new RemixReferenceError('remix_reference_git_attributes');
     for (let index = 0; index < fields.length - 1; index += 3) {
         const [path, attribute, value] = fields.slice(index, index + 3);
-        if (path === WORKSPACE_REMIX_REFERENCES_MANIFEST && (attribute === 'text' || attribute === 'eol'))
+        if (path === WORKSPACE_REMIX_REFERENCES_MANIFEST &&
+            (attribute === 'text' || attribute === 'eol'))
             continue;
         if (value !== 'unset' && value !== 'unspecified')
             throw new RemixReferenceError('remix_reference_git_attributes');
     }
     // A source file may have been tracked despite its old ignore rules. Track this approved snapshot explicitly.
-    await exec('git', [...gitOptions,
-        '--literal-pathspecs', 'add', '--force', '--', record.path, WORKSPACE_REMIX_REFERENCES_MANIFEST], {
-        timeout: 60_000, maxBuffer: 1024 * 1024,
+    await exec('git', [
+        ...gitOptions,
+        '--literal-pathspecs',
+        'add',
+        '--force',
+        '--',
+        record.path,
+        WORKSPACE_REMIX_REFERENCES_MANIFEST,
+    ], {
+        timeout: 60_000,
+        maxBuffer: 1024 * 1024,
         env: environment,
     });
 }
@@ -325,15 +410,20 @@ async function importReference(root, directoryName, input, assertCurrent) {
     const snapshot = parsed.data;
     if (snapshot.contentHash !== hash(remixReferenceContentHashInput(snapshot.files)))
         throw new RemixReferenceError('remix_reference_changed');
-    const plannedFiles = snapshot.files.map(file => {
+    const plannedFiles = snapshot.files.map((file) => {
         const bytes = Buffer.from(file.content, 'base64');
-        if (bytes.toString('base64') !== file.content || bytes.length !== file.size || hash(bytes) !== file.sha256)
+        if (bytes.toString('base64') !== file.content ||
+            bytes.length !== file.size ||
+            hash(bytes) !== file.sha256)
             throw new RemixReferenceError('remix_reference_changed');
-        if (bytes.subarray(0, 128).toString('utf8').startsWith('version https://git-lfs.github.com/spec/v1'))
+        if (bytes
+            .subarray(0, 128)
+            .toString('utf8')
+            .startsWith('version https://git-lfs.github.com/spec/v1'))
             throw new RemixReferenceError('remix_reference_external_resource');
         return { ...file, bytes, targetPath: materializedPath(file.path) };
     });
-    const files = plannedFiles.filter(file => file.targetPath !== undefined);
+    const files = plannedFiles.filter((file) => file.targetPath !== undefined);
     if (!files.length)
         throw new RemixReferenceError('remix_reference_empty');
     const rootReal = await realpath(root);
@@ -341,7 +431,7 @@ async function importReference(root, directoryName, input, assertCurrent) {
     const path = referencePath(referenceId, snapshot.source.commit);
     const items = await readManifest(rootReal);
     await safeDirectory(rootReal, '.playcraft', true);
-    let record = items.find(item => item.referenceId === referenceId);
+    let record = items.find((item) => item.referenceId === referenceId);
     if (record) {
         await verifyReference(rootReal, record, directoryName);
         assertCurrent();
@@ -352,8 +442,11 @@ async function importReference(root, directoryName, input, assertCurrent) {
         throw new RemixReferenceError('remix_reference_limit');
     await safeDirectory(rootReal, WORKSPACE_REMIX_REFERENCES_DIRECTORY, true);
     const target = join(rootReal, path);
-    const existing = await lstat(target).catch((error) => { if (error.code === 'ENOENT')
-        return undefined; throw error; });
+    const existing = await lstat(target).catch((error) => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    });
     if (existing) {
         // A complete published directory is its recovery receipt when the process died before writing the manifest.
         if (!existing.isDirectory() || existing.isSymbolicLink())
@@ -364,10 +457,24 @@ async function importReference(root, directoryName, input, assertCurrent) {
         await verifyReference(rootReal, record, directoryName);
     }
     else {
-        record = workspaceRemixReferenceSchema.parse({ referenceId, directoryName, path, name: snapshot.source.name,
-            source: snapshot.source, contentHash: snapshot.contentHash, importedAt: new Date().toISOString(),
-            files: files.map(file => ({ path: file.targetPath, sourcePath: file.path, sha256: file.sha256, size: file.size })),
-            omittedFiles: plannedFiles.filter(file => file.targetPath === undefined).map(file => ({ path: file.path, sha256: file.sha256, size: file.size })) });
+        record = workspaceRemixReferenceSchema.parse({
+            referenceId,
+            directoryName,
+            path,
+            name: snapshot.source.name,
+            source: snapshot.source,
+            contentHash: snapshot.contentHash,
+            importedAt: new Date().toISOString(),
+            files: files.map((file) => ({
+                path: file.targetPath,
+                sourcePath: file.path,
+                sha256: file.sha256,
+                size: file.size,
+            })),
+            omittedFiles: plannedFiles
+                .filter((file) => file.targetPath === undefined)
+                .map((file) => ({ path: file.path, sha256: file.sha256, size: file.size })),
+        });
         const stage = await mkdtemp(join(dirname(rootReal), '.remix-reference-'));
         try {
             for (const file of files) {
@@ -411,7 +518,9 @@ async function importReference(root, directoryName, input, assertCurrent) {
 }
 export async function importWorkspaceRemixReference(root, directoryName, snapshot, assertCurrent = () => { }) {
     const previous = locks.get(root) ?? Promise.resolve();
-    const current = previous.catch(() => undefined).then(() => importReference(root, directoryName, snapshot, assertCurrent));
+    const current = previous
+        .catch(() => undefined)
+        .then(() => importReference(root, directoryName, snapshot, assertCurrent));
     locks.set(root, current);
     try {
         return await current;

package/dist/workspace-runtime/workspaces/starter-template.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { chmod, lstat, mkdir, mkdtemp, realpath, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { starterTemplateTreeHashInput, workspaceStarterTemplateSnapshotSchema } from '@playcraft/common/cloud-workspace/runtime';
+import { mergeStarterTemplate } from '../batch/source-capture.js';
+import { SHARED_DIRECTORY_MODE, sharePathWithGroup, workspaceGroup } from './shared-write.js';
+/** Prepare the trusted starter in a fresh staging directory; the checkout is never overwritten. */
+export async function prepareStarterTemplate(root, input, check) {
+    const snapshot = workspaceStarterTemplateSnapshotSchema.parse(input);
+    const hash = (body) => createHash('sha256').update(body).digest('hex');
+    const files = new Map();
+    try {
+        mergeStarterTemplate(files, { snapshot, treeHash: hash(starterTemplateTreeHashInput(snapshot.files)) });
+    }
+    catch {
+        throw new Error('remix_reference_incomplete');
+    }
+    const realRoot = await realpath(root);
+    const group = await workspaceGroup(realRoot);
+    const tempRoot = join(realRoot, '.tmp');
+    let created = false;
+    try {
+        await mkdir(tempRoot, { mode: SHARED_DIRECTORY_MODE });
+        created = true;
+    }
+    catch (error) {
+        if (error.code !== 'EEXIST')
+            throw error;
+    }
+    if (created)
+        await sharePathWithGroup(tempRoot, group, SHARED_DIRECTORY_MODE);
+    const temp = await lstat(tempRoot);
+    const sharedTemp = temp.isDirectory() && !temp.isSymbolicLink() && await realpath(tempRoot) === tempRoot &&
+        temp.gid === group && (temp.mode & 0o070) === 0o070;
+    const workspace = await lstat(realRoot);
+    if (!sharedTemp && (workspace.gid !== group || (workspace.mode & 0o070) !== 0o070))
+        throw new Error('remix_reference_path_conflict');
+    const stage = await mkdtemp(join(sharedTemp ? tempRoot : realRoot, sharedTemp ? 'starter-template-' : '.starter-template-'));
+    try {
+        await sharePathWithGroup(stage, group, SHARED_DIRECTORY_MODE);
+        const stageStat = await lstat(stage);
+        if (stageStat.gid !== group || (stageStat.mode & 0o070) !== 0o070)
+            throw new Error('remix_reference_path_conflict');
+        const directories = new Set([stage]);
+        for (const [path, file] of files) {
+            check();
+            const target = join(stage, path);
+            const parts = path.split('/').slice(0, -1);
+            let parent = stage;
+            for (const part of parts) {
+                parent = join(parent, part);
+                if (directories.has(parent))
+                    continue;
+                await mkdir(parent, { mode: SHARED_DIRECTORY_MODE });
+                await sharePathWithGroup(parent, group, SHARED_DIRECTORY_MODE);
+                const current = await lstat(parent);
+                if (current.gid !== group || (current.mode & 0o070) !== 0o070)
+                    throw new Error('remix_reference_path_conflict');
+                directories.add(parent);
+            }
+            // shared: the staged starter is handed to both sandbox identities.
+            await writeFile(target, file.body, { flag: 'wx', mode: file.mode === 0o755 ? 0o750 : 0o640 });
+            await chmod(target, file.mode === 0o755 ? 0o750 : 0o640);
+            if ((await lstat(target)).gid !== group)
+                throw new Error('remix_reference_path_conflict');
+        }
+        check();
+        return { path: stage, templateId: snapshot.templateId, commit: snapshot.commit };
+    }
+    catch (error) {
+        await rm(stage, { recursive: true, force: true });
+        throw error;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "private": false,
   "type": "module",
   "engines": {
@@ -25,6 +25,7 @@
     "dev": "tsc -w",
     "build": "node scripts/generate-asset-skills.mjs && node scripts/generate-video-skills.mjs && node scripts/generate-parameter-skill.mjs && node scripts/generate-level-editor-skill.mjs && node scripts/generate-preview-runtime.mjs && tsc",
     "start": "node dist/index.js",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "pnpm build && vitest run",
     "test:agent": "node scripts/run-agent-tests.mjs --list",
     "test:agent:designer": "node scripts/run-agent-tests.mjs game-designer",
@@ -56,8 +57,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "0.1.71",
-    "@playcraft/common": "0.1.71",
+    "@playcraft/build": "0.1.73",
+    "@playcraft/common": "0.1.73",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",