@tangle-network/agent-profile-materialize 0.14.2 → 0.15.1

package/dist/index.d.ts

@@ -309,6 +309,16 @@ export interface ApplyWorkspacePlanOptions {
     runtimeOnlyFiles?: readonly string[];
     /** Existing workspace paths are either exact idempotent inputs or forbidden. */
     existingFiles?: "allow-identical" | "reject";
+    /**
+     * `workspacePlanDigest` of a plan a prior call already applied into this
+     * workspace. When it equals this plan's digest, application writes no files:
+     * the workspace holds the running agent's live state, and a file the agent
+     * edited or removed since the prior application stays exactly as the agent
+     * left it. Env, flags, prompt intents, and the receipt are still produced.
+     * A different digest applies normally, so a plan that changed mid-session
+     * still meets the existing-file refusal.
+     */
+    appliedPlanDigest?: string;
 }
 /** Fail when a profile asks for controls the chosen harness cannot execute. */
 export declare function assertWorkspacePlanSupported(plan: Pick<WorkspacePlan, "unsupported">): void;

package/dist/index.js

@@ -1894,6 +1894,28 @@ function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDir, opti
         ...file,
         absPath: resolveWorkspaceFilePath(workspaceRoot, file.relPath),
     }));
+    // A prior application of THIS EXACT plan makes the workspace the running
+    // agent's live state: a file the agent edited or removed since then is the
+    // session's own memory, not a conflict, so a byte comparison against the
+    // plan would refuse a resume the caller proved is unchanged. The digest the
+    // caller passes is its own record of what it already applied here; only the
+    // caller can know that, which is why this is an option and not an inference
+    // from disk. `reject` is not short-circuited: that policy asserts an empty
+    // target and must keep failing on any pre-existing path.
+    if (existingFiles === "allow-identical" &&
+        options.appliedPlanDigest !== undefined &&
+        options.appliedPlanDigest === publicPlanDigest) {
+        return {
+            receipt: safeWorkspacePlanReceipt(publicPlan, files.map((file) => file.relPath), publicPlanDigest),
+            spawn: {
+                env: { ...resolvedPlan.env },
+                flags: [...resolvedPlan.flags],
+                ...promptIntentFields(resolvedPlan, samePromptIntentValue),
+                ...systemPromptBindingField(resolvedPlan),
+            },
+            runtimeOnlyFiles: privateRuntimeFiles,
+        };
+    }
     // A path this package invented can only hold this package's own earlier
     // output, so re-applying into the same workspace replaces it rather than
     // failing the turn. `reject` still refuses: that policy is "nothing may
@@ -1906,7 +1928,7 @@ function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDir, opti
         if (workspaceFileExists(file.absPath) &&
             !mayReplace(file) &&
             (existingFiles === "reject" || !workspaceFileMatches(file))) {
-            throw new Error(`Refusing to replace existing workspace file: ${file.relPath}`);
+            throw new Error(workspaceFileConflictMessage(file, existingFiles, publicPlanDigest));
         }
     }
     // Parent directories remain on failure because they may contain concurrent
@@ -1956,7 +1978,7 @@ function applyResolvedWorkspacePlan(publicPlan, resolvedPlan, workspaceDir, opti
                     continue;
                 }
                 if (isFsError(error, "EEXIST")) {
-                    throw new Error(`Refusing to replace existing workspace file: ${entry.file.relPath}`, { cause: error });
+                    throw new Error(workspaceFileConflictMessage(entry.file, existingFiles, publicPlanDigest), { cause: error });
                 }
                 throw error;
             }
@@ -2033,6 +2055,42 @@ function workspaceFileMatches(file) {
         (stats.mode & 0o777) === file.mode &&
         readFileSync(file.absPath, "utf8") === file.content);
 }
+function sha256Hex(content) {
+    return createHash("sha256").update(content).digest("hex");
+}
+/**
+ * The refusal names what differs — planned versus existing content digest,
+ * mode, or file kind — plus the plan digest, so the operator can tell a
+ * mid-session profile swap from an agent-edited workspace file without
+ * reproducing the workspace. Reads here are best-effort diagnosis inside an
+ * already-failing path; an unreadable existing file is reported, not thrown
+ * over.
+ */
+function workspaceFileConflictMessage(file, existingFiles, planDigest) {
+    const prefix = `Refusing to replace existing workspace file: ${file.relPath}`;
+    if (existingFiles === "reject") {
+        return `${prefix} — the reject policy forbids any pre-existing plan path (plan ${planDigest})`;
+    }
+    const planned = `planned sha256:${sha256Hex(file.content)} mode ${file.mode.toString(8)}`;
+    let existing;
+    try {
+        const stats = lstatSync(file.absPath);
+        if (!stats.isFile()) {
+            existing = stats.isSymbolicLink()
+                ? "existing path is a symlink, not a regular file"
+                : "existing path is not a regular file";
+        }
+        else {
+            const mode = (stats.mode & 0o777).toString(8);
+            existing = `existing sha256:${sha256Hex(readFileSync(file.absPath))} mode ${mode}`;
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        existing = `existing file unreadable: ${message}`;
+    }
+    return `${prefix} — ${planned} != ${existing} (plan ${planDigest})`;
+}
 function prepareWorkspaceFile(workspaceRoot, file) {
     assertNoSymlinkPathComponents(workspaceRoot, file.absPath);
     const temporaryPath = join(dirname(file.absPath), `.agent-profile-${randomUUID()}.tmp`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/agent-profile-materialize",
-  "version": "0.14.2",
+  "version": "0.15.1",
   "description": "Materialize an AgentProfile into the native per-harness workspace files (the one shared materializer for cli-bridge, agent-dev-container, and VB).",
   "type": "module",
   "main": "./dist/index.js",
@@ -20,13 +20,13 @@
     "dist"
   ],
   "devDependencies": {
-    "@tangle-network/agent-interface": "0.52.0",
+    "@tangle-network/agent-interface": "0.53.0",
     "@types/node": "25.6.0",
     "typescript": "^6.0.3",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "@tangle-network/agent-interface": ">=0.47.0 <0.53.0"
+    "@tangle-network/agent-interface": ">=0.47.0 <0.54.0"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",