castle-web-cli 0.4.109 → 0.4.111

package/dist/importBrowse.js

@@ -0,0 +1,240 @@
+// The editor's Import picker, server side: `/__castle/import/*` on the serve.
+// Answers "which decks could this person import" and then does the import.
+//
+// It runs the GraphQL with the CLI's own login (`config.getToken()`), which is
+// what a local serve has. In the cloud the shell will instead ask its castle-www
+// host over postMessage, so the sandbox never holds the token -- that path is
+// deliberately not built yet, and this one is what the local editor uses either
+// way.
+//
+// Nothing here goes through the deck iframe or the kit: the Files panel that
+// opens this picker is a builtin shell panel, and it has to keep working on a
+// `--kit none` deck that ships no editor app at all.
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { nanoid } from "nanoid";
+import * as api from "./api.js";
+import * as config from "./config.js";
+import { runTar } from "./save-deck.js";
+import { readCastleJson } from "./castleJson.js";
+import { ImportError, addImportTo, importedDeckIds, parseDeckRef } from "./imports.js";
+import { errorMessage, readRequestBody, sendJson } from "./httpJson.js";
+export const IMPORT_API_PREFIX = "/__castle/import/";
+// Rows per list, and how many decks we are willing to ask the source question
+// about to fill one. An account can hold hundreds of decks and only some are
+// web decks, so the scan has to look past the first fifty -- but not forever.
+const LIST_LIMIT = 50;
+const SCAN_CAP = 200;
+const SOURCE_CHUNK = 100;
+// Playlists read for the Saved list. Flattened together with bookmarks, so a
+// handful is already more decks than the list shows.
+const PLAYLIST_CAP = 10;
+// The bookmarks feed already covers this playlist; listing both would just
+// duplicate it.
+const BOOKMARKS_PLAYLIST_PREFIX = "bookmarks-";
+// The kits list, hardcoded. A playlist can't hold it: playlist feeds drop
+// unlisted decks, and a kit is published unlisted. Adding a kit means shipping
+// an update to this list.
+const KIT_DECK_IDS = [
+    "ckRZGFW4iPrx", // physics-2d
+];
+// Listing is several server round trips, and the picker is opened, closed and
+// reopened while someone decides. Cached briefly so that costs once.
+const LIST_TTL_MS = 60_000;
+const listCache = new Map();
+function asTab(value) {
+    return value === "saved" || value === "kits" ? value : "mine";
+}
+function toCandidate(row, hasSource) {
+    return {
+        deckId: row.deckId,
+        title: row.title?.trim() ? row.title.trim() : "Untitled",
+        creator: row.creator?.username ?? null,
+        imageUrl: row.initialCard?.backgroundImage?.smallUrl ?? null,
+        parentCreator: row.parentDeck?.creator?.username ?? null,
+        hasSource,
+        imported: false,
+    };
+}
+// Which of these the deck already has. Stamped on the way OUT rather than
+// baked into the cached list: the pins change while the picker is open (an
+// import from here, an `add-import` in the terminal), and re-reading one file
+// is cheaper than throwing the list away.
+function stampImported(deckDir, decks) {
+    const already = importedDeckIds(deckDir);
+    return decks.map((deck) => ({ ...deck, imported: already.has(deck.deckId) }));
+}
+// First occurrence of each deck wins, and the deck being edited never appears:
+// a deck can't import itself, so offering it is offering an error.
+function dedupe(rows, currentDeckId) {
+    const seen = new Set();
+    const out = [];
+    for (const row of rows) {
+        if (!row?.deckId || row.deckId === currentDeckId || seen.has(row.deckId))
+            continue;
+        seen.add(row.deckId);
+        out.push(row);
+    }
+    return out;
+}
+// Keep the decks that have source on the server -- having source IS being
+// importable -- taking them in the order they arrived until the list is full.
+// Asks in chunks so one bad batch doesn't cost the whole scan.
+async function filterImportable(rows) {
+    const decks = [];
+    let scanned = 0;
+    while (scanned < rows.length && scanned < SCAN_CAP && decks.length < LIST_LIMIT) {
+        const chunk = rows.slice(scanned, scanned + SOURCE_CHUNK);
+        scanned += chunk.length;
+        const versions = await api.webDeckSourceVersions(chunk.map((r) => r.deckId));
+        for (const row of chunk) {
+            if (decks.length >= LIST_LIMIT)
+                break;
+            if (versions.has(row.deckId))
+                decks.push(toCandidate(row, true));
+        }
+    }
+    return { signedIn: true, decks, truncated: scanned < rows.length };
+}
+// Bookmarks plus the user's playlists, flattened. Both are "decks I kept", and
+// which of the two something landed in is not a distinction worth a tab.
+async function savedRows() {
+    const userId = config.getUserId();
+    const bookmarks = await api.feedDecks("bookmarks", LIST_LIMIT);
+    if (!userId)
+        return bookmarks;
+    const playlists = (await api.myPlaylists(userId, PLAYLIST_CAP * 2))
+        .filter((p) => !p.playlistId.startsWith(BOOKMARKS_PLAYLIST_PREFIX))
+        .slice(0, PLAYLIST_CAP);
+    const lists = await Promise.all(playlists.map((p) => api.feedDecks(`playlist:${p.playlistId}`, LIST_LIMIT).catch(() => [])));
+    return [bookmarks, ...lists].flat();
+}
+async function tabRows(tab) {
+    if (tab === "saved")
+        return savedRows();
+    if (tab === "kits")
+        return api.deckRows(KIT_DECK_IDS);
+    return api.myDecks();
+}
+const EMPTY_LIST = { signedIn: false, decks: [], truncated: false };
+export async function listImportable(deckDir, tab) {
+    if (!config.getToken())
+        return EMPTY_LIST;
+    const key = `${deckDir}|${tab}`;
+    const cached = listCache.get(key);
+    const value = cached && Date.now() - cached.at < LIST_TTL_MS ? cached.value : null;
+    if (value)
+        return { ...value, decks: stampImported(deckDir, value.decks) };
+    const currentDeckId = readCastleJson(deckDir)?.deckId ?? null;
+    const fresh = await filterImportable(dedupe(await tabRows(tab), currentDeckId));
+    listCache.set(key, { at: Date.now(), value: fresh });
+    return { ...fresh, decks: stampImported(deckDir, fresh.decks) };
+}
+// A deck someone pasted a link (or an id) to. Unlike the lists, this one does
+// NOT hide a deck with no source -- naming a specific deck and getting nothing
+// back says less than naming it and being told it was never saved.
+export async function resolveDeckRef(deckDir, ref) {
+    const deckId = parseDeckRef(ref);
+    if (!deckId) {
+        throw new ImportError("bad-deck-ref", `Not a deck id or a castle deck link: ${ref}`);
+    }
+    if (readCastleJson(deckDir)?.deckId === deckId) {
+        throw new ImportError("self-import", `That is this deck -- a deck can't import itself.`);
+    }
+    const [rows, source] = await Promise.all([
+        api.deckRows([deckId]),
+        api.webDeckSource(deckId).catch(() => null),
+    ]);
+    const row = rows[0];
+    if (!row)
+        throw new ImportError("bad-deck-ref", `No deck ${deckId} on the server.`);
+    return stampImported(deckDir, [toCandidate(row, source !== null)])[0];
+}
+// How many files a deck's source holds. Not on any list query, so it is counted
+// from the archive itself -- which means downloading it, which is why the picker
+// asks only about the one deck someone has selected rather than every row.
+// Keyed by version, so re-selecting a row is free until its deck is saved again.
+const fileCountCache = new Map();
+export async function sourceFileCount(deckId) {
+    if (!api.isDeckIdShaped(deckId))
+        return null;
+    const source = await api.webDeckSource(deckId).catch(() => null);
+    if (!source)
+        return null;
+    const key = `${deckId}@${source.updatedAt}`;
+    const cached = fileCountCache.get(key);
+    if (cached !== undefined)
+        return cached;
+    const tmpFile = path.join(os.tmpdir(), `castle-import-count-${nanoid(8)}.tar.gz`);
+    try {
+        const res = await fetch(source.archiveUrl, { signal: AbortSignal.timeout(30000) });
+        if (!res.ok)
+            return null;
+        fs.writeFileSync(tmpFile, Buffer.from(await res.arrayBuffer()));
+        const listing = await runTar(["-tzf", tmpFile], { capture: true });
+        const count = listing.split("\n").filter((line) => line && !line.endsWith("/")).length;
+        fileCountCache.set(key, count);
+        return count;
+    }
+    catch {
+        return null; // an unreadable archive just means no count to show
+    }
+    finally {
+        try {
+            fs.unlinkSync(tmpFile);
+        }
+        catch {
+            /* nothing to clean */
+        }
+    }
+}
+// An ImportError is the caller's problem (a bad link, this deck, a deck that
+// was never saved), so it comes back as a 400 with its code -- the picker shows
+// a different thing for each. Anything else is ours: a 500 with the message.
+function sendResult(res, work) {
+    void work()
+        .then((body) => sendJson(res, 200, body))
+        .catch((err) => {
+        if (err instanceof ImportError)
+            return sendJson(res, 400, { error: err.message, code: err.code });
+        sendJson(res, 500, { error: errorMessage(err) });
+    });
+}
+export function handleImportApi(deckDir, req, res, reqPath) {
+    const action = reqPath.slice(IMPORT_API_PREFIX.length);
+    const url = new URL(req.url ?? "/", "http://localhost");
+    if (action === "list") {
+        sendResult(res, () => listImportable(deckDir, asTab(url.searchParams.get("tab"))));
+        return true;
+    }
+    if (action === "resolve") {
+        const ref = url.searchParams.get("ref") ?? "";
+        sendResult(res, async () => ({ deck: await resolveDeckRef(deckDir, ref) }));
+        return true;
+    }
+    if (action === "files") {
+        const deckId = url.searchParams.get("deckId") ?? "";
+        sendResult(res, async () => ({ fileCount: await sourceFileCount(deckId) }));
+        return true;
+    }
+    if (action === "add") {
+        sendResult(res, async () => {
+            let body;
+            try {
+                body = JSON.parse(await readRequestBody(req));
+            }
+            catch {
+                throw new ImportError("no-deck-ref", "Invalid JSON body.");
+            }
+            const deckRef = typeof body.deckRef === "string" ? body.deckRef : "";
+            const result = await addImportTo(deckDir, { deckRef });
+            // The lists said which decks were importable; one of them just stopped
+            // being a candidate (or changed version), so the cached answers are stale.
+            listCache.clear();
+            return result;
+        });
+        return true;
+    }
+    return (sendJson(res, 404, { error: `Unknown import action: ${action}` }), true);
+}

package/dist/imports.d.ts

@@ -1,4 +1,10 @@
 export declare const IMPORTS_DIR = "imports";
+export type ImportErrorCode = 'no-deck-ref' | 'bad-deck-ref' | 'no-such-dir' | 'self-import' | 'no-source' | 'bad-alias';
+export declare class ImportError extends Error {
+    code: ImportErrorCode;
+    constructor(code: ImportErrorCode, message: string);
+}
+export declare function parseDeckRef(raw: string): string | null;
 export declare function lockImportTree(dir: string): void;
 export declare function syncImportDependencies(deckDir: string): string[];
 export declare function restoreMissingImports(deckDir: string): Promise<string[]>;
@@ -11,8 +17,22 @@ export interface ImportStatus {
     via?: string;
 }
 export declare function importStatuses(deckDir: string): Promise<ImportStatus[]>;
+export declare function importedDeckIds(deckDir: string): Set<string>;
+export interface AddImportResult {
+    deckId: string;
+    alias: string;
+    replaced: boolean;
+    /** Aliases pulled in because the imported deck depends on them. */
+    transitive: string[];
+    /** `name@range (from alias)` entries merged into the deck's package.json. */
+    dependencies: string[];
+}
+export declare function addImportTo(dir: string, options?: {
+    deckRef?: string;
+    alias?: string;
+}): Promise<AddImportResult>;
 export declare function addImport(dir: string, options?: {
-    deckId?: string;
+    deckRef?: string;
     alias?: string;
 }): Promise<void>;
 export declare function updateImport(dir: string, options?: {

package/dist/imports.js

@@ -25,6 +25,37 @@ import { readCastleJsonOrThrow as readCastleJson, } from './castleJson.js';
 // node_modules gets. That also means `get-deck` leaves an existing `imports/`
 // alone when it refreshes a deck.
 export const IMPORTS_DIR = 'imports';
+export class ImportError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ImportError';
+        this.code = code;
+    }
+}
+// What someone has in hand is a deck id or the URL of the page they were just
+// looking at, so both are accepted here rather than in a separate resolve step.
+// Recognized: a bare id, a deck page (`castle.xyz/d/<id>`), and the cloud editor
+// (`castle.xyz/admin/cloud/<id>`) -- for anything else the last path segment is
+// tried, since every castle deck URL ends in the id.
+export function parseDeckRef(raw) {
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    if (!trimmed.includes('/'))
+        return api.isDeckIdShaped(trimmed) ? trimmed : null;
+    let url;
+    try {
+        url = new URL(trimmed.includes('://') ? trimmed : `https://${trimmed}`);
+    }
+    catch {
+        return null;
+    }
+    const segments = url.pathname.split('/').filter(Boolean);
+    const afterD = segments.indexOf('d');
+    const candidate = afterD >= 0 ? segments[afterD + 1] : segments[segments.length - 1];
+    return candidate && api.isDeckIdShaped(candidate) ? candidate : null;
+}
 // Only the `imports` key is ours; everything else in castle.json (deck identity,
 // editor config) is preserved as-is.
 function writeImportPin(dir, alias, pin) {
@@ -70,6 +101,25 @@ function qualifiedAlias(meta, deckId) {
         return `${user}.${title}`;
     return title || slugifyAlias(deckId) || deckId;
 }
+// A derived alias can already be taken -- two people with a same-named deck, or
+// the same title twice. Reusing it would silently replace a different
+// dependency, so a taken name gets a number. A name already pointing at THIS
+// deck is not a collision: that one is the update case, and keeping it is what
+// makes re-importing a deck update it in place.
+const MAX_ALIAS_ATTEMPTS = 100;
+function availableAlias(deckDir, alias, deckId) {
+    const pins = readCastleJson(deckDir)?.imports ?? {};
+    const taken = (name) => pins[name] !== undefined
+        ? pins[name].deckId !== deckId
+        : fs.existsSync(path.join(deckDir, IMPORTS_DIR, name));
+    if (!taken(alias))
+        return alias;
+    for (let n = 2; n <= MAX_ALIAS_ATTEMPTS; n++) {
+        if (!taken(`${alias}-${n}`))
+            return `${alias}-${n}`;
+    }
+    throw new ImportError('bad-alias', `Too many imports already named "${alias}"; pass --as to name this one.`);
+}
 // Dependencies are made read-only ON DISK, not just refused by the files API.
 // The API guard only covers the editor; an agent or a shell command writes
 // straight to the filesystem, and the common "write a temp file and rename it"
@@ -386,49 +436,71 @@ async function addTransitiveImports(deckDir, viaAlias, seen) {
 }
 // Every deckId this deck already has, so a transitive walk doesn't refetch or
 // loop on a cycle.
-function importedDeckIds(deckDir) {
+export function importedDeckIds(deckDir) {
     const pins = readCastleJson(deckDir)?.imports ?? {};
     return new Set(Object.values(pins).map((p) => p?.deckId).filter((id) => !!id));
 }
-export async function addImport(dir, options = {}) {
+// The import itself. Throws ImportError rather than exiting, because this also
+// runs inside the serve (from the editor's Import panel), where taking the
+// process down is not an option. The CLI wrapper below prints and exits.
+export async function addImportTo(dir, options = {}) {
     const targetDir = path.resolve(dir);
-    const deckId = options.deckId;
+    const ref = options.deckRef?.trim();
+    if (!ref) {
+        throw new ImportError('no-deck-ref', 'No deck given. Pass a deck id or a castle.xyz deck link.');
+    }
+    const deckId = parseDeckRef(ref);
     if (!deckId) {
-        console.error('No deck id. Usage: castle-web add-import <deckId> [dir] [--as ALIAS]');
-        process.exit(1);
+        throw new ImportError('bad-deck-ref', `Not a deck id or a castle deck link: ${ref}`);
     }
     if (!fs.existsSync(targetDir)) {
-        console.error(`No such directory: ${targetDir}`);
-        process.exit(1);
+        throw new ImportError('no-such-dir', `No such directory: ${targetDir}`);
     }
     if (readCastleJson(targetDir)?.deckId === deckId) {
-        console.error(`Deck ${deckId} is this deck -- a deck can't import itself.`);
-        process.exit(1);
+        throw new ImportError('self-import', `Deck ${deckId} is this deck -- a deck can't import itself.`);
     }
     const [source, meta] = await Promise.all([
         api.webDeckSource(deckId),
         api.deckMeta(deckId).catch(() => null),
     ]);
     if (!source) {
-        console.error(`No source archive on the server for deck ${deckId}.`);
-        console.error(`Its owner needs to run \`castle-web save-deck\` before it can be imported.`);
-        process.exit(1);
+        throw new ImportError('no-source', `No source archive on the server for deck ${deckId}. ` +
+            'Its owner needs to run `castle-web save-deck` before it can be imported.');
     }
-    const alias = options.alias ? slugifyGivenAlias(options.alias) : qualifiedAlias(meta, deckId);
-    if (!alias) {
-        console.error(`Could not derive a usable name from --as; pick one with letters or digits.`);
-        process.exit(1);
+    const given = options.alias ? slugifyGivenAlias(options.alias) : '';
+    if (options.alias && !given) {
+        throw new ImportError('bad-alias', 'Could not derive a usable name; pick one with letters or digits.');
     }
+    // An explicit `--as` is the caller's call, collision and all. A derived one
+    // gets a number instead, since nothing asked for that particular name.
+    const alias = given || availableAlias(targetDir, qualifiedAlias(meta, deckId), deckId);
     const { replaced } = await placeImport(targetDir, alias, deckId, source);
-    console.log(`${replaced ? 'Updated' : 'Imported'} ${deckId} at ${IMPORTS_DIR}/${alias} (read-only on disk).`);
-    const seen = importedDeckIds(targetDir);
-    const transitive = await addTransitiveImports(targetDir, alias, seen);
-    for (const t of transitive)
-        console.log(`Also imported ${IMPORTS_DIR}/${t} (needed by ${alias})`);
-    const added = syncImportDependencies(targetDir);
-    for (const dep of added)
+    const transitive = await addTransitiveImports(targetDir, alias, importedDeckIds(targetDir));
+    const dependencies = syncImportDependencies(targetDir);
+    return { deckId, alias, replaced, transitive, dependencies };
+}
+export async function addImport(dir, options = {}) {
+    let result;
+    try {
+        result = await addImportTo(dir, options);
+    }
+    catch (err) {
+        if (!(err instanceof ImportError))
+            throw err;
+        console.error(err.message);
+        if (err.code === 'no-deck-ref') {
+            console.error('Usage: castle-web add-import <deckId|url> [dir] [--as ALIAS]');
+        }
+        process.exit(1);
+    }
+    console.log(`${result.replaced ? 'Updated' : 'Imported'} ${result.deckId} at ` +
+        `${IMPORTS_DIR}/${result.alias} (read-only on disk).`);
+    for (const t of result.transitive) {
+        console.log(`Also imported ${IMPORTS_DIR}/${t} (needed by ${result.alias})`);
+    }
+    for (const dep of result.dependencies)
         console.log(`Added dependency ${dep}`);
-    if (added.length > 0)
+    if (result.dependencies.length > 0)
         console.log('Run `castle-web install` to install them.');
 }
 // `castle-web update-import [alias] [dir]`: re-fetch an import (or all of them)

package/dist/index.js

@@ -6,6 +6,7 @@ import { serve } from './serve.js';
 import { saveDeck } from './save-deck.js';
 import { getDeck } from './get-deck.js';
 import { addImport, updateImport } from './imports.js';
+import { listDecks } from './list-decks.js';
 import { getCliVersion, init } from './init.js';
 import { install } from './install.js';
 import { connectWS, savePreviewImage, savePreviewIfNeeded, takeScreenshot } from './preview.js';
@@ -21,6 +22,7 @@ const FLAGS_WITH_VALUES = new Set([
     '--caption',
     '--visibility',
     '--as',
+    '--kind',
 ]);
 function findPositionalDir() {
     for (let i = 1; i < args.length; i++) {
@@ -82,7 +84,8 @@ function usage() {
   castle-web save-preview-image [dir] [--port PORT] [--no-restart]
   castle-web save-deck [dir] [--title TITLE] [--caption TEXT] [--visibility unlisted|private]
   castle-web get-deck [dir] [--deck-id ID] [--force]   (replaces the source if the deck is already there)
-  castle-web add-import <deckId> [dir] [--as ALIAS]   (adds another deck as a read-only dependency in imports/)
+  castle-web list-decks [dir] [--kind mine|saved|kits]   (decks this one could import; ids are what add-import takes)
+  castle-web add-import <deckId|url> [dir] [--as ALIAS]   (adds another deck as a read-only dependency in imports/)
   castle-web update-import [alias] [dir] [--check] [--revert]   (re-fetches imports; no alias means all)
   castle-web install [dir]
   castle-web login
@@ -146,12 +149,16 @@ async function main() {
             });
             break;
         }
+        case 'list-decks': {
+            await listDecks(findPositionalDir(), { kind: getFlagValue('--kind') });
+            break;
+        }
         case 'add-import': {
-            // The deck id is the first positional; the importing deck's dir is an
-            // optional second, defaulting to the cwd.
+            // The deck -- an id or the link to its page -- is the first positional;
+            // the importing deck's dir is an optional second, defaulting to the cwd.
             const positionals = readPositionals();
             await addImport(positionals[1] ?? '.', {
-                deckId: getFlagValue('--deck-id') ?? positionals[0],
+                deckRef: getFlagValue('--deck-id') ?? positionals[0],
                 alias: getFlagValue('--as'),
             });
             break;

package/dist/list-decks.d.ts

@@ -0,0 +1,3 @@
+export declare function listDecks(dir: string, options?: {
+    kind?: string;
+}): Promise<void>;

package/dist/list-decks.js

@@ -0,0 +1,44 @@
+// `castle-web list-decks` -- what this deck could import, for an agent rather
+// than for the editor's picker. Same answer the picker gets (importBrowse's
+// `/__castle/import/*` backend), printed one deck per line.
+//
+// The agent needs this because `add-import` takes a deck id, and until now
+// nothing told it which ids exist -- so it could only import a deck the user
+// had already named.
+import * as path from 'path';
+import { listImportable } from './importBrowse.js';
+const KINDS = ['mine', 'saved', 'kits'];
+function isKind(value) {
+    return KINDS.includes(value);
+}
+// One deck per line, id first: the id is what `add-import` takes, so it reads
+// straight out of the listing without the agent having to parse a sentence.
+function formatDeck(deck) {
+    const parts = [deck.deckId, deck.title];
+    if (deck.creator)
+        parts.push(`@${deck.creator}`);
+    if (deck.imported)
+        parts.push('(already imported)');
+    return parts.join('  ');
+}
+export async function listDecks(dir, options = {}) {
+    const kind = options.kind ?? 'mine';
+    if (!isKind(kind)) {
+        console.error(`Unknown kind "${kind}". Use one of: ${KINDS.join(', ')}.`);
+        process.exit(1);
+    }
+    const list = await listImportable(path.resolve(dir), kind);
+    if (!list.signedIn) {
+        console.error('Not signed in. Run `castle-web login` first.');
+        process.exit(1);
+    }
+    if (list.decks.length === 0) {
+        console.log(`No ${kind} decks with source files to import.`);
+        return;
+    }
+    for (const deck of list.decks)
+        console.log(formatDeck(deck));
+    if (list.truncated) {
+        console.log(`(first ${list.decks.length}; there are more)`);
+    }
+}

package/dist/metering.d.ts

@@ -43,6 +43,7 @@ export interface CastleBudget {
     limitMicros: number | null;
     resetAtMs: number;
     blocked: boolean;
+    blockedModelPrefixes: string[];
 }
 /**
  * The daily Castle-paid AI budget for the user this sandbox belongs to, or null

package/dist/metering.js

@@ -145,6 +145,9 @@ export async function fetchBudget() {
             limitMicros: typeof body.limitMicros === "number" ? body.limitMicros : null,
             resetAtMs: typeof body.resetAtMs === "number" ? body.resetAtMs : 0,
             blocked: body.blocked,
+            blockedModelPrefixes: Array.isArray(body.blockedModelPrefixes)
+                ? body.blockedModelPrefixes.filter((p) => typeof p === "string")
+                : [],
         };
     }
     catch {

package/dist/save-deck.d.ts

@@ -1,5 +1,7 @@
 export declare const SOURCE_ARCHIVE_EXCLUDES: string[];
-export declare function runTar(args: string[]): Promise<void>;
+export declare function runTar(args: string[], opts?: {
+    capture?: boolean;
+}): Promise<string>;
 export declare function archiveSource(projectDir: string): Promise<Buffer>;
 export type SaveVisibility = 'unlisted' | 'private';
 export interface SaveDeckOptions {

package/dist/save-deck.js

@@ -12,10 +12,14 @@ import { bundleProject } from './bundle.js';
 // part of it. (Being on this list also means `get-deck` leaves an existing
 // `imports/` in place when it refreshes a deck.)
 export const SOURCE_ARCHIVE_EXCLUDES = ['node_modules', 'dist', '.castle', '.git', 'imports'];
-export function runTar(args) {
+// `capture` keeps tar's stdout and resolves with it -- for listing an archive
+// (`-tzf`), where the output IS the answer. Packing and unpacking ignore it.
+export function runTar(args, opts = {}) {
     return new Promise((resolve, reject) => {
-        const child = spawn('tar', args, { stdio: ['ignore', 'ignore', 'pipe'] });
+        const child = spawn('tar', args, { stdio: ['ignore', opts.capture ? 'pipe' : 'ignore', 'pipe'] });
+        let stdout = '';
         let stderr = '';
+        child.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
         child.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
         child.on('error', reject);
         child.on('close', (code) => {
@@ -23,7 +27,7 @@ export function runTar(args) {
                 reject(new Error(`tar exited with code ${code}: ${stderr}`));
                 return;
             }
-            resolve();
+            resolve(stdout);
         });
     });
 }

package/dist/serve.js

@@ -4,7 +4,7 @@ import * as path from 'path';
 import { spawn } from 'child_process';
 import { createServer } from 'vite';
 import { WebSocketServer, WebSocket } from 'ws';
-import { createIdeServer } from './ide.js';
+import { createIdeServer, FAVICON_LINK_TAGS } from './ide.js';
 import { createAgentServer } from './agent.js';
 import { sceneFilesPlugin, importsAliasPlugin } from './vitePlugins.js';
 import { installFilesChangedWatcher } from './filesChanged.js';
@@ -58,7 +58,15 @@ function castlePlugin(wsPort, ideServer, agentServer) {
         transformIndexHtml: {
             order: 'pre',
             handler(html) {
-                return html.replace(/<head(\s[^>]*)?>/i, (match) => `${match}\n    <script>window.CastleEmbed={edit:true,host:'dev'};</script>\n    ${CONSOLE_CAPTURE}`);
+                // Give the deck page Castle's favicon too -- it's a real page when
+                // opened directly (play surface / `?edit=0`), not just the editor's
+                // iframe. Injected here rather than in the kit templates so bare
+                // `--kit none` decks and already-scaffolded decks get it as well; a
+                // deck that declares its own icon keeps it.
+                const favicon = /<link[^>]+rel=["']?[^"'>]*icon/i.test(html)
+                    ? ''
+                    : `\n    ${FAVICON_LINK_TAGS}`;
+                return html.replace(/<head(\s[^>]*)?>/i, (match) => `${match}${favicon}\n    <script>window.CastleEmbed={edit:true,host:'dev'};</script>\n    ${CONSOLE_CAPTURE}`);
             },
         },
         configureServer(server) {