@playdrop/playdrop-cli 0.12.42 → 0.13.1

package/dist/commands/feedback.js

@@ -16,7 +16,7 @@ const output_1 = require("../output");
 const clientInfo_1 = require("../clientInfo");
 const MAX_FEEDBACK_TITLE_LENGTH = 70;
 const MAX_FEEDBACK_COMMENT_LENGTH = 10000;
-const FEEDBACK_CATEGORY_SET = new Set(types_1.FEEDBACK_CATEGORY_VALUES);
+const FEEDBACK_CATEGORY_SET = new Set(types_1.MANUAL_FEEDBACK_CATEGORY_VALUES);
 function parsePositiveInteger(raw, label, command, options = {}) {
     if (raw === undefined) {
         return null;
@@ -32,7 +32,7 @@ function parsePositiveInteger(raw, label, command, options = {}) {
 function parseFeedbackCategory(raw, command) {
     const normalized = typeof raw === 'string' && raw.trim().length > 0 ? raw.trim() : 'other';
     if (!FEEDBACK_CATEGORY_SET.has(normalized)) {
-        (0, messages_1.printErrorWithHelp)(`Feedback category must be one of: ${types_1.FEEDBACK_CATEGORY_VALUES.join(', ')}.`, [], { command });
+        (0, messages_1.printErrorWithHelp)(`Feedback category must be one of: ${types_1.MANUAL_FEEDBACK_CATEGORY_VALUES.join(', ')}.`, [], { command });
         process.exitCode = 1;
         return null;
     }
@@ -137,8 +137,50 @@ async function browseFeedback(options = {}) {
         process.exitCode = 1;
         return;
     }
+    const sinceHours = options.sinceHours !== undefined
+        ? parsePositiveInteger(options.sinceHours, '--since-hours', 'feedback browse')
+        : null;
+    if (options.sinceHours !== undefined && sinceHours === null) {
+        return;
+    }
     await (0, commandContext_1.withEnvironment)('feedback browse', 'Browsing feedback', async ({ client }) => {
         try {
+            if (options.admin) {
+                const cutoff = sinceHours === null ? null : Date.now() - sinceHours * 60 * 60 * 1000;
+                const items = [];
+                let nextOffset = offset ?? 0;
+                let hasMore = true;
+                while (hasMore && (limit === null || items.length < limit)) {
+                    const page = await client.fetchAdminFeedback({ limit: 100, offset: nextOffset });
+                    for (const item of page.feedback ?? []) {
+                        if (cutoff !== null && new Date(item.createdAt).getTime() < cutoff) {
+                            hasMore = false;
+                            break;
+                        }
+                        items.push(item);
+                        if (limit !== null && items.length >= limit) {
+                            break;
+                        }
+                    }
+                    nextOffset += page.feedback?.length ?? 0;
+                    hasMore = hasMore && Boolean(page.pagination?.hasMore) && (page.feedback?.length ?? 0) > 0;
+                }
+                if (options.json) {
+                    (0, output_1.printJson)({ items, sinceHours, count: items.length });
+                    return;
+                }
+                if (items.length === 0) {
+                    console.log('No feedback entries found.');
+                    return;
+                }
+                console.log('Feedback:\n');
+                for (const item of items) {
+                    console.log(`#${item.id} | ${item.category} | ${item.client} | ${(0, output_1.formatTimestamp)(item.createdAt)}`);
+                    console.log(`  ${item.title}`);
+                    console.log(`  ${item.comment}`);
+                }
+                return;
+            }
             const response = await client.listFeedback({
                 limit: limit ?? undefined,
                 offset: offset ?? undefined,

package/dist/commands/upload.d.ts

@@ -5,6 +5,7 @@ export type UploadCommandOptions = {
     env?: string;
     skipReview?: boolean;
     clearTags?: boolean;
+    json?: boolean;
 };
 export declare function resolveUploadOwner(actorUsername: string | null | undefined, workspaceOwnerUsername: string | null | undefined): string;
 export declare function resolveDefaultUploadCreator(owner: string | null | undefined, actorUsername: string | null | undefined): string;
@@ -35,6 +36,28 @@ export type WorkerAppPublishResult = {
     creatorUsername: string;
     warnings: string[];
 };
+export type StaticHtmlPublishInput = {
+    client: ApiClient;
+    projectDir: string;
+    creatorUsername: string;
+    primarySurface: 'DESKTOP' | 'MOBILE_LANDSCAPE' | 'MOBILE_PORTRAIT';
+    apiBase: string;
+    webBase?: string | null;
+    token: string;
+    user: UserResponse;
+    taskId?: number;
+    taskToken?: string;
+    claimedAppName?: string | null;
+    devRouterPort?: number;
+};
+export type StaticHtmlPublishResult = WorkerAppPublishResult & {
+    sourceHash: string;
+    runtimeHash: string;
+    playUrl: string;
+    sourceContainsInjectedSdk: false;
+    runtimeContainsInjectedSdk: true;
+    hostedLoadCheckPassed: true;
+};
 export type WorkerPlaydropAssetRequirement = 'PACK' | 'ASSET_OR_PACK';
 export declare function resolveWorkerPlaydropAssetRequirement(value: unknown): WorkerPlaydropAssetRequirement | null;
 export declare function assertAgentNewGamePlaytestContract(task: AppTask): void;
@@ -50,3 +73,4 @@ export declare function assertWorkerAppLocalUploadPreflight(input: {
     creatorRequest?: string | null;
 }): Promise<AgentTaskPlaytestProof | null>;
 export declare function publishWorkerAppProject(input: WorkerAppPublishInput): Promise<WorkerAppPublishResult>;
+export declare function publishStaticHtmlProject(input: StaticHtmlPublishInput): Promise<StaticHtmlPublishResult>;

package/dist/commands/upload.js

@@ -8,17 +8,20 @@ exports.assertAgentNewGamePlaytestContract = assertAgentNewGamePlaytestContract;
 exports.assertTaskPlaytestEvidenceManifest = assertTaskPlaytestEvidenceManifest;
 exports.assertWorkerAppLocalUploadPreflight = assertWorkerAppLocalUploadPreflight;
 exports.publishWorkerAppProject = publishWorkerAppProject;
+exports.publishStaticHtmlProject = publishStaticHtmlProject;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
 const semver_1 = require("semver");
 const types_1 = require("@playdrop/types");
 const apps_1 = require("../apps");
+const staticHtml_1 = require("../apps/staticHtml");
 const registration_1 = require("../apps/registration");
 const commandContext_1 = require("../commandContext");
 const http_1 = require("../http");
 const catalogue_1 = require("../catalogue");
 const messages_1 = require("../messages");
+const output_1 = require("../output");
 const taskSelection_1 = require("../taskSelection");
 const taskUtils_1 = require("../taskUtils");
 const uploadLog_1 = require("../uploadLog");
@@ -1142,6 +1145,10 @@ function printResolvedUploadAccount(input) {
     console.log(`Resolved account: ${username} (${input.env})`);
 }
 async function upload(pathOrName, options) {
+    const directEntryPath = (0, node_path_1.resolve)(pathOrName);
+    const directStaticHtml = (0, node_fs_1.existsSync)(directEntryPath)
+        && (0, node_fs_1.statSync)(directEntryPath).isFile()
+        && (0, node_path_1.basename)(directEntryPath).toLowerCase() === 'index.html';
     const selection = (0, taskSelection_1.selectTasks)(pathOrName);
     const workspaceRoot = resolveUploadWorkspaceRoot(pathOrName, selection.resolution);
     const ctx = await (0, commandContext_1.resolveAuthenticatedEnvironmentContext)('project publish', 'Publishing content', {
@@ -1152,10 +1159,12 @@ async function upload(pathOrName, options) {
         return;
     }
     const { client, env, envConfig } = ctx;
-    printResolvedUploadAccount({
-        env,
-        username: ctx.account?.username,
-    });
+    if (!options?.json) {
+        printResolvedUploadAccount({
+            env,
+            username: ctx.account?.username,
+        });
+    }
     let userInfo = { username: null, role: null, user: null };
     try {
         userInfo = await fetchCurrentUserInfo(client, envConfig.apiBase);
@@ -1167,6 +1176,30 @@ async function upload(pathOrName, options) {
         throw error;
     }
     const owner = resolveUploadOwner(userInfo.username, ctx.workspaceAuth?.config.ownerUsername);
+    if (directStaticHtml) {
+        if (!userInfo.username || !userInfo.user) {
+            throw new Error('static_game_publish_authenticated_user_missing');
+        }
+        const result = await publishStaticHtmlProject({
+            client,
+            projectDir: (0, node_path_1.dirname)(directEntryPath),
+            creatorUsername: userInfo.username,
+            primarySurface: 'DESKTOP',
+            apiBase: envConfig.apiBase,
+            webBase: envConfig.webBase,
+            token: ctx.token,
+            user: userInfo.user,
+        });
+        if (options?.json) {
+            (0, output_1.printJson)(result);
+        }
+        else {
+            (0, output_1.printSuccess)(`Published private static game ${result.creatorUsername}/${result.appName}@${result.version}`);
+            console.log(result.playUrl);
+            result.warnings.forEach((warning) => console.warn(warning));
+        }
+        return;
+    }
     const tagGroupLoad = (0, catalogue_1.resolveCatalogueTagGroups)(workspaceRoot);
     if (tagGroupLoad.errors.length > 0) {
         (0, taskSelection_1.reportTaskErrors)(tagGroupLoad.errors.map((message) => ({
@@ -2054,3 +2087,88 @@ async function publishWorkerAppProject(input) {
         warnings: [...selection.warnings, ...warnings],
     };
 }
+async function publishStaticHtmlProject(input) {
+    const creatorUsername = input.creatorUsername.trim();
+    if (!creatorUsername) {
+        throw new Error('static_game_publish_creator_username_missing');
+    }
+    if (input.user.username !== creatorUsername && input.user.role !== 'ADMIN') {
+        throw new Error(`static_game_publish_on_behalf_requires_admin:${input.user.username}:${creatorUsername}`);
+    }
+    const prepared = await (0, staticHtml_1.prepareStaticHtmlProject)({
+        projectDir: input.projectDir,
+        taskId: input.taskId,
+        appName: input.claimedAppName?.trim() || undefined,
+        primarySurface: input.primarySurface,
+    });
+    try {
+        if (input.taskId !== undefined && !input.claimedAppName?.trim()) {
+            const taskToken = input.taskToken?.trim() ?? '';
+            if (!taskToken) {
+                throw new Error('static_game_publish_task_token_missing');
+            }
+            const claimed = await input.client.workerClaimAgentTaskSlug(input.taskId, {
+                appName: prepared.runtimeTask.name,
+                displayName: prepared.metadata.title,
+            });
+            if (claimed.appName !== prepared.runtimeTask.name) {
+                throw new Error(`static_game_publish_slug_claim_mismatch:${claimed.appName}:${prepared.runtimeTask.name}`);
+            }
+        }
+        const { app } = await (0, registration_1.ensureRegisteredHostedAppShell)({
+            client: input.client,
+            creatorUsername,
+            task: prepared.runtimeTask,
+            agentTaskId: input.taskId,
+        });
+        if (typeof app.id !== 'number' || !Number.isInteger(app.id) || app.id <= 0) {
+            throw new Error('static_game_publish_app_registration_failed');
+        }
+        const appId = app.id;
+        const captureSession = input.taskId !== undefined && input.taskToken?.trim()
+            ? { appId, taskId: input.taskId, taskToken: input.taskToken.trim() }
+            : null;
+        const { upload, warnings } = await (0, apps_1.runAppPipeline)(input.client, prepared.runtimeTask, {
+            creatorUsername,
+            apiBase: input.apiBase,
+            webBase: normalizePortalBase(input.webBase ?? undefined),
+            token: input.token,
+            user: input.user,
+            runLocalLoadCheck: true,
+            devRouterPort: input.devRouterPort,
+            runStagedUploadLoadCheck: true,
+            ensureRegisteredAppShell: true,
+            agentTaskId: input.taskId,
+            mediaCaptureRequired: false,
+            machineCausalGateRequired: false,
+            captureSession,
+            artifacts: prepared.artifacts,
+        });
+        if (!upload.version || !Number.isInteger(upload.versionId) || !upload.versionNodeId?.trim()) {
+            throw new Error('static_game_publish_version_result_missing');
+        }
+        return {
+            appId,
+            appVersionId: upload.versionId,
+            versionNodeId: upload.versionNodeId,
+            version: upload.version,
+            appName: prepared.runtimeTask.name,
+            creatorUsername,
+            sourceHash: prepared.sourceHash,
+            runtimeHash: prepared.runtimeHash,
+            sourceContainsInjectedSdk: false,
+            runtimeContainsInjectedSdk: true,
+            hostedLoadCheckPassed: true,
+            warnings: [...prepared.metadata.warnings, ...warnings],
+            playUrl: (0, appUrls_1.buildPlatformPrivateDraftPlayUrl)(input.webBase, {
+                creatorUsername,
+                appName: prepared.runtimeTask.name,
+                appType: 'GAME',
+                version: upload.version,
+            }),
+        };
+    }
+    finally {
+        await prepared.cleanup();
+    }
+}

package/dist/commands/worker/instrument-evidence.js

@@ -260,7 +260,7 @@ function readAndValidateInstrumentEvidenceManifest(input) {
         const rawCapture = parsed.captures?.[name];
         if (!rawCapture) {
             if (types_1.REQUIRED_INSTRUMENT_EVIDENCE_NAMES.includes(name)) {
-                throw new Error(`invalid_instrument_evidence_capture:${name}`);
+                throw new Error(`invalid_instrument_evidence_capture:${groupId}:${name}`);
             }
             continue;
         }

package/dist/commands/worker/runtime.d.ts

@@ -1,4 +1,6 @@
 export declare const DEFAULT_CODEX_TIMEOUT_MS: number;
+export declare const DEFAULT_CREATOR_AGENT_TIMEOUT_MS: number;
+export declare const DEFAULT_CREATOR_UPLOAD_RECOVERY_TIMEOUT_MS: number;
 export declare const DEFAULT_WORKER_TOKEN_CAP = 20000000;
 export declare const DEFAULT_CODEX_LOG_TAIL_CHARS = 12000;
 export declare const DEFAULT_TRANSCRIPT_FLUSH_INTERVAL_MS = 10000;
@@ -11,6 +13,7 @@ export type LoggedProcessResult = {
     timedOut: boolean;
     tokenUsage: AgentTokenUsage;
     tokensUsed: number | null;
+    providerSessionId?: string | null;
 };
 export type AgentTokenUsage = {
     inputTokens: number | null;
@@ -31,6 +34,7 @@ export declare function readEnvBoolean(name: string, fallback: boolean): boolean
 export declare function extractAgentTokenUsage(output: string): AgentTokenUsage;
 export declare function extractCodexRolloutTokenUsage(output: string): AgentTokenUsage;
 export declare function extractCodexThreadId(output: string): string | null;
+export declare function extractClaudeSessionId(output: string): string | null;
 export type CodexRolloutTokenUsageReadOptions = {
     sessionsRoot?: string;
     deleteAfterRead?: boolean;
@@ -63,6 +67,7 @@ export declare function buildCodexExecArgs(input: {
     networkAccess: boolean;
     sandboxMode?: CodexSandboxMode;
     imagePaths?: string[];
+    resumeSessionId?: string | null;
 }): string[];
 export type CodexSandboxMode = 'danger-full-access' | 'workspace-write' | 'read-only';
 export declare function readCodexSandboxMode(env?: NodeJS.ProcessEnv): CodexSandboxMode;
@@ -75,9 +80,12 @@ export declare function buildClaudeExecArgs(input: {
     workspaceDir?: string | null;
     denyReadRoots?: string[] | null;
     pluginDir?: string | null;
+    playdropCliEnabled?: boolean;
+    resumeSessionId?: string | null;
 }): string[];
 export declare const PLAYWRIGHT_MCP_VERSION = "0.0.78";
 export type WorkerInstrumentSurface = 'DESKTOP' | 'MOBILE_LANDSCAPE' | 'MOBILE_PORTRAIT';
+export declare function resolvePlaywrightMcpCliPath(): string;
 export declare function buildPlaywrightMcpCommand(surface?: WorkerInstrumentSurface | null): {
     command: string;
     args: string[];
@@ -86,6 +94,7 @@ export declare function buildPlaywrightMcpServerConfig(surface?: WorkerInstrumen
 export declare function buildClaudePermissionSettings(input?: {
     workspaceDir?: string | null;
     denyReadRoots?: string[];
+    playdropCliEnabled?: boolean;
 }): {
     permissions: {
         allow: string[];
@@ -108,3 +117,9 @@ export declare function buildWorkerChildEnv(input: {
     playwrightBrowsersPath?: string;
     baseEnv?: NodeJS.ProcessEnv;
 }): NodeJS.ProcessEnv;
+export declare function buildCleanRoomChildEnv(input: {
+    binDir: string;
+    homeDir?: string;
+    codexHomeDir?: string;
+    baseEnv?: NodeJS.ProcessEnv;
+}): NodeJS.ProcessEnv;

package/dist/commands/worker/runtime.js

@@ -3,13 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PLAYWRIGHT_MCP_VERSION = exports.DEFAULT_TRANSCRIPT_FLUSH_INTERVAL_MS = exports.DEFAULT_CODEX_LOG_TAIL_CHARS = exports.DEFAULT_WORKER_TOKEN_CAP = exports.DEFAULT_CODEX_TIMEOUT_MS = void 0;
+exports.PLAYWRIGHT_MCP_VERSION = exports.DEFAULT_TRANSCRIPT_FLUSH_INTERVAL_MS = exports.DEFAULT_CODEX_LOG_TAIL_CHARS = exports.DEFAULT_WORKER_TOKEN_CAP = exports.DEFAULT_CREATOR_UPLOAD_RECOVERY_TIMEOUT_MS = exports.DEFAULT_CREATOR_AGENT_TIMEOUT_MS = exports.DEFAULT_CODEX_TIMEOUT_MS = void 0;
 exports.resolveDescendantProcessIds = resolveDescendantProcessIds;
 exports.readPositiveEnvInt = readPositiveEnvInt;
 exports.readEnvBoolean = readEnvBoolean;
 exports.extractAgentTokenUsage = extractAgentTokenUsage;
 exports.extractCodexRolloutTokenUsage = extractCodexRolloutTokenUsage;
 exports.extractCodexThreadId = extractCodexThreadId;
+exports.extractClaudeSessionId = extractClaudeSessionId;
 exports.readCodexRolloutTokenUsageForThread = readCodexRolloutTokenUsageForThread;
 exports.extractCodexTokensUsed = extractCodexTokensUsed;
 exports.assertWorkerTokenUsageWithinCap = assertWorkerTokenUsageWithinCap;
@@ -17,18 +18,24 @@ exports.runLoggedProcess = runLoggedProcess;
 exports.buildCodexExecArgs = buildCodexExecArgs;
 exports.readCodexSandboxMode = readCodexSandboxMode;
 exports.buildClaudeExecArgs = buildClaudeExecArgs;
+exports.resolvePlaywrightMcpCliPath = resolvePlaywrightMcpCliPath;
 exports.buildPlaywrightMcpCommand = buildPlaywrightMcpCommand;
 exports.buildPlaywrightMcpServerConfig = buildPlaywrightMcpServerConfig;
 exports.buildClaudePermissionSettings = buildClaudePermissionSettings;
 exports.buildClaudeDeniedPermissionRules = buildClaudeDeniedPermissionRules;
 exports.buildWorkerChildEnv = buildWorkerChildEnv;
+exports.buildCleanRoomChildEnv = buildCleanRoomChildEnv;
 const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
+const node_module_1 = require("node:module");
 const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const surfaceProfiles_1 = require("../../apps/surfaceProfiles");
 const CHILD_KILL_GRACE_MS = 10000;
 exports.DEFAULT_CODEX_TIMEOUT_MS = 2 * 60 * 60 * 1000;
+exports.DEFAULT_CREATOR_AGENT_TIMEOUT_MS = 60 * 60 * 1000;
+exports.DEFAULT_CREATOR_UPLOAD_RECOVERY_TIMEOUT_MS = 30 * 60 * 1000;
 exports.DEFAULT_WORKER_TOKEN_CAP = 20000000;
 exports.DEFAULT_CODEX_LOG_TAIL_CHARS = 12000;
 exports.DEFAULT_TRANSCRIPT_FLUSH_INTERVAL_MS = 10000;
@@ -296,6 +303,25 @@ function extractCodexThreadId(output) {
     }
     return null;
 }
+function extractClaudeSessionId(output) {
+    for (const line of output.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed.startsWith('{') || !trimmed.endsWith('}')) {
+            continue;
+        }
+        try {
+            const root = coerceRecord(JSON.parse(trimmed));
+            const rawSessionId = root?.session_id ?? root?.sessionId;
+            if (typeof rawSessionId === 'string' && rawSessionId.trim()) {
+                return rawSessionId.trim();
+            }
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
 async function findCodexRolloutFileForThread(threadId, sessionsRoot) {
     const stack = [{ dir: sessionsRoot, depth: 0 }];
     const matches = [];
@@ -531,10 +557,24 @@ async function runLoggedProcess(input) {
 }
 function buildCodexExecArgs(input) {
     const sandboxMode = input.sandboxMode ?? 'danger-full-access';
+    const resumeSessionId = input.resumeSessionId?.trim() ?? '';
+    if (resumeSessionId) {
+        return [
+            'exec',
+            'resume',
+            '--json',
+            '--skip-git-repo-check',
+            '--model',
+            input.model,
+            '-c',
+            `model_reasoning_effort="${input.reasoningEffort}"`,
+            resumeSessionId,
+            '-',
+        ];
+    }
     const args = [
         'exec',
         '--json',
-        '--ephemeral',
         '--sandbox',
         sandboxMode,
         '--cd',
@@ -581,6 +621,7 @@ function buildClaudeExecArgs(input) {
     const permissionSettings = buildClaudePermissionSettings({
         workspaceDir: input.workspaceDir,
         denyReadRoots: input.denyReadRoots ?? [],
+        playdropCliEnabled: input.playdropCliEnabled,
     });
     const permissionMode = input.chrome || input.playwrightMcp ? 'bypassPermissions' : 'acceptEdits';
     // MCP tools are deferred behind ToolSearch in the Claude CLI; without it in the toolset a
@@ -590,7 +631,7 @@ function buildClaudeExecArgs(input) {
         : input.playwrightMcp
             ? [...CLAUDE_BASE_TOOL_NAMES, 'ToolSearch'].join(',')
             : CLAUDE_BASE_TOOL_NAMES.join(',');
-    const allowedPermissionRules = buildClaudeAllowedPermissionRules(input.workspaceDir);
+    const allowedPermissionRules = buildClaudeAllowedPermissionRules(input.workspaceDir, input.playdropCliEnabled);
     const allowedTools = input.chrome
         ? [...allowedPermissionRules, ...CLAUDE_CHROME_TOOL_NAMES]
         : input.playwrightMcp
@@ -609,7 +650,6 @@ function buildClaudeExecArgs(input) {
         'stream-json',
         '--verbose',
         '--include-partial-messages',
-        '--no-session-persistence',
         '--permission-mode',
         permissionMode,
         '--tools',
@@ -635,6 +675,10 @@ function buildClaudeExecArgs(input) {
     if (effort) {
         args.push('--effort', effort);
     }
+    const resumeSessionId = input.resumeSessionId?.trim() ?? '';
+    if (resumeSessionId) {
+        args.push('--resume', resumeSessionId);
+    }
     return args;
 }
 const CLAUDE_BASE_TOOL_NAMES = [
@@ -649,13 +693,32 @@ const CLAUDE_BASE_TOOL_NAMES = [
 // never through @latest drift (see the 2026-07-13 auto-update incident).
 exports.PLAYWRIGHT_MCP_VERSION = '0.0.78';
 const PLAYWRIGHT_MCP_ALLOWED_TOOL_RULE = 'mcp__playwright';
+const requireFromWorkerRuntime = (0, node_module_1.createRequire)(__filename);
+function resolvePlaywrightMcpCliPath() {
+    let packageJsonPath;
+    let packageJson;
+    try {
+        packageJsonPath = requireFromWorkerRuntime.resolve('@playwright/mcp/package.json');
+        packageJson = requireFromWorkerRuntime('@playwright/mcp/package.json');
+    }
+    catch {
+        throw new Error(`worker_preflight_playwright_mcp_missing:@playwright/mcp@${exports.PLAYWRIGHT_MCP_VERSION}`);
+    }
+    if (packageJson.version !== exports.PLAYWRIGHT_MCP_VERSION) {
+        throw new Error(`worker_preflight_playwright_mcp_version:expected=${exports.PLAYWRIGHT_MCP_VERSION}:actual=${packageJson.version ?? 'missing'}`);
+    }
+    const cliPath = node_path_1.default.join(node_path_1.default.dirname(packageJsonPath), 'cli.js');
+    if (!(0, node_fs_1.existsSync)(cliPath)) {
+        throw new Error(`worker_preflight_playwright_mcp_missing:${cliPath}`);
+    }
+    return cliPath;
+}
 function buildPlaywrightMcpCommand(surface) {
     const surfaceArgs = surface ? (0, surfaceProfiles_1.buildPlaywrightMcpSurfaceArgs)(surface) : [];
     return {
-        command: 'npx',
+        command: process.execPath,
         args: [
-            '-y',
-            `@playwright/mcp@${exports.PLAYWRIGHT_MCP_VERSION}`,
+            resolvePlaywrightMcpCliPath(),
             '--browser',
             'chrome',
             '--isolated',
@@ -702,6 +765,7 @@ const CLAUDE_BUILD_PERMISSION_RULES = [
     'Grep',
     'Bash(playdrop *)',
     'Bash(./bin/playdrop *)',
+    'Bash(../bin/playdrop *)',
     'Bash(bin/playdrop *)',
     'Bash(node *)',
     'Bash(npm *)',
@@ -709,6 +773,7 @@ const CLAUDE_BUILD_PERMISSION_RULES = [
     'Bash(cp *)',
     'Bash(mv *)',
     'Bash(file *)',
+    'Bash(curl *)',
     'Bash(sips *)',
     'Bash(ls *)',
     'Bash(pwd)',
@@ -731,7 +796,7 @@ function normalizeClaudePermissionPath(value) {
     }
     return node_path_1.default.resolve(trimmed).replace(/\\/g, '/').replace(/\/+$/, '');
 }
-function buildClaudeAllowedPermissionRules(workspaceDir) {
+function buildClaudeAllowedPermissionRules(workspaceDir, playdropCliEnabled = true) {
     const workspaceRoot = typeof workspaceDir === 'string' && workspaceDir.trim()
         ? normalizeClaudePermissionPath(workspaceDir)
         : null;
@@ -743,14 +808,14 @@ function buildClaudeAllowedPermissionRules(workspaceDir) {
         `Read(${absoluteWorkspacePattern})`,
         `Edit(${absoluteWorkspacePattern})`,
         `Write(${absoluteWorkspacePattern})`,
-        `Bash(${workspaceRoot}/bin/playdrop *)`,
-        ...CLAUDE_BUILD_PERMISSION_RULES,
+        ...(playdropCliEnabled ? [`Bash(${workspaceRoot}/bin/playdrop *)`] : []),
+        ...CLAUDE_BUILD_PERMISSION_RULES.filter((rule) => (playdropCliEnabled || !rule.toLowerCase().includes('playdrop'))),
     ];
 }
 function buildClaudePermissionSettings(input = {}) {
     return {
         permissions: {
-            allow: buildClaudeAllowedPermissionRules(input.workspaceDir),
+            allow: buildClaudeAllowedPermissionRules(input.workspaceDir, input.playdropCliEnabled),
             deny: buildClaudeDeniedPermissionRules(input.denyReadRoots ?? []),
         },
     };
@@ -860,3 +925,48 @@ function buildWorkerChildEnv(input) {
     }
     return child;
 }
+function buildCleanRoomChildEnv(input) {
+    const base = input.baseEnv ?? process.env;
+    const child = {};
+    for (const key of [
+        'HOME',
+        'USER',
+        'SHELL',
+        'TMPDIR',
+        'LANG',
+        'TERM',
+        'ANTHROPIC_API_KEY',
+        'OPENAI_API_KEY',
+        'HTTP_PROXY',
+        'HTTPS_PROXY',
+        'ALL_PROXY',
+        'NO_PROXY',
+    ]) {
+        const value = base[key];
+        if (typeof value === 'string')
+            child[key] = value;
+    }
+    for (const [key, value] of Object.entries(base)) {
+        if (key.startsWith('LC_') && typeof value === 'string')
+            child[key] = value;
+    }
+    if (input.homeDir !== undefined) {
+        const homeDir = input.homeDir.trim();
+        if (!homeDir || !node_path_1.default.isAbsolute(homeDir))
+            throw new Error('invalid_worker_child_home_dir');
+        child.HOME = homeDir;
+    }
+    if (input.codexHomeDir !== undefined) {
+        const codexHomeDir = input.codexHomeDir.trim();
+        if (!codexHomeDir || !node_path_1.default.isAbsolute(codexHomeDir))
+            throw new Error('invalid_worker_child_codex_home_dir');
+        child.CODEX_HOME = codexHomeDir;
+    }
+    const safeHostPath = (base.PATH ?? '').split(node_path_1.default.delimiter).filter((directory) => {
+        if (!directory || !node_path_1.default.isAbsolute(directory))
+            return false;
+        return !(0, node_fs_1.existsSync)(node_path_1.default.join(directory, process.platform === 'win32' ? 'playdrop.exe' : 'playdrop'));
+    });
+    child.PATH = [input.binDir, ...safeHostPath].join(node_path_1.default.delimiter);
+    return child;
+}