@playcraft/cli 0.1.74 → 0.1.77

package/dist/workspace-runtime/batch/deliver.js

@@ -23,6 +23,7 @@ function buildCommand() {
  */
 const PERMISSION_REPAIR_COMMAND = [
     'find . \\( -path ./node_modules -o -path ./.git \\) -prune -o',
+    '-uid "$(id -u)"',
     '\\( -type d \\( -not -perm -040 -o -not -perm -010 \\) -o -type f -not -perm -040 \\)',
     '-exec chmod g+rX {} +',
 ].join(' ');

package/dist/workspace-runtime/verify-artifact.js

@@ -20,13 +20,16 @@ async function dependencyVersion(name, entry) {
         directory = parent;
     }
 }
-/** Starts only an isolated temporary runtime; never reads or changes an existing workspace. */
 export async function verifyRuntimeArtifact(expectedVersion) {
     assert.match(expectedVersion, /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/);
     const metadata = JSON.parse(await readFile(new URL('../../package.json', import.meta.url), 'utf8'));
     assert.equal(metadata.version, expectedVersion, 'command package version differs from the release target');
-    assert.equal(await dependencyVersion('@playcraft/common', '@playcraft/common/cloud-workspace/runtime'), expectedVersion);
-    assert.equal(await dependencyVersion('@playcraft/build', '@playcraft/build'), expectedVersion);
+    assert.equal(await dependencyVersion('@playcraft/common', '@playcraft/common/cloud-workspace/runtime'), expectedVersion, '@playcraft/common version differs from the release target');
+    assert.equal(await dependencyVersion('@playcraft/build', '@playcraft/build'), expectedVersion, '@playcraft/build version differs from the release target');
+    await verifyRuntimeCapabilities(expectedVersion);
+}
+/** Verifies the runtime in a temporary workspace, including before release versions are aligned. */
+export async function verifyRuntimeCapabilities(cliVersion) {
     const batchId = randomUUID();
     assert.equal(batchSourceRemoteRef(batchId), `refs/tags/playcraft/batch/${batchId}/source`, 'installed shared library lacks standard tag references for source snapshots');
     const directory = await mkdtemp(join(tmpdir(), 'playcraft-artifact-verify-'));
@@ -36,7 +39,7 @@ export async function verifyRuntimeArtifact(expectedVersion) {
             protocolMajor: 1, protocolMinor: 0, environment: 'artifact-verification',
             runtimeId: randomUUID(), userId: 'artifact-verification', generation: 1, runtimeEpoch: 0,
             workspaceMode: 'multi', workspaceRoot: join(directory, 'workspaces'), stateDir: join(directory, 'state'),
-            publicBaseUrl: 'http://127.0.0.1:9', controlToken: randomUUID(), cliVersion: expectedVersion,
+            publicBaseUrl: 'http://127.0.0.1:9', controlToken: randomUUID(), cliVersion,
             listen: { host: '127.0.0.1', port: 0 },
         });
         runtime = await startWorkspaceRuntime(config, { nativeAdapter: createLoopbackNativeAdapter() });

package/dist/workspace-runtime/workspaces/artifact-receipts.js

@@ -7,7 +7,19 @@ import { artifactFormat, relativeArtifactPath, snapshotArtifactBundle } from './
 import { excludeFromGit } from './dependencies.js';
 import { ensureSharedDirectory, openSharedFile } from './shared-write.js';
 export const ARTIFACT_RECEIPTS_DIRECTORY = '.playcraft/artifact-receipts';
+const ARTIFACT_RECEIPTS_EXCLUDE = `/${ARTIFACT_RECEIPTS_DIRECTORY}/`;
 export const artifactReceiptSchema = workspaceArtifactReceiptSchema;
+/** The controller can write Git metadata before a development command runs with read-only Git. */
+export async function prepareWorkspaceArtifactReceiptExclusion(root) {
+    const marker = await lstat(join(root, '.git')).catch(error => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw error;
+    });
+    // Some existing checkouts use a gitdir file. Do not follow it or block workspace startup.
+    if (marker?.isDirectory())
+        await excludeFromGit(root, ARTIFACT_RECEIPTS_EXCLUDE);
+}
 export async function generatedWorkspace(cwd) {
     for (let root = resolve(cwd);; root = dirname(root)) {
         const file = join(root, '.playcraft/workspace-context.json');
@@ -48,6 +60,8 @@ export async function captureGeneratedArtifact(output, tool, metadata = {}, cwd
     }
     if (!isWorkspaceArtifactOutputPath(path) || !artifactFormat(path))
         return;
+    // Check the ignore before publishing a receipt that must stay out of source commits.
+    await excludeFromGit(context.root, ARTIFACT_RECEIPTS_EXCLUDE);
     // Generations are written by whichever identity runs the tool; the controller scans the same tree.
     const receipts = await ensureSharedDirectory(context.root, join(context.root, ARTIFACT_RECEIPTS_DIRECTORY));
     const objects = await ensureSharedDirectory(context.root, join(context.root, ARTIFACT_RECEIPTS_DIRECTORY, 'objects'));
@@ -69,8 +83,6 @@ export async function captureGeneratedArtifact(output, tool, metadata = {}, cwd
         await handle.sync();
         await handle.close();
         await rename(temporary, join(receipts, `${receipt.id}.json`));
-        // The workspace checkpoint retains these receipts; they are not source files or exported assets.
-        await excludeFromGit(context.root, `/${ARTIFACT_RECEIPTS_DIRECTORY}/`);
     }
     finally {
         await handle.close();

package/dist/workspace-runtime/workspaces/attachments.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, open, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, open, rm, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { WORKSPACE_USER_UPLOADS_DIRECTORY, attachmentIdsSchema, attachmentUploadSchema, WORKSPACE_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MAX_BYTES, WORKSPACE_VIDEO_ATTACHMENT_MIME_TYPES, workspaceVideoAttachmentQuerySchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { NativePreparationError } from '../codex/native-adapter.js';
@@ -8,21 +8,9 @@ import { excludeFromGit } from './dependencies.js';
 import { hashAttachment, probeAttachmentVideo } from './video-attachments.js';
 import { resolveLibraryAttachment } from './library-attachments.js';
 import { resolveWorkspaceDirectoryAttachment } from './directory-attachments.js';
-async function attachmentRoot(root) {
-    // Reject redirected upload directories, including symlinks that stay inside the workspace.
-    let directory = root;
-    for (const part of WORKSPACE_USER_UPLOADS_DIRECTORY.split('/')) {
-        directory = join(directory, part);
-        // shared
-        await mkdir(directory, { mode: 0o755 }).catch((error) => {
-            if (error.code !== 'EEXIST')
-                throw error;
-        });
-        if (!(await lstat(directory)).isDirectory())
-            throw new Error('invalid_attachment');
-        await chmod(directory, 0o755);
-    }
-    return directory;
+import { ensureSharedDirectory, shareIfNeeded, SHARED_DIRECTORY_MODE } from './shared-write.js';
+function attachmentRoot(root) {
+    return ensureSharedDirectory(root, join(root, WORKSPACE_USER_UPLOADS_DIRECTORY));
 }
 export function imageMime(bytes) {
     if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10])))
@@ -62,17 +50,11 @@ export async function uploadWorkspaceAttachment(root, body) {
     await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
     const uploads = await attachmentRoot(root);
     const directory = join(uploads, attachment.id);
-    const metadataDirectory = join(uploads, '.metadata');
-    // shared
-    await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => {
-        if (error.code !== 'EEXIST')
-            throw error;
-    });
-    if (!(await lstat(metadataDirectory)).isDirectory())
-        throw new Error('invalid_attachment');
+    const metadataDirectory = await ensureSharedDirectory(root, join(uploads, '.metadata'));
     // Codex can run as a different user from the sandbox control process.
     // shared
-    await mkdir(directory, { mode: 0o755 });
+    await mkdir(directory, { mode: SHARED_DIRECTORY_MODE });
+    await ensureSharedDirectory(root, directory);
     // shared
     await writeFile(join(directory, attachment.name), bytes, { flag: 'wx', mode: 0o644 });
     // shared
@@ -92,14 +74,11 @@ export async function uploadWorkspaceVideoAttachment(root, request, query) {
         throw new Error('invalid_attachment');
     await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
     const uploads = await attachmentRoot(root);
-    const id = randomUUID(), directory = join(uploads, id), metadataDirectory = join(uploads, '.metadata');
-    // shared
-    await mkdir(metadataDirectory, { mode: 0o755 }).catch((error) => { if (error.code !== 'EEXIST')
-        throw error; });
-    if (!(await lstat(metadataDirectory)).isDirectory())
-        throw new Error('invalid_attachment');
+    const id = randomUUID(), directory = join(uploads, id);
+    const metadataDirectory = await ensureSharedDirectory(root, join(uploads, '.metadata'));
     // shared
-    await mkdir(directory, { mode: 0o755 });
+    await mkdir(directory, { mode: SHARED_DIRECTORY_MODE });
+    await ensureSharedDirectory(root, directory);
     // shared
     const handle = await open(join(directory, name), constants.O_CREAT | constants.O_EXCL | constants.O_RDWR | constants.O_NOFOLLOW, 0o644);
     try {
@@ -140,7 +119,7 @@ export async function resolveWorkspaceAttachments(root, input) {
             const directory = join(uploads, id);
             if (!(await lstat(directory)).isDirectory())
                 throw new Error('invalid_attachment');
-            await chmod(directory, 0o755);
+            await shareIfNeeded(root, directory);
             if (!(await lstat(join(uploads, '.metadata'))).isDirectory())
                 throw new Error('invalid_attachment');
             const metadataHandle = await open(join(uploads, '.metadata', `${id}.json`), constants.O_RDONLY | constants.O_NOFOLLOW);

package/dist/workspace-runtime/workspaces/dependencies.js

@@ -292,20 +292,45 @@ export async function excludeFromGit(root, entry = '/node_modules/') {
             return;
         handles.push(git);
         const gitPath = pinned(git, join(root, '.git'));
-        await mkdir(join(gitPath, 'info')).catch((error) => {
-            if (error.code !== 'EEXIST')
+        const infoPath = join(gitPath, 'info');
+        const info = await open(infoPath, flags).catch(async (error) => {
+            if (error.code !== 'ENOENT')
                 throw error;
+            await mkdir(infoPath).catch((error) => {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            });
+            return open(infoPath, flags);
         });
-        const info = await open(join(gitPath, 'info'), flags);
         handles.push(info);
-        // shared
-        file = await open(join(pinned(info, join(root, '.git/info')), 'exclude'), constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 0o666);
-        const metadata = await file.stat();
-        if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > 1024 * 1024) {
-            throw new Error('invalid_git_exclude');
+        const excludePath = join(pinned(info, join(root, '.git/info')), 'exclude');
+        const excludeFlags = constants.O_NOFOLLOW | constants.O_NONBLOCK;
+        const readExclude = async (handle) => {
+            const metadata = await handle.stat();
+            if (!metadata.isFile() || metadata.nlink !== 1 || metadata.size > 1024 * 1024) {
+                throw new Error('invalid_git_exclude');
+            }
+            return handle.readFile('utf8');
+        };
+        const hasEntry = (content) => content.split('\n').some((line) => line.trim() === entry);
+        const existing = await open(excludePath, constants.O_RDONLY | excludeFlags).catch((error) => {
+            if (error.code === 'ENOENT')
+                return undefined;
+            throw error;
+        });
+        if (existing) {
+            try {
+                if (hasEntry(await readExclude(existing)))
+                    return;
+            }
+            finally {
+                await existing.close();
+            }
         }
-        const current = await file.readFile('utf8');
-        if (!current.split('\n').some((line) => line.trim() === entry)) {
+        // shared
+        file = await open(excludePath, constants.O_RDWR | constants.O_CREAT | constants.O_APPEND | excludeFlags, 0o666);
+        const current = await readExclude(file);
+        if (!hasEntry(current)) {
             await file.writeFile(`${current && !current.endsWith('\n') ? '\n' : ''}${entry}\n`);
         }
     }

package/dist/workspace-runtime/workspaces/directories.js

@@ -14,6 +14,7 @@ import { loadWorkspaceSkillArtifact, workspacePlatformSkillAccess, } from './ski
 import { writeWorkspaceCliContext } from './cli-context.js';
 import { checkoutBatchCommit, freezeBatchCommit } from './batch-commit.js';
 import { ensureWorkspaceArtifactInstructions } from './instructions.js';
+import { prepareWorkspaceArtifactReceiptExclusion } from './artifact-receipts.js';
 import { shareWorkspaceRepository } from './git.js';
 import { checkoutChatWorktree } from './worktree-checkout.js';
 const execute = promisify(execFile);
@@ -121,6 +122,7 @@ export async function registerWorkspaceDirectory(state, input, leaseFence, sourc
             }
         }
         await shareWorkspaceRepository(root);
+        await prepareWorkspaceArtifactReceiptExclusion(root);
         await ensureWorkspaceArtifactInstructions(root);
         await openDirectoryToDevelopment(root, (await lstat(state.config.workspaceRoot)).gid);
         await state.journal.exclusive(`workspace:${directory.workspaceId}`, async () => {
@@ -151,7 +153,9 @@ export async function restoreWorkspaceDirectory(state, workspaceId, directoryNam
         if (!binding)
             return;
         if (directory?.status !== 'reclaimed') {
-            await ensureWorkspaceArtifactInstructions(await workspaceRoot(state, workspaceId, directoryName));
+            const root = await workspaceRoot(state, workspaceId, directoryName);
+            await prepareWorkspaceArtifactReceiptExclusion(root);
+            await ensureWorkspaceArtifactInstructions(root);
             return;
         }
         // Recheck under the journal lock: a resident-directory caller holds only shared access.
@@ -176,6 +180,7 @@ export async function restoreWorkspaceDirectory(state, workspaceId, directoryNam
         await ensureWorkspaceSkills(root, join(state.config.stateDir, 'skill-artifacts'), workspacePlatformSkillAccess(state, workspaceId), { optionalPlatformDefaults: true });
         if (directoryName === 'basic')
             await writeWorkspaceCliContext(root, workspaceId);
+        await prepareWorkspaceArtifactReceiptExclusion(root);
         await ensureWorkspaceArtifactInstructions(root);
         await openDirectoryToDevelopment(root, (await lstat(state.config.workspaceRoot)).gid);
         await state.journal.putWorkspace({

package/dist/workspace-runtime/workspaces/directory-attachments.js

@@ -6,6 +6,7 @@ import { attachmentIdsSchema, WORKSPACE_USER_UPLOADS_DIRECTORY, WORKSPACE_ATTACH
 import { artifactMime } from './artifact-files.js';
 import { excludeFromGit } from './dependencies.js';
 import { hashAttachment, probeAttachmentVideo } from './video-attachments.js';
+import { ensureSharedDirectory, SHARED_DIRECTORY_MODE } from './shared-write.js';
 const stagingPath = `${WORKSPACE_USER_UPLOADS_DIRECTORY}/.directory-uploads`;
 const locks = new Map();
 async function withUploadLock(root, id, action) {
@@ -22,15 +23,11 @@ async function withUploadLock(root, id, action) {
     }
 }
 async function safeDirectory(root, relative, create = false) {
+    if (create)
+        return ensureSharedDirectory(root, join(root, relative));
     let directory = root;
     for (const part of relative.split('/')) {
         directory = join(directory, part);
-        // shared
-        if (create)
-            await mkdir(directory, { mode: 0o755 }).catch((error) => {
-                if (error.code !== 'EEXIST')
-                    throw error;
-            });
         if (!(await lstat(directory)).isDirectory())
             throw new Error('invalid_attachment');
     }
@@ -61,12 +58,9 @@ export async function beginWorkspaceDirectoryAttachment(root, body) {
     const id = randomUUID();
     const stage = join(staging, id);
     // shared
-    await mkdir(stage, { mode: 0o755 });
+    await mkdir(stage, { mode: SHARED_DIRECTORY_MODE });
     try {
-        // shared
-        await mkdir(join(stage, 'data'), { mode: 0o755 });
-        // shared
-        await mkdir(join(stage, 'data', manifest.name), { mode: 0o755 });
+        await ensureSharedDirectory(root, join(stage, 'data', manifest.name));
         // shared
         await writeFile(join(stage, 'manifest.json'), JSON.stringify(manifest), { flag: 'wx', mode: 0o644 });
         return { uploadId: id };
@@ -171,8 +165,9 @@ export async function completeWorkspaceDirectoryAttachment(root, id) {
         workspaceAttachmentSchema.parse(attachment);
         const target = join(uploads, id);
         // shared
-        await mkdir(target, { mode: 0o755 });
+        await mkdir(target, { mode: SHARED_DIRECTORY_MODE });
         try {
+            await ensureSharedDirectory(root, target);
             await rename(join(stage, 'data', manifest.name), join(target, manifest.name));
             // shared
             await writeFile(join(metadata, `${id}.json`), JSON.stringify(attachment), { flag: 'wx', mode: 0o644 });

package/dist/workspace-runtime/workspaces/library-attachments.js

@@ -1,22 +1,17 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { constants } from 'node:fs';
-import { chmod, lstat, mkdir, open, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { lstat, mkdir, open, readdir, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { WORKSPACE_USER_UPLOADS_DIRECTORY, WORKSPACE_LIBRARY_ATTACHMENT_MAX_BYTES, WORKSPACE_ATTACHMENT_MAX_COUNT, workspaceAttachmentSchema, workspaceLibraryAttachmentUploadSchema, workspaceLibraryFilePathSchema, } from '@playcraft/common/cloud-workspace/runtime';
 import { excludeFromGit } from './dependencies.js';
+import { ensureSharedDirectory, shareIfNeeded, SHARED_DIRECTORY_MODE } from './shared-write.js';
 const METADATA_MAX_BYTES = 1024 * 1024;
 const locks = new Map();
 const hash = (bytes) => createHash('sha256').update(bytes).digest('hex');
-async function safeDirectory(root, path, create = false) {
+async function safeDirectory(root, path) {
     let directory = root;
     for (const part of path.split('/').filter(Boolean)) {
         directory = join(directory, part);
-        // shared
-        if (create)
-            await mkdir(directory, { mode: 0o755 }).catch((error) => {
-                if (error.code !== 'EEXIST')
-                    throw error;
-            });
         const stat = await lstat(directory);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             throw new Error('invalid_library_attachment');
@@ -24,7 +19,8 @@ async function safeDirectory(root, path, create = false) {
     return directory;
 }
 async function metadataDirectory(root, create = false) {
-    return safeDirectory(root, `${WORKSPACE_USER_UPLOADS_DIRECTORY}/.metadata`, create);
+    const path = `${WORKSPACE_USER_UPLOADS_DIRECTORY}/.metadata`;
+    return create ? ensureSharedDirectory(root, join(root, path)) : safeDirectory(root, path);
 }
 export async function readLibraryAttachmentMetadata(root, id) {
     if (!/^[a-f0-9-]{36}$/.test(id))
@@ -159,8 +155,8 @@ async function importAttachment(root, body) {
         throw new Error('library_asset_changed');
     const id = attachmentId(asset);
     await excludeFromGit(root, `/${WORKSPACE_USER_UPLOADS_DIRECTORY}/`);
-    const uploads = await safeDirectory(root, WORKSPACE_USER_UPLOADS_DIRECTORY, true);
     const metadata = await metadataDirectory(root, true);
+    const uploads = dirname(metadata);
     let record;
     try {
         record = await readLibraryAttachmentMetadata(root, id);
@@ -174,13 +170,13 @@ async function importAttachment(root, body) {
     if (!record) {
         const temporary = join(uploads, `.import-${randomUUID()}`);
         const target = join(uploads, id);
-        // shared
-        await mkdir(temporary, { mode: 0o755 });
+        await mkdir(temporary, { mode: SHARED_DIRECTORY_MODE });
         try {
+            await ensureSharedDirectory(root, temporary);
             for (const file of files) {
                 const parent = dirname(file.path);
                 if (parent !== '.')
-                    await safeDirectory(temporary, parent, true);
+                    await ensureSharedDirectory(root, join(temporary, parent));
                 // shared
                 await writeFile(join(temporary, file.path), file.bytes, { flag: 'wx', mode: 0o644 });
             }
@@ -238,11 +234,11 @@ async function importAttachment(root, body) {
     record.sessionIds = [...new Set([...record.sessionIds, ...(sessionId ? [sessionId] : [])])];
     record.clientRequestIds = [...new Set([...record.clientRequestIds, clientRequestId])];
     record.unbound ||= !sessionId;
+    await shareIfNeeded(root, join(uploads, id));
     const tempMetadata = join(metadata, `.import-${randomUUID()}.json`);
     // shared
     await writeFile(tempMetadata, JSON.stringify(record), { flag: 'wx', mode: 0o644 });
     await rename(tempMetadata, join(metadata, `${id}.json`));
-    await chmod(join(uploads, id), 0o755);
     return publicAttachment(record);
 }
 export async function importWorkspaceLibraryAttachment(root, body) {

package/dist/workspace-runtime/workspaces/registry.js

@@ -12,6 +12,7 @@ import { writeWorkspaceCliContext } from './cli-context.js';
 import { attachWorkspaceRemote } from './git.js';
 import { markRemoteAttachPending } from './remote-attach-marker.js';
 import { ensureWorkspaceArtifactInstructions } from './instructions.js';
+import { prepareWorkspaceArtifactReceiptExclusion } from './artifact-receipts.js';
 import { repairWorkspaceShares } from './workspace-shares.js';
 export { WorkspaceContextError } from './context-error.js';
 const exec = promisify(execFile);
@@ -257,6 +258,7 @@ export async function registerWorkspace(state, input, leaseFence, preparation, r
             throw new WorkspaceContextError('workspace_skills_unavailable');
         }
         await writeWorkspaceCliContext(root, binding.workspaceId);
+        await prepareWorkspaceArtifactReceiptExclusion(root);
         await ensureWorkspaceArtifactInstructions(root);
         await state.journal.putWorkspace({ ...binding, directories });
         // Registration is the one point every reused container reaches: the root repair is skipped

package/dist/workspace-runtime/workspaces/transfer.js

@@ -7,6 +7,7 @@ import { dirname, join, resolve, sep } from 'node:path';
 import { Transform } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { isCredentialFile } from './git.js';
+import { shareIfNeeded } from './shared-write.js';
 const EXCLUDED = new Set(['.git', 'node_modules', '.playcraft-workspace.json', '.playcraft.json']);
 const GIT_TIMEOUT_MS = 15 * 60_000;
 const GIT_OPTIONS = ['-c', 'core.hooksPath=/dev/null', '-c', 'commit.gpgsign=false', '-c', 'core.autocrlf=false',
@@ -224,9 +225,18 @@ async function installFile(root, path, source, executable) {
         return undefined; throw error; });
     if (existing?.isDirectory())
         await rmdir(target);
-    await mkdir(dirname(target), { recursive: true });
-    const stage = join(dirname(target), `.playcraft-transfer-${randomUUID()}.tmp`);
+    const parent = dirname(target);
+    const stage = join(parent, `.playcraft-transfer-${randomUUID()}.tmp`);
     try {
+        // Share only newly created directories so existing permissions survive a failed import.
+        const firstCreated = await mkdir(parent, { recursive: true });
+        if (firstCreated) {
+            for (let directory = parent;; directory = dirname(directory)) {
+                await shareIfNeeded(root, directory);
+                if (directory === firstCreated)
+                    break;
+            }
+        }
         await copyFile(source, stage);
         await chmod(stage, executable ? 0o755 : 0o644);
         await rename(stage, target);

package/dist/workspace-runtime/workspaces/worktree-attachments.js

@@ -1,20 +1,17 @@
 import { constants } from 'node:fs';
 import { createHash, randomUUID } from 'node:crypto';
-import { lstat, mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
+import { lstat, open, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname, join, relative } from 'node:path';
 import { attachmentIdsSchema, WORKSPACE_USER_UPLOADS_DIRECTORY } from '@playcraft/common/cloud-workspace/runtime';
 import { resolveWorkspaceAttachments } from './attachments.js';
 import { excludeFromGit } from './dependencies.js';
-async function safeParents(root, path, create = false) {
+import { ensureSharedDirectory } from './shared-write.js';
+async function safeParents(root, path) {
     let current = root;
     for (const segment of path.split('/')) {
         if (!segment || segment === '.' || segment === '..')
             throw new Error('workspace_worktree_attachment_unavailable');
         current = join(current, segment);
-        // shared
-        if (create)
-            await mkdir(current, { mode: 0o755 }).catch(error => { if (error.code !== 'EEXIST')
-                throw error; });
         const stat = await lstat(current);
         if (!stat.isDirectory() || stat.isSymbolicLink())
             throw new Error('workspace_worktree_attachment_unavailable');
@@ -35,7 +32,7 @@ async function readSafe(root, path, max) {
 }
 async function copyExact(source, target, path, limit) {
     const body = await readSafe(source, path, limit);
-    await safeParents(target, dirname(path), true);
+    await ensureSharedDirectory(target, join(target, dirname(path)));
     const existing = await lstat(join(target, path)).catch(() => undefined);
     if (existing) {
         const previous = await readSafe(target, path, limit);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.1.74",
+  "version": "0.1.77",
   "private": false,
   "type": "module",
   "engines": {
@@ -57,8 +57,8 @@
     "@gltf-transform/core": "^4.3.0",
     "@gltf-transform/extensions": "^4.3.0",
     "@gltf-transform/functions": "^4.3.0",
-    "@playcraft/build": "0.1.74",
-    "@playcraft/common": "0.1.74",
+    "@playcraft/build": "0.1.77",
+    "@playcraft/common": "0.1.77",
     "better-sqlite3-pinned": "npm:better-sqlite3@13.0.3",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",